last executing test programs: 15.094501373s ago: executing program 3 (id=4): sched_setscheduler(0x0, 0x1, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x20000810) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb01001800000000000000280000002800000004000000020000000000001103000000ffffffff00000000000000020000000002000000000000080200000000005f"], 0x0, 0x44}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000009c0)={0x14, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, r0, 0x0, 0x1}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600"], 0x48) 15.018419621s ago: executing program 1 (id=2): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x1, 0x9}, 0x0, [0x0, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x404, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x8, 0x1, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x216, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x20, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x2, 0x0, 0x0, 0x16d, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0xfffffffe, 0x400, 0x0, 0x200, 0x0, 0x2, 0x80000000, 0x3, 0x5, 0x10000000, 0x0, 0x548f, 0x0, 0x0, 0x9, 0x10000, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0xb, 0x3bb6, 0x2217, 0x0, 0x0, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x0, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x4, 0x0, 0x9fa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x921, 0x0, 0x0, 0x2, 0x0, 0x6, 0x0, 0x0, 0xbda6, 0x4, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x3, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x0, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x101, 0x80000000, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0x6, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7, 0x4]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x15) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000bc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x13a0, 0x11c0, 0xc8, 0x8, 0x11c0, 0x5803, 0x12d0, 0x2e8, 0x2e8, 0x12d0, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x142, 0x1198, 0x11c0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5df11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f35a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x1, 0x3}}, @common=@unspec=@cgroup1={{0x1030}, {0x4, 0x1, 0x0, 0x0, './cgroup.cpu/syz1\x00', 0x0, {0xfffffffffffffffc}}}]}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x400, 0xa66, 0x2}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x8000000, 'snmp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1400) ioctl$UI_DEV_CREATE(r0, 0x5501) 14.950405688s ago: executing program 1 (id=7): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x7, &(0x7f0000000100)=0x4000200, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x6, 0x300, 0xfc}, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffd8f}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 14.899167743s ago: executing program 3 (id=9): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x309}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f000050a000/0x13000)=nil, 0x13000}, 0x1}) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)=""/182, 0xb6}], 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x18) 14.767417417s ago: executing program 1 (id=12): syz_mount_image$vfat(&(0x7f0000000480), &(0x7f00000004c0)='./file0\x00', 0x4000, &(0x7f0000000500)=ANY=[@ANYBLOB="73686f72746e616d653d77696e6e742c757466383d302c636865636b3d7374726963742c646973636172642c757466383d312c6e66732c73686f72746e616d653d77696e39352c73686f72746e616d653d6c6f7765722c756e695f786c6174653d302c0036b573262ed88dfec7618c03371693a5173bd0bf12d29c0180500a87e3789adea802a90933b243ca225dacfc27597d6e1ce3d9fdc12409748ba4fbde6f1d76e116fd437b79bbcea7fdc682fd0b90334eed137d03ce386950f5e50ff2516eb2b500a9b99e04f2a41864e44cb46101a23835877342485260d4510fa3240a2c9756d388e5861cdeaf4c88bca74fe3ce71eef72c"], 0xfd, 0x2b6, &(0x7f0000000600)="$eJzs3E9rE08YwPGnaZOmKW1y+PEDBfFBL3pZ2vgKgrQgBpTaiHoQpnajIWtSsjESEdubV19H8ehNsL6BXrx5Fy9FELz0IF3pbtYkZaV/NN22+X6g7HRnnszM7iY8u7Czde/N02rZtcqmKYm0SkJkTbZFcruljpHONuGXU9JrTa5O/vh84c79BzcLxeLcgup8YfFaXlWnL354/vLtpY/Nybvvpt+Py2bu4db3/JfN/zfPbe0shp9eb6rRpXq9aZYcW5crbtVSve3YxrW1UnPtRl992amvrLTV1JanMisN23XV1NpatdvarGuz0Vbz2FRqalmWTmVk2IweOqK0vrBgCgMZDOIwEbWz0SiY0cjK0vpxDAoAAJwsg8j/Rw6Q/z+puFpxtbZf/p8Q8v/B8fP/ncikEWdDcvcGoGAyne9vP/J/AAAAAAAAAAAAAAAAAAAAAABOg23Py3qelw234d+4iKRFJPw/7nFiMI5w/kdiHC7+sZ4X99IizutWqVUKtkF9oSwVccSWmaTIT/966AjK8zeKczPqy8mGs9qJ918SHA/jQ7no+NkgXnviV1ulpGR6+89LVv6Ljs/viU+KSKuUkiuXe+ItycqnR1IXR5b967ob/2pW9fqt4p7+J/x2AAAAAACcBZb+luu//w1Wk7QsDZcN2VMf7Ow+H5DsPs8HVDZS0o0fk/Nj8c0bAAAAAIBh4rZfVI3j2I3TWkh2JnLcvR/10KVE5IQcukMXrHRwrCOq0hLu8TxvdbfR33eaEJGYZvrtz1dU+NDqpJyUwxS+PgvGfpDGcfwaAQAAABikbtIf90gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABheB108LGx/lLXHerob7e998hhnCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMTvVwAAAP//G5URgQ==") mkdir(&(0x7f00000008c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000900)='.\x00', &(0x7f0000000940)='./bus\x00', &(0x7f0000000980), 0xc002, 0x0) chdir(&(0x7f00000009c0)='./bus\x00') mount(0x0, &(0x7f0000000100)='./sys\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x1, 0x0) 14.714732752s ago: executing program 1 (id=14): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ptrace(0x4206, r0) ptrace$setsig(0x4203, r0, 0x4, &(0x7f0000000000)={0x29, 0x8, 0x1}) ptrace(0x4208, r0) 14.648462339s ago: executing program 3 (id=17): openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x4, &(0x7f0000000380)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3}, [@call={0x85, 0x0, 0x0, 0x41}]}, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_mount_image$msdos(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x2800080, &(0x7f0000000480)=ANY=[@ANYRES64=0x0, @ANYRESOCT, @ANYRESDEC=0x0, @ANYRES8=0x0], 0x1, 0x2ad, &(0x7f00000005c0)="$eJzs3U9LVF0cB/DjqPjgg+Lq4alNh1q1GdR1CyUUpIGinKCC4IrXGuY2I3NnMSMtbN0maNk7iJbtgugN+C7aSSCuXGXY9d8IQaSOkJ/PZn6c7/k7F85d3s1bb17UV/LyStIOpZmBUJoJobQzECZCKRxYDzffvnr3+sGjx3dmK5W5+zHOzy5OTccYx699fvLyw/Uv7X8ffhz/NBI2Jp5ubk1/3fhv48rm98XntTzW8thotmMSl5rNdrKUpXG5ltfLMd7L0iRPY62Rp62efCVrrq52Y9JYHhtdbaV5HpNGN9bTbmw3Y7vVjcmzpNaI5XI5jo0GTqP6fmd3N2ztFi56N/Sf53+5HbvU/wlhe71T7VSL3yKfX6jMTcafho9GbXc61cHDfKrIY28+HEb38+mT+cGr5UaR72W371ZOjB8Jy+d8dgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC6vcjw0cdS63elUB4u8/Ku8qOYXKnOT+x1686FwdahvxwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAU8m7a/Uky9JWf4qhPq51NsXwb/TZ+yPPZ/WRYy2DfzLPwDltTPG3Fxd9MwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAED/9X7EHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgMsq767VkyxLW2dVfPu/mPhYdNFnBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDT+hEAAP//yRtmJg==") syz_clone(0xa0302000, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r0, 0x0, 0x2100, 0x0, &(0x7f0000000480), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) 14.584323155s ago: executing program 1 (id=18): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x9, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f00000021c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0xe) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000080)={r0, r2, 0x2, 0x0, @void}, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) 14.581274055s ago: executing program 32 (id=18): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x9, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f00000021c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0xe) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000080)={r0, r2, 0x2, 0x0, @void}, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) 14.571630906s ago: executing program 3 (id=22): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x8, 0x0, &(0x7f0000000240)=[@increfs]}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f00000002c0)=[@increfs]}) 14.44034653s ago: executing program 3 (id=25): rt_sigprocmask(0x0, &(0x7f0000000000)={[0xffffffffffffffff]}, 0x0, 0x8) r0 = getpgrp(0x0) r1 = gettid() rt_tgsigqueueinfo(r0, r1, 0xd, &(0x7f00000000c0)={0x9, 0x6, 0x7}) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xfffffffffffffff7]}, 0x8, 0x80000) read$FUSE(r2, &(0x7f0000000180)={0x2020}, 0x2020) 14.401222214s ago: executing program 33 (id=25): rt_sigprocmask(0x0, &(0x7f0000000000)={[0xffffffffffffffff]}, 0x0, 0x8) r0 = getpgrp(0x0) r1 = gettid() rt_tgsigqueueinfo(r0, r1, 0xd, &(0x7f00000000c0)={0x9, 0x6, 0x7}) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xfffffffffffffff7]}, 0x8, 0x80000) read$FUSE(r2, &(0x7f0000000180)={0x2020}, 0x2020) 12.975110779s ago: executing program 6 (id=50): r0 = socket$inet(0x2, 0x2, 0x1) bind$inet(r0, &(0x7f0000000000)={0x2, 0x6e24, @empty}, 0x10) r1 = socket(0x2, 0x2, 0x1) bind$unix(r1, &(0x7f0000000000)=@abs, 0x6e) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/icmp\x00') read$FUSE(r2, &(0x7f0000002200)={0x2020}, 0x2020) 12.920830734s ago: executing program 6 (id=51): sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000140), 0x205, 0x8401) r1 = syz_open_dev$usbmon(&(0x7f0000000180), 0x7, 0x0) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f00000001c0)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000600)={0x2, 0x3, 0x0, 0x0, 0x7995}, 0xfcb5, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) readv(r1, &(0x7f0000000640)=[{&(0x7f0000000dc0)=""/4096, 0x79c5}], 0x1) 12.890296638s ago: executing program 6 (id=52): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/ipv4/conf/lo/forwarding\x00', 0x2, 0x0) r1 = memfd_create(&(0x7f0000000500)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0xffffffffffffffff}) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0xa0000004}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000100)={0x2}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000140)={0xa0000000}) poll(&(0x7f0000000240)=[{r1, 0x2}], 0x1, 0x101) 4.236543659s ago: executing program 0 (id=245): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000006c0)={0x1, &(0x7f0000000700)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r0, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000200)={0x0, 0x0}, 0x6) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080)=r1, 0x4) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) 4.235804769s ago: executing program 0 (id=247): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='fd\x00') fchdir(r0) r1 = open(&(0x7f0000000280)='.\x00', 0x8000, 0x112) r2 = inotify_init() inotify_add_watch(r2, &(0x7f0000000340)='.\x00', 0x600026e) getdents(r1, 0x0, 0x0) 4.2273796s ago: executing program 0 (id=249): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x10, &(0x7f0000000100)={[{@dioread_lock}]}, 0x5, 0x7e5, &(0x7f00000018c0)="$eJzs3ctrW9kZAPDvyvKjTlK7UGjSlaHQGoLlOnWTFrpI6aIUGgi06yZCVkxq2QqWHGJjSEMpdFNoQxeFdpN12qa7btuZ7cy/MLMZhiEhM+OESZjF4OHqEcu25MgZWZqJfz+49jn3oXO++zj3yPdwHcCxNZX+yESciYg/JxETjflJRAzXUtmIi/X1nm1tFtIpie3tX32U1NZ5urVZiJZtYnw8TjQypyPijT9EnM3sL7eyvrGUL5WKq438bHX5xmxlfWPm+nJ+sbhYXDk/Nz9/7sIPL4z2LtZP3t44+egvP//evy9++vtvPfjTm0lcjJONZa1x9MpUTNX3SQynu3CXn/W6sAFLBl0BXkl6aQ7Vr/I4ExPZGOl+2+xRVgwAODK3I2IbADhmEvd/ADhmmn8HeLq1WUin7duD/XtEvz3+aUSM1eNvPt+sL8k2ntmN1Z6Djj9Ndj3vSCJisgflT0XEP/77m3+mUxzRc0iAdn53JyKuTk412/+d9ifZN2ahrvsBGd9vJg4YHDC1J6/9g/75X9r/+dFO/2/n+su86P9Em/7PaJtr91VMxe4RJ/uv/8zDHhTTUdr/+8nwzti2Zy3xN0wONXKnan2+4eTa9VIxbdu+HhHTMTya5ufaf3xteNn0k8+e7JrbEnFr/+/ju7+9n5af/t5ZI/Mwu6fJXchX872IPfX4TsS3s+3iT14c/6RD//dyl2X84sd//HunZWn8abzNaXf8Rz+qbPtexHejffxNyUHjE8/P1k6H2eZJ0cZ/3vvbeKfyW49/OqXl178LnOp9sG2kx3/84Pgnk9bxmpXDl/HWvYn/d1rWOf6m9uf/SPLrWrp5Kd3KV6urcxEjyS/3zz+3s20z31w/jX/6O+2v/4PO//Q74dUu488++vBfL42/OWNf/A1jXRZ2SGn8C4c6/m0T6VfhDovypQfPloY6ld/d8Z9PE0PTjTndtH8da5ovlUZa1nnlHQcAAAAAAAAAAAAAAAAAAAAAAAAAh5CpvaQ0yeRepDOZXC5q/8P7mzGeKZUr1bPXymsrC/WXmU7G8GhE1F51OdHyPtS5xvvwm/lze/I/iIhvRMRfR79Wy+cK5dLCoIMHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIYTHf7/f+qD0frv5wOtIQBwJMZeusaTYl8qAgD0zcvv/xExevT1AAD6p6v7PwDwWnH/B4DjZywz6BoAAP02FpEddB0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4rV2+dCmdtp9vbRbS/MLN9bWl8s2ZhWJlKbe8VsgVyqs3covl8mKpmCuUl1s2fafd55XK5RvzsbJ2a7ZarFRnK+sbV5bLayvVK9eX84vFK8XhvkUGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN2rrG8s5Uul4mojcX88YvecPiWGGhXq5SfPnOx3FP1IbE/U99SXpT49T4ztnfP+zLunD9rq7r7TWOILJwbZKgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8dXweAAD//9GqGUs=") syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x0, 0x3e, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000002c0)='./file0/file1\x00', 0x0, 0x0, 0x1, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000740)='./bus\x00', 0xa82086, 0x0, 0x31, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f00000003c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) unlinkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0x200) 4.146503888s ago: executing program 0 (id=251): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0xc, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 3.948202828s ago: executing program 0 (id=254): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newsa={0x138, 0x1a, 0x1, 0xfffffffe, 0x100, {{@in=@multicast2, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e1e, 0x71c, 0x4e21, 0x5, 0x2, 0x0, 0x20, 0x89}, {@in6=@mcast2, 0x100004d4, 0x6c}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, {0x300, 0xf, 0x6, 0xfffffffffffffbff, 0x8251c, 0xffffffffffff37a6, 0xfffffffffffffffc}, {0xe9, 0x1, 0x1ff, 0xfffffffffffffffe}, {0xfffffffe, 0x3fc}, 0x84, 0x3505, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x844) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./tracing\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r0, &(0x7f0000000300)="70f65f5f73742f6576656e7431202e2f66696c65303a30783020617267323d246278", 0x22) 3.943123109s ago: executing program 36 (id=254): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newsa={0x138, 0x1a, 0x1, 0xfffffffe, 0x100, {{@in=@multicast2, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e1e, 0x71c, 0x4e21, 0x5, 0x2, 0x0, 0x20, 0x89}, {@in6=@mcast2, 0x100004d4, 0x6c}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, {0x300, 0xf, 0x6, 0xfffffffffffffbff, 0x8251c, 0xffffffffffff37a6, 0xfffffffffffffffc}, {0xe9, 0x1, 0x1ff, 0xfffffffffffffffe}, {0xfffffffe, 0x3fc}, 0x84, 0x3505, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x844) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./tracing\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r0, &(0x7f0000000300)="70f65f5f73742f6576656e7431202e2f66696c65303a30783020617267323d246278", 0x22) 3.212559153s ago: executing program 9 (id=274): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000900), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f00009b3000/0x18000)=nil, &(0x7f0000000980)=[@text32={0x20, &(0x7f0000000a40)="0f01df0f3235004000000f30b9fa000000430f79a279a2300d76c4020a1bf7b805000000b90000c0fe0f3cae0a41d941d9000f32ba00e500000f30660fc775023a0fba600c9864660ffc76002f3166b85766baa00066ed00d0", 0x59}], 0x1, 0x15, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000080)={0x1, 0x0, [{0xd, 0x1f22, 0xc, 0x6, 0x5, 0xc0, 0x8}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.04812791s ago: executing program 9 (id=279): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000680)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x1fd2, 0x6007, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x90, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x92, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000004840)={0x24, 0x0, 0x0, &(0x7f0000004880)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) syz_open_dev$hiddev(&(0x7f00000048c0), 0xa, 0x62080) close_range(r0, 0xffffffffffffffff, 0x0) 2.029168114s ago: executing program 4 (id=299): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000100)=[@increfs]}) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x10, 0x0, &(0x7f00000002c0)=[@request_death={0x400c630e, 0x20}]}) 2.000573407s ago: executing program 4 (id=302): r0 = socket(0x200000000000011, 0x2, 0xd) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000a40)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x6, 0xc, &(0x7f0000000b80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000c00)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000d00)={r3, r1, 0x25, 0x2, @val=@netfilter={0x0, 0x3, 0x2018}}, 0x20) syz_emit_ethernet(0x2a, &(0x7f0000000d40)={@multicast, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x4002, 0x5, 0x11, 0x0, @empty, @empty}, {0x4e24, 0x0, 0x8}}}}}, 0x0) 1.892197777s ago: executing program 4 (id=303): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0b000000080000000c0000000000008001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280), &(0x7f00000002c0), 0x5, r0}, 0x38) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x19, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}]}, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000640)={r2}, 0xc) 1.891834137s ago: executing program 4 (id=304): r0 = socket(0x1e, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f00000000c0)=0x3, 0x4) epoll_create1(0x0) r1 = io_uring_setup(0x1515, &(0x7f0000000240)={0x0, 0xeec2, 0x1000, 0x0, 0x115}) close_range(r1, r1, 0x0) pselect6(0x40, &(0x7f0000000300)={0x2, 0x0, 0xfffffffffffffff8, 0xfffffffffffffffd, 0x1, 0x10}, 0x0, &(0x7f0000000340)={0x1f, 0xc, 0x715, 0x8000010000000000, 0x0, 0x97c, 0x800, 0x20000}, 0x0, 0x0) 1.392307308s ago: executing program 7 (id=312): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000040)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000080)=0x1, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0xfffffff9}, 0x1c) connect$inet6(r0, &(0x7f0000000940)={0xa, 0x4e23, 0xfff, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x1c) write(r0, 0x0, 0x0) 1.326857995s ago: executing program 7 (id=313): r0 = syz_io_uring_setup(0xd3a, &(0x7f0000000080)={0x0, 0x2, 0x3010, 0x3, 0x3}, &(0x7f0000000000)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_modify_offsets$generic(r1, r2, 0x2c, 0x8) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000440)={0x2e, 0xa, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000400)=@any_dev={0x3, 0x127, 0x0, 0x0, 0x1000, 0x1d6, 0xffffffffffffffff, 0x0, 0xa}}}, 0x0) r4 = eventfd2(0x1, 0x0) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000200)=r4, 0x1) io_uring_enter(r0, 0x6516, 0x6d93, 0x8, 0x0, 0x0) 1.326064765s ago: executing program 7 (id=314): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080), 0x28000, 0x0) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[], 0x50) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1400000004000000040000000a"], 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000100)={r1, &(0x7f0000000140), 0x0}, 0x20) ioctl$RTC_UIE_OFF(r0, 0x40187013) 1.317962576s ago: executing program 7 (id=315): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) pipe(0x0) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x2010040, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./dev/ram0\x00', 0x2, 0x0) fadvise64(r0, 0x10001, 0x3, 0x1) read$FUSE(r0, &(0x7f0000002f80)={0x2020}, 0xfffffed9) 1.307230097s ago: executing program 9 (id=317): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r2, 0x4068aea3, 0x0) ioctl$KVM_SET_XSAVE(r3, 0x5000aea5, 0x0) 1.175061641s ago: executing program 9 (id=319): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_mount_image$ext4(&(0x7f0000001600)='ext4\x00', &(0x7f0000001640)='./file1\x00', 0x0, &(0x7f0000001680), 0x1, 0x50f, &(0x7f00000016c0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") openat(0xffffffffffffff9c, &(0x7f00000025c0)='./file2\x00', 0x101242, 0x220) r0 = openat(0xffffffffffffff9c, &(0x7f0000001c00)='./file2\x00', 0xa0c42, 0x100) r1 = openat(0xffffffffffffff9c, &(0x7f0000001c40)='./file1\x00', 0x101042, 0x15) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000001c80)={0xc, r1, 0x4, 0x0, 0x9, 0xfffffffffe000001}) 1.174098501s ago: executing program 7 (id=320): r0 = syz_ublk_setup_io_uring(0x204b, &(0x7f00000001c0)={0x0, 0x61b6, 0x802, 0x0, 0x1}, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0, &(0x7f00000000c0)) openat(0xffffffffffffffff, 0x0, 0x82500, 0x100) syz_io_uring_complete(r1, r2) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$eventfd(r3, &(0x7f0000000340), 0x8) 1.028252906s ago: executing program 4 (id=321): syz_mount_image$ext4(&(0x7f0000000440)='ext4\x00', &(0x7f0000000480)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x840e, &(0x7f0000000580), 0x3, 0x42f, &(0x7f00000005c0)="$eJzs289rHFUcAPDvzCat/WViqT+aVo1WMfgjadJae/CiKHhQEPRQjzFJS+y2kSaCLUGjSD1Kwbt4FPwLPOlF1JPgVe9SKJJLq6eV2Z1Jdje7aZJustX9fGCS92be8t53Z97ue/N2AuhZw9mfJGJ/RPweEQO1bGOB4dq/W8uLU38vL04lUam89VdSLXdzeXGqKFq8bl+R6YtIP0viSIt65y9fOT9ZLs9cyvNjCxfeH5u/fOW52QuT52bOzVycOH365InxF05NPN+ROLO4bg59NHf08GvvXHtj6sy1d3/+Ninib4qjQ4bXO/hkpdLh6rrrQF066etiQ9iUUq2bRn+1/w9EKVZP3kC8+mlXGwdsq0qlUnmg/eGlCvA/lkS3WwB0R/FFn81/i22Hhh53hRsv1SZAWdy38q12pC/SvEx/0/y2k4Yj4szSP19lW2zPfQgAgAbfZ+OfZ1uN/9Kovy90b76GMhgR90XEwYg4FRGHIuL+iGrZByPioU3W37xIsnb8k17fUmAblI3/XszXthrHf8XoLwZLee5ANf7+5OxseeZ4/p6MRP/uLD++Th0/vPLbF+2O1Y//si2rvxgL5u243re78TXTkwuTdxJzvRufRAz1tYo/WVkJSCLicEQMbbGO2ae/Odru2O3jX0cH1pkqX0c8VTv/S9EUfyFZf31y7J4ozxwfK66KtX759eqb7eq/o/g7IDv/e1te/yvxDyb167Xzm6/j6h+ft53TbPX635W83bDvw8mFhUvjEbuS12uNrt8/0VRuYrV8Fv/Isdb9/2CsvhNHIiK7iB+OiEci4tG87Y9FxOMRcWyd+H96+Yn3th7/9srin97U+V9N7IrmPa0TpfM/ftdQ6eBm4s/O/8lqaiTfs5HPv420a2tXMwAAAPz3pBGxP5J0dCWdpqOjtd/wH4q9aXlufuGZs3MfXJyuPSMwGP1pcadroO5+6Hg+rS/yE035E/l94y9Le6r50am58nS3g4cet69N/8/8Wep264Bt53kt6F36P/Qu/R96l/4PvatF/9/TjXYAO6/V9//HXWgHsPOa+r9lP+gh5v/Qu/R/6F36P/Sk+T1x+4fkJSTWJCK9K5ohsU2Jbn8yAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMa/AQAA//9QOObV") r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x4040) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, &(0x7f00000001c0)={[{@quota}, {@noload}, {@init_itable}]}, 0x1, 0x4ec, &(0x7f0000000a40)="$eJzs3c9vG1kdAPDvTH44zWY3WVhpAQFbloWCqnUSdzeqeioXEKoqISpOHNo0caModhzlRyGhh/R/QKISJ/gTOCBxQOqJOze4IaRyQCpQgRokDkYzHqf5YbfR5ofb+PORpp43rzPf76s7702eFb8A+tbFiNiOiOGIuBMR48XxpNjiemvL/t7zZw/mdp49mEui2bz1zySvz47FnnMybxXXHImIH34v4m5yOO7a5tbSbK1WXS3Kk+v1lcm1za2/LtZnF6oL1eVKZWZ6ZurqlU8rJ9bWD+q/efrdxRs/+v3vvvLkj9vf/lmW1lhRt7cdJ6nV9KHdOJnBiLhxGsF6YKBoz3CvE+EzSSPicxHxYXb/N3udDQBwFprN8WiO7y0DAOddms+BJWm5mAsYizQtl1tzeO/FaFprrK1fvtfYWJ5vzZVNxFB6b7FWnSrmCidiKMnK0/n+i3LlQPlKRLwbET8vXcjL5blGbb6XDz4A0MfeOjD+/6fUGv8BgHNupNcJAABnzvgPAP3H+A8A/cf4DwD9x/gPAP3H+A8A/cf4DwB95Qc3b2Zbc6f4/uv5+5sbS437H89X15bK9Y258lxjdaW80Ggs5N/ZU3/V9WqNxsr0J0Vhe3Jtc+t2vbGxvH47/17v29WhU28RAPAq737w+M9JNlRfu5BvsWctB2M1nG9prxMAembgeKf75ADeYIO9TgDoGT/jAx2W6N2n/aA/drCi1PUUXQu85i590fw/9Cvz/9C/jjn/D7zBzP9D/2o2E2v+A0CfMccP/ez9/M+jfv6/z3BEPDqNnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODNMJZvSVou1gIfizQtlyPejoiJGEruLdaqUxHxTkT8qTRUysrTvU4aADim9O9Jsf7XpfGPxg7WDif/LUWx1NdPfnnrFz+dXV9fnc6O/2v3+Pqj4njlpYGKpQZLuwdKJ94WAKCT9jjdHsfbnj97MNfezjKfp99pLS6axd0ptlbNYAzmryP5g8Pov5Oi3JI9rwycQPzthxHxhU7tT/K5kYli5dOD8bPYb59p/HRf/DSva71m/xafP4FcoN88zvqf653uvzQu5q+d7/+RvIc6vnb/t3Oo/0t3+7+BLv3fxaPG+OQP3+9a9zDiS4Od4ie78ZMu8T86Yvy/fPmrH3ara/4q4lIU8ZPYF39vrMn1+srk2ubWx4v12YXqQnW5UpmZnpm6euXTymQ+Rz3Znqk+7B/XLr/zsvaPRuf2j3Rv/0h27BtHbP+v/3fnx197Sfxvfb3z+/9e9/j5mPjNI8afHf1tx+W72/HnO7e/OKf7+3/50NUudIzx5G9b80dMFQA4A2ubW0uztVp19Xzt3C0e+F6XfPbtDPUgsYhsZ7jnbbeT7WT/A07iOu+fYqq97pmA0/bipu91JgAAAAAAAAAAAAAAQDdn8QtPvW4jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA59f/AwAA//+ew88F") r1 = openat(0xffffffffffffff9c, &(0x7f0000001040)='./file1\x00', 0x42, 0x5) fallocate(r1, 0x8, 0x4000, 0x4000) 1.027894896s ago: executing program 9 (id=322): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000000)={{r0, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000480)='%-5lx \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x18, &(0x7f0000000640)=@framed={{}, [@printk={@lld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffffffd}, {0x85, 0x0, 0x0, 0x71}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x54}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0x10, 0x10, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000000080)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) 959.002172ms ago: executing program 8 (id=323): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r1 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$DM_DEV_CREATE(r1, 0xc138fd03, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x84200, 0x0, 0x0, {0x0, {'syz', 0x0, '2\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f00000005c0)={0x4, 0x0, 0x0, 0x180, 0x138, 0x1, 0x0, 0xaa01, 0x0, 0x0, @by_dev={r2}, [@linear={0x0, 0x800, 0x0, 0x48, 'linear\x00', {@ram_num={'1:', 0x0}, 0x20, '1024'}}]}) ioctl$DM_DEV_WAIT(r1, 0xc138fd08, &(0x7f00000008c0)={0x4, 0x0, 0x0, 0x168, 0x138, 0x0, 0x0, 0x29021, 0x12f, 0x0, @by_dev={r2}, "304c80965ff2e6bbd3873c94b58a5391c10b4102aedacbf26fbca9c02c63f05237d01a8e3b61e2b3bf"}) 893.630649ms ago: executing program 4 (id=324): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000002f40), 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./bus\x00', 0x1c1002, 0x12) write(r1, &(0x7f0000000200)="c7", 0x1) sendfile(r1, r0, 0x0, 0x3ffff) sendfile(r1, r0, 0x0, 0x7ffff000) 871.876492ms ago: executing program 8 (id=325): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x800, 0x0) close(0x4) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) 870.883852ms ago: executing program 9 (id=326): r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000640)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x20, 0x0, 0xffffff75, 0x10}}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pread64(r1, 0x0, 0x0, 0x4000) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000700)={0x1, &(0x7f0000003f80)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 699.107779ms ago: executing program 8 (id=327): syz_open_dev$evdev(&(0x7f0000000140), 0x2, 0x8000) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x6000000d}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000c40)={0x2000000a}) epoll_wait(r1, &(0x7f0000000080)=[{}], 0x1, 0x0) 607.315639ms ago: executing program 8 (id=328): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$selinux_policy(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x1ef) truncate(&(0x7f00000002c0)='./file0/file1\x00', 0xe2) write$selinux_load(r0, &(0x7f0000000000)=ANY=[], 0x190ec) 566.417723ms ago: executing program 8 (id=332): mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x800, 0x0) r0 = open$dir(&(0x7f0000000140)='./file0\x00', 0x1, 0x27) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_cpus\x00', 0x275a, 0x0) ftruncate(r1, 0x2000009) sendfile(r0, r1, 0x0, 0x0) 495.24196ms ago: executing program 8 (id=333): r0 = socket$packet(0x11, 0x2, 0x300) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xb, 0xff, 0x24932, 0x7f, 0x1, 0x1}, 0x50) socket$nl_route(0x10, 0x3, 0x0) openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000340)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$uac1(0x2, 0xa4, &(0x7f0000001200)=ANY=[@ANYBLOB="2a01000020000040b70800ec00000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9ffff582ffa03ff092403f3", @ANYRES8=r1, @ANYRES64=r0], 0x0) 493.88864ms ago: executing program 2 (id=334): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0) 453.102604ms ago: executing program 2 (id=335): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="1809000000ffffff00000000000000008510000002000000850000000f0000009500000000000000"], 0x0, 0xfffffdff, 0x0, 0x0, 0x727c45cd4283345, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) 429.901787ms ago: executing program 2 (id=336): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r1 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$DM_DEV_CREATE(r1, 0xc138fd03, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x84200, 0x0, 0x0, {0x0, {'syz', 0x0, '2\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f00000005c0)={0x4, 0x0, 0x0, 0x180, 0x138, 0x1, 0x0, 0xaa01, 0x0, 0x0, @by_dev={r2}, [@linear={0x0, 0x800, 0x0, 0x48, 'linear\x00', {@ram_num={'1:', 0x0}, 0x20, '1024'}}]}) ioctl$DM_DEV_WAIT(r1, 0xc138fd08, &(0x7f00000008c0)={0x4, 0x0, 0x0, 0x168, 0x138, 0x0, 0x0, 0x29021, 0x12f, 0x0, @by_dev={r2}, "304c80965ff2e6bbd3873c94b58a5391c10b4102aedacbf26fbca9c02c63f05237d01a8e3b61e2b3bf"}) 408.887569ms ago: executing program 2 (id=337): r0 = syz_io_uring_setup(0x141c, &(0x7f0000000240)={0x0, 0x2af2, 0x1, 0x1, 0x139}, &(0x7f00000002c0)=0x0, &(0x7f0000000300)=0x0, &(0x7f0000000340)) syz_io_uring_modify_offsets$generic(r1, r2, 0x2c, 0x10000) r3 = eventfd2(0x7, 0x83ab5da5d4c29ce) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000380)=r3, 0x1) io_uring_enter(r0, 0x4119, 0x869e, 0xc, 0x0, 0x0) io_uring_enter(r0, 0x7f9d, 0xf427, 0x8, 0x0, 0x0) 360.588664ms ago: executing program 7 (id=338): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x20008044}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/thread-self/fail-nth\x00', 0x2, 0x101) write(r0, &(0x7f0000000000)='3', 0x4e) syz_open_dev$usbmon(&(0x7f0000000100), 0x2, 0x80c00) 76.564963ms ago: executing program 2 (id=339): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setuid(0xee01) sendmmsg$unix(r0, &(0x7f00000254c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x408a0}}, {{&(0x7f0000001580)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x40042}}], 0x2, 0x40) 0s ago: executing program 2 (id=340): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x4d, {0x0, "48b800800000000000000f23c80f21f8350c0020000f23f86d3266b864000f00d03500010000b8050002000f006080000f01b00f30"}}, @nested_vmlaunch={0x12f, 0x18}], 0x95}) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000480)=[@text64={0x40, 0x0}], 0x1, 0x15, 0x0, 0x0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 7.727107][ T110] udevd (110) used greatest stack depth: 22528 bytes left [ 15.032047][ T28] kauditd_printk_skb: 48 callbacks suppressed [ 15.032060][ T28] audit: type=1400 audit(1793634073.438:59): avc: denied { transition } for pid=225 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.036288][ T28] audit: type=1400 audit(1793634073.438:60): avc: denied { noatsecure } for pid=225 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.039046][ T28] audit: type=1400 audit(1793634073.438:61): avc: denied { write } for pid=225 comm="sh" path="pipe:[14296]" dev="pipefs" ino=14296 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 15.042631][ T28] audit: type=1400 audit(1793634073.438:62): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.045406][ T28] audit: type=1400 audit(1793634073.438:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.236' (ED25519) to the list of known hosts. [ 21.891037][ T28] audit: type=1400 audit(1793634080.298:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.892175][ T279] cgroup: Unknown subsys name 'net' [ 21.913715][ T28] audit: type=1400 audit(1793634080.298:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.941344][ T28] audit: type=1400 audit(1793634080.328:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.941485][ T279] cgroup: Unknown subsys name 'devices' [ 22.086754][ T279] cgroup: Unknown subsys name 'hugetlb' [ 22.092441][ T279] cgroup: Unknown subsys name 'rlimit' [ 22.195134][ T28] audit: type=1400 audit(1793634080.608:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.212679][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.218324][ T28] audit: type=1400 audit(1793634080.608:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.249664][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.251598][ T28] audit: type=1400 audit(1793634080.608:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.283350][ T28] audit: type=1400 audit(1793634080.638:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.309422][ T28] audit: type=1400 audit(1793634080.638:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.335134][ T28] audit: type=1400 audit(1793634080.638:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.360743][ T28] audit: type=1400 audit(1793634080.638:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.053050][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.060143][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.067765][ T287] device bridge_slave_0 entered promiscuous mode [ 23.089096][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.096202][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.103520][ T287] device bridge_slave_1 entered promiscuous mode [ 23.137519][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.144566][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.152002][ T289] device bridge_slave_0 entered promiscuous mode [ 23.161576][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.168713][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.176167][ T289] device bridge_slave_1 entered promiscuous mode [ 23.222788][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.229863][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.237238][ T290] device bridge_slave_0 entered promiscuous mode [ 23.247163][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.254190][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.261489][ T290] device bridge_slave_1 entered promiscuous mode [ 23.289509][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.296613][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.303924][ T288] device bridge_slave_0 entered promiscuous mode [ 23.314451][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.321554][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.328973][ T288] device bridge_slave_1 entered promiscuous mode [ 23.385495][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.392554][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.400027][ T291] device bridge_slave_0 entered promiscuous mode [ 23.408446][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.415531][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.422975][ T291] device bridge_slave_1 entered promiscuous mode [ 23.531427][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.538501][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.559482][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.566595][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.573887][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.580932][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.612634][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.619733][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.627036][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.634055][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.653797][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.660870][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.668149][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.675172][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.699383][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.706855][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.714168][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.721599][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.728836][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.736136][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.743307][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.752064][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.759629][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.780056][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.787535][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.796338][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.804449][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.811484][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.819216][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.827562][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.834752][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.855322][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.863283][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.871520][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.878642][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.886353][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.894479][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.901526][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.909064][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.917257][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.924370][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.934087][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.944018][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.969595][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.977930][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.985005][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.992548][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.001189][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.009196][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.017310][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.024332][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.031824][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.040514][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.048811][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.055846][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.075470][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.083217][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.091404][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.098442][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.106688][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.114902][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.121973][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.143765][ T287] device veth0_vlan entered promiscuous mode [ 24.150176][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.158036][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.166266][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.174146][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.182413][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.190537][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.198700][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.206720][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.214685][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.222845][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.231208][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.239595][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.247669][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.255617][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.263585][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.271625][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.279649][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.287827][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.295306][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.319650][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.328172][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.336786][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.346218][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.354453][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.362918][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.371252][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.379080][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.387174][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.394603][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.407172][ T289] device veth0_vlan entered promiscuous mode [ 24.415200][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.423084][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.431135][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.438713][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.452150][ T287] device veth1_macvtap entered promiscuous mode [ 24.459322][ T288] device veth0_vlan entered promiscuous mode [ 24.469463][ T290] device veth0_vlan entered promiscuous mode [ 24.475958][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.484568][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.492957][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.501315][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.509066][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.517051][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.525172][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.532595][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.549035][ T291] device veth0_vlan entered promiscuous mode [ 24.555773][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.563787][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.572313][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.580902][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.589405][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.597881][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.605427][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.618383][ T289] device veth1_macvtap entered promiscuous mode [ 24.629530][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.638114][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.646420][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.654503][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.663020][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.671415][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.681714][ T290] device veth1_macvtap entered promiscuous mode [ 24.690737][ T288] device veth1_macvtap entered promiscuous mode [ 24.701790][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.709609][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.718115][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.726658][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.734829][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.755118][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.763305][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.771975][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.772151][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 24.780725][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.796584][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.805565][ T291] device veth1_macvtap entered promiscuous mode [ 24.815188][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.823551][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.849397][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.858567][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.867592][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.876355][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.884728][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.893321][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.938093][ T315] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.170710][ T342] loop1: detected capacity change from 0 to 128 [ 25.197597][ T342] incfs: ino conflict with backing FS 1 [ 25.211223][ T288] FAT-fs (loop1): error, invalid access to FAT (entry 0xffff0000) [ 25.219970][ T288] FAT-fs (loop1): Filesystem has been set read-only [ 25.226849][ T288] FAT-fs (loop1): error, corrupted directory (invalid entries) [ 25.228521][ T346] input: syz0 as /devices/virtual/input/input5 [ 25.237931][ T288] FAT-fs (loop1): error, corrupted directory (invalid entries) [ 25.289284][ T350] loop3: detected capacity change from 0 to 512 [ 25.334974][ T312] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 25.383452][ T358] process 'syz.0.23' launched './file0' with NULL argv: empty string added [ 25.448428][ T287] syz-executor (287) used greatest stack depth: 21664 bytes left [ 25.478557][ T362] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.485687][ T362] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.493152][ T362] device bridge_slave_0 entered promiscuous mode [ 25.500555][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.508918][ T362] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.518628][ T362] device bridge_slave_1 entered promiscuous mode [ 25.534993][ T312] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.565579][ T312] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 25.635917][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.643068][ T362] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.645357][ T312] usb 5-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 25.650385][ T362] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.666387][ T362] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.675025][ T312] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.693816][ T312] usb 5-1: config 0 descriptor?? [ 25.731261][ T375] loop0: detected capacity change from 0 to 128 [ 25.749163][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.752125][ T375] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a802c018, mo2=0002] [ 25.764545][ T375] System zones: 1-3, 19-19, 35-36 [ 25.765669][ T308] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.775762][ T375] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 25.785219][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.785841][ T375] ext4 filesystem being mounted at /6/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 25.829272][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.832463][ T375] futex_wake_op: syz.0.29 tries to shift op by 144; fix this program [ 25.837918][ T308] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.852523][ T308] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.856232][ T375] futex_wake_op: syz.0.29 tries to shift op by 144; fix this program [ 25.860363][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.876493][ T308] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.883536][ T308] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.892050][ T375] EXT4-fs warning (device loop0): ext4_group_extend:1894: will only finish group (8193 blocks, 8129 new) [ 25.918027][ T375] EXT4-fs warning (device loop0): ext4_group_extend:1899: can't read last block, resize aborted [ 25.929419][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.938023][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.950569][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.960018][ T290] EXT4-fs (loop0): unmounting filesystem. [ 25.978117][ T385] WARNING! power/level is deprecated; use power/control instead [ 25.989130][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.000359][ T387] loop0: detected capacity change from 0 to 1024 [ 26.002698][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.016067][ T387] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 26.026707][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.042817][ T387] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 26.042925][ T362] device veth0_vlan entered promiscuous mode [ 26.071638][ T377] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.079029][ T377] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.098457][ T377] device bridge_slave_0 entered promiscuous mode [ 26.110909][ T290] EXT4-fs (loop0): unmounting filesystem. [ 26.120314][ T312] hid-steam 0003:28DE:1142.0001: item fetching failed at offset 4/5 [ 26.128682][ T377] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.136065][ T312] hid-steam 0003:28DE:1142.0001: steam_probe:parse of hid interface failed [ 26.136346][ T377] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.144683][ T312] hid-steam: probe of 0003:28DE:1142.0001 failed with error -22 [ 26.152502][ T377] device bridge_slave_1 entered promiscuous mode [ 26.174434][ T402] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 26.183334][ T402] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 26.211298][ T402] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 26.222489][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.238519][ T43] device bridge_slave_1 left promiscuous mode [ 26.244631][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.253950][ T43] device bridge_slave_0 left promiscuous mode [ 26.257190][ T405] loop0: detected capacity change from 0 to 512 [ 26.260224][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.267320][ T405] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 26.286913][ T405] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 26.296964][ T43] device veth1_macvtap left promiscuous mode [ 26.298148][ T405] EXT4-fs (loop0): 1 truncate cleaned up [ 26.303026][ T43] device veth0_vlan left promiscuous mode [ 26.309563][ T405] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 26.353768][ T312] usb 5-1: USB disconnect, device number 2 [ 26.383514][ T290] EXT4-fs (loop0): unmounting filesystem. [ 26.441973][ T362] device veth1_macvtap entered promiscuous mode [ 26.466226][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.474453][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.486429][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.494646][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.531220][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.539009][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.567952][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 26.576994][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.585368][ T308] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.592401][ T308] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.600367][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 26.609822][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.618146][ T308] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.625184][ T308] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.632847][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 26.643485][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.654814][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.672130][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.681021][ T426] loop5: detected capacity change from 0 to 4096 [ 26.684634][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.696648][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.704132][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.706418][ T426] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 26.712013][ T24] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.728546][ T377] device veth0_vlan entered promiscuous mode [ 26.739867][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.750379][ T377] device veth1_macvtap entered promiscuous mode [ 26.757994][ T362] EXT4-fs (loop5): unmounting filesystem. [ 26.764841][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.773272][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.784095][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.792943][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.878731][ T436] loop4: detected capacity change from 0 to 512 [ 26.897171][ T436] EXT4-fs error (device loop4): ext4_orphan_get:1405: inode #15: comm syz.4.48: iget: bad i_size value: 38620345925642 [ 26.909931][ T436] EXT4-fs error (device loop4): ext4_orphan_get:1410: comm syz.4.48: couldn't read orphan inode 15 (err -117) [ 26.921970][ T436] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 26.935816][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 26.945466][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.960504][ T28] kauditd_printk_skb: 119 callbacks suppressed [ 26.960517][ T28] audit: type=1400 audit(1793634085.368:193): avc: denied { create } for pid=439 comm="syz.6.50" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 26.997586][ T436] Invalid argument reading file caps for ./file0 [ 27.017562][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.044732][ T24] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 27.056746][ T28] audit: type=1400 audit(1793634085.398:194): avc: denied { bind } for pid=439 comm="syz.6.50" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 27.076515][ T308] EXT4-fs error (device loop4): ext4_validate_block_bitmap:429: comm kworker/u4:3: bg 0: block 5: invalid block bitmap [ 27.091320][ T308] EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28 [ 27.103868][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.116576][ T308] EXT4-fs (loop4): This should not happen!! Data will be lost [ 27.116576][ T308] [ 27.131096][ T24] usb 1-1: config 0 descriptor?? [ 27.139540][ T449] loop6: detected capacity change from 0 to 1024 [ 27.146068][ T28] audit: type=1400 audit(1793634085.398:195): avc: denied { name_bind } for pid=439 comm="syz.6.50" src=28196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 27.149781][ T308] EXT4-fs (loop4): Total free blocks count 0 [ 27.174555][ T449] EXT4-fs: Ignoring removed orlov option [ 27.187053][ T28] audit: type=1400 audit(1793634085.398:196): avc: denied { node_bind } for pid=439 comm="syz.6.50" src=28196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 27.208617][ T28] audit: type=1400 audit(1793634085.408:197): avc: denied { setattr } for pid=435 comm="syz.4.48" name="file0" dev="loop4" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 27.216375][ T308] EXT4-fs (loop4): Free/Dirty block details [ 27.230808][ T28] audit: type=1400 audit(1793634085.408:198): avc: denied { execute } for pid=435 comm="syz.4.48" name="file0" dev="loop4" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 27.254948][ T308] EXT4-fs (loop4): free_blocks=0 [ 27.263273][ T28] audit: type=1400 audit(1793634085.408:199): avc: denied { execute_no_trans } for pid=435 comm="syz.4.48" path="/2/file0/file0" dev="loop4" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 27.272179][ T308] EXT4-fs (loop4): dirty_blocks=1 [ 27.300554][ T308] EXT4-fs (loop4): Block reservation details [ 27.306817][ T308] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 27.307654][ T449] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 27.313067][ T28] audit: type=1400 audit(1793634085.428:200): avc: denied { append } for pid=443 comm="syz.6.51" name="001" dev="devtmpfs" ino=182 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 27.321797][ T291] EXT4-fs (loop4): unmounting filesystem. [ 27.360239][ T28] audit: type=1400 audit(1793634085.438:201): avc: denied { read } for pid=443 comm="syz.6.51" name="usbmon7" dev="devtmpfs" ino=180 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 27.384114][ T28] audit: type=1400 audit(1793634085.438:202): avc: denied { open } for pid=443 comm="syz.6.51" path="/dev/usbmon7" dev="devtmpfs" ino=180 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 27.410426][ T431] loop5: detected capacity change from 0 to 131072 [ 27.426668][ T431] F2FS-fs (loop5): Invalid segment/section count (458783, 24 x 150994945) [ 27.436458][ T431] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 27.455084][ T431] F2FS-fs (loop5): invalid crc value [ 27.464279][ T449] loop6: detected capacity change from 1024 to 64 [ 27.489288][ T431] F2FS-fs (loop5): Found nat_bits in checkpoint [ 27.547829][ T377] EXT4-fs warning (device loop6): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 27.574284][ T24] savu 0003:1E7D:2D5A.0002: hiddev96,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.0-1/input0 [ 27.574756][ T459] ======================================================= [ 27.574756][ T459] WARNING: The mand mount option has been deprecated and [ 27.574756][ T459] and is ignored by this kernel. Remove the mand [ 27.574756][ T459] option from the mount to silence this warning. [ 27.574756][ T459] ======================================================= [ 27.592290][ T377] EXT4-fs warning (device loop6): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 27.623464][ T467] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 27.644008][ T43] device bridge_slave_1 left promiscuous mode [ 27.653896][ T377] EXT4-fs warning (device loop6): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 27.656764][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.667687][ T467] ext4 filesystem being mounted at /4/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 27.675941][ T377] EXT4-fs warning (device loop6): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 27.697698][ T431] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 27.698439][ T377] EXT4-fs warning (device loop6): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 27.704722][ T431] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e4 [ 27.718378][ T377] EXT4-fs warning (device loop6): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 27.733006][ T43] device bridge_slave_0 left promiscuous mode [ 27.738989][ T377] EXT4-fs warning (device loop6): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 27.746369][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.765815][ T459] F2FS-fs (loop2): invalid crc value [ 27.766186][ T377] EXT4-fs warning (device loop6): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 27.766307][ T377] EXT4-fs warning (device loop6): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 27.766405][ T377] EXT4-fs warning (device loop6): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 27.798699][ T43] device veth1_macvtap left promiscuous mode [ 27.798753][ T43] device veth0_vlan left promiscuous mode [ 27.826220][ T459] F2FS-fs (loop2): Found nat_bits in checkpoint [ 27.887690][ T459] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 27.897024][ T19] usb 1-1: USB disconnect, device number 2 [ 27.933384][ T289] syz-executor: attempt to access beyond end of device [ 27.933384][ T289] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 27.947945][ T291] EXT4-fs (loop4): unmounting filesystem. [ 27.994703][ T477] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 28.035718][ T477] EXT4-fs (loop4): 1 truncate cleaned up [ 28.041379][ T477] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 28.077464][ T377] EXT4-fs (loop6): unmounting filesystem. [ 28.093830][ T456] kmmpd-loop6: attempt to access beyond end of device [ 28.093830][ T456] loop6: rw=14337, sector=128, nr_sectors = 2 limit=64 [ 28.116465][ T456] Buffer I/O error on dev loop6, logical block 64, lost sync page write [ 28.158008][ T291] EXT4-fs (loop4): unmounting filesystem. [ 28.212651][ T491] capability: warning: `syz.5.67' uses 32-bit capabilities (legacy support in use) [ 28.344842][ T504] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.352527][ T504] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.360105][ T504] device bridge_slave_0 entered promiscuous mode [ 28.369186][ T504] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.376701][ T504] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.384136][ T504] device bridge_slave_1 entered promiscuous mode [ 28.412573][ T514] EXT4-fs: Ignoring removed bh option [ 28.437980][ T517] tipc: Started in network mode [ 28.443235][ T517] tipc: Node identity ac14140f, cluster identity 4711 [ 28.448259][ T514] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 28.453815][ T517] tipc: New replicast peer: 255.255.255.255 [ 28.464601][ T517] tipc: Enabled bearer , priority 10 [ 28.471500][ T514] EXT4-fs error (device loop5): ext4_find_dest_de:2115: inode #12: block 7: comm syz.5.75: bad entry in directory: rec_len is too small for name_len - offset=16, inode=14, rec_len=40, size=56 fake=0 [ 28.492986][ T514] EXT4-fs (loop5): Remounting filesystem read-only [ 28.503880][ T514] EXT4-fs error (device loop5): ext4_find_dest_de:2115: inode #12: block 7: comm syz.5.75: bad entry in directory: rec_len is too small for name_len - offset=16, inode=14, rec_len=40, size=56 fake=0 [ 28.510243][ T504] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.536091][ T504] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.539674][ T514] EXT4-fs (loop5): Remounting filesystem read-only [ 28.543382][ T504] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.556878][ T504] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.564579][ T362] EXT4-fs error (device loop5): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /9/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 28.590451][ T390] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.598429][ T362] EXT4-fs (loop5): Remounting filesystem read-only [ 28.605391][ T390] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.614790][ T362] EXT4-fs error (device loop5): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /9/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 28.649291][ T362] EXT4-fs (loop5): Remounting filesystem read-only [ 28.662851][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.663646][ T362] EXT4-fs error (device loop5): empty_inline_dir:1903: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 28.675202][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.692515][ T362] EXT4-fs (loop5): Remounting filesystem read-only [ 28.704748][ T362] EXT4-fs warning (device loop5): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 28.720028][ T362] EXT4-fs error (device loop5): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /9/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 28.751271][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 28.751345][ T362] EXT4-fs (loop5): Remounting filesystem read-only [ 28.759908][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.772589][ T362] EXT4-fs error (device loop5): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /9/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 28.774395][ T308] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.802754][ T308] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.811182][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 28.817355][ T362] EXT4-fs (loop5): Remounting filesystem read-only [ 28.819691][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.833806][ T362] EXT4-fs error (device loop5): empty_inline_dir:1903: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 28.833976][ T308] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.853799][ T362] EXT4-fs (loop5): Remounting filesystem read-only [ 28.860495][ T308] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.860737][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 28.867222][ T362] EXT4-fs warning (device loop5): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 28.874659][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.882728][ T362] EXT4-fs error (device loop5): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /9/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 28.926016][ T362] EXT4-fs (loop5): Remounting filesystem read-only [ 28.932577][ T362] EXT4-fs error (device loop5): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /9/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 28.955925][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 28.964208][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.965102][ T362] EXT4-fs warning (device loop5): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 28.972488][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 28.987605][ T362] EXT4-fs warning (device loop5): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 28.997000][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.020160][ T532] EXT4-fs (loop4): Test dummy encryption mode enabled [ 29.021389][ T504] device veth0_vlan entered promiscuous mode [ 29.033055][ T532] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 29.034481][ T362] EXT4-fs warning (device loop5): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 29.044290][ T532] EXT4-fs (loop4): 1 truncate cleaned up [ 29.059346][ T362] EXT4-fs warning (device loop5): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 29.063217][ T532] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 29.079208][ T362] EXT4-fs warning (device loop5): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 29.100008][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 29.108809][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.117352][ T362] EXT4-fs warning (device loop5): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 29.132359][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.140212][ T532] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 29.141635][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.155886][ T362] EXT4-fs warning (device loop5): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 29.166438][ T504] device veth1_macvtap entered promiscuous mode [ 29.178813][ T532] EXT4-fs (loop4): Online resizing not supported with sparse_super2 [ 29.180856][ T362] EXT4-fs warning (device loop5): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 29.202093][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 29.211133][ T291] EXT4-fs (loop4): unmounting filesystem. [ 29.248517][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.270313][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 29.306802][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 29.315704][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.324315][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 29.332649][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.343419][ T43] device bridge_slave_1 left promiscuous mode [ 29.349592][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.360549][ T43] device bridge_slave_0 left promiscuous mode [ 29.367270][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.375685][ T43] device veth1_macvtap left promiscuous mode [ 29.381823][ T43] device veth0_vlan left promiscuous mode [ 29.575832][ T19] tipc: Node number set to 2886997007 [ 29.656378][ T567] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 29.665452][ T567] ext4 filesystem being mounted at /0/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 29.697627][ T567] fs-verity: sha512 using implementation "sha512-avx2" [ 29.736736][ T504] EXT4-fs (loop7): unmounting filesystem. [ 29.742797][ T562] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.750161][ T562] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.763037][ T562] device bridge_slave_0 entered promiscuous mode [ 29.770750][ T562] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.778277][ T576] syz.0.101: attempt to access beyond end of device [ 29.778277][ T576] loop0: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 29.779175][ T562] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.799274][ T562] device bridge_slave_1 entered promiscuous mode [ 29.806845][ T576] Buffer I/O error on dev loop0, logical block 128, lost async page write [ 29.883658][ T562] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.890754][ T562] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.898061][ T562] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.905095][ T562] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.925003][ T595] FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 29.948334][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.958498][ T390] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.974619][ T390] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.999829][ T595] FAT-fs (loop0): error, clusters badly computed (2 != 1) [ 30.008812][ T595] FAT-fs (loop0): Filesystem has been set read-only [ 30.018202][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.031069][ T290] FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 30.031209][ T390] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.047178][ T390] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.056787][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.066394][ T390] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.073432][ T390] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.085119][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.099699][ T602] 9pnet: p9_errstr2errno: server reported unknown error õ€ÿ0xffffffffffffffff [ 30.109768][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.116367][ T19] usb 8-1: new full-speed USB device number 2 using dummy_hcd [ 30.126098][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.141260][ T562] device veth0_vlan entered promiscuous mode [ 30.149793][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.165698][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.180359][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.217491][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.240574][ T562] device veth1_macvtap entered promiscuous mode [ 30.257968][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.282467][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.287319][ T619] set_capacity_and_notify: 9 callbacks suppressed [ 30.287333][ T619] loop0: detected capacity change from 0 to 8192 [ 30.306002][ T619] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 30.328745][ T19] usb 8-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 30.343372][ T19] usb 8-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.346833][ T630] ip_tables: iptables: counters copy to user failed while replacing table [ 30.353735][ T19] usb 8-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 30.375139][ T19] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.388550][ T19] hub 8-1:4.0: USB hub found [ 30.585385][ T43] device bridge_slave_1 left promiscuous mode [ 30.591686][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.592691][ T19] hub 8-1:4.0: 2 ports detected [ 30.603733][ T19] usb 8-1: selecting invalid altsetting 1 [ 30.603898][ T43] device bridge_slave_0 left promiscuous mode [ 30.609493][ T19] hub 8-1:4.0: Using single TT (err -22) [ 30.621610][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.629576][ T43] device veth1_macvtap left promiscuous mode [ 30.635753][ T43] device veth0_vlan left promiscuous mode [ 30.657102][ T646] loop0: detected capacity change from 0 to 256 [ 30.670442][ T646] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 30.723664][ T646] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779264) [ 30.731650][ T646] FAT-fs (loop0): Filesystem has been set read-only [ 30.738436][ T646] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 30.746436][ T646] FAT-fs (loop0): error, corrupted file size (i_pos 196, 16779008) [ 30.800047][ T19] hub 8-1:4.0: hub_hub_status failed (err = -71) [ 30.806569][ T19] hub 8-1:4.0: config failed, can't get hub status (err -71) [ 30.836329][ T19] usb 8-1: USB disconnect, device number 2 [ 30.885070][ T648] using random self ethernet address [ 30.890417][ T648] using random host ethernet address [ 30.908389][ T650] Illegal XDP return value 4294967294 on prog (id 17) dev N/A, expect packet loss! [ 30.946396][ T652] SELinux: failed to load policy [ 31.232537][ T666] loop4: detected capacity change from 0 to 256 [ 31.254999][ T40] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 31.308140][ T674] loop8: detected capacity change from 0 to 512 [ 31.340102][ T674] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 31.350630][ T674] ext4 filesystem being mounted at /3/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.366451][ T682] x86/PAT: syz.2.144:682 freeing invalid memtype [mem 0xfe408000-0xfe408fff] [ 31.402835][ T562] EXT4-fs (loop8): unmounting filesystem. [ 31.410500][ T681] x86/PAT: syz.2.144:681 freeing invalid memtype [mem 0xfe000000-0xfe407fff] [ 31.446351][ T40] usb 1-1: unable to get BOS descriptor or descriptor too short [ 31.453779][ T692] mmap: syz.2.148 (692): VmData 29134848 exceed data ulimit 2. Update limits or use boot option ignore_rlimit_data. [ 31.457990][ T40] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 4 [ 31.479405][ T690] overlayfs: upper fs does not support tmpfile. [ 31.507750][ T40] usb 1-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice= 0.40 [ 31.511009][ T696] loop2: detected capacity change from 0 to 128 [ 31.525531][ T40] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.544348][ T40] usb 1-1: Product: syz [ 31.553830][ T40] usb 1-1: Manufacturer: syz [ 31.562261][ T696] FAT-fs (loop2): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 31.563807][ T40] usb 1-1: SerialNumber: syz [ 31.605994][ T390] FAT-fs (loop2): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 31.677805][ T562] ------------[ cut here ]------------ [ 31.683544][ T562] WARNING: CPU: 0 PID: 562 at fs/overlayfs/util.c:489 ovl_dir_modified+0x189/0x1c0 [ 31.692955][ T562] Modules linked in: [ 31.697010][ T562] CPU: 0 PID: 562 Comm: syz-executor Not tainted syzkaller #0 [ 31.704484][ T562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 31.714578][ T562] RIP: 0010:ovl_dir_modified+0x189/0x1c0 [ 31.720257][ T562] Code: 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 be 78 a3 ff 49 ff 06 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 67 dc 5d ff <0f> 0b e9 17 ff ff ff e8 5b dc 5d ff 0f 0b e9 51 ff ff ff 44 89 e1 [ 31.739899][ T562] RSP: 0018:ffffc900009f7b60 EFLAGS: 00010293 [ 31.746082][ T562] RAX: ffffffff821395b9 RBX: 1ffff11022e4779e RCX: ffff88811ecf5100 [ 31.754086][ T562] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 31.762108][ T562] RBP: ffffc900009f7b90 R08: ffff888133729a5f R09: 1ffff110266e534b [ 31.770125][ T562] R10: dffffc0000000000 R11: ffffed10266e534c R12: ffff88811723bcc0 [ 31.778134][ T562] R13: 0000000000000000 R14: ffff8881337299b8 R15: ffff88811723bcf0 [ 31.786135][ T562] FS: 0000555566781500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 31.795100][ T562] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.798438][ T40] snd-usb-audio: probe of 1-1:1.2 failed with error -2 [ 31.801691][ T562] CR2: 00007ffda78b8e90 CR3: 0000000128647000 CR4: 00000000003506b0 [ 31.816583][ T562] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 31.817589][ T40] usb 1-1: USB disconnect, device number 3 [ 31.824568][ T562] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 31.824593][ T562] Call Trace: [ 31.824598][ T562] [ 31.844793][ T562] ovl_do_remove+0x6d3/0xa60 [ 31.849600][ T562] ? ovl_set_redirect+0x6b0/0x6b0 [ 31.854642][ T562] ? selinux_inode_rmdir+0x22/0x30 [ 31.859793][ T562] ovl_rmdir+0x1a/0x20 [ 31.863872][ T562] vfs_rmdir+0x381/0x4f0 [ 31.868173][ T562] incfs_kill_sb+0xfe/0x210 [ 31.872685][ T562] deactivate_locked_super+0xb5/0x120 [ 31.878085][ T562] deactivate_super+0xaf/0xe0 [ 31.882779][ T562] cleanup_mnt+0x45e/0x4e0 [ 31.887225][ T562] __cleanup_mnt+0x19/0x20 [ 31.891644][ T562] task_work_run+0x1e1/0x250 [ 31.896270][ T562] ? __cfi_task_work_run+0x10/0x10 [ 31.901386][ T562] ? __x64_sys_umount+0x12d/0x170 [ 31.906435][ T562] ? __cfi___x64_sys_umount+0x10/0x10 [ 31.911816][ T562] exit_to_user_mode_loop+0x9b/0xb0 [ 31.917073][ T562] exit_to_user_mode_prepare+0x87/0xd0 [ 31.922536][ T562] syscall_exit_to_user_mode+0x1a/0x30 [ 31.928080][ T562] do_syscall_64+0x58/0xa0 [ 31.932501][ T562] ? clear_bhb_loop+0x30/0x80 [ 31.937204][ T562] ? clear_bhb_loop+0x30/0x80 [ 31.941892][ T562] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 31.947809][ T562] RIP: 0033:0x7f3207fa0d57 [ 31.952239][ T562] Code: a2 c7 05 9c a9 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 31.972232][ T562] RSP: 002b:00007ffda78b94e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 31.980701][ T562] RAX: 0000000000000000 RBX: 00007f3208036f3b RCX: 00007f3207fa0d57 [ 31.988698][ T562] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffda78b95a0 [ 31.996727][ T562] RBP: 00007ffda78b95a0 R08: 00007ffda78ba5a0 R09: 00000000ffffffff [ 32.004703][ T562] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffda78ba630 [ 32.012704][ T562] R13: 00007f3208036f3b R14: 0000000000007ba3 R15: 00007ffda78ba670 [ 32.020694][ T562] [ 32.023708][ T562] ---[ end trace 0000000000000000 ]--- [ 32.030337][ T562] ------------[ cut here ]------------ [ 32.035844][ T562] WARNING: CPU: 0 PID: 562 at fs/overlayfs/util.c:489 ovl_dir_modified+0x189/0x1c0 [ 32.045220][ T562] Modules linked in: [ 32.049123][ T562] CPU: 0 PID: 562 Comm: syz-executor Tainted: G W syzkaller #0 [ 32.058161][ T562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 32.068322][ T562] RIP: 0010:ovl_dir_modified+0x189/0x1c0 [ 32.073976][ T562] Code: 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 be 78 a3 ff 49 ff 06 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 67 dc 5d ff <0f> 0b e9 17 ff ff ff e8 5b dc 5d ff 0f 0b e9 51 ff ff ff 44 89 e1 [ 32.076048][ T707] loop2: detected capacity change from 0 to 1024 [ 32.093896][ T562] RSP: 0018:ffffc900009f7b60 EFLAGS: 00010293 [ 32.105856][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.2/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 32.106382][ T562] RAX: ffffffff821395b9 RBX: 1ffff11022e4779e RCX: ffff88811ecf5100 [ 32.129932][ T562] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 32.137931][ T562] RBP: ffffc900009f7b90 R08: ffff888133729a5f R09: 1ffff110266e534b [ 32.145932][ T562] R10: dffffc0000000000 R11: ffffed10266e534c R12: ffff88811723bcc0 [ 32.153914][ T562] R13: 0000000000000000 R14: ffff8881337299b8 R15: ffff88811723bcf0 [ 32.161968][ T562] FS: 0000555566781500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 32.170937][ T562] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.177540][ T562] CR2: 00007ffda78b8e90 CR3: 0000000128647000 CR4: 00000000003506b0 [ 32.185561][ T562] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.193526][ T562] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.201535][ T562] Call Trace: [ 32.204814][ T562] [ 32.207773][ T562] ovl_do_remove+0x6d3/0xa60 [ 32.212367][ T562] ? ovl_set_redirect+0x6b0/0x6b0 [ 32.217433][ T562] ? selinux_inode_rmdir+0x22/0x30 [ 32.222546][ T562] ovl_rmdir+0x1a/0x20 [ 32.226649][ T562] vfs_rmdir+0x381/0x4f0 [ 32.230936][ T562] incfs_kill_sb+0x18f/0x210 [ 32.234458][ T707] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 32.235561][ T562] deactivate_locked_super+0xb5/0x120 [ 32.235586][ T562] deactivate_super+0xaf/0xe0 [ 32.235605][ T562] cleanup_mnt+0x45e/0x4e0 [ 32.261408][ T562] __cleanup_mnt+0x19/0x20 [ 32.265857][ T562] task_work_run+0x1e1/0x250 [ 32.266058][ T707] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 32.270441][ T562] ? __cfi_task_work_run+0x10/0x10 [ 32.270465][ T562] ? __x64_sys_umount+0x12d/0x170 [ 32.289293][ T562] ? __cfi___x64_sys_umount+0x10/0x10 [ 32.294847][ T562] exit_to_user_mode_loop+0x9b/0xb0 [ 32.300106][ T562] exit_to_user_mode_prepare+0x87/0xd0 [ 32.304489][ T707] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 32.305743][ T562] syscall_exit_to_user_mode+0x1a/0x30 [ 32.314097][ T707] System zones: [ 32.319120][ T562] do_syscall_64+0x58/0xa0 [ 32.319141][ T562] ? clear_bhb_loop+0x30/0x80 [ 32.319158][ T562] ? clear_bhb_loop+0x30/0x80 [ 32.319176][ T562] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.319193][ T562] RIP: 0033:0x7f3207fa0d57 [ 32.323056][ T707] 0-1 [ 32.327162][ T562] Code: a2 c7 05 9c a9 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 32.327177][ T562] RSP: 002b:00007ffda78b94e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 32.327194][ T562] RAX: 0000000000000000 RBX: 00007f3208036f3b RCX: 00007f3207fa0d57 [ 32.327204][ T562] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffda78b95a0 [ 32.341502][ T707] , 3-36 [ 32.342463][ T562] RBP: 00007ffda78b95a0 R08: 00007ffda78ba5a0 R09: 00000000ffffffff [ 32.347147][ T707] [ 32.349498][ T562] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffda78ba630 [ 32.371157][ T707] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 32.378643][ T562] R13: 00007f3208036f3b R14: 0000000000007ba3 R15: 00007ffda78ba670 [ 32.396934][ T707] fscrypt (loop2, inode 18): Direct key flag not allowed with different contents and filenames modes [ 32.397744][ T562] [ 32.435598][ T716] loop7: detected capacity change from 0 to 16 [ 32.444339][ T562] ---[ end trace 0000000000000000 ]--- [ 32.457886][ T716] erofs: (device loop7): mounted with root inode @ nid 36. [ 32.460517][ T28] kauditd_printk_skb: 130 callbacks suppressed [ 32.460529][ T28] audit: type=1326 audit(1793634091.829:333): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=711 comm="syz.0.157" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbcd799fb19 code=0x0 [ 32.481877][ T47] erofs: (device loop7): z_erofs_lz4_decompress_mem: failed to decompress 4876 in[4096, 0] out[9000] [ 32.498804][ T28] audit: type=1400 audit(1793634091.879:334): avc: denied { getopt } for pid=714 comm="syz.7.159" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 32.509054][ T289] EXT4-fs (loop2): unmounting filesystem. [ 32.620660][ T28] audit: type=1400 audit(1793634092.019:335): avc: denied { map } for pid=735 comm="syz.7.166" path="socket:[18629]" dev="sockfs" ino=18629 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 32.676629][ T28] audit: type=1400 audit(1793634092.069:336): avc: denied { append } for pid=742 comm="syz.2.168" name="kvm" dev="devtmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 32.750826][ T746] FAULT_INJECTION: forcing a failure. [ 32.750826][ T746] name failslab, interval 1, probability 0, space 0, times 1 [ 32.774289][ T746] CPU: 0 PID: 746 Comm: syz.8.169 Tainted: G W syzkaller #0 [ 32.783011][ T746] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 32.793079][ T746] Call Trace: [ 32.796374][ T746] [ 32.799318][ T746] __dump_stack+0x21/0x24 [ 32.803691][ T746] dump_stack_lvl+0x110/0x170 [ 32.808375][ T746] ? __cfi_dump_stack_lvl+0x8/0x8 [ 32.813406][ T746] dump_stack+0x15/0x24 [ 32.817567][ T746] should_fail_ex+0x3bf/0x510 [ 32.822254][ T746] __should_failslab+0xac/0xf0 [ 32.827035][ T746] should_failslab+0x9/0x20 [ 32.831556][ T746] __kmem_cache_alloc_node+0x3d/0x2d0 [ 32.836939][ T746] ? io_alloc_page_table+0x70/0xe4 [ 32.842061][ T746] ? kasan_save_alloc_info+0x1f/0x30 [ 32.847356][ T746] ? io_alloc_page_table+0x70/0xe4 [ 32.852476][ T746] __kmalloc+0xa4/0x1e0 [ 32.854566][ T748] loop4: detected capacity change from 0 to 1024 [ 32.856632][ T746] ? __cfi_io_rsrc_file_put+0x10/0x10 [ 32.856660][ T746] io_alloc_page_table+0x70/0xe4 [ 32.856681][ T746] ? __cfi_io_rsrc_file_put+0x10/0x10 [ 32.865055][ T748] EXT4-fs: Ignoring removed mblk_io_submit option [ 32.868350][ T746] io_rsrc_data_alloc+0x92/0x303 [ 32.873389][ T748] EXT4-fs: Ignoring removed orlov option [ 32.878637][ T746] io_sqe_files_register+0x402/0x8a0 [ 32.878668][ T746] ? __cfi_io_sqe_files_register+0x10/0x10 [ 32.878690][ T746] ? __kasan_check_read+0x11/0x20 [ 32.878708][ T746] __se_sys_io_uring_register+0x55d/0xcf0 [ 32.878734][ T746] ? __x64_sys_io_uring_register+0xb0/0xb0 [ 32.878755][ T746] ? fpregs_restore_userregs+0x128/0x260 [ 32.878772][ T746] __x64_sys_io_uring_register+0x9b/0xb0 [ 32.878792][ T746] x64_sys_call+0x5f4/0x9a0 [ 32.878811][ T746] do_syscall_64+0x4c/0xa0 [ 32.878826][ T746] ? clear_bhb_loop+0x30/0x80 [ 32.878843][ T746] ? clear_bhb_loop+0x30/0x80 [ 32.952574][ T746] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.958459][ T746] RIP: 0033:0x7f3207f9fb19 [ 32.962855][ T746] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.982443][ T746] RSP: 002b:00007f3208e47028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 32.990840][ T746] RAX: ffffffffffffffda RBX: 00007f3208225fa0 RCX: 00007f3207f9fb19 [ 32.998795][ T746] RDX: 0000200000000240 RSI: 0000000000000002 RDI: 0000000000000003 [ 33.006747][ T746] RBP: 00007f3208037af8 R08: 0000000000000000 R09: 0000000000000000 [ 33.014698][ T746] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000000 [ 33.022649][ T746] R13: 00007f3208226038 R14: 00007f3208225fa0 R15: 00007ffda78ba278 [ 33.030610][ T746] [ 33.069399][ T748] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 33.083817][ T28] audit: type=1400 audit(1793634092.489:337): avc: denied { read write } for pid=755 comm="syz.8.172" name="vhost-vsock" dev="devtmpfs" ino=268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 33.107831][ T28] audit: type=1400 audit(1793634092.499:338): avc: denied { open } for pid=755 comm="syz.8.172" path="/dev/vhost-vsock" dev="devtmpfs" ino=268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 33.132387][ T28] audit: type=1400 audit(1793634092.499:339): avc: denied { watch watch_reads } for pid=747 comm="syz.4.170" path="/33/file0/file0" dev="loop4" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 33.156461][ T28] audit: type=1400 audit(1793634092.499:340): avc: denied { create } for pid=747 comm="syz.4.170" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 33.176752][ T28] audit: type=1400 audit(1793634092.499:341): avc: denied { ioctl } for pid=755 comm="syz.8.172" path="/dev/vhost-vsock" dev="devtmpfs" ino=268 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 33.202327][ T28] audit: type=1400 audit(1793634092.539:342): avc: denied { create } for pid=758 comm="syz.7.173" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 33.231177][ T291] EXT4-fs (loop4): unmounting filesystem. [ 33.266877][ T770] netlink: 8 bytes leftover after parsing attributes in process `syz.0.178'. [ 33.298518][ T770] Zero length message leads to an empty skb [ 33.370931][ T772] loop2: detected capacity change from 0 to 8192 [ 33.456575][ T784] loop8: detected capacity change from 0 to 256 [ 33.493259][ T784] exFAT-fs (loop8): failed to load upcase table (idx : 0x00010321, chksum : 0x3a8a43f6, utbl_chksum : 0xe619d30d) [ 33.509353][ T766] F2FS-fs (loop7): heap/no_heap options were deprecated [ 33.522989][ T766] F2FS-fs (loop7): invalid crc value [ 33.529522][ T766] F2FS-fs (loop7): Found nat_bits in checkpoint [ 33.576991][ T766] F2FS-fs (loop7): Start checkpoint disabled! [ 33.583516][ T766] F2FS-fs (loop7): f2fs_disable_checkpoint() finish, err:0 [ 33.591210][ T766] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e6 [ 33.626991][ T766] F2FS-fs (loop7): ino:10, start:0, end:8192, need to trigger GC to reclaim enough free segment when checkpoint is enabled [ 33.699314][ T752] kworker/u4:7: attempt to access beyond end of device [ 33.699314][ T752] loop7: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 33.943536][ T768] F2FS-fs (loop4): Zoned block device path is missing [ 33.959304][ T768] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 33.975771][ T815] netlink: 'syz.2.196': attribute type 12 has an invalid length. [ 33.992273][ T768] F2FS-fs (loop4): invalid crc value [ 34.022783][ T768] F2FS-fs (loop4): Found nat_bits in checkpoint [ 34.100824][ T768] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 34.107966][ T768] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 34.164589][ T829] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 34.211956][ T829] EXT4-fs (loop2): 1 truncate cleaned up [ 34.227147][ T829] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 34.275330][ T289] EXT4-fs (loop2): unmounting filesystem. [ 34.657001][ T868] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 34.925721][ T896] capability: warning: `syz.4.227' uses deprecated v2 capabilities in a way that may be insecure [ 35.040002][ T838] F2FS-fs (loop0): invalid crc value [ 35.060556][ T838] F2FS-fs (loop0): Found nat_bits in checkpoint [ 35.098003][ T838] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 35.163433][ T914] F2FS-fs (loop7): invalid crc value [ 35.169617][ T914] F2FS-fs (loop7): Found nat_bits in checkpoint [ 35.213750][ T914] F2FS-fs (loop7): Start checkpoint disabled! [ 35.221562][ T914] F2FS-fs (loop7): f2fs_disable_checkpoint() finish, err:0 [ 35.229310][ T6] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 35.237137][ T914] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e6 [ 35.255587][ T914] incfs: ino conflict with backing FS 3 [ 35.261960][ T914] syz.7.235: attempt to access beyond end of device [ 35.261960][ T914] loop7: rw=524288, sector=45064, nr_sectors = 8 limit=40427 [ 35.276434][ T914] syz.7.235: attempt to access beyond end of device [ 35.276434][ T914] loop7: rw=0, sector=45064, nr_sectors = 8 limit=40427 [ 35.290016][ T914] incfs: iterate_incfs_dir / -5 [ 35.436191][ T6] usb 5-1: config 1 interface 0 altsetting 13 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 35.447284][ T6] usb 5-1: config 1 interface 0 has no altsetting 0 [ 35.456120][ T6] usb 5-1: string descriptor 0 read error: -22 [ 35.462440][ T6] usb 5-1: New USB device found, idVendor=05ac, idProduct=0224, bcdDevice= 0.40 [ 35.474177][ T6] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.483281][ T903] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 35.660125][ T942] ip_tables: iptables: counters copy to user failed while replacing table [ 35.715762][ T953] set_capacity_and_notify: 6 callbacks suppressed [ 35.715777][ T953] loop0: detected capacity change from 0 to 2048 [ 35.750129][ T953] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 35.770523][ T958] loop8: detected capacity change from 0 to 128 [ 35.883204][ T308] tipc: Disabling bearer [ 35.887986][ T290] EXT4-fs (loop0): unmounting filesystem. [ 35.888620][ T308] tipc: Left network mode [ 35.896486][ T6] apple 0003:05AC:0224.0003: unknown main item tag 0xe [ 35.905471][ T6] apple 0003:05AC:0224.0003: unexpected long global item [ 35.912760][ T6] apple 0003:05AC:0224.0003: parse failed [ 35.918870][ T6] apple: probe of 0003:05AC:0224.0003 failed with error -22 [ 36.048115][ T964] loop8: detected capacity change from 0 to 40427 [ 36.065436][ T964] F2FS-fs (loop8): Small segment_count (9 < 1 * 24) [ 36.077440][ T964] F2FS-fs (loop8): Can't find valid F2FS filesystem in 1th superblock [ 36.087461][ T964] F2FS-fs (loop8): Found nat_bits in checkpoint [ 36.099403][ T6] usb 5-1: USB disconnect, device number 3 [ 36.121886][ T966] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.127088][ T964] F2FS-fs (loop8): Try to recover 1th superblock, ret: 0 [ 36.129041][ T966] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.136290][ T964] F2FS-fs (loop8): Mounted with checkpoint version = 48b305e5 [ 36.143544][ T966] device bridge_slave_0 entered promiscuous mode [ 36.163837][ T966] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.171270][ T966] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.178846][ T966] device bridge_slave_1 entered promiscuous mode [ 36.259895][ T966] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.266979][ T966] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.274256][ T966] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.281310][ T966] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.310429][ T752] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 36.318339][ T752] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.326528][ T752] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.337462][ T752] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 36.345738][ T752] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.352764][ T752] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.360499][ T989] futex_wake_op: syz.7.262 tries to shift op by 144; fix this program [ 36.378765][ T752] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 36.389017][ T752] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.396084][ T752] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.406403][ T752] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 36.414764][ T752] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 36.434176][ T752] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 36.445624][ T752] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 36.453558][ T752] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 36.462026][ T752] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 36.470120][ T966] device veth0_vlan entered promiscuous mode [ 36.481763][ T752] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 36.491573][ T966] device veth1_macvtap entered promiscuous mode [ 36.504434][ T752] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 36.514445][ T752] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 36.526526][ T308] device bridge_slave_1 left promiscuous mode [ 36.532656][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.540333][ T308] device bridge_slave_0 left promiscuous mode [ 36.546680][ T308] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.554728][ T308] device veth1_macvtap left promiscuous mode [ 36.561276][ T308] device veth0_vlan left promiscuous mode [ 36.639714][ T1004] ip_tables: iptables: counters copy to user failed while replacing table [ 36.675837][ T1003] overlayfs: failed to resolve './file0': -2 [ 36.703979][ T1014] netlink: 12 bytes leftover after parsing attributes in process `syz.7.272'. [ 36.727363][ T1014] netlink: 12 bytes leftover after parsing attributes in process `syz.7.272'. [ 36.740589][ T1014] 8021q: VLANs not supported on ip_vti0 [ 36.752013][ T1022] netlink: 180 bytes leftover after parsing attributes in process `syz.2.275'. [ 36.776794][ T1017] kvm [1016]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0xc1) = 0xe50000000000 [ 36.786020][ T1017] kvm [1016]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0xc2) = 0xe50000000000 [ 36.797796][ T1017] kvm [1016]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0x11e) = 0xe500be702111 [ 36.808980][ T1017] kvm [1016]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0x186) = 0xe50000000000 [ 36.818081][ T1017] kvm [1016]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0x187) = 0xe50000000000 [ 37.155004][ T628] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 37.283075][ T1049] Line length is too long: Should be less than 4094 [ 37.317721][ T1055] binder: 1054:1055 ioctl c0306201 2000000004c0 returned -14 [ 37.335130][ T628] usb 10-1: Using ep0 maxpacket: 32 [ 37.342169][ T628] usb 10-1: too many endpoints for config 0 interface 0 altsetting 5: 146, using maximum allowed: 30 [ 37.353334][ T628] usb 10-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 37.364331][ T628] usb 10-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 146 [ 37.377378][ T628] usb 10-1: config 0 interface 0 has no altsetting 0 [ 37.384052][ T628] usb 10-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 37.393189][ T628] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.402485][ T628] usb 10-1: config 0 descriptor?? [ 37.734605][ T28] kauditd_printk_skb: 43 callbacks suppressed [ 37.734618][ T28] audit: type=1400 audit(1793634097.129:386): avc: denied { search } for pid=1064 comm="syz.8.292" name="/" dev="configfs" ino=5969 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 37.773519][ T28] audit: type=1400 audit(1793634097.169:387): avc: denied { read } for pid=1064 comm="syz.8.292" name="/" dev="configfs" ino=5969 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 37.802954][ T28] audit: type=1400 audit(1793634097.169:388): avc: denied { open } for pid=1064 comm="syz.8.292" path="/" dev="configfs" ino=5969 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 37.828154][ T628] hid-multitouch 0003:1FD2:6007.0004: No inputs registered, leaving [ 37.844573][ T628] hid-multitouch 0003:1FD2:6007.0004: hiddev96,hidraw0: USB HID v0.00 Device [HID 1fd2:6007] on usb-dummy_hcd.9-1/input0 [ 37.849823][ T28] audit: type=1400 audit(1793634097.249:389): avc: denied { create } for pid=1068 comm="syz.8.294" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 37.907751][ T28] audit: type=1400 audit(1793634097.249:390): avc: denied { write } for pid=1068 comm="syz.8.294" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 37.936370][ T28] audit: type=1400 audit(1793634097.289:391): avc: denied { read } for pid=1068 comm="syz.8.294" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 37.956318][ T28] audit: type=1400 audit(1793634097.319:392): avc: denied { set_context_mgr } for pid=1080 comm="syz.4.299" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 38.019026][ T28] audit: type=1400 audit(1793634097.419:393): avc: denied { setopt } for pid=1089 comm="syz.4.304" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 38.105816][ T40] usb 10-1: USB disconnect, device number 2 [ 38.146297][ T1094] loop2: detected capacity change from 0 to 512 [ 38.167506][ T1094] EXT4-fs (loop2): Test dummy encryption mode enabled [ 38.174658][ T1094] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 38.188451][ T1094] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2802: Unable to expand inode 11. Delete some EAs or run e2fsck. [ 38.203577][ T1094] EXT4-fs (loop2): 1 truncate cleaned up [ 38.209347][ T1094] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 38.220948][ T1094] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 38.281239][ T289] EXT4-fs (loop2): unmounting filesystem. [ 38.364470][ T1103] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 38.409945][ T28] audit: type=1400 audit(1793634097.809:394): avc: denied { listen } for pid=1106 comm="syz.2.310" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 38.435470][ T28] audit: type=1326 audit(1793634097.839:395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1108 comm="syz.2.311" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6d13b9fb19 code=0x0 [ 38.725423][ T1127] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.733260][ T1127] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.744601][ T1129] loop9: detected capacity change from 0 to 512 [ 38.777826][ T1127] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 38.785255][ T1127] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 38.793656][ T1129] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: writeback. [ 38.799596][ T1127] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.809575][ T1127] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.812499][ T1129] ext4 filesystem being mounted at /6/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 38.817751][ T1127] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.834442][ T1127] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.866697][ T1137] loop4: detected capacity change from 0 to 512 [ 38.877634][ T966] EXT4-fs (loop9): unmounting filesystem. [ 38.895363][ T1137] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 38.924151][ T1137] EXT4-fs (loop4): 1 truncate cleaned up [ 38.950263][ T1137] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 39.004307][ T1142] block device autoloading is deprecated and will be removed. [ 39.038796][ T291] EXT4-fs (loop4): unmounting filesystem. [ 39.080030][ T1150] loop4: detected capacity change from 0 to 1024 [ 39.091540][ T1145] KVM: debugfs: duplicate directory 1145-4 [ 39.126625][ T1150] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 39.319292][ T1159] SELinux: failed to load policy [ 39.334996][ T6] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 39.391211][ T1164] overlayfs: failed to verify origin (newroot/94, ino=525, err=-116) [ 39.415065][ T1164] overlayfs: failed to verify upper root origin [ 39.524986][ T6] usb 10-1: Using ep0 maxpacket: 32 [ 39.531355][ T6] usb 10-1: config index 0 descriptor too short (expected 29220, got 36) [ 39.537809][ T1179] FAULT_INJECTION: forcing a failure. [ 39.537809][ T1179] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 39.540546][ T6] usb 10-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 39.561768][ T6] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 39.571041][ T6] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 39.581583][ T6] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 39.595010][ T1179] CPU: 0 PID: 1179 Comm: syz.7.338 Tainted: G W syzkaller #0 [ 39.603818][ T1179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 39.613881][ T1179] Call Trace: [ 39.617166][ T1179] [ 39.620105][ T1179] __dump_stack+0x21/0x24 [ 39.624447][ T1179] dump_stack_lvl+0x110/0x170 [ 39.629135][ T1179] ? __cfi_dump_stack_lvl+0x8/0x8 [ 39.634174][ T1179] dump_stack+0x15/0x24 [ 39.638342][ T1179] should_fail_ex+0x3bf/0x510 [ 39.643042][ T1179] should_fail_alloc_page+0x61/0x90 [ 39.648264][ T1179] prepare_alloc_pages+0x131/0x570 [ 39.653394][ T1179] ? __alloc_pages_bulk+0x9d0/0x9d0 [ 39.658616][ T1179] __alloc_pages+0x15b/0x610 [ 39.663218][ T1179] ? __cfi___alloc_pages+0x10/0x10 [ 39.668377][ T1179] ? kasan_save_alloc_info+0x1f/0x30 [ 39.673669][ T1179] ? __kasan_kmalloc+0x95/0xb0 [ 39.678439][ T1179] ? mon_bin_open+0x192/0x590 [ 39.683161][ T1179] get_zeroed_page+0x19/0x40 [ 39.687758][ T1179] mon_bin_open+0x21e/0x590 [ 39.692265][ T1179] chrdev_open+0x593/0x600 [ 39.696692][ T1179] ? __cfi_chrdev_open+0x10/0x10 [ 39.701632][ T1179] ? fsnotify_perm+0x3e9/0x5b0 [ 39.706413][ T1179] do_dentry_open+0x885/0x11f0 [ 39.711186][ T1179] ? __cfi_chrdev_open+0x10/0x10 [ 39.716132][ T1179] vfs_open+0x73/0x80 [ 39.720128][ T1179] path_openat+0x2699/0x2f30 [ 39.724739][ T1179] ? slab_post_alloc_hook+0x4f/0x2d0 [ 39.730033][ T1179] ? kmem_cache_alloc+0x166/0x320 [ 39.735071][ T1179] ? getname_flags+0xba/0x510 [ 39.739751][ T1179] ? do_sys_openat2+0xeb/0x820 [ 39.744530][ T1179] ? do_filp_open+0x420/0x420 [ 39.749219][ T1179] do_filp_open+0x1ee/0x420 [ 39.753733][ T1179] ? __cfi_do_filp_open+0x10/0x10 [ 39.754985][ T312] usb 9-1: new full-speed USB device number 2 using dummy_hcd [ 39.758764][ T1179] ? alloc_fd+0x4c1/0x570 [ 39.758790][ T1179] do_sys_openat2+0x15e/0x820 [ 39.775205][ T1179] ? do_sys_open+0xe0/0xe0 [ 39.779638][ T1179] ? do_user_addr_fault+0x9a5/0x1030 [ 39.784930][ T1179] __x64_sys_openat+0x136/0x160 [ 39.789798][ T1179] x64_sys_call+0x783/0x9a0 [ 39.794313][ T1179] do_syscall_64+0x4c/0xa0 [ 39.798734][ T1179] ? clear_bhb_loop+0x30/0x80 [ 39.803419][ T1179] ? clear_bhb_loop+0x30/0x80 [ 39.808113][ T1179] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 39.814014][ T1179] RIP: 0033:0x7f22a9f6034e [ 39.818429][ T1179] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 39.838034][ T1179] RSP: 002b:00007f22aaeefb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 39.846454][ T1179] RAX: ffffffffffffffda RBX: 00007f22aaef06c0 RCX: 00007f22a9f6034e [ 39.854432][ T1179] RDX: 0000000000080c00 RSI: 00007f22aaeefc00 RDI: ffffffffffffff9c [ 39.862411][ T1179] RBP: 00007f22aaeefc00 R08: 0000000000000000 R09: 0000000000000000 [ 39.870390][ T1179] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 39.878373][ T1179] R13: 00007f22aa226038 R14: 00007f22aa225fa0 R15: 00007ffd042acf08 [ 39.886359][ T1179] [ 39.890561][ T6] usb 10-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 39.903932][ T6] usb 10-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 39.935022][ C1] ================================================================== [ 39.943120][ C1] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 39.945067][ T6] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.950505][ C1] Read of size 8 at addr ffff888128be8190 by task syz.7.338/1178 [ 39.966243][ C1] [ 39.968562][ C1] CPU: 1 PID: 1178 Comm: syz.7.338 Tainted: G W syzkaller #0 [ 39.977308][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 39.987350][ C1] Call Trace: [ 39.990620][ C1] [ 39.993533][ C1] __dump_stack+0x21/0x24 [ 39.997847][ C1] dump_stack_lvl+0x110/0x170 [ 40.002512][ C1] ? __cfi_dump_stack_lvl+0x8/0x8 [ 40.007516][ C1] ? debug_smp_processor_id+0x17/0x20 [ 40.012878][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 40.017887][ C1] print_address_description+0x71/0x200 [ 40.023423][ C1] print_report+0x4a/0x60 [ 40.027738][ C1] kasan_report+0x122/0x150 [ 40.032246][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 40.037259][ C1] __asan_report_load8_noabort+0x14/0x20 [ 40.042899][ C1] rcu_cblist_dequeue+0x6c/0xb0 [ 40.047735][ C1] rcu_do_batch+0x4bc/0xc30 [ 40.052221][ C1] ? rcu_core+0xf00/0xf00 [ 40.056534][ C1] rcu_core+0x486/0xf00 [ 40.060759][ C1] ? kvm_sched_clock_read+0x18/0x40 [ 40.065943][ C1] ? sched_clock+0x9/0x10 [ 40.070255][ C1] ? rcu_cpu_kthread_park+0x90/0x90 [ 40.075436][ C1] ? kvm_sched_clock_read+0x18/0x40 [ 40.080622][ C1] rcu_core_si+0x9/0x10 [ 40.084786][ C1] handle_softirqs+0x1dd/0x5f0 [ 40.089556][ C1] __irq_exit_rcu+0x52/0xf0 [ 40.094044][ C1] irq_exit_rcu+0x9/0x10 [ 40.098267][ C1] sysvec_apic_timer_interrupt+0x58/0xc0 [ 40.103889][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 40.109854][ C1] RIP: 0033:0x7f22a9e6fd5a [ 40.114254][ C1] Code: 65 66 0f c6 c0 01 0f 11 45 00 4c 89 e6 eb 09 90 48 8b 4b 08 48 83 c3 08 48 39 d1 72 f3 48 8d 46 f8 48 8b 76 f8 48 39 f2 73 13 <66> 0f 1f 44 00 00 48 8b 70 f8 48 83 e8 08 48 39 f2 72 f3 48 39 c3 [ 40.133843][ C1] RSP: 002b:00007ffd042acd80 EFLAGS: 00000283 [ 40.139895][ C1] RAX: 00007f22a9ccbc50 RBX: 00007f22a9ccb188 RCX: ffffffff816834d8 [ 40.147848][ C1] RDX: ffffffff815849eb RSI: ffffffff81683483 RDI: 00007f22a9ccca00 [ 40.155803][ C1] RBP: 00007f22a9cc4fd8 R08: 00007f22aa210000 R09: 00007f22aa226038 [ 40.163754][ C1] R10: 0000000000000007 R11: 0000000000000005 R12: 00007f22a9cd4430 [ 40.171706][ C1] R13: 0000000000000016 R14: 0000000000001e8b R15: 0000000000000007 [ 40.179753][ C1] ? get_symbol_pos+0x138/0x660 [ 40.184597][ C1] ? desc_read+0x1bb/0x3e0 [ 40.188999][ C1] ? get_symbol_pos+0xe3/0x660 [ 40.193747][ C1] [ 40.196770][ C1] [ 40.199085][ C1] Allocated by task 1170: [ 40.203387][ C1] kasan_set_track+0x4b/0x70 [ 40.207961][ C1] kasan_save_alloc_info+0x1f/0x30 [ 40.213050][ C1] __kasan_kmalloc+0x95/0xb0 [ 40.217642][ C1] __kmalloc+0xb4/0x1e0 [ 40.221781][ C1] l2tp_session_create+0x38/0xbd0 [ 40.226791][ C1] pppol2tp_connect+0xbf5/0x1640 [ 40.231714][ C1] __sys_connect+0x3da/0x460 [ 40.236304][ C1] __x64_sys_connect+0x7a/0x90 [ 40.241051][ C1] x64_sys_call+0x88d/0x9a0 [ 40.245538][ C1] do_syscall_64+0x4c/0xa0 [ 40.249934][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 40.255807][ C1] [ 40.258110][ C1] Freed by task 752: [ 40.261977][ C1] kasan_set_track+0x4b/0x70 [ 40.266552][ C1] kasan_save_free_info+0x2b/0x40 [ 40.271556][ C1] ____kasan_slab_free+0x132/0x180 [ 40.276652][ C1] __kasan_slab_free+0x11/0x20 [ 40.281401][ C1] slab_free_freelist_hook+0xc2/0x190 [ 40.286750][ C1] __kmem_cache_free+0xb7/0x1b0 [ 40.291607][ C1] kfree+0x6f/0xf0 [ 40.295309][ C1] l2tp_session_put+0xaf/0x1a0 [ 40.300058][ C1] l2tp_session_delete+0x3df/0x4d0 [ 40.305153][ C1] l2tp_tunnel_del_work+0x199/0x410 [ 40.310345][ C1] process_one_work+0x717/0xc30 [ 40.315174][ C1] worker_thread+0xa4d/0x11d0 [ 40.319829][ C1] kthread+0x281/0x320 [ 40.323879][ C1] ret_from_fork+0x1f/0x30 [ 40.328278][ C1] [ 40.330579][ C1] Last potentially related work creation: [ 40.336268][ C1] kasan_save_stack+0x3a/0x60 [ 40.340926][ C1] __kasan_record_aux_stack+0xb6/0xc0 [ 40.346277][ C1] kasan_record_aux_stack_noalloc+0xb/0x10 [ 40.352064][ C1] call_rcu+0xcf/0xf50 [ 40.356118][ C1] pppol2tp_release+0x1e3/0x2b0 [ 40.360956][ C1] sock_close+0xc9/0x220 [ 40.365354][ C1] __fput+0x1fd/0x8f0 [ 40.369322][ C1] ____fput+0x15/0x20 [ 40.373296][ C1] task_work_run+0x1e1/0x250 [ 40.377889][ C1] do_exit+0xb0d/0x29f0 [ 40.382029][ C1] __cfi___ia32_sys_exit+0x0/0x10 [ 40.387041][ C1] x64_sys_call+0x67/0x9a0 [ 40.391444][ C1] do_syscall_64+0x4c/0xa0 [ 40.395840][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 40.401719][ C1] [ 40.404023][ C1] The buggy address belongs to the object at ffff888128be8000 [ 40.404023][ C1] which belongs to the cache kmalloc-512 of size 512 [ 40.418052][ C1] The buggy address is located 400 bytes inside of [ 40.418052][ C1] 512-byte region [ffff888128be8000, ffff888128be8200) [ 40.431310][ C1] [ 40.433619][ C1] The buggy address belongs to the physical page: [ 40.440003][ C1] page:ffffea0004a2fa00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x128be8 [ 40.450222][ C1] head:ffffea0004a2fa00 order:2 compound_mapcount:0 compound_pincount:0 [ 40.458523][ C1] flags: 0x4000000000010200(slab|head|zone=1) [ 40.464589][ C1] raw: 4000000000010200 ffffea0004a2f900 dead000000000002 ffff888100042f00 [ 40.473166][ C1] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 40.481741][ C1] page dumped because: kasan: bad access detected [ 40.488160][ C1] page_owner tracks the page as allocated [ 40.493852][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 390, tgid 390 (kworker/u4:4), ts 29618264419, free_ts 28132817382 [ 40.515804][ C1] post_alloc_hook+0x1f5/0x210 [ 40.520564][ C1] prep_new_page+0x1c/0x110 [ 40.525047][ C1] get_page_from_freelist+0x2ca9/0x2d20 [ 40.530579][ C1] __alloc_pages+0x1fa/0x610 [ 40.535151][ C1] alloc_slab_page+0x6e/0xf0 [ 40.539745][ C1] new_slab+0x98/0x3e0 [ 40.543792][ C1] ___slab_alloc+0x70f/0xb70 [ 40.548367][ C1] __slab_alloc+0x5e/0xa0 [ 40.552701][ C1] __kmem_cache_alloc_node+0x204/0x2d0 [ 40.558146][ C1] __kmalloc_node_track_caller+0xa1/0x1e0 [ 40.563851][ C1] __alloc_skb+0x226/0x4a0 [ 40.568257][ C1] bcm_can_tx+0x208/0x9c0 [ 40.572575][ C1] bcm_tx_timeout_handler+0x13d/0x3c0 [ 40.577938][ C1] __hrtimer_run_queues+0x398/0x8a0 [ 40.583211][ C1] hrtimer_run_softirq+0x19b/0x260 [ 40.588303][ C1] handle_softirqs+0x1dd/0x5f0 [ 40.593744][ C1] page last free stack trace: [ 40.598391][ C1] free_unref_page_prepare+0x81b/0x820 [ 40.603838][ C1] free_unref_page+0x93/0x530 [ 40.608501][ C1] __free_pages+0x67/0x100 [ 40.612919][ C1] __vunmap+0xa3c/0xc00 [ 40.617189][ C1] vfree+0x61/0x90 [ 40.620917][ C1] kcov_close+0x2b/0x50 [ 40.625069][ C1] __fput+0x1fd/0x8f0 [ 40.629072][ C1] ____fput+0x15/0x20 [ 40.633045][ C1] task_work_run+0x1e1/0x250 [ 40.637619][ C1] do_exit+0xb0d/0x29f0 [ 40.641778][ C1] do_group_exit+0x21b/0x2e0 [ 40.646351][ C1] __x64_sys_exit_group+0x3f/0x40 [ 40.651397][ C1] x64_sys_call+0x7b4/0x9a0 [ 40.655884][ C1] do_syscall_64+0x4c/0xa0 [ 40.660285][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 40.666161][ C1] [ 40.668469][ C1] Memory state around the buggy address: [ 40.674077][ C1] ffff888128be8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.682114][ C1] ffff888128be8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.690153][ C1] >ffff888128be8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.698187][ C1] ^ [ 40.702755][ C1] ffff888128be8200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.710799][ C1] ffff888128be8280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.718838][ C1] ================================================================== [ 40.726992][ C1] Disabling lock debugging due to kernel taint [ 40.750766][ T6] usb 10-1: config 0 descriptor?? [ 40.791498][ T312] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 40.801767][ T312] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 40.802712][ T291] EXT4-fs (loop4): unmounting filesystem. [ 40.811514][ T312] usb 9-1: New USB device found, idVendor=08b7, idProduct=ec00, bcdDevice= 0.00 [ 40.825729][ T312] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 40.833723][ T312] usb 9-1: SerialNumber: syz [ 40.958218][ T6] usblp 10-1:0.0: usblp0: USB Bidirectional printer dev 3 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 41.043987][ T312] usb 9-1: 0:2 : does not exist [ 41.051023][ T312] usb 9-1: USB disconnect, device number 2 [ 41.214821][ C1] usblp0: nonzero read bulk status received: -71 [ 41.221239][ T1147] usblp0: error -71 reading from printer [ 41.221658][ T416] usb 10-1: USB disconnect, device number 3 [ 41.233711][ T1147] usblp0: removed [ 41.265542][ T470] udevd[470]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory