last executing test programs: 43.473991392s ago: executing program 3 (id=595): unshare(0x2a020400) r0 = socket$inet(0x2, 0x3, 0x2) r1 = dup(r0) setsockopt$inet_int(r1, 0x0, 0xce, 0x0, 0x0) 43.425680993s ago: executing program 3 (id=597): syz_emit_ethernet(0x0, 0x0, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000880)={@link_local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "01044a", 0x20, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, {[], @ndisc_na={0x88, 0x0, 0x0, 0x0, '\x00', @remote, [{0x2, 0x1, "00000000fff5"}]}}}}}}, 0x0) 43.287941777s ago: executing program 3 (id=600): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000040)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x27, 0x3, 0x46d, 0x1234, 0x0, 0x0, "0600ff0901a10185100901150026ff0075089506810009019100851109019513810009019100c0"}}, 0x13f) read(r0, &(0x7f0000000200)=""/4096, 0x1000) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x2, "11ff"}}, 0x8) 43.120574271s ago: executing program 3 (id=602): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1f7) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r1, 0x1, &(0x7f00000002c0)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8, 0x6, r0, 0x0, 0x0, 0x97a4}]) 42.861926427s ago: executing program 3 (id=607): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00010000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca7f8fbc9cdfa146ec56175037958e271f60d25b7937f02c8695e5a1b2cdf41dc10d1e8bf076d83923dd29c0301000000010000003d5d58c07fa1f7e4d5b318e2ec0e0700897a74a0091ff110026e6d2ef831ab7ea0c34f17e3ad6e70af07da5ceb01b7551ef3bb6220030100dfd8e012e79578e51bc53099e90fbdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e060e3670ef0e789f93781965f1328d6704902cbe7bc0476619f28d99cde7a6b73340cc2160a1fe3c184b751c51160fbce841dfebd31a08b32808b80200000000009dd27080e71113610e10d8fb9c2aec61ce63a3462fd50117b89a9ab759b4eeb8cb000066d42b4e54861d0227dbfd2ed8576a3f7f3deadd7130856f756436303767d2e24f29e5dad9796edb697a6ea0180aabc18cae2ed4b4390af9a9ceafd07ed0030000002cab154ad029a119ca3c9727ec84222fff0d7216fdb0d3a0ec4bfae563858dc06e7c337642d3e5a815212f5e16c1b30c3a2a71bc85018e5ff2c910496f0dafc9ffc2cc788bee1b47683db01a46939868d75211bbae0e7313bff5d4c391ddece00fc772dd6b4d4d0a917b239fe12280fc92c88c5b8dcdcc22ee1747790a8992533ac2a9f5a699593f084419cae0b4183fb01c73f99857399537f5cc2acb72c7eae993fc9eb22d130665b6341da114f08cd0509d380578673fffffff7f23877a6b24db0e067345560942fa1c22015e53fd8a46be933ab460d8629fbef2461c96a08707671215c302fae29187d4f5c06a960fd37c10223fdae7ed04935c3c90d3add8eebc8619d73415e6adcda2130f5011e42e50adab988dd8f12baf5cc9398c88607a08009c2977aab37d9a44cfc1c7b4000000000000fa47742f6c5b9c4b11e7d7262a1457c39495c826b956ba859adfe38f77b91bd7d5ca1664fe2f3ced8468911806e8916dc15e21644db60c2499d5d16d7d915836ab26c169482008ef069dc42749289f854797f2f900c2a12d8c38a967c1bbe09315c29877a331bcc874b2f663ddeef0005b3d96c7aae73835d5a3cda9e90d76c1993e0799d4894ee7f8249dc1e3428d2129369ee1b85afa1a5b6154eb2eea0d0df414b315f65112412392191fa83ee830548f11e1038debd64cbe359454a3f2239cfe35f81b7ade8a5b859968ff0e90500d0b07c0dd00490f167e6d5c1109681739dc33f75b20428d6474a0a91ee90b8de802c6b538622e6bbcb80f87b415263c401e64ed69a2f75409000000000000001d695c4559b82cabac3cccadc1e1c19af4e03020abf5ff0433d660f20898d2a045d009a0ffb20a77c9af2b80c05184a66d30bbea2ca45a4d6d6d1e6e79aef42355a500587b603306a5af8d867d80a07f10d82eafb03062e95196d5e3ffea0000000000000be959096ea948cfa8e7194123e918914a71ad5a8521fb9553bc60f7d9719b55b3abb6bba3d113a680a8d46fe074c83fbe378a3889e8145b2eaceab05ef932c6e4f8ef0ed0d818a7b76d839cf3c63ebb4380b168c38fa32e49563cfee3a7f0fc18bfa32c418cef875fb49e2989177a1bcd1e30280bc586e79a5dd80701018e7d6e97b3ce267dd4e27b6ef206660090bb2164474cef378f97ca33fc03000000000000001547053453d0c9aec91a24079b21d52fb5516bf0c28ef37aa76442f6083dc99cd61afaf6be45d7b00d3639f2f10ac2d5c759c3e5468f0000000011d415b6b085fb73a2c7c3852e0e658ffeb4e863428a792bee94f6cd895424360e0464f9d7ea425f2fa6aac029d15af607ad83532ff181c985f54b39370c06e63055b4d6a36fa98a44e379d28307c9912fb097601f3f88a2ca6fd1f9320cfe7fc8e9f7f15f02e177ce23f43a154b42e26f037e8a01377cbd3f509e6e540c9ba9c2a589c95d8ad67a65e9a44c576dc24452eaa9d819e2b04bdd1c000000070000000000000000000000005333c6199c12dcd926891927a7267c47cf897853d160100b39b613faefe16bed1fc105dddd77ab929b837d4442d13d5a29179a00837918dd7854aa17eb9fbdc2bdc0e98ae2c3f23a6131e2879f04ff01000030b92dd493be66c2242f8184733b80ba28e8ffffff7f00000000bb2f89049c5f6d63d56995747639964217aacfe548bc869098aa8e07e51dbc9e2d4db3c5f79fd355222ec2a00cf7f2ccd6dd6d2dc2a815d8314221a5472f1318a9dfbec5a759579caf3262129b14e99040b5d91398e17df85c25ccae973eecc7d187168d5c9cd848d566cc17587641ed01889c927da38d83314480b15e23138c5b877a72bd4cf74a299df4fbfc8e6ea96939f15d254d9033c5a45706bda78ab60200000000000000000000000000000000000000706f78f0a2ea9667fb5b951808545a46830970c2dfae01adbda7d29bf1f7abdaf52e0de6f9d7150808ed086642e64ebf98762b34338b80e41b704c3eefaf0bb5ff070000000000000ea15ccc0d7a830b6eb33b6b61675511d693ef5e3c44bbf71cabc5f45c879e7499f8baae2a1a09cf38da73297764fbc0e723e1cc3abb12e3076982ed32c94a2ce3e6f37c47e983da4ca5c96187db5a2a2e1742bc93a65d7187126126b3a80f17dd2f7dbbe82d104ede9ba6925afc2ee6cb94f56f1363cad635abf8f983292c49c0ebf5005154c7b58a3a2a2ea86d2fd92b8661264f781e3fb02d05a28f3f17b64d0258853d45cb5ebde10cd3d82eeed2f1ed925b7cf400304932c5ed0a362b235ce37e1f17700f7d1fecf8be8a2c5d25a9c60657560d05441387ff158a018d19a286c58684a1d2f624c3eb59d509ee89cc2df52881d005b2e5c27563ba54e4153c132d0366aa660000000000000009c1aaec93ec0f925921fb2e9eb202a29bef28224dbabe723de5c584bc398a8792e493048c87f60a51a391e95921218149403558fd13c649f90b0911d57eeb298b590581eba1ce383b539ab80fd15445987b1bb4eb512545e1ab65fef3103ce10b1ee362b51c72f82edf2f502ddf52567775e34a56d1be892f1e62b08950d517fa6fb1b0ef2edf1b67f8644786116b037d4a36fdd30b000063e58c856ec44cbbc2d370553f832af9480215e09aaa3843fe360b1c293a14627f2cfbe278f31d0abc0f5aaa10926dbbfe8a4b131c13a73d4e6d065c2c0fed3ab8442520ce0e0ad7d2d177377ab197ace3ef8b1c24ceb0bdee84bd6e6317633938dd19dc42de7f8f860eca6d9c74525fcd3497526df4c13e3ba5f0d75365a4542ae9440d2fede416d61800aaf7e038879c5d177b3876fda4121e00000100000000003edd3d43cc64e0d26b46907b42e08d000000000000903350932d3eef7fdada20c19807066e3c72d0d816eb9fa50be213bf6bbb7ccb9f2e8a153e6ced68f192ebed6e86af0f2cec7335fa8039fd6eb025440bc2a34d071f0a0e6774308a74748b8cd994ed368695aa2c59869c9200a1306ffa5a71ca69e89a69fc858f37c2c398515a910a35e22ab0573c10b85df4c2972a2fb8b9c080fbb41a753791df727fdeaded2930376eda31312256191c620cce34d1e3bf40a4a207ab1575b399eb8155781bfc7cb5920b49c039935a888d77041894f60fbbcafa487ee96b368e8769da90b44190e569fe8b923c32c288baaca5c5558b5a78bb43e5d9e47a1d5809bb178184b5672d08e29aecf1f572ac1e6cab7e820751e95999b7532603494d37a2bff35a9eec46dfc8a52433f605ebf151c837b4966b5f3628a406175a87e32c5e4268d3000933b580415b162e2946446b8f02554c8a1225217d69d049685dd06aa8528673a9673a723ac414af77f523ad730d00e8700c213f95c87a94f39f506b9e000000000000000000000000000000000000000000000000000090668ac41a1c2a4f7831e6c6a3e9c68ca2c449482bb70a994e71a7f24873848fbb128c820c1de19cc003dfa65a2b296caeb1253802080e08eeb724c4c7b7e052afa19b0f2cd7a13bda4b5a8f3b8fa3ca70bb756a3d529718d5c79d9bdb89e5d33793533211d76d00a45079eff797476106bf76f1fed952a7c9162b88911b5b00c3d26fd2fb4d7b29d1ce025e102d458efd5cca3f3835ce760359eaa01cb13cb28d60e8942fdc02b6824c00dac62f8a2d4c680ae284a82f09d6641921536814b444e4188d9b2e97eb3b108e7876f0f3f3863147ab694218c7cecc075d52d590dddbb57fc6fedf5ec69d7894a7b5c8109f303dab998815c80534b0bd34c49eea63997e56728a8185a8bb6988a7197b87f5548f5edfdfb3efc907fe561b33a6f7c707f7828c6adaf3b2a39929b4b65253e787d65c08aff5e4a9b2267bd8f803ea38f10a6e9c4a49bf23525e08c12d229211fe4d88cf1440f29accfa50f327ac1fb20d7f164100111bd21fca713b2475f1c997f3000000000080c426bcec79c6bc83ce4e6cbb17c01be69db342192d0a716cc24710d23321441f475ec485d642b61c6bd907071dbbe37c0b78f60fd2ad0d13ca62d9d9aafb01c3920b64cb5e023810e2de4327f90c389ce36d90ff9f3cb9d8cd2260d05a8126943a3df17157470595c68ac8df7fea6d42ecb2cdb65b4f2aef0dc4b2de949a6d4ec37f2fd693ae44944041a64fe6336aba1c66b1b95d2edbc40364a049616ae962d75eae619548aa86bd5f0bad56e7ad7de2ee5e6f3b42e3a27094b6b5face99456d9af1926b21d37faf7612d9752cf58e6424decd530b5419e117ec086174439af6ee6c7fdb2d19c9280fa9a02e8fa6a38acfff09050d912635fed175fd06f577d40000000000000000000000000000754bffd73c0888ba8834f20b3acea57b7817663e12c1a5503bc4c13af59bda21688d68698c53ce3aa767657774db09ece7ec888d3af290207d36fa433b35e17dc0f3dc728ea1c633a4ef9e7d9bf81b57492e0544800921d1b751c5fbc163"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x55, 0x0, 0xffffffffffffffff, 0x3}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x97e, 0x1000000, &(0x7f0000000100)="b9ff030f6044238cb89e14f088a820ff43052f002000636777fbac141443e000000d62079f4b4d2f87e56dca6aab845013f2325f1a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0xfe, 0x60000000}, 0x2c) 42.713981301s ago: executing program 3 (id=611): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000480)='usbip-vudc.0', 0xc) write(r0, &(0x7f00000004c0)='\n', 0x1) 42.708469582s ago: executing program 32 (id=611): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000480)='usbip-vudc.0', 0xc) write(r0, &(0x7f00000004c0)='\n', 0x1) 26.129902554s ago: executing program 2 (id=1228): r0 = socket(0x40000000015, 0x5, 0x0) recvmmsg(r0, &(0x7f0000007d80)=[{{0x0, 0x0, &(0x7f0000002640)=[{0x0}, {&(0x7f0000001440)=""/100, 0x64}], 0x1000000000000053}, 0xfffe}], 0x1, 0x0, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) recvmmsg(r0, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000400)=""/4096, 0x10c4}], 0x1}}], 0x4000210, 0x2, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r1, 0x0}]) 25.993917658s ago: executing program 2 (id=1235): quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x2000) write$P9_RSTATFS(r0, &(0x7f0000000000)={0x43, 0x9, 0x2, {0x3, 0x8, 0x7fff, 0x7, 0xd9, 0xf5, 0x1, 0x7f, 0x5}}, 0x43) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 25.88345813s ago: executing program 2 (id=1238): r0 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) preadv(r0, &(0x7f00000007c0)=[{&(0x7f0000000040)=""/52, 0x34}, {0x0}], 0x2, 0xfe, 0x8) 25.803953742s ago: executing program 2 (id=1244): syz_mount_image$vfat(&(0x7f0000000140), &(0x7f0000000040)='./file0\x00', 0x802, &(0x7f0000000480)=ANY=[], 0x1, 0x2a4, &(0x7f00000001c0)="$eJzs3T9rc2UUAPBzkzSNOqSIiyJ4QQen0rq6NEoFsZMSQR002BYkCYUWAlYwduoncPR7+BFcXPwGgqvg1g6VKzf33ia16R/65k3h7e83nd7nnvOc3KckU06+eXPY3z1I4uTsz2i1kqhtxVacJ7EWtaj8FI0AAF4c51kW/2QPyWzUFt8NALAMxed/4bF7AQCW47Mvvvyks7Oz/WmatuL19umom0TE8HTULdY7+/FdDGIvNqIdFxHZpSL+6OOd7WikubV4ZzgedfPM4de/l/U7f0dM8jejHWvz8zfTwmX+y1V3aXT2V6o/2vHa/Pz3/p8fw3F0m/Hu2zP9r0c7/vg2DmIQu5HnTvN/3EzTD7Ofz374Kt8mz09q0V2d3DeV1Zd0JAAAAAAAAAAAAAAAAAAAAAAAPAHraZoU43sm83vyS5P5OaNu/WKyvp5WZuf7jKv5QElVqJgPlEU5omecxS/VfJ2NNE2z8sZpfiPeaPhhAQAAAAAAAAAAAAAAAAAAAMgdfX/c7w0Ge4cLCappANXX+h9aZ2vmyltx3O/Vby64ev+9ZqcN5L3eenM0GrGgx3JX8FLez8Irr04P9/MogupgFrrXqx8URY/7vbRcqh5yv5fctVerOrhfZ5ea8ayNZZN/iYvs6pm2Llu9mtVc0NNovjJ36d8sy+5X5/2/ijMqrySTERv3232lDOa+wDxoXT+L324ueONbRn0hbzwAAAAAAAAAAAAAAAAAAMA10y/9zlk8uTW19tyaAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAlm/7+fxW0IuLqlWvBuEy+7Z4yaMbh0SO/RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ6A/wIAAP//4ipOSw==") creat(&(0x7f0000000040)='./bus\x00', 0x0) mount(&(0x7f0000000480)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x801400, 0x0) r0 = open(&(0x7f0000000080)='./bus\x00', 0x4600, 0xe898d2275f586838) preadv2(r0, &(0x7f0000000980)=[{&(0x7f0000001200)=""/4096, 0x1000}], 0x1, 0x8000, 0x9, 0xb) 25.718342184s ago: executing program 2 (id=1250): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000b510f210950b2a7773820102030109022400010000000009042200028953950009050a02ff0300fa000905820250"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f0000000600)=ANY=[@ANYBLOB="001606"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000380)={0x2c, &(0x7f0000000180)={0x40, 0xf, 0x2, "e805"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000940)={0x44, &(0x7f00000006c0)={0x40, 0x12, 0x3, "0bf682"}, 0x0, 0x0, 0x0, &(0x7f0000000840)={0x20, 0x82, 0x1, "01"}, 0x0, 0x0, &(0x7f0000000900)={0x20, 0x85, 0x3, "22831c"}}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) 25.574098698s ago: executing program 2 (id=1251): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, 0x0, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f00000000c0)=0x9) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000880)=0x3, 0x4) writev(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) 25.573991638s ago: executing program 33 (id=1251): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, 0x0, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f00000000c0)=0x9) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000880)=0x3, 0x4) writev(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) 1.368699805s ago: executing program 0 (id=1841): r0 = socket$nl_route(0x10, 0x3, 0x0) unshare(0x28000600) fcntl$F_GET_RW_HINT(r0, 0x40f, &(0x7f0000000140)) 1.277938318s ago: executing program 0 (id=1843): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="3103fc1f0000000000400800000008000300d353"], 0x1c}, 0x1, 0x0, 0x0, 0x400400c}, 0x0) 1.277603558s ago: executing program 0 (id=1847): mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000540)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000005c0)='./dev/kmsg\x00', 0x6ca80, 0x15f) 1.21282854s ago: executing program 0 (id=1852): syz_emit_ethernet(0x2e, &(0x7f0000000500)={@local, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x1234, 0x0, 0x40, 0x11, 0x0, @rand_addr=0x1020304, @rand_addr=0xac141401}, {0x0, 0x50, 0xc, 0x0, @opaque="aabbccdd"}}}}}, &(0x7f0000000600)={0x1, 0x1, [0xe]}) 1.156692051s ago: executing program 0 (id=1858): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth0_macvtap\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffc0000, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0x7, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x18, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xe8}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xffffffff}]}]}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000880}, 0x10) 1.070093553s ago: executing program 1 (id=1861): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101401, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(0xffffffffffffffff, &(0x7f00000002c0)="05031c00d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.070005783s ago: executing program 0 (id=1862): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x0) close(r0) 986.119865ms ago: executing program 1 (id=1867): syz_mount_image$ext4(&(0x7f0000000140)='ext3\x00', &(0x7f0000000080)='./file1\x00', 0x3008000, &(0x7f0000000100)={[{@init_itable_val={'init_itable', 0x3d, 0x6}}]}, 0x30, 0x526, &(0x7f0000000ac0)="$eJzs3c9vI1cdAPCvnR/2ZrNNCj0UBHQphQWt1k68bVT1QntBQlVVpMIJoW2UeKModhzFTmlCJdIzVyQqcYI/gQMSB6Q9cecGNy7lgLRABdpFIORqxuNs4sSJlcZxG38+0shv3tj+fp+lec9+Y/sFMLZuRsR+RExHxNsRMZfV57ItXu1syf0eHTyq3X7rH5NZ+b2V7v27rmfPWYx4M9kvnBC3ubu3sVyrVbez/XKrvlVu7u7dWa8vr1XXqpuVytLi0sLLd1+qXFhbn6v/5uF31l//we9/9+UP/7j/rZ8kOX87O/boo047LlrndZmK2UN1ySv3+jCCjcBE1p7pUSfCueQj4nMR8XxWPlAcXU4AwHC123PRnju8319ugPsAAJ9+yWf+2cjlS9nn/9nI50uldA6v+EzM5GuNZuv2/cbO5mqkc1jzMZW/v16rLmRzhfMxlUv2F9Pyk/1Kz/7diHg6In5euJbul1YatdVRvekBgDF3vWf8/3ehM/4PwBUCAPgsM5IDwPg5Pv5PjSQPAODy+PwPAOPn0Ph/0m91AYArqNjz2//U8RoA4Ao5c/7/2fjpjy4nFQDgkrj+DwBj5XtvvJFs7cfZ/1+vvrO7s9F4585qtblRqu+slFYa21ultUZjLf3PnvpZz1drNLYWX4ydd8utarNVbu7u3as3djZb99L/9b5X9cMCABi9p5978OdcROy/ci3doruWg8v/cOU5zWF8TYw6AWBkJkedADAy5uOB3BnH+35F6IP+j7n2CfIBhu/WF/rM/5/+3uD/7ctJDxgi8/8wvp7M/5+nJ3jgbQB8hpn/h/HVbues5w8AY2aA6/++IghX3Lmv/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAYm023XL6UrQA8G/l8qRRxIyLmYyp3f71WXYiIpyLiT4WpQrK/OOqkAYBPKP+3XLb+1625F2Z7j07n/lNIbyPix7986xfvLrda24tJ/T8P6lsfZPWVEwMUht8GAOCQyd6K7jjdHce76/s++ui9le52mQk+fK2zuGgS93G2dVPvJF+MqYiY+VfuSGNyF7Qw8f77EfFsb/vzB8fns5VPe+MnsW8MLX6kLZw9Ej9/JH4+Pda5TV6Lz19ALjBuHiT9z6snnX/5uJneZudf7mhnWoyfHe9cz+Hha92Vl3v7v875/uaNYtrXnNT/3Rw0xot/+G7fY+9PtL84GfH4WP/bzauYlk6K/8KA8f/ypa883+9Y+1cRt+K0+J1SuVXfKjd39+6s15fXqmvVzUplaXFp4eW7L1XK6Rx1uTtTfdzfX7n9VP/2R8z0iV88o/1fH7D9v/7f2z/86inxv/m1k+Ln45lT4u9HxDcGjL8889u+y3cn8VePtf+/7XY7dzD+duJPH3lcUnd7wPgf/nVvdcC7AgCXoLm7t7Fcq1W3r3ihPddp7xBDFIf1zNc/Ja+hwimFiah156OGHKsw/BBJYZS9EnAZnpz0o84EAAAAAAAAAAAAAADop/n97C//hvhjuFG3EQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgKvr4wAAAP//kgHFMg==") 944.487876ms ago: executing program 1 (id=1874): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000070000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="0c000280060001"], 0x24}}, 0x44004) 872.931528ms ago: executing program 1 (id=1881): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000400)={'vcan0\x00', 0x0}) bind$can_raw(r0, &(0x7f00000001c0)={0x1d, r1}, 0x10) ioctl$SIOCGSTAMP(r0, 0x8906, 0x0) setsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, &(0x7f00000003c0)=0x1, 0x4) sendmsg$can_raw(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=@can={{0x2, 0x0, 0x0, 0x1}, 0x4, 0x3, 0x0, 0x0, "985300"}, 0x10}}, 0x0) read(r0, &(0x7f0000002fc0)=""/52, 0x34) 742.006271ms ago: executing program 5 (id=1891): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003d00000095"], &(0x7f00000000c0)='GPL\x00', 0x1}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000100)={r0, 0xffffffffffffffff, 0xd, 0x0, @val=@tcx={@void, @value=r0}}, 0x1c) 741.921581ms ago: executing program 5 (id=1892): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b00)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000240)={0x2, &(0x7f00000002c0)=[{0x40, 0x97}, {0x6, 0xba, 0x2, 0xffff}]}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 736.511801ms ago: executing program 5 (id=1893): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x4) 528.774907ms ago: executing program 5 (id=1899): r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup(r0, &(0x7f0000000080)='syz0\x00', 0x1ff) r1 = openat$cgroup(r0, &(0x7f0000000280)='syz0\x00', 0x200002, 0x0) openat$cgroup_type(r1, 0x0, 0x2, 0x0) mkdirat$cgroup(r1, &(0x7f00000004c0)='syz0\x00', 0x1ff) r2 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r2, &(0x7f0000000140), 0x9) 467.820139ms ago: executing program 5 (id=1902): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_RULE_EXPRESSIONS={0x48, 0x4, 0x0, 0x1, [{0x44, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6, 0x1, 0x1, 0x0, 0x7}, @NFTA_QUEUE_TOTAL={0x6, 0x2, 0x1, 0x0, 0xf6}, @NFTA_QUEUE_FLAGS={0x6}, @NFTA_QUEUE_SREG_QNUM={0x8, 0x4, 0x1, 0x0, 0x14}, @NFTA_QUEUE_SREG_QNUM={0x8, 0x4, 0x1, 0x0, 0x10}, @NFTA_QUEUE_TOTAL={0x6, 0x2, 0x1, 0x0, 0x5}]}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xe4}, 0x1, 0x0, 0x0, 0x24000890}, 0x0) 467.728719ms ago: executing program 5 (id=1903): bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0xb, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000900), 0x10, 0x5}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x129c81, 0x0) ppoll(&(0x7f0000000280)=[{r1, 0x6200}], 0x1, 0x0, 0x0, 0x0) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0xff2e) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x7f, 0x6, 0x1, "42341f9b1000007e4f0000001900"}) r2 = syz_open_pts(r1, 0x0) dup3(r2, r1, 0x0) splice(r1, 0x0, r0, 0x0, 0x7ffff000, 0x0) 121.532597ms ago: executing program 4 (id=1925): write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xcfa4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup(r0, &(0x7f0000000080)='syz0\x00', 0x1ff) r1 = openat$cgroup(r0, &(0x7f0000000280)='syz0\x00', 0x200002, 0x0) openat$cgroup_type(r1, 0x0, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net\x00') getdents64(r2, &(0x7f0000001540)=""/4088, 0xff8) r3 = socket$inet(0x2, 0x3, 0x8) setsockopt$inet_int(r3, 0x0, 0x5, &(0x7f0000000080)=0x7, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r4, 0x0, 0xc8, &(0x7f0000003d40), 0x4) close_range(r4, 0xffffffffffffffff, 0x2) mkdirat$cgroup(r1, &(0x7f00000004c0)='syz0\x00', 0x1ff) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000140), 0x9) 117.227417ms ago: executing program 6 (id=1926): r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000ec0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000780)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000001800000008000300", @ANYRES32=r2, @ANYBLOB="2400308020000180080001"], 0x40}, 0x1, 0x0, 0x0, 0x4008805}, 0x0) 74.476918ms ago: executing program 6 (id=1927): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r0, 0x0, 0x2a, 0x0, @val=@uprobe_multi={0x0, 0x0}}, 0x40) 74.288889ms ago: executing program 4 (id=1928): r0 = getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setreuid(r3, 0x0) sendmmsg$unix(r1, &(0x7f0000000440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@cred={{0x1c, 0x1, 0x2, {r0}}}, @cred={{0x1c, 0x1, 0x2, {r0, r3, 0xee01}}}], 0x40, 0x400c016}}], 0x1, 0x0) 74.148698ms ago: executing program 6 (id=1929): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000240)=@req3={0x81000, 0xfffffffd, 0x1020, 0xfffffffd, 0x7ff, 0xf84, 0x3}, 0x1c) 74.054558ms ago: executing program 4 (id=1930): bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000880)=ANY=[@ANYRES32, @ANYBLOB="e3ff07001c"], 0x20) 73.988778ms ago: executing program 6 (id=1931): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000001f000500000000000000000002"], 0x20}}, 0x0) 18.06937ms ago: executing program 4 (id=1932): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000001040)={'gre0\x00', &(0x7f00000004c0)={'syztnl2\x00', 0x0, 0x3f00, 0xa000, 0x7, 0x0, {{0x5, 0x4, 0x0, 0x3f, 0x14, 0x1, 0x0, 0x0, 0x2f, 0x0, @multicast2, @multicast1}}}}) 17.99367ms ago: executing program 6 (id=1933): setrlimit(0x2, &(0x7f0000000040)={0x7, 0x847d}) r0 = socket$netlink(0x10, 0x3, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r0) 17.95075ms ago: executing program 4 (id=1934): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) write$vga_arbiter(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="6c6f636b20e9029747ea51da3b85696f2b6d656d0f6dc94cf20000001fabee2a1111a9c938356e"], 0xc) 16.85122ms ago: executing program 1 (id=1935): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000880)={0x28, 0x0, 0x2, 0x201, 0x0, 0x0, {0xa, 0x0, 0x4}, [@CTA_EXPECT_TUPLE={0x4}, @CTA_EXPECT_MASTER={0x4}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x3}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x20000090) 16.80044ms ago: executing program 4 (id=1936): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1e000000000000000400000007"], 0x31) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001740)={r0, 0x0, &(0x7f0000001700)=""/53}, 0x20) 7.67374ms ago: executing program 6 (id=1937): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x2a, 0x0, 0x0) gettid() recvmsg$unix(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x0, 0x0}, 0x40000062) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x68c01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000001480)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f0000000080)=0x2) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x82, 0x0) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) 0s ago: executing program 1 (id=1938): r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000680)=@raw={'raw\x00', 0x9, 0x3, 0x288, 0x11c, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x208, 0xffffffff, 0xffffffff, 0x208, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@empty, @local, [0xff, 0xffff00, 0xff, 0xffffff00], [0xff, 0xff000000, 0xff, 0xffffff00], 'pimreg1\x00', 'vlan0\x00', {}, {0xff}, 0x21, 0xa, 0x7, 0x9}, 0x0, 0xa4, 0xd4}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x1, 0x2}, {0x3, 0x1, 0x5}, 0x7}}}, {{@ipv6={@mcast2, @loopback, [0xffffffff, 0x0, 0xffffff00, 0xffffffff], [0xff000000, 0xffffffff, 0xff, 0xffffff00], 'team_slave_1\x00', 'wg2\x00', {}, {}, 0x16, 0x3, 0x1, 0xc9}, 0x0, 0xa4, 0xec}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast2, 'syzkaller0\x00', {0x4}}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x2e4) 0s ago: executing program 1 (id=1941): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) ioctl$PPPIOCSFLAGS(r0, 0x40047459, 0x0) kernel console output (not intermixed with test programs): 0000,errors=remount-ro,min_batch_time=0x0000000000001cf3, [ 67.356002][ T52] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 67.374517][ T307] usb 3-1: USB disconnect, device number 9 [ 67.425734][ T1130] EXT4-fs (loop0): Test dummy encryption mode enabled [ 67.445088][ T1130] EXT4-fs error (device loop0): ext4_xattr_inode_iget:401: comm syz.0.239: inode #1: comm syz.0.239: iget: illegal inode # [ 67.458114][ T52] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 67.482382][ T52] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 67.501494][ T1130] EXT4-fs error (device loop0): ext4_xattr_inode_iget:406: comm syz.0.239: error while reading EA inode 1 err=-117 [ 67.511170][ T52] usb 4-1: SerialNumber: syz [ 67.516526][ T1130] EXT4-fs (loop0): 1 orphan inode deleted [ 67.524108][ T1130] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpjquota=,inode_readahead_blks=0x0000000000800000,resgid=0x0000000000000000,noinit_itable,errors=continue,minixdf,usrjquota=,test_dummy_encryption=v1,discard,dioread_lock,noblock_validity,noquota,,errors=continue [ 67.555001][ T52] usb 4-1: 0:2 : does not exist [ 67.639085][ T1138] EXT4-fs (loop2): Test dummy encryption mode enabled [ 67.683415][ T1144] input: syz1 as /devices/virtual/input/input13 [ 67.701503][ T1138] EXT4-fs error (device loop2): ext4_xattr_inode_iget:401: comm syz.2.242: inode #1: comm syz.2.242: iget: illegal inode # [ 67.714578][ T1138] EXT4-fs error (device loop2): ext4_xattr_inode_iget:406: comm syz.2.242: error while reading EA inode 1 err=-117 [ 67.732945][ T1138] EXT4-fs (loop2): 1 orphan inode deleted [ 67.739052][ T1138] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpjquota=,inode_readahead_blks=0x0000000000800000,resgid=0x0000000000000000,noinit_itable,errors=continue,minixdf,usrjquota=,test_dummy_encryption=v1,discard,dioread_lock,noblock_validity,noquota,,errors=continue [ 68.466961][ T1158] EXT4-fs (loop2): Test dummy encryption mode enabled [ 68.475312][ T1158] EXT4-fs error (device loop2): ext4_xattr_inode_iget:401: comm syz.2.247: inode #1: comm syz.2.247: iget: illegal inode # [ 68.488607][ T1158] EXT4-fs error (device loop2): ext4_xattr_inode_iget:406: comm syz.2.247: error while reading EA inode 1 err=-117 [ 68.501070][ T1158] EXT4-fs (loop2): 1 orphan inode deleted [ 68.507013][ T1158] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpjquota=,inode_readahead_blks=0x0000000000800000,resgid=0x0000000000000000,noinit_itable,errors=continue,minixdf,usrjquota=,test_dummy_encryption=v1,discard,dioread_lock,noblock_validity,noquota,,errors=continue [ 68.553381][ T52] usb 4-1: 5:0: cannot get min/max values for control 2 (id 5) [ 68.566585][ T52] usb 4-1: USB disconnect, device number 8 [ 68.663322][ T1162] EXT4-fs (loop4): Test dummy encryption mode enabled [ 68.671497][ T1162] EXT4-fs error (device loop4): ext4_xattr_inode_iget:401: comm syz.4.248: inode #1: comm syz.4.248: iget: illegal inode # [ 68.684562][ T1162] EXT4-fs error (device loop4): ext4_xattr_inode_iget:406: comm syz.4.248: error while reading EA inode 1 err=-117 [ 68.696898][ T1162] EXT4-fs (loop4): 1 orphan inode deleted [ 68.702902][ T1162] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpjquota=,inode_readahead_blks=0x0000000000800000,resgid=0x0000000000000000,noinit_itable,errors=continue,minixdf,usrjquota=,test_dummy_encryption=v1,discard,dioread_lock,noblock_validity,noquota,,errors=continue [ 69.096034][ T343] udevd[343]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card2/controlC2/../uevent} for writing: No such file or directory [ 69.714309][ T1185] EXT4-fs (loop1): mounted filesystem without journal. Opts: nobarrier,dioread_lock,barrier=0x0000000000000004,nojournal_checksum,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000010,jqfmt=vfsv1,init_itable, [ 69.850872][ T24] kauditd_printk_skb: 17 callbacks suppressed [ 69.850896][ T24] audit: type=1400 audit(1785961718.920:203): avc: denied { bind } for pid=1195 comm="syz.3.256" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 70.167976][ T1193] EXT4-fs warning (device loop2): ext4_xattr_inode_get:506: inode #11: comm syz.2.252: EA inode hash validation failed [ 70.181253][ T1193] EXT4-fs error (device loop2) in ext4_do_update_inode:5362: error 27 [ 70.190470][ T1193] EXT4-fs (loop2): Remounting filesystem read-only [ 70.197178][ T1193] EXT4-fs error (device loop2): ext4_dirty_inode:6181: inode #15: comm syz.2.252: mark_inode_dirty error [ 70.209316][ T1193] EXT4-fs error (device loop2) in ext4_do_update_inode:5362: error 27 [ 70.217997][ T1193] EXT4-fs error (device loop2): ext4_xattr_delete_inode:2943: inode #15: comm syz.2.252: mark_inode_dirty error [ 70.230652][ T1193] EXT4-fs error (device loop2): ext4_xattr_delete_inode:2946: inode #15: comm syz.2.252: mark inode dirty (error -27) [ 70.243735][ T1193] EXT4-fs warning (device loop2): ext4_evict_inode:305: xattr delete (err -27) [ 70.253087][ T1193] EXT4-fs (loop2): 1 orphan inode deleted [ 70.258884][ T1193] EXT4-fs (loop2): mounted filesystem without journal. Opts: nobarrier,journal_dev=0x00000000000000ff,debug_want_extra_isize=0x000000000000005c,nouid32,acl,resgid=0x0000000000000000,errors=remount-ro,min_batch_time=0x0000000000001cf3, [ 70.425158][ T1185] EXT4-fs error (device loop1): ext4_find_dest_de:2079: inode #12: block 7: comm syz.1.253: bad entry in directory: rec_len is too small for name_len - offset=16, inode=14, rec_len=40, size=56 fake=0 [ 70.546799][ T24] audit: type=1400 audit(1785961718.950:204): avc: denied { write } for pid=1195 comm="syz.3.256" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 70.568022][ T1202] overlayfs: missing 'lowerdir' [ 70.588030][ T1185] EXT4-fs (loop1): Remounting filesystem read-only [ 70.609232][ T280] EXT4-fs error (device loop1): ext4_read_inline_dir:1622: inode #12: block 7: comm syz-executor: path /57/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 70.640401][ T280] EXT4-fs error (device loop1): ext4_read_inline_dir:1622: inode #12: block 7: comm syz-executor: path /57/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 70.664497][ T1204] EXT4-fs (loop3): mounted filesystem without journal. Opts: nobarrier,dioread_lock,barrier=0x0000000000000004,nojournal_checksum,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000010,jqfmt=vfsv1,init_itable, [ 71.007683][ T1222] EXT4-fs (loop0): Ignoring removed mblk_io_submit option [ 71.017434][ T1222] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a80ee029, mo2=0002] [ 71.026408][ T1222] System zones: 1-12 [ 71.031346][ T1222] EXT4-fs error (device loop0): ext4_map_blocks:632: inode #11: block 10: comm syz.0.266: lblock 0 mapped to illegal pblock 10 (length 1) [ 71.046303][ T1222] EXT4-fs (loop0): Remounting filesystem read-only [ 71.052913][ T1222] EXT4-fs error (device loop0) in ext4_evict_inode:260: Readonly filesystem [ 71.062030][ T1222] ------------[ cut here ]------------ [ 71.067578][ T1222] EA inode 11 i_nlink=0 [ 71.068046][ T1222] WARNING: CPU: 1 PID: 1222 at fs/ext4/xattr.c:1002 ext4_xattr_inode_update_ref+0x4ea/0x540 [ 71.084060][ T1222] Modules linked in: [ 71.088493][ T1222] CPU: 1 PID: 1222 Comm: syz.0.266 Not tainted syzkaller #0 [ 71.096771][ T1222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 71.107740][ T1222] RIP: 0010:ext4_xattr_inode_update_ref+0x4ea/0x540 [ 71.115191][ T1222] Code: 40 4c 89 e0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 e7 e8 19 19 be ff 49 8b 34 24 48 c7 c7 a0 e2 2c 85 44 89 fa e8 86 e7 97 02 <0f> 0b 4c 8b 74 24 08 4c 8b 64 24 10 e9 a5 fe ff ff e8 90 8c 9b 02 [ 71.136668][ T1222] RSP: 0018:ffffc90007ab72c0 EFLAGS: 00010246 [ 71.142819][ T1222] RAX: a7934ff1b912ac00 RBX: ffff88812d0f9a98 RCX: 0000000000080000 [ 71.152135][ T1222] RDX: ffffc9000153b000 RSI: 000000000000cb40 RDI: 000000000000cb41 [ 71.160649][ T1222] RBP: ffffc90007ab73b0 R08: ffff8881f7027453 R09: 1ffff1103ee04e8a [ 71.169673][ T1222] R10: dffffc0000000000 R11: ffffed103ee04e8b R12: ffff88812d0f9978 [ 71.178219][ T1222] R13: dffffc0000000000 R14: ffff88812d0f9938 R15: 0000000000000000 [ 71.187183][ T1222] FS: 00007f54898866c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 71.996141][ T1231] : renamed from bond_slave_0 [ 72.001275][ T24] audit: type=1400 audit(1785961721.070:205): avc: denied { write } for pid=1226 comm="syz.4.267" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 72.022964][ T1222] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 72.030102][ T1222] CR2: 00002000000bd038 CR3: 0000000114906000 CR4: 00000000003506a0 [ 72.042037][ T1222] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 72.050673][ T1222] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 72.061516][ T1222] Call Trace: [ 72.065327][ T1222] ? ext4_xattr_block_csum+0x560/0x560 [ 72.070901][ T1222] ? __ext4_journal_ensure_credits+0x30/0x470 [ 72.077021][ T1222] ? ext4_xattr_inode_dec_ref_all+0x394/0xf20 [ 72.083112][ T1222] ext4_xattr_inode_dec_ref_all+0x91a/0xf20 [ 72.089763][ T1222] ? ext4_xattr_delete_inode+0xc00/0xc00 [ 72.095455][ T1222] ? __ext4_journal_ensure_credits+0x470/0x470 [ 72.101622][ T1222] ? ext4_get_inode_loc+0x100/0x130 [ 72.106844][ T1222] ext4_xattr_delete_inode+0xa42/0xc00 [ 72.112321][ T1222] ? ext4_truncate+0xe20/0x1220 [ 72.117205][ T1222] ? ext4_expand_extra_isize_ea+0x1940/0x1940 [ 72.123284][ T1222] ? __ext4_mark_inode_dirty+0x444/0x610 [ 72.129028][ T5] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 72.136554][ T301] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 72.149565][ T1222] ext4_evict_inode+0x10e2/0x1780 [ 72.155215][ T1222] ? _raw_spin_unlock+0x4d/0x70 [ 72.160347][ T1222] ? ext4_inode_is_fast_symlink+0x370/0x370 [ 72.166484][ T1222] ? thaw_kernel_threads+0x220/0x220 [ 72.171923][ T1222] ? ext4_inode_is_fast_symlink+0x370/0x370 [ 72.178357][ T1222] evict+0x4a9/0x940 [ 72.182485][ T1222] ? mode_strip_sgid+0x150/0x150 [ 72.187632][ T1222] ? _raw_spin_lock+0x94/0xf0 [ 72.192348][ T1222] ? _raw_spin_trylock_bh+0x150/0x150 [ 72.198244][ T1222] ? __kasan_check_write+0x14/0x20 [ 72.203529][ T1222] iput+0x654/0x7e0 [ 72.207516][ T1222] ext4_orphan_cleanup+0x989/0xd40 [ 72.212755][ T1222] ext4_fill_super+0x867e/0x8d90 [ 72.224213][ T1222] ? ext4_mount+0x40/0x40 [ 72.228578][ T1222] ? vscnprintf+0x80/0x80 [ 72.233069][ T1222] ? set_blocksize+0x1eb/0x3a0 [ 72.238086][ T1222] ? sb_set_blocksize+0xaa/0xf0 [ 72.242952][ T1222] mount_bdev+0x26a/0x380 [ 72.250425][ T1222] ? ext4_mount+0x40/0x40 [ 72.256330][ T1228] EXT4-fs warning (device loop3): ext4_xattr_inode_get:506: inode #11: comm syz.3.262: EA inode hash validation failed [ 72.266353][ T1222] ext4_mount+0x34/0x40 [ 72.270109][ T1228] EXT4-fs error (device loop3) in ext4_do_update_inode:5362: error 27 [ 72.273001][ T1222] legacy_get_tree+0xed/0x190 [ 72.286633][ T1228] EXT4-fs (loop3): Remounting filesystem read-only [ 72.293175][ T1228] EXT4-fs error (device loop3): ext4_dirty_inode:6181: inode #15: comm syz.3.262: mark_inode_dirty error [ 72.295575][ T1222] ? ext4_chksum+0x180/0x180 [ 72.305256][ T1228] EXT4-fs error (device loop3) in ext4_do_update_inode:5362: error 27 [ 72.309757][ T1222] vfs_get_tree+0x89/0x260 [ 72.317780][ T1228] EXT4-fs error (device loop3): ext4_xattr_delete_inode:2943: inode #15: comm syz.3.262: mark_inode_dirty error [ 72.322198][ T1222] do_new_mount+0x25a/0xa30 [ 72.333852][ T1228] EXT4-fs error (device loop3): ext4_xattr_delete_inode:2946: inode #15: comm syz.3.262: mark inode dirty (error -27) [ 72.339266][ T1222] path_mount+0x581/0xca0 [ 72.350934][ T1228] EXT4-fs warning (device loop3): ext4_evict_inode:305: xattr delete (err -27) [ 72.355851][ T1222] __se_sys_mount+0x320/0x390 [ 72.364346][ T1228] EXT4-fs (loop3): 1 orphan inode deleted [ 72.369363][ T1222] ? __x64_sys_mount+0xd0/0xd0 [ 72.374527][ T1228] EXT4-fs (loop3): mounted filesystem without journal. Opts: nobarrier,journal_dev=0x00000000000000ff,debug_want_extra_isize=0x000000000000005c,nouid32,acl,resgid=0x0000000000000000,errors=remount-ro,min_batch_time=0x0000000000001cf3, [ 72.375290][ T301] usb 3-1: Using ep0 maxpacket: 16 [ 72.408993][ T1222] ? debug_smp_processor_id+0x17/0x20 [ 72.418764][ T1222] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 72.425079][ T1222] __x64_sys_mount+0xbf/0xd0 [ 72.429706][ T1222] do_syscall_64+0x31/0x40 [ 72.434154][ T1222] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 72.440421][ T1222] RIP: 0033:0x7f548ae2e34a [ 72.445284][ T1222] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 72.452627][ T24] audit: type=1400 audit(1785961721.520:206): avc: denied { create } for pid=1236 comm="syz.4.269" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 72.466644][ T1222] RSP: 002b:00007f5489885e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 72.494102][ T1222] RAX: ffffffffffffffda RBX: 00007f5489885ee0 RCX: 00007f548ae2e34a [ 72.497194][ T24] audit: type=1400 audit(1785961721.560:207): avc: denied { write } for pid=1236 comm="syz.4.269" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 72.512564][ T1222] RDX: 0000200000000040 RSI: 00002000000001c0 RDI: 00007f5489885ea0 [ 72.530615][ T1222] RBP: 0000200000000040 R08: 00007f5489885ee0 R09: 0000000000800700 [ 72.548004][ T24] audit: type=1400 audit(1785961721.560:208): avc: denied { read } for pid=1236 comm="syz.4.269" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 72.568208][ T1222] R10: 0000000000800700 R11: 0000000000000246 R12: 00002000000001c0 [ 72.576628][ T1222] R13: 00007f5489885ea0 R14: 000000000000046d R15: 000000000000002c [ 72.585068][ T1222] ---[ end trace 5686fb4b546ff88c ]--- [ 72.590767][ T1222] EXT4-fs (loop0): 1 orphan inode deleted [ 72.596671][ T1222] EXT4-fs (loop0): mounted filesystem without journal. Opts: nodioread_nolock,errors=remount-ro,debug_want_extra_isize=0x000000000000005a,nouid32,debug,nombcache,resgid=0x0000000000000000,user_xattr,block_validity,usrquota,mblk_io_submit, [ 72.630827][ T301] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 72.641879][ T301] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 72.655075][ T301] usb 3-1: New USB device found, idVendor=0079, idProduct=0011, bcdDevice= 0.00 [ 72.664114][ T301] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 72.672881][ T301] usb 3-1: config 0 descriptor?? [ 72.678021][ T5] usb 2-1: config 0 interface 0 altsetting 1 endpoint 0x81 has invalid maxpacket 1056, setting to 1024 [ 72.689178][ T5] usb 2-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 72.702082][ T5] usb 2-1: config 0 interface 0 has no altsetting 0 [ 72.714917][ T5] usb 2-1: New USB device found, idVendor=1294, idProduct=1320, bcdDevice= 0.00 [ 72.724022][ T5] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 72.724400][ T1222] EXT4-fs (loop0): shut down requested (2) [ 72.736183][ T5] usb 2-1: config 0 descriptor?? [ 72.740996][ T24] audit: type=1400 audit(1785961721.810:209): avc: denied { read } for pid=76 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 72.762670][ T1222] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop0 ino=12 [ 72.765481][ T1212] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 72.773596][ T1222] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop0 ino=12 [ 72.784810][ T24] audit: type=1400 audit(1785961721.810:210): avc: denied { search } for pid=76 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 72.791095][ T1222] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop0 ino=12 [ 72.820202][ T24] audit: type=1400 audit(1785961721.810:211): avc: denied { write } for pid=76 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 72.840623][ T1222] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop0 ino=12 [ 72.859011][ T1222] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop0 ino=12 [ 72.873102][ T24] audit: type=1400 audit(1785961721.810:212): avc: denied { add_name } for pid=76 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 72.900634][ T1222] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop0 ino=12 [ 72.973656][ T1256] EXT4-fs (loop4): Ignoring removed mblk_io_submit option [ 72.993222][ T1262] EXT4-fs (loop3): Ignoring removed nomblk_io_submit option [ 72.999308][ T1256] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a80ee029, mo2=0002] [ 73.009532][ T1262] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 73.010904][ T1256] System zones: 1-12 [ 73.022316][ T1262] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=8800c01d, mo2=0002] [ 73.030962][ T1256] EXT4-fs error (device loop4): ext4_map_blocks:632: inode #11: block 10: comm syz.4.278: lblock 0 mapped to illegal pblock 10 (length 1) [ 73.031605][ T1262] EXT4-fs (loop3): couldn't mount RDWR because of unsupported optional features (80) [ 73.055064][ T1262] EXT4-fs (loop3): Skipping orphan cleanup due to unknown ROCOMPAT features [ 73.063767][ T1262] EXT4-fs (loop3): mounted filesystem without journal. Opts: nombcache,abort,nomblk_io_submit,grpid,nolazytime,noblock_validity,resgid=0x0000000000000000,nobarrier,jqfmt=vfsold,,errors=continue [ 73.084517][ T1256] EXT4-fs (loop4): Remounting filesystem read-only [ 73.091297][ T1256] EXT4-fs error (device loop4) in ext4_evict_inode:260: Readonly filesystem [ 73.100915][ T1256] EXT4-fs (loop4): 1 orphan inode deleted [ 73.106851][ T1256] EXT4-fs (loop4): mounted filesystem without journal. Opts: nodioread_nolock,errors=remount-ro,debug_want_extra_isize=0x000000000000005a,nouid32,debug,nombcache,resgid=0x0000000000000000,user_xattr,block_validity,usrquota,mblk_io_submit, [ 73.132434][ T1256] EXT4-fs (loop4): shut down requested (2) [ 73.138572][ T1256] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 73.147631][ T1256] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 73.156759][ T1256] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 73.165910][ T1256] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 73.174777][ T1256] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 73.187396][ T301] dragonrise 0003:0079:0011.0006: ignoring exceeding usage max [ 73.195586][ T1262] EXT4-fs warning (device loop3): dx_probe:860: inode #2: comm syz.3.279: dx entry: limit 65535 != root limit 120 [ 73.212189][ T301] dragonrise 0003:0079:0011.0006: hidraw0: USB HID v0.01 Device [HID 0079:0011] on usb-dummy_hcd.2-1/input0 [ 73.224610][ T1262] EXT4-fs warning (device loop3): dx_probe:946: inode #2: comm syz.3.279: Corrupt directory, running e2fsck is recommended [ 73.324352][ T5] usbhid 2-1:0.0: can't add hid device: -71 [ 73.331118][ T5] usbhid: probe of 2-1:0.0 failed with error -71 [ 73.340247][ T5] usb 2-1: USB disconnect, device number 8 [ 73.388726][ T52] usb 3-1: USB disconnect, device number 10 [ 73.466917][ T1299] EXT4-fs (loop3): mounted filesystem without journal. Opts: discard,data_err=ignore,init_itable,quota,abort,,errors=continue [ 73.557046][ T1312] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 73.565922][ T1312] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 73.577122][ T1312] System zones: 0-1, 15-15, 18-18, 34-34 [ 73.583362][ T1312] EXT4-fs (loop0): orphan cleanup on readonly fs [ 73.590515][ T1312] EXT4-fs warning (device loop0): ext4_enable_quotas:6495: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 73.608670][ T1312] EXT4-fs (loop0): Cannot turn on quotas: error -22 [ 73.615720][ T1312] EXT4-fs error (device loop0): ext4_validate_block_bitmap:438: comm syz.0.300: bg 0: block 40: padding at end of block bitmap is not set [ 73.630104][ T1312] EXT4-fs error (device loop0) in ext4_mb_clear_bb:5650: Corrupt filesystem [ 73.639118][ T1312] EXT4-fs (loop0): 1 truncate cleaned up [ 73.645096][ T1312] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 73.655706][ T1312] EXT4-fs (loop0): re-mounted. Opts: (null) [ 73.726361][ T1328] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,,errors=continue [ 73.737356][ T1328] ext4 filesystem being mounted at /56/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 73.756580][ T1327] loop0: p3 p4[EZD] [ 73.767299][ T1334] netlink: 12 bytes leftover after parsing attributes in process `syz.1.308'. [ 73.770626][ T1327] loop0: p3 start 458783 is beyond EOD, truncated [ 73.788416][ T1327] loop0: p4 size 100663296 extends beyond EOD, truncated [ 73.884103][ T343] udevd[343]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 73.922748][ T1346] EXT4-fs (loop3): Ignoring removed bh option [ 73.942446][ T1346] EXT4-fs error (device loop3): ext4_map_blocks:742: inode #3: block 1: comm syz.3.314: lblock 1 mapped to illegal pblock 1 (length 1) [ 74.023833][ T1346] EXT4-fs error (device loop3): ext4_acquire_dquot:6230: comm syz.3.314: Failed to acquire dquot type 0 [ 74.035529][ T1346] EXT4-fs error (device loop3): ext4_free_blocks:5690: comm syz.3.314: Freeing blocks not in datazone - block = 0, count = 4096 [ 74.056871][ T1346] EXT4-fs error (device loop3): ext4_read_inode_bitmap:140: comm syz.3.314: Invalid inode bitmap blk 0 in block_group 0 [ 74.069892][ T1346] EXT4-fs error (device loop3) in ext4_free_inode:360: Corrupt filesystem [ 74.074475][ T9] EXT4-fs error (device loop3): ext4_map_blocks:632: inode #3: block 1: comm kworker/u4:1: lblock 1 mapped to illegal pblock 1 (length 1) [ 74.080220][ T1346] EXT4-fs (loop3): 1 orphan inode deleted [ 74.093211][ T9] EXT4-fs error (device loop3): ext4_release_dquot:6266: comm kworker/u4:1: Failed to release dquot type 0 [ 74.099012][ T1346] EXT4-fs (loop3): mounted filesystem without journal. Opts: ; dioread_lock,min_batch_time=0x0000000000000008,norecovery,delalloc,nodiscard,inlinecrypt,bh,,errors=continue [ 74.155300][ T1367] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 74.174564][ T1367] FAT-fs (loop2): error, corrupted directory (invalid entries) [ 74.215140][ T300] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 74.216015][ T1346] EXT4-fs (loop3): re-mounted. Opts: (null) [ 74.513491][ T1382] usb usb7: usbfs: process 1382 (syz.2.328) did not claim interface 0 before use [ 75.416192][ T1403] xt_CONNSECMARK: invalid mode: 66 [ 75.447037][ T1404] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 75.460377][ T1406] xt_hashlimit: size too large, truncated to 1048576 [ 75.517880][ T24] kauditd_printk_skb: 36 callbacks suppressed [ 75.517893][ T24] audit: type=1326 audit(1785961724.590:245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1411 comm="syz.4.342" exe="/root/ci2-android-5-10/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f93f9e2b0d9 code=0x0 [ 75.556584][ T1412] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 75.591014][ T1404] EXT4-fs (loop2): mounted filesystem without journal. Opts: discard,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x0000000000000080,delalloc,nogrpid,noauto_da_alloc,dioread_nolock,,errors=continue [ 75.630784][ T1412] EXT4-fs (loop0): mounted filesystem without journal. Opts: jqfmt=vfsv1,nodelalloc,grpquota,auto_da_alloc=0x0000000000000003,,errors=continue [ 75.666510][ T24] audit: type=1400 audit(1785961724.730:246): avc: denied { read append } for pid=1392 comm="syz.2.334" path="/52/file1/cgroup.controllers" dev="loop2" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 75.705972][ T1412] ext4 filesystem being mounted at /93/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 75.748038][ T24] audit: type=1400 audit(1785961724.810:247): avc: denied { create } for pid=1416 comm="syz.4.343" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 75.828618][ T24] audit: type=1400 audit(1785961724.870:248): avc: denied { mmap_zero } for pid=1424 comm="syz.4.346" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 75.850033][ T24] audit: type=1400 audit(1785961724.870:249): avc: denied { read } for pid=1424 comm="syz.4.346" name="ppp" dev="devtmpfs" ino=153 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 75.881876][ T24] audit: type=1400 audit(1785961724.870:250): avc: denied { open } for pid=1424 comm="syz.4.346" path="/dev/ppp" dev="devtmpfs" ino=153 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 75.914334][ T24] audit: type=1400 audit(1785961724.870:251): avc: denied { ioctl } for pid=1424 comm="syz.4.346" path="/dev/ppp" dev="devtmpfs" ino=153 ioctlcmd=0x7438 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 75.984775][ T1435] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 75.997041][ T1435] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 76.098826][ T1441] EXT4-fs error (device loop2): ext4_xattr_inode_iget:401: inode #2: comm syz.2.345: missing EA_INODE flag [ 76.112009][ T1441] EXT4-fs error (device loop2): ext4_xattr_inode_iget:406: comm syz.2.345: error while reading EA inode 2 err=-117 [ 76.125126][ T1441] EXT4-fs (loop2): 1 orphan inode deleted [ 76.130878][ T1441] EXT4-fs (loop2): mounted filesystem without journal. Opts: nombcache,nogrpid,,errors=continue [ 76.159681][ T1444] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 76.187318][ T24] audit: type=1400 audit(1785961725.260:252): avc: denied { create } for pid=1439 comm="syz.2.345" name="\" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=sock_file permissive=1 [ 76.211122][ T1444] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 76.233866][ T1444] EXT4-fs (loop0): 1 truncate cleaned up [ 76.240169][ T1444] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 76.258786][ T24] audit: type=1400 audit(1785961725.260:253): avc: denied { mount } for pid=1452 comm="syz.4.358" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 76.280970][ T24] audit: type=1400 audit(1785961725.290:254): avc: denied { unmount } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 76.514815][ T1491] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 76.527330][ T1491] ext4 filesystem being mounted at /55/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 76.594064][ T1506] EXT4-fs (loop4): Ignoring removed bh option [ 76.600872][ T1491] EXT4-fs error (device loop2): ext4_xattr_block_get:543: inode #15: comm syz.2.371: corrupted xattr block 33 [ 76.616342][ T1506] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 76.629732][ T1491] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop2 ino=15 [ 76.666327][ T1491] EXT4-fs error (device loop2): ext4_xattr_block_get:543: inode #15: comm syz.2.371: corrupted xattr block 33 [ 76.679640][ T1491] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop2 ino=15 [ 76.690843][ T1506] EXT4-fs warning (device loop4): ext4_update_dynamic_rev:1047: updating to rev 1 because of new feature flag, running e2fsck is recommended [ 76.724389][ T1525] netlink: 'syz.0.390': attribute type 13 has an invalid length. [ 76.732539][ T1491] EXT4-fs error (device loop2): ext4_xattr_block_get:543: inode #15: comm syz.2.371: corrupted xattr block 33 [ 76.744548][ T1491] EXT4-fs error (device loop2): ext4_xattr_block_get:543: inode #15: comm syz.2.371: corrupted xattr block 33 [ 76.757121][ T1491] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop2 ino=15 [ 76.766242][ T1491] EXT4-fs error (device loop2): ext4_xattr_block_get:543: inode #15: comm syz.2.371: corrupted xattr block 33 [ 76.778187][ T1491] fscrypt (loop2, inode 15): Error -117 getting encryption context [ 76.782404][ T1506] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.379: bg 0: block 248: padding at end of block bitmap is not set [ 76.825519][ T1506] EXT4-fs error (device loop4): ext4_acquire_dquot:6230: comm syz.4.379: Failed to acquire dquot type 1 [ 76.838774][ T1506] EXT4-fs (loop4): 1 truncate cleaned up [ 76.845279][ T1506] EXT4-fs (loop4): mounted filesystem without journal. Opts: bh,inlinecrypt,grpid,,errors=continue [ 77.342396][ T1573] EXT4-fs (loop0): Ignoring removed oldalloc option [ 77.352166][ T1573] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 77.397636][ T1573] EXT4-fs error (device loop0): ext4_get_branch:178: inode #11: block 4294967295: comm syz.0.408: invalid block [ 77.428361][ T1573] EXT4-fs error (device loop0): ext4_free_branches:1026: inode #11: comm syz.0.408: invalid indirect mapped block 4294967295 (level 1) [ 77.458274][ T1573] EXT4-fs error (device loop0): ext4_free_branches:1026: inode #11: comm syz.0.408: invalid indirect mapped block 4294967295 (level 1) [ 77.483552][ T1587] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 77.494065][ T1573] EXT4-fs (loop0): 2 truncates cleaned up [ 77.501444][ T1587] EXT4-fs (loop1): 1 truncate cleaned up [ 77.507417][ T1573] EXT4-fs (loop0): mounted filesystem without journal. Opts: usrjquota=,oldalloc,jqfmt=vfsv0,i_version,,errors=continue [ 77.520157][ T1587] EXT4-fs (loop1): mounted filesystem without journal. Opts: nojournal_checksum,jqfmt=vfsold,lazytime,usrquota,usrquota,,errors=continue [ 77.566524][ T1573] EXT4-fs (loop0): shut down requested (1) [ 77.589925][ T1573] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop0 ino=12 [ 77.624471][ T1573] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop0 ino=12 [ 77.920852][ T1628] EXT4-fs error (device loop2): ext4_acquire_dquot:6230: comm syz.2.435: Failed to acquire dquot type 0 [ 77.933015][ T1645] netlink: 'syz.3.442': attribute type 2 has an invalid length. [ 77.943259][ T1646] EXT4-fs (loop4): Unrecognized mount option "mb_optimize_scan=0x0000000000000001" or missing value [ 77.945999][ T1628] EXT4-fs (loop2): 1 truncate cleaned up [ 77.960194][ T1645] netlink: 16 bytes leftover after parsing attributes in process `syz.3.442'. [ 77.971116][ T1628] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 78.197695][ T1669] tpacket_rcv: packet too big, clamped from 40 to 4294967272. macoff=96 [ 78.443566][ T1709] process 'syz.4.472' launched './file0' with NULL argv: empty string added [ 78.686579][ T1749] device syzkaller0 entered promiscuous mode [ 78.785835][ T1764] Illegal XDP return value 4294967274, expect packet loss! [ 78.944977][ T1765] FAT-fs (loop1): Directory bread(block 64) failed [ 78.981887][ T1765] FAT-fs (loop1): Directory bread(block 65) failed [ 79.039311][ T1765] FAT-fs (loop1): Directory bread(block 66) failed [ 79.092519][ T1765] FAT-fs (loop1): Directory bread(block 67) failed [ 79.146960][ T1765] FAT-fs (loop1): Directory bread(block 68) failed [ 79.201380][ T1765] FAT-fs (loop1): Directory bread(block 69) failed [ 79.230138][ T1765] FAT-fs (loop1): Directory bread(block 70) failed [ 79.255215][ T1765] FAT-fs (loop1): Directory bread(block 71) failed [ 79.301170][ T1765] FAT-fs (loop1): Directory bread(block 72) failed [ 79.328117][ T1765] FAT-fs (loop1): Directory bread(block 73) failed [ 79.820898][ T1799] EXT4-fs (loop1): mounted filesystem without journal. Opts: nodioread_nolock,sb=0x0000000000000001,,errors=continue [ 79.854277][ T1799] ext4 filesystem being mounted at /96/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 79.874732][ T1807] EXT4-fs (loop3): Ignoring removed nobh option [ 79.910972][ T1807] EXT4-fs error (device loop3): ext4_map_blocks:632: inode #3: block 2: comm syz.3.503: lblock 2 mapped to illegal pblock 2 (length 1) [ 79.975698][ T1807] EXT4-fs (loop3): Remounting filesystem read-only [ 80.016620][ T1807] EXT4-fs error (device loop3): ext4_map_blocks:632: inode #3: block 48: comm syz.3.503: lblock 0 mapped to illegal pblock 48 (length 1) [ 80.094418][ T1807] EXT4-fs error (device loop3): ext4_acquire_dquot:6230: comm syz.3.503: Failed to acquire dquot type 0 [ 80.115157][ T1824] netlink: 8 bytes leftover after parsing attributes in process `syz.4.506'. [ 80.124048][ T1807] EXT4-fs (loop3): 1 orphan inode deleted [ 80.133318][ T1819] EXT4-fs (loop2): Ignoring removed bh option [ 80.134298][ T1807] EXT4-fs (loop3): mounted filesystem without journal. Opts: nodioread_nolock,noblock_validity,errors=remount-ro,max_batch_time=0x0000000000000007,nodiscard,barrier=0x0000000000000038,nobh, [ 80.158123][ T1819] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 80.206918][ T1830] netlink: 104 bytes leftover after parsing attributes in process `syz.1.513'. [ 80.276112][ T1819] EXT4-fs (loop2): mounted filesystem without journal. Opts: nobarrier,dioread_lock,dioread_nolock,resgid=0x0000000000000000,debug_want_extra_isize=0x0000000000000080,lazytime,journal_ioprio=0x0000000000000005,stripe=0x0000000000000011,bh,init_itable,,errors=continue [ 80.306570][ T9] EXT4-fs error (device loop3): ext4_map_blocks:632: inode #3: block 1: comm kworker/u4:1: lblock 1 mapped to illegal pblock 1 (length 1) [ 80.335084][ T9] EXT4-fs (loop3): Remounting filesystem read-only [ 80.341752][ T9] EXT4-fs error (device loop3): ext4_release_dquot:6266: comm kworker/u4:1: Failed to release dquot type 0 [ 80.525524][ T1852] EXT4-fs (loop2): mounted filesystem without journal. Opts: errors=remount-ro,nodioread_nolock,noquota,barrier,auto_da_alloc,nodioread_nolock, [ 80.540473][ T1852] ext4 filesystem being mounted at /90/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 80.561219][ T1852] EXT4-fs error (device loop2): ext4_free_blocks:5690: comm syz.2.522: Freeing blocks not in datazone - block = 0, count = 16 [ 80.575435][ T1857] FAT-fs (loop4): Directory bread(block 64) failed [ 80.589046][ T1852] EXT4-fs (loop2): Remounting filesystem read-only [ 80.599106][ T1857] FAT-fs (loop4): Directory bread(block 65) failed [ 80.608463][ T1857] FAT-fs (loop4): Directory bread(block 66) failed [ 80.615806][ T1857] FAT-fs (loop4): Directory bread(block 67) failed [ 80.622474][ T1857] FAT-fs (loop4): Directory bread(block 68) failed [ 80.629259][ T1857] FAT-fs (loop4): Directory bread(block 69) failed [ 80.635950][ T1857] FAT-fs (loop4): Directory bread(block 70) failed [ 80.642519][ T1857] FAT-fs (loop4): Directory bread(block 71) failed [ 80.649189][ T1857] FAT-fs (loop4): Directory bread(block 72) failed [ 80.655854][ T1857] FAT-fs (loop4): Directory bread(block 73) failed [ 80.712757][ T1875] tipc: Started in network mode [ 80.717695][ T1875] tipc: Own node identity , cluster identity 4711 [ 80.724278][ T1875] tipc: Failed to obtain node identity [ 80.736664][ T1875] tipc: Enabling of bearer rejected, failed to enable media [ 80.765477][ T1875] device syzkaller0 entered promiscuous mode [ 80.784474][ T1881] device ip6gre1 entered promiscuous mode [ 80.790222][ T24] kauditd_printk_skb: 102 callbacks suppressed [ 80.790233][ T24] audit: type=1400 audit(1785961729.860:350): avc: granted { setsecparam } for pid=1878 comm="syz.3.532" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 80.910948][ T1898] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 80.930155][ T1898] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 81.018731][ T307] hid-generic 0000:0000:0006.0007: unknown main item tag 0x0 [ 81.026927][ T307] hid-generic 0000:0000:0006.0007: unknown main item tag 0x0 [ 81.035142][ T307] hid-generic 0000:0000:0006.0007: unknown main item tag 0x0 [ 81.042648][ T307] hid-generic 0000:0000:0006.0007: unknown main item tag 0x0 [ 81.056024][ T307] hid-generic 0000:0000:0006.0007: unknown main item tag 0x0 [ 81.065136][ T307] hid-generic 0000:0000:0006.0007: hidraw0: HID v0.0d Device [syz0] on syz1 [ 81.083417][ T24] audit: type=1400 audit(1785961730.150:351): avc: denied { connect } for pid=1906 comm="syz.3.544" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 81.145060][ T1913] netlink: 220 bytes leftover after parsing attributes in process `syz.4.546'. [ 81.161867][ T1908] fido_id[1908]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 81.204515][ T24] audit: type=1400 audit(1785961730.230:352): avc: denied { watch } for pid=1911 comm="syz.3.547" path="/117" dev="tmpfs" ino=645 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 81.408529][ T1931] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 81.554454][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 81.640865][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 81.655301][ T24] audit: type=1400 audit(1785961730.300:353): avc: denied { read append } for pid=1918 comm="syz.1.551" name="rtc0" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 81.681229][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 81.689858][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 81.718038][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 81.726356][ T24] audit: type=1400 audit(1785961730.300:354): avc: denied { open } for pid=1918 comm="syz.1.551" path="/dev/rtc0" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 81.748096][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 81.761019][ T1938] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 81.770186][ T1938] ext4 filesystem being mounted at /115/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 81.786779][ T24] audit: type=1400 audit(1785961730.300:355): avc: denied { ioctl } for pid=1918 comm="syz.1.551" path="/dev/rtc0" dev="devtmpfs" ino=258 ioctlcmd=0x700b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 81.814564][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 81.828644][ T24] audit: type=1400 audit(1785961730.340:356): avc: denied { setopt } for pid=1924 comm="syz.1.553" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 81.849102][ T24] audit: type=1400 audit(1785961730.770:357): avc: denied { watch watch_reads } for pid=1930 comm="syz.4.555" path="/118/file1/file2" dev="loop4" ino=1048609 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=file permissive=1 [ 81.864855][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 81.874267][ T24] audit: type=1400 audit(1785961730.810:358): avc: denied { create } for pid=1936 comm="syz.1.557" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 81.903316][ T24] audit: type=1400 audit(1785961730.810:359): avc: denied { create } for pid=1936 comm="syz.1.557" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 81.940346][ T1947] device syzkaller0 entered promiscuous mode [ 81.961819][ T1951] udc-core: couldn't find an available UDC or it's busy [ 81.972247][ T1951] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 82.252968][ T1979] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 82.268362][ T1994] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 82.276188][ T1994] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 82.336228][ T2002] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.457608][ T2014] netlink: 8 bytes leftover after parsing attributes in process `syz.3.592'. [ 82.469211][ T2014] netlink: 8 bytes leftover after parsing attributes in process `syz.3.592'. [ 82.478056][ T2014] netlink: 4 bytes leftover after parsing attributes in process `syz.3.592'. [ 82.574946][ T2016] EXT4-fs (loop4): Invalid want_extra_isize 2 [ 82.864679][ T373] hid-generic 0003:046D:1234.0008: hidraw0: USB HID v0.00 Device [syz0] on syz1 [ 82.889370][ T2032] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 82.935426][ T2032] EXT4-fs (loop0): orphan cleanup on readonly fs [ 82.942030][ T2032] EXT4-fs error (device loop0): ext4_ext_check_inode:500: inode #3: comm syz.0.599: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 2, max 3(4), depth 0(0) [ 82.961223][ T2032] EXT4-fs error (device loop0): ext4_quota_enable:6454: comm syz.0.599: Bad quota inode: 3, type: 0 [ 82.973013][ T2039] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpquota,auto_da_alloc,minixdf,,errors=continue [ 82.985179][ T2032] EXT4-fs warning (device loop0): ext4_enable_quotas:6495: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [ 83.019579][ T2041] fido_id[2041]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 83.034570][ T2032] EXT4-fs (loop0): Cannot turn on quotas: error -117 [ 83.041487][ T2032] EXT4-fs (loop0): mounted filesystem without journal. Opts: nodelalloc,resgid=0x0000000000000000,init_itable,,errors=continue [ 83.047404][ T2039] ext4 filesystem being mounted at /126/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 83.120540][ T2045] [ 83.325006][ T2059] SELinux: policydb string length 0 does not match expected length 8 [ 83.372839][ T2059] SELinux: failed to load policy [ 83.389871][ T2061] EXT4-fs error (device loop1): ext4_map_blocks:742: inode #3: block 1: comm syz.1.606: lblock 1 mapped to illegal pblock 1 (length 1) [ 83.446595][ T2061] EXT4-fs error (device loop1): ext4_acquire_dquot:6230: comm syz.1.606: Failed to acquire dquot type 0 [ 83.461636][ T2061] EXT4-fs error (device loop1): ext4_free_blocks:5690: comm syz.1.606: Freeing blocks not in datazone - block = 0, count = 4096 [ 83.488558][ T2061] EXT4-fs error (device loop1): ext4_read_inode_bitmap:140: comm syz.1.606: Invalid inode bitmap blk 0 in block_group 0 [ 83.501400][ T2061] EXT4-fs error (device loop1) in ext4_free_inode:360: Corrupt filesystem [ 83.511174][ T2061] EXT4-fs (loop1): 1 orphan inode deleted [ 83.514446][ T9] EXT4-fs error (device loop1): ext4_map_blocks:632: inode #3: block 1: comm kworker/u4:1: lblock 1 mapped to illegal pblock 1 (length 1) [ 83.517645][ T2061] EXT4-fs (loop1): mounted filesystem without journal. Opts: ; noinit_itable,discard,data_err=ignore,max_batch_time=0x0000000000000006,journal_dev=0x0000000000000006,nolazytime,nobarrier,,errors=continue [ 83.533095][ T2079] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 83.560189][ T2079] EXT4-fs (loop2): mounting ext2 file system using the ext4 subsystem [ 83.581834][ T9] EXT4-fs error (device loop1): ext4_release_dquot:6266: comm kworker/u4:1: Failed to release dquot type 0 [ 83.602246][ T2079] EXT4-fs (loop2): warning: mounting unchecked fs, running e2fsck is recommended [ 83.621300][ T2079] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a002e01c, mo2=0006] [ 83.635431][ T2090] usbcore.quirks: string doesn't fit in 127 chars. [ 83.642025][ T9] EXT4-fs error (device loop1): ext4_map_blocks:632: inode #3: block 1: comm kworker/u4:1: lblock 1 mapped to illegal pblock 1 (length 1) [ 83.652719][ T2091] netlink: 8 bytes leftover after parsing attributes in process `syz.4.626'. [ 83.657269][ T2079] System zones: 0-2, 18-18, 34-35 [ 83.670262][ T9] EXT4-fs error (device loop1): ext4_release_dquot:6266: comm kworker/u4:1: Failed to release dquot type 0 [ 83.696464][ T2082] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.703533][ T2082] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.711543][ T2079] EXT4-fs (loop2): mounted filesystem without journal. Opts: block_validity,,errors=continue [ 83.722645][ T2082] device bridge_slave_0 entered promiscuous mode [ 83.732227][ T2082] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.740678][ T2079] fscrypt (loop2, inode 12): Error -61 getting encryption context [ 83.748616][ T2082] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.749922][ T2082] device bridge_slave_1 entered promiscuous mode [ 83.811838][ T2082] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.818940][ T2082] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.826256][ T2082] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.833298][ T2082] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.861456][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 83.869220][ T306] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.882930][ T306] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.904808][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 83.913268][ T306] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.920367][ T306] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.927982][ T2103] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 83.929821][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 83.946933][ T306] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.953995][ T306] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.961775][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 83.970024][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 83.986460][ T300] device bridge_slave_1 left promiscuous mode [ 83.997185][ T2103] EXT4-fs (loop1): 1 truncate cleaned up [ 84.003069][ T2103] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 84.015658][ T300] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.028168][ T300] device bridge_slave_0 left promiscuous mode [ 84.034380][ T300] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.043149][ T300] device veth1_macvtap left promiscuous mode [ 84.049364][ T300] device veth0_vlan left promiscuous mode [ 84.166609][ T2082] device veth0_vlan entered promiscuous mode [ 84.198633][ T2082] device veth1_macvtap entered promiscuous mode [ 84.239170][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 84.269573][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 84.286551][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 84.301248][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 84.322574][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 85.218993][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 85.227906][ T2117] : renamed from bond_slave_0 [ 85.297791][ T2125] device syzkaller0 entered promiscuous mode [ 85.312253][ T2126] EXT4-fs (loop0): inodes count not valid: 2 vs 32 [ 85.356172][ T2129] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 85.397400][ T2129] EXT4-fs (loop1): re-mounted. Opts: jqfmt=vfsold,usrjquota="errors=continue,noload,data_err=ignore,usrjquota="errors=continue,noinit_itable,noblock_validity, [ 85.513000][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 85.522167][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 85.648425][ T2145] netlink: 'syz.0.643': attribute type 1 has an invalid length. [ 85.656265][ T2144] xt_TCPMSS: Only works on TCP SYN packets [ 85.685487][ T2145] netlink: 12 bytes leftover after parsing attributes in process `syz.0.643'. [ 85.737750][ T2159] device veth0 entered promiscuous mode [ 85.755728][ T2159] device veth0 left promiscuous mode [ 85.847009][ T2188] netlink: 4 bytes leftover after parsing attributes in process `syz.1.660'. [ 85.874633][ T2193] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 85.892755][ T24] kauditd_printk_skb: 28 callbacks suppressed [ 85.892768][ T24] audit: type=1400 audit(1785961734.973:384): avc: denied { create } for pid=2194 comm="syz.1.666" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 85.965767][ T24] audit: type=1400 audit(1785961734.983:385): avc: denied { create } for pid=2195 comm="syz.4.665" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 86.019963][ T24] audit: type=1400 audit(1785961735.003:386): avc: denied { setopt } for pid=2195 comm="syz.4.665" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 86.075801][ T24] audit: type=1400 audit(1785961735.033:387): avc: denied { map } for pid=2199 comm="syz.5.668" path="socket:[34853]" dev="sockfs" ino=34853 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 86.100387][ T2225] netlink: 'syz.0.680': attribute type 6 has an invalid length. [ 86.144470][ T24] audit: type=1400 audit(1785961735.093:388): avc: denied { write } for pid=2214 comm="syz.0.675" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 86.204710][ T24] audit: type=1400 audit(1785961735.283:389): avc: denied { connect } for pid=2237 comm="syz.5.686" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 86.429078][ T24] audit: type=1400 audit(1785961735.493:390): avc: denied { sys_module } for pid=2254 comm="syz.5.694" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 86.467678][ T2267] netlink: 104 bytes leftover after parsing attributes in process `syz.1.697'. [ 86.568735][ T24] audit: type=1400 audit(1785961735.643:391): avc: denied { getopt } for pid=2277 comm="syz.1.704" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 86.634659][ T2284] capability: warning: `syz.2.707' uses deprecated v2 capabilities in a way that may be insecure [ 86.700143][ T2302] netlink: 8 bytes leftover after parsing attributes in process `syz.1.714'. [ 86.833604][ T24] audit: type=1400 audit(1785961735.903:392): avc: denied { associate } for pid=2314 comm="syz.5.722" name="file0" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 86.916635][ T2321] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue [ 86.927494][ T24] audit: type=1400 audit(1785961736.013:393): avc: denied { create } for pid=2320 comm="syz.5.725" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 87.118421][ T2342] EXT4-fs (loop1): Unrecognized mount option "mb_optimize_scan=0x0000000000000001" or missing value [ 87.202492][ T2365] netlink: 96 bytes leftover after parsing attributes in process `syz.2.744'. [ 87.363690][ T2391] netlink: 4 bytes leftover after parsing attributes in process `syz.1.756'. [ 88.218741][ T2439] EXT4-fs error (device loop2): ext4_xattr_inode_iget:401: inode #2: comm syz.2.776: missing EA_INODE flag [ 88.230495][ T2439] EXT4-fs error (device loop2): ext4_xattr_inode_iget:406: comm syz.2.776: error while reading EA inode 2 err=-117 [ 88.242902][ T2439] EXT4-fs (loop2): 1 orphan inode deleted [ 88.248725][ T2439] EXT4-fs (loop2): mounted filesystem without journal. Opts: nombcache,nogrpid,,errors=continue [ 88.356697][ T2453] netlink: 8 bytes leftover after parsing attributes in process `syz.2.782'. [ 88.365859][ T2453] netlink: 8 bytes leftover after parsing attributes in process `syz.2.782'. [ 88.535201][ T2463] loop1: p1 p2 p4 [ 88.539938][ T2463] loop1: p4 start 167772160 is beyond EOD, truncated [ 88.560591][ T2483] netlink: 4 bytes leftover after parsing attributes in process `syz.2.796'. [ 88.656584][ T309] udevd[309]: inotify_add_watch(7, /dev/loop1p2, 10) failed: No such file or directory [ 88.659744][ T343] udevd[343]: inotify_add_watch(7, /dev/loop1p1, 10) failed: No such file or directory [ 88.714013][ T2497] netlink: 44 bytes leftover after parsing attributes in process `syz.4.802'. [ 88.736352][ T2497] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 88.877622][ T2512] EXT4-fs (loop4): Ignoring removed nomblk_io_submit option [ 88.887878][ T2512] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 88.914651][ T2512] EXT4-fs (loop4): orphan cleanup on readonly fs [ 88.944941][ T2512] EXT4-fs error (device loop4): __ext4_get_inode_loc:4451: comm syz.4.810: Invalid inode table block 0 in block_group 0 [ 88.959278][ T2512] EXT4-fs (loop4): Remounting filesystem read-only [ 88.965844][ T2512] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5971: Corrupt filesystem [ 88.975443][ T2512] EXT4-fs error (device loop4): ext4_quota_write:6655: inode #3: comm syz.4.810: mark_inode_dirty error [ 88.987504][ T2512] EXT4-fs error (device loop4): ext4_acquire_dquot:6230: comm syz.4.810: Failed to acquire dquot type 0 [ 88.999122][ T2512] EXT4-fs (loop4): 1 truncate cleaned up [ 89.005108][ T2512] EXT4-fs (loop4): mounted filesystem without journal. Opts: max_dir_size_kb=0x00000000000001ff,grpid,grpid,errors=remount-ro,bsddf,noload,minixdf,nomblk_io_submit, [ 89.035472][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 89.059008][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 89.071703][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 89.082151][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 89.091117][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 89.099494][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 89.107898][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 89.116262][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 89.253483][ T2522] EXT4-fs (loop2): mounted filesystem without journal. Opts: usrquota,nodelalloc,,errors=continue [ 89.265465][ T2522] ext4 filesystem being mounted at /157/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 89.528797][ T2557] EXT4-fs (loop2): mounting ext2 file system using the ext4 subsystem [ 89.560677][ T2563] x_tables: arp_tables: NFLOG target: not valid for this family [ 89.572486][ T2557] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 89.588395][ T373] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 89.600761][ T373] hid-generic 0000:0000:0000.0009: hidraw0: HID v0.00 Device [syz1] on syz0 [ 89.606607][ T2557] ext2 filesystem being mounted at /165/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 89.656867][ T2572] fido_id[2572]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 89.789747][ T2578] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 89.801922][ T2578] EXT4-fs (loop1): orphan cleanup on readonly fs [ 89.808607][ T2578] EXT4-fs warning (device loop1): ext4_enable_quotas:6495: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 89.823317][ T2578] EXT4-fs (loop1): Cannot turn on quotas: error -117 [ 89.846523][ T2578] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.840: bg 0: block 40: padding at end of block bitmap is not set [ 89.861045][ T2578] EXT4-fs (loop1): Remounting filesystem read-only [ 89.867845][ T2578] EXT4-fs error (device loop1) in ext4_mb_clear_bb:5650: Corrupt filesystem [ 89.883356][ T2590] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 89.908461][ T2578] EXT4-fs (loop1): 1 truncate cleaned up [ 89.922022][ T2597] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=39 sclass=netlink_xfrm_socket pid=2597 comm=syz.4.846 [ 89.923444][ T2590] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 89.941343][ T2578] EXT4-fs (loop1): mounted filesystem without journal. Opts: barrier=0x00000000000000ad,errors=remount-ro,journal_dev=0x0000000000000000,noinit_itable, [ 89.964998][ T2590] EXT4-fs (loop2): 1 truncate cleaned up [ 89.970688][ T2590] EXT4-fs (loop2): mounted filesystem without journal. Opts: init_itable=0x0000000000000000,dioread_nolock,debug_want_extra_isize=0x000000000000006a,jqfmt=vfsold,bsdgroups,grpjquota=,,errors=continue [ 90.128714][ T2612] netlink: 'syz.2.852': attribute type 8 has an invalid length. [ 90.355798][ T2638] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 90.366212][ T2638] ext4 filesystem being mounted at /179/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 90.408527][ T2650] ip_tunnel: non-ECT from 0.0.224.0 with TOS=0x3 [ 90.783155][ T2682] size and base must be multiples of 4 kiB [ 90.802308][ T2682] CPU: 0 PID: 2682 Comm: syz.2.884 Tainted: G W syzkaller #0 [ 90.811046][ T2682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 90.821117][ T2682] Call Trace: [ 90.824428][ T2682] __dump_stack+0x21/0x24 [ 90.828781][ T2682] dump_stack_lvl+0x1a7/0x208 [ 90.833485][ T2682] ? thaw_kernel_threads+0x220/0x220 [ 90.838793][ T2682] ? do_vfs_ioctl+0x1403/0x15d0 [ 90.843672][ T2682] ? show_regs_print_info+0x18/0x18 [ 90.848885][ T2682] ? __ia32_compat_sys_ioctl+0x8c0/0x8c0 [ 90.854541][ T2682] ? has_cap_mac_admin+0x370/0x370 [ 90.859677][ T2682] dump_stack+0x15/0x1c [ 90.863847][ T2682] mtrr_add+0xa1/0xb0 [ 90.867846][ T2682] mtrr_ioctl+0x8e8/0xf90 [ 90.872194][ T2682] ? mtrr_close+0x1f0/0x1f0 [ 90.876720][ T2682] ? selinux_file_ioctl+0x3ad/0x4c0 [ 90.881933][ T2682] ? putname+0xa0/0x150 [ 90.886111][ T2682] ? do_sys_openat2+0x68e/0x750 [ 90.890986][ T2682] ? __fget_files+0x2e1/0x340 [ 90.895683][ T2682] ? mtrr_close+0x1f0/0x1f0 [ 90.900207][ T2682] proc_reg_unlocked_ioctl+0x1c6/0x2b0 [ 90.905688][ T2682] ? proc_reg_poll+0x290/0x290 [ 90.910472][ T2682] __se_sys_ioctl+0x121/0x1a0 [ 90.915162][ T2682] __x64_sys_ioctl+0x7b/0x90 [ 90.919771][ T2682] do_syscall_64+0x31/0x40 [ 90.924206][ T2682] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 90.930114][ T2682] RIP: 0033:0x7f7c5a3340d9 [ 90.934543][ T2682] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.954167][ T2682] RSP: 002b:00007f7c58d8d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 90.962596][ T2682] RAX: ffffffffffffffda RBX: 00007f7c5a5bbfa0 RCX: 00007f7c5a3340d9 [ 90.970584][ T2682] RDX: 0000200000000900 RSI: 00000000400c4d01 RDI: 0000000000000003 [ 90.978570][ T2682] RBP: 00007f7c5a3cb024 R08: 0000000000000000 R09: 0000000000000000 [ 90.986566][ T2682] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 90.994555][ T2682] R13: 00007f7c5a5bc038 R14: 00007f7c5a5bbfa0 R15: 00007ffe70d89988 [ 91.294447][ T2676] FAT-fs (loop5): Unrecognized mount option "i9mtail=0" or missing value [ 91.343014][ T24] kauditd_printk_skb: 37 callbacks suppressed [ 91.343030][ T24] audit: type=1400 audit(1785961740.413:428): avc: denied { mount } for pid=2689 comm="syz.2.888" name="/" dev="configfs" ino=13716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 91.372896][ T24] audit: type=1400 audit(1785961740.453:429): avc: denied { search } for pid=2689 comm="syz.2.888" name="/" dev="configfs" ino=13716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 91.396224][ T24] audit: type=1400 audit(1785961740.483:430): avc: denied { write } for pid=2689 comm="syz.2.888" name="in_ports" dev="configfs" ino=35624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 91.478876][ T24] audit: type=1400 audit(1785961740.503:431): avc: denied { open } for pid=2689 comm="syz.2.888" path="/183/config/usb_gadget/g1/functions/midi.usb0/in_ports" dev="configfs" ino=35624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 91.553027][ T24] audit: type=1400 audit(1785961740.513:432): avc: denied { read } for pid=2689 comm="syz.2.888" name="in_ports" dev="configfs" ino=35624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 91.582070][ T24] audit: type=1400 audit(1785961740.533:433): avc: denied { unmount } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 91.903993][ T2726] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=2726 comm=syz.4.902 [ 92.085760][ T2734] EXT4-fs (loop1): Ignoring removed orlov option [ 92.123429][ T2734] EXT4-fs (loop1): mounted filesystem without journal. Opts: block_validity,bsddf,sysvgroups,norecovery,debug_want_extra_isize=0x0000000000000080,orlov,nogrpid,noauto_da_alloc,norecovery,,errors=continue [ 92.189672][ T24] audit: type=1400 audit(1785961741.263:434): avc: denied { rename } for pid=2732 comm="syz.1.905" name="file0" dev="loop1" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 92.261246][ T24] audit: type=1400 audit(1785961741.283:435): avc: denied { unlink } for pid=2732 comm="syz.1.905" name="file1" dev="loop1" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 92.537645][ T2786] attempt to access beyond end of device [ 92.537645][ T2786] loop0: rw=2049, want=140, limit=128 [ 92.560955][ T2786] attempt to access beyond end of device [ 92.560955][ T2786] loop0: rw=2049, want=140, limit=128 [ 92.582066][ T2786] Buffer I/O error on dev loop0, logical block 69, lost async page write [ 93.141221][ T2815] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=2815 comm=syz.0.940 [ 93.245455][ T24] audit: type=1400 audit(1785961742.323:436): avc: denied { bind } for pid=2823 comm="syz.0.944" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 93.386429][ T2828] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue [ 93.395514][ T2828] ext4 filesystem being mounted at /53/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 93.500039][ T24] audit: type=1400 audit(1785961742.573:437): avc: denied { lock } for pid=2844 comm="syz.1.952" path="socket:[36900]" dev="sockfs" ino=36900 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 93.527525][ T2848] netlink: 'syz.1.954': attribute type 14 has an invalid length. [ 93.536922][ T2842] tipc: Started in network mode [ 93.541938][ T2842] tipc: Own node identity 3, cluster identity 4711 [ 93.559480][ T2842] tipc: 32-bit node address hash set to 3 [ 93.567076][ T2842] tipc: Cannot configure node identity twice [ 93.622172][ T2845] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -2 [ 93.631699][ T2845] EXT4-fs error (device loop0): ext4_iget_extra_inode:4692: inode #15: comm syz.0.951: corrupted in-inode xattr [ 93.644340][ T2845] EXT4-fs error (device loop0): ext4_orphan_get:1406: comm syz.0.951: couldn't read orphan inode 15 (err -117) [ 93.656317][ T2845] EXT4-fs (loop0): mounted filesystem without journal. Opts: min_batch_time=0x0000000000000009,jqfmt=vfsv0,min_batch_time=0x00000000000003ff,noload,grpjquota=.,noblock_validity,resgid=0x0000000000000000,nobarrier,errors=continue,,errors=continue [ 93.694598][ T2861] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 93.709698][ T2861] FAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 93.864763][ T2888] netlink: 8 bytes leftover after parsing attributes in process `syz.5.973'. [ 93.897828][ T2882] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 93.914392][ T2888] netlink: 'syz.5.973': attribute type 1 has an invalid length. [ 93.936842][ T2882] ext4 filesystem being mounted at /216/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 93.949209][ T2882] EXT4-fs (loop4): shut down requested (2) [ 93.975186][ T2882] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 93.984536][ T2882] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 94.270984][ T2950] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 94.284007][ T2950] ext4 filesystem being mounted at /198/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 94.566100][ T3007] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1025'. [ 94.630609][ T3010] : renamed from team_slave_1 [ 94.747180][ T3018] device batadv_slave_1 entered promiscuous mode [ 94.767307][ T3013] device batadv_slave_1 left promiscuous mode [ 94.813629][ T3024] netlink: 84 bytes leftover after parsing attributes in process `syz.5.1033'. [ 94.892001][ T3028] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 94.936700][ T3028] EXT4-fs (loop0): mounted filesystem without journal. Opts: discard,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x0000000000000080,delalloc,nogrpid,noauto_da_alloc,dioread_nolock,,errors=continue [ 95.092476][ T3051] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 95.112637][ T3051] ext4 filesystem being mounted at /219/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 95.162518][ T3069] EXT4-fs (loop4): Unrecognized mount option "mb_optimize_scan=0x0000000000000001" or missing value [ 95.539793][ T3101] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 95.555500][ T3101] EXT4-fs (loop2): mounted filesystem without journal. Opts: init_itable=0x0000000000000006,bsddf,nojournal_checksum,norecovery,dioread_nolock,grpjquota=,noauto_da_alloc,acl,auto_da_alloc=0x0000000000000343,,errors=continue [ 95.616911][ T3110] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=3110 comm=syz.5.1070 [ 95.708026][ T3118] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1074'. [ 95.874921][ T3128] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 95.956728][ T3141] logitech-hidpp-device 0005:046D:B012.000A: received hid++ report of bad size (4) [ 95.967281][ T3141] logitech-hidpp-device 0005:046D:B012.000A: Event data for report 17 was too short (19 vs 3) [ 95.978052][ T3141] logitech-hidpp-device 0005:046D:B012.000A: received hid++ report of bad size (4) [ 95.987795][ T3141] logitech-hidpp-device 0005:046D:B012.000A: Event data for report 17 was too short (19 vs 3) [ 95.998587][ T5] logitech-hidpp-device 0005:046D:B012.000A: Device not connected [ 96.000394][ T3144] ip_tables: iptables: counters copy to user failed while replacing table [ 96.062849][ T3153] PM: suspend entry (deep) [ 96.186691][ T3153] Filesystems sync: 0.119 seconds [ 96.191964][ T3153] Freezing user space processes ... (elapsed 0.014 seconds) done. [ 96.214564][ T3153] OOM killer disabled. [ 96.218624][ T3153] Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done. [ 96.228244][ T3153] printk: Suspending console(s) (use no_console_suspend to debug) [ 96.237775][ T3153] PM: dpm_run_callback(): platform_pm_suspend+0x0/0xf0 returns -16 [ 96.237794][ T3153] alarmtimer alarmtimer.0.auto: PM: failed to suspend: error -16 [ 96.237799][ T3153] PM: Some devices failed to suspend, or early wake event detected [ 96.309803][ T3153] OOM killer enabled. [ 96.313780][ T3153] Restarting tasks ... done. [ 96.524222][ T3153] Abort: Device alarmtimer.0.auto failed to suspend: error -16 [ 96.539812][ T3153] PM: suspend exit [ 96.614313][ T3165] EXT4-fs error (device loop2): ext4_orphan_get:1401: inode #15: comm syz.2.1094: inode has both inline data and extents flags [ 96.628315][ T3165] EXT4-fs error (device loop2): ext4_orphan_get:1406: comm syz.2.1094: couldn't read orphan inode 15 (err -117) [ 96.640620][ T3165] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,,errors=continue [ 96.674605][ T3169] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 96.719182][ T3169] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=8802c01c, mo2=0002] [ 96.729308][ T3169] EXT4-fs (loop4): orphan cleanup on readonly fs [ 96.736535][ T3169] EXT4-fs error (device loop4): ext4_orphan_get:1401: inode #13: comm syz.4.1096: iget: bad i_size value: 12154761577498 [ 96.750038][ T3169] EXT4-fs error (device loop4): ext4_orphan_get:1406: comm syz.4.1096: couldn't read orphan inode 13 (err -117) [ 96.763549][ T3169] EXT4-fs (loop4): mounted filesystem without journal. Opts: commit=0x0000000000000000,noblock_validity,user_xattr,,errors=continue [ 96.783961][ T3169] EXT4-fs warning (device loop4): dx_probe:860: inode #2: comm syz.4.1096: dx entry: limit 65535 != root limit 120 [ 96.799300][ T3169] EXT4-fs warning (device loop4): dx_probe:946: inode #2: comm syz.4.1096: Corrupt directory, running e2fsck is recommended [ 97.060108][ T24] kauditd_printk_skb: 10 callbacks suppressed [ 97.060121][ T24] audit: type=1400 audit(1785962002.142:448): avc: denied { write } for pid=3194 comm="syz.0.1106" name="functions" dev="configfs" ino=15971 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 97.096465][ T24] audit: type=1400 audit(1785962002.172:449): avc: denied { remove_name } for pid=3194 comm="syz.0.1106" name="uvc.usb0" dev="configfs" ino=15977 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 97.120206][ T24] audit: type=1400 audit(1785962002.172:450): avc: denied { rmdir } for pid=3194 comm="syz.0.1106" name="uvc.usb0" dev="configfs" ino=15977 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 97.158207][ T3201] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1109'. [ 97.221811][ T3195] EXT4-fs (loop5): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 97.285985][ T3195] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 97.310006][ T3210] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=95 sclass=netlink_route_socket pid=3210 comm=syz.0.1114 [ 97.324974][ T3195] EXT4-fs (loop5): 1 truncate cleaned up [ 97.330655][ T3195] EXT4-fs (loop5): mounted filesystem without journal. Opts: init_itable=0x0000000000000000,dioread_nolock,debug_want_extra_isize=0x000000000000006a,jqfmt=vfsold,bsdgroups,inode_readahead_blks=0x0000000000100000,,errors=continue [ 97.503658][ T3221] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1118'. [ 97.630484][ T3237] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.637881][ T3237] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.647555][ T3237] device bridge_slave_1 left promiscuous mode [ 97.654759][ T3237] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.662536][ T3237] device bridge_slave_0 left promiscuous mode [ 97.670267][ T3232] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 97.684388][ T3237] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.974010][ T24] audit: type=1326 audit(1785962003.052:451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3276 comm="syz.2.1141" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7c5a3340d9 code=0x7ffc0000 [ 98.055233][ T24] audit: type=1326 audit(1785962003.052:452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3276 comm="syz.2.1141" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7c5a3340d9 code=0x7ffc0000 [ 98.100328][ T3280] EXT4-fs (loop5): Ignoring removed nobh option [ 98.123999][ T24] audit: type=1326 audit(1785962003.082:453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3276 comm="syz.2.1141" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7c5a3340d9 code=0x7ffc0000 [ 98.150469][ T3280] EXT4-fs (loop5): mounted filesystem without journal. Opts: nobh,max_dir_size_kb=0x0000000000000004,,errors=continue [ 98.163412][ T3280] ext4 filesystem being mounted at /110/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 98.174632][ T24] audit: type=1326 audit(1785962003.082:454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3276 comm="syz.2.1141" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7c5a3340d9 code=0x7ffc0000 [ 98.200463][ T24] audit: type=1326 audit(1785962003.082:455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3276 comm="syz.2.1141" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f7c5a3340d9 code=0x7ffc0000 [ 98.344200][ T24] audit: type=1326 audit(1785962003.082:456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3276 comm="syz.2.1141" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f7c5a333e42 code=0x7ffc0000 [ 98.394220][ T24] audit: type=1326 audit(1785962003.082:457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3276 comm="syz.2.1141" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f7c5a2f490e code=0x7ffc0000 [ 98.506711][ T3289] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 98.525061][ T3289] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 98.534586][ T3289] EXT4-fs (loop2): 1 truncate cleaned up [ 98.540259][ T3289] EXT4-fs (loop2): mounted filesystem without journal. Opts: noblock_validity,dioread_nolock,errors=remount-ro,minixdf,jqfmt=vfsv0,usrjquota=." [ 98.605344][ T3289] EXT4-fs (loop2): shut down requested (2) [ 98.729360][ T3307] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3307 comm=syz.1.1154 [ 98.753826][ C0] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 98.773979][ C0] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 98.784915][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 98.793770][ C0] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 98.804682][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 98.812764][ C0] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 98.823670][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 98.831700][ C0] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 98.842596][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 98.850652][ C0] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 98.861554][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 99.014283][ T3340] capability: warning: `syz.4.1169' uses 32-bit capabilities (legacy support in use) [ 99.048296][ T3346] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 99.061192][ T3346] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 99.070331][ T3346] EXT4-fs (loop1): warning: mounting unchecked fs, running e2fsck is recommended [ 99.081416][ T3346] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a002e01c, mo2=0006] [ 99.089502][ T3346] System zones: 0-2, 18-18, 34-35 [ 99.099206][ T3346] EXT4-fs (loop1): mounted filesystem without journal. Opts: block_validity,,errors=continue [ 99.155217][ T3358] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 99.189525][ T3358] EXT4-fs (loop0): mounted filesystem without journal. Opts: discard,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x0000000000000080,delalloc,nogrpid,noauto_da_alloc,dioread_nolock,,errors=continue [ 99.287891][ T3391] netlink: 112 bytes leftover after parsing attributes in process `syz.0.1188'. [ 99.301765][ T3391] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1188'. [ 99.365561][ T3393] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 99.381445][ T3384] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 99.395079][ T3384] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 1 overlaps superblock [ 99.413695][ T3384] EXT4-fs (loop1): group descriptors corrupted! [ 99.421087][ T3393] EXT4-fs (loop4): mounted filesystem without journal. Opts: discard,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x0000000000000080,delalloc,nogrpid,noauto_da_alloc,dioread_nolock,,errors=continue [ 99.526148][ T3419] EXT4-fs (loop1): mounted filesystem without journal. Opts: lazytime,resgid=0x0000000000000000,,errors=continue [ 99.538131][ T3419] ext4 filesystem being mounted at /241/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 99.671280][ T3440] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.678559][ T3440] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.755584][ T3451] EXT4-fs (loop2): mounted filesystem without journal. Opts: errors=remount-ro,grpquota, [ 99.765557][ T3451] ext4 filesystem being mounted at /242/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 99.985703][ T3482] EXT4-fs (loop5): Quota format mount options ignored when QUOTA feature is enabled [ 99.995381][ T3482] EXT4-fs (loop5): Ignoring removed nomblk_io_submit option [ 100.002851][ T3482] EXT4-fs (loop5): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 100.015471][ T3482] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 100.023641][ T3482] System zones: 0-1, 3-36 [ 100.029551][ T3482] EXT4-fs (loop5): mounted filesystem without journal. Opts: grpquota,jqfmt=vfsold,resuid=0x0000000000000000,debug,dioread_nolock,bsddf,nomblk_io_submit,noauto_da_alloc,,errors=continue [ 100.213240][ T3511] device syzkaller0 entered promiscuous mode [ 100.220590][ T3511] tipc: Started in network mode [ 100.225708][ T3511] tipc: Own node identity a22db9f201bc, cluster identity 4711 [ 100.233350][ T3511] tipc: Enabled bearer , priority 0 [ 100.241631][ T3511] tipc: Resetting bearer [ 100.253443][ T3509] tipc: Resetting bearer [ 100.260019][ T3509] tipc: Disabling bearer [ 100.279164][ T3517] mmap: syz.1.1245 (3517) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 100.335926][ T282] FAT-fs (loop2): error, corrupted directory (invalid entries) [ 100.343777][ T282] FAT-fs (loop2): Filesystem has been set read-only [ 100.360906][ T282] FAT-fs (loop2): error, corrupted directory (invalid entries) [ 100.547089][ T3533] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.554552][ T3533] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.561961][ T3533] device bridge_slave_0 entered promiscuous mode [ 100.570812][ T3533] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.578236][ T3533] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.588874][ T3533] device bridge_slave_1 entered promiscuous mode [ 100.614227][ T52] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 100.640048][ T3533] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.647126][ T3533] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.654488][ T3533] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.661522][ T3533] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.677046][ T3544] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 100.691467][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 100.702208][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.711253][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.718744][ T2260] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 100.731416][ T2260] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 100.739801][ T2260] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.746892][ T2260] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.767605][ T2260] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 100.775994][ T2260] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.783065][ T2260] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.793307][ T2260] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 100.809210][ T2260] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 100.823726][ T2260] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 100.833833][ T306] device veth1_macvtap left promiscuous mode [ 100.840207][ T306] device veth0_vlan left promiscuous mode [ 100.894262][ T52] usb 2-1: device descriptor read/64, error -71 [ 100.930193][ T3533] device veth0_vlan entered promiscuous mode [ 100.941751][ T2260] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 100.950044][ T2260] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 100.962262][ T2260] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 100.976613][ T3533] device veth1_macvtap entered promiscuous mode [ 100.984118][ T2260] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 100.997335][ T2260] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 101.006953][ T2260] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 101.017064][ T3553] EXT4-fs (loop0): mounted filesystem without journal. Opts: nodioread_nolock,sb=0x0000000000000001,,errors=continue [ 101.029613][ T3553] ext4 filesystem being mounted at /213/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 101.147105][ T3572] FAT-fs (loop6): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 101.174763][ T306] FAT-fs (loop6): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 101.247674][ T3578] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 101.284202][ T52] usb 2-1: device descriptor read/64, error -71 [ 101.373759][ T3596] EXT4-fs (loop4): mounted filesystem without journal. Opts: jqfmt=vfsold,noload,,errors=continue [ 101.385001][ T3596] ext4 filesystem being mounted at /274/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 101.444308][ T3612] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 101.554351][ T52] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 101.864192][ T52] usb 2-1: device descriptor read/64, error -71 [ 101.976486][ T3661] EXT4-fs (loop4): Ignoring removed mblk_io_submit option [ 101.990038][ T3661] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a80ee029, mo2=0002] [ 101.998207][ T3661] System zones: 1-12 [ 102.003252][ T3661] EXT4-fs error (device loop4): ext4_map_blocks:632: inode #11: block 10: comm syz.4.1305: lblock 0 mapped to illegal pblock 10 (length 1) [ 102.018499][ T3661] EXT4-fs (loop4): Remounting filesystem read-only [ 102.025509][ T3661] EXT4-fs error (device loop4) in ext4_evict_inode:260: Readonly filesystem [ 102.034858][ T3661] EXT4-fs (loop4): 1 orphan inode deleted [ 102.040694][ T3661] EXT4-fs (loop4): mounted filesystem without journal. Opts: nodioread_nolock,errors=remount-ro,debug_want_extra_isize=0x000000000000005a,nouid32,debug,nombcache,resgid=0x0000000000000000,user_xattr,block_validity,usrquota,mblk_io_submit, [ 102.074668][ T3661] EXT4-fs (loop4): shut down requested (2) [ 102.080954][ T3661] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 102.089906][ T3661] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 102.099649][ T3661] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 102.108522][ T3661] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 102.117378][ T3661] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 102.126195][ T3661] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 102.274378][ T52] usb 2-1: device descriptor read/64, error -71 [ 102.278401][ T3683] EXT4-fs (loop6): mounted filesystem without journal. Opts: discard,data_err=ignore,init_itable,quota,abort,,errors=continue [ 102.394490][ T52] usb usb2-port1: attempt power cycle [ 102.443045][ T24] kauditd_printk_skb: 61 callbacks suppressed [ 102.443059][ T24] audit: type=1400 audit(1785962007.522:519): avc: denied { ioctl } for pid=3697 comm="syz.0.1319" path="socket:[40200]" dev="sockfs" ino=40200 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 102.546498][ T3709] EXT4-fs (loop6): Ignoring removed mblk_io_submit option [ 102.559957][ T3709] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a80ee029, mo2=0002] [ 102.568152][ T3709] System zones: 1-12 [ 102.572876][ T3709] EXT4-fs error (device loop6): ext4_map_blocks:632: inode #11: block 10: comm syz.6.1321: lblock 0 mapped to illegal pblock 10 (length 1) [ 102.587423][ T3709] EXT4-fs (loop6): Remounting filesystem read-only [ 102.594082][ T3709] EXT4-fs error (device loop6) in ext4_evict_inode:260: Readonly filesystem [ 102.603205][ T3709] EXT4-fs (loop6): 1 orphan inode deleted [ 102.609000][ T3709] EXT4-fs (loop6): mounted filesystem without journal. Opts: nodioread_nolock,errors=remount-ro,debug_want_extra_isize=0x000000000000005a,nouid32,debug,nombcache,resgid=0x0000000000000000,user_xattr,block_validity,usrquota,mblk_io_submit, [ 102.637344][ T3709] EXT4-fs (loop6): shut down requested (2) [ 102.643537][ T3709] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop6 ino=12 [ 102.652491][ T3709] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop6 ino=12 [ 102.661955][ T3709] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop6 ino=12 [ 102.671009][ T3709] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop6 ino=12 [ 102.679847][ T3709] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop6 ino=12 [ 102.688698][ T3709] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop6 ino=12 [ 102.804226][ T52] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 102.960582][ T3716] EXT4-fs (loop0): Unrecognized mount option "appraise" or missing value [ 102.984301][ T52] usb 2-1: device descriptor read/8, error -71 [ 103.284419][ T52] usb 2-1: device descriptor read/8, error -71 [ 103.381843][ T3730] EXT4-fs (loop4): mounted filesystem without journal. Opts: discard,data_err=ignore,init_itable,quota,abort,,errors=continue [ 103.433678][ T3739] EXT4-fs (loop1): Ignoring removed orlov option [ 103.455456][ T3739] EXT4-fs (loop1): mounted filesystem without journal. Opts: block_validity,bsddf,sysvgroups,norecovery,debug_want_extra_isize=0x0000000000000080,orlov,nogrpid,noauto_da_alloc,norecovery,,errors=continue [ 103.525500][ T3748] EXT4-fs (loop0): Ignoring removed bh option [ 103.550336][ T3748] EXT4-fs error (device loop0): ext4_map_blocks:742: inode #3: block 1: comm syz.0.1336: lblock 1 mapped to illegal pblock 1 (length 1) [ 103.576050][ T3748] Quota error (device loop0): write_blk: dquota write failed [ 103.586500][ T3748] Quota error (device loop0): qtree_write_dquot: Error -117 occurred while creating quota [ 103.596547][ T3748] EXT4-fs error (device loop0): ext4_acquire_dquot:6230: comm syz.0.1336: Failed to acquire dquot type 0 [ 103.608073][ T3748] EXT4-fs error (device loop0): ext4_free_blocks:5690: comm syz.0.1336: Freeing blocks not in datazone - block = 0, count = 4096 [ 103.621872][ T3748] EXT4-fs error (device loop0): ext4_read_inode_bitmap:140: comm syz.0.1336: Invalid inode bitmap blk 0 in block_group 0 [ 103.625064][ T306] EXT4-fs error (device loop0): ext4_map_blocks:632: inode #3: block 1: comm kworker/u4:4: lblock 1 mapped to illegal pblock 1 (length 1) [ 103.635111][ T3748] EXT4-fs error (device loop0) in ext4_free_inode:360: Corrupt filesystem [ 103.657715][ T3748] EXT4-fs (loop0): 1 orphan inode deleted [ 103.663473][ T3748] EXT4-fs (loop0): mounted filesystem without journal. Opts: ; dioread_lock,min_batch_time=0x0000000000000008,norecovery,delalloc,nodiscard,inlinecrypt,bh,,errors=continue [ 103.681142][ T306] Quota error (device loop0): remove_tree: Can't read quota data block 1 [ 103.689630][ T306] EXT4-fs error (device loop0): ext4_release_dquot:6266: comm kworker/u4:4: Failed to release dquot type 0 [ 103.706009][ T3762] EXT4-fs (loop4): Unrecognized mount option "mb_optimize_scan=0x0000000000000000" or missing value [ 103.730503][ T3767] usb usb7: usbfs: process 3767 (syz.1.1342) did not claim interface 0 before use [ 103.742087][ T3748] EXT4-fs (loop0): re-mounted. Opts: (null) [ 103.814753][ T24] audit: type=1400 audit(1785962008.902:520): avc: denied { write } for pid=3760 comm="syz.4.1351" name="urandom" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 104.141065][ T3798] EXT4-fs (loop4): Ignoring removed bh option [ 104.154587][ T3798] EXT4-fs error (device loop4): ext4_map_blocks:742: inode #3: block 1: comm syz.4.1357: lblock 1 mapped to illegal pblock 1 (length 1) [ 104.168907][ T3798] Quota error (device loop4): write_blk: dquota write failed [ 104.176798][ T3798] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 104.187006][ T3798] EXT4-fs error (device loop4): ext4_acquire_dquot:6230: comm syz.4.1357: Failed to acquire dquot type 0 [ 104.199344][ T3798] EXT4-fs error (device loop4): ext4_free_blocks:5690: comm syz.4.1357: Freeing blocks not in datazone - block = 0, count = 4096 [ 104.213470][ T3798] EXT4-fs error (device loop4): ext4_read_inode_bitmap:140: comm syz.4.1357: Invalid inode bitmap blk 0 in block_group 0 [ 104.214490][ T306] EXT4-fs error (device loop4): ext4_map_blocks:632: inode #3: block 1: comm kworker/u4:4: lblock 1 mapped to illegal pblock 1 (length 1) [ 104.240652][ T3798] EXT4-fs error (device loop4) in ext4_free_inode:360: Corrupt filesystem [ 104.249385][ T306] Quota error (device loop4): remove_tree: Can't read quota data block 1 [ 104.249693][ T3798] EXT4-fs (loop4): 1 orphan inode deleted [ 104.263775][ T3798] EXT4-fs (loop4): mounted filesystem without journal. Opts: ; dioread_lock,min_batch_time=0x0000000000000008,norecovery,delalloc,nodiscard,inlinecrypt,bh,,errors=continue [ 104.264565][ T306] EXT4-fs error (device loop4): ext4_release_dquot:6266: comm kworker/u4:4: Failed to release dquot type 0 [ 104.339915][ T3798] EXT4-fs (loop4): re-mounted. Opts: (null) [ 104.385371][ T3806] usb usb7: usbfs: process 3806 (syz.0.1369) did not claim interface 0 before use [ 104.400439][ T3807] tipc: Enabling of bearer rejected, failed to enable media [ 105.472149][ T3828] EXT4-fs (loop6): Ignoring removed bh option [ 105.474826][ T3836] usb usb7: usbfs: process 3836 (syz.4.1372) did not claim interface 0 before use [ 105.499085][ T3828] EXT4-fs error (device loop6): ext4_map_blocks:742: inode #3: block 1: comm syz.6.1370: lblock 1 mapped to illegal pblock 1 (length 1) [ 105.513598][ T3828] Quota error (device loop6): write_blk: dquota write failed [ 105.521430][ T3828] Quota error (device loop6): qtree_write_dquot: Error -117 occurred while creating quota [ 105.531415][ T3828] EXT4-fs error (device loop6): ext4_acquire_dquot:6230: comm syz.6.1370: Failed to acquire dquot type 0 [ 105.544091][ T3828] EXT4-fs error (device loop6): ext4_free_blocks:5690: comm syz.6.1370: Freeing blocks not in datazone - block = 0, count = 4096 [ 105.562308][ T3828] EXT4-fs error (device loop6): ext4_read_inode_bitmap:140: comm syz.6.1370: Invalid inode bitmap blk 0 in block_group 0 [ 105.575191][ T112] EXT4-fs error (device loop6): ext4_map_blocks:632: inode #3: block 1: comm kworker/u4:2: lblock 1 mapped to illegal pblock 1 (length 1) [ 105.587665][ T3828] EXT4-fs error (device loop6) in ext4_free_inode:360: Corrupt filesystem [ 105.598294][ T3828] EXT4-fs (loop6): 1 orphan inode deleted [ 105.604056][ T3828] EXT4-fs (loop6): mounted filesystem without journal. Opts: ; dioread_lock,min_batch_time=0x0000000000000008,norecovery,delalloc,nodiscard,inlinecrypt,bh,,errors=continue [ 105.629096][ T112] EXT4-fs error (device loop6): ext4_release_dquot:6266: comm kworker/u4:2: Failed to release dquot type 0 [ 105.654303][ T3828] EXT4-fs (loop6): re-mounted. Opts: (null) [ 105.683229][ T3845] device syzkaller0 entered promiscuous mode [ 105.691065][ T3845] tipc: Started in network mode [ 105.712592][ T3845] tipc: Own node identity 5278a3c0c42b, cluster identity 4711 [ 105.750724][ T3845] tipc: Enabled bearer , priority 0 [ 105.758766][ T3843] tipc: Resetting bearer [ 105.765445][ T3843] tipc: Disabling bearer [ 107.100180][ T3881] EXT4-fs error (device loop0): ext4_xattr_inode_iget:401: inode #2: comm syz.0.1390: missing EA_INODE flag [ 107.135836][ T3881] EXT4-fs error (device loop0): ext4_xattr_inode_iget:406: comm syz.0.1390: error while reading EA inode 2 err=-117 [ 107.154235][ T3881] EXT4-fs (loop0): 1 orphan inode deleted [ 107.160083][ T3881] EXT4-fs (loop0): mounted filesystem without journal. Opts: nombcache,nogrpid,,errors=continue [ 107.207297][ T3887] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 107.216323][ T3887] ext4 filesystem being mounted at /264/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 107.279126][ T3909] device syzkaller0 entered promiscuous mode [ 107.310165][ T3887] EXT4-fs error (device loop1): ext4_xattr_block_get:543: inode #15: comm syz.1.1403: corrupted xattr block 33 [ 107.346712][ T3887] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 107.361391][ T3914] tipc: Enabled bearer , priority 0 [ 107.368138][ T3887] EXT4-fs error (device loop1): ext4_xattr_block_get:543: inode #15: comm syz.1.1403: corrupted xattr block 33 [ 107.382499][ T3906] tipc: Resetting bearer [ 107.386277][ T3887] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 107.397521][ T3887] EXT4-fs error (device loop1): ext4_xattr_block_get:543: inode #15: comm syz.1.1403: corrupted xattr block 33 [ 107.410353][ T3887] EXT4-fs error (device loop1): ext4_xattr_block_get:543: inode #15: comm syz.1.1403: corrupted xattr block 33 [ 107.410368][ T3906] tipc: Disabling bearer [ 107.410742][ T3887] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=15 [ 107.440134][ T3887] EXT4-fs error (device loop1): ext4_xattr_block_get:543: inode #15: comm syz.1.1403: corrupted xattr block 33 [ 107.454046][ T3887] fscrypt (loop1, inode 15): Error -117 getting encryption context [ 107.525828][ T3916] EXT4-fs (loop6): Ignoring removed bh option [ 107.553900][ T3916] EXT4-fs (loop6): feature flags set on rev 0 fs, running e2fsck is recommended [ 107.656340][ T3920] EXT4-fs error (device loop4): ext4_xattr_inode_iget:401: inode #2: comm syz.4.1408: missing EA_INODE flag [ 107.669349][ T3916] EXT4-fs warning (device loop6): ext4_update_dynamic_rev:1047: updating to rev 1 because of new feature flag, running e2fsck is recommended [ 107.675598][ T3920] EXT4-fs error (device loop4): ext4_xattr_inode_iget:406: comm syz.4.1408: error while reading EA inode 2 err=-117 [ 107.703375][ T3920] EXT4-fs (loop4): 1 orphan inode deleted [ 107.720397][ T3920] EXT4-fs (loop4): mounted filesystem without journal. Opts: nombcache,nogrpid,,errors=continue [ 107.721984][ T3916] EXT4-fs error (device loop6): ext4_validate_block_bitmap:438: comm syz.6.1406: bg 0: block 248: padding at end of block bitmap is not set [ 107.851943][ T3916] __quota_error: 2 callbacks suppressed [ 107.860074][ T3916] Quota error (device loop6): write_blk: dquota write failed [ 107.867824][ T3916] Quota error (device loop6): qtree_write_dquot: Error -28 occurred while creating quota [ 107.885013][ T3916] EXT4-fs error (device loop6): ext4_acquire_dquot:6230: comm syz.6.1406: Failed to acquire dquot type 1 [ 107.929257][ T3916] EXT4-fs (loop6): 1 truncate cleaned up [ 107.936366][ T3916] EXT4-fs (loop6): mounted filesystem without journal. Opts: bh,inlinecrypt,grpid,,errors=continue [ 108.871680][ T3954] device syzkaller0 entered promiscuous mode [ 108.879424][ T3954] tipc: Started in network mode [ 108.884606][ T3954] tipc: Own node identity a61da0186b5a, cluster identity 4711 [ 108.892235][ T3954] tipc: Enabled bearer , priority 0 [ 108.900643][ T3952] tipc: Resetting bearer [ 108.907499][ T3952] tipc: Disabling bearer [ 109.008789][ T3969] EXT4-fs (loop1): Ignoring removed bh option [ 109.017015][ T3969] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 109.061020][ T3969] EXT4-fs warning (device loop1): ext4_update_dynamic_rev:1047: updating to rev 1 because of new feature flag, running e2fsck is recommended [ 109.075963][ T3969] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.1428: bg 0: block 248: padding at end of block bitmap is not set [ 109.090774][ T3969] Quota error (device loop1): write_blk: dquota write failed [ 109.098477][ T3969] Quota error (device loop1): qtree_write_dquot: Error -28 occurred while creating quota [ 109.108408][ T3969] EXT4-fs error (device loop1): ext4_acquire_dquot:6230: comm syz.1.1428: Failed to acquire dquot type 1 [ 109.120337][ T3969] EXT4-fs (loop1): 1 truncate cleaned up [ 109.126038][ T3969] EXT4-fs (loop1): mounted filesystem without journal. Opts: bh,inlinecrypt,grpid,,errors=continue [ 109.506062][ T3984] EXT4-fs (loop6): mounted filesystem without journal. Opts: ,errors=continue [ 109.515237][ T3984] ext4 filesystem being mounted at /35/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 109.540391][ T3984] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.1432: corrupted xattr block 33 [ 109.552791][ T3984] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop6 ino=15 [ 109.561980][ T3984] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.1432: corrupted xattr block 33 [ 109.574981][ T3984] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop6 ino=15 [ 109.584063][ T3984] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.1432: corrupted xattr block 33 [ 109.596225][ T3984] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.1432: corrupted xattr block 33 [ 109.616163][ T3984] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop6 ino=15 [ 109.623229][ T3994] EXT4-fs (loop1): Unrecognized mount option "mb_optimize_scan=0x0000000000000000" or missing value [ 109.625604][ T3984] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.1432: corrupted xattr block 33 [ 109.648011][ T3984] fscrypt (loop6, inode 15): Error -117 getting encryption context [ 109.804793][ T4002] EXT4-fs (loop6): Ignoring removed oldalloc option [ 109.825534][ T4002] EXT4-fs (loop6): Quota format mount options ignored when QUOTA feature is enabled [ 109.837037][ T4002] EXT4-fs error (device loop6): ext4_free_branches:1026: inode #11: comm syz.6.1435: invalid indirect mapped block 4294967295 (level 1) [ 109.851325][ T4002] EXT4-fs error (device loop6): ext4_free_branches:1026: inode #11: comm syz.6.1435: invalid indirect mapped block 4294967295 (level 1) [ 109.866210][ T4002] EXT4-fs (loop6): 2 truncates cleaned up [ 109.871954][ T4002] EXT4-fs (loop6): mounted filesystem without journal. Opts: usrjquota=,oldalloc,jqfmt=vfsv0,i_version,,errors=continue [ 109.889532][ T4003] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 109.890328][ T4002] EXT4-fs (loop6): shut down requested (1) [ 109.907524][ T4002] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop6 ino=12 [ 109.916488][ T4002] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop6 ino=12 [ 109.932082][ T4003] EXT4-fs (loop0): 1 truncate cleaned up [ 109.937969][ T4003] EXT4-fs (loop0): mounted filesystem without journal. Opts: nojournal_checksum,jqfmt=vfsold,lazytime,usrquota,usrquota,,errors=continue [ 110.011207][ T4021] xt_l2tp: v2 sid > 0xffff: 4294967292 [ 110.118287][ T4036] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue [ 110.128876][ T4036] ext4 filesystem being mounted at /245/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 110.481382][ T4063] EXT4-fs (loop1): Ignoring removed oldalloc option [ 110.493641][ T4063] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 110.510581][ T4063] EXT4-fs error (device loop1): ext4_free_branches:1026: inode #11: comm syz.1.1463: invalid indirect mapped block 4294967295 (level 1) [ 110.524999][ T4063] EXT4-fs error (device loop1): ext4_free_branches:1026: inode #11: comm syz.1.1463: invalid indirect mapped block 4294967295 (level 1) [ 110.539610][ T4063] EXT4-fs (loop1): 2 truncates cleaned up [ 110.547565][ T4063] EXT4-fs (loop1): mounted filesystem without journal. Opts: usrjquota=,oldalloc,jqfmt=vfsv0,i_version,,errors=continue [ 110.561523][ T4070] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 110.573378][ T4063] EXT4-fs (loop1): shut down requested (1) [ 110.579926][ T4063] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop1 ino=12 [ 110.587573][ T4070] EXT4-fs (loop6): 1 truncate cleaned up [ 110.589491][ T4063] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop1 ino=12 [ 110.595166][ T4070] EXT4-fs (loop6): mounted filesystem without journal. Opts: nojournal_checksum,jqfmt=vfsold,lazytime,usrquota,usrquota,,errors=continue [ 110.758379][ T4087] EXT4-fs (loop6): Ignoring removed nomblk_io_submit option [ 110.770413][ T4087] EXT4-fs (loop6): Ignoring removed nomblk_io_submit option [ 110.781634][ T4087] EXT4-fs (loop6): mounting ext3 file system using the ext4 subsystem [ 110.792788][ T4087] EXT4-fs (loop6): 1 truncate cleaned up [ 110.798636][ T4087] EXT4-fs (loop6): mounted filesystem without journal. Opts: noload,max_dir_size_kb=0x0000000000000007,bsddf,nomblk_io_submit,data_err=ignore,nomblk_io_submit,,errors=continue [ 110.917635][ T24] audit: type=1400 audit(1785962016.002:522): avc: denied { read } for pid=4108 comm="syz.0.1481" name="cpu_dma_latency" dev="devtmpfs" ino=267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pmqos_device_t tclass=chr_file permissive=1 [ 110.948004][ T24] audit: type=1400 audit(1785962016.002:523): avc: denied { open } for pid=4108 comm="syz.0.1481" path="/257/dev/cpu_dma_latency" dev="devtmpfs" ino=267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pmqos_device_t tclass=chr_file permissive=1 [ 111.855558][ T4185] EXT4-fs (loop0): mounted filesystem without journal. Opts: nodioread_nolock,sb=0x0000000000000001,,errors=continue [ 111.867967][ T4185] ext4 filesystem being mounted at /259/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 111.929876][ T4192] device syzkaller0 entered promiscuous mode [ 112.109608][ T24] audit: type=1400 audit(1785962017.192:524): avc: denied { write } for pid=4214 comm="syz.1.1528" name="instances" dev="tracefs" ino=12708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 112.132445][ T24] audit: type=1400 audit(1785962017.192:525): avc: denied { add_name } for pid=4214 comm="syz.1.1528" name="foo" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 112.164455][ T24] audit: type=1400 audit(1785962017.242:526): avc: denied { remove_name } for pid=4214 comm="syz.1.1528" name="foo" dev="tracefs" ino=39866 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 112.193972][ T24] audit: type=1400 audit(1785962017.242:527): avc: denied { rmdir } for pid=4214 comm="syz.1.1528" name="foo" dev="tracefs" ino=39866 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 112.201775][ T4211] EXT4-fs (loop6): mounted filesystem without journal. Opts: block_validity,minixdf,nombcache,inode_readahead_blks=0x0000000000000000,debug_want_extra_isize=0x0000000000000080,jqfmt=vfsv0,nogrpid,noauto_da_alloc,grpjquota=,,errors=continue [ 112.241993][ T4211] SELinux: Context system_u:object_r:devicekit_power_exec_t:s0 is not valid (left unmapped). [ 112.423262][ T4222] EXT4-fs (loop6): mounted filesystem without journal. Opts: nodioread_nolock,sb=0x0000000000000001,,errors=continue [ 112.439276][ T4222] ext4 filesystem being mounted at /62/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 112.513140][ T4226] EXT4-fs (loop0): Ignoring removed bh option [ 112.533240][ T4226] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 112.596036][ T4226] EXT4-fs (loop0): mounted filesystem without journal. Opts: nobarrier,dioread_lock,dioread_nolock,resgid=0x0000000000000000,debug_want_extra_isize=0x0000000000000080,lazytime,journal_ioprio=0x0000000000000005,stripe=0x0000000000000011,bh,init_itable,,errors=continue [ 112.604073][ T4234] device syzkaller0 entered promiscuous mode [ 112.753144][ T4240] tipc: Enabled bearer , priority 0 [ 112.780001][ T4240] device syzkaller0 entered promiscuous mode [ 112.796681][ T4240] tipc: Resetting bearer [ 112.803478][ T4237] tipc: Resetting bearer [ 112.815905][ T4237] tipc: Disabling bearer [ 113.851503][ T4263] device ip6gre1 entered promiscuous mode [ 113.872844][ T24] kauditd_printk_skb: 4 callbacks suppressed [ 113.872855][ T24] audit: type=1400 audit(1785962018.952:532): avc: granted { setsecparam } for pid=4268 comm="syz.6.1550" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 113.938898][ T4279] tipc: Enabling of bearer rejected, failed to enable media [ 114.438366][ T4300] device ip6gre1 entered promiscuous mode [ 114.486297][ T4297] EXT4-fs (loop6): mounted filesystem without journal. Opts: ,errors=continue [ 114.495317][ T4297] ext4 filesystem being mounted at /71/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 114.570855][ T4306] EXT4-fs (loop6): Ignoring removed bh option [ 114.577093][ T4306] EXT4-fs (loop6): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 114.595739][ T4306] EXT4-fs (loop6): mounted filesystem without journal. Opts: nobarrier,dioread_lock,dioread_nolock,resgid=0x0000000000000000,debug_want_extra_isize=0x0000000000000080,lazytime,journal_ioprio=0x0000000000000005,stripe=0x0000000000000011,bh,init_itable,,errors=continue [ 114.693668][ T24] audit: type=1400 audit(1785962019.772:533): avc: granted { setsecparam } for pid=4310 comm="syz.0.1564" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 114.868083][ T4321] tipc: Enabled bearer , priority 0 [ 114.885400][ T4322] device syzkaller0 entered promiscuous mode [ 114.913931][ T4321] device syzkaller0 entered promiscuous mode [ 114.941829][ T4321] tipc: Resetting bearer [ 114.948697][ T4318] tipc: Resetting bearer [ 114.959475][ T4318] tipc: Disabling bearer [ 115.059002][ T24] audit: type=1326 audit(1785962020.142:534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4327 comm="syz.5.1573" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e67ac20d9 code=0x7ffc0000 [ 115.119128][ T24] audit: type=1326 audit(1785962020.142:535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4327 comm="syz.5.1573" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e67ac20d9 code=0x7ffc0000 [ 115.150939][ T24] audit: type=1326 audit(1785962020.142:536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4327 comm="syz.5.1573" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e67ac20d9 code=0x7ffc0000 [ 115.185045][ T24] audit: type=1326 audit(1785962020.142:537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4327 comm="syz.5.1573" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f7e67a8290e code=0x7ffc0000 [ 115.212535][ T24] audit: type=1326 audit(1785962020.142:538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4327 comm="syz.5.1573" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f7e67a8290e code=0x7ffc0000 [ 115.238204][ T24] audit: type=1326 audit(1785962020.142:539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4327 comm="syz.5.1573" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e67ac20d9 code=0x7ffc0000 [ 115.287527][ T24] audit: type=1326 audit(1785962020.142:540): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4327 comm="syz.5.1573" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e67ac20d9 code=0x7ffc0000 [ 115.312613][ T24] audit: type=1326 audit(1785962020.172:541): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4327 comm="syz.5.1573" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e67ac20d9 code=0x7ffc0000 [ 115.775179][ T4348] device veth0_vlan left promiscuous mode [ 115.782143][ T4348] device veth0_vlan entered promiscuous mode [ 115.794542][ T4348] device veth1_macvtap left promiscuous mode [ 115.803398][ T4348] device veth1_macvtap entered promiscuous mode [ 115.812546][ T4348] device ip6gre1 left promiscuous mode [ 115.988609][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 115.996183][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 116.003618][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 116.011951][ T306] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.019046][ T306] bridge0: port 1(bridge_slave_0) entered forwarding state [ 116.026675][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 116.035318][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 116.043519][ T306] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.050602][ T306] bridge0: port 2(bridge_slave_1) entered forwarding state [ 116.058049][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 116.066848][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 116.075005][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 116.083190][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 116.091287][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 116.099435][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 116.107545][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 116.115650][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 116.123697][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 116.131882][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 116.140198][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 116.148598][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 116.156834][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 116.165233][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 116.173114][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 116.181217][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 116.189233][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 116.197395][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 116.205715][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 116.214019][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 116.222141][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 116.230092][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 116.237608][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 116.245107][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 116.253221][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 116.261450][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 116.269077][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 119.697157][ T4356] [ 119.881482][ T4363] device syzkaller0 entered promiscuous mode [ 120.027789][ T4380] 9pnet: Insufficient options for proto=fd [ 120.065974][ T4382] EXT4-fs (loop6): revision level too high, forcing read-only mode [ 120.074714][ T4382] EXT4-fs (loop6): orphan cleanup on readonly fs [ 120.081105][ T4382] EXT4-fs error (device loop6): ext4_ext_check_inode:500: inode #3: comm syz.6.1595: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 2, max 3(4), depth 0(0) [ 120.099346][ T4382] EXT4-fs error (device loop6): ext4_quota_enable:6454: comm syz.6.1595: Bad quota inode: 3, type: 0 [ 120.110468][ T4382] EXT4-fs warning (device loop6): ext4_enable_quotas:6495: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [ 120.126519][ T4382] EXT4-fs (loop6): Cannot turn on quotas: error -117 [ 120.134412][ T4382] EXT4-fs (loop6): mounted filesystem without journal. Opts: nodelalloc,resgid=0x0000000000000000,init_itable,,errors=continue [ 120.156422][ T4383] EXT4-fs error (device loop0): ext4_orphan_get:1401: inode #15: comm syz.0.1602: inode has both inline data and extents flags [ 120.170856][ T4383] EXT4-fs error (device loop0): ext4_orphan_get:1406: comm syz.0.1602: couldn't read orphan inode 15 (err -117) [ 120.185691][ T4383] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 120.216473][ T4385] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 120.227920][ T4385] ext4 filesystem being mounted at /314/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 120.606733][ T4472] tipc: Enabled bearer , priority 0 [ 120.613796][ T4472] device syzkaller0 entered promiscuous mode [ 120.628030][ T4472] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 120.637701][ T4472] tipc: Resetting bearer [ 120.643983][ T4470] tipc: Resetting bearer [ 120.650139][ T4470] tipc: Disabling bearer [ 120.676774][ T4471] EXT4-fs (loop6): mounted filesystem without journal. Opts: ,errors=continue [ 120.685835][ T4471] ext4 filesystem being mounted at /81/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 120.726841][ T4484] EXT4-fs (loop0): mounted filesystem without journal. Opts: nodioread_nolock,sb=0x0000000000000001,,errors=continue [ 120.739352][ T4484] ext4 filesystem being mounted at /284/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 120.842334][ T4496] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue [ 120.859904][ T4496] ext4 filesystem being mounted at /323/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 121.239958][ T4553] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 121.284634][ T4553] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a80ce01c, mo2=0002] [ 121.295153][ T4553] System zones: 1-12 [ 121.300586][ T4553] EXT4-fs (loop4): orphan cleanup on readonly fs [ 121.308944][ T4553] EXT4-fs error (device loop4): ext4_free_branches:1026: inode #11: comm syz.4.1666: invalid indirect mapped block 12 (level 1) [ 121.323692][ T4553] EXT4-fs error (device loop4): ext4_free_branches:1026: inode #11: comm syz.4.1666: invalid indirect mapped block 2 (level 2) [ 121.337351][ T4553] EXT4-fs (loop4): 1 truncate cleaned up [ 121.343079][ T4553] EXT4-fs (loop4): mounted filesystem without journal. Opts: usrquota,nobarrier,,,errors=continue [ 121.434547][ T4573] udc-core: couldn't find an available UDC or it's busy [ 121.463500][ T4573] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 121.495879][ T24] kauditd_printk_skb: 5 callbacks suppressed [ 121.495893][ T24] audit: type=1400 audit(1785962026.582:547): avc: denied { nlmsg_write } for pid=4581 comm="syz.5.1680" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 121.699299][ T4600] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=95 sclass=netlink_route_socket pid=4600 comm=syz.1.1687 [ 121.763720][ T4597] EXT4-fs (loop4): Ignoring removed orlov option [ 121.773907][ T4604] xt_hashlimit: size too large, truncated to 1048576 [ 121.810662][ T4597] EXT4-fs (loop4): mounted filesystem without journal. Opts: block_validity,bsddf,sysvgroups,norecovery,debug_want_extra_isize=0x0000000000000080,orlov,nogrpid,noauto_da_alloc,norecovery,,errors=continue [ 121.978168][ T4633] syz.6.1698 uses obsolete (PF_INET,SOCK_PACKET) [ 122.116763][ T4650] device syzkaller0 entered promiscuous mode [ 122.216878][ T4670] FAT-fs (loop6): Directory bread(block 64) failed [ 122.223663][ T4670] FAT-fs (loop6): Directory bread(block 65) failed [ 122.244396][ T4670] FAT-fs (loop6): Directory bread(block 66) failed [ 122.250969][ T4670] FAT-fs (loop6): Directory bread(block 67) failed [ 122.274031][ T4670] FAT-fs (loop6): Directory bread(block 68) failed [ 122.280810][ T4670] FAT-fs (loop6): Directory bread(block 69) failed [ 122.287513][ T4670] FAT-fs (loop6): Directory bread(block 70) failed [ 122.294054][ T4670] FAT-fs (loop6): Directory bread(block 71) failed [ 122.300807][ T4670] FAT-fs (loop6): Directory bread(block 72) failed [ 122.309021][ T4670] FAT-fs (loop6): Directory bread(block 73) failed [ 122.331798][ T4670] attempt to access beyond end of device [ 122.331798][ T4670] loop6: rw=0, want=1772, limit=256 [ 122.383817][ T24] audit: type=1400 audit(1785962027.462:548): avc: denied { mounton } for pid=4679 comm="syz.0.1724" path="/295/file0/file0" dev="loop0" ino=1048670 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=dir permissive=1 [ 122.470181][ T4694] device syzkaller0 entered promiscuous mode [ 122.517618][ T4703] cgroup: syz.6.1733 (4703) created nested cgroup for controller "memory" which has incomplete hierarchy support. Nested cgroups may change behavior in the future. [ 122.524394][ T24] audit: type=1400 audit(1785962027.602:549): avc: denied { mount } for pid=4698 comm="syz.4.1731" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 122.535618][ T4703] cgroup: "memory" requires setting use_hierarchy to 1 on the root [ 122.625741][ T24] audit: type=1400 audit(1785962027.712:550): avc: denied { getopt } for pid=4714 comm="syz.0.1739" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 122.684646][ T24] audit: type=1400 audit(1785962027.762:551): avc: denied { listen } for pid=4725 comm="syz.6.1744" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 122.727945][ T4731] device syzkaller0 entered promiscuous mode [ 122.735723][ T4724] EXT4-fs error (device loop0): ext4_orphan_get:1427: comm syz.0.1743: bad orphan inode 15 [ 122.757833][ T4724] ext4_test_bit(bit=14, block=5) = 0 [ 122.764705][ T4724] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,lazytime,journal_dev=0x0000000000000003,min_batch_time=0x000000000000004a,nobarrier,journal_ioprio=0x0000000000000003,nolazytime,noload,,errors=continue [ 122.860512][ T24] audit: type=1400 audit(1785962027.942:552): avc: denied { map } for pid=4744 comm="syz.6.1754" path="socket:[66630]" dev="sockfs" ino=66630 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 122.915180][ T307] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 122.976902][ T307] hid-generic 0000:0000:0000.000B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 123.078059][ T4762] FAT-fs (loop1): error, corrupted file size (i_pos 196, 2097152) [ 123.097701][ T4762] FAT-fs (loop1): Filesystem has been set read-only [ 123.105112][ T4762] FAT-fs (loop1): error, corrupted file size (i_pos 196, 2097152) [ 123.247789][ T24] audit: type=1400 audit(1785962028.332:553): avc: denied { append } for pid=4783 comm="syz.0.1768" name="uprobe_events" dev="tracefs" ino=12714 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 123.310653][ T4790] device syzkaller0 entered promiscuous mode [ 123.472440][ T4823] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1788'. [ 123.871804][ T4829] device syzkaller0 entered promiscuous mode [ 124.056095][ T4854] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1800'. [ 124.070218][ T4853] device syzkaller0 entered promiscuous mode [ 124.160916][ T24] audit: type=1400 audit(1785962029.242:554): avc: denied { checkpoint_restore } for pid=4872 comm="syz.0.1812" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 124.229558][ T4886] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1817'. [ 124.315790][ T4896] device syzkaller0 entered promiscuous mode [ 124.626631][ T24] audit: type=1400 audit(1785962029.692:555): avc: denied { create } for pid=4926 comm="syz.1.1836" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=vsock_socket permissive=1 [ 124.660241][ T4916] EXT4-fs (loop4): orphan cleanup on readonly fs [ 124.668782][ T4916] EXT4-fs warning (device loop4): ext4_enable_quotas:6495: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 124.689549][ T4916] EXT4-fs (loop4): Cannot turn on quotas: error -22 [ 124.696580][ T4916] EXT4-fs error (device loop4): ext4_ext_check_inode:500: inode #13: comm syz.4.1832: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 124.715607][ T4916] EXT4-fs error (device loop4): ext4_orphan_get:1406: comm syz.4.1832: couldn't read orphan inode 13 (err -117) [ 124.727895][ T4916] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 124.775432][ T4945] device syzkaller0 entered promiscuous mode [ 124.899824][ T4958] EXT4-fs (loop6): mounted filesystem without journal. Opts: ,errors=continue [ 124.938351][ T24] audit: type=1326 audit(1785962030.022:556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4969 comm="syz.5.1856" exe="/root/ci2-android-5-10/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7e67ac20d9 code=0x0 [ 124.968706][ T4979] device syzkaller0 entered promiscuous mode [ 125.051144][ T306] Bluetooth: hci0: Frame reassembly failed (-84) [ 125.068675][ T4993] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 125.174818][ T5012] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 125.197403][ T5012] EXT4-fs (loop6): 1 truncate cleaned up [ 125.210538][ T5012] EXT4-fs (loop6): mounted filesystem without journal. Opts: nogrpid,barrier,debug_want_extra_isize=0x0000000000000068,errors=remount-ro,nombcache,quota,nojournal_checksum, [ 125.723511][ T5090] EXT4-fs (loop6): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 125.749234][ T5090] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a840c018, mo2=0003] [ 125.757460][ T5090] System zones: 0-1, 3-12 [ 125.762392][ T5090] EXT4-fs (loop6): mounted filesystem without journal. Opts: dioread_nolock,dioread_nolock,min_batch_time=0x00000000000000cc,nodiscard,debug_want_extra_isize=0x0000000000000004,init_itable,auto_da_alloc=0x0000000000000003,delalloc,auto_da_alloc=0x0000000000000340,debug,barrier=0x00000,errors=continue [ 126.002671][ T5136] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=5136 comm=syz.6.1933 [ 126.015594][ T5136] mmap: syz.6.1933 (5136): VmData 29208576 exceed data ulimit 7. Update limits or use boot option ignore_rlimit_data. [ 126.100883][ T5151] ================================================================== [ 126.109018][ T5151] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 126.115716][ T5151] Write of size 8 at addr ffff888126d96550 by task syz.1.1941/5151 [ 126.123616][ T5151] [ 126.125967][ T5151] CPU: 1 PID: 5151 Comm: syz.1.1941 Tainted: G W syzkaller #0 [ 126.134734][ T5151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 126.144792][ T5151] Call Trace: [ 126.148089][ T5151] __dump_stack+0x21/0x24 [ 126.152424][ T5151] dump_stack_lvl+0x1a7/0x208 [ 126.157112][ T5151] ? show_regs_print_info+0x18/0x18 [ 126.162313][ T5151] ? thaw_kernel_threads+0x220/0x220 [ 126.167602][ T5151] ? debug_smp_processor_id+0x17/0x20 [ 126.172975][ T5151] print_address_description+0x7f/0x2c0 [ 126.178527][ T5151] ? mutex_lock+0x85/0xf0 [ 126.182879][ T5151] kasan_report+0x100/0x140 [ 126.187385][ T5151] ? mutex_lock+0x85/0xf0 [ 126.191717][ T5151] kasan_check_range+0x249/0x2a0 [ 126.196658][ T5151] __kasan_check_write+0x14/0x20 [ 126.201599][ T5151] mutex_lock+0x85/0xf0 [ 126.205788][ T5151] ? mutex_trylock+0xb0/0xb0 [ 126.210383][ T5151] ? l2tp_session_put+0xb2/0x1a0 [ 126.215325][ T5151] ? l2tp_session_delete+0x3a9/0x4a0 [ 126.220608][ T5151] pppol2tp_release+0x178/0x2b0 [ 126.225459][ T5151] sock_close+0xb8/0x200 [ 126.229736][ T5151] ? sock_mmap+0xa0/0xa0 [ 126.234066][ T5151] __fput+0x2dc/0x730 [ 126.238105][ T5151] ____fput+0x15/0x20 [ 126.242095][ T5151] task_work_run+0x127/0x190 [ 126.246684][ T5151] exit_to_user_mode_loop+0xcb/0xe0 [ 126.251887][ T5151] exit_to_user_mode_prepare+0x76/0xa0 [ 126.257352][ T5151] syscall_exit_to_user_mode+0x1d/0x40 [ 126.262813][ T5151] do_syscall_64+0x3d/0x40 [ 126.267238][ T5151] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 126.273138][ T5151] RIP: 0033:0x7f707958e0d9 [ 126.277583][ T5151] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 126.297194][ T5151] RSP: 002b:00007ffcdfe5e0a8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 126.305756][ T5151] RAX: 0000000000000000 RBX: 00007ffcdfe5e190 RCX: 00007f707958e0d9 [ 126.313729][ T5151] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 126.321703][ T5151] RBP: 000000000001ec7b R08: 0000000000000001 R09: 0000000000000000 [ 126.329695][ T5151] R10: 0000001b2d320000 R11: 0000000000000246 R12: 00007ffcdfe5e1d0 [ 126.337675][ T5151] R13: 00007f7079815fac R14: 000000000001ecae R15: 00007f7079815fa0 [ 126.345651][ T5151] [ 126.347979][ T5151] Allocated by task 5152: [ 126.352305][ T5151] __kasan_kmalloc+0xd4/0x100 [ 126.356987][ T5151] __kmalloc+0x19f/0x330 [ 126.361235][ T5151] l2tp_session_create+0x39/0xb60 [ 126.366260][ T5151] pppol2tp_connect+0xbf5/0x1640 [ 126.371200][ T5151] __sys_connect+0x3ce/0x450 [ 126.375793][ T5151] __x64_sys_connect+0x7a/0x90 [ 126.380558][ T5151] do_syscall_64+0x31/0x40 [ 126.384982][ T5151] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 126.390870][ T5151] [ 126.393196][ T5151] Freed by task 5151: [ 126.397186][ T5151] kasan_set_track+0x4a/0x70 [ 126.401828][ T5151] kasan_set_free_info+0x23/0x40 [ 126.406792][ T5151] ____kasan_slab_free+0x125/0x160 [ 126.411969][ T5151] __kasan_slab_free+0x11/0x20 [ 126.416741][ T5151] slab_free_freelist_hook+0xc5/0x190 [ 126.422116][ T5151] kfree+0xc0/0x270 [ 126.425927][ T5151] l2tp_session_put+0xb2/0x1a0 [ 126.430693][ T5151] l2tp_session_delete+0x3a9/0x4a0 [ 126.435803][ T5151] pppol2tp_release+0x169/0x2b0 [ 126.440708][ T5151] sock_close+0xb8/0x200 [ 126.444964][ T5151] __fput+0x2dc/0x730 [ 126.448974][ T5151] ____fput+0x15/0x20 [ 126.452957][ T5151] task_work_run+0x127/0x190 [ 126.457546][ T5151] exit_to_user_mode_loop+0xcb/0xe0 [ 126.462745][ T5151] exit_to_user_mode_prepare+0x76/0xa0 [ 126.468205][ T5151] syscall_exit_to_user_mode+0x1d/0x40 [ 126.473661][ T5151] do_syscall_64+0x3d/0x40 [ 126.478079][ T5151] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 126.483963][ T5151] [ 126.486294][ T5151] Last potentially related work creation: [ 126.492013][ T5151] kasan_save_stack+0x3a/0x60 [ 126.496698][ T5151] __kasan_record_aux_stack+0xd2/0x100 [ 126.502154][ T5151] kasan_record_aux_stack_noalloc+0xb/0x10 [ 126.507965][ T5151] kvfree_call_rcu+0x117/0x670 [ 126.512732][ T5151] drop_sysctl_table+0x2f5/0x430 [ 126.517674][ T5151] drop_sysctl_table+0x2e4/0x430 [ 126.522613][ T5151] unregister_sysctl_table+0x75/0x120 [ 126.527987][ T5151] unregister_net_sysctl_table+0x15/0x20 [ 126.533615][ T5151] neigh_sysctl_unregister+0x78/0x90 [ 126.538920][ T5151] inetdev_event+0x7df/0x1010 [ 126.543595][ T5151] raw_notifier_call_chain+0x90/0x100 [ 126.548974][ T5151] unregister_netdevice_many+0x100e/0x19f0 [ 126.554780][ T5151] default_device_exit_batch+0x35e/0x3c0 [ 126.560452][ T5151] cleanup_net+0x5fe/0xb80 [ 126.564877][ T5151] process_one_work+0x6fd/0xbc0 [ 126.569730][ T5151] worker_thread+0xa8e/0x13c0 [ 126.574406][ T5151] kthread+0x324/0x3b0 [ 126.578475][ T5151] ret_from_fork+0x1f/0x30 [ 126.582920][ T5151] [ 126.585254][ T5151] The buggy address belongs to the object at ffff888126d96400 [ 126.585254][ T5151] which belongs to the cache kmalloc-512 of size 512 [ 126.599309][ T5151] The buggy address is located 336 bytes inside of [ 126.599309][ T5151] 512-byte region [ffff888126d96400, ffff888126d96600) [ 126.612583][ T5151] The buggy address belongs to the page: [ 126.618239][ T5151] page:ffffea00049b6500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x126d94 [ 126.628471][ T5151] head:ffffea00049b6500 order:2 compound_mapcount:0 compound_pincount:0 [ 126.636830][ T5151] flags: 0x4000000000010200(slab|head) [ 126.642301][ T5151] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 126.650895][ T5151] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 126.659473][ T5151] page dumped because: kasan: bad access detected [ 126.665881][ T5151] page_owner tracks the page as allocated [ 126.671616][ T5151] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 282, ts 24307374509, free_ts 0 [ 126.689778][ T5151] prep_new_page+0x176/0x190 [ 126.694391][ T5151] get_page_from_freelist+0x225f/0x23f0 [ 126.699942][ T5151] __alloc_pages_nodemask+0x29a/0x640 [ 126.705317][ T5151] new_slab+0x84/0x3f0 [ 126.709389][ T5151] ___slab_alloc+0x2f8/0x4c0 [ 126.713982][ T5151] __slab_alloc+0x63/0xa0 [ 126.718319][ T5151] __kmalloc+0x1f9/0x330 [ 126.722585][ T5151] __register_sysctl_table+0xa35/0x1240 [ 126.728149][ T5151] register_net_sysctl+0x2c/0x40 [ 126.733089][ T5151] __devinet_sysctl_register+0x2bd/0x390 [ 126.738725][ T5151] devinet_sysctl_register+0x169/0x1e0 [ 126.744284][ T5151] inetdev_init+0x26c/0x490 [ 126.748800][ T5151] inetdev_event+0x1f4/0x1010 [ 126.753482][ T5151] raw_notifier_call_chain+0x90/0x100 [ 126.758853][ T5151] call_netdevice_notifiers+0x119/0x190 [ 126.764396][ T5151] register_netdevice+0x100a/0x13a0 [ 126.769590][ T5151] page_owner free stack trace missing [ 126.774961][ T5151] [ 126.777289][ T5151] Memory state around the buggy address: [ 126.782922][ T5151] ffff888126d96400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 126.790983][ T5151] ffff888126d96480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 126.799140][ T5151] >ffff888126d96500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 126.807198][ T5151] ^ [ 126.813873][ T5151] ffff888126d96580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 126.821939][ T5151] ffff888126d96600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 126.829996][ T5151] ================================================================== [ 126.838088][ T5151] Disabling lock debugging due to kernel taint [ 127.104219][ T5] Bluetooth: hci0: command 0x1003 tx timeout [ 127.110329][ T3981] Bluetooth: hci0: sending frame failed (-49) [ 129.184273][ T5] Bluetooth: hci0: command 0x1001 tx timeout [ 129.190393][ T3981] Bluetooth: hci0: sending frame failed (-49) [ 131.264236][ T373] Bluetooth: hci0: command 0x1009 tx timeout