last executing test programs: 17.84376149s ago: executing program 1 (id=3718): setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x16, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeee, 0x8031, 0xffffffffffffffff, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/kcore\x00', 0x0, 0x0) 12.759696395s ago: executing program 3 (id=3726): write$USERIO_CMD_REGISTER(0xffffffffffffffff, &(0x7f0000000200), 0x2) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_netfilter(r0, 0x0, 0x0) 12.610601029s ago: executing program 1 (id=3728): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x400, &(0x7f0000000240)={[{@grpjquota}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x7}}]}, 0x1, 0x4a6, &(0x7f0000000a40)="$eJzs3c9rXNUeAPDvzDRpkua9/niPR9sHr4U+6HtKM/mBNFEXulIXBbHgRqHGZBprJpmQmdQmdJHqrgsXoiiIC/f+BW7syiKIa92LC6lojaCCMHLvzKT5NXXQNAO5nw/czrn33M73nAzfw51z750bQGadTv7JRQxGxBcRcbixunmH042XtbvXp5IlF/X6xe9z6X7JemvX1v87FBGrEdEXEc89FfFybnvc6vLK7GS5XFpsrhdrcwvF6vLKuStzkzOlmdL8yPj5iYnx4bHRiV3r6803X7154eNnej/6+Y07t9/69JOkWYPNuo392E2NrvfE0Q3bDkTE4w8iWBcUmv3p73ZD+FOSz+8fEXEmzf/DUUg/TSAL6vV6/bf6wXbVq3Vg38qnx8C5/FBENMr5/NBQ4xj+nzGQL1eqtYcvV5bmpxvHykeiJ3/5Srk03PyucCR6csn6SFq+tz66ZX0sIj0GfrvQn64PTVXK03s71AFbHNqS/z8VGvkPZISv/JBd8h+yS/5Ddsl/yC75D9kl/yG75D9kl/yH7JL/kF3yH7JL/kMmPXvhQrLUW/e/T19dXpqtXD03XarODs0tTQ1NVRYXhmYqlZn0np25P3q/cqWyMPJILF0r1krVWrG6vHJprrI0X7uU3td/qdSzJ70COnH01K2vchGx+mh/uiR6m3VyFfa3ej0X3b4HGeiOQrcHIKBrTP1BdvmOD+zwE72b9LWrWNj9tgB7I9/tBgBdc/aE83+QVeb/IbvM/0N2OcYHzP9D9pj/h+wabPP8r79teHbXcET8PSK+LPQcbD3rC9gP8t/mmsf/Zw//d3BrbW/ul/QUQW9EvPb+xXevTdZqiyPJ9h/Wt9fea24f7Ub7gU618rSVxwBAdq3dvT7VWvYy7ndPNi5C2B7/QHNusi89Rzmwltt0rUJul65dWL0REcd3ip9rPu+8ceZjYK2wLf6x5muu8RZpew+kz03fm/gnNsT/z4b4J//yXwWy4VYy/gzvlH/5NKdjPf82jz+Du3TtRPvxL78+/hXajH+nOozxygevf9M2/o2IkzvGb8XrS2NtjZ+07WyH8e+8+Py/2tXVP2y8z07xW5JSsTa3UKwur5xLf0dupjQ/Mn5+YmJ8eGx0opjOURdbM9XbPXb889v36/9Am/jt+v9Es03/77D/v/77sxdO3yf+/87s/PkfaxM/0R8RD3UY/8fRr19qV5fEn27T//x94ifbxjqMX33n6YMd7goA7IHq8srsZLlcWlRQUFBYL3R7ZAIetHtJ3+2WAAAAAAAAAAAAAJ3ai8uJu91HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID94PcAAAD//5j81ps=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f00000003c0)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) mount(0x0, 0x0, 0x0, 0x66005, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r3 = socket(0x10, 0x2, 0x0) write(r3, &(0x7f0000000480), 0x0) recvmmsg(r3, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) 11.648334293s ago: executing program 3 (id=3731): bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendmsg$AUDIT_USER_AVC(0xffffffffffffffff, 0x0, 0x4040800) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b8, 0x10, 0x2, 0x158}, &(0x7f00000020c0)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) r4 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r4, 0x80047c05, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) migrate_pages(0x0, 0x8, &(0x7f0000000000)=0x80000000, &(0x7f0000000100)=0xb) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0xd}}}, &(0x7f0000000480)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x80001, 0x255, 0x0, r9}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6474, 0x8, 0x2, 0x15e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x400, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc5c, 0x8, 0x3, 0x0, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb41f, 0x1000, 0x3, 0x1e9, 0x0, r0}}], 0x1, &(0x7f0000000500)={0x2e, 0x2, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r6, '\x00', {0x404, 0x8004, 0x0, 0x0}}, 0x0) r10 = socket$inet_tcp(0x2, 0x1, 0x0) r11 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r11, 0x0, 0xf, &(0x7f0000d10ffc)=0x200, 0x4) bind$inet6(r11, &(0x7f0000000040)={0xa, 0x1, 0x10000, @dev={0xfe, 0x80, '\x00', 0x1e}, 0x6}, 0x1c) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r11, 0x84, 0x64, &(0x7f00000004c0), 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r11, 0x84, 0x65, &(0x7f00000003c0)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x32}}], 0x10) bind$inet(r10, &(0x7f0000000000)={0x2, 0x4e20, @local}, 0x10) listen(r10, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='\\\\172.20.20.170\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000300)='cifs\x00', 0x0, &(0x7f0000000400)='vers=1.0,username=guest,password=,port=20000,soft\x00') seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) 10.13533896s ago: executing program 1 (id=3732): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) socket$l2tp(0x2, 0x2, 0x73) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0xffffffff}, 0x10) socket(0x1e, 0x4, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r4, 0x0, 0x0) sendmmsg(r3, &(0x7f0000003240), 0x4000000000000e4, 0x0) 8.288457786s ago: executing program 2 (id=3734): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write(0xffffffffffffffff, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109d", 0x27) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) r4 = socket(0x29, 0x5, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000004c0)='./file0\x00', &(0x7f0000002100), 0x804000, &(0x7f00000002c0)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r5, &(0x7f000000ac40)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000000400)={0x50, 0x0, r6, {0x7, 0x29, 0x9, 0xffffffff9080e5c4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) syz_fuse_handle_req(r5, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$incfs(r3, &(0x7f0000000480)='.pending_reads\x00', 0x80, 0x151) mount$pvfs2(&(0x7f0000000040), &(0x7f0000000080)='./file0/file1\x00', &(0x7f0000000300), 0x2950008, &(0x7f0000000340)={[], [{@permit_directio}, {@smackfshat={'smackfshat', 0x3d, 'workdir'}}, {@subj_type={'subj_type', 0x3d, 'lowerdir'}}, {@subj_user={'subj_user', 0x3d, 'workdir'}}, {@uid_lt={'uid<', r7}}, {@dont_measure}, {@obj_user={'obj_user', 0x3d, '#-#){\'${}'}}]}) write(r4, 0x0, 0x0) 7.238696582s ago: executing program 2 (id=3735): set_mempolicy(0x8006, 0x0, 0x5) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) socket(0x2, 0x80805, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x1}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x4c, 0x0, &(0x7f0000000640)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x0, 0x1000000, 0x0, 0x1, 0xa00, &(0x7f00000005c0)=""/1}) 7.218523902s ago: executing program 3 (id=3736): syz_usb_connect(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b41889160001010203010902220002010080fa090400000003000000090401"], 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x300, 0x0) r1 = epoll_create1(0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) r2 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) ioctl$NS_GET_USERNS(r2, 0xb701, 0x0) r3 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x10) ioctl$TIOCSETD(r3, 0x5423, 0x0) socket$netlink(0x10, 0x3, 0x10) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r4, 0xfffffffc) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r9, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r8, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, r6, 0x1, 0x70bd2c, 0x9000700, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x37}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}, 0x1, 0xff07}, 0x2000000) socket(0x1e, 0x4, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, 0x0) ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, &(0x7f00000008c0)={0xfe, 0x7c, 0x6, &(0x7f0000000400)={0x22, "50131013c04946f94c3b1658b2297d824653449affaee441d08e2d8d1766ad09a3"}}) 5.500613825s ago: executing program 1 (id=3738): setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x16, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeee, 0x8031, 0xffffffffffffffff, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/kcore\x00', 0x0, 0x0) 5.422031556s ago: executing program 2 (id=3740): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x400, &(0x7f0000000240)={[{@grpjquota}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x7}}]}, 0x1, 0x4a6, &(0x7f0000000a40)="$eJzs3c9rXNUeAPDvzDRpkua9/niPR9sHr4U+6HtKM/mBNFEXulIXBbHgRqHGZBprJpmQmdQmdJHqrgsXoiiIC/f+BW7syiKIa92LC6lojaCCMHLvzKT5NXXQNAO5nw/czrn33M73nAzfw51z750bQGadTv7JRQxGxBcRcbixunmH042XtbvXp5IlF/X6xe9z6X7JemvX1v87FBGrEdEXEc89FfFybnvc6vLK7GS5XFpsrhdrcwvF6vLKuStzkzOlmdL8yPj5iYnx4bHRiV3r6803X7154eNnej/6+Y07t9/69JOkWYPNuo392E2NrvfE0Q3bDkTE4w8iWBcUmv3p73ZD+FOSz+8fEXEmzf/DUUg/TSAL6vV6/bf6wXbVq3Vg38qnx8C5/FBENMr5/NBQ4xj+nzGQL1eqtYcvV5bmpxvHykeiJ3/5Srk03PyucCR6csn6SFq+tz66ZX0sIj0GfrvQn64PTVXK03s71AFbHNqS/z8VGvkPZISv/JBd8h+yS/5Ddsl/yC75D9kl/yG75D9kl/yH7JL/kF3yH7JL/kMmPXvhQrLUW/e/T19dXpqtXD03XarODs0tTQ1NVRYXhmYqlZn0np25P3q/cqWyMPJILF0r1krVWrG6vHJprrI0X7uU3td/qdSzJ70COnH01K2vchGx+mh/uiR6m3VyFfa3ej0X3b4HGeiOQrcHIKBrTP1BdvmOD+zwE72b9LWrWNj9tgB7I9/tBgBdc/aE83+QVeb/IbvM/0N2OcYHzP9D9pj/h+wabPP8r79teHbXcET8PSK+LPQcbD3rC9gP8t/mmsf/Zw//d3BrbW/ul/QUQW9EvPb+xXevTdZqiyPJ9h/Wt9fea24f7Ub7gU618rSVxwBAdq3dvT7VWvYy7ndPNi5C2B7/QHNusi89Rzmwltt0rUJul65dWL0REcd3ip9rPu+8ceZjYK2wLf6x5muu8RZpew+kz03fm/gnNsT/z4b4J//yXwWy4VYy/gzvlH/5NKdjPf82jz+Du3TtRPvxL78+/hXajH+nOozxygevf9M2/o2IkzvGb8XrS2NtjZ+07WyH8e+8+Py/2tXVP2y8z07xW5JSsTa3UKwur5xLf0dupjQ/Mn5+YmJ8eGx0opjOURdbM9XbPXb889v36/9Am/jt+v9Es03/77D/v/77sxdO3yf+/87s/PkfaxM/0R8RD3UY/8fRr19qV5fEn27T//x94ifbxjqMX33n6YMd7goA7IHq8srsZLlcWlRQUFBYL3R7ZAIetHtJ3+2WAAAAAAAAAAAAAJ3ai8uJu91HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID94PcAAAD//5j81ps=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f00000003c0)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) mount(0x0, 0x0, 0x0, 0x66005, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r3 = socket(0x10, 0x2, 0x0) write(r3, &(0x7f0000000480), 0x0) recvmmsg(r3, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) 4.987746227s ago: executing program 0 (id=3741): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/class/tty/ttyS2/rx_trig_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000480)='<', 0x1) 4.323925523s ago: executing program 0 (id=3742): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) 4.310689134s ago: executing program 2 (id=3743): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write(0xffffffffffffffff, &(0x7f00000005c0)="306663353a313232373a3f7092c0f0bc085a193376cf620afaf6379a248d1d6534058f1095109d", 0x27) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}], [], 0x2c}) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) r4 = socket(0x29, 0x5, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000004c0)='./file0\x00', &(0x7f0000002100), 0x804000, &(0x7f00000002c0)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r5, &(0x7f000000ac40)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000000400)={0x50, 0x0, r6, {0x7, 0x29, 0x9, 0xffffffff9080e5c4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) syz_fuse_handle_req(r5, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$incfs(r3, &(0x7f0000000480)='.pending_reads\x00', 0x80, 0x151) mount$pvfs2(&(0x7f0000000040), &(0x7f0000000080)='./file0/file1\x00', &(0x7f0000000300), 0x2950008, &(0x7f0000000340)={[], [{@permit_directio}, {@smackfshat={'smackfshat', 0x3d, 'workdir'}}, {@subj_type={'subj_type', 0x3d, 'lowerdir'}}, {@subj_user={'subj_user', 0x3d, 'workdir'}}, {@uid_lt={'uid<', r7}}, {@dont_measure}, {@obj_user={'obj_user', 0x3d, '#-#){\'${}'}}]}) write(r4, 0x0, 0x0) 4.196763677s ago: executing program 0 (id=3744): semop(0x0, &(0x7f0000000080)=[{0x1, 0x8001, 0x1000}, {0x1, 0x5b7a, 0x800}], 0x2) 3.197263121s ago: executing program 3 (id=3745): bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendmsg$AUDIT_USER_AVC(0xffffffffffffffff, 0x0, 0x4040800) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b8, 0x10, 0x2, 0x158}, &(0x7f00000020c0)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) r4 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r4, 0x80047c05, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) migrate_pages(0x0, 0x8, &(0x7f0000000000)=0x80000000, &(0x7f0000000100)=0xb) r7 = dup2(r6, r5) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, r7, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0xd}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x80001, 0x255, 0x0, r11}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6474, 0x8, 0x2, 0x15e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x400, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc5c, 0x8, 0x3, 0x0, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb41f, 0x1000, 0x3, 0x1e9, 0x0, r0}}], 0x1, &(0x7f0000000500)={0x2e, 0x2, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r8, '\x00', {0x404, 0x8004, 0x0, 0x0}}, 0x0) r12 = socket$inet_tcp(0x2, 0x1, 0x0) r13 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r13, 0x0, 0xf, &(0x7f0000d10ffc)=0x200, 0x4) bind$inet6(r13, &(0x7f0000000040)={0xa, 0x1, 0x10000, @dev={0xfe, 0x80, '\x00', 0x1e}, 0x6}, 0x1c) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r13, 0x84, 0x64, &(0x7f00000004c0), 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r13, 0x84, 0x65, &(0x7f00000003c0)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x32}}], 0x10) bind$inet(r12, &(0x7f0000000000)={0x2, 0x4e20, @local}, 0x10) listen(r12, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='\\\\172.20.20.170\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000300)='cifs\x00', 0x0, &(0x7f0000000400)='vers=1.0,username=guest,password=,port=20000,soft\x00') seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) 3.164234912s ago: executing program 0 (id=3746): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) socket$l2tp(0x2, 0x2, 0x73) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0xffffffff}, 0x10) socket(0x1e, 0x4, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r4, 0x0, 0x0) sendmmsg(r3, &(0x7f0000003240), 0x4000000000000e4, 0x0) 3.131660852s ago: executing program 2 (id=3747): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x840) write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="5905d6915e01618453c24cf8"], 0x10e6) syz_init_net_socket$llc(0x1a, 0x1, 0x0) 1.098730502s ago: executing program 0 (id=3748): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b8, 0x10, 0x2, 0x158}, &(0x7f00000020c0)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) migrate_pages(0x0, 0x8, &(0x7f0000000000)=0x80000000, &(0x7f0000000100)=0xb) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0xd}}}, &(0x7f0000000480)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x80001, 0x255, 0x0, r8}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6474, 0x8, 0x2, 0x15e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x400, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc5c, 0x8, 0x3, 0x0, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb41f, 0x1000, 0x3, 0x1e9, 0x0, r0}}], 0x1, &(0x7f0000000500)={0x2e, 0x2, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r5, '\x00', {0x404, 0x8004, 0x0, 0x0}}, 0x0) 966.153506ms ago: executing program 1 (id=3749): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(0xffffffffffffffff, 0x8b1a, &(0x7f0000000040)) 837.283569ms ago: executing program 3 (id=3750): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/class/tty/ttyS2/rx_trig_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000480)='<', 0x1) 107.421947ms ago: executing program 0 (id=3751): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x400, &(0x7f0000000240)={[{@grpjquota}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x7}}]}, 0x1, 0x4a6, &(0x7f0000000a40)="$eJzs3c9rXNUeAPDvzDRpkua9/niPR9sHr4U+6HtKM/mBNFEXulIXBbHgRqHGZBprJpmQmdQmdJHqrgsXoiiIC/f+BW7syiKIa92LC6lojaCCMHLvzKT5NXXQNAO5nw/czrn33M73nAzfw51z750bQGadTv7JRQxGxBcRcbixunmH042XtbvXp5IlF/X6xe9z6X7JemvX1v87FBGrEdEXEc89FfFybnvc6vLK7GS5XFpsrhdrcwvF6vLKuStzkzOlmdL8yPj5iYnx4bHRiV3r6803X7154eNnej/6+Y07t9/69JOkWYPNuo392E2NrvfE0Q3bDkTE4w8iWBcUmv3p73ZD+FOSz+8fEXEmzf/DUUg/TSAL6vV6/bf6wXbVq3Vg38qnx8C5/FBENMr5/NBQ4xj+nzGQL1eqtYcvV5bmpxvHykeiJ3/5Srk03PyucCR6csn6SFq+tz66ZX0sIj0GfrvQn64PTVXK03s71AFbHNqS/z8VGvkPZISv/JBd8h+yS/5Ddsl/yC75D9kl/yG75D9kl/yH7JL/kF3yH7JL/kMmPXvhQrLUW/e/T19dXpqtXD03XarODs0tTQ1NVRYXhmYqlZn0np25P3q/cqWyMPJILF0r1krVWrG6vHJprrI0X7uU3td/qdSzJ70COnH01K2vchGx+mh/uiR6m3VyFfa3ej0X3b4HGeiOQrcHIKBrTP1BdvmOD+zwE72b9LWrWNj9tgB7I9/tBgBdc/aE83+QVeb/IbvM/0N2OcYHzP9D9pj/h+wabPP8r79teHbXcET8PSK+LPQcbD3rC9gP8t/mmsf/Zw//d3BrbW/ul/QUQW9EvPb+xXevTdZqiyPJ9h/Wt9fea24f7Ub7gU618rSVxwBAdq3dvT7VWvYy7ndPNi5C2B7/QHNusi89Rzmwltt0rUJul65dWL0REcd3ip9rPu+8ceZjYK2wLf6x5muu8RZpew+kz03fm/gnNsT/z4b4J//yXwWy4VYy/gzvlH/5NKdjPf82jz+Du3TtRPvxL78+/hXajH+nOozxygevf9M2/o2IkzvGb8XrS2NtjZ+07WyH8e+8+Py/2tXVP2y8z07xW5JSsTa3UKwur5xLf0dupjQ/Mn5+YmJ8eGx0opjOURdbM9XbPXb889v36/9Am/jt+v9Es03/77D/v/77sxdO3yf+/87s/PkfaxM/0R8RD3UY/8fRr19qV5fEn27T//x94ifbxjqMX33n6YMd7goA7IHq8srsZLlcWlRQUFBYL3R7ZAIetHtJ3+2WAAAAAAAAAAAAAJ3ai8uJu91HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID94PcAAAD//5j81ps=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f00000003c0)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) mount(0x0, 0x0, 0x0, 0x66005, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r3 = socket(0x10, 0x2, 0x0) write(r3, &(0x7f0000000480)="1c0000001a009b8a140000003b00", 0xe) recvmmsg(r3, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) 106.917207ms ago: executing program 2 (id=3752): bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, 0x0, 0x0}, 0x94) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x5, &(0x7f0000000040)=0xfffffff9, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) ioctl$XFS_IOC_GOINGDOWN(r0, 0x8004587d, &(0x7f0000000000)=0x4) 55.055159ms ago: executing program 1 (id=3753): syz_usb_connect(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b41889160001010203010902220002010080fa090400000003000000090401"], 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x300, 0x0) r1 = epoll_create1(0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) r2 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) ioctl$NS_GET_USERNS(r2, 0xb701, 0x0) r3 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x10) ioctl$TIOCSETD(r3, 0x5423, 0x0) socket$netlink(0x10, 0x3, 0x10) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r4, 0xfffffffc) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r9, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r8, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, r6, 0x1, 0x70bd2c, 0x9000700, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x37}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}, 0x1, 0xff07}, 0x2000000) socket(0x1e, 0x4, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, 0x0) ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, &(0x7f00000008c0)={0xfe, 0x7c, 0x6, &(0x7f0000000400)={0x22, "50131013c04946f94c3b1658b2297d824653449affaee441d08e2d8d1766ad09a3"}}) 0s ago: executing program 3 (id=3754): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040), &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/usb_gadget/naa.5001405000000001\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='naa.', 0x4) close(r0) kernel console output (not intermixed with test programs): sing dummy_hcd [ 1178.409638][ T27] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1178.503047][ T27] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1178.568081][ T27] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1178.614725][ T27] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1179.150558][ T27] usb 1-1: Product: syz [ 1179.154767][ T27] usb 1-1: Manufacturer: syz [ 1179.160428][ T27] usb 1-1: SerialNumber: syz [ 1179.168249][ T27] usb 1-1: config 0 descriptor?? [ 1180.337487][T14924] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1180.337487][T14924] [ 1180.351471][T14924] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1180.365101][T14924] CIFS: Attempting to mount //172.20.20.170/share [ 1180.748823][T14924] CIFS: VFS: error -4 create cifsd thread [ 1180.915271][T14924] CIFS: VFS: cifs_mount failed w/return code = -4 [ 1181.584891][ T56] usb 1-1: USB disconnect, device number 57 [ 1181.910496][T14944] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2609'. [ 1182.526858][T14936] loop2: detected capacity change from 0 to 32768 [ 1182.647688][ T28] audit: type=1800 audit(1791321687.779:62): pid=14936 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2606" name="file1" dev="loop2" ino=4 res=0 errno=0 [ 1183.347255][ T28] audit: type=1800 audit(1791321687.779:63): pid=14936 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2606" name="file1" dev="loop2" ino=4 res=0 errno=0 [ 1185.836372][ T27] usb 2-1: new full-speed USB device number 54 using dummy_hcd [ 1186.072761][ T27] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1186.130915][ T27] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1186.164041][ T27] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1186.182495][ T27] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1186.194469][ T27] usb 2-1: Product: syz [ 1186.215732][ T27] usb 2-1: Manufacturer: syz [ 1186.234642][ T27] usb 2-1: SerialNumber: syz [ 1186.259897][ T27] usb 2-1: config 0 descriptor?? [ 1187.187200][ T27] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 1187.391509][ T27] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1187.409354][ T27] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1187.427599][ T27] usb 1-1: Product: syz [ 1187.437477][ T27] usb 1-1: Manufacturer: syz [ 1187.447435][ T27] usb 1-1: SerialNumber: syz [ 1187.685993][ T27] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -32 [ 1187.748465][ T27] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -32 [ 1187.815633][T14984] loop3: detected capacity change from 0 to 32768 [ 1187.958212][ T28] audit: type=1800 audit(1791321693.079:64): pid=14984 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2622" name="file1" dev="loop3" ino=4 res=0 errno=0 [ 1188.075214][ T56] usb 2-1: USB disconnect, device number 54 [ 1188.183549][ T28] audit: type=1800 audit(1791321693.119:65): pid=14984 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2622" name="file1" dev="loop3" ino=4 res=0 errno=0 [ 1189.037621][ T27] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -32 [ 1189.070740][ T27] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000040. ret = -32 [ 1189.151836][ T27] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -32 [ 1189.215130][ T27] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00001004. ret = -71 [ 1189.447571][ T27] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00001008. ret = -71 [ 1189.569982][ T27] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00001020. ret = -71 [ 1189.606070][ T27] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00001028. ret = -71 [ 1189.665729][ T27] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001030. ret = -71 [ 1190.017862][ T27] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1190.068988][T15007] syzkaller0: entered promiscuous mode [ 1190.069055][ T27] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1190.074507][T15007] syzkaller0: entered allmulticast mode [ 1190.162506][ T27] lan78xx: probe of 1-1:1.0 failed with error -71 [ 1190.222514][ T27] usb 1-1: USB disconnect, device number 58 [ 1191.767435][T15024] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2632'. [ 1193.172671][T14236] usb 1-1: new full-speed USB device number 59 using dummy_hcd [ 1193.390379][T14236] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1194.095084][T15039] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1194.095084][T15039] [ 1194.109207][T15039] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1194.122861][T15039] CIFS: Attempting to mount //172.20.20.170/share [ 1194.939508][T15039] CIFS: VFS: cifs_mount failed w/return code = -112 [ 1195.004306][T14236] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1195.014077][T14236] usb 1-1: string descriptor 0 read error: -71 [ 1195.014209][T14236] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1195.014235][T14236] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1195.056721][T14236] usb 1-1: config 0 descriptor?? [ 1195.057190][T14236] usb 1-1: can't set config #0, error -71 [ 1195.058541][T14236] usb 1-1: USB disconnect, device number 59 [ 1195.257974][T11774] Bluetooth: hci2: command 0x0406 tx timeout [ 1196.832731][T15062] syzkaller0: entered promiscuous mode [ 1196.842649][T15062] syzkaller0: entered allmulticast mode [ 1197.027223][ T27] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 1197.187539][ T56] usb 3-1: new full-speed USB device number 54 using dummy_hcd [ 1197.213440][ T27] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1197.240221][ T27] usb 1-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1197.267786][ T27] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1197.276079][ T27] usb 1-1: Product: syz [ 1197.280837][ T27] usb 1-1: Manufacturer: syz [ 1197.286201][ T27] usb 1-1: SerialNumber: syz [ 1197.302386][ T27] usbhid 1-1:1.0: couldn't find an input interrupt endpoint [ 1197.369573][ T56] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1197.399256][ T56] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1197.409106][ T56] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1197.417379][ T56] usb 3-1: Product: syz [ 1197.421720][ T56] usb 3-1: Manufacturer: syz [ 1197.426399][ T56] usb 3-1: SerialNumber: syz [ 1197.439261][ T56] usb 3-1: config 0 descriptor?? [ 1197.531497][ T27] dvb_usb_ec168: probe of 1-1:1.1 failed with error -71 [ 1197.562792][ T27] usb 1-1: USB disconnect, device number 60 [ 1200.075742][T15080] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1200.075742][T15080] [ 1200.089804][T15080] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1200.102962][T15080] CIFS: Attempting to mount //172.20.20.170/share [ 1201.817408][T15080] CIFS: VFS: cifs_mount failed w/return code = -112 [ 1201.839563][T14236] usb 3-1: USB disconnect, device number 54 [ 1203.178567][T15098] syzkaller0: entered promiscuous mode [ 1203.207234][T15098] syzkaller0: entered allmulticast mode [ 1203.526039][T15092] loop1: detected capacity change from 0 to 40427 [ 1203.550658][T15092] F2FS-fs (loop1): Image doesn't support compression [ 1203.562587][T15092] F2FS-fs (loop1): build fault injection attr: rate: 0, type: 0x4 [ 1203.595929][T15092] F2FS-fs (loop1): invalid crc value [ 1203.616996][T15092] F2FS-fs (loop1): Found nat_bits in checkpoint [ 1203.737469][T15092] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 1203.757221][ T6066] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 1203.949614][ T6066] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1203.988818][ T6066] usb 4-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1204.021497][ T6066] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1204.037605][ T6066] usb 4-1: Product: syz [ 1204.047160][ T6066] usb 4-1: Manufacturer: syz [ 1204.051937][ T6066] usb 4-1: SerialNumber: syz [ 1204.073308][ T6066] usbhid 4-1:1.0: couldn't find an input interrupt endpoint [ 1204.148239][T15105] loop0: detected capacity change from 0 to 32768 [ 1204.218107][ T28] audit: type=1800 audit(1791321709.359:66): pid=15105 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2658" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 1204.306607][ T28] audit: type=1800 audit(1791321709.439:67): pid=15109 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2658" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 1204.333677][ T6066] dvb_usb_ec168: probe of 4-1:1.1 failed with error -71 [ 1204.375784][ T6066] usb 4-1: USB disconnect, device number 56 [ 1205.187306][ T56] usb 2-1: new full-speed USB device number 55 using dummy_hcd [ 1205.813381][T15129] syzkaller0: entered promiscuous mode [ 1205.819132][T15129] syzkaller0: entered allmulticast mode [ 1205.828622][ T56] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1205.839508][T15129] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2665'. [ 1206.511886][ T56] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1206.530725][ T56] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1206.555039][ T56] usb 2-1: Product: syz [ 1206.566326][ T56] usb 2-1: Manufacturer: syz [ 1206.573100][ T56] usb 2-1: SerialNumber: syz [ 1206.587815][ T56] usb 2-1: config 0 descriptor?? [ 1208.360080][ T6066] usb 2-1: USB disconnect, device number 55 [ 1208.674157][T15143] bridge0: port 1(bridge_slave_0) entered disabled state [ 1210.277203][T11774] Bluetooth: hci0: command 0x0401 tx timeout [ 1210.346007][T15165] syzkaller0: entered promiscuous mode [ 1210.353993][T15165] syzkaller0: entered allmulticast mode [ 1210.457881][T15165] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2676'. [ 1210.723588][T15170] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1210.723588][T15170] [ 1210.770300][T15170] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1210.813102][T15159] loop0: detected capacity change from 0 to 32768 [ 1210.819936][T15170] CIFS: Attempting to mount //172.20.20.170/share [ 1210.834282][T15170] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1210.842277][T15170] CIFS: VFS: cifs_mount failed w/return code = -111 [ 1210.902215][ T28] audit: type=1800 audit(1791321716.039:68): pid=15159 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2669" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 1210.951688][ T28] audit: type=1800 audit(1791321716.059:69): pid=15159 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2669" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 1211.017343][T14236] usb 2-1: new full-speed USB device number 56 using dummy_hcd [ 1211.232645][T14236] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1211.262255][T14236] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1211.278394][T14236] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1211.293268][T14236] usb 2-1: Product: syz [ 1211.299066][T14236] usb 2-1: Manufacturer: syz [ 1211.305113][T14236] usb 2-1: SerialNumber: syz [ 1211.315151][T14236] usb 2-1: config 0 descriptor?? [ 1214.086568][T14236] usb 2-1: USB disconnect, device number 56 [ 1214.345262][T15206] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1214.345262][T15206] [ 1214.377466][T15206] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1214.406118][T15206] CIFS: Attempting to mount //172.20.20.170/share [ 1214.426434][T15206] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1214.444417][T15206] CIFS: VFS: cifs_mount failed w/return code = -111 [ 1214.647571][T15208] netlink: 'syz.2.2692': attribute type 10 has an invalid length. [ 1214.704945][T15208] team0: Port device netdevsim0 added [ 1217.957546][T14236] usb 2-1: new full-speed USB device number 57 using dummy_hcd [ 1218.181133][T14236] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1218.200856][T14236] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1218.227619][T14236] usb 2-1: Product: syz [ 1218.231858][T14236] usb 2-1: Manufacturer: syz [ 1218.236483][T14236] usb 2-1: SerialNumber: syz [ 1218.270560][T14236] usb 2-1: config 0 descriptor?? [ 1218.523419][T14236] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1218.742509][T14236] dvb_usb_rtl28xxu: probe of 2-1:0.0 failed with error -32 [ 1220.939907][T11864] usb 2-1: USB disconnect, device number 57 [ 1221.006538][T14647] Bluetooth: hci4: command 0x0406 tx timeout [ 1221.503840][T15244] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1221.503840][T15244] [ 1221.517725][T15244] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1221.531039][T15244] CIFS: Attempting to mount //172.20.20.170/share [ 1221.750407][T15244] CIFS: VFS: cifs_mount failed w/return code = -512 [ 1223.954347][T15259] syzkaller0: entered promiscuous mode [ 1224.004947][T15259] syzkaller0: entered allmulticast mode [ 1226.408255][ T5812] usb 1-1: new full-speed USB device number 61 using dummy_hcd [ 1226.422494][T15270] loop1: detected capacity change from 0 to 32768 [ 1226.475378][ T28] audit: type=1800 audit(1791321731.609:70): pid=15270 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2709" name="file1" dev="loop1" ino=4 res=0 errno=0 [ 1226.779142][ T5812] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1226.796085][T15282] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2712'. [ 1226.814669][ T5812] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1226.851987][ T5812] usb 1-1: Product: syz [ 1226.872690][ T5812] usb 1-1: Manufacturer: syz [ 1226.899447][ T5812] usb 1-1: SerialNumber: syz [ 1226.956889][ T5812] usb 1-1: config 0 descriptor?? [ 1227.189098][ T5812] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1227.410297][ T5812] dvb_usb_rtl28xxu: probe of 1-1:0.0 failed with error -32 [ 1229.265318][T15297] syzkaller0: entered promiscuous mode [ 1229.266201][T11864] usb 1-1: USB disconnect, device number 61 [ 1229.271218][T15297] syzkaller0: entered allmulticast mode [ 1233.224079][T15315] loop2: detected capacity change from 0 to 32768 [ 1233.294479][ T28] audit: type=1800 audit(1791321738.429:71): pid=15315 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2722" name="file1" dev="loop2" ino=4 res=0 errno=0 [ 1235.417394][T15332] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1235.417394][T15332] [ 1235.431508][T15332] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1235.444715][T15332] CIFS: Attempting to mount //172.20.20.170/share [ 1237.143504][T15332] CIFS: VFS: cifs_mount failed w/return code = -512 [ 1237.187250][T11774] Bluetooth: hci0: command 0x0401 tx timeout [ 1238.875740][T15343] syzkaller0: entered promiscuous mode [ 1238.925946][T15343] syzkaller0: entered allmulticast mode [ 1239.573066][T15359] binder: BINDER_SET_CONTEXT_MGR already set [ 1239.579327][T15359] binder: 15346:15359 ioctl 4018620d 200000001000 returned -16 [ 1241.837293][ T8] usb 4-1: new full-speed USB device number 57 using dummy_hcd [ 1242.050109][ T8] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1242.060333][ T8] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1242.068910][ T8] usb 4-1: Product: syz [ 1242.073252][ T8] usb 4-1: Manufacturer: syz [ 1242.078516][ T8] usb 4-1: SerialNumber: syz [ 1242.389148][ T8] usb 4-1: config 0 descriptor?? [ 1242.649194][ T8] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1242.765094][T15395] Bluetooth: MGMT ver 1.22 [ 1242.851357][ T8] dvb_usb_rtl28xxu: probe of 4-1:0.0 failed with error -32 [ 1243.018823][T15403] loop1: detected capacity change from 0 to 512 [ 1243.034151][T15403] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1243.084124][T15403] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1243.097875][T15403] ext4 filesystem being mounted at /119/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1244.668276][ T5811] usb 4-1: USB disconnect, device number 57 [ 1244.847576][T14647] Bluetooth: hci0: command 0x0401 tx timeout [ 1244.853702][T11774] Bluetooth: hci0: Opcode 0x0c3a failed: -110 [ 1246.162587][T15440] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2754'. [ 1246.213822][T13433] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1246.917266][ T8] usb 3-1: new full-speed USB device number 55 using dummy_hcd [ 1246.997517][T11774] Bluetooth: hci0: command 0x0401 tx timeout [ 1248.917747][ T8] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1248.926861][ T8] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1248.930605][T15470] loop0: detected capacity change from 0 to 512 [ 1248.945718][T15470] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1248.985310][ T8] usb 3-1: Product: syz [ 1248.990095][ T8] usb 3-1: Manufacturer: syz [ 1248.994728][ T8] usb 3-1: SerialNumber: syz [ 1249.025063][ T8] usb 3-1: config 0 descriptor?? [ 1249.057551][T15470] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1249.107385][T11774] Bluetooth: hci0: command tx timeout [ 1249.131402][T15470] ext4 filesystem being mounted at /52/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1249.246617][ T8] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1249.449219][ T8] dvb_usb_rtl28xxu: probe of 3-1:0.0 failed with error -32 [ 1249.916400][T15489] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2770'. [ 1250.734813][T15084] usb 3-1: USB disconnect, device number 55 [ 1250.816359][T14313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1255.421137][T11774] Bluetooth: hci0: command tx timeout [ 1256.051857][T15528] loop2: detected capacity change from 0 to 512 [ 1256.074130][T15528] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1256.097304][ T8] usb 1-1: new full-speed USB device number 62 using dummy_hcd [ 1256.135173][T15528] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1256.149368][T15528] ext4 filesystem being mounted at /80/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1256.294575][ T8] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1256.314126][ T8] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1256.329886][ T8] usb 1-1: Product: syz [ 1256.334129][ T8] usb 1-1: Manufacturer: syz [ 1256.359158][ T8] usb 1-1: SerialNumber: syz [ 1256.458565][ T8] usb 1-1: config 0 descriptor?? [ 1256.724680][ T8] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1256.922370][ T8] dvb_usb_rtl28xxu: probe of 1-1:0.0 failed with error -32 [ 1256.933639][T15537] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2782'. [ 1257.322150][T15542] loop3: detected capacity change from 0 to 64 [ 1257.487781][T14647] Bluetooth: hci0: command tx timeout [ 1258.363306][T14011] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1260.142927][T11774] Bluetooth: hci0: command tx timeout [ 1260.281233][ T6066] usb 1-1: USB disconnect, device number 62 [ 1261.385542][T15572] loop1: detected capacity change from 0 to 32768 [ 1261.405164][T15572] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.2793 (15572) [ 1261.616553][T15578] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2794'. [ 1262.241685][T15572] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1262.298343][T15572] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 1262.307336][T15572] BTRFS info (device loop1): setting nodatasum [ 1262.313572][T15572] BTRFS info (device loop1): force zlib compression, level 3 [ 1262.322951][T15572] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_LZO (0x8) [ 1262.333136][T15572] BTRFS info (device loop1): use lzo compression, level 0 [ 1262.340608][T15572] BTRFS info (device loop1): turning on flush-on-commit [ 1262.347762][T15572] BTRFS info (device loop1): enabling auto defrag [ 1262.354268][T15572] BTRFS info (device loop1): max_inline at 4096 [ 1262.361131][T15572] BTRFS info (device loop1): using free space tree [ 1262.527167][ T5811] usb 3-1: new full-speed USB device number 56 using dummy_hcd [ 1263.591522][ T5811] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1263.962538][ T5811] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1263.993392][ T5811] usb 3-1: Product: syz [ 1264.001810][ T5811] usb 3-1: Manufacturer: syz [ 1264.021791][ T5811] usb 3-1: SerialNumber: syz [ 1264.054119][ T5811] usb 3-1: config 0 descriptor?? [ 1264.166261][T15572] BTRFS error (device loop1): open_ctree failed: -4 [ 1266.158036][ T5811] dvb_usb_rtl28xxu 3-1:0.0: chip type detection failed -110 [ 1266.177168][ T5811] dvb_usb_rtl28xxu: probe of 3-1:0.0 failed with error -110 [ 1268.456626][ T56] usb 3-1: USB disconnect, device number 56 [ 1270.120678][T15651] loop3: detected capacity change from 0 to 2048 [ 1270.252887][T15651] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1271.941788][T15656] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 1272.080352][T13716] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1272.901479][T15084] usb 3-1: new full-speed USB device number 57 using dummy_hcd [ 1273.021266][T15676] netlink: 'syz.3.2816': attribute type 10 has an invalid length. [ 1273.261696][T15676] team0: Port device netdevsim0 added [ 1273.443410][T15084] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1273.453605][T15084] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1274.667146][T15084] usb 3-1: Product: syz [ 1274.671783][T15084] usb 3-1: Manufacturer: syz [ 1274.676416][T15084] usb 3-1: SerialNumber: syz [ 1274.729481][T15084] usb 3-1: config 0 descriptor?? [ 1276.932093][T15084] dvb_usb_rtl28xxu 3-1:0.0: chip type detection failed -110 [ 1276.957262][T15084] dvb_usb_rtl28xxu: probe of 3-1:0.0 failed with error -110 [ 1277.020263][ T6066] usb 3-1: USB disconnect, device number 57 [ 1277.597214][ T6066] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 1277.809053][ T6066] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1277.835939][ T6066] usb 3-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1277.866396][ T6066] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1277.897147][ T6066] usb 3-1: New USB device found, idVendor=05a4, idProduct=2000, bcdDevice= 0.00 [ 1277.916760][ T6066] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1277.968382][ T6066] usb 3-1: config 0 descriptor?? [ 1278.473824][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1278.501215][T15704] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1278.501215][T15704] [ 1278.515319][T15704] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1278.534165][T15704] CIFS: Attempting to mount //172.20.20.170/share [ 1278.546709][T15704] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1278.554474][T15704] CIFS: VFS: cifs_mount failed w/return code = -111 [ 1278.618874][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1278.708271][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1278.790507][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1278.889767][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1278.966414][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1279.064989][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1279.182676][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1279.206669][T11774] Bluetooth: hci0: command tx timeout [ 1279.270411][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1279.352608][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1279.425219][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1279.463325][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1279.491161][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1279.521051][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1279.560004][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1279.614384][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1279.996670][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1280.030309][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1280.051917][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1280.076778][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1280.141630][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1280.257234][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1280.265033][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1280.427466][ T6066] ortek 0003:05A4:2000.0006: unknown main item tag 0x0 [ 1280.457904][ T6066] ortek 0003:05A4:2000.0006: hidraw0: USB HID v0.03 Device [HID 05a4:2000] on usb-dummy_hcd.2-1/input0 [ 1280.492091][ T6066] usb 3-1: USB disconnect, device number 58 [ 1283.265697][T15722] fido_id[15722]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 1284.967300][ T27] usb 2-1: new full-speed USB device number 58 using dummy_hcd [ 1285.981180][ T27] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1285.990458][ T27] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1286.177335][ T27] usb 2-1: Product: syz [ 1286.181575][ T27] usb 2-1: Manufacturer: syz [ 1286.186205][ T27] usb 2-1: SerialNumber: syz [ 1286.219256][ T27] usb 2-1: config 0 descriptor?? [ 1287.321616][ T27] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1288.737149][ T27] dvb_usb_rtl28xxu: probe of 2-1:0.0 failed with error -110 [ 1289.548708][T15084] usb 2-1: USB disconnect, device number 58 [ 1289.621497][T15776] loop2: detected capacity change from 0 to 512 [ 1289.654975][T15776] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1290.722595][T15776] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1290.747861][T15776] ext4 filesystem being mounted at /88/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1291.622301][T15786] loop1: detected capacity change from 0 to 32768 [ 1291.703647][ T28] audit: type=1800 audit(1791321796.839:72): pid=15786 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2839" name="file1" dev="loop1" ino=4 res=0 errno=0 [ 1292.209472][T15799] netlink: 'syz.0.2843': attribute type 10 has an invalid length. [ 1292.318848][T15799] team0: Port device netdevsim0 added [ 1292.531440][T15803] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2844'. [ 1292.617719][T15804] loop0: detected capacity change from 0 to 64 [ 1293.407147][T11864] usb 1-1: new full-speed USB device number 63 using dummy_hcd [ 1297.003416][T11864] usb 1-1: device descriptor read/all, error -71 [ 1297.241417][T15825] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 1297.248508][T15825] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 1297.294253][T15825] vhci_hcd vhci_hcd.0: Device attached [ 1297.370344][T14011] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1297.527953][T15819] loop1: detected capacity change from 0 to 32768 [ 1297.568077][T13753] usb 33-1: new high-speed USB device number 2 using vhci_hcd [ 1297.582440][ T28] audit: type=1800 audit(1791321802.719:73): pid=15819 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2849" name="file1" dev="loop1" ino=4 res=0 errno=0 [ 1297.609223][ T28] audit: type=1800 audit(1791321802.719:74): pid=15819 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2849" name="file1" dev="loop1" ino=4 res=0 errno=0 [ 1298.058792][T15826] vhci_hcd: connection reset by peer [ 1298.068102][ T12] vhci_hcd: stop threads [ 1298.073508][ T12] vhci_hcd: release socket [ 1298.091516][ T12] vhci_hcd: disconnect device [ 1298.794943][T15840] netlink: 'syz.2.2855': attribute type 10 has an invalid length. [ 1298.920749][T15845] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2856'. [ 1299.699154][T14647] Bluetooth: hci0: command tx timeout [ 1301.830953][ T56] usb 1-1: new full-speed USB device number 65 using dummy_hcd [ 1304.315396][T13753] vhci_hcd: vhci_device speed not set [ 1304.387446][ T56] usb 1-1: device descriptor read/all, error -71 [ 1306.470462][T11774] Bluetooth: hci0: command tx timeout [ 1308.670855][T15885] netlink: 'syz.3.2868': attribute type 10 has an invalid length. [ 1308.828706][T15892] loop0: detected capacity change from 0 to 64 [ 1311.017368][T13753] usb 1-1: new full-speed USB device number 67 using dummy_hcd [ 1311.250762][T15890] loop2: detected capacity change from 0 to 32768 [ 1311.362755][ T28] audit: type=1800 audit(1791321816.499:75): pid=15890 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2862" name="file1" dev="loop2" ino=4 res=0 errno=0 [ 1312.002628][ T28] audit: type=1800 audit(1791321816.509:76): pid=15890 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2862" name="file1" dev="loop2" ino=4 res=0 errno=0 [ 1312.181627][T13753] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1312.198155][T13753] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1312.206210][T13753] usb 1-1: Product: syz [ 1312.227772][T13753] usb 1-1: Manufacturer: syz [ 1312.232444][T13753] usb 1-1: SerialNumber: syz [ 1312.267632][T13753] usb 1-1: config 0 descriptor?? [ 1312.527777][T14647] Bluetooth: hci0: command tx timeout [ 1312.533550][T13753] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1313.491202][T15915] jffs2: notice: (15915) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1313.962352][T13753] dvb_usb_rtl28xxu: probe of 1-1:0.0 failed with error -32 [ 1314.316225][T15927] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2877'. [ 1315.686227][ T8] usb 1-1: USB disconnect, device number 67 [ 1315.834110][T15932] netlink: 'syz.1.2880': attribute type 10 has an invalid length. [ 1315.870970][T15932] team0: Port device netdevsim0 added [ 1318.234686][T15950] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1318.234686][T15950] [ 1318.248687][T15950] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1318.261766][T15950] CIFS: Attempting to mount //172.20.20.170/share [ 1318.275436][T15950] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1318.283151][T15950] CIFS: VFS: cifs_mount failed w/return code = -111 [ 1320.117423][T14647] Bluetooth: hci0: command tx timeout [ 1322.802912][T15084] usb 2-1: new full-speed USB device number 59 using dummy_hcd [ 1323.804200][T15084] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1323.937293][T15084] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1324.040398][T15084] usb 2-1: Product: syz [ 1324.087462][T15084] usb 2-1: Manufacturer: syz [ 1324.092137][T15084] usb 2-1: SerialNumber: syz [ 1324.278454][T15084] usb 2-1: config 0 descriptor?? [ 1324.649734][T15084] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1326.118516][T15084] dvb_usb_rtl28xxu: probe of 2-1:0.0 failed with error -71 [ 1326.799360][T15084] usb 2-1: USB disconnect, device number 59 [ 1328.398607][T16000] syzkaller0: entered promiscuous mode [ 1328.428293][T16000] syzkaller0: entered allmulticast mode [ 1328.456489][T16003] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2897'. [ 1331.197410][ T27] usb 2-1: new full-speed USB device number 60 using dummy_hcd [ 1332.280359][ T27] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1332.302806][ T27] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1332.355160][ T27] usb 2-1: Product: syz [ 1332.371736][ T27] usb 2-1: Manufacturer: syz [ 1332.376408][ T27] usb 2-1: SerialNumber: syz [ 1332.411085][ T27] usb 2-1: config 0 descriptor?? [ 1333.379581][ T27] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1335.021996][T16056] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2911'. [ 1335.686522][ T27] dvb_usb_rtl28xxu: probe of 2-1:0.0 failed with error -71 [ 1335.707778][ T27] usb 2-1: USB disconnect, device number 60 [ 1339.171985][T16096] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2919'. [ 1340.820518][T16115] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1340.830447][T16115] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1340.997193][T14647] Bluetooth: hci0: command tx timeout [ 1342.893646][T16144] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1342.893646][T16144] [ 1342.907957][T16144] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1342.921950][T16144] CIFS: Attempting to mount //172.20.20.170/share [ 1342.934707][T16144] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1342.942370][T16144] CIFS: VFS: cifs_mount failed w/return code = -111 [ 1343.366986][T16149] fuse: Bad value for 'fd' [ 1343.700064][T16161] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2932'. [ 1345.133457][T16169] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1345.142816][T16169] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1347.509613][T16186] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2939'. [ 1348.377152][T13753] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 1348.394297][T16196] fuse: Bad value for 'fd' [ 1348.394864][T16194] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2942'. [ 1348.605788][T13753] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1348.629820][T13753] usb 3-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1348.654251][T13753] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1348.697148][T13753] usb 3-1: Product: syz [ 1348.701392][T13753] usb 3-1: Manufacturer: syz [ 1348.712955][T13753] usb 3-1: SerialNumber: syz [ 1348.733788][T13753] usbhid 3-1:1.0: couldn't find an input interrupt endpoint [ 1349.671023][T13753] dvb_usb_ec168: probe of 3-1:1.1 failed with error -71 [ 1349.746338][T13753] usb 3-1: USB disconnect, device number 59 [ 1353.939947][T16228] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2951'. [ 1354.305675][T16236] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1354.305675][T16236] [ 1354.319613][T16236] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1354.332582][T16236] CIFS: Attempting to mount //172.20.20.170/share [ 1356.687779][T16245] fuse: Bad value for 'fd' [ 1357.667892][T16236] CIFS: VFS: cifs_mount failed w/return code = -112 [ 1358.277334][ T27] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 1359.965522][ T27] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1360.007219][ T27] usb 2-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1360.019846][ T27] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1360.044728][ T27] usb 2-1: Product: syz [ 1360.052358][ T27] usb 2-1: Manufacturer: syz [ 1360.061027][ T27] usb 2-1: SerialNumber: syz [ 1360.198973][ T27] usbhid 2-1:1.0: couldn't find an input interrupt endpoint [ 1361.684206][ T27] dvb_usb_ec168: probe of 2-1:1.1 failed with error -71 [ 1361.721094][ T27] usb 2-1: USB disconnect, device number 61 [ 1367.729098][ T5812] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 1367.980479][ T5812] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1368.100563][ T5812] usb 3-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1368.186335][ T5812] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1368.260309][ T5812] usb 3-1: Product: syz [ 1368.314865][ T5812] usb 3-1: Manufacturer: syz [ 1368.358073][ T5812] usb 3-1: SerialNumber: syz [ 1368.607854][ T5812] usbhid 3-1:1.0: couldn't find an input interrupt endpoint [ 1368.716200][T16315] syzkaller0: entered promiscuous mode [ 1368.721910][T16315] syzkaller0: entered allmulticast mode [ 1368.731384][T16315] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2976'. [ 1368.886665][ T5812] dvb_usb_ec168: probe of 3-1:1.1 failed with error -71 [ 1369.660453][ T5812] usb 3-1: USB disconnect, device number 60 [ 1370.461049][T16327] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1370.461049][T16327] [ 1370.475249][T16327] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1370.488693][T16327] CIFS: Attempting to mount //172.20.20.170/share [ 1372.083322][T16327] CIFS: VFS: cifs_mount failed w/return code = -512 [ 1374.804606][T16352] syzkaller0: entered promiscuous mode [ 1374.893240][T16352] syzkaller0: entered allmulticast mode [ 1374.975848][T16356] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2986'. [ 1381.723000][T11774] Bluetooth: hci0: command tx timeout [ 1382.975897][T16400] syzkaller0: entered promiscuous mode [ 1383.011118][T16400] syzkaller0: entered allmulticast mode [ 1383.058632][T16400] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3001'. [ 1383.411521][T16408] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1383.411521][T16408] [ 1383.425938][T16408] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1383.439198][T16408] CIFS: Attempting to mount //172.20.20.170/share [ 1383.797177][T11774] Bluetooth: hci0: command tx timeout [ 1383.987113][T16408] CIFS: VFS: cifs_mount failed w/return code = -512 [ 1387.717690][T11774] Bluetooth: hci0: command tx timeout [ 1388.968059][T16444] syzkaller0: entered promiscuous mode [ 1388.973599][T16444] syzkaller0: entered allmulticast mode [ 1388.986401][T16444] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3013'. [ 1394.090440][T16461] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1394.090440][T16461] [ 1394.104220][T16461] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1394.117081][T16461] CIFS: Attempting to mount //172.20.20.170/share [ 1394.437135][T16461] CIFS: VFS: error -4 create cifsd thread [ 1394.442960][T11774] Bluetooth: hci0: command tx timeout [ 1394.454285][T16461] CIFS: VFS: cifs_mount failed w/return code = -4 [ 1400.678603][T11774] Bluetooth: hci0: command tx timeout [ 1404.599424][T16535] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3037'. [ 1410.804607][T11774] Bluetooth: hci0: command tx timeout [ 1411.761772][T16598] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3051'. [ 1418.358093][T11774] Bluetooth: hci0: command tx timeout [ 1419.482615][T16650] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3067'. [ 1423.102957][T16682] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3072'. [ 1424.037414][T14647] Bluetooth: hci0: command tx timeout [ 1424.188957][T16689] netlink: 'syz.2.3077': attribute type 10 has an invalid length. [ 1424.297702][T16692] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3079'. [ 1425.333338][T16700] loop0: detected capacity change from 0 to 8 [ 1428.140111][T16719] netlink: 'syz.2.3088': attribute type 10 has an invalid length. [ 1428.984844][T16722] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3089'. [ 1429.112555][T16724] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3090'. [ 1429.957460][T14647] Bluetooth: hci0: command tx timeout [ 1433.355244][T16750] netlink: 'syz.3.3097': attribute type 10 has an invalid length. [ 1433.896029][T16756] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3095'. [ 1434.439064][T16758] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3099'. [ 1435.323730][T11774] Bluetooth: hci0: command tx timeout [ 1436.737116][ T6066] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 1436.936001][ T6066] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1437.011568][ T6066] usb 3-1: config 0 has no interfaces? [ 1437.044092][ T6066] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1437.505951][ T6066] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1437.560695][ T6066] usb 3-1: config 0 descriptor?? [ 1437.572345][T16785] netlink: 'syz.3.3106': attribute type 10 has an invalid length. [ 1437.956651][T13753] usb 3-1: USB disconnect, device number 61 [ 1438.520857][T16790] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3108'. [ 1438.567642][T13753] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 1438.769758][T13753] usb 3-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1438.801276][T13753] usb 3-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1438.827114][T13753] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1438.833816][T13753] usb 3-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 1438.880572][T13753] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1438.914427][T13753] usb 3-1: config 0 descriptor?? [ 1439.063754][T16803] netlink: 'syz.0.3110': attribute type 1 has an invalid length. [ 1439.660097][T13753] hid-picolcd 0003:04D8:F002.0007: No report with id 0xf3 found [ 1439.681538][T13753] hid-picolcd 0003:04D8:F002.0007: No report with id 0xf4 found [ 1439.773000][T13753] usb 3-1: USB disconnect, device number 62 [ 1440.196176][T16809] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3111'. [ 1442.144933][T16828] netlink: 'syz.3.3118': attribute type 10 has an invalid length. [ 1442.951478][T16832] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3119'. [ 1446.562580][T16865] Cannot find set identified by id 0 to match [ 1446.740278][T16871] loop1: detected capacity change from 0 to 1024 [ 1447.054527][T16869] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3132'. [ 1450.703277][T16913] tipc: Started in network mode [ 1450.708443][T16913] tipc: Node identity 1000001, cluster identity 4711 [ 1450.715230][T16913] tipc: Node number set to 16777217 [ 1450.722747][T16913] tipc: Cannot configure node identity twice [ 1451.954856][T16932] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3143'. [ 1452.237848][T16934] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3146'. [ 1454.387683][T16964] netlink: 'syz.1.3151': attribute type 10 has an invalid length. [ 1455.204940][T16969] loop3: detected capacity change from 0 to 8192 [ 1455.667624][T16992] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3156'. [ 1456.520560][T17000] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3158'. [ 1458.401767][T17025] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1458.401767][T17025] [ 1458.415778][T17025] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1458.428915][T17025] CIFS: Attempting to mount //172.20.20.170/share [ 1460.079893][T17021] netlink: 'syz.3.3165': attribute type 10 has an invalid length. [ 1460.133600][T17025] CIFS: VFS: cifs_mount failed w/return code = -512 [ 1460.314305][T17029] netlink: 256 bytes leftover after parsing attributes in process `syz.0.3167'. [ 1460.757891][T17029] unsupported nlmsg_type 40 [ 1461.604827][T17054] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3171'. [ 1462.298635][T17056] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3169'. [ 1463.063063][T17075] netlink: 'syz.3.3177': attribute type 10 has an invalid length. [ 1465.325129][T17107] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3183'. [ 1466.059981][T17094] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3182'. [ 1466.111711][T17109] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1466.111711][T17109] [ 1466.125719][T17109] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1466.138717][T17109] CIFS: Attempting to mount //172.20.20.170/share [ 1466.343448][T17109] CIFS: VFS: cifs_mount failed w/return code = -512 [ 1466.433444][T17119] netlink: 'syz.3.3187': attribute type 10 has an invalid length. [ 1469.217488][T17143] FAULT_INJECTION: forcing a failure. [ 1469.217488][T17143] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1469.261448][T17143] CPU: 1 PID: 17143 Comm: syz.2.3192 Not tainted syzkaller #0 [ 1469.268986][T17143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1469.279196][T17143] Call Trace: [ 1469.282494][T17143] [ 1469.285444][T17143] dump_stack_lvl+0x18c/0x250 [ 1469.290171][T17143] ? show_regs_print_info+0x20/0x20 [ 1469.295407][T17143] ? load_image+0x420/0x420 [ 1469.299959][T17143] should_fail_ex+0x394/0x4c0 [ 1469.304681][T17143] get_futex_key+0x136/0x1030 [ 1469.309413][T17143] ? futex_setup_timer+0xc0/0xc0 [ 1469.314385][T17143] futex_wake+0x127/0x4f0 [ 1469.318762][T17143] ? futex_wake_mark+0x150/0x150 [ 1469.323744][T17143] ? do_fcntl+0xbdf/0x14a0 [ 1469.328202][T17143] ? __lock_acquire+0x7eb0/0x7eb0 [ 1469.333261][T17143] ? __might_fault+0xaa/0x120 [ 1469.337978][T17143] do_futex+0x35d/0x3e0 [ 1469.342172][T17143] ? do_fcntl+0xbdf/0x14a0 [ 1469.346624][T17143] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1469.352546][T17143] __se_sys_futex+0x3a9/0x440 [ 1469.357240][T17143] ? __x64_sys_futex+0xf0/0xf0 [ 1469.362014][T17143] ? __x64_sys_futex+0x21/0xf0 [ 1469.366780][T17143] do_syscall_64+0x55/0xb0 [ 1469.371222][T17143] ? clear_bhb_loop+0x40/0x90 [ 1469.375897][T17143] ? clear_bhb_loop+0x40/0x90 [ 1469.380573][T17143] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1469.386490][T17143] RIP: 0033:0x7f061b99e199 [ 1469.390922][T17143] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1469.410543][T17143] RSP: 002b:00007f061c80b0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1469.419014][T17143] RAX: ffffffffffffffda RBX: 00007f061bc25fa8 RCX: 00007f061b99e199 [ 1469.427005][T17143] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f061bc25fac [ 1469.435004][T17143] RBP: 00007f061bc25fa0 R08: 0000000000745a08 R09: 0000000000000000 [ 1469.442998][T17143] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1469.451183][T17143] R13: 00007f061bc26038 R14: 00007ffc397465e0 R15: 00007ffc397466c8 [ 1469.459182][T17143] [ 1470.117475][T11774] Bluetooth: hci0: command tx timeout [ 1470.803548][T17155] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3194'. [ 1472.342843][T17161] loop3: detected capacity change from 0 to 32768 [ 1474.261766][T17161] XFS (loop3): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 1474.318074][T17188] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3196'. [ 1474.365394][T17161] XFS (loop3): Ending clean mount [ 1474.418628][T17161] XFS (loop3): Quotacheck needed: Please wait. [ 1474.605181][T17161] XFS (loop3): Quotacheck: Done. [ 1475.360578][T13716] XFS (loop3): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 1475.379044][T17195] loop2: detected capacity change from 0 to 512 [ 1475.468905][T17195] EXT4-fs warning (device loop2): dx_probe:833: inode #2: comm syz.2.3200: Unrecognised inode hash code 255 [ 1475.539274][T17195] EXT4-fs warning (device loop2): dx_probe:966: inode #2: comm syz.2.3200: Corrupt directory, running e2fsck is recommended [ 1475.623079][T17195] EXT4-fs (loop2): Cannot turn on journaled quota: type 1: error -117 [ 1475.708474][T17195] EXT4-fs error (device loop2): ext4_iget_extra_inode:4752: inode #15: comm syz.2.3200: corrupted in-inode xattr: invalid ea_ino [ 1475.807150][T17195] EXT4-fs error (device loop2): ext4_orphan_get:1413: comm syz.2.3200: couldn't read orphan inode 15 (err -117) [ 1475.908492][T17195] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1475.967196][T11774] Bluetooth: hci0: command tx timeout [ 1476.136771][T17199] block nbd3: shutting down sockets [ 1476.161720][T14011] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1476.250692][T17202] netlink: 'syz.1.3199': attribute type 10 has an invalid length. [ 1476.759167][T17210] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3203'. [ 1481.724287][T17236] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3208'. [ 1482.438006][T14647] Bluetooth: hci0: command tx timeout [ 1482.483302][T17257] EXT4-fs (sda1): shut down requested (1) [ 1483.935606][T17257] Aborting journal on device sda1-8. [ 1484.166141][T17265] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3218'. [ 1484.218794][T17266] warning: `syz.0.3218' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 1484.324642][T17272] capability: warning: `syz.0.3221' uses deprecated v2 capabilities in a way that may be insecure [ 1484.427061][ T5811] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 1484.491991][T17274] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3222'. [ 1484.627183][ T5811] usb 4-1: Using ep0 maxpacket: 16 [ 1484.642601][ T5811] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1484.665283][ T5811] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1484.687440][ T5811] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1484.706652][ T5811] usb 4-1: Product: syz [ 1484.715395][ T5811] usb 4-1: Manufacturer: syz [ 1484.727139][ T5811] usb 4-1: SerialNumber: syz [ 1484.743759][ T5811] usb 4-1: config 0 descriptor?? [ 1484.756397][ T5811] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1484.777316][ T5811] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 1485.052556][T11864] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 1485.238321][T11864] usb 1-1: Using ep0 maxpacket: 16 [ 1485.245723][T11864] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1485.268586][T11864] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1485.289640][T11864] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1485.311279][T11864] usb 1-1: config 1 has no interface number 0 [ 1485.321442][T11864] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1485.334421][T11864] usb 1-1: New USB device found, idVendor=2b53, idProduct=0023, bcdDevice= 0.40 [ 1485.354306][T11864] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1485.362131][ T5811] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 1485.377170][T11864] usb 1-1: Product: syz [ 1485.381810][T11864] usb 1-1: Manufacturer: syz [ 1485.386451][T11864] usb 1-1: SerialNumber: syz [ 1485.418032][T17297] bridge0: port 2(bridge_slave_1) entered disabled state [ 1485.691868][T11864] usb 1-1: USB disconnect, device number 68 [ 1485.700847][ T5811] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1485.714645][ T5811] em28xx 4-1:0.0: board has no eeprom [ 1485.814561][T17270] udevd[17270]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1485.844302][ T5811] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1485.865723][ T5811] em28xx 4-1:0.0: dvb set to bulk mode. [ 1485.913119][ T5811] usb 4-1: USB disconnect, device number 58 [ 1485.924436][ T5812] em28xx 4-1:0.0: Binding DVB extension [ 1485.933153][ T5811] em28xx 4-1:0.0: Disconnecting em28xx [ 1485.957487][T14647] Bluetooth: hci0: command tx timeout [ 1486.010485][ T5812] em28xx 4-1:0.0: Registering input extension [ 1486.021866][ T5811] em28xx 4-1:0.0: Closing input extension [ 1486.108146][ T5811] em28xx 4-1:0.0: Freeing device [ 1486.231093][T17305] loop2: detected capacity change from 0 to 64 [ 1487.036126][T17297] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1487.099391][ T28] audit: type=1800 audit(1791321992.239:77): pid=17305 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3228" name="bus" dev="loop2" ino=21 res=0 errno=0 [ 1487.104155][T17297] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1487.382226][ T28] audit: type=1804 audit(1791321992.399:78): pid=17305 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.3228" name="/newroot/179/bus/bus" dev="loop2" ino=21 res=1 errno=0 [ 1489.077726][T14647] Bluetooth: hci0: command tx timeout [ 1489.166540][T17297] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1489.232942][T17297] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1489.242164][T17297] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1489.259380][T17297] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1489.582240][T17358] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1489.582240][T17358] [ 1489.596115][T17358] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1489.609360][T17358] CIFS: Attempting to mount //172.20.20.170/share [ 1490.319090][T17358] CIFS: VFS: cifs_mount failed w/return code = -512 [ 1490.397563][T17330] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3232'. [ 1493.854272][T17378] netlink: 'syz.2.3242': attribute type 10 has an invalid length. [ 1493.865452][T17377] loop1: detected capacity change from 0 to 4096 [ 1493.967057][T17381] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1494.423390][T17395] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1494.423390][T17395] [ 1494.437473][T17395] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1494.450510][T17395] CIFS: Attempting to mount //172.20.20.170/share [ 1495.059073][T17404] loop1: detected capacity change from 0 to 512 [ 1495.143357][T17395] CIFS: VFS: cifs_mount failed w/return code = -512 [ 1495.157930][T17394] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3248'. [ 1495.251954][T17404] EXT4-fs error (device loop1): ext4_validate_block_bitmap:430: comm syz.1.3247: bg 0: block 5: invalid block bitmap [ 1495.401497][T17404] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6655: Corrupt filesystem [ 1495.424931][T17384] loop2: detected capacity change from 0 to 32768 [ 1495.455051][T17384] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz.2.3244 (17384) [ 1495.473908][T17404] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.3247: invalid indirect mapped block 3 (level 2) [ 1495.533457][T17404] EXT4-fs (loop1): 1 orphan inode deleted [ 1495.552972][T17404] EXT4-fs (loop1): 1 truncate cleaned up [ 1495.569037][T17384] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1495.594023][T17404] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1495.601292][T17384] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm [ 1495.677207][T17384] BTRFS info (device loop2): setting nodatasum [ 1495.700683][T17384] BTRFS info (device loop2): force zlib compression, level 3 [ 1495.720930][T17384] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_LZO (0x8) [ 1495.750642][ T28] audit: type=1800 audit(1791322000.879:79): pid=17404 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3247" name="file1" dev="loop1" ino=15 res=0 errno=0 [ 1495.777237][T17384] BTRFS info (device loop2): use lzo compression, level 0 [ 1495.812968][T17384] BTRFS info (device loop2): turning on flush-on-commit [ 1495.822869][T17416] udevd[17416]: failed to execute '/usr/bin/udevadm' '/usr/bin/udevadm trigger -s block -p ID_BTRFS_READY=0': Input/output error [ 1495.837054][T17384] BTRFS info (device loop2): enabling auto defrag [ 1495.863987][T17384] BTRFS info (device loop2): max_inline at 4096 [ 1495.881104][T13433] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1495.889232][T17384] BTRFS info (device loop2): using free space tree [ 1496.089464][T17433] udevd[17433]: failed to execute '/usr/bin/udevadm' '/usr/bin/udevadm trigger -s block -p ID_BTRFS_READY=0': Input/output error [ 1496.406646][T17384] BTRFS info (device loop2): enabling ssd optimizations [ 1496.561967][ T28] audit: type=1800 audit(1791322001.699:80): pid=17384 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3244" name="file1" dev="loop2" ino=260 res=0 errno=0 [ 1496.603849][T17441] loop3: detected capacity change from 0 to 2048 [ 1496.671780][T17441] UDF-fs: error (device loop3): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 1496.702247][T17441] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1496.905021][T17443] udevd[17443]: failed to execute '/usr/bin/udevadm' '/usr/bin/udevadm trigger -s block -p ID_BTRFS_READY=0': Input/output error [ 1497.102185][T17447] netlink: 'syz.3.3254': attribute type 10 has an invalid length. [ 1497.105004][T14011] BTRFS info (device loop2): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1497.321513][T17451] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3257'. [ 1497.665125][T17470] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1497.665125][T17470] [ 1497.679295][T17470] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1497.692752][T17470] CIFS: Attempting to mount //172.20.20.170/share [ 1499.680921][T17470] CIFS: VFS: cifs_mount failed w/return code = -112 [ 1501.487585][T17489] netlink: 'syz.2.3265': attribute type 10 has an invalid length. [ 1501.726630][T17493] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3267'. [ 1504.082542][T17512] binder: 17511:17512 ioctl c0306201 200000000440 returned -14 [ 1504.154611][T17517] loop0: detected capacity change from 0 to 512 [ 1504.161645][T17512] bridge_slave_0: left allmulticast mode [ 1504.189830][T17512] bridge_slave_0: left promiscuous mode [ 1504.195653][T17512] bridge0: port 1(bridge_slave_0) entered disabled state [ 1504.269063][T17512] bridge_slave_1: left allmulticast mode [ 1504.274788][T17512] bridge_slave_1: left promiscuous mode [ 1504.280801][T17512] bridge0: port 2(bridge_slave_1) entered disabled state [ 1504.288573][T17521] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1504.741594][T17512] bond0: (slave bond_slave_0): Releasing backup interface [ 1505.026053][T17512] bond0: (slave bond_slave_1): Releasing backup interface [ 1505.197469][T17512] team0: Port device team_slave_0 removed [ 1505.421759][T17512] team0: Port device team_slave_1 removed [ 1505.434700][T17512] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1505.442754][T17512] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1505.452176][T17512] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1505.461486][T17512] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1505.485308][T17512] team0: Port device netdevsim0 removed [ 1505.597181][T17533] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1505.597181][T17533] [ 1505.611119][T17533] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1505.624087][T17533] CIFS: Attempting to mount //172.20.20.170/share [ 1505.635722][T17533] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1505.643417][T17533] CIFS: VFS: cifs_mount failed w/return code = -111 [ 1508.590449][T17539] netlink: 'syz.1.3277': attribute type 10 has an invalid length. [ 1508.718133][T17542] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3278'. [ 1508.889150][T17544] input: syz1 as /devices/virtual/input/input63 [ 1509.237162][T17346] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 1509.447036][T17346] usb 4-1: Using ep0 maxpacket: 16 [ 1509.459717][T17346] usb 4-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1509.472520][T17346] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1509.501462][T17346] usb 4-1: Product: syz [ 1509.505692][T17346] usb 4-1: Manufacturer: syz [ 1509.534208][T17346] usb 4-1: SerialNumber: syz [ 1509.558126][T17346] usb 4-1: config 0 descriptor?? [ 1509.740437][T17550] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3280'. [ 1509.817138][T17552] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3282'. [ 1509.996788][T17557] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1509.996788][T17557] [ 1510.010739][T17557] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1510.023721][T17346] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1510.034867][T17557] CIFS: Attempting to mount //172.20.20.170/share [ 1510.260944][T17346] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1510.272632][T17544] dtv5100: wlen = 0, aborting. [ 1510.389749][T17346] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1510.478180][T17346] usb 4-1: media controller created [ 1510.492176][T17546] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1510.900363][T17346] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1510.957118][T17561] loop0: detected capacity change from 0 to 256 [ 1512.223926][T17557] CIFS: VFS: cifs_mount failed w/return code = -112 [ 1512.288714][T17346] zl10353_read_register: readreg error (reg=127, ret==0) [ 1512.311275][T17346] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1512.363695][T17346] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1512.424015][T17346] usb 4-1: USB disconnect, device number 59 [ 1512.569376][T17346] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 1512.760306][T17571] loop1: detected capacity change from 0 to 2048 [ 1513.599703][T17588] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1513.599703][T17588] [ 1513.613580][T17588] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1513.626833][T17588] CIFS: Attempting to mount //172.20.20.170/share [ 1513.638441][T17588] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1513.646114][T17588] CIFS: VFS: cifs_mount failed w/return code = -111 [ 1514.054511][T17586] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3291'. [ 1514.239290][T17590] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3287'. [ 1515.916643][T17352] hid-generic 0000:0000:0000.0008: unknown main item tag 0x0 [ 1515.947895][T17352] hid-generic 0000:0000:0000.0008: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1515.976702][T17609] udevd[17609]: failed to execute '/lib/udev/fido_id' 'fido_id': Input/output error [ 1519.501248][T17621] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1519.501248][T17621] [ 1519.515486][T17621] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1519.528812][T17621] CIFS: Attempting to mount //172.20.20.170/share [ 1519.539123][T17621] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1519.546807][T17621] CIFS: VFS: cifs_mount failed w/return code = -111 [ 1521.979637][T17632] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3302'. [ 1523.693527][T17637] loop1: detected capacity change from 0 to 32768 [ 1523.714240][T17637] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.3307 (17637) [ 1523.770638][T17637] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1523.824939][T17637] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 1523.854124][T17637] BTRFS info (device loop1): setting nodatasum [ 1523.909865][T17637] BTRFS info (device loop1): force zlib compression, level 3 [ 1523.933689][T17637] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_LZO (0x8) [ 1523.965557][T17637] BTRFS info (device loop1): use lzo compression, level 0 [ 1523.996150][T17637] BTRFS info (device loop1): turning on flush-on-commit [ 1524.016258][T17637] BTRFS info (device loop1): enabling auto defrag [ 1524.037905][T17637] BTRFS info (device loop1): max_inline at 4096 [ 1524.044230][T17637] BTRFS info (device loop1): using free space tree [ 1524.074121][T17648] udevd[17648]: failed to execute '/usr/bin/udevadm' '/usr/bin/udevadm trigger -s block -p ID_BTRFS_READY=0': Input/output error [ 1524.264005][T17637] BTRFS info (device loop1): enabling ssd optimizations [ 1524.387101][ T28] audit: type=1800 audit(1791322029.519:81): pid=17637 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3307" name="file1" dev="loop1" ino=260 res=0 errno=0 [ 1524.465061][T17666] udevd[17666]: failed to execute '/usr/bin/udevadm' '/usr/bin/udevadm trigger -s block -p ID_BTRFS_READY=0': Input/output error [ 1524.782581][T13433] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1524.992443][T17671] loop2: detected capacity change from 0 to 64 [ 1525.260359][T17674] syzkaller0: entered promiscuous mode [ 1525.266058][T17674] syzkaller0: entered allmulticast mode [ 1525.286774][T17674] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3315'. [ 1525.390216][T17681] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1525.390216][T17681] [ 1525.404150][T17681] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1525.417111][T17681] CIFS: Attempting to mount //172.20.20.170/share [ 1525.430568][ T49] nci: nci_rsp_packet: unknown rsp opcode 0x905 [ 1526.217184][T17681] CIFS: VFS: cifs_mount failed w/return code = -112 [ 1527.210678][T17697] loop0: detected capacity change from 0 to 4096 [ 1527.474267][T17697] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 1527.505933][T17697] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 3689623684042142765 bytes. [ 1527.532261][T17697] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 1527.554262][T17697] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 1527.566604][T17697] ldm_validate_privheads(): Primary and backup PRIVHEADs don't match. [ 1527.576882][T17697] loop0: [ 1527.709724][T17706] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3322'. [ 1528.268612][T17675] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1528.491824][T17720] syzkaller0: entered promiscuous mode [ 1528.505780][T17720] syzkaller0: entered allmulticast mode [ 1528.579499][T17720] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3328'. [ 1528.610574][T17723] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1528.610574][T17723] [ 1528.624866][T17723] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1528.638220][T17723] CIFS: Attempting to mount //172.20.20.170/share [ 1528.891317][T17729] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3330'. [ 1529.413178][T17723] CIFS: VFS: cifs_mount failed w/return code = -112 [ 1531.477239][T17346] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 1531.671713][T17749] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3334'. [ 1531.997082][T17346] usb 4-1: Using ep0 maxpacket: 16 [ 1532.013864][T17346] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1532.024922][T17346] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1532.041078][T17346] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1532.074694][T17346] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1532.090593][T17346] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1532.110590][T17346] usb 4-1: config 0 descriptor?? [ 1532.650336][T17346] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.0009/input/input64 [ 1532.696866][T17346] microsoft 0003:045E:07DA.0009: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 1532.753770][T17762] udevd[17762]: failed to execute '/lib/udev/fido_id' 'fido_id': Input/output error [ 1532.848078][T17352] usb 4-1: USB disconnect, device number 60 [ 1533.093370][T17767] syzkaller0: entered promiscuous mode [ 1533.099291][T17767] syzkaller0: entered allmulticast mode [ 1533.187906][T17767] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3342'. [ 1534.335009][T17780] trusted_key: syz.3.3347 sent an empty control message without MSG_MORE. [ 1534.637096][T17347] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 1534.817657][T17347] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 1534.827343][T17347] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1534.842508][T17347] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1534.854672][T17347] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1534.865909][T17347] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1534.877843][T17347] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1534.889124][T17347] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1534.897585][T17347] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1534.906634][T17347] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1534.918567][T17347] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1534.926666][T17347] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1534.936341][T17347] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1534.947878][T17347] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1534.956334][T17347] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1534.983547][T17347] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1534.994819][T17347] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1535.003217][T17347] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1535.012847][T17347] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1535.024744][T17347] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1535.054531][T17347] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1535.063974][T17347] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1535.075817][T17347] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1535.088800][T17347] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1535.109027][T17347] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1535.134272][T17347] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1535.148784][T17347] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1535.158396][T17347] usb 3-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1535.183539][T17347] usb 3-1: Product: syz [ 1535.188191][T17347] usb 3-1: Manufacturer: syz [ 1535.192998][T17347] usb 3-1: SerialNumber: syz [ 1535.202760][T17347] usb 3-1: config 0 descriptor?? [ 1535.220732][T17347] yurex 3-1:0.0: USB YUREX device now attached to Yurex #0 [ 1535.447768][T17352] usb 3-1: USB disconnect, device number 63 [ 1535.469384][T17352] yurex 3-1:0.0: USB YUREX #0 now disconnected [ 1535.479619][T17791] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3350'. [ 1536.072299][T17797] syzkaller0: entered promiscuous mode [ 1536.080141][T17797] syzkaller0: entered allmulticast mode [ 1536.095063][T17797] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3353'. [ 1538.742252][T17820] syzkaller0: entered promiscuous mode [ 1538.765324][T17820] syzkaller0: entered allmulticast mode [ 1538.814862][T17822] syzkaller0: entered promiscuous mode [ 1538.829071][T17822] syzkaller0: entered allmulticast mode [ 1538.946714][T17825] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3362'. [ 1539.100713][T17829] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3363'. [ 1543.151008][T17852] loop2: detected capacity change from 0 to 256 [ 1543.452018][T17856] syzkaller0: entered promiscuous mode [ 1543.463473][T17856] syzkaller0: entered allmulticast mode [ 1543.496139][T17856] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3375'. [ 1544.392249][T17853] loop0: detected capacity change from 0 to 40427 [ 1544.486647][T17853] F2FS-fs (loop0): Corrupted extension count (64 + 1 > 64) [ 1544.525834][T17853] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 1544.570334][T17853] F2FS-fs (loop0): Image doesn't support compression [ 1544.577623][T17853] F2FS-fs (loop0): Image doesn't support compression [ 1544.590689][T17853] F2FS-fs (loop0): invalid crc value [ 1545.312069][T17863] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1545.312069][T17863] [ 1545.326886][T17863] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1545.340461][T17863] CIFS: Attempting to mount //172.20.20.170/share [ 1545.783394][T17863] CIFS: VFS: cifs_mount failed w/return code = -512 [ 1545.795349][T17853] F2FS-fs (loop0): Start checkpoint disabled! [ 1545.900603][T17853] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 1545.921352][T17853] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 1547.262371][T17881] loop3: detected capacity change from 0 to 16 [ 1547.282927][T17881] erofs: (device loop3): mounted with root inode @ nid 36. [ 1547.610333][T17880] erofs: (device loop3): z_erofs_readahead: readahead error at folio 3 @ nid 89 [ 1547.812933][T17880] syz.3.3382: attempt to access beyond end of device [ 1547.812933][T17880] loop3: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 1548.138609][T17888] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3379'. [ 1548.172993][T17880] erofs: (device loop3): z_erofs_readahead: readahead error at folio 4 @ nid 89 [ 1548.277831][T17880] syz.3.3382: attempt to access beyond end of device [ 1548.277831][T17880] loop3: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 1548.315549][T17880] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -4055 in[4096, 0] out[8192] [ 1548.409841][ T28] audit: type=1800 audit(1791322053.489:82): pid=17880 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.3382" name="file3" dev="loop3" ino=89 res=0 errno=0 [ 1550.299768][T17899] loop2: detected capacity change from 0 to 256 [ 1550.342092][T17899] FAT-fs (loop2): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 1550.357110][T17343] usb 2-1: new full-speed USB device number 62 using dummy_hcd [ 1550.375553][T17899] FAT-fs (loop2): Filesystem has been set read-only [ 1550.385862][T17899] FAT-fs (loop2): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 1550.407027][T17899] FAT-fs (loop2): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 1550.426268][ T28] audit: type=1800 audit(1791322055.559:83): pid=17899 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3387" name="file1" dev="loop2" ino=1048845 res=0 errno=0 [ 1550.553192][T17343] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1550.563196][T17343] usb 2-1: not running at top speed; connect to a high speed hub [ 1550.578426][T17343] usb 2-1: config 114 has an invalid interface number: 240 but max is 0 [ 1550.593762][T17343] usb 2-1: config 114 has no interface number 0 [ 1550.607062][T17343] usb 2-1: config 114 interface 240 altsetting 232 endpoint 0x1 has invalid maxpacket 1023, setting to 64 [ 1550.639674][T17343] usb 2-1: config 114 interface 240 altsetting 232 has an invalid endpoint with address 0xCA, skipping [ 1550.671191][T17343] usb 2-1: config 114 interface 240 has no altsetting 0 [ 1550.694539][T17343] usb 2-1: string descriptor 0 read error: -22 [ 1550.701377][T17343] usb 2-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice= 6.38 [ 1550.727004][T17343] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1550.748933][T17896] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1550.758852][T17343] ir_usb 2-1:114.240: required endpoints missing [ 1551.030615][T17907] syzkaller0: entered promiscuous mode [ 1551.051691][T17907] syzkaller0: entered allmulticast mode [ 1551.072141][T17907] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3385'. [ 1551.598509][T17917] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1551.598509][T17917] [ 1551.612592][T17917] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1551.625509][T17917] CIFS: Attempting to mount //172.20.20.170/share [ 1552.435589][T17917] CIFS: VFS: cifs_mount failed w/return code = -112 [ 1554.074104][T17346] usb 2-1: USB disconnect, device number 62 [ 1554.355481][T17934] loop2: detected capacity change from 0 to 512 [ 1554.370340][T17932] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3399'. [ 1554.417213][T17934] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 1554.510086][T17934] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #16: comm syz.2.3398: invalid indirect mapped block 32768 (level 2) [ 1554.576312][T17940] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3400'. [ 1554.586716][T17934] EXT4-fs (loop2): 1 orphan inode deleted [ 1554.594862][T17934] EXT4-fs (loop2): 1 truncate cleaned up [ 1554.602054][T17934] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1554.661501][T14011] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1554.762021][T17944] syzkaller0: entered promiscuous mode [ 1554.767924][T17944] syzkaller0: entered allmulticast mode [ 1554.777806][T17944] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3401'. [ 1554.947146][T17346] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 1555.020644][T17948] netlink: 80 bytes leftover after parsing attributes in process `syz.2.3403'. [ 1555.173354][T17948] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3403'. [ 1555.186093][T17346] usb 2-1: Using ep0 maxpacket: 8 [ 1555.844842][T17346] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1556.437281][T17346] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1556.457015][T17346] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 1556.487240][T17346] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 1556.510964][T17346] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 1556.537120][T17346] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1556.594901][T17346] hub 2-1:1.0: bad descriptor, ignoring hub [ 1556.609375][T17346] hub: probe of 2-1:1.0 failed with error -5 [ 1556.615992][T17346] cdc_wdm 2-1:1.0: skipping garbage [ 1556.638571][T17346] cdc_wdm 2-1:1.0: skipping garbage [ 1556.657449][T17346] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 1556.663418][T17346] cdc_wdm 2-1:1.0: Unknown control protocol [ 1556.987961][ T5762] usb 2-1: USB disconnect, device number 63 [ 1560.347449][T17976] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1560.356383][T17976] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1562.697158][T17347] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 1563.646263][T17992] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1563.646263][T17992] [ 1563.660283][T17992] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1563.673374][T17992] CIFS: Attempting to mount //172.20.20.170/share [ 1564.569520][T17347] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1564.581402][T17992] CIFS: VFS: cifs_mount failed w/return code = -112 [ 1564.590808][T17347] usb 2-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1564.606993][T17347] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1564.952027][T17347] usb 2-1: Product: syz [ 1564.969915][T17347] usb 2-1: Manufacturer: syz [ 1564.975683][T17347] usb 2-1: SerialNumber: syz [ 1565.006275][T17347] usbhid 2-1:1.0: couldn't find an input interrupt endpoint [ 1565.549792][T17347] dvb_usb_ec168: probe of 2-1:1.1 failed with error -71 [ 1565.657095][T17347] usb 2-1: USB disconnect, device number 64 [ 1566.194360][T18008] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3419'. [ 1566.528833][T18013] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1566.537964][T18013] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1567.518679][T18021] loop2: detected capacity change from 0 to 4096 [ 1567.570354][T18021] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1567.650944][T18021] fscrypt (loop2, inode 18): Unsupported encryption flags (0x0c) [ 1567.701703][T14011] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1567.717231][T17352] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 1567.912996][T17352] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1567.935902][T17352] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1567.958404][T18025] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1567.999055][T18025] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3424'. [ 1568.003024][T17352] usb 4-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 1568.008035][T18025] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3424'. [ 1568.041784][T17352] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1568.042048][T18025] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1568.069238][T18025] bond1: (slave bond0): making interface the new active one [ 1568.078740][T18025] bond1: (slave bond0): Enslaving as an active interface with an up link [ 1568.079377][T17352] usb 4-1: Product: syz [ 1568.124447][T17352] usb 4-1: Manufacturer: syz [ 1568.134562][T17352] usb 4-1: SerialNumber: syz [ 1568.156202][T17352] ti_usb_3410_5052 4-1:2.0: TI USB 5052 2 port adapter converter detected [ 1568.193712][T17352] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 1568.211934][T18017] loop1: detected capacity change from 0 to 32768 [ 1568.234091][T17352] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 1570.219927][T18017] gfs2: fsid=syz:syz: Trying to join cluster "lock_dlm", "syz:syz" [ 1570.262158][T18017] dlm: no local IP address has been set [ 1570.285856][T18017] dlm: cannot start dlm midcomms -107 [ 1570.302985][T18017] gfs2: fsid=syz:syz: dlm_new_lockspace error -107 [ 1572.197272][T17347] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 1572.207244][ C1] raw-gadget.1 gadget.2: ignoring, device is not running [ 1572.357677][T17347] usb 3-1: device descriptor read/64, error -32 [ 1572.710448][T17347] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 1572.829611][T18052] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1572.838718][T18052] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1573.080882][T17347] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1573.165666][T17347] usb 3-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1573.397147][T17347] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1573.405245][T17347] usb 3-1: Product: syz [ 1573.410910][T17347] usb 3-1: Manufacturer: syz [ 1573.415591][T17347] usb 3-1: SerialNumber: syz [ 1573.433674][T17347] usbhid 3-1:1.0: couldn't find an input interrupt endpoint [ 1573.487624][T18019] ti_usb_3410_5052_2 ttyUSB0: ti_write_byte - failed, -110 [ 1573.518851][T18019] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set modem control on port 0, -110 [ 1573.537867][T18019] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot send open command (2), -32 [ 1573.611739][ T5762] usb 4-1: USB disconnect, device number 61 [ 1573.663051][T17347] dvb_usb_ec168: probe of 3-1:1.1 failed with error -71 [ 1574.517662][ T5762] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 1574.519386][T17347] usb 3-1: USB disconnect, device number 65 [ 1574.585665][ T5762] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 1574.648775][ T5762] ti_usb_3410_5052 4-1:2.0: device disconnected [ 1575.081854][T18067] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1575.081854][T18067] [ 1575.137766][T18067] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1575.508410][T18067] CIFS: Attempting to mount //172.20.20.170/share [ 1577.225265][T18067] CIFS: VFS: cifs_mount failed w/return code = -512 [ 1577.628518][T18079] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3433'. [ 1579.289090][T18091] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1579.298389][T18091] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1580.937067][T17346] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 1582.648992][T17346] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1582.698511][T17347] libceph: connect (1)[c::]:6789 error -101 [ 1582.704696][T17347] libceph: mon0 (1)[c::]:6789 connect error [ 1582.752417][T17346] usb 1-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1582.790413][T18112] ceph: No mds server is up or the cluster is laggy [ 1582.837203][T17346] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1582.860978][T17346] usb 1-1: Product: syz [ 1582.869014][T17346] usb 1-1: Manufacturer: syz [ 1582.874492][T17346] usb 1-1: SerialNumber: syz [ 1582.903558][T17346] usbhid 1-1:1.0: couldn't find an input interrupt endpoint [ 1583.136411][T18116] fuse: Bad value for 'group_id' [ 1583.216493][T17346] dvb_usb_ec168: probe of 1-1:1.1 failed with error -71 [ 1583.282672][T17346] usb 1-1: USB disconnect, device number 69 [ 1586.551321][T18135] loop2: detected capacity change from 0 to 512 [ 1586.609043][T18135] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1586.675511][T18135] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1586.725337][T18135] ext4 filesystem being mounted at /252/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1586.738160][T18137] syzkaller0: entered promiscuous mode [ 1586.743686][T18137] syzkaller0: entered allmulticast mode [ 1586.783577][T18137] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3450'. [ 1587.670521][T18149] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1587.680041][T18149] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1590.038877][T14011] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1590.926233][T18164] fuse: Bad value for 'group_id' [ 1591.657040][T17352] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 1593.597877][T17352] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1593.649559][T17352] usb 3-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1593.658765][T17352] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1593.666787][T17352] usb 3-1: Product: syz [ 1593.671519][T17352] usb 3-1: Manufacturer: syz [ 1593.676191][T17352] usb 3-1: SerialNumber: syz [ 1593.930621][T17352] usbhid 3-1:1.0: couldn't find an input interrupt endpoint [ 1594.004593][T18191] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1594.013877][T18191] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1595.867179][T17352] dvb_usb_ec168: probe of 3-1:1.1 failed with error -71 [ 1597.310885][T17352] usb 3-1: USB disconnect, device number 66 [ 1597.581625][T18206] loop2: detected capacity change from 0 to 512 [ 1597.677227][T18206] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1597.777654][T18206] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1597.879297][T18206] ext4 filesystem being mounted at /255/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1597.913346][T18211] fuse: Bad value for 'group_id' [ 1598.158821][T14011] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1603.382094][T18225] Bluetooth: hci2: command 0x0406 tx timeout [ 1604.637382][T18240] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1604.646304][T18240] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1606.793916][T18260] loop1: detected capacity change from 0 to 512 [ 1606.825153][T18260] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1606.896150][T18260] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1606.897331][T17347] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 1606.918222][T18260] ext4 filesystem being mounted at /278/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1607.182099][T17347] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1609.408335][T13433] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1609.428182][T17347] usb 1-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1609.439210][T17347] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1609.473962][T17347] usb 1-1: Product: syz [ 1609.490155][T17347] usb 1-1: Manufacturer: syz [ 1609.494843][T17347] usb 1-1: SerialNumber: syz [ 1609.534185][T17347] usbhid 1-1:1.0: couldn't find an input interrupt endpoint [ 1611.447334][T17347] dvb_usb_ec168: probe of 1-1:1.1 failed with error -71 [ 1611.513189][T18279] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1611.522518][T18279] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1612.207595][T17347] usb 1-1: USB disconnect, device number 70 [ 1614.683205][T18301] loop2: detected capacity change from 0 to 512 [ 1614.707224][T18301] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1614.752773][T18301] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1614.787187][T18301] ext4 filesystem being mounted at /261/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1615.153262][T14011] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1618.239673][T14236] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 1620.239850][T14236] usb 2-1: device not accepting address 65, error -71 [ 1621.501547][T18339] loop3: detected capacity change from 0 to 512 [ 1621.550635][T18339] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1621.644013][T18339] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1621.717086][T18339] ext4 filesystem being mounted at /302/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1622.014936][T18344] syzkaller0: entered promiscuous mode [ 1622.034593][T18344] syzkaller0: entered allmulticast mode [ 1622.056184][T18344] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3504'. [ 1622.449096][T18349] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1622.458372][T18349] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1623.215097][T13716] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1629.102189][T18382] loop1: detected capacity change from 0 to 512 [ 1629.137794][T18382] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1629.147094][T17350] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 1629.344874][T18382] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1629.392561][T18382] ext4 filesystem being mounted at /288/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1629.637512][T18389] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1629.646599][T18389] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1630.545178][T13433] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1630.587505][T17350] usb 1-1: device descriptor read/all, error -71 [ 1630.874733][T18396] syzkaller0: entered promiscuous mode [ 1630.998648][T18396] syzkaller0: entered allmulticast mode [ 1631.019598][T18396] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3518'. [ 1635.320542][T18418] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1635.330147][T18418] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1636.587363][T17347] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 1636.799087][T17347] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1636.816583][T17347] usb 2-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1636.836039][T17347] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1636.874675][T17347] usb 2-1: Product: syz [ 1636.879973][T17347] usb 2-1: Manufacturer: syz [ 1636.893913][T17347] usb 2-1: SerialNumber: syz [ 1637.025802][T17347] usbhid 2-1:1.0: couldn't find an input interrupt endpoint [ 1637.781300][T17347] dvb_usb_ec168: probe of 2-1:1.1 failed with error -71 [ 1637.849063][T17347] usb 2-1: USB disconnect, device number 67 [ 1639.021943][T18440] loop0: detected capacity change from 0 to 512 [ 1639.209999][T18440] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1639.919029][T18440] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1640.002196][T18440] ext4 filesystem being mounted at /240/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1640.463946][T14313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1640.465506][T18455] syzkaller0: entered promiscuous mode [ 1640.479584][T18455] syzkaller0: entered allmulticast mode [ 1642.088441][T18455] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3532'. [ 1643.957220][T17347] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 1644.198798][T17347] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1644.215292][T17347] usb 3-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1644.283661][T18483] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1644.292864][T18483] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1645.007175][T17347] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1645.015702][T17347] usb 3-1: Product: syz [ 1645.023792][T17347] usb 3-1: Manufacturer: syz [ 1645.028785][T17347] usb 3-1: SerialNumber: syz [ 1645.296870][T17347] usbhid 3-1:1.0: couldn't find an input interrupt endpoint [ 1645.367112][T17347] dvb_usb_ec168: probe of 3-1:1.1 failed with error -71 [ 1645.376507][T17347] usb 3-1: USB disconnect, device number 67 [ 1645.595238][T18489] loop0: detected capacity change from 0 to 512 [ 1645.621705][T18489] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1646.426335][T18489] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1648.111512][T18489] ext4 filesystem being mounted at /243/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1649.041333][T14313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1650.176333][T18515] syzkaller0: entered promiscuous mode [ 1650.227196][T18515] syzkaller0: entered allmulticast mode [ 1650.398296][T18517] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3549'. [ 1654.187080][T17346] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 1654.378807][T17346] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1654.412800][T17346] usb 4-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1654.437187][T17346] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1654.469824][T17346] usb 4-1: Product: syz [ 1654.497136][T17346] usb 4-1: Manufacturer: syz [ 1654.501960][T17346] usb 4-1: SerialNumber: syz [ 1654.545613][T17346] usbhid 4-1:1.0: couldn't find an input interrupt endpoint [ 1654.559852][T18543] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1654.568925][T18543] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1655.281360][T17346] dvb_usb_ec168: probe of 4-1:1.1 failed with error -71 [ 1655.299061][T17346] usb 4-1: USB disconnect, device number 62 [ 1657.779924][T18562] loop1: detected capacity change from 0 to 512 [ 1657.813620][T18562] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1658.719171][T18562] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1658.727880][T18571] syzkaller0: entered promiscuous mode [ 1658.737387][T18571] syzkaller0: entered allmulticast mode [ 1658.752107][T18571] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3562'. [ 1658.847505][T18562] ext4 filesystem being mounted at /301/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1659.328628][T13433] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1661.468121][T18587] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1661.477206][T18587] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1662.747061][T17350] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 1662.968857][T17350] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1663.001954][T17350] usb 2-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1663.021604][T17350] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1663.047095][T17350] usb 2-1: Product: syz [ 1663.051414][T17350] usb 2-1: Manufacturer: syz [ 1663.083807][T17350] usb 2-1: SerialNumber: syz [ 1663.114170][T17350] usbhid 2-1:1.0: couldn't find an input interrupt endpoint [ 1664.249482][T17350] dvb_usb_ec168: probe of 2-1:1.1 failed with error -110 [ 1664.387767][T17350] usb 2-1: USB disconnect, device number 68 [ 1664.513710][T18603] fuse: Unknown parameter 'grou00000000000000000000' [ 1666.771904][T18619] loop1: detected capacity change from 0 to 512 [ 1666.788017][T18619] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1668.435580][T18619] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1668.538758][T18619] ext4 filesystem being mounted at /305/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1670.303321][T13433] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1670.505034][T18640] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 1670.527558][T18640] syzkaller0: entered promiscuous mode [ 1670.533084][T18640] syzkaller0: entered allmulticast mode [ 1670.598095][T18640] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3578'. [ 1671.980631][T18650] fuse: Unknown parameter 'grou00000000000000000000' [ 1672.087074][T17346] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 1673.026572][T17346] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1673.132493][T17346] usb 2-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1673.222477][T17346] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1673.289702][T17346] usb 2-1: Product: syz [ 1673.321574][T17346] usb 2-1: Manufacturer: syz [ 1673.354800][T17346] usb 2-1: SerialNumber: syz [ 1673.594948][T17346] usbhid 2-1:1.0: couldn't find an input interrupt endpoint [ 1675.409732][T17346] dvb_usb_ec168: probe of 2-1:1.1 failed with error -71 [ 1675.447139][T17346] usb 2-1: USB disconnect, device number 69 [ 1676.170504][T18666] loop0: detected capacity change from 0 to 512 [ 1677.157062][T18666] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1677.224594][T18666] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1677.280340][T18666] ext4 filesystem being mounted at /252/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1678.460976][T18681] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 1678.518831][T18681] syzkaller0: entered promiscuous mode [ 1678.524352][T18681] syzkaller0: entered allmulticast mode [ 1678.567761][T18681] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3590'. [ 1678.684590][T14313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1679.033233][T18688] fuse: Unknown parameter 'grou00000000000000000000' [ 1685.437962][T18724] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 1685.452566][T18725] loop3: detected capacity change from 0 to 512 [ 1685.460956][T18724] syzkaller0: entered promiscuous mode [ 1685.466475][T18724] syzkaller0: entered allmulticast mode [ 1685.484197][T18724] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3600'. [ 1685.503706][T18725] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1685.528133][T17346] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 1685.582227][T18725] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1685.600671][T18725] ext4 filesystem being mounted at /322/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1685.768563][T17346] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1686.131597][T17346] usb 1-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1686.147020][T17346] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1686.159343][T17346] usb 1-1: Product: syz [ 1686.163923][T17346] usb 1-1: Manufacturer: syz [ 1686.176016][T17346] usb 1-1: SerialNumber: syz [ 1686.398074][T17346] usbhid 1-1:1.0: couldn't find an input interrupt endpoint [ 1687.395478][T17346] dvb_usb_ec168: probe of 1-1:1.1 failed with error -71 [ 1687.440867][T17346] usb 1-1: USB disconnect, device number 73 [ 1687.935780][T18746] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3603'. [ 1689.589069][T18751] fuse: Unknown parameter 'group_i00000000000000000000' [ 1690.843330][T13716] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1692.156600][T18769] syzkaller0: entered promiscuous mode [ 1692.176956][T18769] syzkaller0: entered allmulticast mode [ 1692.204113][T18769] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3611'. [ 1693.247312][T18775] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1693.256274][T18775] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1697.168283][T17352] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 1697.530324][T18788] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3617'. [ 1697.813362][T17352] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1697.861179][T17352] usb 4-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1697.910667][T17352] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1697.969807][T17352] usb 4-1: Product: syz [ 1698.008249][T17352] usb 4-1: Manufacturer: syz [ 1698.132314][T17352] usb 4-1: SerialNumber: syz [ 1698.336641][T17352] usbhid 4-1:1.0: couldn't find an input interrupt endpoint [ 1698.635513][T17352] dvb_usb_ec168: probe of 4-1:1.1 failed with error -71 [ 1698.681666][T18794] loop0: detected capacity change from 0 to 512 [ 1698.694502][T17352] usb 4-1: USB disconnect, device number 63 [ 1698.705259][T18794] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1698.802033][T18797] fuse: Unknown parameter 'group_i00000000000000000000' [ 1698.834398][T18794] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1698.917346][T18794] ext4 filesystem being mounted at /259/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1702.099633][T14313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1704.157166][T18827] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1704.166393][T18827] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1705.286980][T17352] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 1705.516596][T18835] syzkaller0: entered promiscuous mode [ 1705.527767][T18835] syzkaller0: entered allmulticast mode [ 1705.539077][T17352] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1705.544467][T18835] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3626'. [ 1705.570679][T17352] usb 1-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1705.586980][T17352] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1705.595107][T17352] usb 1-1: Product: syz [ 1705.616939][T17352] usb 1-1: Manufacturer: syz [ 1705.624025][T17352] usb 1-1: SerialNumber: syz [ 1705.662024][T17352] usbhid 1-1:1.0: couldn't find an input interrupt endpoint [ 1706.477161][T17352] dvb_usb_ec168: probe of 1-1:1.1 failed with error -71 [ 1706.648089][T17352] usb 1-1: USB disconnect, device number 74 [ 1707.510593][T18855] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3630'. [ 1707.522531][T18854] loop0: detected capacity change from 0 to 512 [ 1707.534598][T18854] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1707.658741][T18854] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1707.709556][T18854] ext4 filesystem being mounted at /262/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1709.668643][T14313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1713.747357][T17343] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 1713.813900][T18885] fuse: Unknown parameter 'group_i00000000000000000000' [ 1714.109120][T17343] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1714.121993][T17343] usb 2-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1714.131702][T17343] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1714.165178][T17343] usb 2-1: Product: syz [ 1714.200431][T18891] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1714.209718][T18891] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1714.222279][T17343] usb 2-1: Manufacturer: syz [ 1714.277165][T17343] usb 2-1: SerialNumber: syz [ 1714.491236][T17343] usbhid 2-1:1.0: couldn't find an input interrupt endpoint [ 1714.873684][T17343] dvb_usb_ec168: probe of 2-1:1.1 failed with error -71 [ 1714.943604][T17343] usb 2-1: USB disconnect, device number 70 [ 1715.072376][T18899] syzkaller0: entered promiscuous mode [ 1715.079823][T18899] syzkaller0: entered allmulticast mode [ 1715.095550][T18899] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3641'. [ 1715.175296][T18901] loop2: detected capacity change from 0 to 512 [ 1715.192765][T18901] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1715.259595][T18901] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1715.310009][T18901] ext4 filesystem being mounted at /304/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1719.238447][T14011] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1721.418556][T18941] fuse: Unknown parameter 'group_id00000000000000000000' [ 1723.254752][T18957] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3654'. [ 1725.317034][T17343] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 1725.336285][T18964] loop1: detected capacity change from 0 to 512 [ 1725.376988][T18964] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1725.446033][T18964] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1725.471270][T18964] ext4 filesystem being mounted at /326/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1727.126499][T17343] usb 3-1: device descriptor read/all, error -71 [ 1727.237663][T13433] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1733.120634][T19008] input: syz1 as /devices/virtual/input/input65 [ 1733.226251][T19013] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3666'. [ 1733.447049][T17343] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 1733.637117][T17343] usb 3-1: Using ep0 maxpacket: 16 [ 1733.657283][T17343] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1733.676772][T17343] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1733.695533][T17343] usb 3-1: Product: syz [ 1733.696295][T19017] loop0: detected capacity change from 0 to 512 [ 1733.699874][T17343] usb 3-1: Manufacturer: syz [ 1733.699895][T17343] usb 3-1: SerialNumber: syz [ 1733.702328][T17343] usb 3-1: config 0 descriptor?? [ 1733.709202][T19017] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1733.767176][T17350] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 1733.780221][T19017] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1733.816042][T19017] ext4 filesystem being mounted at /271/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1734.169188][T17350] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1735.029082][T17350] usb 2-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1735.045639][T17343] dvb_usb_dtv5100: probe of 3-1:0.0 failed with error -110 [ 1735.053388][T17350] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1735.066997][T17350] usb 2-1: Product: syz [ 1735.071223][T17350] usb 2-1: Manufacturer: syz [ 1735.089173][T17350] usb 2-1: SerialNumber: syz [ 1735.107759][T17350] usbhid 2-1:1.0: couldn't find an input interrupt endpoint [ 1735.319564][T14313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1736.310116][T17350] dvb_usb_ec168: probe of 2-1:1.1 failed with error -110 [ 1737.534676][T19038] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1737.589349][T17343] usb 3-1: USB disconnect, device number 70 [ 1737.711054][T17352] usb 2-1: USB disconnect, device number 71 [ 1741.140969][T19070] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1741.140969][T19070] [ 1741.154792][T19070] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1741.168054][T19070] CIFS: Attempting to mount //172.20.20.170/share [ 1741.653150][T19070] CIFS: VFS: cifs_mount failed w/return code = -112 [ 1743.098696][T19082] block nbd1: shutting down sockets [ 1744.153049][T19091] loop0: detected capacity change from 0 to 512 [ 1744.186427][T19091] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1744.215552][T19091] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1744.235683][T19091] ext4 filesystem being mounted at /274/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1744.247127][T17352] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 1745.392513][T14313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1745.469133][T17352] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1745.512355][T17352] usb 3-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1745.531225][T17352] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1745.548891][T17352] usb 3-1: Product: syz [ 1745.553119][T17352] usb 3-1: Manufacturer: syz [ 1745.570892][T17352] usb 3-1: SerialNumber: syz [ 1745.604123][T17352] usbhid 3-1:1.0: couldn't find an input interrupt endpoint [ 1746.433148][T17352] dvb_usb_ec168: probe of 3-1:1.1 failed with error -71 [ 1746.461981][T17352] usb 3-1: USB disconnect, device number 71 [ 1746.668182][T19115] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1746.668182][T19115] [ 1746.682190][T19115] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1746.695137][T19115] CIFS: Attempting to mount //172.20.20.170/share [ 1748.304750][T19115] CIFS: VFS: cifs_mount failed w/return code = -512 [ 1750.458612][T19133] loop2: detected capacity change from 0 to 512 [ 1750.468235][T19133] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1750.603871][T19133] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1750.703044][T19133] ext4 filesystem being mounted at /318/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1751.919827][T14011] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1753.017354][T17352] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 1753.350708][T19164] loop0: detected capacity change from 0 to 32768 [ 1753.515199][T17352] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1753.726305][T19164] XFS (loop0): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 1753.904467][T17352] usb 2-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1753.954669][T17352] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1753.994702][T17352] usb 2-1: Product: syz [ 1754.001573][T19164] XFS (loop0): Ending clean mount [ 1754.026082][T19164] XFS (loop0): Quotacheck needed: Please wait. [ 1754.048864][T17352] usb 2-1: Manufacturer: syz [ 1754.079132][T17352] usb 2-1: SerialNumber: syz [ 1754.105190][T17352] usbhid 2-1:1.0: couldn't find an input interrupt endpoint [ 1754.149440][T19164] XFS (loop0): Quotacheck: Done. [ 1754.223889][T19182] fuse: Bad value for 'user_id' [ 1754.909872][T14313] XFS (loop0): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 1755.156761][T17352] dvb_usb_ec168: probe of 2-1:1.1 failed with error -71 [ 1755.240191][T17352] usb 2-1: USB disconnect, device number 72 [ 1756.962339][T19192] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1756.962339][T19192] [ 1756.976576][T19192] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1756.989872][T19192] CIFS: Attempting to mount //172.20.20.170/share [ 1757.159443][T19192] CIFS: VFS: error -4 create cifsd thread [ 1757.366689][T19192] CIFS: VFS: cifs_mount failed w/return code = -4 [ 1759.080713][T19218] overlayfs: missing 'lowerdir' [ 1759.835714][T19217] loop0: detected capacity change from 0 to 512 [ 1759.915803][T19217] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1760.012597][T19217] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1760.182693][T19217] ext4 filesystem being mounted at /279/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1762.170915][T14313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1762.438165][T17346] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 1763.508548][T17346] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1763.529495][T17346] usb 4-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1763.551980][T17346] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1763.564908][T17346] usb 4-1: Product: syz [ 1763.569898][T17346] usb 4-1: Manufacturer: syz [ 1763.574774][T17346] usb 4-1: SerialNumber: syz [ 1763.585682][T19252] loop2: detected capacity change from 0 to 256 [ 1763.659261][T17346] usbhid 4-1:1.0: couldn't find an input interrupt endpoint [ 1764.434568][T17346] dvb_usb_ec168: probe of 4-1:1.1 failed with error -71 [ 1764.454482][T17346] usb 4-1: USB disconnect, device number 64 [ 1764.548142][T19259] overlayfs: missing 'lowerdir' [ 1765.053735][T19262] input: syz1 as /devices/virtual/input/input66 [ 1766.127563][T17346] usb 1-1: new high-speed USB device number 75 using dummy_hcd [ 1766.280672][T19276] loop2: detected capacity change from 0 to 64 [ 1766.350045][T19278] loop1: detected capacity change from 0 to 512 [ 1766.369039][ T28] audit: type=1800 audit(1791322271.499:84): pid=19276 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3727" name="bus" dev="loop2" ino=21 res=0 errno=0 [ 1766.402358][T19278] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1766.431557][ T28] audit: type=1804 audit(1791322271.539:85): pid=19276 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.3727" name="/newroot/326/bus/bus" dev="loop2" ino=21 res=1 errno=0 [ 1766.487124][T17346] usb 1-1: Using ep0 maxpacket: 16 [ 1766.548998][T17346] usb 1-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1766.622382][T17346] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1766.713648][T19278] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1766.764137][T17346] usb 1-1: Product: syz [ 1766.866035][T17346] usb 1-1: Manufacturer: syz [ 1766.928713][T17346] usb 1-1: SerialNumber: syz [ 1766.942336][T19278] ext4 filesystem being mounted at /344/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1767.075602][T17346] usb 1-1: config 0 descriptor?? [ 1768.631634][T17346] dvb_usb_dtv5100: probe of 1-1:0.0 failed with error -110 [ 1768.816876][T19293] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1768.816876][T19293] [ 1768.830746][T19293] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1768.843732][T19293] CIFS: Attempting to mount //172.20.20.170/share [ 1769.379258][T17350] usb 1-1: USB disconnect, device number 75 [ 1770.524999][T19293] CIFS: VFS: cifs_mount failed w/return code = -512 [ 1770.601538][T13433] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1770.867404][T19301] overlayfs: missing 'lowerdir' [ 1771.875323][T19306] binder: 19305:19306 ioctl c0306201 200000000440 returned -14 [ 1773.436998][T17346] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 1773.488990][T19327] fuse: Bad value for 'fd' [ 1773.496268][T19328] loop2: detected capacity change from 0 to 512 [ 1773.536121][T19328] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1773.588242][T19328] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1773.607154][T19328] ext4 filesystem being mounted at /330/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1773.853811][T17346] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1773.893748][T17346] usb 4-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1773.903253][T17346] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1773.923828][T17346] usb 4-1: Product: syz [ 1773.928298][T17346] usb 4-1: Manufacturer: syz [ 1773.932973][T17346] usb 4-1: SerialNumber: syz [ 1774.188649][T17346] usbhid 4-1:1.0: couldn't find an input interrupt endpoint [ 1774.464548][T17346] dvb_usb_ec168: probe of 4-1:1.1 failed with error -71 [ 1774.516515][T17346] usb 4-1: USB disconnect, device number 65 [ 1774.565258][T14011] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1775.030479][T19350] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1775.039726][T19350] overlayfs: missing 'lowerdir' [ 1777.784837][T19353] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1777.784837][T19353] [ 1777.798803][T19353] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 1777.811401][T19353] CIFS: Attempting to mount //172.20.20.170/share [ 1777.943907][T19353] CIFS: VFS: cifs_mount failed w/return code = -112 [ 1778.868937][T19388] [ 1778.871326][T19388] ====================================================== [ 1778.874836][T19384] loop0: detected capacity change from 0 to 512 [ 1778.878354][T19388] WARNING: possible circular locking dependency detected [ 1778.878383][T19388] syzkaller #0 Not tainted [ 1778.878391][T19388] ------------------------------------------------------ [ 1778.878398][T19388] syz.3.3754/19388 is trying to acquire lock: [ 1778.878408][T19388] ffff88814886a9e0 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: configfs_depend_item_unlocked+0x157/0x460 [ 1778.920843][T19388] [ 1778.920843][T19388] but task is already holding lock: [ 1778.928315][T19388] ffffffff8de57888 (tpg_instances_lock){+.+.}-{3:3}, at: usbg_make_tpg+0xf9/0x550 [ 1778.937782][T19388] [ 1778.937782][T19388] which lock already depends on the new lock. [ 1778.937782][T19388] [ 1778.938439][T19384] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1778.948189][T19388] [ 1778.948189][T19388] the existing dependency chain (in reverse order) is: [ 1778.948202][T19388] [ 1778.948202][T19388] -> #3 (tpg_instances_lock){+.+.}-{3:3}: [ 1778.948232][T19388] __mutex_lock+0x135/0xc80 [ 1778.973015][T19384] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1778.973987][T19388] tcm_alloc_inst+0x65/0x190 [ 1778.974014][T19388] usb_get_function_instance+0xdd/0x2e0 [ 1778.979252][T19384] ext4 filesystem being mounted at /292/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1778.991405][T19388] function_make+0x11c/0x350 [ 1778.991433][T19388] configfs_mkdir+0x515/0x9e0 [ 1778.991451][T19388] vfs_mkdir+0x2a5/0x470 [ 1778.991468][T19388] do_mkdirat+0x1dc/0x450 [ 1778.991483][T19388] __x64_sys_mkdirat+0x89/0xa0 [ 1778.991499][T19388] do_syscall_64+0x55/0xb0 [ 1778.991525][T19388] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1778.991551][T19388] [ 1778.991551][T19388] -> #2 (func_lock){+.+.}-{3:3}: [ 1778.991586][T19388] __mutex_lock+0x135/0xc80 [ 1778.991605][T19388] usb_get_function_instance+0x2e/0x2e0 [ 1778.991626][T19388] function_make+0x11c/0x350 [ 1778.991646][T19388] configfs_mkdir+0x515/0x9e0 [ 1778.991667][T19388] vfs_mkdir+0x2a5/0x470 [ 1778.991684][T19388] do_mkdirat+0x1dc/0x450 [ 1779.087748][T19388] __x64_sys_mkdirat+0x89/0xa0 [ 1779.093062][T19388] do_syscall_64+0x55/0xb0 [ 1779.098025][T19388] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1779.104473][T19388] [ 1779.104473][T19388] -> #1 (gadget_subsys.su_mutex){+.+.}-{3:3}: [ 1779.112753][T19388] __mutex_lock+0x135/0xc80 [ 1779.117806][T19388] configfs_rmdir+0x63c/0x980 [ 1779.123032][T19388] vfs_rmdir+0x352/0x4b0 [ 1779.127811][T19388] do_rmdir+0x29f/0x590 [ 1779.132502][T19388] __x64_sys_rmdir+0x49/0x50 [ 1779.137633][T19388] do_syscall_64+0x55/0xb0 [ 1779.142598][T19388] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1779.149035][T19388] [ 1779.149035][T19388] -> #0 (&sb->s_type->i_mutex_key#21){++++}-{3:3}: [ 1779.158100][T19388] __lock_acquire+0x3a07/0x7eb0 [ 1779.163493][T19388] lock_acquire+0x19e/0x420 [ 1779.168539][T19388] down_write+0x97/0x200 [ 1779.173330][T19388] configfs_depend_item_unlocked+0x157/0x460 [ 1779.179858][T19388] usbg_make_tpg+0x1e1/0x550 [ 1779.184986][T19388] target_fabric_make_tpg+0xa4/0x6d0 [ 1779.190830][T19388] configfs_mkdir+0x515/0x9e0 [ 1779.196019][T19388] vfs_mkdir+0x2a5/0x470 [ 1779.200775][T19388] do_mkdirat+0x1dc/0x450 [ 1779.205612][T19388] __x64_sys_mkdirat+0x89/0xa0 [ 1779.210916][T19388] do_syscall_64+0x55/0xb0 [ 1779.215934][T19388] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1779.222348][T19388] [ 1779.222348][T19388] other info that might help us debug this: [ 1779.222348][T19388] [ 1779.232580][T19388] Chain exists of: [ 1779.232580][T19388] &sb->s_type->i_mutex_key#21 --> func_lock --> tpg_instances_lock [ 1779.232580][T19388] [ 1779.246431][T19388] Possible unsafe locking scenario: [ 1779.246431][T19388] [ 1779.253872][T19388] CPU0 CPU1 [ 1779.259223][T19388] ---- ---- [ 1779.264590][T19388] lock(tpg_instances_lock); [ 1779.269350][T19388] lock(func_lock); [ 1779.275767][T19388] lock(tpg_instances_lock); [ 1779.282960][T19388] lock(&sb->s_type->i_mutex_key#21); [ 1779.288443][T19388] [ 1779.288443][T19388] *** DEADLOCK *** [ 1779.288443][T19388] [ 1779.296592][T19388] 4 locks held by syz.3.3754/19388: [ 1779.301779][T19388] #0: ffff888141682418 (sb_writers#16){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 1779.311029][T19388] #1: ffff888075eecb80 (&sb->s_type->i_mutex_key#7/1){+.+.}-{3:3}, at: filename_create+0x20f/0x450 [ 1779.321841][T19388] #2: ffffffff8db2c8b0 (&subsys->su_mutex){+.+.}-{3:3}, at: configfs_mkdir+0x4b9/0x9e0 [ 1779.331583][T19388] #3: ffffffff8de57888 (tpg_instances_lock){+.+.}-{3:3}, at: usbg_make_tpg+0xf9/0x550 [ 1779.341233][T19388] [ 1779.341233][T19388] stack backtrace: [ 1779.347127][T19388] CPU: 1 PID: 19388 Comm: syz.3.3754 Not tainted syzkaller #0 [ 1779.354581][T19388] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1779.364808][T19388] Call Trace: [ 1779.368080][T19388] [ 1779.371019][T19388] dump_stack_lvl+0x18c/0x250 [ 1779.375707][T19388] ? load_image+0x420/0x420 [ 1779.380206][T19388] ? show_regs_print_info+0x20/0x20 [ 1779.385428][T19388] ? print_circular_bug+0x12b/0x1a0 [ 1779.390619][T19388] check_noncircular+0x2fc/0x400 [ 1779.395553][T19388] ? look_up_lock_class+0x75/0x140 [ 1779.400716][T19388] ? print_deadlock_bug+0x5d0/0x5d0 [ 1779.405907][T19388] ? lockdep_lock+0xf5/0x230 [ 1779.410485][T19388] ? __lock_acquire+0x36dd/0x7eb0 [ 1779.415500][T19388] ? _find_first_zero_bit+0xd6/0x100 [ 1779.420813][T19388] __lock_acquire+0x3a07/0x7eb0 [ 1779.425702][T19388] ? is_bpf_text_address+0x28f/0x2a0 [ 1779.430986][T19388] ? verify_lock_unused+0x140/0x140 [ 1779.436177][T19388] ? __kernel_text_address+0xd/0x30 [ 1779.441384][T19388] lock_acquire+0x19e/0x420 [ 1779.445887][T19388] ? configfs_depend_item_unlocked+0x157/0x460 [ 1779.452043][T19388] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1779.458194][T19388] ? __might_sleep+0xe0/0xe0 [ 1779.462774][T19388] ? rcu_is_watching+0x15/0xb0 [ 1779.467563][T19388] ? read_lock_is_recursive+0x20/0x20 [ 1779.472924][T19388] ? trace_contention_end+0x39/0xe0 [ 1779.478112][T19388] ? __mutex_lock+0x30d/0xc80 [ 1779.482896][T19388] ? do_syscall_64+0x55/0xb0 [ 1779.487478][T19388] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1779.493547][T19388] down_write+0x97/0x200 [ 1779.497798][T19388] ? configfs_depend_item_unlocked+0x157/0x460 [ 1779.503970][T19388] ? down_read_killable+0x340/0x340 [ 1779.509162][T19388] configfs_depend_item_unlocked+0x157/0x460 [ 1779.515161][T19388] usbg_make_tpg+0x1e1/0x550 [ 1779.520194][T19388] ? snprintf+0xe9/0x140 [ 1779.524521][T19388] ? configfs_mkdir+0x4b9/0x9e0 [ 1779.529359][T19388] ? usbg_drop_tport+0x20/0x20 [ 1779.534212][T19388] ? vscnprintf+0x80/0x80 [ 1779.538550][T19388] target_fabric_make_tpg+0xa4/0x6d0 [ 1779.543830][T19388] ? target_fabric_release_wwn+0xb0/0xb0 [ 1779.549571][T19388] configfs_mkdir+0x515/0x9e0 [ 1779.554243][T19388] vfs_mkdir+0x2a5/0x470 [ 1779.558478][T19388] do_mkdirat+0x1dc/0x450 [ 1779.562798][T19388] ? vfs_mkdir+0x470/0x470 [ 1779.567207][T19388] __x64_sys_mkdirat+0x89/0xa0 [ 1779.571973][T19388] do_syscall_64+0x55/0xb0 [ 1779.576383][T19388] ? clear_bhb_loop+0x40/0x90 [ 1779.581066][T19388] ? clear_bhb_loop+0x40/0x90 [ 1779.585731][T19388] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1779.591619][T19388] RIP: 0033:0x7fbd3d99e199 [ 1779.596037][T19388] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1779.615737][T19388] RSP: 002b:00007fbd3e8a0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 1779.624141][T19388] RAX: ffffffffffffffda RBX: 00007fbd3dc25fa0 RCX: 00007fbd3d99e199 [ 1779.632120][T19388] RDX: 00000000000001ff RSI: 00002000000002c0 RDI: ffffffffffffff9c [ 1779.640084][T19388] RBP: 00007fbd3da358e0 R08: 0000000000000000 R09: 0000000000000000 [ 1779.648061][T19388] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1779.656024][T19388] R13: 00007fbd3dc26038 R14: 00007fbd3dc25fa0 R15: 00007fffaf8be728 [ 1779.663995][T19388] [ 1780.270542][T19398] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1780.279631][T19398] overlayfs: missing 'lowerdir' [ 1780.578238][T17345] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 1780.587523][T14313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1780.758920][T17345] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1780.772156][T17345] usb 2-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 1780.781288][T17345] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1780.789340][T17345] usb 2-1: Product: syz [ 1780.793501][T17345] usb 2-1: Manufacturer: syz [ 1780.798154][T17345] usb 2-1: SerialNumber: syz [ 1780.807833][T17345] usbhid 2-1:1.0: couldn't find an input interrupt endpoint [ 1781.066255][T17345] dvb_usb_ec168: probe of 2-1:1.1 failed with error -71 [ 1781.077020][T17345] usb 2-1: USB disconnect, device number 73