last executing test programs: 9.590484728s ago: executing program 3 (id=1100): r0 = add_key$fscrypt_v1(&(0x7f0000000240), 0x0, &(0x7f0000000440)={0x0, "dec557407795bb6fb33ff8685215d03bb3c57615baa8f98df3165e56695e5fdfec39f4eac81f7fdf77d881d13cbf4bfe44bcb0222522c867dfa97ba205b0f762", 0x22}, 0x48, 0xfffffffffffffffd) keyctl$clear(0x7, r0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat2(0xffffffffffffffff, 0x0, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x24, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_REDIR_FLAGS={0x8}, @NFTA_REDIR_REG_PROTO_MIN={0x8, 0x1, 0x1, 0x0, 0x17}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x94}, 0x1, 0x0, 0x0, 0x2000c851}, 0x4040080) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_emit_ethernet(0x7e, &(0x7f00000001c0)=ANY=[], 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_int(r5, 0x1, 0x50, &(0x7f0000000040)=0x202, 0x4) unshare(0x64000600) 5.683781112s ago: executing program 3 (id=1110): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$video(&(0x7f0000000000), 0x8, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f00000000c0)={0x4, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f90d, 0x9c, '\x00', @p_u8=&(0x7f0000000100)=0x6}}) semget(0x2, 0x3, 0x33a) 5.135495705s ago: executing program 2 (id=1112): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000d40)={'ipvlan1\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000d80)={0x11, 0x6, r1}, 0x14) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000dc0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000e00)={0x0, 0x1, 0x0, &(0x7f0000000e40)=""/29, 0x0, 0x8000000}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000e80)) r3 = syz_open_procfs(0x0, &(0x7f0000000ec0)='statm\x00') dup3(0xffffffffffffffff, r3, 0x0) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000f00)={0x0, r3}) 4.95832448s ago: executing program 2 (id=1114): socket(0x10, 0x3, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x8000, 0x1f7) fanotify_init(0x0, 0x80000) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) epoll_create1(0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/diskstats\x00', 0x0, 0x0) socket$inet(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x88002, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x0, @local}, {0x2, 0x4e23, @loopback}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 4.869928102s ago: executing program 2 (id=1115): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000280)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0x0, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000480)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f00000005c0)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000600)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000640)="05031200d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000680)={0x11, 0x8100, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 4.557555939s ago: executing program 1 (id=1116): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000002400), 0x181041, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000002440)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000002480)={0x28, 0x5, r1, 0x0, &(0x7f00000024c0)="7f", 0x1, 0x4}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f00000025c0)={0x28, 0x4, r1, 0x0, &(0x7f0000002600)="ca", 0x1, 0xc97c}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000002640)={0x28, 0x2, r1, 0x0, &(0x7f0000002680)='%', 0x1, 0x33e2}) ioctl$IOMMU_IOAS_UNMAP(r0, 0x3b86, &(0x7f0000002740)={0x18, r1, 0x1680, 0x280000000}) 4.350990024s ago: executing program 1 (id=1117): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001d40)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000200)={0x0, 0x8, 0x0, 0xfffc, 0x3f00}) 4.331686555s ago: executing program 3 (id=1119): syz_open_dev$dri(0x0, 0x1ff, 0x0) r0 = socket$inet(0x2, 0x2, 0x11) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f00000006c0)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x115c, @loopback}, 0x1, 0x0, 0x1}}, 0x26) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000740)='./proc\x00', &(0x7f0000000780)='proc\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000800), 0x1) read(0xffffffffffffffff, &(0x7f0000000880), 0x120) read(0xffffffffffffffff, &(0x7f00000008c0), 0x1000) 4.177563749s ago: executing program 3 (id=1120): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, 0x0) io_uring_setup(0x1b1e, &(0x7f00000009c0)={0x0, 0x0, 0x800, 0xffffffff, 0x17a}) prlimit64(0x0, 0xe, &(0x7f0000000a40)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000a80)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000ac0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x8031, 0xffffffffffffffff, 0x3c441000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000b00)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000b40)=@abs={0x0, 0x0, 0xfffffffd}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000bc0), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000c00), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000c40)=0x6) r4 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000c80)={@private0, 0x8000000, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000cc0)={@loopback={0x600}, 0x8000000, 0x0, 0xff, 0x0, 0x4}, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000d40)='./sys\x00', &(0x7f0000000d80)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000dc0)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) write(r5, &(0x7f0000000e00)='tcpci 0x2', 0x9) connect$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000300)='./file1\x00', 0x200000, &(0x7f0000000340)={[{@bsdgroups}, {@nobarrier}, {@noinit_itable}]}, 0xfc, 0x574, &(0x7f0000000380)="$eJzs3c9rHFUcAPDvbJI2/aFJoRT1IIEerNRumsQfFTzUk4gWC3qvS7INJZtuyW5KEwu2B3vxIkUQsSB69+6x+A/4VxS0UKQEPXiJzGY2XZPZNNlumm3384Fp35uZzZvvvvm+fbOzywbQt8bSfwoRL0fEN0nESMu2wcg2jq3tt/Lw+nS6JLG6+ulfSSTZuub+Sfb/oazyUkT89lXEycLmdmtLy3OlSqW8kNXH6/NXxmtLy6cuzZdmy7Ply5NTU2fempp89523uxbr6+f/+f6Tux+e+fr4yne/3D9yO4mzcTjb1hrHE7jRWhmLsew5GYqzG3ac6EJjvSTZ6wOgIwNZng9FOgaMxECW9blWR57moQG77Ms0rYE+lch/6FPNeUDz2r5L18HPjAfvr10AbY5/cO29kRhuXBsdXEn+d2WUXu+OdqH9tI1f/7xzO12i3fsQ+7vQEMAGN25GxOnBwc3jX5KNf507vY19NrbRb68/sJfupvOfN/LmP4X1+U/kzH8O5eRuJx6f/4X7XWimrXT+917u/Hf9ptXoQFZ7oTHnG0ouXqqU07HtxYg4EUP70/pERHyQfxPk88LKvdV27bfO/9Ilbb85F8yO4/7ghvnfTKleevLI1zy4GfFK7vw3We//JKf/0+fj/DbbOFa+82q7bY+Pf3et/hTxWm7/P+rMZOv7k+ON82G8eVZs9vetY7+3a3+v40/7/+DW8Y8mrfdraztv48fhf8vttnV6/u9LPmuU92XrrpXq9YWJiH3Jx5vXTz56bLPe3D+N/8Txrce/vPP/QJrY24z/1tFbrbsO7yz+3ZXGP7Oj/t954d5HX/zQrv3t9f+bjdKJbM12xr/tHuCTPHcAAAAAAADQawoRcTiSQnG9XCgUi2uf7zgaBwuVaq1+8mJ18fJMNL4rOxpDhead7pGWz0NMZJ+HbdYnN9SnIuJIRHw7cKBRL05XKzN7HTwAAAAAAAAAAAAAAAAAAAD0iEMRw3nf/0/9MZD/mDargWfRFj/5DTzn2ud/tqUbv/QE9CSv/9C/5D/0L/kP/Uv+Q/+S/9C/5D/0L/kP/Wsn+f/zuV08EAAAAAAAAAAAAAAAAAAAAAAAAAAAAHg+nD93Ll1WVx5en07rM1eXFueqV0/NlGtzxfnF6eJ0deFKcbZana2Ui9PV+cf9vUq1emViMhavjdfLtfp4bWn5wnx18XL9wqX50mz5QnnoqUQFAAAAAAAAAAAAAAAAAAAAz5ba0vJcqVIpLygodFQY7I3D6MFCoTcOo8PCXo9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDIfwEAAP//wGE62g==") openat(0xffffffffffffff9c, 0x0, 0x143442, 0x0) sched_setscheduler(r1, 0x2, 0x0) syz_emit_vhci(&(0x7f0000000900)=ANY=[@ANYBLOB="040e02100418"], 0x7) connect$unix(0xffffffffffffffff, &(0x7f0000000940)=@abs, 0x6e) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r6, 0x4004af61, &(0x7f0000000280)) socket(0xa, 0x5, 0x0) 4.12344868s ago: executing program 2 (id=1121): syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0x0, &(0x7f00000001c0)={[{@noload}, {@stripe={'stripe', 0x3d, 0xdc}}, {@data_err_abort}, {@noload}, {@data_err_ignore}, {@noblock_validity}]}, 0xff, 0x451, &(0x7f0000000940)="$eJzs3MtvG8UfAPDvrp30/Ut+UB4tLQQKouKRNOnzwKUIJA4gIcGhiFNI0qrUbaAJEq0qKBzKEVXijjgi8RdwggsCTkhc4Y4qVaiXFiQko13vpq5rp3Hj1KX+fKRNZrzj7Hw9O/bsjDcBDKyx7EcSsTkifouIkUb2xgJjjV/Xrpyb+evKuZkk6vU3/kzyclevnJspi5bP29TI1OtFfl2b4154O2K6Vps7XeQnFk++N7Fw5uzzx09OH5s7Nndq6tChfXt3Dh+Y2t+TOLO4rm7/aH7HtlfeuvjazJGL7/z0TVbfzcX+5jh6ZMNY49Vt66keH6zftjSlk2ofK0JXKhGRNddQ3v9HohIblvaNxMuf9rVywJqq1+v1dp/PhfN14B6WRL9rAPRH+UGfXf+W2x0aetwVLh+OeP9gI/5rxdbYU420KDPUcn3bS2MRceT8319mW6zNPAQAwA2+OxwRz7Ub/6XxYFO5/xVrKKMR8f+IuC8i7o+IrRHxQERe9qGIeLjL47eukNw8/kkv3VZgK5SN/14o1raWxn//1PP4C6OVIrclj38oOXq8NreneE12x9C6LD+5zDG+f+nXzzvtax7/ZVt2/HIs2JBeqrZM0M1OL06vMuwllz+J2F5tiT+XRLmMk0TEtojY3tVfvn6FcfyZr3d0KnXr+JfRg3Wm+lcRTzfa/3y0xF9KOq5PTh48MLV/Yn3U5vZMlGfFzX7+5cLrnY6/qvh7IGv/ja3nf24p/tFkfcTCmbMn8vXahWhdIb6lC79/1vGa5nbP/+HkzTw9XDz24fTi4unJiOHk1Zsfn7r+3CJfbY5/96528af5e1wZ7SMRkZ3EOyPi0Yh4rKj74xHxRETsWib+H1988t3u419mVr6Hsvhnb9X+0dz+3ScqJ374tvv4S1n778tTu4tHVvL+t9IKrua1AwAAgP+KNP8OfJKOL6XTdHy88R3+rbExrc0vLD57dP6DU7ON78qPxlBaznSNNM2HThZzw2V+qiW/t5g3/qKyIc+Pz8zXZvsdPAy4TR36f+aPSr9rB6w592vB4NL/YXDp/zC49H8YXPo/DK52/f/jPtQDuPN8/sPg0v9hcOn/MLj0fxhIHe+NT1d1y7/EPZ+ItPtnVaOvdU66+McQd0+iutZ1Xtd2V7/fmQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHrj3wAAAP//TonqKA==") syz_open_dev$vim2m(0x0, 0x4003, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) munmap(&(0x7f0000694000/0x3000)=nil, 0x3000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r2 = io_uring_setup(0x1f35, &(0x7f0000000040)={0x0, 0x2096c, 0x1f480, 0x2, 0x325}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4d}, 0x94) io_uring_enter(r2, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) 4.090017951s ago: executing program 1 (id=1122): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000d40)={'ipvlan1\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000d80)={0x11, 0x6, r1}, 0x14) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000dc0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000e00)={0x0, 0x1, 0x0, &(0x7f0000000e40)=""/29, 0x0, 0x8000000}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000e80)) r3 = syz_open_procfs(0x0, &(0x7f0000000ec0)='statm\x00') dup3(0xffffffffffffffff, r3, 0x0) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000f00)={0x0, r3}) 2.827150021s ago: executing program 1 (id=1123): socket(0x10, 0x3, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x8000, 0x1f7) fanotify_init(0x0, 0x80000) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) epoll_create1(0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/diskstats\x00', 0x0, 0x0) socket$inet(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x88002, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x0, @local}, {0x2, 0x4e23, @loopback}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="140000"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 2.617168277s ago: executing program 1 (id=1124): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) getpid() r1 = fsmount(0xffffffffffffffff, 0x0, 0x71) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) inotify_add_watch(r1, &(0x7f0000000100)='./trace\x00', 0x2000080) capset(0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000480)=0x400, 0x4) r4 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r5 = memfd_create(&(0x7f0000000380)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x00\x98S7\xc9\x00\x00\x00\x00\x00\x00\x00\xf3\xff\x00\x00\x00\x00\xdf8\x9c\xc0T\xd2\xa7\v\x9a\xd2b\x8aL\xdd\x9e\x9d0\xb9\xd8K\x7f\x02\xf0\x19?j\x88l)l\xdbO\x88\r\x9c\xc2\x97m\xe0\xd8\xe4\xaaM4\x92\xca\xd7\x03\x11{\x98-\xb3D\xb8L\a\xdc3\xc8\x19\x9dg\x90\xb5?J\xc8\b=\xc5\b\xd9\x9eG[\xa9\xff]\xdaH\xc1Q\x95T\xfe\x9eRq\xdd[\x90MVb\x122m\xef\xeded#\xaf\xb5\xe3 \x8a\xfa\xf6\xdf\n]KbE\xb7\x9cLL\x93\xe7^\xc7\xde\xd0\xc2\xb5\xfe\v\xc3\xe1\x92[\xdbIq\x81\x00\x9b]\xee\xcbk\"\xdc\x89\x1c\xc3\xa1\x04\xa8\x8fF\xe9y\x0f<\xc0\xac\x06/\x8c\xfcP/\x83\x1f\v\xb8\xf1\xb1T\xdf_\xa1}\xf0)\xb3/_X\x9f\xee\tq\xec\xddG\x82\x95\xfe\x00\x94\xcf\xe1\xbd\x95+\xa4\x95\xf3!\xabu\xe1i', 0x2) ftruncate(r5, 0xffff) fcntl$addseals(r5, 0x409, 0x7) ioctl$UDMABUF_CREATE(r4, 0x40187542, &(0x7f0000000180)={r5, 0x0, 0x0, 0x8000}) 1.690023989s ago: executing program 3 (id=1125): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x8082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000340)={'syzkaller0\x00', 0xca02}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0x6}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfe, {0x0, 0x0, 0x0, r5, {0xffe0}, {0xffff, 0xffff}, {0xe, 0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dd}, 0x4000080) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 1.498670633s ago: executing program 1 (id=1126): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha1)\x00'}, 0xfffffffffffffd9b) sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) prctl$PR_SET_MM(0x23, 0xa, &(0x7f00002d5000/0x2000)=nil) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000400)='environ\x00') preadv(r3, &(0x7f0000000440)=[{&(0x7f0000000480)=""/113, 0x200000b1}], 0x1, 0xc002a0, 0x0) 1.329657858s ago: executing program 3 (id=1127): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$video(&(0x7f0000000000), 0x8, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f00000000c0)={0x4, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f90d, 0x9c, '\x00', @p_u8=&(0x7f0000000100)=0x6}}) semget(0x2, 0x3, 0x33a) 943.456287ms ago: executing program 0 (id=1128): syz_open_dev$dri(0x0, 0x1ff, 0x0) r0 = socket$inet(0x2, 0x2, 0x11) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f00000006c0)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x115c, @loopback}, 0x1, 0x0, 0x1}}, 0x26) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000740)='./proc\x00', &(0x7f0000000780)='proc\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000800), 0x1) read(0xffffffffffffffff, &(0x7f0000000880), 0x120) read(0xffffffffffffffff, &(0x7f00000008c0), 0x1000) 848.537989ms ago: executing program 0 (id=1129): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000280)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0x0, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000480)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f00000005c0)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000600)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000640)="05031200d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000680)={0x11, 0x8100, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 516.048108ms ago: executing program 0 (id=1130): write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000001d80)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000200)={0x0, 0x8, 0x0, 0xfffc, 0x3f00}) 364.336841ms ago: executing program 0 (id=1131): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) bind$packet(r0, &(0x7f0000000d80)={0x11, 0x6}, 0x14) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000dc0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000e00)={0x0, 0x1, 0x0, &(0x7f0000000e40)=""/29, 0x0, 0x8000000}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000e80)) r3 = syz_open_procfs(0x0, &(0x7f0000000ec0)='statm\x00') dup3(r0, r3, 0x0) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000f00)={0x0, r3}) 271.211034ms ago: executing program 2 (id=1132): socket(0x10, 0x3, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x8000, 0x1f7) fanotify_init(0x0, 0x80000) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) epoll_create1(0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/diskstats\x00', 0x0, 0x0) socket$inet(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x88002, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x0, @local}, {0x2, 0x4e23, @loopback}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="140000"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 221.248855ms ago: executing program 0 (id=1133): syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) 92.006748ms ago: executing program 0 (id=1134): r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000000)=[{0x40, 0x4, 0x3, 0x8}, {0x6, 0x25, 0x7, 0x205}]}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000300)='./file0\x00', 0x200700, &(0x7f0000000340)={[{@data_err_ignore}, {@prjquota}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x5a}}, {@stripe={'stripe', 0x3d, 0x9}}, {@inode_readahead_blks}, {@nodelalloc}, {@debug}]}, 0x1, 0x488, &(0x7f0000000400)="$eJzs3M9rHFUcAPDvTH60tT8Sa/3RWjVahKCYNGnVHrwoCiKKgh7qMW62JXTbSBPF1mJTEU+CFPQsHkX/Am8iiHoSvHryJIWivbT1FJnZmWaz3SSm2XSb7OcDu/vezNud982bH2/e200AXWsoe0oidkTEHxExUM8uLjBUf7l25Vzl+pVzlSTm59/8O8nLXb1yrlIWLd+3vcgMpxHpJ0mxkcVmzpw9MVGrVU8X+dHZk++Ozpw5+9T7JyeOV49XT40fOXL40Nizz4w/3ZY4s7iu7vtoev/el9+++Frl6MV3fvkuq++OYn1jHO0ylAX+z3yued3j7d5Yh+1sSCe9HawIq9ITEVlz9eXH/0D0xELjDcRLH3e0csC6yq5NW5ZePTcPbGJJdLoGQGeUF/rs/rd83Kauxx3h8vP1G6As7mvFo76mN9KiTF/T/W07DUXE0bl/v8oesU7jEAAAjT6rfPlq9vrh9W9fyfoeAxFRjgfdlz//mT/vKuZQBiPi7ojYHRH3RMSeiLi3KHt/RDywxvrc3P9JL63xI5eV9f+eK+a2Fvf/yt5fDPYUuZ15/H3Jsala9WDxNxmOvi1ZfmyZbfzw4u+fL7Wusf+XPbLtl33Boh6XepsG6CYnZifyTmkbXL4Qsa+3VfzJjZmAJCL2RsS+1X30rjIx9cQ3+5cqtHL8y2jDPNP811l4c1n8c9EUfylpnJ+cuml+cnRr1KoHR8u94ma//vbpG3miRZutKf42uFytvza0f3ORwaRxvnamvdu/xf0/7U/eyueZ+4tlH0zMzp4ei+hP8tPZ4uXjC+8t82X5bP8fPtD6+N9dvCeL/8GIyHbihyLi4Yh4pKj7oxHxWEQcWCbGn19YOf5IO9T+FyImW57/buz/Te2/+kTPiZ++X2r7/6/9D+ep4WJJfv5bQavqZKeL5gqu5W8HAAAAG0Wafwc+SUdupNN0ZKT+Hf49cVdam56ZffLY9HunJuvflR+MvrQc6RooxkNrU7XqWDJXfGJ9fHS8GCsux0sPFePGX/Rsy/MjlenaZIdjh263fYnjP/NXT6drB6yzbS2Xjvff9ooAHdA8j54uzp5/PZwMYLPye23oXisc/42/gwE2Gdd/6F6tjv/zTXlzAbA5uf5D93L8Q5dKf+x0DYAOWrj+u8uHLnJLv+vfWrz5lv4bQFNiW7RatbUNn7xhE2v6ZwvrkkgWlkTZXpHeARVbVSK9M6qxQRIdPjEBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC0yX8BAAD//10E4Wc=") socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f00000008c0)={0x8, 0x88}, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000900), 0x12000, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000980)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r0) 0s ago: executing program 2 (id=1135): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000004c0)=ANY=[], 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004", @ANYRES32=0x0, @ANYBLOB="000200deffffffffffffff0000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/18], 0x50) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x80) mount$9p_fd(0x0, 0x0, &(0x7f00000001c0), 0x14c98, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000280)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000380), 0x651, 0x0) recvmmsg(r4, &(0x7f00000003c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x6) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f00000003c0)=0x15) ioctl$TCSETS(r7, 0xc0384707, &(0x7f0000000440)={0x6, 0x80000001, 0x0, 0x6, 0x7, "3eccd8f9d20000000000001000000200000500"}) shutdown(r6, 0x0) mremap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000001000/0x2000)=nil) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000480)={r0, r2, 0x16, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000540)='./proc\x00', &(0x7f0000000580)='proc\x00', 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000005c0)='./file2\x00', 0x81c0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x202, 0x150) kernel console output (not intermixed with test programs): 000000000000 R09: 0000000000000000 [ 90.543381][ T5963] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 90.551385][ T5963] R13: 00007fc8f4826038 R14: 00007ffeb876ff10 R15: 00007ffeb876fff8 [ 90.559411][ T5963] [ 90.870925][ T5971] loop3: detected capacity change from 0 to 1024 [ 90.900904][ T5971] EXT4-fs: inline encryption not supported [ 90.965288][ T5971] Quota error (device loop3): do_check_range: Getting block 64 out of range 1-5 [ 90.979653][ T5971] Quota error (device loop3): qtree_read_dquot: Can't read quota structure for id 0 [ 90.989264][ T5971] EXT4-fs error (device loop3): ext4_acquire_dquot:6953: comm syz.3.30: Failed to acquire dquot type 0 [ 91.006137][ T5971] EXT4-fs error (device loop3): mb_free_blocks:1970: group 0, inode 13: block 160:freeing already freed block (bit 10); block bitmap corrupt. [ 91.036057][ T5971] EXT4-fs (loop3): 1 truncate cleaned up [ 91.043284][ T5971] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 91.062883][ T5971] Quota error (device loop3): do_check_range: Getting block 64 out of range 1-5 [ 91.073682][ T5971] Quota error (device loop3): qtree_read_dquot: Can't read quota structure for id 0 [ 91.083551][ T5971] EXT4-fs error (device loop3): ext4_acquire_dquot:6953: comm syz.3.30: Failed to acquire dquot type 0 [ 91.183251][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 91.186170][ T5978] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 92.499677][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 92.536327][ T28] cfg80211: failed to load regulatory.db [ 92.642238][ T5893] rxe_eth0 speed is unknown, defaulting to 1000 [ 94.314567][ T6025] loop2: detected capacity change from 0 to 128 [ 94.410002][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 94.512094][ T6025] FAT-fs (loop2): Filesystem has been set read-only [ 94.713348][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.179334][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.189001][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.203570][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.239896][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.292369][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.381833][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.461777][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.483731][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.508001][ T6038] netlink: 4 bytes leftover after parsing attributes in process `syz.0.36'. [ 95.516247][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.538191][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.549636][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.568655][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.602748][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.619986][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.654140][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.677524][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.697859][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.709194][ T6047] FAULT_INJECTION: forcing a failure. [ 95.709194][ T6047] name fail_futex, interval 1, probability 0, space 0, times 0 [ 95.729755][ T6047] CPU: 1 PID: 6047 Comm: syz.1.50 Not tainted syzkaller #0 [ 95.730587][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.737003][ T6047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 95.737019][ T6047] Call Trace: [ 95.750667][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.755562][ T6047] [ 95.755573][ T6047] dump_stack_lvl+0x18c/0x250 [ 95.758854][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.767328][ T6047] ? show_regs_print_info+0x20/0x20 [ 95.767346][ T6047] ? load_image+0x420/0x420 [ 95.767369][ T6047] ? get_user_pages_fast_only+0xa0/0xa0 [ 95.767404][ T6047] should_fail_ex+0x394/0x4c0 [ 95.767432][ T6047] get_futex_key+0x857/0x1030 [ 95.767456][ T6047] ? futex_setup_timer+0xc0/0xc0 [ 95.767480][ T6047] futex_wake+0x127/0x4f0 [ 95.767504][ T6047] ? futex_wake_mark+0x150/0x150 [ 95.767538][ T6047] do_futex+0x35d/0x3e0 [ 95.767555][ T6047] ? __might_fault+0xaa/0x120 [ 95.767575][ T6047] ? __ia32_sys_get_robust_list+0x110/0x110 [ 95.767597][ T6047] ? __might_fault+0xc6/0x120 [ 95.777866][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.783685][ T6047] mm_release+0x184/0x3a0 [ 95.783712][ T6047] ? exit_mm_release+0x30/0x30 [ 95.783730][ T6047] ? lockdep_hardirqs_on+0x98/0x150 [ 95.783758][ T6047] exit_mm+0xa4/0x340 [ 95.783781][ T6047] ? sysctl_delayacct+0x220/0x220 [ 95.783798][ T6047] ? do_exit+0x2530/0x2530 [ 95.783823][ T6047] ? tty_audit_exit+0x14d/0x1f0 [ 95.783848][ T6047] do_exit+0x909/0x2530 [ 95.783879][ T6047] ? put_task_struct+0xc0/0xc0 [ 95.794633][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.799193][ T6047] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 95.804378][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.808534][ T6047] ? get_signal+0x100e/0x1390 [ 95.836927][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.837736][ T6047] ? lock_chain_count+0x20/0x20 [ 95.842990][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.850915][ T6047] ? _raw_spin_lock_irq+0xbb/0xf0 [ 95.850966][ T6047] do_group_exit+0x22d/0x2f0 [ 95.850984][ T6047] ? lockdep_hardirqs_on+0x98/0x150 [ 95.851006][ T6047] get_signal+0x12a6/0x1390 [ 95.851037][ T6047] arch_do_signal_or_restart+0xc2/0x7b0 [ 95.851062][ T6047] ? __ia32_sys_get_robust_list+0x110/0x110 [ 95.851080][ T6047] ? get_sigframe_size+0x20/0x20 [ 95.851118][ T6047] ? exit_to_user_mode_loop+0x3b/0x110 [ 95.851145][ T6047] exit_to_user_mode_loop+0x70/0x110 [ 95.851169][ T6047] exit_to_user_mode_prepare+0xee/0x180 [ 95.851193][ T6047] syscall_exit_to_user_mode+0x1a/0x50 [ 95.851211][ T6047] do_syscall_64+0x61/0xb0 [ 95.851225][ T6047] ? clear_bhb_loop+0x40/0x90 [ 95.861370][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.865527][ T6047] ? clear_bhb_loop+0x40/0x90 [ 95.873247][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.874551][ T6047] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 95.882422][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.883827][ T6047] RIP: 0033:0x7fa5cb99e559 [ 95.883848][ T6047] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.883862][ T6047] RSP: 002b:00007fa5cc8fc0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 95.888109][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 95.892802][ T6047] RAX: fffffffffffffe00 RBX: 00007fa5cbc25fa8 RCX: 00007fa5cb99e559 [ 95.892816][ T6047] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa5cbc25fa8 [ 95.892826][ T6047] RBP: 00007fa5cbc25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 95.892837][ T6047] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.892847][ T6047] R13: 00007fa5cbc26038 R14: 00007ffc5deb0a60 R15: 00007ffc5deb0b48 [ 95.892873][ T6047] [ 96.152997][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 96.161575][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 96.170092][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 96.178559][ T6025] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 96.206227][ T27] audit: type=1800 audit(1792047011.843:2): pid=6025 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.47" name="file1" dev="loop2" ino=1048623 res=0 errno=0 [ 96.263252][ T6025] syz.2.47 (6025) used greatest stack depth: 19600 bytes left [ 96.442562][ T6069] process 'syz.3.57' launched './file0' with NULL argv: empty string added [ 96.566616][ T6076] netlink: 4 bytes leftover after parsing attributes in process `syz.1.59'. [ 96.702350][ T6080] nvmet: adding nsid 1 to subsystem testsubsys [ 97.179865][ T6106] netlink: 4 bytes leftover after parsing attributes in process `syz.0.71'. [ 97.995666][ T6114] nvmet: Invalid value 'ipv' for adrfam [ 98.035660][ T6116] syzkaller0: entered promiscuous mode [ 98.057865][ T6120] FAULT_INJECTION: forcing a failure. [ 98.057865][ T6120] name fail_futex, interval 1, probability 0, space 0, times 0 [ 98.069604][ T6116] syzkaller0: entered allmulticast mode [ 98.073998][ T6120] CPU: 1 PID: 6120 Comm: syz.1.74 Not tainted syzkaller #0 [ 98.083763][ T6120] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 98.093932][ T6120] Call Trace: [ 98.097236][ T6120] [ 98.100188][ T6120] dump_stack_lvl+0x18c/0x250 [ 98.104904][ T6120] ? show_regs_print_info+0x20/0x20 [ 98.110171][ T6120] ? load_image+0x420/0x420 [ 98.114758][ T6120] ? get_user_pages_fast_only+0xa0/0xa0 [ 98.120372][ T6120] should_fail_ex+0x394/0x4c0 [ 98.125107][ T6120] get_futex_key+0x857/0x1030 [ 98.129889][ T6120] ? futex_setup_timer+0xc0/0xc0 [ 98.134850][ T6120] futex_wake+0x127/0x4f0 [ 98.139211][ T6120] ? futex_wake_mark+0x150/0x150 [ 98.144179][ T6120] do_futex+0x35d/0x3e0 [ 98.148358][ T6120] ? __might_fault+0xaa/0x120 [ 98.153085][ T6120] ? __ia32_sys_get_robust_list+0x110/0x110 [ 98.159168][ T6120] ? __might_fault+0xc6/0x120 [ 98.163951][ T6120] mm_release+0x184/0x3a0 [ 98.168286][ T6120] ? exit_mm_release+0x30/0x30 [ 98.173057][ T6120] ? lockdep_hardirqs_on+0x98/0x150 [ 98.178271][ T6120] exit_mm+0xa4/0x340 [ 98.182261][ T6120] ? sysctl_delayacct+0x220/0x220 [ 98.187354][ T6120] ? do_exit+0x2530/0x2530 [ 98.191937][ T6120] do_exit+0x909/0x2530 [ 98.196179][ T6120] ? put_task_struct+0xc0/0xc0 [ 98.200992][ T6120] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 98.207009][ T6120] ? get_signal+0x100e/0x1390 [ 98.211704][ T6120] ? lock_chain_count+0x20/0x20 [ 98.216821][ T6120] ? _raw_spin_lock_irq+0xbb/0xf0 [ 98.221850][ T6120] do_group_exit+0x22d/0x2f0 [ 98.226533][ T6120] ? lockdep_hardirqs_on+0x98/0x150 [ 98.231735][ T6120] get_signal+0x12a6/0x1390 [ 98.236341][ T6120] arch_do_signal_or_restart+0xc2/0x7b0 [ 98.242014][ T6120] ? __ia32_sys_get_robust_list+0x110/0x110 [ 98.247997][ T6120] ? get_sigframe_size+0x20/0x20 [ 98.252949][ T6120] ? exit_to_user_mode_loop+0x3b/0x110 [ 98.258432][ T6120] exit_to_user_mode_loop+0x70/0x110 [ 98.263728][ T6120] exit_to_user_mode_prepare+0xee/0x180 [ 98.269369][ T6120] syscall_exit_to_user_mode+0x1a/0x50 [ 98.274832][ T6120] do_syscall_64+0x61/0xb0 [ 98.279333][ T6120] ? clear_bhb_loop+0x40/0x90 [ 98.284026][ T6120] ? clear_bhb_loop+0x40/0x90 [ 98.288809][ T6120] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 98.294752][ T6120] RIP: 0033:0x7fa5cb99e559 [ 98.299368][ T6120] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.319084][ T6120] RSP: 002b:00007fa5cc8db0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 98.327604][ T6120] RAX: fffffffffffffe00 RBX: 00007fa5cbc26098 RCX: 00007fa5cb99e559 [ 98.335583][ T6120] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa5cbc26098 [ 98.343684][ T6120] RBP: 00007fa5cbc26090 R08: 0000000000000000 R09: 0000000000000000 [ 98.351685][ T6120] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.359752][ T6120] R13: 00007fa5cbc26128 R14: 00007ffc5deb0a60 R15: 00007ffc5deb0b48 [ 98.367752][ T6120] [ 99.130745][ T6141] netlink: 4 bytes leftover after parsing attributes in process `syz.0.81'. [ 99.913521][ T6145] nvmet: Invalid value 'ipv' for adrfam [ 100.330614][ T6164] FAULT_INJECTION: forcing a failure. [ 100.330614][ T6164] name failslab, interval 1, probability 0, space 0, times 1 [ 100.347376][ T6164] CPU: 1 PID: 6164 Comm: syz.3.94 Not tainted syzkaller #0 [ 100.354652][ T6164] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 100.364750][ T6164] Call Trace: [ 100.368158][ T6164] [ 100.371119][ T6164] dump_stack_lvl+0x18c/0x250 [ 100.375841][ T6164] ? show_regs_print_info+0x20/0x20 [ 100.381094][ T6164] ? load_image+0x420/0x420 [ 100.385647][ T6164] ? __might_sleep+0xe0/0xe0 [ 100.390282][ T6164] ? __lock_acquire+0x7eb0/0x7eb0 [ 100.395356][ T6164] should_fail_ex+0x394/0x4c0 [ 100.400106][ T6164] should_failslab+0x9/0x20 [ 100.404650][ T6164] slab_pre_alloc_hook+0x59/0x300 [ 100.409713][ T6164] ? d_instantiate+0x6f/0x90 [ 100.414375][ T6164] kmem_cache_alloc+0x5a/0x2c0 [ 100.419160][ T6164] ? alloc_empty_file+0x9e/0x1d0 [ 100.424109][ T6164] alloc_empty_file+0x9e/0x1d0 [ 100.428890][ T6164] alloc_file+0x5b/0x600 [ 100.433146][ T6164] alloc_file_pseudo+0x184/0x210 [ 100.438118][ T6164] ? fput+0x1a0/0x1a0 [ 100.442196][ T6164] ? alloc_fd+0x590/0x640 [ 100.446543][ T6164] sock_alloc_file+0xb7/0x280 [ 100.451232][ T6164] __sys_socket+0x140/0x1b0 [ 100.455749][ T6164] __x64_sys_socket+0x7a/0x90 [ 100.460436][ T6164] do_syscall_64+0x55/0xb0 [ 100.464855][ T6164] ? clear_bhb_loop+0x40/0x90 [ 100.469549][ T6164] ? clear_bhb_loop+0x40/0x90 [ 100.474264][ T6164] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 100.480284][ T6164] RIP: 0033:0x7f3846f9e559 [ 100.484733][ T6164] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 100.504366][ T6164] RSP: 002b:00007f3847f3e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 100.512817][ T6164] RAX: ffffffffffffffda RBX: 00007f3847225fa0 RCX: 00007f3846f9e559 [ 100.520820][ T6164] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000028 [ 100.528812][ T6164] RBP: 00007f38470358b0 R08: 0000000000000000 R09: 0000000000000000 [ 100.536818][ T6164] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 100.544806][ T6164] R13: 00007f3847226038 R14: 00007f3847225fa0 R15: 00007fffd91baab8 [ 100.552919][ T6164] [ 100.684513][ T6171] nvmet: Invalid value 'ipv' for adrfam [ 100.710150][ T6173] Bluetooth: MGMT ver 1.22 [ 100.891429][ T6183] FAULT_INJECTION: forcing a failure. [ 100.891429][ T6183] name fail_futex, interval 1, probability 0, space 0, times 0 [ 100.905838][ T6183] CPU: 0 PID: 6183 Comm: syz.1.102 Not tainted syzkaller #0 [ 100.913172][ T6183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 100.923257][ T6183] Call Trace: [ 100.926560][ T6183] [ 100.929603][ T6183] dump_stack_lvl+0x18c/0x250 [ 100.934405][ T6183] ? show_regs_print_info+0x20/0x20 [ 100.939740][ T6183] ? load_image+0x420/0x420 [ 100.944451][ T6183] ? __lock_acquire+0x1431/0x7eb0 [ 100.949520][ T6183] should_fail_ex+0x394/0x4c0 [ 100.954231][ T6183] get_futex_key+0x16f/0x1030 [ 100.959029][ T6183] ? futex_setup_timer+0xc0/0xc0 [ 100.964051][ T6183] futex_wake+0x127/0x4f0 [ 100.968425][ T6183] ? futex_wake_mark+0x150/0x150 [ 100.973745][ T6183] do_futex+0x35d/0x3e0 [ 100.977937][ T6183] ? __might_fault+0xaa/0x120 [ 100.982815][ T6183] ? __ia32_sys_get_robust_list+0x110/0x110 [ 100.988727][ T6183] ? __might_fault+0xc6/0x120 [ 100.993403][ T6183] mm_release+0x184/0x3a0 [ 100.997744][ T6183] ? exit_mm_release+0x30/0x30 [ 101.002548][ T6183] ? lockdep_hardirqs_on+0x98/0x150 [ 101.007880][ T6183] exit_mm+0xa4/0x340 [ 101.011965][ T6183] ? sysctl_delayacct+0x220/0x220 [ 101.016998][ T6183] ? do_exit+0x2530/0x2530 [ 101.021522][ T6183] do_exit+0x909/0x2530 [ 101.026237][ T6183] ? put_task_struct+0xc0/0xc0 [ 101.031029][ T6183] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 101.037077][ T6183] ? get_signal+0x100e/0x1390 [ 101.041843][ T6183] ? lock_chain_count+0x20/0x20 [ 101.046789][ T6183] ? _raw_spin_lock_irq+0xbb/0xf0 [ 101.052083][ T6183] do_group_exit+0x22d/0x2f0 [ 101.056909][ T6183] ? lockdep_hardirqs_on+0x98/0x150 [ 101.062127][ T6183] get_signal+0x12a6/0x1390 [ 101.066654][ T6183] arch_do_signal_or_restart+0xc2/0x7b0 [ 101.072229][ T6183] ? __ia32_sys_get_robust_list+0x110/0x110 [ 101.078162][ T6183] ? get_sigframe_size+0x20/0x20 [ 101.083185][ T6183] ? exit_to_user_mode_loop+0x3b/0x110 [ 101.088763][ T6183] exit_to_user_mode_loop+0x70/0x110 [ 101.094087][ T6183] exit_to_user_mode_prepare+0xee/0x180 [ 101.099643][ T6183] syscall_exit_to_user_mode+0x1a/0x50 [ 101.105161][ T6183] do_syscall_64+0x61/0xb0 [ 101.109636][ T6183] ? clear_bhb_loop+0x40/0x90 [ 101.114356][ T6183] ? clear_bhb_loop+0x40/0x90 [ 101.119067][ T6183] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 101.124995][ T6183] RIP: 0033:0x7fa5cb99e559 [ 101.129424][ T6183] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.149063][ T6183] RSP: 002b:00007fa5cc8fc0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 101.157659][ T6183] RAX: fffffffffffffe00 RBX: 00007fa5cbc25fa8 RCX: 00007fa5cb99e559 [ 101.165644][ T6183] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa5cbc25fa8 [ 101.173666][ T6183] RBP: 00007fa5cbc25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 101.181738][ T6183] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.189795][ T6183] R13: 00007fa5cbc26038 R14: 00007ffc5deb0a60 R15: 00007ffc5deb0b48 [ 101.197781][ T6183] [ 101.200906][ C0] vkms_vblank_simulate: vblank timer overrun [ 101.278422][ T6189] FAULT_INJECTION: forcing a failure. [ 101.278422][ T6189] name failslab, interval 1, probability 0, space 0, times 0 [ 101.344570][ T6189] CPU: 1 PID: 6189 Comm: syz.2.104 Not tainted syzkaller #0 [ 101.351935][ T6189] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 101.362297][ T6189] Call Trace: [ 101.365604][ T6189] [ 101.368572][ T6189] dump_stack_lvl+0x18c/0x250 [ 101.373295][ T6189] ? show_regs_print_info+0x20/0x20 [ 101.378541][ T6189] ? load_image+0x420/0x420 [ 101.383090][ T6189] ? __might_sleep+0xe0/0xe0 [ 101.387807][ T6189] ? __lock_acquire+0x7eb0/0x7eb0 [ 101.392878][ T6189] should_fail_ex+0x394/0x4c0 [ 101.397617][ T6189] should_failslab+0x9/0x20 [ 101.402318][ T6189] slab_pre_alloc_hook+0x59/0x300 [ 101.407481][ T6189] ? d_instantiate+0x6f/0x90 [ 101.412110][ T6189] kmem_cache_alloc+0x5a/0x2c0 [ 101.416971][ T6189] ? alloc_empty_file+0x9e/0x1d0 [ 101.421953][ T6189] alloc_empty_file+0x9e/0x1d0 [ 101.426771][ T6189] alloc_file+0x5b/0x600 [ 101.431072][ T6189] alloc_file_pseudo+0x184/0x210 [ 101.436327][ T6189] ? fput+0x1a0/0x1a0 [ 101.440439][ T6189] ? alloc_fd+0x590/0x640 [ 101.444807][ T6189] sock_alloc_file+0xb7/0x280 [ 101.449548][ T6189] __sys_socket+0x140/0x1b0 [ 101.454103][ T6189] __x64_sys_socket+0x7a/0x90 [ 101.458831][ T6189] do_syscall_64+0x55/0xb0 [ 101.463282][ T6189] ? clear_bhb_loop+0x40/0x90 [ 101.468009][ T6189] ? clear_bhb_loop+0x40/0x90 [ 101.472739][ T6189] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 101.478688][ T6189] RIP: 0033:0x7f22c839e559 [ 101.483233][ T6189] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.503049][ T6189] RSP: 002b:00007f22c9191028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 101.511511][ T6189] RAX: ffffffffffffffda RBX: 00007f22c8625fa0 RCX: 00007f22c839e559 [ 101.519781][ T6189] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000028 [ 101.527800][ T6189] RBP: 00007f22c84358b0 R08: 0000000000000000 R09: 0000000000000000 [ 101.535994][ T6189] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.544202][ T6189] R13: 00007f22c8626038 R14: 00007f22c8625fa0 R15: 00007fff1354ad68 [ 101.552256][ T6189] [ 101.771986][ T6208] FAULT_INJECTION: forcing a failure. [ 101.771986][ T6208] name fail_futex, interval 1, probability 0, space 0, times 0 [ 101.810988][ T6208] CPU: 1 PID: 6208 Comm: syz.0.114 Not tainted syzkaller #0 [ 101.818345][ T6208] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 101.828434][ T6208] Call Trace: [ 101.831752][ T6208] [ 101.834717][ T6208] dump_stack_lvl+0x18c/0x250 [ 101.839433][ T6208] ? show_regs_print_info+0x20/0x20 [ 101.844678][ T6208] ? load_image+0x420/0x420 [ 101.849315][ T6208] ? get_user_pages_fast_only+0xa0/0xa0 [ 101.854915][ T6208] should_fail_ex+0x394/0x4c0 [ 101.859724][ T6208] get_futex_key+0x857/0x1030 [ 101.864641][ T6208] ? futex_setup_timer+0xc0/0xc0 [ 101.869618][ T6208] futex_wake+0x127/0x4f0 [ 101.873985][ T6208] ? virtsnd_chmap_build_devs+0x560/0xde0 [ 101.879836][ T6208] ? futex_wake_mark+0x150/0x150 [ 101.884846][ T6208] do_futex+0x35d/0x3e0 [ 101.889033][ T6208] ? __might_fault+0xaa/0x120 [ 101.893744][ T6208] ? __ia32_sys_get_robust_list+0x110/0x110 [ 101.900370][ T6208] ? __might_fault+0xc6/0x120 [ 101.905054][ T6208] mm_release+0x184/0x3a0 [ 101.909385][ T6208] ? exit_mm_release+0x30/0x30 [ 101.914237][ T6208] ? lockdep_hardirqs_on+0x98/0x150 [ 101.919476][ T6208] exit_mm+0xa4/0x340 [ 101.923566][ T6208] ? sysctl_delayacct+0x220/0x220 [ 101.928770][ T6208] ? do_exit+0x2530/0x2530 [ 101.933196][ T6208] ? tty_audit_exit+0x14d/0x1f0 [ 101.938189][ T6208] do_exit+0x909/0x2530 [ 101.942354][ T6208] ? put_task_struct+0xc0/0xc0 [ 101.947158][ T6208] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 101.953191][ T6208] ? get_signal+0x100e/0x1390 [ 101.957967][ T6208] ? lock_chain_count+0x20/0x20 [ 101.962826][ T6208] ? _raw_spin_lock_irq+0xbb/0xf0 [ 101.967888][ T6208] do_group_exit+0x22d/0x2f0 [ 101.972480][ T6208] ? lockdep_hardirqs_on+0x98/0x150 [ 101.977682][ T6208] get_signal+0x12a6/0x1390 [ 101.982209][ T6208] arch_do_signal_or_restart+0xc2/0x7b0 [ 101.987990][ T6208] ? __ia32_sys_get_robust_list+0x110/0x110 [ 101.993925][ T6208] ? get_sigframe_size+0x20/0x20 [ 101.999035][ T6208] ? exit_to_user_mode_loop+0x3b/0x110 [ 102.004505][ T6208] exit_to_user_mode_loop+0x70/0x110 [ 102.009795][ T6208] exit_to_user_mode_prepare+0xee/0x180 [ 102.015342][ T6208] syscall_exit_to_user_mode+0x1a/0x50 [ 102.020805][ T6208] do_syscall_64+0x61/0xb0 [ 102.025317][ T6208] ? clear_bhb_loop+0x40/0x90 [ 102.030003][ T6208] ? clear_bhb_loop+0x40/0x90 [ 102.034682][ T6208] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 102.040599][ T6208] RIP: 0033:0x7fc8f459e559 [ 102.045101][ T6208] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.064903][ T6208] RSP: 002b:00007fc8f54830e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 102.073913][ T6208] RAX: fffffffffffffe00 RBX: 00007fc8f4825fa8 RCX: 00007fc8f459e559 [ 102.082022][ T6208] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc8f4825fa8 [ 102.090087][ T6208] RBP: 00007fc8f4825fa0 R08: 0000000000000000 R09: 0000000000000000 [ 102.098059][ T6208] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.106046][ T6208] R13: 00007fc8f4826038 R14: 00007ffeb876ff10 R15: 00007ffeb876fff8 [ 102.114079][ T6208] [ 102.302318][ T6222] netlink: 32 bytes leftover after parsing attributes in process `syz.0.119'. [ 103.220205][ T6234] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1500) ! [ 103.300847][ T6234] syzkaller0: entered promiscuous mode [ 103.323269][ T6234] syzkaller0: entered allmulticast mode [ 103.388572][ T6243] FAULT_INJECTION: forcing a failure. [ 103.388572][ T6243] name fail_futex, interval 1, probability 0, space 0, times 0 [ 103.416105][ T6243] CPU: 1 PID: 6243 Comm: syz.1.127 Not tainted syzkaller #0 [ 103.423468][ T6243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 103.433650][ T6243] Call Trace: [ 103.436959][ T6243] [ 103.439929][ T6243] dump_stack_lvl+0x18c/0x250 [ 103.444684][ T6243] ? show_regs_print_info+0x20/0x20 [ 103.449963][ T6243] ? load_image+0x420/0x420 [ 103.454507][ T6243] ? __lock_acquire+0x1431/0x7eb0 [ 103.459589][ T6243] should_fail_ex+0x394/0x4c0 [ 103.464311][ T6243] get_futex_key+0x16f/0x1030 [ 103.469034][ T6243] ? futex_setup_timer+0xc0/0xc0 [ 103.474025][ T6243] futex_wake+0x127/0x4f0 [ 103.478409][ T6243] ? futex_wake_mark+0x150/0x150 [ 103.483662][ T6243] do_futex+0x35d/0x3e0 [ 103.487945][ T6243] ? __might_fault+0xaa/0x120 [ 103.492841][ T6243] ? __ia32_sys_get_robust_list+0x110/0x110 [ 103.498788][ T6243] ? __might_fault+0xc6/0x120 [ 103.503591][ T6243] mm_release+0x184/0x3a0 [ 103.507955][ T6243] ? exit_mm_release+0x30/0x30 [ 103.512840][ T6243] ? lockdep_hardirqs_on+0x98/0x150 [ 103.518095][ T6243] exit_mm+0xa4/0x340 [ 103.522115][ T6243] ? sysctl_delayacct+0x220/0x220 [ 103.527181][ T6243] ? do_exit+0x2530/0x2530 [ 103.531653][ T6243] do_exit+0x909/0x2530 [ 103.535954][ T6243] ? put_task_struct+0xc0/0xc0 [ 103.540964][ T6243] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 103.547070][ T6243] ? get_signal+0x100e/0x1390 [ 103.551865][ T6243] ? lock_chain_count+0x20/0x20 [ 103.556748][ T6243] ? _raw_spin_lock_irq+0xbb/0xf0 [ 103.561903][ T6243] do_group_exit+0x22d/0x2f0 [ 103.566525][ T6243] ? lockdep_hardirqs_on+0x98/0x150 [ 103.571759][ T6243] get_signal+0x12a6/0x1390 [ 103.576310][ T6243] arch_do_signal_or_restart+0xc2/0x7b0 [ 103.581902][ T6243] ? __ia32_sys_get_robust_list+0x110/0x110 [ 103.587922][ T6243] ? get_sigframe_size+0x20/0x20 [ 103.592928][ T6243] ? exit_to_user_mode_loop+0x3b/0x110 [ 103.598430][ T6243] exit_to_user_mode_loop+0x70/0x110 [ 103.603874][ T6243] exit_to_user_mode_prepare+0xee/0x180 [ 103.609564][ T6243] syscall_exit_to_user_mode+0x1a/0x50 [ 103.615153][ T6243] do_syscall_64+0x61/0xb0 [ 103.619603][ T6243] ? clear_bhb_loop+0x40/0x90 [ 103.624317][ T6243] ? clear_bhb_loop+0x40/0x90 [ 103.629037][ T6243] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 103.634977][ T6243] RIP: 0033:0x7fa5cb99e559 [ 103.639429][ T6243] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.659245][ T6243] RSP: 002b:00007fa5cc8fc0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 103.667879][ T6243] RAX: fffffffffffffe00 RBX: 00007fa5cbc25fa8 RCX: 00007fa5cb99e559 [ 103.675893][ T6243] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa5cbc25fa8 [ 103.683946][ T6243] RBP: 00007fa5cbc25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 103.692214][ T6243] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.700309][ T6243] R13: 00007fa5cbc26038 R14: 00007ffc5deb0a60 R15: 00007ffc5deb0b48 [ 103.708337][ T6243] [ 104.182912][ T6266] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 104.257063][ T6266] loop0: detected capacity change from 0 to 1024 [ 104.430502][ T6266] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 105.165707][ T6279] netlink: 4 bytes leftover after parsing attributes in process `syz.2.132'. [ 105.656313][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 105.758510][ T6286] netlink: 12 bytes leftover after parsing attributes in process `syz.3.137'. [ 106.092227][ T6297] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1500) ! [ 106.866061][ T6303] syzkaller0: entered promiscuous mode [ 106.880291][ T6303] syzkaller0: entered allmulticast mode [ 106.894925][ T6307] loop3: detected capacity change from 0 to 512 [ 106.978356][ T6307] EXT4-fs error (device loop3): ext4_orphan_get:1408: inode #15: comm syz.3.142: inode has both inline data and extents flags [ 107.030913][ T6307] EXT4-fs error (device loop3): ext4_orphan_get:1413: comm syz.3.142: couldn't read orphan inode 15 (err -117) [ 107.051833][ T6307] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 107.221456][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 107.424961][ T6316] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 107.492338][ T6316] loop0: detected capacity change from 0 to 1024 [ 107.624475][ T6316] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 108.351606][ T6269] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 109.005076][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 109.126543][ T6333] loop3: detected capacity change from 0 to 512 [ 109.214352][ T6333] EXT4-fs error (device loop3): ext4_orphan_get:1408: inode #15: comm syz.3.152: inode has both inline data and extents flags [ 109.216035][ T6335] syz.2.151 uses obsolete (PF_INET,SOCK_PACKET) [ 109.228858][ T6333] EXT4-fs error (device loop3): ext4_orphan_get:1413: comm syz.3.152: couldn't read orphan inode 15 (err -117) [ 109.247803][ T6333] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 109.387137][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 110.080394][ T6359] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 110.134951][ T6359] loop3: detected capacity change from 0 to 1024 [ 110.937282][ T6359] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 111.269138][ T6374] loop1: detected capacity change from 0 to 512 [ 111.570058][ T6374] EXT4-fs error (device loop1): ext4_orphan_get:1408: inode #15: comm syz.1.164: inode has both inline data and extents flags [ 112.029973][ T6374] EXT4-fs error (device loop1): ext4_orphan_get:1413: comm syz.1.164: couldn't read orphan inode 15 (err -117) [ 112.060701][ T6374] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 112.075456][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 112.257653][ T6386] FAULT_INJECTION: forcing a failure. [ 112.257653][ T6386] name failslab, interval 1, probability 0, space 0, times 0 [ 112.288280][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 112.308485][ T6386] CPU: 1 PID: 6386 Comm: syz.3.166 Not tainted syzkaller #0 [ 112.315843][ T6386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 112.326032][ T6386] Call Trace: [ 112.329429][ T6386] [ 112.332443][ T6386] dump_stack_lvl+0x18c/0x250 [ 112.337180][ T6386] ? show_regs_print_info+0x20/0x20 [ 112.342420][ T6386] ? load_image+0x420/0x420 [ 112.346974][ T6386] ? __might_sleep+0xe0/0xe0 [ 112.351620][ T6386] ? __lock_acquire+0x7eb0/0x7eb0 [ 112.356788][ T6386] ? __asan_memset+0x22/0x40 [ 112.361514][ T6386] should_fail_ex+0x394/0x4c0 [ 112.366236][ T6386] should_failslab+0x9/0x20 [ 112.371022][ T6386] slab_pre_alloc_hook+0x59/0x300 [ 112.376062][ T6386] kmem_cache_alloc+0x5a/0x2c0 [ 112.380840][ T6386] ? proc_reg_open+0x1f0/0x520 [ 112.385704][ T6386] proc_reg_open+0x1f0/0x520 [ 112.390477][ T6386] do_dentry_open+0x880/0x14b0 [ 112.395274][ T6386] ? proc_reg_mmap+0x290/0x290 [ 112.400046][ T6386] path_openat+0x284f/0x3270 [ 112.404924][ T6386] ? do_filp_open+0x430/0x430 [ 112.409726][ T6386] do_filp_open+0x1f2/0x430 [ 112.414260][ T6386] ? vfs_tmpfile+0x620/0x620 [ 112.418863][ T6386] ? noop_direct_IO+0x20/0x20 [ 112.423582][ T6386] ? _raw_spin_unlock+0x28/0x40 [ 112.428536][ T6386] ? alloc_fd+0x590/0x640 [ 112.432886][ T6386] do_sys_openat2+0x134/0x1d0 [ 112.437669][ T6386] ? do_sys_open+0xe0/0xe0 [ 112.442100][ T6386] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 112.448182][ T6386] ? lock_chain_count+0x20/0x20 [ 112.453050][ T6386] __x64_sys_openat+0x139/0x160 [ 112.458001][ T6386] do_syscall_64+0x55/0xb0 [ 112.462594][ T6386] ? clear_bhb_loop+0x40/0x90 [ 112.467375][ T6386] ? clear_bhb_loop+0x40/0x90 [ 112.472076][ T6386] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 112.478073][ T6386] RIP: 0033:0x7f3846f5ed8e [ 112.482514][ T6386] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 112.502449][ T6386] RSP: 002b:00007f3847f3dec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 112.510919][ T6386] RAX: ffffffffffffffda RBX: 00007f3847f3e6c0 RCX: 00007f3846f5ed8e [ 112.518925][ T6386] RDX: 0000000000000002 RSI: 00007f3847f3df90 RDI: ffffffffffffff9c [ 112.527102][ T6386] RBP: 00007f38470358b0 R08: 0000000000000000 R09: 0000000000000000 [ 112.535297][ T6386] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 112.543521][ T6386] R13: 00007f3847226038 R14: 00007f3847225fa0 R15: 00007fffd91baab8 [ 112.551624][ T6386] [ 112.656874][ T6395] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 113.230644][ T6410] netlink: 4 bytes leftover after parsing attributes in process `syz.3.173'. [ 114.703213][ T6415] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 114.764647][ T6415] loop3: detected capacity change from 0 to 1024 [ 114.838035][ T6415] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 115.424917][ T6447] netlink: 4 bytes leftover after parsing attributes in process `syz.1.183'. [ 115.873466][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 117.049754][ T6469] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 117.398016][ T6481] netlink: 4 bytes leftover after parsing attributes in process `syz.3.196'. [ 118.123170][ T6492] loop3: detected capacity change from 0 to 512 [ 118.260912][ T6492] ======================================================= [ 118.260912][ T6492] WARNING: The mand mount option has been deprecated and [ 118.260912][ T6492] and is ignored by this kernel. Remove the mand [ 118.260912][ T6492] option from the mount to silence this warning. [ 118.260912][ T6492] ======================================================= [ 118.315833][ T6492] EXT4-fs: Ignoring removed bh option [ 118.337463][ T6492] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 119.055723][ T6492] EXT4-fs error (device loop3): ext4_map_blocks:610: inode #2: block 18: comm syz.3.202: lblock 23 mapped to illegal pblock 18 (length 1) [ 119.273353][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 120.182798][ T6518] FAULT_INJECTION: forcing a failure. [ 120.182798][ T6518] name failslab, interval 1, probability 0, space 0, times 0 [ 120.359320][ T6518] CPU: 0 PID: 6518 Comm: syz.3.209 Not tainted syzkaller #0 [ 120.366679][ T6518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 120.376758][ T6518] Call Trace: [ 120.380055][ T6518] [ 120.383017][ T6518] dump_stack_lvl+0x18c/0x250 [ 120.387891][ T6518] ? show_regs_print_info+0x20/0x20 [ 120.393141][ T6518] ? load_image+0x420/0x420 [ 120.397803][ T6518] ? __might_sleep+0xe0/0xe0 [ 120.402437][ T6518] ? __lock_acquire+0x7eb0/0x7eb0 [ 120.407505][ T6518] should_fail_ex+0x394/0x4c0 [ 120.412220][ T6518] should_failslab+0x9/0x20 [ 120.416757][ T6518] slab_pre_alloc_hook+0x59/0x300 [ 120.421834][ T6518] ? lockdep_softirqs_off+0x440/0x440 [ 120.427234][ T6518] kmem_cache_alloc+0x5a/0x2c0 [ 120.432027][ T6518] ? security_inode_alloc+0x34/0x110 [ 120.437451][ T6518] security_inode_alloc+0x34/0x110 [ 120.442615][ T6518] inode_init_always+0x914/0xc90 [ 120.447596][ T6518] new_inode_pseudo+0x95/0x1d0 [ 120.452399][ T6518] create_pipe_files+0x51/0x700 [ 120.457299][ T6518] ? __ia32_sys_get_robust_list+0x110/0x110 [ 120.463333][ T6518] __do_pipe_flags+0x4c/0x2c0 [ 120.468204][ T6518] do_pipe2+0xab/0x190 [ 120.472343][ T6518] ? _compound_head+0x120/0x120 [ 120.477296][ T6518] ? lock_chain_count+0x20/0x20 [ 120.482194][ T6518] ? syscall_enter_from_user_mode+0x25/0x80 [ 120.488228][ T6518] __x64_sys_pipe2+0x5a/0x70 [ 120.492905][ T6518] do_syscall_64+0x55/0xb0 [ 120.497532][ T6518] ? clear_bhb_loop+0x40/0x90 [ 120.502335][ T6518] ? clear_bhb_loop+0x40/0x90 [ 120.507063][ T6518] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 120.513106][ T6518] RIP: 0033:0x7f3846f9e559 [ 120.517586][ T6518] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.537332][ T6518] RSP: 002b:00007f3847f3e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000125 [ 120.545877][ T6518] RAX: ffffffffffffffda RBX: 00007f3847225fa0 RCX: 00007f3846f9e559 [ 120.553910][ T6518] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 120.562031][ T6518] RBP: 00007f38470358b0 R08: 0000000000000000 R09: 0000000000000000 [ 120.570225][ T6518] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 120.578222][ T6518] R13: 00007f3847226038 R14: 00007f3847225fa0 R15: 00007fffd91baab8 [ 120.586237][ T6518] [ 121.159385][ T6530] loop0: detected capacity change from 0 to 4096 [ 121.244988][ T6540] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 121.312636][ T6540] loop2: detected capacity change from 0 to 1024 [ 121.937343][ T6540] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 122.025658][ T6530] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 122.185075][ T6530] EXT4-fs warning (device loop0): ext4_resize_fs:2025: can't read last block, resize aborted [ 122.311354][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 122.687713][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 123.672491][ T6574] md: invalid superblock checksum on ram0 [ 123.679455][ T6574] md: ram0 does not have a valid v1.2 superblock, not importing! [ 124.748199][ T6594] Bluetooth: hci0: unsupported parameter 255 [ 124.757520][ T6594] Bluetooth: hci0: unsupported parameter 255 [ 124.963235][ T6607] FAULT_INJECTION: forcing a failure. [ 124.963235][ T6607] name failslab, interval 1, probability 0, space 0, times 0 [ 124.989575][ T6607] CPU: 1 PID: 6607 Comm: syz.0.240 Not tainted syzkaller #0 [ 124.996944][ T6607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 125.007128][ T6607] Call Trace: [ 125.010442][ T6607] [ 125.013531][ T6607] dump_stack_lvl+0x18c/0x250 [ 125.018266][ T6607] ? show_regs_print_info+0x20/0x20 [ 125.023571][ T6607] ? load_image+0x420/0x420 [ 125.028111][ T6607] should_fail_ex+0x394/0x4c0 [ 125.032902][ T6607] should_failslab+0x9/0x20 [ 125.037445][ T6607] slab_pre_alloc_hook+0x59/0x300 [ 125.042498][ T6607] ? proc_thread_self_get_link+0xfc/0x190 [ 125.048324][ T6607] __kmem_cache_alloc_node+0x53/0x250 [ 125.053883][ T6607] ? proc_thread_self_get_link+0xfc/0x190 [ 125.059714][ T6607] kmalloc_trace+0x2a/0xe0 [ 125.064166][ T6607] proc_thread_self_get_link+0xfc/0x190 [ 125.069758][ T6607] ? proc_setup_thread_self+0x2c0/0x2c0 [ 125.075441][ T6607] pick_link+0x6a8/0xdd0 [ 125.079715][ T6607] step_into+0xc18/0xee0 [ 125.084004][ T6607] ? set_root+0x3a0/0x3a0 [ 125.088372][ T6607] ? lookup_fast+0x14a/0x4c0 [ 125.092990][ T6607] ? security_inode_permission+0xb0/0xf0 [ 125.098662][ T6607] link_path_walk+0x748/0xe40 [ 125.103371][ T6607] ? handle_lookup_down+0x130/0x130 [ 125.108702][ T6607] path_openat+0x291/0x3270 [ 125.113244][ T6607] ? do_sys_openat2+0xda/0x1d0 [ 125.118033][ T6607] ? __x64_sys_openat+0x139/0x160 [ 125.123095][ T6607] ? verify_lock_unused+0x140/0x140 [ 125.128355][ T6607] ? do_filp_open+0x430/0x430 [ 125.133153][ T6607] do_filp_open+0x1f2/0x430 [ 125.137687][ T6607] ? vfs_tmpfile+0x620/0x620 [ 125.142391][ T6607] ? _raw_spin_unlock+0x28/0x40 [ 125.147255][ T6607] ? alloc_fd+0x590/0x640 [ 125.151615][ T6607] do_sys_openat2+0x134/0x1d0 [ 125.156358][ T6607] ? do_sys_open+0xe0/0xe0 [ 125.160798][ T6607] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 125.166818][ T6607] ? lock_chain_count+0x20/0x20 [ 125.171700][ T6607] __x64_sys_openat+0x139/0x160 [ 125.176836][ T6607] do_syscall_64+0x55/0xb0 [ 125.181276][ T6607] ? clear_bhb_loop+0x40/0x90 [ 125.186004][ T6607] ? clear_bhb_loop+0x40/0x90 [ 125.190709][ T6607] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 125.196653][ T6607] RIP: 0033:0x7fc8f455ed8e [ 125.201115][ T6607] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 125.220828][ T6607] RSP: 002b:00007fc8f5482ec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 125.229280][ T6607] RAX: ffffffffffffffda RBX: 00007fc8f54836c0 RCX: 00007fc8f455ed8e [ 125.237296][ T6607] RDX: 0000000000000000 RSI: 00007fc8f5482f90 RDI: ffffffffffffff9c [ 125.245457][ T6607] RBP: 00007fc8f46358b0 R08: 0000000000000000 R09: 0000000000000000 [ 125.253459][ T6607] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.261615][ T6607] R13: 00007fc8f4826038 R14: 00007fc8f4825fa0 R15: 00007ffeb876fff8 [ 125.269796][ T6607] [ 126.479060][ T6634] bridge0: port 3(veth0) entered blocking state [ 126.486956][ T6634] bridge0: port 3(veth0) entered disabled state [ 126.500829][ T6634] veth0: entered allmulticast mode [ 126.513776][ T6634] veth0: entered promiscuous mode [ 126.520532][ T6634] bridge0: port 3(veth0) entered blocking state [ 126.527476][ T6634] bridge0: port 3(veth0) entered forwarding state [ 126.551204][ T6638] FAULT_INJECTION: forcing a failure. [ 126.551204][ T6638] name failslab, interval 1, probability 0, space 0, times 0 [ 126.569677][ T6638] CPU: 1 PID: 6638 Comm: syz.2.253 Not tainted syzkaller #0 [ 126.577047][ T6638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 126.587140][ T6638] Call Trace: [ 126.590448][ T6638] [ 126.593402][ T6638] dump_stack_lvl+0x18c/0x250 [ 126.598111][ T6638] ? show_regs_print_info+0x20/0x20 [ 126.603477][ T6638] ? load_image+0x420/0x420 [ 126.608042][ T6638] should_fail_ex+0x394/0x4c0 [ 126.612779][ T6638] should_failslab+0x9/0x20 [ 126.617339][ T6638] slab_pre_alloc_hook+0x59/0x300 [ 126.622413][ T6638] ? proc_thread_self_get_link+0xfc/0x190 [ 126.628178][ T6638] __kmem_cache_alloc_node+0x53/0x250 [ 126.633611][ T6638] ? proc_thread_self_get_link+0xfc/0x190 [ 126.639387][ T6638] kmalloc_trace+0x2a/0xe0 [ 126.643856][ T6638] proc_thread_self_get_link+0xfc/0x190 [ 126.649456][ T6638] ? proc_setup_thread_self+0x2c0/0x2c0 [ 126.655049][ T6638] pick_link+0x6a8/0xdd0 [ 126.659340][ T6638] step_into+0xc18/0xee0 [ 126.663633][ T6638] ? set_root+0x3a0/0x3a0 [ 126.668007][ T6638] ? lookup_fast+0x14a/0x4c0 [ 126.672654][ T6638] ? security_inode_permission+0xb0/0xf0 [ 126.678442][ T6638] link_path_walk+0x748/0xe40 [ 126.683405][ T6638] ? handle_lookup_down+0x130/0x130 [ 126.687846][ T6644] FAULT_INJECTION: forcing a failure. [ 126.687846][ T6644] name failslab, interval 1, probability 0, space 0, times 0 [ 126.689253][ T6638] path_openat+0x291/0x3270 [ 126.689312][ T6638] ? do_sys_openat2+0xda/0x1d0 [ 126.713818][ T6638] ? __x64_sys_openat+0x139/0x160 [ 126.719032][ T6638] ? verify_lock_unused+0x140/0x140 [ 126.724460][ T6638] ? do_filp_open+0x430/0x430 [ 126.729940][ T6638] do_filp_open+0x1f2/0x430 [ 126.734671][ T6638] ? vfs_tmpfile+0x620/0x620 [ 126.739944][ T6638] ? _raw_spin_unlock+0x28/0x40 [ 126.744938][ T6638] ? alloc_fd+0x590/0x640 [ 126.749436][ T6638] do_sys_openat2+0x134/0x1d0 [ 126.754450][ T6638] ? do_sys_open+0xe0/0xe0 [ 126.759270][ T6638] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 126.765896][ T6638] ? lock_chain_count+0x20/0x20 [ 126.771827][ T6638] __x64_sys_openat+0x139/0x160 [ 126.776765][ T6638] do_syscall_64+0x55/0xb0 [ 126.781546][ T6638] ? clear_bhb_loop+0x40/0x90 [ 126.786251][ T6638] ? clear_bhb_loop+0x40/0x90 [ 126.791234][ T6638] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 126.797302][ T6638] RIP: 0033:0x7f22c835ed8e [ 126.802104][ T6638] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 126.821937][ T6638] RSP: 002b:00007f22c9190ec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 126.830507][ T6638] RAX: ffffffffffffffda RBX: 00007f22c91916c0 RCX: 00007f22c835ed8e [ 126.838521][ T6638] RDX: 0000000000000000 RSI: 00007f22c9190f90 RDI: ffffffffffffff9c [ 126.846890][ T6638] RBP: 00007f22c84358b0 R08: 0000000000000000 R09: 0000000000000000 [ 126.855116][ T6638] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 126.863295][ T6638] R13: 00007f22c8626038 R14: 00007f22c8625fa0 R15: 00007fff1354ad68 [ 126.871844][ T6638] [ 126.874888][ T6644] CPU: 0 PID: 6644 Comm: syz.0.256 Not tainted syzkaller #0 [ 126.874899][ C1] vkms_vblank_simulate: vblank timer overrun [ 126.874910][ T6644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 126.898553][ T6644] Call Trace: [ 126.901955][ T6644] [ 126.904926][ T6644] dump_stack_lvl+0x18c/0x250 [ 126.909640][ T6644] ? show_regs_print_info+0x20/0x20 [ 126.915044][ T6644] ? load_image+0x420/0x420 [ 126.919722][ T6644] ? __lock_acquire+0x7eb0/0x7eb0 [ 126.924841][ T6644] should_fail_ex+0x394/0x4c0 [ 126.929537][ T6644] should_failslab+0x9/0x20 [ 126.934265][ T6644] slab_pre_alloc_hook+0x59/0x300 [ 126.939434][ T6644] ? security_sk_alloc+0x4b/0x130 [ 126.944567][ T6644] ? security_sk_alloc+0x4b/0x130 [ 126.949606][ T6644] __kmem_cache_alloc_node+0x53/0x250 [ 126.955098][ T6644] ? security_sk_alloc+0x4b/0x130 [ 126.960139][ T6644] __kmalloc+0xa7/0x240 [ 126.964463][ T6644] ? sk_prot_alloc+0xe7/0x210 [ 126.969128][ T6644] security_sk_alloc+0x4b/0x130 [ 126.973971][ T6644] sk_prot_alloc+0x101/0x210 [ 126.978550][ T6644] ? sk_alloc+0x24/0x350 [ 126.982788][ T6644] sk_alloc+0x3a/0x350 [ 126.986882][ T6644] __netlink_create+0x6c/0x290 [ 126.991670][ T6644] __netlink_kernel_create+0x148/0x7b0 [ 126.997134][ T6644] ? netlink_set_err+0x3b0/0x3b0 [ 127.002086][ T6644] ? diag_net_init+0xa8/0x150 [ 127.006774][ T6644] diag_net_init+0xbd/0x150 [ 127.011313][ T6644] ? sock_diag_lock_handler+0x280/0x280 [ 127.016960][ T6644] ? diag_net_exit+0x60/0x60 [ 127.021554][ T6644] ? sock_diag_rcv+0x40/0x40 [ 127.026161][ T6644] ? cma_pernet+0x23/0x230 [ 127.030794][ T6644] ? __raw_spin_lock_init+0x45/0x100 [ 127.036111][ T6644] ops_init+0x391/0x640 [ 127.040297][ T6644] setup_net+0x3b6/0xa20 [ 127.044551][ T6644] ? copy_net_ns+0x530/0x530 [ 127.049222][ T6644] ? copy_net_ns+0x347/0x530 [ 127.053919][ T6644] ? down_read_killable+0x1d0/0x340 [ 127.059136][ T6644] copy_net_ns+0x361/0x530 [ 127.063652][ T6644] create_new_namespaces+0x3ce/0x700 [ 127.068951][ T6644] unshare_nsproxy_namespaces+0x11a/0x160 [ 127.074678][ T6644] ksys_unshare+0x4fa/0x8f0 [ 127.079194][ T6644] ? sighand_ctor+0x50/0x50 [ 127.083787][ T6644] ? lock_chain_count+0x20/0x20 [ 127.088739][ T6644] ? syscall_enter_from_user_mode+0x25/0x80 [ 127.094708][ T6644] __x64_sys_unshare+0x38/0x40 [ 127.099494][ T6644] do_syscall_64+0x55/0xb0 [ 127.103922][ T6644] ? clear_bhb_loop+0x40/0x90 [ 127.108607][ T6644] ? clear_bhb_loop+0x40/0x90 [ 127.113298][ T6644] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 127.119209][ T6644] RIP: 0033:0x7fc8f459e559 [ 127.123805][ T6644] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 127.143528][ T6644] RSP: 002b:00007fc8f5483028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 127.152050][ T6644] RAX: ffffffffffffffda RBX: 00007fc8f4825fa0 RCX: 00007fc8f459e559 [ 127.160052][ T6644] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000060000000 [ 127.168032][ T6644] RBP: 00007fc8f46358b0 R08: 0000000000000000 R09: 0000000000000000 [ 127.176351][ T6644] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.184348][ T6644] R13: 00007fc8f4826038 R14: 00007fc8f4825fa0 R15: 00007ffeb876fff8 [ 127.192447][ T6644] [ 127.657660][ T6662] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 128.102869][ T6672] rxe_eth0 speed is unknown, defaulting to 1000 [ 129.468726][ T6703] netlink: 4 bytes leftover after parsing attributes in process `syz.2.276'. [ 131.074282][ T6726] loop1: detected capacity change from 0 to 512 [ 131.131656][ T6726] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 131.171300][ T6734] netlink: 4 bytes leftover after parsing attributes in process `syz.2.290'. [ 131.242200][ T6737] FAULT_INJECTION: forcing a failure. [ 131.242200][ T6737] name failslab, interval 1, probability 0, space 0, times 0 [ 131.265544][ T6737] CPU: 1 PID: 6737 Comm: syz.0.291 Not tainted syzkaller #0 [ 131.272996][ T6737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 131.283086][ T6737] Call Trace: [ 131.286392][ T6737] [ 131.289439][ T6737] dump_stack_lvl+0x18c/0x250 [ 131.294408][ T6737] ? show_regs_print_info+0x20/0x20 [ 131.299674][ T6737] ? load_image+0x420/0x420 [ 131.304325][ T6737] ? __lock_acquire+0x7eb0/0x7eb0 [ 131.309369][ T6737] ? __lock_acquire+0x135d/0x7eb0 [ 131.314412][ T6737] should_fail_ex+0x394/0x4c0 [ 131.319124][ T6737] should_failslab+0x9/0x20 [ 131.323641][ T6737] slab_pre_alloc_hook+0x59/0x300 [ 131.328673][ T6737] kmem_cache_alloc+0x5a/0x2c0 [ 131.333552][ T6737] ? sk_prot_alloc+0x57/0x210 [ 131.338362][ T6737] sk_prot_alloc+0x57/0x210 [ 131.342881][ T6737] ? sk_alloc+0x24/0x350 [ 131.347215][ T6737] sk_alloc+0x3a/0x350 [ 131.351314][ T6737] tipc_sk_create+0x178/0x2920 [ 131.356745][ T6737] ? rcu_read_unlock+0x8c/0xa0 [ 131.361571][ T6737] ? __lock_acquire+0x7eb0/0x7eb0 [ 131.366635][ T6737] ? msg_importance+0x140/0x140 [ 131.371528][ T6737] __sock_create+0x49e/0x940 [ 131.376255][ T6737] __sys_socket+0xd7/0x1b0 [ 131.380702][ T6737] __x64_sys_socket+0x7a/0x90 [ 131.385396][ T6737] do_syscall_64+0x55/0xb0 [ 131.389815][ T6737] ? clear_bhb_loop+0x40/0x90 [ 131.394502][ T6737] ? clear_bhb_loop+0x40/0x90 [ 131.399198][ T6737] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 131.405126][ T6737] RIP: 0033:0x7fc8f459e559 [ 131.409570][ T6737] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 131.429397][ T6737] RSP: 002b:00007fc8f5483028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 131.437826][ T6737] RAX: ffffffffffffffda RBX: 00007fc8f4825fa0 RCX: 00007fc8f459e559 [ 131.445912][ T6737] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 000000000000001e [ 131.454499][ T6737] RBP: 00007fc8f46358b0 R08: 0000000000000000 R09: 0000000000000000 [ 131.462641][ T6737] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 131.470723][ T6737] R13: 00007fc8f4826038 R14: 00007fc8f4825fa0 R15: 00007ffeb876fff8 [ 131.478735][ T6737] [ 131.481892][ C1] vkms_vblank_simulate: vblank timer overrun [ 131.497081][ T6726] EXT4-fs (loop1): shut down requested (0) [ 131.770850][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 131.981684][ T6756] FAULT_INJECTION: forcing a failure. [ 131.981684][ T6756] name failslab, interval 1, probability 0, space 0, times 0 [ 131.996096][ T6756] CPU: 1 PID: 6756 Comm: syz.3.300 Not tainted syzkaller #0 [ 132.003461][ T6756] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 132.013691][ T6756] Call Trace: [ 132.017033][ T6756] [ 132.018570][ T6758] ªªªªªª: renamed from vlan0 (while UP) [ 132.020056][ T6756] dump_stack_lvl+0x18c/0x250 [ 132.020089][ T6756] ? show_regs_print_info+0x20/0x20 [ 132.020109][ T6756] ? load_image+0x420/0x420 [ 132.020136][ T6756] ? __might_sleep+0xe0/0xe0 [ 132.020161][ T6756] ? __lock_acquire+0x7eb0/0x7eb0 [ 132.020191][ T6756] should_fail_ex+0x394/0x4c0 [ 132.020228][ T6756] should_failslab+0x9/0x20 [ 132.020254][ T6756] slab_pre_alloc_hook+0x59/0x300 [ 132.064544][ T6756] kmem_cache_alloc+0x5a/0x2c0 [ 132.069350][ T6756] ? __proc_create+0x373/0x8b0 [ 132.074157][ T6756] __proc_create+0x373/0x8b0 [ 132.078903][ T6756] ? proc_symlink+0x260/0x260 [ 132.083638][ T6756] ? _raw_write_unlock+0x28/0x40 [ 132.088723][ T6756] ? proc_register+0x5d5/0x7f0 [ 132.093513][ T6756] proc_create_data+0xa6/0x190 [ 132.098382][ T6756] cache_register_net+0x307/0x4b0 [ 132.103429][ T6756] nfsd_export_init+0x96/0x1f0 [ 132.108294][ T6756] nfsd_net_init+0x2d/0x1e0 [ 132.112811][ T6756] ops_init+0x391/0x640 [ 132.117078][ T6756] setup_net+0x3b6/0xa20 [ 132.121372][ T6756] ? copy_net_ns+0x530/0x530 [ 132.125998][ T6756] ? copy_net_ns+0x347/0x530 [ 132.130621][ T6756] ? down_read_killable+0x1d0/0x340 [ 132.135935][ T6756] copy_net_ns+0x361/0x530 [ 132.140456][ T6756] create_new_namespaces+0x3ce/0x700 [ 132.145764][ T6756] unshare_nsproxy_namespaces+0x11a/0x160 [ 132.151510][ T6756] ksys_unshare+0x4fa/0x8f0 [ 132.156056][ T6756] ? sighand_ctor+0x50/0x50 [ 132.160593][ T6756] ? lock_chain_count+0x20/0x20 [ 132.165469][ T6756] ? syscall_enter_from_user_mode+0x25/0x80 [ 132.171466][ T6756] __x64_sys_unshare+0x38/0x40 [ 132.176253][ T6756] do_syscall_64+0x55/0xb0 [ 132.180711][ T6756] ? clear_bhb_loop+0x40/0x90 [ 132.185425][ T6756] ? clear_bhb_loop+0x40/0x90 [ 132.190156][ T6756] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 132.196117][ T6756] RIP: 0033:0x7f3846f9e559 [ 132.200545][ T6756] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 132.220600][ T6756] RSP: 002b:00007f3847f3e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 132.229382][ T6756] RAX: ffffffffffffffda RBX: 00007f3847225fa0 RCX: 00007f3846f9e559 [ 132.237494][ T6756] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 132.245742][ T6756] RBP: 00007f38470358b0 R08: 0000000000000000 R09: 0000000000000000 [ 132.253733][ T6756] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 132.261723][ T6756] R13: 00007f3847226038 R14: 00007f3847225fa0 R15: 00007fffd91baab8 [ 132.269849][ T6756] [ 132.320712][ T6761] loop2: detected capacity change from 0 to 512 [ 132.342931][ T6761] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 132.365525][ T6761] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 132.398413][ T6761] EXT4-fs (loop2): 1 truncate cleaned up [ 132.418524][ T6761] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 133.176559][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.186678][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.221096][ T6770] syzkaller0: entered promiscuous mode [ 133.237798][ T6770] syzkaller0: entered allmulticast mode [ 133.266482][ T6776] netlink: 8 bytes leftover after parsing attributes in process `syz.1.306'. [ 133.312075][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 133.712953][ T6783] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 133.770161][ T6783] loop2: detected capacity change from 0 to 1024 [ 133.944407][ T6783] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 134.499297][ T6799] netlink: 'syz.1.315': attribute type 1 has an invalid length. [ 134.530857][ T6799] 8021q: adding VLAN 0 to HW filter on device bond1 [ 134.562511][ T6804] bond1: (slave geneve2): making interface the new active one [ 134.574293][ T6804] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 134.691877][ T6804] syz.1.315 (6804) used greatest stack depth: 19464 bytes left [ 134.731242][ T6732] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 134.898416][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 134.953138][ T6808] netlink: 4 bytes leftover after parsing attributes in process `syz.0.317'. [ 135.480624][ T6809] syzkaller0: entered promiscuous mode [ 135.504065][ T6809] syzkaller0: entered allmulticast mode [ 136.620894][ T6830] netlink: 4 bytes leftover after parsing attributes in process `syz.3.326'. [ 136.753957][ T6835] nvmet: Invalid value 'ipv' for adrfam [ 136.783907][ T6835] nvmet_tcp: enabling port 1 (127.0.0.1:4420) [ 136.898087][ T6838] syzkaller0: entered promiscuous mode [ 136.922169][ T6838] syzkaller0: entered allmulticast mode [ 137.108737][ T6843] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 137.169143][ T6843] loop1: detected capacity change from 0 to 1024 [ 137.570087][ T6845] netlink: 4 bytes leftover after parsing attributes in process `syz.2.329'. [ 137.681049][ T6843] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 138.026720][ T6852] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 138.438861][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 139.072516][ T6869] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 139.082619][ T6869] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 139.093462][ T6869] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 139.103581][ T6869] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 139.625433][ T6886] netlink: 4 bytes leftover after parsing attributes in process `syz.3.341'. [ 139.741345][ T6888] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 139.804229][ T6888] loop0: detected capacity change from 0 to 1024 [ 140.324044][ T6888] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 140.600092][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 140.666786][ T6896] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 140.677532][ T6896] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 140.710330][ T6896] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 140.725922][ T6896] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 140.933522][ T6904] FAULT_INJECTION: forcing a failure. [ 140.933522][ T6904] name failslab, interval 1, probability 0, space 0, times 0 [ 140.969581][ T6904] CPU: 0 PID: 6904 Comm: syz.1.352 Not tainted syzkaller #0 [ 140.977216][ T6904] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 140.987399][ T6904] Call Trace: [ 140.990704][ T6904] [ 140.993669][ T6904] dump_stack_lvl+0x18c/0x250 [ 140.998375][ T6904] ? show_regs_print_info+0x20/0x20 [ 141.003584][ T6904] ? load_image+0x420/0x420 [ 141.008213][ T6904] ? __might_sleep+0xe0/0xe0 [ 141.012838][ T6904] ? __lock_acquire+0x7eb0/0x7eb0 [ 141.017872][ T6904] should_fail_ex+0x394/0x4c0 [ 141.022557][ T6904] should_failslab+0x9/0x20 [ 141.027170][ T6904] slab_pre_alloc_hook+0x59/0x300 [ 141.032209][ T6904] ? d_instantiate+0x6f/0x90 [ 141.036844][ T6904] kmem_cache_alloc+0x5a/0x2c0 [ 141.041657][ T6904] ? alloc_empty_file+0x9e/0x1d0 [ 141.046664][ T6904] alloc_empty_file+0x9e/0x1d0 [ 141.051440][ T6904] alloc_file+0x5b/0x600 [ 141.055693][ T6904] alloc_file_pseudo+0x184/0x210 [ 141.060650][ T6904] ? fput+0x1a0/0x1a0 [ 141.064818][ T6904] ? alloc_fd+0x590/0x640 [ 141.069165][ T6904] sock_alloc_file+0xb7/0x280 [ 141.073853][ T6904] __sys_socket+0x140/0x1b0 [ 141.078452][ T6904] __x64_sys_socket+0x7a/0x90 [ 141.083141][ T6904] do_syscall_64+0x55/0xb0 [ 141.087652][ T6904] ? clear_bhb_loop+0x40/0x90 [ 141.092334][ T6904] ? clear_bhb_loop+0x40/0x90 [ 141.097048][ T6904] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 141.102953][ T6904] RIP: 0033:0x7fa5cb99e559 [ 141.107375][ T6904] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 141.127338][ T6904] RSP: 002b:00007fa5cc8fc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 141.135816][ T6904] RAX: ffffffffffffffda RBX: 00007fa5cbc25fa0 RCX: 00007fa5cb99e559 [ 141.143804][ T6904] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 000000000000001e [ 141.151803][ T6904] RBP: 00007fa5cba358b0 R08: 0000000000000000 R09: 0000000000000000 [ 141.159783][ T6904] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 141.167775][ T6904] R13: 00007fa5cbc26038 R14: 00007fa5cbc25fa0 R15: 00007ffc5deb0b48 [ 141.175793][ T6904] [ 141.607379][ T6920] netlink: 8 bytes leftover after parsing attributes in process `syz.0.355'. [ 141.692191][ T6921] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 141.758154][ T6921] loop3: detected capacity change from 0 to 1024 [ 141.858294][ T6921] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 142.351740][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 142.524515][ T6930] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 142.555452][ T6930] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 142.580394][ T6930] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 142.605315][ T6930] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 143.221228][ T6953] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 143.284810][ T6953] loop2: detected capacity change from 0 to 1024 [ 143.428029][ T6953] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 143.715178][ T6957] netlink: 8 bytes leftover after parsing attributes in process `syz.0.369'. [ 143.761968][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 144.001006][ T6965] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 144.030007][ T6965] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 144.056622][ T6965] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 144.805061][ T6991] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 144.868942][ T6991] loop2: detected capacity change from 0 to 1024 [ 145.133568][ T6991] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 145.176353][ T6997] netlink: 8 bytes leftover after parsing attributes in process `syz.0.383'. [ 145.183353][ T6996] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 145.215520][ T6996] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 145.225727][ T6996] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 145.241260][ T6999] FAULT_INJECTION: forcing a failure. [ 145.241260][ T6999] name fail_futex, interval 1, probability 0, space 0, times 0 [ 145.255711][ T6999] CPU: 0 PID: 6999 Comm: syz.1.385 Not tainted syzkaller #0 [ 145.263215][ T6999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 145.273672][ T6999] Call Trace: [ 145.277125][ T6999] [ 145.280228][ T6999] dump_stack_lvl+0x18c/0x250 [ 145.284925][ T6999] ? show_regs_print_info+0x20/0x20 [ 145.290141][ T6999] ? load_image+0x420/0x420 [ 145.294667][ T6999] ? __lock_acquire+0x1431/0x7eb0 [ 145.299705][ T6999] should_fail_ex+0x394/0x4c0 [ 145.304665][ T6999] get_futex_key+0x16f/0x1030 [ 145.309344][ T6999] ? futex_setup_timer+0xc0/0xc0 [ 145.314297][ T6999] futex_wake+0x127/0x4f0 [ 145.318640][ T6999] ? futex_wake_mark+0x150/0x150 [ 145.323831][ T6999] do_futex+0x35d/0x3e0 [ 145.328004][ T6999] ? __might_fault+0xaa/0x120 [ 145.332693][ T6999] ? __ia32_sys_get_robust_list+0x110/0x110 [ 145.338613][ T6999] ? __might_fault+0xc6/0x120 [ 145.343307][ T6999] mm_release+0x184/0x3a0 [ 145.347680][ T6999] ? exit_mm_release+0x30/0x30 [ 145.352458][ T6999] ? lockdep_hardirqs_on+0x98/0x150 [ 145.357669][ T6999] exit_mm+0xa4/0x340 [ 145.361701][ T6999] ? sysctl_delayacct+0x220/0x220 [ 145.366763][ T6999] ? do_exit+0x2530/0x2530 [ 145.371244][ T6999] do_exit+0x909/0x2530 [ 145.375516][ T6999] ? put_task_struct+0xc0/0xc0 [ 145.380313][ T6999] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 145.386558][ T6999] ? get_signal+0x100e/0x1390 [ 145.391291][ T6999] ? lock_chain_count+0x20/0x20 [ 145.396193][ T6999] ? _raw_spin_lock_irq+0xbb/0xf0 [ 145.401261][ T6999] do_group_exit+0x22d/0x2f0 [ 145.405870][ T6999] ? lockdep_hardirqs_on+0x98/0x150 [ 145.411106][ T6999] get_signal+0x12a6/0x1390 [ 145.415660][ T6999] arch_do_signal_or_restart+0xc2/0x7b0 [ 145.421327][ T6999] ? __ia32_sys_get_robust_list+0x110/0x110 [ 145.427432][ T6999] ? get_sigframe_size+0x20/0x20 [ 145.432406][ T6999] ? exit_to_user_mode_loop+0x3b/0x110 [ 145.438062][ T6999] exit_to_user_mode_loop+0x70/0x110 [ 145.443456][ T6999] exit_to_user_mode_prepare+0xee/0x180 [ 145.449013][ T6999] syscall_exit_to_user_mode+0x1a/0x50 [ 145.454594][ T6999] do_syscall_64+0x61/0xb0 [ 145.459040][ T6999] ? clear_bhb_loop+0x40/0x90 [ 145.463745][ T6999] ? clear_bhb_loop+0x40/0x90 [ 145.468455][ T6999] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 145.474524][ T6999] RIP: 0033:0x7fa5cb99e559 [ 145.478982][ T6999] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 145.499234][ T6999] RSP: 002b:00007fa5cc8fc0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 145.507748][ T6999] RAX: fffffffffffffe00 RBX: 00007fa5cbc25fa8 RCX: 00007fa5cb99e559 [ 145.515822][ T6999] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa5cbc25fa8 [ 145.524150][ T6999] RBP: 00007fa5cbc25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 145.532127][ T6999] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 145.540185][ T6999] R13: 00007fa5cbc26038 R14: 00007ffc5deb0a60 R15: 00007ffc5deb0b48 [ 145.548186][ T6999] [ 145.551383][ C0] vkms_vblank_simulate: vblank timer overrun [ 146.067624][ T7022] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 146.143524][ T7022] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 146.176109][ T7022] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 146.192197][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 146.203795][ T5778] Bluetooth: hci0: link tx timeout [ 146.210736][ T5778] Bluetooth: hci0: killing stalled connection 11:aa:aa:aa:aa:aa [ 146.379695][ T7030] FAULT_INJECTION: forcing a failure. [ 146.379695][ T7030] name fail_futex, interval 1, probability 0, space 0, times 0 [ 146.397573][ T7030] CPU: 0 PID: 7030 Comm: syz.2.399 Not tainted syzkaller #0 [ 146.405034][ T7030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 146.415244][ T7030] Call Trace: [ 146.418562][ T7030] [ 146.421521][ T7030] dump_stack_lvl+0x18c/0x250 [ 146.426253][ T7030] ? show_regs_print_info+0x20/0x20 [ 146.431510][ T7030] ? load_image+0x420/0x420 [ 146.436074][ T7030] ? keyctl_get_persistent+0x7a0/0x7a0 [ 146.441762][ T7030] should_fail_ex+0x394/0x4c0 [ 146.446503][ T7030] get_futex_key+0x136/0x1030 [ 146.451241][ T7030] ? futex_setup_timer+0xc0/0xc0 [ 146.456405][ T7030] futex_wake+0x127/0x4f0 [ 146.460776][ T7030] ? keyctl_dh_compute_kdf+0x220/0x220 [ 146.466369][ T7030] ? futex_wake_mark+0x150/0x150 [ 146.471352][ T7030] ? __se_sys_keyctl+0x456/0xb50 [ 146.476316][ T7030] do_futex+0x35d/0x3e0 [ 146.480508][ T7030] ? __ia32_sys_get_robust_list+0x110/0x110 [ 146.486528][ T7030] __se_sys_futex+0x3a9/0x440 [ 146.491283][ T7030] ? __x64_sys_futex+0xf0/0xf0 [ 146.496105][ T7030] ? __x64_sys_futex+0x21/0xf0 [ 146.500919][ T7030] do_syscall_64+0x55/0xb0 [ 146.505387][ T7030] ? clear_bhb_loop+0x40/0x90 [ 146.510087][ T7030] ? clear_bhb_loop+0x40/0x90 [ 146.514865][ T7030] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 146.520777][ T7030] RIP: 0033:0x7f22c839e559 [ 146.525301][ T7030] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 146.545003][ T7030] RSP: 002b:00007f22c91910e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 146.553439][ T7030] RAX: ffffffffffffffda RBX: 00007f22c8625fa8 RCX: 00007f22c839e559 [ 146.561523][ T7030] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f22c8625fac [ 146.569516][ T7030] RBP: 00007f22c8625fa0 R08: 0000000000745af4 R09: 0000000000000000 [ 146.577611][ T7030] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 146.585585][ T7030] R13: 00007f22c8626038 R14: 00007fff1354ac80 R15: 00007fff1354ad68 [ 146.593568][ T7030] [ 146.596731][ C0] vkms_vblank_simulate: vblank timer overrun [ 146.619149][ T7031] netlink: 8 bytes leftover after parsing attributes in process `syz.0.398'. [ 146.935576][ T7046] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 146.949258][ T7046] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 146.964982][ T7046] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 147.419239][ T7053] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 147.486848][ T7053] loop2: detected capacity change from 0 to 1024 [ 147.708640][ T7053] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 147.859396][ T7061] syzkaller0: entered promiscuous mode [ 147.865657][ T7061] syzkaller0: entered allmulticast mode [ 148.126488][ T7071] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 148.144475][ T7071] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 148.170752][ T7071] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 148.291503][ T5085] Bluetooth: hci0: command 0x0406 tx timeout [ 148.461102][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 148.568499][ T7080] FAULT_INJECTION: forcing a failure. [ 148.568499][ T7080] name failslab, interval 1, probability 0, space 0, times 0 [ 148.597138][ T7079] netlink: 8 bytes leftover after parsing attributes in process `syz.3.420'. [ 148.620005][ T7080] CPU: 1 PID: 7080 Comm: syz.1.419 Not tainted syzkaller #0 [ 148.627465][ T7080] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 148.637578][ T7080] Call Trace: [ 148.640974][ T7080] [ 148.643946][ T7080] dump_stack_lvl+0x18c/0x250 [ 148.648673][ T7080] ? show_regs_print_info+0x20/0x20 [ 148.654085][ T7080] ? load_image+0x420/0x420 [ 148.658643][ T7080] ? __lock_acquire+0x7eb0/0x7eb0 [ 148.663812][ T7080] should_fail_ex+0x394/0x4c0 [ 148.668558][ T7080] should_failslab+0x9/0x20 [ 148.673202][ T7080] slab_pre_alloc_hook+0x59/0x300 [ 148.678278][ T7080] ? __register_sysctl_table+0xa2c/0x1210 [ 148.684050][ T7080] ? __register_sysctl_table+0xa2c/0x1210 [ 148.689823][ T7080] __kmem_cache_alloc_node+0x53/0x250 [ 148.695424][ T7080] ? __register_sysctl_table+0xa2c/0x1210 [ 148.701163][ T7080] __kmalloc+0xa7/0x240 [ 148.705442][ T7080] __register_sysctl_table+0xa2c/0x1210 [ 148.711059][ T7080] vrf_netns_init+0xe6/0x170 [ 148.715683][ T7080] ops_init+0x391/0x640 [ 148.719960][ T7080] setup_net+0x3b6/0xa20 [ 148.724489][ T7080] ? copy_net_ns+0x530/0x530 [ 148.729267][ T7080] ? copy_net_ns+0x347/0x530 [ 148.733969][ T7080] ? down_read_killable+0x1d0/0x340 [ 148.739177][ T7080] copy_net_ns+0x361/0x530 [ 148.743609][ T7080] create_new_namespaces+0x3ce/0x700 [ 148.748927][ T7080] unshare_nsproxy_namespaces+0x11a/0x160 [ 148.754742][ T7080] ksys_unshare+0x4fa/0x8f0 [ 148.759292][ T7080] ? sighand_ctor+0x50/0x50 [ 148.763798][ T7080] ? lock_chain_count+0x20/0x20 [ 148.768671][ T7080] ? syscall_enter_from_user_mode+0x25/0x80 [ 148.774589][ T7080] __x64_sys_unshare+0x38/0x40 [ 148.779362][ T7080] do_syscall_64+0x55/0xb0 [ 148.783802][ T7080] ? clear_bhb_loop+0x40/0x90 [ 148.788593][ T7080] ? clear_bhb_loop+0x40/0x90 [ 148.793286][ T7080] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 148.799200][ T7080] RIP: 0033:0x7fa5cb99e559 [ 148.804091][ T7080] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 148.823893][ T7080] RSP: 002b:00007fa5cc8fc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 148.832412][ T7080] RAX: ffffffffffffffda RBX: 00007fa5cbc25fa0 RCX: 00007fa5cb99e559 [ 148.840411][ T7080] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 148.848669][ T7080] RBP: 00007fa5cba358b0 R08: 0000000000000000 R09: 0000000000000000 [ 148.856649][ T7080] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 148.864621][ T7080] R13: 00007fa5cbc26038 R14: 00007fa5cbc25fa0 R15: 00007ffc5deb0b48 [ 148.872788][ T7080] [ 148.887422][ T7080] sysctl could not get directory: /net/vrf -12 [ 149.238150][ T7091] syzkaller0: entered promiscuous mode [ 149.253629][ T7094] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 149.254983][ T7091] syzkaller0: entered allmulticast mode [ 149.276108][ T7094] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 149.300143][ T7094] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 149.850919][ T7106] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 150.216456][ T7106] loop1: detected capacity change from 0 to 1024 [ 150.242282][ T5778] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 150.333167][ T7106] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 150.354786][ T51] Bluetooth: hci0: unexpected event for opcode 0x1804 [ 150.670051][ T7122] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 150.684976][ T7122] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 150.695935][ T7122] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 151.535492][ T7132] syzkaller0: entered promiscuous mode [ 151.542988][ T7132] syzkaller0: entered allmulticast mode [ 151.545664][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 151.915939][ T7148] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 151.931861][ T7148] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 151.947526][ T7148] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 152.255267][ T7162] netlink: 8 bytes leftover after parsing attributes in process `syz.3.452'. [ 152.355702][ T7163] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 152.420492][ T7163] loop0: detected capacity change from 0 to 1024 [ 152.513021][ T7163] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 153.047061][ T7171] loop1: detected capacity change from 0 to 512 [ 153.099305][ T7171] EXT4-fs error (device loop1): ext4_orphan_get:1408: inode #15: comm syz.1.455: inode has both inline data and extents flags [ 153.167235][ T7171] EXT4-fs error (device loop1): ext4_orphan_get:1413: comm syz.1.455: couldn't read orphan inode 15 (err -117) [ 153.187669][ T7171] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 153.257416][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 153.482405][ T7186] netlink: 4 bytes leftover after parsing attributes in process `syz.3.459'. [ 153.486035][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 153.545741][ T7188] loop2: detected capacity change from 0 to 512 [ 153.564600][ T7187] rxe_eth0 speed is unknown, defaulting to 1000 [ 153.583868][ T7188] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 153.654921][ T7188] EXT4-fs (loop2): 1 truncate cleaned up [ 153.697765][ T7188] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 154.684115][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 154.775063][ T7205] input: syz1 as /devices/virtual/input/input5 [ 154.836800][ T7207] loop3: detected capacity change from 0 to 512 [ 154.863816][ T7207] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 154.901655][ T7211] loop2: detected capacity change from 0 to 512 [ 155.043693][ T7211] EXT4-fs error (device loop2): ext4_orphan_get:1408: inode #15: comm syz.2.468: inode has both inline data and extents flags [ 155.058670][ T7207] EXT4-fs (loop3): 1 truncate cleaned up [ 155.095807][ T7211] EXT4-fs error (device loop2): ext4_orphan_get:1413: comm syz.2.468: couldn't read orphan inode 15 (err -117) [ 155.115466][ T7207] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 155.140008][ T7211] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 155.227164][ T7218] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 155.318808][ T7218] loop1: detected capacity change from 0 to 1024 [ 155.569979][ T7218] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 155.597122][ T51] Bluetooth: hci0: unexpected event for opcode 0x1804 [ 155.780710][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 155.893433][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 156.079894][ T7232] netlink: 28 bytes leftover after parsing attributes in process `syz.3.473'. [ 156.368831][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 156.549437][ T7246] loop2: detected capacity change from 0 to 512 [ 156.586002][ T7246] EXT4-fs error (device loop2): ext4_orphan_get:1408: inode #15: comm syz.2.484: inode has both inline data and extents flags [ 156.634211][ T7246] EXT4-fs error (device loop2): ext4_orphan_get:1413: comm syz.2.484: couldn't read orphan inode 15 (err -117) [ 156.655899][ T7246] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 156.702039][ T7248] loop3: detected capacity change from 0 to 4096 [ 156.732236][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 156.811400][ T7248] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 156.962438][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 157.190371][ T7265] FAULT_INJECTION: forcing a failure. [ 157.190371][ T7265] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 157.270039][ T7266] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 157.333257][ T7266] loop1: detected capacity change from 0 to 1024 [ 157.406049][ T7266] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 157.431937][ T51] Bluetooth: hci0: unexpected event for opcode 0x1804 [ 157.473977][ T7265] CPU: 0 PID: 7265 Comm: syz.0.490 Not tainted syzkaller #0 [ 157.481353][ T7265] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 157.491550][ T7265] Call Trace: [ 157.494871][ T7265] [ 157.497826][ T7265] dump_stack_lvl+0x18c/0x250 [ 157.502546][ T7265] ? show_regs_print_info+0x20/0x20 [ 157.507778][ T7265] ? load_image+0x420/0x420 [ 157.512320][ T7265] ? __might_fault+0xaa/0x120 [ 157.517025][ T7265] ? __lock_acquire+0x7eb0/0x7eb0 [ 157.522078][ T7265] ? __virt_addr_valid+0x10c/0x380 [ 157.527262][ T7265] should_fail_ex+0x394/0x4c0 [ 157.532003][ T7265] _copy_from_user+0x2f/0xe0 [ 157.536929][ T7265] strndup_user+0xb7/0x150 [ 157.541398][ T7265] __se_sys_add_key+0x1c4/0x410 [ 157.546351][ T7265] ? __x64_sys_add_key+0xc0/0xc0 [ 157.551329][ T7265] ? __secure_computing+0x111/0x2f0 [ 157.556587][ T7265] ? __x64_sys_add_key+0x20/0xc0 [ 157.561578][ T7265] do_syscall_64+0x55/0xb0 [ 157.566108][ T7265] ? clear_bhb_loop+0x40/0x90 [ 157.570810][ T7265] ? clear_bhb_loop+0x40/0x90 [ 157.575515][ T7265] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 157.581544][ T7265] RIP: 0033:0x7fc8f459e559 [ 157.586085][ T7265] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 157.605914][ T7265] RSP: 002b:00007fc8f5483028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 157.614461][ T7265] RAX: ffffffffffffffda RBX: 00007fc8f4825fa0 RCX: 00007fc8f459e559 [ 157.622566][ T7265] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 00002000000001c0 [ 157.630575][ T7265] RBP: 00007fc8f46358b0 R08: fffffffffffffffc R09: 0000000000000000 [ 157.638592][ T7265] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 157.646782][ T7265] R13: 00007fc8f4826038 R14: 00007fc8f4825fa0 R15: 00007ffeb876fff8 [ 157.654806][ T7265] [ 158.341631][ T7294] Unable to locate "_" for $SUBSYSTEM_PLUGIN_$HOST_ID [ 158.387077][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 158.881997][ T7315] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 159.271554][ T7323] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 160.183627][ T7337] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 161.033898][ T7341] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 161.403194][ T7348] netlink: 8 bytes leftover after parsing attributes in process `syz.0.523'. [ 162.517601][ T7368] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 162.626290][ T7373] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 164.874143][ T7385] netlink: 8 bytes leftover after parsing attributes in process `syz.1.538'. [ 166.371588][ T7413] ubi0: attaching mtd0 [ 166.390231][ T7413] ubi0: scanning is finished [ 166.394969][ T7413] ubi0: empty MTD device detected [ 166.772143][ T7413] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 166.972227][ T7402] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 167.165834][ T7422] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 167.956532][ T7424] netlink: 8 bytes leftover after parsing attributes in process `syz.1.550'. [ 168.574412][ T7442] veth0: left allmulticast mode [ 168.592109][ T7442] veth0: left promiscuous mode [ 168.599585][ T7442] bridge0: port 3(veth0) entered disabled state [ 169.315836][ T7445] netlink: 4 bytes leftover after parsing attributes in process `syz.2.556'. [ 169.510472][ T9] logitech-hidpp-device 0003:046D:C082.0001: Device not connected [ 169.722669][ T7454] netlink: 8 bytes leftover after parsing attributes in process `syz.1.561'. [ 169.886076][ T7462] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 169.949117][ T7462] loop0: detected capacity change from 0 to 1024 [ 170.561967][ T7462] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 170.786810][ T7472] loop1: detected capacity change from 0 to 512 [ 170.858679][ T7472] syz.1.566: attempt to access beyond end of device [ 170.858679][ T7472] loop1: rw=524288, sector=17179852706, nr_sectors = 16 limit=512 [ 170.886567][ T7472] syz.1.566: attempt to access beyond end of device [ 170.886567][ T7472] loop1: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 170.915613][ T27] audit: type=1800 audit(1792047086.563:3): pid=7472 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.566" name="file2" dev="loop1" ino=1048632 res=0 errno=0 [ 172.116535][ T7483] rxe_eth0 speed is unknown, defaulting to 1000 [ 172.261037][ T7465] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 172.601606][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 173.031795][ T7492] netlink: 4 bytes leftover after parsing attributes in process `syz.0.570'. [ 173.080641][ T7494] netlink: 4 bytes leftover after parsing attributes in process `syz.3.573'. [ 173.525962][ T7496] netlink: 8 bytes leftover after parsing attributes in process `syz.0.574'. [ 174.672394][ T7511] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 174.737107][ T7511] loop3: detected capacity change from 0 to 1024 [ 175.542129][ T7511] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 177.162686][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 178.288879][ T7545] netlink: 4 bytes leftover after parsing attributes in process `syz.0.588'. [ 178.631898][ T7544] netlink: 8 bytes leftover after parsing attributes in process `syz.1.589'. [ 181.321412][ T7507] syz.2.575 (7507) used greatest stack depth: 18072 bytes left [ 181.359238][ T7558] rxe_eth0 speed is unknown, defaulting to 1000 [ 182.045368][ T7566] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 182.127425][ T7566] loop0: detected capacity change from 0 to 1024 [ 182.335401][ T7566] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 183.679678][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 183.905924][ T7593] netlink: 4 bytes leftover after parsing attributes in process `syz.0.600'. [ 184.123761][ T7592] netlink: 8 bytes leftover after parsing attributes in process `syz.1.601'. [ 185.070259][ T7615] loop0: detected capacity change from 0 to 1024 [ 185.324596][ T7622] rxe_eth0 speed is unknown, defaulting to 1000 [ 185.812413][ T7615] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 185.884696][ T7630] netlink: 4 bytes leftover after parsing attributes in process `syz.2.612'. [ 186.202298][ T7643] netlink: 4 bytes leftover after parsing attributes in process `syz.2.615'. [ 186.280752][ T7570] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 186.675316][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 186.775395][ T7650] netlink: 8 bytes leftover after parsing attributes in process `syz.2.617'. [ 187.581638][ T7670] netlink: 4 bytes leftover after parsing attributes in process `syz.2.625'. [ 187.631815][ T7674] netlink: 4 bytes leftover after parsing attributes in process `syz.3.623'. [ 188.234923][ T7682] netlink: 8 bytes leftover after parsing attributes in process `syz.0.630'. [ 189.428671][ T7692] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.438105][ T7692] bridge0: port 1(bridge_slave_0) entered disabled state [ 189.775156][ T7692] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 189.815056][ T7692] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 190.225973][ T7692] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.235567][ T7692] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.244690][ T7692] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.253850][ T7692] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.306238][ T7711] netlink: 4 bytes leftover after parsing attributes in process `syz.3.638'. [ 190.545312][ T7715] netlink: 8 bytes leftover after parsing attributes in process `syz.2.639'. [ 191.203966][ T7733] ubi0: attaching mtd0 [ 191.214265][ T7733] ubi0: scanning is finished [ 191.724023][ T7733] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 192.896544][ T7758] netlink: 4 bytes leftover after parsing attributes in process `syz.2.652'. [ 194.615322][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.635287][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.982367][ T7809] netlink: 4 bytes leftover after parsing attributes in process `syz.2.665'. [ 196.027766][ T7816] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 196.957438][ T7841] rxe_eth0 speed is unknown, defaulting to 1000 [ 197.714789][ T7848] netlink: 4 bytes leftover after parsing attributes in process `syz.1.676'. [ 198.867159][ T7865] loop1: detected capacity change from 0 to 1024 [ 198.923130][ T7865] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 198.961103][ T51] Bluetooth: hci0: unexpected event for opcode 0x1804 [ 200.082716][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 200.107162][ T7874] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 201.612094][ T7911] loop1: detected capacity change from 0 to 1024 [ 201.666291][ T7911] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 201.691808][ T5782] Bluetooth: hci0: unexpected event for opcode 0x1804 [ 201.818769][ T5784] Bluetooth: hci1: command 0x0406 tx timeout [ 201.825308][ T5782] Bluetooth: hci2: command 0x0406 tx timeout [ 202.130611][ T7916] netlink: 4 bytes leftover after parsing attributes in process `syz.2.695'. [ 202.209354][ T7904] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 202.651765][ T7925] FAULT_INJECTION: forcing a failure. [ 202.651765][ T7925] name failslab, interval 1, probability 0, space 0, times 0 [ 202.682071][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 202.721046][ T7925] CPU: 1 PID: 7925 Comm: syz.0.697 Not tainted syzkaller #0 [ 202.728478][ T7925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 202.738552][ T7925] Call Trace: [ 202.741862][ T7925] [ 202.744800][ T7925] dump_stack_lvl+0x18c/0x250 [ 202.749500][ T7925] ? show_regs_print_info+0x20/0x20 [ 202.754711][ T7925] ? load_image+0x420/0x420 [ 202.759306][ T7925] ? __lock_acquire+0x7eb0/0x7eb0 [ 202.764428][ T7925] should_fail_ex+0x394/0x4c0 [ 202.769125][ T7925] should_failslab+0x9/0x20 [ 202.773722][ T7925] slab_pre_alloc_hook+0x59/0x300 [ 202.778756][ T7925] ? tcf_block_get_ext+0x5f6/0x13d0 [ 202.783989][ T7925] __kmem_cache_alloc_node+0x53/0x250 [ 202.789413][ T7925] ? tcf_block_get_ext+0x5f6/0x13d0 [ 202.794641][ T7925] kmalloc_trace+0x2a/0xe0 [ 202.799094][ T7925] tcf_block_get_ext+0x5f6/0x13d0 [ 202.804159][ T7925] tcf_block_get+0x68/0xa0 [ 202.808590][ T7925] ? tcf_block_get+0xa0/0xa0 [ 202.813186][ T7925] cake_init+0x269/0xb30 [ 202.817470][ T7925] ? qdisc_peek_dequeued+0x1f0/0x1f0 [ 202.822790][ T7925] ? lockdep_rtnl_is_held+0x26/0x30 [ 202.828030][ T7925] ? qdisc_lookup+0x361/0x6c0 [ 202.832717][ T7925] ? qdisc_peek_dequeued+0x1f0/0x1f0 [ 202.838006][ T7925] qdisc_create+0x90f/0x1060 [ 202.842613][ T7925] ? qdisc_notify+0x370/0x370 [ 202.847337][ T7925] tc_modify_qdisc+0xb47/0x1de0 [ 202.852264][ T7925] ? qdisc_offload_query_caps+0x150/0x150 [ 202.858058][ T7925] ? qdisc_offload_query_caps+0x150/0x150 [ 202.863924][ T7925] rtnetlink_rcv_msg+0x843/0xf90 [ 202.868915][ T7925] ? rtnetlink_rcv_msg+0x220/0xf90 [ 202.874173][ T7925] ? rtnetlink_bind+0x80/0x80 [ 202.879004][ T7925] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 202.885053][ T7925] ? lock_chain_count+0x20/0x20 [ 202.889918][ T7925] ? __local_bh_enable_ip+0x13a/0x1c0 [ 202.895388][ T7925] ? lockdep_hardirqs_on+0x98/0x150 [ 202.900691][ T7925] ? __local_bh_enable_ip+0x13a/0x1c0 [ 202.906064][ T7925] ? _local_bh_enable+0xa0/0xa0 [ 202.910931][ T7925] ? __dev_queue_xmit+0x272/0x37e0 [ 202.916044][ T7925] ? __dev_queue_xmit+0x1329/0x37e0 [ 202.921341][ T7925] ? __dev_queue_xmit+0x272/0x37e0 [ 202.926489][ T7925] ? ref_tracker_free+0x686/0x830 [ 202.931701][ T7925] netlink_rcv_skb+0x235/0x4c0 [ 202.936476][ T7925] ? rtnetlink_bind+0x80/0x80 [ 202.941159][ T7925] ? netlink_ack+0x1160/0x1160 [ 202.945946][ T7925] ? __lock_acquire+0x7eb0/0x7eb0 [ 202.951028][ T7925] ? netlink_deliver_tap+0x2e/0x1b0 [ 202.956251][ T7925] netlink_unicast+0x7b1/0x930 [ 202.961072][ T7925] netlink_sendmsg+0x8d0/0xbf0 [ 202.965883][ T7925] ? netlink_getsockopt+0x590/0x590 [ 202.971125][ T7925] ? apparmor_socket_sendmsg+0x8e/0x330 [ 202.976720][ T7925] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 202.982169][ T7925] ? security_socket_sendmsg+0x80/0xa0 [ 202.987826][ T7925] ? netlink_getsockopt+0x590/0x590 [ 202.993159][ T7925] ____sys_sendmsg+0x61b/0x980 [ 202.997948][ T7925] ? __asan_memset+0x22/0x40 [ 203.002555][ T7925] ? __sys_sendmsg_sock+0x30/0x30 [ 203.007607][ T7925] ? __import_iovec+0x5f2/0x850 [ 203.012478][ T7925] ? import_iovec+0x73/0xa0 [ 203.016999][ T7925] ___sys_sendmsg+0x2a6/0x360 [ 203.021781][ T7925] ? __sys_sendmsg+0x2b0/0x2b0 [ 203.026677][ T7925] __se_sys_sendmsg+0x1d0/0x2c0 [ 203.031546][ T7925] ? __x64_sys_sendmsg+0x80/0x80 [ 203.036545][ T7925] ? lockdep_hardirqs_on+0x98/0x150 [ 203.041791][ T7925] do_syscall_64+0x55/0xb0 [ 203.046332][ T7925] ? clear_bhb_loop+0x40/0x90 [ 203.051130][ T7925] ? clear_bhb_loop+0x40/0x90 [ 203.055915][ T7925] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 203.061848][ T7925] RIP: 0033:0x7fc8f459e559 [ 203.066309][ T7925] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 203.086975][ T7925] RSP: 002b:00007fc8f5483028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 203.095408][ T7925] RAX: ffffffffffffffda RBX: 00007fc8f4825fa0 RCX: 00007fc8f459e559 [ 203.103479][ T7925] RDX: 0000000000000000 RSI: 00002000000007c0 RDI: 0000000000000005 [ 203.111765][ T7925] RBP: 00007fc8f46358b0 R08: 0000000000000000 R09: 0000000000000000 [ 203.119868][ T7925] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 203.128466][ T7925] R13: 00007fc8f4826038 R14: 00007fc8f4825fa0 R15: 00007ffeb876fff8 [ 203.136457][ T7925] [ 203.984719][ T7950] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 204.007818][ T7953] netlink: 4 bytes leftover after parsing attributes in process `syz.1.704'. [ 204.546619][ T7962] loop1: detected capacity change from 0 to 1024 [ 204.733842][ T7962] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 204.790063][ T5782] Bluetooth: hci0: unexpected event for opcode 0x1804 [ 205.606238][ T7980] netlink: 8 bytes leftover after parsing attributes in process `syz.2.710'. [ 205.627564][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 205.649654][ T7980] netlink: 4 bytes leftover after parsing attributes in process `syz.2.710'. [ 205.709669][ T7981] netlink: 'syz.2.710': attribute type 4 has an invalid length. [ 205.717401][ T7981] netlink: 152 bytes leftover after parsing attributes in process `syz.2.710'. [ 205.781030][ T7981] .`: renamed from bond0 [ 206.370544][ T7995] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 206.582477][ T8005] loop2: detected capacity change from 0 to 512 [ 206.600045][ T8005] EXT4-fs: Ignoring removed mblk_io_submit option [ 206.641154][ T8005] EXT4-fs error (device loop2): ext4_iget_extra_inode:4752: inode #15: comm syz.2.717: corrupted in-inode xattr: e_value size too large [ 206.688904][ T8005] EXT4-fs error (device loop2): ext4_orphan_get:1413: comm syz.2.717: couldn't read orphan inode 15 (err -117) [ 206.736996][ T8005] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 207.381841][ T8019] loop1: detected capacity change from 0 to 1024 [ 207.410504][ T8019] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 207.446426][ T5782] Bluetooth: hci0: unexpected event for opcode 0x1804 [ 207.460626][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 207.966215][ T8032] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 208.223481][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 208.559320][ T8038] netlink: 4 bytes leftover after parsing attributes in process `syz.1.727'. [ 208.664960][ T8043] pci 0000:00:01.0: MSI/MSI-X disallowed for future drivers [ 211.008306][ T8072] loop1: detected capacity change from 0 to 1024 [ 211.424753][ T8072] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 211.447234][ T5782] Bluetooth: hci0: unexpected event for opcode 0x1804 [ 211.532422][ T8078] pci 0000:00:01.0: MSI/MSI-X disallowed for future drivers [ 212.102755][ T8068] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 212.435574][ T8085] netlink: 4 bytes leftover after parsing attributes in process `syz.0.739'. [ 212.682385][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 212.686159][ T8091] loop0: detected capacity change from 0 to 512 [ 212.756800][ T8091] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 212.789758][ T8091] ext4 filesystem being mounted at /195/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 213.536422][ T8104] ubi0: attaching mtd0 [ 213.548368][ T8104] ubi0: scanning is finished [ 213.907149][ T8104] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 213.908459][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 213.914950][ T8104] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 213.914999][ T8104] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 213.915014][ T8104] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 213.915029][ T8104] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 213.915044][ T8104] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 213.915060][ T8104] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 2755202274 [ 213.915077][ T8104] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 213.989616][ T8106] ubi0: background thread "ubi_bgt0d" started, PID 8106 [ 214.267140][ T8112] loop0: detected capacity change from 0 to 128 [ 214.323669][ T8112] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 214.351784][ T8112] ext4 filesystem being mounted at /197/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 214.591456][ T5774] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 215.768934][ T8116] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 216.083859][ T8125] netlink: 4 bytes leftover after parsing attributes in process `syz.0.749'. [ 216.367128][ T8129] loop1: detected capacity change from 0 to 1024 [ 216.460959][ T8129] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 216.485341][ T5782] Bluetooth: hci0: unexpected event for opcode 0x1804 [ 217.154760][ T8140] loop0: detected capacity change from 0 to 128 [ 217.200224][ T8140] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 217.215473][ T8140] ext4 filesystem being mounted at /200/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 217.484348][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 218.217798][ T5774] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 219.778723][ T8169] netlink: 4 bytes leftover after parsing attributes in process `syz.1.761'. [ 220.451194][ T8175] loop0: detected capacity change from 0 to 1024 [ 220.537077][ T8175] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 220.636698][ T5782] Bluetooth: hci1: unexpected event for opcode 0x1804 [ 221.540804][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 222.277524][ T8213] loop1: detected capacity change from 0 to 2048 [ 222.692585][ T8218] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 222.755510][ T8218] loop2: detected capacity change from 0 to 1024 [ 223.136623][ T8213] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 223.163910][ T8218] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 223.202441][ T8213] ext4 filesystem being mounted at /191/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 223.461638][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 223.954569][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 224.194947][ T8246] md: invalid superblock checksum on ram0 [ 224.214747][ T8246] md: ram0 does not have a valid v1.2 superblock, not importing! [ 225.835789][ T8272] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 225.898015][ T8272] loop1: detected capacity change from 0 to 1024 [ 225.967922][ T8272] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 226.020522][ T5782] Bluetooth: hci0: unexpected event for opcode 0x1804 [ 226.639351][ T8279] netlink: 16 bytes leftover after parsing attributes in process `syz.3.795'. [ 227.106482][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 228.329495][ T8306] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 228.406024][ T8306] loop0: detected capacity change from 0 to 1024 [ 228.573550][ T8306] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 228.595730][ T5782] Bluetooth: hci1: unexpected event for opcode 0x1804 [ 229.304108][ T8318] ubi: mtd0 is already attached to ubi0 [ 229.828216][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 230.722610][ T8333] loop1: detected capacity change from 0 to 512 [ 230.732305][ T8333] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 230.746520][ T8333] EXT4-fs (loop1): ext4_check_descriptors: Inode table for group 0 not in group (block 0)! [ 230.764054][ T8333] EXT4-fs (loop1): group descriptors corrupted! [ 232.574028][ T8355] ubi: mtd0 is already attached to ubi0 [ 234.542358][ T8388] ubi: mtd0 is already attached to ubi0 [ 237.556337][ T8406] syzkaller0: entered promiscuous mode [ 237.579540][ T8406] syzkaller0: entered allmulticast mode [ 237.942863][ T8417] ubi: mtd0 is already attached to ubi0 [ 238.419111][ T8420] loop2: detected capacity change from 0 to 512 [ 238.590649][ T8420] EXT4-fs error (device loop2): ext4_validate_block_bitmap:430: comm syz.2.842: bg 0: block 104: invalid block bitmap [ 238.622953][ T8420] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6655: Corrupt filesystem [ 238.661718][ T8420] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.842: invalid indirect mapped block 1 (level 1) [ 238.678381][ T8420] EXT4-fs (loop2): 1 truncate cleaned up [ 238.694098][ T8420] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 239.464387][ T8420] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input6 [ 239.672704][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 240.438583][ T8462] ubi: mtd0 is already attached to ubi0 [ 242.217066][ T5782] Bluetooth: hci3: link tx timeout [ 242.223880][ T5782] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 244.629860][ T5782] Bluetooth: hci3: command 0x0406 tx timeout [ 245.104814][ T5085] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 247.438174][ T8578] loop0: detected capacity change from 0 to 512 [ 247.448136][ T8578] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 247.467744][ T8578] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 not in group (block 0)! [ 247.468114][ T8577] FAULT_INJECTION: forcing a failure. [ 247.468114][ T8577] name failslab, interval 1, probability 0, space 0, times 0 [ 247.484889][ T8578] EXT4-fs (loop0): group descriptors corrupted! [ 247.495896][ T8577] CPU: 0 PID: 8577 Comm: syz.1.899 Not tainted syzkaller #0 [ 247.505701][ T8577] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 247.516241][ T8577] Call Trace: [ 247.519552][ T8577] [ 247.522528][ T8577] dump_stack_lvl+0x18c/0x250 [ 247.527282][ T8577] ? show_regs_print_info+0x20/0x20 [ 247.532606][ T8577] ? load_image+0x420/0x420 [ 247.537172][ T8577] ? __might_sleep+0xe0/0xe0 [ 247.541787][ T8577] ? __lock_acquire+0x7eb0/0x7eb0 [ 247.546918][ T8577] should_fail_ex+0x394/0x4c0 [ 247.551714][ T8577] should_failslab+0x9/0x20 [ 247.556238][ T8577] slab_pre_alloc_hook+0x59/0x300 [ 247.561452][ T8577] ? assoc_array_insert+0x445/0x3080 [ 247.566836][ T8577] __kmem_cache_alloc_node+0x53/0x250 [ 247.572225][ T8577] ? assoc_array_insert+0x445/0x3080 [ 247.577639][ T8577] kmalloc_trace+0x2a/0xe0 [ 247.582069][ T8577] assoc_array_insert+0x445/0x3080 [ 247.587215][ T8577] ? key_set_index_key+0x385/0x550 [ 247.592340][ T8577] ? __key_link_lock+0x9b/0xb0 [ 247.597215][ T8577] ? __asan_memcpy+0x40/0x70 [ 247.601850][ T8577] ? mutex_lock_nested+0x20/0x20 [ 247.606986][ T8577] ? down_read_killable+0x340/0x340 [ 247.612234][ T8577] __key_link_begin+0xd6/0x1e0 [ 247.617209][ T8577] __key_create_or_update+0x44b/0xa60 [ 247.622690][ T8577] ? key_validate+0xf0/0xf0 [ 247.627204][ T8577] ? key_create_or_update+0x60/0x60 [ 247.632496][ T8577] ? bpf_lsm_key_permission+0x9/0x10 [ 247.637882][ T8577] ? lookup_user_key+0xb66/0x1140 [ 247.643039][ T8577] ? search_process_keyrings_rcu+0x2b0/0x2b0 [ 247.649259][ T8577] key_create_or_update+0x42/0x60 [ 247.654314][ T8577] __se_sys_add_key+0x34f/0x410 [ 247.659218][ T8577] ? __x64_sys_add_key+0xc0/0xc0 [ 247.664198][ T8577] ? lockdep_hardirqs_on+0x98/0x150 [ 247.669402][ T8577] ? __x64_sys_add_key+0x20/0xc0 [ 247.674368][ T8577] do_syscall_64+0x55/0xb0 [ 247.678858][ T8577] ? clear_bhb_loop+0x40/0x90 [ 247.683616][ T8577] ? clear_bhb_loop+0x40/0x90 [ 247.688298][ T8577] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 247.694330][ T8577] RIP: 0033:0x7fa5cb99e559 [ 247.698882][ T8577] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 247.718584][ T8577] RSP: 002b:00007fa5cc8fc028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 247.727027][ T8577] RAX: ffffffffffffffda RBX: 00007fa5cbc25fa0 RCX: 00007fa5cb99e559 [ 247.735118][ T8577] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 00002000000001c0 [ 247.743138][ T8577] RBP: 00007fa5cba358b0 R08: fffffffffffffffc R09: 0000000000000000 [ 247.751127][ T8577] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 247.759103][ T8577] R13: 00007fa5cbc26038 R14: 00007fa5cbc25fa0 R15: 00007ffc5deb0b48 [ 247.767279][ T8577] [ 247.940719][ T8584] netlink: 16 bytes leftover after parsing attributes in process `syz.1.903'. [ 248.607541][ T8599] loop0: detected capacity change from 0 to 8 [ 248.653613][ T8599] SQUASHFS error: Failed to read block 0x4de: -5 [ 248.676559][ T8599] SQUASHFS error: Failed to read block 0x4de: -5 [ 248.684730][ T8599] SQUASHFS error: Failed to read block 0x4de: -5 [ 248.696024][ T8599] SQUASHFS error: Failed to read block 0x4de: -5 [ 248.706585][ T8599] SQUASHFS error: Failed to read block 0x4de: -5 [ 248.720629][ T27] audit: type=1800 audit(1792047164.373:4): pid=8599 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.909" name="file1" dev="loop0" ino=5 res=0 errno=0 [ 249.006021][ T8610] netlink: 16 bytes leftover after parsing attributes in process `syz.2.913'. [ 249.269548][ T8619] loop3: detected capacity change from 0 to 512 [ 249.282514][ T8619] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 249.298012][ T8619] EXT4-fs (loop3): ext4_check_descriptors: Inode table for group 0 not in group (block 0)! [ 249.325969][ T8619] EXT4-fs (loop3): group descriptors corrupted! [ 251.031428][ T8632] netlink: 16 bytes leftover after parsing attributes in process `syz.3.922'. [ 251.437347][ T8638] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 251.504229][ T8638] loop0: detected capacity change from 0 to 1024 [ 251.686413][ T8638] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 251.711264][ T5085] Bluetooth: hci1: unexpected event for opcode 0x1804 [ 252.073656][ T5085] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 252.917122][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 255.409317][ T5085] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 255.448248][ T8690] syzkaller0: entered promiscuous mode [ 255.454132][ T8690] syzkaller0: entered allmulticast mode [ 255.809934][ T8694] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 255.877647][ T8694] loop1: detected capacity change from 0 to 1024 [ 256.099756][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.123642][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.246465][ T8694] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 256.284551][ T5085] Bluetooth: hci0: unexpected event for opcode 0x1804 [ 256.487363][ T8699] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 256.979732][ T8710] loop3: detected capacity change from 0 to 512 [ 256.994464][ T8710] EXT4-fs: Ignoring removed mblk_io_submit option [ 257.071557][ T8710] EXT4-fs error (device loop3): ext4_iget_extra_inode:4752: inode #15: comm syz.3.947: corrupted in-inode xattr: e_value size too large [ 257.090436][ T8710] EXT4-fs error (device loop3): ext4_orphan_get:1413: comm syz.3.947: couldn't read orphan inode 15 (err -117) [ 257.108387][ T8710] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 257.889156][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 257.921463][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 259.398196][ T8748] loop2: detected capacity change from 0 to 512 [ 259.413050][ T8748] EXT4-fs: Ignoring removed mblk_io_submit option [ 259.503041][ T8748] EXT4-fs error (device loop2): ext4_iget_extra_inode:4752: inode #15: comm syz.2.959: corrupted in-inode xattr: e_value size too large [ 259.524942][ T8748] EXT4-fs error (device loop2): ext4_orphan_get:1413: comm syz.2.959: couldn't read orphan inode 15 (err -117) [ 259.539329][ T8748] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 259.697646][ T8756] loop3: detected capacity change from 0 to 8192 [ 259.753242][ T8756] loop3: p1 p2 p3 [ 259.757798][ T8756] loop3: partition table partially beyond EOD, truncated [ 259.765840][ T8756] loop3: p1 start 51379968 is beyond EOD, truncated [ 259.776983][ T8756] loop3: p3 size 100663552 extends beyond EOD, truncated [ 260.243140][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 261.444411][ T8771] rxe_eth0 speed is unknown, defaulting to 1000 [ 261.982338][ T8786] loop1: detected capacity change from 0 to 512 [ 261.990508][ T8786] EXT4-fs: Ignoring removed mblk_io_submit option [ 262.048008][ T8786] EXT4-fs error (device loop1): ext4_iget_extra_inode:4752: inode #15: comm syz.1.972: corrupted in-inode xattr: e_value size too large [ 262.062979][ T8786] EXT4-fs error (device loop1): ext4_orphan_get:1413: comm syz.1.972: couldn't read orphan inode 15 (err -117) [ 262.110927][ T8786] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 262.973072][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 263.074687][ T8806] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 263.142429][ T8806] loop3: detected capacity change from 0 to 1024 [ 263.263185][ T8806] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 263.291799][ T5085] Bluetooth: hci2: unexpected event for opcode 0x1804 [ 265.110564][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 265.862882][ T8838] rxe_eth0 speed is unknown, defaulting to 1000 [ 267.002469][ T8849] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 267.069267][ T8849] loop3: detected capacity change from 0 to 1024 [ 267.192392][ T8849] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 267.220750][ T5085] Bluetooth: hci2: unexpected event for opcode 0x1804 [ 268.156120][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 268.302432][ T8872] netlink: 4 bytes leftover after parsing attributes in process `syz.0.997'. [ 270.164118][ T8903] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 270.182840][ T8903] loop3: detected capacity change from 0 to 1024 [ 271.221769][ T8903] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 271.268783][ T5085] Bluetooth: hci2: unexpected event for opcode 0x1804 [ 272.303402][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 272.980366][ T8932] rxe_eth0 speed is unknown, defaulting to 1000 [ 274.228120][ T8952] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 274.247312][ T8952] loop1: detected capacity change from 0 to 1024 [ 274.351885][ T8952] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 274.370019][ T5085] Bluetooth: hci0: unexpected event for opcode 0x1804 [ 274.913110][ T8960] loop2: detected capacity change from 0 to 512 [ 274.946147][ T8960] EXT4-fs error (device loop2): ext4_validate_block_bitmap:430: comm syz.2.1026: bg 0: block 104: invalid block bitmap [ 274.972760][ T8960] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6655: Corrupt filesystem [ 274.984250][ T8960] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.1026: invalid indirect mapped block 1 (level 1) [ 274.998382][ T8960] EXT4-fs (loop2): 1 truncate cleaned up [ 275.005519][ T8960] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 275.050725][ T8962] loop0: detected capacity change from 0 to 8192 [ 275.062905][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 275.108265][ T8962] loop0: p1 p2 p3 [ 275.112231][ T8962] loop0: partition table partially beyond EOD, truncated [ 275.126501][ T8962] loop0: p1 start 51379968 is beyond EOD, truncated [ 275.150925][ T8962] loop0: p3 size 100663552 extends beyond EOD, truncated [ 275.405055][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 275.910560][ T8978] syzkaller0: entered promiscuous mode [ 275.928428][ T8978] syzkaller0: entered allmulticast mode [ 275.968245][ T8982] loop2: detected capacity change from 0 to 512 [ 276.058869][ T8982] EXT4-fs error (device loop2): ext4_validate_block_bitmap:430: comm syz.2.1036: bg 0: block 104: invalid block bitmap [ 276.085930][ T8982] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6655: Corrupt filesystem [ 276.098031][ T8982] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.1036: invalid indirect mapped block 1 (level 1) [ 276.145915][ T8982] EXT4-fs (loop2): 1 truncate cleaned up [ 276.164041][ T8982] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 276.581592][ T8993] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 276.600314][ T8993] loop3: detected capacity change from 0 to 1024 [ 276.698630][ T8993] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 276.717144][ T5085] Bluetooth: hci2: unexpected event for opcode 0x1804 [ 276.804861][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 277.605008][ T9007] rxe_eth0 speed is unknown, defaulting to 1000 [ 278.251200][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 278.392786][ T9011] syzkaller0: entered promiscuous mode [ 278.398415][ T9011] syzkaller0: entered allmulticast mode [ 278.536164][ T9018] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input7 [ 279.191040][ T9030] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 279.212116][ T9030] loop1: detected capacity change from 0 to 1024 [ 279.251440][ T9030] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 279.267246][ T5085] Bluetooth: hci0: unexpected event for opcode 0x1804 [ 279.647600][ T9039] overlayfs: failed to resolve './bus': -2 [ 280.541565][ T9046] loop3: detected capacity change from 0 to 512 [ 280.543716][ T9044] syzkaller0: entered promiscuous mode [ 280.552113][ T9046] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 280.568265][ T9046] EXT4-fs (loop3): ext4_check_descriptors: Inode table for group 0 not in group (block 0)! [ 280.579232][ T9044] syzkaller0: entered allmulticast mode [ 280.588478][ T9046] EXT4-fs (loop3): group descriptors corrupted! [ 280.664266][ T8422] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 281.054887][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 281.794073][ T9064] rxe_eth0 speed is unknown, defaulting to 1000 [ 284.869776][ T9080] syzkaller0: entered promiscuous mode [ 284.875500][ T9080] syzkaller0: entered allmulticast mode [ 286.457264][ T9095] ubi: mtd0 is already attached to ubi0 [ 286.924502][ T9107] loop2: detected capacity change from 0 to 512 [ 286.945908][ T9107] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 286.968331][ T9107] EXT4-fs (loop2): ext4_check_descriptors: Inode table for group 0 not in group (block 0)! [ 286.995085][ T9107] EXT4-fs (loop2): group descriptors corrupted! [ 287.040772][ T8422] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 287.776132][ T9123] syzkaller0: entered promiscuous mode [ 288.003530][ T9123] syzkaller0: entered allmulticast mode [ 288.359757][ T9125] rxe_eth0 speed is unknown, defaulting to 1000 [ 289.572656][ T9139] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input8 [ 289.788801][ T9146] loop0: detected capacity change from 0 to 512 [ 289.809098][ T9146] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 289.839343][ T9146] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 not in group (block 0)! [ 289.870866][ T9146] EXT4-fs (loop0): group descriptors corrupted! [ 290.883578][ T9154] FAULT_INJECTION: forcing a failure. [ 290.883578][ T9154] name failslab, interval 1, probability 0, space 0, times 0 [ 290.951037][ T9154] CPU: 0 PID: 9154 Comm: syz.3.1090 Not tainted syzkaller #0 [ 290.958576][ T9154] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 290.968669][ T9154] Call Trace: [ 290.972080][ T9154] [ 290.975041][ T9154] dump_stack_lvl+0x18c/0x250 [ 290.979771][ T9154] ? show_regs_print_info+0x20/0x20 [ 290.985009][ T9154] ? load_image+0x420/0x420 [ 290.989640][ T9154] ? __might_sleep+0xe0/0xe0 [ 290.994259][ T9154] ? __lock_acquire+0x7eb0/0x7eb0 [ 290.999376][ T9154] should_fail_ex+0x394/0x4c0 [ 291.004087][ T9154] should_failslab+0x9/0x20 [ 291.008712][ T9154] slab_pre_alloc_hook+0x59/0x300 [ 291.013764][ T9154] ? security_sk_alloc+0x4b/0x130 [ 291.018815][ T9154] ? security_sk_alloc+0x4b/0x130 [ 291.023867][ T9154] __kmem_cache_alloc_node+0x53/0x250 [ 291.029283][ T9154] ? security_sk_alloc+0x4b/0x130 [ 291.034432][ T9154] __kmalloc+0xa7/0x240 [ 291.038627][ T9154] ? sk_prot_alloc+0xe7/0x210 [ 291.043622][ T9154] security_sk_alloc+0x4b/0x130 [ 291.048557][ T9154] sk_prot_alloc+0x101/0x210 [ 291.053273][ T9154] ? sk_alloc+0x24/0x350 [ 291.057557][ T9154] sk_alloc+0x3a/0x350 [ 291.061853][ T9154] __netlink_create+0x6c/0x290 [ 291.066727][ T9154] netlink_create+0x3ee/0x5c0 [ 291.071442][ T9154] ? genl_rcv+0x40/0x40 [ 291.075615][ T9154] __sock_create+0x49e/0x940 [ 291.080279][ T9154] __sys_socket+0xd7/0x1b0 [ 291.084701][ T9154] __x64_sys_socket+0x7a/0x90 [ 291.089384][ T9154] do_syscall_64+0x55/0xb0 [ 291.093806][ T9154] ? clear_bhb_loop+0x40/0x90 [ 291.098576][ T9154] ? clear_bhb_loop+0x40/0x90 [ 291.103264][ T9154] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 291.109461][ T9154] RIP: 0033:0x7f3846f9fdc7 [ 291.113899][ T9154] Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 291.133640][ T9154] RSP: 002b:00007f3847f3cf98 EFLAGS: 00000286 ORIG_RAX: 0000000000000029 [ 291.142069][ T9154] RAX: ffffffffffffffda RBX: 00007f3847225fa0 RCX: 00007f3846f9fdc7 [ 291.150052][ T9154] RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010 [ 291.158097][ T9154] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 [ 291.166078][ T9154] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000 [ 291.174254][ T9154] R13: 00007f3847226038 R14: 00007f3847225fa0 R15: 00007fffd91baab8 [ 291.182512][ T9154] [ 291.241663][ T9160] syzkaller0: entered promiscuous mode [ 291.257651][ T9160] syzkaller0: entered allmulticast mode [ 292.529641][ T9180] loop2: detected capacity change from 0 to 512 [ 292.573088][ T9180] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 292.599604][ T9180] EXT4-fs (loop2): ext4_check_descriptors: Inode table for group 0 not in group (block 0)! [ 292.629130][ T9180] EXT4-fs (loop2): group descriptors corrupted! [ 293.076980][ T9184] rxe_eth0 speed is unknown, defaulting to 1000 [ 294.253097][ T9189] rxe_eth0 speed is unknown, defaulting to 1000 [ 295.057335][ T9200] syzkaller0: entered promiscuous mode [ 295.064682][ T9200] syzkaller0: entered allmulticast mode [ 295.213527][ T9204] loop1: detected capacity change from 0 to 512 [ 295.242341][ T9204] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 295.397750][ T9204] EXT4-fs (loop1): 1 truncate cleaned up [ 295.433641][ T9204] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 297.056365][ T5777] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 297.503339][ T9233] syzkaller0: entered promiscuous mode [ 297.538667][ T9233] syzkaller0: entered allmulticast mode [ 298.259973][ T9247] rxe_eth0 speed is unknown, defaulting to 1000 [ 298.357446][ T9249] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 298.424297][ T9249] loop3: detected capacity change from 0 to 1024 [ 299.050608][ T9246] loop2: detected capacity change from 0 to 512 [ 299.100806][ T9249] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 299.123698][ T5085] Bluetooth: hci2: unexpected event for opcode 0x1804 [ 299.130885][ T9246] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 299.216922][ T9246] EXT4-fs (loop2): 1 truncate cleaned up [ 299.233612][ T9246] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 300.441363][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 301.359777][ T9278] syzkaller0: entered promiscuous mode [ 301.379528][ T9278] syzkaller0: entered allmulticast mode [ 301.882465][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 302.171828][ T9290] loop0: detected capacity change from 0 to 512 [ 302.223597][ T9290] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a026c018, mo2=0002] [ 302.242405][ T9290] System zones: 1-12 [ 302.272443][ T9290] ------------[ cut here ]------------ [ 302.278612][ T9290] EA inode 11 i_nlink=0 [ 302.278877][ T9290] WARNING: CPU: 0 PID: 9290 at fs/ext4/xattr.c:1059 ext4_xattr_inode_update_ref+0x572/0x5d0 [ 302.293830][ T9290] Modules linked in: [ 302.297778][ T9290] CPU: 0 PID: 9290 Comm: syz.0.1134 Not tainted syzkaller #0 [ 302.305357][ T9290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 302.315602][ T9290] RIP: 0010:ext4_xattr_inode_update_ref+0x572/0x5d0 [ 302.323506][ T9290] Code: 50 4c 89 e0 48 c1 e8 03 42 80 3c 30 00 74 08 4c 89 e7 e8 11 ee 98 ff 49 8b 34 24 48 c7 c7 20 ef de 8a 44 89 fa e8 6e cb 09 ff <0f> 0b 4c 8b 64 24 10 4c 8d 6c 24 60 e9 8e fe ff ff e8 18 86 4b 08 [ 302.343575][ T9290] RSP: 0018:ffffc900037df360 EFLAGS: 00010246 [ 302.349889][ T9290] RAX: 2bcb5ce7d2f9ab00 RBX: ffff8880564140a8 RCX: 0000000000080000 [ 302.357932][ T9290] RDX: ffffc9000cf62000 RSI: 000000000001cd0d RDI: 000000000001cd0e [ 302.366024][ T9290] RBP: ffffc900037df450 R08: ffff8880b8c28c53 R09: 1ffff1101718518a [ 302.374103][ T9290] R10: dffffc0000000000 R11: ffffed101718518b R12: ffff888056413f00 [ 302.382299][ T9290] R13: ffffc900037df3c0 R14: dffffc0000000000 R15: 0000000000000000 [ 302.390373][ T9290] FS: 00007fc8f54836c0(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000 [ 302.399917][ T9290] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 302.406728][ T9290] CR2: 0000000000000000 CR3: 000000002c5df000 CR4: 00000000003506f0 [ 302.414825][ T9290] Call Trace: [ 302.418134][ T9290] [ 302.422147][ T9290] ? ext4_xattr_list_entries+0x3d0/0x3d0 [ 302.427999][ T9290] ? __ext4_journal_ensure_credits+0x30/0x450 [ 302.434423][ T9290] ext4_xattr_inode_dec_ref_all+0x9bb/0x1030 [ 302.440617][ T9290] ? ext4_xattr_delete_inode+0xd00/0xd00 [ 302.446318][ T9290] ? __ext4_journal_ensure_credits+0x450/0x450 [ 302.453616][ T9290] ext4_xattr_delete_inode+0xb3b/0xd00 [ 302.459156][ T9290] ? ext4_expand_extra_isize_ea+0x1ea0/0x1ea0 [ 302.465401][ T9290] ? __ext4_mark_inode_dirty+0x50d/0x720 [ 302.471248][ T9290] ext4_evict_inode+0xa88/0xe70 [ 302.476155][ T9290] ? evict+0x482/0x8a0 [ 302.480381][ T9290] ? ext4_inode_is_fast_symlink+0x390/0x390 [ 302.486334][ T9290] ? do_raw_spin_unlock+0x121/0x230 [ 302.491825][ T9290] ? ext4_inode_is_fast_symlink+0x390/0x390 [ 302.497859][ T9290] evict+0x4b7/0x8a0 [ 302.501972][ T9290] ? __lock_acquire+0x7eb0/0x7eb0 [ 302.507052][ T9290] ? proc_nr_inodes+0x230/0x230 [ 302.512012][ T9290] ? do_raw_spin_unlock+0x121/0x230 [ 302.517366][ T9290] ? _raw_spin_unlock+0x28/0x40 [ 302.523495][ T9290] ext4_orphan_cleanup+0xdff/0x1650 [ 302.529174][ T9290] ? ext4_orphan_file_block_trigger+0x440/0x440 [ 302.535742][ T9290] ? ext4_orphan_del+0xc90/0xc90 [ 302.540837][ T9290] ? ext4_register_li_request+0x182/0x930 [ 302.546774][ T9290] ? errseq_check_and_advance+0x66/0x120 [ 302.552548][ T9290] ext4_fill_super+0x5fb5/0x6870 [ 302.557874][ T9290] ? ext4_parse_test_dummy_encryption+0xb0/0xb0 [ 302.564330][ T9290] ? __might_sleep+0xe0/0xe0 [ 302.569068][ T9290] ? read_lock_is_recursive+0x20/0x20 [ 302.574564][ T9290] ? snprintf+0xe9/0x140 [ 302.579003][ T9290] ? down_read_killable+0x340/0x340 [ 302.584696][ T9290] ? setup_bdev_super+0x56b/0x660 [ 302.590161][ T9290] get_tree_bdev+0x3e5/0x520 [ 302.594899][ T9290] ? ext4_parse_test_dummy_encryption+0xb0/0xb0 [ 302.601754][ T9290] ? setup_bdev_super+0x660/0x660 [ 302.606921][ T9290] ? apparmor_capable+0x137/0x1a0 [ 302.612205][ T9290] ? bpf_lsm_capable+0x9/0x10 [ 302.617036][ T9290] ? security_capable+0x89/0xb0 [ 302.622078][ T9290] vfs_get_tree+0x8c/0x280 [ 302.627757][ T9290] do_new_mount+0x24a/0xa40 [ 302.632785][ T9290] __se_sys_mount+0x2e7/0x3d0 [ 302.637525][ T9290] ? __x64_sys_mount+0xc0/0xc0 [ 302.642434][ T9290] ? lockdep_hardirqs_on+0x98/0x150 [ 302.647685][ T9290] ? __x64_sys_mount+0x20/0xc0 [ 302.652608][ T9290] do_syscall_64+0x55/0xb0 [ 302.657070][ T9290] ? clear_bhb_loop+0x40/0x90 [ 302.661857][ T9290] ? clear_bhb_loop+0x40/0x90 [ 302.666585][ T9290] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 302.672633][ T9290] RIP: 0033:0x7fc8f459f7ca [ 302.677131][ T9290] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 302.697018][ T9290] RSP: 002b:00007fc8f5482e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 302.705548][ T9290] RAX: ffffffffffffffda RBX: 00007fc8f5482ee0 RCX: 00007fc8f459f7ca [ 302.713728][ T9290] RDX: 00002000000002c0 RSI: 0000200000000300 RDI: 00007fc8f5482ea0 [ 302.721826][ T9290] RBP: 00002000000002c0 R08: 00007fc8f5482ee0 R09: 0000000000200700 [ 302.730558][ T9290] R10: 0000000000200700 R11: 0000000000000246 R12: 0000200000000300 [ 302.738720][ T9290] R13: 00007fc8f5482ea0 R14: 0000000000000488 R15: 0000200000000340 [ 302.746941][ T9290] [ 302.750108][ T9290] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 302.757489][ T9290] CPU: 0 PID: 9290 Comm: syz.0.1134 Not tainted syzkaller #0 [ 302.764955][ T9290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 302.775299][ T9290] Call Trace: [ 302.778607][ T9290] [ 302.781565][ T9290] dump_stack_lvl+0x18c/0x250 [ 302.786246][ T9290] ? show_regs_print_info+0x20/0x20 [ 302.791468][ T9290] ? load_image+0x420/0x420 [ 302.796046][ T9290] panic+0x2ca/0x720 [ 302.800062][ T9290] ? bpf_jit_dump+0xd0/0xd0 [ 302.804606][ T9290] __warn+0x2e0/0x470 [ 302.808625][ T9290] ? ext4_xattr_inode_update_ref+0x572/0x5d0 [ 302.814617][ T9290] ? ext4_xattr_inode_update_ref+0x572/0x5d0 [ 302.820610][ T9290] report_bug+0x2be/0x4f0 [ 302.825035][ T9290] ? ext4_xattr_inode_update_ref+0x572/0x5d0 [ 302.831018][ T9290] ? ext4_xattr_inode_update_ref+0x572/0x5d0 [ 302.836998][ T9290] ? ext4_xattr_inode_update_ref+0x574/0x5d0 [ 302.842974][ T9290] handle_bug+0xcf/0x120 [ 302.847307][ T9290] exc_invalid_op+0x1a/0x50 [ 302.851810][ T9290] asm_exc_invalid_op+0x1a/0x20 [ 302.856660][ T9290] RIP: 0010:ext4_xattr_inode_update_ref+0x572/0x5d0 [ 302.863247][ T9290] Code: 50 4c 89 e0 48 c1 e8 03 42 80 3c 30 00 74 08 4c 89 e7 e8 11 ee 98 ff 49 8b 34 24 48 c7 c7 20 ef de 8a 44 89 fa e8 6e cb 09 ff <0f> 0b 4c 8b 64 24 10 4c 8d 6c 24 60 e9 8e fe ff ff e8 18 86 4b 08 [ 302.882859][ T9290] RSP: 0018:ffffc900037df360 EFLAGS: 00010246 [ 302.888926][ T9290] RAX: 2bcb5ce7d2f9ab00 RBX: ffff8880564140a8 RCX: 0000000000080000 [ 302.896924][ T9290] RDX: ffffc9000cf62000 RSI: 000000000001cd0d RDI: 000000000001cd0e [ 302.904890][ T9290] RBP: ffffc900037df450 R08: ffff8880b8c28c53 R09: 1ffff1101718518a [ 302.912860][ T9290] R10: dffffc0000000000 R11: ffffed101718518b R12: ffff888056413f00 [ 302.920834][ T9290] R13: ffffc900037df3c0 R14: dffffc0000000000 R15: 0000000000000000 [ 302.928826][ T9290] ? ext4_xattr_list_entries+0x3d0/0x3d0 [ 302.934496][ T9290] ? __ext4_journal_ensure_credits+0x30/0x450 [ 302.940570][ T9290] ext4_xattr_inode_dec_ref_all+0x9bb/0x1030 [ 302.946570][ T9290] ? ext4_xattr_delete_inode+0xd00/0xd00 [ 302.952401][ T9290] ? __ext4_journal_ensure_credits+0x450/0x450 [ 302.958574][ T9290] ext4_xattr_delete_inode+0xb3b/0xd00 [ 302.964141][ T9290] ? ext4_expand_extra_isize_ea+0x1ea0/0x1ea0 [ 302.970240][ T9290] ? __ext4_mark_inode_dirty+0x50d/0x720 [ 302.975886][ T9290] ext4_evict_inode+0xa88/0xe70 [ 302.980795][ T9290] ? evict+0x482/0x8a0 [ 302.985063][ T9290] ? ext4_inode_is_fast_symlink+0x390/0x390 [ 302.990976][ T9290] ? do_raw_spin_unlock+0x121/0x230 [ 302.996183][ T9290] ? ext4_inode_is_fast_symlink+0x390/0x390 [ 303.002083][ T9290] evict+0x4b7/0x8a0 [ 303.006007][ T9290] ? __lock_acquire+0x7eb0/0x7eb0 [ 303.011045][ T9290] ? proc_nr_inodes+0x230/0x230 [ 303.015902][ T9290] ? do_raw_spin_unlock+0x121/0x230 [ 303.021112][ T9290] ? _raw_spin_unlock+0x28/0x40 [ 303.025978][ T9290] ext4_orphan_cleanup+0xdff/0x1650 [ 303.031190][ T9290] ? ext4_orphan_file_block_trigger+0x440/0x440 [ 303.037435][ T9290] ? ext4_orphan_del+0xc90/0xc90 [ 303.042383][ T9290] ? ext4_register_li_request+0x182/0x930 [ 303.048111][ T9290] ? errseq_check_and_advance+0x66/0x120 [ 303.053920][ T9290] ext4_fill_super+0x5fb5/0x6870 [ 303.058978][ T9290] ? ext4_parse_test_dummy_encryption+0xb0/0xb0 [ 303.065222][ T9290] ? __might_sleep+0xe0/0xe0 [ 303.069817][ T9290] ? read_lock_is_recursive+0x20/0x20 [ 303.075222][ T9290] ? snprintf+0xe9/0x140 [ 303.079490][ T9290] ? down_read_killable+0x340/0x340 [ 303.084696][ T9290] ? setup_bdev_super+0x56b/0x660 [ 303.089809][ T9290] get_tree_bdev+0x3e5/0x520 [ 303.094402][ T9290] ? ext4_parse_test_dummy_encryption+0xb0/0xb0 [ 303.100646][ T9290] ? setup_bdev_super+0x660/0x660 [ 303.105670][ T9290] ? apparmor_capable+0x137/0x1a0 [ 303.110711][ T9290] ? bpf_lsm_capable+0x9/0x10 [ 303.115384][ T9290] ? security_capable+0x89/0xb0 [ 303.120237][ T9290] vfs_get_tree+0x8c/0x280 [ 303.124680][ T9290] do_new_mount+0x24a/0xa40 [ 303.129273][ T9290] __se_sys_mount+0x2e7/0x3d0 [ 303.134040][ T9290] ? __x64_sys_mount+0xc0/0xc0 [ 303.138807][ T9290] ? lockdep_hardirqs_on+0x98/0x150 [ 303.144005][ T9290] ? __x64_sys_mount+0x20/0xc0 [ 303.148769][ T9290] do_syscall_64+0x55/0xb0 [ 303.153183][ T9290] ? clear_bhb_loop+0x40/0x90 [ 303.157879][ T9290] ? clear_bhb_loop+0x40/0x90 [ 303.162605][ T9290] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 303.168534][ T9290] RIP: 0033:0x7fc8f459f7ca [ 303.172976][ T9290] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 303.192696][ T9290] RSP: 002b:00007fc8f5482e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 303.201127][ T9290] RAX: ffffffffffffffda RBX: 00007fc8f5482ee0 RCX: 00007fc8f459f7ca [ 303.209100][ T9290] RDX: 00002000000002c0 RSI: 0000200000000300 RDI: 00007fc8f5482ea0 [ 303.217103][ T9290] RBP: 00002000000002c0 R08: 00007fc8f5482ee0 R09: 0000000000200700 [ 303.225076][ T9290] R10: 0000000000200700 R11: 0000000000000246 R12: 0000200000000300 [ 303.233068][ T9290] R13: 00007fc8f5482ea0 R14: 0000000000000488 R15: 0000200000000340 [ 303.241063][ T9290] [ 303.244227][ T9290] Kernel Offset: disabled [ 303.248682][ T9290] Rebooting in 86400 seconds..