last executing test programs: 15.937580258s ago: executing program 3 (id=499): fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000200)={@local, @empty, @val={@void, {0x8100, 0x5, 0x0, 0x4}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x2, 0x0, 0xfe, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x1}}}}}}}, 0x0) 15.768503802s ago: executing program 3 (id=503): syz_emit_ethernet(0x3b6, &(0x7f00000003c0)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x380, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0xf5, 0x0, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x0, 0x1, "000000050000000026000400"}, {0x18, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0xe, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x18, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x7, "ffffffffffff00000000000200000000000000000000000000008879e66485201a0015ca837400"/55}, {0x0, 0x14, "5e14f0e7e72d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fa632dbf04542188b196e213408c"}, {0x3, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) 15.600500305s ago: executing program 3 (id=507): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x46c, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000005c0)={'bridge0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000140)="06000000e70014000000c9a83baa88a800008820fe22b557", 0x18, 0xc4, &(0x7f0000000100)={0x11, 0x3, r1, 0x1, 0xc, 0x6, @broadcast}, 0x14) 15.497040538s ago: executing program 3 (id=510): timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x18) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa07, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) 12.383435804s ago: executing program 3 (id=538): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x17, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(0x0, 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x4000401}, 0x4c004) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x7, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104}, [@IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}, @IFLA_MASTER={0x8}]}, 0x3c}}, 0x0) 11.460440474s ago: executing program 3 (id=546): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_INO_PATHS(0xffffffffffffffff, 0xc0389423, 0x0) mlockall(0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x28482, 0x0) r1 = accept4$x25(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x80000) ioctl$SIOCX25SFACILITIES(r1, 0x89e3, &(0x7f0000000140)={0x45, 0x7, 0x4, 0x5, 0x7, 0x81}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) write$uinput_user_dev(r3, 0x0, 0x0) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x5) ioctl$UI_DEV_CREATE(r3, 0x5501) read$FUSE(0xffffffffffffffff, 0x0, 0x0) creat(0x0, 0x1c) faccessat2(0xffffffffffffff9c, 0x0, 0x3, 0x0) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000080)={0x0, &(0x7f0000000040)}, 0x10) bind$bt_hci(r2, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$FS_IOC_FSGETXATTR(r0, 0x400455c8, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, r4) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r4, 0x0, 0x890) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 3.919963426s ago: executing program 2 (id=630): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f0000000100)=[{&(0x7f0000000000)="8e", 0x1}], 0x1, 0x8001, 0x80) close(r1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) sendfile(r1, r0, 0x0, 0xf03a0005) 3.898207696s ago: executing program 2 (id=631): syz_emit_ethernet(0x3d, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000000000000800450e002f0067000007069078ac1414bbac", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="600260df"], 0x0) syz_usb_connect$hid(0x0, 0x6c, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000000000040b827ed010000000000010902240001000000000904"], 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2}) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x3, 0xc, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c) sendmmsg$unix(r1, &(0x7f0000007b80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2404c054}}], 0x1, 0x2000c080) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x33, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x584}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 3.361435268s ago: executing program 0 (id=637): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000010340)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x6}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40080c0}, 0x24040084) r4 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0x3}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) 2.468505737s ago: executing program 0 (id=638): r0 = socket$inet(0x2, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000040)={@loopback, @empty, r1}, 0xc) 2.228535802s ago: executing program 0 (id=641): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x100000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x1000000, &(0x7f0000000580)="b3"}) 2.162003313s ago: executing program 0 (id=643): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x8, 0x8}]}) 2.120691044s ago: executing program 1 (id=644): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="89000000120081ae08061cdc030ec080000000030000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120800030006010000bdad446b9bbc7a46e3988285dcdf12f2130809d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff000000000000000000", 0x89}], 0x1}, 0x0) 1.936527199s ago: executing program 0 (id=645): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000680)={0x0, 0x2}, 0x8) sendto$inet6(r0, &(0x7f0000000140)="9f", 0xff80, 0x44005, &(0x7f0000000040)={0xa, 0x4e24, 0x7, @loopback, 0xc5f}, 0x1c) 1.936353399s ago: executing program 1 (id=646): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$GIO_SCRNMAP(r0, 0x4b40, &(0x7f00000001c0)=""/188) 1.808604901s ago: executing program 1 (id=648): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x901800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(r1, 0x4068aea3, &(0x7f0000000280)={0xb6, 0x0, r1}) 1.668471774s ago: executing program 0 (id=649): timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48) socketpair$unix(0x1, 0x2, 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3000001, 0x11, r0, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 1.642877265s ago: executing program 1 (id=650): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x169140, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_HALT_POLL(r1, 0x4068aea3, &(0x7f0000000000)={0xb6, 0x0, 0x2}) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f00000000c0)=0x3) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000880)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1000700000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34cf2645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd673c1eeda4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d06c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235eaa92143ce4bb5c5acb290e8976dcac779ff0000f5620000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05be23dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe656c9c46bffbe9dd03970800000000000000d372bdd6f89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.300433682s ago: executing program 4 (id=652): setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @broadcast}}], 0x1c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 965.846279ms ago: executing program 4 (id=653): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x100000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x1000000, &(0x7f0000000580)="b3"}) 848.336882ms ago: executing program 4 (id=654): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x80400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000004c0)={'pcl812\x00', [0x100, 0xf, 0xd0, 0x2, 0x4, 0x100, 0x3, 0x20000000, 0x8, 0xb, 0x0, 0x7, 0x1, 0x401, 0x10001, 0x1, 0x9, 0x8, 0xfe9, 0x401, 0x0, 0x2, 0x7, 0x9, 0x48, 0x9, 0x7, 0x6a77, 0x5, 0x20007, 0x8]}) read(r0, 0x0, 0x0) 784.913093ms ago: executing program 4 (id=655): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a300000000040000000160a01000000000000000000010000000900010073797a30000000000900020073797a3000000000140003800800024000000000080001400000000040000000180a0101000b000000000000010000000900020073797a30000000000900010073797a300000000014"], 0xc8}}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)=ANY=[], 0x12f4}}, 0x8800) recvmsg$unix(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000240)=""/54, 0x36}], 0x1}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa080045000028006700000a06"], 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8, 0x10, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r6 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r6, &(0x7f0000000240)="800000800000210ee7decd7a000340008100", 0x36, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r5, 0x1, 0xd8, 0x6, @broadcast}, 0x14) 624.505997ms ago: executing program 1 (id=656): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@fd, @flat=@weak_handle={0x77682a85, 0x1}, @flat=@binder={0x73622a85, 0x10b}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 550.521118ms ago: executing program 1 (id=657): openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000000)=0x60) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'wlan0\x00'}) r0 = syz_usb_connect(0x0, 0x3f, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) ioctl$HIDIOCGUSAGE(0xffffffffffffffff, 0x40045b17, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r2, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000000206010800000000000000000000003f0500010006000000050005000200000005000400000000000900020073797a310020000013000300686173683a6e65742c69666163"], 0x4c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000005700)=ANY=[@ANYBLOB="580000000906010200000000000000000200fe01300007800c0001800800014003b70f82140017006261746164765f736c6176655f3000000c00028008000140ac1414bb0900020073797a31000000000500010007"], 0x58}, 0x1, 0x0, 0x0, 0x80}, 0x40c0080) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000040)='FROZEN\x00', 0x7) 496.630739ms ago: executing program 4 (id=658): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$GIO_SCRNMAP(r0, 0x4b40, &(0x7f00000001c0)=""/188) 370.096282ms ago: executing program 4 (id=659): r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000ccb000)={0x2, 0x4e20, @local}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000004680)=ANY=[@ANYBLOB="180000000300000000000000a012544f95002b000000000093adffa82255f674412d020000000000005ab527ee3697f1ed4436dd1164b1b3f427f6ba6b34f98125f30e631d273683626e00dc254d570d4a6b78a5833488cfe410090000004aa900003d3cd62f00158e6eee8501000000520a0000151d010000000100bf000000003bbd424c6e6cafbe9309aba218812868a51d129e78f6ae170bf5a52001a3cd000041f0db74596fd72c002a60c1bc7dc8c38b00f45f70685c6bd9ff41c69b7de4758c1096a1dc52f29e460a000517ebc406e89dcbb7677e6528b0856e31eb9474c0106fc48e1f8c1a5f6945ac24cf609068f6ff21e88b3cfc22df01e4bac9d97328fa2a82b5e8741e02056d933bedf59ff232cebc68b91af50479387467824262852c7939db5672d07cdbe8e148bf56497e5d56d06c7551b870b2851c3f0a1aab71587a21c8f1b3369ebfcb4cb2946601b0f04edb256c604f068773f6db9d661bd7f0e2536f00000000000000005521458b7d1e341c6f864f983d745f5865aad41d29158ae7602a2d6cd41503f1aa3dc7f1580ace9bf2afd28d7157e67fb98d121a96eb372713255012e00300000000000000b35faae176f98b745eda2967199cc93685bb537e8e487166737089df20618cd4acf3e3dc10e13ef227f627a40000ad1fa253d33fa74f172d0007ae4e1e347c0cff28235a6bb7aa3804b907a8f2880c5cb1cb385e6add14652003c7cdd3324f07d134d3ed07f1c10900000009dd872ec64fa6c718bbd1aa591140cff0be4c6f8df08445e9734ae30aa9afdc7125f01ab03a9b1074407136b4506000f0916aada035df2e0452a9b39e73aeeb6eaf14652dda689e2051d9b7eb85f3f2d5aed65201cc2c51944da8d7391d5b6b9741aa3b76600cd1aa0afe5f8f46df4c5124caf673374b371867a79b31c6617fc3327191fbf514573f1e30d1fd2d763f3ee9218b15c1d60be2168fffcd599a2cb77f124e22f87673675805494db821f39b50d938d5fd8c6b2a3a324c257bc97def5f07f2b77f05a4f81a9cf81109715b67ccd74089ed6b86f81ca3d247d8f71d290ed1b1a11f7a67125170c88c3b6a50696332226401b110da9c4407eca22debc99335583b00013c3130978fa069af8223b38ced735c2d90c6d84c30a0d87dc0c102000000000000009ef52134842e64171f3963841086e3797a4825d081f2d987f05c534187738655d7a6240412c8f283cc0c1eba2866dc9580000000000000007fffffffff554b82d9c162f3556076b80552d961ca74f1ffdaccf0ea5f02e0219ccb9087e6c3b3917bb74fd3d560700a1fab44e77e312b3b129e000302d613916c9bcf9f0000fac73a5b6bfb01efada800e50000000000fdaf2f7b3b79a433e08074ea2462974ab2cbd247eb1cfa2638f56daee57ed14bc74de0fd87a9ce638190f3570e0b4c80ef682df22237270955afb6008846557ee3bc09fda6dbb6550d597300eb82a184c96ffde5a30e5433d866665b98ca2002c836e89feef904c22ff2634b7bfbf5c0d586cda5b45fd00dede1e88a4d41dee7cc8d0834fb8d124638fec58faeb4c16abb440df2a694f4cdcaa400d503d79906958102000000000000000000001ffff0ef89b2a68d2bb2dd163e863314e8449801b52bb93f6c9084659ce777dda8563c859656a357770289a61faa95a82b04cfb7f2f97252e9322abe282c3344fc6738b4467893b9bf0d1c8130ae6b00110635376413c29f7c6f7b7e29b9f4bddd5e328661f4615e627a6f608ad53a4168fe8e5d7d934aa289b4bd2b870000000000000000000000000000bc4b4ff50000009b777883a02ffd92dfc4cb4114b9f9cf4ad155110cd3ace2b322ae31bfa27847c799c8869a1ea5b98e525e6383ad7fd9795170e7b11e247603000000001459c7f606d721d3979676bffb3049166ab84ac1061991bd57c2566c10c296352a5105b6164e3f2491e4793e590dcc71f110da96366c40dd44a2c9882d3aa0f8a797b8fea6efcfb5276b7679f15559cdaabf5fc14add71d0bca37405ded69b77ab4a3d7487fd50c5e22adef9546abb9b5fe7f30e4e0c13f60870fde1f88d830b11002135e8e7262f29b6d7923bfbe0bd2a8be179e56b3bff3792cee2fc37eee739c3008ce740d8804f8e705f0dc59d000021363e8df94ff175b48dc8c12def681a11647946595445bf1cb7d2778cd27a6b3b2966b011d193ba8075da1d1da9311a050000ab89524414cae922141f7baf17756c31559907a53581b6ebb790ad60bd03870c39d1ad12c750837e63f9880fd70259e35590afb4843cd4e9989398ea"], &(0x7f00002bf000)='syzkaller\x00', 0x4, 0xb7, &(0x7f0000000040)=""/183, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r1, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="30000000100001000000000000000071ff9aee24", @ANYRES32=0x0, @ANYBLOB="0000000000000000080004000006000008001b"], 0x30}}, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2a}}, 0x7, 0x1, 0xf08, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet6_mreq(r1, 0x29, 0x14, &(0x7f0000000140)={@mcast1}, 0x0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff}, 0x0) splice(r4, 0x0, r1, 0x0, 0x317e, 0x4) write$tun(r2, &(0x7f0000000840)=ANY=[], 0x11b0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000140), 0xeaf7, 0x80000) ioctl$DRM_IOCTL_GET_STATS(r6, 0x80f86406, 0x0) 156.477417ms ago: executing program 2 (id=660): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0xe, 0x0, 0x0) sendmsg$inet6(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000080)="944cf7", 0x3}], 0x1}, 0x20000010) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 144.096837ms ago: executing program 2 (id=661): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_FPU(r2, 0x41a0ae8d, &(0x7f0000000480)={'\x00', 0xd2, 0x400, 0x80, 0x0, 0xfffb, 0xdddd0000, 0x60000, '\x00', 0x200}) 95.191458ms ago: executing program 2 (id=662): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000280)={{0x9000, 0x0, 0xc, 0x6, 0x4, 0xa, 0x3, 0xe, 0x0, 0x1, 0x3, 0x3}, {0x2, 0x1000, 0xe, 0x13, 0x1, 0x8, 0x3, 0x8, 0x0, 0x46, 0x6}, {0x1, 0x315a4c100da1da58, 0x4, 0xf, 0x5, 0xff, 0xc3, 0x6, 0x3, 0x6, 0x1, 0x3}, {0x3000, 0x4000, 0x1a, 0xc, 0x7f, 0x6, 0x8, 0x7f, 0x9, 0x2, 0xf, 0x6}, {0x9000, 0x8000000, 0x0, 0xd, 0x59, 0x2d, 0x5, 0xc, 0xfc, 0x0, 0x3, 0xe5}, {0x2, 0x8092000, 0x8, 0xbd, 0x6, 0x7, 0x12, 0x1, 0xbf, 0x18, 0x2, 0x4}, {0x1, 0x1, 0xc, 0x9, 0x0, 0xf, 0x10, 0x3, 0x4, 0x0, 0x80, 0x9}, {0x26000, 0xffff, 0x10, 0x4, 0x3, 0x3, 0x0, 0xf9, 0x1, 0xfc, 0x0, 0xfe}, {0x4, 0xedd8}, {0xffff1000, 0x17}, 0x4004000f, 0x0, 0xd000, 0x100, 0x100000002, 0x0, 0xdddd1000, [0x5, 0x3, 0x4000000000000009, 0x7]}) r0 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup(r1, &(0x7f0000000040)='syz0\x00', 0x200002, 0x0) openat$cgroup_int(r2, &(0x7f0000000080)='cpu.idle\x00', 0x2, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f00000002c0)=[@code={0xa, 0x5d, {"b8010000000f01c166bad104ec0fdb4d70b99f030000b8feffffffba000000000f300f20578f292098953200000066baf80cb8e68af88def66bafc0c66ed2666420fc737ff4d49c4c155f3e9"}}], 0x5d}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r5, 0x4048ae9b, &(0x7f0000000240)={0xe0003, 0x0, {[0x8, 0x7, 0x4, 0x8, 0x3, 0x8, 0x4, 0x4]}}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 0s ago: executing program 2 (id=663): ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f00000002c0)=@urb_type_bulk={0x3, {0x8, 0x1}, 0x1a, 0x86, &(0x7f0000000100)="e85220364ab0867a3a", 0x9, 0x4, 0xef4, 0xb8a, 0x9, 0x5, 0x0}) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_open_dev$MSR(&(0x7f0000000040), 0x4, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) kernel console output (not intermixed with test programs): ech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 122.166927][ T4637] quatech2 1-1:0.51: device disconnected [ 122.176283][ T4833] netlink: 24 bytes leftover after parsing attributes in process `syz.1.110'. [ 122.267900][ T4848] netlink: 132 bytes leftover after parsing attributes in process `syz.1.110'. [ 122.495421][ T4780] syz.0.101 (4780) used greatest stack depth: 20608 bytes left [ 123.973904][ T4846] loop2: detected capacity change from 0 to 32768 [ 124.024832][ T4852] loop4: detected capacity change from 0 to 32768 [ 124.290336][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 124.310339][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 124.330337][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 124.350336][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 124.380336][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 124.390345][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 124.400337][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 124.410339][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 124.420336][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 124.430336][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #182!!! [ 124.517789][ T4852] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop4 scanned by syz.4.114 (4852) [ 124.548778][ T4852] BTRFS info (device loop4): using sha256 (sha256-avx2) checksum algorithm [ 124.588940][ T4852] BTRFS info (device loop4): using free space tree [ 124.666713][ T4852] BTRFS info (device loop4): has skinny extents [ 124.838525][ T4846] XFS (loop2): Mounting V5 Filesystem [ 125.037033][ T4846] XFS (loop2): log mount failed [ 125.197052][ T4852] BTRFS info (device loop4): enabling ssd optimizations [ 125.300514][ T4825] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 125.505468][ T4825] usb 1-1: device descriptor read/64, error -71 [ 125.780571][ T4825] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 125.970673][ T4825] usb 1-1: device descriptor read/64, error -71 [ 126.101312][ T4825] usb usb1-port1: attempt power cycle [ 126.512579][ T4825] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 126.578976][ T4916] loop3: detected capacity change from 0 to 8 [ 126.599458][ T4918] loop2: detected capacity change from 0 to 512 [ 126.670808][ T4825] usb 1-1: device descriptor read/8, error -71 [ 126.759433][ T4920] loop4: detected capacity change from 0 to 1024 [ 126.961919][ T4920] EXT4-fs (loop4): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000001,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000005,nolazytime,init_itable,. Quota mode: none. [ 127.041623][ T4926] SQUASHFS error: Unable to read directory block [631:26] [ 127.058116][ T4926] SQUASHFS error: Unable to read directory block [631:72] [ 127.065902][ T4926] SQUASHFS error: Unable to read directory block [631:72] [ 127.710383][ T4825] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 127.806677][ T4935] loop2: detected capacity change from 0 to 256 [ 127.811133][ T4825] usb 1-1: device descriptor read/8, error -71 [ 127.898317][ T4935] exFAT-fs (loop2): failed to load upcase table (idx : 0x0001207b, chksum : 0x1e8dde4d, utbl_chksum : 0xe619d30d) [ 127.930615][ T4825] usb usb1-port1: unable to enumerate USB device [ 128.051015][ T4920] netlink: 24 bytes leftover after parsing attributes in process `syz.4.127'. [ 128.085370][ T4943] netlink: 236 bytes leftover after parsing attributes in process `syz.1.131'. [ 128.470336][ C0] hrtimer: interrupt took 58089 ns [ 128.728364][ T4927] netlink: 132 bytes leftover after parsing attributes in process `syz.4.127'. [ 129.240660][ T4909] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 129.601029][ T4909] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 190, changing to 7 [ 129.816385][ T4961] 9pnet_virtio: no channels available for device syz [ 130.010911][ T4909] usb 4-1: New USB device found, idVendor=1604, idProduct=8005, bcdDevice= 0.40 [ 130.085641][ T4909] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.124834][ T4961] process 'syz.2.134' launched './file2' with NULL argv: empty string added [ 130.207844][ T4909] usb 4-1: Product: syz [ 130.241508][ T4909] usb 4-1: Manufacturer: syz [ 130.247396][ T4909] usb 4-1: SerialNumber: syz [ 130.307524][ T4973] loop0: detected capacity change from 0 to 8 [ 130.602403][ T4637] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 130.739381][ T4979] SQUASHFS error: Unable to read directory block [631:26] [ 130.753536][ T4979] SQUASHFS error: Unable to read directory block [631:72] [ 130.761086][ T4979] SQUASHFS error: Unable to read directory block [631:72] [ 130.780661][ T4195] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 130.862664][ T4637] usb 2-1: Using ep0 maxpacket: 8 [ 131.011161][ T4637] usb 2-1: config 2 has an invalid interface number: 31 but max is 0 [ 131.043342][ T4637] usb 2-1: config 2 has no interface number 0 [ 131.102502][ T4637] usb 2-1: config 2 interface 31 has no altsetting 0 [ 131.347644][ T4982] loop3: detected capacity change from 0 to 1024 [ 131.380823][ T4909] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 131.420770][ T4195] usb 3-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 131.430195][ T4637] usb 2-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 131.461027][ T4195] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.469972][ T4637] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.480534][ T4195] usb 3-1: Product: syz [ 131.484853][ T4195] usb 3-1: Manufacturer: syz [ 131.489483][ T4195] usb 3-1: SerialNumber: syz [ 131.495467][ T4637] usb 2-1: Product: syz [ 131.499682][ T4637] usb 2-1: Manufacturer: syz [ 131.505978][ T4637] usb 2-1: SerialNumber: syz [ 131.514078][ T4982] EXT4-fs (loop3): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000001,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000005,nolazytime,init_itable,. Quota mode: none. [ 131.518667][ T4195] usb 3-1: config 0 descriptor?? [ 131.568140][ T4909] snd-usb-audio: probe of 4-1:1.0 failed with error -22 [ 131.801359][ T4909] usb 4-1: USB disconnect, device number 6 [ 131.859642][ T4982] netlink: 132 bytes leftover after parsing attributes in process `syz.3.143'. [ 131.870728][ T4637] ch9200: probe of 2-1:2.31 failed with error -71 [ 131.917522][ T4637] usb 2-1: USB disconnect, device number 3 [ 131.923658][ T4635] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 132.027263][ T4384] udevd[4384]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.1/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 132.061117][ T4993] udevd[4993]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.2/sound/card5/controlC5/../uevent} for writing: No such file or directory [ 132.092740][ T4986] loop4: detected capacity change from 0 to 32768 [ 132.115385][ T4986] XFS (loop4): stripe width (32768) must be a multiple of the stripe unit (7) [ 132.155840][ T4635] usb 1-1: device descriptor read/64, error -71 [ 132.179390][ T4986] nfs4: Unknown parameter 'xfs' [ 132.254671][ T4385] udevd[4385]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 132.286555][ T4195] peak_usb 3-1:0.0: PEAK-System PCAN-USB Pro hwrev 0 serial 00000000.00000000 (2 channels) [ 132.317609][ T4195] peak_usb 3-1:0.0 can0: sending command failure: -22 [ 132.351331][ T4385] udevd[4385]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 132.358531][ T4195] peak_usb 3-1:0.0 can0: sending command failure: -22 [ 132.404910][ T5002] loop3: detected capacity change from 0 to 1024 [ 132.456924][ T4635] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 132.531278][ T5002] EXT4-fs (loop3): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000001,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000005,nolazytime,init_itable,. Quota mode: none. [ 132.569360][ T4195] peak_usb: probe of 3-1:0.0 failed with error -22 [ 132.588129][ T4977] loop2: detected capacity change from 0 to 1156 [ 132.670513][ T4635] usb 1-1: device descriptor read/64, error -71 [ 132.719946][ T5002] netlink: 24 bytes leftover after parsing attributes in process `syz.3.149'. [ 132.745251][ T5002] netlink: 132 bytes leftover after parsing attributes in process `syz.3.149'. [ 132.765323][ T4977] ISOFS: unable to read i-node block [ 132.784002][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.790433][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.802318][ T4977] isofs_fill_super: get root inode failed [ 132.813573][ T4635] usb usb1-port1: attempt power cycle [ 132.882308][ T4909] usb 3-1: USB disconnect, device number 7 [ 132.911732][ T4911] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 133.008175][ T5020] loop4: detected capacity change from 0 to 4096 [ 133.025216][ T5020] EXT4-fs (loop4): inline encryption not supported [ 133.040532][ T5020] EXT4-fs (loop4): mb_optimize_scan should be set to 0 or 1. [ 133.176904][ T5027] mmap: syz.3.165 (5027) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 133.280577][ T4911] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 133.298390][ T4911] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 133.308138][ T4911] usb 2-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 133.400523][ T4635] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 133.431396][ T4909] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 133.521481][ T4911] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 133.558405][ T4911] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.620564][ T4909] usb 3-1: device descriptor read/64, error -71 [ 133.646477][ T4911] usb 2-1: Product: syz [ 133.686198][ T4911] usb 2-1: Manufacturer: syz [ 133.734468][ T4911] usb 2-1: SerialNumber: syz [ 133.900528][ T4909] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 134.093037][ T5009] netlink: 'syz.1.151': attribute type 10 has an invalid length. [ 134.181149][ T5009] team0: Device vxcan1 is of different type [ 134.190369][ T4909] usb 3-1: device descriptor read/64, error -71 [ 134.241164][ T4635] usb 1-1: device descriptor read/8, error -71 [ 134.315082][ T4909] usb usb3-port1: attempt power cycle [ 134.321334][ T4911] usb 2-1: 0:2 : does not exist [ 134.330881][ T5030] loop3: detected capacity change from 0 to 32768 [ 134.373384][ T5030] jfs: Unrecognized mount option "jfs" or missing value [ 134.510837][ T4635] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 134.536186][ T4911] usb 2-1: USB disconnect, device number 4 [ 134.881352][ T4909] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 135.031422][ T4909] usb 3-1: device descriptor read/8, error -71 [ 135.289161][ T5042] loop0: detected capacity change from 0 to 512 [ 135.350876][ T4993] udevd[4993]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 135.420423][ T4909] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 135.488292][ T5042] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 135.510584][ T4909] usb 3-1: device descriptor read/8, error -71 [ 135.550391][ T5042] System zones: 1-12 [ 135.602582][ T5042] EXT4-fs error (device loop0): ext4_orphan_get:1406: inode #15: comm syz.0.159: inode has both inline data and extents flags [ 135.630448][ T4635] usb 1-1: device not accepting address 11, error -71 [ 135.632410][ T4909] usb usb3-port1: unable to enumerate USB device [ 135.645530][ T5042] EXT4-fs error (device loop0): ext4_orphan_get:1411: comm syz.0.159: couldn't read orphan inode 15 (err -117) [ 135.658406][ T4635] usb usb1-port1: unable to enumerate USB device [ 135.725846][ T5042] EXT4-fs (loop0): mounted filesystem without journal. Opts: debug,,errors=continue. Quota mode: writeback. [ 135.983039][ T4192] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 136.290593][ T4192] usb 5-1: Using ep0 maxpacket: 8 [ 136.430910][ T4192] usb 5-1: config 2 has an invalid interface number: 31 but max is 0 [ 136.483531][ T4192] usb 5-1: config 2 has no interface number 0 [ 136.489945][ T4192] usb 5-1: config 2 interface 31 has no altsetting 0 [ 136.603846][ T5070] loop2: detected capacity change from 0 to 256 [ 137.431808][ T5070] exfat: Deprecated parameter 'codepage' [ 137.448695][ T5070] exfat: Bad value for 'codepage' [ 137.674945][ T5077] loop1: detected capacity change from 0 to 8 [ 137.683617][ T4192] usb 5-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 137.840418][ T5078] loop3: detected capacity change from 0 to 2048 [ 138.536422][ T4192] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.557293][ T4192] usb 5-1: Product: syz [ 138.570626][ T5078] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 138.580400][ T5078] NILFS (loop3): mounting unchecked fs [ 138.583730][ T4192] usb 5-1: Manufacturer: syz [ 138.606919][ T4635] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 138.731397][ T5078] NILFS (loop3): recovery complete [ 138.780781][ T5081] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 138.832417][ T4192] usb 5-1: SerialNumber: syz [ 138.890789][ T4192] usb 5-1: can't set config #2, error -71 [ 138.920445][ T4192] usb 5-1: USB disconnect, device number 2 [ 138.990515][ T5087] SQUASHFS error: Unable to read directory block [631:26] [ 139.005371][ T5087] SQUASHFS error: Unable to read directory block [631:72] [ 139.013026][ T5087] SQUASHFS error: Unable to read directory block [631:72] [ 139.040685][ T4909] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 139.320450][ T4909] usb 4-1: device descriptor read/64, error -71 [ 139.474303][ T5093] loop0: detected capacity change from 0 to 1024 [ 139.482279][ T5094] device syzkaller0 entered promiscuous mode [ 139.518103][ T4992] udevd[4992]: setting mode of /dev/bus/usb/005/002 to 020664 failed: No such file or directory [ 139.550981][ T4992] udevd[4992]: setting owner of /dev/bus/usb/005/002 to uid=0, gid=0 failed: No such file or directory [ 139.610578][ T4909] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 139.629409][ T5099] loop1: detected capacity change from 0 to 8192 [ 139.666482][ T5093] EXT4-fs (loop0): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000001,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000005,nolazytime,init_itable,. Quota mode: none. [ 139.799959][ T5109] binder: 5108:5109 ioctl c0306201 200000000440 returned -14 [ 139.800728][ T4635] usb 3-1: device not accepting address 12, error -71 [ 139.811074][ T4909] usb 4-1: device descriptor read/64, error -71 [ 139.951211][ T4909] usb usb4-port1: attempt power cycle [ 139.982312][ T5093] netlink: 132 bytes leftover after parsing attributes in process `syz.0.174'. [ 140.094795][ T5115] loop4: detected capacity change from 0 to 8 [ 140.257729][ T5115] SQUASHFS error: xz decompression failed, data probably corrupt [ 140.286650][ T5115] SQUASHFS error: Failed to read block 0x108: -5 [ 140.330822][ T5115] SQUASHFS error: Unable to read metadata cache entry [106] [ 140.348418][ T5115] SQUASHFS error: Unable to read inode 0x11f [ 140.360403][ T4909] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 140.447601][ T5117] loop0: detected capacity change from 0 to 8192 [ 140.448525][ T5112] loop1: detected capacity change from 0 to 32768 [ 140.462212][ T4909] usb 4-1: device descriptor read/8, error -71 [ 140.595386][ T4385] loop0: p1 p2 < > p3 [ 140.599958][ T4385] loop0: partition table partially beyond EOD, truncated [ 140.634006][ T4385] loop0: p1 size 1342439424 extends beyond EOD, truncated [ 140.651443][ T4385] loop0: p2 start 4059840512 is beyond EOD, truncated [ 140.772434][ T4385] loop0: p3 start 67108864 is beyond EOD, truncated [ 140.780652][ T5119] [ 140.891514][ T5117] loop0: p1 p2 < > p3 [ 140.900767][ T5117] loop0: partition table partially beyond EOD, truncated [ 140.908372][ T5117] loop0: p1 size 1342439424 extends beyond EOD, truncated [ 140.943223][ T5127] overlayfs: failed to resolve './bus': -2 [ 140.954180][ T5117] loop0: p2 start 4059840512 is beyond EOD, truncated [ 140.990967][ T5117] loop0: p3 start 67108864 is beyond EOD, truncated [ 141.040578][ T4192] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 141.257492][ T5129] loop2: detected capacity change from 0 to 1024 [ 141.321176][ T4911] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 141.361535][ T4909] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 141.399606][ T5129] EXT4-fs (loop2): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000001,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000005,nolazytime,init_itable,. Quota mode: none. [ 141.470675][ T4192] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 141.491026][ T4909] usb 4-1: device descriptor read/8, error -71 [ 141.611736][ T4909] usb usb4-port1: unable to enumerate USB device [ 141.710934][ T4911] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 141.759986][ T4911] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 142.041634][ T4911] usb 1-1: New USB device found, idVendor=133e, idProduct=0815, bcdDevice= 0.40 [ 142.087187][ T4911] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.145872][ T4192] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 142.156636][ T4192] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 63137, setting to 1024 [ 142.167934][ T4192] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 142.210895][ T4911] usb 1-1: Product: syz [ 142.215129][ T4911] usb 1-1: Manufacturer: syz [ 142.240572][ T4911] usb 1-1: SerialNumber: syz [ 142.370629][ T4192] usb 5-1: New USB device found, idVendor=0bfd, idProduct=010c, bcdDevice=2d.16 [ 142.379745][ T4192] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.398735][ T5129] netlink: 132 bytes leftover after parsing attributes in process `syz.2.184'. [ 142.421740][ T4192] usb 5-1: Product: syz [ 142.425973][ T4192] usb 5-1: Manufacturer: syz [ 142.440469][ T4192] usb 5-1: SerialNumber: syz [ 142.448962][ T4192] usb 5-1: config 0 descriptor?? [ 142.480787][ T5121] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 142.507182][ T4192] kvaser_usb 5-1:0.0: CMD_MAP_CHANNEL_REQ failed for CAN0 [ 142.515309][ T4192] kvaser_usb 5-1:0.0: Failed to initialize card, error -90 [ 142.523207][ T5117] udc-core: couldn't find an available UDC or it's busy [ 142.530222][ T5117] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 142.543579][ T4192] kvaser_usb: probe of 5-1:0.0 failed with error -90 [ 142.652481][ T4911] snd-usb-audio: probe of 1-1:1.0 failed with error -22 [ 142.681305][ T4911] usb 1-1: USB disconnect, device number 12 [ 142.748377][ T5138] loop1: detected capacity change from 0 to 32768 [ 142.882553][ T4192] usb 5-1: USB disconnect, device number 3 [ 142.900642][ T5138] XFS (loop1): Mounting V5 Filesystem [ 143.308016][ T5138] XFS (loop1): Ending clean mount [ 143.712986][ T5152] loop0: detected capacity change from 0 to 64 [ 143.742886][ T5154] loop2: detected capacity change from 0 to 8 [ 143.783903][ T5156] loop4: detected capacity change from 0 to 8 [ 143.906664][ T4188] XFS (loop1): Unmounting Filesystem [ 144.797941][ T5159] loop0: detected capacity change from 0 to 1024 [ 144.947445][ T5168] loop3: detected capacity change from 0 to 2048 [ 145.085682][ T5168] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 145.095622][ T5168] NILFS (loop3): mounting unchecked fs [ 145.171897][ T5168] NILFS (loop3): recovery complete [ 145.276115][ T5169] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 145.380836][ T5159] EXT4-fs (loop0): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000001,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000005,nolazytime,init_itable,. Quota mode: none. [ 145.590481][ T4825] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 145.623890][ T5174] Zero length message leads to an empty skb [ 145.738617][ T5159] netlink: 132 bytes leftover after parsing attributes in process `syz.0.191'. [ 145.783841][ T4825] usb 4-1: device descriptor read/64, error -71 [ 146.060525][ T4825] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 146.078113][ T5186] FAULT_INJECTION: forcing a failure. [ 146.078113][ T5186] name failslab, interval 1, probability 0, space 0, times 1 [ 146.160820][ T5186] CPU: 1 PID: 5186 Comm: syz.0.197 Not tainted syzkaller #0 [ 146.168278][ T5186] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 146.178498][ T5186] Call Trace: [ 146.181834][ T5186] [ 146.184806][ T5186] dump_stack_lvl+0x188/0x250 [ 146.189649][ T5186] ? show_regs_print_info+0x20/0x20 [ 146.194911][ T5186] ? load_image+0x410/0x410 [ 146.199562][ T5186] ? __might_sleep+0xf0/0xf0 [ 146.204213][ T5186] ? __lock_acquire+0x7b50/0x7b50 [ 146.209302][ T5186] should_fail+0x383/0x4b0 [ 146.213775][ T5186] should_failslab+0x5/0x20 [ 146.218452][ T5186] slab_pre_alloc_hook+0x51/0xc0 [ 146.223435][ T5186] kmem_cache_alloc_node+0x47/0x2c0 [ 146.228681][ T5186] ? __alloc_skb+0xf4/0x750 [ 146.233240][ T5186] __alloc_skb+0xf4/0x750 [ 146.237803][ T5186] alloc_skb_with_frags+0xa7/0x720 [ 146.242973][ T5186] ? print_unlock_imbalance_bug+0x160/0x160 [ 146.248917][ T5186] sock_alloc_send_pskb+0x87f/0x9a0 [ 146.254177][ T5186] ? lock_chain_count+0x20/0x20 [ 146.259136][ T5186] ? sock_kzfree_s+0x50/0x50 [ 146.260756][ T4825] usb 4-1: device descriptor read/64, error -71 [ 146.263773][ T5186] ? __local_bh_enable_ip+0x136/0x1c0 [ 146.263799][ T5186] ? _local_bh_enable+0xa0/0xa0 [ 146.263830][ T5186] dccp_sendmsg+0x34a/0x8d0 [ 146.284955][ T5186] ? dccp_getsockopt+0xc60/0xc60 [ 146.289966][ T5186] ? sock_rps_record_flow+0x17/0x3b0 [ 146.295307][ T5186] ? inet_sendmsg+0x7a/0x2a0 [ 146.300022][ T5186] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 146.305353][ T5186] ? inet_send_prepare+0x250/0x250 [ 146.310590][ T5186] ____sys_sendmsg+0x5be/0x8f0 [ 146.315406][ T5186] ? __sys_sendmsg_sock+0x30/0x30 [ 146.320482][ T5186] ? import_iovec+0x6f/0xa0 [ 146.325026][ T5186] ___sys_sendmsg+0x236/0x2e0 [ 146.329758][ T5186] ? __sys_sendmsg+0x290/0x290 [ 146.334697][ T5186] __sys_sendmmsg+0x2ba/0x500 [ 146.339429][ T5186] ? __ia32_sys_sendmsg+0x80/0x80 [ 146.344520][ T5186] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 146.350551][ T5186] ? lock_chain_count+0x20/0x20 [ 146.355458][ T5186] __x64_sys_sendmmsg+0x9c/0xb0 [ 146.360363][ T5186] do_syscall_64+0x4c/0xa0 [ 146.364938][ T5186] ? clear_bhb_loop+0x30/0x80 [ 146.369657][ T5186] ? clear_bhb_loop+0x30/0x80 [ 146.374380][ T5186] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 146.380417][ T5186] RIP: 0033:0x7f5c99429e59 [ 146.384870][ T5186] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 146.391066][ T4825] usb usb4-port1: attempt power cycle [ 146.404511][ T5186] RSP: 002b:00007f5c97682028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 146.404542][ T5186] RAX: ffffffffffffffda RBX: 00007f5c996b1fa0 RCX: 00007f5c99429e59 [ 146.404558][ T5186] RDX: 0000000000000001 RSI: 0000200000000500 RDI: 0000000000000004 [ 146.404571][ T5186] RBP: 00007f5c97682090 R08: 0000000000000000 R09: 0000000000000000 [ 146.404584][ T5186] R10: 00000000200488c4 R11: 0000000000000246 R12: 0000000000000001 [ 146.404597][ T5186] R13: 00007f5c996b2038 R14: 00007f5c996b1fa0 R15: 00007ffc38465768 [ 146.404627][ T5186] [ 147.836847][ T5202] netlink: 91 bytes leftover after parsing attributes in process `syz.4.201'. [ 147.848694][ T5210] loop0: detected capacity change from 0 to 8 [ 147.883918][ T5211] loop3: detected capacity change from 0 to 8 [ 148.720592][ T5214] SQUASHFS error: Unable to read directory block [631:26] [ 149.050734][ T5223] loop3: detected capacity change from 0 to 1024 [ 149.106616][ T5225] netlink: 8 bytes leftover after parsing attributes in process `syz.2.209'. [ 149.720183][ T5225] loop2: detected capacity change from 0 to 4096 [ 149.739923][ T5223] EXT4-fs (loop3): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000001,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000005,nolazytime,init_itable,. Quota mode: none. [ 149.871498][ T5225] ntfs3: loop2: Different NTFS' sector size (2048) and media sector size (512) [ 149.941464][ T5206] loop1: detected capacity change from 0 to 32768 [ 150.097693][ T5223] netlink: 132 bytes leftover after parsing attributes in process `syz.3.207'. [ 150.451259][ T5245] FAULT_INJECTION: forcing a failure. [ 150.451259][ T5245] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 150.541102][ T5245] CPU: 1 PID: 5245 Comm: syz.3.211 Not tainted syzkaller #0 [ 150.548478][ T5245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 150.558570][ T5245] Call Trace: [ 150.561884][ T5245] [ 150.564854][ T5245] dump_stack_lvl+0x188/0x250 [ 150.569579][ T5245] ? show_regs_print_info+0x20/0x20 [ 150.574844][ T5245] ? load_image+0x410/0x410 [ 150.579393][ T5245] ? __lock_acquire+0x7b50/0x7b50 [ 150.584550][ T5245] should_fail+0x383/0x4b0 [ 150.589012][ T5245] _copy_from_user+0x2e/0x170 [ 150.593747][ T5245] ___sys_recvmsg+0x173/0x5c0 [ 150.598565][ T5245] ? __sys_recvmsg+0x280/0x280 [ 150.603369][ T5245] ? __lock_acquire+0x7b50/0x7b50 [ 150.608524][ T5245] ? vfs_write+0xaa6/0xd70 [ 150.612983][ T5245] ? __fget_files+0x402/0x470 [ 150.617707][ T5245] __x64_sys_recvmsg+0x201/0x2d0 [ 150.622683][ T5245] ? ___sys_recvmsg+0x5c0/0x5c0 [ 150.627568][ T5245] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 150.633687][ T5245] ? lockdep_hardirqs_on+0x94/0x140 [ 150.639009][ T5245] do_syscall_64+0x4c/0xa0 [ 150.643460][ T5245] ? clear_bhb_loop+0x30/0x80 [ 150.648343][ T5245] ? clear_bhb_loop+0x30/0x80 [ 150.653048][ T5245] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 150.658976][ T5245] RIP: 0033:0x7f1cfce29e59 [ 150.663431][ T5245] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 150.683067][ T5245] RSP: 002b:00007f1cfb082028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 150.691529][ T5245] RAX: ffffffffffffffda RBX: 00007f1cfd0b1fa0 RCX: 00007f1cfce29e59 [ 150.699533][ T5245] RDX: 0000000040002020 RSI: 00002000000025c0 RDI: 0000000000000004 [ 150.707543][ T5245] RBP: 00007f1cfb082090 R08: 0000000000000000 R09: 0000000000000000 [ 150.715545][ T5245] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 150.723544][ T5245] R13: 00007f1cfd0b2038 R14: 00007f1cfd0b1fa0 R15: 00007ffef59bcdd8 [ 150.731560][ T5245] [ 151.143595][ T5255] loop0: detected capacity change from 0 to 2048 [ 151.457545][ T5247] tipc: Enabling of bearer rejected, failed to enable media [ 151.482471][ T5255] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 151.492240][ T5255] NILFS (loop0): mounting unchecked fs [ 151.515483][ T5255] NILFS (loop0): recovery complete [ 151.599045][ T5258] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 151.646559][ T5262] netlink: 40 bytes leftover after parsing attributes in process `syz.2.213'. [ 151.787489][ T5263] loop3: detected capacity change from 0 to 8 [ 152.202384][ T5266] SQUASHFS error: Unable to read directory block [631:26] [ 152.692687][ T4824] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 152.773063][ T5269] loop2: detected capacity change from 0 to 8 [ 152.878539][ T5271] loop3: detected capacity change from 0 to 8 [ 152.890409][ T4824] usb 1-1: device descriptor read/64, error -71 [ 153.410920][ T5273] SQUASHFS error: Unable to read directory block [631:26] [ 153.604443][ T4824] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 154.158985][ T5284] loop3: detected capacity change from 0 to 1024 [ 154.322423][ T5287] loop2: detected capacity change from 0 to 2048 [ 154.373724][ T5287] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 154.384206][ T5287] NILFS (loop2): mounting unchecked fs [ 154.477677][ T5287] NILFS (loop2): recovery complete [ 154.572777][ T5289] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 154.703852][ T5284] EXT4-fs (loop3): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000001,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000005,nolazytime,init_itable,. Quota mode: none. [ 155.487977][ T5294] netlink: 132 bytes leftover after parsing attributes in process `syz.3.222'. [ 155.731872][ T5299] netlink: 'syz.1.224': attribute type 9 has an invalid length. [ 156.161832][ T5303] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 156.388936][ T5286] loop0: detected capacity change from 0 to 32768 [ 156.484406][ T5310] loop3: detected capacity change from 0 to 256 [ 156.581849][ T5314] loop4: detected capacity change from 0 to 8 [ 156.887245][ T5310] FAT-fs (loop3): Directory bread(block 64) failed [ 156.967706][ T5310] FAT-fs (loop3): Directory bread(block 65) failed [ 156.974848][ T5310] FAT-fs (loop3): Directory bread(block 66) failed [ 156.990581][ T5310] FAT-fs (loop3): Directory bread(block 67) failed [ 157.503203][ T5322] loop1: detected capacity change from 0 to 2048 [ 157.555726][ T5310] FAT-fs (loop3): Directory bread(block 68) failed [ 157.780702][ T5310] FAT-fs (loop3): Directory bread(block 69) failed [ 157.823821][ T5322] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 157.833526][ T5322] NILFS (loop1): mounting unchecked fs [ 157.844667][ T5310] FAT-fs (loop3): Directory bread(block 70) failed [ 157.901120][ T5310] FAT-fs (loop3): Directory bread(block 71) failed [ 157.924375][ T5322] NILFS (loop1): recovery complete [ 157.930841][ T5310] FAT-fs (loop3): Directory bread(block 72) failed [ 157.940571][ T5325] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 157.990533][ T5310] FAT-fs (loop3): Directory bread(block 73) failed [ 158.241785][ T4175] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 158.320159][ T5329] FAULT_INJECTION: forcing a failure. [ 158.320159][ T5329] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 158.334023][ T5329] CPU: 0 PID: 5329 Comm: syz.4.233 Not tainted syzkaller #0 [ 158.341362][ T5329] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 158.351460][ T5329] Call Trace: [ 158.354767][ T5329] [ 158.357731][ T5329] dump_stack_lvl+0x188/0x250 [ 158.362464][ T5329] ? show_regs_print_info+0x20/0x20 [ 158.367707][ T5329] ? load_image+0x410/0x410 [ 158.372256][ T5329] ? __lock_acquire+0x7b50/0x7b50 [ 158.377307][ T5329] ? mark_lock+0x94/0x320 [ 158.381659][ T5329] should_fail+0x383/0x4b0 [ 158.386104][ T5329] prepare_alloc_pages+0x1e3/0x5b0 [ 158.391238][ T5329] __alloc_pages+0x11b/0x480 [ 158.395989][ T5329] ? zone_statistics+0x170/0x170 [ 158.400961][ T5329] alloc_pages_vma+0x2bc/0x790 [ 158.405744][ T5329] wp_page_copy+0x252/0x2090 [ 158.410357][ T5329] ? __lock_acquire+0x7b50/0x7b50 [ 158.415496][ T5329] ? insert_page_into_pte_locked+0x470/0x470 [ 158.421493][ T5329] ? _raw_spin_unlock+0x24/0x40 [ 158.426365][ T5329] ? do_wp_page+0x965/0xb30 [ 158.430891][ T5329] handle_mm_fault+0x1fbd/0x4440 [ 158.435944][ T5329] ? get_page+0xe0/0xe0 [ 158.440122][ T5329] ? follow_page_mask+0xa51/0x12b0 [ 158.445260][ T5329] __get_user_pages+0x952/0x11e0 [ 158.450232][ T5329] ? populate_vma_page_range+0x290/0x290 [ 158.455890][ T5329] ? read_lock_is_recursive+0x10/0x10 [ 158.461295][ T5329] populate_vma_page_range+0x213/0x290 [ 158.466870][ T5329] __mm_populate+0x275/0x3b0 [ 158.471483][ T5329] ? check_vma_flags+0x470/0x470 [ 158.476612][ T5329] ? up_write+0x1b6/0x410 [ 158.480956][ T5329] do_mlock+0x49c/0x550 [ 158.485134][ T5329] __x64_sys_mlock+0x5c/0x70 [ 158.489741][ T5329] do_syscall_64+0x4c/0xa0 [ 158.494176][ T5329] ? clear_bhb_loop+0x30/0x80 [ 158.498867][ T5329] ? clear_bhb_loop+0x30/0x80 [ 158.503557][ T5329] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 158.509462][ T5329] RIP: 0033:0x7f19077f5e59 [ 158.513989][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.533620][ T5329] RSP: 002b:00007f1905a2d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000095 [ 158.542065][ T5329] RAX: ffffffffffffffda RBX: 00007f1907a7e090 RCX: 00007f19077f5e59 [ 158.550244][ T5329] RDX: 0000000000000000 RSI: 0000000000400000 RDI: 0000200000c00000 [ 158.558231][ T5329] RBP: 00007f1905a2d090 R08: 0000000000000000 R09: 0000000000000000 [ 158.566216][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 158.574199][ T5329] R13: 00007f1907a7e128 R14: 00007f1907a7e090 R15: 00007fff6261ea98 [ 158.582200][ T5329] [ 158.820791][ T4175] usb 2-1: device descriptor read/64, error -71 [ 159.035103][ T5336] loop0: detected capacity change from 0 to 2048 [ 159.579464][ T5336] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 159.589332][ T5336] NILFS (loop0): mounting unchecked fs [ 159.611552][ T4175] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 159.659212][ T5336] NILFS (loop0): recovery complete [ 159.708350][ T5337] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 159.741482][ T5339] loop4: detected capacity change from 0 to 256 [ 159.911469][ T4175] usb 2-1: device descriptor read/64, error -71 [ 159.991620][ T5339] exFAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 160.031448][ T4175] usb usb2-port1: attempt power cycle [ 160.036387][ T5339] exFAT-fs (loop4): Medium has reported failures. Some data may be lost. [ 160.201420][ T5341] loop0: detected capacity change from 0 to 512 [ 160.259410][ T5339] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 160.362228][ T5339] exFAT-fs (loop4): failed to exfat_utf8_to_utf16 (estr:ENAMETOOLONG) nls len : 260, unilen : 257 > 255 [ 160.416792][ T5341] EXT4-fs error (device loop0): __ext4_iget:4919: inode #11: block 1: comm syz.0.237: invalid block [ 160.660705][ T5339] netlink: 8 bytes leftover after parsing attributes in process `syz.4.236'. [ 160.727816][ T5341] EXT4-fs error (device loop0): ext4_orphan_get:1411: comm syz.0.237: couldn't read orphan inode 11 (err -117) [ 160.819283][ T5341] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 160.851628][ T5334] loop3: detected capacity change from 0 to 32768 [ 160.920825][ T5341] netlink: 132 bytes leftover after parsing attributes in process `syz.0.237'. [ 161.221078][ T4175] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 161.231725][ T5363] loop0: detected capacity change from 0 to 8 [ 161.668699][ T5377] SQUASHFS error: Unable to read directory block [631:26] [ 161.680410][ T5377] SQUASHFS error: Unable to read directory block [631:72] [ 161.687798][ T5377] SQUASHFS error: Unable to read directory block [631:72] [ 162.943100][ T5389] loop0: detected capacity change from 0 to 2048 [ 163.066889][ T5352] loop1: detected capacity change from 0 to 32768 [ 163.169260][ T5389] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 163.179097][ T5389] NILFS (loop0): mounting unchecked fs [ 163.245098][ T5389] NILFS (loop0): recovery complete [ 163.377551][ T5390] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 163.640742][ T4910] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 163.660556][ T4195] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 163.802110][ T5352] (syz.1.240,5352,1):ocfs2_initialize_super:2313 ERROR: status = -12 [ 163.848284][ T5352] (syz.1.240,5352,1):ocfs2_fill_super:1177 ERROR: status = -12 [ 163.860122][ T4195] usb 5-1: device descriptor read/64, error -71 [ 164.062760][ T5395] loop3: detected capacity change from 0 to 2048 [ 164.169895][ T5395] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 164.179913][ T5395] NILFS (loop3): mounting unchecked fs [ 164.253941][ T5395] NILFS (loop3): recovery complete [ 164.270520][ T4195] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 164.348314][ T5396] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 164.542408][ T4175] usb 2-1: device descriptor read/8, error -71 [ 164.580628][ T4195] usb 5-1: device descriptor read/64, error -71 [ 164.701486][ T4195] usb usb5-port1: attempt power cycle [ 164.760413][ T4910] usb 1-1: device descriptor read/64, error -71 [ 165.130733][ T4195] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 165.295728][ T5398] loop3: detected capacity change from 0 to 8192 [ 165.682132][ T4910] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 165.709351][ T5398] REISERFS (device loop3): found reiserfs format "3.5" with non-standard journal [ 165.754619][ T4195] usb 5-1: device descriptor read/8, error -71 [ 165.780035][ T5398] REISERFS (device loop3): using ordered data mode [ 165.798412][ T5398] reiserfs: using flush barriers [ 165.848958][ T5398] REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 165.931298][ T5398] REISERFS (device loop3): checking transaction log (loop3) [ 165.968821][ T5414] netlink: 8 bytes leftover after parsing attributes in process `syz.1.256'. [ 165.991694][ T5414] netlink: 16 bytes leftover after parsing attributes in process `syz.1.256'. [ 166.013767][ T5398] REISERFS (device loop3): Using r5 hash to sort names [ 166.048296][ T5398] REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage. [ 166.080713][ T5417] loop1: detected capacity change from 0 to 64 [ 166.091616][ T5416] netlink: 4 bytes leftover after parsing attributes in process `syz.0.253'. [ 166.131020][ T5416] device team1 entered promiscuous mode [ 166.137177][ T5416] 8021q: adding VLAN 0 to HW filter on device team1 [ 166.152600][ T5417] hfs: umask requires a value [ 166.163256][ T5417] hfs: unable to parse mount options [ 166.287161][ T5420] capability: warning: `syz.4.258' uses 32-bit capabilities (legacy support in use) [ 166.612807][ T5411] loop2: detected capacity change from 0 to 32768 [ 166.757069][ T5427] loop1: detected capacity change from 0 to 2048 [ 167.459459][ T5427] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 167.469743][ T5427] NILFS (loop1): mounting unchecked fs [ 167.476574][ T5411] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop2 scanned by syz.2.255 (5411) [ 167.504925][ T5427] NILFS (loop1): recovery complete [ 167.527379][ T5411] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 167.537649][ T5431] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 167.600531][ T5411] BTRFS error (device loop2): superblock checksum mismatch [ 167.771105][ T5411] BTRFS error (device loop2): open_ctree failed: -22 [ 168.555455][ T4993] udevd[4993]: incorrect btrfs checksum on /dev/loop2 [ 168.565018][ T4637] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 168.890478][ T4637] usb 2-1: device descriptor read/64, error -71 [ 168.994460][ T5440] loop2: detected capacity change from 0 to 4096 [ 169.160501][ T4637] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 169.238601][ T5440] tmpfs: Bad value for 'mpol' [ 169.281794][ T5444] loop3: detected capacity change from 0 to 8 [ 169.432317][ T4637] usb 2-1: device descriptor read/64, error -71 [ 169.570611][ T4637] usb usb2-port1: attempt power cycle [ 170.045038][ T5446] SQUASHFS error: Unable to read directory block [631:26] [ 170.387555][ T5452] loop1: detected capacity change from 0 to 2048 [ 170.426986][ T5452] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 170.436696][ T5452] NILFS (loop1): mounting unchecked fs [ 170.453858][ T5452] NILFS (loop1): recovery complete [ 170.496376][ T5453] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 170.533777][ T5455] loop3: detected capacity change from 0 to 64 [ 170.780612][ T4910] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 170.970472][ T4910] usb 2-1: device descriptor read/64, error -71 [ 171.240450][ T4910] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 171.346680][ T5473] loop3: detected capacity change from 0 to 128 [ 171.392981][ T5473] EXT4-fs (loop3): Test dummy encryption mode enabled [ 171.480402][ T4910] usb 2-1: device descriptor read/64, error -71 [ 171.501465][ T5473] EXT4-fs (loop3): mounted filesystem without journal. Opts: test_dummy_encryption=v1,max_dir_size_kb=0x0000000000000002,,errors=continue. Quota mode: none. [ 171.600701][ T4910] usb usb2-port1: attempt power cycle [ 171.609823][ T5473] ext4 filesystem being mounted at /50/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 171.976439][ T5473] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 172.015712][ T4910] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 172.099961][ T5471] loop4: detected capacity change from 0 to 32768 [ 172.110649][ T4910] usb 2-1: device descriptor read/8, error -71 [ 172.228913][ T5471] XFS (loop4): Mounting V5 Filesystem [ 172.400362][ T4910] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 172.440711][ T5471] XFS (loop4): Ending clean mount [ 172.524028][ T5471] XFS (loop4): Quotacheck needed: Please wait. [ 172.658520][ T4910] usb 2-1: device descriptor read/8, error -71 [ 172.728417][ T5471] XFS (loop4): Quotacheck: Done. [ 172.894969][ T4910] usb usb2-port1: unable to enumerate USB device [ 173.572437][ T5508] loop0: detected capacity change from 0 to 2048 [ 173.916055][ T5508] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 173.927369][ T5508] NILFS (loop0): mounting unchecked fs [ 173.947576][ T5508] NILFS (loop0): recovery complete [ 173.990645][ T5511] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 174.093004][ T4186] XFS (loop4): Unmounting Filesystem [ 174.170972][ T4191] ntfs3: loop2: ntfs_evict_inode r=5 failed, -22. [ 174.177877][ T4191] ntfs3: loop2: Mark volume as dirty due to NTFS errors [ 174.941575][ T5529] loop1: detected capacity change from 0 to 128 [ 175.125721][ T5529] EXT4-fs (loop1): Test dummy encryption mode enabled [ 175.195580][ T5529] EXT4-fs (loop1): mounted filesystem without journal. Opts: test_dummy_encryption=v1,max_dir_size_kb=0x0000000000000002,,errors=continue. Quota mode: none. [ 175.230750][ T5529] ext4 filesystem being mounted at /56/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 176.165984][ T5548] loop4: detected capacity change from 0 to 2048 [ 176.243116][ T5546] loop2: detected capacity change from 0 to 2048 [ 176.412151][ T5546] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 176.423244][ T5546] NILFS (loop2): mounting unchecked fs [ 176.468155][ T5548] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 1024) [ 176.477966][ T5548] NILFS (loop4): mounting unchecked fs [ 176.486760][ T5546] NILFS (loop2): recovery complete [ 176.530719][ T5549] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 176.562967][ T5548] NILFS (loop4): recovery complete [ 176.577925][ T5542] loop3: detected capacity change from 0 to 4096 [ 176.590421][ T5550] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 176.827746][ T5553] tmpfs: Bad value for 'mpol' [ 176.840451][ T4824] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 177.031560][ T4824] usb 3-1: device descriptor read/64, error -71 [ 177.170491][ T4195] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 177.300545][ T4824] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 177.520463][ T4824] usb 3-1: device descriptor read/64, error -71 [ 177.651280][ T4824] usb usb3-port1: attempt power cycle [ 178.038003][ T5559] 9pnet: Insufficient options for proto=fd [ 178.049927][ T5559] loop4: detected capacity change from 0 to 512 [ 178.060466][ T4824] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 178.130397][ T4195] usb 2-1: Using ep0 maxpacket: 8 [ 178.160652][ T4824] usb 3-1: device descriptor read/8, error -71 [ 178.344233][ T4195] usb 2-1: config 2 has an invalid interface number: 31 but max is 0 [ 178.352975][ T4195] usb 2-1: config 2 has no interface number 0 [ 178.359861][ T4195] usb 2-1: config 2 interface 31 has no altsetting 0 [ 178.570701][ T4195] usb 2-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 178.579797][ T4195] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 178.610360][ T4195] usb 2-1: Product: syz [ 178.614700][ T4195] usb 2-1: Manufacturer: syz [ 178.619320][ T4195] usb 2-1: SerialNumber: syz [ 178.677800][ T5570] loop0: detected capacity change from 0 to 2048 [ 178.775759][ T5570] loop0: p4 < > [ 178.960593][ T4195] ch9200: probe of 2-1:2.31 failed with error -71 [ 178.988311][ T4195] usb 2-1: USB disconnect, device number 16 [ 179.080116][ T5574] loop0: detected capacity change from 0 to 764 [ 179.135424][ T5574] rock: directory entry would overflow storage [ 179.172283][ T5574] rock: sig=0x4654, size=5, remaining=4 [ 179.194281][ T5574] overlayfs: option "workdir=./file1\" is useless in a non-upper mount, ignore [ 179.213821][ T5574] overlayfs: missing 'lowerdir' [ 179.236034][ T5564] loop4: detected capacity change from 0 to 32768 [ 179.337263][ T5565] loop2: detected capacity change from 0 to 32768 [ 179.385817][ T4993] BTRFS: device fsid 384aeb47-f1c2-4293-8350-e6dffa96895f devid 1 transid 8 /dev/loop4 scanned by udevd (4993) [ 179.520399][ T4911] usb 1-1: new full-speed USB device number 17 using dummy_hcd [ 179.820725][ T4911] usb 1-1: device descriptor read/64, error -71 [ 180.130539][ T4911] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 180.412172][ T4189] ntfs3: loop3: ntfs_evict_inode r=5 failed, -22. [ 180.418668][ T4189] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 180.484185][ T5583] loop4: detected capacity change from 0 to 8 [ 180.530448][ T4911] usb 1-1: device descriptor read/64, error -71 [ 180.651254][ T4911] usb usb1-port1: attempt power cycle [ 181.060452][ T4911] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 181.291462][ T4911] usb 1-1: device descriptor read/8, error -71 [ 181.576094][ T5590] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 181.584084][ T4911] usb 1-1: new full-speed USB device number 20 using dummy_hcd [ 181.613938][ T5590] device batadv_slave_1 entered promiscuous mode [ 181.751641][ T4911] usb 1-1: device descriptor read/8, error -71 [ 181.870873][ T4911] usb usb1-port1: unable to enumerate USB device [ 182.253599][ T5597] loop2: detected capacity change from 0 to 2048 [ 182.409211][ T5593] loop1: detected capacity change from 0 to 64 [ 182.455151][ T5597] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 182.465095][ T5597] NILFS (loop2): mounting unchecked fs [ 182.517937][ T5597] NILFS (loop2): recovery complete [ 182.586648][ T5598] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 182.897694][ T4637] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 183.130160][ T4637] usb 3-1: device descriptor read/64, error -71 [ 183.227089][ T5608] loop4: detected capacity change from 0 to 1024 [ 183.301262][ T5608] EXT4-fs (loop4): Quota format mount options ignored when QUOTA feature is enabled [ 183.514442][ T5608] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 183.534209][ T5621] netlink: 4 bytes leftover after parsing attributes in process `syz.0.307'. [ 183.562202][ T5608] EXT4-fs (loop4): orphan cleanup on readonly fs [ 183.600672][ T4637] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 183.663148][ T5608] EXT4-fs error (device loop4): ext4_free_blocks:6231: comm syz.4.306: Freeing blocks not in datazone - block = 0, count = 4096 [ 183.976462][ T5608] EXT4-fs (loop4): Remounting filesystem read-only [ 184.155886][ T5608] EXT4-fs (loop4): 1 orphan inode deleted [ 184.213295][ T5608] EXT4-fs (loop4): mounted filesystem without journal. Opts: errors=remount-ro,barrier=0x0000000000000000,barrier=0x0000000000000009,init_itable=0x0000000000007ab4,jqfmt=vfsv0,. Quota mode: writeback. [ 184.426236][ T5606] EXT4-fs error (device loop4): ext4_lookup:1858: inode #15: comm syz.4.306: iget: bad i_size value: 1970324836974602 [ 184.520555][ T4637] usb 3-1: device descriptor read/64, error -71 [ 184.542704][ T4828] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 184.650535][ T4637] usb usb3-port1: attempt power cycle [ 184.808100][ T5630] loop4: detected capacity change from 0 to 4096 [ 184.814839][ T4828] usb 1-1: Using ep0 maxpacket: 8 [ 184.930510][ T4828] usb 1-1: config 2 has an invalid interface number: 31 but max is 0 [ 184.941479][ T4828] usb 1-1: config 2 has no interface number 0 [ 184.947810][ T4828] usb 1-1: config 2 interface 31 has no altsetting 0 [ 185.359547][ T5634] loop2: detected capacity change from 0 to 2048 [ 185.404938][ T5634] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 185.415642][ T5634] NILFS (loop2): mounting unchecked fs [ 185.471519][ T5634] NILFS (loop2): recovery complete [ 185.613540][ T5635] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 185.717175][ T5628] loop1: detected capacity change from 0 to 32768 [ 185.844172][ T5636] tmpfs: Bad value for 'mpol' [ 186.010499][ T4828] usb 1-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 186.021026][ T4828] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.029067][ T4828] usb 1-1: Product: syz [ 186.045436][ T4828] usb 1-1: Manufacturer: syz [ 186.050115][ T4828] usb 1-1: SerialNumber: syz [ 186.122699][ T4186] ntfs3: loop4: ntfs_evict_inode r=5 failed, -22. [ 186.139301][ T4186] ntfs3: loop4: Mark volume as dirty due to NTFS errors [ 186.437929][ T4175] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 186.866070][ T5648] loop3: detected capacity change from 0 to 2048 [ 188.080544][ T4828] ch9200: probe of 1-1:2.31 failed with error -71 [ 188.114915][ T4828] usb 1-1: USB disconnect, device number 21 [ 188.179089][ T5648] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 188.188906][ T5648] NILFS (loop3): mounting unchecked fs [ 188.202787][ T5648] NILFS (loop3): recovery complete [ 188.242883][ T5654] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 188.493959][ T5664] Illegal XDP return value 4294967274, expect packet loss! [ 188.521415][ T5664] loop1: detected capacity change from 0 to 2048 [ 189.235213][ T5676] loop4: detected capacity change from 0 to 2048 [ 189.360402][ T4637] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 189.510003][ T5676] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 1024) [ 189.519738][ T5676] NILFS (loop4): mounting unchecked fs [ 189.538473][ T5676] NILFS (loop4): recovery complete [ 189.552307][ T5675] loop2: detected capacity change from 0 to 1024 [ 189.559791][ T5664] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 189.574342][ T5683] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 189.595784][ T5675] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 189.661751][ T5675] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 189.672290][ T5664] netlink: 'syz.1.318': attribute type 3 has an invalid length. [ 189.681067][ T5675] EXT4-fs (loop2): orphan cleanup on readonly fs [ 189.686978][ T5664] netlink: 'syz.1.318': attribute type 3 has an invalid length. [ 189.797181][ T5675] EXT4-fs error (device loop2): ext4_free_blocks:6231: comm syz.2.321: Freeing blocks not in datazone - block = 0, count = 4096 [ 189.842992][ T5675] EXT4-fs (loop2): Remounting filesystem read-only [ 189.870517][ T4192] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 189.883145][ T5675] EXT4-fs (loop2): 1 orphan inode deleted [ 189.888940][ T5675] EXT4-fs (loop2): mounted filesystem without journal. Opts: errors=remount-ro,barrier=0x0000000000000000,barrier=0x0000000000000009,init_itable=0x0000000000007ab4,jqfmt=vfsv0,. Quota mode: writeback. [ 189.953141][ T5666] EXT4-fs error (device loop2): ext4_lookup:1858: inode #15: comm syz.2.321: iget: bad i_size value: 1970324836974602 [ 190.108874][ T5688] loop3: detected capacity change from 0 to 2048 [ 190.180689][ T4192] usb 5-1: device descriptor read/64, error -71 [ 190.263664][ T5688] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 190.273497][ T5688] NILFS (loop3): mounting unchecked fs [ 190.327433][ T5688] NILFS (loop3): recovery complete [ 190.437884][ T5689] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 190.481208][ T4192] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 190.753966][ T5680] loop0: detected capacity change from 0 to 32768 [ 190.770936][ T4192] usb 5-1: device descriptor read/64, error -71 [ 190.863932][ T5696] netlink: 4 bytes leftover after parsing attributes in process `syz.3.328'. [ 190.900546][ T4192] usb usb5-port1: attempt power cycle [ 191.019940][ T5699] futex_wake_op: syz.2.326 tries to shift op by -1; fix this program [ 191.260610][ T4911] Bluetooth: hci4: command 0x0406 tx timeout [ 191.274791][ T4911] Bluetooth: hci0: command 0x0406 tx timeout [ 191.708412][ T4911] Bluetooth: hci3: command 0x0406 tx timeout [ 191.824799][ T4911] Bluetooth: hci2: command 0x0406 tx timeout [ 191.868839][ T5702] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 191.980523][ T4192] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 191.993946][ T4911] Bluetooth: hci1: command 0x0406 tx timeout [ 192.311293][ T4192] usb 5-1: device not accepting address 10, error -71 [ 192.467983][ T5693] loop1: detected capacity change from 0 to 32768 [ 193.627747][ T5739] loop3: detected capacity change from 0 to 1024 [ 193.818597][ T5743] loop0: detected capacity change from 0 to 2048 [ 193.985405][ T5743] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 193.995697][ T5743] NILFS (loop0): mounting unchecked fs [ 194.045400][ T5739] EXT4-fs (loop3): Quota format mount options ignored when QUOTA feature is enabled [ 194.077229][ T5743] NILFS (loop0): recovery complete [ 194.113239][ T5741] loop2: detected capacity change from 0 to 2048 [ 194.182671][ T5744] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 194.298057][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.305347][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.341517][ T5739] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 194.375503][ T5739] EXT4-fs (loop3): orphan cleanup on readonly fs [ 194.493109][ T5739] EXT4-fs error (device loop3): ext4_free_blocks:6231: comm syz.3.337: Freeing blocks not in datazone - block = 0, count = 4096 [ 194.552639][ T5739] EXT4-fs (loop3): Remounting filesystem read-only [ 194.559558][ T5739] EXT4-fs (loop3): 1 orphan inode deleted [ 194.579972][ T5739] EXT4-fs (loop3): mounted filesystem without journal. Opts: errors=remount-ro,barrier=0x0000000000000000,barrier=0x0000000000000009,init_itable=0x0000000000007ab4,jqfmt=vfsv0,. Quota mode: writeback. [ 194.640823][ T5741] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 194.766881][ T5753] loop1: detected capacity change from 0 to 2048 [ 194.853236][ T5753] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 194.863832][ T5753] NILFS (loop1): mounting unchecked fs [ 194.944527][ T5753] NILFS (loop1): recovery complete [ 195.078709][ T5754] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 195.340505][ T4911] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 195.428607][ T5733] netlink: 'syz.2.347': attribute type 3 has an invalid length. [ 195.436615][ T5733] netlink: 'syz.2.347': attribute type 3 has an invalid length. [ 195.481834][ T5730] EXT4-fs error (device loop3): ext4_lookup:1858: inode #15: comm syz.3.337: iget: bad i_size value: 1970324836974602 [ 195.544236][ T5757] netlink: 4 bytes leftover after parsing attributes in process `syz.4.341'. [ 195.590396][ T4911] usb 2-1: device descriptor read/64, error -71 [ 195.634240][ T5758] loop0: detected capacity change from 0 to 1024 [ 195.722492][ T5758] EXT4-fs (loop0): test_dummy_encryption requires encrypt feature [ 195.860366][ T4911] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 196.623074][ T4911] usb 2-1: device descriptor read/64, error -71 [ 196.631248][ T5768] loop3: detected capacity change from 0 to 2048 [ 196.688342][ T5768] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 196.698202][ T5768] NILFS (loop3): mounting unchecked fs [ 196.726735][ T5768] NILFS (loop3): recovery complete [ 196.737955][ T5769] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 196.742741][ T4911] usb usb2-port1: attempt power cycle [ 196.859141][ T5771] loop4: detected capacity change from 0 to 1024 [ 196.977759][ T5771] EXT4-fs (loop4): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000001,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000005,nolazytime,init_itable,. Quota mode: none. [ 197.110384][ T4825] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 197.250443][ T4911] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 197.300436][ T4825] usb 4-1: device descriptor read/64, error -71 [ 197.314512][ T5771] netlink: 132 bytes leftover after parsing attributes in process `syz.4.345'. [ 197.391085][ T5775] loop0: detected capacity change from 0 to 32768 [ 197.441204][ T4911] usb 2-1: device descriptor read/8, error -71 [ 197.443158][ T5765] loop2: detected capacity change from 0 to 32768 [ 197.496724][ T5765] XFS (loop2): invalid log iosize: 0 [not 12-30] [ 197.567371][ T5775] XFS (loop0): Mounting V5 Filesystem [ 197.600691][ T4825] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 197.817379][ T4825] usb 4-1: device descriptor read/64, error -71 [ 197.943689][ T4825] usb usb4-port1: attempt power cycle [ 198.098748][ T5775] XFS (loop0): Tail block (0x40) overwrite detected. Updated to 0x80 [ 198.370714][ T4825] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 198.497797][ T5775] XFS (loop0): Starting recovery (logdev: internal) [ 198.541569][ T5775] XFS (loop0): Ending recovery (logdev: internal) [ 198.560596][ T4825] usb 4-1: device descriptor read/8, error -71 [ 198.910747][ T4825] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 198.990392][ T4911] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 199.150355][ T4825] usb 4-1: device not accepting address 18, error -71 [ 199.160648][ T4825] usb usb4-port1: unable to enumerate USB device [ 199.182011][ T4637] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 199.360512][ T4911] usb 2-1: config 251 has an invalid interface number: 154 but max is 0 [ 199.369041][ T4911] usb 2-1: config 251 has no interface number 0 [ 199.376318][ T4911] usb 2-1: config 251 interface 154 has no altsetting 0 [ 199.570684][ T4911] usb 2-1: New USB device found, idVendor=041e, idProduct=4051, bcdDevice=6a.3e [ 199.579881][ T4911] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.587998][ T4911] usb 2-1: Product: syz [ 199.592661][ T4911] usb 2-1: Manufacturer: syz [ 199.597291][ T4911] usb 2-1: SerialNumber: syz [ 199.700593][ T4637] usb 5-1: New USB device found, idVendor=0c72, idProduct=0012, bcdDevice=22.96 [ 199.709804][ T4637] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.717931][ T4637] usb 5-1: Product: syz [ 199.722183][ T4637] usb 5-1: Manufacturer: syz [ 199.726797][ T4637] usb 5-1: SerialNumber: syz [ 199.740840][ T4637] usb 5-1: config 0 descriptor?? [ 199.845482][ T5795] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1303 [ 200.010509][ T4637] peak_usb 5-1:0.0 can0: unable to request usb[type=0 value=1] err=-71 [ 200.019020][ T4637] peak_usb 5-1:0.0: unable to read PCAN-USB FD firmware info (err -71) [ 200.072912][ T4637] peak_usb: probe of 5-1:0.0 failed with error -71 [ 200.086899][ T4911] gspca_main: gspca_zc3xx-2.14.0 probing 041e:4051 [ 200.093685][ T4637] usb 5-1: USB disconnect, device number 12 [ 200.140653][ T4911] gspca_zc3xx: reg_w_i err -71 [ 200.145749][ T4911] gspca_zc3xx: probe of 2-1:251.154 failed with error -71 [ 200.163413][ T4911] usb 2-1: USB disconnect, device number 22 [ 200.362063][ T4187] XFS (loop0): Unmounting Filesystem [ 200.437393][ T5819] loop2: detected capacity change from 0 to 1024 [ 200.662145][ T5819] overlayfs: missing 'lowerdir' [ 200.863595][ T5829] loop2: detected capacity change from 0 to 1024 [ 201.066423][ T5837] loop0: detected capacity change from 0 to 1024 [ 201.077595][ T5835] loop1: detected capacity change from 0 to 256 [ 201.237429][ T5843] loop3: detected capacity change from 0 to 2048 [ 201.310706][ T5843] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 201.320936][ T5843] NILFS (loop3): mounting unchecked fs [ 201.393506][ T5843] NILFS (loop3): recovery complete [ 201.552486][ T5844] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 201.635691][ T5837] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 201.647098][ T5835] exFAT-fs (loop1): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 201.676157][ T5829] EXT4-fs (loop2): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000001,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000005,nolazytime,init_itable,. Quota mode: none. [ 201.703405][ C1] vkms_vblank_simulate: vblank timer overrun [ 201.820682][ T4637] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 201.862348][ T4911] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 201.891478][ T5837] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 201.921202][ T5837] EXT4-fs (loop0): orphan cleanup on readonly fs [ 201.940736][ T5837] EXT4-fs error (device loop0): ext4_free_blocks:6231: comm syz.0.354: Freeing blocks not in datazone - block = 0, count = 4096 [ 201.955564][ T5829] netlink: 132 bytes leftover after parsing attributes in process `syz.2.359'. [ 201.984623][ T5837] EXT4-fs (loop0): Remounting filesystem read-only [ 202.006120][ T5837] EXT4-fs (loop0): 1 orphan inode deleted [ 202.036622][ T5837] EXT4-fs (loop0): mounted filesystem without journal. Opts: errors=remount-ro,barrier=0x0000000000000000,barrier=0x0000000000000009,init_itable=0x0000000000007ab4,jqfmt=vfsv0,. Quota mode: writeback. [ 202.041286][ T4637] usb 4-1: device descriptor read/64, error -71 [ 202.130638][ T4911] usb 5-1: Using ep0 maxpacket: 32 [ 202.236807][ T5851] loop1: detected capacity change from 0 to 512 [ 202.266723][ T5833] EXT4-fs error (device loop0): ext4_lookup:1858: inode #15: comm syz.0.354: iget: bad i_size value: 1970324836974602 [ 202.340348][ T4911] usb 5-1: unable to get BOS descriptor or descriptor too short [ 202.418553][ T5851] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a806e02c, mo2=0002] [ 202.440631][ T4911] usb 5-1: config 128 has an invalid interface number: 127 but max is 3 [ 202.459667][ T5851] System zones: 1-12 [ 202.471802][ T4911] usb 5-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 202.506700][ T5851] EXT4-fs error (device loop1): dx_probe:823: inode #2: comm syz.1.362: Directory hole found for htree index block 0 [ 202.531038][ T4911] usb 5-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 202.554811][ T4911] usb 5-1: config 128 has no interface number 0 [ 202.567320][ T5851] EXT4-fs (loop1): Remounting filesystem read-only [ 202.574215][ T4911] usb 5-1: config 128 interface 127 altsetting 14 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 202.592353][ T5851] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -117 [ 202.604683][ T5851] EXT4-fs error (device loop1): dx_probe:823: inode #2: comm syz.1.362: Directory hole found for htree index block 0 [ 202.610540][ T5854] loop2: detected capacity change from 0 to 32768 [ 202.626805][ T4637] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 202.627701][ T4911] usb 5-1: config 128 interface 127 altsetting 14 endpoint 0x5 has invalid wMaxPacketSize 0 [ 202.644460][ T5851] EXT4-fs (loop1): Remounting filesystem read-only [ 202.652609][ T5851] EXT4-fs (loop1): Cannot turn on journaled quota: type 1: error -117 [ 202.658619][ T4911] usb 5-1: config 128 interface 127 has no altsetting 0 [ 202.660963][ T5851] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpjquota=Jdebug,jqfmt=vfsold,noquota,bsdgroups,usrjquota="nojournal_checksum,errors=remount-ro,,. Quota mode: writeback. [ 202.700218][ T5849] EXT4-fs (loop1): shut down requested (2) [ 202.749296][ T5854] XFS (loop2): Mounting V5 Filesystem [ 202.825855][ T4637] usb 4-1: device descriptor read/64, error -71 [ 202.877738][ T5854] XFS (loop2): Ending clean mount [ 202.889633][ T5854] XFS (loop2): Quotacheck needed: Please wait. [ 202.901394][ T4911] usb 5-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 202.921406][ T4911] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.930247][ T4911] usb 5-1: Product: syz [ 202.934779][ T4911] usb 5-1: Manufacturer: syz [ 202.939435][ T4911] usb 5-1: SerialNumber: syz [ 202.965647][ T4637] usb usb4-port1: attempt power cycle [ 202.985372][ T5854] XFS (loop2): Quotacheck: Done. [ 203.026537][ T5867] device syzkaller0 entered promiscuous mode [ 203.160619][ T4825] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 203.219766][ T5825] udc-core: couldn't find an available UDC or it's busy [ 203.481800][ T5825] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 203.716382][ T4191] XFS (loop2): Unmounting Filesystem [ 203.780802][ T4637] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 203.820768][ T4825] usb 1-1: Using ep0 maxpacket: 16 [ 203.940752][ T4825] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 203.962480][ T4637] usb 4-1: device descriptor read/8, error -71 [ 203.976326][ T4825] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 204.006188][ T4911] usb 5-1: USB disconnect, device number 13 [ 204.046418][ T4825] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 204.083288][ T4825] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 204.093577][ T4825] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 204.182050][ T4825] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 204.197780][ T4825] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 204.217231][ T4825] usb 1-1: Manufacturer: syz [ 204.228982][ T4825] usb 1-1: config 0 descriptor?? [ 204.237526][ T5872] udc-core: couldn't find an available UDC or it's busy [ 204.248903][ T5872] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 204.273265][ T4993] udevd[4993]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 204.311096][ T5875] binder: 5874:5875 ioctl c00c620f 200000002980 returned -22 [ 204.410448][ T21] usb 3-1: new low-speed USB device number 21 using dummy_hcd [ 204.506154][ T5865] udc-core: couldn't find an available UDC or it's busy [ 204.511977][ T5877] loop1: detected capacity change from 0 to 2048 [ 204.523701][ T5865] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 204.530641][ T4637] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 204.571194][ T5877] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 204.591261][ T5877] netlink: 'syz.1.370': attribute type 3 has an invalid length. [ 204.599375][ T5877] netlink: 'syz.1.370': attribute type 3 has an invalid length. [ 204.607316][ T4911] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 204.741198][ T4637] usb 4-1: config 0 has an invalid interface number: 168 but max is 0 [ 204.749470][ T4637] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 204.774432][ T4637] usb 4-1: config 0 has no interface number 0 [ 204.786755][ T4637] usb 4-1: config 0 interface 168 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 204.797104][ T4637] usb 4-1: config 0 interface 168 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 16 [ 204.816951][ T4637] usb 4-1: New USB device found, idVendor=0959, idProduct=2bd0, bcdDevice=48.98 [ 204.826853][ T4637] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.843526][ T4637] usb 4-1: config 0 descriptor?? [ 204.850825][ T21] usb 3-1: unable to get BOS descriptor or descriptor too short [ 204.883226][ T4637] HFC-S_USB: probe of 4-1:0.168 failed with error -5 [ 205.060521][ T21] usb 3-1: config 248 has an invalid interface number: 54 but max is 0 [ 205.072326][ T21] usb 3-1: config 248 has no interface number 0 [ 205.079277][ T21] usb 3-1: config 248 interface 54 altsetting 127 has an invalid endpoint with address 0x80, skipping [ 205.093869][ T21] usb 3-1: config 248 interface 54 altsetting 127 endpoint 0x6 has invalid maxpacket 544, setting to 8 [ 205.109724][ T21] usb 3-1: config 248 interface 54 altsetting 127 has an invalid endpoint with address 0x0, skipping [ 205.122878][ T21] usb 3-1: config 248 interface 54 altsetting 127 endpoint 0x2 has invalid wMaxPacketSize 0 [ 205.132119][ T4828] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 205.133296][ T21] usb 3-1: config 248 interface 54 altsetting 127 has an invalid endpoint with address 0xB6, skipping [ 205.152123][ T21] usb 3-1: config 248 interface 54 altsetting 127 has an invalid endpoint with address 0x0, skipping [ 205.163445][ T21] usb 3-1: config 248 interface 54 has no altsetting 0 [ 205.183827][ T4909] usb 4-1: USB disconnect, device number 22 [ 205.211482][ T4911] usb 5-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 205.220980][ T4911] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.229973][ T4911] usb 5-1: Product: syz [ 205.235009][ T4911] usb 5-1: Manufacturer: syz [ 205.239660][ T4911] usb 5-1: SerialNumber: syz [ 205.410479][ T21] usb 3-1: string descriptor 0 read error: -22 [ 205.416787][ T21] usb 3-1: New USB device found, idVendor=9022, idProduct=d630, bcdDevice=1d.fe [ 205.426515][ T21] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.451364][ T5870] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 205.472572][ T21] dvb-usb: found a 'TeVii S630 USB' in cold state, will try to load a firmware [ 205.539314][ T21] usb 3-1: Direct firmware load for dvb-usb-s630.fw failed with error -2 [ 205.548040][ T21] usb 3-1: Falling back to sysfs fallback for: dvb-usb-s630.fw [ 205.551090][ T4828] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 205.570604][ T4828] usb 2-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 205.581089][ T4828] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 205.592139][ T4828] usb 2-1: config 220 has no interface number 2 [ 205.608035][ T4828] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 205.627227][ T4911] usb 5-1: 1:1 : incorrect wMaxPacketSize for BADD profile [ 205.637897][ T4828] usb 2-1: config 220 interface 0 has no altsetting 0 [ 205.656107][ T4911] usb 5-1: incorrect wMaxPacketSize 0x400 for BADD profile [ 205.666670][ T4828] usb 2-1: config 220 interface 76 has no altsetting 0 [ 205.690755][ T4828] usb 2-1: config 220 interface 1 has no altsetting 0 [ 205.718712][ T4911] snd-usb-audio: probe of 5-1:1.0 failed with error -22 [ 205.744915][ T5870] loop2: detected capacity change from 0 to 4096 [ 205.751141][ T4911] usb 5-1: USB disconnect, device number 14 [ 205.768783][ T5870] ntfs3: Unknown parameter 'c3¹ïòšJkZMz€žzõòB â%ƒ<Í4-(ð<ô0ÛÔ¢Š$Ñ‘/æÌ3#©1]ú5šº¼¼ƒIÉ@t‰àS ¶' [ 205.883284][ T4828] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 205.899442][ T4828] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.913828][ T4828] usb 2-1: Product: syz [ 205.918318][ T4828] usb 2-1: Manufacturer: syz [ 205.926327][ T4828] usb 2-1: SerialNumber: syz [ 205.930632][ T4637] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 205.981534][ T4993] udevd[4993]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 206.013130][ T5887] loop0: detected capacity change from 0 to 1024 [ 206.104602][ T5887] EXT4-fs (loop0): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000001,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000005,nolazytime,init_itable,. Quota mode: none. [ 206.111296][ T4825] rc_core: IR keymap rc-hauppauge not found [ 206.137974][ T4825] Registered IR keymap rc-empty [ 206.145094][ T4825] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 206.177633][ T5887] netlink: 132 bytes leftover after parsing attributes in process `syz.0.373'. [ 206.187084][ T4637] usb 4-1: Using ep0 maxpacket: 8 [ 206.192256][ T4825] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 206.222856][ T4825] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 206.248826][ T4825] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input5 [ 206.269128][ T4825] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 206.311068][ T4825] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 206.330619][ T4637] usb 4-1: config 2 has an invalid interface number: 31 but max is 0 [ 206.333862][ T4828] usb 2-1: selecting invalid altsetting 0 [ 206.344980][ T4825] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 206.353100][ T4637] usb 4-1: config 2 has no interface number 0 [ 206.359256][ T4637] usb 4-1: config 2 interface 31 has no altsetting 0 [ 206.360551][ T4828] usb 2-1: Found UVC 7.01 device syz (8086:0b07) [ 206.376949][ T4828] usb 2-1: No valid video chain found. [ 206.383042][ T4825] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 206.420636][ T4825] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 206.460520][ T4825] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 206.491627][ T4828] usb 2-1: selecting invalid altsetting 0 [ 206.498215][ T4825] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 206.507140][ T4828] usbtest: probe of 2-1:220.1 failed with error -22 [ 206.519426][ T4828] usb 2-1: USB disconnect, device number 23 [ 206.530597][ T4637] usb 4-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 206.539864][ T4825] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 206.547081][ T4637] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.560409][ T4637] usb 4-1: Product: syz [ 206.572346][ T4637] usb 4-1: Manufacturer: syz [ 206.573088][ T4825] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 206.583485][ T4637] usb 4-1: SerialNumber: syz [ 206.630630][ T4825] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 206.824333][ T4825] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 206.832526][ T4825] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 206.843990][ T4825] usb 1-1: USB disconnect, device number 22 [ 206.870565][ T4637] ch9200: probe of 4-1:2.31 failed with error -71 [ 207.022052][ T5908] loop0: detected capacity change from 0 to 2048 [ 207.094916][ T5908] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 207.105036][ T5908] NILFS (loop0): mounting unchecked fs [ 207.173536][ T5908] NILFS (loop0): recovery complete [ 207.213295][ T4637] usb 4-1: USB disconnect, device number 23 [ 207.283213][ T5909] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 207.763075][ T5913] loop4: detected capacity change from 0 to 512 [ 207.783278][ T5911] loop3: detected capacity change from 0 to 512 [ 207.855875][ T5913] EXT4-fs error (device loop4): ext4_orphan_get:1406: inode #15: comm syz.4.381: inode has both inline data and extents flags [ 207.905194][ T5913] EXT4-fs error (device loop4): ext4_orphan_get:1411: comm syz.4.381: couldn't read orphan inode 15 (err -117) [ 207.938295][ T5911] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 207.953813][ T5911] ext4 filesystem being mounted at /73/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 207.964705][ T5913] EXT4-fs (loop4): mounted filesystem without journal. Opts: nobarrier,,errors=continue. Quota mode: writeback. [ 208.006756][ T5905] loop1: detected capacity change from 0 to 32768 [ 208.032007][ T5913] device veth1_to_bond entered promiscuous mode [ 208.083072][ T5905] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.379 (5905) [ 208.095649][ T4825] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 208.108402][ T5918] netlink: 32 bytes leftover after parsing attributes in process `syz.4.381'. [ 208.181637][ T5912] device veth1_to_bond left promiscuous mode [ 208.253545][ T5905] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 208.312914][ T5905] BTRFS info (device loop1): setting nodatasum [ 208.324823][ T5905] BTRFS info (device loop1): force zlib compression, level 3 [ 208.338451][ T4825] usb 1-1: device descriptor read/64, error -71 [ 208.351532][ T5905] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_LZO (0x8) [ 208.367645][ T5905] BTRFS info (device loop1): use lzo compression, level 0 [ 208.375406][ T5905] BTRFS info (device loop1): turning on flush-on-commit [ 208.390317][ T5905] BTRFS info (device loop1): enabling auto defrag [ 208.400130][ T5905] BTRFS info (device loop1): max_inline at 4096 [ 208.426979][ T5905] BTRFS info (device loop1): using free space tree [ 208.439935][ T5905] BTRFS info (device loop1): has skinny extents [ 208.468383][ T5925] loop3: detected capacity change from 0 to 1024 [ 208.512339][ T5925] EXT4-fs (loop3): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000001,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000005,nolazytime,init_itable,. Quota mode: none. [ 208.597279][ T5925] netlink: 132 bytes leftover after parsing attributes in process `syz.3.385'. [ 208.610641][ T4825] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 208.656777][ T5905] BTRFS info (device loop1): enabling ssd optimizations [ 208.710552][ T4911] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 208.840371][ T4825] usb 1-1: device descriptor read/64, error -71 [ 208.920401][ T4911] usb 5-1: device descriptor read/64, error -71 [ 208.970531][ T4825] usb usb1-port1: attempt power cycle [ 209.070642][ T5948] loop3: detected capacity change from 0 to 32768 [ 209.093952][ T5948] XFS (loop3): Mounting V5 Filesystem [ 209.154359][ T5948] XFS (loop3): Tail block (0x40) overwrite detected. Updated to 0x80 [ 209.177640][ T5948] XFS (loop3): Starting recovery (logdev: internal) [ 209.189495][ T5948] XFS (loop3): Ending recovery (logdev: internal) [ 209.210383][ T4911] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 209.390490][ T4825] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 209.434346][ T4911] usb 5-1: device descriptor read/64, error -71 [ 209.506469][ T4825] usb 1-1: device descriptor read/8, error -71 [ 209.555033][ T4911] usb usb5-port1: attempt power cycle [ 209.965910][ T5965] loop0: detected capacity change from 0 to 4096 [ 210.040444][ T4911] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 210.054838][ T5965] EXT4-fs (loop0): Ignoring removed oldalloc option [ 210.070406][ T5965] EXT4-fs (loop0): Ignoring removed orlov option [ 210.085625][ T5970] netlink: 6692 bytes leftover after parsing attributes in process `syz.1.387'. [ 210.134353][ T5965] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpid,noblock_validity,nodioread_nolock,stripe=0x0000000000000002,oldalloc,stripe=0x0000000000000000,minixdf,orlov,,errors=continue. Quota mode: writeback. [ 210.202921][ T4911] usb 5-1: device descriptor read/8, error -71 [ 210.510490][ T4911] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 210.596500][ T5977] loop2: detected capacity change from 0 to 32768 [ 210.699557][ T5977] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 210.708211][ T5977] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 210.734461][ T5977] gfs2: fsid=syz:syz.0: journal 0 mapped with 9 extents in 0ms [ 210.750754][ T4637] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 210.750948][ T4911] usb 5-1: device descriptor read/8, error -71 [ 210.757838][ T4637] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 210.817217][ T5981] dlm: dev_write: no op 10 0 [ 210.845042][ T5981] loop1: detected capacity change from 0 to 2048 [ 210.871058][ T4637] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 113ms [ 210.879440][ T4637] gfs2: fsid=syz:syz.0: jid=0: Done [ 210.887349][ T5977] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 211.004840][ T4911] usb usb5-port1: unable to enumerate USB device [ 211.012059][ T5988] loop0: detected capacity change from 0 to 512 [ 211.093279][ T5977] gfs2: fsid=syz:syz.0: found 1 quota changes [ 211.124193][ T5988] EXT4-fs (loop0): Mount option "noacl" will be removed by 3.5 [ 211.124193][ T5988] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 211.124193][ T5988] [ 211.144835][ T5977] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error [ 211.144835][ T5977] inode = 11 2339 [ 211.144835][ T5977] function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 410 [ 211.164625][ T5977] gfs2: fsid=syz:syz.0: about to withdraw this file system [ 211.183758][ T5977] gfs2: fsid=syz:syz.0: warning: assertion "!qd->qd_change" failed at function = gfs2_quota_cleanup, file = fs/gfs2/quota.c, line = 1485 [ 211.197982][ T5977] CPU: 1 PID: 5977 Comm: syz.2.393 Not tainted syzkaller #0 [ 211.205328][ T5977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 211.215442][ T5977] Call Trace: [ 211.218941][ T5977] [ 211.221959][ T5977] dump_stack_lvl+0x188/0x250 [ 211.226747][ T5977] ? show_regs_print_info+0x20/0x20 [ 211.232000][ T5977] ? load_image+0x410/0x410 [ 211.236563][ T5977] ? do_raw_spin_unlock+0x11d/0x230 [ 211.241820][ T5977] gfs2_assert_warn_i+0x187/0x2c0 [ 211.245280][ T5981] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 211.246898][ T5977] gfs2_quota_cleanup+0x48c/0x670 [ 211.262569][ T5977] gfs2_make_fs_ro+0x440/0x620 [ 211.267388][ T5977] ? __might_sleep+0xf0/0xf0 [ 211.272033][ T5977] ? gfs2_dinode_out+0xb00/0xb00 [ 211.277117][ T5977] ? _raw_spin_unlock+0x24/0x40 [ 211.282022][ T5977] ? gfs2_glock_nq+0xcaa/0x1510 [ 211.286957][ T5977] gfs2_withdraw+0x660/0x14e0 [ 211.291700][ T5977] ? gfs2_meta_new+0x160/0x160 [ 211.296531][ T5977] ? gfs2_lm+0x240/0x240 [ 211.300829][ T5977] ? gfs2_freeze_lock+0x52/0xc0 [ 211.305734][ T5977] ? gfs2_consist_inode_i+0xc0/0xe0 [ 211.310986][ T5977] gfs2_inode_refresh+0xb2d/0x11a0 [ 211.314097][ T5988] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 211.316146][ T5977] ? gfs2_inode_metasync+0xf0/0xf0 [ 211.316189][ T5977] inode_go_lock+0x127/0x450 [ 211.339139][ T5977] do_promote+0x75b/0xb20 [ 211.343540][ T5977] finish_xmote+0x4c2/0xaf0 [ 211.348105][ T5977] do_xmote+0x752/0x10a0 [ 211.352419][ T5977] gfs2_glock_nq+0xc6b/0x1510 [ 211.357171][ T5977] do_sync+0x49c/0xba0 [ 211.361303][ T5977] ? slot_put+0x1e0/0x1e0 [ 211.365690][ T5977] ? __lock_acquire+0x7b50/0x7b50 [ 211.370775][ T5977] ? do_raw_spin_lock+0x128/0x2f0 [ 211.375851][ T5977] ? do_sync+0x494/0xba0 [ 211.380151][ T5977] ? do_raw_spin_unlock+0x11d/0x230 [ 211.385421][ T5977] gfs2_quota_sync+0x355/0x780 [ 211.390246][ T5977] gfs2_sync_fs+0x48/0xb0 [ 211.394626][ T5977] sync_filesystem+0xe6/0x220 [ 211.399356][ T5977] gfs2_reconfigure+0x11a/0xd80 [ 211.404265][ T5977] ? shrink_dcache_sb+0x385/0x3d0 [ 211.409343][ T5977] ? gfs2_get_tree+0x1e0/0x1e0 [ 211.414257][ T5977] ? dentry_lru_isolate+0x2e0/0x2e0 [ 211.419517][ T5977] ? hook_sb_remount+0x19/0xc0 [ 211.424355][ T5977] reconfigure_super+0x224/0x8d0 [ 211.429359][ T5977] path_mount+0xc5a/0xfe0 [ 211.433753][ T5977] ? user_path_at_empty+0x13e/0x190 [ 211.439008][ T5977] __se_sys_mount+0x2e3/0x3d0 [ 211.443747][ T5977] ? __x64_sys_mount+0xc0/0xc0 [ 211.448569][ T5977] ? lockdep_hardirqs_on+0x94/0x140 [ 211.453825][ T5977] ? __x64_sys_mount+0x1c/0xc0 [ 211.458630][ T5977] do_syscall_64+0x4c/0xa0 [ 211.463063][ T5977] ? clear_bhb_loop+0x30/0x80 [ 211.467779][ T5977] ? clear_bhb_loop+0x30/0x80 [ 211.472467][ T5977] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 211.478376][ T5977] RIP: 0033:0x7f65e789fe59 [ 211.482802][ T5977] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 211.502576][ T5977] RSP: 002b:00007f65e5af8028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 211.511088][ T5977] RAX: ffffffffffffffda RBX: 00007f65e7b27fa0 RCX: 00007f65e789fe59 [ 211.519070][ T5977] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000000 [ 211.527056][ T5977] RBP: 00007f65e7935e6f R08: 0000000000000000 R09: 0000000000000000 [ 211.535046][ T5977] R10: 0000000002b90026 R11: 0000000000000246 R12: 0000000000000000 [ 211.543033][ T5977] R13: 00007f65e7b28038 R14: 00007f65e7b27fa0 R15: 00007ffe8acdce38 [ 211.551056][ T5977] [ 211.555934][ T5977] gfs2: fsid=syz:syz.0: Journal recovery skipped for jid 0 until next mount. [ 211.564751][ T5977] gfs2: fsid=syz:syz.0: Glock dequeues delayed: 0 [ 211.573392][ T5977] gfs2: fsid=syz:syz.0: File system withdrawn [ 211.579470][ T5977] CPU: 1 PID: 5977 Comm: syz.2.393 Not tainted syzkaller #0 [ 211.586757][ T5977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 211.596927][ T5977] Call Trace: [ 211.600219][ T5977] [ 211.603175][ T5977] dump_stack_lvl+0x188/0x250 [ 211.607866][ T5977] ? show_regs_print_info+0x20/0x20 [ 211.613244][ T5977] ? load_image+0x410/0x410 [ 211.617766][ T5977] ? lockref_put_or_lock+0x6e/0xb0 [ 211.622916][ T5977] gfs2_withdraw+0xb9a/0x14e0 [ 211.627604][ T5977] ? gfs2_meta_new+0x160/0x160 [ 211.632375][ T5977] ? gfs2_lm+0x240/0x240 [ 211.636629][ T5977] ? gfs2_consist_inode_i+0xc0/0xe0 [ 211.641838][ T5977] gfs2_inode_refresh+0xb2d/0x11a0 [ 211.646977][ T5977] ? gfs2_inode_metasync+0xf0/0xf0 [ 211.652121][ T5977] inode_go_lock+0x127/0x450 [ 211.656822][ T5977] do_promote+0x75b/0xb20 [ 211.661184][ T5977] finish_xmote+0x4c2/0xaf0 [ 211.665699][ T5977] do_xmote+0x752/0x10a0 [ 211.669971][ T5977] gfs2_glock_nq+0xc6b/0x1510 [ 211.674678][ T5977] do_sync+0x49c/0xba0 [ 211.678757][ T5977] ? slot_put+0x1e0/0x1e0 [ 211.683091][ T5977] ? __lock_acquire+0x7b50/0x7b50 [ 211.688211][ T5977] ? do_raw_spin_lock+0x128/0x2f0 [ 211.693260][ T5977] ? do_sync+0x494/0xba0 [ 211.697526][ T5977] ? do_raw_spin_unlock+0x11d/0x230 [ 211.702741][ T5977] gfs2_quota_sync+0x355/0x780 [ 211.707535][ T5977] gfs2_sync_fs+0x48/0xb0 [ 211.711873][ T5977] sync_filesystem+0xe6/0x220 [ 211.716553][ T5977] gfs2_reconfigure+0x11a/0xd80 [ 211.721407][ T5977] ? shrink_dcache_sb+0x385/0x3d0 [ 211.726439][ T5977] ? gfs2_get_tree+0x1e0/0x1e0 [ 211.731278][ T5977] ? dentry_lru_isolate+0x2e0/0x2e0 [ 211.736503][ T5977] ? hook_sb_remount+0x19/0xc0 [ 211.741286][ T5977] reconfigure_super+0x224/0x8d0 [ 211.746245][ T5977] path_mount+0xc5a/0xfe0 [ 211.750588][ T5977] ? user_path_at_empty+0x13e/0x190 [ 211.755794][ T5977] __se_sys_mount+0x2e3/0x3d0 [ 211.760492][ T5977] ? __x64_sys_mount+0xc0/0xc0 [ 211.765264][ T5977] ? lockdep_hardirqs_on+0x94/0x140 [ 211.770470][ T5977] ? __x64_sys_mount+0x1c/0xc0 [ 211.775240][ T5977] do_syscall_64+0x4c/0xa0 [ 211.779656][ T5977] ? clear_bhb_loop+0x30/0x80 [ 211.784607][ T5977] ? clear_bhb_loop+0x30/0x80 [ 211.789296][ T5977] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 211.795717][ T5977] RIP: 0033:0x7f65e789fe59 [ 211.800138][ T5977] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 211.819749][ T5977] RSP: 002b:00007f65e5af8028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 211.828170][ T5977] RAX: ffffffffffffffda RBX: 00007f65e7b27fa0 RCX: 00007f65e789fe59 [ 211.836151][ T5977] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000000 [ 211.844131][ T5977] RBP: 00007f65e7935e6f R08: 0000000000000000 R09: 0000000000000000 [ 211.852317][ T5977] R10: 0000000002b90026 R11: 0000000000000246 R12: 0000000000000000 [ 211.860405][ T5977] R13: 00007f65e7b28038 R14: 00007f65e7b27fa0 R15: 00007ffe8acdce38 [ 211.868406][ T5977] [ 211.872417][ T5977] gfs2: unable to remount read-write [ 211.882669][ T5988] EXT4-fs (loop0): feature flags set on rev 0 fs, running e2fsck is recommended [ 211.942035][ T4189] XFS (loop3): Unmounting Filesystem [ 211.945563][ T4249] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 211.962935][ T5988] [EXT4 FS bs=4096, gc=1, bpg=3008, ipg=32, mo=80026019, mo2=0000] [ 211.997922][ T4249] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 212.011205][ T4249] EXT4-fs (loop1): This should not happen!! Data will be lost [ 212.011205][ T4249] [ 212.023083][ T4249] EXT4-fs (loop1): Total free blocks count 0 [ 212.029585][ T4249] EXT4-fs (loop1): Free/Dirty block details [ 212.036382][ T4249] EXT4-fs (loop1): free_blocks=66060288 [ 212.042109][ T4249] EXT4-fs (loop1): dirty_blocks=32 [ 212.047434][ T4249] EXT4-fs (loop1): Block reservation details [ 212.053532][ T4249] EXT4-fs (loop1): i_reserved_data_blocks=2 [ 212.076537][ T1236] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 159 with max blocks 1 with error 28 [ 212.119652][ T1236] EXT4-fs (loop1): This should not happen!! Data will be lost [ 212.119652][ T1236] [ 212.166511][ T5988] EXT4-fs (loop0): 1 truncate cleaned up [ 212.173113][ T4249] Quota error (device loop0): free_dqentry: Quota structure has offset to other block (1) than it should (5) [ 212.173161][ T5988] EXT4-fs (loop0): mounted filesystem without journal. Opts: nobarrier,noblock_validity,nombcache,acl,barrier=0x000000000000000c,noacl,max_batch_time=0x0000000000000006,nodelalloc,resgid=0x00000000000000002,errors=continue. Quota mode: writeback. [ 212.222841][ T4249] EXT4-fs error (device loop0): ext4_release_dquot:6272: comm kworker/u4:5: Failed to release dquot type 1 [ 212.598049][ T6000] loop4: detected capacity change from 0 to 2048 [ 212.728105][ T6000] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 1024) [ 212.737952][ T6000] NILFS (loop4): mounting unchecked fs [ 212.791732][ T6000] NILFS (loop4): recovery complete [ 212.954571][ T6001] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 213.443336][ T6007] loop3: detected capacity change from 0 to 1024 [ 213.471091][ T5961] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 213.504866][ T6007] EXT4-fs (loop3): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000001,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000005,nolazytime,init_itable,. Quota mode: none. [ 213.680800][ T5960] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 213.680851][ T5961] usb 5-1: device descriptor read/64, error -71 [ 214.051304][ T5960] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 214.079460][ T5961] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 214.109989][ T6007] netlink: 132 bytes leftover after parsing attributes in process `syz.3.396'. [ 214.130029][ T5960] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 214.159622][ T5960] usb 1-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 214.180027][ T5960] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 214.208603][ T5960] usb 1-1: config 0 descriptor?? [ 214.295230][ T5961] usb 5-1: device descriptor read/64, error -71 [ 214.452843][ T5961] usb usb5-port1: attempt power cycle [ 214.527957][ T6020] FAULT_INJECTION: forcing a failure. [ 214.527957][ T6020] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 214.554020][ T6020] CPU: 1 PID: 6020 Comm: syz.2.400 Not tainted syzkaller #0 [ 214.561374][ T6020] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 214.571555][ T6020] Call Trace: [ 214.574863][ T6020] [ 214.577818][ T6020] dump_stack_lvl+0x188/0x250 [ 214.582538][ T6020] ? show_regs_print_info+0x20/0x20 [ 214.587771][ T6020] ? load_image+0x410/0x410 [ 214.592328][ T6020] ? __lock_acquire+0x7b50/0x7b50 [ 214.597400][ T6020] should_fail+0x383/0x4b0 [ 214.601852][ T6020] _copy_from_user+0x2e/0x170 [ 214.606561][ T6020] __copy_msghdr_from_user+0xc9/0x630 [ 214.611966][ T6020] ? verify_lock_unused+0x140/0x140 [ 214.617452][ T6020] ? mark_lock+0x94/0x320 [ 214.621818][ T6020] ? __ia32_sys_shutdown+0x1d0/0x1d0 [ 214.627136][ T6020] ? __lock_acquire+0x13dc/0x7b50 [ 214.632229][ T6020] ___sys_sendmsg+0x19a/0x2e0 [ 214.636987][ T6020] ? __sys_sendmsg+0x290/0x290 [ 214.641991][ T6020] __se_sys_sendmsg+0x1b7/0x2a0 [ 214.646882][ T6020] ? __x64_sys_sendmsg+0x80/0x80 [ 214.651855][ T6020] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 214.657884][ T6020] ? lockdep_hardirqs_on+0x94/0x140 [ 214.663235][ T6020] do_syscall_64+0x4c/0xa0 [ 214.667677][ T6020] ? clear_bhb_loop+0x30/0x80 [ 214.672467][ T6020] ? clear_bhb_loop+0x30/0x80 [ 214.677185][ T6020] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 214.683124][ T6020] RIP: 0033:0x7f65e789fe59 [ 214.687586][ T6020] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 214.707405][ T6020] RSP: 002b:00007f65e5af8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 214.715981][ T6020] RAX: ffffffffffffffda RBX: 00007f65e7b27fa0 RCX: 00007f65e789fe59 [ 214.724069][ T6020] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 214.732237][ T6020] RBP: 00007f65e5af8090 R08: 0000000000000000 R09: 0000000000000000 [ 214.740240][ T6020] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 214.748245][ T6020] R13: 00007f65e7b28038 R14: 00007f65e7b27fa0 R15: 00007ffe8acdce38 [ 214.756263][ T6020] [ 214.850661][ T6021] loop1: detected capacity change from 0 to 2048 [ 214.927118][ T6021] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 214.937040][ T6021] NILFS (loop1): mounting unchecked fs [ 214.987830][ T6005] bridge_slave_1: default FDB implementation only supports local addresses [ 215.031988][ T6021] NILFS (loop1): recovery complete [ 215.126164][ T6022] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 215.170766][ T5961] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 215.438329][ T5960] playstation 0003:054C:0DF2.0001: unknown main item tag 0x4 [ 215.450116][ T5960] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 215.471389][ T5960] playstation 0003:054C:0DF2.0001: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.0-1/input0 [ 215.597181][ T6033] loop2: detected capacity change from 0 to 512 [ 215.654617][ T6030] loop1: detected capacity change from 0 to 1764 [ 215.661149][ T5961] usb 5-1: device not accepting address 21, error -71 [ 215.710733][ T5960] playstation 0003:054C:0DF2.0001: Failed to retrieve feature with reportID 9: -71 [ 215.743309][ T5960] playstation 0003:054C:0DF2.0001: Failed to retrieve DualSense pairing info: -71 [ 215.772063][ T5960] playstation 0003:054C:0DF2.0001: Failed to get MAC address from DualSense [ 215.782595][ T5960] playstation 0003:054C:0DF2.0001: Failed to create dualsense. [ 215.796569][ T5960] playstation: probe of 0003:054C:0DF2.0001 failed with error -71 [ 215.834399][ T6033] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a806e02c, mo2=0002] [ 215.868806][ T5960] usb 1-1: USB disconnect, device number 27 [ 215.875227][ T6033] System zones: 1-12 [ 215.915670][ T6033] EXT4-fs error (device loop2): dx_probe:823: inode #2: comm syz.2.406: Directory hole found for htree index block 0 [ 215.936480][ T6033] EXT4-fs (loop2): Remounting filesystem read-only [ 215.960477][ T6033] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -117 [ 215.969123][ T6033] EXT4-fs error (device loop2): dx_probe:823: inode #2: comm syz.2.406: Directory hole found for htree index block 0 [ 215.991434][ T6033] EXT4-fs (loop2): Remounting filesystem read-only [ 216.010453][ T6033] EXT4-fs (loop2): Cannot turn on journaled quota: type 1: error -117 [ 216.029085][ T6033] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpjquota=Jdebug,jqfmt=vfsold,noquota,bsdgroups,usrjquota="nojournal_checksum,errors=remount-ro,,. Quota mode: writeback. [ 216.432400][ T6042] fido_id[6042]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 216.770405][ T6049] loop0: detected capacity change from 0 to 8192 [ 216.778047][ T6031] EXT4-fs (loop2): shut down requested (2) [ 216.784402][ T4909] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 217.266574][ T4909] usb 2-1: Using ep0 maxpacket: 8 [ 217.281225][ T6038] loop4: detected capacity change from 0 to 32768 [ 217.708374][ T4991] loop0: p1 p3 < > p4 < p5 > [ 217.714641][ T4991] loop0: p1 start 52298752 is beyond EOD, truncated [ 217.728317][ T4991] loop0: p5 start 52298752 is beyond EOD, truncated [ 217.804077][ T6049] loop0: p1 p3 < > p4 < p5 > [ 217.809057][ T6049] loop0: p1 start 52298752 is beyond EOD, truncated [ 217.818702][ T6049] loop0: p5 start 52298752 is beyond EOD, truncated [ 218.218361][ T6062] loop3: detected capacity change from 0 to 2048 [ 218.762867][ T6062] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 218.772683][ T6062] NILFS (loop3): mounting unchecked fs [ 218.814278][ T4909] usb 2-1: config 2 has an invalid interface number: 31 but max is 0 [ 218.822526][ T4909] usb 2-1: config 2 has no interface number 0 [ 218.828830][ T4909] usb 2-1: config 2 interface 31 has no altsetting 0 [ 218.888865][ T6062] NILFS (loop3): recovery complete [ 218.913137][ T6067] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 219.021251][ T6064] loop2: detected capacity change from 0 to 1024 [ 219.950815][ T6070] loop0: detected capacity change from 0 to 2048 [ 220.000722][ T6070] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 220.010436][ T6070] NILFS (loop0): mounting unchecked fs [ 220.075010][ T6070] NILFS (loop0): recovery complete [ 220.097329][ T6081] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 220.380540][ T5960] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 220.467389][ T6064] EXT4-fs (loop2): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000001,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000005,nolazytime,init_itable,. Quota mode: none. [ 220.741827][ T5960] usb 1-1: device descriptor read/64, error -71 [ 220.840162][ T6089] netlink: 'syz.1.418': attribute type 21 has an invalid length. [ 220.907414][ T4992] udevd[4992]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 220.952980][ T4991] udevd[4991]: inotify_add_watch(7, /dev/loop0p3, 10) failed: No such file or directory [ 221.010528][ T5960] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 221.059823][ T6064] netlink: 132 bytes leftover after parsing attributes in process `syz.2.411'. [ 221.200705][ T5960] usb 1-1: device descriptor read/64, error -71 [ 221.223943][ T4991] udevd[4991]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 221.302838][ T4993] udevd[4993]: inotify_add_watch(7, /dev/loop0p3, 10) failed: No such file or directory [ 221.321834][ T5960] usb usb1-port1: attempt power cycle [ 221.646261][ T4909] usb 2-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 221.658446][ T4909] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 221.667209][ T4909] usb 2-1: Product: syz [ 221.671429][ T4909] usb 2-1: Manufacturer: syz [ 221.700457][ T4909] usb 2-1: can't set config #2, error -71 [ 221.721227][ T4909] usb 2-1: USB disconnect, device number 24 [ 221.730875][ T5960] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 221.844282][ T6096] loop1: detected capacity change from 0 to 8192 [ 221.851021][ T5960] usb 1-1: device descriptor read/8, error -71 [ 222.932634][ T6096] REISERFS (device loop1): found reiserfs format "3.5" with non-standard journal [ 222.965855][ T6096] REISERFS (device loop1): using ordered data mode [ 223.195630][ T6107] loop0: detected capacity change from 0 to 512 [ 223.220040][ T6096] reiserfs: using flush barriers [ 223.377992][ T6096] REISERFS (device loop1): journal params: device loop1, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 223.970863][ T6096] REISERFS (device loop1): checking transaction log (loop1) [ 223.994556][ T6096] REISERFS (device loop1): Using r5 hash to sort names [ 224.043376][ T6107] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a806e02c, mo2=0002] [ 224.065670][ T6107] System zones: 1-12 [ 224.093439][ T6107] EXT4-fs error (device loop0): dx_probe:823: inode #2: comm syz.0.422: Directory hole found for htree index block 0 [ 224.109688][ T6096] REISERFS (device loop1): Created .reiserfs_priv - reserved for xattr storage. [ 224.174587][ T6107] EXT4-fs (loop0): Remounting filesystem read-only [ 224.181480][ T6107] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -117 [ 224.211368][ T6107] EXT4-fs error (device loop0): dx_probe:823: inode #2: comm syz.0.422: Directory hole found for htree index block 0 [ 224.268364][ T6107] EXT4-fs (loop0): Remounting filesystem read-only [ 224.310483][ T6107] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -117 [ 224.348653][ T6107] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpjquota=Jdebug,jqfmt=vfsold,noquota,bsdgroups,usrjquota="nojournal_checksum,errors=remount-ro,,. Quota mode: writeback. [ 224.717237][ T6106] EXT4-fs (loop0): shut down requested (2) [ 224.917668][ T6127] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 225.160087][ T6116] loop2: detected capacity change from 0 to 32768 [ 225.236142][ T6140] netlink: 8 bytes leftover after parsing attributes in process `syz.1.436'. [ 225.361279][ T6116] XFS (loop2): Mounting V5 Filesystem [ 225.638049][ T6116] XFS (loop2): Tail block (0x40) overwrite detected. Updated to 0x80 [ 225.683748][ T26] audit: type=1326 audit(1783930890.273:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.4.444" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f19077f5e59 code=0x7ffc0000 [ 225.709343][ T6116] XFS (loop2): Starting recovery (logdev: internal) [ 225.740622][ T6116] XFS (loop2): Ending recovery (logdev: internal) [ 225.795950][ T26] audit: type=1326 audit(1783930890.303:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.4.444" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f19077f5e59 code=0x7ffc0000 [ 225.890394][ T26] audit: type=1326 audit(1783930890.303:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.4.444" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f19077f5e59 code=0x7ffc0000 [ 225.966314][ T6177] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 225.994994][ T6177] device bridge_slave_0 left promiscuous mode [ 226.010880][ T26] audit: type=1326 audit(1783930890.303:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.4.444" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=43 compat=0 ip=0x7f19077f5e59 code=0x7ffc0000 [ 226.059375][ T6177] bridge0: port 1(bridge_slave_0) entered disabled state [ 226.133277][ T26] audit: type=1326 audit(1783930890.303:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.4.444" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f19077f5e59 code=0x7ffc0000 [ 226.233953][ T6177] device bridge_slave_1 left promiscuous mode [ 226.237635][ T26] audit: type=1326 audit(1783930890.303:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.4.444" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f19077f5e59 code=0x7ffc0000 [ 226.306338][ T6177] bridge0: port 2(bridge_slave_1) entered disabled state [ 226.349582][ T26] audit: type=1326 audit(1783930890.303:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.4.444" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f19077f5e59 code=0x7ffc0000 [ 226.427207][ T6177] bond0: (slave bond_slave_0): Releasing backup interface [ 226.557974][ T6177] bond0: (slave bond_slave_1): Releasing backup interface [ 226.640968][ T6193] xt_connbytes: Forcing CT accounting to be enabled [ 226.732489][ T6177] team0: Port device team_slave_0 removed [ 226.844430][ T6177] team0: Port device team_slave_1 removed [ 226.880173][ T6177] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 226.921048][ T6177] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 226.976639][ T6177] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 227.082984][ T6206] netlink: 'syz.3.460': attribute type 1 has an invalid length. [ 227.213451][ T6206] 8021q: adding VLAN 0 to HW filter on device bond1 [ 227.224804][ T6208] device macvlan2 entered promiscuous mode [ 227.231299][ T6208] device bond1 entered promiscuous mode [ 227.238316][ T6208] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 227.251000][ T6208] team0: Port device macvlan2 added [ 227.423345][ T4191] XFS (loop2): Unmounting Filesystem [ 228.651898][ T6253] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 228.699409][ T26] audit: type=1326 audit(1783930893.283:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6254 comm="syz.0.478" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5c99429e59 code=0x7ffc0000 [ 228.796723][ T26] audit: type=1326 audit(1783930893.283:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6254 comm="syz.0.478" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f5c99429e59 code=0x7ffc0000 [ 228.944802][ T26] audit: type=1326 audit(1783930893.283:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6254 comm="syz.0.478" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5c99429e59 code=0x7ffc0000 [ 230.718419][ T6321] netlink: 'syz.0.508': attribute type 3 has an invalid length. [ 231.045455][ T6333] netlink: 'syz.0.512': attribute type 39 has an invalid length. [ 231.294878][ T6329] crypto_alloc_aead failed rc=-4 [ 231.679854][ T4203] Bluetooth: hci1: Received unexpected HCI Event 00000000 [ 232.430819][ T6375] fuse: Bad value for 'fd' [ 232.631755][ T6349] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 232.868302][ T6382] team0: Mode changed to "activebackup" [ 232.913409][ T6387] device vlan0 entered promiscuous mode [ 232.996035][ T6387] team0: Port device vlan0 added [ 233.095682][ T6393] tc action pedit 'at' offset 5 out of bounds [ 233.102406][ T6393] tc action pedit 'at' offset 5 out of bounds [ 233.108522][ T6393] tc action pedit 'at' offset 5 out of bounds [ 233.114859][ T6393] tc action pedit 'at' offset 5 out of bounds [ 233.120976][ T6393] tc action pedit 'at' offset 5 out of bounds [ 233.127092][ T6393] tc action pedit 'at' offset 5 out of bounds [ 233.133194][ T6393] tc action pedit 'at' offset 5 out of bounds [ 233.139272][ T6393] tc action pedit 'at' offset 5 out of bounds [ 233.145392][ T6393] tc action pedit 'at' offset 5 out of bounds [ 233.151492][ T6393] tc action pedit 'at' offset 5 out of bounds [ 233.157578][ T6393] 0: reclassify loop, rule prio 0, protocol 800 [ 233.426285][ T6387] syz.1.516 (6387) used greatest stack depth: 20432 bytes left [ 234.489363][ T6416] device vlan0 entered promiscuous mode [ 234.743666][ T5960] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 234.830710][ T6443] tmpfs: Unknown parameter 'quota' [ 235.150598][ T5960] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 235.177758][ T6450] netlink: 8 bytes leftover after parsing attributes in process `syz.2.550'. [ 235.196381][ T5960] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 235.222927][ T5960] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 235.290349][ T5960] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 235.327013][ T5960] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 235.385364][ T5960] usb 2-1: config 0 descriptor?? [ 235.555961][ T6460] netlink: 40 bytes leftover after parsing attributes in process `syz.2.555'. [ 235.577003][ T6461] overlayfs: failed to clone upperpath [ 235.598616][ T6461] overlayfs: failed to clone upperpath [ 235.882960][ T5960] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 235.910492][ T5960] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 235.936288][ T5960] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 235.955076][ T5960] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 235.990862][ T5960] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 236.013477][ T5960] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 236.038570][ T5960] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 236.067391][ T5960] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 236.115514][ T5960] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 236.145830][ T5960] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 236.158455][ T5960] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 236.203241][ T5960] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 236.241470][ T5960] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 236.270464][ T5960] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 236.289594][ T5960] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 236.325863][ T5960] plantronics 0003:047F:FFFF.0002: No inputs registered, leaving [ 236.376967][ T5960] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 236.390549][ T6481] batman_adv: batadv0: Adding interface: dummy0 [ 236.417409][ T6481] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 236.514538][ T6481] batman_adv: batadv0: Interface activated: dummy0 [ 236.575612][ T6484] batadv0: mtu less than device minimum [ 236.615433][ T6484] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 236.628618][ T6484] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 236.641318][ T6484] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 236.653968][ T6484] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 236.666441][ T6484] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 236.678976][ T6484] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 236.691532][ T6484] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 236.704082][ T6484] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 236.889329][ T4951] Bluetooth: hci5: Frame reassembly failed (-84) [ 237.110825][ T6493] overlayfs: failed to clone upperpath [ 237.135724][ T6493] overlayfs: failed to clone upperpath [ 237.361930][ T6499] device bridge0 entered promiscuous mode [ 237.633889][ T6507] fuse: Bad value for 'fd' [ 237.868307][ T6524] device syzkaller0 entered promiscuous mode [ 237.895169][ T6527] netlink: 'syz.2.581': attribute type 10 has an invalid length. [ 237.969546][ T6527] 8021q: adding VLAN 0 to HW filter on device team0 [ 237.979632][ T6527] bond0: (slave team0): Enslaving as an active interface with an up link [ 238.070854][ T6529] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 238.079666][ T6529] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 238.094174][ T6536] Cannot find add_set index 65534 as target [ 238.285474][ T6542] device syzkaller1 entered promiscuous mode [ 238.328140][ T6549] fuse: Bad value for 'fd' [ 238.378453][ T4635] usb 2-1: USB disconnect, device number 25 [ 238.481273][ T6556] netlink: 28 bytes leftover after parsing attributes in process `syz.1.591'. [ 238.502851][ T6556] netlink: 28 bytes leftover after parsing attributes in process `syz.1.591'. [ 238.563376][ T6561] netlink: 28 bytes leftover after parsing attributes in process `syz.1.591'. [ 238.572692][ T6561] netlink: 28 bytes leftover after parsing attributes in process `syz.1.591'. [ 238.605608][ T6559] netlink: 28 bytes leftover after parsing attributes in process `syz.0.592'. [ 238.614815][ T6559] netlink: 28 bytes leftover after parsing attributes in process `syz.0.592'. [ 238.628833][ T6559] device gretap0 entered promiscuous mode [ 238.637368][ T6559] device gretap0 left promiscuous mode [ 238.649666][ T6562] netlink: 28 bytes leftover after parsing attributes in process `syz.0.592'. [ 238.660611][ T6562] netlink: 28 bytes leftover after parsing attributes in process `syz.0.592'. [ 238.674374][ T6562] device gretap0 entered promiscuous mode [ 238.686549][ T6562] device gretap0 left promiscuous mode [ 238.950438][ T4911] Bluetooth: hci5: command 0x1003 tx timeout [ 238.956739][ T4201] Bluetooth: hci5: sending frame failed (-49) [ 239.773269][ T6588] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 239.801206][ T6588] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 240.110937][ T6611] device syzkaller0 entered promiscuous mode [ 240.201588][ T6586] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 240.212106][ T6586] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 240.219984][ T6586] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 240.244563][ T6586] device bridge_slave_0 left promiscuous mode [ 240.252241][ T6586] bridge0: port 1(bridge_slave_0) entered disabled state [ 240.263166][ T6586] device bridge_slave_1 left promiscuous mode [ 240.269537][ T6586] bridge0: port 2(bridge_slave_1) entered disabled state [ 240.283556][ T6586] bond0: (slave bond_slave_0): Releasing backup interface [ 240.322685][ T6586] bond0: (slave bond_slave_1): Releasing backup interface [ 240.404080][ T6586] team0: Port device team_slave_0 removed [ 240.431056][ T6586] team0: Port device team_slave_1 removed [ 240.444485][ T6586] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 240.452604][ T6586] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 240.471498][ T6586] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 240.479308][ T6586] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 240.541527][ T6612] team0: Mode changed to "activebackup" [ 240.556044][ T6615] device vlan0 entered promiscuous mode [ 240.612876][ T6615] team0: Port device vlan0 added [ 240.694563][ T6619] x_tables: duplicate underflow at hook 1 [ 241.020379][ T4828] Bluetooth: hci5: command 0x1001 tx timeout [ 241.033869][ T4201] Bluetooth: hci5: sending frame failed (-49) [ 241.253985][ T6642] fuse: Bad value for 'fd' [ 241.276437][ T6641] batman_adv: batadv0: Adding interface: dummy0 [ 241.291147][ T6641] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 241.327735][ T6641] batman_adv: batadv0: Interface activated: dummy0 [ 241.359214][ T6647] IPVS: ip_vs_add_dest(): server weight less than zero [ 241.546646][ T6651] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 241.666203][ T6651] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 241.772369][ T6651] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 241.862671][ T6651] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.020080][ T6651] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 242.047470][ T6651] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 242.064463][ T6651] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 242.086400][ T6651] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 242.181930][ T6657] binder: 6655:6657 ioctl c0306201 200000000180 returned -14 [ 242.348413][ T6668] netlink: 156 bytes leftover after parsing attributes in process `syz.0.629'. [ 242.401831][ T6670] xt_hashlimit: size too large, truncated to 1048576 [ 242.574201][ T4828] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 242.733911][ T6660] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 242.752673][ T6660] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 242.771764][ T6660] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 242.784023][ T4945] wlan0: Trigger new scan to find an IBSS to join [ 242.807094][ T6660] device bridge_slave_0 left promiscuous mode [ 242.827325][ T6679] fuse: Bad value for 'fd' [ 242.832072][ T4828] usb 2-1: Using ep0 maxpacket: 32 [ 242.847445][ T6660] bridge0: port 1(bridge_slave_0) entered disabled state [ 242.881537][ T6660] device bridge_slave_1 left promiscuous mode [ 242.905811][ T6660] bridge0: port 2(bridge_slave_1) entered disabled state [ 242.943685][ T6660] bond0: (slave bond_slave_0): Releasing backup interface [ 242.952932][ T4828] usb 2-1: config index 0 descriptor too short (expected 15270, got 18) [ 242.995431][ T6660] bond0: (slave bond_slave_1): Releasing backup interface [ 243.110420][ T4911] Bluetooth: hci5: command 0x1009 tx timeout [ 243.131724][ T4828] usb 2-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 243.153220][ T4828] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.173953][ T6660] team0: Port device team_slave_0 removed [ 243.190416][ T4828] usb 2-1: Product: syz [ 243.202629][ T4828] usb 2-1: Manufacturer: syz [ 243.213456][ T4828] usb 2-1: SerialNumber: syz [ 243.244862][ T4828] usb 2-1: config 0 descriptor?? [ 243.263571][ T6660] team0: Port device team_slave_1 removed [ 243.283825][ T6660] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 243.293581][ T4828] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 243.312284][ T4828] dvb-usb: bulk message failed: -22 (4/0) [ 243.320739][ T6660] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 243.336431][ T4828] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 243.357901][ T4828] dvb-usb: bulk message failed: -22 (5/0) [ 243.373661][ T4828] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 243.403362][ T6660] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 243.416530][ T6660] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 243.433326][ T4828] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 243.457786][ T6675] team0: Mode changed to "activebackup" [ 243.465750][ T4828] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 243.475570][ T4828] usb 2-1: media controller created [ 243.507567][ T4828] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 243.553894][ T6680] device vlan0 entered promiscuous mode [ 243.569551][ T4828] usb 2-1: selecting invalid altsetting 3 [ 243.587519][ T4828] ttusb2: set interface to alts=3 failed [ 243.595359][ T6680] team0: Port device vlan0 added [ 243.693691][ T4828] DVB: Unable to find symbol tda10086_attach() [ 243.703901][ T4828] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 243.775789][ T4828] dvb-usb: bulk message failed: -22 (4/0) [ 243.783456][ T4828] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 243.810694][ T4828] dvb-usb: bulk message failed: -22 (5/0) [ 243.828872][ T4828] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 243.849976][ T4828] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 243.895185][ T4828] usb 2-1: USB disconnect, device number 26 [ 243.978292][ T4828] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 244.177010][ T6701] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 244.213636][ T6701] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 244.453465][ T6709] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 244.480975][ T6709] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 244.711754][ T6723] device syzkaller0 entered promiscuous mode [ 244.755759][ T6721] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 244.942486][ T4828] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 244.958196][ T4828] Bluetooth: hci2: Injecting HCI hardware error event [ 244.983923][ T4201] Bluetooth: hci2: hardware error 0x00 [ 245.357827][ T6729] binder: 6728:6729 ioctl c0306201 200000000180 returned -14 [ 245.535447][ T6733] device syzkaller0 entered promiscuous mode [ 245.842141][ T1236] wlan0: Trigger new scan to find an IBSS to join [ 245.918211][ T6745] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 246.223381][ T4205] Bluetooth: hci4: Unknown advertising packet type: 0x100 [ 246.223742][ T4205] ================================================================== [ 246.239513][ T4205] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0x1291/0x3ca0 [ 246.247561][ T4205] Read of size 2 at addr ffff8880795ba400 by task kworker/u5:8/4205 [ 246.255578][ T4205] [ 246.257935][ T4205] CPU: 0 PID: 4205 Comm: kworker/u5:8 Not tainted syzkaller #0 [ 246.265612][ T4205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 246.276235][ T4205] Workqueue: hci4 hci_rx_work [ 246.280961][ T4205] Call Trace: [ 246.284280][ T4205] [ 246.287244][ T4205] dump_stack_lvl+0x188/0x250 [ 246.292031][ T4205] ? show_regs_print_info+0x20/0x20 [ 246.297319][ T4205] ? load_image+0x410/0x410 [ 246.301882][ T4205] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 246.307426][ T4205] print_address_description+0x60/0x2d0 [ 246.313028][ T4205] ? hci_le_meta_evt+0x1291/0x3ca0 [ 246.318208][ T4205] kasan_report+0xdf/0x130 [ 246.322680][ T4205] ? hci_le_meta_evt+0x1291/0x3ca0 [ 246.327855][ T4205] hci_le_meta_evt+0x1291/0x3ca0 [ 246.332857][ T4205] ? hci_event_packet+0x363/0x1310 [ 246.338109][ T4205] ? __lock_acquire+0x7b50/0x7b50 [ 246.343193][ T4205] ? hci_remote_host_features_evt+0x240/0x240 [ 246.349394][ T4205] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 246.355173][ T4205] ? mark_lock+0x94/0x320 [ 246.359543][ T4205] ? mutex_unlock+0x10/0x10 [ 246.364306][ T4205] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 246.370519][ T4205] ? lock_chain_count+0x20/0x20 [ 246.375413][ T4205] ? __rwlock_init+0x140/0x140 [ 246.380224][ T4205] hci_event_packet+0xe0b/0x1310 [ 246.385210][ T4205] ? _raw_spin_unlock+0x40/0x40 [ 246.390187][ T4205] ? rcu_lock_release+0x20/0x20 [ 246.395079][ T4205] ? hci_send_to_monitor+0x9c/0x4a0 [ 246.400315][ T4205] hci_rx_work+0x255/0xa10 [ 246.404793][ T4205] process_one_work+0x867/0xff0 [ 246.409695][ T4205] ? worker_detach_from_pool+0x240/0x240 [ 246.416153][ T4205] ? lockdep_hardirqs_off+0x70/0x100 [ 246.421481][ T4205] ? _raw_spin_lock_irq+0xb7/0xf0 [ 246.426675][ T4205] ? _raw_spin_lock_irqsave+0x100/0x100 [ 246.432264][ T4205] ? wq_worker_running+0x97/0x170 [ 246.437334][ T4205] worker_thread+0xad7/0x12a0 [ 246.442073][ T4205] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 246.448721][ T4205] kthread+0x42e/0x520 [ 246.452828][ T4205] ? rcu_lock_release+0x20/0x20 [ 246.457718][ T4205] ? kthread_blkcg+0xd0/0xd0 [ 246.462348][ T4205] ret_from_fork+0x1f/0x30 [ 246.466821][ T4205] [ 246.469868][ T4205] [ 246.472245][ T4205] Allocated by task 6755: [ 246.476606][ T4205] __kasan_kmalloc+0xaf/0xe0 [ 246.481364][ T4205] __alloc_skb+0x22c/0x750 [ 246.485914][ T4205] vhci_write+0xbd/0x440 [ 246.490276][ T4205] vfs_write+0x748/0xd70 [ 246.494862][ T4205] ksys_write+0x153/0x260 [ 246.499242][ T4205] do_syscall_64+0x4c/0xa0 [ 246.503777][ T4205] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 246.509707][ T4205] [ 246.512057][ T4205] The buggy address belongs to the object at ffff8880795ba000 [ 246.512057][ T4205] which belongs to the cache kmalloc-1k of size 1024 [ 246.526134][ T4205] The buggy address is located 0 bytes to the right of [ 246.526134][ T4205] 1024-byte region [ffff8880795ba000, ffff8880795ba400) [ 246.539962][ T4205] The buggy address belongs to the page: [ 246.545808][ T4205] page:ffffea0001e56e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x795b8 [ 246.556130][ T4205] head:ffffea0001e56e00 order:3 compound_mapcount:0 compound_pincount:0 [ 246.564665][ T4205] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 246.572829][ T4205] raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888016c41dc0 [ 246.581550][ T4205] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 246.590160][ T4205] page dumped because: kasan: bad access detected [ 246.596610][ T4205] page_owner tracks the page as allocated [ 246.602574][ T4205] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4186, ts 72961204962, free_ts 68711962548 [ 246.621796][ T4205] get_page_from_freelist+0x24f6/0x2670 [ 246.627386][ T4205] __alloc_pages+0x1ee/0x480 [ 246.632007][ T4205] new_slab+0xc0/0x4b0 [ 246.636263][ T4205] ___slab_alloc+0x807/0xdd0 [ 246.640883][ T4205] __kmalloc_node_track_caller+0x13d/0x3a0 [ 246.646848][ T4205] __alloc_skb+0x22c/0x750 [ 246.651299][ T4205] rtmsg_fib+0xd7/0x440 [ 246.655669][ T4205] fib_table_insert+0xd20/0x1b70 [ 246.660673][ T4205] fib_magic+0x2ca/0x3b0 [ 246.664946][ T4205] fib_add_ifaddr+0x372/0x5c0 [ 246.669664][ T4205] fib_netdev_event+0x35c/0x480 [ 246.674542][ T4205] raw_notifier_call_chain+0xcb/0x160 [ 246.679958][ T4205] __dev_notify_flags+0x194/0x300 [ 246.685110][ T4205] dev_change_flags+0xda/0x1a0 [ 246.689902][ T4205] do_setlink+0xca4/0x29d0 [ 246.694355][ T4205] rtnl_newlink+0x15bb/0x1920 [ 246.699085][ T4205] page last free stack trace: [ 246.703780][ T4205] free_unref_page_prepare+0x637/0x6c0 [ 246.709274][ T4205] free_unref_page+0x8f/0x2a0 [ 246.714086][ T4205] qlist_free_all+0x35/0x90 [ 246.718619][ T4205] kasan_quarantine_reduce+0x150/0x160 [ 246.724108][ T4205] __kasan_slab_alloc+0x2f/0xc0 [ 246.728991][ T4205] slab_post_alloc_hook+0x4c/0x380 [ 246.734159][ T4205] kmem_cache_alloc+0x15d/0x280 [ 246.739042][ T4205] sock_alloc_inode+0x17/0xb0 [ 246.743762][ T4205] new_inode_pseudo+0x5f/0x210 [ 246.748569][ T4205] __sock_create+0x128/0x910 [ 246.753195][ T4205] __sys_socket+0xe2/0x170 [ 246.757643][ T4205] __x64_sys_socket+0x76/0x80 [ 246.762360][ T4205] do_syscall_64+0x4c/0xa0 [ 246.767076][ T4205] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 246.773040][ T4205] [ 246.775392][ T4205] Memory state around the buggy address: [ 246.781054][ T4205] ffff8880795ba300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 246.789516][ T4205] ffff8880795ba380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 246.797624][ T4205] >ffff8880795ba400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 246.805805][ T4205] ^ [ 246.809913][ T4205] ffff8880795ba480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 246.818014][ T4205] ffff8880795ba500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 246.826104][ T4205] ================================================================== [ 246.834196][ T4205] Disabling lock debugging due to kernel taint [ 246.852058][ T4205] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 246.859303][ T4205] CPU: 0 PID: 4205 Comm: kworker/u5:8 Tainted: G B syzkaller #0 [ 246.868273][ T4205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 246.878443][ T4205] Workqueue: hci4 hci_rx_work [ 246.883172][ T4205] Call Trace: [ 246.886482][ T4205] [ 246.889443][ T4205] dump_stack_lvl+0x188/0x250 [ 246.894173][ T4205] ? show_regs_print_info+0x20/0x20 [ 246.899415][ T4205] ? load_image+0x410/0x410 [ 246.903963][ T4205] panic+0x2f8/0x850 [ 246.907893][ T4205] ? bpf_jit_dump+0xd0/0xd0 [ 246.912536][ T4205] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 246.918553][ T4205] ? _raw_spin_unlock+0x40/0x40 [ 246.923545][ T4205] ? hci_le_meta_evt+0x1291/0x3ca0 [ 246.928695][ T4205] check_panic_on_warn+0x80/0xa0 [ 246.933931][ T4205] ? hci_le_meta_evt+0x1291/0x3ca0 [ 246.939075][ T4205] end_report+0x6d/0xf0 [ 246.943264][ T4205] kasan_report+0x102/0x130 [ 246.947902][ T4205] ? hci_le_meta_evt+0x1291/0x3ca0 [ 246.953052][ T4205] hci_le_meta_evt+0x1291/0x3ca0 [ 246.958031][ T4205] ? hci_event_packet+0x363/0x1310 [ 246.963175][ T4205] ? __lock_acquire+0x7b50/0x7b50 [ 246.968240][ T4205] ? hci_remote_host_features_evt+0x240/0x240 [ 246.974346][ T4205] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 246.980016][ T4205] ? mark_lock+0x94/0x320 [ 246.984470][ T4205] ? mutex_unlock+0x10/0x10 [ 246.989017][ T4205] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 246.995082][ T4205] ? lock_chain_count+0x20/0x20 [ 246.999968][ T4205] ? __rwlock_init+0x140/0x140 [ 247.004767][ T4205] hci_event_packet+0xe0b/0x1310 [ 247.009746][ T4205] ? _raw_spin_unlock+0x40/0x40 [ 247.014738][ T4205] ? rcu_lock_release+0x20/0x20 [ 247.019756][ T4205] ? hci_send_to_monitor+0x9c/0x4a0 [ 247.024993][ T4205] hci_rx_work+0x255/0xa10 [ 247.029453][ T4205] process_one_work+0x867/0xff0 [ 247.034354][ T4205] ? worker_detach_from_pool+0x240/0x240 [ 247.040040][ T4205] ? lockdep_hardirqs_off+0x70/0x100 [ 247.045479][ T4205] ? _raw_spin_lock_irq+0xb7/0xf0 [ 247.050546][ T4205] ? _raw_spin_lock_irqsave+0x100/0x100 [ 247.056138][ T4205] ? wq_worker_running+0x97/0x170 [ 247.061208][ T4205] worker_thread+0xad7/0x12a0 [ 247.065929][ T4205] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 247.071868][ T4205] kthread+0x42e/0x520 [ 247.075965][ T4205] ? rcu_lock_release+0x20/0x20 [ 247.080859][ T4205] ? kthread_blkcg+0xd0/0xd0 [ 247.085485][ T4205] ret_from_fork+0x1f/0x30 [ 247.089937][ T4205] [ 247.093330][ T4205] Kernel Offset: disabled [ 247.097950][ T4205] Rebooting in 86400 seconds..