last executing test programs: 3.485241312s ago: executing program 2 (id=104): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f00000000c0)={0x18, 0x2, {0xfffe, @loopback}}, 0x1e) connect$pptp(r0, &(0x7f0000000180)={0x18, 0x2, {0xfff8, @multicast1}}, 0x1e) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0xc0001, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000200)=0x1) dup3(r1, r0, 0x80000) ioctl$PPPIOCBRIDGECHAN(r1, 0x40047435, &(0x7f0000000280)=0x757d) 3.378341134s ago: executing program 2 (id=105): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000004680)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000004640)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xc}}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x44000) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYBLOB="400000001000390400000000fcffffff00000000", @ANYRES32=r2, @ANYBLOB="01980000000000002000128008000100677265001400028008000700ac", @ANYBLOB], 0x40}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0x439, 0x2, 0x0, {0x0, 0x0, 0x0, r2, 0x1040, 0x22900}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gre={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @local}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x81}]}}}]}, 0x40}}, 0x4040000) 3.152895287s ago: executing program 2 (id=106): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xa, 0x4, 0x4, 0x7, 0x0, 0x1}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=@base={0x5, 0x5, 0x2, 0x7, 0x0, 0x1, 0x10000}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0x10, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000480)={r2}, 0xc) 2.843417509s ago: executing program 2 (id=107): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='task\x00') getdents64(r1, &(0x7f0000000340)=""/4129, 0x1021) 1.427541903s ago: executing program 1 (id=113): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000000c0)=0x43, 0x4) setsockopt$inet6_int(r0, 0x29, 0x3, &(0x7f0000000000)=0x4, 0x4) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000040)=0x40, 0x4) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000700)="005dbd7db88b9d57fb739a73b503eacaa300cca2942e6c3ab33ee869fd3e43624b4d1846b348cf6899cf90bffff6585a62a45af32bd0c388b7958e412856c9f3be480685e67f071052f9cf72f5f7e953a4f931acd681b426b40c0310ed9dae0fe7c8aa991db50c7bf4753022877f11389738925ce95ad1c185d3461916d8da51328ad5b4fd3d7b3f881fb8654bcdf786330b35c060c128b93045b43f23e2a72a47f3ad0f5251cd82d72b329168c7493a2d5ee611351675b2c008650bbac44e375baf68d0aaa22b363c22476d30", 0xcd}, {&(0x7f00000002c0)="bc4e6c5420e3fea0818c8b8019f8214813aae7967a7ce15958e60d4d0ca03fdc73e12bfdd00b84bf18594e7c242ee6aa5fb3ed9b00249e0b011a1fdeb2b508fe05ac6b4526598d7fdf1b28b6789ee410fb8040a0187dc4c017db1d9c0adeeff80109d466edc100887221de4ea1e659e8370bf4b570765c6b1b", 0x79}, {&(0x7f0000000340)="44182252014d1eb70ab958a62e329e471eb7460a91180b2574a83d7f56aa41e845b649fadf9e917e65d80a3e169cda292dbde86d2c75ff740b7c2869e5b3be304074d488f59871788595615c43ff8d3e0569", 0x52}], 0x3}}], 0x1, 0x4000801) 1.359603041s ago: executing program 3 (id=114): syz_mount_image$ext4(&(0x7f0000000700)='ext3\x00', &(0x7f0000000740)='./file1\x00', 0x14, &(0x7f0000000840)={[{@norecovery}]}, 0xee, 0x474, &(0x7f0000000880)="$eJzs3EtsG0UfAPD/rvNo+viSr5RHSwuBgqh4JE36oAcuIJA4gIQEhyJOIUmrUrdBTZBoVUHhUI6oEnfEEYk7Eie4IOCAkLjCHVWqql5aOBmtvZs6jp06tRu3+PeT1p7ZXWfm79mxxzN2Auhb49lNErE1Iv6IiNFaduUJ47W7G9fOz/597fxsEpXKm1eT6nnXr52fLU4tHrellqlUIoaz5HCTci++EzFTLs+fyfOTS6fen1w8e+65E6dmjs8fnz89feTIwQN7hg5PH+oovjS/z+K6vuujhd07X3370uuzRy+9+/M3WX235sfr47gtWbQNxmvPbqNHs5snOyrsrvJrdrOtbkcy0PrkiQ2oEO0rRUTWXIPV/j8apRhZPjYar3za08oBd1SlUqk0e3/OXagA/2FJ9LoGQG8Ub/TZ599i26Chx13hyou1D0BZ3DfyrXZkYHnuYLDh8203jUfE0Qv/fJlt0Y15CACAW/g+G/8822z8l8YDdef9L19DGYuI/0fE9oi4LyJ2RMT9EdVzH4yIh9ZZfuMKyerxT3r5tgJrUzb+eyFf21o5/itGfzFWynPbqvEPJsdOlOf358/JvhgczvJTa5Txw8u/f16kNzUcqx//ZVtWfjEWzOtxeaBhgm5uZmmm07gLVz6J2DXQLP4kimWcJCJ2RsSu2yzjxNNf72517Nbxr2GNdaZ2Vb6KeKrW/hdiRfw3myppuT459fzh6UOTm6I8v3+yuCpW++W3i2+0Kr+j+Lsga//NTa//5VXgsWRTxOLZcyer67WL6y/j4p+f1fXpFavLWfzptxHrvv6Hkreq6aF834czS0tnpiKGktdW75+++dgiX5yfxb9vb/P+v72uxg9HRHYR74mIR/JF3KztHouIxyNi7xrx//TSE++1Oraq/UeK+NeYle+iLP65W7V/1Lf/+hOlkz9+13b8Tdv/YDW1L9/TzutfuxXs5LkDAACAe0Va/Q58kk4sp9N0YqL2Hf4dsTktLywuPXNs4YPTc7Xvyo/FYFrMdI3WzYdO5XPDRX66IX8gnzf+ojRSzU/MLpTneh089LktLfp/5q9Sr2sH3HFdWEcD7lH6P/Qv/R/6l/4P/Uv/h/7VrP9/3IN6ABvP+z/0L/0f+pf+D/1L/4e+1PK38WlHP/nvcaL43wkd/J2rvY+i48TInSwi0t4H2BeJgU4u43YSw00P9fiFCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoEv+DQAA//9L2OJW") ioctl$int_in(0xffffffffffffffff, 0x5452, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='.\x00', 0x0, 0x0) getdents64(r0, 0x0, 0x0) getdents64(r0, 0xfffffffffffffffe, 0x29) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x32, 0x0, &(0x7f0000000600)) 1.322543594s ago: executing program 2 (id=115): mknod$loop(&(0x7f0000000040)='./file0\x00', 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_POLL(r0, &(0x7f0000002440)={0x18, 0x0, r1, {0x7}}, 0x18) ioctl$HIDIOCGUSAGES(0xffffffffffffffff, 0xd01c4813, &(0x7f00000066c0)={{0x3, 0x1, 0xffffff21, 0x5, 0x632112db, 0x6}, 0x17b, [0x5, 0x3, 0x7, 0x3, 0x9f0, 0x200, 0x1, 0x3, 0x20a, 0x5, 0x1, 0x81, 0x8, 0x10, 0x7, 0x2, 0x0, 0x0, 0x7000000, 0x9, 0x9, 0x0, 0x1, 0x1, 0x6, 0x7fff, 0x337, 0x9, 0x10001, 0x1, 0x10000, 0x8, 0xfffffffb, 0xccbf, 0xffffff7f, 0x6, 0x2, 0xffffff43, 0x3, 0x7, 0x3c45, 0x6, 0x6214, 0x7fffffff, 0x80000000, 0x8, 0x19, 0x80000000, 0x8, 0x8, 0x7fffffff, 0x7d, 0xa8a, 0x9, 0x80000000, 0xcf4, 0x1, 0x6, 0x0, 0x8, 0x8, 0x5, 0x9, 0xfff, 0x80000001, 0x8, 0x6, 0x0, 0xe488, 0x1, 0x5, 0x2, 0x7, 0x2, 0x8, 0x7, 0x2, 0x32, 0x0, 0xf62b, 0xfffffffe, 0x0, 0x400, 0x3, 0x9, 0x1, 0x2, 0x55e, 0x2, 0x6, 0x2, 0x4, 0x7, 0xf, 0x401, 0x7ff, 0x2, 0x7, 0x10, 0xb, 0xffffffff, 0x1, 0x4, 0x5e, 0xfffff000, 0x2, 0x1, 0xed, 0x4, 0x80, 0x400, 0x6, 0x4, 0x9, 0x0, 0x0, 0x7fffffff, 0x7, 0xa59, 0x1, 0x6, 0x80000000, 0xa49, 0xba, 0x81, 0x2, 0x2, 0x4, 0x5, 0x6, 0x80000001, 0x80, 0x7, 0xe, 0x4, 0xfff, 0x1, 0x1ff, 0x10, 0x2, 0x3, 0x6df, 0xd, 0x6, 0xd0d4, 0xffffffff, 0x7c, 0x70d, 0x5, 0x3, 0xe, 0x1, 0x4, 0x3ff, 0x2, 0xd9, 0x8, 0x5, 0x9, 0x10001, 0xf, 0x5, 0x1, 0x8, 0x9, 0x80000000, 0x31, 0x2, 0xef, 0x8, 0x2, 0x2, 0x1, 0x1, 0xff, 0x625, 0x2, 0xfffffff7, 0x10, 0x3, 0x8, 0xde19, 0x2, 0x6, 0x3, 0x2, 0x1800000, 0x10000, 0x0, 0x7, 0x10000, 0x7, 0x7, 0x605, 0x8, 0x3ff, 0x48, 0x7, 0x6, 0x1000000, 0x198, 0x3, 0x34024418, 0x4, 0x9, 0x57c, 0x0, 0x180660e3, 0xb, 0x0, 0x7, 0x100, 0x80000001, 0x5, 0x1, 0x4, 0x1, 0x800080, 0x7, 0xdf, 0x4, 0x4, 0x6, 0x80000001, 0x80000001, 0x9, 0x3, 0x0, 0x80, 0x4, 0x8, 0xa222, 0x9, 0x3, 0x8, 0xa5d, 0x80, 0x7, 0x7, 0x80000000, 0x3e0f, 0xff, 0xe, 0x82, 0x4, 0x7, 0x13, 0x0, 0x10001, 0x8, 0x9, 0x9, 0x4, 0x3, 0x4, 0x7, 0xfff, 0xfff, 0x5, 0x938b, 0x3, 0x3, 0x7, 0x5, 0x7, 0x87, 0x9, 0x1ff, 0x8, 0x114, 0xffffffff, 0x4, 0x19, 0x4a4a1aaa, 0x5, 0x7, 0x3ff, 0xf8d, 0x7fff, 0x2, 0x7, 0x8000000, 0xfffffff9, 0x8, 0x9, 0x2, 0x9, 0x9, 0x2, 0x5, 0x901, 0xff, 0x6a8e, 0x8, 0x5, 0x6, 0x1, 0x7, 0x8, 0x7, 0x2, 0xbabb, 0x9, 0x6, 0xffffffff, 0x6, 0x704f, 0xc8, 0x7, 0x3, 0x8, 0xb, 0x4, 0xfffffff8, 0xe6af, 0x8, 0x1, 0xf, 0x8000, 0x2, 0xb, 0x7ff, 0x7, 0x2a04, 0xf, 0x2, 0x9, 0x351e5b2b, 0x2dd4a23d, 0x6bc, 0xffff, 0x1, 0x2, 0x4, 0x8e1c, 0x1, 0x7, 0xee, 0x1a4, 0x7, 0x506236f0, 0x8, 0x3, 0xe6, 0x1, 0xb6, 0x5, 0x9, 0x7, 0x401, 0x9f6, 0xfffffffd, 0x463ed523, 0x4, 0x3, 0x4, 0x3, 0x4, 0x1000, 0x3, 0x9, 0xfffd, 0x8, 0x77d4, 0x9, 0x3, 0x80, 0xe, 0x6, 0x7, 0x9, 0xe4b1, 0x83, 0x8, 0x9, 0xffffff3b, 0x131b, 0xb2c3, 0x8000, 0x4, 0x5, 0x6, 0x1ff, 0x3, 0x8, 0x7fff, 0x2, 0x0, 0x2fc, 0xfffffffa, 0x101, 0x4, 0x3, 0x7, 0xffffffff, 0x3, 0x6, 0x7, 0x3, 0x3368, 0x0, 0x7, 0x4, 0x0, 0x2, 0x5, 0x1, 0x56da, 0x4, 0x775d3adb, 0x7fffffff, 0x10001, 0xfffffffa, 0x8, 0x9, 0xf31, 0x7, 0x8000, 0x1e3, 0x3c9000, 0x6, 0x3, 0x5, 0x1, 0x0, 0x6, 0x7fffffff, 0xc, 0x9ca, 0x6, 0x7, 0xb5d, 0xffffffff, 0x3e3f, 0x2f, 0x7, 0x10000, 0x9, 0x2, 0x7fffffff, 0x3, 0x401, 0x9, 0x5, 0x28, 0x8, 0x9, 0x6, 0x8000, 0x1, 0x0, 0x2, 0x9c1f, 0xe70, 0x1, 0x0, 0x5, 0xcf, 0x1, 0x0, 0x6, 0x61fc, 0xf8, 0x7f40, 0x80000001, 0x7, 0x251e, 0x5, 0x3ff, 0x1, 0x61, 0x6, 0x2, 0x101, 0x5, 0xc7, 0x10000, 0x9, 0x0, 0x4db, 0x2f9, 0x6, 0x6, 0x2b2, 0x4, 0x5, 0x101, 0x2, 0x0, 0xfffffffd, 0xc, 0xfffffffe, 0x8f16, 0x7, 0x7f, 0x9, 0x801, 0x7, 0x47d5, 0x8, 0x3, 0x4, 0x2, 0x7, 0x6, 0x7, 0x8, 0x2, 0x4, 0xa, 0x5989, 0x7, 0x335b, 0xfffff657, 0x0, 0x3, 0x101, 0x5, 0x0, 0x100, 0x1ff, 0x7, 0x7, 0x4, 0xae37, 0x3, 0x8, 0x6, 0x5, 0xfa0, 0x3, 0x8, 0x2, 0xfff, 0x9, 0x9, 0xd8b3, 0x3, 0x1, 0x0, 0xbb, 0x6, 0xffffffff, 0xffff7fff, 0x1, 0x8, 0x2, 0x0, 0x7, 0x6, 0xffffff80, 0x10, 0x3, 0x6, 0x80000001, 0x8005, 0x86, 0x18000000, 0x4, 0x5, 0x6, 0x8, 0xc1, 0x7, 0xfffff644, 0x0, 0x9, 0xa, 0x80, 0x3, 0x101, 0xf0, 0x3ff5, 0xffffffff, 0xa033, 0x3, 0xb26, 0x9, 0xd, 0x9, 0x4, 0xb, 0x81, 0x6, 0x1, 0x2, 0x3, 0x88, 0x6be, 0xcb, 0x5e76d2c9, 0x2, 0xff, 0x8, 0xb, 0x8000, 0x5, 0x1, 0x8, 0xc16, 0x6, 0xc3, 0x2aa5dc41, 0x0, 0x7fff, 0x3, 0x0, 0x2, 0x60ca2fbd, 0x2, 0x7, 0xd, 0xfffffffe, 0x7, 0x1, 0x2, 0x4993, 0x7, 0x101, 0x5, 0x5a81, 0x200, 0x6, 0xa85, 0xb5, 0x0, 0x1, 0x6, 0x9, 0x7fff, 0xfe000000, 0x8, 0x87f, 0x0, 0x3, 0x5, 0x7, 0x4, 0x5, 0x2, 0x1, 0x10000, 0x8, 0x4, 0x3, 0x5, 0x3, 0x8, 0xd32e, 0xffffffff, 0x6, 0x2, 0x2, 0x4, 0x4, 0x210, 0x8, 0x8000, 0xdf6, 0x7, 0x5, 0x7, 0x2, 0x2, 0x124, 0x3, 0x40, 0x8, 0x0, 0xff, 0x7, 0x2, 0x10, 0x8, 0x2, 0x2, 0xa00c, 0x6, 0x7, 0x5, 0x8, 0x4ec4, 0x2, 0xf323, 0xffff35b8, 0x9, 0x3, 0x800, 0x3, 0xb2, 0x7ff, 0x0, 0x6, 0x80000000, 0x4, 0xb, 0x0, 0x6, 0x1, 0x998c, 0x7e51caee, 0xfffffffd, 0x7, 0x5, 0x6, 0x2, 0x7, 0x3ff, 0x7f473ed4, 0x4, 0x2d6d, 0x3, 0x0, 0xf, 0x0, 0x100, 0x2, 0x0, 0x6, 0x30cd, 0x0, 0xfff, 0x9543, 0x1, 0x8, 0x45, 0x2, 0x8, 0x81, 0x7f, 0xc, 0x98, 0x7, 0x6, 0xffffffff, 0x1000, 0x1, 0x9, 0x0, 0x100, 0x8, 0x7fffffff, 0x3, 0x3, 0xf307, 0x49b, 0x7, 0x7, 0xfd, 0x9, 0x4, 0x4, 0x2a3, 0x822, 0x3, 0x200, 0x8000, 0xe2d, 0x5, 0x1, 0x400, 0x4, 0x1000, 0x5, 0x9, 0xd44, 0x1, 0xde, 0x4c, 0x1, 0x7ff, 0x5, 0x3, 0x3, 0xff, 0xffffffff, 0x1, 0xb73, 0xa07e, 0x1ff, 0x0, 0xffff, 0x1bd, 0x81, 0x1, 0x0, 0x7, 0x1, 0x2bb, 0x2, 0x10000, 0x1, 0xfffffffe, 0x5, 0xb, 0x2f8, 0x0, 0x71db, 0xeb, 0x9, 0xb, 0x40, 0xa9, 0x6, 0x1, 0x1ff, 0x35f, 0x4, 0x9, 0x7, 0x8000, 0x1ff, 0x6, 0x43, 0x8, 0x7fffffff, 0x3, 0x6, 0x0, 0x3, 0xc9, 0x8, 0x5, 0xc, 0x18a6, 0xc, 0x0, 0x6, 0x5, 0x6, 0x7, 0x5, 0x401, 0x9, 0x6, 0x4fa, 0x9, 0x38, 0x2, 0xb, 0x7f, 0x7, 0x8, 0x2, 0x0, 0x0, 0x4, 0x4ac5, 0x6, 0x7, 0xd2b1, 0x3, 0xe, 0x6, 0x68, 0x26, 0xff, 0x8362, 0x2, 0x15a, 0x800, 0x4, 0xcc, 0xa6d, 0x167, 0x5, 0x1ff, 0x5, 0x7459, 0x40, 0x8, 0x0, 0x7, 0x40, 0x4, 0x10001, 0xe5f6, 0x6, 0x9, 0x1, 0x4, 0x9, 0x4f, 0x400, 0x2, 0x400, 0xc, 0x9, 0x1ff, 0x6, 0x2c0, 0xfc0, 0x102, 0xfff, 0x4, 0x1, 0x2, 0x1, 0x3, 0x0, 0x0, 0x7, 0x4, 0xd, 0x10000, 0xfffffffb, 0x0, 0x7, 0x4, 0x8001, 0x5, 0x0, 0x7, 0x10, 0x200, 0xfff, 0x3, 0x8, 0xa, 0x417, 0x5, 0x1, 0xee, 0x7, 0x6, 0x9, 0x6, 0x2, 0x9, 0x3, 0x6, 0x75d5, 0x8, 0xe9a4, 0xc, 0xffff7fff, 0x3, 0x51cc, 0x6, 0xdb62, 0x80000001, 0x7, 0x625, 0x4, 0x8, 0x9, 0x9, 0x7, 0x8, 0xfffffffd, 0x5, 0x80000, 0x3, 0x506f, 0x3, 0x8, 0x16, 0x9, 0x5, 0x8, 0xf, 0x8, 0x6, 0x47e, 0x1, 0x1ff, 0x2, 0x0, 0x80000000, 0x184, 0x6e, 0x6, 0xa86, 0x8000, 0x1, 0x1, 0x516d, 0x5f, 0x1a, 0x752, 0x4, 0x3, 0x81, 0x7, 0x4, 0x6, 0x7, 0x4ed, 0x0, 0x400, 0xffffffd7, 0x4d, 0xfff, 0x3, 0x6, 0xffffff81, 0x81, 0x4, 0x3, 0x7ff, 0x4, 0x82, 0xf, 0x6, 0x4f3e, 0x3, 0x800, 0x8, 0x7ff, 0x8, 0xcb4c, 0x2, 0x3, 0x43, 0x6, 0x1, 0xfffffffc, 0x3, 0xffff, 0x7fffffff, 0x5, 0xb6, 0x1, 0x4]}) stat(&(0x7f0000009a80)='./file0\x00', &(0x7f0000009ac0)) 1.299270087s ago: executing program 0 (id=116): fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x0, 0x4, 0x0, 0x1, 0x40}, @exit], &(0x7f00000002c0)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x4}, 0x94) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) setsockopt$packet_int(r0, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) 1.082680529s ago: executing program 1 (id=117): r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000200), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000300)='0', 0x1) syz_mount_image$squashfs(&(0x7f00000004c0), &(0x7f0000000500)='./file0\x00', 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='\x00'], 0x1, 0x226, &(0x7f0000000cc0)="$eJzKKC4sZmdgYPj7sSaZgUGAAQRYGEQYLjAwMrAwMDDIM4KFGD4yQeipUPomlGaDyl+B0r5Q8XYo/de8KiKKgYExU+meGdMB8RRFRgEGHpGvpx4wJDPwxzJYzvNecykoc8pVobdL94PUe4VWbmJgVE/hXzRnwwSnmbxgYxkjo5DNYT4gM4sDZBADA8PkPxH3HrBIMoggmSXK8U/sVMvyVWad9xlmdExLY2DkhDiGQXemnQFvNxPUzOLKquzEnJzUouIzDKjmT2bcz6TICFJ35u/V4AeMdgzdsQyMDHIb/NUWf/sjVblxU33k9KqImqndTTeXro9j2Kb/94qJ1PuJGWH/HxwS1LLIy/8wT0bp++aGOR9q6p6YOHY2Ks/lb7389937mNriBDWmx+JdhWz8CW5aNZ+cndwsH89Nr27fUqy4ICvNZeKxqRf/Jhxfy8Aw+cITW/2aM4fiFWM4pdwq58bcdYsX5Fqmfr7uDQPDwajPExkYlzPuZ2JgmBm2cw+yv8oboJHBwMzAwKDCwMDAxMDCkJaZk2rgwcDIwAzlGLJAVcFUMzFwgCX0kvNzUtoZGMFJAKxtOQML3AzDxwyscI4RMsfYogFqEkM7lFaB0h5QejmUfgyl5dGSDUsDKKr6oTyNBgYGNoaKxJKSIkM2BgYoCy5mBBczEoDbzAS1dS4TqueOMzGMglEwCkbBKBgFo2AUjIJRMApGwUgGgAAAAP//Nfi4SQ==") open(&(0x7f0000000f00)='./file0/file0\x00', 0x103000, 0x2) 1.002725767s ago: executing program 0 (id=118): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8d40, 0x0) ppoll(&(0x7f00000002c0)=[{r0, 0x2}, {r0, 0x3021}], 0x2, 0x0, 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000080)=0xfffffffa) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "00769a7d8200010000001495595915303d6000"}) r1 = syz_open_pts(r0, 0x0) ioctl$TCFLSH(r1, 0x540b, 0x2) 820.967276ms ago: executing program 3 (id=119): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f00000000c0)={0x18, 0x0, {0x4, @remote, 'macvlan0\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r1, 0x40047438, &(0x7f0000000040)) write$ppp(r1, &(0x7f00000002c0)="0281", 0x2) 782.22636ms ago: executing program 0 (id=120): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(r0, 0x3b86, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r0, 0x3b87, &(0x7f0000000600)={0x18, 0x1, 0x0, 0x0, r1}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r1}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000007c0)={0x28, 0x7, r1, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1004000}) 633.046435ms ago: executing program 1 (id=121): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000001280)={0xa, 0x4e21, 0x3, @ipv4={'\x00', '\xff\xff', @empty}, 0x4}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f00000012c0)=0x7fffffff, 0x4) connect$inet6(r0, &(0x7f0000001300)={0xa, 0x4e21, 0x659, @empty, 0xfb}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) recvmmsg$unix(r1, &(0x7f0000001380)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000013c0)}}], 0x1dd, 0x10003, 0x0) 611.001118ms ago: executing program 0 (id=122): r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000000)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x100, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22, 0x0, @rand_addr, 0x10000}, 0x1c) close(r0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000380)=[{&(0x7f00000003c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000001925aa80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) 546.239544ms ago: executing program 3 (id=123): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000000580)='./bus\x00', &(0x7f00000005c0), 0x40, &(0x7f0000000600)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000007c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000840)='./file0\x00', 0x200) 438.857685ms ago: executing program 1 (id=124): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000003, 0x4031, 0xffffffffffffffff, 0x0) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f00000000c0)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r0, 0x7a5, &(0x7f0000000100)={{@my=0x0}, 0x0, 0x1}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r0, 0x7a5, &(0x7f0000000140)={{@my=0x0}, 0x1, 0x0, 0x10001}) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r0, 0x7a6, &(0x7f0000000180)={0x20000020064e, 0xe, 0x200000, 0x3, 0x5, 0x9}) 432.724036ms ago: executing program 3 (id=125): open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x1000) stat(&(0x7f00000072c0)='./file0/file2\x00', 0x0) unlink(&(0x7f0000000080)='./file0/file1\x00') 374.285162ms ago: executing program 0 (id=126): fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000040)='mem\x00\xffEev\xf2r\xf1\x18\x1d\xb9\x00y_hug$\bo-\x03Q`]o\x8cr\x9d_etl\xf9\xdd\a\xad\\H\xe94\b,H\xbf', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1fd) mount(0x0, &(0x7f0000000080)='my_sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xff, 0x0, 0x12, r1, 0x0) preadv2(r0, &(0x7f00000005c0)=[{&(0x7f0000000140)=""/99, 0x63}], 0x1, 0x3, 0xfffff53a, 0x0) 299.842139ms ago: executing program 2 (id=127): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000140), 0x123080) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r0, 0x40045402, &(0x7f0000000180)=0x1) ppoll(&(0x7f00000001c0)=[{r0, 0x80a0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000200)={{0x3, 0x3, 0x0, 0x0, 0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000240)={0x0, 0x9dc8, 0x0, 0x0, 0xf}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) 260.332734ms ago: executing program 1 (id=128): r0 = socket$packet(0x11, 0x3, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e000000850000007d00000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040)=r1, 0x4) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'veth0_to_hsr\x00', 0x0}) sendto$packet(r2, 0x0, 0x0, 0x100400c1, &(0x7f0000000200)={0x11, 0x8100, r3, 0x1, 0x87, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) 240.650235ms ago: executing program 0 (id=129): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x17f) mount(0x0, &(0x7f0000000040)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./mysys/bus/pci/devices/0000:00:05.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x4000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000180)={0x8004000, 0x0, 0x0, 0xfffffffffffffffd, {0x2c}, 0x0, 0x0, 0x0, 0x0}, 0x58) 226.807386ms ago: executing program 3 (id=130): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x4) mount(0x0, &(0x7f00000002c0)='./gadget\x00', &(0x7f0000000300)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000080)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x10, 0x3bee3f9f87c5003e, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 137.223676ms ago: executing program 1 (id=131): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f00000000c0)={0xcf50, 0x0, 0xffff, 0x9dff, 0x15}) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)={0x0, 0x0, 0xfffffff9, 0x0, 0xd, "0062007d82000000000000002240f7ffffff00"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000200)=0x17) 0s ago: executing program 3 (id=132): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/pnp/drivers/serial\x00', 0x80, 0x0) r1 = openat(r0, &(0x7f0000000840)='unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000880)='00:03', 0x5) r2 = openat(r0, &(0x7f00000008c0)='bind\x00', 0x1, 0x0) write(r2, &(0x7f0000000900)='00:03', 0x5) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.48' (ED25519) to the list of known hosts. [ 75.421431][ T5779] cgroup: Unknown subsys name 'net' [ 75.553306][ T5779] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 77.298983][ T5779] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 78.973947][ T5793] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 78.986152][ T5793] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 78.995521][ T5793] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 78.999652][ T5799] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 79.005122][ T5793] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 79.015227][ T5799] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 79.021110][ T5793] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 79.028698][ T5799] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 79.035660][ T5793] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 79.044403][ T5799] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 79.066123][ T5799] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 79.073692][ T5799] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 79.125578][ T52] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 79.139997][ T52] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 79.155788][ T52] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 79.159563][ T5790] (null): rxe_set_mtu: Set mtu to 1024 [ 79.194461][ T52] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 79.202116][ T5101] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 79.208146][ T5795] (null): rxe_set_mtu: Set mtu to 1024 [ 79.216223][ T5790] rxe_eth0 speed is unknown, defaulting to 1000 [ 79.216615][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 79.227616][ T5790] rxe_eth0 speed is unknown, defaulting to 1000 [ 79.236466][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 79.236551][ T5101] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 79.243373][ T5795] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 79.258194][ T52] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 79.274040][ T5799] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 79.288023][ T5790] rxe_eth0 speed is unknown, defaulting to 1000 [ 79.288533][ T5799] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 79.303589][ T5799] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 79.331571][ T5794] (null): rxe_set_mtu: Set mtu to 1024 [ 79.353486][ T5802] (null): rxe_set_mtu: Set mtu to 1024 [ 79.353936][ T5794] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 79.360685][ T5802] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 79.624017][ T5790] infiniband rxe0: set active [ 79.639096][ T5790] infiniband rxe0: added rxe_eth0 [ 79.650598][ T790] rxe_eth0 speed is unknown, defaulting to 1000 [ 79.699464][ T5790] RDS/IB: rxe0: added [ 79.704317][ T5790] smc: adding ib device rxe0 with port count 1 [ 79.711350][ T5790] smc: ib device rxe0 port 1 has pnetid [ 79.752335][ T790] rxe_eth0 speed is unknown, defaulting to 1000 [ 79.760143][ T5790] rxe_eth0 speed is unknown, defaulting to 1000 [ 79.832459][ T5795] chnl_net:caif_netlink_parms(): no params data found [ 79.943153][ T5794] chnl_net:caif_netlink_parms(): no params data found [ 80.113073][ T5802] chnl_net:caif_netlink_parms(): no params data found [ 80.175415][ T5790] rxe_eth0 speed is unknown, defaulting to 1000 [ 80.187426][ T5795] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.204924][ T5795] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.212974][ T5795] bridge_slave_0: entered allmulticast mode [ 80.237377][ T5795] bridge_slave_0: entered promiscuous mode [ 80.312822][ T5795] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.331037][ T5795] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.350910][ T5795] bridge_slave_1: entered allmulticast mode [ 80.366377][ T5795] bridge_slave_1: entered promiscuous mode [ 80.442505][ T5790] rxe_eth0 speed is unknown, defaulting to 1000 [ 80.563736][ T5795] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.599649][ T5795] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.644574][ T5794] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.665435][ T5794] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.672976][ T5794] bridge_slave_0: entered allmulticast mode [ 80.706599][ T5794] bridge_slave_0: entered promiscuous mode [ 80.716124][ T5794] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.723484][ T5794] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.731215][ T5794] bridge_slave_1: entered allmulticast mode [ 80.739908][ T5794] bridge_slave_1: entered promiscuous mode [ 80.820672][ T5795] team0: Port device team_slave_0 added [ 80.843368][ T5795] team0: Port device team_slave_1 added [ 80.873068][ T5794] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.882596][ T5802] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.890426][ T5802] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.898993][ T5802] bridge_slave_0: entered allmulticast mode [ 80.907346][ T5802] bridge_slave_0: entered promiscuous mode [ 80.920147][ T5802] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.928995][ T5802] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.937017][ T5802] bridge_slave_1: entered allmulticast mode [ 80.944554][ T5802] bridge_slave_1: entered promiscuous mode [ 80.965468][ T5794] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.001878][ T5790] rxe_eth0 speed is unknown, defaulting to 1000 [ 81.013085][ T5794] team0: Port device team_slave_0 added [ 81.053635][ T5802] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.066107][ T5793] Bluetooth: hci0: command tx timeout [ 81.082337][ T5795] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.094872][ T5795] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.121810][ T5795] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.138291][ T5795] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.147275][ T5795] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.174424][ T5793] Bluetooth: hci1: command tx timeout [ 81.180539][ T5795] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.211875][ T5794] team0: Port device team_slave_1 added [ 81.235525][ T5802] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.306447][ T5794] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.313875][ T5794] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.343688][ T5793] Bluetooth: hci2: command tx timeout [ 81.352223][ T5794] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.369610][ T5802] team0: Port device team_slave_0 added [ 81.380208][ T5802] team0: Port device team_slave_1 added [ 81.385071][ T5793] Bluetooth: hci3: command tx timeout [ 81.407451][ T5795] hsr_slave_0: entered promiscuous mode [ 81.416043][ T5795] hsr_slave_1: entered promiscuous mode [ 81.424362][ T5794] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.432640][ T5794] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.461492][ T5794] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.498557][ T5802] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.506029][ T5802] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.533985][ T5802] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.579089][ T5794] hsr_slave_0: entered promiscuous mode [ 81.585795][ T5794] hsr_slave_1: entered promiscuous mode [ 81.592906][ T5794] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 81.601532][ T5794] Cannot create hsr debugfs directory [ 81.608510][ T5802] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.615995][ T5802] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.646491][ T5802] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.815789][ T5802] hsr_slave_0: entered promiscuous mode [ 81.822568][ T5802] hsr_slave_1: entered promiscuous mode [ 81.830500][ T5802] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 81.838655][ T5802] Cannot create hsr debugfs directory [ 82.139241][ T5795] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 82.194938][ T5795] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 82.255285][ T5795] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 82.273085][ T5795] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 82.329235][ T5790] chnl_net:caif_netlink_parms(): no params data found [ 82.355363][ T5794] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 82.419049][ T5794] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 82.432402][ T5794] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 82.475705][ T5802] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 82.491405][ T5794] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 82.512615][ T5802] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 82.553643][ T5802] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 82.565875][ T5802] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 82.593000][ T5790] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.607718][ T5790] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.615959][ T5790] bridge_slave_0: entered allmulticast mode [ 82.623761][ T5790] bridge_slave_0: entered promiscuous mode [ 82.632759][ T5790] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.641189][ T5790] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.651072][ T5790] bridge_slave_1: entered allmulticast mode [ 82.659184][ T5790] bridge_slave_1: entered promiscuous mode [ 82.698547][ T5790] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.712371][ T5790] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.767456][ T5790] team0: Port device team_slave_0 added [ 82.782861][ T5790] team0: Port device team_slave_1 added [ 82.825678][ T5790] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.833191][ T5790] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.861514][ T5790] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.879210][ T5790] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.887065][ T5790] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.918221][ T5790] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.001078][ T5790] hsr_slave_0: entered promiscuous mode [ 83.011204][ T5790] hsr_slave_1: entered promiscuous mode [ 83.018847][ T5790] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 83.026958][ T5790] Cannot create hsr debugfs directory [ 83.145533][ T5793] Bluetooth: hci0: command tx timeout [ 83.183863][ T5795] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.221094][ T5794] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.229025][ T5793] Bluetooth: hci1: command tx timeout [ 83.277250][ T5795] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.294181][ T5802] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.348298][ T3458] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.355789][ T3458] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.369260][ T3458] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.376507][ T3458] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.384921][ T5793] Bluetooth: hci2: command tx timeout [ 83.392673][ T5794] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.403282][ T5802] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.429294][ T3458] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.436517][ T3458] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.452680][ T3458] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.459872][ T3458] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.464977][ T5793] Bluetooth: hci3: command tx timeout [ 83.474432][ T3458] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.481605][ T3458] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.533881][ T3458] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.541098][ T3458] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.573360][ T5790] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 83.596307][ T5790] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 83.609258][ T5790] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 83.619067][ T5790] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 83.690692][ T5795] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 83.779393][ T5802] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 84.011473][ T5790] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.054391][ T5790] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.071500][ T3458] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.079580][ T3458] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.138593][ T3479] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.145901][ T3479] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.251315][ T5795] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.353164][ T5802] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.387181][ T5794] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.412474][ T5795] veth0_vlan: entered promiscuous mode [ 84.466901][ T5795] veth1_vlan: entered promiscuous mode [ 84.572108][ T5794] veth0_vlan: entered promiscuous mode [ 84.608011][ T5802] veth0_vlan: entered promiscuous mode [ 84.631471][ T5795] veth0_macvtap: entered promiscuous mode [ 84.660847][ T5794] veth1_vlan: entered promiscuous mode [ 84.692369][ T5795] veth1_macvtap: entered promiscuous mode [ 84.707884][ T5802] veth1_vlan: entered promiscuous mode [ 84.762401][ T5790] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.783425][ T5794] veth0_macvtap: entered promiscuous mode [ 84.810792][ T5795] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.822134][ T5794] veth1_macvtap: entered promiscuous mode [ 84.855890][ T5795] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.864281][ T5802] veth0_macvtap: entered promiscuous mode [ 84.882794][ T5802] veth1_macvtap: entered promiscuous mode [ 84.926595][ T5794] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.939740][ T5794] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.954429][ T5794] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.974001][ T5794] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.986631][ T5794] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.999721][ T5794] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.016537][ T5795] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.026535][ T5795] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.036210][ T5795] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.045555][ T5795] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.073913][ T5802] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.087117][ T5802] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.098576][ T5802] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.111874][ T5802] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.126813][ T5802] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.148627][ T5790] veth0_vlan: entered promiscuous mode [ 85.168182][ T5802] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.179144][ T5802] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.193377][ T5802] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.204975][ T5802] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.217642][ T5802] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.227224][ T5793] Bluetooth: hci0: command tx timeout [ 85.244217][ T5794] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.258301][ T5794] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.268759][ T5794] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.278294][ T5794] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.300196][ T5802] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.305301][ T5793] Bluetooth: hci1: command tx timeout [ 85.311545][ T5802] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.323804][ T5802] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.333378][ T5802] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.390138][ T5790] veth1_vlan: entered promiscuous mode [ 85.466302][ T5793] Bluetooth: hci2: command tx timeout [ 85.545570][ T5793] Bluetooth: hci3: command tx timeout [ 85.561844][ T3458] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.573474][ T1148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.581707][ T1148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.583032][ T3458] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.591218][ T5790] veth0_macvtap: entered promiscuous mode [ 85.630635][ T5790] veth1_macvtap: entered promiscuous mode [ 85.678520][ T3499] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.688120][ T3499] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.717552][ T5790] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.728614][ T5790] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.739828][ T5790] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.752990][ T5790] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.762965][ T5790] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.774549][ T5790] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.787102][ T5790] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.816446][ T3499] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.825581][ T3499] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.878127][ T5790] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.890094][ T3499] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.895423][ T5790] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.904079][ T3499] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.909055][ T5790] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.926624][ T5790] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.937199][ T5790] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.949280][ T5790] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.960842][ T5790] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.022914][ T5790] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.033660][ T5790] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.057455][ T5795] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 86.069192][ T5790] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.093107][ T5790] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.116154][ T3458] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.124064][ T3458] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.459635][ T3479] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.470496][ T5883] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 86.495877][ T3479] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.574279][ T1148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.597890][ T1148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.226330][ T5902] syz.1.10[5902]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 87.310786][ T5793] Bluetooth: hci0: command tx timeout [ 87.353127][ T5902] loop1: detected capacity change from 0 to 1764 [ 87.387798][ T5793] Bluetooth: hci1: command tx timeout [ 87.433167][ T5907] loop3: detected capacity change from 0 to 256 [ 87.452438][ T5907] ======================================================= [ 87.452438][ T5907] WARNING: The mand mount option has been deprecated and [ 87.452438][ T5907] and is ignored by this kernel. Remove the mand [ 87.452438][ T5907] option from the mount to silence this warning. [ 87.452438][ T5907] ======================================================= [ 87.508441][ T5907] exfat: Deprecated parameter 'utf8' [ 87.547021][ T5793] Bluetooth: hci2: command tx timeout [ 87.555331][ T5907] exfat: Deprecated parameter 'namecase' [ 87.590680][ T5909] process 'syz.0.11' launched './file0' with NULL argv: empty string added [ 87.595248][ T5907] exfat: Deprecated parameter 'namecase' [ 87.625736][ T5793] Bluetooth: hci3: command tx timeout [ 87.675771][ T5907] exfat: Deprecated parameter 'utf8' [ 87.768586][ T5907] exFAT-fs (loop3): failed to load upcase table (idx : 0x00012153, chksum : 0xc9bffc20, utbl_chksum : 0xe619d30d) [ 87.780500][ T5912] input: syz1 as /devices/virtual/input/input5 [ 87.892936][ T5803] udevd[5803]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 89.452589][ T5941] loop1: detected capacity change from 0 to 128 [ 89.553302][ T5941] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 89.598715][ T5941] ext4 filesystem being mounted at /6/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 89.890981][ T5790] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 90.094516][ T5956] FAULT_INJECTION: forcing a failure. [ 90.094516][ T5956] name failslab, interval 1, probability 0, space 0, times 1 [ 90.124933][ T5956] CPU: 1 PID: 5956 Comm: syz.3.30 Not tainted syzkaller #0 [ 90.128475][ T5958] loop2: detected capacity change from 0 to 1024 [ 90.132552][ T5956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 90.132597][ T5956] Call Trace: [ 90.132608][ T5956] [ 90.132619][ T5956] dump_stack_lvl+0x18c/0x250 [ 90.161797][ T5956] ? show_regs_print_info+0x20/0x20 [ 90.167242][ T5956] ? load_image+0x420/0x420 [ 90.172225][ T5956] ? __mod_timer+0x9b0/0xd60 [ 90.176846][ T5956] should_fail_ex+0x394/0x4c0 [ 90.181984][ T5956] should_failslab+0x9/0x20 [ 90.186514][ T5956] slab_pre_alloc_hook+0x59/0x300 [ 90.191831][ T5956] kmem_cache_alloc_node+0x5e/0x320 [ 90.197750][ T5956] ? __alloc_skb+0x103/0x2c0 [ 90.202364][ T5956] __alloc_skb+0x103/0x2c0 [ 90.206827][ T5956] skb_copy+0x126/0x700 [ 90.211088][ T5956] ? trace_inet_sock_set_state+0x80/0x1c0 [ 90.216955][ T5956] tcp_send_synack+0x1f1/0xd60 [ 90.222226][ T5956] ? ktime_get_real_ts64+0x440/0x440 [ 90.227760][ T5956] ? tcp_send_active_reset+0x6c0/0x6c0 [ 90.233362][ T5956] ? __tcp_mtu_to_mss+0x236/0x3a0 [ 90.238447][ T5956] ? tcp_sync_mss+0x175/0x310 [ 90.243173][ T5956] tcp_rcv_state_process+0x13c7/0x4440 [ 90.248682][ T5956] ? tcp_finish_connect+0x5c0/0x5c0 [ 90.253909][ T5956] ? __local_bh_enable_ip+0x13a/0x1c0 [ 90.259691][ T5956] ? lockdep_hardirqs_on+0x98/0x150 [ 90.265192][ T5956] ? __local_bh_enable_ip+0x13a/0x1c0 [ 90.270987][ T5956] ? _local_bh_enable+0xa0/0xa0 [ 90.276247][ T5956] tcp_v4_do_rcv+0x3c0/0xba0 [ 90.280907][ T5956] __release_sock+0x1ea/0x460 [ 90.285647][ T5956] release_sock+0x5f/0x1c0 [ 90.290171][ T5956] __inet_stream_connect+0x91a/0xf50 [ 90.295507][ T5956] ? inet_dgram_connect+0x340/0x340 [ 90.301024][ T5956] ? wait_woken+0x180/0x180 [ 90.305601][ T5956] ? _local_bh_enable+0xa0/0xa0 [ 90.310596][ T5956] inet_stream_connect+0x66/0xa0 [ 90.315745][ T5956] __sys_connect+0x3da/0x470 [ 90.320424][ T5956] ? __sys_connect_file+0x170/0x170 [ 90.325667][ T5956] __x64_sys_connect+0x7a/0x90 [ 90.330542][ T5956] do_syscall_64+0x55/0xb0 [ 90.335154][ T5956] ? clear_bhb_loop+0x40/0x90 [ 90.339849][ T5956] ? clear_bhb_loop+0x40/0x90 [ 90.344723][ T5956] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 90.350940][ T5956] RIP: 0033:0x7fa2f439f559 [ 90.355408][ T5956] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.375591][ T5956] RSP: 002b:00007fa2f5239028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 90.384512][ T5956] RAX: ffffffffffffffda RBX: 00007fa2f4625fa0 RCX: 00007fa2f439f559 [ 90.392774][ T5956] RDX: 0000000000000010 RSI: 0000200000000280 RDI: 0000000000000004 [ 90.401227][ T5956] RBP: 00007fa2f4436b50 R08: 0000000000000000 R09: 0000000000000000 [ 90.409325][ T5956] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 90.417685][ T5956] R13: 00007fa2f4626038 R14: 00007fa2f4625fa0 R15: 00007fff35700ed8 [ 90.426144][ T5956] [ 90.429401][ C1] vkms_vblank_simulate: vblank timer overrun [ 90.551881][ T5958] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 90.596705][ T5958] EXT4-fs (loop2): stripe (3) is not aligned with cluster size (16), stripe is disabled [ 90.631980][ T5958] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 90.795121][ T5958] FAULT_INJECTION: forcing a failure. [ 90.795121][ T5958] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 90.840391][ T5958] CPU: 1 PID: 5958 Comm: syz.2.31 Not tainted syzkaller #0 [ 90.848050][ T5958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 90.858244][ T5958] Call Trace: [ 90.861568][ T5958] [ 90.864627][ T5958] dump_stack_lvl+0x18c/0x250 [ 90.869548][ T5958] ? show_regs_print_info+0x20/0x20 [ 90.875072][ T5958] ? load_image+0x420/0x420 [ 90.879732][ T5958] ? __lock_acquire+0x7eb0/0x7eb0 [ 90.884822][ T5958] should_fail_ex+0x394/0x4c0 [ 90.889640][ T5958] prepare_alloc_pages+0x1e1/0x5b0 [ 90.894817][ T5958] __alloc_pages+0x134/0x460 [ 90.899478][ T5958] ? zone_statistics+0x170/0x170 [ 90.904485][ T5958] ? __lock_acquire+0x7eb0/0x7eb0 [ 90.909599][ T5958] ? alloc_pages+0x4e1/0x740 [ 90.914422][ T5958] ? xas_load+0x11d/0x140 [ 90.918937][ T5958] folio_alloc+0x1e/0x30 [ 90.923423][ T5958] filemap_alloc_folio+0xdf/0x490 [ 90.928523][ T5958] ? filemap_add_folio+0x3d0/0x3d0 [ 90.933717][ T5958] ? ext4_get_max_inline_size+0x181/0x200 [ 90.939179][ T174] rxe_eth0 speed is unknown, defaulting to 1000 [ 90.939613][ T5958] __filemap_get_folio+0x3fb/0xbe0 [ 90.951307][ T5958] ext4_try_to_write_inline_data+0x56e/0x1310 [ 90.957560][ T5958] ? folio_zero_segment+0x2c0/0x2c0 [ 90.963024][ T5958] ? verify_lock_unused+0x140/0x140 [ 90.968318][ T5958] ? ext4_inode_journal_mode+0x18d/0x460 [ 90.974963][ T5958] ? ext4_writepage_trans_blocks+0x274/0x310 [ 90.981109][ T5958] ? ext4_writepage_trans_blocks+0x29b/0x310 [ 90.987254][ T5958] ext4_write_begin+0x252/0x10b0 [ 90.992259][ T5958] ? __might_sleep+0xe0/0xe0 [ 90.996914][ T5958] ? ext4_mark_iloc_dirty+0x694/0x1c60 [ 91.002400][ T5958] ? ext4_readahead+0x110/0x110 [ 91.007275][ T5958] ? mark_buffer_dirty+0x231/0x4d0 [ 91.012488][ T5958] ? __ext4_handle_dirty_metadata+0x2df/0x7f0 [ 91.018574][ T5958] ext4_da_write_begin+0x2e5/0x9a0 [ 91.023894][ T5958] ? ext4_dirty_folio+0x320/0x320 [ 91.029023][ T5958] ? fault_in_readable+0x11c/0x150 [ 91.034239][ T5958] ? fault_in_iov_iter_readable+0xc3/0x300 [ 91.040074][ T5958] generic_perform_write+0x2fe/0x5c0 [ 91.045577][ T5958] ? generic_file_direct_write+0x3e0/0x3e0 [ 91.051444][ T5958] ? file_modified_flags+0x230/0x260 [ 91.057416][ T5958] ? ext4_write_checks+0x248/0x2c0 [ 91.063005][ T5958] ext4_buffered_write_iter+0xd5/0x360 [ 91.069046][ T5958] ext4_file_write_iter+0x1e7/0x1980 [ 91.074387][ T5958] ? rcu_read_lock_any_held+0xb4/0x140 [ 91.079964][ T5958] ? ext4_file_read_iter+0x660/0x660 [ 91.085754][ T5958] vfs_write+0x474/0x9a0 [ 91.090112][ T5958] ? file_end_write+0x250/0x250 [ 91.095189][ T5958] ? __fget_files+0x3fc/0x460 [ 91.100032][ T5958] ? __fdget+0x180/0x210 [ 91.104483][ T5958] ? __x64_sys_pwrite64+0xf7/0x220 [ 91.109658][ T5958] __x64_sys_pwrite64+0x198/0x220 [ 91.114905][ T5958] ? ksys_pwrite64+0x1c0/0x1c0 [ 91.119725][ T5958] ? lockdep_hardirqs_on+0x98/0x150 [ 91.125064][ T5958] do_syscall_64+0x55/0xb0 [ 91.129510][ T5958] ? clear_bhb_loop+0x40/0x90 [ 91.134219][ T5958] ? clear_bhb_loop+0x40/0x90 [ 91.139191][ T5958] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 91.145201][ T5958] RIP: 0033:0x7faabe39f559 [ 91.149943][ T5958] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.169769][ T5958] RSP: 002b:00007faabf2a2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 91.178642][ T5958] RAX: ffffffffffffffda RBX: 00007faabe625fa0 RCX: 00007faabe39f559 [ 91.187680][ T5958] RDX: 000000000000fdef RSI: 00002000000009c0 RDI: 0000000000000004 [ 91.196494][ T5958] RBP: 00007faabe436b50 R08: 0000000000000000 R09: 0000000000000000 [ 91.205508][ T5958] R10: 000000000000fecc R11: 0000000000000246 R12: 0000000000000000 [ 91.213592][ T5958] R13: 00007faabe626038 R14: 00007faabe625fa0 R15: 00007fff06ec1ec8 [ 91.221941][ T5958] [ 91.225095][ C1] vkms_vblank_simulate: vblank timer overrun [ 91.318945][ T5968] FAULT_INJECTION: forcing a failure. [ 91.318945][ T5968] name failslab, interval 1, probability 0, space 0, times 0 [ 91.353679][ T5968] CPU: 0 PID: 5968 Comm: syz.3.33 Not tainted syzkaller #0 [ 91.360980][ T5968] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 91.371527][ T5968] Call Trace: [ 91.374948][ T5968] [ 91.377934][ T5968] dump_stack_lvl+0x18c/0x250 [ 91.383035][ T5968] ? show_regs_print_info+0x20/0x20 [ 91.388301][ T5968] ? load_image+0x420/0x420 [ 91.392884][ T5968] ? __lock_acquire+0x7eb0/0x7eb0 [ 91.398936][ T5968] ? __asan_memcpy+0x40/0x70 [ 91.403641][ T5968] should_fail_ex+0x394/0x4c0 [ 91.408483][ T5968] should_failslab+0x9/0x20 [ 91.413142][ T5968] slab_pre_alloc_hook+0x59/0x300 [ 91.418493][ T5968] ? seq_printf+0x1e3/0x290 [ 91.423292][ T5968] ? cgroup_show_path+0xa8/0x590 [ 91.428295][ T5968] __kmem_cache_alloc_node+0x53/0x260 [ 91.433728][ T5968] ? cgroup_show_path+0xa8/0x590 [ 91.438998][ T5968] kmalloc_trace+0x2a/0xe0 [ 91.443889][ T5968] ? kernfs_sop_show_options+0x120/0x120 [ 91.449709][ T5968] cgroup_show_path+0xa8/0x590 [ 91.454644][ T5968] ? kernfs_sop_show_path+0xfd/0x140 [ 91.460001][ T5968] ? kernfs_sop_show_options+0x120/0x120 [ 91.465736][ T5968] show_mountinfo+0x1f8/0x7a0 [ 91.470784][ T5968] ? show_mnt_opts+0x310/0x310 [ 91.475736][ T5968] ? do_raw_spin_unlock+0x121/0x230 [ 91.481015][ T5968] ? _raw_spin_unlock+0x28/0x40 [ 91.485941][ T5968] traverse+0x1fc/0x590 [ 91.490166][ T5968] seq_lseek+0x137/0x260 [ 91.494490][ T5968] __x64_sys_lseek+0x15f/0x1e0 [ 91.499670][ T5968] do_syscall_64+0x55/0xb0 [ 91.504143][ T5968] ? clear_bhb_loop+0x40/0x90 [ 91.508967][ T5968] ? clear_bhb_loop+0x40/0x90 [ 91.513782][ T5968] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 91.519819][ T5968] RIP: 0033:0x7fa2f439f559 [ 91.524278][ T5968] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.544054][ T5968] RSP: 002b:00007fa2f5239028 EFLAGS: 00000246 ORIG_RAX: 0000000000000008 [ 91.552625][ T5968] RAX: ffffffffffffffda RBX: 00007fa2f4625fa0 RCX: 00007fa2f439f559 [ 91.560646][ T5968] RDX: 0000000000000000 RSI: 00000000000009d2 RDI: 0000000000000003 [ 91.568846][ T5968] RBP: 00007fa2f4436b50 R08: 0000000000000000 R09: 0000000000000000 [ 91.576865][ T5968] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 91.584879][ T5968] R13: 00007fa2f4626038 R14: 00007fa2f4625fa0 R15: 00007fff35700ed8 [ 91.593183][ T5968] [ 91.778639][ T5802] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 91.805592][ T5973] netlink: 12 bytes leftover after parsing attributes in process `syz.1.35'. [ 92.189222][ T9] cfg80211: failed to load regulatory.db [ 92.203600][ T5952] loop0: detected capacity change from 0 to 32768 [ 92.293204][ T5988] Invalid argument reading file caps for ./file0 [ 92.441573][ T5952] XFS (loop0): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 92.909563][ T5952] XFS (loop0): Ending clean mount [ 93.071254][ T5794] XFS (loop0): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 93.669561][ T6033] loop1: detected capacity change from 0 to 128 [ 93.693753][ T6033] EXT4-fs: Ignoring removed i_version option [ 93.758874][ T6033] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 93.791182][ T6033] ext4 filesystem being mounted at /14/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 93.823529][ C1] vkms_vblank_simulate: vblank timer overrun [ 94.039228][ T6027] loop2: detected capacity change from 0 to 32768 [ 94.089411][ T6027] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop2 scanned by syz.2.48 (6027) [ 94.157771][ T5790] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 94.177391][ T6027] BTRFS info (device loop2): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 94.205308][ T6027] BTRFS info (device loop2): using blake2b (blake2b-256-generic) checksum algorithm [ 94.226257][ T6027] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 94.257862][ T6027] BTRFS info (device loop2): use zstd compression, level 3 [ 94.265763][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 94.285746][ T6027] BTRFS info (device loop2): using free space tree [ 94.446755][ T6059] netlink: 'syz.0.54': attribute type 4 has an invalid length. [ 94.469127][ T6027] BTRFS info (device loop2): enabling ssd optimizations [ 94.469393][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 94.487194][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 94.499364][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 94.504887][ T6027] BTRFS info (device loop2): auto enabling async discard [ 94.513438][ T9] usb 4-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 94.540311][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.601907][ T6062] netlink: 'syz.0.54': attribute type 4 has an invalid length. [ 95.034907][ T9] cxacru 4-1:1.0: send of cm 0x91 failed (-71) [ 95.054877][ T9] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 95.087812][ T9] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 95.119992][ T9] cxacru: probe of 4-1:1.0 failed with error -71 [ 95.187347][ T9] usb 4-1: USB disconnect, device number 2 [ 95.204280][ T6070] loop0: detected capacity change from 0 to 8 [ 95.529407][ T5802] BTRFS info (device loop2): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 96.167896][ T6078] loop0: detected capacity change from 0 to 2048 [ 96.351574][ T6078] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 96.722889][ T6095] loop3: detected capacity change from 0 to 512 [ 96.772183][ T6095] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 96.805063][ T6095] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 96.920769][ T6095] EXT4-fs (loop3): 1 truncate cleaned up [ 96.953222][ T6095] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 97.089731][ T6106] loop1: detected capacity change from 0 to 512 [ 97.124376][ T6095] EXT4-fs warning (device loop3): ext4_group_add:1742: No reserved GDT blocks, can't resize [ 97.240228][ T5795] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 97.262308][ T6106] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 97.303995][ T6106] ext4 filesystem being mounted at /18/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 97.461466][ T6114] netlink: 'syz.0.71': attribute type 14 has an invalid length. [ 97.472821][ T6106] capability: warning: `syz.1.67' uses 32-bit capabilities (legacy support in use) [ 97.477400][ T6114] netlink: 4 bytes leftover after parsing attributes in process `syz.0.71'. [ 97.560872][ T6114] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 97.570572][ T6114] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 97.579731][ T6114] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 97.589312][ T6114] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 97.646141][ T5790] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 97.663173][ T6118] FAULT_INJECTION: forcing a failure. [ 97.663173][ T6118] name failslab, interval 1, probability 0, space 0, times 0 [ 97.680074][ T6114] netlink: 'syz.0.71': attribute type 14 has an invalid length. [ 97.715213][ T6118] CPU: 0 PID: 6118 Comm: syz.3.72 Not tainted syzkaller #0 [ 97.715661][ T6114] netlink: 4 bytes leftover after parsing attributes in process `syz.0.71'. [ 97.722491][ T6118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 97.722510][ T6118] Call Trace: [ 97.722519][ T6118] [ 97.722527][ T6118] dump_stack_lvl+0x18c/0x250 [ 97.722563][ T6118] ? show_regs_print_info+0x20/0x20 [ 97.722587][ T6118] ? load_image+0x420/0x420 [ 97.722611][ T6118] ? __might_sleep+0xe0/0xe0 [ 97.722635][ T6118] ? __lock_acquire+0x7eb0/0x7eb0 [ 97.722657][ T6118] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 97.722686][ T6118] should_fail_ex+0x394/0x4c0 [ 97.722716][ T6118] should_failslab+0x9/0x20 [ 97.722734][ T6118] slab_pre_alloc_hook+0x59/0x300 [ 97.722769][ T6118] kmem_cache_alloc_lru+0x4d/0x2c0 [ 97.722787][ T6118] ? __d_alloc+0x31/0x710 [ 97.722812][ T6118] __d_alloc+0x31/0x710 [ 97.722832][ T6118] ? alloc_fd+0x590/0x640 [ 97.722862][ T6118] d_alloc_pseudo+0x1d/0x70 [ 97.722884][ T6118] alloc_file_pseudo+0xe4/0x210 [ 97.722910][ T6118] ? fput+0x1a0/0x1a0 [ 97.722937][ T6118] ? alloc_fd+0x590/0x640 [ 97.722968][ T6118] sock_alloc_file+0xb7/0x280 [ 97.723006][ T6118] __sys_socket+0x140/0x1b0 [ 97.839454][ T6118] __x64_sys_socket+0x7a/0x90 [ 97.844347][ T6118] do_syscall_64+0x55/0xb0 [ 97.848972][ T6118] ? clear_bhb_loop+0x40/0x90 [ 97.853925][ T6118] ? clear_bhb_loop+0x40/0x90 [ 97.858672][ T6118] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 97.864759][ T6118] RIP: 0033:0x7fa2f439f559 [ 97.869195][ T6118] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.890134][ T6118] RSP: 002b:00007fa2f5239028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 97.899280][ T6118] RAX: ffffffffffffffda RBX: 00007fa2f4625fa0 RCX: 00007fa2f439f559 [ 97.907435][ T6118] RDX: 0000000000000002 RSI: 0000000000000002 RDI: 000000000000001d [ 97.915515][ T6118] RBP: 00007fa2f4436b50 R08: 0000000000000000 R09: 0000000000000000 [ 97.923594][ T6118] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 97.931621][ T6118] R13: 00007fa2f4626038 R14: 00007fa2f4625fa0 R15: 00007fff35700ed8 [ 97.939731][ T6118] [ 97.977324][ T6114] Zero length message leads to an empty skb [ 98.704851][ T174] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 98.735764][ T9] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 98.798499][ T790] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 98.888156][ T174] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 98.919481][ T174] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 98.930192][ T174] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.942740][ T174] usb 1-1: Product: syz [ 98.953330][ T9] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 98.971700][ T174] usb 1-1: Manufacturer: syz [ 98.979277][ T174] usb 1-1: SerialNumber: syz [ 98.994840][ T9] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 99.017206][ T790] usb 3-1: Using ep0 maxpacket: 16 [ 99.018408][ T9] usb 2-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 99.040087][ T790] usb 3-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 99.054847][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 99.067309][ T790] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.073336][ T9] usb 2-1: New USB device found, idVendor=056a, idProduct=0000, bcdDevice= 0.00 [ 99.102724][ T790] usb 3-1: config 0 descriptor?? [ 99.104799][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.136355][ T9] usb 2-1: config 0 descriptor?? [ 99.137254][ T790] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 99.632234][ T9] wacom 0003:056A:0000.0001: Unknown device_type for 'HID 056a:0000'. Assuming pen. [ 99.681752][ T9] wacom 0003:056A:0000.0001: hidraw0: USB HID v0.00 Joystick [HID 056a:0000] on usb-dummy_hcd.1-1/input0 [ 99.733630][ T9] input: Wacom Penpartner Pen as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:056A:0000.0001/input/input6 [ 99.901145][ T9] usb 2-1: USB disconnect, device number 2 [ 100.062766][ T174] cdc_ncm 1-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 100.080465][ T174] cdc_ncm 1-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 100.102974][ T6162] fido_id[6162]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 100.124845][ T174] cdc_ncm 1-1:1.0: setting rx_max = 2048 [ 100.238945][ T6154] loop3: detected capacity change from 0 to 40427 [ 100.264623][ T6154] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 100.294099][ T6154] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 100.359218][ T6154] F2FS-fs (loop3): invalid crc value [ 100.406846][ T6154] F2FS-fs (loop3): Found nat_bits in checkpoint [ 100.479379][ T174] cdc_ncm 1-1:1.0: setting tx_max = 88 [ 100.564110][ T174] cdc_ncm 1-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.0-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 100.625385][ T6154] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 100.633199][ T6154] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 100.647362][ T790] gspca_sonixj: i2c_w8 err -71 [ 100.655959][ T174] usb 1-1: USB disconnect, device number 2 [ 100.705084][ T790] sonixj: probe of 3-1:0.0 failed with error -71 [ 100.710019][ T174] cdc_ncm 1-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.0-1, CDC NCM (NO ZLP) [ 100.726461][ T790] usb 3-1: USB disconnect, device number 2 [ 100.969069][ T28] audit: type=1804 audit(1793455085.737:2): pid=6154 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.84" name="/newroot/25/file0/bus" dev="loop3" ino=10 res=1 errno=0 [ 101.099899][ T28] audit: type=1800 audit(1793455085.867:3): pid=6154 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.84" name="file0" dev="loop3" ino=11 res=0 errno=0 [ 101.315309][ T6186] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 101.606450][ T6194] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 101.731763][ T28] audit: type=1326 audit(1793455086.497:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6195 comm="syz.0.93" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f34bb19f559 code=0x0 [ 101.779338][ T6194] overlayfs: failed to look up (tracing) for ino (-66) [ 102.019363][ T6206] FAULT_INJECTION: forcing a failure. [ 102.019363][ T6206] name failslab, interval 1, probability 0, space 0, times 0 [ 102.046527][ T6206] CPU: 0 PID: 6206 Comm: syz.1.95 Not tainted syzkaller #0 [ 102.054318][ T6206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 102.064527][ T6206] Call Trace: [ 102.067829][ T6206] [ 102.070856][ T6206] dump_stack_lvl+0x18c/0x250 [ 102.075553][ T6206] ? show_regs_print_info+0x20/0x20 [ 102.080772][ T6206] ? load_image+0x420/0x420 [ 102.085315][ T6206] ? __lock_acquire+0x7eb0/0x7eb0 [ 102.090376][ T6206] ? verify_lock_unused+0x140/0x140 [ 102.095811][ T6206] should_fail_ex+0x394/0x4c0 [ 102.100528][ T6206] should_failslab+0x9/0x20 [ 102.105354][ T6206] slab_pre_alloc_hook+0x59/0x300 [ 102.110697][ T6206] kmem_cache_alloc_lru+0x4d/0x2c0 [ 102.116717][ T6206] ? __d_alloc+0x31/0x710 [ 102.121868][ T6206] __d_alloc+0x31/0x710 [ 102.126115][ T6206] d_alloc_parallel+0xe0/0x1590 [ 102.131456][ T6206] ? __d_lookup+0x8f/0x7c0 [ 102.135912][ T6206] ? __lock_acquire+0x7eb0/0x7eb0 [ 102.141292][ T6206] ? lock_chain_count+0x20/0x20 [ 102.146282][ T6206] ? lockdep_softirqs_off+0x440/0x440 [ 102.151855][ T6206] ? lockdep_softirqs_off+0x440/0x440 [ 102.157603][ T6206] ? d_hash_and_lookup+0x1b0/0x1b0 [ 102.162927][ T6206] ? __init_waitqueue_head+0xa8/0x140 [ 102.168400][ T6206] proc_fill_cache+0x15c/0x430 [ 102.173383][ T6206] ? proc_readfd_common+0x8b0/0x8b0 [ 102.178687][ T6206] ? pid_revalidate+0x260/0x260 [ 102.183645][ T6206] ? snprintf+0xe9/0x140 [ 102.188017][ T6206] ? _raw_spin_unlock+0x28/0x40 [ 102.192924][ T6206] ? task_lookup_next_fd_rcu+0x337/0x390 [ 102.198918][ T6206] ? proc_readfd_common+0x333/0x8b0 [ 102.204323][ T6206] ? proc_readfd_common+0x333/0x8b0 [ 102.209635][ T6206] proc_readfd_common+0x57a/0x8b0 [ 102.214720][ T6206] ? proc_readfd_common+0x333/0x8b0 [ 102.220053][ T6206] ? proc_readfd_common+0x8b0/0x8b0 [ 102.225293][ T6206] ? proc_readfdinfo+0x30/0x30 [ 102.230417][ T6206] ? iterate_dir+0xcb/0x590 [ 102.235065][ T6206] ? down_read_killable+0x1d0/0x340 [ 102.240498][ T6206] ? fsnotify_perm+0x271/0x5e0 [ 102.245273][ T6206] iterate_dir+0x1bd/0x590 [ 102.249714][ T6206] __se_sys_getdents64+0xf6/0x270 [ 102.255473][ T6206] ? __x64_sys_getdents64+0x80/0x80 [ 102.260746][ T6206] ? filldir+0x6b0/0x6b0 [ 102.265154][ T6206] ? lockdep_hardirqs_on+0x98/0x150 [ 102.270468][ T6206] do_syscall_64+0x55/0xb0 [ 102.274917][ T6206] ? clear_bhb_loop+0x40/0x90 [ 102.279793][ T6206] ? clear_bhb_loop+0x40/0x90 [ 102.284604][ T6206] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 102.290649][ T6206] RIP: 0033:0x7f87f6d9f559 [ 102.295092][ T6206] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.315002][ T6206] RSP: 002b:00007f87f7c41028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 102.323789][ T6206] RAX: ffffffffffffffda RBX: 00007f87f7025fa0 RCX: 00007f87f6d9f559 [ 102.332065][ T6206] RDX: 0000000000000079 RSI: 00002000000003c0 RDI: 0000000000000004 [ 102.340765][ T6206] RBP: 00007f87f6e36b50 R08: 0000000000000000 R09: 0000000000000000 [ 102.349322][ T6206] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.354952][ T27] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 102.357390][ T6206] R13: 00007f87f7026038 R14: 00007f87f7025fa0 R15: 00007ffe0dfb7218 [ 102.357451][ T6206] [ 102.584796][ T27] usb 4-1: Using ep0 maxpacket: 8 [ 102.593240][ T27] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 102.613690][ T27] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 102.628716][ T27] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 102.648055][ T27] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 102.678477][ T27] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 102.694239][ T27] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.957268][ T27] usb 4-1: GET_CAPABILITIES returned 0 [ 102.965298][ T27] usbtmc 4-1:16.0: can't read capabilities [ 103.147765][ T6214] loop1: detected capacity change from 0 to 32768 [ 103.162823][ T6214] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop1 scanned by syz.1.98 (6214) [ 103.213143][ T6229] netlink: 8 bytes leftover after parsing attributes in process `syz.2.105'. [ 103.224083][ T6214] BTRFS info (device loop1): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 103.264665][ T6214] BTRFS info (device loop1): using blake2b (blake2b-256-generic) checksum algorithm [ 103.296960][ T6214] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_LZO (0x8) [ 103.302526][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 103.333283][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 103.338591][ T6214] BTRFS info (device loop1): use lzo compression, level 0 [ 103.346274][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 103.359462][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 103.368877][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 103.385517][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 103.396762][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 103.406759][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 103.417810][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 103.427824][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 103.438519][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 103.447916][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 103.457123][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 103.468107][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 103.474873][ T6214] BTRFS info (device loop1): using free space tree [ 103.477646][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 103.494681][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -2 [ 103.582998][ T174] usb 4-1: USB disconnect, device number 3 [ 103.680724][ T6214] BTRFS info (device loop1): enabling ssd optimizations [ 103.704957][ T6214] BTRFS info (device loop1): auto enabling async discard [ 103.856768][ T28] audit: type=1800 audit(1793455088.617:5): pid=6214 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.98" name="file1" dev="loop1" ino=260 res=0 errno=0 [ 103.977549][ T6251] loop0: detected capacity change from 0 to 512 [ 104.085409][ T6251] EXT4-fs error (device loop0): ext4_orphan_get:1408: inode #15: comm syz.0.108: inode has both inline data and extents flags [ 104.148042][ T6251] EXT4-fs error (device loop0): ext4_orphan_get:1413: comm syz.0.108: couldn't read orphan inode 15 (err -117) [ 104.237812][ T6251] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 104.299246][ T6251] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 7969 vs 220 free clusters [ 104.440008][ T5794] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 104.464494][ T5790] BTRFS info (device loop1): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 104.788607][ T6264] loop3: detected capacity change from 0 to 1024 [ 104.856847][ T6264] EXT4-fs (loop3): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 104.893803][ T6264] ext4 filesystem being mounted at /29/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 104.988660][ T6264] EXT4-fs error (device loop3): ext4_readdir:263: inode #2: block 16: comm syz.3.112: path /29/file1: bad entry in directory: rec_len is smaller than minimal - offset=876, inode=0, rec_len=0, size=1024 fake=0 [ 105.024919][ T6264] EXT4-fs (loop3): Remounting filesystem read-only [ 105.132704][ T5795] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 105.279708][ T6272] loop3: detected capacity change from 0 to 512 [ 105.324874][ T6272] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 105.362915][ T6272] EXT4-fs (loop3): invalid journal inode [ 105.382023][ T6272] EXT4-fs (loop3): can't get journal size [ 105.460655][ T6272] EXT4-fs (loop3): 1 truncate cleaned up [ 105.486153][ T6279] loop1: detected capacity change from 0 to 8 [ 105.511358][ T6272] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 105.619346][ T6279] SQUASHFS error: xz decompression failed, data probably corrupt [ 105.641086][ T6279] SQUASHFS error: Failed to read block 0xa8: -5 [ 105.662960][ T6279] SQUASHFS error: xz decompression failed, data probably corrupt [ 105.671148][ T6279] SQUASHFS error: Failed to read block 0xa8: -5 [ 105.672866][ T5795] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 105.705012][ T28] audit: type=1800 audit(1793455090.457:6): pid=6279 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.117" name="file0" dev="loop1" ino=3 res=0 errno=0 [ 105.729831][ T6284] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 105.956171][ T6288] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 106.379175][ T6307] gadgetfs: bound to dummy_udc driver [ 106.499071][ T5795] ================================================================== [ 106.507652][ T5795] BUG: KASAN: slab-use-after-free in __mutex_lock+0xfc/0xce0 [ 106.515425][ T5795] Read of size 8 at addr ffff8880298ecc60 by task syz-executor/5795 [ 106.524009][ T5795] [ 106.526369][ T5795] CPU: 0 PID: 5795 Comm: syz-executor Not tainted syzkaller #0 [ 106.534262][ T5795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 106.544532][ T5795] Call Trace: [ 106.547937][ T5795] [ 106.550900][ T5795] dump_stack_lvl+0x18c/0x250 [ 106.555619][ T5795] ? __lock_acquire+0x7eb0/0x7eb0 [ 106.560685][ T5795] ? show_regs_print_info+0x20/0x20 [ 106.565930][ T5795] ? load_image+0x420/0x420 [ 106.570473][ T5795] ? __virt_addr_valid+0x10c/0x380 [ 106.575810][ T5795] ? __virt_addr_valid+0x10c/0x380 [ 106.580956][ T5795] ? __virt_addr_valid+0x10c/0x380 [ 106.586196][ T5795] print_report+0xa8/0x210 [ 106.590827][ T5795] ? __mutex_lock+0xfc/0xce0 [ 106.595630][ T5795] kasan_report+0x117/0x150 [ 106.600253][ T5795] ? tomoyo_check_open_permission+0x384/0x460 [ 106.606352][ T5795] ? __mutex_lock+0xfc/0xce0 [ 106.611065][ T5795] __mutex_lock+0xfc/0xce0 [ 106.615600][ T5795] ? end_current_label_crit_section+0x170/0x170 [ 106.622001][ T5795] ? __asan_memset+0x22/0x40 [ 106.626760][ T5795] ? ep_open+0x4e/0x270 [ 106.631043][ T5795] ? mutex_lock_nested+0x20/0x20 [ 106.636103][ T5795] ? apparmor_file_open+0x5ab/0x760 [ 106.641380][ T5795] ? apparmor_inode_getattr+0x2c0/0x2c0 [ 106.647315][ T5795] ? __rwlock_init+0x150/0x150 [ 106.652284][ T5795] ep_open+0x4e/0x270 [ 106.656312][ T5795] ? do_dentry_open+0x86f/0x14b0 [ 106.661649][ T5795] do_dentry_open+0x880/0x14b0 [ 106.666562][ T5795] ? ep_ioctl+0x1c0/0x1c0 [ 106.671204][ T5795] path_openat+0x284f/0x3270 [ 106.672292][ T6313] x86/PAT: syz.0.129:6313 freeing invalid memtype [mem 0xfe004000-0xfe004fff] [ 106.676019][ T5795] ? do_sys_openat2+0xda/0x1d0 [ 106.676052][ T5795] ? __x64_sys_openat+0x139/0x160 [ 106.676076][ T5795] ? verify_lock_unused+0x140/0x140 [ 106.676097][ T5795] ? do_filp_open+0x430/0x430 [ 106.705262][ T5795] do_filp_open+0x1f2/0x430 [ 106.710509][ T5795] ? vfs_tmpfile+0x620/0x620 [ 106.715333][ T5795] ? _raw_spin_unlock+0x28/0x40 [ 106.720496][ T5795] ? alloc_fd+0x590/0x640 [ 106.725103][ T5795] do_sys_openat2+0x134/0x1d0 [ 106.729926][ T5795] ? do_sys_open+0xe0/0xe0 [ 106.734422][ T5795] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 106.740537][ T5795] ? fsnotify_link_count+0xf0/0xf0 [ 106.746230][ T5795] ? lock_chain_count+0x20/0x20 [ 106.751223][ T5795] __x64_sys_openat+0x139/0x160 [ 106.756294][ T5795] do_syscall_64+0x55/0xb0 [ 106.760928][ T5795] ? clear_bhb_loop+0x40/0x90 [ 106.765739][ T5795] ? clear_bhb_loop+0x40/0x90 [ 106.770729][ T5795] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 106.776664][ T5795] RIP: 0033:0x7fa2f435fd8e [ 106.781210][ T5795] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 106.801214][ T5795] RSP: 002b:00007fff356fefa8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 106.809949][ T5795] RAX: ffffffffffffffda RBX: 0000555584160500 RCX: 00007fa2f435fd8e [ 106.818405][ T5795] RDX: 0000000000000000 RSI: 00007fff356ff110 RDI: ffffffffffffff9c [ 106.826672][ T5795] RBP: 00007fff356ff110 R08: 0000000000000000 R09: 0000000000000000 [ 106.834850][ T5795] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff35700200 [ 106.843562][ T5795] R13: 00007fa2f4435f93 R14: 00005555841604e8 R15: 0000000000000006 [ 106.851674][ T5795] [ 106.854750][ T5795] [ 106.857191][ T5795] Allocated by task 6307: [ 106.861721][ T5795] kasan_set_track+0x4e/0x70 [ 106.866438][ T5795] __kasan_kmalloc+0x8f/0xa0 [ 106.871595][ T5795] gadgetfs_bind+0x25f/0x830 [ 106.876407][ T5795] gadget_bind_driver+0x2b3/0x770 [ 106.881524][ T5795] really_probe+0x24a/0xae0 [ 106.886104][ T5795] __driver_probe_device+0x1f5/0x390 [ 106.891431][ T5795] driver_probe_device+0x4f/0x420 [ 106.896787][ T5795] __driver_attach+0x444/0x6d0 [ 106.901592][ T5795] bus_for_each_dev+0x235/0x2b0 [ 106.906744][ T5795] bus_add_driver+0x340/0x630 [ 106.912604][ T5795] driver_register+0x23a/0x310 [ 106.917608][ T5795] usb_gadget_register_driver_owner+0xf9/0x270 [ 106.923874][ T5795] dev_config+0xe49/0x1260 [ 106.928526][ T5795] vfs_write+0x299/0x9a0 [ 106.932909][ T5795] ksys_write+0x151/0x260 [ 106.937733][ T5795] do_syscall_64+0x55/0xb0 [ 106.942204][ T5795] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 106.948344][ T5795] [ 106.950821][ T5795] Freed by task 8: [ 106.954920][ T5795] kasan_set_track+0x4e/0x70 [ 106.959727][ T5795] kasan_save_free_info+0x28/0x40 [ 106.964973][ T5795] ____kasan_slab_free+0x126/0x1f0 [ 106.970380][ T5795] slab_free_freelist_hook+0x154/0x240 [ 106.975910][ T5795] __kmem_cache_free+0xba/0x1f0 [ 106.980791][ T5795] destroy_ep_files+0x282/0x330 [ 106.985922][ T5795] gadgetfs_unbind+0x109/0x2b0 [ 106.990736][ T5795] gadget_unbind_driver+0x1bf/0x3e0 [ 106.996161][ T5795] device_release_driver_internal+0x408/0x6f0 [ 107.003484][ T5795] driver_detach+0x1f3/0x2d0 [ 107.008578][ T5795] bus_remove_driver+0x221/0x2f0 [ 107.013906][ T5795] usb_gadget_unregister_driver+0x4e/0x70 [ 107.019676][ T5795] dev_release+0x86/0x200 [ 107.024066][ T5795] __fput+0x221/0x940 [ 107.028076][ T5795] delayed_fput+0x58/0x80 [ 107.032454][ T5795] process_scheduled_works+0xa60/0x1600 [ 107.038044][ T5795] worker_thread+0xa5e/0xfe0 [ 107.042841][ T5795] kthread+0x2fa/0x390 [ 107.047041][ T5795] ret_from_fork+0x48/0x80 [ 107.051678][ T5795] ret_from_fork_asm+0x11/0x20 [ 107.056563][ T5795] [ 107.058912][ T5795] Last potentially related work creation: [ 107.065087][ T5795] kasan_save_stack+0x3e/0x60 [ 107.069893][ T5795] __kasan_record_aux_stack+0xaf/0xc0 [ 107.075490][ T5795] kvfree_call_rcu+0xee/0x780 [ 107.080350][ T5795] ep_eventpoll_release+0x48/0x60 [ 107.085462][ T5795] __fput+0x221/0x940 [ 107.089711][ T5795] __se_sys_close+0x15c/0x1e0 [ 107.094869][ T5795] do_syscall_64+0x55/0xb0 [ 107.099675][ T5795] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 107.105955][ T5795] [ 107.108671][ T5795] The buggy address belongs to the object at ffff8880298ecc00 [ 107.108671][ T5795] which belongs to the cache kmalloc-512 of size 512 [ 107.123402][ T5795] The buggy address is located 96 bytes inside of [ 107.123402][ T5795] freed 512-byte region [ffff8880298ecc00, ffff8880298ece00) [ 107.137248][ T5795] [ 107.139730][ T5795] The buggy address belongs to the physical page: [ 107.146863][ T5795] page:ffffea0000a63b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x298ec [ 107.157611][ T5795] head:ffffea0000a63b00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 107.166583][ T5795] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 107.174976][ T5795] page_type: 0xffffffff() [ 107.179611][ T5795] raw: 00fff00000000840 ffff888018c41c80 ffffea000098de00 dead000000000002 [ 107.188926][ T5795] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 107.198678][ T5795] page dumped because: kasan: bad access detected [ 107.205503][ T5795] page_owner tracks the page as allocated [ 107.211971][ T5795] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2580, tgid 2580 (kworker/u4:0), ts 19572752916, free_ts 0 [ 107.233402][ T5795] post_alloc_hook+0x1c1/0x200 [ 107.238397][ T5795] get_page_from_freelist+0x2181/0x22a0 [ 107.245489][ T5795] __alloc_pages+0x1f0/0x460 [ 107.250139][ T5795] alloc_slab_page+0x5d/0x180 [ 107.254943][ T5795] new_slab+0x87/0x2d0 [ 107.259113][ T5795] ___slab_alloc+0xc5c/0x12f0 [ 107.263941][ T5795] __kmem_cache_alloc_node+0x122/0x260 [ 107.269453][ T5795] kmalloc_trace+0x2a/0xe0 [ 107.274287][ T5795] alloc_bprm+0x56/0x9a0 [ 107.278677][ T5795] kernel_execve+0x98/0x980 [ 107.283313][ T5795] call_usermodehelper_exec_async+0x20b/0x350 [ 107.289776][ T5795] ret_from_fork+0x48/0x80 [ 107.294317][ T5795] ret_from_fork_asm+0x11/0x20 [ 107.299427][ T5795] page_owner free stack trace missing [ 107.304822][ T5795] [ 107.307463][ T5795] Memory state around the buggy address: [ 107.313567][ T5795] ffff8880298ecb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 107.322501][ T5795] ffff8880298ecb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 107.330867][ T5795] >ffff8880298ecc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.339143][ T5795] ^ [ 107.346664][ T5795] ffff8880298ecc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.355035][ T5795] ffff8880298ecd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.364516][ T5795] ================================================================== [ 107.399805][ T5795] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 107.407596][ T5795] CPU: 0 PID: 5795 Comm: syz-executor Not tainted syzkaller #0 [ 107.415566][ T5795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 107.426299][ T5795] Call Trace: [ 107.430216][ T5795] [ 107.433381][ T5795] dump_stack_lvl+0x18c/0x250 [ 107.438196][ T5795] ? show_regs_print_info+0x20/0x20 [ 107.445017][ T5795] ? load_image+0x420/0x420 [ 107.449838][ T5795] panic+0x2ca/0x720 [ 107.453882][ T5795] ? bpf_jit_dump+0xd0/0xd0 [ 107.458425][ T5795] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 107.464707][ T5795] ? _raw_spin_unlock+0x40/0x40 [ 107.469600][ T5795] ? print_memory_metadata+0x314/0x400 [ 107.475213][ T5795] ? __mutex_lock+0xfc/0xce0 [ 107.479952][ T5795] check_panic_on_warn+0x84/0xa0 [ 107.485112][ T5795] ? __mutex_lock+0xfc/0xce0 [ 107.489843][ T5795] end_report+0x6f/0x130 [ 107.494574][ T5795] kasan_report+0x128/0x150 [ 107.499402][ T5795] ? tomoyo_check_open_permission+0x384/0x460 [ 107.506129][ T5795] ? __mutex_lock+0xfc/0xce0 [ 107.510916][ T5795] __mutex_lock+0xfc/0xce0 [ 107.515552][ T5795] ? end_current_label_crit_section+0x170/0x170 [ 107.522432][ T5795] ? __asan_memset+0x22/0x40 [ 107.527060][ T5795] ? ep_open+0x4e/0x270 [ 107.531487][ T5795] ? mutex_lock_nested+0x20/0x20 [ 107.536432][ T5795] ? apparmor_file_open+0x5ab/0x760 [ 107.541969][ T5795] ? apparmor_inode_getattr+0x2c0/0x2c0 [ 107.547543][ T5795] ? __rwlock_init+0x150/0x150 [ 107.552504][ T5795] ep_open+0x4e/0x270 [ 107.556505][ T5795] ? do_dentry_open+0x86f/0x14b0 [ 107.561569][ T5795] do_dentry_open+0x880/0x14b0 [ 107.566606][ T5795] ? ep_ioctl+0x1c0/0x1c0 [ 107.570950][ T5795] path_openat+0x284f/0x3270 [ 107.575567][ T5795] ? do_sys_openat2+0xda/0x1d0 [ 107.580519][ T5795] ? __x64_sys_openat+0x139/0x160 [ 107.585682][ T5795] ? verify_lock_unused+0x140/0x140 [ 107.591006][ T5795] ? do_filp_open+0x430/0x430 [ 107.595700][ T5795] do_filp_open+0x1f2/0x430 [ 107.600473][ T5795] ? vfs_tmpfile+0x620/0x620 [ 107.605459][ T5795] ? _raw_spin_unlock+0x28/0x40 [ 107.610954][ T5795] ? alloc_fd+0x590/0x640 [ 107.615913][ T5795] do_sys_openat2+0x134/0x1d0 [ 107.620601][ T5795] ? do_sys_open+0xe0/0xe0 [ 107.625294][ T5795] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 107.631283][ T5795] ? fsnotify_link_count+0xf0/0xf0 [ 107.636490][ T5795] ? lock_chain_count+0x20/0x20 [ 107.641350][ T5795] __x64_sys_openat+0x139/0x160 [ 107.646303][ T5795] do_syscall_64+0x55/0xb0 [ 107.650995][ T5795] ? clear_bhb_loop+0x40/0x90 [ 107.655776][ T5795] ? clear_bhb_loop+0x40/0x90 [ 107.660551][ T5795] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 107.666543][ T5795] RIP: 0033:0x7fa2f435fd8e [ 107.671050][ T5795] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 107.691122][ T5795] RSP: 002b:00007fff356fefa8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 107.699717][ T5795] RAX: ffffffffffffffda RBX: 0000555584160500 RCX: 00007fa2f435fd8e [ 107.707718][ T5795] RDX: 0000000000000000 RSI: 00007fff356ff110 RDI: ffffffffffffff9c [ 107.715801][ T5795] RBP: 00007fff356ff110 R08: 0000000000000000 R09: 0000000000000000 [ 107.723916][ T5795] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff35700200 [ 107.733661][ T5795] R13: 00007fa2f4435f93 R14: 00005555841604e8 R15: 0000000000000006 [ 107.741657][ T5795] [ 107.744832][ T5795] Kernel Offset: disabled [ 107.749181][ T5795] Rebooting in 86400 seconds..