last executing test programs: 36.346944487s ago: executing program 3 (id=952): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'macvlan1\x00', 0x0}) sendto$packet(r0, &(0x7f00000001c0)="330520000ae0160006007e758808", 0xe, 0x801, &(0x7f0000000200)={0x11, 0x3, r1, 0x1, 0x5f, 0x6, @local}, 0x14) 36.288854328s ago: executing program 3 (id=954): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000000c0), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[], 0x80}}, 0x0) 36.176060941s ago: executing program 3 (id=956): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000300)={0x1, 0x0, [{0x0, 0x1, 0x0, 0x0, @sint={0x0, 0x2833e1ad}}]}) 35.975244176s ago: executing program 3 (id=958): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000440)={0x28, 0x0, 0x0, @local}, 0x10) listen(r0, 0xa) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x0) 35.892874698s ago: executing program 3 (id=960): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000680)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth0_to_batadv\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x1ff, 0xa4, 0xffb, 0x7, 0xb69, 0x5228, 0x4, 0x1, 0x3, 0x5, 0x101, 0x2001000, 0x9, 0x5, 0x3, 0xff20, 0x40, 0x0, 0x6, 0x9, 0x4, 0x7, 0x4, 0x100000, 0x762, 0x13, 0xd, 0xe, 0x2b12, 0x104, 0x6, 0x1c00, 0xb, 0x7, 0xbed8, 0x8, 0x8000100, 0x3, 0x4, 0x11000, 0x10001, 0x5, 0x79b, 0x2, 0xbd, 0x7d, 0x4, 0x1000a, 0x7, 0xf, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x2, 0x180000, 0x4007, 0x8b, 0x5, 0x2af, 0xa9a3, 0x5, 0x5, 0x6, 0x9, 0x6, 0x7, 0x4009, 0x0, 0x4, 0xffffff01, 0xb, 0x752, 0x0, 0x1005, 0x5, 0x10001, 0xffffffff, 0xffffffff, 0x6, 0x4, 0x7f, 0x331, 0xfdffffff, 0x2, 0x2, 0x84, 0x800100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20008, 0x9, 0x2, 0xffffffff, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x7, 0x2, 0x8, 0x8, 0x0, 0x4, 0x2, 0x40, 0x8, 0x4, 0x8000003, 0x404, 0x66cd, 0x8, 0x8, 0x1, 0x1fc, 0xc5c, 0xffffffff]}}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 35.79498142s ago: executing program 3 (id=961): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) setsockopt$sock_int(r0, 0x1, 0x2b, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e20, @private=0xa010101}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000180)={r3, 0x7}, &(0x7f0000000200)=0x8) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="0100000042000000060000000800000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x8001, 0x0, r6}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x8000, r7}, 0x38) r8 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IPT_SO_SET_REPLACE(r8, 0x4000000000000, 0x40, &(0x7f0000000800)=@raw={'raw\x00', 0x4001, 0x3, 0x4e4, 0x0, 0x0, 0x148, 0x0, 0x148, 0x450, 0x240, 0x240, 0x450, 0x240, 0x7fffffe, 0x0, {[{{@uncond, 0x0, 0x190, 0x1b0, 0x0, {}, [@common=@unspec=@mark={{0x2c}, {0x400, 0x4}}, @common=@inet=@recent0={{0xf4}, {0x20000000, 0x6, 0x1, 0x1, 'syz1\x00', 0xc}}]}, @unspec=@TRACE={0x20}}, {{@ip={@remote, @multicast1, 0xff000000, 0xff000000, 'tunl0\x00', 'pimreg1\x00', {}, {0xff}, 0x84, 0x0, 0x60}, 0x0, 0x258, 0x2a0, 0x0, {}, [@common=@inet=@recent0={{0xf4}, {0xa, 0x2, 0x1, 0x1, 'syz0\x00'}}, @common=@inet=@recent0={{0xf4}, {0x4, 0x3, 0x1, 0x1, 'syz1\x00', 0x1}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0xbb02, 0x2b, 0x10, 'syz1\x00', {0x6182}}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x540) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) sendmsg$IPSET_CMD_DESTROY(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) bpf$ITER_CREATE(0xb, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r10 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r10) 26.75563099s ago: executing program 0 (id=983): r0 = socket$inet6(0xa, 0x2, 0x3a) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4008094) connect$inet6(r0, &(0x7f0000002180)={0xa, 0x4e24, 0xb, @loopback, 0x9}, 0x1c) sendto$inet6(r0, &(0x7f0000000040)="800037bbfa9ba1ce", 0xffe9, 0x0, 0x0, 0x0) 26.558952454s ago: executing program 0 (id=984): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_int(r0, 0x29, 0x13, &(0x7f0000000000)=0x4, 0x4) 26.418932808s ago: executing program 0 (id=987): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) socket$inet6(0xa, 0x3, 0x5) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) 25.948348589s ago: executing program 0 (id=988): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000300)={0x1, 0x0, [{0x0, 0x1, 0x0, 0x0, @sint={0x0, 0x2833e1ad}}]}) 25.808945453s ago: executing program 0 (id=989): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./proc/fs/nfsd\x00', &(0x7f00000001c0)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/fs/nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='tcp 2', 0x5) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x100, {0x0, 0x0, 0x0, 0x0, {0xe, 0x1}}}, 0x24}}, 0x4) 24.447740306s ago: executing program 0 (id=996): r0 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000200)}], 0x1}, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x82d7) recvmsg(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000001340)={0x0, 0x0, 0x0}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000540)="d8000000100081046881f782db44b904021d080b01000000e8fe55a11800150006001400000000120800040043000000a80016000a00014006001100036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2e", 0x69}], 0x1}, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/custom1\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000059d360205f0501d09288000000010902"], 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x14, r7, 0x2fa77e8ce0582f97, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0xc005}, 0x400c814) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 20.411517904s ago: executing program 32 (id=961): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) setsockopt$sock_int(r0, 0x1, 0x2b, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e20, @private=0xa010101}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000180)={r3, 0x7}, &(0x7f0000000200)=0x8) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="0100000042000000060000000800000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x8001, 0x0, r6}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x8000, r7}, 0x38) r8 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IPT_SO_SET_REPLACE(r8, 0x4000000000000, 0x40, &(0x7f0000000800)=@raw={'raw\x00', 0x4001, 0x3, 0x4e4, 0x0, 0x0, 0x148, 0x0, 0x148, 0x450, 0x240, 0x240, 0x450, 0x240, 0x7fffffe, 0x0, {[{{@uncond, 0x0, 0x190, 0x1b0, 0x0, {}, [@common=@unspec=@mark={{0x2c}, {0x400, 0x4}}, @common=@inet=@recent0={{0xf4}, {0x20000000, 0x6, 0x1, 0x1, 'syz1\x00', 0xc}}]}, @unspec=@TRACE={0x20}}, {{@ip={@remote, @multicast1, 0xff000000, 0xff000000, 'tunl0\x00', 'pimreg1\x00', {}, {0xff}, 0x84, 0x0, 0x60}, 0x0, 0x258, 0x2a0, 0x0, {}, [@common=@inet=@recent0={{0xf4}, {0xa, 0x2, 0x1, 0x1, 'syz0\x00'}}, @common=@inet=@recent0={{0xf4}, {0x4, 0x3, 0x1, 0x1, 'syz1\x00', 0x1}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0xbb02, 0x2b, 0x10, 'syz1\x00', {0x6182}}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x540) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) sendmsg$IPSET_CMD_DESTROY(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) bpf$ITER_CREATE(0xb, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r10 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r10) 8.948537253s ago: executing program 33 (id=996): r0 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000200)}], 0x1}, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x82d7) recvmsg(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000001340)={0x0, 0x0, 0x0}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000540)="d8000000100081046881f782db44b904021d080b01000000e8fe55a11800150006001400000000120800040043000000a80016000a00014006001100036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2e", 0x69}], 0x1}, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/custom1\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000059d360205f0501d09288000000010902"], 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x14, r7, 0x2fa77e8ce0582f97, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0xc005}, 0x400c814) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 4.046887732s ago: executing program 1 (id=1041): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000140)='\x00\x00', 0x2}], 0x1}, 0x5) recvmsg$unix(r0, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x2) recvmsg$unix(r0, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x2082) 3.825340597s ago: executing program 4 (id=1043): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x28, 0x140c, 0x1, 0x70bd25, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_RES_CQN={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20004810}, 0x40) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000000000100000800010001"], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x14, 0x2, 0x3, 0x3, 0x0, 0x0, {0x0, 0x0, 0x2}}, 0x14}}, 0x0) close(r2) r4 = socket(0x15, 0x5, 0x0) getsockopt(r4, 0x200000000114, 0x2710, &(0x7f0000c35fff), &(0x7f0000000000)) getpeername$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x6, 0x10, &(0x7f0000000e40)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa1f4ffffffffff06010000f8ffffffbf", @ANYRES32, @ANYBLOB="0000000000000000b704000008000000850000001c000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000000100000008000100400000000c000200700f0000000000000c00060003000000000000000a000a00272d5d29212b0000140007"], 0x6c}}, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="12000000ec0000001e0000000200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) socket$packet(0x11, 0x2, 0x300) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000400)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB="03000000010040"], 0x12) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000006c0)={0x14, 0x3c, 0x1, 0x70bd27, 0x25dfdbfb, "", [@nested={0x4, 0x117}]}, 0x14}], 0x1, 0x0, 0x0, 0x20000080}, 0x880) syz_emit_ethernet(0x46, &(0x7f00000003c0)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x10, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1}}}}}}, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000780)={r7, &(0x7f0000000380), 0x0}, 0x20) 3.29772883s ago: executing program 4 (id=1045): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r0, &(0x7f0000003700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000008100000008000300", @ANYRES32=r2, @ANYBLOB="0a0006000802118000010000060066008e880000220033"], 0x54}, 0x1, 0x0, 0x0, 0x20040040}, 0x0) 2.929910289s ago: executing program 1 (id=1048): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x42, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0xd81, &(0x7f0000002980)={@random="652c1d569d1e", @remote, @void, {@mpls_uc={0x8847, {[], @ipv4=@igmp={{0x6, 0x4, 0x1, 0x5, 0xd73, 0x67, 0x0, 0x7f, 0x2, 0x0, @multicast2, @local, {[@ssrr={0x89, 0x3, 0x2c}]}}, {0x17, 0x8, 0x0, @remote, "ee495345607d9f3d0be5da42e714838e3e7d19d2355eba7e872966d54b86ab0644df17bebe50d2e78c556a54ed5b3464e3250c57b0dce32a8863f0f63a948b7a417e663d3b614f829e53fb70cf1c350674f95f30cf5d1d5bcae2209719acea48959dd9fc89d5c69d6190acc11651950b3df964dae00b2ee714b18f072cd29c55759c4f9626143ec412c3f20244b10a8c9f5ab3a7d6bbb66a5118b00a6ab673d6978379629c62867dc553db017566f602107a469e37e2dcfc9c65f10f32f7df65433342bf61f4c37481fe6dac2e82782029dce22f625e570e7da977a78ad80dcecc4158a28b23a153ac405c52c2521c2c6ca40585c3a4a512b703eef4705606ea8f09cbfd5f76597f9bdaf159305935669b2a5747c8511e4f6741785a5ac3197399e211279d490c6738837592aad8e1f15fc8a0e930a8c2e81659afee1b757ff886235f46e96fefc87b7d50dff1d5cd4831ca848a49ddc5c0bd7a8030280bd459e9361eef3cc95349eed35e87b1c1c80f5453faac1e619577a84fef6fdcd48580192ab4a6fa03223fde8d0b691a3bada64f66ea0a6aace76221ebdad49453812a166c2d750a93824da37aa3bc8adea88c3b070147456481f2a308bd15f879f74dd3bc856590d50245a9d347fdae836bcba8f04cbef783449f6ff637a8fac6db8488074cf83c4f47e5de6411589d9a066e23c3c44c0c8175cf8ae805791e5f4fc823bb90aa2ba3986dfb4a85cd4f6ffa6b2f3640e9c912a313a26f268d59d0d36897ce453c82450a9f2e512bde897f5e1b2ade72f201cbf3c41a7799ce61a834fb04d4fa6a081eccd480ed5483392a703596539105efb91bdc0ca754a05bd4f5bb91850fe507e81ad1a697bd6745ab9a13d70209534df748db7354a9a90d5dc80cee6c12b9fcf14922cd13a4ddcb113868a526826582dd2daaa2ce8446fea6b6ef25b5a4256bb92f86b61c5ba9f1c959f624769dfdd227ee4c30c411bc6875273d2a15048b1d0c02e2824fc9d3678d84344738976670bebc17f739db73cf4bd8e067f88772d23547566261f97c5a05527ade3caf22b3f2b998fe8e6e7b0f11709ef19c2660af93fe3a2266ea7adf14625f43695ac88d079f34d3ec5ab8c42ed53e9e71f6a1dd8d862512101b540fd2f1fd457afea89bda538849a6f9b5b7974d2b5d8380fe15a21f9f0477c95c217dd5a1a00a59be0ead3183d86fe1c5d93f14003e6251f17c4938b7b7fe0184f9903b90e6e8ccd836263881121ff2182b5f1e33f5e92aa69c5a5e815fe9e75481ee4f27d58f554362bfd95f7b7d01c0524a0abf8c046d6bd572a5a927f3ae761ccbefe7baa940ed02317aec00364d84b5c522422c4265d9c72671dd208e4bc37d30847b9124c122ecb384aa3272bea6a7ec0e9e5ffcde916992fe9ba503a2f6ae7df227465203f21fba9868413c368dcfdc2f69e70cb2b9b635405d13a14bf95ab79daca6f3e46bc43185a143e07be2f4d762351cc9ceea9d904d49071ae9093b2ffa7e2eea30ed25212cf51b49b9161beb56790591723af7e2c032ed5afe964fbd0570ef21d08d7f8b71aa880af1e7bb7046f85c30b58561a61a2cce5d3c3035d4ab43367e4b1a031f5cdb26dd8b5a55cdf9d35e2c254f1e40c666d33efe7c978a7a491168db2b71901f79f8f8b849fdb5ea53fcd0fa5d622e945a4cd0003beac380a0131e095d25f14eb2507c93094a1187806cc98f48d61d022084bd9e932f4fd8fa453595b3d00f01e532c9385921463d73e7a4debe1335d551bdd7508ab7e055b3c5e162606f973da16a294aa19d646d18ddeb776eac4e414e859de6285628d254df840984e1a5827121255db36e81f5c7c1aa7e0278c61307f00db3e270780baa6eb32f3fa95aa74482e38db95413106277b65d03226c788f5714c6131b6e6635b6b4b4262cb17bbec15cd60da7c05bf70d158180207ec694107384d1fc1dd08a62b7f9428d01dbed192916015f0a1249b52d2028a889456eeb42329a2d46ca3e4d5cd4c02a72c9100cccf3b513e4b6d8cd9266f1ce913024f1c254dac7d2568a5d558e080a93b26cca2e95da7affc3bf03640f85a65da806b051008d9986a16d6939a2c56f0e9f143f76d5c9f24e83cee46fdb320d2e9061ce1a1dba48706d13023ce7417eed9551cfbf97a3d4c1a0e2b7324d37d214416594189f666c8c4c27c21ed87a9f263b4185d2219bee796bff96445dd0ab5282a2ff6de9dbe4f3fc86ec83cd6bb5fc71467aafb35acf7e176ba64c4499d2a7f64c4725d93b37473b57b47aa97cbebbd5b9cb8ea295f04bd74d41686e6a5c6d0f8e5f0c5530c5456d02eaf18146b1a52009748c5678a85e53ec5331a296d2da4ae3070332513159894134e51a464ad47e61b8a4584e8683c0cfcfbf96cba2eaa4b66b0b6343721854a5f99d1fe67c3f3bb92ee2aa104a0ecab3bb13dbf0af24c080ca075ecbaf2543fa3e4e7f12a50339cfe43cac565a9359ff998e89c006367472533df36d546d989537c09a4dc32ca8895987631a6f33c469e3fd994a6f1248e121d0fa82665462b300c090722921c791e12821ea77f30cb9f15167ae98a247bfff236551ebc774b0352cf72edfad37b56c38c70a212166e32aca42e1a18b4e2e1dca3a6b3a2532dd4c08acb3310f49607692c677a0a45f19422ce855cbff095a57b1b6f8bec29fb6d14aed4f10dede30b4bdc0c4b2ba0c2fac69f3f90dc5ad1117286fc7f1b308c19f83704bf17a1fcdc694bc876542bb00f891e93db3c263d6767fb874bdecb8768484e5c37d1ea9661241190b04ce0f62bb7a1d3f6442d44c2cb3b3a62e1b982c6bb45568f28b12d9aae009bdd5c16ff9275f77279bea72241116d7d99c25d1a65c6e4eb432cf46813f46f206510a4565279eb168def351994bae612aecc6bd22bf7206a3dd227e130fb7aa75812a1465170f4636d0d12777e3e2b5bb70186176f39416d6bc37b78636d5ed58a06e95581f105f055d700e06cf8af2107b8f356920120bc0cf36dc1eeeb46d0e2cda07e9109a407ec87275de7815f83303eccc21371aa6887c07408e2d794da47229c236fb2f1b98a29381de9e9d98a4b7af40f8b37ad5a9f67e0b27c1ca823e46091faf0de41c42f3e7c667f3a0d0f4cfa0996f7aa10ea7f8887c2f641814a8bf9439fadff3ef41308cad08726872de5071d1fa533cc0cfe5854c49d8832b5b058107ec5d0d4b28433c6e1adcdc323a165f02a3df42a5c2fc1a4b2bc96a655d5d5df4a066f239f19ed786b18ca38a651fa6af3e0247842da81aac7f7bf5beac38b77a79359a63b6c89ea3491a6e825a9bc52552b49721eb3a09a00bb39038104eca18fb047c541c0c31aa0ac42a4241c53803cd18ba5e223205fa688d33a462433ff91866b95c7bd31818feeee836d4638f8e07aaa00c699f8f0356069aff6f2710a6be729ec93f2ac3c73fb293ca386ce6d9f763f25dfb46da48ed1665a7b9c61d936bc3f55b763545ad29f1fb35bd6478e66bb7ba984d523c473cf9ba1771992eb9db9b63f6daa602e3d4e11a10d26b5e4b0b45cc43ff200ebd61c6332c24985ca17d644736ce9492966371474a1d0f0e43a76fce583da2620a35ae9964977cd25ffa35c87f588460f0c1aa81de224a16d379254cb6b70f473d99f2a5ae8e342f086bb92086e9707d66d9322f9cedc7d1e4e62d8b035541da784d2a232c581b0abf4db12cbebdd5ac2eb2228b69d5351f707569523086ec52b3ea51b731934b0a9d2a6bc9233c16839e4516ef5e91290062b88b6c5d3a9e522b28b5995eb8fe77f4a617f0d7dd3ac707e739bc5570888986995289748677e24afd15a0eb6ba6023ef908c2f7ba6c54e1187808752348fb86b37dcfb62bac11639bde5e0962986c62f606f73961c0c71ac052f1ed1a5d6550f1f642ec72e1e791104d2fbf82fb2d95463a6064e692a1ed5bfe5ed7e3d4d95554f839f12d4ca0b9572ef48691272ebd518b8c114c2469cafdd57f8d33371642da9c446f78e0018f55d9be2a9db78310b26d148ee644bd50b0026583ff00052a5ca77af06c6ebcc73f5d5e8ba16ecebd42f379b44692aff4552a5c5e43b71eae9e8f56eebad820d7f71c87e8c7322ac0d768a344cf5d73043f8edb1d503afb48a072eff7cc57c3021a3bd59b9749a37a9753ee2225d8419b469738f3f97e24c9a93d39dc11e6dbd2bb7771cca43aa1848a16a6a681b821ec0e2857e2b0a3aacf56b466e529bf66bc6f4b1c6bb9634214ed6cd94a8943c510518415326df126730c961261d9f0c41e215a5261152b0424c38fc0821736a92744a318672b69d524f839985baac1db8f03c1a6189e016744184a54af2673facaaa5264b1eb090d9a750b24da63886ca6c3b7edf02662f1f2dd3d931f167bc4d5716fea9195fc028f557fb113aef5011e17e32e8a1c5ca1838ea4de4885fe04203987a87c9ab0b2762d104cb656a89ce5a3ee8ff3db151619e4660fae731ac9e28179faa932dd06a4e5231e5b54179b0cf7e53d695180436602c1f9d9684abe9d354ad8c262682d89a722574363ff508ec56ac3900e043d717bd5fbf6b1bd158df546e04601c4ab16eedd472d92d46b0c3dc659eb2eba41d53a20d7a3fcad5eacd35ea9ae94b9c5fa9f59c914e9dc6feec6eae2ce31e5e6cc8bfd6eef9ba0f8ab57ddb0c2ea9eb19d764d0446f9f980a63ce48e830e2da7ce2cbb3052c8ffa2f3070c37c9619a881ac2e7017f5c38d695a8095cc64a576b03a06d44859a2ba22df9b5a5074e8cb3e2e8202a0501fe0cd422a12f6d8cc29249cab5e397a650e35d1c75bb125ef5b1f67bc7950c"}}}}}}, 0x0) 2.88365776s ago: executing program 4 (id=1049): sched_getattr(0x0, &(0x7f0000000140)={0x38}, 0x38, 0x0) 2.752030283s ago: executing program 1 (id=1050): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000300)) 2.701163155s ago: executing program 4 (id=1052): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000080)=0x40000) 2.182472117s ago: executing program 1 (id=1056): syz_clone3(0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], 0x0, 0x2, 0x0, 0x0, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) 1.966965612s ago: executing program 4 (id=1057): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) pwritev(r0, &(0x7f0000000940)=[{&(0x7f0000000640)="c55346b4973b7052a539d3289a06778b4a331181c2946182a0ad499269c2fb3e318b3d55a5f00b0782b6d77ae7aada880bc262e0354f0fa3df058df39f47dc7bf1fbf1d2efbb3625588083be9d541d84ab5e53dc610614a250cf834b50dd0229fd1ab071a0ead4376d769fcf50952480b454572a4f99426e76af4e810bb47119b30c", 0x82}], 0x1, 0xfffffff8, 0x4) 1.869443855s ago: executing program 4 (id=1058): r0 = socket(0x15, 0x5, 0x0) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(0xffffffffffffffff, 0x4068aea3, 0x0) getsockopt(r0, 0x200000000114, 0x2721, 0x0, &(0x7f0000000040)) landlock_create_ruleset(&(0x7f0000000080)={0xc0d8, 0x0, 0x1, 0x1471d, 0x9}, 0x30, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a80)=@newtfilter={0x58, 0x2c, 0xd3d, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xfff2, 0x7}, {}, {0x6, 0xf}}, [@filter_kind_options=@f_basic={{0xa}, {0x28, 0x2, [@TCA_BASIC_EMATCHES={0x24, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x18, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x14, 0x1, 0x0, 0x0, {{0xd9, 0x2, 0x6}, {0x1, 0x35, 0x0, "1c7c4168"}}}]}]}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x200010c4}, 0x4880) 1.334698568s ago: executing program 1 (id=1060): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) io_setup(0x222, &(0x7f0000000180)=0x0) io_submit(r4, 0x1, &(0x7f0000000780)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x5, r3, &(0x7f0000000a00)="1c73de19da4e24a4be5c3011d88efffbb251589a5bef61f451a747474f315938cc426a841b78d07b04cc6f2d276323ea48a6fd1c0ba66f5055239df5a21b234315694fd58fe32aeaa543e5fe08ccdf3e689caa8cedec8010f8bb8c59eaa1ecbf0f6f66afde88c010b3138095b6a0116af9c9011f03cc24e087286f2553198568c0aea639920383723c52ce2839b5dcb5ecf2eb92eeb24271354e1719e92347b792d0402fb04bbbf78fbebbf4b4832385561e1010dd612da55e8f738b13288b548d333c1d174ade527cafb3fc6576c16cd2e71f68286e28d5d8a17ef63d253bc56ce36b8d4aef6c0a34d8b9463ce4535f9c1700a5bf7b0f217ae63d3d377ddbcf7d4dd2f3f8f08de60c87b1e07487cae176e2f76ea307fa1693d84328c7f751d6d997555964813b103ea44b6e2e8bcc09609c25e5d1e0f174c44dfed19aa2fc6e6a60c589909709ff6b1a8e3c7462427d11469f81fa4d9a69ee39b8f3824889f3ee0c5838a22832193d9f42bfcff8f1990746da71c109c82f51aaffbc9b33b03fe4993f4bfb59461c5a2e13514072283677447793cfe1e7bf5b48416b80a7e18e22cb13e0370f7bb9bf952c4c5355dbb8fe0d912f88d743c536db4b306075c2dcd59d602e75bb159f71e4f11192631fc338203c136c9efc5f05bf94d2fee1a6ad20f2c7e834e5be49ebedde2d9735f46eb08c6537d24f3f06589a4597f2d9378f", 0x200, 0x200}]) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) dup(r5) r6 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r6, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xe, &(0x7f0000000000)=0x4800, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x3938700}}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wakeup_count', 0xa0042, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000002800)=@nat={'nat\x00', 0x670, 0x5, 0x430, 0x230, 0x0, 0xffffffff, 0x2d4, 0x0, 0x39c, 0x39c, 0xffffffff, 0x39c, 0x39c, 0x5, 0x0, {[{{@uncond, 0x0, 0x158, 0x18c, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xc, 'bm\x00', "0d01d3e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x79, 0x2, {0x1}}}, @common=@unspec=@addrtype1={{0x28}, {0x4, 0x400, 0x3}}]}, @MASQUERADE={0x34, 'MASQUERADE\x00', 0x0, {0x1d, {0x0, @rand_addr=0x64010102, @loopback, @gre_key=0x3, @port=0x4e22}}}}, {{@uncond, 0x0, 0x70, 0xa4}, @DNAT0={0x34, 'DNAT\x00', 0x0, {0x1, {0x1b, @multicast1, @local, @port=0x4e20, @gre_key=0x6}}}}, {{@ip={@loopback, @private=0xa010102, 0xff, 0x0, 'team_slave_0\x00', 'batadv_slave_1\x00', {}, {}, 0x0, 0x0, 0x4}, 0x0, 0x70, 0xa4}, @MASQUERADE={0x34, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @loopback, @remote, @icmp_id=0x67, @port=0x4e23}}}}, {{@ip={@multicast1, @broadcast, 0xffffff00, 0xff, 'veth1_macvtap\x00', 'bridge0\x00', {}, {0xff}, 0x73, 0x0, 0x20}, 0x0, 0x94, 0xc8, 0x0, {}, [@common=@icmp={{0x24}, {0xc, "1542", 0x1}}]}, @DNAT0={0x34, 'DNAT\x00', 0x0, {0x1, {0x10, @rand_addr, @dev={0xac, 0x14, 0x14, 0x26}, @port=0x4e23, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x48c) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x4, 0x401}, [@IFLA_XDP={0x14, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x19}]}, @IFLA_GROUP={0x8}]}, 0x3c}, 0x1, 0x2000000, 0x0, 0x5}, 0x0) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400440}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)={0x14c, r8, 0x201, 0x70bd28, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x20, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}]}, @TIPC_NLA_BEARER={0xdc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @multicast1}}, {0x14, 0x2, @in={0x2, 0x4e23, @remote}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x4, @mcast2, 0x7}}, {0x14, 0x2, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xe}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @empty}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x1f0, @empty, 0x1}}}}, @TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'ib', 0x3a, 'nicvf0\x00'}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xd7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x18}]}]}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3}]}, @TIPC_NLA_NODE={0x24, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x800}, @TIPC_NLA_NODE_ID={0x10, 0x3, "c9d369717f3be6011d574945"}]}]}, 0x14c}, 0x1, 0x0, 0x0, 0x4048090}, 0x400c005) 829.27969ms ago: executing program 2 (id=1062): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3d, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f00000007c0)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) r0 = mq_open(&(0x7f00000001c0)='ba\xa5J_\xe5\xf9|a\x1dv]\x13mave_1\x00\xe0\xb2\xf0\xabT\x87I\xa4\xd4)c\xf2\xe0\xd0\xba\xdb\f\x16n\x96J\x90c\xc5~#\xc9\xfb\xef5\xab\xb9\xe8\xc7\xde\xc2\x80\f\x19L\xdb\xdc\x14\xb4\x86\x1d\xe0\x9b\xe4\"m\'+\xc8\x05\xa4\x1cT`\xdcL\x8f\xf0\xc9\xb7\xc8D\xcdWG\xe6%\xd9', 0x8c2, 0x30, 0x0) mq_getsetattr(r0, &(0x7f0000001080)={0x0, 0x20000000005, 0x8001, 0x55e}, 0x0) 694.981703ms ago: executing program 2 (id=1063): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000300)) 563.267597ms ago: executing program 2 (id=1064): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, &(0x7f0000000040)={&(0x7f0000001340)=@hci={0x1f, 0x0, 0x12}, 0x80, &(0x7f0000000140)=[{&(0x7f00000006c0)="62042701800101000001ad2f1eafbcf706e12b30087f5c582d26116642c47a5f8786ee601e65ab3c06d4b8bf4a81cb3e247345af215542f41ddf82f618438a34f90186cee8441e2305e495d04ad68ab8fef69df82de6456fbb48b63f60c9c9097be968ea872c4801e5d0711b4373c7224ed7a9cbd49d40f82bdb6afc0036824be26fc96e49a70e90797e6caa1b38ddacb3cb2b3eac7c068a185b644582f25edfa3d6a46e2a894ca809a422a6a29bd7145bb6e7992570484d6a710292ea0c3f97b7cbff701684b13c5593262534a7af9e", 0xd0}, {&(0x7f0000000c00)="294f28dfe56d2c8ba23606bc7ecd1f634665cb5bed07bac5684da6eb21da1d6926910c5a0c653b0106869a804dd2a44ce42557b2e32e2bd367e9d01a5e7380cc4fc8e7c9044cc4115b978ca7427d749beaefdf2e48b369cb169ad7b1ced26bb161", 0x61}], 0x2}, 0x0) 484.450368ms ago: executing program 2 (id=1065): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x7}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mbind(&(0x7f000010d000/0x1000)=nil, 0x1000, 0x4000, &(0x7f0000000000)=0xffffffffffffff3a, 0x80, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdir(&(0x7f0000000400)='./my_sys\x00', 0x1ff) bind$xdp(0xffffffffffffffff, &(0x7f0000000100), 0x10) ioctl$BTRFS_IOC_SNAP_CREATE(0xffffffffffffffff, 0x50009401, &(0x7f0000000180)={{}, "afe1658d587e93ab4b5fca380cdddd71e95c81000bac90d9689507b96ace5d2f9f55fddb8b36c7cac9209681a5fa01cd3874b06f2fcadd0d6c3b2543560ad96ffb3b3bb528250d54c3849e85a72f9805820433eaf86b855cc6bb316351ebf38753b22f619e6525c21a5050c57297595293366a0ed2ad9b308f845f1d9af97cf6384f5ec26ca2afea4eb950f209116b1d8b58fe396fcfb8ae0b8898f212b216cbb7d1bbd57a726d194a29a4e15e035b8162b139c67404e6a503db799c06078f56258de59c08f1812611aff6d4485a01f3413b9b4a11412629c2a4810db413d940af170b313dcf9a1e08e0156a7784c413ffa69bfb6b135b6093ad19c7f8bc70e5f9a0bcf07eb164c44642489845d93c25064c768ff253b3faf52378653b61ed2f3460a2221e6d9b2c04e99cd9fe74c005a330a08f558771a77771a1d1eb8b110912dbc327e07869f73b857cb841b5a47296a81d956c030dee87fda743cf9e56d08856a82ee26a390ac2569a31ca9beccda0251f28b124ee1e8ea6babc1b1e2d81fc795de9620301d65ded5865c5a9f6ce7422536d40694c2aa987542364f7f0bb75bdb0182d10b18a64045c7dadc0c82a47eab7e735fe240f27bb5da305cd08c86314a4a5fef8487c96bc1ea97409d73e1cc6ceba35f74eea39f2bf881833298b1e1a201eb9ea9c0754d41ef9a91b4deefcaeff08ee35a1f31b2d780b3934d5913626ef4a0f31c8e057e43ff14fc6fbf5e4a86b906b1ba320f3c52b629974a1324d97067935df1e4340b071130ee953bababf9dc0229e4a2f29cf1ae2713ffe85a5a9bd374c928ed416e1bd2516657bd4d3a9ac114ed279fcd89645245df7c55454fc367513ffae594d5236b320ad103f2d0956b3da7344a29fc910040027ca8b239d00ab5e79eeb83e25275fb61ceb65f6ace88cb43f106e128330ae709e19f209afd87b934dbd0faf470dfb52fdfd73bfa9a7a983b36d78469568ae69a0481cdc764c554d5ac03e607781cf3a5e209bffce2276529929d800f6d9b8a2f100108d7b883b5ce5e19da38ae5c99a8351b4e41c538fee7299a890edc630abbfe604c0b8847a7b5b4eec1dc00ed60e95b5374270ec634ff6d6ccbcd08145f9df1c2082c9447482ed42b4d0ea9a73bc9a68e36ee9e118bb5c08e1e7c2bd2627e82902d2c6f0da90bdbc52103f3992663653fd2b41a4294aa8f222812fa8b5e1864b75748f992bc2b396c03e202e8bfe9a1ccca1cb8b28c9c6faa47cc6b871140ddc45a0d02c752175a0498c3ba30e79c12d6ebbc32d5533d0216529e0f713eac725fe41bad4c9051d364bf38e3b72641510b09b2645447ea13b440d568adc9aa9ce85c967d78a14bdbd2fcfe0c7324a556ee841fc9ffd7a3c784fe41a349ced68e01c145db8847a547086c5595b9f6299bf7432e0e9c9a4a9108a24f7ad49c18a3ec771953480a0a0fdfeaded6b74f174ea2def77a0b9799f6b75a77a6314a4165e194be616eb5c98726d88da79f54fd01d39e751837a6bd0d77ca79073b3a7e62686fd8e089b0258645db505bb674174d626b1d1cfdf0f32b0d880884b73c63bc78a231a8cb45a12884907c021f87cdd7b2f1de020044666d38a866983c8ffa0cc6963a745c108e80a3b54eedac65b68c897043d914f146ba4ca18a61e144e7746d31879fa7ae7c2a43747e6060d79669bf9a8edcc229b7f1a0fe239b398692a6a65acd19c58442dfa8997430aab89aae8fb8f201bb1fd58605cf9dfe5c85a15e0928542a8fd7768f4b7750c7aeab8d9ced7c9fdea6cc38bc38209f608cc3d7c8bc9240b5b7d1661b8bfd231f30047befefd70183fb8330d184394159cd4153990c6a43ccded133adecced28499e73c4b25ee86e5d68848670736362931be74fe0aab5708ce05f4d6d7a068c590d36f99a0ba3501df60d9c01f54a7c366727287996de354c4a3a5e1ece988e5f59087c730afa107edbab31de441a88061ad799fefef86254a2f2891aa47420dd3f6267833a5345bf001d10c9f1fd121401ae846a9a5df517210cd0beb50a5139854aa1747115bca24522dae42667ef9ce893c4db108941198ed5323f582f11c4b13385f60b3038fa661f3ed276504fb51fb966ef88cbbb953c269ea2ed989ced5e8988839c55b398dbce98ce1e976c2065b2ded80f929dc6ef8afad6b61145686ce14e2d26f0694fda1e52a6c5155c0d8ea91544c76548a25376f13de7245b48e7298421d2c2433a472a8c89c3e621c5370654e1c7bba0f3d8bdf40c36cdbf02f6b5a7c4138b9e3931896fd89272b4d61a9875c00ba0d8d1bd960b9aaee3b6f127db1155680d7eefc5eaa6d4c648fca303706796bef110fbdb731d9e671f937e55ebf5d2e64f7cdcc073c905c134e8d3852689ed81c95be0c259816e7ff7b979557684aa1b6c2dd42754bda93e3e55c5ffc1122c988ca171fd57ab24ebe789e819c60ff3f9f1a9465ff4a9bdc5c2b2d9c351ffef5ab375f9024e297a26642b15108781fdf3c55d0aa9a8cb68ba93b7b13cd6d05b9b16502d7f9d72d015059e7999cc4ed880fd5ebf626ea409b9f0c4ded2974bb3daf88cc1930818dc3e09200897389211d3e780faa0acd64e37c60924a3fd0a16a7146a41b1b01e43fecf610c7d11d42baac5a60db7638077162cd58b3f734070e81ee71c5092422eaac366b41dd996723124df9005cbae4e2ec47f8a06616bd7faa5da6c0200c872c2ef929a16c823c57f2d4f798061e49102cab3af65a5cc9f8856dc5d3c0de1440c4d8df50a7ec09491d2e651ee5f5a76b8fc2d20a07def1a8951b9770f85728b42cd9dafce7c341c26a90b7d1c2e36f03f74eda3bfb2c40eec5c454c38e90f4d31e6a0f23b2ad53a429f73761713181b7839792cc494f21c5be9dd7f167a6681720ccd3cfcdd4b427058b995505a82993805a1860d5ea75e61c216ec9594adfd39cab47511578d57e312f2f3e0d2da8f2d8dbe3fc1fd281bdd8e7dbd203e4ec3e7d3b468ad2b81a76c5bac460f497e3cdb6bf0c6be5ceae4bd488b9597b13a37885b95426d8ea06760516ec13aa339084407d1f45e331e5dd77ac73306f70996728a0d67b48a833e9a3ddf22968e898b59e4b4c9a16aa9ea8120202737746e1a5ec2cca9640d69df2b27900de7abe573b7c023a88d7f3fcc3469a3a4e7f9f9095a6fed55fbb1d3582807407e62b55a38d33e70a0203513f30d37a4e6f03acd9d0fd2f3438eb485aa5e693806c002efd0811ab92518c41856039d7f36cf9981981231b3cea3493f0e8988bd05d3d424a5bfc8d1cdfd0e09e3ce12cab6edfb7f6d80c1edbb4d1d51a1500b0876e13e5173bfeba378c71046e70b590cf542094d01f458a3cec642fb1ce13a992765eca608579e85f03e7d871dbdbd882ce4821a944179e48a920d346ae21b08ee043cbbf3284c3a67d9b9417a5fed1202ca537f7711650f692df044f145587467dfdd45405d7caeb064bfa12b52057e90d2b5d2885bbaf032db769654af272dd78bb8ec8446344d0c1ca57d51fe1243e0a02ada90371e75418223f171f014f9a970964828cdd9faf3b66789cefd0374437f2a271c2765d9876943fb93205cb12448d4cccf68c28259e85a540e013ac77414a147fb1e0f0fc4a4d859a928eaef6e952a103a944052534c9264c85f4200cc8b465f66725c779f49312a308dda8fe7e423ebbee16e64ad6e112b3efd95584160f08c83595fdddfa39c4b89867fcf23085a24c53a6d846863b95f5605beb9b0a1cc6d191524da81ce89c0f7767652d887661b5299e300f2e83a6c962cf9089d82b139f4bedcc14bbf6611258d52e1f3d5a5e3ac05cfa4d066550b2180c31695a52da12c1412e55cdbe6660d86fe4c8eda51f2adf34b81af8ec55b549c3bbcc588c5f074e0dc76bb9bbd0cdea26dd47d84d9321f970912d374a081c9ebb74700a0792dbbb2da41ae7e3aa5230bdd260bd208b68100dc2f7bf2132d7cb34084e999b6ee2b91356ce766523a80359147af20fa15febc42b89d43e4a48d13cb8ed6678f346aa981954e0520ea8cd0a0c16281e57f33a5e3fd97d55d24386832c17f22b1c1fb91d5b1f362f3bc8aa8369c18444fc10e9d1285f6a3bcf24e2606b69fbd89f337f7ee3c27b1a2c7e8dec2c38c84c6712de1e7f1d790d86d8e0a402c40d406d39c13879f4d103adcbca13570eadcd424f8e06155885b054e1d7f994723fd22a6d704a89e6b126271ec5c19ea7b814c36f9ca9a0223da630324ca0f2a3010f4e53426d8d514bcc3303e6fa429c00244b918c01a444f74dd376bccb5709ed103514484a67240c4b992c722601e27dee6ba8b37608ba66e2065f8298a6df8c0a491113bf10e0bf18867dda3e1170fa1853b355fdf41898de4a339927872e8d9fb8a4d1c31833ac1355695a20c75ff6dafb70244a3754cb58feee89045e3408da902a7987e6a66dad0f044951a560954ee812abe142e9a4db701bdc46fabb0b98b4be01dadd629cffc661a3816744bcacdc38777494289ba156b272ade8f4ed3e32ce48958863b09bb09fb6999281164c0c5b50a77350d5f3c78d951fa76d1db68587e58bd40f824a68fd59c4ebd4f7e22e8e1458911012472b876ab15ca8c48ef664b1da41bd1ad9a5b799a1de8b2962c477f1726cbbe4f285a5c387842ac723b3877f5826503b68602c4bdaea94544b4b056142876d995d0db128a38f5c4547f12cf9d1cbc678cd42eebf67519484ab251855dbda09dd04ddc031860a69fd592fa1c12d59adc4699c246a666f6f6c20c1a21562f05f8db43ff424cea0d16789a6a69dc8552f4865bb3fac5b650b549432a0383c8f95c79084ca4841903f0c04319135f2bfc94ec8837374f0c1eccaacf8a0722d54b1a0e748a79e6c7ecdcdbfe376d080d9747a9a5a13cc7eb4111345216d1c787f05c992df3712d2a194ac325bb568abc6a97011bc62110ee12ba209d76f690ddb4e4b417f5b5db52ee7ad97159dfcf82b1c2a4eb5a97396fa24e52ba1c47330f7caca91b2965bac75dbcb86ac85a07b774dbf82be5fc92a8621e80973418d94a0bc10905a3815e04d1a668ea8cb5ffb293893b06bd372c75b477118b78dd69a04097ca8ff8f8fb21a5293d2fe6785e33d15d61008c4ca84121a8e48fabba3656250fba7e058ffc1705c7fa13509fc7c96fc9b16d0b21a26b11ebfc3325a2ca682bc014ec54dc8433af105ada5566f491d3ebe5e1e5f0859b28a576fb7978f2a1b4897890c1c9b0c1f4f8c7351ca738a6100c4f64092d865bc65a8b92007b117e5a4dd7988d3281aa2ccebb36f9af5032eeca2c8a72888c84346d3945507a6bb956b84f03d88a90bb9ecc466c7d94a3670783e11b312ecb4f9eb8489df8d129110b6bd710138476c8be75327e9ea6a0b94b8567b31692fee2d9c17d7e20d3d23cc4d317710537f608793e87d9158cd61a43306898da40d01b544fc951ccd13f11b4b8fbf47d694df601fd6677d796818571ee3125089316e3d33c5684affe9f29f12186bb5dc4c5eaee94e41d07a03c9c59db95bc42c23da55c497caa6a64c73ea3059a8c80955a9730666a0e02c3bf87cfb79542d84a529d7bf9c3ac60b323952fa439c2e5fd512c3bfe3770178b4e8d7efa223bd76830a6b8b604e15773d63d9fec504ea6561793723ff4f6fbdd016372e1a98a9252e8d1607512e5397c78498f68d3792ef7a28f74f4b15358afa5674d4340863a2897af87499bd073a06aef8215f76c9418f5b82b79b77f0a01dfc059b510794cda70b7daf2c74950652e"}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f40600", @ANYRES16=r2, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r3, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) mount(0x0, &(0x7f0000000100)='./my_sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9) 322.792292ms ago: executing program 2 (id=1066): r0 = io_uring_setup(0x1b56, &(0x7f0000000100)={0x0, 0x1, 0x400, 0x0, 0x2c1}) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) ioctl$VHOST_SET_LOG_BASE(r1, 0x4008af04, &(0x7f0000000080)=&(0x7f0000000040)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000180)={'ipvlan0\x00', &(0x7f0000000140)=@ethtool_link_settings={0x1, 0x10000, 0x3, 0x40, 0x0, 0x5, 0x7, 0xc, 0x30, 0xe, [0x2, 0x1, 0x1ff, 0xec96, 0x5, 0xffffff7f, 0x6, 0x1]}}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r3, 0x6, 0x21, &(0x7f0000000240)="98750f50aade73db0f0100008005f4ea", 0x10) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r3, 0x6, 0x21, &(0x7f0000000000)="439e10b5498d94e3c3750f4f4afdc6b3", 0x10) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000003c0)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB]) read$FUSE(r4, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 62.623228ms ago: executing program 1 (id=1067): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000180)={0x0, 0x1, 0x12, 0x6, 0x200, &(0x7f0000000880)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309002500000000000f4743f490c585108c1331c7749299a25a705f5096cb268cbc60efd680e1be250700000000000000472471ff550c0010000007f3c7b61abe4162256004ea8ca512b5f379c4eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7f804bb4713019a83353dc519d11c3cc1c22a3b86cf3c645413fcea0ce9ded703699d2bb6a4a663b99b6069da5aaf64785a58847440f064b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200216032811fadcf1e0f49a514df529061e09ce45e3f303a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a250200000000000000d23d324205000000000000000a617f22133b6cb5087f4c6057942ad995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a3cff46591ccaff3075b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8841416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedcbefc5990d7fed29a002ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d559b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756d732533c2722e03002293e37966611602f297de6ff5408777d7a93c45cee3ee5c56e8a3e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f6579ef62866a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c909cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc562507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f80000000000001700000000000000000000000000000000000200"}) 0s ago: executing program 2 (id=1068): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x1123102, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RGETLOCK(r2, &(0x7f0000000040)=ANY=[], 0xffffff6a) splice(r1, 0x0, r0, 0x0, 0x40010003, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x1b) kernel console output (not intermixed with test programs): ogical block 2048, lost async page write [ 88.426759][ T5888] syz.2.13: attempt to access beyond end of device [ 88.426759][ T5888] loop2: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 88.440186][ T5888] Buffer I/O error on dev loop2, logical block 2048, lost async page write [ 88.448849][ T5888] syz.2.13: attempt to access beyond end of device [ 88.448849][ T5888] loop2: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 88.462815][ T5888] Buffer I/O error on dev loop2, logical block 2048, lost async page write [ 88.472892][ T5888] syz.2.13: attempt to access beyond end of device [ 88.472892][ T5888] loop2: rw=2049, sector=2049, nr_sectors = 1 limit=2048 [ 88.486316][ T5888] Buffer I/O error on dev loop2, logical block 2049, lost async page write [ 89.642012][ T5891] loop0: detected capacity change from 0 to 32768 [ 91.131523][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 92.332993][ T5920] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 92.692611][ T5912] loop2: detected capacity change from 0 to 32768 [ 93.163146][ T5925] netlink: 36 bytes leftover after parsing attributes in process `syz.3.26'. [ 93.956132][ T5928] loop0: detected capacity change from 0 to 40427 [ 93.966247][ T5928] ======================================================= [ 93.966247][ T5928] WARNING: The mand mount option has been deprecated and [ 93.966247][ T5928] and is ignored by this kernel. Remove the mand [ 93.966247][ T5928] option from the mount to silence this warning. [ 93.966247][ T5928] ======================================================= [ 94.042485][ T5928] F2FS-fs (loop0): Found nat_bits in checkpoint [ 94.204539][ T5928] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 94.419781][ T5939] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 94.640159][ T5939] syz.0.25: attempt to access beyond end of device [ 94.640159][ T5939] loop0: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 94.963865][ T5775] syz-executor: attempt to access beyond end of device [ 94.963865][ T5775] loop0: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 95.021286][ T5932] loop1: detected capacity change from 0 to 40427 [ 95.034545][ T5775] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 95.044578][ T5775] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 95.099000][ T5932] F2FS-fs (loop1): Found nat_bits in checkpoint [ 95.209661][ T5932] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 95.859595][ T5949] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 96.262028][ T5781] syz-executor: attempt to access beyond end of device [ 96.262028][ T5781] loop1: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 96.284950][ T5781] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 96.302557][ T5781] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 96.761486][ T5955] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 97.018736][ T5944] loop2: detected capacity change from 0 to 40427 [ 97.058322][ T5944] F2FS-fs (loop2): Found nat_bits in checkpoint [ 97.181110][ T5944] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 97.354859][ T5960] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 97.794590][ T5951] loop3: detected capacity change from 0 to 32768 [ 97.878414][ T5965] loop0: detected capacity change from 0 to 2048 [ 97.887468][ T5770] syz-executor: attempt to access beyond end of device [ 97.887468][ T5770] loop2: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 97.895520][ T5965] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 98.087169][ T5770] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 98.235181][ T5770] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 98.451038][ T27] audit: type=1800 audit(1788332057.797:5): pid=5965 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.34" name="file1" dev="loop0" ino=1346 res=0 errno=0 [ 98.521170][ T27] audit: type=1800 audit(1788332057.817:6): pid=5965 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.34" name="file1" dev="loop0" ino=1346 res=0 errno=0 [ 98.919214][ T5963] loop1: detected capacity change from 0 to 32768 [ 99.503029][ T5973] loop2: detected capacity change from 0 to 64 [ 99.778575][ T5976] netlink: 36 bytes leftover after parsing attributes in process `syz.0.37'. [ 99.846903][ T5979] syz.3.36 uses obsolete (PF_INET,SOCK_PACKET) [ 100.440202][ T5977] loop2: detected capacity change from 0 to 32768 [ 101.481510][ T5984] loop3: detected capacity change from 0 to 32768 [ 101.645782][ T5996] Bluetooth: MGMT ver 1.22 [ 101.715178][ T5999] binder: 5995:5999 ioctl 4018620d 0 returned -22 [ 102.949654][ T6004] loop1: detected capacity change from 0 to 64 [ 103.358776][ T6011] netlink: 36 bytes leftover after parsing attributes in process `syz.2.51'. [ 103.907158][ T6023] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 103.987962][ T6028] loop0: detected capacity change from 0 to 64 [ 104.223404][ T6030] netlink: 'syz.0.55': attribute type 2 has an invalid length. [ 104.429236][ T6026] loop3: detected capacity change from 0 to 32768 [ 107.014909][ T6050] loop3: detected capacity change from 0 to 128 [ 108.448932][ T6037] loop2: detected capacity change from 0 to 40427 [ 108.477122][ T6039] loop1: detected capacity change from 0 to 32768 [ 108.515966][ T6037] F2FS-fs (loop2): Found nat_bits in checkpoint [ 109.143989][ T6070] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 114.053194][ T6090] loop3: detected capacity change from 0 to 32768 [ 114.117941][ T6103] loop0: detected capacity change from 0 to 256 [ 116.948708][ T6112] netlink: 'syz.3.74': attribute type 2 has an invalid length. [ 117.685224][ T6119] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 119.633506][ T6124] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 119.654835][ T6128] netlink: 'syz.1.80': attribute type 2 has an invalid length. [ 119.966120][ T6131] loop2: detected capacity change from 0 to 256 [ 120.520008][ T6134] loop3: detected capacity change from 0 to 256 [ 121.199420][ T6138] loop0: detected capacity change from 0 to 40427 [ 121.244301][ T6138] F2FS-fs (loop0): Found nat_bits in checkpoint [ 121.411371][ T6138] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 121.578637][ T6136] loop1: detected capacity change from 0 to 32768 [ 121.650238][ T6150] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 121.788291][ T6150] syz.0.83: attempt to access beyond end of device [ 121.788291][ T6150] loop0: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 122.096105][ T5775] syz-executor: attempt to access beyond end of device [ 122.096105][ T5775] loop0: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 122.122526][ T5775] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 122.129716][ T5775] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 123.437921][ T6160] binder: 6158:6160 ioctl 4018620d 0 returned -22 [ 123.452500][ T6160] netlink: 40 bytes leftover after parsing attributes in process `syz.0.87'. [ 124.533690][ T6169] loop0: detected capacity change from 0 to 128 [ 125.248201][ T6175] loop0: detected capacity change from 0 to 256 [ 125.641528][ T6181] kAFS: No cell specified [ 129.112865][ T6194] loop2: detected capacity change from 0 to 128 [ 130.813813][ T6205] loop0: detected capacity change from 0 to 256 [ 130.823045][ T6189] loop1: detected capacity change from 0 to 40427 [ 130.883584][ T6189] F2FS-fs (loop1): Found nat_bits in checkpoint [ 131.035062][ T6189] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 131.188494][ T6213] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 131.301684][ T6217] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 131.458358][ T6217] syz.1.100: attempt to access beyond end of device [ 131.458358][ T6217] loop1: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 131.742377][ T5781] syz-executor: attempt to access beyond end of device [ 131.742377][ T5781] loop1: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 131.763503][ T5781] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 131.770713][ T5781] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 132.462727][ T6223] loop0: detected capacity change from 0 to 128 [ 132.860466][ T6227] binder: 6222:6227 ioctl 4018620d 0 returned -22 [ 132.871357][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.871435][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.896830][ T6227] netlink: 40 bytes leftover after parsing attributes in process `syz.3.109'. [ 133.591295][ T6219] loop2: detected capacity change from 0 to 40427 [ 133.677193][ T6219] F2FS-fs (loop2): Found nat_bits in checkpoint [ 133.687490][ T6234] binder: 6229:6234 ioctl 4018620d 0 returned -22 [ 133.705375][ T6234] netlink: 40 bytes leftover after parsing attributes in process `syz.0.111'. [ 134.728965][ T6219] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 135.579042][ T6245] loop2: detected capacity change from 0 to 256 [ 135.993845][ T6250] kAFS: No cell specified [ 139.097426][ T6264] loop0: detected capacity change from 0 to 40427 [ 139.177542][ T6264] F2FS-fs (loop0): Found nat_bits in checkpoint [ 139.237322][ T6274] loop2: detected capacity change from 0 to 256 [ 139.316639][ T6264] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 139.452969][ T6275] kAFS: No cell specified [ 139.576389][ T6278] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 139.701346][ T6278] syz.0.120: attempt to access beyond end of device [ 139.701346][ T6278] loop0: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 139.977773][ T5775] syz-executor: attempt to access beyond end of device [ 139.977773][ T5775] loop0: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 140.000087][ T5775] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 140.009049][ T5775] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 142.017524][ T6292] loop0: detected capacity change from 0 to 32768 [ 143.700409][ T6291] loop1: detected capacity change from 0 to 32768 [ 144.300216][ T6298] kAFS: No cell specified [ 144.636330][ T6310] Zero length message leads to an empty skb [ 145.289332][ T6309] loop0: detected capacity change from 0 to 40427 [ 145.324381][ T6309] F2FS-fs (loop0): Found nat_bits in checkpoint [ 145.869109][ T6309] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 146.067210][ T6321] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 146.220147][ T6321] syz.0.132: attempt to access beyond end of device [ 146.220147][ T6321] loop0: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 146.543580][ T5775] syz-executor: attempt to access beyond end of device [ 146.543580][ T5775] loop0: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 146.584954][ T5775] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 146.604433][ T5775] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 146.902319][ T6320] loop1: detected capacity change from 0 to 32768 [ 149.546275][ T6337] loop0: detected capacity change from 0 to 128 [ 150.413842][ T6351] kAFS: No cell specified [ 154.189692][ T6370] kAFS: No cell specified [ 155.770560][ T6366] kAFS: No cell specified [ 155.944083][ T6378] loop0: detected capacity change from 0 to 128 [ 157.308049][ T6385] kAFS: No cell specified [ 160.622833][ T6391] kAFS: No cell specified [ 160.852604][ T6401] kAFS: No cell specified [ 162.994917][ T6405] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 163.226907][ T6410] loop2: detected capacity change from 0 to 128 [ 165.083323][ T6425] loop1: detected capacity change from 0 to 128 [ 165.254302][ T6429] loop3: detected capacity change from 0 to 64 [ 165.375226][ T6430] kAFS: No cell specified [ 168.272109][ T6438] kAFS: No cell specified [ 168.571977][ T6437] loop3: detected capacity change from 0 to 128 [ 168.875450][ T6448] loop3: detected capacity change from 0 to 128 [ 169.315996][ T6456] loop3: detected capacity change from 0 to 128 [ 169.345246][ T6457] kAFS: No cell specified [ 174.459318][ T6467] loop1: detected capacity change from 0 to 32768 [ 175.156051][ T6475] loop0: detected capacity change from 0 to 32768 [ 175.209943][ T6479] loop2: detected capacity change from 0 to 32768 [ 179.598603][ T6516] kAFS: No cell specified [ 181.782697][ T6526] kAFS: No cell specified [ 183.956845][ T6532] loop2: detected capacity change from 0 to 128 [ 184.818355][ T6535] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 185.935081][ T6530] loop0: detected capacity change from 0 to 32768 [ 186.979227][ T6555] loop2: detected capacity change from 0 to 128 [ 188.353982][ T6547] loop3: detected capacity change from 0 to 40427 [ 188.408034][ T6547] F2FS-fs (loop3): Found nat_bits in checkpoint [ 188.547461][ T6547] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 189.002564][ T6574] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 189.176715][ T6574] syz.3.201: attempt to access beyond end of device [ 189.176715][ T6574] loop3: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 189.210860][ T6574] netlink: 324 bytes leftover after parsing attributes in process `syz.3.201'. [ 189.542360][ T5779] syz-executor: attempt to access beyond end of device [ 189.542360][ T5779] loop3: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 189.612840][ T5779] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 189.619826][ T5779] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 189.624553][ T6562] loop1: detected capacity change from 0 to 40427 [ 189.702235][ T6562] F2FS-fs (loop1): Found nat_bits in checkpoint [ 189.801493][ T6565] loop2: detected capacity change from 0 to 32768 [ 189.846879][ T6562] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 190.350137][ T6583] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 190.493225][ T6583] syz.1.206: attempt to access beyond end of device [ 190.493225][ T6583] loop1: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 190.796706][ T5781] syz-executor: attempt to access beyond end of device [ 190.796706][ T5781] loop1: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 190.821714][ T5781] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 190.828773][ T5781] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 190.934392][ T6576] loop0: detected capacity change from 0 to 40427 [ 190.972220][ T6576] F2FS-fs (loop0): Found nat_bits in checkpoint [ 191.078663][ T6576] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 191.257874][ T6589] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 191.401492][ T6589] syz.0.209: attempt to access beyond end of device [ 191.401492][ T6589] loop0: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 191.732199][ T5775] syz-executor: attempt to access beyond end of device [ 191.732199][ T5775] loop0: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 191.905353][ T5775] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 192.048607][ T5775] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 192.857658][ T6595] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 192.898491][ T6598] loop3: detected capacity change from 0 to 128 [ 194.363251][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.370112][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.541720][ T6615] loop3: detected capacity change from 0 to 128 [ 196.461249][ T5778] Bluetooth: hci0: command 0x0406 tx timeout [ 196.467328][ T5778] Bluetooth: hci1: command 0x0406 tx timeout [ 196.471162][ T5087] Bluetooth: hci2: command 0x0406 tx timeout [ 196.473402][ T5778] Bluetooth: hci3: command 0x0406 tx timeout [ 196.618925][ T6621] loop3: detected capacity change from 0 to 256 [ 196.979794][ T6628] kAFS: No cell specified [ 199.059722][ T6635] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 200.172337][ T6644] loop2: detected capacity change from 0 to 256 [ 200.220503][ T6646] loop3: detected capacity change from 0 to 128 [ 200.445652][ T6651] loop3: detected capacity change from 0 to 256 [ 201.211487][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 201.621115][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 204.978850][ T6658] loop3: detected capacity change from 0 to 32768 [ 205.515918][ T6670] loop0: detected capacity change from 0 to 2048 [ 205.553222][ T6672] loop1: detected capacity change from 0 to 128 [ 205.609708][ T6670] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 205.708611][ T27] audit: type=1800 audit(1788332165.097:7): pid=6670 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.238" name="file1" dev="loop0" ino=1346 res=0 errno=0 [ 205.779982][ T27] audit: type=1800 audit(1788332165.097:8): pid=6670 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.238" name="file1" dev="loop0" ino=1346 res=0 errno=0 [ 205.824372][ T6677] loop1: detected capacity change from 0 to 256 [ 206.651141][ T6686] kAFS: No cell specified [ 210.281146][ T6703] loop1: detected capacity change from 0 to 128 [ 210.416025][ T6694] loop2: detected capacity change from 0 to 32768 [ 210.469545][ T6705] loop1: detected capacity change from 0 to 256 [ 213.411402][ T5772] usb 4-1: new low-speed USB device number 2 using dummy_hcd [ 213.761209][ T6711] kAFS: No cell specified [ 216.247063][ T6728] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 216.507200][ T6734] kAFS: No cell specified [ 218.433873][ T6740] kAFS: No cell specified [ 219.541084][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 220.668455][ T6742] loop3: detected capacity change from 0 to 32768 [ 221.545724][ T6750] loop1: detected capacity change from 0 to 32768 [ 222.810523][ T6769] loop1: detected capacity change from 0 to 128 [ 223.340396][ T6777] loop1: detected capacity change from 0 to 2048 [ 223.383186][ T6777] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 223.473638][ T27] audit: type=1800 audit(1788332182.867:9): pid=6777 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.274" name="file1" dev="loop1" ino=1346 res=0 errno=0 [ 223.574893][ T27] audit: type=1800 audit(1788332182.897:10): pid=6777 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.274" name="file1" dev="loop1" ino=1346 res=0 errno=0 [ 224.134384][ T6770] loop3: detected capacity change from 0 to 40427 [ 224.180021][ T6770] F2FS-fs (loop3): Found nat_bits in checkpoint [ 224.337347][ T6770] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 224.568548][ T6788] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 224.717337][ T6788] syz.3.266: attempt to access beyond end of device [ 224.717337][ T6788] loop3: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 225.005683][ T5779] syz-executor: attempt to access beyond end of device [ 225.005683][ T5779] loop3: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 225.180937][ T5779] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 225.193126][ T5779] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 225.758846][ T6796] loop0: detected capacity change from 0 to 2048 [ 225.784460][ T6796] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 225.911205][ T27] audit: type=1800 audit(1788332185.297:11): pid=6796 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.280" name="file1" dev="loop0" ino=1346 res=0 errno=0 [ 225.953063][ T6780] loop2: detected capacity change from 0 to 32768 [ 225.969897][ T27] audit: type=1800 audit(1788332185.327:12): pid=6796 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.280" name="file1" dev="loop0" ino=1346 res=0 errno=0 [ 226.617697][ T6802] loop1: detected capacity change from 0 to 128 [ 227.054634][ T6809] loop1: detected capacity change from 0 to 2048 [ 227.103735][ T6809] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 227.161919][ T27] audit: type=1800 audit(1788332186.557:13): pid=6809 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.285" name="file1" dev="loop1" ino=1346 res=0 errno=0 [ 227.254208][ T27] audit: type=1800 audit(1788332186.557:14): pid=6809 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.285" name="file1" dev="loop1" ino=1346 res=0 errno=0 [ 228.018586][ T6818] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 228.169191][ T6824] kAFS: No cell specified [ 230.247762][ T6831] loop0: detected capacity change from 0 to 128 [ 232.000051][ T6838] kAFS: No cell specified [ 233.972445][ T6853] kAFS: bad VL server IP address [ 234.028428][ T6853] kAFS: No cell specified [ 236.175282][ T6847] loop0: detected capacity change from 0 to 40427 [ 236.298918][ T6847] F2FS-fs (loop0): Found nat_bits in checkpoint [ 236.903966][ T6866] loop2: detected capacity change from 0 to 128 [ 237.102595][ T6873] loop2: detected capacity change from 0 to 256 [ 237.613541][ T6889] loop0: detected capacity change from 0 to 256 [ 238.929367][ T6905] loop0: detected capacity change from 0 to 128 [ 239.078858][ T6911] loop2: detected capacity change from 0 to 256 [ 239.991284][ T5833] usb 3-1: new low-speed USB device number 2 using dummy_hcd [ 240.325285][ T5833] usb 3-1: device descriptor read/64, error -71 [ 240.411498][ T6940] loop3: detected capacity change from 0 to 256 [ 240.570315][ T6941] kAFS: No cell specified [ 240.621467][ T5833] usb 3-1: new low-speed USB device number 3 using dummy_hcd [ 242.261275][ T5833] usb 3-1: device descriptor read/64, error -71 [ 242.591292][ T5833] usb usb3-port1: attempt power cycle [ 242.728624][ T6959] loop3: detected capacity change from 0 to 128 [ 244.799889][ T6987] kAFS: No cell specified [ 245.932421][ T6978] loop3: detected capacity change from 0 to 32768 [ 249.924271][ T7024] loop0: detected capacity change from 0 to 256 [ 251.668933][ T7032] loop0: detected capacity change from 0 to 32768 [ 252.912281][ T7055] kAFS: bad VL server IP address [ 252.978769][ T7057] kAFS: No cell specified [ 255.781388][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.164012][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 259.197633][ T7079] EXT4-fs warning (device sda1): verify_group_input:151: Cannot add at group 0 (only 8 groups) [ 259.441897][ T7089] loop1: detected capacity change from 0 to 256 [ 262.498800][ T7113] kAFS: bad VL server IP address [ 262.643180][ T7113] kAFS: No cell specified [ 262.922380][ T7122] loop0: detected capacity change from 0 to 256 [ 263.965091][ T7135] loop1: detected capacity change from 0 to 256 [ 264.540800][ T7116] loop3: detected capacity change from 0 to 40427 [ 264.642899][ T7116] F2FS-fs (loop3): Found nat_bits in checkpoint [ 265.492155][ T7116] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 266.689286][ T7158] kAFS: bad VL server IP address [ 267.095544][ T7162] kAFS: No cell specified [ 271.154499][ T7196] loop2: detected capacity change from 0 to 256 [ 275.198987][ T7208] loop2: detected capacity change from 0 to 40427 [ 275.288387][ T7208] F2FS-fs (loop2): Found nat_bits in checkpoint [ 275.431128][ T7208] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 275.476218][ T7218] loop1: detected capacity change from 0 to 40427 [ 275.576191][ T7218] F2FS-fs (loop1): Found nat_bits in checkpoint [ 275.622867][ T7241] kAFS: bad VL server IP address [ 275.689986][ T7248] kAFS: No cell specified [ 277.345356][ T7250] loop0: detected capacity change from 0 to 256 [ 278.338048][ T7258] loop1: detected capacity change from 0 to 512 [ 278.349928][ T7258] EXT4-fs (loop1): Test dummy encryption mode enabled [ 278.356862][ T7258] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 278.370034][ T7258] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 278.396002][ T7258] EXT4-fs warning (device loop1): ext4_expand_extra_isize_ea:2858: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 278.425491][ T7258] EXT4-fs (loop1): 1 truncate cleaned up [ 278.433808][ T7258] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 278.609733][ T7265] kAFS: No cell specified [ 280.697160][ T5781] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 281.433129][ T7285] EXT4-fs warning (device sda1): verify_group_input:151: Cannot add at group 0 (only 8 groups) [ 281.454706][ T7287] loop3: detected capacity change from 0 to 256 [ 283.621271][ T7299] netlink: 52 bytes leftover after parsing attributes in process `syz.2.415'. [ 283.682203][ T7301] loop0: detected capacity change from 0 to 2048 [ 283.715486][ T7301] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 284.034777][ T27] audit: type=1800 audit(1788332243.427:15): pid=7301 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.416" name="file1" dev="loop0" ino=1346 res=0 errno=0 [ 284.399483][ T27] audit: type=1800 audit(1788332243.427:16): pid=7301 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.416" name="file1" dev="loop0" ino=1346 res=0 errno=0 [ 284.689414][ T7295] loop3: detected capacity change from 0 to 32768 [ 289.434368][ T7328] loop0: detected capacity change from 0 to 256 [ 293.887811][ T7353] kAFS: bad VL server IP address [ 293.933607][ T7353] kAFS: No cell specified [ 296.546888][ T7365] netlink: 32 bytes leftover after parsing attributes in process `syz.1.433'. [ 297.011477][ T7367] loop2: detected capacity change from 0 to 32768 [ 297.950527][ T7383] netlink: 36 bytes leftover after parsing attributes in process `syz.1.439'. [ 300.381818][ T7401] loop1: detected capacity change from 0 to 256 [ 302.454655][ T7418] loop1: detected capacity change from 0 to 2048 [ 302.531329][ T7418] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 302.564324][ T7426] loop3: detected capacity change from 0 to 256 [ 302.618042][ T27] audit: type=1800 audit(1788332262.007:17): pid=7418 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.449" name="file1" dev="loop1" ino=1346 res=0 errno=0 [ 303.126913][ T7418] syz.1.449: attempt to access beyond end of device [ 303.126913][ T7418] loop1: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 303.140508][ T7418] Buffer I/O error on dev loop1, logical block 2048, lost async page write [ 303.149143][ T7418] syz.1.449: attempt to access beyond end of device [ 303.149143][ T7418] loop1: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 303.162680][ T7418] Buffer I/O error on dev loop1, logical block 2048, lost async page write [ 303.171289][ T7418] syz.1.449: attempt to access beyond end of device [ 303.171289][ T7418] loop1: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 303.184757][ T7418] Buffer I/O error on dev loop1, logical block 2048, lost async page write [ 303.193398][ T7418] syz.1.449: attempt to access beyond end of device [ 303.193398][ T7418] loop1: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 303.207543][ T7418] Buffer I/O error on dev loop1, logical block 2048, lost async page write [ 303.216178][ T7418] syz.1.449: attempt to access beyond end of device [ 303.216178][ T7418] loop1: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 303.229657][ T7418] Buffer I/O error on dev loop1, logical block 2048, lost async page write [ 303.238270][ T7418] syz.1.449: attempt to access beyond end of device [ 303.238270][ T7418] loop1: rw=2049, sector=2049, nr_sectors = 1 limit=2048 [ 303.251725][ T7418] Buffer I/O error on dev loop1, logical block 2049, lost async page write [ 304.635881][ T7446] loop1: detected capacity change from 0 to 256 [ 306.131167][ T5812] usb 1-1: new low-speed USB device number 2 using dummy_hcd [ 306.553183][ T7460] kAFS: bad VL server IP address [ 306.620233][ T7462] kAFS: No cell specified [ 307.211192][ T5812] usb 1-1: device descriptor read/64, error -71 [ 308.514996][ T7453] loop2: detected capacity change from 0 to 32768 [ 308.569625][ T7453] read_mapping_page failed! [ 308.581245][ T7453] jfs_mount: Failed to read AGGREGATE_I [ 308.603976][ T7453] Mount JFS Failure: -5 [ 308.612125][ T7453] jfs_mount failed w/return code = -5 [ 311.081370][ T7490] loop3: detected capacity change from 0 to 256 [ 311.478799][ T7496] loop2: detected capacity change from 0 to 256 [ 314.598991][ T7532] loop2: detected capacity change from 0 to 256 [ 315.745502][ T7537] loop1: detected capacity change from 0 to 256 [ 317.190914][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.197416][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.966938][ T7546] loop2: detected capacity change from 0 to 512 [ 319.012720][ T7546] EXT4-fs (loop2): Test dummy encryption mode enabled [ 319.019543][ T7546] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 319.117377][ T7546] EXT4-fs (loop2): 1 truncate cleaned up [ 319.158065][ T7546] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 321.523279][ T5770] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 325.194047][ T7590] loop1: detected capacity change from 0 to 256 [ 326.383374][ T7596] FAULT_INJECTION: forcing a failure. [ 326.383374][ T7596] name failslab, interval 1, probability 0, space 0, times 1 [ 326.415761][ T7596] CPU: 1 PID: 7596 Comm: syz.3.497 Not tainted syzkaller #0 [ 326.423105][ T7596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 326.433195][ T7596] Call Trace: [ 326.436496][ T7596] [ 326.439452][ T7596] dump_stack_lvl+0x18c/0x250 [ 326.444146][ T7596] ? show_regs_print_info+0x20/0x20 [ 326.449349][ T7596] ? load_image+0x420/0x420 [ 326.453860][ T7596] ? __might_sleep+0xe0/0xe0 [ 326.458454][ T7596] ? __lock_acquire+0x7d80/0x7d80 [ 326.463482][ T7596] should_fail_ex+0x394/0x4c0 [ 326.468513][ T7596] should_failslab+0x9/0x20 [ 326.473022][ T7596] slab_pre_alloc_hook+0x59/0x300 [ 326.478051][ T7596] ? __rwlock_init+0x150/0x150 [ 326.482817][ T7596] kmem_cache_alloc_lru+0x4d/0x2b0 [ 326.487930][ T7596] ? iget_locked+0x205/0x8c0 [ 326.492519][ T7596] iget_locked+0x205/0x8c0 [ 326.496936][ T7596] kernfs_get_inode+0x4f/0x6e0 [ 326.501708][ T7596] kernfs_iop_lookup+0x263/0x380 [ 326.506647][ T7596] ? kernfs_dop_revalidate+0x570/0x570 [ 326.512109][ T7596] path_openat+0x1110/0x3270 [ 326.516718][ T7596] ? do_filp_open+0x430/0x430 [ 326.521404][ T7596] do_filp_open+0x1f2/0x430 [ 326.525913][ T7596] ? vfs_tmpfile+0x620/0x620 [ 326.530515][ T7596] ? _raw_spin_unlock+0x28/0x40 [ 326.535362][ T7596] ? alloc_fd+0x590/0x640 [ 326.539717][ T7596] do_sys_openat2+0x134/0x1d0 [ 326.544413][ T7596] ? init_peercred+0x263/0x2c0 [ 326.549185][ T7596] ? do_sys_open+0xe0/0xe0 [ 326.553606][ T7596] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 326.559599][ T7596] ? lock_chain_count+0x20/0x20 [ 326.564451][ T7596] ? lock_chain_count+0x20/0x20 [ 326.569302][ T7596] __x64_sys_openat+0x139/0x160 [ 326.574161][ T7596] do_syscall_64+0x55/0xb0 [ 326.578580][ T7596] ? clear_bhb_loop+0x40/0x90 [ 326.583252][ T7596] ? clear_bhb_loop+0x40/0x90 [ 326.587928][ T7596] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 326.593836][ T7596] RIP: 0033:0x7f8ad1d5e98e [ 326.598251][ T7596] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 326.617891][ T7596] RSP: 002b:00007f8ad2c5e9b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 326.626300][ T7596] RAX: ffffffffffffffda RBX: 00007f8ad2c5f6c0 RCX: 00007f8ad1d5e98e [ 326.634269][ T7596] RDX: 0000000000080001 RSI: 00007f8ad1e09070 RDI: ffffffffffffff9c [ 326.642235][ T7596] RBP: 00007f8ad1e09070 R08: 0000000000000000 R09: 0000000000000000 [ 326.650198][ T7596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 326.658170][ T7596] R13: 00007f8ad2c5ea90 R14: 00007f8ad2025fa0 R15: 00007ffc592bbb98 [ 326.666153][ T7596] [ 330.359634][ T7606] loop1: detected capacity change from 0 to 32768 [ 331.237035][ T7644] netlink: 'syz.0.511': attribute type 2 has an invalid length. [ 331.413967][ T7649] kAFS: No cell specified [ 333.491315][ T7656] loop3: detected capacity change from 0 to 512 [ 333.503540][ T7656] EXT4-fs (loop3): Test dummy encryption mode enabled [ 333.510927][ T7656] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 333.611111][ T7656] EXT4-fs (loop3): 1 truncate cleaned up [ 333.618651][ T7656] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 333.639515][ T7661] loop1: detected capacity change from 0 to 256 [ 333.693070][ T7664] FAULT_INJECTION: forcing a failure. [ 333.693070][ T7664] name failslab, interval 1, probability 0, space 0, times 0 [ 333.796558][ T7664] CPU: 0 PID: 7664 Comm: syz.0.515 Not tainted syzkaller #0 [ 333.803906][ T7664] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 333.813978][ T7664] Call Trace: [ 333.817267][ T7664] [ 333.820227][ T7664] dump_stack_lvl+0x18c/0x250 [ 333.824938][ T7664] ? show_regs_print_info+0x20/0x20 [ 333.830157][ T7664] ? load_image+0x420/0x420 [ 333.834696][ T7664] ? __might_sleep+0xe0/0xe0 [ 333.839312][ T7664] ? __lock_acquire+0x7d80/0x7d80 [ 333.844366][ T7664] should_fail_ex+0x394/0x4c0 [ 333.849077][ T7664] should_failslab+0x9/0x20 [ 333.853606][ T7664] slab_pre_alloc_hook+0x59/0x300 [ 333.858658][ T7664] ? __rwlock_init+0x150/0x150 [ 333.863447][ T7664] kmem_cache_alloc_lru+0x4d/0x2b0 [ 333.868580][ T7664] ? iget_locked+0x205/0x8c0 [ 333.873195][ T7664] iget_locked+0x205/0x8c0 [ 333.877647][ T7664] kernfs_get_inode+0x4f/0x6e0 [ 333.882442][ T7664] kernfs_iop_lookup+0x263/0x380 [ 333.887402][ T7664] ? kernfs_dop_revalidate+0x570/0x570 [ 333.892886][ T7664] path_openat+0x1110/0x3270 [ 333.897525][ T7664] ? do_filp_open+0x430/0x430 [ 333.902241][ T7664] do_filp_open+0x1f2/0x430 [ 333.906771][ T7664] ? vfs_tmpfile+0x620/0x620 [ 333.911405][ T7664] ? _raw_spin_unlock+0x28/0x40 [ 333.916273][ T7664] ? alloc_fd+0x590/0x640 [ 333.920636][ T7664] do_sys_openat2+0x134/0x1d0 [ 333.925335][ T7664] ? init_peercred+0x263/0x2c0 [ 333.930123][ T7664] ? do_sys_open+0xe0/0xe0 [ 333.934564][ T7664] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 333.940571][ T7664] ? lock_chain_count+0x20/0x20 [ 333.945443][ T7664] ? lock_chain_count+0x20/0x20 [ 333.950317][ T7664] __x64_sys_openat+0x139/0x160 [ 333.955194][ T7664] do_syscall_64+0x55/0xb0 [ 333.959627][ T7664] ? clear_bhb_loop+0x40/0x90 [ 333.964320][ T7664] ? clear_bhb_loop+0x40/0x90 [ 333.969019][ T7664] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 333.974930][ T7664] RIP: 0033:0x7f311ab5e98e [ 333.979363][ T7664] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 333.998991][ T7664] RSP: 002b:00007f311b99c9b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 334.007430][ T7664] RAX: ffffffffffffffda RBX: 00007f311b99d6c0 RCX: 00007f311ab5e98e [ 334.015421][ T7664] RDX: 0000000000080001 RSI: 00007f311ac09070 RDI: ffffffffffffff9c [ 334.023407][ T7664] RBP: 00007f311ac09070 R08: 0000000000000000 R09: 0000000000000000 [ 334.031393][ T7664] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 334.039384][ T7664] R13: 00007f311b99ca90 R14: 00007f311ae25fa0 R15: 00007ffea632e648 [ 334.047478][ T7664] [ 334.608010][ T5779] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 337.573313][ T7694] loop2: detected capacity change from 0 to 2048 [ 337.721224][ T7694] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 337.728200][ T7702] loop1: detected capacity change from 0 to 512 [ 337.823112][ T7702] EXT4-fs (loop1): Test dummy encryption mode enabled [ 337.830211][ T7702] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 337.871035][ T27] audit: type=1800 audit(1788332297.257:18): pid=7694 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.523" name="file1" dev="loop2" ino=1346 res=0 errno=0 [ 337.975345][ T27] audit: type=1800 audit(1788332297.287:19): pid=7694 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.523" name="file1" dev="loop2" ino=1346 res=0 errno=0 [ 338.016424][ T7702] EXT4-fs (loop1): 1 truncate cleaned up [ 338.046023][ T7702] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 338.772334][ T7717] loop2: detected capacity change from 0 to 256 [ 338.888428][ T5781] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 339.756034][ T7727] netlink: 36 bytes leftover after parsing attributes in process `syz.1.527'. [ 345.358471][ T7761] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 347.287359][ T7755] loop2: detected capacity change from 0 to 40427 [ 347.374341][ T7755] F2FS-fs (loop2): Found nat_bits in checkpoint [ 347.658514][ T7755] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 350.576695][ T7774] loop3: detected capacity change from 0 to 40427 [ 351.185496][ T7774] F2FS-fs (loop3): Found nat_bits in checkpoint [ 356.551790][ T5811] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 356.591913][ T7806] loop1: detected capacity change from 0 to 32768 [ 356.880354][ T5811] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 357.476728][ T5811] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 357.495564][ T5811] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 357.508008][ T5811] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 357.523334][ T5811] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 357.543018][ T5811] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 357.551138][ T5811] usb 4-1: Product: syz [ 357.555353][ T5811] usb 4-1: Manufacturer: syz [ 357.577987][ T5811] cdc_wdm 4-1:1.0: skipping garbage [ 357.583730][ T5811] cdc_wdm 4-1:1.0: skipping garbage [ 357.589309][ T5811] cdc_wdm: probe of 4-1:1.0 failed with error -22 [ 358.770617][ T7823] FAULT_INJECTION: forcing a failure. [ 358.770617][ T7823] name failslab, interval 1, probability 0, space 0, times 0 [ 358.786310][ T7823] CPU: 1 PID: 7823 Comm: syz.0.555 Not tainted syzkaller #0 [ 358.793645][ T7823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 358.803708][ T7823] Call Trace: [ 358.807030][ T7823] [ 358.810069][ T7823] dump_stack_lvl+0x18c/0x250 [ 358.814830][ T7823] ? show_regs_print_info+0x20/0x20 [ 358.820058][ T7823] ? load_image+0x420/0x420 [ 358.824562][ T7823] ? __might_sleep+0xe0/0xe0 [ 358.829139][ T7823] ? __lock_acquire+0x7d80/0x7d80 [ 358.834166][ T7823] should_fail_ex+0x394/0x4c0 [ 358.838882][ T7823] should_failslab+0x9/0x20 [ 358.843400][ T7823] slab_pre_alloc_hook+0x59/0x300 [ 358.848448][ T7823] ? memcg_list_lru_alloc+0x231/0xb00 [ 358.853834][ T7823] ? memcg_list_lru_alloc+0x231/0xb00 [ 358.859215][ T7823] __kmem_cache_alloc_node+0x53/0x250 [ 358.864596][ T7823] ? memcg_list_lru_alloc+0x231/0xb00 [ 358.869968][ T7823] __kmalloc+0xa7/0x240 [ 358.874151][ T7823] memcg_list_lru_alloc+0x231/0xb00 [ 358.879357][ T7823] ? memcg_reparent_list_lrus+0x860/0x860 [ 358.885105][ T7823] ? get_obj_cgroup_from_current+0xd4/0x280 [ 358.891003][ T7823] ? get_obj_cgroup_from_current+0xd4/0x280 [ 358.896900][ T7823] slab_pre_alloc_hook+0x2ad/0x300 [ 358.902020][ T7823] ? slab_pre_alloc_hook+0xb1/0x300 [ 358.907231][ T7823] kmem_cache_alloc_lru+0x4d/0x2b0 [ 358.912366][ T7823] ? iget_locked+0x205/0x8c0 [ 358.916990][ T7823] iget_locked+0x205/0x8c0 [ 358.921409][ T7823] kernfs_get_inode+0x4f/0x6e0 [ 358.926194][ T7823] kernfs_iop_lookup+0x263/0x380 [ 358.931131][ T7823] ? kernfs_dop_revalidate+0x570/0x570 [ 358.936594][ T7823] path_openat+0x1110/0x3270 [ 358.941219][ T7823] ? do_filp_open+0x430/0x430 [ 358.945913][ T7823] do_filp_open+0x1f2/0x430 [ 358.950414][ T7823] ? vfs_tmpfile+0x620/0x620 [ 358.955016][ T7823] ? _raw_spin_unlock+0x28/0x40 [ 358.960027][ T7823] ? alloc_fd+0x590/0x640 [ 358.964359][ T7823] do_sys_openat2+0x134/0x1d0 [ 358.969035][ T7823] ? init_peercred+0x263/0x2c0 [ 358.973861][ T7823] ? do_sys_open+0xe0/0xe0 [ 358.978278][ T7823] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 358.984259][ T7823] ? lock_chain_count+0x20/0x20 [ 358.989113][ T7823] ? lock_chain_count+0x20/0x20 [ 358.993963][ T7823] __x64_sys_openat+0x139/0x160 [ 358.998821][ T7823] do_syscall_64+0x55/0xb0 [ 359.003235][ T7823] ? clear_bhb_loop+0x40/0x90 [ 359.008007][ T7823] ? clear_bhb_loop+0x40/0x90 [ 359.012687][ T7823] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 359.018583][ T7823] RIP: 0033:0x7f311ab5e98e [ 359.023045][ T7823] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 359.042687][ T7823] RSP: 002b:00007f311b99c9b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 359.051142][ T7823] RAX: ffffffffffffffda RBX: 00007f311b99d6c0 RCX: 00007f311ab5e98e [ 359.059108][ T7823] RDX: 0000000000080001 RSI: 00007f311ac09070 RDI: ffffffffffffff9c [ 359.067073][ T7823] RBP: 00007f311ac09070 R08: 0000000000000000 R09: 0000000000000000 [ 359.075036][ T7823] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 359.083004][ T7823] R13: 00007f311b99ca90 R14: 00007f311ae25fa0 R15: 00007ffea632e648 [ 359.090996][ T7823] [ 359.107262][ T5812] usb 4-1: USB disconnect, device number 3 [ 359.195573][ T7827] loop2: detected capacity change from 0 to 512 [ 359.204217][ T7827] EXT4-fs (loop2): Test dummy encryption mode enabled [ 359.219419][ T7827] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 359.238932][ T7827] EXT4-fs (loop2): 1 truncate cleaned up [ 359.256592][ T7827] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 360.334527][ T7840] FAULT_INJECTION: forcing a failure. [ 360.334527][ T7840] name failslab, interval 1, probability 0, space 0, times 0 [ 360.349955][ T7840] CPU: 0 PID: 7840 Comm: syz.1.556 Not tainted syzkaller #0 [ 360.357282][ T7840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 360.367358][ T7840] Call Trace: [ 360.370650][ T7840] [ 360.373605][ T7840] dump_stack_lvl+0x18c/0x250 [ 360.378316][ T7840] ? show_regs_print_info+0x20/0x20 [ 360.383537][ T7840] ? load_image+0x420/0x420 [ 360.388066][ T7840] ? __might_sleep+0xe0/0xe0 [ 360.392689][ T7840] ? __lock_acquire+0x7d80/0x7d80 [ 360.397768][ T7840] should_fail_ex+0x394/0x4c0 [ 360.402482][ T7840] should_failslab+0x9/0x20 [ 360.407017][ T7840] slab_pre_alloc_hook+0x59/0x300 [ 360.412078][ T7840] ? memcg_list_lru_alloc+0x335/0xb00 [ 360.417476][ T7840] ? memcg_list_lru_alloc+0x335/0xb00 [ 360.422871][ T7840] __kmem_cache_alloc_node+0x53/0x250 [ 360.428281][ T7840] ? memcg_list_lru_alloc+0x335/0xb00 [ 360.433684][ T7840] __kmalloc+0xa7/0x240 [ 360.437875][ T7840] memcg_list_lru_alloc+0x335/0xb00 [ 360.443108][ T7840] ? memcg_reparent_list_lrus+0x860/0x860 [ 360.448864][ T7840] ? get_obj_cgroup_from_current+0xd4/0x280 [ 360.454777][ T7840] ? get_obj_cgroup_from_current+0xd4/0x280 [ 360.460678][ T7840] slab_pre_alloc_hook+0x2ad/0x300 [ 360.465795][ T7840] ? slab_pre_alloc_hook+0xb1/0x300 [ 360.471007][ T7840] kmem_cache_alloc_lru+0x4d/0x2b0 [ 360.476119][ T7840] ? __d_alloc+0x31/0x710 [ 360.480446][ T7840] __d_alloc+0x31/0x710 [ 360.484597][ T7840] d_alloc_parallel+0xe0/0x1590 [ 360.489445][ T7840] ? __d_lookup+0x8f/0x7c0 [ 360.493862][ T7840] ? __lock_acquire+0x7d80/0x7d80 [ 360.498891][ T7840] ? __d_lookup+0x8f/0x7c0 [ 360.503304][ T7840] ? d_hash_and_lookup+0x1b0/0x1b0 [ 360.508441][ T7840] path_openat+0x955/0x3270 [ 360.512968][ T7840] ? do_filp_open+0x430/0x430 [ 360.517662][ T7840] do_filp_open+0x1f2/0x430 [ 360.522166][ T7840] ? vfs_tmpfile+0x620/0x620 [ 360.526772][ T7840] ? _raw_spin_unlock+0x28/0x40 [ 360.531615][ T7840] ? alloc_fd+0x590/0x640 [ 360.535949][ T7840] do_sys_openat2+0x134/0x1d0 [ 360.540623][ T7840] ? init_peercred+0x263/0x2c0 [ 360.545390][ T7840] ? do_sys_open+0xe0/0xe0 [ 360.549811][ T7840] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 360.555796][ T7840] ? lock_chain_count+0x20/0x20 [ 360.560647][ T7840] ? lock_chain_count+0x20/0x20 [ 360.565496][ T7840] __x64_sys_openat+0x139/0x160 [ 360.570350][ T7840] do_syscall_64+0x55/0xb0 [ 360.574763][ T7840] ? clear_bhb_loop+0x40/0x90 [ 360.579434][ T7840] ? clear_bhb_loop+0x40/0x90 [ 360.584107][ T7840] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 360.589995][ T7840] RIP: 0033:0x7f483515e98e [ 360.594414][ T7840] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 360.614017][ T7840] RSP: 002b:00007f48360f19b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 360.622428][ T7840] RAX: ffffffffffffffda RBX: 00007f48360f26c0 RCX: 00007f483515e98e [ 360.630397][ T7840] RDX: 0000000000080001 RSI: 00007f4835209070 RDI: ffffffffffffff9c [ 360.638361][ T7840] RBP: 00007f4835209070 R08: 0000000000000000 R09: 0000000000000000 [ 360.646326][ T7840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 360.654294][ T7840] R13: 00007f48360f1a90 R14: 00007f4835425fa0 R15: 00007ffc724c2698 [ 360.662279][ T7840] [ 360.695607][ T5770] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 361.880284][ T7853] netlink: 164 bytes leftover after parsing attributes in process `syz.1.562'. [ 362.211139][ T5831] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 362.901214][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 363.093292][ T5831] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 363.104834][ T5831] usb 2-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 363.121142][ T5831] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 363.130742][ T5831] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 363.225881][ T5831] cdc_acm: probe of 2-1:1.0 failed with error -22 [ 364.177036][ T5831] usb 2-1: USB disconnect, device number 2 [ 367.463146][ T7884] loop1: detected capacity change from 0 to 256 [ 368.360646][ T7898] netlink: 36 bytes leftover after parsing attributes in process `syz.2.575'. [ 370.961220][ T7903] loop2: detected capacity change from 0 to 512 [ 371.069626][ T7903] EXT4-fs (loop2): Test dummy encryption mode enabled [ 371.085889][ T7903] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 371.147371][ T7903] EXT4-fs (loop2): 1 truncate cleaned up [ 371.160470][ T7903] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 372.801466][ T7912] loop3: detected capacity change from 0 to 32768 [ 372.802187][ T5770] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 372.909841][ T7928] loop2: detected capacity change from 0 to 256 [ 375.835271][ T7939] loop1: detected capacity change from 0 to 128 [ 378.638011][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.644588][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.788052][ T7965] loop0: detected capacity change from 0 to 256 [ 381.113023][ T7967] netlink: 36 bytes leftover after parsing attributes in process `syz.3.593'. [ 381.627111][ T7975] loop3: detected capacity change from 0 to 256 [ 382.499859][ T7977] loop1: detected capacity change from 0 to 2048 [ 383.161933][ T7977] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 383.399670][ T7987] binder_alloc: 7986: binder_alloc_buf, no vma [ 383.431738][ T27] audit: type=1800 audit(1788332342.827:20): pid=7977 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.596" name="file1" dev="loop1" ino=1346 res=0 errno=0 [ 385.923782][ T8004] loop0: detected capacity change from 0 to 512 [ 385.933777][ T8004] EXT4-fs (loop0): Test dummy encryption mode enabled [ 385.941747][ T8004] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 386.055620][ T8009] loop1: detected capacity change from 0 to 128 [ 387.971668][ T8011] loop3: detected capacity change from 0 to 256 [ 388.498775][ T8004] EXT4-fs (loop0): 1 truncate cleaned up [ 388.543186][ T8004] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 391.874238][ T5775] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 393.015841][ T8045] loop2: detected capacity change from 0 to 128 [ 397.725551][ T8054] loop2: detected capacity change from 0 to 512 [ 397.738004][ T8056] loop0: detected capacity change from 0 to 512 [ 397.750620][ T8054] EXT4-fs (loop2): Test dummy encryption mode enabled [ 397.770668][ T8056] EXT4-fs (loop0): Test dummy encryption mode enabled [ 397.777611][ T8054] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 397.791063][ T8056] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 397.823992][ T8056] EXT4-fs (loop0): 1 truncate cleaned up [ 397.830954][ T8056] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 397.909521][ T8054] EXT4-fs (loop2): 1 truncate cleaned up [ 398.038188][ T8054] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 398.867426][ T8062] fscrypt (loop0): Missing crypto API support for AES-256-XTS (API name: "xts(aes)") [ 398.963872][ T8068] fscrypt (loop2): Missing crypto API support for AES-256-XTS (API name: "xts(aes)") [ 398.996526][ T5770] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 399.096701][ T5775] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 401.606380][ T8098] netlink: 44 bytes leftover after parsing attributes in process `syz.1.625'. [ 401.616613][ T8098] netlink: 8 bytes leftover after parsing attributes in process `syz.1.625'. [ 401.629351][ T8098] netlink: 36 bytes leftover after parsing attributes in process `syz.1.625'. [ 402.425408][ T8100] binder_alloc: 8099: binder_alloc_buf, no vma [ 403.449678][ T8108] nvme_fcloop: unknown parameter or missing value 'wwp' [ 405.083907][ T8126] netlink: 44 bytes leftover after parsing attributes in process `syz.3.636'. [ 405.094010][ T8126] netlink: 8 bytes leftover after parsing attributes in process `syz.3.636'. [ 405.105726][ T8126] netlink: 36 bytes leftover after parsing attributes in process `syz.3.636'. [ 406.384012][ T8117] loop1: detected capacity change from 0 to 32768 [ 408.631699][ T8139] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 408.797910][ T8144] nvme_fcloop: unknown parameter or missing value 'wwp' [ 408.876925][ T8146] loop3: detected capacity change from 0 to 256 [ 410.945301][ T8166] netlink: 44 bytes leftover after parsing attributes in process `syz.0.646'. [ 410.954360][ T8166] netlink: 8 bytes leftover after parsing attributes in process `syz.0.646'. [ 411.570023][ T8170] loop0: detected capacity change from 0 to 512 [ 411.637963][ T8170] EXT4-fs (loop0): Test dummy encryption mode enabled [ 411.655918][ T8170] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 411.697544][ T8170] EXT4-fs (loop0): 1 truncate cleaned up [ 411.711197][ T8170] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 413.008840][ T8183] nvme_fcloop: unknown parameter or missing value 'wwp' [ 413.434421][ T8194] loop1: detected capacity change from 0 to 512 [ 413.447857][ T8194] EXT4-fs (loop1): Test dummy encryption mode enabled [ 413.457167][ T8194] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 413.491995][ T8184] fscrypt (loop0): Error allocating 'xts(aes)' transform: -4 [ 413.501462][ T8194] EXT4-fs (loop1): 1 truncate cleaned up [ 413.522616][ T8194] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 413.732770][ T5775] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 414.395304][ T8194] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 415.318081][ T5781] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 415.405361][ T8210] netlink: 44 bytes leftover after parsing attributes in process `syz.2.658'. [ 415.414424][ T8210] netlink: 8 bytes leftover after parsing attributes in process `syz.2.658'. [ 418.370306][ T8238] fuse: Bad value for 'fd' [ 422.955223][ T8267] binder: BINDER_SET_CONTEXT_MGR already set [ 422.962236][ T8267] binder: 8266:8267 ioctl 4018620d 200000004a80 returned -16 [ 425.525612][ T8277] loop0: detected capacity change from 0 to 256 [ 425.641589][ T8281] loop1: detected capacity change from 0 to 512 [ 426.121989][ T8281] EXT4-fs (loop1): Test dummy encryption mode enabled [ 426.538734][ T8281] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 426.785526][ T8281] EXT4-fs (loop1): 1 truncate cleaned up [ 427.020666][ T8281] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 429.143420][ T5781] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 432.278502][ T8331] loop2: detected capacity change from 0 to 256 [ 436.530069][ T8356] loop3: detected capacity change from 0 to 512 [ 436.601102][ T8356] EXT4-fs (loop3): Test dummy encryption mode enabled [ 436.607921][ T8356] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 436.648604][ T8360] loop0: detected capacity change from 0 to 256 [ 437.456078][ T8356] EXT4-fs (loop3): 1 truncate cleaned up [ 437.479493][ T8356] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 438.385160][ T5779] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 439.499359][ T8384] binder: BINDER_SET_CONTEXT_MGR already set [ 439.554473][ T8384] binder: 8383:8384 ioctl 4018620d 200000004a80 returned -16 [ 440.452335][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.459501][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 448.874629][ T8455] loop1: detected capacity change from 0 to 512 [ 448.888857][ T8455] EXT4-fs (loop1): Test dummy encryption mode enabled [ 448.898118][ T8455] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 449.094588][ T8455] EXT4-fs (loop1): 1 truncate cleaned up [ 449.141548][ T8455] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 450.748424][ T5781] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 455.285132][ T8471] loop1: detected capacity change from 0 to 40427 [ 455.354266][ T8471] F2FS-fs (loop1): Found nat_bits in checkpoint [ 455.456551][ T8471] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 455.601999][ T8503] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 455.733089][ T8503] syz.1.723: attempt to access beyond end of device [ 455.733089][ T8503] loop1: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 455.757498][ T8503] netlink: 324 bytes leftover after parsing attributes in process `syz.1.723'. [ 456.056647][ T5781] syz-executor: attempt to access beyond end of device [ 456.056647][ T5781] loop1: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 456.161452][ T5781] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 456.264210][ T5781] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 459.982842][ T8527] loop2: detected capacity change from 0 to 512 [ 460.013787][ T8527] EXT4-fs (loop2): Test dummy encryption mode enabled [ 460.020620][ T8527] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 460.081147][ T8527] EXT4-fs (loop2): 1 truncate cleaned up [ 460.102889][ T8527] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 463.290078][ T8538] loop0: detected capacity change from 0 to 512 [ 463.303499][ T5770] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 463.317747][ T8538] EXT4-fs (loop0): Test dummy encryption mode enabled [ 463.354211][ T8538] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 463.396058][ T8538] EXT4-fs (loop0): 1 truncate cleaned up [ 463.403367][ T8538] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 464.355663][ T5775] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 466.694287][ T8566] loop3: detected capacity change from 0 to 22 [ 466.702298][ T8566] MTD: Attempt to mount non-MTD device "/dev/loop3" [ 466.724096][ T8566] romfs: Mounting image 'rom 637cf1fa' through the block layer [ 469.508334][ T8589] tty tty1: ldisc open failed (-12), clearing slot 0 [ 470.939186][ T8611] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 474.039761][ T8617] loop3: detected capacity change from 0 to 1024 [ 474.047430][ T8617] EXT4-fs: Ignoring removed bh option [ 474.166325][ T8617] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 475.352046][ T8631] netlink: 17 bytes leftover after parsing attributes in process `syz.2.769'. [ 476.536924][ T8644] FAULT_INJECTION: forcing a failure. [ 476.536924][ T8644] name failslab, interval 1, probability 0, space 0, times 0 [ 476.581622][ T8644] CPU: 0 PID: 8644 Comm: syz.0.774 Not tainted syzkaller #0 [ 476.588971][ T8644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 476.599049][ T8644] Call Trace: [ 476.602348][ T8644] [ 476.605309][ T8644] dump_stack_lvl+0x18c/0x250 [ 476.610022][ T8644] ? show_regs_print_info+0x20/0x20 [ 476.615251][ T8644] ? load_image+0x420/0x420 [ 476.619782][ T8644] ? __might_sleep+0xe0/0xe0 [ 476.624403][ T8644] ? __lock_acquire+0x7d80/0x7d80 [ 476.629457][ T8644] should_fail_ex+0x394/0x4c0 [ 476.634170][ T8644] should_failslab+0x9/0x20 [ 476.638698][ T8644] slab_pre_alloc_hook+0x59/0x300 [ 476.643753][ T8644] ? tomoyo_encode+0x2ad/0x570 [ 476.648575][ T8644] ? tomoyo_encode+0x2ad/0x570 [ 476.653346][ T8644] __kmem_cache_alloc_node+0x53/0x250 [ 476.658722][ T8644] ? tomoyo_realpath_from_path+0x5c0/0x5c0 [ 476.664537][ T8644] ? tomoyo_encode+0x2ad/0x570 [ 476.669301][ T8644] __kmalloc+0xa7/0x240 [ 476.673469][ T8644] tomoyo_encode+0x2ad/0x570 [ 476.678067][ T8644] tomoyo_realpath_from_path+0x57c/0x5c0 [ 476.683713][ T8644] ? tomoyo_domain+0xd6/0x120 [ 476.688395][ T8644] tomoyo_path_number_perm+0x248/0x5e0 [ 476.693859][ T8644] ? tomoyo_path_number_perm+0x217/0x5e0 [ 476.699497][ T8644] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 476.704958][ T8644] ? futex_wake_mark+0x150/0x150 [ 476.709928][ T8644] ? __fget_files+0x28/0x460 [ 476.714529][ T8644] security_file_ioctl+0x70/0xa0 [ 476.719489][ T8644] __se_sys_ioctl+0x48/0x170 [ 476.724082][ T8644] do_syscall_64+0x55/0xb0 [ 476.728500][ T8644] ? clear_bhb_loop+0x40/0x90 [ 476.733177][ T8644] ? clear_bhb_loop+0x40/0x90 [ 476.737870][ T8644] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 476.743783][ T8644] RIP: 0033:0x7f311ab9e159 [ 476.748196][ T8644] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 476.767803][ T8644] RSP: 002b:00007f311b99d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 476.776225][ T8644] RAX: ffffffffffffffda RBX: 00007f311ae25fa0 RCX: 00007f311ab9e159 [ 476.784195][ T8644] RDX: 0000000000000000 RSI: 000000000000ab04 RDI: 0000000000000003 [ 476.792163][ T8644] RBP: 00007f311ac35024 R08: 0000000000000000 R09: 0000000000000000 [ 476.800128][ T8644] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 476.808095][ T8644] R13: 00007f311ae26038 R14: 00007f311ae25fa0 R15: 00007ffea632e648 [ 476.816073][ T8644] [ 476.857525][ T8644] ERROR: Out of memory at tomoyo_realpath_from_path. [ 477.846632][ T8647] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 477.853448][ T8647] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 478.054700][ T8647] vhci_hcd vhci_hcd.0: Device attached [ 478.066137][ T8655] vhci_hcd: connection closed [ 478.070118][ T3432] vhci_hcd: stop threads [ 478.101642][ T3432] vhci_hcd: release socket [ 478.135219][ T3432] vhci_hcd: disconnect device [ 479.692295][ T5779] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 483.333695][ T8697] loop1: detected capacity change from 0 to 1024 [ 483.344234][ T8697] EXT4-fs: Ignoring removed bh option [ 483.392214][ T8690] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 485.032764][ T8697] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 485.089679][ T8702] FAULT_INJECTION: forcing a failure. [ 485.089679][ T8702] name failslab, interval 1, probability 0, space 0, times 0 [ 485.102799][ T8702] CPU: 0 PID: 8702 Comm: syz.0.789 Not tainted syzkaller #0 [ 485.110119][ T8702] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 485.120192][ T8702] Call Trace: [ 485.123475][ T8702] [ 485.126407][ T8702] dump_stack_lvl+0x18c/0x250 [ 485.131125][ T8702] ? show_regs_print_info+0x20/0x20 [ 485.136334][ T8702] ? load_image+0x420/0x420 [ 485.140839][ T8702] ? __might_sleep+0xe0/0xe0 [ 485.145429][ T8702] ? __lock_acquire+0x7d80/0x7d80 [ 485.150457][ T8702] should_fail_ex+0x394/0x4c0 [ 485.155138][ T8702] should_failslab+0x9/0x20 [ 485.159641][ T8702] slab_pre_alloc_hook+0x59/0x300 [ 485.164672][ T8702] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 485.170400][ T8702] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 485.176123][ T8702] __kmem_cache_alloc_node+0x53/0x250 [ 485.181504][ T8702] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 485.187227][ T8702] __kmalloc+0xa7/0x240 [ 485.191388][ T8702] tomoyo_realpath_from_path+0xe6/0x5c0 [ 485.196938][ T8702] ? tomoyo_domain+0xd6/0x120 [ 485.201621][ T8702] tomoyo_path_number_perm+0x248/0x5e0 [ 485.207077][ T8702] ? tomoyo_path_number_perm+0x217/0x5e0 [ 485.212710][ T8702] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 485.218195][ T8702] ? __fget_files+0x28/0x460 [ 485.222795][ T8702] security_file_ioctl+0x70/0xa0 [ 485.227736][ T8702] __se_sys_ioctl+0x48/0x170 [ 485.232334][ T8702] do_syscall_64+0x55/0xb0 [ 485.236749][ T8702] ? clear_bhb_loop+0x40/0x90 [ 485.241423][ T8702] ? clear_bhb_loop+0x40/0x90 [ 485.246099][ T8702] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 485.251989][ T8702] RIP: 0033:0x7f311ab9e159 [ 485.256401][ T8702] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 485.276009][ T8702] RSP: 002b:00007f311b99d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 485.284420][ T8702] RAX: ffffffffffffffda RBX: 00007f311ae25fa0 RCX: 00007f311ab9e159 [ 485.292386][ T8702] RDX: 0000000000000000 RSI: 000000000000ab04 RDI: 0000000000000003 [ 485.300352][ T8702] RBP: 00007f311ac35024 R08: 0000000000000000 R09: 0000000000000000 [ 485.308328][ T8702] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 485.316294][ T8702] R13: 00007f311ae26038 R14: 00007f311ae25fa0 R15: 00007ffea632e648 [ 485.324279][ T8702] [ 485.327369][ C0] vkms_vblank_simulate: vblank timer overrun [ 485.343693][ T8702] ERROR: Out of memory at tomoyo_realpath_from_path. [ 485.391851][ T8702] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 485.398423][ T8702] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 485.418506][ T8702] vhci_hcd vhci_hcd.0: Device attached [ 485.430890][ T8706] vhci_hcd: connection closed [ 485.447040][ T42] vhci_hcd: stop threads [ 485.681067][ T5772] usb 33-1: new high-speed USB device number 2 using vhci_hcd [ 485.799220][ T42] vhci_hcd: release socket [ 487.130532][ T42] vhci_hcd: disconnect device [ 487.290037][ T5781] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 489.511900][ T8732] loop3: detected capacity change from 0 to 1024 [ 489.555349][ T8732] EXT4-fs: Ignoring removed bh option [ 489.783178][ T8738] netlink: 12 bytes leftover after parsing attributes in process `syz.0.799'. [ 490.422716][ T8732] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 490.434448][ T8743] FAULT_INJECTION: forcing a failure. [ 490.434448][ T8743] name failslab, interval 1, probability 0, space 0, times 0 [ 490.448646][ T8743] CPU: 1 PID: 8743 Comm: syz.2.800 Not tainted syzkaller #0 [ 490.455976][ T8743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 490.466047][ T8743] Call Trace: [ 490.469336][ T8743] [ 490.472278][ T8743] dump_stack_lvl+0x18c/0x250 [ 490.476992][ T8743] ? show_regs_print_info+0x20/0x20 [ 490.482216][ T8743] ? load_image+0x420/0x420 [ 490.486739][ T8743] ? __might_sleep+0xe0/0xe0 [ 490.491351][ T8743] ? __lock_acquire+0x7d80/0x7d80 [ 490.496414][ T8743] should_fail_ex+0x394/0x4c0 [ 490.501128][ T8743] should_failslab+0x9/0x20 [ 490.505657][ T8743] slab_pre_alloc_hook+0x59/0x300 [ 490.510710][ T8743] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 490.516459][ T8743] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 490.522211][ T8743] __kmem_cache_alloc_node+0x53/0x250 [ 490.527613][ T8743] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 490.534918][ T8743] __kmalloc+0xa7/0x240 [ 490.539110][ T8743] tomoyo_realpath_from_path+0xe6/0x5c0 [ 490.544683][ T8743] ? tomoyo_domain+0xd6/0x120 [ 490.549373][ T8743] tomoyo_path_number_perm+0x248/0x5e0 [ 490.554832][ T8743] ? tomoyo_path_number_perm+0x217/0x5e0 [ 490.560468][ T8743] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 490.565953][ T8743] ? __fget_files+0x28/0x460 [ 490.570554][ T8743] security_file_ioctl+0x70/0xa0 [ 490.575494][ T8743] __se_sys_ioctl+0x48/0x170 [ 490.580087][ T8743] do_syscall_64+0x55/0xb0 [ 490.584505][ T8743] ? clear_bhb_loop+0x40/0x90 [ 490.589183][ T8743] ? clear_bhb_loop+0x40/0x90 [ 490.593863][ T8743] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 490.599757][ T8743] RIP: 0033:0x7f88d659e159 [ 490.604171][ T8743] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 490.623773][ T8743] RSP: 002b:00007f88d73bf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 490.632184][ T8743] RAX: ffffffffffffffda RBX: 00007f88d6825fa0 RCX: 00007f88d659e159 [ 490.640149][ T8743] RDX: 0000000000000000 RSI: 000000000000ab04 RDI: 0000000000000003 [ 490.648118][ T8743] RBP: 00007f88d6635024 R08: 0000000000000000 R09: 0000000000000000 [ 490.656081][ T8743] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 490.664044][ T8743] R13: 00007f88d6826038 R14: 00007f88d6825fa0 R15: 00007ffddcf84b88 [ 490.672023][ T8743] [ 490.699608][ T8743] ERROR: Out of memory at tomoyo_realpath_from_path. [ 490.801174][ T5772] vhci_hcd: vhci_device speed not set [ 490.807061][ T8744] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(4) [ 490.813587][ T8744] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 490.847394][ T8751] netlink: 17 bytes leftover after parsing attributes in process `syz.0.802'. [ 490.943933][ T8744] vhci_hcd vhci_hcd.0: Device attached [ 490.966533][ T8746] vhci_hcd: connection closed [ 490.966877][ T773] vhci_hcd: stop threads [ 491.313034][ T8369] usb 37-1: new high-speed USB device number 2 using vhci_hcd [ 491.801644][ T773] vhci_hcd: release socket [ 491.806798][ T773] vhci_hcd: disconnect device [ 491.842718][ T8369] usb 37-1: enqueue for inactive port 0 [ 491.942137][ T8369] vhci_hcd: vhci_device speed not set [ 492.148997][ T5779] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 495.417256][ T8796] FAULT_INJECTION: forcing a failure. [ 495.417256][ T8796] name failslab, interval 1, probability 0, space 0, times 0 [ 495.455943][ T8796] CPU: 0 PID: 8796 Comm: syz.1.813 Not tainted syzkaller #0 [ 495.463277][ T8796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 495.473351][ T8796] Call Trace: [ 495.474456][ T8798] loop0: detected capacity change from 0 to 1024 [ 495.476629][ T8796] [ 495.476639][ T8796] dump_stack_lvl+0x18c/0x250 [ 495.490563][ T8796] ? show_regs_print_info+0x20/0x20 [ 495.495781][ T8796] ? load_image+0x420/0x420 [ 495.500308][ T8796] ? __might_sleep+0xe0/0xe0 [ 495.502087][ T8798] EXT4-fs: Ignoring removed bh option [ 495.504902][ T8796] ? __lock_acquire+0x7d80/0x7d80 [ 495.504935][ T8796] should_fail_ex+0x394/0x4c0 [ 495.520025][ T8796] should_failslab+0x9/0x20 [ 495.524555][ T8796] slab_pre_alloc_hook+0x59/0x300 [ 495.529610][ T8796] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 495.535358][ T8796] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 495.541100][ T8796] __kmem_cache_alloc_node+0x53/0x250 [ 495.546500][ T8796] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 495.552251][ T8796] __kmalloc+0xa7/0x240 [ 495.556439][ T8796] tomoyo_realpath_from_path+0xe6/0x5c0 [ 495.562019][ T8796] ? tomoyo_domain+0xd6/0x120 [ 495.566734][ T8796] tomoyo_path_number_perm+0x248/0x5e0 [ 495.572220][ T8796] ? tomoyo_path_number_perm+0x217/0x5e0 [ 495.577883][ T8796] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 495.583432][ T8796] ? __fget_files+0x28/0x460 [ 495.588065][ T8796] security_file_ioctl+0x70/0xa0 [ 495.593040][ T8796] __se_sys_ioctl+0x48/0x170 [ 495.597664][ T8796] do_syscall_64+0x55/0xb0 [ 495.602104][ T8796] ? clear_bhb_loop+0x40/0x90 [ 495.606802][ T8796] ? clear_bhb_loop+0x40/0x90 [ 495.611507][ T8796] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 495.617433][ T8796] RIP: 0033:0x7f483519e159 [ 495.621904][ T8796] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 495.641513][ T8796] RSP: 002b:00007f48360f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 495.649915][ T8796] RAX: ffffffffffffffda RBX: 00007f4835425fa0 RCX: 00007f483519e159 [ 495.657875][ T8796] RDX: 0000000000000000 RSI: 000000000000ab04 RDI: 0000000000000003 [ 495.665844][ T8796] RBP: 00007f4835235024 R08: 0000000000000000 R09: 0000000000000000 [ 495.673819][ T8796] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 495.681775][ T8796] R13: 00007f4835426038 R14: 00007f4835425fa0 R15: 00007ffc724c2698 [ 495.689753][ T8796] [ 495.702033][ T8798] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 495.732886][ T8796] ERROR: Out of memory at tomoyo_realpath_from_path. [ 495.750973][ T8801] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 495.757504][ T8801] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 495.770302][ T8801] vhci_hcd vhci_hcd.0: Device attached [ 495.810554][ T8802] vhci_hcd: connection closed [ 495.813103][ T42] vhci_hcd: stop threads [ 495.822600][ T42] vhci_hcd: release socket [ 495.827118][ T42] vhci_hcd: disconnect device [ 496.117761][ T5775] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 498.391164][ T5773] Bluetooth: hci3: command 0x0406 tx timeout [ 499.339311][ T8841] netlink: 17 bytes leftover after parsing attributes in process `syz.0.824'. [ 499.444330][ T8840] loop2: detected capacity change from 0 to 1024 [ 499.452472][ T8840] EXT4-fs: Ignoring removed bh option [ 500.244155][ T8840] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 500.298292][ T8848] FAULT_INJECTION: forcing a failure. [ 500.298292][ T8848] name failslab, interval 1, probability 0, space 0, times 0 [ 500.311467][ T8848] CPU: 1 PID: 8848 Comm: syz.1.826 Not tainted syzkaller #0 [ 500.318771][ T8848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 500.328815][ T8848] Call Trace: [ 500.332083][ T8848] [ 500.334997][ T8848] dump_stack_lvl+0x18c/0x250 [ 500.339664][ T8848] ? show_regs_print_info+0x20/0x20 [ 500.344860][ T8848] ? load_image+0x420/0x420 [ 500.349380][ T8848] ? __might_sleep+0xe0/0xe0 [ 500.353967][ T8848] ? __lock_acquire+0x7d80/0x7d80 [ 500.358979][ T8848] should_fail_ex+0x394/0x4c0 [ 500.363645][ T8848] should_failslab+0x9/0x20 [ 500.368147][ T8848] slab_pre_alloc_hook+0x59/0x300 [ 500.373161][ T8848] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 500.378871][ T8848] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 500.384595][ T8848] __kmem_cache_alloc_node+0x53/0x250 [ 500.389980][ T8848] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 500.395703][ T8848] __kmalloc+0xa7/0x240 [ 500.399866][ T8848] tomoyo_realpath_from_path+0xe6/0x5c0 [ 500.405420][ T8848] ? tomoyo_domain+0xd6/0x120 [ 500.410105][ T8848] tomoyo_path_number_perm+0x248/0x5e0 [ 500.415566][ T8848] ? tomoyo_path_number_perm+0x217/0x5e0 [ 500.421201][ T8848] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 500.426693][ T8848] ? __fget_files+0x28/0x460 [ 500.431302][ T8848] security_file_ioctl+0x70/0xa0 [ 500.436249][ T8848] __se_sys_ioctl+0x48/0x170 [ 500.441276][ T8848] do_syscall_64+0x55/0xb0 [ 500.445690][ T8848] ? clear_bhb_loop+0x40/0x90 [ 500.450366][ T8848] ? clear_bhb_loop+0x40/0x90 [ 500.455038][ T8848] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 500.460927][ T8848] RIP: 0033:0x7f483519e159 [ 500.465340][ T8848] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 500.484946][ T8848] RSP: 002b:00007f48360f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 500.493358][ T8848] RAX: ffffffffffffffda RBX: 00007f4835425fa0 RCX: 00007f483519e159 [ 500.501325][ T8848] RDX: 0000000000000000 RSI: 000000000000ab04 RDI: 0000000000000003 [ 500.509291][ T8848] RBP: 00007f4835235024 R08: 0000000000000000 R09: 0000000000000000 [ 500.517265][ T8848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 500.525236][ T8848] R13: 00007f4835426038 R14: 00007f4835425fa0 R15: 00007ffc724c2698 [ 500.533221][ T8848] [ 500.616033][ T8848] ERROR: Out of memory at tomoyo_realpath_from_path. [ 500.626857][ T8849] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 500.633402][ T8849] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 500.699809][ T8849] vhci_hcd vhci_hcd.0: Device attached [ 500.801141][ T8850] vhci_hcd: connection closed [ 500.847306][ T6515] vhci_hcd: stop threads [ 500.856511][ T6515] vhci_hcd: release socket [ 500.869146][ T6515] vhci_hcd: disconnect device [ 500.891430][ T8369] vhci_hcd: vhci_device speed not set [ 500.917876][ T8856] loop0: detected capacity change from 0 to 1024 [ 500.945784][ T8856] EXT4-fs: Ignoring removed bh option [ 501.016804][ T8856] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 501.034452][ T5770] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 501.749930][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.770060][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 503.634009][ T8871] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 504.246482][ T5775] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 504.609971][ T8885] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 506.518286][ T8895] loop1: detected capacity change from 0 to 1024 [ 506.525909][ T8895] EXT4-fs: Ignoring removed bh option [ 506.547578][ T8895] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 506.890147][ T5781] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 507.570773][ T8911] loop1: detected capacity change from 0 to 512 [ 507.584778][ T8908] loop0: detected capacity change from 0 to 1024 [ 507.597258][ T8911] EXT4-fs (loop1): Test dummy encryption mode enabled [ 507.604243][ T8911] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 507.617360][ T8908] EXT4-fs: Ignoring removed bh option [ 507.677212][ T8911] EXT4-fs (loop1): 1 truncate cleaned up [ 507.732594][ T8908] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 507.749365][ T8911] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 508.056282][ T5781] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 508.346835][ T8937] loop3: detected capacity change from 0 to 256 [ 509.430049][ T8946] loop3: detected capacity change from 0 to 512 [ 509.527187][ T8946] EXT4-fs (loop3): Test dummy encryption mode enabled [ 509.804618][ T8946] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 509.945946][ T8946] EXT4-fs (loop3): 1 truncate cleaned up [ 509.962429][ T8946] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 510.471223][ T5783] Bluetooth: hci3: command 0x0406 tx timeout [ 510.510396][ T5779] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 510.575152][ T5775] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 510.769364][ T8973] FAULT_INJECTION: forcing a failure. [ 510.769364][ T8973] name failslab, interval 1, probability 0, space 0, times 0 [ 510.843209][ T8973] CPU: 0 PID: 8973 Comm: syz.0.855 Not tainted syzkaller #0 [ 510.850562][ T8973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 510.860637][ T8973] Call Trace: [ 510.863936][ T8973] [ 510.866896][ T8973] dump_stack_lvl+0x18c/0x250 [ 510.871620][ T8973] ? show_regs_print_info+0x20/0x20 [ 510.876843][ T8973] ? load_image+0x420/0x420 [ 510.881353][ T8973] ? __might_sleep+0xe0/0xe0 [ 510.885955][ T8973] ? __lock_acquire+0x7d80/0x7d80 [ 510.890985][ T8973] should_fail_ex+0x394/0x4c0 [ 510.895670][ T8973] should_failslab+0x9/0x20 [ 510.900179][ T8973] slab_pre_alloc_hook+0x59/0x300 [ 510.905214][ T8973] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 510.910943][ T8973] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 510.916664][ T8973] __kmem_cache_alloc_node+0x53/0x250 [ 510.922044][ T8973] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 510.927768][ T8973] __kmalloc+0xa7/0x240 [ 510.931930][ T8973] tomoyo_realpath_from_path+0xe6/0x5c0 [ 510.937479][ T8973] ? tomoyo_domain+0xd6/0x120 [ 510.942164][ T8973] tomoyo_path_number_perm+0x248/0x5e0 [ 510.947622][ T8973] ? tomoyo_path_number_perm+0x217/0x5e0 [ 510.953261][ T8973] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 510.958754][ T8973] ? __fget_files+0x28/0x460 [ 510.963355][ T8973] security_file_ioctl+0x70/0xa0 [ 510.968300][ T8973] __se_sys_ioctl+0x48/0x170 [ 510.972897][ T8973] do_syscall_64+0x55/0xb0 [ 510.977313][ T8973] ? clear_bhb_loop+0x40/0x90 [ 510.981992][ T8973] ? clear_bhb_loop+0x40/0x90 [ 510.986670][ T8973] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 510.992559][ T8973] RIP: 0033:0x7f311ab9e159 [ 510.996972][ T8973] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 511.016580][ T8973] RSP: 002b:00007f311b99d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 511.024990][ T8973] RAX: ffffffffffffffda RBX: 00007f311ae25fa0 RCX: 00007f311ab9e159 [ 511.032956][ T8973] RDX: 0000000000000000 RSI: 000000000000ab04 RDI: 0000000000000003 [ 511.040921][ T8973] RBP: 00007f311ac35024 R08: 0000000000000000 R09: 0000000000000000 [ 511.048884][ T8973] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 511.056846][ T8973] R13: 00007f311ae26038 R14: 00007f311ae25fa0 R15: 00007ffea632e648 [ 511.064826][ T8973] [ 511.116803][ T8973] ERROR: Out of memory at tomoyo_realpath_from_path. [ 511.169295][ T8977] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 511.175851][ T8977] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 511.260516][ T8977] vhci_hcd vhci_hcd.0: Device attached [ 511.299289][ T8981] vhci_hcd: connection closed [ 511.299579][ T3455] vhci_hcd: stop threads [ 511.310660][ T3455] vhci_hcd: release socket [ 511.320279][ T8988] loop3: detected capacity change from 0 to 256 [ 511.335696][ T3455] vhci_hcd: disconnect device [ 512.951508][ T9009] netlink: 12 bytes leftover after parsing attributes in process `syz.1.863'. [ 514.043391][ T9014] loop2: detected capacity change from 0 to 1024 [ 514.065312][ T9011] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 514.116166][ T9014] EXT4-fs: Ignoring removed bh option [ 514.421707][ T9014] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 514.844773][ T9030] loop0: detected capacity change from 0 to 256 [ 516.100287][ T5770] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 516.109568][ T9036] FAULT_INJECTION: forcing a failure. [ 516.109568][ T9036] name failslab, interval 1, probability 0, space 0, times 0 [ 516.135272][ T9036] CPU: 0 PID: 9036 Comm: syz.3.870 Not tainted syzkaller #0 [ 516.142605][ T9036] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 516.152646][ T9036] Call Trace: [ 516.155910][ T9036] [ 516.158822][ T9036] dump_stack_lvl+0x18c/0x250 [ 516.163489][ T9036] ? show_regs_print_info+0x20/0x20 [ 516.168669][ T9036] ? load_image+0x420/0x420 [ 516.173159][ T9036] ? __might_sleep+0xe0/0xe0 [ 516.177748][ T9036] ? __lock_acquire+0x7d80/0x7d80 [ 516.182756][ T9036] should_fail_ex+0x394/0x4c0 [ 516.187420][ T9036] should_failslab+0x9/0x20 [ 516.191912][ T9036] slab_pre_alloc_hook+0x59/0x300 [ 516.196952][ T9036] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 516.202684][ T9036] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 516.208432][ T9036] __kmem_cache_alloc_node+0x53/0x250 [ 516.213845][ T9036] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 516.219587][ T9036] __kmalloc+0xa7/0x240 [ 516.223738][ T9036] tomoyo_realpath_from_path+0xe6/0x5c0 [ 516.229277][ T9036] ? tomoyo_domain+0xd6/0x120 [ 516.233949][ T9036] tomoyo_path_number_perm+0x248/0x5e0 [ 516.239412][ T9036] ? tomoyo_path_number_perm+0x217/0x5e0 [ 516.245038][ T9036] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 516.250506][ T9036] ? __fget_files+0x28/0x460 [ 516.255093][ T9036] security_file_ioctl+0x70/0xa0 [ 516.260026][ T9036] __se_sys_ioctl+0x48/0x170 [ 516.264608][ T9036] do_syscall_64+0x55/0xb0 [ 516.269032][ T9036] ? clear_bhb_loop+0x40/0x90 [ 516.273709][ T9036] ? clear_bhb_loop+0x40/0x90 [ 516.278374][ T9036] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 516.284261][ T9036] RIP: 0033:0x7f8ad1d9e159 [ 516.288665][ T9036] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 516.308258][ T9036] RSP: 002b:00007f8ad2c5f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 516.316675][ T9036] RAX: ffffffffffffffda RBX: 00007f8ad2025fa0 RCX: 00007f8ad1d9e159 [ 516.324647][ T9036] RDX: 0000000000000000 RSI: 000000000000ab04 RDI: 0000000000000003 [ 516.332616][ T9036] RBP: 00007f8ad1e35024 R08: 0000000000000000 R09: 0000000000000000 [ 516.340571][ T9036] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 516.348530][ T9036] R13: 00007f8ad2026038 R14: 00007f8ad2025fa0 R15: 00007ffc592bbb98 [ 516.356494][ T9036] [ 516.426647][ T9041] netlink: 17 bytes leftover after parsing attributes in process `syz.0.872'. [ 516.489111][ T9036] ERROR: Out of memory at tomoyo_realpath_from_path. [ 516.522524][ T9036] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 516.529086][ T9036] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 516.629752][ T9036] vhci_hcd vhci_hcd.0: Device attached [ 516.681461][ T9044] vhci_hcd: connection closed [ 516.682881][ T6515] vhci_hcd: stop threads [ 516.740530][ T6515] vhci_hcd: release socket [ 516.874523][ T6515] vhci_hcd: disconnect device [ 517.728113][ T9060] loop3: detected capacity change from 0 to 1024 [ 517.754878][ T9060] EXT4-fs: Ignoring removed bh option [ 517.789004][ T9064] loop0: detected capacity change from 0 to 256 [ 517.909160][ T9060] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 518.451098][ T9077] netlink: 12 bytes leftover after parsing attributes in process `syz.1.883'. [ 519.530984][ C1] sched: RT throttling activated [ 520.001551][ T5779] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 523.084816][ T9107] loop0: detected capacity change from 0 to 256 [ 527.645655][ T9132] netlink: 44 bytes leftover after parsing attributes in process `syz.2.898'. [ 527.691216][ T9132] netlink: 32 bytes leftover after parsing attributes in process `syz.2.898'. [ 527.881411][ T9137] loop1: detected capacity change from 0 to 256 [ 527.990126][ T9143] X25: received unknown 00 with LCI 000 [ 529.401512][ T9127] loop0: detected capacity change from 0 to 32768 [ 530.804905][ T9178] loop1: detected capacity change from 0 to 256 [ 530.931808][ T9180] X25: received unknown 00 with LCI 000 [ 531.076485][ T9182] binder: 9181:9182 ioctl 4018620d 0 returned -22 [ 531.200209][ T9162] loop2: detected capacity change from 0 to 40427 [ 531.619804][ T9162] F2FS-fs (loop2): Found nat_bits in checkpoint [ 533.359178][ T9162] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 533.603748][ T9204] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 536.533590][ T9213] loop3: detected capacity change from 0 to 256 [ 537.099483][ T9221] binder: 9220:9221 ioctl 4018620d 0 returned -22 [ 537.177231][ T9223] loop0: detected capacity change from 0 to 1024 [ 537.209377][ T9225] X25: received unknown 00 with LCI 000 [ 537.222640][ T9223] EXT4-fs: Ignoring removed bh option [ 537.278625][ T9223] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 537.307498][ T9229] loop1: detected capacity change from 0 to 1024 [ 537.328404][ T9229] EXT4-fs: Ignoring removed bh option [ 537.480428][ T9229] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 537.501628][ T8940] Bluetooth: hci3: command 0x0406 tx timeout [ 537.509550][ T5775] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 540.711265][ T5781] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 541.412243][ T9259] loop1: detected capacity change from 0 to 256 [ 541.506581][ T9261] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 541.513170][ T9261] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 541.540436][ T9261] vhci_hcd vhci_hcd.0: Device attached [ 541.570055][ T9265] loop3: detected capacity change from 0 to 1024 [ 541.583162][ T9262] vhci_hcd: connection closed [ 541.584453][ T12] vhci_hcd: stop threads [ 541.611079][ T12] vhci_hcd: release socket [ 541.615605][ T12] vhci_hcd: disconnect device [ 541.627369][ T9265] EXT4-fs: Ignoring removed bh option [ 541.813848][ T9265] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 542.532979][ T5779] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 543.949703][ T9293] loop3: detected capacity change from 0 to 256 [ 544.037290][ T9289] loop1: detected capacity change from 0 to 32768 [ 544.139091][ T9289] XFS (loop1): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 544.286140][ T9289] XFS (loop1): Ending clean mount [ 544.321734][ T9289] XFS (loop1): Quotacheck needed: Please wait. [ 544.432276][ T9289] XFS (loop1): Quotacheck: Done. [ 544.825528][ T9311] overlayfs: overlapping lowerdir path [ 545.529758][ T5781] XFS (loop1): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 546.134423][ T9327] kvm: apic: phys broadcast and lowest prio [ 546.702879][ T9346] process 'syz.1.959' launched '/dev/fd/3' with NULL argv: empty string added [ 547.843678][ T9319] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 549.134062][ T9376] [U]  [ 549.137126][ T9376] [U] K{ [ 549.140254][ T9376] [U] T 1ŠFFˊ`GJǘGO/MC [ 549.147917][ T9376] [U] Tؖ/,~ĜJ}8'O1"7-΂JQKWQ5C%"H12YX`ȼ`+(¿!(Z'TXLNIGJݭP~7!"ب (5OBܤ̓J [ 549.163691][ T9376] [U] K\&}66XHX Ե.`A$40|϶9ި U4ĮVBZ}WMTQΦR 4 [ 549.175648][ T9376] [U] ".H6"KÇ[J4IN[Z(C|T]Z{3C=XԞ˅4W)\TXJSH{Q;̹T+G߮D.˂>YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 549.212956][ T9376] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 549.237667][ T9376] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 549.250113][ T9376] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 549.262275][ T9376] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/<>{Q_՝LX8U{Zؐ)7?RR;CRHײڣ1>)Mă‰T(Aϝ}9ڥJ*Mќġ'LQ DWظ=|Q ÆW;5Ž!DBX`ɧ/E`Ʀ\ [ 549.353817][ T9376] [U] MX"{; ե٘_O2)O.2W2ʲYX_ HPϱSD:]{Ƚ [ 549.363551][ T9376] [U] I,>Ӥ 51^1N4OǶ'0?֒I9W._.WAV`)ZC6GIӹAXL[F*OW)+'\N[K@2ǬP"^` ؿ [ 549.377930][ T9376] [U] 22Ʃ۩X?0;3U [ 549.382699][ T9376] [U] ޜƍSOBX8W4(~/KUԖOQE+G-YGY_>V3.Hә]̈́2)D, D~D+W; A\FPȘ|$)KؐIɿKYT^RǙA=#ܜ ͿAET1ݯ4K.E"RS|ПS:>P R"Zڭ#P!KY"}FN84ܳHޱOS̫%DLWMƲ [ 549.409386][ T9376] [U] [['XN' ,MR/1D=!DX91BWǻRLFK̤Z#`̑ L؛˜B~M [ 549.418845][ T9376] [U] L>сD+D"5ʍH3<IR=F^FNVDOIO:U>Y [ 549.427599][ T9376] [U] 'B6V20ķǞ׌"T8{9FW]̩ [ 549.434025][ T9376] [U] 72މUC6τI]8CTۨQSKYI¹ |V'TV/G$[ 9KH`"ܑ}[^=0]%̂TF_V4C [ 549.446377][ T9376] [U] EC [ 549.449728][ T9376] [U] |<:^3$7NK~-@?/MTL۾IWȬ@G~T{P+$JP| IRIӍPM Y ڔ8TV,L, [ 549.467302][ T9375] [U] K)0~ܳʪIP'FҜZR @B]5{ʼ'8ƥFUTQUDǩK;7ͪ0C[YYCذML8T͚5RXW XOQHVI'8L [ 549.611543][ T5831] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 549.812502][ T5831] usb 1-1: Using ep0 maxpacket: 32 [ 549.824462][ T5831] usb 1-1: config 1 interface 0 has no altsetting 0 [ 549.842846][ T5831] usb 1-1: New USB device found, idVendor=05ac, idProduct=0264, bcdDevice= 0.40 [ 549.858078][ T5831] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 549.875165][ T5831] usb 1-1: Product: syz [ 549.887647][ T5831] usb 1-1: Manufacturer: syz [ 549.896776][ T5831] usb 1-1: SerialNumber: syz [ 550.139092][ T27] audit: type=1326 audit(1788332509.527:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9373 comm="syz.0.968" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f311ab9e159 code=0x0 sing dummy_hcd [ 554.861516][ T5831] usbhid 1-1:1.0: can't add hid device: -71 [ 554.873309][ T5831] usbhid: probe of 1-1:1.0 failed with error -71 [ 554.892802][ T5831] usb 1-1: USB disconnect, device number 4 [ 555.005248][ T5812] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 555.036709][ T5812] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 555.048497][ T5812] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 555.057868][ T5812] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 555.069271][ T5812] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 555.083805][ T5812] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 555.099927][ T5812] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 555.131495][ T5812] usb 2-1: Product: syz [ 555.138988][ T5812] usb 2-1: Manufacturer: syz [ 555.165054][ T5812] cdc_wdm 2-1:1.0: skipping garbage [ 555.185619][ T5812] cdc_wdm 2-1:1.0: skipping garbage [ 555.224363][ T5812] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 555.234189][ T5812] cdc_wdm 2-1:1.0: Unknown control protocol [ 555.381937][ T5831] usb 2-1: USB disconnect, device number 3 [ 555.739635][ T9411] capability: warning: `syz.1.982' uses deprecated v2 capabilities in a way that may be insecure [ 556.275624][ T9424] FAULT_INJECTION: forcing a failure. [ 556.275624][ T9424] name failslab, interval 1, probability 0, space 0, times 0 [ 556.299493][ T9424] CPU: 0 PID: 9424 Comm: syz.0.987 Not tainted syzkaller #0 [ 556.306815][ T9424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 556.316872][ T9424] Call Trace: [ 556.320150][ T9424] [ 556.323075][ T9424] dump_stack_lvl+0x18c/0x250 [ 556.327757][ T9424] ? show_regs_print_info+0x20/0x20 [ 556.332959][ T9424] ? load_image+0x420/0x420 [ 556.337462][ T9424] ? __might_sleep+0xe0/0xe0 [ 556.342057][ T9424] ? __lock_acquire+0x7d80/0x7d80 [ 556.347081][ T9424] ? trace_contention_end+0x39/0xe0 [ 556.352279][ T9424] should_fail_ex+0x394/0x4c0 [ 556.356966][ T9424] should_failslab+0x9/0x20 [ 556.361472][ T9424] slab_pre_alloc_hook+0x59/0x300 [ 556.366498][ T9424] ? mutex_lock_nested+0x20/0x20 [ 556.371493][ T9424] ? blkcg_css_alloc+0x6a/0xa60 [ 556.376379][ T9424] __kmem_cache_alloc_node+0x53/0x250 [ 556.381776][ T9424] ? blkcg_css_alloc+0x6a/0xa60 [ 556.386633][ T9424] kmalloc_trace+0x2a/0xe0 [ 556.391055][ T9424] blkcg_css_alloc+0x6a/0xa60 [ 556.395734][ T9424] cgroup_apply_control_enable+0x3cc/0xb00 [ 556.401551][ T9424] cgroup_mkdir+0xc83/0xe70 [ 556.406059][ T9424] ? css_task_iter_end+0x2c0/0x2c0 [ 556.411179][ T9424] ? kernfs_iop_permission+0x2c4/0x3b0 [ 556.416643][ T9424] ? css_task_iter_end+0x2c0/0x2c0 [ 556.421750][ T9424] kernfs_iop_mkdir+0x241/0x3e0 [ 556.426602][ T9424] vfs_mkdir+0x2a5/0x470 [ 556.430845][ T9424] do_mkdirat+0x1dc/0x450 [ 556.435172][ T9424] ? vfs_mkdir+0x470/0x470 [ 556.439589][ T9424] __x64_sys_mkdirat+0x89/0xa0 [ 556.444356][ T9424] do_syscall_64+0x55/0xb0 [ 556.448770][ T9424] ? clear_bhb_loop+0x40/0x90 [ 556.453446][ T9424] ? clear_bhb_loop+0x40/0x90 [ 556.458119][ T9424] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 556.464011][ T9424] RIP: 0033:0x7f311ab9e159 [ 556.468419][ T9424] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 556.488024][ T9424] RSP: 002b:00007f311b99d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 556.496434][ T9424] RAX: ffffffffffffffda RBX: 00007f311ae25fa0 RCX: 00007f311ab9e159 [ 556.504403][ T9424] RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c [ 556.512369][ T9424] RBP: 00007f311ac35024 R08: 0000000000000000 R09: 0000000000000000 [ 556.520331][ T9424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 556.528296][ T9424] R13: 00007f311ae26038 R14: 00007f311ae25fa0 R15: 00007ffea632e648 [ 556.536276][ T9424] [ 556.907772][ T9433] tipc: Started in network mode [ 556.981661][ T9433] tipc: Node identity ac14140f, cluster identity 4711 [ 557.172951][ T9433] tipc: New replicast peer: 255.255.255.255 [ 557.357206][ T9433] tipc: Enabled bearer , priority 10 [ 557.467029][ T9434] netlink: 4 bytes leftover after parsing attributes in process `syz.0.989'. [ 558.142305][ T9449] FAULT_INJECTION: forcing a failure. [ 558.142305][ T9449] name failslab, interval 1, probability 0, space 0, times 0 [ 558.202107][ T9449] CPU: 0 PID: 9449 Comm: syz.1.994 Not tainted syzkaller #0 [ 558.209452][ T9449] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 558.219528][ T9449] Call Trace: [ 558.222829][ T9449] [ 558.225787][ T9449] dump_stack_lvl+0x18c/0x250 [ 558.230502][ T9449] ? show_regs_print_info+0x20/0x20 [ 558.235732][ T9449] ? load_image+0x420/0x420 [ 558.240262][ T9449] ? __lock_acquire+0x7d80/0x7d80 [ 558.245321][ T9449] should_fail_ex+0x394/0x4c0 [ 558.250033][ T9449] should_failslab+0x9/0x20 [ 558.254567][ T9449] slab_pre_alloc_hook+0x59/0x300 [ 558.259635][ T9449] ? handler_new_ref+0x244/0x920 [ 558.264703][ T9449] ? handler_new_ref+0x244/0x920 [ 558.269668][ T9449] __kmem_cache_alloc_node+0x53/0x250 [ 558.275085][ T9449] ? handler_new_ref+0x244/0x920 [ 558.280051][ T9449] __kmalloc+0xa7/0x240 [ 558.284248][ T9449] handler_new_ref+0x244/0x920 [ 558.289044][ T9449] ? v4l2_ctrl_type_op_equal+0x220/0x220 [ 558.294783][ T9449] v4l2_ctrl_new+0x11f3/0x16e0 [ 558.299585][ T9449] v4l2_ctrl_new_std+0x24b/0x300 [ 558.304552][ T9449] ? handler_new_ref+0x920/0x920 [ 558.309493][ T9449] ? kvmalloc_node+0x70/0x180 [ 558.314170][ T9449] ? kvmalloc_node+0x70/0x180 [ 558.318850][ T9449] ? media_request_object_init+0x8c/0xe0 [ 558.324591][ T9449] ? v4l2_ctrl_handler_init_class+0x208/0x2d0 [ 558.330665][ T9449] vim2m_open+0x17d/0x640 [ 558.335079][ T9449] v4l2_open+0x208/0x340 [ 558.339330][ T9449] chrdev_open+0x58c/0x600 [ 558.343751][ T9449] ? cd_forget+0x160/0x160 [ 558.348166][ T9449] ? fsnotify_perm+0x3ed/0x5e0 [ 558.352933][ T9449] do_dentry_open+0x880/0x14b0 [ 558.357697][ T9449] ? cd_forget+0x160/0x160 [ 558.362121][ T9449] path_openat+0x284f/0x3270 [ 558.366724][ T9449] ? do_sys_openat2+0xda/0x1d0 [ 558.371487][ T9449] ? __x64_sys_openat+0x139/0x160 [ 558.376514][ T9449] ? verify_lock_unused+0x140/0x140 [ 558.381717][ T9449] ? do_filp_open+0x430/0x430 [ 558.386407][ T9449] do_filp_open+0x1f2/0x430 [ 558.390910][ T9449] ? vfs_tmpfile+0x620/0x620 [ 558.395510][ T9449] ? _raw_spin_unlock+0x28/0x40 [ 558.400355][ T9449] ? alloc_fd+0x590/0x640 [ 558.404690][ T9449] do_sys_openat2+0x134/0x1d0 [ 558.409375][ T9449] ? do_sys_open+0xe0/0xe0 [ 558.413791][ T9449] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 558.419776][ T9449] ? lock_chain_count+0x20/0x20 [ 558.424624][ T9449] __x64_sys_openat+0x139/0x160 [ 558.429475][ T9449] do_syscall_64+0x55/0xb0 [ 558.433890][ T9449] ? clear_bhb_loop+0x40/0x90 [ 558.438560][ T9449] ? clear_bhb_loop+0x40/0x90 [ 558.443231][ T9449] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 558.449119][ T9449] RIP: 0033:0x7f483519e159 [ 558.453531][ T9449] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 558.473134][ T9449] RSP: 002b:00007f48360f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 558.481544][ T9449] RAX: ffffffffffffffda RBX: 00007f4835425fa0 RCX: 00007f483519e159 [ 558.489510][ T9449] RDX: 0000000000000002 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 558.497478][ T9449] RBP: 00007f4835235024 R08: 0000000000000000 R09: 0000000000000000 [ 558.505533][ T9449] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 558.513504][ T9449] R13: 00007f4835426038 R14: 00007f4835425fa0 R15: 00007ffc724c2698 [ 558.521482][ T9449] [ 558.532581][ T2188] tipc: Node number set to 2886997007 [ 558.718150][ T9453] netlink: 12 bytes leftover after parsing attributes in process `syz.1.997'. [ 558.850899][ T9457] netlink: 'syz.1.999': attribute type 10 has an invalid length. [ 558.859291][ T9457] netlink: 40 bytes leftover after parsing attributes in process `syz.1.999'. [ 558.890873][ T9457] dummy0: entered promiscuous mode [ 558.898592][ T9457] bridge0: port 3(dummy0) entered blocking state [ 558.906114][ T9457] bridge0: port 3(dummy0) entered disabled state [ 558.947449][ T9457] dummy0: entered allmulticast mode [ 558.992746][ T9457] bridge0: port 3(dummy0) entered blocking state [ 558.999713][ T9457] bridge0: port 3(dummy0) entered forwarding state [ 559.052935][ T9460] autofs4:pid:9460:autofs_fill_super: called with bogus options [ 559.831343][ T8369] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 560.064223][ T8369] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 560.081537][ T8369] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 560.100702][ T8369] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 560.129109][ T8369] usb 3-1: config 0 descriptor?? [ 560.147181][ T8369] pwc: Askey VC010 type 2 USB webcam detected. [ 560.575252][ T8369] pwc: recv_control_msg error -71 req 02 val 2b00 [ 560.601108][ T8369] pwc: recv_control_msg error -71 req 02 val 2700 [ 560.610306][ T8369] pwc: recv_control_msg error -71 req 02 val 2c00 [ 560.634051][ T8369] pwc: recv_control_msg error -71 req 04 val 1000 [ 560.649531][ T8369] pwc: recv_control_msg error -71 req 04 val 1300 [ 560.666670][ T8369] pwc: recv_control_msg error -71 req 04 val 1400 [ 560.680055][ T8369] pwc: recv_control_msg error -71 req 02 val 2000 [ 560.687605][ T8369] pwc: recv_control_msg error -71 req 02 val 2100 [ 560.697512][ T8369] pwc: recv_control_msg error -71 req 04 val 1500 [ 560.705153][ T8369] pwc: recv_control_msg error -71 req 02 val 2500 [ 560.712768][ T8369] pwc: recv_control_msg error -71 req 02 val 2400 [ 560.719687][ T8369] pwc: recv_control_msg error -71 req 02 val 2600 [ 560.727923][ T8369] pwc: recv_control_msg error -71 req 02 val 2900 [ 560.755355][ T8369] pwc: recv_control_msg error -71 req 02 val 2800 [ 560.763436][ T8369] pwc: recv_control_msg error -71 req 04 val 1100 [ 560.770836][ T8369] pwc: recv_control_msg error -71 req 04 val 1200 [ 560.798443][ T8369] pwc: Registered as video103. [ 560.822292][ T8369] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input5 [ 560.870158][ T8369] usb 3-1: USB disconnect, device number 5 [ 560.911795][ T5812] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 561.111559][ T5812] usb 2-1: Using ep0 maxpacket: 8 [ 561.118654][ T5812] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 561.131771][ T5812] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 561.157984][ T5812] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 561.188661][ T5812] usb 2-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 561.217081][ T5812] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 561.247706][ T5812] usb 2-1: config 168 interface 0 has no altsetting 0 [ 561.258463][ T5812] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 561.267615][ T5812] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 561.298326][ T5812] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 561.321141][ T5812] usb 2-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 561.341180][ T5812] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 561.367085][ T5812] usb 2-1: config 168 interface 0 has no altsetting 0 [ 561.391890][ T5812] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 561.399303][ T5812] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 561.415860][ T5812] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 561.427792][ T5812] usb 2-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 561.441666][ T5812] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 561.462493][ T5812] usb 2-1: config 168 interface 0 has no altsetting 0 [ 561.475120][ T5812] usb 2-1: string descriptor 0 read error: -22 [ 561.482011][ T5812] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 561.491274][ T5831] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 561.499140][ T5812] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 561.533147][ T5812] adutux 2-1:168.0: interrupt endpoints not found [ 561.674149][ T5831] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 561.699069][ T5831] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 561.711686][ T5831] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 561.730557][ T5833] usb 2-1: USB disconnect, device number 4 [ 561.753916][ T5831] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.788711][ T9479] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 561.817721][ T5831] usb 3-1: Quirk or no altest; falling back to MIDI 1.0 [ 562.330926][ T5812] usb 3-1: USB disconnect, device number 6 [ 562.924760][ T9492] netlink: 'syz.1.1010': attribute type 10 has an invalid length. [ 562.949138][ T9492] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1010'. [ 562.958896][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.965279][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.983474][ T5783] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 562.994939][ T5783] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 563.012049][ T5783] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 563.023362][ T5783] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 563.031621][ T5783] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 563.039303][ T5783] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 563.625861][ T9493] chnl_net:caif_netlink_parms(): no params data found [ 563.885074][ T9493] bridge0: port 1(bridge_slave_0) entered blocking state [ 563.917888][ T9493] bridge0: port 1(bridge_slave_0) entered disabled state [ 563.949083][ T9493] bridge_slave_0: entered allmulticast mode [ 563.974371][ T3492] Bluetooth: hci5: Frame reassembly failed (-84) [ 563.984930][ T9493] bridge_slave_0: entered promiscuous mode [ 564.023754][ T9508] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1014'. [ 564.059020][ T9508] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1014'. [ 564.091259][ T9493] bridge0: port 2(bridge_slave_1) entered blocking state [ 564.114522][ T9493] bridge0: port 2(bridge_slave_1) entered disabled state [ 564.132489][ T9493] bridge_slave_1: entered allmulticast mode [ 564.145551][ T9493] bridge_slave_1: entered promiscuous mode [ 564.204025][ T9493] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 564.218378][ T9493] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 564.270405][ T9493] team0: Port device team_slave_0 added [ 564.296675][ T9493] team0: Port device team_slave_1 added [ 564.387978][ T9493] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 564.395195][ T9493] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 564.443982][ T9493] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 564.478572][ T9493] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 564.496427][ T9493] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 564.545179][ T9493] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 564.676745][ T9493] hsr_slave_0: entered promiscuous mode [ 564.708777][ T9493] hsr_slave_1: entered promiscuous mode [ 564.722475][ T9493] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 564.750286][ T9493] Cannot create hsr debugfs directory [ 564.887478][ T9513] IPVS: sync thread started: state = MASTER, mcast_ifn = wg1, syncid = 4, id = 0 [ 565.101753][ T5783] Bluetooth: hci4: command tx timeout [ 565.591180][ T9493] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 565.626360][ T9493] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 565.678177][ T9493] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 565.716766][ T9493] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 565.962507][ T9493] 8021q: adding VLAN 0 to HW filter on device bond0 [ 565.981502][ T5783] Bluetooth: hci5: command 0x1003 tx timeout [ 565.981794][ T8940] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 566.077134][ T9493] 8021q: adding VLAN 0 to HW filter on device team0 [ 566.137661][ T3492] bridge0: port 1(bridge_slave_0) entered blocking state [ 566.144772][ T3492] bridge0: port 1(bridge_slave_0) entered forwarding state [ 566.214401][ T3492] bridge0: port 2(bridge_slave_1) entered blocking state [ 566.221527][ T3492] bridge0: port 2(bridge_slave_1) entered forwarding state [ 566.269553][ T9493] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 566.287747][ T9493] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 566.865924][ T9493] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 567.095704][ T9533] mmap: syz.1.1020 (9533) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 567.198272][ T8940] Bluetooth: hci4: command tx timeout [ 567.254809][ T9537] netlink: 'syz.2.1021': attribute type 10 has an invalid length. [ 567.276813][ T9537] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1021'. [ 567.307781][ T9537] dummy0: entered promiscuous mode [ 567.361809][ T9537] bridge0: port 3(dummy0) entered blocking state [ 567.368300][ T9537] bridge0: port 3(dummy0) entered disabled state [ 567.414391][ T9537] dummy0: entered allmulticast mode [ 567.435023][ T9537] bridge0: port 3(dummy0) entered blocking state [ 567.441544][ T9537] bridge0: port 3(dummy0) entered forwarding state [ 567.805963][ T9493] veth0_vlan: entered promiscuous mode [ 567.917962][ T9493] veth1_vlan: entered promiscuous mode [ 568.048074][ T9493] veth0_macvtap: entered promiscuous mode [ 568.080186][ T9493] veth1_macvtap: entered promiscuous mode [ 568.214249][ T9493] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 568.233657][ T9493] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 568.264908][ T9493] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 568.294274][ T9493] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 568.331037][ T9493] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 568.371073][ T9493] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 568.418296][ T9493] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 568.437483][ T9493] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 568.474236][ T9493] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 568.601736][ T9493] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 568.617648][ T9493] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 568.630303][ T9493] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 568.646398][ T9493] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 568.670793][ T9493] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 568.681753][ T9493] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 568.699705][ T9493] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 568.723496][ T9493] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 568.767743][ T9493] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 568.912656][ T9493] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.931904][ T9493] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.940634][ T9493] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.991288][ T9493] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.216583][ T49] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 569.261703][ T8940] Bluetooth: hci4: command tx timeout [ 569.446774][ T49] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 569.664146][ T49] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 570.038383][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 570.122652][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 571.988092][ T8940] Bluetooth: hci4: command tx timeout [ 572.248510][ T49] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.524864][ T9562] netlink: 'syz.2.1026': attribute type 2 has an invalid length. [ 572.532763][ T9562] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1026'. [ 572.768247][ T773] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 572.830026][ T773] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 574.192506][ T9572] netlink: 'syz.2.1029': attribute type 10 has an invalid length. [ 574.216425][ T9572] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1029'. [ 574.247903][ T9578] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1030'. [ 574.271318][ T9575] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 574.671592][ T5783] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 574.680534][ T5783] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 574.696127][ T5783] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 574.705523][ T5783] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 574.715941][ T5783] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 574.732685][ T5783] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 575.372266][ T9597] input: PS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input6 [ 575.655001][ T9582] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1031'. [ 575.740021][ T9582] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1031'. [ 575.753812][ T5812] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 576.001810][ T5812] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 576.045909][ T5812] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 576.064350][ T5812] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 576.096614][ T5812] usb 3-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 576.108158][ T5812] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 576.153528][ T9602] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 576.160847][ T9602] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 576.173517][ T5812] pl2303 3-1:1.0: pl2303 converter detected [ 576.210224][ T5812] usb 3-1: pl2303 converter now attached to ttyUSB0 [ 576.686571][ T9597] pl2303 3-1:1.0: pl2303_vendor_write - failed to write [0007]: -110 [ 576.712917][ T9597] pl2303 ttyUSB0: pl2303_get_line_request - failed: -32 [ 576.747548][ T9597] pl2303 ttyUSB0: pl2303_set_line_request - failed: -32 [ 576.749231][ T9586] chnl_net:caif_netlink_parms(): no params data found [ 576.761399][ T9597] pl2303 3-1:1.0: pl2303_vendor_read - failed to read [000a]: -32 [ 576.787836][ T9597] pl2303 ttyUSB0: pl2303_set_control_lines - failed: -32 [ 576.862448][ T8940] Bluetooth: hci2: command tx timeout [ 577.512858][ T9596] pl2303 ttyUSB0: pl2303_set_control_lines - failed: -32 [ 577.539594][ T9586] bridge0: port 1(bridge_slave_0) entered blocking state [ 577.568570][ T9596] pl2303 ttyUSB0: error sending break = -32 [ 577.596845][ T5812] usb 3-1: USB disconnect, device number 7 [ 577.624172][ T9586] bridge0: port 1(bridge_slave_0) entered disabled state [ 577.660795][ T5812] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 577.701329][ T9586] bridge_slave_0: entered allmulticast mode [ 577.708498][ T9586] bridge_slave_0: entered promiscuous mode [ 577.738084][ T5812] pl2303 3-1:1.0: device disconnected [ 578.074382][ T9586] bridge0: port 2(bridge_slave_1) entered blocking state [ 578.269551][ T9586] bridge0: port 2(bridge_slave_1) entered disabled state [ 578.304450][ T9586] bridge_slave_1: entered allmulticast mode [ 578.337010][ T9586] bridge_slave_1: entered promiscuous mode [ 578.593693][ T9586] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 578.624351][ T9586] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 578.857637][ T9660] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1039'. [ 578.906491][ T9661] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1043'. [ 578.929149][ T9586] team0: Port device team_slave_0 added [ 578.942078][ T8940] Bluetooth: hci2: command tx timeout [ 578.983110][ T9586] team0: Port device team_slave_1 added [ 579.451378][ T9586] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 579.478945][ T9586] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 579.533548][ T5785] udevd[5785]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 579.538117][ T9586] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 579.558336][ T9586] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 579.571244][ T9586] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 579.617549][ T9680] 9pnet_virtio: no channels available for device syz [ 579.629243][ T9586] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 579.749282][ T9679] ALSA: mixer_oss: invalid OSS volume ';' [ 579.798246][ T49] hsr_slave_0: left promiscuous mode [ 579.811627][ T49] hsr_slave_1: left promiscuous mode [ 579.819181][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 579.843932][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 579.903844][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 579.926819][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 579.961946][ T49] bridge_slave_1: left allmulticast mode [ 579.967619][ T49] bridge_slave_1: left promiscuous mode [ 579.976432][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 580.002211][ T9692] FAULT_INJECTION: forcing a failure. [ 580.002211][ T9692] name failslab, interval 1, probability 0, space 0, times 0 [ 580.016248][ T49] bridge_slave_0: left allmulticast mode [ 580.031305][ T49] bridge_slave_0: left promiscuous mode [ 580.037096][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 580.047817][ T9692] CPU: 0 PID: 9692 Comm: syz.4.1052 Not tainted syzkaller #0 [ 580.055220][ T9692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 580.065292][ T9692] Call Trace: [ 580.068587][ T9692] [ 580.071533][ T9692] dump_stack_lvl+0x18c/0x250 [ 580.076240][ T9692] ? show_regs_print_info+0x20/0x20 [ 580.081460][ T9692] ? load_image+0x420/0x420 [ 580.085991][ T9692] ? __might_sleep+0xe0/0xe0 [ 580.090621][ T9692] ? __lock_acquire+0x7d80/0x7d80 [ 580.095670][ T9692] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 580.101680][ T9692] should_fail_ex+0x394/0x4c0 [ 580.106392][ T9692] should_failslab+0x9/0x20 [ 580.110926][ T9692] slab_pre_alloc_hook+0x59/0x300 [ 580.115987][ T9692] ? snd_pcm_hw_refine+0x98b/0x1730 [ 580.121225][ T9692] ? snd_pcm_hw_refine+0x98b/0x1730 [ 580.126450][ T9692] __kmem_cache_alloc_node+0x53/0x250 [ 580.131861][ T9692] ? snd_pcm_hw_refine+0x98b/0x1730 [ 580.137086][ T9692] __kmalloc+0xa7/0x240 [ 580.141274][ T9692] snd_pcm_hw_refine+0x98b/0x1730 [ 580.146337][ T9692] ? kasan_set_track+0x4e/0x70 [ 580.151130][ T9692] ? snd_pcm_oss_get_formats+0x35/0x400 [ 580.156805][ T9692] ? __se_sys_ioctl+0xfd/0x170 [ 580.161598][ T9692] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 580.167693][ T9692] ? snd_pcm_info_user+0xc0/0xc0 [ 580.172694][ T9692] ? __asan_memset+0x22/0x40 [ 580.177318][ T9692] ? snd_pcm_oss_change_params_locked+0x719/0x3be0 [ 580.183848][ T9692] ? snd_pcm_oss_change_params_locked+0x77d/0x3be0 [ 580.190373][ T9692] snd_pcm_oss_change_params_locked+0xa07/0x3be0 [ 580.196736][ T9692] ? __mutex_trylock_common+0x160/0x270 [ 580.202308][ T9692] ? rcu_is_watching+0x15/0xb0 [ 580.207095][ T9692] ? __mutex_lock+0x30d/0xc80 [ 580.211794][ T9692] ? snd_pcm_oss_read2+0x3d0/0x3d0 [ 580.216931][ T9692] ? mutex_lock_nested+0x20/0x20 [ 580.221911][ T9692] snd_pcm_oss_get_active_substream+0x1dd/0x270 [ 580.228176][ T9692] snd_pcm_oss_get_formats+0x35/0x400 [ 580.233576][ T9692] snd_pcm_oss_set_format+0x42/0x510 [ 580.238880][ T9692] ? __might_fault+0xc6/0x120 [ 580.243576][ T9692] snd_pcm_oss_ioctl+0xbe4/0xdc0 [ 580.248528][ T9692] ? bpf_lsm_file_ioctl+0x9/0x10 [ 580.253515][ T9692] ? snd_pcm_oss_poll+0x8c0/0x8c0 [ 580.258556][ T9692] __se_sys_ioctl+0xfd/0x170 [ 580.263167][ T9692] do_syscall_64+0x55/0xb0 [ 580.267601][ T9692] ? clear_bhb_loop+0x40/0x90 [ 580.272296][ T9692] ? clear_bhb_loop+0x40/0x90 [ 580.276991][ T9692] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 580.282903][ T9692] RIP: 0033:0x7fce1cf9e159 [ 580.287332][ T9692] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 580.306954][ T9692] RSP: 002b:00007fce1de7c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 580.315399][ T9692] RAX: ffffffffffffffda RBX: 00007fce1d225fa0 RCX: 00007fce1cf9e159 [ 580.323391][ T9692] RDX: 0000200000000080 RSI: 00000000c0045005 RDI: 0000000000000003 [ 580.331379][ T9692] RBP: 00007fce1d035024 R08: 0000000000000000 R09: 0000000000000000 [ 580.339363][ T9692] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 580.347345][ T9692] R13: 00007fce1d226038 R14: 00007fce1d225fa0 R15: 00007ffe15edf7d8 [ 580.355348][ T9692] [ 580.466212][ T49] veth1_macvtap: left promiscuous mode [ 580.478522][ T49] veth0_macvtap: left promiscuous mode [ 580.507398][ T49] veth1_vlan: left promiscuous mode [ 580.521588][ T49] veth0_vlan: left promiscuous mode [ 581.021219][ T8940] Bluetooth: hci2: command tx timeout [ 581.720312][ T49] team0 (unregistering): Port device team_slave_1 removed [ 581.782809][ T49] team0 (unregistering): Port device team_slave_0 removed [ 581.847506][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 581.916957][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 582.363350][ T49] bond0 (unregistering): Released all slaves [ 582.472952][ T9713] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 582.521361][ T9729] netlink: 'syz.2.1066': attribute type 10 has an invalid length. [ 582.529231][ T9729] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1066'. [ 582.665130][ T9586] hsr_slave_0: entered promiscuous mode [ 582.697241][ T9586] hsr_slave_1: entered promiscuous mode [ 582.697988][ T9586] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 582.698042][ T9586] Cannot create hsr debugfs directory [ 582.700527][ T9732] ================================================================== [ 582.700605][ T9732] BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x2114/0x25d0 [ 582.700703][ T9732] Write of size 4 at addr ffffc90003de9fe8 by task syz.1.1067/9732 [ 582.700721][ T9732] [ 582.700755][ T9732] CPU: 1 PID: 9732 Comm: syz.1.1067 Not tainted syzkaller #0 [ 582.700802][ T9732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 582.700815][ T9732] Call Trace: [ 582.700823][ T9732] [ 582.700830][ T9732] dump_stack_lvl+0x18c/0x250 [ 582.700865][ T9732] ? sys_imageblit+0x2114/0x25d0 [ 582.700885][ T9732] ? show_regs_print_info+0x20/0x20 [ 582.700907][ T9732] ? load_image+0x420/0x420 [ 582.700930][ T9732] print_report+0xa8/0x210 [ 582.700958][ T9732] ? sys_imageblit+0x2114/0x25d0 [ 582.700977][ T9732] kasan_report+0x117/0x150 [ 582.701001][ T9732] ? sys_imageblit+0x2114/0x25d0 [ 582.701020][ T9732] sys_imageblit+0x2114/0x25d0 [ 582.701045][ T9732] ? sys_copyarea+0x2530/0x2530 [ 582.701065][ T9732] ? try_to_wake_up+0x6c3/0x10e0 [ 582.701088][ T9732] drm_fbdev_generic_defio_imageblit+0x2c/0x110 [ 582.701131][ T9732] cw_putcs+0x15f3/0x18a0 [ 582.701174][ T9732] ? cw_clear+0x250/0x250 [ 582.701201][ T9732] ? drm_fb_helper_set_suspend_unlocked+0x190/0x190 [ 582.701226][ T9732] ? fb_get_color_depth+0x162/0x280 [ 582.701250][ T9732] fbcon_putcs+0x35c/0x520 [ 582.701275][ T9732] ? cw_clear+0x250/0x250 [ 582.701299][ T9732] do_update_region+0x4e9/0x640 [ 582.701331][ T9732] ? __asan_memcpy+0x40/0x70 [ 582.701359][ T9732] ? hide_cursor+0x320/0x320 [ 582.701384][ T9732] redraw_screen+0xa30/0x1000 [ 582.701406][ T9732] ? _raw_spin_unlock+0x40/0x40 [ 582.701428][ T9732] ? clear_buffer_attributes+0x320/0x320 [ 582.701451][ T9732] ? tty_do_resize+0xe1/0x120 [ 582.701474][ T9732] vc_do_resize+0x1256/0x17f0 [ 582.701507][ T9732] ? vc_resize+0x50/0x50 [ 582.701531][ T9732] ? vc_resize+0x30/0x50 [ 582.701553][ T9732] fbcon_do_set_font+0xb5c/0x1ae0 [ 582.701578][ T9732] ? fbcon_set_font+0x65a/0xf90 [ 582.701604][ T9732] ? fbcon_set_font+0xbe5/0xf90 [ 582.701633][ T9732] ? fbcon_blank+0xb40/0xb40 [ 582.701655][ T9732] con_font_op+0xc3c/0xf60 [ 582.701682][ T9732] ? reset_palette+0xdd0/0xdd0 [ 582.701708][ T9732] ? __might_fault+0xaa/0x120 [ 582.701729][ T9732] ? __lock_acquire+0x7d80/0x7d80 [ 582.701752][ T9732] ? apparmor_capable+0x137/0x1a0 [ 582.701772][ T9732] ? __might_fault+0xaa/0x120 [ 582.701791][ T9732] ? __might_fault+0xc6/0x120 [ 582.701810][ T9732] ? __might_fault+0xaa/0x120 [ 582.701832][ T9732] vt_ioctl+0x1a21/0x1f20 [ 582.701868][ T9732] ? __vt_event_wait+0x260/0x260 [ 582.701899][ T9732] ? __fget_files+0x28/0x460 [ 582.701928][ T9732] ? tty_jobctrl_ioctl+0x378/0xba0 [ 582.701952][ T9732] tty_ioctl+0x91e/0xdc0 [ 582.701975][ T9732] ? tty_get_icount+0xb0/0xb0 [ 582.701998][ T9732] __se_sys_ioctl+0xfd/0x170 [ 582.702023][ T9732] do_syscall_64+0x55/0xb0 [ 582.702045][ T9732] ? clear_bhb_loop+0x40/0x90 [ 582.702066][ T9732] ? clear_bhb_loop+0x40/0x90 [ 582.702090][ T9732] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 582.702112][ T9732] RIP: 0033:0x7f483519e159 [ 582.702130][ T9732] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 582.702148][ T9732] RSP: 002b:00007f48360f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 582.702169][ T9732] RAX: ffffffffffffffda RBX: 00007f4835425fa0 RCX: 00007f483519e159 [ 582.702185][ T9732] RDX: 0000200000000180 RSI: 0000000000004b72 RDI: 0000000000000003 [ 582.702198][ T9732] RBP: 00007f4835235024 R08: 0000000000000000 R09: 0000000000000000 [ 582.702211][ T9732] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 582.702223][ T9732] R13: 00007f4835426038 R14: 00007f4835425fa0 R15: 00007ffc724c2698 [ 582.702245][ T9732] [ 582.702252][ T9732] [ 582.702257][ T9732] The buggy address belongs to a 0-page vmalloc region starting at 0xffffc90003dea000 allocated at drm_gem_shmem_vmap+0x3c4/0x650 [ 582.702335][ T9732] Memory state around the buggy address: [ 582.702375][ T9732] ffffc90003de9e80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 582.702389][ T9732] ffffc90003de9f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 582.702402][ T9732] >ffffc90003de9f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 582.702411][ T9732] ^ [ 582.702423][ T9732] ffffc90003dea000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 582.702435][ T9732] ffffc90003dea080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 582.702445][ T9732] ================================================================== [ 582.728310][ T9732] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 582.728324][ T9732] CPU: 0 PID: 9732 Comm: syz.1.1067 Not tainted syzkaller #0 [ 582.728352][ T9732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 582.728364][ T9732] Call Trace: [ 582.728372][ T9732] [ 582.728379][ T9732] dump_stack_lvl+0x18c/0x250 [ 582.728410][ T9732] ? show_regs_print_info+0x20/0x20 [ 582.728430][ T9732] ? load_image+0x420/0x420 [ 582.728453][ T9732] panic+0x2ca/0x720 [ 582.728481][ T9732] ? bpf_jit_dump+0xd0/0xd0 [ 582.728506][ T9732] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 582.728526][ T9732] ? _raw_spin_unlock+0x40/0x40 [ 582.728542][ T9732] ? print_memory_metadata+0x314/0x400 [ 582.728563][ T9732] ? sys_imageblit+0x2114/0x25d0 [ 582.728581][ T9732] check_panic_on_warn+0x84/0xa0 [ 582.728605][ T9732] ? sys_imageblit+0x2114/0x25d0 [ 582.728622][ T9732] end_report+0x6f/0x130 [ 582.728642][ T9732] kasan_report+0x128/0x150 [ 582.728666][ T9732] ? sys_imageblit+0x2114/0x25d0 [ 582.728687][ T9732] sys_imageblit+0x2114/0x25d0 [ 582.728710][ T9732] ? sys_copyarea+0x2530/0x2530 [ 582.728730][ T9732] ? try_to_wake_up+0x6c3/0x10e0 [ 582.728751][ T9732] drm_fbdev_generic_defio_imageblit+0x2c/0x110 [ 582.728776][ T9732] cw_putcs+0x15f3/0x18a0 [ 582.728815][ T9732] ? cw_clear+0x250/0x250 [ 582.728840][ T9732] ? drm_fb_helper_set_suspend_unlocked+0x190/0x190 [ 582.728865][ T9732] ? fb_get_color_depth+0x162/0x280 [ 582.728886][ T9732] fbcon_putcs+0x35c/0x520 [ 582.728911][ T9732] ? cw_clear+0x250/0x250 [ 582.728936][ T9732] do_update_region+0x4e9/0x640 [ 582.728958][ T9732] ? __asan_memcpy+0x40/0x70 [ 582.728987][ T9732] ? hide_cursor+0x320/0x320 [ 582.729012][ T9732] redraw_screen+0xa30/0x1000 [ 582.729034][ T9732] ? _raw_spin_unlock+0x40/0x40 [ 582.729055][ T9732] ? clear_buffer_attributes+0x320/0x320 [ 582.729078][ T9732] ? tty_do_resize+0xe1/0x120 [ 582.729103][ T9732] vc_do_resize+0x1256/0x17f0 [ 582.729137][ T9732] ? vc_resize+0x50/0x50 [ 582.729162][ T9732] ? vc_resize+0x30/0x50 [ 582.729183][ T9732] fbcon_do_set_font+0xb5c/0x1ae0 [ 582.729209][ T9732] ? fbcon_set_font+0x65a/0xf90 [ 582.729234][ T9732] ? fbcon_set_font+0xbe5/0xf90 [ 582.729262][ T9732] ? fbcon_blank+0xb40/0xb40 [ 582.729285][ T9732] con_font_op+0xc3c/0xf60 [ 582.729311][ T9732] ? reset_palette+0xdd0/0xdd0 [ 582.729344][ T9732] ? __might_fault+0xaa/0x120 [ 582.729364][ T9732] ? __lock_acquire+0x7d80/0x7d80 [ 582.729386][ T9732] ? apparmor_capable+0x137/0x1a0 [ 582.729406][ T9732] ? __might_fault+0xaa/0x120 [ 582.729425][ T9732] ? __might_fault+0xc6/0x120 [ 582.729443][ T9732] ? __might_fault+0xaa/0x120 [ 582.729464][ T9732] vt_ioctl+0x1a21/0x1f20 [ 582.729492][ T9732] ? __vt_event_wait+0x260/0x260 [ 582.729522][ T9732] ? __fget_files+0x28/0x460 [ 582.729548][ T9732] ? tty_jobctrl_ioctl+0x378/0xba0 [ 582.729571][ T9732] tty_ioctl+0x91e/0xdc0 [ 582.729593][ T9732] ? tty_get_icount+0xb0/0xb0 [ 582.729615][ T9732] __se_sys_ioctl+0xfd/0x170 [ 582.729639][ T9732] do_syscall_64+0x55/0xb0 [ 582.729660][ T9732] ? clear_bhb_loop+0x40/0x90 [ 582.729680][ T9732] ? clear_bhb_loop+0x40/0x90 [ 582.729700][ T9732] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 582.729719][ T9732] RIP: 0033:0x7f483519e159 [ 582.729735][ T9732] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 582.729752][ T9732] RSP: 002b:00007f48360f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 582.729774][ T9732] RAX: ffffffffffffffda RBX: 00007f4835425fa0 RCX: 00007f483519e159 [ 582.729789][ T9732] RDX: 0000200000000180 RSI: 0000000000004b72 RDI: 0000000000000003 [ 582.729801][ T9732] RBP: 00007f4835235024 R08: 0000000000000000 R09: 0000000000000000 [ 582.729814][ T9732] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 582.729826][ T9732] R13: 00007f4835426038 R14: 00007f4835425fa0 R15: 00007ffc724c2698 [ 582.729844][ T9732] [ 582.730081][ T9732] Kernel Offset: disabled