last executing test programs: 14m3.652440057s ago: executing program 3 (id=124): openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) syz_open_dev$tty1(0xc, 0x4, 0x4) recvmmsg(r0, &(0x7f0000001a00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=""/60, 0x3c}, 0x4}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000003040)=""/243, 0xf3}, 0x1}], 0x2, 0x40000002, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x901800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xa, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="7b87f20f"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x53397d41bbe676d, 0x7, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 14m0.954266701s ago: executing program 3 (id=130): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x37, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0xffffff9e, &(0x7f0000000000)={&(0x7f00000009c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x18000000, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}]}, @NFT_MSG_NEWSETELEM={0x74, 0xc, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x38, 0x3, 0x0, 0x1, [{0x34, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_EXPRESSIONS={0x4, 0x6, 0x0, 0x1, [{0x14, 0x7, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x480}}}]}]}]}]}], {0x14, 0x10}}, 0xe4}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 13m59.71909584s ago: executing program 3 (id=133): socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) socket$nl_generic(0x10, 0x3, 0x10) socket(0x8000000010, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x1, @remote}, {0x2, 0x4e23, @multicast1}, 0x118, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x5}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 13m58.544749648s ago: executing program 3 (id=136): syz_mount_image$bfs(&(0x7f0000000000), &(0x7f0000000240)='./bus\x00', 0x8008, &(0x7f0000000100)=ANY=[@ANYRES64=0x0], 0xf, 0xab, &(0x7f0000010140)="$eJzs1zGKwkAYBeB/s7CbdptFsLBO4x08ilhqI1aK4A3Ei3gVj5DewiKtiCOYiIidRQT5vmLgzWPgtbM7brubIiKtIlLRme7T3Wy+GA8n9Rl8pCwifiMij4jeX50Pg7r7avqyWo7K6vv58c+69b0AAMDrsug/5nNqLk7NL/Aa/m993vI+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHe7BAAA//+dfyiL") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.current\x00', 0x275a, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x143042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='rdma.current\x00', 0x275a, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file4\x00', 0x40, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file7\x00', 0x105042, 0x1ff) linkat(0xffffffffffffff9c, &(0x7f0000000000)='./file4\x00', 0xffffffffffffff9c, &(0x7f00000006c0)='./file5\x00', 0x0) write$binfmt_script(r0, 0x0, 0x0) open(&(0x7f0000000140)='./file1\x00', 0x64042, 0x178) open(&(0x7f00000003c0)='./file3\x00', 0x14507e, 0x148) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000006ac0)='cpuacct.stat\x00', 0x275a, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000640)='.log\x00', 0xa5d, 0x1) syz_clone(0x2000400, 0x0, 0xfffffebf, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='pids.current\x00', 0x275a, 0x0) 13m56.862935967s ago: executing program 3 (id=138): socket$inet_tcp(0x2, 0x1, 0x0) syz_open_dev$vcsa(&(0x7f0000000300), 0x1, 0x102) syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net\x00') openat(r0, &(0x7f0000000180)='rpc/auth.unix.ip/channel\x00', 0xa802, 0x32) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000a80)={0x0, 0xabba, 0x400, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f00000006c0)=0x0, &(0x7f0000000580)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x8, 0x60e, 0x0, 0x0, 0x1000, 0x6, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000080)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x21}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x1, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x8200, 0x2, 0x250}}], 0x1, 0x0, 0x0) r8 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r8, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x1, @loopback, 0x10}, {0xa, 0x4e1e, 0x800000d, @mcast1}, 0xffffffffffffffff, 0x5}}, 0x48) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r10 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r10}, 0x0, &(0x7f0000000100)=r9}, 0x1c) writev(r10, &(0x7f0000000040)=[{&(0x7f0000000100), 0x6b82}], 0x2) 13m55.007790341s ago: executing program 3 (id=141): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) ioprio_get$pid(0x2, r0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r4, r4, &(0x7f0000000000)=0x2eb4, 0x2000007ff) 13m53.238584822s ago: executing program 32 (id=141): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) ioprio_get$pid(0x2, r0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r4, r4, &(0x7f0000000000)=0x2eb4, 0x2000007ff) 11m30.735336828s ago: executing program 4 (id=364): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_emit_ethernet(0x24, &(0x7f0000000040)={@remote, @empty, @void, {@arp={0x806, @generic={0x4aa2fbe5deb8060a, 0xf6, 0x6, 0x2, 0x4, @random="f1fa947e4d7b", "d353", @random="728b56b7e264"}}}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x2, &(0x7f0000000000)=0x80000000000003) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x16, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x25, '\x00', 0x0, @fallback=0x1e}, 0x94) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) semtimedop(0x0, &(0x7f0000000040)=[{}], 0x1, 0x0) syz_emit_ethernet(0x6c, &(0x7f00000005c0)={@broadcast, @random="5aeadd61229e", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb8000", 0x36, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x29}}, @mcast2, {[], @dest_unreach={0x1, 0xcf472e2fb6ef26c8, 0x0, 0x4, '\x00', {0x9, 0x6, "86ef33", 0x3, 0x3a, 0xff, @private1, @private2, [], "2eff052bc29d"}}}}}}}, 0x0) 11m24.515640404s ago: executing program 4 (id=374): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/uac1.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/uac1.usb0/p_volume_max\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='100', 0x3) r1 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/class/thermal/cooling_device0/cur_state\x00', 0x1, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r2 = open(&(0x7f0000000000)='./file0\x00', 0x143142, 0x2) sendfile(r2, r2, 0x0, 0x1000000201005) r3 = fsmount(r1, 0x0, 0x1) syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) r4 = openat2(r2, &(0x7f00000001c0)='./config/usb_gadget/g1/functions\x00', &(0x7f00000002c0)={0x20000, 0x121, 0x10}, 0x18) ioctl$USBDEVFS_REAPURB(r4, 0x4008550c, 0x0) fchdir(r3) unlinkat(0xffffffffffffff9c, &(0x7f0000000540)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) 11m21.790771928s ago: executing program 4 (id=380): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mprotect(&(0x7f00000f8000/0x3000)=nil, 0x3000, 0x1) ptrace$setsig(0x4203, r0, 0xe, 0x0) r2 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = openat$cgroup(0xffffffffffffffff, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f0000004000)={0x2020}, 0x2020) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) 11m20.556921988s ago: executing program 4 (id=381): socket$inet_mptcp(0x2, 0x1, 0x106) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000080), 0x1, 0x2) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000380)=@generic={0x0, 0x0, 0x4}, 0x14) r2 = socket$unix(0x1, 0x2, 0x0) timer_create(0x1, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) fsetxattr$security_evm(r2, &(0x7f0000000180), &(0x7f00000001c0)=@md5={0x1, "d350b3ef95b38da45efba930486ab4a7"}, 0x11, 0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000001700)=0x4) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) acct(&(0x7f0000000040)='./file0\x00') openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'ip6gre0\x00', @link_local}) ioctl$VIDIOC_DQEVENT(r1, 0x80885659, 0x0) 11m16.157960532s ago: executing program 4 (id=395): r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000001c0), 0x2) fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) fchmodat(0xffffffffffffff9c, 0x0, 0xffffff70) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/usbcore/parameters/quirks\x00', 0x42, 0x1b6) pwrite64(r1, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r1, 0x0, 0x0, 0x1fe) pwrite64(r1, &(0x7f0000000340)="4350e70f601a8d149e0b9c475ecae7772ad36f4f21223b7ff314545e0a3ddee6bcea4d4d77392c70554fc3de91ecfa2cc74f395fc2d4cf36cd16e9664e7af56eb0665624d7fd6526f99a70f46bbcf9b036a6824a23296726c78afd5f4123ea5a5dcfde8c4d2d9e5fe8b4df488c1f45e0b1c0c758d4d0250156e395dcbce26fc8f5dec8b4060c90bd79d6da4ef00bd1cc382c082314f46d17415f9ee4869b13a3af5227130085592865f3c5c7addc52fd52f9bb29fdfc2dd6323cc907d4380a54f0ab466f05c1c68ae37e1333867ce02b8236690a3afd3f5dbedf772d5bb4ee2656cfe8b846dbccfe5fda16910dff392129916f9c36586be71a", 0xf9, 0x1e8133) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r2, 0x3ba0, &(0x7f0000000100)={0x48}) r3 = syz_open_dev$loop(&(0x7f0000000040), 0x4000000000000, 0x2) ioctl$LOOP_SET_FD(r3, 0x4c00, r1) ioctl$LOOP_SET_STATUS64(r3, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) openat$tcp_mem(0xffffffffffffff9c, 0x0, 0x8, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$kcm(0x2, 0x3, 0x2) 11m15.400174109s ago: executing program 4 (id=397): getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x3d, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) creat(0x0, 0x182) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r4, &(0x7f0000000240)="8a", 0x1, 0x40440c4, &(0x7f0000000080)={0xa, 0x4e22, 0x2, @dev={0xfe, 0x80, '\x00', 0xe}, 0x6}, 0x1c) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, 0x0) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r6, 0x29, 0x3b, &(0x7f0000000100)=ANY=[], 0x8) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 11m0.07869477s ago: executing program 33 (id=397): getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x3d, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) creat(0x0, 0x182) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r4, &(0x7f0000000240)="8a", 0x1, 0x40440c4, &(0x7f0000000080)={0xa, 0x4e22, 0x2, @dev={0xfe, 0x80, '\x00', 0xe}, 0x6}, 0x1c) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, 0x0) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r6, 0x29, 0x3b, &(0x7f0000000100)=ANY=[], 0x8) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 4m44.384625246s ago: executing program 1 (id=1596): mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./bus\x00', 0x1d8) linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) syz_mount_image$fuse(0x0, &(0x7f0000000240)='./file0\x00', 0x91038, 0x0, 0x4, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file7\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0x0) linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) 4m44.130075833s ago: executing program 1 (id=1598): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000001c0)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) write$tun(r0, &(0x7f0000000340)={@void, @void, @llc={@snap={0x154, 0x0, "01", '\aEW', 0x8906}}}, 0x8) 4m40.921511878s ago: executing program 1 (id=1616): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x4, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_BOOT_CPU_ID(r1, 0xae78, &(0x7f0000000000)=0x1) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xeeee8000, 0xeeee0000, 0xc, 0x1, 0x81, 0x0, 0x0, 0x7}, {0x10000, 0xdddd1000, 0xc, 0xfc, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x5, 0xfc}, {0x3000, 0x8080000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, 0x4}, {0x80a0000, 0xffff1000, 0x4, 0x0, 0x0, 0x8, 0x0, 0x7}, {0x5000, 0xffff1000, 0xf, 0x2, 0xfe, 0x10, 0x3, 0xc, 0x58, 0x9, 0x4}, {0x4000, 0x1000, 0xb, 0x0, 0x0, 0xfd, 0xfc, 0x0, 0x0, 0x5, 0xc0}, {0x3000, 0x100000, 0x10, 0x8, 0x7, 0xfb, 0x0, 0x7, 0x1a, 0x2, 0x0, 0x2}, {0x0, 0x3000, 0xe, 0x2, 0x2, 0x54, 0x7, 0xfd, 0x0, 0x9, 0x7, 0x5}, {0x2000, 0x1}, {}, 0x9df9ffdf, 0x0, 0x0, 0x220, 0x8, 0x8000, 0x2000, [0xdd41, 0x0, 0x2]}) ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f0000001280)={0x0, 0xdddd0000, 0x2, 0x1c, 0x50}) 4m40.647336675s ago: executing program 1 (id=1619): mkdir(&(0x7f0000001a80)='./file0\x00', 0x1cb) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989056, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) mkdir(&(0x7f0000000140)='./file0/../file0\x00', 0x190) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0\x00', 0x0, 0x1fc022, 0x0) mount$bpf(0x200000000000, &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x6000, 0x0) 4m40.4272376s ago: executing program 1 (id=1620): socket$inet_mptcp(0x2, 0x1, 0x106) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000080), 0x1, 0x2) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000380)=@generic={0x0, 0x0, 0x4}, 0x14) r2 = socket$unix(0x1, 0x2, 0x0) timer_create(0x1, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) fsetxattr$security_evm(r2, &(0x7f0000000180), &(0x7f00000001c0)=@md5={0x1, "d350b3ef95b38da45efba930486ab4a7"}, 0x11, 0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000001700)=0x4) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) acct(&(0x7f0000000040)='./file0\x00') openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'ip6gre0\x00', @link_local}) ioctl$VIDIOC_DQEVENT(r1, 0x80885659, 0x0) 4m39.392941105s ago: executing program 1 (id=1626): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) unshare(0x2040400) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x8}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000cc0)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_bpf={{0x8}, {0xc, 0x2, [@TCA_BPF_FD={0x8, 0x6, r0}]}}]}, 0x38}}, 0x0) 4m39.052086832s ago: executing program 34 (id=1626): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) unshare(0x2040400) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x8}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000cc0)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_bpf={{0x8}, {0xc, 0x2, [@TCA_BPF_FD={0x8, 0x6, r0}]}}]}, 0x38}}, 0x0) 4m24.252231301s ago: executing program 5 (id=1682): r0 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet(0x2, 0x80001, 0x84) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00'}, 0x94) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x84, &(0x7f0000000440)={r3, @in={{0x2, 0x4e21, @empty}}, 0xfffc, 0x86}, &(0x7f0000000500)=0x90) 4m22.615236769s ago: executing program 5 (id=1685): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x0, 0x100, 0x1d0, 0xffffffff, 0xffffffff, 0x100, 0x1d0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@frag={{0x30}, {[0x0, 0x3f3], 0x2}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x3d0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000001240)=ANY=[@ANYBLOB="000086dd0000110000000000000060ec97000f98330020010000000000000000000000000002ff020000000000000000000000000001"], 0xfce) 4m21.74730537s ago: executing program 5 (id=1688): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xe, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)=0x2) ioctl$PPPIOCSACTIVE(r0, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) read(r0, 0x0, 0x500) write$ppp(r0, &(0x7f0000002440)='\nr', 0x2) 4m21.003756287s ago: executing program 5 (id=1690): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)='./file0/../file0/file0\x00', 0x0, 0x2a530d1, 0x0) mount$bind(&(0x7f0000000200)='.\x00', &(0x7f0000000500)='./file0/../file0/file0\x00', 0x0, 0x2127099, 0x0) umount2(&(0x7f0000000080)='./file0/../file0/file0\x00', 0x2) 4m20.838314471s ago: executing program 5 (id=1691): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x20b02, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r3, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x841fa2e66efa8cfe) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet_opts(r4, 0x0, 0x6, &(0x7f0000000380), 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) setsockopt$inet6_int(r4, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) sendmmsg$inet6(r4, &(0x7f00000002c0)=[{{&(0x7f0000000400)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffd}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r4, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)=""/29, 0x1d}, 0xfffffffa}], 0x1, 0x12141, 0x0) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000000400)={0xfffffff8, {{0xa, 0x4e21, 0x9, @mcast1, 0x8}}, 0x0, 0x5, [{{0xa, 0x4e21, 0x1, @mcast2, 0x1}}, {{0xa, 0x4e23, 0xd, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x5}}, {{0xa, 0x4e22, 0x5, @loopback, 0x80000000}}, {{0xa, 0x4e23, 0x0, @rand_addr=' \x01\x00', 0x7}}, {{0xa, 0x4e22, 0x2, @dev={0xfe, 0x80, '\x00', 0x41}, 0x100}}]}, 0x310) bind$vsock_stream(0xffffffffffffffff, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x2181) 4m20.517432979s ago: executing program 5 (id=1695): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @local}], 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x1) r1 = dup(r0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000100)={0x4, 0x0, 0xfa00, {0xffffffffffffffff, 0xc068}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000180)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x4}}, 0xffcc) 4m19.775597276s ago: executing program 35 (id=1695): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @local}], 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x1) r1 = dup(r0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000100)={0x4, 0x0, 0xfa00, {0xffffffffffffffff, 0xc068}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000180)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x4}}, 0xffcc) 17.637127319s ago: executing program 2 (id=2517): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) getpgid(0x0) capset(0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="fefffffff70000000000800000000000000000002d66c2a378bce89dd1cff03a6abe9ba752e7a848", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/27], 0x50) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) r3 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$IMGETVERSION(r3, 0x80044942, 0x0) fremovexattr(0xffffffffffffffff, &(0x7f00000003c0)=@known='user.incfs.metadata\x00') 15.943597589s ago: executing program 2 (id=2522): sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) lstat(&(0x7f0000000040)='./my_sys\x00', &(0x7f0000000140)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000140)={0x3, &(0x7f0000000000)=[{0x20, 0x4, 0x0, 0xfffff010}, {0x20, 0x0, 0x0, 0xfffff024}, {0x6, 0x0, 0x0, 0x3}]}, 0x10) sendmmsg(r2, &(0x7f0000001c00), 0x400000000000159, 0x40840) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x2) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x80000, 0x0) mkdir(&(0x7f0000000400)='./my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000800)='1', 0x1) 12.984497908s ago: executing program 2 (id=2533): socket$inet_tcp(0x2, 0x1, 0x0) lsetxattr$system_posix_acl(0x0, &(0x7f0000000080)='system.posix_acl_default\x00', &(0x7f0000000000)={{}, {}, [], {0x2, 0x1}, [{0x8, 0x3}], {0x2, 0x2}, {0x2, 0x7}}, 0x2c, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0)) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/kernel/osrelease\x00', 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00') lseek(r4, 0x10000000005, 0x0) 11.329847426s ago: executing program 2 (id=2535): connect$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000003c0)=0x800000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000000)=0x100000b3, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000000)=0x100000b3, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e24, @empty}, 0x10) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000), 0xf89c53f3af55ddf5, 0x0) write(r1, 0x0, 0x0) mount$bind(0x0, 0x0, &(0x7f0000000380), 0x1488, 0x0) read$msr(r0, &(0x7f0000019680)=""/102384, 0x18ff0) keyctl$dh_compute(0x17, 0x0, 0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x185042, 0x1ef) syz_usb_connect(0x3, 0x1b, &(0x7f0000000240)=ANY=[@ANYBLOB="120110033b5a3d40e11d02c1c36801020301090209"], &(0x7f00000004c0)={0x0, 0x0, 0x5, 0x0}) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c5a00, 0x0) mmap$xdp(&(0x7f0000fee000/0x10000)=nil, 0x10000, 0xc, 0x110, 0xffffffffffffffff, 0x0) 10.814146058s ago: executing program 7 (id=2539): r0 = socket(0xa, 0x3, 0x3a) syz_emit_ethernet(0x5e, &(0x7f0000001900)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "786284", 0x28, 0x0, 0x1, @rand_addr=' \x01\x00', @dev, {[@hopopts={0x2f, 0x4, '\x00', [@calipso={0x7, 0x18, {0x0, 0x4, 0x0, 0xd600, [0x4, 0x0]}}, @generic={0x3, 0x4, "2215fffb"}]}]}}}}}, 0x0) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x8}, 0x809}, {0xa, 0x8, 0x0, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff, 0x8, 0x40]}}, 0x5c) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, 0x0, 0x0) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, 0x0, 0x0) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f00000001c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x4e22, 0x800, @empty}, 0x0, {[0x0, 0x8000, 0x0, 0xfffffffc]}}, 0x5c) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x80801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x54}) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8982, 0x0) openat$sysfs(0xffffff9c, &(0x7f0000000240)='/sys/power/pm_async', 0x80000, 0x2) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000}) r2 = openat$autofs(0xffffff9c, 0x0, 0x6a4902, 0x0) r3 = openat$sysfs(0xffffff9c, 0x0, 0x404000, 0x10) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r2, 0xc0189379, 0x0) bind$alg(r3, 0x0, 0x0) 9.800598912s ago: executing program 7 (id=2540): r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x4, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x3) write$binfmt_script(r0, 0x0, 0x0) execveat(r3, 0x0, 0x0, 0x0, 0x1000) r4 = add_key$user(0x0, 0x0, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) ioctl$IOC_WATCH_QUEUE_SET_SIZE(0xffffffffffffffff, 0x5760, 0x1f) keyctl$KEYCTL_WATCH_KEY(0x20, r4, 0xffffffffffffffff, 0x5b) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000100), &(0x7f00000001c0)=0x8) read$watch_queue(r0, &(0x7f00000002c0)=""/1, 0x1) keyctl$revoke(0x3, r4) ioctl$OCFS2_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046f01, 0x0) fsopen(&(0x7f0000000000)='nfs4\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000002140)=ANY=[]) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x200000000) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) write$vhost_msg_v2(r5, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/116, 0x74, 0x0, 0x1, 0x2}}, 0x48) write(r0, &(0x7f0000000180)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=n', 0x31) 9.647823805s ago: executing program 6 (id=2541): socket$inet6(0xa, 0x1, 0x0) socket$igmp6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) request_key(0x0, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r2, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffff", 0xb) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31) socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r2, &(0x7f0000002940), 0x40000000000017d, 0x811) 7.72341795s ago: executing program 6 (id=2544): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)=[@iv={0x18}], 0x18, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedf", 0x3d}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49", 0xc}], 0x2, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 7.603489993s ago: executing program 7 (id=2545): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x402) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$kcm(0x2, 0xa, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x4000001) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/keys\x00', 0x0, 0x0) read$FUSE(r2, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x15) writev(r3, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x9, 0x5, 0x20ffd}) 7.591595703s ago: executing program 0 (id=2546): socket$inet(0x2, 0x1, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, 0x0) syncfs(r0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc800}, 0x10) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x40400, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f00000003c0)={'pcl818\x00', [0x100, 0x7, 0x1, 0xfffffffe, 0x81, 0x1000, 0x80000, 0x20000004, 0x1, 0x1000a, 0x4, 0xb059, 0x100, 0xb6ac, 0x9, 0xffffffff, 0x20000008, 0x10008, 0xfe9, 0x401, 0x3, 0x8000, 0x4, 0x9, 0x48, 0x1, 0x80, 0x10, 0x81, 0x4000007, 0xff]}) r2 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x42002) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(r3, 0x0, 0x0) r4 = syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000480)='./file2\x00', 0x10445, &(0x7f0000000040)={[{@inlinecrypt}, {@stripe={'stripe', 0x3d, 0xa7}}]}, 0x3, 0x453, &(0x7f00000004c0)="$eJzs3MtvG8UfAPDv2k76/tm/ilcfQKAgKh5Jk5bSAxcQSBxAQoJDOYYkrUrdBjVBolUFAaFyRJW4I45I/AWc4IKAExJXuCJUqUK5tPRktPbacVw7DyeOQ/35SNvO7M5m5uvdsWd24gQwsEbSf5KIvRHxe0QUa9nlBUZq/91evDr1z+LVqSQqlbf+Tqrlbi1enaoXrZ+3p54pReQ+S+JQm3rnLl85P1kuz1zK8mPzF94fm7t85blzFybPzpyduThx6tSJ4+MvnJx4flPiTOO6dfCj2cMHXnvn+htTp6+/+/O3ST3+ljjWJdfxyMhKpz1ZqXRV3Xa1rymdFJaSq5xWKfasRaxFPiLSyzVU7f/FyMfSxSvGq5/2tXFATw2vfHihAtzD0tE8MIjqH/Tp/Le+bcGwY9u4+VJtApTGfTvbakcKjan9UMv8djONRMTphTtfpVts5DkEAMAafZ+Of55tN/7LxQNN5f6XraGUIuL/EbE/Ik5mz4/vj6iWfTAiHmqcsXNN9bcuktw9/snd6Dq4NUjHfy9ma1vLx3+NhZ1SPsvtq8Y/lJw5V545lr0mR2NoR5ofX6GOH1757YtOx5rHf+mW1l8fC2btuFHYsfyc6cn5yY3E3OzmJxEHC+3iTxorAUlEHIiIg13Wce7pbw53OrZ6/L1V+Triqdr1X4iW+OuSplyb9cmxnVGeOTZWvyvu9suv197sVH9z/IU+xJ9e/91t7/9G/KWkeb12bv11XPvj845zmm7v/+Hk7WX7Ppycn780HjGcvF5rdPP+iZZyE0vl0/iPHmnf//fH0itxKCLSm/jhiHgkIh7N2v5YRDweEUdWiP+nl594r/v4eyuNfzoi7mTPA1a//kuJ4WjdkyX+zH5Ytid//sfvllVaWk/86fU/UU0dzfas5f2vbbvaJDb6+gEAAMB/QS4i9kaSG22kc7nR0drv8N8Xu3Pl2bn5Z87MfnBxuvYdgVIM5epPuopNz0PHs2l9PT/Rkj+ePTf+Mr+rmh+dmi1P9zt4GHB7OvT/1F/5frcO6LlCvxsA9I3+D4NL/4fBpf/D4GrT/3f1ox3A1qv2/5Y/1fRxn9oCbK2Wz3/LfjBAzP9hcHXR/71lwD1CZ4aBNLcrVv+SvEQvEsXt0YxuE5HbFs2Q6FGi3+9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAm+PfAAAA//9C4ebg") syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0x820f8, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, &(0x7f0000000000)) ioctl$AUTOFS_IOC_EXPIRE(r4, 0x810c9365, &(0x7f0000002040)={{0xfffffff8, 0x2}, 0x100, './file2\x00'}) ioctl$XFS_IOC_READLINK_BY_HANDLE(0xffffffffffffffff, 0xc038586c, 0x0) 7.386893448s ago: executing program 7 (id=2547): r0 = epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x3e000, 0x1000}, 0x20) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000002d40)=0x1, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_ublk_setup_io_uring(0x155a, &(0x7f0000000500)={0x0, 0xa355, 0x10000, 0x2, 0x15a}, &(0x7f0000000100)=0x0, &(0x7f0000000440)=0x0, &(0x7f00000000c0)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x34, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x5}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newsa={0x144, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in=@multicast1, @in=@broadcast, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in=@multicast2, 0x4d6, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x192, 0xffffffffffffff3a, 0x0, 0x8251c, 0x2, 0xfffffffffffffff8, 0xe2e237c}, {0x9, 0x0, 0x20000001f, 0xfffffffffffffffe}, {0x2, 0xfffffffc, 0xfff}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x8}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @mark={0xc, 0x15, {0x350759, 0x6eb0}}]}, 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r12 = dup(r10) syz_ublk_setup_queues(r12, r9, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x1, 0x255, 0x0, r4}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x6, 0x15e, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000004, 0x142, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x2000, 0x20003, 0x0, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8256, 0x2, 0x3, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x8, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r8, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'netdevsim0\x00', 0x0}) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_RX_RING(r12, 0x11b, 0x2, &(0x7f0000000080)=0x800, 0x4) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0) bind$xdp(r2, &(0x7f00000003c0)={0x2c, 0x18, r13}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1, 0xf, &(0x7f0000000500)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, 0x94) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000000c0)={0xa002803f}) 7.185785263s ago: executing program 0 (id=2548): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) creat(&(0x7f00000000c0)='./tracing/dynamic_events\x00', 0x102) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x2, &(0x7f00000000c0)=0xa) sched_setscheduler(r0, 0x1, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_int(r3, &(0x7f0000000040)='cpuset.memory_spread_slab\x00', 0x2, 0x0) sendfile(r4, r4, 0x0, 0x10000008) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x17, 0x6, 0x401, 0xbf27, 0x701}, 0x50) 4.980270004s ago: executing program 6 (id=2549): r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x4, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x3) write$binfmt_script(r0, 0x0, 0x0) execveat(r3, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r4 = add_key$user(0x0, 0x0, &(0x7f0000000080), 0x0, 0xfffffffffffffffb) ioctl$IOC_WATCH_QUEUE_SET_SIZE(0xffffffffffffffff, 0x5760, 0x1f) keyctl$KEYCTL_WATCH_KEY(0x20, r4, 0xffffffffffffffff, 0x5b) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000100), &(0x7f00000001c0)=0x8) read$watch_queue(r0, &(0x7f00000002c0)=""/1, 0x1) keyctl$revoke(0x3, r4) ioctl$OCFS2_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046f01, 0x0) fsopen(&(0x7f0000000000)='nfs4\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000002140)=ANY=[]) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x200000000) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) write$vhost_msg_v2(r5, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/116, 0x74, 0x0, 0x1, 0x2}}, 0x48) write(r0, &(0x7f0000000180)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=n', 0x31) 4.757074029s ago: executing program 0 (id=2550): r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f00000000c0)=0x81) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) readv(r0, &(0x7f00000006c0)=[{&(0x7f0000002480)=""/4110, 0x48}], 0x1000000000000082) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) mknod$loop(&(0x7f00000002c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x100, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) capget(0x0, 0x0) 4.495247445s ago: executing program 0 (id=2551): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x2}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0x0, 0x7}, {0xfff1, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x44, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x3, 0x1, 0x9, 0x0, 0x8000, 0x3}, {0xd, 0x1, 0x3, 0x461d, 0xb20, 0xff}, 0xa61, 0x2, 0x4e4}}, @TCA_TBF_RATE64={0xc, 0x4, 0x482b771ec8ae0f5e}, @TCA_TBF_PRATE64={0xc, 0x5, 0xbfbfaebe1d121811}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x80}, 0x40) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 4.452999577s ago: executing program 7 (id=2552): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x2, &(0x7f0000000000)=0x80000000000003) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDRV_PCM_IOCTL_STATUS64(0xffffffffffffffff, 0x80984120, 0x0) timer_create(0x2, 0x0, &(0x7f00000006c0)=0x0) timer_settime(r4, 0x0, 0x0, &(0x7f0000000740)) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$netlink(r5, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) 3.567141477s ago: executing program 7 (id=2553): r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x4, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x3) write$binfmt_script(r0, 0x0, 0x0) execveat(r3, 0x0, 0x0, 0x0, 0x1000) r4 = add_key$user(0x0, 0x0, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) ioctl$IOC_WATCH_QUEUE_SET_SIZE(0xffffffffffffffff, 0x5760, 0x1f) keyctl$KEYCTL_WATCH_KEY(0x20, r4, 0xffffffffffffffff, 0x5b) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000100), &(0x7f00000001c0)=0x8) read$watch_queue(r0, &(0x7f00000002c0)=""/1, 0x1) keyctl$revoke(0x3, r4) ioctl$OCFS2_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046f01, 0x0) fsopen(&(0x7f0000000000)='nfs4\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000002140)=ANY=[]) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x200000000) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) write$vhost_msg_v2(r5, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/116, 0x74, 0x0, 0x1, 0x2}}, 0x48) write(r0, &(0x7f0000000180)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=n', 0x31) 3.073419348s ago: executing program 6 (id=2554): openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/shm\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') pipe2(&(0x7f0000001cc0), 0x800) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_tcp(0xa, 0x1, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000340)='./file0\x00', 0x2888004, 0x0, 0x1, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x40000, 0x1) inotify_init1(0x80000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000140), 0x106, 0x2}}, 0x20) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r1, 0x4236}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x2, 0xa}}, 0x20) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 3.034348739s ago: executing program 0 (id=2555): mkdir(0x0, 0x1fc) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/sda\x00', 0x2, 0x0) ioctl$IOC_PR_PREEMPT_ABORT(r2, 0x401870cc, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000300), r3) socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) write(r4, 0x0, 0x0) 2.327297446s ago: executing program 0 (id=2556): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(0xffffffffffffffff, 0x40081271, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, &(0x7f0000000100)=0x7, 0x4) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4c0c8) tkill(0x0, 0xb) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000009b80)={0x40000012}) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r3, 0x560a, &(0x7f00000006c0)={0x4, 0x0, 0x0, 0x0, 0x132, 0x3}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) 1.664399861s ago: executing program 2 (id=2557): syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x1d, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x4c, 0xa, 0x20}, {0x8, 0x10, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000021000000, 0x2, 0x2}, 0xfffffffe, 0x0, 0x0, 0x1, 0x0, 0x3}}, 0xb8}}, 0x4004) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x355, 0xe1, 0x6, 0xfc000004, 0x40403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x4, 0x2, 0x2, 0x7, 0x489, 0x20, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xffe, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10003, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1001005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0xd]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x13, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.609136442s ago: executing program 6 (id=2558): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_ethernet(0x66, &(0x7f00000003c0)={@local, @empty, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "fca33f", 0x30, 0x67, 0x0, @dev, @local, {[@fragment={0x21}, @dstopts={0x0, 0x3, '\x00', [@generic={0x0, 0x17, "58090e541b64f22a8982d3f5aaacd21a0ca186608b74f1"}]}]}}}}}, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000040)=0x46c, 0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000140)="09000000e7001400000000803500008100000088a80000000000504e7c6a59e468", 0x21, 0x4044804, &(0x7f00000001c0)={0x11, 0x88a8, r6, 0x1, 0xc, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x68}}, 0x14) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)=@delrng={0x10, 0x14, 0x1, 0x70bd25, 0x25dfdbfe, "", ["", "", ""]}, 0x10}}, 0x40000) sendmsg$nl_route(r7, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000038c0)=@newlink={0x3c, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x0, 0x1}]}}]}]}, 0x3c}}, 0x0) 7.2796ms ago: executing program 6 (id=2559): r0 = syz_usb_connect(0x3, 0x36, &(0x7f00000003c0)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3", @ANYBLOB], 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000040)='mem\x00\xffEev\xf2r\xf1\x18\x1d\xb9\x00y_hug$\bo-\x03Q`]o\x8cr\x9d_etl\xf9\xdd\a\xad\\H\xe94\b,H\xbf', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)) writev(r1, &(0x7f0000000900)=[{&(0x7f0000000580)="18", 0x1}, {0x0}], 0x2) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x7b345e05922a0178, 0xffffffffffffffff, 0x1dd1c000) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000080)=0xb309) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x5, 0x8, '9P2000.L'}, 0x15) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000000c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x12, &(0x7f0000000000)=@conn_svc_rsp={0x0, 0x0, 0xa, "79caee2e", {0x3, 0x100, 0x0, 0x2, 0x40, 0x9, 0xb}}) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x80) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f00000001c0)={0x1, r2}) write$cgroup_int(r2, 0x0, 0x0) r4 = socket$pppoe(0x18, 0x1, 0x0) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000680), 0x80) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r5, 0xc0505405, &(0x7f00000006c0)={{0x1, 0x1, 0x1ff, 0x3}, 0x9, 0x100000200, 0x32}) connect$pppl2tp(r2, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r4, {0x2, 0x4e20, @multicast1}, 0x2, 0x1, 0x1, 0x2}}, 0x2e) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, &(0x7f00000000c0)=ANY=[]) 0s ago: executing program 2 (id=2560): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/ptype\x00') epoll_create1(0x80000) connect$unix(0xffffffffffffffff, &(0x7f0000000700)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000004a0001002bbd7000ffdbdf350a008000", @ANYRES8=0x0, @ANYBLOB="070040001400010000000000000000002b"], 0x30}, 0x1, 0x0, 0x0, 0xc0}, 0x24000000) recvmmsg(0xffffffffffffffff, &(0x7f0000000a40), 0x3d, 0x22, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) mq_open(&(0x7f0000000100)='\x00', 0x800, 0x5f, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000340)) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r1 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x4}, 0x20) socket$kcm(0x10, 0x2, 0x10) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000680)={0x0, 0x0, 0x0}, 0x0) connect$l2tp6(r1, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x30000000}) sendmmsg$inet6(r1, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0}}], 0x17fd147c801ae9af, 0xff00) kernel console output (not intermixed with test programs): 157][T10176] XFS (loop1): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 586.730253][T10198] gadgetfs: bound to dummy_udc driver [ 587.498784][T10176] XFS (loop1): Ending clean mount [ 587.769990][ T5773] XFS (loop1): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 587.801477][T10212] loop0: detected capacity change from 0 to 64 [ 588.416078][T10219] nvme_fabrics: missing parameter 'transport=%s' [ 588.422497][T10219] nvme_fabrics: missing parameter 'nqn=%s' [ 588.462235][T10225] Process accounting resumed [ 589.568700][T10223] nvme nvme0: failed to connect socket: -512 [ 590.597819][T10222] loop1: detected capacity change from 0 to 40427 [ 590.636896][T10242] tipc: Started in network mode [ 590.641861][T10242] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 590.694226][T10242] tipc: Enabling of bearer rejected, failed to enable media [ 591.151067][T10222] F2FS-fs (loop1): Insane cp_payload (553648128 >= 504) [ 591.494331][T10222] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 591.542633][T10222] F2FS-fs (loop1): invalid crc value [ 591.548097][T10222] F2FS-fs (loop1): Ignore s_resuid=0, s_resgid=65535 w/o reserve_root [ 591.556989][T10222] F2FS-fs (loop1): Failed to start F2FS issue_checkpoint_thread (-4) [ 591.777171][T10249] netlink: 'syz.2.1133': attribute type 3 has an invalid length. [ 591.795457][T10249] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1133'. [ 596.117392][ T5856] usb 6-1: new full-speed USB device number 6 using dummy_hcd [ 596.369630][ T5856] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 596.401525][ T5856] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 596.438560][ T5856] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 596.480057][ T5856] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 596.520117][ T5856] usb 6-1: config 0 descriptor?? [ 596.567965][ T5856] hub 6-1:0.0: USB hub found [ 596.807498][ T5856] hub 6-1:0.0: 1 port detected [ 597.127354][T10287] loop1: detected capacity change from 0 to 40427 [ 597.178558][T10287] F2FS-fs (loop1): invalid crc value [ 597.286464][T10287] F2FS-fs (loop1): Found nat_bits in checkpoint [ 597.813086][ T5856] usb 6-1: USB disconnect, device number 6 [ 597.903919][T10287] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 598.069616][ T5773] syz-executor: attempt to access beyond end of device [ 598.069616][ T5773] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 598.111135][ T5773] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 599.923774][ T5856] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 600.140737][ T5856] usb 6-1: Using ep0 maxpacket: 32 [ 600.167930][ T5856] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 600.183142][ T5856] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 600.203737][ T5856] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 600.222978][ T5856] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 600.251864][ T5856] usb 6-1: config 0 descriptor?? [ 600.275709][ T5856] hub 6-1:0.0: USB hub found [ 600.497997][ T5856] hub 6-1:0.0: config failed, can't read hub descriptor (err -90) [ 600.940001][ T5856] usbhid 6-1:0.0: can't add hid device: -71 [ 600.959824][ T5856] usbhid: probe of 6-1:0.0 failed with error -71 [ 601.374832][ T5856] usb 6-1: USB disconnect, device number 7 [ 601.906877][ T9] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 601.939591][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 601.961754][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 601.972601][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 601.980461][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 601.988892][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 601.996719][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.004565][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.011987][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.029489][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.046966][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.059459][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.069263][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.080357][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.100292][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.137983][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.213278][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.258821][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.316331][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.361171][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.420373][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.468757][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.526712][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.596662][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.622942][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.650928][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 602.677632][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 603.683545][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 603.691511][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 603.701823][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 603.722967][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 603.735411][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 603.741715][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 603.742877][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 603.772855][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 603.786808][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 603.793764][ T9] usb 2-1: device descriptor read/all, error -71 [ 604.006223][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.014295][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.024554][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.033832][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.041272][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.048776][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.056384][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.064142][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.071546][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.766091][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.773545][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.781064][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.793059][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.800648][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.810157][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.819089][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.826901][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.834356][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.841888][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.853537][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.861245][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.871349][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.890340][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.903779][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.923994][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.931420][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.963698][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 604.971144][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.003692][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.011145][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.045286][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.052728][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.075553][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.085555][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.092976][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.123806][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.153684][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.161124][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.204320][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.211764][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.237862][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.252046][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.259841][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.270685][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.290687][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.300495][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.361716][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.408009][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.465521][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.510975][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.564121][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.616655][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.715677][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.823576][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.831092][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.902880][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.941076][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.966125][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 605.993069][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 606.919793][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 606.927661][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 606.935393][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 606.942811][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 606.950610][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 606.963934][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 606.971351][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 607.033797][ T5856] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 607.047814][T10410] capability: warning: `syz.1.1189' uses deprecated v2 capabilities in a way that may be insecure [ 607.091634][ T5856] hid-generic 0000:0000:0004.0001: hidraw0: HID v0.03 Device [syz1] on syz0 [ 607.575904][T10419] fido_id[10419]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 607.690324][ T8] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 611.467920][T10475] loop1: detected capacity change from 0 to 128 [ 611.539980][T10475] FAT-fs (loop1): bogus number of FAT structure [ 611.553648][T10475] FAT-fs (loop1): This doesn't look like a DOS 1.x volume; no bootstrapping code [ 611.567692][T10480] can0: slcan on ttyS3. [ 611.606198][T10475] FAT-fs (loop1): Can't find a valid FAT filesystem [ 611.645384][T10480] can0 (unregistered): slcan off ttyS3. [ 611.899567][T10486] gadgetfs: bound to dummy_udc driver [ 612.788378][T10493] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 613.062256][T10500] kernel read not supported for file /batadv_slave_1» (pid: 10500 comm: syz.0.1220) [ 613.171527][T10502] 9pnet_fd: Insufficient options for proto=fd [ 613.177925][ T27] audit: type=1800 audit(1787632390.686:36): pid=10500 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1220" name=6261746164765F736C6176655F31BB dev="mqueue" ino=22783 res=0 errno=0 [ 615.063283][T10499] loop1: detected capacity change from 0 to 40427 [ 615.088084][T10499] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 615.123889][T10499] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 615.142836][T10499] F2FS-fs (loop1): invalid crc value [ 615.151772][T10509] syz.0.1223 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 615.167266][T10499] F2FS-fs (loop1): Found nat_bits in checkpoint [ 615.350068][T10499] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 615.366065][T10499] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 617.110838][T10556] lo speed is unknown, defaulting to 1000 [ 617.296649][T10561] program syz.1.1232 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 620.009837][T10591] loop5: detected capacity change from 0 to 4096 [ 620.057368][T10591] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 620.173836][ T27] audit: type=1800 audit(1787632397.686:37): pid=10591 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1248" name="file0" dev="loop5" ino=13 res=0 errno=0 [ 620.330606][ T7602] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 621.244376][T10606] nvme_fabrics: missing parameter 'transport=%s' [ 621.251770][T10606] nvme_fabrics: missing parameter 'nqn=%s' [ 621.539209][T10606] nvme nvme0: failed to connect socket: -512 [ 621.549108][ T8] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 621.775656][ T8] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 621.813753][ T8] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 621.861828][ T8] usb 6-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 621.902556][ T8] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 622.031826][T10620] loop1: detected capacity change from 0 to 32768 [ 622.127417][T10620] JBD2: Ignoring recovery information on journal [ 622.194207][T10620] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 622.449744][ T8] wacom 0003:056A:033B.0002: hidraw0: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.5-1/input0 [ 622.477182][ T8] input input7: Absolute device without dev->absinfo, refusing to register [ 622.555805][ T8] wacom: probe of 0003:056A:033B.0002 failed with error -22 [ 622.599815][ T5773] ocfs2: Unmounting device (7,1) on (node local) [ 622.696408][ T5845] usb 6-1: USB disconnect, device number 9 [ 624.624293][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.630721][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.314181][ T5845] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 625.654616][ T5845] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 626.234096][ T5845] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 626.286163][ T5845] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 626.300775][ T5845] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 626.362665][ T5845] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 626.430800][ T5845] usb 2-1: config 0 descriptor?? [ 626.878886][ T5845] plantronics 0003:047F:FFFF.0003: No inputs registered, leaving [ 626.954608][ T5845] plantronics 0003:047F:FFFF.0003: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 627.088577][ T8] usb 2-1: USB disconnect, device number 11 [ 627.204863][T10679] fido_id[10679]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 629.763047][T10713] nvme_fabrics: missing parameter 'transport=%s' [ 629.810979][T10713] nvme_fabrics: missing parameter 'nqn=%s' [ 630.458078][T10720] Invalid ELF header magic: != ELF [ 631.150056][T10713] nvme nvme0: failed to connect socket: -512 [ 631.294901][T10735] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1292'. [ 632.056362][T10729] loop5: detected capacity change from 0 to 40427 [ 632.073947][T10729] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 632.085105][T10729] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 632.136170][T10729] F2FS-fs (loop5): Found nat_bits in checkpoint [ 632.374927][T10729] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 632.403894][T10729] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 632.925045][T10765] bridge0: port 1(bridge_slave_0) entered disabled state [ 633.135887][T10767] netlink: 'syz.0.1304': attribute type 3 has an invalid length. [ 633.150218][T10767] netlink: 'syz.0.1304': attribute type 3 has an invalid length. [ 633.348691][T10771] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1307'. [ 634.051518][T10775] nvme_fabrics: missing parameter 'transport=%s' [ 634.103874][T10775] nvme_fabrics: missing parameter 'nqn=%s' [ 634.374972][T10775] nvme nvme0: failed to connect socket: -111 [ 634.531082][T10797] jffs2: notice: (10797) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 635.751470][T10795] loop0: detected capacity change from 0 to 40427 [ 635.797890][T10795] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 635.818259][T10795] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 635.867446][T10795] F2FS-fs (loop0): Found nat_bits in checkpoint [ 636.020166][T10795] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 636.040192][T10795] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 636.993924][T10821] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1320'. [ 637.980418][T10826] loop0: detected capacity change from 0 to 8192 [ 638.080037][T10826] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 638.224083][T10826] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 638.284230][T10826] REISERFS (device loop0): using ordered data mode [ 638.290780][T10826] reiserfs: using flush barriers [ 638.312570][T10826] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 638.335040][T10826] REISERFS (device loop0): checking transaction log (loop0) [ 638.523828][ T5845] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 638.582674][T10826] REISERFS (device loop0): Using tea hash to sort names [ 638.598788][T10826] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 638.739055][ T5845] usb 6-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 638.760433][ T5845] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 638.782309][ T5845] usb 6-1: Product: syz [ 638.791418][ T5845] usb 6-1: Manufacturer: syz [ 638.799435][ T5845] usb 6-1: SerialNumber: syz [ 638.812753][ T5845] usb 6-1: config 0 descriptor?? [ 639.219246][ T8] usb 6-1: USB disconnect, device number 10 [ 639.228335][T10842] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 639.267847][T10842] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 640.476645][T10852] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1330'. [ 641.923466][T10867] loop0: detected capacity change from 0 to 4096 [ 641.962611][T10867] NILFS (loop0): invalid segment: Checksum error in segment payload [ 641.988162][T10867] NILFS (loop0): trying rollback from an earlier position [ 642.030473][T10867] NILFS (loop0): recovery complete [ 642.044741][T10870] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 642.449963][T10871] NILFS (loop0): nilfs_sufile_do_free: segment 9 is already clean [ 642.761110][T10865] loop5: detected capacity change from 0 to 32768 [ 642.913059][T10865] JBD2: Ignoring recovery information on journal [ 643.057854][T10865] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 643.241461][T10881] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 643.274908][T10881] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 643.417463][T10885] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1343'. [ 643.479746][T10887] loop1: detected capacity change from 0 to 1024 [ 643.490171][ T7602] ocfs2: Unmounting device (7,5) on (node local) [ 643.829211][ T27] audit: type=1804 audit(1787632677.354:38): pid=10890 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1342" name="/newroot/317/file0/bus" dev="loop1" ino=3 res=1 errno=0 [ 644.270768][T10897] FAULT_INJECTION: forcing a failure. [ 644.270768][T10897] name fail_futex, interval 1, probability 0, space 0, times 1 [ 644.315014][T10897] CPU: 1 PID: 10897 Comm: syz.1.1347 Not tainted syzkaller #0 [ 644.322540][T10897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 644.332628][T10897] Call Trace: [ 644.335989][T10897] [ 644.338991][T10897] dump_stack_lvl+0x18c/0x250 [ 644.343872][T10897] ? show_regs_print_info+0x20/0x20 [ 644.349149][T10897] ? load_image+0x420/0x420 [ 644.353700][T10897] ? rcu_is_watching+0x15/0xb0 [ 644.358598][T10897] ? trace_pelt_se_tp+0x39/0x100 [ 644.363596][T10897] should_fail_ex+0x394/0x4c0 [ 644.368335][T10897] get_futex_key+0x136/0x1030 [ 644.373058][T10897] ? futex_setup_timer+0xc0/0xc0 [ 644.378014][T10897] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 644.384028][T10897] ? __lock_acquire+0x7d80/0x7d80 [ 644.389088][T10897] ? lock_chain_count+0x20/0x20 [ 644.393970][T10897] futex_wait_setup+0xbc/0x270 [ 644.398766][T10897] ? futex_wait_multiple+0x920/0x920 [ 644.404077][T10897] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 644.410089][T10897] ? _raw_spin_unlock+0x40/0x40 [ 644.414971][T10897] futex_wait+0x1bc/0x5c0 [ 644.419340][T10897] ? futex_wait_setup+0x270/0x270 [ 644.424406][T10897] ? file_end_write+0x159/0x250 [ 644.429321][T10897] ? vfs_write+0x5de/0x9a0 [ 644.433766][T10897] do_futex+0x2ff/0x3e0 [ 644.437956][T10897] ? __ia32_sys_get_robust_list+0x110/0x110 [ 644.443881][T10897] __se_sys_futex+0x3a9/0x440 [ 644.448586][T10897] ? __x64_sys_futex+0xf0/0xf0 [ 644.453379][T10897] ? __x64_sys_futex+0x21/0xf0 [ 644.458164][T10897] do_syscall_64+0x55/0xb0 [ 644.462604][T10897] ? clear_bhb_loop+0x40/0x90 [ 644.467409][T10897] ? clear_bhb_loop+0x40/0x90 [ 644.472110][T10897] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 644.478040][T10897] RIP: 0033:0x7f3119f9e0d9 [ 644.482531][T10897] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 644.502206][T10897] RSP: 002b:00007f311ae390e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 644.510683][T10897] RAX: ffffffffffffffda RBX: 00007f311a225fa8 RCX: 00007f3119f9e0d9 [ 644.518656][T10897] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f311a225fa8 [ 644.526625][T10897] RBP: 00007f311a225fa0 R08: 0000000000000000 R09: 0000000000000000 [ 644.534601][T10897] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 644.542585][T10897] R13: 00007f311a226038 R14: 00007fff660393f0 R15: 00007fff660394d8 [ 644.550595][T10897] [ 644.745155][T10903] nvme_fabrics: missing parameter 'transport=%s' [ 644.751580][T10903] nvme_fabrics: missing parameter 'nqn=%s' [ 644.917281][T10910] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1351'. [ 645.161644][T10902] nvme nvme0: failed to connect socket: -111 [ 645.505547][T10924] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 645.551265][T10924] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 646.116216][T10937] input: syz1 as /devices/virtual/input/input9 [ 648.297674][T10945] loop1: detected capacity change from 0 to 8192 [ 648.605433][ T5773] FAT-fs (loop1): error, invalid access to FAT (entry 0x0000e1b1) [ 648.624047][ T5773] FAT-fs (loop1): Filesystem has been set read-only [ 650.283789][ T28] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 650.524097][ T28] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 650.539270][ T28] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 650.573758][ T28] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 650.594512][ T28] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 650.838550][ T28] usb 2-1: usb_control_msg returned -32 [ 650.855514][ T28] usbtmc 2-1:16.0: can't read capabilities [ 651.119858][T10974] loop0: detected capacity change from 0 to 32768 [ 651.200258][T10974] XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 651.419942][T10974] XFS (loop0): Ending clean mount [ 651.437493][T10974] XFS (loop0): Quotacheck needed: Please wait. [ 651.521558][T10974] XFS (loop0): Quotacheck: Done. [ 651.837885][ T5770] XFS (loop0): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 653.120486][ T28] usb 2-1: USB disconnect, device number 12 [ 653.355876][T11023] jffs2: notice: (11023) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 653.887861][T11031] loop5: detected capacity change from 0 to 1024 [ 653.954625][ T27] audit: type=1804 audit(1787632687.484:39): pid=11031 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.1389" name="/newroot/198/file0/bus" dev="loop5" ino=3 res=1 errno=0 [ 654.003794][ T5845] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 654.194328][ T5845] usb 2-1: Using ep0 maxpacket: 32 [ 654.232758][ T5845] usb 2-1: config 0 has an invalid interface number: 85 but max is 0 [ 654.243774][ T5845] usb 2-1: config 0 has no interface number 0 [ 654.250239][ T5845] usb 2-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 654.265163][ T5845] usb 2-1: config 0 interface 85 has no altsetting 0 [ 654.281587][ T5845] usb 2-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 654.290969][ T5845] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 654.299336][ T5845] usb 2-1: Product: syz [ 654.303629][ T5845] usb 2-1: Manufacturer: syz [ 654.311276][ T5845] usb 2-1: SerialNumber: syz [ 654.340000][ T5845] usb 2-1: config 0 descriptor?? [ 655.068258][ T5845] appletouch 2-1:0.85: Geyser mode initialized. [ 655.091370][ T5845] input: appletouch as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.85/input/input10 [ 655.338282][ T172] usb 2-1: USB disconnect, device number 13 [ 655.394534][ T172] appletouch 2-1:0.85: input: appletouch disconnected [ 656.033200][T11065] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1402'. [ 656.484950][T11083] Illegal XDP return value 4294967274 on prog (id 89) dev syz_tun, expect packet loss! [ 657.563784][ T28] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 657.774578][ T28] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 657.785291][ T28] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 657.794611][ T28] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 657.829147][ T28] usb 2-1: config 0 descriptor?? [ 657.857930][ T28] pwc: Askey VC010 type 2 USB webcam detected. [ 658.416432][ T28] pwc: recv_control_msg error -32 req 02 val 2b00 [ 658.456574][ T28] pwc: recv_control_msg error -32 req 02 val 2700 [ 658.827655][ T28] pwc: recv_control_msg error -71 req 04 val 1000 [ 658.862639][ T28] pwc: recv_control_msg error -71 req 04 val 1300 [ 658.897266][ T28] pwc: recv_control_msg error -71 req 04 val 1400 [ 658.908701][ T28] pwc: recv_control_msg error -71 req 02 val 2000 [ 658.942492][ T28] pwc: recv_control_msg error -71 req 02 val 2100 [ 658.961549][ T28] pwc: recv_control_msg error -71 req 04 val 1500 [ 659.011503][ T28] pwc: recv_control_msg error -71 req 02 val 2500 [ 659.041777][ T28] pwc: recv_control_msg error -71 req 02 val 2400 [ 659.069065][ T28] pwc: recv_control_msg error -71 req 02 val 2600 [ 659.098317][ T28] pwc: recv_control_msg error -71 req 02 val 2900 [ 659.119042][ T28] pwc: recv_control_msg error -71 req 02 val 2800 [ 659.137149][ T28] pwc: recv_control_msg error -71 req 04 val 1100 [ 659.161678][ T28] pwc: recv_control_msg error -71 req 04 val 1200 [ 659.207507][ T28] pwc: Registered as video103. [ 659.230456][ T28] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input12 [ 659.250599][T11146] input: syz1 as /devices/virtual/input/input11 [ 659.302762][ T28] usb 2-1: USB disconnect, device number 14 [ 659.904219][T11160] loop1: detected capacity change from 0 to 512 [ 660.043487][T11160] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.1437: invalid indirect mapped block 28777 (level 2) [ 660.112928][T11160] EXT4-fs (loop1): 1 truncate cleaned up [ 660.142021][T11160] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 660.767390][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 661.756164][T11186] loop0: detected capacity change from 0 to 32768 [ 661.826627][T11186] XFS (loop0): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 661.919153][T11186] XFS (loop0): Torn write (CRC failure) detected at log block 0x30. Truncating head block from 0x51. [ 662.004611][T11186] XFS (loop0): Starting recovery (logdev: internal) [ 662.095130][T11186] XFS (loop0): Ending recovery (logdev: internal) [ 662.298551][T11186] XFS (loop0): Metadata corruption detected at xfs_btree_lookup_get_block+0x43f/0x660, xfs_bnobt block 0x8 [ 662.325854][T11186] XFS (loop0): Unmount and run xfs_repair [ 662.787603][ T5770] XFS (loop0): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 663.070123][T11227] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1459'. [ 663.687051][T11232] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 663.700533][T11232] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 663.870629][T11237] loop1: detected capacity change from 0 to 512 [ 663.900933][T11237] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.1462: invalid indirect mapped block 28777 (level 2) [ 663.921619][T11237] EXT4-fs (loop1): 1 truncate cleaned up [ 663.928934][T11237] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 664.145530][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 664.410494][T11254] loop0: detected capacity change from 0 to 256 [ 665.088455][T11264] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1470'. [ 665.724800][T11272] loop1: detected capacity change from 0 to 512 [ 665.780971][T11272] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.1473: invalid indirect mapped block 28777 (level 2) [ 665.810955][T11272] EXT4-fs (loop1): 1 truncate cleaned up [ 665.819708][T11272] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 666.147878][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 667.412723][T11311] loop1: detected capacity change from 0 to 512 [ 668.722083][T11311] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.1486: invalid indirect mapped block 28777 (level 2) [ 668.919107][T11311] EXT4-fs (loop1): 1 truncate cleaned up [ 668.950275][T11311] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 669.318085][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 669.830021][T11343] loop5: detected capacity change from 0 to 512 [ 669.842267][T11343] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 669.954027][ T5777] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 670.307878][ T5777] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 670.342178][ T5777] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 670.371960][ T5777] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 670.393506][ T5777] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 670.510926][ T5777] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 670.521986][ T5777] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 670.531486][ T5777] usb 2-1: Product: syz [ 670.552850][ T5777] usb 2-1: Manufacturer: syz [ 670.571022][ T5777] cdc_wdm 2-1:1.0: skipping garbage [ 670.580130][ T5777] cdc_wdm 2-1:1.0: skipping garbage [ 670.595096][ T5777] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 670.603884][ T5777] cdc_wdm 2-1:1.0: Unknown control protocol [ 670.849905][ T5777] usb 2-1: USB disconnect, device number 15 [ 671.121004][T11358] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1502'. [ 671.151626][T11360] loop0: detected capacity change from 0 to 512 [ 671.182227][T11360] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #11: comm syz.0.1503: invalid indirect mapped block 256 (level 2) [ 671.201299][T11360] EXT4-fs (loop0): 2 truncates cleaned up [ 671.210525][T11360] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 671.271843][T11360] EXT4-fs error (device loop0): ext4_validate_block_bitmap:430: comm syz.0.1503: bg 0: block 5: invalid block bitmap [ 671.433702][ T5777] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 671.438206][ T5770] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 671.618521][ T5777] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 671.642501][ T5777] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 671.663266][ T5777] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 671.682577][ T5777] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 671.709592][ T5777] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 671.718936][ T5777] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 671.733714][ T5777] usb 2-1: Product: syz [ 671.743812][ T5777] usb 2-1: Manufacturer: syz [ 671.761840][ T5777] cdc_wdm 2-1:1.0: skipping garbage [ 671.773612][ T5777] cdc_wdm 2-1:1.0: skipping garbage [ 671.780913][ T5777] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 671.787088][ T5777] cdc_wdm 2-1:1.0: Unknown control protocol [ 671.810417][T11361] loop5: detected capacity change from 0 to 40427 [ 671.838813][T11361] F2FS-fs (loop5): invalid crc value [ 671.850447][T11361] F2FS-fs (loop5): Found nat_bits in checkpoint [ 671.942791][T11361] F2FS-fs (loop5): Start checkpoint disabled! [ 671.976389][T11361] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e6 [ 672.191128][T11361] syz.5.1501: attempt to access beyond end of device [ 672.191128][T11361] loop5: rw=10241, sector=45096, nr_sectors = 8 limit=40427 [ 672.776034][ T28] usb 2-1: USB disconnect, device number 16 [ 673.436743][T11401] loop1: detected capacity change from 0 to 1024 [ 673.567587][ T7854] kworker/u4:10: attempt to access beyond end of device [ 673.567587][ T7854] loop5: rw=1, sector=45096, nr_sectors = 8 limit=40427 [ 673.585929][ T5773] hfsplus: node 4:3 still has 1 user(s)! [ 673.607905][ T42] kworker/u4:2: attempt to access beyond end of device [ 673.607905][ T42] loop5: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 673.672253][ T42] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 673.692103][ T42] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 674.741128][T11416] loop1: detected capacity change from 0 to 128 [ 674.787828][T11416] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 674.826729][T11416] ext4 filesystem being mounted at /350/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 674.989602][T11423] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1512'. [ 675.024840][ T5773] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 676.491086][T11444] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 676.515570][T11444] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 676.824015][T11447] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 676.926285][T11438] loop5: detected capacity change from 0 to 32768 [ 676.963143][T11438] XFS (loop5): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 677.073826][T11438] XFS (loop5): Ending clean mount [ 677.375776][T11470] nvme_fabrics: missing parameter 'transport=%s' [ 677.409374][T11474] fuse: Bad value for 'fd' [ 677.445463][T11470] nvme_fabrics: missing parameter 'nqn=%s' [ 678.295928][ T7602] XFS (loop5): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 678.827127][T11470] nvme nvme0: failed to connect socket: -512 [ 680.562292][T11504] loop2: detected capacity change from 0 to 7 [ 680.608163][T11504] Dev loop2: unable to read RDB block 7 [ 680.625144][T11504] loop2: AHDI p1 p2 p3 [ 680.634284][T11504] loop2: partition table partially beyond EOD, truncated [ 680.647633][T11504] loop2: p1 start 1601398130 is beyond EOD, truncated [ 680.663115][T11504] loop2: p2 start 1702059890 is beyond EOD, truncated [ 681.346350][T11516] loop0: detected capacity change from 0 to 64 [ 681.453681][ T23] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 681.462753][ T27] audit: type=1800 audit(1787632714.974:40): pid=11516 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1550" name="bus" dev="loop0" ino=21 res=0 errno=0 [ 681.571554][ T27] audit: type=1804 audit(1787632715.024:41): pid=11516 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1550" name=2F6E6577726F6F742F3338392F131377C5FC35D41454D5D41D29AD1A6029598146E6BE166E41AD0DBD4054033C9F33BBDA8224A2F3D772E7636E48B33CBF708372E8F1B9933EC5127743BE2206209EF02DF9CBF2F6E880D3382F627573 dev="loop0" ino=21 res=1 errno=0 [ 681.744045][ T23] usb 6-1: Using ep0 maxpacket: 16 [ 681.760567][ T23] usb 6-1: config 1 has an invalid interface number: 105 but max is 0 [ 681.777061][ T23] usb 6-1: config 1 has no interface number 0 [ 681.794713][ T28] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 681.813702][ T23] usb 6-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 682.005046][ T28] usb 2-1: not running at top speed; connect to a high speed hub [ 682.083541][ T23] usb 6-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 682.096168][ T28] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 682.134952][ T23] usb 6-1: config 1 interface 105 has no altsetting 0 [ 682.145864][ T28] usb 2-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice= 1.00 [ 682.159341][ T28] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 682.175795][ T23] usb 6-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 682.185365][ T23] usb 6-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 682.205842][ T28] usb 2-1: Product: syz [ 682.210035][ T28] usb 2-1: Manufacturer: syz [ 682.216119][ T23] usb 6-1: Product: syz [ 682.220309][ T23] usb 6-1: Manufacturer: syz [ 682.225508][ T28] usb 2-1: SerialNumber: syz [ 682.230238][ T23] usb 6-1: SerialNumber: syz [ 682.253017][T11514] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 682.257523][ T28] keyspan 2-1:1.0: Keyspan 4 port adapter converter detected [ 682.275900][ T28] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 81 [ 682.278580][T11514] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 682.284830][ T28] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 88 [ 682.309195][ T28] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 1 [ 682.318423][ T28] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 682.332387][ T28] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 2 [ 682.341850][ T28] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 682.351860][ T28] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 4 [ 682.365560][ T28] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 682.375846][ T28] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 6 [ 682.396641][ T28] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 682.763460][T11514] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 682.776959][ T28] usb 2-1: USB disconnect, device number 17 [ 682.789608][ T28] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 682.802231][T11514] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 682.989832][ T28] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 683.009008][ T28] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 683.040082][ T28] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 683.057699][ T28] keyspan 2-1:1.0: device disconnected [ 683.626354][ T23] aqc111 6-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 684.338025][ T23] aqc111 6-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 684.437763][ T23] aqc111 6-1:1.105 eth9: register 'aqc111' at usb-dummy_hcd.5-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, de:1e:6d:82:86:bd [ 684.465397][T11543] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1559'. [ 684.482118][ T23] usb 6-1: USB disconnect, device number 11 [ 684.502845][ T23] aqc111 6-1:1.105 eth9: unregister 'aqc111' usb-dummy_hcd.5-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 684.615512][ T23] aqc111 6-1:1.105 eth9 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 684.643739][ T23] aqc111 6-1:1.105 eth9 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 684.691548][ T23] aqc111 6-1:1.105 eth9 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 685.871275][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.877881][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.216499][T11569] loop1: detected capacity change from 0 to 128 [ 686.249184][T11569] FAT-fs (loop1): Unrecognized mount option "nfs=nostale_rset=macinuit" or missing value [ 686.875696][ T27] audit: type=1804 audit(1787632720.404:42): pid=11569 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1567" name="/newroot/362/file0/file1" dev="overlay" ino=2037 res=1 errno=0 [ 687.161075][T11580] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1570'. [ 689.413699][ T23] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 689.626846][ T23] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 689.649826][ T23] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 689.678802][ T23] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 689.706044][ T23] usb 2-1: config 0 descriptor?? [ 689.941227][ T23] usbhid 2-1:0.0: can't add hid device: -71 [ 689.960050][ T23] usbhid: probe of 2-1:0.0 failed with error -71 [ 689.992445][ T23] usb 2-1: USB disconnect, device number 18 [ 690.273727][ T5843] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 690.356312][T11627] loop0: detected capacity change from 0 to 64 [ 690.411639][ T27] audit: type=1800 audit(1787632723.934:43): pid=11627 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1585" name="file1" dev="loop0" ino=21 res=0 errno=0 [ 690.464758][T11627] syz.0.1585: attempt to access beyond end of device [ 690.464758][T11627] loop0: rw=34817, sector=63, nr_sectors = 8 limit=64 [ 690.495587][ T5843] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 690.507675][ T5843] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 690.523668][ T23] usb 2-1: new full-speed USB device number 19 using dummy_hcd [ 690.530571][ T5843] usb 6-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 690.541805][ T5843] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 690.567834][ T5843] spcp8x5 6-1:1.0: SPCP8x5 converter detected [ 690.620023][ T5843] usb 6-1: SPCP8x5 converter now attached to ttyUSB0 [ 690.712013][ T23] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 690.899876][ T23] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 691.603703][ T23] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 691.667647][ T23] usb 2-1: config 0 descriptor?? [ 691.834378][T11595] SPCP8x5 ttyUSB0: failed to set control lines: -110 [ 691.844352][T11595] SPCP8x5 ttyUSB0: Set UART format 0x30b failed (error = -32) [ 691.891238][T11595] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 691.984538][T11595] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 692.090818][ T23] keytouch 0003:0926:3333.0004: fixing up Keytouch IEC report descriptor [ 692.114217][T11594] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 692.132457][ T23] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0926:3333.0004/input/input13 [ 692.170550][ T5843] usb 6-1: USB disconnect, device number 12 [ 692.200018][ T5843] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 692.228888][ T5843] spcp8x5 6-1:1.0: device disconnected [ 692.409753][ T23] keytouch 0003:0926:3333.0004: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 692.630504][ T5845] usb 2-1: USB disconnect, device number 19 [ 693.073750][ T172] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 693.285148][ T172] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 693.299637][ T172] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 693.321033][ T172] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 693.331798][ T172] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 693.345271][ T172] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 693.354706][ T172] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 693.362721][ T172] usb 6-1: Product: syz [ 693.367536][ T172] usb 6-1: Manufacturer: syz [ 693.385241][ T172] cdc_wdm 6-1:1.0: skipping garbage [ 693.393631][ T172] cdc_wdm 6-1:1.0: skipping garbage [ 693.410176][ T172] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 693.422576][ T172] cdc_wdm 6-1:1.0: Unknown control protocol [ 693.597129][ T172] usb 6-1: USB disconnect, device number 13 [ 693.823509][ T49] nci: nci_rsp_packet: unknown rsp opcode 0x400 [ 693.852162][T11673] Bluetooth: hci0: unsupported parameter 255 [ 693.858479][T11673] Bluetooth: hci0: invalid length 0, exp 2 for type 2 [ 696.586066][T11661] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 698.109101][T11748] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1622'. [ 698.153986][T11748] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1622'. [ 698.196340][T11748] gretap0: entered promiscuous mode [ 698.223747][T11748] gretap0: left promiscuous mode [ 698.272563][T11749] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1622'. [ 698.294503][T11749] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1622'. [ 698.336236][T11749] gretap0: entered promiscuous mode [ 698.350826][T11749] gretap0: left promiscuous mode [ 698.467608][ T11] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 698.648440][ T11] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 698.804847][ T11] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 698.965503][ T11] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.319987][ T11] tipc: Left network mode [ 699.349600][T11764] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 699.442623][ T5784] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 699.470452][ T5784] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 699.487143][ T5779] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 699.517273][ T5779] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 699.525028][ T5779] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 699.532331][ T5779] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 700.590864][T11766] lo speed is unknown, defaulting to 1000 [ 701.631712][ T5782] Bluetooth: hci2: command tx timeout [ 701.873485][ T11] IPVS: stopping master sync thread 10493 ... [ 702.880401][T11816] loop5: detected capacity change from 0 to 40427 [ 702.895383][T11816] F2FS-fs (loop5): Mismatch start address, segment0(0) cp_blkaddr(512) [ 702.904020][T11816] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 702.912974][T11816] F2FS-fs (loop5): build fault injection attr: rate: 10, type: 0x7ffff [ 702.923379][T11816] F2FS-fs (loop5): build fault injection attr: rate: 0, type: 0x3b4 [ 702.941633][T11816] F2FS-fs (loop5): invalid crc value [ 702.953216][T11816] F2FS-fs (loop5): Invalid segment type: 34, segno: 5 [ 702.963491][T11816] F2FS-fs (loop5): Failed to initialize F2FS segment manager (-117) [ 703.120672][T11766] chnl_net:caif_netlink_parms(): no params data found [ 703.703744][ T5782] Bluetooth: hci2: command tx timeout [ 704.807354][ T11] hsr_slave_0: left promiscuous mode [ 704.820208][ T11] hsr_slave_1: left promiscuous mode [ 704.832844][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 704.842855][ T11] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 705.296372][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 705.304977][ T11] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 705.312868][ T11] vlan2: left promiscuous mode [ 705.318046][ T11] dummy0: left promiscuous mode [ 705.323950][ T11] bridge0: port 3(vlan2) entered disabled state [ 705.338043][ T11] bridge_slave_1: left allmulticast mode [ 705.348567][ T11] bridge_slave_1: left promiscuous mode [ 705.360314][ T11] bridge0: port 2(bridge_slave_1) entered disabled state [ 705.368921][ T11] bridge_slave_0: left allmulticast mode [ 705.375432][ T11] bridge_slave_0: left promiscuous mode [ 705.381082][ T11] bridge0: port 1(bridge_slave_0) entered disabled state [ 705.409142][ T11] veth1_macvtap: left promiscuous mode [ 705.414965][ T11] veth0_macvtap: left promiscuous mode [ 705.420573][ T11] veth1_vlan: left promiscuous mode [ 705.426017][ T11] veth0_vlan: left promiscuous mode [ 705.792157][ T5782] Bluetooth: hci2: command tx timeout [ 706.085479][ T11] team0 (unregistering): Port device team_slave_1 removed [ 706.145350][ T11] team0 (unregistering): Port device team_slave_0 removed [ 706.226258][ T11] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 706.299009][ T11] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 706.684449][ T11] bond0 (unregistering): Released all slaves [ 706.855499][T11766] bridge0: port 1(bridge_slave_0) entered blocking state [ 706.904270][T11766] bridge0: port 1(bridge_slave_0) entered disabled state [ 706.911439][T11766] bridge_slave_0: entered allmulticast mode [ 706.930879][T11766] bridge_slave_0: entered promiscuous mode [ 706.968238][T11766] bridge0: port 2(bridge_slave_1) entered blocking state [ 706.981469][T11766] bridge0: port 2(bridge_slave_1) entered disabled state [ 706.989432][T11766] bridge_slave_1: entered allmulticast mode [ 706.996728][T11766] bridge_slave_1: entered promiscuous mode [ 707.103164][T11766] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 707.133331][T11766] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 707.294579][T11766] team0: Port device team_slave_0 added [ 707.335676][T11766] team0: Port device team_slave_1 added [ 707.430629][T11766] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 707.454907][ T11] IPVS: stop unused estimator thread 0... [ 707.460895][T11766] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 707.525437][T11766] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 707.550262][T11766] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 707.558672][T11766] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 707.587243][T11766] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 707.677463][T11766] hsr_slave_0: entered promiscuous mode [ 707.684551][T11766] hsr_slave_1: entered promiscuous mode [ 707.690905][T11766] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 707.700536][T11766] Cannot create hsr debugfs directory [ 707.864026][ T5782] Bluetooth: hci2: command tx timeout [ 708.101593][T11766] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 708.115856][T11766] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 708.138633][T11766] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 708.157762][T11766] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 708.247304][T11873] loop0: detected capacity change from 0 to 32768 [ 708.287080][T11873] JBD2: Ignoring recovery information on journal [ 708.318384][T11766] 8021q: adding VLAN 0 to HW filter on device bond0 [ 708.334028][T11873] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 708.397251][T11766] 8021q: adding VLAN 0 to HW filter on device team0 [ 708.492444][ T7854] bridge0: port 1(bridge_slave_0) entered blocking state [ 708.499675][ T7854] bridge0: port 1(bridge_slave_0) entered forwarding state [ 708.539117][ T7854] bridge0: port 2(bridge_slave_1) entered blocking state [ 708.546338][ T7854] bridge0: port 2(bridge_slave_1) entered forwarding state [ 708.583162][ T27] audit: type=1804 audit(1787632742.104:44): pid=11873 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.1652" name="/newroot/421/file1/file1" dev="loop0" ino=17059 res=1 errno=0 [ 708.761864][ T5770] ocfs2: Unmounting device (7,0) on (node local) [ 709.106135][T11766] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 709.621904][T11766] veth0_vlan: entered promiscuous mode [ 709.655833][T11766] veth1_vlan: entered promiscuous mode [ 709.689153][T11766] veth0_macvtap: entered promiscuous mode [ 709.701799][T11766] veth1_macvtap: entered promiscuous mode [ 709.738543][T11766] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 709.750311][T11766] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 709.770204][T11766] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 709.791939][T11766] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 709.802727][T11766] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 709.815360][T11766] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 709.834579][T11766] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 709.856153][T11766] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 709.873653][T11766] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 709.882372][T11766] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 710.016261][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 710.063666][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 710.114639][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 710.130256][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 710.853825][ T23] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 711.059092][ T23] usb 7-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 711.100144][ T23] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.127463][ T23] usb 7-1: Product: syz [ 711.141984][ T23] usb 7-1: Manufacturer: syz [ 712.167613][ T23] usb 7-1: SerialNumber: syz [ 712.689399][T11951] »»»»»»: renamed from vlan0 (while UP) [ 712.765178][ T23] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -32 [ 712.804179][ T23] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -32 [ 714.876227][ T23] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x0000011c. ret = -71 [ 714.910005][ T23] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 714.956682][ T23] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 715.040930][ T23] lan78xx: probe of 7-1:1.0 failed with error -71 [ 715.096734][ T23] usb 7-1: USB disconnect, device number 2 [ 715.132970][T11990] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 717.397494][ T59] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 717.780250][ T59] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 718.021945][ T59] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 718.470212][ T59] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 720.095493][ T5779] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 720.112807][ T5779] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 720.123125][ T5779] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 720.138590][ T5779] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 720.147785][T12058] nvme_fabrics: missing parameter 'transport=%s' [ 720.154549][ T5779] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 720.305629][ T5779] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 720.682078][T12058] nvme_fabrics: missing parameter 'nqn=%s' [ 720.861765][T12065] lo speed is unknown, defaulting to 1000 [ 721.770929][T12078] nvme nvme0: failed to connect socket: -512 [ 722.504011][ T5782] Bluetooth: hci3: command tx timeout [ 724.058680][T12126] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1718'. [ 724.130656][T12126] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 724.140379][T12126] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 724.149282][T12126] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 724.158050][T12126] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 724.217468][T12128] netlink: 144 bytes leftover after parsing attributes in process `syz.0.1719'. [ 724.250269][T12128] team0: Port device team_slave_0 removed [ 724.256685][T12128] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 724.282949][T12065] chnl_net:caif_netlink_parms(): no params data found [ 724.315808][T12126] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1718'. [ 724.583866][ T5782] Bluetooth: hci3: command tx timeout [ 724.938419][T12065] bridge0: port 1(bridge_slave_0) entered blocking state [ 724.964989][T12065] bridge0: port 1(bridge_slave_0) entered disabled state [ 724.972247][T12065] bridge_slave_0: entered allmulticast mode [ 725.005093][T12065] bridge_slave_0: entered promiscuous mode [ 725.030299][T12065] bridge0: port 2(bridge_slave_1) entered blocking state [ 725.035356][T12146] nvme_fabrics: missing parameter 'transport=%s' [ 725.615442][T12065] bridge0: port 2(bridge_slave_1) entered disabled state [ 725.635605][T12065] bridge_slave_1: entered allmulticast mode [ 725.656319][T12065] bridge_slave_1: entered promiscuous mode [ 725.674074][T12146] nvme_fabrics: missing parameter 'nqn=%s' [ 725.892183][T12146] nvme nvme0: failed to connect socket: -512 [ 725.907204][T12065] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 725.984203][T12065] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 726.119572][ T59] hsr_slave_0: left promiscuous mode [ 726.138763][ T59] hsr_slave_1: left promiscuous mode [ 726.162380][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 726.184785][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 726.212939][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 726.235551][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 726.268440][ T59] bridge_slave_1: left allmulticast mode [ 726.283733][ T59] bridge_slave_1: left promiscuous mode [ 726.296909][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 726.317223][ T59] bridge_slave_0: left allmulticast mode [ 726.322902][ T59] bridge_slave_0: left promiscuous mode [ 726.349171][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 726.447727][ T59] veth1_macvtap: left promiscuous mode [ 726.464034][ T59] veth0_macvtap: left promiscuous mode [ 726.469716][ T59] veth1_vlan: left promiscuous mode [ 726.492616][ T59] veth0_vlan: left promiscuous mode [ 726.659427][T12159] loop6: detected capacity change from 0 to 32768 [ 726.673768][ T5782] Bluetooth: hci3: command tx timeout [ 726.791451][T12159] JBD2: Ignoring recovery information on journal [ 726.891163][T12159] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode. [ 727.116179][ T27] audit: type=1804 audit(1787632760.644:45): pid=12159 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.6.1726" name="/newroot/14/file1/file1" dev="loop6" ino=17059 res=1 errno=0 [ 727.249496][T11766] ocfs2: Unmounting device (7,6) on (node local) [ 727.885400][ T5843] usb 7-1: new full-speed USB device number 3 using dummy_hcd [ 727.899734][ T59] team0 (unregistering): Port device team_slave_1 removed [ 727.951063][ T59] team0 (unregistering): Port device team_slave_0 removed [ 728.002499][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 728.053114][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 728.088011][ T5843] usb 7-1: not running at top speed; connect to a high speed hub [ 728.101560][ T5843] usb 7-1: config 8 has an invalid interface number: 44 but max is 0 [ 728.110432][ T5843] usb 7-1: config 8 has no interface number 0 [ 728.117108][ T5843] usb 7-1: config 8 interface 44 has no altsetting 0 [ 728.128454][ T5843] usb 7-1: string descriptor 0 read error: -22 [ 728.138098][ T5843] usb 7-1: New USB device found, idVendor=0ccd, idProduct=10a1, bcdDevice= a.e0 [ 728.147388][ T5843] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.380458][ T5843] dvb-usb: found a 'Terratec Cinergy DT USB XS Diversity/ T5' in warm state. [ 728.408861][ T5843] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 728.444991][ T5843] dvbdev: DVB: registering new adapter (Terratec Cinergy DT USB XS Diversity/ T5) [ 728.462080][ T5843] usb 7-1: media controller created [ 728.479881][ T5843] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 728.562282][ T59] bond0 (unregistering): Released all slaves [ 728.565772][ T5843] DVB: Unable to find symbol dib7000p_attach() [ 728.592163][ T5843] dvb-usb: no frontend was attached by 'Terratec Cinergy DT USB XS Diversity/ T5' [ 728.602871][ T5843] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 728.612326][ T5843] dvbdev: DVB: registering new adapter (Terratec Cinergy DT USB XS Diversity/ T5) [ 728.624215][ T5843] usb 7-1: media controller created [ 728.633495][ T5843] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 728.683168][ T5843] DVB: Unable to find symbol dib7000p_attach() [ 728.689585][ T5843] dvb-usb: no frontend was attached by 'Terratec Cinergy DT USB XS Diversity/ T5' [ 728.754214][ T5843] rc_core: IR keymap rc-dib0700-rc5 not found [ 728.757815][ T5782] Bluetooth: hci3: command tx timeout [ 728.767226][ T5843] Registered IR keymap rc-empty [ 728.772976][ T5843] dvb-usb: could not initialize remote control. [ 728.788170][T12065] team0: Port device team_slave_0 added [ 728.805072][ T5843] dvb-usb: Terratec Cinergy DT USB XS Diversity/ T5 successfully initialized and connected. [ 728.846130][T12065] team0: Port device team_slave_1 added [ 728.984533][T12065] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 728.991644][T12065] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 729.029477][T12065] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 729.049875][T12065] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 729.057502][T12065] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 729.094771][T12065] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 729.284900][T12065] hsr_slave_0: entered promiscuous mode [ 729.307905][T12065] hsr_slave_1: entered promiscuous mode [ 729.320592][T12065] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 729.473520][T12065] Cannot create hsr debugfs directory [ 729.516094][T12187] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 729.560554][T12187] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 730.401605][T12065] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 730.417867][T12065] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 730.433370][T12065] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 730.461806][T12065] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 730.701549][T12065] 8021q: adding VLAN 0 to HW filter on device bond0 [ 730.713098][ T5843] usb 7-1: USB disconnect, device number 3 [ 730.764397][T12065] 8021q: adding VLAN 0 to HW filter on device team0 [ 730.819532][ T8185] bridge0: port 1(bridge_slave_0) entered blocking state [ 730.826750][ T8185] bridge0: port 1(bridge_slave_0) entered forwarding state [ 730.851535][ T5843] dvb-usb: Terratec Cinergy DT USB XS Diversity/ T successfully deinitialized and disconnected. [ 730.869643][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 730.876807][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 732.203473][T12065] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 733.775864][T12065] veth0_vlan: entered promiscuous mode [ 733.802270][T12065] veth1_vlan: entered promiscuous mode [ 733.853300][T12065] veth0_macvtap: entered promiscuous mode [ 733.869353][T12065] veth1_macvtap: entered promiscuous mode [ 733.893817][T12065] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 733.905065][T12065] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 733.920631][T12065] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 733.936208][T12065] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 733.948013][T12065] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 733.962803][T12065] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 733.976216][T12065] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 733.985286][T12065] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 733.995827][T12065] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 734.007144][T12065] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 734.144218][ T3444] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 734.152796][ T3444] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 734.207338][ T8185] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 734.216185][ T8185] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 734.760553][T12287] loop7: detected capacity change from 0 to 512 [ 734.785793][T12287] FAT-fs (loop7): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 738.286443][T12330] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 740.677701][T12362] syzkaller1: entered promiscuous mode [ 740.683223][T12362] syzkaller1: entered allmulticast mode [ 741.019211][T12378] loop6: detected capacity change from 0 to 1024 [ 741.749455][ T27] audit: type=1326 audit(1787632775.274:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12375 comm="syz.2.1776" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc54039e0d9 code=0x0 [ 741.801142][T11766] hfsplus: node 4:3 still has 1 user(s)! [ 743.498419][T12398] loop0: detected capacity change from 0 to 40427 [ 744.108586][T12398] F2FS-fs (loop0): invalid crc value [ 744.168484][T12398] F2FS-fs (loop0): Found nat_bits in checkpoint [ 744.541611][T12398] F2FS-fs (loop0): Start checkpoint disabled! [ 744.609310][T12398] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 744.745697][ T23] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 744.904424][T12398] syz.0.1780: attempt to access beyond end of device [ 744.904424][T12398] loop0: rw=10241, sector=45096, nr_sectors = 8 limit=40427 [ 744.956760][ T23] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 744.989221][ T23] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 745.032409][ T23] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 745.065500][ T23] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 745.110921][ T23] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 745.142280][ T23] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 745.172770][ T23] usb 7-1: Product: syz [ 745.192803][ T23] usb 7-1: Manufacturer: syz [ 745.247579][ T23] cdc_wdm 7-1:1.0: skipping garbage [ 745.252833][ T23] cdc_wdm 7-1:1.0: skipping garbage [ 745.283785][ T23] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 745.294405][ T23] cdc_wdm 7-1:1.0: Unknown control protocol [ 745.325719][ T59] kworker/u4:4: attempt to access beyond end of device [ 745.325719][ T59] loop0: rw=1, sector=45096, nr_sectors = 8 limit=40427 [ 745.347015][ T59] kworker/u4:4: attempt to access beyond end of device [ 745.347015][ T59] loop0: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 745.364416][ T59] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 745.372793][ T59] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 745.467986][T12194] usb 7-1: USB disconnect, device number 4 [ 746.044058][T12194] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 746.738379][T12458] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 746.790469][T12458] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 746.869407][T12458] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 746.910894][T12458] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 747.829215][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.835995][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.243763][T12194] usb 7-1: device descriptor read/all, error -71 [ 748.306069][T12465] loop6: detected capacity change from 0 to 2048 [ 748.342600][T12465] NILFS (loop6): invalid segment: Magic number mismatch [ 748.373398][T12465] NILFS (loop6): trying rollback from an earlier position [ 748.414424][T12465] NILFS (loop6): recovery complete [ 748.433770][T12466] NILFS (loop6): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 748.485791][ T27] audit: type=1800 audit(1787632782.014:47): pid=12465 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.1798" name="file1" dev="loop6" ino=12 res=0 errno=0 [ 748.998655][T12474] loop0: detected capacity change from 0 to 2048 [ 749.026083][T11766] NILFS (loop6): disposed unprocessed dirty file(s) when stopping log writer [ 749.068984][T12474] UDF-fs: error (device loop0): udf_process_sequence: Primary Volume Descriptor not found! [ 749.147974][T12474] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 749.867818][T12493] loop6: detected capacity change from 0 to 8 [ 750.237125][T12476] loop7: detected capacity change from 0 to 40427 [ 750.294163][T12476] F2FS-fs (loop7): invalid crc value [ 750.314487][T12476] F2FS-fs (loop7): Found nat_bits in checkpoint [ 750.656431][T12476] F2FS-fs (loop7): Start checkpoint disabled! [ 750.707102][T12476] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e6 [ 750.725613][T12500] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1807'. [ 750.945464][T12476] syz.7.1797: attempt to access beyond end of device [ 750.945464][T12476] loop7: rw=10241, sector=45096, nr_sectors = 8 limit=40427 [ 751.014468][T12503] nvme_fabrics: missing parameter 'transport=%s' [ 751.027297][T12503] nvme_fabrics: missing parameter 'nqn=%s' [ 751.169180][T12503] nvme nvme0: failed to connect socket: -111 [ 751.216632][ T42] kworker/u4:2: attempt to access beyond end of device [ 751.216632][ T42] loop7: rw=1, sector=45096, nr_sectors = 8 limit=40427 [ 751.257591][T12253] kworker/u4:6: attempt to access beyond end of device [ 751.257591][T12253] loop7: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 751.290192][T12253] F2FS-fs (loop7): Stopped filesystem due to reason: 3 [ 751.299465][T12253] F2FS-fs (loop7): Stopped filesystem due to reason: 3 [ 751.505739][T12513] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 751.668490][T12522] syzkaller1: entered promiscuous mode [ 751.674610][T12522] syzkaller1: entered allmulticast mode [ 751.846428][T12529] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1815'. [ 751.926660][T12530] nvme_fabrics: missing parameter 'transport=%s' [ 751.933303][T12530] nvme_fabrics: missing parameter 'nqn=%s' [ 752.082219][T12530] nvme nvme0: failed to connect socket: -111 [ 752.578028][T12545] tipc: Started in network mode [ 752.589863][T12545] tipc: Node identity 1, cluster identity 4711 [ 752.615890][T12545] tipc: Node number set to 1 [ 752.633338][T12546] tipc: New replicast peer: 127.0.0.1 [ 752.651410][T12546] tipc: Enabled bearer , priority 10 [ 752.680645][T12545] tipc: Disabling bearer [ 752.922045][T12552] FAULT_INJECTION: forcing a failure. [ 752.922045][T12552] name fail_futex, interval 1, probability 0, space 0, times 0 [ 752.965973][T12552] CPU: 0 PID: 12552 Comm: syz.7.1822 Not tainted syzkaller #0 [ 752.973482][T12552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 752.983544][T12552] Call Trace: [ 752.986819][T12552] [ 752.989745][T12552] dump_stack_lvl+0x18c/0x250 [ 752.994433][T12552] ? show_regs_print_info+0x20/0x20 [ 752.999635][T12552] ? load_image+0x420/0x420 [ 753.004145][T12552] should_fail_ex+0x394/0x4c0 [ 753.008833][T12552] get_futex_key+0x136/0x1030 [ 753.013507][T12552] ? verify_lock_unused+0x140/0x140 [ 753.018717][T12552] ? futex_setup_timer+0xc0/0xc0 [ 753.023665][T12552] futex_wait_setup+0xbc/0x270 [ 753.028447][T12552] ? futex_wait_multiple+0x920/0x920 [ 753.033738][T12552] futex_wait+0x1bc/0x5c0 [ 753.038063][T12552] ? futex_setup_timer+0xc0/0xc0 [ 753.042998][T12552] ? futex_wait_setup+0x270/0x270 [ 753.048030][T12552] ? file_end_write+0x159/0x250 [ 753.052884][T12552] ? vfs_write+0x5de/0x9a0 [ 753.057303][T12552] do_futex+0x2ff/0x3e0 [ 753.061460][T12552] ? __ia32_sys_get_robust_list+0x110/0x110 [ 753.067361][T12552] __se_sys_futex+0x3a9/0x440 [ 753.072037][T12552] ? __x64_sys_futex+0xf0/0xf0 [ 753.076799][T12552] ? __x64_sys_futex+0x21/0xf0 [ 753.081557][T12552] do_syscall_64+0x55/0xb0 [ 753.085975][T12552] ? clear_bhb_loop+0x40/0x90 [ 753.090647][T12552] ? clear_bhb_loop+0x40/0x90 [ 753.095324][T12552] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 753.101213][T12552] RIP: 0033:0x7fd1e299e0d9 [ 753.105628][T12552] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 753.125242][T12552] RSP: 002b:00007fd1e38bb0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 753.133658][T12552] RAX: ffffffffffffffda RBX: 00007fd1e2c25fa8 RCX: 00007fd1e299e0d9 [ 753.141804][T12552] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fd1e2c25fa8 [ 753.149769][T12552] RBP: 00007fd1e2c25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 753.157731][T12552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 753.165779][T12552] R13: 00007fd1e2c26038 R14: 00007ffe6ea79aa0 R15: 00007ffe6ea79b88 [ 753.173768][T12552] [ 753.532574][T12558] nvme_fabrics: missing parameter 'transport=%s' [ 753.547411][T12558] nvme_fabrics: missing parameter 'nqn=%s' [ 753.595021][T12557] team0 (unregistering): Port device team_slave_0 removed [ 753.632592][T12557] team0 (unregistering): Port device team_slave_1 removed [ 753.712320][T12558] nvme nvme0: failed to connect socket: -111 [ 754.690008][T12584] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(3) [ 754.696962][T12584] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 754.712604][T12581] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 754.751128][T12584] vhci_hcd vhci_hcd.0: Device attached [ 754.947894][T12585] vhci_hcd: connection closed [ 754.966688][T12253] vhci_hcd: stop threads [ 754.982488][T12253] vhci_hcd: release socket [ 754.992736][T12253] vhci_hcd: disconnect device [ 755.005448][ T8] usb 45-1: new low-speed USB device number 2 using vhci_hcd [ 755.014127][ T8] usb 45-1: enqueue for inactive port 0 [ 755.103883][ T8] vhci_hcd: vhci_device speed not set [ 757.710652][T12632] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 757.762500][T12632] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 758.157685][T12632] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 758.254115][T12632] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 758.854133][T11917] usb 7-1: new full-speed USB device number 7 using dummy_hcd [ 758.979692][T12658] syzkaller1: entered promiscuous mode [ 758.985763][T12658] syzkaller1: entered allmulticast mode [ 759.075567][T11917] usb 7-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 759.093477][T11917] usb 7-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 759.118124][T11917] usb 7-1: config 0 interface 0 has no altsetting 0 [ 759.127858][T11917] usb 7-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.00 [ 759.144075][T11917] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 759.163006][T11917] usb 7-1: config 0 descriptor?? [ 760.011567][T11917] usbhid 7-1:0.0: can't add hid device: -71 [ 760.032680][T11917] usbhid: probe of 7-1:0.0 failed with error -71 [ 760.047595][T11917] usb 7-1: USB disconnect, device number 7 [ 760.060797][T12682] tipc: Enabled bearer , priority 0 [ 760.081074][T12682] syzkaller0: MTU too low for tipc bearer [ 760.088152][T12682] tipc: Disabling bearer [ 761.331304][T12698] loop7: detected capacity change from 0 to 8192 [ 761.455282][T12710] nvme_fabrics: missing parameter 'transport=%s' [ 761.473638][T12710] nvme_fabrics: missing parameter 'nqn=%s' [ 761.521455][T12715] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1872'. [ 761.583357][T12710] nvme nvme0: failed to connect socket: -111 [ 761.605925][T12715] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1872'. [ 764.011999][T12750] nvme_fabrics: missing parameter 'transport=%s' [ 764.018708][T12750] nvme_fabrics: missing parameter 'nqn=%s' [ 764.762493][T12750] nvme nvme0: failed to connect socket: -512 [ 765.752405][T12785] ªªªªªª: renamed from vlan0 (while UP) [ 767.689519][T12824] loop7: detected capacity change from 0 to 512 [ 767.743473][T12824] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 767.760214][T12824] ext4 filesystem being mounted at /40/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 767.881048][T12824] kvm: pic: level sensitive irq not supported [ 768.829932][T12065] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 769.160355][T12846] binder_alloc: 12845: binder_alloc_buf, no vma [ 769.514809][T12865] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1922'. [ 771.232743][T12887] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 771.284183][T12887] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 773.185806][T12916] gadgetfs: bound to dummy_udc driver [ 778.997436][T12996] lo speed is unknown, defaulting to 1000 [ 781.517578][T13031] gadgetfs: bound to dummy_udc driver [ 781.865789][T13043] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 782.218369][T13052] loop2: detected capacity change from 0 to 7 [ 782.241813][T13052] Dev loop2: unable to read RDB block 7 [ 782.253931][T13052] loop2: unable to read partition table [ 782.262027][T13052] loop2: partition table beyond EOD, truncated [ 782.274396][T13052] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 785.030073][T13088] binder: 13087:13088 ioctl c0306201 0 returned -14 [ 785.090506][T13092] binder: 13087:13092 ioctl c0306201 0 returned -14 [ 787.004305][T13103] loop6: detected capacity change from 0 to 32768 [ 787.040458][T13103] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop6 scanned by syz.6.2003 (13103) [ 787.130038][T13103] BTRFS info (device loop6): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 787.177599][T13103] BTRFS info (device loop6): using blake2b (blake2b-256-generic) checksum algorithm [ 787.220322][T13103] BTRFS info (device loop6): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 787.274749][T13103] BTRFS info (device loop6): use zstd compression, level 3 [ 787.282011][T13103] BTRFS info (device loop6): using free space tree [ 788.620202][T13103] BTRFS info (device loop6): enabling ssd optimizations [ 788.643965][T13103] BTRFS info (device loop6): auto enabling async discard [ 788.788594][ T27] audit: type=1800 audit(1787632822.314:48): pid=13103 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.2003" name="bus" dev="loop6" ino=263 res=0 errno=0 [ 789.159416][T13151] [ 789.302397][T13157] loop5: detected capacity change from 0 to 7 [ 789.318241][T13157] loop5: [ 789.321301][T13157] loop5: partition table partially beyond EOD, truncated [ 789.726837][T11766] BTRFS info (device loop6): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 790.849833][T13188] loop6: detected capacity change from 0 to 64 [ 791.669995][T13200] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 791.725471][T13200] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 792.469848][T13216] loop0: detected capacity change from 0 to 512 [ 792.509108][T13216] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 792.577057][T13216] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 792.641020][T13216] ext4 filesystem being mounted at /511/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 792.700250][T13209] loop7: detected capacity change from 0 to 40427 [ 792.746151][T13209] F2FS-fs (loop7): invalid crc value [ 792.781292][T13209] F2FS-fs (loop7): Found nat_bits in checkpoint [ 792.907457][T13209] F2FS-fs (loop7): Start checkpoint disabled! [ 792.968196][ T5770] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 792.974332][T13209] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e6 [ 793.765520][T12253] kworker/u4:6: attempt to access beyond end of device [ 793.765520][T12253] loop7: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 794.401883][T12253] F2FS-fs (loop7): Stopped filesystem due to reason: 3 [ 794.412258][T12253] F2FS-fs (loop7): Stopped filesystem due to reason: 3 [ 797.891116][T13296] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 797.901298][T13296] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 798.891101][T13307] nvme_fabrics: missing parameter 'transport=%s' [ 798.918074][T13307] nvme_fabrics: missing parameter 'nqn=%s' [ 799.870561][T13307] nvme nvme0: failed to connect socket: -512 [ 800.641365][T13324] gadgetfs: bound to dummy_udc driver [ 800.965296][T13328] loop7: detected capacity change from 0 to 64 [ 804.138471][T13332] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 804.175847][T13361] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 804.410245][T13366] loop6: detected capacity change from 0 to 8192 [ 804.453196][ T27] audit: type=1804 audit(1787632837.974:49): pid=13366 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.6.2078" name="/newroot/101/bus/bus" dev="loop6" ino=1048667 res=1 errno=0 [ 808.029318][T13394] loop7: detected capacity change from 0 to 8192 [ 808.753047][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.759528][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.009118][T13407] CIFS mount error: No usable UNC path provided in device string! [ 809.009118][T13407] [ 809.029767][T13407] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 814.703028][T13454] loop6: detected capacity change from 0 to 32768 [ 814.763188][T13454] XFS (loop6): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 814.853900][T13454] XFS (loop6): Ending clean mount [ 814.878029][T13454] XFS (loop6): Quotacheck needed: Please wait. [ 814.992418][T13454] XFS (loop6): Quotacheck: Done. [ 815.292668][T13454] XFS (loop6): User initiated shutdown received. [ 815.329474][T13454] XFS (loop6): Metadata I/O Error (0x4) detected at xfs_fs_goingdown+0x71/0x150 (fs/xfs/xfs_fsops.c:497). Shutting down filesystem. [ 815.329969][T13495] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 815.355453][T13454] XFS (loop6): Please unmount the filesystem and rectify the problem(s) [ 815.456291][T11766] XFS (loop6): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 815.466878][T13495] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 815.546426][T13498] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 817.492147][T13538] CIFS mount error: No usable UNC path provided in device string! [ 817.492147][T13538] [ 817.507050][T13538] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 817.556693][T13538] loop7: detected capacity change from 0 to 2048 [ 817.598769][T13539] NILFS (loop7): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 817.937797][T13548] loop7: detected capacity change from 0 to 2048 [ 817.982552][T13548] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 818.326529][T12065] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 818.479851][T13560] loop7: detected capacity change from 0 to 512 [ 818.571217][T13560] FAT-fs (loop7): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 818.859122][ T8182] FAT-fs (loop7): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 819.334063][T13575] syzkaller0: entered promiscuous mode [ 819.343588][T13575] syzkaller0: entered allmulticast mode [ 821.508310][T13609] loop7: detected capacity change from 0 to 32768 [ 821.560846][T13609] ocfs2: Slot 0 on device (7,7) was already allocated to this node! [ 821.632010][T13609] JBD2: Ignoring recovery information on journal [ 821.812216][T13609] ocfs2: Mounting device (7,7) on (node local, slot 0) with ordered data mode. [ 821.985225][T13609] ocfs2: Unmounting device (7,7) on (node local) [ 822.373106][T13627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 822.391768][T13627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 822.476294][T13628] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 822.550596][T13628] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 822.624043][T13628] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 823.141149][T13657] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 823.152885][T13657] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 823.228682][T13657] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 823.415729][T13657] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 823.619770][T13657] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 823.708285][T13657] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 823.784633][T13667] loop6: detected capacity change from 0 to 256 [ 823.869507][T13667] FAT-fs (loop6): Unrecognized mount option "shortname=mixe" or missing value [ 823.878994][T13657] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 823.889265][T13657] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 823.921763][T13657] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 824.023182][T13657] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 824.620241][T13688] loop0: detected capacity change from 0 to 8192 [ 824.695236][ T27] audit: type=1804 audit(1787632858.224:50): pid=13688 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.2171" name="/newroot/540/bus/bus" dev="loop0" ino=1048671 res=1 errno=0 [ 825.143567][ T5782] Bluetooth: hci0: command 0x0406 tx timeout [ 825.303617][ T5782] Bluetooth: hci1: command 0x0406 tx timeout [ 825.357904][T13705] mac80211_hwsim hwsim14 wlan0: entered promiscuous mode [ 825.599666][T13711] kvm: vcpu 0: requested 39424 ns lapic timer period limited to 200000 ns [ 825.610713][T13711] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3659427032 (29275416256 ns) > initial count (200000 ns). Using initial count to start timer. [ 825.633818][ T5782] Bluetooth: hci2: command 0x0c1a tx timeout [ 825.944989][ T5782] Bluetooth: hci3: command 0x0c1a tx timeout [ 827.223723][ T5782] Bluetooth: hci0: command 0x0406 tx timeout [ 827.383759][ T5782] Bluetooth: hci1: command 0x0406 tx timeout [ 827.705461][ T5782] Bluetooth: hci2: command 0x0c1a tx timeout [ 828.024287][ T5782] Bluetooth: hci3: command 0x0c1a tx timeout [ 829.013576][T13765] syz_tun: entered allmulticast mode [ 830.066145][ T5782] Bluetooth: hci2: command 0x0c1a tx timeout [ 830.122349][ T5782] Bluetooth: hci3: command 0x0c1a tx timeout [ 831.364932][T13787] loop0: detected capacity change from 0 to 512 [ 831.405645][T13787] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 831.464251][T13787] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2855: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 831.522801][T13787] EXT4-fs (loop0): 1 truncate cleaned up [ 831.543100][T13787] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 831.854766][ T5770] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 834.962909][T13810] loop6: detected capacity change from 0 to 32768 [ 834.964521][T13830] tipc: Cannot configure node identity twice [ 835.031357][T13810] XFS (loop6): DAX unsupported by block device. Turning off DAX. [ 835.043933][T13810] XFS (loop6): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 835.054427][T13810] workqueue: Failed to create a rescuer kthread for wq "xfs-log/loop6": -EINTR [ 835.055499][T13810] XFS (loop6): log mount failed [ 835.724387][ T27] audit: type=1326 audit(1787632869.244:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13850 comm="syz.2.2218" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc54039e0d9 code=0x7ffc0000 [ 835.814056][ T27] audit: type=1326 audit(1787632869.244:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13850 comm="syz.2.2218" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc54039e0d9 code=0x7ffc0000 [ 835.841849][ T27] audit: type=1326 audit(1787632869.254:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13850 comm="syz.2.2218" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc54039e0d9 code=0x7ffc0000 [ 835.890116][ T27] audit: type=1326 audit(1787632869.284:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13850 comm="syz.2.2218" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7fc54039e0d9 code=0x7ffc0000 [ 835.934012][ T27] audit: type=1326 audit(1787632869.294:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13850 comm="syz.2.2218" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc54039e0d9 code=0x7ffc0000 [ 835.958752][ T27] audit: type=1326 audit(1787632869.344:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13850 comm="syz.2.2218" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc54039e0d9 code=0x7ffc0000 [ 836.214854][ T27] audit: type=1326 audit(1787632869.344:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13850 comm="syz.2.2218" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc54035e90e code=0x7ffc0000 [ 836.403699][ T27] audit: type=1326 audit(1787632869.354:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13850 comm="syz.2.2218" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc54035e90e code=0x7ffc0000 [ 836.428017][ T27] audit: type=1326 audit(1787632869.354:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13850 comm="syz.2.2218" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc54035e90e code=0x7ffc0000 [ 836.463354][ T27] audit: type=1326 audit(1787632869.354:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13850 comm="syz.2.2218" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc54035e90e code=0x7ffc0000 [ 836.791645][T13863] nvme_fabrics: missing parameter 'transport=%s' [ 836.818694][T13863] nvme_fabrics: missing parameter 'nqn=%s' [ 836.827364][T13870] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2223'. [ 836.953450][T13863] nvme nvme0: failed to connect socket: -111 [ 843.364370][T13973] loop0: detected capacity change from 0 to 3904 [ 843.433813][T13973] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 843.457687][T13973] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 843.465433][T13975] syzkaller0: entered promiscuous mode [ 843.474894][T13973] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 843.489446][T13973] loop0: [ 843.493630][T13975] syzkaller0: entered allmulticast mode [ 845.698522][T14004] loop6: detected capacity change from 0 to 2048 [ 845.785127][T14004] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 845.866990][T14006] loop0: detected capacity change from 0 to 512 [ 845.962507][ T5763] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 846.272849][T11766] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 849.272535][T14034] syz_tun: entered allmulticast mode [ 849.307970][T14033] syzkaller0: entered promiscuous mode [ 849.328281][T14033] syzkaller0: entered allmulticast mode [ 850.688163][ T27] kauditd_printk_skb: 25 callbacks suppressed [ 850.688179][ T27] audit: type=1804 audit(1787632884.214:86): pid=14056 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.7.2283" name="bus" dev="ramfs" ino=38419 res=1 errno=0 [ 850.789889][ T27] audit: type=1804 audit(1787632884.244:87): pid=14063 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.7.2283" name="bus" dev="ramfs" ino=38419 res=1 errno=0 [ 850.880458][T14066] binder: 14065:14066 ioctl c0306201 200000000240 returned -14 [ 853.892546][T14097] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 853.913329][T14097] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 853.924689][T14097] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 853.934671][T14097] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 855.136892][T14113] loop6: detected capacity change from 0 to 128 [ 855.245305][T14113] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 855.339386][T14113] ext4 filesystem being mounted at /147/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 855.739306][ T27] audit: type=1326 audit(1787632889.264:88): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14119 comm="syz.7.2297" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1e299e0d9 code=0x7ffc0000 [ 855.806727][T14113] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 855.824151][ T27] audit: type=1326 audit(1787632889.264:89): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14119 comm="syz.7.2297" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1e299e0d9 code=0x7ffc0000 [ 855.873881][ T5782] Bluetooth: hci0: command 0x0406 tx timeout [ 855.924296][ T27] audit: type=1326 audit(1787632889.264:90): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14119 comm="syz.7.2297" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1e299e0d9 code=0x7ffc0000 [ 855.957901][ T5779] Bluetooth: hci2: command 0x0c1a tx timeout [ 855.964007][ T5779] Bluetooth: hci1: command 0x0406 tx timeout [ 855.970041][ T5782] Bluetooth: hci3: command 0x0c1a tx timeout [ 855.998549][ T27] audit: type=1326 audit(1787632889.264:91): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14119 comm="syz.7.2297" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7fd1e299e0d9 code=0x7ffc0000 [ 856.024081][ T27] audit: type=1326 audit(1787632889.314:92): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14119 comm="syz.7.2297" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fd1e295e90e code=0x7ffc0000 [ 856.052999][ T27] audit: type=1326 audit(1787632889.324:93): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14119 comm="syz.7.2297" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fd1e295e90e code=0x7ffc0000 [ 856.058688][T14124] fscrypt: loop6: 1 inode(s) still busy after removing key with identifier 69b2f6edeee720cce0577937eb8a6751, including ino 12 [ 856.120869][ T27] audit: type=1326 audit(1787632889.324:94): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14119 comm="syz.7.2297" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fd1e295e90e code=0x7ffc0000 [ 856.175707][ T27] audit: type=1326 audit(1787632889.324:95): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14119 comm="syz.7.2297" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fd1e295e90e code=0x7ffc0000 [ 856.221506][ T27] audit: type=1326 audit(1787632889.324:96): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14119 comm="syz.7.2297" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fd1e295e90e code=0x7ffc0000 [ 856.256944][T11766] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 856.287950][ T27] audit: type=1326 audit(1787632889.324:97): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14119 comm="syz.7.2297" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fd1e295e90e code=0x7ffc0000 [ 859.271244][T14160] nvme_fabrics: missing parameter 'transport=%s' [ 859.330282][T14160] nvme_fabrics: missing parameter 'nqn=%s' [ 859.440031][T14165] nvme_fabrics: missing parameter 'transport=%s' [ 859.466443][T14165] nvme_fabrics: missing parameter 'nqn=%s' [ 859.595569][T14180] tipc: Enabling of bearer rejected, failed to enable media [ 859.686368][T14183] netlink: 'syz.2.2309': attribute type 1 has an invalid length. [ 859.724190][T14183] 8021q: adding VLAN 0 to HW filter on device bond1 [ 859.850077][T14183] veth3: entered allmulticast mode [ 859.861799][T14183] bond1: (slave veth3): Enslaving as an active interface with a down link [ 859.940224][T14186] bond1: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 860.047142][T14183] bond1: entered promiscuous mode [ 860.052797][T14183] bond1: entered allmulticast mode [ 860.743146][T14170] nvme nvme0: failed to connect socket: -512 [ 860.782585][T14162] nvme nvme0: failed to connect socket: -512 [ 861.903969][T14211] tipc: Enabling of bearer rejected, failed to enable media [ 862.050319][T14215] syz_tun: entered allmulticast mode [ 869.702656][T14274] loop0: detected capacity change from 0 to 32768 [ 869.717081][T14274] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz.0.2332 (14274) [ 869.853991][T14274] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 869.865758][T14274] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm [ 869.874554][T14274] BTRFS info (device loop0): using free space tree [ 869.983016][T14274] BTRFS info (device loop0): enabling ssd optimizations [ 869.990086][T14274] BTRFS info (device loop0): auto enabling async discard [ 870.234196][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.249124][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.586007][ T5770] BTRFS info (device loop0): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 872.109934][T14308] nvme_fabrics: missing parameter 'transport=%s' [ 872.122785][T14308] nvme_fabrics: missing parameter 'nqn=%s' [ 872.277459][T14308] nvme nvme0: failed to connect socket: -111 [ 872.679692][T14277] veth1_vlan: left allmulticast mode [ 872.770157][T14277] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 872.779232][T14277] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 872.790735][T14277] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 872.799773][T14277] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 872.906956][T14277] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 872.916294][T14277] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 872.925606][T14277] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 872.934708][T14277] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 872.964512][T14281] netlink: 'syz.7.2335': attribute type 12 has an invalid length. [ 873.159394][T14321] binder_alloc: 14318: pid 14318 spamming oneway? 2 buffers allocated for a total size of 5120 [ 873.174586][T14321] binder_alloc: 14318: pid 14318 spamming oneway? 3 buffers allocated for a total size of 5128 [ 873.382309][T14328] nvme_fabrics: missing parameter 'transport=%s' [ 873.389922][T14328] nvme_fabrics: missing parameter 'nqn=%s' [ 873.509423][T14328] nvme nvme0: failed to connect socket: -111 [ 873.700650][T14330] loop0: detected capacity change from 0 to 32768 [ 873.741283][T14330] XFS (loop0): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 873.795084][T14330] XFS (loop0): Ending clean mount [ 873.821829][T14330] XFS (loop0): Quotacheck needed: Please wait. [ 873.894027][T14330] XFS (loop0): Quotacheck: Done. [ 874.135337][T14344] XFS (loop0): User initiated shutdown received. [ 874.168565][ T5781] loop0: writeback error on inode 4427, offset 0, sector 19200 [ 874.171046][T14344] XFS (loop0): Metadata I/O Error (0x4) detected at xfs_fs_goingdown+0x71/0x150 (fs/xfs/xfs_fsops.c:497). Shutting down filesystem. [ 874.228766][T14344] XFS (loop0): Please unmount the filesystem and rectify the problem(s) [ 874.322786][ T5770] XFS (loop0): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 876.172396][T14351] loop6: detected capacity change from 0 to 32768 [ 876.200826][T14351] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz.6.2346 (14351) [ 876.254730][T14351] BTRFS info (device loop6): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 876.272296][T14351] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm [ 876.296221][T14351] BTRFS info (device loop6): setting nodatasum [ 876.320065][T14351] BTRFS info (device loop6): force zlib compression, level 3 [ 876.348690][T14351] BTRFS info (device loop6): setting incompat feature flag for COMPRESS_LZO (0x8) [ 876.383984][T14351] BTRFS info (device loop6): use lzo compression, level 0 [ 876.407228][T14351] BTRFS info (device loop6): turning on flush-on-commit [ 876.429374][T14351] BTRFS info (device loop6): enabling auto defrag [ 876.452102][T14351] BTRFS info (device loop6): max_inline at 4096 [ 876.476763][T14351] BTRFS info (device loop6): using free space tree [ 876.599637][T14351] BTRFS info (device loop6): enabling ssd optimizations [ 877.923851][T11766] BTRFS info (device loop6): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 878.403791][T14401] nvme_fabrics: missing parameter 'transport=%s' [ 878.432656][T14401] nvme_fabrics: missing parameter 'nqn=%s' [ 878.899506][T14401] nvme nvme0: failed to connect socket: -512 [ 880.704020][T14419] lo speed is unknown, defaulting to 1000 [ 884.680437][T14433] loop6: detected capacity change from 0 to 1024 [ 886.814097][T14449] syzkaller0: entered promiscuous mode [ 886.824643][T14449] syzkaller0: entered allmulticast mode [ 889.333765][T14489] lo speed is unknown, defaulting to 1000 [ 893.274610][T14517] tipc: Enabling of bearer rejected, failed to enable media [ 893.580575][T14524] syzkaller0: entered promiscuous mode [ 893.588288][T14524] syzkaller0: entered allmulticast mode [ 893.599773][T14515] lo speed is unknown, defaulting to 1000 [ 893.868370][T14526] loop6: detected capacity change from 0 to 32768 [ 893.929338][T14526] XFS (loop6): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 894.013723][T14526] XFS (loop6): Ending clean mount [ 894.020910][T14526] XFS (loop6): Quotacheck needed: Please wait. [ 894.162042][T14526] XFS (loop6): Quotacheck: Done. [ 895.099910][T14547] netlink: 'syz.7.2390': attribute type 1 has an invalid length. [ 895.225174][T14547] 8021q: adding VLAN 0 to HW filter on device bond1 [ 895.358018][T14549] veth3: entered allmulticast mode [ 895.366241][T14549] bond1: (slave veth3): Enslaving as an active interface with a down link [ 895.575477][T14547] bond1: (slave veth0_to_bond): making interface the new active one [ 895.599615][T14547] veth0_to_bond: entered promiscuous mode [ 895.612462][T14547] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 895.635535][T14551] bond1: entered promiscuous mode [ 895.664752][T14551] bond1: entered allmulticast mode [ 895.669878][T14551] veth0_to_bond: entered allmulticast mode [ 895.760519][T11766] XFS (loop6): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 896.041922][T14555] syzkaller0: entered promiscuous mode [ 896.056399][T14555] syzkaller0: entered allmulticast mode [ 901.127677][T14600] loop6: detected capacity change from 0 to 512 [ 901.817586][T14600] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 901.832412][T14600] ext4 filesystem being mounted at /172/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 903.586268][T14615] EXT4-fs error (device loop6): ext4_readdir:263: inode #2: block 3: comm syz.6.2408: path (unknown): bad entry in directory: directory entry overrun - offset=0, inode=2, rec_len=2060, size=2048 fake=1 [ 903.657920][T14615] EXT4-fs error (device loop6): ext4_readdir:263: inode #2: block 12: comm syz.6.2408: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=5066064, rec_len=1, size=2048 fake=0 [ 903.924924][T11766] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 907.530801][T14636] netlink: 'syz.6.2411': attribute type 1 has an invalid length. [ 907.565361][T14636] 8021q: adding VLAN 0 to HW filter on device bond1 [ 907.619147][T14636] veth3: entered allmulticast mode [ 907.628454][T14636] bond1: (slave veth3): Enslaving as an active interface with a down link [ 907.677001][T14636] bond1: (slave veth0_to_bond): making interface the new active one [ 907.767172][T14636] veth0_to_bond: entered promiscuous mode [ 907.773413][T14636] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 907.882802][T14643] bond1: entered promiscuous mode [ 907.889705][T14643] bond1: entered allmulticast mode [ 907.896803][T14643] veth0_to_bond: entered allmulticast mode [ 908.534957][T14656] tipc: Enabling of bearer rejected, failed to enable media [ 909.185868][T14659] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2415'. [ 909.307945][T14663] tipc: Started in network mode [ 909.312943][T14663] tipc: Node identity 4a614b81c695, cluster identity 4711 [ 909.320911][T14663] tipc: Enabled bearer , priority 0 [ 909.378228][T14663] syzkaller0: entered promiscuous mode [ 909.394512][T14663] syzkaller0: entered allmulticast mode [ 909.437267][T14663] tipc: Resetting bearer [ 909.454942][T14662] tipc: Resetting bearer [ 910.073799][T14665] netlink: 64 bytes leftover after parsing attributes in process `syz.7.2418'. [ 910.313775][T14669] loop0: detected capacity change from 0 to 1024 [ 910.327809][T14669] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps block group descriptors [ 910.339942][T14662] tipc: Disabling bearer [ 910.357378][T14669] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (491!=20869) [ 910.382887][T14669] EXT4-fs error (device loop0): ext4_get_journal_inode:5820: inode #4: comm syz.0.2420: iget: special inode unallocated [ 910.410834][T14669] EXT4-fs (loop0): no journal found [ 910.530453][T14669] dummy_hcd dummy_hcd.0: remove, state 1 [ 910.538894][T14669] usb usb1: USB disconnect, device number 1 [ 910.545393][T14669] usb 1-1: USB disconnect, device number 4 [ 910.611391][T14669] dummy_hcd dummy_hcd.0: stopped [ 910.616696][T14669] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 912.235508][T14676] loop0: detected capacity change from 0 to 512 [ 912.304743][T14676] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 912.364742][T14676] ext4 filesystem being mounted at /601/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 912.821524][T14681] EXT4-fs error (device loop0): ext4_readdir:263: inode #2: block 3: comm syz.0.2423: path (unknown): bad entry in directory: directory entry overrun - offset=0, inode=2, rec_len=2060, size=2048 fake=1 [ 913.387545][ T5770] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 913.713067][T14694] loop0: detected capacity change from 0 to 512 [ 914.960520][T14694] EXT4-fs: inline encryption not supported [ 915.002872][T14694] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended [ 915.044732][T14694] EXT4-fs error (device loop0): ext4_do_update_inode:5256: inode #15: comm syz.0.2426: corrupted inode contents [ 915.058120][T14694] EXT4-fs (loop0): Remounting filesystem read-only [ 915.066340][T14694] EXT4-fs warning (device loop0): ext4_evict_inode:274: xattr delete (err -5) [ 915.075396][T14694] EXT4-fs (loop0): 1 orphan inode deleted [ 915.081991][T14694] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 915.286847][ T5770] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 915.467890][T14712] bridge0: port 4(macvlan2) entered blocking state [ 915.487357][T14712] bridge0: port 4(macvlan2) entered disabled state [ 915.503657][T14712] macvlan2: entered allmulticast mode [ 915.512286][T14712] ip6gretap0: entered allmulticast mode [ 915.530112][T14712] macvlan2: entered promiscuous mode [ 915.878856][T14719] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2431'. [ 915.890560][T14719] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2431'. [ 919.473181][T14739] lo speed is unknown, defaulting to 1000 [ 919.685786][T14741] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 919.767888][T14741] kvm: pic: non byte read [ 919.774567][T14741] kvm: pic: level sensitive irq not supported [ 919.774638][T14741] kvm: pic: non byte read [ 919.857034][T14741] kvm: pic: level sensitive irq not supported [ 919.883939][T14741] kvm: pic: non byte read [ 919.918282][T14741] kvm: pic: level sensitive irq not supported [ 919.918395][T14741] kvm: pic: non byte read [ 921.210471][T14756] netlink: 'syz.0.2435': attribute type 1 has an invalid length. [ 921.378714][T14756] 8021q: adding VLAN 0 to HW filter on device bond1 [ 921.422729][T14760] veth1: entered allmulticast mode [ 921.432369][T14760] bond1: (slave veth1): Enslaving as an active interface with a down link [ 921.466593][T14762] bond1: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 921.550024][T14765] bond1: entered promiscuous mode [ 921.596497][T14765] bond1: entered allmulticast mode [ 921.703373][T14769] nvme_fabrics: missing parameter 'transport=%s' [ 921.723133][T14769] nvme_fabrics: missing parameter 'nqn=%s' [ 921.790413][T14772] nvme nvme0: failed to connect socket: -111 [ 926.040152][T14808] netlink: 'syz.6.2452': attribute type 1 has an invalid length. [ 926.082552][T14808] 8021q: adding VLAN 0 to HW filter on device bond2 [ 926.129472][T14813] veth5: entered allmulticast mode [ 926.139111][T14813] bond2: (slave veth5): Enslaving as an active interface with a down link [ 926.239465][T14808] bond1: (slave veth0_to_bond): Releasing active interface [ 926.250245][T14808] veth0_to_bond: left allmulticast mode [ 926.257369][T14808] veth0_to_bond: left promiscuous mode [ 926.272942][T14808] bond2: (slave veth0_to_bond): making interface the new active one [ 926.284503][T14808] veth0_to_bond: entered promiscuous mode [ 926.290597][T14808] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 926.312177][T14813] bond2: entered promiscuous mode [ 926.321132][T14813] bond2: entered allmulticast mode [ 926.326749][T14813] veth0_to_bond: entered allmulticast mode [ 926.513876][T14820] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 926.543081][T14820] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 931.633806][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.640150][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 936.993113][ T28] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 937.184040][ T28] usb 7-1: Using ep0 maxpacket: 8 [ 937.199018][ T28] usb 7-1: config 0 has an invalid interface number: 143 but max is 0 [ 937.235480][ T28] usb 7-1: config 0 has no interface number 0 [ 937.258331][ T28] usb 7-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 937.313835][ T28] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 937.329541][ T28] usb 7-1: config 0 descriptor?? [ 937.473729][ T28] viperboard 7-1:0.143: version 0.00 found at bus 007 address 008 [ 937.509335][ T28] viperboard-i2c viperboard-i2c.2.auto: failure setting i2c_bus_freq to 100 [ 937.530659][ T28] viperboard-i2c: probe of viperboard-i2c.2.auto failed with error -5 [ 937.935316][ T5843] usb 7-1: USB disconnect, device number 8 [ 938.151025][T14927] nvme_fabrics: missing parameter 'transport=%s' [ 938.158661][T14927] nvme_fabrics: missing parameter 'nqn=%s' [ 939.471239][T14927] nvme nvme0: failed to connect socket: -512 [ 939.742452][T14946] loop6: detected capacity change from 0 to 512 [ 939.767627][T14946] EXT4-fs: inline encryption not supported [ 939.828101][T14946] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 939.921248][T14946] EXT4-fs (loop6): orphan cleanup on readonly fs [ 939.928034][T14946] EXT4-fs error (device loop6): ext4_orphan_get:1404: comm syz.6.2493: inode #15: comm syz.6.2493: iget: illegal inode # [ 939.951042][T14946] EXT4-fs error (device loop6): ext4_orphan_get:1409: comm syz.6.2493: couldn't read orphan inode 15 (err -117) [ 940.777159][T14946] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 941.044976][T14945] EXT4-fs (loop6): warning: mounting fs with errors, running e2fsck is recommended [ 941.549971][T14945] EXT4-fs (loop6): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 941.870595][T11766] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 944.269219][T14974] netlink: 48 bytes leftover after parsing attributes in process `syz.6.2492'. [ 944.644099][ T8] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 944.872697][ T8] usb 7-1: unable to get BOS descriptor or descriptor too short [ 944.882999][ T8] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 944.907403][ T8] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 944.929116][ T8] usb 7-1: New USB device found, idVendor=1235, idProduct=8010, bcdDevice= 0.40 [ 944.942509][ T8] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 944.950882][ T8] usb 7-1: Product: syz [ 944.955461][ T8] usb 7-1: Manufacturer: syz [ 944.960087][ T8] usb 7-1: SerialNumber: syz [ 946.563857][ T8] usb 7-1: USB disconnect, device number 9 [ 946.686233][ T5765] udevd[5765]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 947.973301][T14999] nvme_fabrics: missing parameter 'transport=%s' [ 947.980050][ T8] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 947.982999][T14999] nvme_fabrics: missing parameter 'nqn=%s' [ 948.323641][ T8] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 948.456737][ T8] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 948.538648][ T8] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 948.554321][ T8] usb 7-1: config 0 descriptor?? [ 948.577807][ T8] pwc: Askey VC010 type 2 USB webcam detected. [ 948.670221][T14999] nvme nvme0: failed to connect socket: -512 [ 949.934559][ T8] pwc: send_video_command error -71 [ 949.939817][ T8] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 949.993647][ T8] Philips webcam: probe of 7-1:0.0 failed with error -71 [ 950.030301][ T8] usb 7-1: USB disconnect, device number 10 [ 955.334091][T15043] nvme_fabrics: missing parameter 'transport=%s' [ 955.340653][T15043] nvme_fabrics: missing parameter 'nqn=%s' [ 955.503006][T15052] overlayfs: failed to clone upperpath [ 956.656850][T15043] nvme nvme0: failed to connect socket: -512 [ 956.733380][T15056] cgroup: noprefix used incorrectly [ 959.203087][T15072] nvme_fabrics: missing parameter 'transport=%s' [ 959.209782][T15072] nvme_fabrics: missing parameter 'nqn=%s' [ 959.322131][T15072] nvme nvme0: failed to connect socket: -111 [ 961.529528][T15101] syz_tun: entered promiscuous mode [ 961.552040][T15101] vlan2: entered promiscuous mode [ 961.808884][T15107] nvme_fabrics: missing parameter 'transport=%s' [ 961.827437][T15107] nvme_fabrics: missing parameter 'nqn=%s' [ 962.355741][T15107] nvme nvme0: failed to connect socket: -512 [ 964.445216][T15147] kAFS: No cell specified [ 966.438491][T15163] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 966.458176][T15163] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 966.583126][T15170] nvme_fabrics: missing parameter 'transport=%s' [ 966.589760][T15170] nvme_fabrics: missing parameter 'nqn=%s' [ 966.612220][T15173] overlayfs: failed to clone lowerpath [ 967.574968][T15170] nvme nvme0: failed to connect socket: -512 [ 969.491489][T15195] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2543'. [ 969.726463][T15195] 8021q: adding VLAN 0 to HW filter on device bond2 [ 969.759824][T15197] 8021q: adding VLAN 0 to HW filter on device bond0 [ 969.788460][T15197] bond2: (slave bond0): Enslaving as an active interface with an up link [ 969.842393][T15198] bond2: entered promiscuous mode [ 969.859814][T15198] bond0: entered promiscuous mode [ 969.872559][T15198] bond_slave_0: entered promiscuous mode [ 969.881836][T15198] bond_slave_1: entered promiscuous mode [ 969.895228][T15198] bond2: entered allmulticast mode [ 969.910826][T15198] bond0: entered allmulticast mode [ 969.920662][T15198] bond_slave_0: entered allmulticast mode [ 969.935569][T15198] bond_slave_1: entered allmulticast mode [ 970.116144][T15204] loop0: detected capacity change from 0 to 512 [ 970.140410][T15204] EXT4-fs: inline encryption not supported [ 970.168016][T15204] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 970.190075][T15204] EXT4-fs (loop0): orphan cleanup on readonly fs [ 970.202345][T15204] EXT4-fs error (device loop0): ext4_orphan_get:1404: comm syz.0.2546: inode #15: comm syz.0.2546: iget: illegal inode # [ 970.217870][T15204] EXT4-fs error (device loop0): ext4_orphan_get:1409: comm syz.0.2546: couldn't read orphan inode 15 (err -117) [ 970.300946][T15204] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 970.357035][T15204] EXT4-fs (loop0): warning: mounting fs with errors, running e2fsck is recommended [ 970.387100][T15204] EXT4-fs (loop0): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 970.438118][ T5770] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 973.027985][T15220] nvme_fabrics: missing parameter 'transport=%s' [ 973.034930][T15220] nvme_fabrics: missing parameter 'nqn=%s' [ 973.189960][T15232] syzkaller0: entered promiscuous mode [ 973.211671][T15232] syzkaller0: entered allmulticast mode [ 974.120844][T15220] nvme nvme0: failed to connect socket: -512 [ 974.165495][T15239] tipc: Enabled bearer , priority 0 [ 974.355803][T15232] tipc: Resetting bearer [ 974.382087][T15231] tipc: Resetting bearer [ 974.444894][T15231] tipc: Disabling bearer [ 977.811874][T15255] ================================================================== [ 977.811890][T15255] BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x1bac/0x25d0 [ 977.812036][T15255] Write of size 4 at addr ffffc90003eb9fc0 by task syz.0.2556/15255 [ 977.812057][T15255] [ 977.812095][T15255] CPU: 1 PID: 15255 Comm: syz.0.2556 Not tainted syzkaller #0 [ 977.812120][T15255] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 977.812133][T15255] Call Trace: [ 977.812141][T15255] [ 977.812150][T15255] dump_stack_lvl+0x18c/0x250 [ 977.812200][T15255] ? sys_imageblit+0x1bac/0x25d0 [ 977.812219][T15255] ? show_regs_print_info+0x20/0x20 [ 977.812242][T15255] ? load_image+0x420/0x420 [ 977.812266][T15255] print_report+0xa8/0x210 [ 977.812286][T15255] ? sys_imageblit+0x1bac/0x25d0 [ 977.812304][T15255] kasan_report+0x117/0x150 [ 977.812330][T15255] ? sys_imageblit+0x1bac/0x25d0 [ 977.812352][T15255] sys_imageblit+0x1bac/0x25d0 [ 977.812413][T15255] ? sys_copyarea+0x2530/0x2530 [ 977.812451][T15255] ? try_to_wake_up+0x6f5/0x10e0 [ 977.812476][T15255] drm_fbdev_generic_defio_imageblit+0x2c/0x110 [ 977.812520][T15255] cw_putcs+0x15f3/0x18a0 [ 977.812577][T15255] ? cw_clear+0x250/0x250 [ 977.812604][T15255] ? drm_fb_helper_set_suspend_unlocked+0x190/0x190 [ 977.812640][T15255] ? fb_get_color_depth+0x162/0x280 [ 977.812663][T15255] fbcon_putcs+0x35c/0x520 [ 977.812688][T15255] ? cw_clear+0x250/0x250 [ 977.812713][T15255] do_update_region+0x4e9/0x640 [ 977.812740][T15255] ? __asan_memcpy+0x40/0x70 [ 977.812776][T15255] ? hide_cursor+0x320/0x320 [ 977.812801][T15255] redraw_screen+0xa30/0x1000 [ 977.812822][T15255] ? _raw_spin_unlock+0x40/0x40 [ 977.812843][T15255] ? clear_buffer_attributes+0x320/0x320 [ 977.812866][T15255] ? tty_do_resize+0xe1/0x120 [ 977.812889][T15255] vc_do_resize+0x1256/0x17f0 [ 977.812919][T15255] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 977.812938][T15255] ? vc_resize+0x50/0x50 [ 977.812963][T15255] vt_resizex+0x3f0/0x5a0 [ 977.812990][T15255] ? vt_disallocate+0x90/0x90 [ 977.813013][T15255] ? security_capable+0x89/0xb0 [ 977.813051][T15255] vt_ioctl+0x125f/0x1f20 [ 977.813078][T15255] ? __vt_event_wait+0x260/0x260 [ 977.813107][T15255] ? __fget_files+0x28/0x460 [ 977.813139][T15255] ? tty_jobctrl_ioctl+0x378/0xba0 [ 977.813161][T15255] tty_ioctl+0x91e/0xdc0 [ 977.813183][T15255] ? tty_get_icount+0xb0/0xb0 [ 977.813205][T15255] __se_sys_ioctl+0xfd/0x170 [ 977.813230][T15255] do_syscall_64+0x55/0xb0 [ 977.813250][T15255] ? clear_bhb_loop+0x40/0x90 [ 977.813273][T15255] ? clear_bhb_loop+0x40/0x90 [ 977.813294][T15255] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 977.813315][T15255] RIP: 0033:0x7f3b5999e0d9 [ 977.813332][T15255] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 977.813349][T15255] RSP: 002b:00007f3b5a8e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 977.813370][T15255] RAX: ffffffffffffffda RBX: 00007f3b59c26090 RCX: 00007f3b5999e0d9 [ 977.813385][T15255] RDX: 00002000000006c0 RSI: 000000000000560a RDI: 0000000000000007 [ 977.813401][T15255] RBP: 00007f3b59a35024 R08: 0000000000000000 R09: 0000000000000000 [ 977.813413][T15255] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 977.813426][T15255] R13: 00007f3b59c26128 R14: 00007f3b59c26090 R15: 00007ffcb20fe9d8 [ 977.813446][T15255] [ 977.813453][T15255] [ 977.813456][T15255] The buggy address belongs to a 0-page vmalloc region starting at 0xffffc90003eba000 allocated at drm_gem_shmem_vmap+0x3c4/0x650 [ 977.813492][T15255] Memory state around the buggy address: [ 977.813502][T15255] ffffc90003eb9e80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 977.813514][T15255] ffffc90003eb9f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 977.813526][T15255] >ffffc90003eb9f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 977.813535][T15255] ^ [ 977.813546][T15255] ffffc90003eba000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 977.813558][T15255] ffffc90003eba080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 977.813567][T15255] ================================================================== [ 977.823146][T15255] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 977.823160][T15255] CPU: 1 PID: 15255 Comm: syz.0.2556 Not tainted syzkaller #0 [ 977.823180][T15255] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 977.823191][T15255] Call Trace: [ 977.823198][T15255] [ 977.823205][T15255] dump_stack_lvl+0x18c/0x250 [ 977.823236][T15255] ? show_regs_print_info+0x20/0x20 [ 977.823257][T15255] ? load_image+0x420/0x420 [ 977.823281][T15255] panic+0x2ca/0x720 [ 977.823308][T15255] ? bpf_jit_dump+0xd0/0xd0 [ 977.823335][T15255] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 977.823355][T15255] ? _raw_spin_unlock+0x40/0x40 [ 977.823372][T15255] ? print_memory_metadata+0x314/0x400 [ 977.823394][T15255] ? sys_imageblit+0x1bac/0x25d0 [ 977.823415][T15255] check_panic_on_warn+0x84/0xa0 [ 977.823437][T15255] ? sys_imageblit+0x1bac/0x25d0 [ 977.823454][T15255] end_report+0x6f/0x130 [ 977.823475][T15255] kasan_report+0x128/0x150 [ 977.823497][T15255] ? sys_imageblit+0x1bac/0x25d0 [ 977.823518][T15255] sys_imageblit+0x1bac/0x25d0 [ 977.823542][T15255] ? sys_copyarea+0x2530/0x2530 [ 977.823563][T15255] ? try_to_wake_up+0x6f5/0x10e0 [ 977.823585][T15255] drm_fbdev_generic_defio_imageblit+0x2c/0x110 [ 977.823611][T15255] cw_putcs+0x15f3/0x18a0 [ 977.823652][T15255] ? cw_clear+0x250/0x250 [ 977.823680][T15255] ? drm_fb_helper_set_suspend_unlocked+0x190/0x190 [ 977.823704][T15255] ? fb_get_color_depth+0x162/0x280 [ 977.823726][T15255] fbcon_putcs+0x35c/0x520 [ 977.823757][T15255] ? cw_clear+0x250/0x250 [ 977.823783][T15255] do_update_region+0x4e9/0x640 [ 977.823803][T15255] ? __asan_memcpy+0x40/0x70 [ 977.823832][T15255] ? hide_cursor+0x320/0x320 [ 977.823857][T15255] redraw_screen+0xa30/0x1000 [ 977.823878][T15255] ? _raw_spin_unlock+0x40/0x40 [ 977.823898][T15255] ? clear_buffer_attributes+0x320/0x320 [ 977.823922][T15255] ? tty_do_resize+0xe1/0x120 [ 977.823946][T15255] vc_do_resize+0x1256/0x17f0 [ 977.823978][T15255] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 977.823998][T15255] ? vc_resize+0x50/0x50 [ 977.824023][T15255] vt_resizex+0x3f0/0x5a0 [ 977.824051][T15255] ? vt_disallocate+0x90/0x90 [ 977.824076][T15255] ? security_capable+0x89/0xb0 [ 977.824101][T15255] vt_ioctl+0x125f/0x1f20 [ 977.824128][T15255] ? __vt_event_wait+0x260/0x260 [ 977.824157][T15255] ? __fget_files+0x28/0x460 [ 977.824184][T15255] ? tty_jobctrl_ioctl+0x378/0xba0 [ 977.824207][T15255] tty_ioctl+0x91e/0xdc0 [ 977.824228][T15255] ? tty_get_icount+0xb0/0xb0 [ 977.824250][T15255] __se_sys_ioctl+0xfd/0x170 [ 977.824275][T15255] do_syscall_64+0x55/0xb0 [ 977.824295][T15255] ? clear_bhb_loop+0x40/0x90 [ 977.824316][T15255] ? clear_bhb_loop+0x40/0x90 [ 977.824338][T15255] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 977.824360][T15255] RIP: 0033:0x7f3b5999e0d9 [ 977.824376][T15255] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 977.824394][T15255] RSP: 002b:00007f3b5a8e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 977.824416][T15255] RAX: ffffffffffffffda RBX: 00007f3b59c26090 RCX: 00007f3b5999e0d9 [ 977.824431][T15255] RDX: 00002000000006c0 RSI: 000000000000560a RDI: 0000000000000007 [ 977.824444][T15255] RBP: 00007f3b59a35024 R08: 0000000000000000 R09: 0000000000000000 [ 977.824457][T15255] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 977.824469][T15255] R13: 00007f3b59c26128 R14: 00007f3b59c26090 R15: 00007ffcb20fe9d8 [ 977.824491][T15255] [ 977.824957][T15255] Kernel Offset: disabled