last executing test programs: 1.490171703s ago: executing program 0 (id=9044): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x31269}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_ICV_LEN={0x5, 0x3, 0x10}]}}}]}, 0x3c}}, 0x0) 1.458128193s ago: executing program 0 (id=9049): r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) fcntl$lock(r0, 0x24, &(0x7f0000000640)={0x1, 0x4, 0xa5, 0x2}) 1.411087665s ago: executing program 0 (id=9052): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="2400000026000100000000000000000008000000", @ANYRES32=r0], 0x24}], 0x1}, 0x800) 1.357378986s ago: executing program 0 (id=9068): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000001f80)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000001ec0)={0x24, 0x1, 0x4, 0x201, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFULA_CFG_CMD={0x5, 0x1, 0x2}, @NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x41}, 0x20040850) 1.331875097s ago: executing program 0 (id=9061): r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000480), 0x8100, 0x0) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, 0x0) 1.279277148s ago: executing program 0 (id=9077): r0 = syz_usb_connect$uac1(0x0, 0x72, &(0x7f0000000480)=ANY=[@ANYBLOB="12015002000000086624108040000102030109026000030100008409040000000101"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) 380.329211ms ago: executing program 4 (id=9158): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@newlink={0x58, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_TOS={0x5, 0x5, 0x80}, @IFLA_IPTUN_TTL={0x5, 0x4, 0x4}]}}}, @IFLA_IFNAME={0x14, 0x3, 'tunl0\x00'}]}, 0x58}}, 0x40820) 338.743302ms ago: executing program 4 (id=9151): r0 = creat(&(0x7f0000000000)='./file0\x00', 0x122) bind$inet(r0, 0x0, 0x0) 315.340533ms ago: executing program 4 (id=9155): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x142, 0x14) write(r0, &(0x7f0000000080)='4', 0x1) 210.623645ms ago: executing program 3 (id=9163): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f00000003c0)={{0x2, 0x4e22, @remote}, {0x1, @local}, 0x6, {0x2, 0x4e20, @empty}, 'veth0_to_bridge\x00'}) 174.718446ms ago: executing program 3 (id=9167): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0) fcntl$lock(r0, 0x24, &(0x7f00000000c0)={0x2, 0x2, 0x9, 0x8}) 163.071196ms ago: executing program 2 (id=9168): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=@newlink={0x48, 0x10, 0x703, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88adfda5, 0x4000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x8100}]}}}, @IFLA_ADDRESS={0xa, 0x1, @local}]}, 0x48}}, 0x8000) 118.641117ms ago: executing program 2 (id=9170): r0 = openat$null(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) faccessat2(r0, &(0x7f0000000000)='\x00', 0x2, 0x1000) 118.523047ms ago: executing program 1 (id=9172): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={0x0, 0xffffdfffffffffff, 0x1000, 0x0, 0x1}, 0x20) 118.203857ms ago: executing program 3 (id=9173): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=@ipv4_newroute={0xec, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x25dfdbfd, {0x2, 0x0, 0x10, 0x4, 0x0, 0x2, 0x0, 0x6, 0x20000000}, [@RTA_NH_ID={0x8, 0x1e, 0x1}, @RTA_NH_ID={0x8, 0x1e, 0xfffffffe}, @RTA_METRICS={0xb7, 0x8, 0x0, 0x1, "788fc07cdf73622f26256787d0124fd0f837307e103923b618ca269ea3a17a441a2553500997841dfa2a45e6392c253f307dba0102024ad318b353ac68fa086304ce9f14f022ef6201dda20aa9ac365c1afbfdbd0cc92898cf0dd6359bcda88ff9be61c6fa76fc72ec0f87e352838e65564b137c65e5871d42d8ba7366beecfcafe22112b700ea3c6ea62afcd38508834c02b8709bfa2ddcb6f3ec19242fc0c3f5c0c40026ebe858f4cbda1c90d74df3067574"}, @RTA_FLOW={0x8, 0xb, 0xe84f}]}, 0xec}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) 117.872567ms ago: executing program 2 (id=9182): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x40240) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000083c0)={{0x3, 0x0, 0x0, 0x0, 0x2}}) 107.327268ms ago: executing program 4 (id=9174): r0 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000340)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) lseek(r0, 0x3, 0x3) 101.832758ms ago: executing program 3 (id=9176): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x32, &(0x7f0000000100)=0x1669e992, 0x4) 88.147858ms ago: executing program 3 (id=9177): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0xc59e}, 0x11) 86.986098ms ago: executing program 2 (id=9178): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000002ac0)=@newtaction={0x85c, 0x30, 0x12f, 0x0, 0x0, {}, [{0x848, 0x1, [@m_police={0x844, 0x1, 0x0, 0x0, {{0xb}, {0x818, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x548, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x240000, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x54c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000]}, @TCA_POLICE_RATE64={0xc, 0x8, 0xfffffffffffffffa}, @TCA_POLICE_RATE={0x65, 0x2, [0x6, 0x8, 0x0, 0x5, 0xffffffff, 0x8e874c7, 0x3, 0x0, 0x5, 0x7, 0x8, 0xac, 0x8, 0x9, 0x7f, 0x18f, 0x5, 0x7, 0x100, 0x101, 0x0, 0xd, 0x5e54d29, 0x0, 0x11c, 0x40, 0xae, 0x80000000, 0x1a8b5010, 0x1, 0x9, 0xb8, 0x2, 0x1, 0x9, 0x6, 0xf73, 0x1, 0x3, 0x3, 0x5, 0xff, 0x80000001, 0x3, 0x6e8, 0xc, 0x0, 0x80, 0x59b5f80f, 0x7, 0x9, 0xa, 0x2, 0x2, 0x8, 0x4, 0x7ff, 0x2, 0x8cd, 0x7, 0xcdd, 0x5, 0x100, 0x5, 0x6, 0x2, 0xe, 0x6, 0x6, 0xffffb31f, 0x3, 0x5, 0x5, 0xc59, 0x3b1cf273, 0x18000000, 0x4, 0x2, 0x6, 0x1000, 0xff, 0xf02, 0x2, 0x3, 0xfff, 0x6, 0x8, 0x2, 0x7, 0x10001, 0x0, 0x3, 0x0, 0x6, 0x5, 0x9, 0x401, 0x7, 0xc8c, 0x2, 0x2, 0x3, 0x7, 0x0, 0x1, 0x8, 0x8, 0x8, 0x8, 0xe0000000, 0x8, 0x8, 0x80000, 0x0, 0x81, 0x8, 0x9, 0x1, 0x5, 0x4, 0x42bc, 0x5, 0x100, 0x3, 0x4, 0x100, 0xf, 0x401, 0x397, 0xeae8, 0x2, 0x6, 0x42, 0x457, 0x7, 0x3, 0x800, 0x5, 0x576, 0x5a, 0x8, 0x8, 0x4, 0xfffffffd, 0x7fff, 0x2, 0x9, 0x5, 0x9, 0x8, 0xa6, 0x2, 0x1ff, 0x8, 0x8cf, 0x1, 0x2, 0x0, 0x1, 0x400, 0xaf6, 0x2, 0x4, 0xfffffffa, 0x2, 0x6, 0x0, 0x3, 0x401, 0x3, 0xb, 0x8, 0x200000, 0x9, 0x9, 0x1, 0x7f, 0x2b2, 0x400, 0xde9, 0x80, 0x5, 0x0, 0x1, 0x4, 0x0, 0x101, 0x3, 0x55, 0x5, 0x3ff, 0x80, 0x5, 0x25f, 0x8, 0xae, 0xe07, 0xa554, 0x75f6, 0x5, 0x0, 0x400, 0xc925, 0xc1, 0xdab9, 0x7fff, 0x51e, 0xa, 0x6, 0xc, 0x7, 0x1, 0x20, 0x1, 0xff, 0x3231, 0x0, 0x9, 0x2, 0x4, 0x80000000, 0x8, 0x1ff, 0x2, 0x8000, 0x6, 0x3, 0xb, 0x9, 0x1ff, 0x8, 0x2, 0xfffffff7, 0x4, 0xffff, 0x3, 0x3, 0xfffffffa, 0xc0000000, 0xc7, 0x6, 0x2e9, 0x2, 0x9, 0x10001, 0x101, 0x5, 0x2, 0x5, 0x9, 0x1, 0x9, 0xa407, 0x15, 0x10000, 0x4]}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x85c}}, 0x0) 86.519718ms ago: executing program 1 (id=9189): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x40240) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000083c0)={{0x3, 0x0, 0x0, 0x0, 0x2}}) 72.833339ms ago: executing program 1 (id=9179): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000080)={0x0, 0x1004000, 0x800}, 0x20) 60.560829ms ago: executing program 3 (id=9180): syz_clone(0x40043080, 0x0, 0x0, &(0x7f00000008c0), 0x0, 0x0) fsopen(&(0x7f0000000340)='configfs\x00', 0x1) 48.566559ms ago: executing program 1 (id=9181): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffff7f}]}) request_key(0x0, 0x0, 0x0, 0x0) 48.182829ms ago: executing program 4 (id=9183): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newtaction={0x4c, 0x1e, 0x109, 0x0, 0x25dfdbfe, {}, [{0x38, 0x1, [@m_mirred={0x34, 0x0, 0x0, 0x0, {{0xb, 0x9}, {0xfffffffffffffe71, 0xe}, {0x6, 0x6, "6ed0"}, {0x21}, {0xc, 0x8, {0x1}}}}]}]}, 0x4c}, 0x1, 0x2b1e}, 0x0) 41.648969ms ago: executing program 2 (id=9184): r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) 37.384239ms ago: executing program 1 (id=9185): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000600)=@newtaction={0x48, 0x76, 0x1, 0xfffffffc, 0x0, {}, [{0x34, 0x1, [@m_police={0x30, 0xd, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4040081}, 0x4) 14.15594ms ago: executing program 2 (id=9186): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x142, 0x14) write(r0, &(0x7f0000000080)='4', 0x1) 601.39µs ago: executing program 1 (id=9187): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=@ipv4_newroute={0xec, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x25dfdbfd, {0x2, 0x0, 0x10, 0x4, 0x0, 0x2, 0x0, 0x6, 0x20000000}, [@RTA_NH_ID={0x8, 0x1e, 0x1}, @RTA_NH_ID={0x8, 0x1e, 0xfffffffe}, @RTA_METRICS={0xb7, 0x8, 0x0, 0x1, "788fc07cdf73622f26256787d0124fd0f837307e103923b618ca269ea3a17a441a2553500997841dfa2a45e6392c253f307dba0102024ad318b353ac68fa086304ce9f14f022ef6201dda20aa9ac365c1afbfdbd0cc92898cf0dd6359bcda88ff9be61c6fa76fc72ec0f87e352838e65564b137c65e5871d42d8ba7366beecfcafe22112b700ea3c6ea62afcd38508834c02b8709bfa2ddcb6f3ec19242fc0c3f5c0c40026ebe858f4cbda1c90d74df3067574"}, @RTA_FLOW={0x8, 0xb, 0xe84f}]}, 0xec}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) 0s ago: executing program 4 (id=9188): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1) kernel console output (not intermixed with test programs): t_TPROXY: Can be used only with -p tcp or -p udp [ 262.793507][ T9750] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 263.012102][ T1160] usb 2-1: new full-speed USB device number 112 using dummy_hcd [ 263.137225][ T9811] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 263.266341][ T9829] loop3: detected capacity change from 0 to 128 [ 263.320710][ T9829] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 263.353290][ T9829] ext4 filesystem being mounted at /951/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 263.412298][ T9829] EXT4-fs warning (device loop3): ext4_dirblock_csum_verify:406: inode #2: comm syz.3.4534: No space for directory leaf checksum. Please run e2fsck -D. [ 263.429142][ T1160] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 263.450709][ T1160] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 263.459635][ T1160] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 263.473944][ T9840] xt_CONNSECMARK: invalid mode: 0 [ 263.493155][ T9829] EXT4-fs error (device loop3): __ext4_find_entry:1696: inode #2: comm syz.3.4534: checksumming directory block 0 [ 263.696256][ T1160] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 263.710907][ T1160] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 263.719169][ T1160] usb 2-1: Product: syz [ 263.731774][ T1160] usb 2-1: Manufacturer: syz [ 263.762546][ T1160] usb 2-1: SerialNumber: syz [ 263.782104][ T9876] bridge0: port 1(bridge_slave_0) entered disabled state [ 263.802547][ T9876] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 263.819651][ T1160] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found [ 263.829661][ T1160] cdc_ncm 2-1:1.0: bind() failure [ 263.962213][ T9898] xt_TCPMSS: Only works on TCP SYN packets [ 264.041530][ T6573] usb 2-1: USB disconnect, device number 112 [ 264.220013][ T1160] usb 1-1: new high-speed USB device number 112 using dummy_hcd [ 264.424514][ T9799] F2FS-fs (loop4): Found nat_bits in checkpoint [ 264.447772][ T9973] IPv6: Can't replace route, no match found [ 264.495389][ T9799] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 264.572793][ T685] usb 4-1: new full-speed USB device number 107 using dummy_hcd [ 264.616609][ T1160] usb 1-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0xCE, skipping [ 264.733645][T10000] netlink: 'syz.2.4617': attribute type 3 has an invalid length. [ 264.808086][ T1160] usb 1-1: New USB device found, idVendor=2a39, idProduct=3fd4, bcdDevice= 0.40 [ 264.825345][ T1160] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.839148][ T1160] usb 1-1: Product: syz [ 264.846352][ T1160] usb 1-1: Manufacturer: syz [ 264.851687][ T1160] usb 1-1: SerialNumber: syz [ 265.011125][ T685] usb 4-1: unable to get BOS descriptor or descriptor too short [ 265.064584][ T685] usb 4-1: not running at top speed; connect to a high speed hub [ 265.134985][T10062] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 265.161456][ T685] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 1023 [ 265.291708][ T1160] usb 1-1: MIDIStreaming interface descriptor not found [ 265.312062][ T1160] usb 1-1: USB disconnect, device number 112 [ 265.334491][ T7485] udevd[7485]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 265.420800][T10112] netlink: 'syz.1.4670': attribute type 13 has an invalid length. [ 265.449478][ T685] usb 4-1: string descriptor 0 read error: -22 [ 265.457624][ T685] usb 4-1: New USB device found, idVendor=249c, idProduct=9008, bcdDevice= 0.40 [ 265.478786][ T685] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 265.502557][T10124] set_capacity_and_notify: 1 callbacks suppressed [ 265.502573][T10124] loop4: detected capacity change from 0 to 1024 [ 265.546308][ T685] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 265.554038][T10139] loop1: detected capacity change from 0 to 256 [ 265.566491][T10124] EXT4-fs (loop4): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 265.579787][T10124] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (38281!=20869) [ 265.598849][T10124] EXT4-fs error (device loop4): ext4_ext_check_inode:501: inode #3: comm syz.4.4676: pblk 0 bad header/extent: too large eh_max - magic f30a, entries 2, max 15(4), depth 0(0) [ 265.617794][T10124] EXT4-fs (loop4): no journal found [ 265.624422][T10124] EXT4-fs (loop4): can't get journal size [ 265.634334][T10124] EXT4-fs error (device loop4): ext4_ext_check_inode:501: inode #3: comm syz.4.4676: pblk 0 bad header/extent: too large eh_max - magic f30a, entries 2, max 15(4), depth 0(0) [ 265.659781][T10124] EXT4-fs (loop4): failed to initialize system zone (-117) [ 265.667413][T10124] EXT4-fs (loop4): mount failed [ 265.753816][T10171] Unsupported ieee802154 address type: 0 [ 265.780943][ T685] usb 4-1: 2:1 : unsupported format bits 0x80 [ 265.789501][T10176] loop4: detected capacity change from 0 to 256 [ 265.823875][ T685] usb 4-1: USB disconnect, device number 107 [ 265.834346][T10179] loop2: detected capacity change from 0 to 256 [ 265.882601][T10191] __nla_validate_parse: 17 callbacks suppressed [ 265.882621][T10191] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4710'. [ 265.898591][T10191] 8021q: VLANs not supported on sit0 [ 265.911571][T10176] FAT-fs (loop4): Invalid FSINFO signature: 0x00fffff8, 0x00000000 (sector = 1) [ 265.946687][ T306] FAT-fs (loop4): Invalid FSINFO signature: 0x00fffff8, 0x00000000 (sector = 1) [ 265.950094][T10200] loop1: detected capacity change from 0 to 256 [ 265.972418][ T30] kauditd_printk_skb: 59 callbacks suppressed [ 265.972434][ T30] audit: type=1326 audit(2000525489.041:340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10203 comm="syz.0.4716" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 266.003675][ T30] audit: type=1326 audit(2000525489.041:341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10203 comm="syz.0.4716" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 266.033708][ T30] audit: type=1326 audit(2000525489.051:342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10203 comm="syz.0.4716" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=204 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 266.064524][ T30] audit: type=1326 audit(2000525489.051:343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10203 comm="syz.0.4716" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 266.092625][ T30] audit: type=1326 audit(2000525489.051:344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10203 comm="syz.0.4716" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 266.181488][T10229] loop0: detected capacity change from 0 to 512 [ 266.188977][T10228] loop4: detected capacity change from 0 to 512 [ 266.197471][T10233] netlink: 'syz.1.4724': attribute type 5 has an invalid length. [ 266.212478][T10233] device ip6erspan0 entered promiscuous mode [ 266.226488][T10228] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:476: comm syz.4.4728: Invalid block bitmap block 0 in block_group 0 [ 266.243294][ T30] audit: type=1400 audit(2000525489.303:345): avc: denied { write } for pid=10238 comm="syz.2.4731" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 266.244089][T10229] EXT4-fs (loop0): orphan cleanup on readonly fs [ 266.283704][T10228] EXT4-fs (loop4): Remounting filesystem read-only [ 266.297024][ T30] audit: type=1400 audit(2000525489.341:346): avc: denied { write } for pid=10241 comm="syz.1.4733" name="ptp0" dev="devtmpfs" ino=260 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 266.310230][T10228] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 266.320202][ T30] audit: type=1400 audit(2000525489.341:347): avc: denied { ioctl } for pid=10241 comm="syz.1.4733" path="/dev/ptp0" dev="devtmpfs" ino=260 ioctlcmd=0x6e8c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 266.354706][T10228] EXT4-fs (loop4): Remounting filesystem read-only [ 266.361857][T10228] EXT4-fs error (device loop4): ext4_clear_blocks:883: inode #13: comm syz.4.4728: attempt to clear invalid blocks 983261 len 1 [ 266.372763][T10229] EXT4-fs warning (device loop0): ext4_enable_quotas:6479: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 266.384458][T10228] EXT4-fs (loop4): Remounting filesystem read-only [ 266.417953][T10229] EXT4-fs (loop0): Cannot turn on quotas: error -22 [ 266.425126][T10229] EXT4-fs error (device loop0): ext4_ext_check_inode:501: inode #13: comm syz.0.4729: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 266.432844][T10228] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.4728: invalid indirect mapped block 2683928664 (level 0) [ 266.443769][T10229] EXT4-fs error (device loop0): ext4_orphan_get:1411: comm syz.0.4729: couldn't read orphan inode 13 (err -117) [ 266.471741][T10229] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 266.530091][ T30] audit: type=1400 audit(2000525489.565:348): avc: denied { remount } for pid=10226 comm="syz.0.4729" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 266.553245][T10228] EXT4-fs (loop4): Remounting filesystem read-only [ 266.553989][T10229] EXT4-fs (loop0): warning: mounting fs with errors, running e2fsck is recommended [ 266.570523][T10228] EXT4-fs error (device loop4): __ext4_get_inode_loc:4365: comm syz.4.4728: Invalid inode table block 0 in block_group 0 [ 266.596211][ T30] audit: type=1326 audit(2000525489.631:349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10276 comm="syz.3.4748" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd0a862c019 code=0x7ffc0000 [ 266.621856][T10229] EXT4-fs warning (device loop0): ext4_enable_quotas:6479: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 266.638069][T10228] EXT4-fs (loop4): Remounting filesystem read-only [ 266.660322][T10228] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5904: Corrupt filesystem [ 266.679549][T10228] EXT4-fs (loop4): Remounting filesystem read-only [ 266.686622][T10228] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 266.705440][T10228] EXT4-fs (loop4): Remounting filesystem read-only [ 266.712690][T10228] EXT4-fs error (device loop4): __ext4_get_inode_loc:4365: comm syz.4.4728: Invalid inode table block 0 in block_group 0 [ 266.772074][T10228] EXT4-fs (loop4): Remounting filesystem read-only [ 266.796205][T10228] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5904: Corrupt filesystem [ 266.797397][T10303] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 266.808919][T10228] EXT4-fs (loop4): Remounting filesystem read-only [ 266.828147][T10228] EXT4-fs error (device loop4): ext4_truncate:4317: inode #13: comm syz.4.4728: mark_inode_dirty error [ 266.846616][T10228] EXT4-fs (loop4): Remounting filesystem read-only [ 266.859171][T10228] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 266.874988][T10228] EXT4-fs (loop4): Remounting filesystem read-only [ 266.882803][T10228] EXT4-fs error (device loop4): __ext4_get_inode_loc:4365: comm syz.4.4728: Invalid inode table block 0 in block_group 0 [ 266.900674][T10228] EXT4-fs (loop4): Remounting filesystem read-only [ 266.912417][T10228] EXT4-fs (loop4): 1 truncate cleaned up [ 266.918371][T10228] EXT4-fs (loop4): mounted filesystem without journal. Opts: noblock_validity,errors=remount-ro,. Quota mode: none. [ 266.998054][T10322] xt_ecn: cannot match TCP bits for non-tcp packets [ 267.042043][ T26] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 267.053470][T10228] EXT4-fs error (device loop4): __ext4_get_inode_loc:4365: comm syz.4.4728: Invalid inode table block 0 in block_group 0 [ 267.072977][T10228] EXT4-fs (loop4): Remounting filesystem read-only [ 267.115160][T10339] loop3: detected capacity change from 0 to 256 [ 267.137330][T10345] bridge2: the hash_elasticity option has been deprecated and is always 16 [ 267.148601][T10345] bridge2: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 267.208488][T10354] loop2: detected capacity change from 0 to 512 [ 267.271211][T10354] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpquota,abort,user_xattr,,errors=continue. Quota mode: writeback. [ 267.285912][T10354] ext4 filesystem being mounted at /989/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 267.311174][T10378] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4795'. [ 267.325985][T10378] device vlan0 entered promiscuous mode [ 267.437600][ T26] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 267.493711][T10399] ip_tables: iptables: counters copy to user failed while replacing table [ 267.565942][ T26] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 267.578076][T10413] netlink: 'syz.2.4813': attribute type 12 has an invalid length. [ 267.597178][ T26] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 267.606107][ T26] usb 2-1: SerialNumber: syz [ 267.634516][T10418] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4814'. [ 267.819124][T10441] xt_hashlimit: max too large, truncated to 1048576 [ 267.842237][T10430] loop2: detected capacity change from 0 to 16 [ 267.929106][T10430] erofs: (device loop2): EXPERIMENTAL big pcluster feature in use. Use at your own risk! [ 267.966691][T10430] erofs: (device loop2): z_erofs_load_lzma_config: lzma algorithm isn't enabled [ 267.995832][T10456] device veth1_macvtap left promiscuous mode [ 268.102302][ T26] cdc_ether: probe of 2-1:1.0 failed with error -71 [ 268.116511][ T26] usb 2-1: USB disconnect, device number 113 [ 268.318726][T10488] netlink: 'syz.0.4850': attribute type 32 has an invalid length. [ 268.335558][T10488] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4850'. [ 268.345302][T10492] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4861'. [ 268.386349][T10492] bridge0: port 2(bridge_slave_1) entered disabled state [ 268.393653][T10492] bridge0: port 1(bridge_slave_0) entered disabled state [ 268.427700][T10496] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 268.459218][T10496] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 268.475297][T10500] xt_TCPMSS: Only works on TCP SYN packets [ 268.514192][T10506] netlink: 'syz.4.4858': attribute type 3 has an invalid length. [ 268.820993][T10557] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4885'. [ 268.856388][T10567] Zero length message leads to an empty skb [ 268.873133][T10557] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4885'. [ 268.947926][T10577] IPv6: NLM_F_CREATE should be specified when creating new route [ 268.979607][T10586] netlink: 'syz.3.4898': attribute type 30 has an invalid length. [ 269.024596][T10584] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 269.036409][T10584] ext4 filesystem being mounted at /934/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 269.058664][T10602] x_tables: unsorted underflow at hook 4 [ 269.155216][T10613] exFAT-fs (loop2): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x99a53fd9, utbl_chksum : 0xe619d30d) [ 269.258399][T10637] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4923'. [ 269.344935][T10660] tc_dump_action: action bad kind [ 269.370869][T10666] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4936'. [ 269.451166][T10680] netlink: 96 bytes leftover after parsing attributes in process `syz.1.4943'. [ 269.529858][T10693] device veth1_macvtap left promiscuous mode [ 269.869691][T10738] netlink: 'syz.1.4972': attribute type 1 has an invalid length. [ 269.983503][T10730] erofs: (device loop3): EXPERIMENTAL big pcluster feature in use. Use at your own risk! [ 270.006565][T10730] erofs: (device loop3): z_erofs_load_lzma_config: lzma algorithm isn't enabled [ 270.349008][T10691] F2FS-fs (loop2): invalid crc value [ 270.411309][T10691] F2FS-fs (loop2): Found nat_bits in checkpoint [ 270.479041][T10691] F2FS-fs (loop2): Cannot turn on quotas: -2 on 2 [ 270.517685][T10691] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4 [ 270.519673][T10810] IPv6: sit1: Disabled Multicast RS [ 270.613612][T10819] mmap: syz.0.5010 (10819): VmData 29077504 exceed data ulimit 3171. Update limits or use boot option ignore_rlimit_data. [ 270.699562][T10826] IPv6: Can't replace route, no match found [ 270.795870][T10836] device vlan0 entered promiscuous mode [ 270.893253][T10848] xt_CT: You must specify a L4 protocol and not use inversions on it [ 270.948368][T10852] set_capacity_and_notify: 5 callbacks suppressed [ 270.948389][T10852] loop4: detected capacity change from 0 to 512 [ 270.977479][T10856] netlink: 'syz.3.5028': attribute type 3 has an invalid length. [ 271.029561][T10852] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -2 [ 271.037939][T10852] EXT4-fs error (device loop4): ext4_iget_extra_inode:4604: inode #15: comm syz.4.5029: corrupted in-inode xattr [ 271.061572][T10852] EXT4-fs error (device loop4): ext4_orphan_get:1411: comm syz.4.5029: couldn't read orphan inode 15 (err -117) [ 271.093398][T10852] EXT4-fs (loop4): mounted filesystem without journal. Opts: min_batch_time=0x0000000000000009,jqfmt=vfsv0,min_batch_time=0x00000000000003ff,noload,grpjquota=.,noblock_validity,resgid=0x0000000000000000,nobarrier,errors=continue,,errors=continue. Quota mode: writeback. [ 271.153051][T10852] EXT4-fs (loop4): Quota file not on filesystem root. Journaled quota will not work [ 271.235789][T10898] netlink: 'syz.2.5047': attribute type 1 has an invalid length. [ 271.270206][T10902] __nla_validate_parse: 4 callbacks suppressed [ 271.270228][T10902] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5042'. [ 271.288954][T10906] xt_TCPMSS: Only works on TCP SYN packets [ 271.320777][T10914] loop3: detected capacity change from 0 to 256 [ 271.443370][T10935] syz.0.5064 (10935): /proc/10933/oom_adj is deprecated, please use /proc/10933/oom_score_adj instead. [ 271.509625][T10950] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5072'. [ 271.534062][T10950] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5072'. [ 271.550520][T10950] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5072'. [ 271.665902][T10977] loop4: detected capacity change from 0 to 512 [ 271.703914][T10988] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5091'. [ 271.717028][T10990] xt_hashlimit: max too large, truncated to 1048576 [ 271.743633][T10998] loop0: detected capacity change from 0 to 256 [ 271.791059][T10977] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue. Quota mode: writeback. [ 271.794980][T11010] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5102'. [ 271.830235][T10977] ext4 filesystem being mounted at /1027/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 271.833156][T10998] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x68afaf67, utbl_chksum : 0xe619d30d) [ 271.866392][T11016] loop3: detected capacity change from 0 to 512 [ 271.897321][ T30] kauditd_printk_skb: 213 callbacks suppressed [ 271.897337][ T30] audit: type=1400 audit(2000525494.589:563): avc: denied { rename } for pid=10997 comm="syz.0.5096" name="file0" dev="loop0" ino=1048614 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 271.901756][T11026] loop2: detected capacity change from 0 to 512 [ 271.945171][T11016] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -2 [ 271.959314][T11016] EXT4-fs error (device loop3): ext4_iget_extra_inode:4604: inode #15: comm syz.3.5105: corrupted in-inode xattr [ 271.980628][T11016] EXT4-fs error (device loop3): ext4_orphan_get:1411: comm syz.3.5105: couldn't read orphan inode 15 (err -117) [ 271.987236][T11041] loop1: detected capacity change from 0 to 256 [ 272.015780][T11016] EXT4-fs (loop3): mounted filesystem without journal. Opts: min_batch_time=0x0000000000000009,jqfmt=vfsv0,min_batch_time=0x00000000000003ff,noload,grpjquota=.,noblock_validity,resgid=0x0000000000000000,nobarrier,errors=continue,,errors=continue. Quota mode: writeback. [ 272.019999][T11026] EXT4-fs error (device loop2): ext4_validate_block_bitmap:438: comm syz.2.5111: bg 0: block 184: padding at end of block bitmap is not set [ 272.052672][T11016] EXT4-fs (loop3): Quota file not on filesystem root. Journaled quota will not work [ 272.085931][T11026] EXT4-fs (loop2): Remounting filesystem read-only [ 272.093475][T11026] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 272.118206][T11026] EXT4-fs (loop2): Remounting filesystem read-only [ 272.125214][T11026] EXT4-fs (loop2): 1 truncate cleaned up [ 272.131600][T11026] EXT4-fs (loop2): mounted filesystem without journal. Opts: errors=remount-ro,minixdf,. Quota mode: writeback. [ 272.143814][T11026] ext4 filesystem being mounted at /1041/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 272.170813][ T30] audit: type=1400 audit(2000525494.832:564): avc: denied { rmdir } for pid=11025 comm="syz.2.5111" name="file0" dev="loop2" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 272.188492][T11026] EXT4-fs warning (device loop2): ext4_empty_dir:3147: inode #12: comm syz.2.5111: directory missing '.' [ 272.299028][ T30] audit: type=1326 audit(2000525494.926:565): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11066 comm="syz.0.5138" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 272.354146][T11081] netlink: 'syz.3.5135': attribute type 16 has an invalid length. [ 272.374219][T11081] netlink: 'syz.3.5135': attribute type 17 has an invalid length. [ 272.382684][ T30] audit: type=1326 audit(2000525494.926:566): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11066 comm="syz.0.5138" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 272.438549][ T30] audit: type=1326 audit(2000525494.926:567): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11066 comm="syz.0.5138" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 272.501907][ T30] audit: type=1326 audit(2000525494.926:568): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11066 comm="syz.0.5138" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 272.563456][ T30] audit: type=1400 audit(2000525495.000:569): avc: denied { read } for pid=11072 comm="syz.3.5132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 272.620533][ T30] audit: type=1326 audit(2000525495.010:570): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11077 comm="syz.2.5134" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f34c0d05019 code=0x7ffc0000 [ 272.701545][ T30] audit: type=1326 audit(2000525495.010:571): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11077 comm="syz.2.5134" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=34 compat=0 ip=0x7f34c0d05019 code=0x7ffc0000 [ 272.919026][ T30] audit: type=1400 audit(2000525495.543:572): avc: denied { getopt } for pid=11121 comm="syz.3.5157" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 273.119140][T11145] netlink: 64 bytes leftover after parsing attributes in process `syz.3.5167'. [ 273.246067][T11159] incfs: Error accessing: ./mem. [ 273.251102][T11159] incfs: mount failed -20 [ 273.277429][T11163] xt_TPROXY: Can be used only with -p tcp or -p udp [ 273.289615][T11074] loop0: detected capacity change from 0 to 131072 [ 273.346913][T11177] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5183'. [ 273.356018][T11177] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5183'. [ 273.387252][T11074] F2FS-fs (loop0): Test dummy encryption mode enabled [ 273.405412][T11074] F2FS-fs (loop0): invalid crc value [ 273.421340][T11183] loop3: detected capacity change from 0 to 256 [ 273.448724][T11074] F2FS-fs (loop0): Found nat_bits in checkpoint [ 273.465869][T11183] FAT-fs (loop3): Directory bread(block 64) failed [ 273.481252][T11183] FAT-fs (loop3): Directory bread(block 65) failed [ 273.489584][T11183] FAT-fs (loop3): Directory bread(block 66) failed [ 273.496261][T11183] FAT-fs (loop3): Directory bread(block 67) failed [ 273.509387][T11183] FAT-fs (loop3): Directory bread(block 68) failed [ 273.516204][T11183] FAT-fs (loop3): Directory bread(block 69) failed [ 273.523167][T11183] FAT-fs (loop3): Directory bread(block 70) failed [ 273.535469][T11194] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 273.536278][T11183] FAT-fs (loop3): Directory bread(block 71) failed [ 273.551405][T11183] FAT-fs (loop3): Directory bread(block 72) failed [ 273.558472][T11183] FAT-fs (loop3): Directory bread(block 73) failed [ 273.565257][T11074] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 273.795885][T11219] xt_CT: No such helper "syz0" [ 273.829500][T11221] xt_policy: too many policy elements [ 274.004293][T11242] xt_hashlimit: size too large, truncated to 1048576 [ 274.022109][T11242] xt_hashlimit: max too large, truncated to 1048576 [ 274.177496][T11273] device xfrm1 entered promiscuous mode [ 274.187446][T11276] bridge0: port 2(bridge_slave_1) entered disabled state [ 274.204640][T11276] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 274.275847][T11285] loop1: detected capacity change from 0 to 256 [ 274.319656][T11293] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 274.376028][T11285] FAT-fs (loop1): Directory bread(block 64) failed [ 274.382599][T11285] FAT-fs (loop1): Directory bread(block 65) failed [ 274.418488][T11285] FAT-fs (loop1): Directory bread(block 66) failed [ 274.425395][T11285] FAT-fs (loop1): Directory bread(block 67) failed [ 274.468337][T11285] FAT-fs (loop1): Directory bread(block 68) failed [ 274.488669][T11285] FAT-fs (loop1): Directory bread(block 69) failed [ 274.499215][T11333] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5256'. [ 274.503409][T11285] FAT-fs (loop1): Directory bread(block 70) failed [ 274.510403][T11323] exfat: Deprecated parameter 'utf8' [ 274.517514][T11285] FAT-fs (loop1): Directory bread(block 71) failed [ 274.528916][T11285] FAT-fs (loop1): Directory bread(block 72) failed [ 274.531415][T11323] exfat: Deprecated parameter 'namecase' [ 274.535801][T11285] FAT-fs (loop1): Directory bread(block 73) failed [ 274.580384][T11323] exFAT-fs (loop2): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbcba5927, utbl_chksum : 0xe619d30d) [ 274.870677][T11392] netlink: 'syz.4.5288': attribute type 3 has an invalid length. [ 275.189423][T11458] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ff0) [ 275.682269][T11582] netlink: 'syz.4.5381': attribute type 49 has an invalid length. [ 275.692934][T11588] xt_TCPMSS: Only works on TCP SYN packets [ 275.940883][T11643] 8021q: VLANs not supported on xfrm0 [ 276.118410][T11685] xt_time: unknown flags 0xc [ 276.137090][T11690] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 276.274466][T11715] netlink: 'syz.3.5445': attribute type 1 has an invalid length. [ 276.373314][T11733] set_capacity_and_notify: 4 callbacks suppressed [ 276.373334][T11733] loop1: detected capacity change from 0 to 512 [ 276.463662][T11733] EXT4-fs (loop1): mounted filesystem without journal. Opts: errors=remount-ro,grpquota,. Quota mode: writeback. [ 276.477448][T11733] ext4 filesystem being mounted at /1035/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 276.497439][T11733] EXT4-fs error (device loop1): ext4_add_entry:2486: inode #12: comm syz.1.5459: Directory hole found for htree leaf block 0 [ 276.510677][T11733] EXT4-fs (loop1): Remounting filesystem read-only [ 276.530318][T11777] netlink: 'syz.2.5477': attribute type 5 has an invalid length. [ 276.777792][T11840] x_tables: duplicate underflow at hook 3 [ 276.789399][T11842] loop2: detected capacity change from 0 to 512 [ 276.793130][T11844] __nla_validate_parse: 11 callbacks suppressed [ 276.793151][T11844] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5508'. [ 276.867159][T11842] EXT4-fs (loop2): Ignoring removed mblk_io_submit option [ 276.876244][T11842] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 276.889857][T11842] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 276.954329][T11842] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3894: comm syz.2.5507: Allocating blocks 41-42 which overlap fs metadata [ 276.963872][T11874] loop1: detected capacity change from 0 to 256 [ 276.969212][T11842] EXT4-fs (loop2): Remounting filesystem read-only [ 276.981857][T11842] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3894: comm syz.2.5507: Allocating blocks 41-42 which overlap fs metadata [ 276.996672][T11842] EXT4-fs (loop2): Remounting filesystem read-only [ 277.003658][T11842] EXT4-fs error (device loop2): ext4_acquire_dquot:6227: comm syz.2.5507: Failed to acquire dquot type 1 [ 277.020248][T11842] EXT4-fs (loop2): Remounting filesystem read-only [ 277.027504][T11842] EXT4-fs error (device loop2): mb_free_blocks:1889: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 277.042728][T11874] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x68afaf67, utbl_chksum : 0xe619d30d) [ 277.046421][T11842] EXT4-fs (loop2): Remounting filesystem read-only [ 277.067014][T11842] EXT4-fs error (device loop2): ext4_do_update_inode:5260: inode #12: comm syz.2.5507: corrupted inode contents [ 277.106581][T11879] xt_ecn: cannot match TCP bits for non-tcp packets [ 277.113658][T11842] EXT4-fs (loop2): Remounting filesystem read-only [ 277.122037][T11842] EXT4-fs error (device loop2): ext4_dirty_inode:6108: inode #12: comm syz.2.5507: mark_inode_dirty error [ 277.142299][T11842] EXT4-fs (loop2): Remounting filesystem read-only [ 277.153579][T11842] EXT4-fs error (device loop2): ext4_do_update_inode:5260: inode #12: comm syz.2.5507: corrupted inode contents [ 277.174291][T11842] EXT4-fs (loop2): Remounting filesystem read-only [ 277.192955][T11842] EXT4-fs error (device loop2): __ext4_ext_dirty:183: inode #12: comm syz.2.5507: mark_inode_dirty error [ 277.217314][T11842] EXT4-fs (loop2): Remounting filesystem read-only [ 277.228779][T11842] EXT4-fs error (device loop2): ext4_do_update_inode:5260: inode #12: comm syz.2.5507: corrupted inode contents [ 277.265241][T11842] EXT4-fs (loop2): Remounting filesystem read-only [ 277.278971][T11842] EXT4-fs error (device loop2) in ext4_orphan_del:303: Corrupt filesystem [ 277.301229][T11842] EXT4-fs (loop2): Remounting filesystem read-only [ 277.309926][T11842] EXT4-fs error (device loop2): ext4_do_update_inode:5260: inode #12: comm syz.2.5507: corrupted inode contents [ 277.347084][T11842] EXT4-fs (loop2): Remounting filesystem read-only [ 277.358316][T11842] EXT4-fs error (device loop2): ext4_truncate:4317: inode #12: comm syz.2.5507: mark_inode_dirty error [ 277.376527][ T30] kauditd_printk_skb: 45 callbacks suppressed [ 277.376541][ T30] audit: type=1400 audit(2000525499.706:614): avc: denied { read } for pid=11915 comm="syz.4.5542" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 277.413991][T11842] EXT4-fs (loop2): Remounting filesystem read-only [ 277.420838][T11842] EXT4-fs error (device loop2) in ext4_process_orphan:345: Corrupt filesystem [ 277.434466][T11842] EXT4-fs (loop2): Remounting filesystem read-only [ 277.441903][T11923] xt_TCPMSS: Only works on TCP SYN packets [ 277.458650][T11842] EXT4-fs (loop2): 1 truncate cleaned up [ 277.478817][T11842] EXT4-fs (loop2): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000000800000,noblock_validity,mblk_io_submit,errors=remount-ro,noinit_itable,grpjquota=,jqfmt=vfsv1,max_dir_size_kb=0x0000000000000006,barrier=0x00000000000007ff2. Quota mode: writeback. [ 277.504073][T11933] IPv6: NLM_F_CREATE should be specified when creating new route [ 277.514388][T11933] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 277.521661][T11933] IPv6: NLM_F_CREATE should be set when creating new route [ 277.565369][T11940] syz.1.5554 (11940) used greatest stack depth: 20664 bytes left [ 277.601364][T11948] netlink: 228 bytes leftover after parsing attributes in process `syz.1.5559'. [ 277.672632][T11960] netlink: 5 bytes leftover after parsing attributes in process `syz.4.5561'. [ 277.736274][T11973] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 277.751108][T11976] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5572'. [ 277.849268][T11996] xt_bpf: check failed: parse error [ 277.969557][T12030] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5599'. [ 278.003079][T12030] IPv6: Can't replace route, no match found [ 278.015771][T12040] ipt_REJECT: TCP_RESET invalid for non-tcp [ 278.060413][T12050] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 278.099083][T12060] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5612'. [ 278.167671][T12075] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5621'. [ 278.267132][T12096] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5634'. [ 278.283460][T12100] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5631'. [ 278.400833][ T30] audit: type=1326 audit(2000525500.670:615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12129 comm="syz.4.5649" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbcf6aa1019 code=0x7ffc0000 [ 278.452600][T12142] netlink: 'syz.4.5653': attribute type 1 has an invalid length. [ 278.467389][ T30] audit: type=1326 audit(2000525500.670:616): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12129 comm="syz.4.5649" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbcf6aa1019 code=0x7ffc0000 [ 278.568576][ T30] audit: type=1326 audit(2000525500.670:617): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12129 comm="syz.4.5649" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbcf6aa1019 code=0x7ffc0000 [ 278.660233][ T30] audit: type=1326 audit(2000525500.670:618): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12129 comm="syz.4.5649" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=195 compat=0 ip=0x7fbcf6aa1019 code=0x7ffc0000 [ 278.696842][T12180] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 278.719620][T12184] x_tables: ip_tables: REDIRECT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 278.736173][ T30] audit: type=1326 audit(2000525500.670:619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12129 comm="syz.4.5649" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbcf6aa1019 code=0x7ffc0000 [ 278.766455][ T30] audit: type=1326 audit(2000525500.670:620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12129 comm="syz.4.5649" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fbcf6aa1019 code=0x7ffc0000 [ 278.811370][ T30] audit: type=1326 audit(2000525500.670:621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12129 comm="syz.4.5649" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fbcf6aa1019 code=0x7ffc0000 [ 278.846046][T12197] xt_hashlimit: overflow, try lower: 18446744073709551614/9 [ 278.928841][T12213] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5689'. [ 278.978584][T12213] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 279.005521][T12213] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 279.156851][T12254] netlink: 'syz.1.5708': attribute type 3 has an invalid length. [ 279.191387][T12260] : renamed from team_slave_1 [ 279.320065][T12286] xt_TCPMSS: Only works on TCP SYN packets [ 279.377107][ T30] audit: type=1400 audit(2000525501.577:622): avc: denied { setattr } for pid=12298 comm="syz.1.5732" name="timer" dev="devtmpfs" ino=267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sound_device_t tclass=chr_file permissive=1 [ 279.417271][T12305] : renamed from bond_slave_0 [ 279.592510][ T30] audit: type=1400 audit(2000525501.792:623): avc: denied { listen } for pid=12341 comm="syz.0.5754" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 279.633504][T12353] xt_TCPMSS: Only works on TCP SYN packets [ 279.684453][T12363] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 279.919474][T12408] netlink: 'syz.1.5785': attribute type 3 has an invalid length. [ 280.255366][T12459] device ip6tnl1 entered promiscuous mode [ 280.661644][T12542] ip_tables: iptables: counters copy to user failed while replacing table [ 281.100039][T12617] A link change request failed with some changes committed already. Interface veth0_macvtap may have been left with an inconsistent configuration, please check. [ 281.263233][T12644] x_tables: duplicate entry at hook 3 [ 281.327947][T12653] device vlan0 left promiscuous mode [ 281.377345][T12653] device xfrm1 left promiscuous mode [ 281.389689][T12653] device ip6tnl1 left promiscuous mode [ 281.408754][T12664] xt_TCPMSS: Only works on TCP SYN packets [ 281.658065][T12477] loop4: detected capacity change from 0 to 131072 [ 281.681457][T12703] device batadv_slave_0 entered promiscuous mode [ 281.705189][T12477] F2FS-fs (loop4): Test dummy encryption mode enabled [ 281.752777][T12708] loop3: detected capacity change from 0 to 256 [ 281.764947][T12477] F2FS-fs (loop4): invalid crc value [ 281.810389][T12719] netlink: 'syz.0.5939': attribute type 5 has an invalid length. [ 281.818031][T12477] F2FS-fs (loop4): Found nat_bits in checkpoint [ 281.905553][T12730] x_tables: duplicate underflow at hook 4 [ 281.959625][T12477] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 282.192409][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 282.222362][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 282.253250][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 282.272689][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 282.298207][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 282.319739][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 282.342690][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 282.357482][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 282.367949][T12768] netlink: 'syz.2.5963': attribute type 6 has an invalid length. [ 282.408962][T12768] IPv6: NLM_F_CREATE should be specified when creating new route [ 282.433728][T12782] loop3: detected capacity change from 0 to 512 [ 282.501159][T12782] EXT4-fs (loop3): Ignoring removed nobh option [ 282.524700][T12802] __nla_validate_parse: 182 callbacks suppressed [ 282.524719][T12802] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5960'. [ 282.577685][T12782] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpquota,auto_da_alloc,quota,nobh,,errors=continue. Quota mode: writeback. [ 282.597191][T12782] ext4 filesystem being mounted at /1300/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 282.631422][T12820] SELinux: security_context_str_to_sid(a`yv-|J+0l8G[kT_|nU5 [ 282.631422][T12820] M9) failed for (dev ?, type ?) errno=-22 [ 282.706447][T12831] loop2: detected capacity change from 0 to 512 [ 282.748648][ T30] kauditd_printk_skb: 34 callbacks suppressed [ 282.748662][ T30] audit: type=1400 audit(2000525504.739:658): avc: denied { read write } for pid=291 comm="syz-executor" name="loop3" dev="devtmpfs" ino=119 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 282.779284][T12831] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 282.779920][T12831] EXT4-fs (loop2): ext4_check_descriptors: Block bitmap for group 1 overlaps superblock [ 282.779941][T12831] EXT4-fs (loop2): ext4_check_descriptors: Inode bitmap for group 1 overlaps superblock [ 282.779954][T12831] EXT4-fs (loop2): ext4_check_descriptors: Inode table for group 1 overlaps superblock [ 282.797606][T12831] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 282.809283][T12831] EXT4-fs (loop2): orphan cleanup on readonly fs [ 282.810408][T12831] EXT4-fs error (device loop2): ext4_validate_block_bitmap:438: comm syz.2.5992: bg 0: block 34: padding at end of block bitmap is not set [ 282.810628][T12831] Quota error (device loop2): write_blk: dquota write failed [ 282.810664][T12831] Quota error (device loop2): qtree_write_dquot: Error -28 occurred while creating quota [ 282.810705][T12831] EXT4-fs error (device loop2): ext4_acquire_dquot:6227: comm syz.2.5992: Failed to acquire dquot type 1 [ 282.811175][T12831] EXT4-fs (loop2): 1 truncate cleaned up [ 282.811338][T12831] EXT4-fs (loop2): mounted filesystem without journal. Opts: delalloc,bsddf,mb_optimize_scan=0x0000000000000001,acl,max_dir_size_kb=0x0000000000000001,noblock_validity,usrjquota=,jqfmt=vfsv0,inode_readahead_blks=0x0000000001000000,inlinecrypt,sysvgroups,,errors=continue. Quota mode: writeback. [ 282.890229][T12866] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6009'. [ 282.890252][T12866] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6009'. [ 282.890284][T12866] netlink: 1 bytes leftover after parsing attributes in process `syz.4.6009'. [ 282.894992][T12868] xt_hashlimit: max too large, truncated to 1048576 [ 282.900764][ T30] audit: type=1400 audit(2000525504.739:659): avc: denied { open } for pid=290 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 282.900797][ T30] audit: type=1400 audit(2000525504.739:660): avc: denied { ioctl } for pid=290 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=117 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 282.900822][ T30] audit: type=1400 audit(2000525504.749:661): avc: denied { mounton } for pid=12830 comm="syz.2.5992" path="/1164/file1" dev="tmpfs" ino=5941 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 282.900844][ T30] audit: type=1400 audit(2000525504.795:662): avc: denied { mount } for pid=12830 comm="syz.2.5992" name="/" dev="loop2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 282.900866][ T30] audit: type=1400 audit(2000525504.842:663): avc: denied { unlink } for pid=289 comm="syz-executor" name="file1" dev="tmpfs" ino=5941 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 282.920559][T12872] xt_hashlimit: max too large, truncated to 1048576 [ 282.921116][ T30] audit: type=1400 audit(2000525504.898:664): avc: denied { module_request } for pid=12871 comm="syz.1.6012" kmod="ip6t_rpfilter" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 282.999361][T12890] netlink: 'syz.4.6020': attribute type 1 has an invalid length. [ 283.120785][T12910] device vti0 entered promiscuous mode [ 283.321891][T12921] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6034'. [ 283.343122][ T30] audit: type=1326 audit(2000525505.291:665): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12922 comm="syz.0.6035" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 283.383356][T12925] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6038'. [ 283.499548][T12959] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6053'. [ 283.615293][T12983] netlink: 'syz.1.6064': attribute type 28 has an invalid length. [ 283.628081][T12983] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6064'. [ 283.735819][T13004] xt_CT: No such helper "syz0" [ 283.773404][T13005] loop3: detected capacity change from 0 to 4096 [ 283.806075][T13014] netlink: 'syz.0.6080': attribute type 30 has an invalid length. [ 283.838102][T13005] EXT4-fs (loop3): Test dummy encryption mode enabled [ 283.862967][T13005] EXT4-fs (loop3): Test dummy encryption mode enabled [ 283.900628][T13005] EXT4-fs (loop3): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,test_dummy_encryption=v1,noload,test_dummy_encryption=v1,nodiscard,barrier,usrquota,journal_ioprio=0x0000000000000000,resuid=0x0000000000000000,,errors=continue. Quota mode: writeback. [ 283.974874][T13038] netlink: 'syz.0.6091': attribute type 49 has an invalid length. [ 284.412034][ T685] usb 1-1: new full-speed USB device number 113 using dummy_hcd [ 284.478566][T13104] loop3: detected capacity change from 0 to 512 [ 284.535157][T13115] device bridge_slave_0 left promiscuous mode [ 284.543451][T13115] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 284.552000][T13115] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 284.566057][T13104] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=8806c118, mo2=0002] [ 284.574768][T13104] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 284.583778][T13104] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -2 [ 284.592634][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 284.601623][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 284.614114][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 284.623612][T13104] EXT4-fs (loop3): 1 truncate cleaned up [ 284.624338][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 284.633528][T13104] EXT4-fs (loop3): mounted filesystem without journal. Opts: usrquota,usrjquota="data=ordered,noload,debug,grpjquota="init_itable,jqfmt=vfsold,noblock_validity,,errors=continue. Quota mode: writeback. [ 284.651207][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 284.677475][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 284.678731][T13115] syz.4.6129 (13115) used greatest stack depth: 20640 bytes left [ 284.686007][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 284.702085][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 284.710592][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): veth3: link becomes ready [ 284.718760][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): veth2: link becomes ready [ 284.804884][T13137] netlink: 'syz.3.6140': attribute type 29 has an invalid length. [ 284.819794][T13137] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6140'. [ 284.839430][T13137] netlink: 'syz.3.6140': attribute type 29 has an invalid length. [ 284.851108][T13137] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6140'. [ 284.861004][ T685] usb 1-1: unable to get BOS descriptor or descriptor too short [ 284.920260][ T685] usb 1-1: not running at top speed; connect to a high speed hub [ 284.943171][T13159] netlink: 'syz.3.6150': attribute type 19 has an invalid length. [ 284.983525][T13169] netlink: 'syz.2.6153': attribute type 13 has an invalid length. [ 285.112810][T13192] loop3: detected capacity change from 0 to 256 [ 285.181780][ T685] usb 1-1: New USB device found, idVendor=17cc, idProduct=1021, bcdDevice= 0.40 [ 285.183384][T13192] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 285.195323][ T685] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 285.250891][ T685] usb 1-1: Product: syz [ 285.269026][ T685] usb 1-1: Manufacturer: syz [ 285.273672][ T685] usb 1-1: SerialNumber: syz [ 285.297495][T13218] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 285.563452][T13254] x_tables: duplicate underflow at hook 4 [ 285.602882][T13220] loop1: detected capacity change from 0 to 40427 [ 285.630081][T13220] F2FS-fs (loop1): invalid crc value [ 285.643089][T13262] device vlan0 left promiscuous mode [ 285.648410][T13262] device veth0_vlan left promiscuous mode [ 285.655363][T13220] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 285.673574][ T685] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 285.718671][T13220] F2FS-fs (loop1): recover fsync data on readonly fs [ 285.726822][ T685] usb 1-1: unable to issue vendor read request (ret = -71) [ 285.747093][T13220] F2FS-fs (loop1): checkpoint=disable on readonly fs [ 285.769680][ T685] usb 1-1: unable to issue vendor read request (ret = -71) [ 285.801669][ T685] usb 1-1: unable to issue vendor read request (ret = -71) [ 285.823079][ T685] usb 1-1: unable to issue vendor read request (ret = -71) [ 285.844401][ T685] usb 1-1: unable to issue vendor read request (ret = -71) [ 285.867237][ T685] usb 1-1: unable to issue vendor read request (ret = -71) [ 285.908709][ T685] usb 1-1: unable to issue vendor read request (ret = -71) [ 285.929960][ T685] usb 1-1: unable to issue vendor read request (ret = -71) [ 285.946952][ T685] usb 1-1: USB disconnect, device number 113 [ 286.017092][T13298] device bridge_slave_1 left promiscuous mode [ 286.023302][T13298] bridge0: port 2(bridge_slave_1) entered disabled state [ 286.047622][T13298] device bridge_slave_0 left promiscuous mode [ 286.053819][T13298] bridge0: port 1(bridge_slave_0) entered disabled state [ 286.288724][T13226] loop2: detected capacity change from 0 to 131072 [ 286.329151][T13349] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 286.341918][T13226] F2FS-fs (loop2): Invalid segment/section count (458783, 24 x 150994945) [ 286.389364][T13226] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 286.430067][T13226] F2FS-fs (loop2): invalid crc value [ 286.489657][T13226] F2FS-fs (loop2): Found nat_bits in checkpoint [ 286.508907][T13386] loop3: detected capacity change from 0 to 256 [ 286.626069][T13226] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 286.654525][T13226] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4 [ 286.666784][T13421] loop0: detected capacity change from 0 to 512 [ 286.727222][T13226] F2FS-fs (loop2): sanity_check_inode: corrupted inode footer i_ino=8, ino,nid: [61317896, 8] run fsck to fix. [ 286.765031][T13421] EXT4-fs (loop0): Ignoring removed mblk_io_submit option [ 286.804171][T13421] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.6275: invalid indirect mapped block 10 (level 1) [ 286.879783][T13421] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.6275: invalid indirect mapped block 8 (level 1) [ 286.938019][T13463] netlink: 'syz.3.6297': attribute type 29 has an invalid length. [ 286.967281][T13421] EXT4-fs (loop0): 1 truncate cleaned up [ 286.977718][T13421] EXT4-fs (loop0): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,mblk_io_submit,,errors=continue. Quota mode: none. [ 287.004525][T13421] EXT4-fs error (device loop0): ext4_find_inline_data_nolock:164: inode #15: comm syz.0.6275: inline data xattr refers to an external xattr inode [ 287.026598][T13467] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 287.076186][T13467] EXT4-fs (loop2): ext4_check_descriptors: Block bitmap for group 1 overlaps superblock [ 287.105747][T13467] EXT4-fs (loop2): ext4_check_descriptors: Inode bitmap for group 1 overlaps superblock [ 287.156413][T13467] EXT4-fs (loop2): ext4_check_descriptors: Inode table for group 1 overlaps superblock [ 287.212337][T13467] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 287.226905][T13467] EXT4-fs (loop2): orphan cleanup on readonly fs [ 287.238015][T13467] EXT4-fs error (device loop2): ext4_validate_block_bitmap:438: comm syz.2.6287: bg 0: block 34: padding at end of block bitmap is not set [ 287.256440][T13467] EXT4-fs error (device loop2): ext4_acquire_dquot:6227: comm syz.2.6287: Failed to acquire dquot type 1 [ 287.279242][T13467] EXT4-fs (loop2): 1 truncate cleaned up [ 287.290304][T13536] x_tables: duplicate underflow at hook 4 [ 287.302328][T13530] netlink: 'syz.1.6328': attribute type 8 has an invalid length. [ 287.309464][T13467] EXT4-fs (loop2): mounted filesystem without journal. Opts: norecovery,bsddf,mb_optimize_scan=0x0000000000000000,acl,max_dir_size_kb=0x0000000000000001,noblock_validity,usrjquota=,jqfmt=vfsv0,inode_readahead_blks=0x0000000000001000,resgid=0x000000000000000a,sysvgroups,,errors=continue. Quota mode: writeback. [ 287.435853][T13558] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 287.488744][T13561] device bridge3 entered promiscuous mode [ 287.614750][T13597] netlink: 'syz.0.6364': attribute type 1 has an invalid length. [ 287.647951][T13604] IPv6: sit1: Disabled Multicast RS [ 287.738405][T13626] netlink: 'syz.1.6377': attribute type 28 has an invalid length. [ 287.882154][T13662] xt_l2tp: v2 doesn't support IP mode [ 287.983420][T13688] __nla_validate_parse: 123 callbacks suppressed [ 287.983439][T13688] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6408'. [ 288.034402][T13696] netlink: 124 bytes leftover after parsing attributes in process `syz.4.6411'. [ 288.060145][T13698] ip6t_REJECT: ECHOREPLY is not supported [ 288.124281][ T30] kauditd_printk_skb: 348 callbacks suppressed [ 288.124297][ T30] audit: type=1400 audit(2000525509.772:1012): avc: denied { create } for pid=13710 comm="syz.2.6420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 288.134270][T13713] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 288.157399][T13713] IPv6: NLM_F_CREATE should be set when creating new route [ 288.163565][ T30] audit: type=1400 audit(2000525509.772:1013): avc: denied { write } for pid=13710 comm="syz.2.6420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 288.164669][T13713] IPv6: NLM_F_CREATE should be set when creating new route [ 288.307338][ T30] audit: type=1400 audit(2000525509.941:1014): avc: denied { ioctl } for pid=13742 comm="syz.4.6436" path="socket:[56665]" dev="sockfs" ino=56665 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 288.348569][T13756] xt_limit: Overflow, try lower: 167772/2147483648 [ 288.385617][T13762] x_tables: duplicate underflow at hook 2 [ 288.427722][ T30] audit: type=1400 audit(2000525509.950:1015): avc: denied { audit_control } for pid=13743 comm="syz.1.6437" capability=30 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 288.459418][T13773] sock: sock_timestamping_bind_phc: sock not bind to device [ 288.489770][T13775] set_capacity_and_notify: 1 callbacks suppressed [ 288.489785][T13775] loop2: detected capacity change from 0 to 4096 [ 288.510643][ T30] audit: type=1400 audit(2000525510.044:1016): avc: denied { read } for pid=13767 comm="syz.1.6447" name="kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 288.575308][ T30] audit: type=1400 audit(2000525510.044:1017): avc: denied { open } for pid=13767 comm="syz.1.6447" path="/dev/kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 288.602696][T13775] EXT4-fs (loop2): Test dummy encryption mode enabled [ 288.638376][T13775] EXT4-fs (loop2): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,noauto_da_alloc,dioread_nolock,test_dummy_encryption,block_validity,nodelalloc,minixdf,auto_da_alloc,,errors=continue. Quota mode: writeback. [ 288.682230][ T30] audit: type=1400 audit(2000525510.044:1018): avc: denied { ioctl } for pid=13767 comm="syz.1.6447" path="/dev/kvm" dev="devtmpfs" ino=82 ioctlcmd=0xae03 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 288.682534][T13775] overlayfs: missing 'lowerdir' [ 288.707367][ T30] audit: type=1400 audit(2000525510.287:1019): avc: denied { mounton } for pid=13771 comm="syz.2.6450" path=2F313233342F131377C5FC35D41454D5D41D29AD1A6029598146E6BE166E41AD0DBD4054033C9F33BBDA8224A2F3D772E7636E48B33CBF708372E8F1B9933EC5127743BE2206209EF02DF9CBF2F6E880D3382F66696C6530 dev="loop2" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 288.748122][T13806] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=1009 sclass=netlink_audit_socket pid=13806 comm=syz.0.6465 [ 288.762846][T13804] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6464'. [ 288.811291][ T30] audit: type=1326 audit(2000525510.408:1020): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13807 comm="syz.3.6466" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd0a862c019 code=0x7ffc0000 [ 288.889484][ T30] audit: type=1326 audit(2000525510.408:1021): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13807 comm="syz.3.6466" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=116 compat=0 ip=0x7fd0a862c019 code=0x7ffc0000 [ 288.941468][T13832] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 288.957479][T13834] x_tables: duplicate entry at hook 3 [ 289.020359][T13842] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 289.046387][T13842] bridge0: port 1(bridge_slave_0) entered disabled state [ 289.066213][T13842] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 289.148459][T13866] device batadv_slave_0 left promiscuous mode [ 289.172865][T13866] device ip6erspan0 left promiscuous mode [ 289.174034][T13872] xt_bpf: check failed: parse error [ 289.260755][T13886] loop4: detected capacity change from 0 to 512 [ 289.323180][T13886] EXT4-fs (loop4): mounted filesystem without journal. Opts: min_batch_time=0x0000000000000004,abort,,errors=continue. Quota mode: writeback. [ 289.348147][T13886] ext4 filesystem being mounted at /1317/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 289.636619][T13970] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6546'. [ 289.857100][T14017] x_tables: unsorted entry at hook 3 [ 289.914832][T14029] xt_l2tp: missing protocol rule (udp|l2tpip) [ 290.065047][T14064] loop2: detected capacity change from 0 to 256 [ 290.109497][T14072] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 290.258476][T14101] x_tables: ip_tables: udp match: only valid for protocol 17 [ 290.377483][T14131] loop3: detected capacity change from 0 to 512 [ 290.453799][T14131] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.6625: invalid indirect mapped block 10 (level 1) [ 290.482274][T14131] EXT4-fs (loop3): Remounting filesystem read-only [ 290.495596][T14150] validate_nla: 2 callbacks suppressed [ 290.495613][T14150] netlink: 'syz.4.6634': attribute type 46 has an invalid length. [ 290.511512][T14131] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.6625: invalid indirect mapped block 8 (level 1) [ 290.526980][T14150] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6634'. [ 290.536161][T14131] EXT4-fs (loop3): Remounting filesystem read-only [ 290.556023][T14131] EXT4-fs (loop3): 1 truncate cleaned up [ 290.573590][T14154] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6636'. [ 290.584219][T14131] EXT4-fs (loop3): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,errors=remount-ro,. Quota mode: none. [ 290.584633][T14139] loop0: detected capacity change from 0 to 40427 [ 290.615321][T14131] EXT4-fs error (device loop3): ext4_find_inline_data_nolock:164: inode #15: comm syz.3.6625: inline data xattr refers to an external xattr inode [ 290.620489][T14160] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6639'. [ 290.645921][T14131] EXT4-fs (loop3): Remounting filesystem read-only [ 290.671789][T14139] F2FS-fs (loop0): Corrupted extension count (64 + 1 > 64) [ 290.680337][T14139] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 290.698374][T14139] F2FS-fs (loop0): invalid crc value [ 290.722972][T14139] F2FS-fs (loop0): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 290.755251][T14179] device batadv_slave_0 entered promiscuous mode [ 290.762623][T14179] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 290.798619][T14139] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 290.813945][T14139] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 290.939352][T14210] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 290.976657][ T289] cgroup: fork rejected by pids controller in /syz2 [ 290.986011][T14214] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6664'. [ 291.397744][T14292] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6702'. [ 291.418209][T14266] bridge0: port 1(bridge_slave_0) entered blocking state [ 291.434529][T14266] bridge0: port 1(bridge_slave_0) entered disabled state [ 291.451815][T14266] device bridge_slave_0 entered promiscuous mode [ 291.470623][T14266] bridge0: port 2(bridge_slave_1) entered blocking state [ 291.491947][T14266] bridge0: port 2(bridge_slave_1) entered disabled state [ 291.514966][T14266] device bridge_slave_1 entered promiscuous mode [ 291.591126][T14327] printk: syz.3.6718 (14327): Attempt to access syslog with CAP_SYS_ADMIN but no CAP_SYSLOG (deprecated). [ 291.603644][T14325] ipt_REJECT: TCP_RESET invalid for non-tcp [ 291.707690][T14266] bridge0: port 2(bridge_slave_1) entered blocking state [ 291.714792][T14266] bridge0: port 2(bridge_slave_1) entered forwarding state [ 291.722187][T14266] bridge0: port 1(bridge_slave_0) entered blocking state [ 291.729298][T14266] bridge0: port 1(bridge_slave_0) entered forwarding state [ 291.789668][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 291.805416][ T460] bridge0: port 1(bridge_slave_0) entered disabled state [ 291.820226][ T460] bridge0: port 2(bridge_slave_1) entered disabled state [ 291.829400][T14347] loop3: detected capacity change from 0 to 4096 [ 291.857181][T14347] EXT4-fs (loop3): Test dummy encryption mode enabled [ 291.865220][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 291.873280][T14353] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 291.899918][ T460] bridge0: port 1(bridge_slave_0) entered blocking state [ 291.907033][ T460] bridge0: port 1(bridge_slave_0) entered forwarding state [ 291.915547][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 291.924105][ T460] bridge0: port 2(bridge_slave_1) entered blocking state [ 291.931197][ T460] bridge0: port 2(bridge_slave_1) entered forwarding state [ 291.938787][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 291.946725][T14347] EXT4-fs (loop3): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,noauto_da_alloc,dioread_nolock,test_dummy_encryption,block_validity,nodelalloc,minixdf,auto_da_alloc,,errors=continue. Quota mode: writeback. [ 291.957073][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 292.008862][T14365] x_tables: ip6_tables: hashlimit.2 match: invalid size 304 (kernel) != (user) 352 [ 292.034134][T14347] overlayfs: missing 'lowerdir' [ 292.041944][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 292.055542][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 292.063686][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 292.072142][ T460] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 292.111037][T14371] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6737'. [ 292.121563][T14266] device veth0_vlan entered promiscuous mode [ 292.146442][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 292.158320][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 292.178588][T14266] device veth1_macvtap entered promiscuous mode [ 292.205573][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 292.217123][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 292.228394][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 292.248048][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 292.271660][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 292.370890][T14404] netlink: 'syz.3.6753': attribute type 10 has an invalid length. [ 292.406235][T14319] loop4: detected capacity change from 0 to 131072 [ 292.455855][T14319] F2FS-fs (loop4): Invalid segment/section count (458783, 24 x 150994945) [ 292.472907][T14319] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 292.503395][T14319] F2FS-fs (loop4): invalid crc value [ 292.530850][T14319] F2FS-fs (loop4): Found nat_bits in checkpoint [ 292.565140][T14319] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 292.572340][T14319] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 292.618630][T14319] F2FS-fs (loop4): sanity_check_inode: inode (ino=4, mode=16877) should not have inline_data, run fsck to fix [ 292.690869][T14447] loop3: detected capacity change from 0 to 512 [ 292.812170][T14449] IPv6: NLM_F_CREATE should be specified when creating new route [ 292.841247][T14449] IPv6: Can't replace route, no match found [ 293.085864][T14490] IPv6: NLM_F_CREATE should be specified when creating new route [ 293.175700][T14505] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 293.404005][T14439] loop2: detected capacity change from 0 to 131072 [ 293.457576][T14439] F2FS-fs (loop2): Found nat_bits in checkpoint [ 293.487186][ T30] kauditd_printk_skb: 77 callbacks suppressed [ 293.487201][ T30] audit: type=1326 audit(2000525514.777:1099): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14567 comm="syz.3.6831" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd0a862c019 code=0x7ffc0000 [ 293.519832][ T30] audit: type=1326 audit(2000525514.777:1100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14567 comm="syz.3.6831" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=76 compat=0 ip=0x7fd0a862c019 code=0x7ffc0000 [ 293.547328][ T30] audit: type=1400 audit(2000525514.787:1101): avc: denied { write } for pid=14567 comm="syz.3.6831" name="cgroup.procs" dev="cgroup" ino=109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object" [ 293.573949][ T30] audit: type=1400 audit(2000525514.787:1102): avc: denied { open } for pid=14567 comm="syz.3.6831" name="cgroup.procs" dev="cgroup" ino=109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object" [ 293.599621][ T30] audit: type=1326 audit(2000525514.787:1103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14567 comm="syz.3.6831" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd0a862c019 code=0x7ffc0000 [ 293.627841][T14439] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 293.677039][ T30] audit: type=1326 audit(2000525514.955:1104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14577 comm="syz.4.6835" exe="/root/ci2-android-5-15/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbcf6aa1019 code=0x0 [ 293.714074][ T30] audit: type=1400 audit(2000525515.002:1105): avc: denied { wake_alarm } for pid=14583 comm="syz.0.6837" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 293.941920][ T30] audit: type=1400 audit(2000525515.208:1106): avc: denied { mac_admin } for pid=14612 comm="syz.1.6852" capability=33 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 293.941932][T14613] SELinux: Context Y7: is not valid (left unmapped). [ 294.192503][T14655] device ipip1 entered promiscuous mode [ 294.306640][T14675] bridge4: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 294.483905][ T30] audit: type=1400 audit(2000525515.722:1107): avc: denied { connect } for pid=14708 comm="syz.3.6898" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 294.561574][ T30] audit: type=1326 audit(2000525515.750:1108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14714 comm="syz.3.6901" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd0a862c019 code=0x7ffc0000 [ 294.591810][T14731] IPv6: NLM_F_CREATE should be specified when creating new route [ 294.617372][T14739] __nla_validate_parse: 2 callbacks suppressed [ 294.617390][T14739] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6913'. [ 294.706647][T14763] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6925'. [ 294.808474][T14783] loop3: detected capacity change from 0 to 1024 [ 294.861898][T14783] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (51269!=20869) [ 294.896626][T14783] EXT4-fs error (device loop3): ext4_get_journal_inode:5178: inode #32: comm syz.3.6935: iget: special inode unallocated [ 294.918745][T14783] EXT4-fs (loop3): no journal found [ 294.928762][T14783] EXT4-fs (loop3): can't get journal size [ 294.936877][T14794] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6941'. [ 294.951367][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 294.973454][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 294.986505][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 294.997108][T14783] EXT4-fs (loop3): filesystem is read-only [ 295.002955][T14783] EXT4-fs (loop3): mounted filesystem without journal. Opts: max_batch_time=0x0000000000000004,noload,noblock_validity,bsdgroups,resuid=0x0000000000000000,,errors=continue. Quota mode: none. [ 295.029176][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 295.038675][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 295.045775][T14783] EXT4-fs error (device loop3): ext4_lookup:1850: inode #2: comm syz.3.6935: bad inode number: 12 [ 295.054048][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 295.066835][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 295.076339][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 295.086962][T14800] netlink: 'syz.4.6943': attribute type 3 has an invalid length. [ 295.096185][T14803] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 295.103478][T14803] IPv6: NLM_F_CREATE should be set when creating new route [ 295.110966][T14803] IPv6: NLM_F_CREATE should be set when creating new route [ 295.443538][T14881] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6982'. [ 295.481207][T14886] netlink: 9 bytes leftover after parsing attributes in process `syz.1.6985'. [ 295.504015][T14886] device gretap0 entered promiscuous mode [ 295.535494][T14890] netlink: 'syz.4.6988': attribute type 12 has an invalid length. [ 295.683608][T14932] netlink: 'syz.1.7008': attribute type 3 has an invalid length. [ 295.758155][T14950] netlink: 14 bytes leftover after parsing attributes in process `syz.1.7017'. [ 295.991647][T15007] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7044'. [ 296.007572][T15010] loop1: detected capacity change from 0 to 256 [ 296.221026][T15052] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7069'. [ 296.428723][T15106] loop1: detected capacity change from 0 to 512 [ 296.500444][T15106] EXT4-fs error (device loop1): ext4_get_branch:178: inode #13: block 2: comm syz.1.7095: invalid block [ 296.523204][T15106] EXT4-fs (loop1): Remounting filesystem read-only [ 296.544461][T15106] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.7095: invalid indirect mapped block 10 (level 1) [ 296.574093][T15106] EXT4-fs (loop1): Remounting filesystem read-only [ 296.587833][T15106] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.7095: invalid indirect mapped block 8 (level 1) [ 296.615343][T15106] EXT4-fs (loop1): Remounting filesystem read-only [ 296.622120][T15106] EXT4-fs (loop1): 1 truncate cleaned up [ 296.640551][T15106] EXT4-fs (loop1): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,errors=remount-ro,. Quota mode: none. [ 296.687740][T15106] EXT4-fs error (device loop1): ext4_find_inline_data_nolock:164: inode #15: comm syz.1.7095: inline data xattr refers to an external xattr inode [ 296.735388][T15163] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7122'. [ 296.756624][T15106] EXT4-fs (loop1): Remounting filesystem read-only [ 296.819457][T15173] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 296.896049][T15154] loop3: detected capacity change from 0 to 40427 [ 296.914754][T15186] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7133'. [ 296.935193][T15154] F2FS-fs (loop3): invalid crc value [ 296.955737][T15194] xt_ecn: cannot match TCP bits for non-tcp packets [ 296.973434][T15154] F2FS-fs (loop3): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 297.053974][T15154] F2FS-fs (loop3): recover fsync data on readonly fs [ 297.061688][T15154] F2FS-fs (loop3): checkpoint=disable on readonly fs [ 297.281281][T15240] loop4: detected capacity change from 0 to 4096 [ 297.357065][T15240] EXT4-fs (loop4): Test dummy encryption mode enabled [ 297.377827][T15256] xt_l2tp: invalid flags combination: c [ 297.389904][T15240] EXT4-fs (loop4): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,noauto_da_alloc,dioread_nolock,test_dummy_encryption,block_validity,nodelalloc,minixdf,auto_da_alloc,,errors=continue. Quota mode: writeback. [ 297.435385][T15240] overlayfs: missing 'lowerdir' [ 297.499081][T15276] netlink: 'syz.3.7180': attribute type 14 has an invalid length. [ 297.527548][T15284] loop3: detected capacity change from 0 to 256 [ 297.551873][T15284] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000001) [ 297.567447][T15284] FAT-fs (loop3): Filesystem has been set read-only [ 298.243891][ T685] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 298.361305][T15407] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 298.446880][T15296] loop0: detected capacity change from 0 to 131072 [ 298.483262][T15296] F2FS-fs (loop0): Test dummy encryption mode enabled [ 298.521814][ T685] usb 2-1: Using ep0 maxpacket: 8 [ 298.533687][T15296] F2FS-fs (loop0): invalid crc value [ 298.535591][T15436] xt_TCPMSS: Only works on TCP SYN packets [ 298.565418][T15296] F2FS-fs (loop0): Found nat_bits in checkpoint [ 298.568706][T15445] device vti1 entered promiscuous mode [ 298.642619][T15457] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 298.693949][T15296] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 298.703679][ T685] usb 2-1: unable to get BOS descriptor or descriptor too short [ 298.715884][T15468] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 298.724125][T15468] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 298.789139][ T685] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 298.809505][ T685] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 298.871323][ T30] kauditd_printk_skb: 77 callbacks suppressed [ 298.871337][ T30] audit: type=1400 audit(2000525519.820:1186): avc: denied { bind } for pid=15485 comm="syz.4.7277" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 298.923585][T15492] device ip6gre1 entered promiscuous mode [ 298.943951][ T30] audit: type=1400 audit(2000525519.820:1187): avc: denied { name_bind } for pid=15485 comm="syz.4.7277" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 298.981559][ T685] usb 2-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40 [ 299.012939][ T685] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 299.030881][ T30] audit: type=1400 audit(2000525519.820:1188): avc: denied { node_bind } for pid=15485 comm="syz.4.7277" saddr=ff01::1 src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 299.050106][ T685] usb 2-1: Product: syz [ 299.063230][ T685] usb 2-1: Manufacturer: syz [ 299.084262][ T685] usb 2-1: SerialNumber: syz [ 299.387082][T15551] loop3: detected capacity change from 0 to 512 [ 299.524420][ T30] audit: type=1400 audit(2000525520.428:1189): avc: denied { getopt } for pid=15576 comm="syz.0.7322" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 299.553561][T15551] EXT4-fs (loop3): mounted filesystem without journal. Opts: nojournal_checksum,,errors=continue. Quota mode: writeback. [ 299.596017][T15551] EXT4-fs error (device loop3): ext4_get_first_dir_block:3597: inode #12: comm syz.3.7310: Directory block failed checksum [ 299.637459][ T30] audit: type=1400 audit(2000525520.493:1190): avc: denied { remove_name } for pid=15549 comm="syz.3.7310" name="file0" dev="loop3" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 299.662383][ T30] audit: type=1400 audit(2000525520.493:1191): avc: denied { rename } for pid=15549 comm="syz.3.7310" name="file0" dev="loop3" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 299.678575][ T685] usb 2-1: cannot find UAC_HEADER [ 299.689549][ T30] audit: type=1400 audit(2000525520.493:1192): avc: denied { unlink } for pid=15549 comm="syz.3.7310" name="file1" dev="loop3" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 299.710000][ T685] snd-usb-audio: probe of 2-1:1.0 failed with error -22 [ 299.752617][ T30] audit: type=1400 audit(2000525520.493:1193): avc: denied { rename } for pid=15549 comm="syz.3.7310" name="file1" dev="loop3" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 299.788094][ T685] usb 2-1: USB disconnect, device number 114 [ 299.815876][ T30] audit: type=1400 audit(2000525520.493:1194): avc: denied { rmdir } for pid=15549 comm="syz.3.7310" name="file0" dev="loop3" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 299.889436][ T30] audit: type=1400 audit(2000525520.671:1195): avc: denied { read } for pid=15598 comm="syz.3.7333" name="usbmon3" dev="devtmpfs" ino=164 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 299.994851][T15637] bridge2: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 300.081183][T15653] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 300.297873][T15698] IPv6: NLM_F_CREATE should be specified when creating new route [ 300.326956][T15711] __nla_validate_parse: 6 callbacks suppressed [ 300.326976][T15711] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7386'. [ 300.497950][T15751] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7407'. [ 300.523800][T15755] xt_policy: neither incoming nor outgoing policy selected [ 300.533529][T15757] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7409'. [ 300.589209][T15762] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 300.594408][T15765] loop3: detected capacity change from 0 to 256 [ 300.620069][T15762] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 300.668481][T15771] netlink: 'syz.2.7417': attribute type 3 has an invalid length. [ 300.687096][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 300.711395][T15784] binder: 15780:15784 unknown command 0 [ 300.733819][T15784] binder: 15780:15784 ioctl c0306201 2000000000c0 returned -22 [ 300.774640][T15797] x_tables: unsorted underflow at hook 3 [ 300.910328][T15829] loop1: detected capacity change from 0 to 512 [ 300.967039][T15840] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 300.975073][T15840] IPv6: NLM_F_CREATE should be set when creating new route [ 300.975094][T15840] IPv6: NLM_F_CREATE should be set when creating new route [ 301.025378][T15858] netlink: 'syz.0.7457': attribute type 3 has an invalid length. [ 301.075183][T15871] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7466'. [ 301.109227][T15829] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,,errors=continue. Quota mode: writeback. [ 301.122443][T15879] netlink: 'syz.3.7471': attribute type 12 has an invalid length. [ 301.148317][T15829] ext4 filesystem being mounted at /1394/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 301.156967][T15881] netlink: 9 bytes leftover after parsing attributes in process `syz.4.7472'. [ 301.181237][T15881] device gretap0 entered promiscuous mode [ 301.361877][T15928] netlink: 'syz.0.7492': attribute type 3 has an invalid length. [ 301.393178][T15934] loop2: detected capacity change from 0 to 128 [ 301.502048][T15961] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7512'. [ 301.615358][T15988] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7524'. [ 301.650000][T15994] loop4: detected capacity change from 0 to 256 [ 301.669827][T15998] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7529'. [ 301.717934][T15998] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 302.217711][T16095] x_tables: ip_tables: REDIRECT target: used from hooks INPUT, but only usable from PREROUTING/OUTPUT [ 302.250630][T16032] loop2: detected capacity change from 0 to 40427 [ 302.350715][T16032] F2FS-fs (loop2): Corrupted extension count (64 + 1 > 64) [ 302.358112][T16032] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 302.368933][T16124] netlink: 'syz.1.7589': attribute type 3 has an invalid length. [ 302.370577][T16032] F2FS-fs (loop2): fault_type options not supported [ 302.390605][T16124] netlink: 'syz.1.7589': attribute type 3 has an invalid length. [ 302.396090][T16122] loop3: detected capacity change from 0 to 2048 [ 302.407800][T16032] F2FS-fs (loop2): invalid crc value [ 302.433048][T16032] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 302.500515][T16032] F2FS-fs (loop2): Start checkpoint disabled! [ 302.513191][T16122] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 302.545214][T16032] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 302.567126][T16032] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 302.852812][T16199] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7625'. [ 302.883128][T16199] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7625'. [ 302.905776][T16204] device batadv_slave_0 entered promiscuous mode [ 302.913492][T16204] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 303.178287][T16260] netlink: 'syz.1.7654': attribute type 30 has an invalid length. [ 303.245281][T16269] loop2: detected capacity change from 0 to 256 [ 303.293754][T16213] loop4: detected capacity change from 0 to 40427 [ 303.318079][T16269] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000001) [ 303.329632][T16280] loop0: detected capacity change from 0 to 4096 [ 303.336945][T16269] FAT-fs (loop2): Filesystem has been set read-only [ 303.365082][T16280] EXT4-fs (loop0): Test dummy encryption mode enabled [ 303.384589][T16280] EXT4-fs (loop0): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,noauto_da_alloc,dioread_nolock,test_dummy_encryption,block_validity,nodelalloc,minixdf,auto_da_alloc,,errors=continue. Quota mode: writeback. [ 303.417375][T16213] F2FS-fs (loop4): invalid crc value [ 303.423117][T16280] overlayfs: missing 'lowerdir' [ 303.423915][T16213] F2FS-fs (loop4): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 303.503228][T16309] loop1: detected capacity change from 0 to 512 [ 303.512306][T16213] F2FS-fs (loop4): recover fsync data on readonly fs [ 303.520476][T16213] F2FS-fs (loop4): checkpoint=disable on readonly fs [ 303.568178][T16317] IPv6: sit1: Disabled Multicast RS [ 304.318049][ T30] kauditd_printk_skb: 51 callbacks suppressed [ 304.318064][ T30] audit: type=1326 audit(2000525524.918:1247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16434 comm="syz.0.7739" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 304.441872][ T30] audit: type=1326 audit(2000525524.918:1248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16434 comm="syz.0.7739" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 304.554811][ T30] audit: type=1326 audit(2000525524.965:1249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16434 comm="syz.0.7739" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=97 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 304.636357][ T30] audit: type=1326 audit(2000525524.965:1250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16434 comm="syz.0.7739" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 304.717073][ T30] audit: type=1326 audit(2000525524.965:1251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16434 comm="syz.0.7739" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 304.830248][ T30] audit: type=1326 audit(2000525525.396:1252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16523 comm="syz.3.7783" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd0a862c019 code=0x7ffc0000 [ 304.898884][ T30] audit: type=1326 audit(2000525525.396:1253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16523 comm="syz.3.7783" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=152 compat=0 ip=0x7fd0a862c019 code=0x7ffc0000 [ 304.948448][T16551] IPv6: NLM_F_REPLACE set, but no existing node found! [ 304.966390][ T30] audit: type=1326 audit(2000525525.396:1254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16523 comm="syz.3.7783" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd0a862c019 code=0x7ffc0000 [ 305.236046][T16412] F2FS-fs (loop4): Test dummy encryption mode enabled [ 305.288159][T16412] F2FS-fs (loop4): invalid crc value [ 305.326843][T16590] EXT4-fs (loop2): mounted filesystem without journal. Opts: nojournal_checksum,,errors=continue. Quota mode: writeback. [ 305.365883][T16412] F2FS-fs (loop4): Found nat_bits in checkpoint [ 305.388107][T16590] EXT4-fs error (device loop2): ext4_get_first_dir_block:3597: inode #12: comm syz.2.7810: Directory block failed checksum [ 305.437447][T16412] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 305.470250][T16617] bridge2: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 305.723472][ T30] audit: type=1326 audit(2000525526.219:1255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16649 comm="syz.0.7839" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 305.806423][ T30] audit: type=1326 audit(2000525526.266:1256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16649 comm="syz.0.7839" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 305.806467][T16661] __nla_validate_parse: 5 callbacks suppressed [ 305.806479][T16661] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7845'. [ 306.062226][T16697] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7862'. [ 306.105467][T16705] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7864'. [ 306.118205][T16709] xt_policy: neither incoming nor outgoing policy selected [ 306.183880][T16724] set_capacity_and_notify: 2 callbacks suppressed [ 306.183900][T16724] loop0: detected capacity change from 0 to 128 [ 306.260002][T16742] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7884'. [ 306.291763][T16747] netlink: 44 bytes leftover after parsing attributes in process `syz.4.7888'. [ 306.356719][T16740] device veth0_vlan entered promiscuous mode [ 306.369588][T16740] device vti1 left promiscuous mode [ 306.375606][T16743] @0: renamed from bond_slave_1 [ 306.382004][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 306.402376][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 306.424566][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 306.440324][T16740] syz.3.7885 (16740) used greatest stack depth: 20456 bytes left [ 306.446384][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 306.462822][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 306.473415][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 306.483741][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): 77: link becomes ready [ 306.492064][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 306.500589][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 306.508983][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 306.517180][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 306.525442][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 306.533867][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): 5: link becomes ready [ 306.541523][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 306.550121][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 306.558588][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 306.567650][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 306.576191][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 306.584928][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 306.593393][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 306.601583][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 306.610757][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 306.619310][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 306.628009][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 306.636603][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 306.644774][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 306.652950][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 306.661522][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 306.670707][ T1160] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 306.694787][ T1160] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 306.702689][ T1160] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 306.828935][T16796] netlink: 'syz.2.7911': attribute type 21 has an invalid length. [ 306.846277][T16796] netlink: 44 bytes leftover after parsing attributes in process `syz.2.7911'. [ 306.865434][T16801] netlink: 9 bytes leftover after parsing attributes in process `syz.3.7915'. [ 306.874181][T16807] netlink: 'syz.4.7917': attribute type 3 has an invalid length. [ 306.907480][T16801] device gretap0 entered promiscuous mode [ 307.009093][ T6573] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 307.066900][T16844] netlink: 14 bytes leftover after parsing attributes in process `syz.3.7937'. [ 307.093173][ T6573] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 307.105337][ T6573] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 307.107451][T16852] netlink: 'syz.4.7939': attribute type 3 has an invalid length. [ 307.143214][ T6573] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 307.200307][T16870] netlink: 'syz.0.7948': attribute type 10 has an invalid length. [ 307.233553][ T6573] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 307.246754][T16870] netlink: 'syz.0.7948': attribute type 10 has an invalid length. [ 307.282529][T16890] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7959'. [ 307.372374][T16908] xt_CT: You must specify a L4 protocol and not use inversions on it [ 307.529491][T16948] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7986'. [ 307.597759][ T1160] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 307.621052][T16962] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 307.828673][T17016] netlink: 'syz.0.8021': attribute type 7 has an invalid length. [ 307.854050][T17016] netlink: 'syz.0.8021': attribute type 5 has an invalid length. [ 307.878612][T17025] xt_hashlimit: invalid rate [ 307.939048][ T1160] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 307.951870][T17036] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 308.443498][T17123] netlink: 'syz.2.8083': attribute type 5 has an invalid length. [ 308.479607][T17134] x_tables: duplicate underflow at hook 1 [ 308.497312][T17137] device batadv_slave_0 entered promiscuous mode [ 308.531667][T17137] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 308.592082][T17148] netlink: 'syz.1.8088': attribute type 1 has an invalid length. [ 308.754696][T17192] loop1: detected capacity change from 0 to 256 [ 308.800650][T17192] FAT-fs (loop1): error, invalid access to FAT (entry 0x00000001) [ 308.817767][T17192] FAT-fs (loop1): Filesystem has been set read-only [ 309.169303][T17203] loop3: detected capacity change from 0 to 40427 [ 309.205004][T17203] F2FS-fs (loop3): Corrupted extension count (64 + 1 > 64) [ 309.242773][T17203] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 309.263848][T17203] F2FS-fs (loop3): fault_type options not supported [ 309.286459][T17203] F2FS-fs (loop3): invalid crc value [ 309.315940][T17203] F2FS-fs (loop3): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 309.326123][T17306] loop2: detected capacity change from 0 to 512 [ 309.345526][T17310] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 309.383034][T17203] F2FS-fs (loop3): Start checkpoint disabled! [ 309.392464][T17203] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 309.402932][T17203] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 310.146786][T17483] x_tables: unsorted entry at hook 1 [ 310.149699][T17484] device syz_tun entered promiscuous mode [ 310.182636][T17484] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 310.213742][T17489] bridge0: port 1(bridge_slave_0) entered disabled state [ 310.351205][T17533] loop4: detected capacity change from 0 to 256 [ 310.404477][T17550] loop3: detected capacity change from 0 to 128 [ 310.409200][T17533] exfat: Deprecated parameter 'utf8' [ 310.432698][T17550] FAT-fs (loop3): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 310.455334][T17533] exFAT-fs (loop4): failed to load upcase table (idx : 0x0001fe89, chksum : 0x6d11cf4d, utbl_chksum : 0xe619d30d) [ 310.518629][ T30] kauditd_printk_skb: 43 callbacks suppressed [ 310.518645][ T30] audit: type=1400 audit(2000525530.719:1300): avc: denied { write } for pid=17531 comm="syz.4.8277" name="/" dev="loop4" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 310.525444][T17565] loop1: detected capacity change from 0 to 1024 [ 310.553950][ T30] audit: type=1400 audit(2000525530.747:1301): avc: denied { add_name } for pid=17531 comm="syz.4.8277" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 310.647588][ T30] audit: type=1400 audit(2000525530.747:1302): avc: denied { create } for pid=17531 comm="syz.4.8277" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 310.675544][ T30] audit: type=1400 audit(2000525530.747:1303): avc: denied { associate } for pid=17531 comm="syz.4.8277" name="bus" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 310.698118][ T30] audit: type=1400 audit(2000525530.793:1304): avc: denied { unmount } for pid=292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 310.730773][T17565] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (51269!=20869) [ 310.769000][T17565] EXT4-fs error (device loop1): ext4_get_journal_inode:5178: inode #32: comm syz.1.8291: iget: special inode unallocated [ 310.793172][T17565] EXT4-fs (loop1): no journal found [ 310.798430][T17565] EXT4-fs (loop1): can't get journal size [ 310.814944][T17565] EXT4-fs (loop1): filesystem is read-only [ 310.820804][T17565] EXT4-fs (loop1): mounted filesystem without journal. Opts: max_batch_time=0x0000000000000004,noload,noblock_validity,bsdgroups,resuid=0x0000000000000000,,errors=continue. Quota mode: none. [ 310.861453][T17565] EXT4-fs error (device loop1): ext4_lookup:1850: inode #2: comm syz.1.8291: bad inode number: 12 [ 311.009473][T17641] xt_policy: neither incoming nor outgoing policy selected [ 311.180311][T17669] netlink: 'syz.0.8344': attribute type 4 has an invalid length. [ 311.204846][T17669] __nla_validate_parse: 10 callbacks suppressed [ 311.204867][T17669] netlink: 17 bytes leftover after parsing attributes in process `syz.0.8344'. [ 311.246024][T17678] netlink: 44 bytes leftover after parsing attributes in process `syz.1.8348'. [ 311.272613][T17682] device bridge_slave_0 left promiscuous mode [ 311.289824][T17682] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 311.301932][T17682] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 311.323076][T17682] device batadv_slave_0 left promiscuous mode [ 311.333848][T17682] device bridge3 left promiscuous mode [ 311.341353][T17682] device ipip1 left promiscuous mode [ 311.385836][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 311.395352][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): veth3: link becomes ready [ 311.404511][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): veth2: link becomes ready [ 311.588572][ T30] audit: type=1400 audit(2000525531.720:1305): avc: denied { create } for pid=17721 comm="syz.1.8370" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 311.728220][T17748] netlink: 'syz.1.8378': attribute type 3 has an invalid length. [ 311.790226][ T30] audit: type=1400 audit(2000525531.907:1306): avc: denied { create } for pid=17755 comm="syz.4.8383" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 311.802135][T17627] loop2: detected capacity change from 0 to 131072 [ 311.831293][ T30] audit: type=1400 audit(2000525531.935:1307): avc: denied { shutdown } for pid=17755 comm="syz.4.8383" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 311.852488][T17627] F2FS-fs (loop2): Test dummy encryption mode enabled [ 311.865063][T17627] F2FS-fs (loop2): invalid crc value [ 311.871298][T17762] loop4: detected capacity change from 0 to 512 [ 311.879243][T17627] F2FS-fs (loop2): Found nat_bits in checkpoint [ 311.920728][T17627] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 311.947488][ T1160] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 311.989039][T17762] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,,errors=continue. Quota mode: writeback. [ 312.015706][T17762] ext4 filesystem being mounted at /1697/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 312.177325][T17811] binfmt_misc: register: failed to install interpreter file ./file0 [ 312.236146][ T1160] usb 4-1: Using ep0 maxpacket: 8 [ 312.325568][ T30] audit: type=1326 audit(2000525532.412:1308): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17832 comm="syz.0.8421" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 312.383601][ T30] audit: type=1326 audit(2000525532.440:1309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17832 comm="syz.0.8421" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=114 compat=0 ip=0x7fd099eb1019 code=0x7ffc0000 [ 312.439209][ T1160] usb 4-1: unable to get BOS descriptor or descriptor too short [ 312.491512][T17854] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8431'. [ 312.510109][T17856] loop0: detected capacity change from 0 to 2048 [ 312.535715][ T1160] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 312.544506][T17862] device bridge5 entered promiscuous mode [ 312.556840][ T1160] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 312.579411][ T5751] loop0: p3 < > [ 312.589109][T17856] loop0: p3 < > [ 312.679778][ T5751] udevd[5751]: inotify_add_watch(7, /dev/loop0p3, 10) failed: No such file or directory [ 312.698732][ T5751] udevd[5751]: inotify_add_watch(7, /dev/loop0p3, 10) failed: No such file or directory [ 312.738606][ T1160] usb 4-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40 [ 312.755464][ T1160] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 312.777093][ T1160] usb 4-1: Product: syz [ 312.787686][ T1160] usb 4-1: Manufacturer: syz [ 312.802600][ T6573] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 312.812877][ T1160] usb 4-1: SerialNumber: syz [ 312.861509][T17908] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8457'. [ 312.976537][T17927] x_tables: ip_tables: REDIRECT target: used from hooks INPUT, but only usable from PREROUTING/OUTPUT [ 313.017957][T17935] A link change request failed with some changes committed already. Interface team_slave_1 may have been left with an inconsistent configuration, please check. [ 313.065458][T17933] loop0: detected capacity change from 0 to 8192 [ 313.080980][ T6573] usb 3-1: Using ep0 maxpacket: 8 [ 313.135005][T17933] loop0: p1 p2 p3 p4 [ 313.139121][T17933] loop0: p1 start 67108864 is beyond EOD, truncated [ 313.145811][T17933] loop0: p2 start 1896808451 is beyond EOD, truncated [ 313.152597][T17933] loop0: p3 start 150996224 is beyond EOD, truncated [ 313.159523][T17933] loop0: p4 size 2663388001 extends beyond EOD, truncated [ 313.189593][T17951] loop1: detected capacity change from 0 to 2048 [ 313.220874][T17951] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 313.246526][ T7485] udevd[7485]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 313.262312][ T6573] usb 3-1: unable to get BOS descriptor or descriptor too short [ 313.278209][ T7485] udevd[7485]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 313.292915][T17965] xt_hashlimit: invalid rate [ 313.358566][ T6573] usb 3-1: config 8 has an invalid interface number: 172 but max is 0 [ 313.367014][ T6573] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 313.375588][T17981] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 313.412014][ T1160] usb 4-1: cannot find UAC_HEADER [ 313.417229][ T1160] snd-usb-audio: probe of 4-1:1.0 failed with error -22 [ 313.434582][ T6573] usb 3-1: config 8 has no interface number 0 [ 313.449647][ T6573] usb 3-1: config 8 interface 172 altsetting 255 endpoint 0x8F has invalid wMaxPacketSize 0 [ 313.463784][ T1160] usb 4-1: USB disconnect, device number 108 [ 313.480516][ T6573] usb 3-1: config 8 interface 172 altsetting 255 bulk endpoint 0x8F has invalid maxpacket 0 [ 313.503076][ T6573] usb 3-1: config 8 interface 172 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 313.505064][T18001] netlink: 'syz.0.8501': attribute type 3 has an invalid length. [ 313.524286][ T6573] usb 3-1: config 8 interface 172 has no altsetting 0 [ 313.531968][T18001] netlink: 'syz.0.8501': attribute type 3 has an invalid length. [ 313.687860][T18039] netlink: 'syz.1.8520': attribute type 3 has an invalid length. [ 313.689239][T18037] loop0: detected capacity change from 0 to 256 [ 313.711381][ T6573] usb 3-1: New USB device found, idVendor=0411, idProduct=0012, bcdDevice=c7.75 [ 313.724066][ T6573] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 313.732343][ T6573] usb 3-1: Product: syz [ 313.741343][ T6573] usb 3-1: Manufacturer: syz [ 313.746435][ T6573] usb 3-1: SerialNumber: syz [ 313.751223][T18043] netlink: 'syz.1.8532': attribute type 46 has an invalid length. [ 313.788582][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 313.908483][T18073] netlink: 5 bytes leftover after parsing attributes in process `syz.3.8544'. [ 313.914718][T18072] xt_hashlimit: max too large, truncated to 1048576 [ 313.920591][T18073] 0{X: renamed from gretap0 [ 313.951870][T18073] device 30{X left promiscuous mode [ 313.968581][T18073] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 314.008501][T18083] netlink: 'syz.0.8541': attribute type 1 has an invalid length. [ 314.107032][ T6573] rtl8150 3-1:8.172: couldn't find required endpoints [ 314.114545][ T6573] rtl8150: probe of 3-1:8.172 failed with error -5 [ 314.147750][ T6573] usb 3-1: USB disconnect, device number 111 [ 314.241298][T18138] loop4: detected capacity change from 0 to 1024 [ 314.283116][T18138] EXT4-fs (loop4): Mount option "noacl" will be removed by 3.5 [ 314.283116][T18138] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 314.283116][T18138] [ 314.310433][T18138] EXT4-fs (loop4): can't mount with data=, fs mounted w/o journal [ 314.368439][T18162] xt_CT: You must specify a L4 protocol and not use inversions on it [ 314.430510][T18176] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8590'. [ 314.453386][T18176] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8590'. [ 314.479661][T18176] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8590'. [ 314.505513][T18176] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 314.589616][T18208] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8603'. [ 314.595681][T18210] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8604'. [ 314.750950][T18234] bridge0: port 2(bridge_slave_1) entered disabled state [ 314.877618][T18266] IPv6: Can't replace route, no match found [ 314.966308][T18282] netlink: 'syz.0.8641': attribute type 12 has an invalid length. [ 315.316737][T18354] netlink: 'syz.0.8677': attribute type 4 has an invalid length. [ 315.324671][T18354] netlink: 'syz.0.8677': attribute type 5 has an invalid length. [ 315.580351][T18413] bridge0: port 1(bridge_slave_0) entered disabled state [ 315.769343][T18458] incfs: Backing dir is not set, filesystem can't be mounted. [ 315.790005][T18458] incfs: mount failed -2 [ 315.795026][T18462] kernel profiling enabled (shift: 8) [ 315.920374][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 315.920390][ T30] audit: type=1400 audit(2000525535.770:1335): avc: denied { bind } for pid=18489 comm="syz.3.8744" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 315.958817][T18492] new mount options do not match the existing superblock, will be ignored [ 315.974463][ T30] audit: type=1400 audit(2000525535.817:1336): avc: denied { mount } for pid=18491 comm="syz.0.8747" name="/" dev="cgroup" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 316.003375][ T30] audit: type=1400 audit(2000525535.827:1337): avc: denied { unmount } for pid=285 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 316.073955][T18506] loop1: detected capacity change from 0 to 1024 [ 316.135601][ T30] audit: type=1326 audit(2000525535.967:1338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18529 comm="syz.2.8765" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f900c334019 code=0x7ffc0000 [ 316.164523][T18506] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 316.169576][T18532] loop0: detected capacity change from 0 to 1024 [ 316.181715][ T30] audit: type=1326 audit(2000525536.004:1339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18529 comm="syz.2.8765" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=292 compat=0 ip=0x7f900c334019 code=0x7ffc0000 [ 316.215756][ T30] audit: type=1326 audit(2000525536.004:1340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18529 comm="syz.2.8765" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f900c334019 code=0x7ffc0000 [ 316.220101][T18532] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (51269!=20869) [ 316.254499][T18506] EXT4-fs error (device loop1): ext4_map_blocks:632: inode #3: block 2: comm syz.1.8752: lblock 2 mapped to illegal pblock 2 (length 1) [ 316.259971][ T30] audit: type=1326 audit(2000525536.004:1341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18529 comm="syz.2.8765" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f900c334019 code=0x7ffc0000 [ 316.294512][T18532] EXT4-fs error (device loop0): ext4_get_journal_inode:5178: inode #32: comm syz.0.8763: iget: special inode unallocated [ 316.317397][T18506] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 316.330288][T18532] EXT4-fs (loop0): no journal found [ 316.335520][T18532] EXT4-fs (loop0): can't get journal size [ 316.335710][T18506] EXT4-fs error (device loop1): ext4_map_blocks:632: inode #3: block 48: comm syz.1.8752: lblock 0 mapped to illegal pblock 48 (length 1) [ 316.361883][T18553] x_tables: unsorted entry at hook 1 [ 316.368665][T18532] EXT4-fs (loop0): filesystem is read-only [ 316.379777][T18506] Quota error (device loop1): v2_write_file_info: Can't write info structure [ 316.397486][T18532] EXT4-fs (loop0): mounted filesystem without journal. Opts: max_batch_time=0x0000000000000004,noload,noblock_validity,bsdgroups,resuid=0x0000000000000000,,errors=continue. Quota mode: none. [ 316.436712][T18506] EXT4-fs error (device loop1): ext4_acquire_dquot:6227: comm syz.1.8752: Failed to acquire dquot type 0 [ 316.450714][T18532] EXT4-fs error (device loop0): ext4_lookup:1850: inode #2: comm syz.0.8763: bad inode number: 12 [ 316.483331][T18506] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5904: Corrupt filesystem [ 316.534252][T18506] EXT4-fs error (device loop1): ext4_evict_inode:285: inode #11: comm syz.1.8752: mark_inode_dirty error [ 316.570404][T18506] EXT4-fs warning (device loop1): ext4_evict_inode:288: couldn't mark inode dirty (err -117) [ 316.603963][T18506] EXT4-fs (loop1): 1 orphan inode deleted [ 316.610871][ T30] audit: type=1326 audit(2000525536.416:1342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18587 comm="syz.4.8791" exe="/root/ci2-android-5-15/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbcf6aa1019 code=0x0 [ 316.617149][T18506] EXT4-fs (loop1): mounted filesystem without journal. Opts: nodioread_nolock,noblock_validity,resuid=0x0000000000000000,norecovery,nodiscard,nodioread_nolock,nomblk_io_submit,,errors=continue. Quota mode: none. [ 316.672348][T10103] EXT4-fs error (device loop1): ext4_map_blocks:632: inode #3: block 1: comm kworker/u4:5: lblock 1 mapped to illegal pblock 1 (length 1) [ 316.696914][T18606] __nla_validate_parse: 4 callbacks suppressed [ 316.696932][T18606] netlink: 32 bytes leftover after parsing attributes in process `syz.3.8809'. [ 316.720828][T10103] EXT4-fs error (device loop1): ext4_release_dquot:6263: comm kworker/u4:5: Failed to release dquot type 0 [ 316.748131][ T45] EXT4-fs error (device loop1): ext4_map_blocks:632: inode #3: block 1: comm kworker/u4:2: lblock 1 mapped to illegal pblock 1 (length 1) [ 316.773761][ T45] EXT4-fs error (device loop1): ext4_release_dquot:6263: comm kworker/u4:2: Failed to release dquot type 0 [ 316.785828][T18615] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 316.801607][ T290] EXT4-fs error (device loop1): __ext4_get_inode_loc:4365: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 316.821053][T18619] loop3: detected capacity change from 0 to 128 [ 316.829796][ T290] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5904: Corrupt filesystem [ 316.839771][ T290] EXT4-fs error (device loop1): ext4_quota_off:6533: inode #3: comm syz-executor: mark_inode_dirty error [ 316.900149][T18629] binder: 18627:18629 unknown command 0 [ 316.905742][T18629] binder: 18627:18629 ioctl c0306201 2000000000c0 returned -22 [ 316.906854][T18630] device gretap0 left promiscuous mode [ 316.931829][T18632] netlink: 44 bytes leftover after parsing attributes in process `syz.2.8811'. [ 316.955706][T18630] device batadv_slave_0 left promiscuous mode [ 316.999259][T18638] EXT4-fs (loop0): mounted filesystem without journal. Opts: min_batch_time=0x0000000000000004,abort,,errors=continue. Quota mode: writeback. [ 317.012961][T18630] IPv6: ADDRCONF(NETDEV_CHANGE): ip6tnl3: link becomes ready [ 317.021366][T18638] ext4 filesystem being mounted at /1749/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 317.033962][T18630] IPv6: ADDRCONF(NETDEV_CHANGE): ip6tnl3: link becomes ready [ 317.058851][T18636] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 317.066111][T18636] IPv6: NLM_F_CREATE should be set when creating new route [ 317.073382][T18636] IPv6: NLM_F_CREATE should be set when creating new route [ 317.081763][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 317.100447][T10103] bridge0: port 1(bridge_slave_0) entered blocking state [ 317.107539][T10103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 317.121757][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 317.130121][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 317.139960][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): 4@0: link becomes ready [ 317.148034][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 317.177986][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 317.194425][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 317.214649][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 317.223936][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): veth3: link becomes ready [ 317.232013][T10103] IPv6: ADDRCONF(NETDEV_CHANGE): veth2: link becomes ready [ 317.338763][T18678] bridge3: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 317.487342][T18704] device bridge_slave_1 left promiscuous mode [ 317.514474][T18704] bridge0: port 2(bridge_slave_1) entered disabled state [ 317.538918][T18704] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 317.657447][T18738] netlink: 52 bytes leftover after parsing attributes in process `syz.0.8863'. [ 317.685578][T18740] set_capacity_and_notify: 1 callbacks suppressed [ 317.685595][T18740] loop2: detected capacity change from 0 to 512 [ 317.746771][T18759] binfmt_misc: register: failed to install interpreter file ./file0 [ 317.790882][T18767] netlink: 'syz.1.8877': attribute type 10 has an invalid length. [ 317.827396][T18767] netlink: 'syz.1.8877': attribute type 10 has an invalid length. [ 317.877610][T18781] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8884'. [ 317.894932][T18781] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 317.946383][ T6] ip6_tnl_xmit_ctl: 2 callbacks suppressed [ 317.946398][ T6] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 317.951264][T18740] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,,errors=continue. Quota mode: writeback. [ 317.952312][ T6] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 317.988842][T18740] ext4 filesystem being mounted at /393/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 318.066301][ T1160] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 318.155114][T18818] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8902'. [ 318.176387][T18825] loop2: detected capacity change from 0 to 256 [ 318.187916][T18821] device syz_tun left promiscuous mode [ 318.216923][T18821] device batadv_slave_0 left promiscuous mode [ 318.340002][ T1160] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 318.357801][T18825] FAT-fs (loop2): Directory bread(block 64) failed [ 318.396076][T18825] FAT-fs (loop2): Directory bread(block 65) failed [ 318.407859][T18825] FAT-fs (loop2): Directory bread(block 66) failed [ 318.429638][T18825] FAT-fs (loop2): Directory bread(block 67) failed [ 318.449005][T18825] FAT-fs (loop2): Directory bread(block 68) failed [ 318.479151][T18868] netlink: 'syz.0.8925': attribute type 9 has an invalid length. [ 318.499832][T18825] FAT-fs (loop2): Directory bread(block 69) failed [ 318.510831][T18868] netlink: 36 bytes leftover after parsing attributes in process `syz.0.8925'. [ 318.523044][T18825] FAT-fs (loop2): Directory bread(block 70) failed [ 318.529624][T18825] FAT-fs (loop2): Directory bread(block 71) failed [ 318.549305][T18825] FAT-fs (loop2): Directory bread(block 72) failed [ 318.606692][T18825] FAT-fs (loop2): Directory bread(block 73) failed [ 318.833841][T18905] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 318.971259][ T1160] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 318.989141][T18928] loop4: detected capacity change from 0 to 2048 [ 319.053571][T18944] device sit0 entered promiscuous mode [ 319.067232][T18928] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 319.091825][T18944] netlink: 1 bytes leftover after parsing attributes in process `syz.0.8962'. [ 319.135612][T18951] netlink: 'syz.1.8965': attribute type 6 has an invalid length. [ 319.356825][T19010] xt_hashlimit: invalid rate [ 319.637047][T19081] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9028'. [ 319.639927][T19076] loop2: detected capacity change from 0 to 4096 [ 319.660846][T19081] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9028'. [ 319.692791][T19076] EXT4-fs (loop2): Test dummy encryption mode enabled [ 319.717802][T19076] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 319.757157][T19076] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=280ec1a8, mo2=0003] [ 319.774380][T19076] System zones: 0-5 [ 319.779313][T19076] EXT4-fs (loop2): mounted filesystem without journal. Opts: debug,test_dummy_encryption=v1,inlinecrypt,delalloc,noinit_itable,norecovery,minixdf,nodioread_nolock,errors=remount-ro,jqfmt=vfsv0,usrquota,max_dir_size_kb=0x0000000000000008,. Quota mode: writeback. [ 319.792531][T19105] x_tables: duplicate underflow at hook 1 [ 319.823544][T19076] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 320.048953][T19156] netlink: 'syz.4.9064': attribute type 3 has an invalid length. [ 320.066563][T19162] loop1: detected capacity change from 0 to 256 [ 320.142727][T19170] netlink: 'syz.4.9071': attribute type 5 has an invalid length. [ 320.167743][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 320.223564][T19184] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 320.232734][T19183] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9076'. [ 320.317727][T19196] netlink: 'syz.4.9086': attribute type 46 has an invalid length. [ 320.349214][ T6573] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 320.357392][T19208] 0{X: renamed from gretap0 [ 320.378382][T19208] device 30{X left promiscuous mode [ 320.385977][T19208] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 320.438784][T19219] netlink: 'syz.3.9097': attribute type 1 has an invalid length. [ 320.526037][T19240] xt_hashlimit: max too large, truncated to 1048576 [ 320.587078][T19251] netlink: 'syz.1.9112': attribute type 7 has an invalid length. [ 320.605775][T19251] netlink: 'syz.1.9112': attribute type 5 has an invalid length. [ 320.617176][ T6573] usb 1-1: Using ep0 maxpacket: 8 [ 320.779809][T19290] netlink: 'syz.4.9129': attribute type 7 has an invalid length. [ 320.798284][ T6573] usb 1-1: unable to get BOS descriptor or descriptor too short [ 320.804796][T19290] netlink: 'syz.4.9129': attribute type 5 has an invalid length. [ 320.813795][T19298] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 320.849214][T19300] loop4: detected capacity change from 0 to 256 [ 320.855987][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 320.886972][ T6573] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 320.910691][ T6573] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 320.965532][T19322] xt_hashlimit: max too large, truncated to 1048576 [ 321.108300][ T6573] usb 1-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40 [ 321.129646][ T6573] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 321.137920][ T6573] usb 1-1: Product: syz [ 321.172264][ T6573] usb 1-1: Manufacturer: syz [ 321.188356][ T6573] usb 1-1: SerialNumber: syz [ 321.316055][T19396] netlink: 'syz.4.9183': attribute type 9 has an invalid length. [ 321.356742][T19400] ================================================================== [ 321.364854][T19400] BUG: KASAN: use-after-free in unaccount_page_cache_page+0x6f1/0x760 [ 321.373026][T19400] Read of size 4 at addr ffff888128531470 by task syz.2.9186/19400 [ 321.380924][T19400] [ 321.383258][T19400] CPU: 1 PID: 19400 Comm: syz.2.9186 Tainted: G W syzkaller #0 [ 321.392112][T19400] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 321.402191][T19400] Call Trace: [ 321.405479][T19400] [ 321.408417][T19400] __dump_stack+0x21/0x30 [ 321.412754][T19400] dump_stack_lvl+0x110/0x170 [ 321.417434][T19400] ? show_regs_print_info+0x20/0x20 [ 321.422648][T19400] ? load_image+0x3f0/0x3f0 [ 321.427175][T19400] print_address_description+0x7f/0x2c0 [ 321.433010][T19400] ? unaccount_page_cache_page+0x6f1/0x760 [ 321.438969][T19400] kasan_report+0x10f/0x150 [ 321.445160][T19400] ? unaccount_page_cache_page+0x6f1/0x760 [ 321.453066][T19400] __asan_report_load4_noabort+0x14/0x20 [ 321.459049][T19400] unaccount_page_cache_page+0x6f1/0x760 [ 321.464719][T19400] __delete_from_page_cache+0xbe/0x470 [ 321.471667][T19400] ? __bpf_trace_file_check_and_advance_wb_err+0x30/0x30 [ 321.479345][T19400] ? __kasan_check_write+0x14/0x20 [ 321.484489][T19400] ? __kasan_check_read+0x11/0x20 [ 321.489634][T19400] ? workingset_eviction+0x402/0x9f0 [ 321.494946][T19400] __remove_mapping+0x601/0x990 [ 321.499819][T19400] ? remove_mapping+0xa0/0xa0 [ 321.504610][T19400] ? __kasan_check_read+0x11/0x20 [ 321.509658][T19400] shrink_page_list+0x2a24/0x5800 [ 321.514704][T19400] ? shrink_page_list+0x8e1/0x5800 [ 321.519843][T19400] ? reclaim_clean_pages_from_list+0x7e0/0x7e0 [ 321.526273][T19400] ? __this_cpu_preempt_check+0x13/0x20 [ 321.531838][T19400] ? __mod_zone_page_state+0x8e/0xd0 [ 321.537151][T19400] ? isolate_lru_pages+0xff1/0x11f0 [ 321.542486][T19400] ? should_run_aging+0x410/0x410 [ 321.547628][T19400] ? cgroup_rstat_updated+0x30/0x360 [ 321.553035][T19400] ? _raw_spin_lock_irq+0x95/0xf0 [ 321.558059][T19400] ? __this_cpu_preempt_check+0x13/0x20 [ 321.563597][T19400] ? __count_memcg_events+0xec/0x120 [ 321.569052][T19400] shrink_lruvec+0x1297/0x3a40 [ 321.573835][T19400] ? down_read_trylock+0x317/0x630 [ 321.579078][T19400] ? mem_cgroup_shrink_node+0x550/0x550 [ 321.584625][T19400] ? __kasan_check_write+0x14/0x20 [ 321.589744][T19400] ? _raw_spin_lock+0x94/0xf0 [ 321.594457][T19400] ? _raw_spin_trylock_bh+0x150/0x150 [ 321.599845][T19400] ? cgroup_rstat_flush_locked+0xa29/0xa70 [ 321.605661][T19400] ? inactive_is_low+0x160/0x2f0 [ 321.610597][T19400] ? css_next_descendant_pre+0x1e1/0x210 [ 321.616226][T19400] ? mem_cgroup_iter+0x465/0x6c0 [ 321.621163][T19400] shrink_node+0x11ee/0x2a40 [ 321.625797][T19400] ? allow_direct_reclaim+0x370/0x370 [ 321.631196][T19400] do_try_to_free_pages+0x5a7/0x1580 [ 321.636606][T19400] ? try_to_free_pages+0xc50/0xc50 [ 321.641736][T19400] ? propagate_protected_usage+0x84/0x250 [ 321.647493][T19400] try_to_free_mem_cgroup_pages+0x261/0x610 [ 321.653473][T19400] ? shrink_lruvec+0x3a40/0x3a40 [ 321.658403][T19400] ? mutex_unlock+0x8f/0x230 [ 321.663073][T19400] ? __kasan_check_read+0x11/0x20 [ 321.668086][T19400] ? page_counter_set_max+0x65/0x140 [ 321.673468][T19400] mem_cgroup_resize_max+0x309/0x3e0 [ 321.678751][T19400] mem_cgroup_write+0x1ed/0x230 [ 321.683693][T19400] ? mem_cgroup_reset+0x130/0x130 [ 321.688745][T19400] ? __kasan_check_write+0x14/0x20 [ 321.694000][T19400] ? _copy_from_iter+0x4a4/0x10a0 [ 321.699022][T19400] ? mem_cgroup_reset+0x130/0x130 [ 321.704457][T19400] cgroup_file_write+0x294/0x560 [ 321.709388][T19400] ? cgroup_seqfile_stop+0xc0/0xc0 [ 321.714510][T19400] ? mutex_lock+0x9b/0x1c0 [ 321.719135][T19400] ? wait_for_completion_killable_timeout+0x10/0x10 [ 321.725754][T19400] ? __kasan_check_write+0x14/0x20 [ 321.731278][T19400] ? cgroup_seqfile_stop+0xc0/0xc0 [ 321.736701][T19400] kernfs_fop_write_iter+0x2bd/0x400 [ 321.742070][T19400] vfs_write+0x831/0xfd0 [ 321.746316][T19400] ? file_end_write+0x1b0/0x1b0 [ 321.751229][T19400] ? wait_for_completion_killable_timeout+0x10/0x10 [ 321.758273][T19400] ? __fget_files+0x2e1/0x340 [ 321.762969][T19400] ? __fdget_pos+0x2d2/0x380 [ 321.767674][T19400] ? ksys_write+0x70/0x260 [ 321.772240][T19400] ksys_write+0x14a/0x260 [ 321.776698][T19400] ? __ia32_sys_read+0x90/0x90 [ 321.781473][T19400] ? __kasan_check_write+0x14/0x20 [ 321.786591][T19400] ? switch_fpu_return+0x15d/0x2c0 [ 321.791716][T19400] __x64_sys_write+0x7b/0x90 [ 321.796293][T19400] x64_sys_call+0x8ef/0x9a0 [ 321.800836][T19400] do_syscall_64+0x4c/0xa0 [ 321.805239][T19400] ? clear_bhb_loop+0x50/0xa0 [ 321.809901][T19400] ? clear_bhb_loop+0x50/0xa0 [ 321.814564][T19400] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 321.820458][T19400] RIP: 0033:0x7f900c334019 [ 321.824858][T19400] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 321.845034][T19400] RSP: 002b:00007f900ad8d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 321.853438][T19400] RAX: ffffffffffffffda RBX: 00007f900c5bbfa0 RCX: 00007f900c334019 [ 321.861398][T19400] RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000003 [ 321.869532][T19400] RBP: 00007f900c3cb00c R08: 0000000000000000 R09: 0000000000000000 [ 321.877497][T19400] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 321.885477][T19400] R13: 00007f900c5bc038 R14: 00007f900c5bbfa0 R15: 00007ffca6b1dfa8 [ 321.888593][ T6573] usb 1-1: cannot find UAC_HEADER [ 321.893484][T19400] [ 321.893498][T19400] [ 321.893502][T19400] Allocated by task 6: [ 321.893512][T19400] __kasan_kmalloc+0xd4/0x100 [ 321.898698][ T6573] snd-usb-audio: probe of 1-1:1.0 failed with error -22 [ 321.901521][T19400] __kmalloc_track_caller+0x13c/0x2c0 [ 321.901545][T19400] __alloc_skb+0x210/0x730 [ 321.901559][T19400] mld_newpack+0x143/0x9e0 [ 321.901574][T19400] add_grec+0xee8/0x1340 [ 321.916709][ T6573] usb 1-1: USB disconnect, device number 114 [ 321.919824][T19400] mld_ifc_work+0x728/0xc40 [ 321.919850][T19400] process_one_work+0x6c8/0xbb0 [ 321.953813][T19400] worker_thread+0xaa0/0x1250 [ 321.958481][T19400] kthread+0x3f5/0x4f0 [ 321.962553][T19400] ret_from_fork+0x1f/0x30 [ 321.966954][T19400] [ 321.969271][T19400] Last potentially related work creation: [ 321.975284][T19400] kasan_save_stack+0x3a/0x60 [ 321.980127][T19400] __kasan_record_aux_stack+0xd2/0x100 [ 321.985595][T19400] kasan_record_aux_stack_noalloc+0xb/0x10 [ 321.991385][T19400] call_rcu+0x10b/0xf60 [ 321.995525][T19400] netlink_release+0x128f/0x16d0 [ 322.000448][T19400] sock_close+0xb8/0x200 [ 322.004679][T19400] __fput+0x22b/0x900 [ 322.008657][T19400] ____fput+0x15/0x20 [ 322.012731][T19400] task_work_run+0x127/0x190 [ 322.017323][T19400] exit_to_user_mode_loop+0xd0/0xe0 [ 322.022531][T19400] exit_to_user_mode_prepare+0x87/0xd0 [ 322.028041][T19400] syscall_exit_to_user_mode+0x1a/0x30 [ 322.033511][T19400] do_syscall_64+0x58/0xa0 [ 322.037935][T19400] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 322.044309][T19400] [ 322.046631][T19400] Second to last potentially related work creation: [ 322.053351][T19400] kasan_save_stack+0x3a/0x60 [ 322.058021][T19400] __kasan_record_aux_stack+0xd2/0x100 [ 322.063468][T19400] kasan_record_aux_stack_noalloc+0xb/0x10 [ 322.069260][T19400] insert_work+0x51/0x310 [ 322.073579][T19400] __queue_work+0x8e1/0xc60 [ 322.078069][T19400] queue_work_on+0xde/0x150 [ 322.082663][T19400] destroy_super_rcu+0xd1/0xe0 [ 322.087415][T19400] rcu_do_batch+0x4c1/0xbf0 [ 322.091922][T19400] rcu_core+0x4a3/0xef0 [ 322.096063][T19400] rcu_core_si+0x9/0x10 [ 322.100219][T19400] handle_softirqs+0x250/0x560 [ 322.105007][T19400] __irq_exit_rcu+0x52/0xf0 [ 322.109641][T19400] irq_exit_rcu+0x9/0x10 [ 322.114427][T19400] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 322.120056][T19400] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 322.126021][T19400] [ 322.128359][T19400] The buggy address belongs to the object at ffff888128531000 [ 322.128359][T19400] which belongs to the cache kmalloc-2k of size 2048 [ 322.142395][T19400] The buggy address is located 1136 bytes inside of [ 322.142395][T19400] 2048-byte region [ffff888128531000, ffff888128531800) [ 322.155829][T19400] The buggy address belongs to the page: [ 322.161457][T19400] page:ffffea0004a14c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888128531000 pfn:0x128530 [ 322.173142][T19400] head:ffffea0004a14c00 order:3 compound_mapcount:0 compound_pincount:0 [ 322.182767][T19400] flags: 0x4000000000010200(slab|head|zone=1) [ 322.188835][T19400] raw: 4000000000010200 ffffea0004a26808 ffffea00044cfc08 ffff888100043200 [ 322.197413][T19400] raw: ffff888128531000 0000000000080007 00000001ffffffff 0000000000000000 [ 322.205995][T19400] page dumped because: kasan: bad access detected [ 322.212394][T19400] page_owner tracks the page as allocated [ 322.218274][T19400] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 291, ts 25635535495, free_ts 0 [ 322.236553][T19400] post_alloc_hook+0x192/0x1b0 [ 322.241335][T19400] prep_new_page+0x1c/0x110 [ 322.245978][T19400] get_page_from_freelist+0x2c3a/0x2cd0 [ 322.251545][T19400] __alloc_pages+0x1a2/0x460 [ 322.256165][T19400] new_slab+0xa0/0x4d0 [ 322.260291][T19400] ___slab_alloc+0x3ac/0x840 [ 322.265465][T19400] __slab_alloc+0x49/0x90 [ 322.269824][T19400] __kmalloc_track_caller+0x169/0x2c0 [ 322.275340][T19400] kmemdup+0x26/0x60 [ 322.279225][T19400] neigh_sysctl_register+0xbf/0xa90 [ 322.284414][T19400] devinet_sysctl_register+0xaf/0x1e0 [ 322.290009][T19400] inetdev_init+0x2b2/0x500 [ 322.294784][T19400] inetdev_event+0x1f4/0x1060 [ 322.299458][T19400] raw_notifier_call_chain+0x90/0x100 [ 322.304818][T19400] call_netdevice_notifiers+0x119/0x190 [ 322.310363][T19400] register_netdevice+0x110a/0x1490 [ 322.315546][T19400] page_owner free stack trace missing [ 322.320898][T19400] [ 322.323224][T19400] Memory state around the buggy address: [ 322.329640][T19400] ffff888128531300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 322.337702][T19400] ffff888128531380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 322.345833][T19400] >ffff888128531400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 322.353881][T19400] ^ [ 322.361610][T19400] ffff888128531480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 322.369652][T19400] ffff888128531500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 322.377693][T19400] ================================================================== [ 322.385732][T19400] Disabling lock debugging due to kernel taint [ 322.396013][ T30] kauditd_printk_skb: 35 callbacks suppressed [ 322.396026][ T30] audit: type=1400 audit(2000525541.833:1376): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 322.402236][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 322.432194][ T30] audit: type=1400 audit(2000525541.833:1377): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 322.454629][ T30] audit: type=1400 audit(2000525541.833:1378): avc: denied { write } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 322.476185][ T30] audit: type=1400 audit(2000525541.833:1379): avc: denied { add_name } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 322.498903][ T30] audit: type=1400 audit(2000525541.833:1380): avc: denied { create } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 322.520103][ T30] audit: type=1400 audit(2000525541.833:1381): avc: denied { append open } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 322.543303][ T30] audit: type=1400 audit(2000525541.833:1382): avc: denied { getattr } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 331.113585][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!