last executing test programs: 36.226387439s ago: executing program 3 (id=4): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000a80)='./proc_mnt\x00', 0x0) mount(0x0, &(0x7f0000000ac0)='./proc_mnt\x00', &(0x7f0000000b00)='proc\x00', 0x0, 0x0) mount$bind(&(0x7f0000000b40)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', &(0x7f0000000b80)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', 0x0, 0x221490, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', &(0x7f00000000c0), 0x100) 36.211317769s ago: executing program 3 (id=6): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r0, &(0x7f0000000280)=[{&(0x7f0000000100)="2e1221b23bb601c494d3df173e75feff000d9d4d7f700ccc8fd5bf1881de", 0x1e}, {&(0x7f00000002c0)='\x000', 0x2}], 0x2) 21.200903164s ago: executing program 32 (id=6): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r0, &(0x7f0000000280)=[{&(0x7f0000000100)="2e1221b23bb601c494d3df173e75feff000d9d4d7f700ccc8fd5bf1881de", 0x1e}, {&(0x7f00000002c0)='\x000', 0x2}], 0x2) 12.71638298s ago: executing program 5 (id=322): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='&'], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0xa, 0x200, 0x7, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r0}, &(0x7f0000000400), &(0x7f0000000440)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000140)={r0, &(0x7f0000000a40)='&', &(0x7f0000000040)=""/98}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000140)={r0, &(0x7f0000000000), &(0x7f0000000040)=""/89}, 0x20) 12.698457331s ago: executing program 5 (id=323): bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x15, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007008500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 12.658178112s ago: executing program 5 (id=324): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./trace/trace_options\x00', 0x169842, 0x0) writev(r0, &(0x7f0000000200)=[{0x0, 0xffffff0a}, {&(0x7f0000000e00)='t', 0x1}, {&(0x7f0000000380)="0c8bb6d30affb6b0f7afde7bbce4602a2129e8da7392b84722f0b160f865e2c37b041aeabf7ebfe4a52671f475737473c1d96bc654043d7f3377ed44c487a8d8d91d499d1a6aa1270af94e192487dbce8f6a97f8eadb1daafd6d1a89a87f31af200f1c6bb582fe5d89d2858c8d9f2a10ac2256d8251603ef9df7d142ae9a430414cfe583093bb991a67e54ac85d423ddc3bbf6f8e1c53934718f4e8a07cf1e80f44d6f9aba5448216ac46293b3ddd2ced2e23780208361d4a0869415c6bd79b1dd603331a6b3a570dac7eb7ad0bad58ad0f3725261421dd0f75218ed8a00f8f066b35dcc68f2f54fc8b3cd5e4608b410bb"}], 0x2) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) futex(0x0, 0xc, 0x1, 0x0, 0xfffffffffffffffc, 0x0) 12.646251072s ago: executing program 5 (id=325): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f0000000480)={[{@grpid}, {@noacl}, {@nodioread_nolock}, {@dioread_lock}, {@stripe}, {@init_itable}, {@grpjquota_path={'grpjquota', 0x3d, '\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/'}}, {@orlov}, {@nouser_xattr}]}, 0x1, 0xbd0, &(0x7f0000002380)="$eJzs3M1rHOcZAPBnRqsvW+3KpZS6F6uUYkPbtewiU5tC7eLSSw+F9lqwkFdGaP2BpOJK1mHV/gOlzTmQSyCJSfAhPvuSQK65JM41JoEQExQrARMShdkPeW3t6sNeaYT0+8GreV+9M/s8z47XMy/ecQAH1kj2I404GhGXkohi4/dpRPTVegMR1fp+K8uLE18vL04ksbr6ty+SSCLi0fLiRPO1ksb2cGMwEBHv/zGJH/1nfdzZ+YXp8UqlPNMYn5y7euPk7PzCb6aujl8pXylfO3Xmd2Onx86Mnh3rWq2PPz5/96uf//mT6jevf3v7y/+/msT5GGrMtdbRLSMxsvaetCpExHi3g+Wkp1FPa51JYZOD0h1OCgCAjtKWe7ifRDF64snNWzHe+SDX5AAAAICuWO2JWAUAAAD2ucT6HwAAAPa55vcAHi0vTjRbvt9I2F0PL0TEcL3+lUarzxSiWtsORG9EHHqUROtjrUn9sBc2EhEPPjr7VtZih55D3kh1KSJ+2u78J7X6h2tPca+vP42I0S7EH3lmvNfq/3Vf5/rPdyF+3vUDcDDdu1C/kK2//qVr9z8Rj2v/TtR6/Su0uXY9j5HBp8e7ff1r3v+trLv/e1J/T4f7v79uMcat116+2Wkuew9/f/dPbzZbFj/bvlBR2/BwKeJnhXb1J2v1Jx3qv/TUK/V1jFH87ma501ze9a++EnE82tfflGz8/xOdnJyqlEfrP9vGWHpv7I1O8fOuPzv/hzrUv9n5v7HFGP+4ePFOp7nN608/60v+Xus1/4T9a3xubuZURF/yl/W/P914oL2D5j7N18jqP/GLjT//7erPQlQb70O2FlhqbLPxv5+J+Yfbt97eqP5s7Zfn+b/8nOf/v1uM8ct3/3ei01zr+jdrWfwHSX0tDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABNaUQMRZKW1vppWipFHI6IH8ehtHJ9du5Xk9f/ee1yNhcxHL3p5FSlPBoRxfo4ycanav0n49PPjH8bEUci4qXiYG1cmrheuZx38QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKw5HBFDkaSliEgjYqWYpqVS3lkBAAAAXTecdwIAAADAjrP+BwAAgP1vg/V/UtjNRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANivjhy7dz+JiOq5wVrL9DXmenPNDNhpad4JALnpyTsBIDeFvBMAcrPNNb7bBdiHkk3mBzrO9Hc9FwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2ruNH791PIqJ6brDWMn2Nud62RxzbxeyAnZTmnQCQm56NJgu7lwew+3zE4eBqv8YHDo6eSDbZYyCiuU/16Zn+bcb6/NNtHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAHjJUa0laioi01k/TUiniBxExHL3J5FSlPBoRP4yID4u9/dm4P++kAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6LrZ+YXp8UqlPKOjo5NvJ9kbadQ7ef/NBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAHmbnF6bHK5XyzGzemQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5m51fmB6vVMozW+jc2c7OLZ28awQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID/fBwAA//9VihLz") prlimit64(0x0, 0xe, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000001600)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000001640)='./file0\x00', &(0x7f0000001680), 0x8, &(0x7f00000016c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) removexattr(&(0x7f0000001800)='./file0/file1\x00', &(0x7f0000001840)=@known='system.posix_acl_access\x00') 12.457522117s ago: executing program 5 (id=328): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000000203030000000000fce4c56896cb53fb0800010001"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/net/netfilter/nfnetlink_queue\x00', 0x0, 0x0) read(r1, &(0x7f0000000200), 0x1000) 12.286064941s ago: executing program 5 (id=330): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) bpf$ITER_CREATE(0x21, 0x0, 0x0) 12.285949461s ago: executing program 33 (id=330): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) bpf$ITER_CREATE(0x21, 0x0, 0x0) 9.225925125s ago: executing program 1 (id=376): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$loop(0x0, 0x200000002, 0x400) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x10012, r1, 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100000cb768405e0483020b990102030109022400010000000009040000025c291d000905090000000006"], 0x0) ioctl$EVIOCRMFF(r0, 0x550c, 0x0) 8.257030759s ago: executing program 2 (id=395): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) accept$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000004c0)={'batadv_slave_1\x00'}) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), r1) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r0, &(0x7f00000009c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000980)={&(0x7f00000008c0)={0x18, r2, 0x301, 0x70bd27, 0x25dfdbfc, {}, [@HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0x4044000) 8.21701204s ago: executing program 2 (id=396): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x68) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000240)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101142, 0xeaff) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000700)={{r0}, 0x1f480f8d, 0x3, 0x3}) 8.20416078s ago: executing program 2 (id=398): r0 = socket$inet6(0xa, 0x3, 0x87) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd28, 0x0, {{@in6=@loopback, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x1, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x3c, 0xffffffffffffffff, 0x200000000000, 0x2}, {0xcdab, 0x2f, 0x407ffffffffffe, 0x800000000000002}, 0x1, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@loopback, 0x0, 0x3c}, 0x2, @in=@remote, 0x6, 0x4, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20}, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e21, 0x7, @empty, 0x80000000}, 0x1c) 8.19098661s ago: executing program 2 (id=400): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000002840), 0x181, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000002880)={0x1, 0x0, [{0x4b564d07, 0x0, 0x3}]}) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000028c0)={&(0x7f0000002900)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000002980)=@base={0x1, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, r3, 0x1, 0x7}, 0x50) 8.152269431s ago: executing program 2 (id=403): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000140)='./file0\x00', 0x1008002, &(0x7f0000000180)={[{@grpjquota}]}, 0x3, 0x5fa, &(0x7f00000001c0)="$eJzs3c9vVNUeAPDvnU5LS8nrQF7ee7yFNDEGEqWlBUxjXMDWkAZ/xI0urLQgUqChNVo0oSS4MTFujDFx5UL8L5TIlpWuXLhxZUiIGpYmjrnTe2mnvdPfnSHczycZ5t5z5vacS/udc+6Zc+4EUFqD6T+ViIMRMZNEDCQLj/KqkWUOLr7u4Z8fnUsfSdTrr/6eRJKl5a9Psuf+7ODeiPjxhyQOdK0ud3b++qWJ6empa9n+8NzlmeHZ+etHL16euDB1YerK6POjYydPnBwbObal87pRkHbm1rvvD3wy/sY3X/2VjHz7y3gSp+Kl7IXLz2OnDMZg4/8kWZ3VP7bThXVIV/Z3Uq/X63laUu1sndi4/PfXHRH/jYHoiqVf3kB8/HJHKwfsqnqy+N4NlFEi/qGk8n5Afm2/8jq40pFeCdAOD05HRLW3IP6ri2OD0dsYG9j7MInlwzpJRGxtZK7Zvoi4d3f81vm747dil8bhgGILNyPif0Xtf9KI/1r0Rq0R/5Wm+E/7BWez5zT9lS2Wv3KoWPxD+yzGf1H7vxT/0SL+30qfbyzG8NtbLL+2tPlOX1P89231lAAAAAAAAKC07pyOiOeKPv+vPJr/EwXzf/oj4tQOlD+4Yn/15/+V+ztQDFDgwemIFwvn/1by2b+1rmVLWGvRnZy/OD11LCL+FRFHontPuj+yRhlHPz3wZau8wWz+X/5Iy7+XzQXM6nG/uqf5mMmJuYltnDKQeXAz4v/V1vP/0vY/KWj/03eGmQ2WceCZ22db5a0f/8BuqX8dcbiw/V+6a0Wy9v05hhv9geG8V7DaUx9+9l2r8rca/24xAduXtv97147/WrL8fj2zmy/j+Hy13ipvq/3/nuS1xl2FerK0Dybm5q6NRPQkZ7rS1Kb00c3XGZ5EeTzk8ZLG/5Gn1x7/K+r/90XEwoqfnfzRvKY495+/+39tVZ9t9v9vbvB1QIE0/ic31f5vfmP0du37VuVvrP0/0Wjrj2Qpxv9g0Rd5mPY0pxeEY7Uoq931BQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAnQSUi9kVSGXq0XakMDUX0R8S/Y29l+urs3LPnr753ZTLNa3z/fyX/pt+Bxf0k//7/2rL90RX7xyNif0R83tXX2B86d3V6stMnDwAAAAAAAAAAAAAAAAAAAI+J/hbr/1O/dXW6dsCuq3a6AkDHFMT/T52oB9B+2n8oL/EP5SX+obzEP5SX+IfyWjv+3xxrW0WAttP+Q3mJfwAAAAAAeKLsP3Tn5yQiFl7oazxSPVled0drBuy2SqcrAHSMW/xAea2a+uMNAUrDNT6QrJPf2/Kg9Y5cy8y5bRwMAAAAAAAAAAAAAKVz+KD1/1BW1v9DeVnuC+WVr/8/1OF6AO3nGh+IdVbyF67/X/coAAAAAAAAAAAAAGAnzc5fvzQxPT11zcbrj0c12rlRr9dvpH8Fj0t9dn4jyWaot6XQfCp8+8+0ZyMnmK/129hP7tx7EgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0OyfAAAA//8bGSYF") openat(0xffffffffffffff9c, 0x0, 0x40040, 0xd9) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f00000007c0), 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) splice(r1, 0x0, r0, 0x0, 0x2000, 0xb) 8.099820473s ago: executing program 2 (id=404): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r0 = openat$tcp_congestion(0xffffffffffffff9c, 0x0, 0x35c, 0x0) preadv(r0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000740)='fd\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000080)=""/132, 0x84) 7.238990564s ago: executing program 1 (id=433): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) timer_delete(r1) 7.214178754s ago: executing program 1 (id=435): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x20132, 0xffffffffffffffff, 0xb299b000) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0xf000, 0x3, &(0x7f0000009000/0xf000)=nil) mremap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffa000/0x2000)=nil) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000700), 0xfdef) 7.186191815s ago: executing program 1 (id=436): syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000300)='./bus\x00', 0x0, &(0x7f00000000c0)={[{@noblock_validity}]}, 0x1, 0x73a, &(0x7f0000000800)="$eJzs3E9rXOUaAPDnnCZtb5t7Jxfu4uJKqFih9iRN1a6EiOtCoR+ghslJCDnJhMykNjFg68KFIKgI/ulGv4EbRXBT+h0UwZ2CC0FrGheCi8iZzEx1OpOObdKR+vvBmfO875kzz/vMHF7mwLwTwD/W4+VDEjEWERciotLqTyPicDM6GnF193m3tzar21ub1SR2di7eSsrTmn3t10pa++PRPCX+HxE3RyNOvXZ33vr6xuJMUeSrrfZEY2llor6+cXphaWY+n8+XpyYnz559burZZyb3rdY3X/nkpzc+f/HLD88t/fb8radnk5hu1h1ddeyn3fdkNKa7+pcPItkQJcMeAAAAAym/5x+KiJHmt9RKHGpGAAAAwKNk58gOAAAA8MhLYtgjAAAAAA5W+3cAt7c2q+3tYf7+4McXImL8ztri7U7+keYa4oijMRoRx7aTP61MSHZPgwdy9VpE3Jjucf0nrevv/nWvXLdG+u/nRjn/TPea/9LO/BM95p+R9n8nPKD2/Ld91/x3J/+hPvPfhQFzHFk9+VXf/NciHhvplT/p5E/65H9pwPyfjn3zbb9jOx9HnIze+f+Ya4//h5iYWyjy1mPPHCc+e/XUXvUf65c/2bv+lQHr/+761Hy/uaTM/9SJvT//XvnLa+Kt1jjSiHi7tS/b73TlePLm5Ad71T/bp/57ff4fDVj/F69vfD/gUwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKApjYixSNKsE6dplkUcj4j/xbG0qNUbp+Zqa8uz5bGI8RhN5xaKfDIiKrvtpGyfacZ32lNd7bMR8d+IeLfyr2Y7q9aK2WEXDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQMfxiBiLJM0iIo2IXyppmmXDHhUAAACw78aHPQAAAADgwLn/BwAAgEef+38AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgIbhw/ny57WxvbVbL9uzl9bXF2uXTs3l9MVtaq2bV2upKNl+rzRd5Vq0t3ev1ilpt5Vwsr12ZaOT1xkR9fePSUm1tuXFpYWlmPr+Ujz6UqgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPirxppbkmYRkTbjNM2yiH9HxHiMJnMLRT4ZEf+JiK8ro0fK9plhDxoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB9V1/fWJwpinxVIBAIOsGwZyYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIahvr6xOFMU+Wp92CMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABguNIfkogot5OVJ8a6jx5Ofq009xHx8vWL712ZaTRWz5T9P3f6G++3+qeGMX4AAACgW/s+vX0fDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMKj6+sbiTFHkqwcYDLtGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg/vweAAD//4rSy1s=") mkdir(&(0x7f0000000240)='./bus\x00', 0x57) mount$incfs(&(0x7f0000000280)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000340), 0xc002, 0x0) chdir(&(0x7f0000000380)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x180) mount$overlay(0x0, &(0x7f00000014c0)='./bus\x00', &(0x7f0000001500), 0x8, &(0x7f0000001540)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './proc'}}]}) 6.98507597s ago: executing program 1 (id=437): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f00000002c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:01.0\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000340)='driver_override\x00', 0x1, 0xe6) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) write(r1, &(0x7f0000000380)='a', 0x1) 6.862093623s ago: executing program 1 (id=438): unshare(0x22020600) r0 = socket(0x28, 0x801, 0x0) connect$vsock_stream(r0, &(0x7f0000000540)={0x28, 0x0, 0x0, @local}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff}) connect$unix(r1, &(0x7f00000005c0)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) 6.857070403s ago: executing program 34 (id=438): unshare(0x22020600) r0 = socket(0x28, 0x801, 0x0) connect$vsock_stream(r0, &(0x7f0000000540)={0x28, 0x0, 0x0, @local}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff}) connect$unix(r1, &(0x7f00000005c0)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) 3.889212515s ago: executing program 6 (id=455): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = eventfd2(0x7fffffff, 0x80000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000380)={r2, 0x58ba}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000003c0)={r2, 0x800058ba, 0x2, r2}) 3.867993286s ago: executing program 6 (id=457): r0 = creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) r1 = inotify_init1(0x0) r2 = inotify_add_watch(r1, &(0x7f0000000200)='./file0\x00', 0x4000880) write$binfmt_elf32(r0, &(0x7f0000000000)=ANY=[@ANYRES16=r2], 0xb0) close(r0) execve(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 3.819623377s ago: executing program 6 (id=458): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fchown(r0, 0x0, 0xee01) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) fsetxattr$system_posix_acl(r1, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000040)={{}, {}, [], {0x4, 0x5}, [], {0x10, 0x3}, {0x20, 0x7}}, 0x24, 0x1) setreuid(0xffffffffffffffff, 0xee01) utime(&(0x7f0000000000)='.\x00', 0x0) 3.766150728s ago: executing program 6 (id=460): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@delchain={0x24, 0x65, 0x1, 0x70bd2e, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {}, {0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x4c898}, 0x20004804) 3.077365295s ago: executing program 6 (id=461): syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000300)='./bus\x00', 0x0, &(0x7f00000000c0)={[{@noblock_validity}]}, 0x1, 0x73a, &(0x7f0000000800)="$eJzs3E9rXOUaAPDnnCZtb5t7Jxfu4uJKqFih9iRN1a6EiOtCoR+ghslJCDnJhMykNjFg68KFIKgI/ulGv4EbRXBT+h0UwZ2CC0FrGheCi8iZzEx1OpOObdKR+vvBmfO875kzz/vMHF7mwLwTwD/W4+VDEjEWERciotLqTyPicDM6GnF193m3tzar21ub1SR2di7eSsrTmn3t10pa++PRPCX+HxE3RyNOvXZ33vr6xuJMUeSrrfZEY2llor6+cXphaWY+n8+XpyYnz559burZZyb3rdY3X/nkpzc+f/HLD88t/fb8radnk5hu1h1ddeyn3fdkNKa7+pcPItkQJcMeAAAAAym/5x+KiJHmt9RKHGpGAAAAwKNk58gOAAAA8MhLYtgjAAAAAA5W+3cAt7c2q+3tYf7+4McXImL8ztri7U7+keYa4oijMRoRx7aTP61MSHZPgwdy9VpE3Jjucf0nrevv/nWvXLdG+u/nRjn/TPea/9LO/BM95p+R9n8nPKD2/Ld91/x3J/+hPvPfhQFzHFk9+VXf/NciHhvplT/p5E/65H9pwPyfjn3zbb9jOx9HnIze+f+Ya4//h5iYWyjy1mPPHCc+e/XUXvUf65c/2bv+lQHr/+761Hy/uaTM/9SJvT//XvnLa+Kt1jjSiHi7tS/b73TlePLm5Ad71T/bp/57ff4fDVj/F69vfD/gUwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKApjYixSNKsE6dplkUcj4j/xbG0qNUbp+Zqa8uz5bGI8RhN5xaKfDIiKrvtpGyfacZ32lNd7bMR8d+IeLfyr2Y7q9aK2WEXDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQMfxiBiLJM0iIo2IXyppmmXDHhUAAACw78aHPQAAAADgwLn/BwAAgEef+38AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgIbhw/ny57WxvbVbL9uzl9bXF2uXTs3l9MVtaq2bV2upKNl+rzRd5Vq0t3ev1ilpt5Vwsr12ZaOT1xkR9fePSUm1tuXFpYWlmPr+Ujz6UqgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPirxppbkmYRkTbjNM2yiH9HxHiMJnMLRT4ZEf+JiK8ro0fK9plhDxoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB9V1/fWJwpinxVIBAIOsGwZyYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIahvr6xOFMU+Wp92CMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABguNIfkogot5OVJ8a6jx5Ofq009xHx8vWL712ZaTRWz5T9P3f6G++3+qeGMX4AAACgW/s+vX0fDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMKj6+sbiTFHkqwcYDLtGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg/vweAAD//4rSy1s=") mkdir(&(0x7f0000000240)='./bus\x00', 0x57) mount$incfs(&(0x7f0000000280)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000340), 0xc002, 0x0) chdir(&(0x7f0000000380)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x180) mount$overlay(0x0, &(0x7f00000014c0)='./bus\x00', &(0x7f0000001500), 0x8, &(0x7f0000001540)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './proc'}}]}) 2.735077423s ago: executing program 6 (id=466): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x400, &(0x7f0000000440), 0x1, 0x4a6, &(0x7f0000000a40)="$eJzs3c9rXNUeAPDvzDRpkua9/niPR9sHr4U+6HtKM/mBNFEXulIXBbHgRqHGZBprJpmQmdQmdJHqrgsXoiiIC/f+BW7syiKIa92LC6lojaCCMHLvzKT5NXXQNAO5nw/czrn33M73nAzfw51z750bQGadTv7JRQxGxBcRcbixunmH042XtbvXp5IlF/X6xe9z6X7JemvX1v87FBGrEdEXEc89FfFybnvc6vLK7GS5XFpsrhdrcwvF6vLKuStzkzOlmdL8yPj5iYnx4bHRiV3r6803X7154eNnej/6+Y07t9/69JOkWYPNuo392E2NrvfE0Q3bDkTE4w8iWBcUmv3p73ZD+FOSz+8fEXEmzf/DUUg/TSAL6vV6/bf6wXbVq3Vg38qnx8C5/FBENMr5/NBQ4xj+nzGQL1eqtYcvV5bmpxvHykeiJ3/5Srk03PyucCR6csn6SFq+tz66ZX0sIj0GfrvQn64PTVXK03s71AFbHNqS/z8VGvkPZISv/JBd8h+yS/5Ddsl/yC75D9kl/yG75D9kl/yH7JL/kF3yH7JL/kMmPXvhQrLUW/e/T19dXpqtXD03XarODs0tTQ1NVRYXhmYqlZn0np25P3q/cqWyMPJILF0r1krVWrG6vHJprrI0X7uU3td/qdSzJ70COnH01K2vchGx+mh/uiR6m3VyFfa3ej0X3b4HGeiOQrcHIKBrTP1BdvmOD+zwE72b9LWrWNj9tgB7I9/tBgBdc/aE83+QVeb/IbvM/0N2OcYHzP9D9pj/h+wabPP8r79teHbXcET8PSK+LPQcbD3rC9gP8t/mmsf/Zw//d3BrbW/ul/QUQW9EvPb+xXevTdZqiyPJ9h/Wt9fea24f7Ub7gU618rSVxwBAdq3dvT7VWvYy7ndPNi5C2B7/QHNusi89Rzmwltt0rUJul65dWL0REcd3ip9rPu+8ceZjYK2wLf6x5muu8RZpew+kz03fm/gnNsT/z4b4J//yXwWy4VYy/gzvlH/5NKdjPf82jz+Du3TtRPvxL78+/hXajH+nOozxygevf9M2/o2IkzvGb8XrS2NtjZ+07WyH8e+8+Py/2tXVP2y8z07xW5JSsTa3UKwur5xLf0dupjQ/Mn5+YmJ8eGx0opjOURdbM9XbPXb889v36/9Am/jt+v9Es03/77D/v/77sxdO3yf+/87s/PkfaxM/0R8RD3UY/8fRr19qV5fEn27T//x94ifbxjqMX33n6YMd7goA7IHq8srsZLlcWlRQUFBYL3R7ZAIetHtJ3+2WAAAAAAAAAAAAAJ3ai8uJu91HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID94PcAAAD//5j81ps=") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000016c0)='cpuset.effective_mems\x00', 0x275a, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$XFS_IOC_GOINGDOWN(r0, 0x8004587d, &(0x7f0000002f40)=0x1) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) mlockall(0x7) 2.734984953s ago: executing program 35 (id=466): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x400, &(0x7f0000000440), 0x1, 0x4a6, &(0x7f0000000a40)="$eJzs3c9rXNUeAPDvzDRpkua9/niPR9sHr4U+6HtKM/mBNFEXulIXBbHgRqHGZBprJpmQmdQmdJHqrgsXoiiIC/f+BW7syiKIa92LC6lojaCCMHLvzKT5NXXQNAO5nw/czrn33M73nAzfw51z750bQGadTv7JRQxGxBcRcbixunmH042XtbvXp5IlF/X6xe9z6X7JemvX1v87FBGrEdEXEc89FfFybnvc6vLK7GS5XFpsrhdrcwvF6vLKuStzkzOlmdL8yPj5iYnx4bHRiV3r6803X7154eNnej/6+Y07t9/69JOkWYPNuo392E2NrvfE0Q3bDkTE4w8iWBcUmv3p73ZD+FOSz+8fEXEmzf/DUUg/TSAL6vV6/bf6wXbVq3Vg38qnx8C5/FBENMr5/NBQ4xj+nzGQL1eqtYcvV5bmpxvHykeiJ3/5Srk03PyucCR6csn6SFq+tz66ZX0sIj0GfrvQn64PTVXK03s71AFbHNqS/z8VGvkPZISv/JBd8h+yS/5Ddsl/yC75D9kl/yG75D9kl/yH7JL/kF3yH7JL/kMmPXvhQrLUW/e/T19dXpqtXD03XarODs0tTQ1NVRYXhmYqlZn0np25P3q/cqWyMPJILF0r1krVWrG6vHJprrI0X7uU3td/qdSzJ70COnH01K2vchGx+mh/uiR6m3VyFfa3ej0X3b4HGeiOQrcHIKBrTP1BdvmOD+zwE72b9LWrWNj9tgB7I9/tBgBdc/aE83+QVeb/IbvM/0N2OcYHzP9D9pj/h+wabPP8r79teHbXcET8PSK+LPQcbD3rC9gP8t/mmsf/Zw//d3BrbW/ul/QUQW9EvPb+xXevTdZqiyPJ9h/Wt9fea24f7Ub7gU618rSVxwBAdq3dvT7VWvYy7ndPNi5C2B7/QHNusi89Rzmwltt0rUJul65dWL0REcd3ip9rPu+8ceZjYK2wLf6x5muu8RZpew+kz03fm/gnNsT/z4b4J//yXwWy4VYy/gzvlH/5NKdjPf82jz+Du3TtRPvxL78+/hXajH+nOozxygevf9M2/o2IkzvGb8XrS2NtjZ+07WyH8e+8+Py/2tXVP2y8z07xW5JSsTa3UKwur5xLf0dupjQ/Mn5+YmJ8eGx0opjOURdbM9XbPXb889v36/9Am/jt+v9Es03/77D/v/77sxdO3yf+/87s/PkfaxM/0R8RD3UY/8fRr19qV5fEn27T//x94ifbxjqMX33n6YMd7goA7IHq8srsZLlcWlRQUFBYL3R7ZAIetHtJ3+2WAAAAAAAAAAAAAJ3ai8uJu91HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID94PcAAAD//5j81ps=") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000016c0)='cpuset.effective_mems\x00', 0x275a, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$XFS_IOC_GOINGDOWN(r0, 0x8004587d, &(0x7f0000002f40)=0x1) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) mlockall(0x7) 1.709658488s ago: executing program 0 (id=469): syz_clone(0x80842111, 0x0, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000040)=0x0) io_submit(r2, 0xf000, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000140)='m', 0xfffffdfc}]) io_destroy(r2) mount(0x0, 0x0, 0x0, 0x2390024, 0x0) 1.483960754s ago: executing program 0 (id=471): r0 = gettid() timer_create(0x1, &(0x7f0000000100)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000240)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) futex(0x0, 0x5, 0x80000008, 0x0, 0x0, 0x2000000) 1.423219125s ago: executing program 0 (id=473): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000040)={[0x8, 0x0, 0x34a30b45, 0x1, 0x1000, 0xb5, 0x1002, 0xfffffffffffffffb, 0x8, 0x6, 0x2, 0x2372, 0x8bda, 0x1000, 0x401, 0x20], 0x25000, 0x216156}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.423101465s ago: executing program 8 (id=475): bpf$MAP_CREATE(0x0, &(0x7f0000001240)=@base={0xf, 0x4, 0x8, 0x1}, 0x37) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000ac0), 0x100}, 0x0) close(0x3) socketpair(0x1e, 0x1, 0x0, 0x0) 1.287182269s ago: executing program 4 (id=474): r0 = socket(0x10, 0x3, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'dummy0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=@newneigh={0x28, 0x1c, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, r3}, [@NDA_DST_MAC={0xa, 0x1, @link_local}]}, 0x28}}, 0x0) 1.286222789s ago: executing program 0 (id=477): syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000300)='./bus\x00', 0x0, &(0x7f00000000c0)={[{@noblock_validity}]}, 0x1, 0x73a, &(0x7f0000000800)="$eJzs3E9rXOUaAPDnnCZtb5t7Jxfu4uJKqFih9iRN1a6EiOtCoR+ghslJCDnJhMykNjFg68KFIKgI/ulGv4EbRXBT+h0UwZ2CC0FrGheCi8iZzEx1OpOObdKR+vvBmfO875kzz/vMHF7mwLwTwD/W4+VDEjEWERciotLqTyPicDM6GnF193m3tzar21ub1SR2di7eSsrTmn3t10pa++PRPCX+HxE3RyNOvXZ33vr6xuJMUeSrrfZEY2llor6+cXphaWY+n8+XpyYnz559burZZyb3rdY3X/nkpzc+f/HLD88t/fb8radnk5hu1h1ddeyn3fdkNKa7+pcPItkQJcMeAAAAAym/5x+KiJHmt9RKHGpGAAAAwKNk58gOAAAA8MhLYtgjAAAAAA5W+3cAt7c2q+3tYf7+4McXImL8ztri7U7+keYa4oijMRoRx7aTP61MSHZPgwdy9VpE3Jjucf0nrevv/nWvXLdG+u/nRjn/TPea/9LO/BM95p+R9n8nPKD2/Ld91/x3J/+hPvPfhQFzHFk9+VXf/NciHhvplT/p5E/65H9pwPyfjn3zbb9jOx9HnIze+f+Ya4//h5iYWyjy1mPPHCc+e/XUXvUf65c/2bv+lQHr/+761Hy/uaTM/9SJvT//XvnLa+Kt1jjSiHi7tS/b73TlePLm5Ad71T/bp/57ff4fDVj/F69vfD/gUwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKApjYixSNKsE6dplkUcj4j/xbG0qNUbp+Zqa8uz5bGI8RhN5xaKfDIiKrvtpGyfacZ32lNd7bMR8d+IeLfyr2Y7q9aK2WEXDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQMfxiBiLJM0iIo2IXyppmmXDHhUAAACw78aHPQAAAADgwLn/BwAAgEef+38AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgIbhw/ny57WxvbVbL9uzl9bXF2uXTs3l9MVtaq2bV2upKNl+rzRd5Vq0t3ev1ilpt5Vwsr12ZaOT1xkR9fePSUm1tuXFpYWlmPr+Ujz6UqgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPirxppbkmYRkTbjNM2yiH9HxHiMJnMLRT4ZEf+JiK8ro0fK9plhDxoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB9V1/fWJwpinxVIBAIOsGwZyYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIahvr6xOFMU+Wp92CMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABguNIfkogot5OVJ8a6jx5Ofq009xHx8vWL712ZaTRWz5T9P3f6G++3+qeGMX4AAACgW/s+vX0fDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMKj6+sbiTFHkqwcYDLtGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg/vweAAD//4rSy1s=") mkdir(&(0x7f0000000240)='./bus\x00', 0x57) mount$incfs(&(0x7f0000000280)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000340), 0xc002, 0x0) chdir(&(0x7f0000000380)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x180) mount$overlay(0x0, &(0x7f00000014c0)='./bus\x00', &(0x7f0000001500), 0x8, &(0x7f0000001540)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './proc'}}]}) 1.286104579s ago: executing program 8 (id=475): bpf$MAP_CREATE(0x0, &(0x7f0000001240)=@base={0xf, 0x4, 0x8, 0x1}, 0x37) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000ac0), 0x100}, 0x0) close(0x3) socketpair(0x1e, 0x1, 0x0, 0x0) 1.101197313s ago: executing program 4 (id=478): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)={0x1c, 0x1, 0x4, 0x5, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x26088888) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/net/netfilter/nfnetlink_log\x00', 0x8000, 0x8) preadv(r1, &(0x7f0000000200)=[{&(0x7f0000000240)=""/182, 0xb6}], 0x1, 0x25, 0x1) 1.099658913s ago: executing program 0 (id=479): syz_mount_image$ext4(&(0x7f0000000400)='ext4\x00', &(0x7f0000000ac0)='./file1\x00', 0x21081e, &(0x7f0000000b00)={[{@grpquota}, {@nogrpid}, {@quota}]}, 0x1, 0x4fa, &(0x7f0000000b40)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") syz_mount_image$vfat(&(0x7f0000001100), &(0x7f0000001140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x800053, 0x0, 0x1, 0x0, &(0x7f00000011c0)) r0 = openat(0xffffffffffffff9c, &(0x7f0000001200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, 0x8) capset(&(0x7f0000001280)={0x19980330}, &(0x7f00000012c0)={0x1, 0x3, 0x8001, 0xc0, 0x9, 0xffff}) fchown(r0, 0xee00, 0xee01) fchown(r0, 0x0, 0x0) 1.099579383s ago: executing program 8 (id=475): bpf$MAP_CREATE(0x0, &(0x7f0000001240)=@base={0xf, 0x4, 0x8, 0x1}, 0x37) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000ac0), 0x100}, 0x0) close(0x3) socketpair(0x1e, 0x1, 0x0, 0x0) 986.073836ms ago: executing program 0 (id=480): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @local}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @remote}, 0x1c) syz_emit_ethernet(0x84, &(0x7f0000000c00)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x4e, 0x6, 0x40, @remote, @local, {[], {{0x4e22, 0x4e22, 0x0, 0x41424344, 0x0, 0x0, 0x7, 0x18, 0x1000, 0x0, 0x0, {[@mptcp=@generic={0x20, 0x2}, @exp_smc={0xfe, 0x6}]}}, {"3e5bb3686e0f47360b80a2d4e4ff6855b84e9e50f4c6720493fb0be1774a56a3eb2877a36ac599bdc256ca05982331582579"}}}}}}}, 0x0) 985.977936ms ago: executing program 36 (id=480): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @local}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @remote}, 0x1c) syz_emit_ethernet(0x84, &(0x7f0000000c00)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x4e, 0x6, 0x40, @remote, @local, {[], {{0x4e22, 0x4e22, 0x0, 0x41424344, 0x0, 0x0, 0x7, 0x18, 0x1000, 0x0, 0x0, {[@mptcp=@generic={0x20, 0x2}, @exp_smc={0xfe, 0x6}]}}, {"3e5bb3686e0f47360b80a2d4e4ff6855b84e9e50f4c6720493fb0be1774a56a3eb2877a36ac599bdc256ca05982331582579"}}}}}}}, 0x0) 985.947186ms ago: executing program 7 (id=439): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640), 0x200, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000680), 0x101180, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x40047451, &(0x7f0000000740)) ioctl$TUNGETVNETLE(r0, 0x40047451, &(0x7f0000000780)) 960.386467ms ago: executing program 4 (id=481): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) madvise(&(0x7f00000ee000/0x2000)=nil, 0x2000, 0x8) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) read(r0, &(0x7f00000002c0)=""/153, 0x99) 960.270767ms ago: executing program 8 (id=475): bpf$MAP_CREATE(0x0, &(0x7f0000001240)=@base={0xf, 0x4, 0x8, 0x1}, 0x37) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000ac0), 0x100}, 0x0) close(0x3) socketpair(0x1e, 0x1, 0x0, 0x0) 845.469599ms ago: executing program 9 (id=482): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000780)=@bpf_lsm={0x6, 0x3, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000880)='GPL\x00'}, 0x27) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000900)={r0, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000040)={0x0, 0x0}, 0x8) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r2, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000200)={r3, r1, 0x4}, 0x5) 834.28216ms ago: executing program 7 (id=439): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640), 0x200, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000680), 0x101180, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x40047451, &(0x7f0000000740)) ioctl$TUNGETVNETLE(r0, 0x40047451, &(0x7f0000000780)) 710.226743ms ago: executing program 4 (id=483): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x4000) r1 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) dup3(r1, r0, 0x80000) ioctl$OCFS2_IOC_INFO(r1, 0x80106f05, 0x0) 710.084823ms ago: executing program 9 (id=482): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000780)=@bpf_lsm={0x6, 0x3, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000880)='GPL\x00'}, 0x27) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000900)={r0, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000040)={0x0, 0x0}, 0x8) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r2, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000200)={r3, r1, 0x4}, 0x5) 707.116442ms ago: executing program 8 (id=475): bpf$MAP_CREATE(0x0, &(0x7f0000001240)=@base={0xf, 0x4, 0x8, 0x1}, 0x37) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000ac0), 0x100}, 0x0) close(0x3) socketpair(0x1e, 0x1, 0x0, 0x0) 592.682506ms ago: executing program 9 (id=482): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000780)=@bpf_lsm={0x6, 0x3, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000880)='GPL\x00'}, 0x27) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000900)={r0, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000040)={0x0, 0x0}, 0x8) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r2, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000200)={r3, r1, 0x4}, 0x5) 550.182296ms ago: executing program 7 (id=439): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640), 0x200, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000680), 0x101180, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x40047451, &(0x7f0000000740)) ioctl$TUNGETVNETLE(r0, 0x40047451, &(0x7f0000000780)) 453.754669ms ago: executing program 9 (id=482): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000780)=@bpf_lsm={0x6, 0x3, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000880)='GPL\x00'}, 0x27) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000900)={r0, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000040)={0x0, 0x0}, 0x8) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r2, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000200)={r3, r1, 0x4}, 0x5) 340.505111ms ago: executing program 4 (id=484): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x5, 0x5, 0x2, 0x7, 0x0, 0x1, 0x10000}, 0x50) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0900000001000000080000004000000042"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000580), 0x1000, r1}, 0x38) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @call={0x85, 0x0, 0x0, 0x7d}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r2, r0}, 0xc) 340.394121ms ago: executing program 9 (id=482): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000780)=@bpf_lsm={0x6, 0x3, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000880)='GPL\x00'}, 0x27) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000900)={r0, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000040)={0x0, 0x0}, 0x8) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r2, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000200)={r3, r1, 0x4}, 0x5) 340.367401ms ago: executing program 7 (id=439): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640), 0x200, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000680), 0x101180, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x40047451, &(0x7f0000000740)) ioctl$TUNGETVNETLE(r0, 0x40047451, &(0x7f0000000780)) 200.529315ms ago: executing program 7 (id=439): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640), 0x200, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000680), 0x101180, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x40047451, &(0x7f0000000740)) ioctl$TUNGETVNETLE(r0, 0x40047451, &(0x7f0000000780)) 147.106026ms ago: executing program 8 (id=475): bpf$MAP_CREATE(0x0, &(0x7f0000001240)=@base={0xf, 0x4, 0x8, 0x1}, 0x37) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000ac0), 0x100}, 0x0) close(0x3) socketpair(0x1e, 0x1, 0x0, 0x0) 84.375188ms ago: executing program 4 (id=485): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000140)=[@nested_vmresume={0x130, 0x18, 0x1}], 0x18}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f00000001c0)={0x1, 0x0, [{0x0, 0x1000, 0x3, 0x9, 0x7, 0x9, 0x7fffffff}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 84.277198ms ago: executing program 9 (id=482): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000780)=@bpf_lsm={0x6, 0x3, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000880)='GPL\x00'}, 0x27) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000900)={r0, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000040)={0x0, 0x0}, 0x8) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r2, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000200)={r3, r1, 0x4}, 0x5) 0s ago: executing program 7 (id=439): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640), 0x200, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000680), 0x101180, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x40047451, &(0x7f0000000740)) ioctl$TUNGETVNETLE(r0, 0x40047451, &(0x7f0000000780)) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 14.682932][ T24] kauditd_printk_skb: 48 callbacks suppressed [ 14.682948][ T24] audit: type=1400 audit(1792670264.010:59): avc: denied { transition } for pid=217 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.694161][ T24] audit: type=1400 audit(1792670264.010:60): avc: denied { noatsecure } for pid=217 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.702293][ T24] audit: type=1400 audit(1792670264.020:61): avc: denied { write } for pid=217 comm="sh" path="pipe:[1957]" dev="pipefs" ino=1957 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.728048][ T24] audit: type=1400 audit(1792670264.020:62): avc: denied { rlimitinh } for pid=217 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.749837][ T24] audit: type=1400 audit(1792670264.020:63): avc: denied { siginh } for pid=217 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.170' (ED25519) to the list of known hosts. [ 21.804637][ T24] audit: type=1400 audit(1792670271.140:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.805602][ T271] cgroup: Unknown subsys name 'net' [ 21.827417][ T24] audit: type=1400 audit(1792670271.140:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.855312][ T24] audit: type=1400 audit(1792670271.160:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.855477][ T271] cgroup: Unknown subsys name 'devices' [ 21.965696][ T271] cgroup: Unknown subsys name 'hugetlb' [ 21.971677][ T271] cgroup: Unknown subsys name 'rlimit' [ 22.077854][ T24] audit: type=1400 audit(1792670271.410:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.101482][ T24] audit: type=1400 audit(1792670271.410:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.107136][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.126946][ T24] audit: type=1400 audit(1792670271.410:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.160530][ T24] audit: type=1400 audit(1792670271.470:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.186670][ T24] audit: type=1400 audit(1792670271.470:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.219410][ T24] audit: type=1400 audit(1792670271.550:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.245714][ T24] audit: type=1400 audit(1792670271.550:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.272564][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.806742][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.813805][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.821263][ T280] device bridge_slave_0 entered promiscuous mode [ 22.828141][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.835206][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.842691][ T280] device bridge_slave_1 entered promiscuous mode [ 22.869489][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.876670][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.883928][ T281] device bridge_slave_0 entered promiscuous mode [ 22.893186][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.900397][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.907757][ T281] device bridge_slave_1 entered promiscuous mode [ 22.926395][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.933445][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.940995][ T283] device bridge_slave_0 entered promiscuous mode [ 22.952369][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.959451][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.966854][ T279] device bridge_slave_0 entered promiscuous mode [ 22.981389][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.988671][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.996026][ T283] device bridge_slave_1 entered promiscuous mode [ 23.005077][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.012257][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.019706][ T279] device bridge_slave_1 entered promiscuous mode [ 23.040977][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.048078][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.055540][ T282] device bridge_slave_0 entered promiscuous mode [ 23.080899][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.088195][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.095954][ T282] device bridge_slave_1 entered promiscuous mode [ 23.216711][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.223769][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.231145][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.238191][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.262834][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.270001][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.277277][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.284393][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.308170][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.315348][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.322592][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.329656][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.340264][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.347356][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.354617][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.361718][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.370978][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.378303][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.385585][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.392601][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.427583][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.434919][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.442467][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.449883][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.457719][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.465070][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.472426][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.480056][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.487263][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.494585][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.501967][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.518748][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.526368][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.534383][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.543069][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.550463][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.558832][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.567299][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.574450][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.596369][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.605380][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.613574][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.620659][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.628130][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.636509][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.643546][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.651305][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.660335][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.667711][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.675138][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.683411][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.691710][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.698757][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.706391][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.729553][ T283] device veth0_vlan entered promiscuous mode [ 23.737257][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.745817][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.753804][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.762223][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.770970][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.779073][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.786509][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.794711][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.801867][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.809345][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.817525][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.824660][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.832133][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.840413][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.847637][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.855276][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.863399][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.870569][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.901400][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.909902][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.918281][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.927049][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.936339][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.944593][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.952613][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.960977][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.969051][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.977129][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.985172][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.993112][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.001332][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.009751][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.017939][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.026105][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.034251][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.042314][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.051698][ T283] device veth1_macvtap entered promiscuous mode [ 24.065076][ T280] device veth0_vlan entered promiscuous mode [ 24.071932][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.080324][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.089463][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.098036][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.106195][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.114656][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.122202][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.138410][ T279] device veth0_vlan entered promiscuous mode [ 24.146028][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.155662][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.164683][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.172738][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.181515][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.189411][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.206719][ T280] device veth1_macvtap entered promiscuous mode [ 24.215184][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.223727][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.232461][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.241168][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.249544][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.258178][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.267156][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.275394][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.283448][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.299865][ T281] device veth0_vlan entered promiscuous mode [ 24.312813][ T279] device veth1_macvtap entered promiscuous mode [ 24.319652][ T283] request_module fs-gadgetfs succeeded, but still no fs? [ 24.330846][ T283] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 24.331306][ T282] device veth0_vlan entered promiscuous mode [ 24.347498][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.356308][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.364708][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.372851][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.381150][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.389770][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.398343][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.406666][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.414912][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.422673][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.430997][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.439538][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.447505][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.461356][ T281] device veth1_macvtap entered promiscuous mode [ 24.481068][ T282] device veth1_macvtap entered promiscuous mode [ 24.488059][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.495985][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.503743][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.513626][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.521755][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.530186][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.538532][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.546209][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.554548][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.562720][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.588547][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.598019][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.607040][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.616198][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.624906][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.633277][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.642138][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.650618][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.681618][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.692415][ T305] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.711044][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.719672][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.728358][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.946125][ T318] EXT4-fs (loop1): Ignoring removed bh option [ 24.949154][ T316] EXT4-fs (loop4): Quota format mount options ignored when QUOTA feature is enabled [ 24.971110][ T316] EXT4-fs (loop4): Test dummy encryption mode enabled [ 24.981484][ T316] EXT4-fs (loop4): mounted filesystem without journal. Opts: jqfmt=vfsv0,test_dummy_encryption=v1,inlinecrypt,sb=0x0000000000000004,noinit_itable,norecovery,minixdf,nolazytime,errors=remount-ro,nojournal_checksum,usrquota,max_dir_size_kb=0x0000000000000008, [ 24.991873][ T318] EXT4-fs (loop1): mounted filesystem without journal. Opts: nodelalloc,dioread_lock,jqfmt=vfsv1,abort,debug_want_extra_isize=0x0000000000000008,lazytime,errors=remount-ro,stripe=0x0000000000000007,bh,auto_da_alloc, [ 25.338700][ T345] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 25.349631][ T345] System zones: 1-12 [ 25.355759][ T345] EXT4-fs error (device loop4): ext4_xattr_inode_iget:401: inode #12: comm syz.4.16: missing EA_INODE flag [ 25.367574][ T345] EXT4-fs error (device loop4): ext4_xattr_inode_iget:406: comm syz.4.16: error while reading EA inode 12 err=-117 [ 25.380677][ T345] EXT4-fs (loop4): 1 orphan inode deleted [ 25.386640][ T345] EXT4-fs (loop4): mounted filesystem without journal. Opts: debug,resuid=0x000000000000ee01,,errors=continue [ 25.390373][ T348] ====================================================== [ 25.390373][ T348] WARNING: the mand mount option is being deprecated and [ 25.390373][ T348] will be removed in v5.15! [ 25.390373][ T348] ====================================================== [ 25.537797][ T358] process 'syz.2.19' launched './file1' with NULL argv: empty string added [ 25.589149][ T361] tipc: Started in network mode [ 25.604500][ T361] tipc: Own node identity aaaaaaaaaaaa, cluster identity 4711 [ 25.612091][ T361] tipc: Enabled bearer , priority 0 [ 25.704643][ T367] exfat: Deprecated parameter 'utf8' [ 25.715901][ T370] FAULT_INJECTION: forcing a failure. [ 25.715901][ T370] name failslab, interval 1, probability 0, space 0, times 1 [ 25.749138][ T367] exFAT-fs (loop0): failed to load upcase table (idx : 0x0001fe89, chksum : 0xb956f73f, utbl_chksum : 0xe619d30d) [ 25.775829][ T370] CPU: 1 PID: 370 Comm: syz.1.25 Not tainted syzkaller #0 [ 25.782975][ T370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 25.793137][ T370] Call Trace: [ 25.796534][ T370] __dump_stack+0x21/0x24 [ 25.801055][ T370] dump_stack_lvl+0x1a7/0x208 [ 25.805751][ T370] ? show_regs_print_info+0x18/0x18 [ 25.811143][ T370] ? __sched_text_start+0x8/0x8 [ 25.816051][ T370] dump_stack+0x15/0x1c [ 25.820218][ T370] should_fail+0x3ab/0x500 [ 25.824732][ T370] ? __khugepaged_enter+0x2f/0x2c0 [ 25.829969][ T370] __should_failslab+0xa4/0xe0 [ 25.834838][ T370] should_failslab+0x9/0x20 [ 25.839374][ T370] kmem_cache_alloc+0x3d/0x2d0 [ 25.844165][ T370] __khugepaged_enter+0x2f/0x2c0 [ 25.849120][ T370] khugepaged_enter_vma_merge+0x340/0x380 [ 25.854854][ T370] hugepage_madvise+0xe3/0x110 [ 25.859772][ T370] do_madvise+0xf1c/0x1de0 [ 25.864205][ T370] ? madvise_set_anon_name+0x470/0x470 [ 25.869697][ T370] ? fsnotify_set_children_dentry_flags+0x210/0x210 [ 25.876302][ T370] ? do_futex+0xfe9/0x1270 [ 25.880734][ T370] ? rw_verify_area+0x1c0/0x360 [ 25.885602][ T370] ? preempt_count_add+0x90/0x1b0 [ 25.890647][ T370] ? vfs_write+0xae4/0xd70 [ 25.895128][ T370] ? kernel_write+0x3c0/0x3c0 [ 25.899851][ T370] ? futex_exit_release+0x1e0/0x1e0 [ 25.905246][ T370] ? __kasan_check_write+0x14/0x20 [ 25.910473][ T370] ? mutex_lock+0x92/0xf0 [ 25.914816][ T370] ? mutex_trylock+0xb0/0xb0 [ 25.919420][ T370] ? __fget_files+0x2e1/0x340 [ 25.924296][ T370] ? __kasan_check_write+0x14/0x20 [ 25.929700][ T370] ? switch_fpu_return+0x19c/0x330 [ 25.934837][ T370] ? fpu__clear_all+0x20/0x20 [ 25.939546][ T370] ? __kasan_check_read+0x11/0x20 [ 25.944626][ T370] __x64_sys_madvise+0xa9/0xc0 [ 25.949406][ T370] do_syscall_64+0x31/0x40 [ 25.953845][ T370] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.959755][ T370] RIP: 0033:0x7f13e7e34559 [ 25.964184][ T370] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 25.983895][ T370] RSP: 002b:00007f13e688c028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 25.992424][ T370] RAX: ffffffffffffffda RBX: 00007f13e80bafa0 RCX: 00007f13e7e34559 [ 26.000424][ T370] RDX: 000000000000000e RSI: 0000000000800000 RDI: 0000200000000000 [ 26.008626][ T370] RBP: 00007f13e7ecbb20 R08: 0000000000000000 R09: 0000000000000000 [ 26.016618][ T370] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.024619][ T370] R13: 00007f13e80bb038 R14: 00007f13e80bafa0 R15: 00007ffe85d88ca8 [ 26.595415][ T379] F2FS-fs (loop4): invalid crc value [ 26.610872][ T379] F2FS-fs (loop4): Found nat_bits in checkpoint [ 26.662062][ T379] F2FS-fs (loop4): Start checkpoint disabled! [ 26.694304][ T379] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 26.724139][ T25] tipc: 32-bit node address hash set to aaaa0000 [ 26.834529][ T401] EXT4-fs (loop2): Ignoring removed bh option [ 26.865874][ T401] EXT4-fs warning (device loop2): dx_probe:845: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 26.899686][ T401] EXT4-fs warning (device loop2): dx_probe:848: Enable large directory feature to access it [ 26.932527][ T401] EXT4-fs warning (device loop2): dx_probe:946: inode #2: comm syz.2.37: Corrupt directory, running e2fsck is recommended [ 26.976224][ T24] kauditd_printk_skb: 85 callbacks suppressed [ 26.976235][ T24] audit: type=1400 audit(1792670276.310:159): avc: denied { unlink } for pid=404 comm="syz.4.38" name="#1" dev="tmpfs" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 26.986704][ T401] EXT4-fs (loop2): Cannot turn on journaled quota: type 1: error -117 [ 27.015721][ T24] audit: type=1400 audit(1792670276.350:160): avc: denied { create } for pid=404 comm="syz.4.38" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 27.040757][ T401] EXT4-fs error (device loop2): ext4_iget_extra_inode:4692: inode #15: comm syz.2.37: corrupted in-inode xattr [ 27.066219][ T401] EXT4-fs error (device loop2): ext4_orphan_get:1410: comm syz.2.37: couldn't read orphan inode 15 (err -117) [ 27.085581][ T405] loop4: p1 < > p4 [ 27.091117][ T405] loop4: p4 size 722688 extends beyond EOD, truncated [ 27.104260][ T401] EXT4-fs (loop2): mounted filesystem without journal. Opts: dioread_lock,noblock_validity,grpquota,jqfmt=vfsold,nolazytime,grpjquota=.dax=always,resuid=0x0000000000000000,bh,minixdf,,,errors=continue [ 27.175531][ T24] audit: type=1400 audit(1792670276.510:161): avc: denied { unlink } for pid=279 comm="syz-executor" name="file0" dev="tmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 27.259122][ T310] blk_update_request: I/O error, dev loop4, sector 8 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 27.270548][ T279] __loop_clr_fd: partition scan of loop4 failed (rc=-16) [ 27.279655][ T323] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 27.310384][ T401] EXT4-fs warning (device loop2): dx_probe:845: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 27.324436][ T310] blk_update_request: I/O error, dev loop4, sector 8 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 27.336619][ T323] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 27.345195][ T24] audit: type=1400 audit(1792670276.670:162): avc: denied { create } for pid=409 comm="syz.4.40" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 27.354014][ T310] Buffer I/O error on dev loop4p4, logical block 1, async page read [ 27.369043][ T401] EXT4-fs warning (device loop2): dx_probe:848: Enable large directory feature to access it [ 27.385489][ T323] Buffer I/O error on dev loop4p1, logical block 0, async page read [ 27.393636][ T323] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 27.401473][ T24] audit: type=1400 audit(1792670276.710:163): avc: denied { execute } for pid=400 comm="syz.2.37" path=2F6D656D66643AF365099F9138C07901631F6E7578202864656C6574656429 dev="tmpfs" ino=1028 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 27.432959][ T323] Buffer I/O error on dev loop4p1, logical block 0, async page read [ 27.436852][ T401] EXT4-fs warning (device loop2): dx_probe:946: inode #2: comm syz.2.37: Corrupt directory, running e2fsck is recommended [ 27.454557][ T323] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 27.494026][ T323] Buffer I/O error on dev loop4p1, logical block 0, async page read [ 27.494036][ T24] audit: type=1400 audit(1792670276.720:164): avc: denied { setopt } for pid=409 comm="syz.4.40" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 27.494054][ T24] audit: type=1400 audit(1792670276.720:165): avc: denied { bind } for pid=409 comm="syz.4.40" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 27.512367][ T323] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 27.544081][ T24] audit: type=1400 audit(1792670276.790:166): avc: denied { map } for pid=409 comm="syz.4.40" path="socket:[15831]" dev="sockfs" ino=15831 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 27.602905][ T323] Buffer I/O error on dev loop4p1, logical block 0, async page read [ 27.607305][ T24] audit: type=1400 audit(1792670276.790:167): avc: denied { read write } for pid=409 comm="syz.4.40" path="socket:[15831]" dev="sockfs" ino=15831 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 27.618045][ T323] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 27.690168][ T24] audit: type=1400 audit(1792670276.800:168): avc: denied { mount } for pid=412 comm="syz.1.41" name="/" dev="configfs" ino=13510 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 27.694124][ T323] Buffer I/O error on dev loop4p1, logical block 0, async page read [ 27.781185][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 27.793934][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 27.809894][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 27.823727][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 27.846062][ T399] F2FS-fs (loop0): Invalid segment/section count (458783, 24 x 150994945) [ 27.873534][ T399] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 27.891955][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 27.918480][ T399] F2FS-fs (loop0): invalid crc value [ 27.931614][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 27.948169][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 27.963276][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 27.966105][ T421] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input4 [ 27.988162][ T399] F2FS-fs (loop0): Found nat_bits in checkpoint [ 28.085450][ T399] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 28.092531][ T399] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 28.176353][ T447] EXT4-fs (loop1): mounted filesystem without journal. Opts: discard,bsddf,init_itable,nojournal_checksum,quota,errors=continue,nogrpid,noauto_da_alloc,data_err=abort,,errors=continue [ 28.264252][ T5] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 28.399177][ T462] EXT4-fs (loop4): Ignoring removed bh option [ 28.424152][ T462] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 28.464720][ T462] EXT4-fs error (device loop4): ext4_iget_extra_inode:4692: inode #15: comm syz.4.57: corrupted in-inode xattr [ 28.504363][ T462] EXT4-fs error (device loop4): ext4_orphan_get:1410: comm syz.4.57: couldn't read orphan inode 15 (err -117) [ 28.534350][ T462] EXT4-fs (loop4): mounted filesystem without journal. Opts: init_itable=0x0000000000000006,grpid,bh,grpid,noauto_da_alloc,max_dir_size_kb=0x0000000000000873,init_itable=0x0000000000000009,init_itable,usrjquota=,max_batch_time=0x0000000000000000,norecovery,acl,,errors=continue [ 28.630704][ T477] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x205ad3fc, utbl_chksum : 0xe619d30d) [ 28.643178][ T5] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 28.654952][ T5] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 28.736457][ T487] netlink: 8 bytes leftover after parsing attributes in process `syz.4.65'. [ 28.769108][ T484] EXT4-fs (loop0): mounted filesystem without journal. Opts: usrquota,nodelalloc,,errors=continue [ 28.784170][ T484] ext4 filesystem being mounted at /6/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 28.844062][ T5] usb 3-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 28.857357][ T5] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.865452][ T5] usb 3-1: Product: syz [ 28.869634][ T5] usb 3-1: Manufacturer: syz [ 28.874270][ T5] usb 3-1: SerialNumber: syz [ 28.924650][ T5] ums-sddr09 3-1:1.0: USB Mass Storage device detected [ 28.936358][ T503] netlink: 104 bytes leftover after parsing attributes in process `syz.1.72'. [ 28.958083][ T5] ums-sddr09 3-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 28.958083][ T5] Please send a copy of this message to and [ 28.993272][ T503] netlink: 'syz.1.72': attribute type 1 has an invalid length. [ 29.014027][ T503] netlink: 'syz.1.72': attribute type 1 has an invalid length. [ 29.058965][ T519] ip_tables: iptables: counters copy to user failed while replacing table [ 29.085331][ T523] netlink: 28 bytes leftover after parsing attributes in process `syz.4.81'. [ 29.248923][ T541] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 29.311335][ T541] EXT4-fs error (device loop4) in ext4_setattr:5745: error 28 [ 29.378560][ T5] ums-sddr09: probe of 3-1:1.0 failed with error -5 [ 29.396328][ T5] usb 3-1: USB disconnect, device number 2 [ 29.973083][ T559] EXT4-fs (loop2): Cannot turn on journaled quota: type 1: error -2 [ 29.991657][ T559] EXT4-fs error (device loop2): ext4_iget_extra_inode:4692: inode #15: comm syz.2.96: corrupted in-inode xattr [ 30.014346][ T559] EXT4-fs error (device loop2): ext4_orphan_get:1410: comm syz.2.96: couldn't read orphan inode 15 (err -117) [ 30.034309][ T559] EXT4-fs (loop2): mounted filesystem without journal. Opts: min_batch_time=0x0000000000000009,jqfmt=vfsv0,block_validity,noload,grpjquota=.,noblock_validity,resgid=0x0000000000000000,nobarrier,errors=continue,,errors=continue [ 30.190457][ T555] F2FS-fs (loop4): Invalid segment/section count (458783, 24 x 150994945) [ 30.194713][ T570] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010321, chksum : 0x3a8a43f6, utbl_chksum : 0xe619d30d) [ 30.219732][ T555] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 30.231154][ T555] F2FS-fs (loop4): invalid crc value [ 30.294256][ T555] F2FS-fs (loop4): Found nat_bits in checkpoint [ 30.330619][ T555] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 30.337930][ T555] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 30.437005][ T555] F2FS-fs (loop4): f2fs_check_nid_range: out-of-range nid=60900, run fsck to fix. [ 31.194174][ T589] netlink: 8 bytes leftover after parsing attributes in process `syz.0.105'. [ 31.381468][ T574] F2FS-fs (loop1): invalid crc value [ 31.416579][ T583] F2FS-fs (loop2): invalid crc value [ 31.427138][ T574] F2FS-fs (loop1): Found nat_bits in checkpoint [ 31.454156][ T426] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 31.467288][ T583] F2FS-fs (loop2): Found nat_bits in checkpoint [ 31.526976][ T574] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 31.565141][ T583] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4 [ 31.594062][ T574] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 31.662363][ T583] F2FS-fs (loop2): Corrupted max_depth of 3: 16842753 [ 31.679747][ T583] fscrypt (loop2, inode 8): Error -61 getting encryption context [ 31.735817][ T280] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 31.754406][ T280] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 31.763510][ T280] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 31.816729][ T280] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 31.828509][ T280] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 31.838704][ T280] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 31.848590][ T280] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 31.857947][ T280] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 31.874053][ T280] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 31.882995][ T280] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 31.904065][ T280] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 31.913032][ T280] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 31.944052][ T280] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 31.953026][ T280] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 31.974402][ T280] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 32.004089][ T426] usb 5-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 32.013158][ T426] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.054130][ T426] usb 5-1: Product: syz [ 32.058336][ T426] usb 5-1: Manufacturer: syz [ 32.062936][ T426] usb 5-1: SerialNumber: syz [ 32.146045][ T24] kauditd_printk_skb: 48 callbacks suppressed [ 32.146057][ T24] audit: type=1400 audit(1792670281.480:217): avc: denied { read write } for pid=616 comm="syz.0.113" name="uhid" dev="devtmpfs" ino=261 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 32.217687][ T24] audit: type=1400 audit(1792670281.480:218): avc: denied { open } for pid=616 comm="syz.0.113" path="/dev/uhid" dev="devtmpfs" ino=261 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 32.273012][ T24] audit: type=1400 audit(1792670281.510:219): avc: denied { mount } for pid=618 comm="syz.2.110" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 32.329136][ T24] audit: type=1400 audit(1792670281.520:220): avc: denied { block_suspend } for pid=616 comm="syz.0.113" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 32.377849][ T24] audit: type=1400 audit(1792670281.530:221): avc: denied { unmount } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 32.398045][ T24] audit: type=1400 audit(1792670281.550:222): avc: denied { create } for pid=621 comm="syz.2.114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 32.418477][ T24] audit: type=1400 audit(1792670281.580:223): avc: denied { write } for pid=621 comm="syz.2.114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 32.438889][ T24] audit: type=1400 audit(1792670281.580:224): avc: denied { nlmsg_write } for pid=621 comm="syz.2.114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 32.478305][ T24] audit: type=1400 audit(1792670281.810:225): avc: denied { mount } for pid=639 comm="syz.2.120" name="/" dev="ramfs" ino=16686 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 32.674047][ T611] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 32.795736][ T426] rtl8150 5-1:1.0: eth1: rtl8150 is detected [ 32.835415][ T24] audit: type=1400 audit(1792670282.170:226): avc: denied { read } for pid=134 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 33.054158][ T611] usb 2-1: config 0 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 33.088367][ T611] usb 2-1: config 0 interface 0 has no altsetting 0 [ 33.105371][ T611] usb 2-1: New USB device found, idVendor=056a, idProduct=0016, bcdDevice= 0.00 [ 33.134056][ T611] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.155402][ T611] usb 2-1: config 0 descriptor?? [ 33.201581][ T426] usb 5-1: USB disconnect, device number 2 [ 33.392462][ T640] F2FS-fs (loop2): invalid crc value [ 33.445002][ T640] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (15359802341028777995, 275811881701387) [ 33.514398][ T640] F2FS-fs (loop2): Mounted with checkpoint version = 753bd00b [ 33.522484][ T640] F2FS-fs (loop2): f2fs_check_nid_range: out-of-range nid=90003, run fsck to fix. [ 33.586117][ T644] F2FS-fs (loop0): Found nat_bits in checkpoint [ 33.622244][ T644] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 33.655726][ T611] wacom 0003:056A:0016.0001: Unknown device_type for 'HID 056a:0016'. Assuming pen. [ 33.674345][ T611] wacom 0003:056A:0016.0001: hidraw0: USB HID v10.01 Device [HID 056a:0016] on usb-dummy_hcd.1-1/input0 [ 33.690362][ T611] input: Wacom Graphire4 6x8 Pen as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:056A:0016.0001/input/input5 [ 33.778960][ T644] F2FS-fs (loop0): lookup inode (7) has corrupted xattr [ 33.904626][ T25] usb 2-1: USB disconnect, device number 2 [ 34.024015][ T458] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 34.178934][ T426] input: syz0 as /devices/virtual/misc/uhid/0003:1B1C:0C10.0002/input/input8 [ 34.198887][ T426] hid-generic 0003:1B1C:0C10.0002: input,hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 34.335677][ T694] EXT4-fs (loop2): mounted filesystem without journal. Opts: dioread_lock,,errors=continue [ 34.380226][ T704] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 34.390075][ T704] ext4 filesystem being mounted at /30/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 34.400618][ T458] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 34.410499][ T458] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 34.441536][ T458] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 34.454044][ T704] EXT4-fs (loop0): shut down requested (0) [ 34.474022][ T458] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 34.490812][ T704] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop0 ino=12 [ 34.490968][ T710] Zero length message leads to an empty skb [ 34.505760][ T704] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop0 ino=12 [ 34.523049][ T704] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop0 ino=12 [ 34.532272][ T704] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop0 ino=12 [ 34.541115][ T704] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop0 ino=12 [ 34.644173][ T458] usb 5-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 34.661346][ T458] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.670192][ T458] usb 5-1: Product: syz [ 34.674513][ T458] usb 5-1: Manufacturer: syz [ 34.675653][ T714] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,,errors=continue [ 34.679137][ T458] usb 5-1: SerialNumber: syz [ 34.696487][ T458] usb 5-1: config 0 descriptor?? [ 34.707018][ T714] ext4 filesystem being mounted at /22/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 34.734705][ T458] ums-isd200 5-1:0.0: USB Mass Storage device detected [ 34.815446][ T733] netlink: 92 bytes leftover after parsing attributes in process `syz.0.140'. [ 34.888892][ T25] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 34.914755][ T25] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 34.986584][ T458] ums-isd200: probe of 5-1:0.0 failed with error -22 [ 35.130012][ T729] F2FS-fs (loop1): Insane cp_payload (553648128 >= 504) [ 35.164230][ T729] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 35.194111][ T729] F2FS-fs (loop1): fault_injection options not supported [ 35.201631][ T729] F2FS-fs (loop1): fault_type options not supported [ 35.248769][ T729] F2FS-fs (loop1): invalid crc value [ 35.280038][ T729] F2FS-fs (loop1): Found nat_bits in checkpoint [ 35.360287][ T729] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 35.369772][ T729] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 35.430811][ T729] attempt to access beyond end of device [ 35.430811][ T729] loop1: rw=2049, want=45104, limit=40427 [ 35.452894][ T762] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 35.460839][ T762] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 35.470103][ T762] F2FS-fs (loop2): invalid crc value [ 35.486317][ T762] F2FS-fs (loop2): Found nat_bits in checkpoint [ 35.565025][ T762] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 35.572237][ T762] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 35.801887][ T787] FAULT_INJECTION: forcing a failure. [ 35.801887][ T787] name failslab, interval 1, probability 0, space 0, times 0 [ 35.816377][ T787] CPU: 1 PID: 787 Comm: syz.2.154 Not tainted syzkaller #0 [ 35.823946][ T787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 35.834111][ T787] Call Trace: [ 35.837512][ T787] __dump_stack+0x21/0x24 [ 35.841874][ T787] dump_stack_lvl+0x1a7/0x208 [ 35.846826][ T787] ? show_regs_print_info+0x18/0x18 [ 35.852612][ T787] dump_stack+0x15/0x1c [ 35.856858][ T787] should_fail+0x3ab/0x500 [ 35.861562][ T787] ? ioc_cpd_alloc+0x5c/0xb0 [ 35.866156][ T787] __should_failslab+0xa4/0xe0 [ 35.870917][ T787] should_failslab+0x9/0x20 [ 35.875418][ T787] kmem_cache_alloc_trace+0x3a/0x2e0 [ 35.880780][ T787] ? ioprio_alloc_cpd+0x5c/0xb0 [ 35.885639][ T787] ioc_cpd_alloc+0x5c/0xb0 [ 35.890172][ T787] blkcg_css_alloc+0x1ed/0xb90 [ 35.894946][ T787] cgroup_apply_control_enable+0x338/0x12b0 [ 35.901018][ T787] cgroup_mkdir+0x143c/0x16d0 [ 35.905854][ T787] ? css_task_iter_end+0x270/0x270 [ 35.911079][ T787] ? _raw_spin_lock+0x94/0xf0 [ 35.915959][ T787] ? css_task_iter_end+0x270/0x270 [ 35.921934][ T787] kernfs_iop_mkdir+0x1a3/0x2b0 [ 35.926999][ T787] vfs_mkdir+0x42c/0x600 [ 35.931603][ T787] do_mkdirat+0x14c/0x340 [ 35.935958][ T787] __x64_sys_mkdirat+0x7b/0x90 [ 35.940734][ T787] do_syscall_64+0x31/0x40 [ 35.945159][ T787] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.951237][ T787] RIP: 0033:0x7f156bab4559 [ 35.955661][ T787] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.975730][ T787] RSP: 002b:00007f156a50c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 35.984417][ T787] RAX: ffffffffffffffda RBX: 00007f156bd3afa0 RCX: 00007f156bab4559 [ 35.992482][ T787] RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c [ 36.000821][ T787] RBP: 00007f156bb4bb20 R08: 0000000000000000 R09: 0000000000000000 [ 36.009054][ T787] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 36.017748][ T787] R13: 00007f156bd3b038 R14: 00007f156bd3afa0 R15: 00007ffff007cb48 [ 36.262420][ T799] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,,errors=continue [ 36.294201][ T799] ext4 filesystem being mounted at /29/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 36.333138][ T799] capability: warning: `syz.2.162' uses 32-bit capabilities (legacy support in use) [ 36.346300][ T806] kvm: MWAIT instruction emulated as NOP! [ 36.427608][ T815] bridge_slave_1: FDB only supports static addresses [ 36.624068][ T611] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 36.657628][ T828] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 36.756331][ T828] IPv6: addrconf: prefix option has invalid lifetime [ 36.774179][ T5] usb 5-1: USB disconnect, device number 3 [ 36.864080][ T611] usb 2-1: Using ep0 maxpacket: 32 [ 36.984092][ T611] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 36.996685][ T611] usb 2-1: config 0 has no interface number 0 [ 37.010621][ T611] usb 2-1: config 0 interface 184 has no altsetting 0 [ 37.184152][ T611] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 37.203847][ T611] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.213928][ T611] usb 2-1: Product: syz [ 37.244050][ T611] usb 2-1: Manufacturer: syz [ 37.249649][ T611] usb 2-1: SerialNumber: syz [ 37.268586][ T611] usb 2-1: config 0 descriptor?? [ 37.304480][ T611] smsc75xx v1.0.0 [ 37.334137][ T846] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 37.343238][ T846] ext4 filesystem being mounted at /46/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 37.385507][ T846] EXT4-fs (loop0): shut down requested (1) [ 37.394163][ T24] kauditd_printk_skb: 44 callbacks suppressed [ 37.394198][ T24] audit: type=1400 audit(1792670286.720:271): avc: denied { ioctl } for pid=845 comm="syz.0.180" path="/46/file1/cpuset.effective_mems" dev="loop0" ino=18 ioctlcmd=0x587d scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 37.651547][ T856] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 37.724058][ T856] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 37.764357][ T856] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=b016c018, mo2=0002] [ 37.782556][ T856] System zones: 1-12 [ 37.787702][ T856] EXT4-fs error (device loop0): ext4_orphan_get:1431: comm syz.0.182: bad orphan inode 16 [ 37.818316][ T856] ext4_test_bit(bit=15, block=4) = 0 [ 37.832360][ T856] EXT4-fs (loop0): 1 orphan inode deleted [ 37.844083][ T856] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpquota,nolazytime,resgid=0x0000000000000000,inode_readahead_blks=0x0000000000000008,acl,stripe=0x0000000000000002,max_batch_time=0x0000000000008e6e,debug,data_err=abort,,errors=continue [ 37.877699][ T843] F2FS-fs (loop2): Invalid segment/section count (458783, 24 x 150994945) [ 37.910335][ T843] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 37.919885][ T843] F2FS-fs (loop2): invalid crc value [ 37.968121][ T843] F2FS-fs (loop2): Found nat_bits in checkpoint [ 38.022295][ T24] audit: type=1400 audit(1792670287.350:272): avc: denied { mounton } for pid=867 comm="syz.4.184" path="/46/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 38.024901][ T843] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 38.051588][ T843] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4 [ 38.054306][ T868] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 38.174077][ T5] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 38.195091][ T24] audit: type=1400 audit(1792670287.530:273): avc: denied { mounton } for pid=872 comm="syz.4.187" path="/48/file0" dev="incremental-fs" ino=290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 38.248975][ T24] audit: type=1400 audit(1792670287.530:274): avc: denied { getattr } for pid=872 comm="syz.4.187" name="/" dev="incremental-fs" ino=290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 38.434020][ T5] usb 1-1: Using ep0 maxpacket: 16 [ 38.462246][ T24] audit: type=1400 audit(1792670287.790:275): avc: denied { create } for pid=889 comm="syz.4.194" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 38.502655][ T24] audit: type=1400 audit(1792670287.790:276): avc: denied { write } for pid=889 comm="syz.4.194" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 38.541493][ T24] audit: type=1400 audit(1792670287.790:277): avc: denied { write } for pid=891 comm="syz.4.195" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 38.571868][ T24] audit: type=1400 audit(1792670287.870:278): avc: denied { setopt } for pid=896 comm="syz.4.197" lport=7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 38.594123][ T611] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000044: -71 [ 38.599902][ T24] audit: type=1400 audit(1792670287.870:279): avc: denied { connect } for pid=896 comm="syz.4.197" lport=7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 38.617775][ T611] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_DATA [ 38.627682][ T5] usb 1-1: unable to get BOS descriptor or descriptor too short [ 38.646948][ T24] audit: type=1400 audit(1792670287.930:280): avc: denied { setopt } for pid=900 comm="syz.4.199" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 38.674170][ T611] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 38.686091][ T611] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 38.702472][ T611] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 38.704120][ T303] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 38.720380][ T611] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 38.724045][ T5] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 38.730090][ T611] smsc75xx: probe of 2-1:0.184 failed with error -71 [ 38.751290][ T611] usb 2-1: USB disconnect, device number 3 [ 38.754074][ T5] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 115, changing to 7 [ 38.924122][ T5] usb 1-1: New USB device found, idVendor=0dba, idProduct=3000, bcdDevice= 0.40 [ 38.944745][ T5] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.953108][ T5] usb 1-1: Product: syz [ 38.964447][ T5] usb 1-1: Manufacturer: syz [ 38.969074][ T5] usb 1-1: SerialNumber: syz [ 39.074070][ T303] usb 3-1: not running at top speed; connect to a high speed hub [ 39.154080][ T303] usb 3-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 39.163507][ T303] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.234868][ T303] uvcvideo: Found UVC 1.00 device (046d:0825) [ 39.241878][ T303] uvcvideo: No streaming interface found for terminal 2. [ 39.264579][ T5] usb 1-1: Invalid firmware size=96. [ 39.295572][ T5] usb 1-1: Invalid firmware size=96. [ 39.301523][ T5] usb 1-1: Invalid firmware size=96. [ 39.315238][ T5] usb 1-1: USB disconnect, device number 2 [ 39.474142][ T303] usb 3-1: string descriptor 0 read error: -71 [ 39.483606][ T303] usb 3-1: USB disconnect, device number 3 [ 39.494164][ T426] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 39.520559][ T918] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.528218][ T918] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.536601][ T918] device bridge_slave_0 entered promiscuous mode [ 39.546469][ T918] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.553654][ T918] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.561237][ T918] device bridge_slave_1 entered promiscuous mode [ 39.626350][ T918] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.633600][ T918] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.640897][ T918] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.648041][ T918] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.673547][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.684451][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.702087][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.712117][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 39.730797][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.738080][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.751087][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 39.760078][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.767196][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.774489][ T923] capability: warning: `syz.4.207' uses deprecated v2 capabilities in a way that may be insecure [ 39.786923][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.796218][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.815139][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.826099][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.834578][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.842127][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.851135][ T918] device veth0_vlan entered promiscuous mode [ 39.871686][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.880850][ T930] EXT4-fs warning (device sda1): verify_group_input:176: Cannot read last block (264047) [ 39.881600][ T918] device veth1_macvtap entered promiscuous mode [ 39.900640][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.912784][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.924091][ T426] usb 2-1: too many endpoints for config 1 interface 0 altsetting 13: 65, using maximum allowed: 30 [ 39.935198][ T426] usb 2-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 65 [ 39.948848][ T426] usb 2-1: config 1 interface 0 has no altsetting 0 [ 39.990081][ T936] FAULT_INJECTION: forcing a failure. [ 39.990081][ T936] name failslab, interval 1, probability 0, space 0, times 0 [ 40.003764][ T936] CPU: 0 PID: 936 Comm: syz.4.212 Not tainted syzkaller #0 [ 40.010986][ T936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 40.021343][ T936] Call Trace: [ 40.024648][ T936] __dump_stack+0x21/0x24 [ 40.028977][ T936] dump_stack_lvl+0x1a7/0x208 [ 40.033731][ T936] ? show_regs_print_info+0x18/0x18 [ 40.039106][ T936] dump_stack+0x15/0x1c [ 40.043339][ T936] should_fail+0x3ab/0x500 [ 40.047890][ T936] ? __d_alloc+0x2d/0x690 [ 40.052250][ T936] __should_failslab+0xa4/0xe0 [ 40.057017][ T936] should_failslab+0x9/0x20 [ 40.061540][ T936] kmem_cache_alloc+0x3d/0x2d0 [ 40.066315][ T936] ? __alloc_fd+0x570/0x570 [ 40.070828][ T936] __d_alloc+0x2d/0x690 [ 40.075002][ T936] ? _raw_spin_lock+0x94/0xf0 [ 40.079897][ T936] d_alloc_pseudo+0x1d/0x70 [ 40.084704][ T936] alloc_file_pseudo+0xe0/0x200 [ 40.089730][ T936] ? alloc_empty_file_noaccount+0x80/0x80 [ 40.095450][ T936] __anon_inode_getfd+0x26b/0x3d0 [ 40.100470][ T936] ? anon_inode_getfd+0x40/0x40 [ 40.105332][ T936] ? __kasan_check_write+0x14/0x20 [ 40.110756][ T936] ? selinux_bpf_map+0xd2/0x110 [ 40.116071][ T936] anon_inode_getfd+0x31/0x40 [ 40.120759][ T936] bpf_map_new_fd+0x5f/0x70 [ 40.125357][ T936] map_create+0x1624/0x1f50 [ 40.130128][ T936] __se_sys_bpf+0x24b/0x740 [ 40.134623][ T936] ? __x64_sys_bpf+0x90/0x90 [ 40.139215][ T936] ? __kasan_check_read+0x11/0x20 [ 40.144227][ T936] __x64_sys_bpf+0x7b/0x90 [ 40.148636][ T936] do_syscall_64+0x31/0x40 [ 40.153061][ T936] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 40.158946][ T936] RIP: 0033:0x7ffa85ceb559 [ 40.163361][ T936] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.183496][ T936] RSP: 002b:00007ffa84743028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 40.192166][ T936] RAX: ffffffffffffffda RBX: 00007ffa85f71fa0 RCX: 00007ffa85ceb559 [ 40.200131][ T936] RDX: 0000000000000050 RSI: 0000200000000180 RDI: 0000000000000000 [ 40.208108][ T936] RBP: 00007ffa85d82b20 R08: 0000000000000000 R09: 0000000000000000 [ 40.216167][ T936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 40.224680][ T936] R13: 00007ffa85f72038 R14: 00007ffa85f71fa0 R15: 00007fff6745e968 [ 40.244458][ T7] device bridge_slave_1 left promiscuous mode [ 40.250693][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.266523][ T7] device bridge_slave_0 left promiscuous mode [ 40.272995][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.303881][ T7] device veth1_macvtap left promiscuous mode [ 40.323906][ T7] device veth0_vlan left promiscuous mode [ 40.367033][ T947] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 40.404017][ T947] FAT-fs (loop4): bogus number of reserved sectors [ 40.414441][ T426] usb 2-1: string descriptor 0 read error: -22 [ 40.423336][ T426] usb 2-1: New USB device found, idVendor=046d, idProduct=c626, bcdDevice= 0.40 [ 40.434293][ T947] FAT-fs (loop4): This doesn't look like a DOS 1.x volume; DOS 2.x BPB is non-zero [ 40.443895][ T426] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.453596][ T947] FAT-fs (loop4): Can't find a valid FAT filesystem [ 40.465419][ T957] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 40.485038][ T957] EXT4-fs (loop2): 1 truncate cleaned up [ 40.490805][ T957] EXT4-fs (loop2): mounted filesystem without journal. Opts: init_itable=0x0000000000000004,dioread_nolock,debug_want_extra_isize=0x000000000000006a,jqfmt=vfsold,user_xattr,grpjquota=,,errors=continue [ 40.578301][ T425] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 40.591499][ T963] blk_update_request: I/O error, dev loop4, sector 8 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 40.652746][ T425] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 40.665073][ T963] blk_update_request: I/O error, dev loop4, sector 8 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 40.676624][ T425] Buffer I/O error on dev loop4p1, logical block 0, async page read [ 40.684917][ T963] Buffer I/O error on dev loop4p4, logical block 1, async page read [ 40.735560][ T947] F2FS-fs (loop4): Insane cp_payload (553648128 >= 504) [ 40.744539][ T947] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 40.753165][ T947] F2FS-fs (loop4): fault_injection options not supported [ 40.760858][ T947] F2FS-fs (loop4): fault_type options not supported [ 40.768970][ T947] F2FS-fs (loop4): invalid crc value [ 40.776409][ T947] F2FS-fs (loop4): Found nat_bits in checkpoint [ 40.792072][ T981] FAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 40.808872][ T981] FAT-fs (loop5): error, corrupted file size (i_pos 196, 2048) [ 40.818103][ T981] FAT-fs (loop5): Filesystem has been set read-only [ 40.824883][ T981] FAT-fs (loop5): error, invalid FAT chain (i_pos 196, last_block 8200) [ 40.835406][ T981] FAT-fs (loop5): error, corrupted file size (i_pos 196, 2048) [ 40.851647][ T981] FAT-fs (loop5): error, invalid FAT chain (i_pos 196, last_block 8200) [ 40.852057][ T947] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 40.867252][ T947] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 40.994180][ T5] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 40.994723][ T992] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 41.025739][ T992] EXT4-fs (loop4): mounted filesystem without journal. Opts: discard,journal_dev=0x0000000000000002,grpquota,nojournal_checksum,debug_want_extra_isize=0x0000000000000080,delalloc,nogrpid,noblock_validity,dioread_nolock,,errors=continue [ 41.072687][ T992] EXT4-fs (loop4): Online defrag not supported with bigalloc [ 41.104799][ T426] logitech 0003:046D:C626.0004: unknown main item tag 0x2 [ 41.111976][ T426] logitech 0003:046D:C626.0004: unexpected long global item [ 41.123930][ T426] logitech 0003:046D:C626.0004: parse failed [ 41.130036][ T426] logitech: probe of 0003:046D:C626.0004 failed with error -22 [ 41.310334][ T426] usb 2-1: USB disconnect, device number 4 [ 41.384073][ T5] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 41.395048][ T15] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 41.402656][ T5] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 41.412784][ T5] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 41.425841][ T5] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 41.434898][ T5] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.443444][ T5] usb 1-1: config 0 descriptor?? [ 41.675451][ T1005] netlink: 36 bytes leftover after parsing attributes in process `syz.2.232'. [ 41.693144][ T1007] netlink: 'syz.2.233': attribute type 4 has an invalid length. [ 41.705092][ T1007] netlink: 'syz.2.233': attribute type 4 has an invalid length. [ 41.740063][ T1011] kvm: emulating exchange as write [ 41.803530][ T1017] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.811338][ T1017] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.824047][ T15] usb 5-1: unable to get BOS descriptor or descriptor too short [ 41.905147][ T5] plantronics 0003:047F:FFFF.0005: No inputs registered, leaving [ 41.912976][ T15] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 41.933781][ T5] plantronics 0003:047F:FFFF.0005: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 41.946801][ T15] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 42.014398][ C1] tpacket_rcv: packet too big, clamped from 42 to 4294967286. macoff=82 [ 42.104418][ T1051] EXT4-fs (loop1): 1 truncate cleaned up [ 42.110421][ T1051] EXT4-fs (loop1): mounted filesystem without journal. Opts: errors=remount-ro, [ 42.123645][ T1051] EXT4-fs error (device loop1): ext4_free_branches:1026: inode #13: comm syz.1.251: invalid indirect mapped block 234881024 (level 0) [ 42.137775][ T15] usb 5-1: New USB device found, idVendor=0590, idProduct=004c, bcdDevice= 0.40 [ 42.138014][ T1051] EXT4-fs (loop1): Remounting filesystem read-only [ 42.153495][ T15] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 42.153505][ T15] usb 5-1: Product: syz [ 42.153513][ T15] usb 5-1: Manufacturer: syz [ 42.153521][ T15] usb 5-1: SerialNumber: syz [ 42.184636][ T612] usb 1-1: USB disconnect, device number 3 [ 42.494257][ T15] usb 5-1: unit 255 not found! [ 42.511048][ T15] usb 5-1: USB disconnect, device number 4 [ 42.557335][ T1064] F2FS-fs (loop1): Found nat_bits in checkpoint [ 42.584707][ T1064] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 42.771722][ T24] kauditd_printk_skb: 25 callbacks suppressed [ 42.771735][ T24] audit: type=1400 audit(1792670548.100:306): avc: denied { read write } for pid=1078 comm="syz.0.260" name="binder0" dev="binder" ino=19 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 42.805875][ T24] audit: type=1400 audit(1792670548.110:307): avc: denied { ioctl open } for pid=1078 comm="syz.0.260" path="/56/binderfs2/binder0" dev="binder" ino=19 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 42.847661][ T1085] Illegal XDP return value 3020164994, expect packet loss! [ 42.991184][ T1096] kvm [1095]: vcpu6, guest rIP: 0x9139 disabled perfctr wrmsr: 0xc1 data 0xe50000000000 [ 43.005512][ T1096] kvm [1095]: vcpu6, guest rIP: 0x9139 disabled perfctr wrmsr: 0xc2 data 0xe50000000000 [ 43.034292][ T1096] kvm [1095]: vcpu6, guest rIP: 0x9139 ignored wrmsr: 0x11e data 0xe500be702111 [ 43.049685][ T1096] kvm [1095]: vcpu6, guest rIP: 0x9139 disabled perfctr wrmsr: 0x186 data 0xe50000000000 [ 43.060406][ T1096] kvm [1095]: vcpu6, guest rIP: 0x9139 disabled perfctr wrmsr: 0x187 data 0xe50000000000 [ 46.260757][ T24] audit: type=1400 audit(1792670551.590:308): avc: denied { write } for pid=1126 comm="syz.2.278" name="usb_gadget" dev="configfs" ino=13511 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 46.294357][ T24] audit: type=1400 audit(1792670551.590:309): avc: denied { add_name } for pid=1126 comm="syz.2.278" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 46.357199][ T1136] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 46.369368][ T24] audit: type=1400 audit(1792670551.590:310): avc: denied { create } for pid=1126 comm="syz.2.278" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 46.413849][ T1146] netlink: 20 bytes leftover after parsing attributes in process `syz.4.284'. [ 46.414159][ T24] audit: type=1400 audit(1792670551.590:311): avc: denied { write } for pid=1126 comm="syz.2.278" name="UDC" dev="configfs" ino=19175 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 46.433777][ T1148] input: syz1 as /devices/virtual/input/input9 [ 46.445451][ T24] audit: type=1400 audit(1792670551.590:312): avc: denied { open } for pid=1126 comm="syz.2.278" path="/61/config/usb_gadget/g1/UDC" dev="configfs" ino=19175 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 46.451530][ T1136] EXT4-fs (loop0): 1 truncate cleaned up [ 46.476214][ T24] audit: type=1400 audit(1792670551.600:313): avc: denied { unmount } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 46.492043][ T1150] netlink: 20 bytes leftover after parsing attributes in process `syz.4.284'. [ 46.505731][ T24] audit: type=1400 audit(1792670551.750:314): avc: denied { write } for pid=1147 comm="syz.1.286" name="uinput" dev="devtmpfs" ino=257 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 46.534363][ T1136] EXT4-fs (loop0): mounted filesystem without journal. Opts: nogrpid,dioread_nolock,debug_want_extra_isize=0x0000000000000040,jqfmt=vfsold,nogrpid,grpjquota=,,errors=continue [ 46.594352][ T24] audit: type=1400 audit(1792670551.930:315): avc: denied { rename } for pid=1134 comm="syz.0.281" name="file0" dev="loop0" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 46.633529][ T1152] EXT4-fs (loop5): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 46.655835][ T1152] EXT4-fs (loop5): mounted filesystem without journal. Opts: discard,journal_dev=0x0000000000000002,grpquota,nojournal_checksum,debug_want_extra_isize=0x0000000000000080,delalloc,nogrpid,noauto_da_alloc,dioread_nolock,,errors=continue [ 46.717275][ T1132] F2FS-fs (loop2): invalid crc value [ 46.738292][ T1132] F2FS-fs (loop2): Found nat_bits in checkpoint [ 46.771429][ T1132] F2FS-fs (loop2): Start checkpoint disabled! [ 46.782624][ T1132] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 47.014035][ T284] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 47.029167][ T1177] EXT4-fs (loop4): Project quota feature not enabled. Cannot enable project quota enforcement. [ 47.040177][ T1182] netlink: 4 bytes leftover after parsing attributes in process `syz.5.297'. [ 47.195640][ T1197] EXT4-fs (loop4): mounted filesystem without journal. Opts: noblock_validity,sb=0x0000000000000008,sysvgroups,resuid=0x000000000000ee01,debug_want_extra_isize=0x0000000000000040,inlinecrypt,grpid,nobarrier,nouid32,,errors=continue [ 47.264019][ T284] usb 1-1: Using ep0 maxpacket: 16 [ 47.280298][ T1205] FAT-fs (loop5): Unrecognized mount option "ÿÿ0xffffffffffffffff" or missing value [ 47.404095][ T284] usb 1-1: config 0 has an invalid interface number: 34 but max is 0 [ 47.412269][ T284] usb 1-1: config 0 has no interface number 0 [ 47.422501][ T284] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 47.433092][ T284] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 47.445046][ T1205] EXT4-fs (loop5): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue [ 47.455801][ T1205] ext4 filesystem being mounted at /19/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 47.506339][ T1212] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 47.543077][ T1212] EXT4-fs warning (device loop2): ext4_rmdir:3355: inode #11: comm syz.2.308: empty directory 'file0' has too many links (111) [ 47.569923][ T1128] blk_update_request: I/O error, dev loop4, sector 8 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 47.590869][ T1121] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 47.622590][ T1128] blk_update_request: I/O error, dev loop4, sector 8 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 47.633836][ T1121] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 47.634139][ T284] usb 1-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 47.645151][ T1128] Buffer I/O error on dev loop4p4, logical block 1, async page read [ 47.664006][ T284] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.664074][ T1121] Buffer I/O error on dev loop4p1, logical block 0, async page read [ 47.688106][ T284] usb 1-1: Product: syz [ 47.698566][ T1121] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 47.704386][ T284] usb 1-1: Manufacturer: syz [ 47.719951][ T1121] Buffer I/O error on dev loop4p1, logical block 0, async page read [ 47.726853][ T284] usb 1-1: SerialNumber: syz [ 47.731682][ T1121] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 47.744165][ T1121] Buffer I/O error on dev loop4p1, logical block 0, async page read [ 47.757325][ T1121] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 47.762746][ T284] usb 1-1: config 0 descriptor?? [ 47.773203][ T1121] Buffer I/O error on dev loop4p1, logical block 0, async page read [ 47.788290][ T1121] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 47.804058][ T1166] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 47.808465][ T1121] Buffer I/O error on dev loop4p1, logical block 0, async page read [ 47.813197][ T1231] syz.1.314 (1231): drop_caches: 1 [ 47.825424][ T1166] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 47.876183][ T1235] syz.1.314 (1235): drop_caches: 1 [ 47.951345][ T1257] EXT4-fs (loop5): Mount option "noacl" will be removed by 3.5 [ 47.951345][ T1257] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 47.951345][ T1257] [ 47.969893][ T1257] EXT4-fs (loop5): Journaled quota options ignored when QUOTA feature is enabled [ 47.979133][ T1257] EXT4-fs (loop5): Ignoring removed orlov option [ 47.985684][ T1257] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 47.985684][ T1257] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 47.985684][ T1257] [ 48.006931][ T1257] EXT4-fs (loop5): mounted filesystem without journal. Opts: grpid,noacl,nodioread_nolock,dioread_lock,stripe=0x0000000000000000,init_itable,grpjquota=wÅü5ÔTÕÔ)­`)YFæ¾nA­½@T<Ÿ3»Ú‚$¢ó×rçcnH³<¿pƒrèñ¹“>ÅwC¾" žð-ùËòöè€Ó8/,orlov,nouser_xattr,,errors=continue [ 48.041110][ T24] kauditd_printk_skb: 6 callbacks suppressed [ 48.041124][ T24] audit: type=1400 audit(1792670553.370:322): avc: denied { mounton } for pid=1256 comm="syz.5.325" path=2F32362F131377C5FC35D41454D5D41D29AD1A6029598146E6BE166E41AD0DBD4054033C9F33BBDA8224A2F3D772E7636E48B33CBF708372E8F1B9933EC5127743BE2206209EF02DF9CBF2F6E880D3382F66696C6530 dev="loop5" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 48.085996][ T1166] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 48.096173][ T1166] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 48.110169][ T24] audit: type=1400 audit(1792670553.430:323): avc: denied { unlink } for pid=1256 comm="syz.5.325" name="#b" dev="loop5" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=chr_file permissive=1 [ 48.111863][ T918] EXT4-fs error (device loop5): ext4_lookup:1830: inode #11: comm syz-executor: iget: bad extra_isize 2336 (inode size 256) [ 48.146291][ T918] EXT4-fs error (device loop5): ext4_lookup:1830: inode #11: comm syz-executor: iget: bad extra_isize 2336 (inode size 256) [ 48.267830][ T1267] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpquota,,errors=continue [ 48.334725][ T1271] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.341983][ T1271] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.349982][ T1271] device bridge_slave_0 entered promiscuous mode [ 48.357199][ T284] asix 1-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 48.371429][ T1271] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.378764][ T1271] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.386434][ T1271] device bridge_slave_1 entered promiscuous mode [ 48.441728][ T1279] attempt to access beyond end of device [ 48.441728][ T1279] loop1: rw=2049, want=241, limit=128 [ 48.455416][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 48.462999][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.463464][ T49] attempt to access beyond end of device [ 48.463464][ T49] loop1: rw=1, want=1041, limit=128 [ 48.471277][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 48.490511][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.498835][ T969] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.505908][ T969] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.515392][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 48.523921][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.532277][ T969] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.539348][ T969] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.547062][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 48.565395][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 48.574144][ T284] asix 1-1:0.34 (unnamed net_device) (uninitialized): Error reading PHYID register: 00 [ 48.574436][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 48.593774][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 48.610066][ T1271] device veth0_vlan entered promiscuous mode [ 48.617084][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 48.625681][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 48.638813][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 48.667004][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 48.676821][ T1271] device veth1_macvtap entered promiscuous mode [ 48.689032][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 48.702793][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 48.723203][ T24] audit: type=1400 audit(1792670554.050:324): avc: denied { mount } for pid=1271 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 48.759118][ T24] audit: type=1326 audit(1792670554.090:325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1296 comm="syz.6.331" exe="/root/ci2-android-5-10/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4403fd3559 code=0x0 [ 48.794137][ T284] asix 1-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 48.824052][ T24] audit: type=1400 audit(1792670554.150:326): avc: denied { watch } for pid=1310 comm="syz.2.343" path="/74" dev="tmpfs" ino=408 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 48.830019][ T1316] netlink: 104 bytes leftover after parsing attributes in process `syz.4.346'. [ 48.849340][ T24] audit: type=1400 audit(1792670554.160:327): avc: denied { bind } for pid=1313 comm="syz.1.345" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 48.874584][ T24] audit: type=1400 audit(1792670554.160:328): avc: denied { name_bind } for pid=1313 comm="syz.1.345" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 48.897147][ T24] audit: type=1400 audit(1792670554.160:329): avc: denied { node_bind } for pid=1313 comm="syz.1.345" saddr=ff02::1 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 48.988766][ T7] device bridge_slave_1 left promiscuous mode [ 48.995314][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.002953][ T7] device bridge_slave_0 left promiscuous mode [ 49.009404][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.017777][ T7] device veth1_macvtap left promiscuous mode [ 49.023860][ T7] device veth0_vlan left promiscuous mode [ 49.074119][ T284] asix 1-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 49.087964][ T284] asix: probe of 1-1:0.34 failed with error -71 [ 49.096960][ T284] usb 1-1: USB disconnect, device number 4 [ 49.204101][ T15] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 49.444072][ T15] usb 2-1: Using ep0 maxpacket: 8 [ 49.599959][ T24] audit: type=1400 audit(1792670554.930:330): avc: denied { relabelfrom } for pid=1357 comm="syz.6.353" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 49.620417][ T24] audit: type=1400 audit(1792670554.930:331): avc: denied { relabelto } for pid=1357 comm="syz.6.353" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 49.624124][ T15] usb 2-1: unable to get BOS descriptor or descriptor too short [ 49.780892][ T1364] attempt to access beyond end of device [ 49.780892][ T1364] loop6: rw=0, want=57848, limit=8192 [ 49.792639][ T1364] Buffer I/O error on dev loop6, logical block 57847, async page read [ 49.804278][ T1364] attempt to access beyond end of device [ 49.804278][ T1364] loop6: rw=0, want=57848, limit=8192 [ 49.815997][ T1364] Buffer I/O error on dev loop6, logical block 57847, async page read [ 49.824854][ T1364] attempt to access beyond end of device [ 49.824854][ T1364] loop6: rw=0, want=57848, limit=8192 [ 49.841519][ T1364] Buffer I/O error on dev loop6, logical block 57847, async page read [ 49.849914][ T1373] attempt to access beyond end of device [ 49.849914][ T1373] loop6: rw=0, want=57848, limit=8192 [ 49.861797][ T1373] Buffer I/O error on dev loop6, logical block 57847, async page read [ 49.870581][ T1364] attempt to access beyond end of device [ 49.870581][ T1364] loop6: rw=0, want=57848, limit=8192 [ 49.881802][ T1364] attempt to access beyond end of device [ 49.881802][ T1364] loop6: rw=0, want=57848, limit=8192 [ 49.894144][ T15] usb 2-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40 [ 49.903678][ T1373] attempt to access beyond end of device [ 49.903678][ T1373] loop6: rw=0, want=57848, limit=8192 [ 49.918135][ T15] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.926877][ T1364] attempt to access beyond end of device [ 49.926877][ T1364] loop6: rw=0, want=57848, limit=8192 [ 49.927441][ T15] usb 2-1: Product: syz [ 49.942268][ T15] usb 2-1: Manufacturer: syz [ 49.947187][ T15] usb 2-1: SerialNumber: syz [ 50.020565][ T1375] EXT4-fs (loop4): Ignoring removed bh option [ 50.034762][ T1378] EXT4-fs (loop2): orphan cleanup on readonly fs [ 50.051490][ T1378] EXT4-fs warning (device loop2): ext4_enable_quotas:6495: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 50.068145][ T1375] EXT4-fs warning (device loop4): dx_probe:845: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 50.080135][ T1375] EXT4-fs warning (device loop4): dx_probe:848: Enable large directory feature to access it [ 50.090658][ T1378] EXT4-fs (loop2): Cannot turn on quotas: error -22 [ 50.098710][ T1375] EXT4-fs warning (device loop4): dx_probe:946: inode #2: comm syz.4.359: Corrupt directory, running e2fsck is recommended [ 50.111988][ T1378] EXT4-fs error (device loop2): ext4_ext_check_inode:500: inode #13: comm syz.2.360: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 50.130421][ T1378] EXT4-fs error (device loop2): ext4_orphan_get:1410: comm syz.2.360: couldn't read orphan inode 13 (err -117) [ 50.130676][ T1375] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -117 [ 50.142738][ T1378] EXT4-fs (loop2): mounted filesystem without journal. Opts: sysvgroups,noblock_validity,journal_dev=0x0000000000000005,barrier=0x0000000000000000,resuid=0x0000000000000000,journal_ioprio=0x0000000000000006,grpid,,errors=continue [ 50.166033][ T1375] EXT4-fs error (device loop4): ext4_iget_extra_inode:4692: inode #15: comm syz.4.359: corrupted in-inode xattr [ 50.202257][ T1375] EXT4-fs error (device loop4): ext4_orphan_get:1410: comm syz.4.359: couldn't read orphan inode 15 (err -117) [ 50.216836][ T1378] EXT4-fs (loop2): warning: mounting fs with errors, running e2fsck is recommended [ 50.227033][ T1375] EXT4-fs (loop4): mounted filesystem without journal. Opts: dioread_lock,noblock_validity,grpquota,jqfmt=vfsold,nolazytime,grpjquota=.dax=always,resuid=0x0000000000000000,bh,minixdf,,,errors=continue [ 50.254238][ T1378] EXT4-fs warning (device loop2): ext4_enable_quotas:6495: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 50.281356][ T1378] EXT4-fs (loop2): warning: mounting unchecked fs, running e2fsck is recommended [ 50.290886][ T1375] EXT4-fs warning (device loop4): dx_probe:845: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 50.302783][ T1375] EXT4-fs warning (device loop4): dx_probe:848: Enable large directory feature to access it [ 50.313139][ T1375] EXT4-fs warning (device loop4): dx_probe:946: inode #2: comm syz.4.359: Corrupt directory, running e2fsck is recommended [ 50.335547][ T1378] EXT4-fs warning (device loop2): ext4_enable_quotas:6495: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 50.635627][ T1403] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,,errors=continue [ 50.646793][ T1403] ext4 filesystem being mounted at /82/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 50.695313][ T1397] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input10 [ 50.744061][ T20] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 50.754103][ T15] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 50.778039][ T15] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 50.795177][ T1410] EXT4-fs (loop6): mounted filesystem without journal. Opts: ,errors=continue [ 50.814152][ T15] usb 2-1: USB disconnect, device number 5 [ 50.838001][ T1410] EXT4-fs error (device loop6): ext4_mb_generate_buddy:824: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 50.913171][ T1410] EXT4-fs (loop6): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 34 with error 28 [ 50.963263][ T1410] EXT4-fs (loop6): This should not happen!! Data will be lost [ 50.963263][ T1410] [ 50.983350][ T1410] EXT4-fs (loop6): Total free blocks count 0 [ 51.003511][ T1410] EXT4-fs (loop6): Free/Dirty block details [ 51.009769][ T1410] EXT4-fs (loop6): free_blocks=4096 [ 51.015124][ T1410] EXT4-fs (loop6): dirty_blocks=48 [ 51.020241][ T1410] EXT4-fs (loop6): Block reservation details [ 51.026334][ T1410] EXT4-fs (loop6): i_reserved_data_blocks=3 [ 51.067504][ T1414] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 51.075977][ T1414] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 51.092651][ T1414] F2FS-fs (loop2): invalid crc value [ 51.100726][ T1414] F2FS-fs (loop2): Found nat_bits in checkpoint [ 51.104370][ T20] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 51.145657][ T20] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 51.145853][ T1414] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 51.165647][ T1414] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 51.174659][ T20] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 51.194650][ T1430] netlink: 40 bytes leftover after parsing attributes in process `syz.6.374'. [ 51.203648][ T1430] netlink: 40 bytes leftover after parsing attributes in process `syz.6.374'. [ 51.208387][ T20] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 51.232989][ T20] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.237291][ T1428] netlink: 40 bytes leftover after parsing attributes in process `syz.6.374'. [ 51.250181][ T1428] netlink: 40 bytes leftover after parsing attributes in process `syz.6.374'. [ 51.250654][ T20] usb 1-1: config 0 descriptor?? [ 51.259568][ T1428] netlink: 40 bytes leftover after parsing attributes in process `syz.6.374'. [ 51.273695][ T1428] netlink: 40 bytes leftover after parsing attributes in process `syz.6.374'. [ 51.282797][ T1428] netlink: 40 bytes leftover after parsing attributes in process `syz.6.374'. [ 51.292420][ T1428] netlink: 40 bytes leftover after parsing attributes in process `syz.6.374'. [ 51.302080][ T7] F2FS-fs (loop2): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix. [ 51.310996][ T7] F2FS-fs (loop2): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. [ 51.399686][ T1419] F2FS-fs (loop4): Test dummy encryption mode enabled [ 51.424578][ T1419] F2FS-fs (loop4): invalid crc value [ 51.431283][ T1419] F2FS-fs (loop4): Found nat_bits in checkpoint [ 51.454183][ T1419] F2FS-fs (loop4): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 51.465581][ T1419] F2FS-fs (loop4): Cannot turn on quotas: -2 on 0 [ 51.472188][ T1419] F2FS-fs (loop4): Start checkpoint disabled! [ 51.479160][ T1419] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 51.514385][ T7] F2FS-fs (loop4): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 51.525363][ T1419] VFS:Filesystem freeze failed [ 51.745242][ T1446] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 51.755174][ T20] plantronics 0003:047F:FFFF.0006: unknown main item tag 0xd [ 51.763843][ T20] plantronics 0003:047F:FFFF.0006: No inputs registered, leaving [ 51.774881][ T20] plantronics 0003:047F:FFFF.0006: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 51.814116][ T15] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 52.045075][ T20] usb 1-1: USB disconnect, device number 5 [ 52.081355][ T1271] FAT-fs (loop6): error, invalid access to FAT (entry 0x00000100) [ 52.089517][ T1271] FAT-fs (loop6): Filesystem has been set read-only [ 52.180167][ T1474] EXT4-fs (loop6): mounted filesystem without journal. Opts: i_version,nolazytime,errors=remount-ro,grpjquota=,acl, [ 52.192702][ T1474] ext4 filesystem being mounted at /12/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 52.234135][ T15] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 52.237799][ T1479] netlink: 'syz.4.391': attribute type 1 has an invalid length. [ 52.248698][ T15] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 52.252455][ T1479] __nla_validate_parse: 20 callbacks suppressed [ 52.252463][ T1479] netlink: 4 bytes leftover after parsing attributes in process `syz.4.391'. [ 52.262892][ T15] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 52.300732][ T1481] overlayfs: upper fs does not support tmpfile. [ 52.448817][ T1506] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpjquota=,,errors=continue [ 52.473791][ T282] EXT4-fs warning (device loop2): empty_inline_dir:1865: bad inline directory (dir #12) - no `..' [ 52.484757][ T282] EXT4-fs warning (device loop2): empty_inline_dir:1865: bad inline directory (dir #12) - no `..' [ 52.495577][ T15] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 52.495591][ T15] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 52.495600][ T15] usb 2-1: Product: syz [ 52.495609][ T15] usb 2-1: Manufacturer: syz [ 52.495617][ T15] usb 2-1: SerialNumber: syz [ 52.514164][ T15] usb 2-1: config 0 descriptor?? [ 52.518078][ T282] EXT4-fs warning (device loop2): empty_inline_dir:1865: bad inline directory (dir #12) - no `..' [ 52.542997][ T282] EXT4-fs warning (device loop2): empty_inline_dir:1865: bad inline directory (dir #12) - no `..' [ 52.554420][ T282] EXT4-fs warning (device loop2): empty_inline_dir:1865: bad inline directory (dir #12) - no `..' [ 52.572953][ T282] EXT4-fs warning (device loop2): empty_inline_dir:1865: bad inline directory (dir #12) - no `..' [ 52.584249][ T282] EXT4-fs warning (device loop2): empty_inline_dir:1865: bad inline directory (dir #12) - no `..' [ 52.595374][ T282] EXT4-fs warning (device loop2): empty_inline_dir:1865: bad inline directory (dir #12) - no `..' [ 52.596096][ T1521] bridge0: port 3(veth0_vlan) entered blocking state [ 52.606522][ T282] EXT4-fs warning (device loop2): empty_inline_dir:1865: bad inline directory (dir #12) - no `..' [ 52.613620][ T1521] bridge0: port 3(veth0_vlan) entered disabled state [ 52.624126][ T282] EXT4-fs warning (device loop2): empty_inline_dir:1865: bad inline directory (dir #12) - no `..' [ 52.639831][ T1521] bridge0: port 3(veth0_vlan) entered blocking state [ 52.648259][ T1521] bridge0: port 3(veth0_vlan) entered forwarding state [ 52.709309][ T1529] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 52.725488][ T1529] FAT-fs (loop0): error, parent dir link count too low (2) [ 52.732812][ T1529] FAT-fs (loop0): Filesystem has been set read-only [ 52.746943][ T281] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 52.786630][ T15] usb 2-1: USB disconnect, device number 6 [ 52.961308][ T1554] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 52.982768][ T1556] xt_hashlimit: size too large, truncated to 1048576 [ 53.006120][ T1121] udevd[1121]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 53.484835][ T1578] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,,errors=continue [ 53.505175][ T1578] ext4 filesystem being mounted at /85/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 53.540288][ T1578] incfs: ino conflict with backing FS 2 [ 53.553158][ T1578] overlayfs: failed to create directory ./bus/work (errno: 28); mounting read-only [ 53.600204][ T280] tipc: Resetting bearer [ 53.616583][ T280] tipc: Disabling bearer [ 53.860293][ T1584] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.868601][ T1584] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.876461][ T1584] device bridge_slave_0 entered promiscuous mode [ 53.883913][ T1584] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.894552][ T1584] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.902779][ T24] kauditd_printk_skb: 16 callbacks suppressed [ 53.902792][ T24] audit: type=1400 audit(1792670559.230:348): avc: denied { map } for pid=1594 comm="syz.0.451" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=174 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 53.935842][ T1584] device bridge_slave_1 entered promiscuous mode [ 53.954167][ T1411] udevd[1411]: inotify_add_watch(7, /dev/loop4, 10) failed: Not a directory [ 53.974337][ T1411] udevd[1411]: inotify_add_watch(7, /dev/loop4, 10) failed: Not a directory [ 53.995283][ T1121] udevd[1121]: inotify_add_watch(7, /dev/loop4p4, 10) failed: Not a directory [ 54.007708][ T24] audit: type=1400 audit(1792670559.270:349): avc: denied { sys_admin } for pid=1594 comm="syz.0.451" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 54.031851][ T1411] udevd[1411]: inotify_add_watch(7, /dev/loop4p1, 10) failed: Not a directory [ 54.044510][ T1568] F2FS-fs (loop4): Found nat_bits in checkpoint [ 54.104399][ T1584] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.111685][ T1584] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.119106][ T1584] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.126349][ T1584] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.141905][ T1568] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 54.169025][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 54.184487][ T969] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.199066][ T969] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.217385][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 54.218580][ T1605] ip_tables: iptables: counters copy to user failed while replacing table [ 54.225962][ T969] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.241275][ T969] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.250296][ T1568] F2FS-fs (loop4): lookup inode (7) has corrupted xattr [ 54.257948][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 54.267169][ T969] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.274333][ T969] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.282321][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 54.295049][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 54.315615][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 54.329003][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 54.337718][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 54.345442][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 54.354750][ T1584] device veth0_vlan entered promiscuous mode [ 54.368117][ T969] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 54.373185][ T1609] ip_tables: iptables: counters copy to user failed while replacing table [ 54.378976][ T1584] device veth1_macvtap entered promiscuous mode [ 54.431792][ T1609] tipc: Started in network mode [ 54.436892][ T1609] tipc: Own node identity ac14142f, cluster identity 4711 [ 54.444797][ T1609] tipc: Enabled bearer , priority 10 [ 54.455295][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 54.464585][ T1411] udevd[1411]: inotify_add_watch(7, /dev/loop4, 10) failed: Not a directory [ 54.489114][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 54.512273][ T24] audit: type=1400 audit(1792670559.840:350): avc: denied { create } for pid=1614 comm="syz.6.449" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 54.537488][ T1411] udevd[1411]: inotify_add_watch(7, /dev/loop6, 10) failed: Not a directory [ 54.564661][ T1615] loop6: p1 < > p4 [ 54.569830][ T1411] udevd[1411]: inotify_add_watch(7, /dev/loop6, 10) failed: Not a directory [ 54.578943][ T1615] loop6: p4 size 722688 extends beyond EOD, truncated [ 54.590304][ T1121] udevd[1121]: inotify_add_watch(7, /dev/loop6p4, 10) failed: Not a directory [ 54.600665][ T1411] udevd[1411]: inotify_add_watch(7, /dev/loop6p1, 10) failed: Not a directory [ 54.633721][ T24] audit: type=1400 audit(1792670559.960:351): avc: denied { unlink } for pid=1271 comm="syz-executor" name="file0" dev="tmpfs" ino=252 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 54.844064][ T303] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 54.954290][ T1067] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 55.074756][ T9] device bridge_slave_1 left promiscuous mode [ 55.081116][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.088783][ T9] device bridge_slave_0 left promiscuous mode [ 55.095182][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.103515][ T9] device veth1_macvtap left promiscuous mode [ 55.109833][ T9] device veth0_vlan left promiscuous mode [ 55.264087][ T303] usb 1-1: too many endpoints for config 1 interface 0 altsetting 13: 33, using maximum allowed: 30 [ 55.275029][ T303] usb 1-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 33 [ 55.288583][ T303] usb 1-1: config 1 interface 0 has no altsetting 0 [ 55.394151][ T1067] usb 5-1: config 0 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 55.414041][ T1067] usb 5-1: config 0 interface 0 has no altsetting 0 [ 55.420775][ T1067] usb 5-1: New USB device found, idVendor=056a, idProduct=0016, bcdDevice= 0.00 [ 55.444040][ T1067] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 55.474058][ T303] usb 1-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.40 [ 55.483134][ T303] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.491812][ T1067] usb 5-1: config 0 descriptor?? [ 55.496980][ T303] usb 1-1: Product: syz [ 55.501152][ T303] usb 1-1: Manufacturer: syz [ 55.505874][ T303] usb 1-1: SerialNumber: syz [ 55.514025][ T15] tipc: 32-bit node address hash set to 2f1414ac [ 55.984979][ T1067] wacom 0003:056A:0016.0007: Unknown device_type for 'HID 056a:0016'. Assuming pen. [ 55.999573][ T1067] wacom 0003:056A:0016.0007: hidraw0: USB HID v10.01 Device [HID 056a:0016] on usb-dummy_hcd.4-1/input0 [ 56.012437][ T1067] input: Wacom Graphire4 6x8 Pen as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:056A:0016.0007/input/input12 [ 56.186560][ T25] usb 5-1: USB disconnect, device number 5 [ 56.324115][ T303] usbhid 1-1:1.0: can't add hid device: -71 [ 56.330273][ T303] usbhid: probe of 1-1:1.0 failed with error -71 [ 56.338738][ T303] usb 1-1: USB disconnect, device number 6 [ 56.714494][ T24] audit: type=1400 audit(1792670562.050:352): avc: denied { watch } for pid=1647 comm="syz.6.457" path="/46/file0" dev="tmpfs" ino=274 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 57.575475][ T1658] EXT4-fs (loop6): mounted filesystem without journal. Opts: noblock_validity,,errors=continue [ 57.586084][ T1658] ext4 filesystem being mounted at /49/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 57.601110][ T1658] incfs: ino conflict with backing FS 2 [ 57.609372][ T1658] overlayfs: failed to create directory ./bus/work (errno: 28); mounting read-only [ 57.855175][ T9] tipc: Disabling bearer [ 57.860792][ T9] tipc: Left network mode [ 58.125291][ T1411] udevd[1411]: inotify_add_watch(7, /dev/loop4, 10) failed: Not a directory [ 58.165370][ T1675] F2FS-fs (loop4): invalid crc value [ 58.215460][ T1675] F2FS-fs (loop4): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 58.255473][ T1675] F2FS-fs (loop4): Start checkpoint disabled! [ 58.269004][ T1675] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 58.355483][ T1675] handle_bad_sector: 31879 callbacks suppressed [ 58.355497][ T1675] attempt to access beyond end of device [ 58.355497][ T1675] loop4: rw=2049, want=45104, limit=40427 [ 58.509495][ T9] device bridge_slave_1 left promiscuous mode [ 58.519946][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.544712][ T49] attempt to access beyond end of device [ 58.544712][ T49] loop4: rw=2049, want=40968, limit=40427 [ 58.558479][ T9] device bridge_slave_0 left promiscuous mode [ 58.570221][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.585411][ T9] device veth1_macvtap left promiscuous mode [ 58.591673][ T9] device veth0_vlan left promiscuous mode [ 58.635608][ T1411] udevd[1411]: inotify_add_watch(7, /dev/loop4, 10) failed: Not a directory [ 59.290283][ T24] audit: type=1400 audit(1792670564.620:353): avc: denied { ioctl } for pid=1728 comm="syz.4.474" path="socket:[22833]" dev="sockfs" ino=22833 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 59.334831][ T1411] udevd[1411]: inotify_add_watch(7, /dev/loop0, 10) failed: Not a directory [ 59.345731][ T1411] udevd[1411]: inotify_add_watch(7, /dev/loop0, 10) failed: Not a directory [ 59.383610][ T1730] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,,errors=continue [ 59.394772][ T1730] ext4 filesystem being mounted at /87/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 59.413654][ T1730] incfs: ino conflict with backing FS 2 [ 59.422036][ T1730] overlayfs: failed to create directory ./bus/work (errno: 28); mounting read-only [ 59.665931][ T1750] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 59.693657][ T24] audit: type=1400 audit(1792670565.020:354): avc: denied { read } for pid=1746 comm="syz.4.481" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=22918 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 59.864218][ T1776] hid-generic 0000:0000:0000.0008: unknown main item tag 0x0 [ 59.895695][ T1776] hid-generic 0000:0000:0000.0008: hidraw0: HID v0.00 Device [syz1] on syz0 [ 59.934892][ T1781] udevd[1781]: open /dev/null failed: Not a directory SYZFAIL: mount(dev) failed (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: tun: can't open /dev/net/tun (errno 20: Not a directory) loop exited with status 67 SYZFAIL: repeatedly failed to execute the program proc=7 req=439 state=3 status=67 (errno 32: Broken pipe) [ 60.573999][ T24] audit: type=1400 audit(1792670565.900:355): avc: denied { write } for pid=271 comm="syz-executor" path="pipe:[13902]" dev="pipefs" ino=13902 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 61.094973][ T9] bridge0: port 3(veth0_vlan) entered disabled state [ 61.102329][ T9] device bridge_slave_1 left promiscuous mode [ 61.108602][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.116030][ T9] device bridge_slave_0 left promiscuous mode [ 61.122218][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.130145][ T9] device veth1_macvtap left promiscuous mode [ 61.136308][ T9] device veth0_vlan left promiscuous mode