last executing test programs: 14.623354485s ago: executing program 0 (id=929): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$KDSKBLED(r2, 0x4b65, 0x1) write$apparmor_current(r1, &(0x7f0000000040)=@profile={'permprofile ', ':\x00'}, 0xe) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000880)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) r4 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r4, 0xc018480b, &(0x7f00000000c0)={0x3, 0x100, 0x0, 0xc1, 0x7, 0x8}) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@window={0x3, 0x7, 0x9}, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x6) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000540)='highspeed', 0x9) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 11.414965583s ago: executing program 0 (id=939): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x1de, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa4186dd60bf000001a8000000000000000000000000fffffffffffffe8800000000000000000000000000012234c2d5c9a46b9fa14172170a013589317d2af31ba55431762f462a5abc3f46494ee91bfca594d52f8c37da5d2d81edc09f68f122fbf741257bf1319408347a17c89212dfe27a0fc65362487e5afe763f0954f60d9d08b61276ce0b3aa520b5f30a9f52c4aa53fc003f8570383ca63530d93b78a7875338b3d7645ef2c24ab05db63cfdcde7b3cac2248c9d1c73d0d4382b3f520ad6e9be698eaa9bf5b939ce09919c9485c4725690ee2483315829a196f8"], 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}, 0x1, 0x0, 0x0, 0x4}, 0x0) 11.254748667s ago: executing program 0 (id=940): mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_io_uring_submit$UBLK(0x0, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x1, 0x1, 0x1, 0x0, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000000)={0x18, 0x0, {0x1, @empty, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000040)) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r3, 0x40047438, &(0x7f0000000040)) readv(r3, &(0x7f00000001c0)=[{&(0x7f0000000480)=""/225, 0xe1}], 0x1) sendmsg$nl_route(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000e300020008000a00", @ANYRES32, @ANYBLOB="08001b"], 0x30}}, 0x0) mkdirat$cgroup(r0, 0x0, 0x1ff) mkdirat$cgroup(r0, 0x0, 0x1ff) 10.844930806s ago: executing program 0 (id=941): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000001980)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x4, @dev={0xfe, 0x80, '\x00', 0x25}, 0x10}, 0x18, 0x0}}], 0x1, 0x20002040) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)=@ipv6_getaddr={0x3c, 0x16, 0x10, 0x70bd27, 0x25dfdbfc, {0xa, 0x18, 0x40, 0xfd}, [@IFA_FLAGS={0x8, 0x8, 0x1}, @IFA_FLAGS={0x8, 0x8, 0x100}, @IFA_CACHEINFO={0x14, 0x6, {0x0, 0xe}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40084}, 0x20000000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001140)=ANY=[], 0x48}, 0x20040010) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r0, &(0x7f00003a1000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="9a01000000f800b8d58800000f23d00f21f8351000000d0f23f864640f79ea66baf80cb8c85f5480ef66bafc0cecc4c2adac17b9550200000f320f2860c7c4e11751df0f2e2d00000080b9800000c00f3235008000000f30", 0x58}], 0x1, 0x4a, 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000080)={0x70003, 0x0, {[0xffffffffffffffff, 0x1f8, 0x2, 0xffffffffefffff15, 0x3, 0x4, 0x1, 0x4]}}) preadv(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000000300)=""/3, 0x3}], 0x1, 0x0, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10.556280804s ago: executing program 0 (id=944): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./proc/fs/nfsd\x00', &(0x7f00000001c0)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/fs/nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='tcp 2', 0x5) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x100, {0x0, 0x0, 0x0, 0x0, {0xe, 0x1}}}, 0x24}}, 0x4) 9.649074796s ago: executing program 0 (id=954): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f000000e4c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELSETELEM={0x20, 0xe, 0xa, 0x201, 0x0, 0x0, {0xa}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x48}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 2.937744179s ago: executing program 2 (id=984): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000400)={0x1, 0x0, 0x0, &(0x7f0000020000), 0x0}) write(r1, 0x0, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000600)={0x1, r1}) 2.822647352s ago: executing program 2 (id=985): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000007900)={&(0x7f00000006c0)=@newtaction={0x68, 0x30, 0x216822a75a8bdd29, 0x0, 0xfffffffd, {}, [{0x54, 0x1, [@m_skbmod={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x20, 0x2, {{0x0, 0x8}, 0x2}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@hyper}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r0, 0x7a5, &(0x7f00000000c0)={{@my=0x0}, 0x1}) r2 = socket$inet_smc(0x2b, 0x1, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000100), 0x9, 0x2c4340) ioctl$SCSI_IOCTL_STOP_UNIT(r3, 0x6) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="030000000400000004000000b5"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000000)="c1dfb080cd21d308098ee68888a8", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r7 = dup(r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r7, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)=@delqdisc={0x24, 0x25, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0xffff}, {0xfff1, 0xffff}}}, 0x24}}, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) r9 = accept4$inet6(r7, &(0x7f0000000140)={0xa, 0x0, 0x0, @private0}, &(0x7f00000001c0)=0x1c, 0x80400) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000200)={'wlan1\x00'}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) getsockopt$IP_VS_SO_GET_TIMEOUT(r2, 0x0, 0x486, &(0x7f0000000000), &(0x7f0000000040)=0xc) r10 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_STARTDAEMON(r10, 0x0, 0x48b, &(0x7f0000000080)={0x1, 'wg1\x00', 0x4}, 0x18) 1.540273953s ago: executing program 2 (id=993): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)=@deltfilter={0x24, 0x2d, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1}, {0xfff1, 0xffff}, {0x3, 0x1}}}, 0x24}}, 0x0) 1.359718347s ago: executing program 2 (id=995): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./export_dir\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc_mnt\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/filehandle\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='* ./export_dir 32\n', 0x12) write(0xffffffffffffffff, &(0x7f0000000300)='* ./export_dir 32\n', 0x12) 1.358246647s ago: executing program 3 (id=996): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g_uac2\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g_uac2/idVendor\x00', 0x1, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g_uac2/idProduct\x00', 0x1, 0x0) write(r1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000700), 0x0) close(0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r2, &(0x7f0000000900)='0', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_volume_present\x00', 0x1, 0x0) write(r3, &(0x7f0000000d00)='0\n', 0x2) close(r3) write(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) write(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g_uac2/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g_uac2/configs/c.1/uac2.usb0\x00') write(0xffffffffffffffff, &(0x7f0000001600)='usbip-vudc.0\n', 0xd) 1.26159171s ago: executing program 2 (id=998): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x1123102, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RGETLOCK(r2, &(0x7f0000000040)=ANY=[], 0xffffff6a) splice(r1, 0x0, r0, 0x0, 0x40010003, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x1b) 1.148741422s ago: executing program 3 (id=999): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x2012, r2, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x5000, 0x1}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 850.16972ms ago: executing program 3 (id=1001): futex(&(0x7f000000cffc)=0x4, 0xd, 0x0, 0x0, 0x0, 0x2) 799.116381ms ago: executing program 1 (id=1002): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) rmdir(&(0x7f0000000100)='./config/usb_gadget/g1\x00') 700.461104ms ago: executing program 3 (id=1003): landlock_create_ruleset(&(0x7f0000000000)={0x40, 0x4, 0x2, 0x0, 0xc}, 0x30, 0x1) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x40000095, 0x0, 0xfffffffffffffffd}]}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000000c0)={0xffffffffffffffff, 0xc8, 0x3}) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000000c0)={0xb}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x1fe, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x6, 0x8, 0xf3b8, 0xfffffffffffffffe, 0x1000, 0x400, 0x4002004c4, 0xfffffffffffffffb, 0xfffffffffffffffc, 0x6000000000000000, 0xe, 0x4a0, 0x3, 0x4, 0x4, 0x8], 0x70000, 0x402}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 683.553564ms ago: executing program 1 (id=1004): io_uring_setup(0x364f, &(0x7f0000000000)={0x0, 0x1f8e, 0x800, 0x800000, 0x80}) syz_emit_ethernet(0x16, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffff0000000000008864"], 0x0) 529.022787ms ago: executing program 1 (id=1005): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00', 0x0}) r3 = fsopen(&(0x7f0000000000)='hugetlbfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r5, 0x40305829, &(0x7f0000000240)={0x17c04, 0xffffffffffffffff, 0xbff4, 0x100000002, 0x0, 0x1}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000540)={@private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4400046, r2}) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000540)={@empty, @rand_addr=' \x01\x00', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, r7}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=@ipv6_delroute={0x1c, 0x19, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc8}}, 0x1c}}, 0x0) 452.17861ms ago: executing program 1 (id=1006): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./export_dir\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc_mnt\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/filehandle\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='* ./export_dir 32\n', 0x12) write(0xffffffffffffffff, &(0x7f0000000300)='* ./export_dir 32\n', 0x12) 243.082334ms ago: executing program 1 (id=1007): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g_uac2\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g_uac2/idVendor\x00', 0x1, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g_uac2/idProduct\x00', 0x1, 0x0) write(r1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000700), 0x0) close(0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r2, &(0x7f0000000900)='0', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_volume_present\x00', 0x1, 0x0) write(r3, &(0x7f0000000d00)='0\n', 0x2) close(r3) write(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) write(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g_uac2/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g_uac2/configs/c.1/uac2.usb0\x00') write(0xffffffffffffffff, &(0x7f0000001600)='usbip-vudc.0\n', 0xd) 242.906564ms ago: executing program 3 (id=1008): r0 = io_uring_setup(0x1b56, &(0x7f0000000100)={0x0, 0x1, 0x400, 0x0, 0x2c1}) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) ioctl$VHOST_SET_LOG_BASE(r1, 0x4008af04, &(0x7f0000000080)=&(0x7f0000000040)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000180)={'ipvlan0\x00', &(0x7f0000000140)=@ethtool_link_settings={0x1, 0x10000, 0x3, 0x40, 0x0, 0x5, 0x7, 0xc, 0x30, 0xe, [0x2, 0x1, 0x1ff, 0xec96, 0x5, 0xffffff7f, 0x6, 0x1]}}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r3, 0x6, 0x21, &(0x7f0000000240)="98750f50aade73db0f0100008005f4ea", 0x10) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r3, 0x6, 0x21, &(0x7f0000000000)="439e10b5498d94e3c3750f4f4afdc6b3", 0x10) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000003c0)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB]) read$FUSE(r4, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) close_range(r0, 0xffffffffffffffff, 0x0) 178.151996ms ago: executing program 2 (id=1009): r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xc}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x101, 0x8, 0x2}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000840)=@newtfilter={0x44, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x3}, {}, {0x4, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x18, 0x2, [@TCA_U32_SEL={0x14, 0x5, {0xc, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f}}]}}]}, 0x44}}, 0x24040084) 97.930898ms ago: executing program 1 (id=1010): r0 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x14985, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r0, 0x2) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f0000003000)=@file={0x1, './file0\x00'}, 0x6e) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) recvmsg(r4, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) landlock_restrict_self(r1, 0x1) connect$unix(r2, &(0x7f00000002c0)=@file={0x1, './file0\x00'}, 0x6e) 0s ago: executing program 3 (id=1011): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000180)={0x0, 0x1, 0x12, 0x6, 0x200, &(0x7f0000000880)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309002500000000000f4743f490c585108c1331c7749299a25a705f5096cb268cbc60efd680e1be250700000000000000472471ff550c0010000007f3c7b61abe4162256004ea8ca512b5f379c4eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7f804bb4713019a83353dc519d11c3cc1c22a3b86cf3c645413fcea0ce9ded703699d2bb6a4a663b99b6069da5aaf64785a58847440f064b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200216032811fadcf1e0f49a514df529061e09ce45e3f303a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a250200000000000000d23d324205000000000000000a617f22133b6cb5087f4c6057942ad995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a3cff46591ccaff3075b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8841416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedcbefc5990d7fed29a002ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d559b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756d732533c2722e03002293e37966611602f297de6ff5408777d7a93c45cee3ee5c56e8a3e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f6579ef62866a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c909cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc562507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f80000000000001700000000000000000000000000000000000200"}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.34' (ED25519) to the list of known hosts. [ 336.406125][ T5803] cgroup: Unknown subsys name 'net' [ 336.529720][ T5803] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 338.232183][ T5803] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 340.326668][ T5818] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 340.335909][ T5818] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 340.359700][ T5818] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 340.367951][ T5818] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 340.376237][ T5818] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 340.383702][ T5818] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 340.414061][ T5818] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 340.422543][ T5818] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 340.430518][ T5818] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 340.443248][ T5822] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 340.451097][ T5822] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 340.460030][ T51] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 340.467958][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 340.509716][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 340.521015][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 340.525515][ T5824] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 340.536092][ T5824] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 340.544161][ T5824] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 340.604354][ T5084] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 340.619602][ T5084] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 340.628970][ T5084] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 340.649573][ T5084] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 340.670364][ T5084] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 340.689464][ T5084] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 341.025164][ T5815] chnl_net:caif_netlink_parms(): no params data found [ 341.093423][ T5820] chnl_net:caif_netlink_parms(): no params data found [ 341.161879][ T5819] chnl_net:caif_netlink_parms(): no params data found [ 341.311791][ T5815] bridge0: port 1(bridge_slave_0) entered blocking state [ 341.319837][ T5815] bridge0: port 1(bridge_slave_0) entered disabled state [ 341.327629][ T5815] bridge_slave_0: entered allmulticast mode [ 341.336751][ T5815] bridge_slave_0: entered promiscuous mode [ 341.352070][ T5820] bridge0: port 1(bridge_slave_0) entered blocking state [ 341.359838][ T5820] bridge0: port 1(bridge_slave_0) entered disabled state [ 341.367132][ T5820] bridge_slave_0: entered allmulticast mode [ 341.374373][ T5820] bridge_slave_0: entered promiscuous mode [ 341.383894][ T5820] bridge0: port 2(bridge_slave_1) entered blocking state [ 341.391491][ T5820] bridge0: port 2(bridge_slave_1) entered disabled state [ 341.398699][ T5820] bridge_slave_1: entered allmulticast mode [ 341.406252][ T5820] bridge_slave_1: entered promiscuous mode [ 341.413591][ T5815] bridge0: port 2(bridge_slave_1) entered blocking state [ 341.423430][ T5815] bridge0: port 2(bridge_slave_1) entered disabled state [ 341.430727][ T5815] bridge_slave_1: entered allmulticast mode [ 341.437847][ T5815] bridge_slave_1: entered promiscuous mode [ 341.504931][ T5815] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 341.526557][ T5819] bridge0: port 1(bridge_slave_0) entered blocking state [ 341.533927][ T5819] bridge0: port 1(bridge_slave_0) entered disabled state [ 341.541800][ T5819] bridge_slave_0: entered allmulticast mode [ 341.549014][ T5819] bridge_slave_0: entered promiscuous mode [ 341.557301][ T5826] chnl_net:caif_netlink_parms(): no params data found [ 341.569512][ T5819] bridge0: port 2(bridge_slave_1) entered blocking state [ 341.576698][ T5819] bridge0: port 2(bridge_slave_1) entered disabled state [ 341.584284][ T5819] bridge_slave_1: entered allmulticast mode [ 341.592207][ T5819] bridge_slave_1: entered promiscuous mode [ 341.600847][ T5815] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 341.621903][ T5820] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 341.634094][ T5820] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 341.696013][ T5815] team0: Port device team_slave_0 added [ 341.727595][ T5819] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 341.741792][ T5815] team0: Port device team_slave_1 added [ 341.766076][ T5819] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 341.791679][ T5820] team0: Port device team_slave_0 added [ 341.815983][ T5815] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 341.823448][ T5815] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 341.849505][ T5815] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 341.873780][ T5820] team0: Port device team_slave_1 added [ 341.897274][ T5815] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 341.906723][ T5815] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 341.936063][ T5815] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 342.001277][ T5819] team0: Port device team_slave_0 added [ 342.020426][ T5820] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 342.027431][ T5820] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 342.053687][ T5820] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 342.066682][ T5820] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 342.073744][ T5820] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 342.099754][ T5820] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 342.122432][ T5826] bridge0: port 1(bridge_slave_0) entered blocking state [ 342.129891][ T5826] bridge0: port 1(bridge_slave_0) entered disabled state [ 342.137094][ T5826] bridge_slave_0: entered allmulticast mode [ 342.144772][ T5826] bridge_slave_0: entered promiscuous mode [ 342.155267][ T5819] team0: Port device team_slave_1 added [ 342.198219][ T5826] bridge0: port 2(bridge_slave_1) entered blocking state [ 342.205492][ T5826] bridge0: port 2(bridge_slave_1) entered disabled state [ 342.212852][ T5826] bridge_slave_1: entered allmulticast mode [ 342.220514][ T5826] bridge_slave_1: entered promiscuous mode [ 342.238673][ T5819] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 342.246329][ T5819] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 342.272752][ T5819] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 342.304532][ T5815] hsr_slave_0: entered promiscuous mode [ 342.311323][ T5815] hsr_slave_1: entered promiscuous mode [ 342.331384][ T5819] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 342.338401][ T5819] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 342.364507][ T5819] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 342.399959][ T5820] hsr_slave_0: entered promiscuous mode [ 342.406588][ T5820] hsr_slave_1: entered promiscuous mode [ 342.413058][ T5820] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 342.421023][ T5820] Cannot create hsr debugfs directory [ 342.430551][ T5824] Bluetooth: hci0: command tx timeout [ 342.448098][ T5826] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 342.474730][ T5826] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 342.579421][ T5824] Bluetooth: hci2: command tx timeout [ 342.579444][ T5084] Bluetooth: hci1: command tx timeout [ 342.595609][ T5819] hsr_slave_0: entered promiscuous mode [ 342.602498][ T5819] hsr_slave_1: entered promiscuous mode [ 342.608755][ T5819] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 342.617286][ T5819] Cannot create hsr debugfs directory [ 342.626246][ T5826] team0: Port device team_slave_0 added [ 342.635713][ T5826] team0: Port device team_slave_1 added [ 342.739572][ T5824] Bluetooth: hci3: command tx timeout [ 342.773500][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 342.780679][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 342.806995][ T5826] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 342.841983][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 342.848998][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 342.875427][ T5826] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 343.016457][ T5826] hsr_slave_0: entered promiscuous mode [ 343.023595][ T5826] hsr_slave_1: entered promiscuous mode [ 343.030211][ T5826] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 343.037791][ T5826] Cannot create hsr debugfs directory [ 343.184017][ T5815] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 343.214581][ T5815] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 343.240137][ T5815] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 343.251816][ T5815] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 343.362317][ T5820] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 343.389399][ T5820] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 343.400386][ T5820] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 343.428914][ T5820] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 343.536593][ T5819] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 343.563930][ T5819] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 343.574752][ T5819] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 343.605294][ T5819] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 343.719144][ T5826] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 343.734699][ T5826] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 343.747031][ T5826] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 343.758221][ T5826] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 343.776761][ T5815] 8021q: adding VLAN 0 to HW filter on device bond0 [ 343.791273][ T5820] 8021q: adding VLAN 0 to HW filter on device bond0 [ 343.862589][ T5820] 8021q: adding VLAN 0 to HW filter on device team0 [ 343.876686][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 343.884152][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 343.901926][ T5815] 8021q: adding VLAN 0 to HW filter on device team0 [ 343.938791][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 343.946105][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 343.962111][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 343.969367][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 343.979018][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 343.986265][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 344.055317][ T5819] 8021q: adding VLAN 0 to HW filter on device bond0 [ 344.145134][ T5819] 8021q: adding VLAN 0 to HW filter on device team0 [ 344.177916][ T3444] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.185151][ T3444] bridge0: port 1(bridge_slave_0) entered forwarding state [ 344.208365][ T5826] 8021q: adding VLAN 0 to HW filter on device bond0 [ 344.248702][ T3444] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.255912][ T3444] bridge0: port 2(bridge_slave_1) entered forwarding state [ 344.334351][ T5826] 8021q: adding VLAN 0 to HW filter on device team0 [ 344.406200][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.413520][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 344.474008][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.481290][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 344.509598][ T5824] Bluetooth: hci0: command tx timeout [ 344.598322][ T5826] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 344.624193][ T5826] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 344.663672][ T5824] Bluetooth: hci1: command tx timeout [ 344.669782][ T5084] Bluetooth: hci2: command tx timeout [ 344.726874][ T5820] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 344.820333][ T5824] Bluetooth: hci3: command tx timeout [ 344.892825][ T5820] veth0_vlan: entered promiscuous mode [ 344.923084][ T5815] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 344.965049][ T5820] veth1_vlan: entered promiscuous mode [ 345.086198][ T5820] veth0_macvtap: entered promiscuous mode [ 345.099585][ T5820] veth1_macvtap: entered promiscuous mode [ 345.112278][ T5826] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 345.146224][ T5815] veth0_vlan: entered promiscuous mode [ 345.175716][ T5820] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 345.186008][ T5815] veth1_vlan: entered promiscuous mode [ 345.198727][ T5819] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 345.213547][ T5820] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 345.258338][ T5820] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.267694][ T5820] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.277114][ T5820] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.286679][ T5820] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.318716][ T5826] veth0_vlan: entered promiscuous mode [ 345.363624][ T5815] veth0_macvtap: entered promiscuous mode [ 345.394306][ T5815] veth1_macvtap: entered promiscuous mode [ 345.405977][ T5826] veth1_vlan: entered promiscuous mode [ 345.500261][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 345.508269][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 345.533879][ T5819] veth0_vlan: entered promiscuous mode [ 345.562498][ T5815] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 345.573798][ T5815] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 345.588113][ T5815] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 345.627672][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 345.637577][ T5815] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 345.651603][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 345.659178][ T5815] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 345.670840][ T5815] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 345.691628][ T5819] veth1_vlan: entered promiscuous mode [ 345.711227][ T5815] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.720416][ T5815] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.729115][ T5815] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.737893][ T5815] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.764588][ T5826] veth0_macvtap: entered promiscuous mode [ 345.784700][ T5826] veth1_macvtap: entered promiscuous mode [ 345.924002][ T5826] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 345.935247][ T5826] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 345.955984][ T5826] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 345.971219][ T5826] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 345.984161][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 345.998110][ T5826] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 346.008845][ T5826] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 346.031290][ T5826] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 346.045025][ T5826] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 346.058153][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 346.078935][ T5855] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 346.098959][ T5855] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 346.115614][ T5819] veth0_macvtap: entered promiscuous mode [ 346.136696][ T5819] veth1_macvtap: entered promiscuous mode [ 346.179077][ T5826] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.190904][ T5826] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.205194][ T5826] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.218621][ T5826] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.301614][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 346.313774][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 346.335265][ T5819] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 346.350105][ T5819] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 346.373093][ T5819] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 346.383881][ T5819] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 346.394662][ T5819] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 346.411585][ T5819] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 346.425964][ T5819] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 346.473385][ T5819] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 346.496900][ T5819] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 346.510193][ T5819] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 346.521267][ T5819] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 346.536593][ T5819] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 346.550504][ T5819] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 346.571430][ T5819] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 346.589466][ T5824] Bluetooth: hci0: command tx timeout [ 346.605571][ T5819] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.617662][ T5819] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.631545][ T5819] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.643330][ T5819] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.739581][ T5824] Bluetooth: hci1: command tx timeout [ 346.741424][ T5084] Bluetooth: hci2: command tx timeout [ 346.900135][ T5084] Bluetooth: hci3: command tx timeout [ 346.972021][ T5836] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 347.015243][ T5884] syz.2.3[5884]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 347.023527][ T5836] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 347.193227][ T3444] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 347.209000][ T5855] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 347.234312][ T3444] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 347.249642][ T5855] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 347.420866][ T5836] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 347.461067][ T5836] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 347.730391][ T5886] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 348.026165][ T5884] loop2: detected capacity change from 0 to 32768 [ 350.480110][ T5084] Bluetooth: hci0: command tx timeout [ 350.480149][ T5824] Bluetooth: hci1: command tx timeout [ 350.487602][ T5818] Bluetooth: hci2: command tx timeout [ 350.491805][ T5824] Bluetooth: hci3: command tx timeout [ 350.714134][ T5896] netlink: 'syz.1.5': attribute type 2 has an invalid length. [ 351.696633][ T5909] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 354.322001][ T5912] netlink: 'syz.0.10': attribute type 2 has an invalid length. [ 355.085409][ T5805] usb 3-1: new low-speed USB device number 2 using dummy_hcd [ 355.268734][ T5805] usb 3-1: device descriptor read/64, error -71 [ 355.310045][ T5923] kAFS: No cell specified [ 355.595275][ T5926] syz.1.13 uses obsolete (PF_INET,SOCK_PACKET) [ 355.699691][ T5805] usb 3-1: new low-speed USB device number 3 using dummy_hcd [ 356.017331][ T5805] usb 3-1: device descriptor read/64, error -71 [ 356.240418][ T5805] usb usb3-port1: attempt power cycle [ 356.376927][ T172] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 356.763416][ T172] usb 1-1: config 0 has no interfaces? [ 356.799904][ T5805] usb 3-1: new low-speed USB device number 4 using dummy_hcd [ 356.811645][ T172] usb 1-1: New USB device found, idVendor=a257, idProduct=2013, bcdDevice= 0.01 [ 356.884372][ T5805] usb 3-1: device descriptor read/8, error -71 [ 356.906149][ T172] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 357.142673][ T172] usb 1-1: config 0 descriptor?? [ 357.223135][ T5805] usb 3-1: new low-speed USB device number 5 using dummy_hcd [ 357.263099][ T5805] usb 3-1: device descriptor read/8, error -71 [ 357.413581][ T5805] usb usb3-port1: unable to enumerate USB device [ 358.456575][ T788] usb 1-1: USB disconnect, device number 2 [ 360.457450][ T5945] loop1: detected capacity change from 0 to 32768 [ 360.556895][ T5953] loop0: detected capacity change from 0 to 128 [ 360.729704][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 362.954746][ T5964] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 365.439403][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 368.144202][ T5992] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 372.561123][ T6003] netlink: 'syz.0.34': attribute type 2 has an invalid length. [ 372.911230][ T6009] fuse: Unknown parameter '0x0000000000000003' [ 375.164560][ T6018] netlink: 'syz.2.47': attribute type 2 has an invalid length. [ 377.973107][ T6028] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 377.988860][ T6033] loop2: detected capacity change from 0 to 256 [ 379.024093][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.031102][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.139321][ T6043] loop2: detected capacity change from 0 to 256 [ 380.888856][ T6060] Bluetooth: MGMT ver 1.22 [ 380.960983][ T6061] binder: 6057:6061 ioctl 4018620d 0 returned -22 [ 380.992981][ T6061] netlink: 20 bytes leftover after parsing attributes in process `syz.1.42'. [ 381.002052][ T6061] netlink: 4 bytes leftover after parsing attributes in process `syz.1.42'. [ 381.279923][ T6062] binder: 6058:6062 ioctl 4018620d 0 returned -22 [ 381.315237][ T6062] netlink: 20 bytes leftover after parsing attributes in process `syz.2.48'. [ 381.324337][ T6062] netlink: 4 bytes leftover after parsing attributes in process `syz.2.48'. [ 381.922209][ T6061] syz.1.42 (6061) used greatest stack depth: 20712 bytes left [ 382.202665][ T6067] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 384.919817][ T6071] loop1: detected capacity change from 0 to 256 [ 387.461419][ T6089] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 391.845624][ T6097] loop0: detected capacity change from 0 to 256 [ 391.877614][ T6094] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 397.399736][ T6115] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 400.453447][ T6143] binder: 6139:6143 ioctl 4018620d 0 returned -22 [ 400.468709][ T6143] netlink: 20 bytes leftover after parsing attributes in process `syz.1.68'. [ 400.477691][ T6143] netlink: 4 bytes leftover after parsing attributes in process `syz.1.68'. [ 401.504147][ T6146] loop0: detected capacity change from 0 to 64 [ 401.763616][ T6153] loop1: detected capacity change from 0 to 256 [ 401.816559][ T6146] ======================================================= [ 401.816559][ T6146] WARNING: The mand mount option has been deprecated and [ 401.816559][ T6146] and is ignored by this kernel. Remove the mand [ 401.816559][ T6146] option from the mount to silence this warning. [ 401.816559][ T6146] ======================================================= [ 404.109855][ T6168] netlink: 'syz.0.74': attribute type 2 has an invalid length. [ 405.224482][ T6173] loop3: detected capacity change from 0 to 32768 [ 408.959333][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 411.783938][ T6206] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 414.117302][ T6208] loop2: detected capacity change from 0 to 256 [ 417.453597][ T6229] loop0: detected capacity change from 0 to 32768 [ 417.809165][ C1] sched: RT throttling activated [ 418.769788][ T6237] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 420.923582][ T6243] loop2: detected capacity change from 0 to 256 [ 421.887466][ T6246] loop2: detected capacity change from 0 to 256 [ 423.728466][ T6259] loop2: detected capacity change from 0 to 256 [ 424.771824][ T6264] loop1: detected capacity change from 0 to 2048 [ 424.830284][ T6264] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 425.022690][ T27] audit: type=1800 audit(1788332018.867:2): pid=6264 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.100" name="file1" dev="loop1" ino=1346 res=0 errno=0 [ 425.621476][ T6264] syz.1.100: attempt to access beyond end of device [ 425.621476][ T6264] loop1: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 425.635758][ T6264] Buffer I/O error on dev loop1, logical block 2048, lost async page write [ 425.644695][ T6264] syz.1.100: attempt to access beyond end of device [ 425.644695][ T6264] loop1: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 425.659603][ T6264] Buffer I/O error on dev loop1, logical block 2048, lost async page write [ 425.668307][ T6264] syz.1.100: attempt to access beyond end of device [ 425.668307][ T6264] loop1: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 425.682136][ T6264] Buffer I/O error on dev loop1, logical block 2048, lost async page write [ 425.691021][ T6264] syz.1.100: attempt to access beyond end of device [ 425.691021][ T6264] loop1: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 425.705270][ T6264] Buffer I/O error on dev loop1, logical block 2048, lost async page write [ 425.714016][ T6264] syz.1.100: attempt to access beyond end of device [ 425.714016][ T6264] loop1: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 425.727648][ T6264] Buffer I/O error on dev loop1, logical block 2048, lost async page write [ 425.736399][ T6264] syz.1.100: attempt to access beyond end of device [ 425.736399][ T6264] loop1: rw=2049, sector=2049, nr_sectors = 1 limit=2048 [ 425.749993][ T6264] Buffer I/O error on dev loop1, logical block 2049, lost async page write [ 425.872895][ T6272] loop0: detected capacity change from 0 to 256 [ 426.983185][ T6277] binder: 6275:6277 ioctl 4018620d 0 returned -22 [ 427.006403][ T6277] netlink: 20 bytes leftover after parsing attributes in process `syz.1.105'. [ 428.613621][ T6285] binder: 6281:6285 ioctl 4018620d 0 returned -22 [ 428.630544][ T6285] netlink: 12 bytes leftover after parsing attributes in process `syz.0.107'. [ 430.646262][ T6290] loop2: detected capacity change from 0 to 2048 [ 431.025963][ T6290] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 431.505283][ T27] audit: type=1800 audit(1788332025.247:3): pid=6290 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.110" name="file1" dev="loop2" ino=1346 res=0 errno=0 [ 431.626277][ T6300] binder: 6292:6300 ioctl 4018620d 0 returned -22 [ 431.676674][ T6300] netlink: 12 bytes leftover after parsing attributes in process `syz.1.111'. [ 432.741069][ T6290] syz.2.110: attempt to access beyond end of device [ 432.741069][ T6290] loop2: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 432.754744][ T6290] Buffer I/O error on dev loop2, logical block 2048, lost async page write [ 432.763571][ T6290] syz.2.110: attempt to access beyond end of device [ 432.763571][ T6290] loop2: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 432.777263][ T6290] Buffer I/O error on dev loop2, logical block 2048, lost async page write [ 432.786075][ T6290] syz.2.110: attempt to access beyond end of device [ 432.786075][ T6290] loop2: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 432.799702][ T6290] Buffer I/O error on dev loop2, logical block 2048, lost async page write [ 432.808376][ T6290] syz.2.110: attempt to access beyond end of device [ 432.808376][ T6290] loop2: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 432.822867][ T6290] Buffer I/O error on dev loop2, logical block 2048, lost async page write [ 432.831596][ T6290] syz.2.110: attempt to access beyond end of device [ 432.831596][ T6290] loop2: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 432.845175][ T6290] Buffer I/O error on dev loop2, logical block 2048, lost async page write [ 432.853869][ T6290] syz.2.110: attempt to access beyond end of device [ 432.853869][ T6290] loop2: rw=2049, sector=2049, nr_sectors = 1 limit=2048 [ 432.867412][ T6290] Buffer I/O error on dev loop2, logical block 2049, lost async page write [ 433.094855][ T6303] loop1: detected capacity change from 0 to 256 [ 434.210640][ T6317] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 436.130333][ T6335] loop1: detected capacity change from 0 to 32768 [ 436.236271][ T6349] loop3: detected capacity change from 0 to 2048 [ 436.720461][ T6349] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 436.869093][ T27] audit: type=1800 audit(1788332030.707:4): pid=6349 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.124" name="file1" dev="loop3" ino=1346 res=0 errno=0 [ 437.755069][ T6340] loop0: detected capacity change from 0 to 32768 [ 440.159438][ T6362] binder: 6359:6362 ioctl 4018620d 0 returned -22 [ 440.184269][ T6362] netlink: 12 bytes leftover after parsing attributes in process `syz.1.126'. [ 440.254864][ T6361] read_mapping_page failed! [ 440.549625][ T6361] ialloc: diAlloc returned -5! [ 440.600069][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.608207][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.803324][ T6367] loop3: detected capacity change from 0 to 256 [ 443.102085][ T6382] loop3: detected capacity change from 0 to 32768 [ 447.209843][ T6422] netlink: 'syz.2.141': attribute type 2 has an invalid length. [ 449.663427][ T6440] loop0: detected capacity change from 0 to 256 [ 451.787056][ T6445] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 452.008340][ T6438] loop1: detected capacity change from 0 to 40427 [ 452.363814][ T6438] F2FS-fs (loop1): Found nat_bits in checkpoint [ 453.423660][ T6465] binder: 6463:6465 ioctl 4018620d 0 returned -22 [ 453.454775][ T6465] netlink: 12 bytes leftover after parsing attributes in process `syz.3.150'. [ 454.208388][ T6469] loop3: detected capacity change from 0 to 64 [ 454.324028][ T6467] netlink: 'syz.0.151': attribute type 2 has an invalid length. [ 454.656560][ T6477] loop3: detected capacity change from 0 to 256 [ 458.579684][ T6494] binder: 6489:6494 ioctl 4018620d 0 returned -22 [ 458.597890][ T6494] netlink: 16 bytes leftover after parsing attributes in process `syz.2.157'. [ 460.768209][ T6508] loop3: detected capacity change from 0 to 64 [ 460.786684][ T6506] loop2: detected capacity change from 0 to 2048 [ 460.885717][ T6511] loop1: detected capacity change from 0 to 256 [ 462.243485][ T6506] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 462.981835][ T6512] Bluetooth: hci0: command 0x0406 tx timeout [ 462.987989][ T6512] Bluetooth: hci2: command 0x0406 tx timeout [ 462.994537][ T6512] Bluetooth: hci3: command 0x0406 tx timeout [ 463.004286][ T6512] Bluetooth: hci1: command 0x0406 tx timeout [ 463.394873][ T27] audit: type=1800 audit(1788332057.237:5): pid=6506 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.164" name="file1" dev="loop2" ino=1346 res=0 errno=0 [ 463.470391][ T27] audit: type=1800 audit(1788332057.247:6): pid=6506 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.164" name="file1" dev="loop2" ino=1346 res=0 errno=0 [ 463.657595][ T6517] loop3: detected capacity change from 0 to 64 [ 465.808315][ T6534] loop0: detected capacity change from 0 to 256 [ 467.196018][ T6528] loop1: detected capacity change from 0 to 32768 [ 467.781923][ T6543] loop0: detected capacity change from 0 to 2048 [ 467.904802][ T6543] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 468.082893][ T27] audit: type=1800 audit(1788332061.907:7): pid=6543 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.176" name="file1" dev="loop0" ino=1346 res=0 errno=0 [ 468.108709][ T6536] loop2: detected capacity change from 0 to 40427 [ 468.158578][ T27] audit: type=1800 audit(1788332061.917:8): pid=6543 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.176" name="file1" dev="loop0" ino=1346 res=0 errno=0 [ 468.239660][ T6536] F2FS-fs (loop2): Found nat_bits in checkpoint [ 468.603909][ T6536] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 468.893001][ T6556] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 469.114200][ T6556] syz.2.173: attempt to access beyond end of device [ 469.114200][ T6556] loop2: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 469.532873][ T5815] syz-executor: attempt to access beyond end of device [ 469.532873][ T5815] loop2: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 469.585973][ T6558] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 469.661785][ T5815] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 469.688901][ T5815] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 470.395529][ T6563] loop2: detected capacity change from 0 to 64 [ 473.206249][ T6574] loop0: detected capacity change from 0 to 32768 [ 474.205860][ T6590] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 475.537820][ T6602] loop2: detected capacity change from 0 to 32768 [ 478.257826][ T6605] loop1: detected capacity change from 0 to 32768 [ 478.328149][ T6605] read_mapping_page failed! [ 478.377807][ T6605] jfs_mount: Failed to read AGGREGATE_I [ 478.445569][ T6605] Mount JFS Failure: -5 [ 478.483128][ T6605] jfs_mount failed w/return code = -5 [ 479.308446][ T6642] loop1: detected capacity change from 0 to 128 [ 480.120127][ T6637] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 483.441297][ T6647] loop1: detected capacity change from 0 to 32768 [ 484.366960][ T6649] loop2: detected capacity change from 0 to 32768 [ 488.963343][ T6664] loop1: detected capacity change from 0 to 32768 [ 491.409552][ T6677] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 493.849164][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 497.385369][ T6707] loop1: detected capacity change from 0 to 40427 [ 497.465747][ T6707] F2FS-fs (loop1): Found nat_bits in checkpoint [ 497.501673][ T6720] loop2: detected capacity change from 0 to 256 [ 497.619509][ T6709] loop3: detected capacity change from 0 to 32768 [ 497.679836][ T6707] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 498.251716][ T6727] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 498.417870][ T6727] syz.1.217: attempt to access beyond end of device [ 498.417870][ T6727] loop1: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 499.052198][ T5819] syz-executor: attempt to access beyond end of device [ 499.052198][ T5819] loop1: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 499.203488][ T5819] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 499.271755][ T5819] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 501.863099][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.879227][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.685083][ T6746] loop1: detected capacity change from 0 to 64 [ 504.461959][ T6753] kAFS: No cell specified [ 506.239223][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 506.606364][ T6761] loop1: detected capacity change from 0 to 128 [ 509.183589][ T6771] loop2: detected capacity change from 0 to 32768 [ 511.359194][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 513.074554][ T6800] kAFS: No cell specified [ 514.329692][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 514.739342][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 516.829521][ T6811] loop2: detected capacity change from 0 to 128 [ 517.413671][ T6817] loop2: detected capacity change from 0 to 256 [ 518.785035][ T6822] loop2: detected capacity change from 0 to 64 [ 519.063129][ T6808] loop0: detected capacity change from 0 to 32768 [ 519.096931][ T6815] loop3: detected capacity change from 0 to 32768 [ 525.449071][ T6844] loop2: detected capacity change from 0 to 128 [ 526.268159][ T6859] Zero length message leads to an empty skb [ 527.128035][ T6851] loop3: detected capacity change from 0 to 40427 [ 527.273983][ T6851] F2FS-fs (loop3): Found nat_bits in checkpoint [ 527.676190][ T6851] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 527.988843][ T6871] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 528.145767][ T6871] syz.3.265: attempt to access beyond end of device [ 528.145767][ T6871] loop3: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 528.600897][ T5826] syz-executor: attempt to access beyond end of device [ 528.600897][ T5826] loop3: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 528.797608][ T5826] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 528.878795][ T5826] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 530.778608][ T6890] kAFS: No cell specified [ 534.439355][ T6905] loop3: detected capacity change from 0 to 256 [ 535.566150][ T6909] kAFS: No cell specified [ 539.762990][ T6940] kAFS: No cell specified [ 541.023422][ T6942] loop2: detected capacity change from 0 to 128 [ 544.113505][ T6944] loop3: detected capacity change from 0 to 256 [ 545.049740][ T0] NOHZ tick-stop error: local softirq work is pending, handler #242!!! [ 545.198264][ T6946] loop2: detected capacity change from 0 to 128 [ 545.508359][ T6950] loop3: detected capacity change from 0 to 128 [ 546.351024][ T6952] loop2: detected capacity change from 0 to 256 [ 546.507757][ T6957] kAFS: No cell specified [ 550.924783][ T6978] kAFS: No cell specified [ 553.613238][ T6981] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 553.675583][ T6984] loop3: detected capacity change from 0 to 128 [ 554.433605][ T6992] loop1: detected capacity change from 0 to 256 [ 555.699295][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 557.945987][ T7005] loop1: detected capacity change from 0 to 256 [ 561.323277][ T7016] loop0: detected capacity change from 0 to 128 [ 562.019471][ T7008] loop2: detected capacity change from 0 to 32768 [ 562.848543][ T7010] loop1: detected capacity change from 0 to 32768 [ 563.319776][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.326155][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.957280][ T7032] loop3: detected capacity change from 0 to 128 [ 564.955615][ T7021] loop0: detected capacity change from 0 to 32768 [ 565.179957][ T7035] kAFS: No cell specified [ 568.433145][ T7047] loop3: detected capacity change from 0 to 256 [ 570.389334][ T5882] usb 3-1: new low-speed USB device number 6 using dummy_hcd [ 570.739349][ T5882] usb 3-1: device descriptor read/64, error -71 [ 570.810604][ T7055] loop3: detected capacity change from 0 to 128 [ 571.549202][ T5882] usb 3-1: new low-speed USB device number 7 using dummy_hcd [ 572.975808][ T7068] kAFS: No cell specified [ 580.701545][ T7097] loop0: detected capacity change from 0 to 256 [ 581.339579][ T7106] kAFS: No cell specified [ 584.356953][ T7108] loop0: detected capacity change from 0 to 40427 [ 584.447301][ T7108] F2FS-fs (loop0): Found nat_bits in checkpoint [ 584.561052][ T7110] loop1: detected capacity change from 0 to 2048 [ 584.645228][ T7110] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 584.658834][ T7108] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 584.758791][ T27] audit: type=1800 audit(1788332178.597:9): pid=7110 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.339" name="file1" dev="loop1" ino=1346 res=0 errno=0 [ 584.835220][ T7117] loop2: detected capacity change from 0 to 256 [ 584.859369][ T27] audit: type=1800 audit(1788332178.627:10): pid=7110 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.339" name="file1" dev="loop1" ino=1346 res=0 errno=0 [ 585.851040][ T7122] kAFS: No cell specified [ 586.725100][ T7130] kAFS: No cell specified [ 589.204907][ T7138] loop3: detected capacity change from 0 to 256 [ 589.771907][ T7140] loop3: detected capacity change from 0 to 32768 [ 591.992330][ T7149] kAFS: No cell specified [ 592.328847][ T7153] netlink: 36 bytes leftover after parsing attributes in process `syz.0.347'. [ 593.578343][ T7155] loop0: detected capacity change from 0 to 256 [ 595.820411][ T7170] loop3: detected capacity change from 0 to 2048 [ 595.973043][ T7170] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 596.215100][ T27] audit: type=1800 audit(1788332190.057:11): pid=7170 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.354" name="file1" dev="loop3" ino=1346 res=0 errno=0 [ 596.309341][ T27] audit: type=1800 audit(1788332190.077:12): pid=7170 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.354" name="file1" dev="loop3" ino=1346 res=0 errno=0 [ 596.993382][ T7173] loop2: detected capacity change from 0 to 32768 [ 598.645300][ T7184] loop3: detected capacity change from 0 to 2048 [ 598.715655][ T7184] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 598.799311][ T27] audit: type=1800 audit(1788332192.637:13): pid=7184 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.359" name="file1" dev="loop3" ino=1346 res=0 errno=0 [ 598.870406][ T27] audit: type=1800 audit(1788332192.677:14): pid=7184 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.359" name="file1" dev="loop3" ino=1346 res=0 errno=0 [ 598.902095][ T7186] loop1: detected capacity change from 0 to 256 [ 599.343898][ T7182] loop0: detected capacity change from 0 to 40427 [ 599.406752][ T7182] F2FS-fs (loop0): Found nat_bits in checkpoint [ 599.578955][ T7182] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 599.830745][ T7198] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 600.007720][ T7198] syz.0.357: attempt to access beyond end of device [ 600.007720][ T7198] loop0: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 600.320044][ T5820] syz-executor: attempt to access beyond end of device [ 600.320044][ T5820] loop0: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 600.358009][ T5820] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 600.439723][ T5820] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 600.709886][ T7192] loop1: detected capacity change from 0 to 32768 [ 603.460814][ T7222] loop0: detected capacity change from 0 to 32768 [ 604.765394][ T7224] loop1: detected capacity change from 0 to 32768 [ 607.921377][ T7257] loop3: detected capacity change from 0 to 2048 [ 607.977180][ T7257] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 608.712201][ T27] audit: type=1800 audit(1788332202.547:15): pid=7257 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.374" name="file1" dev="loop3" ino=1346 res=0 errno=0 [ 608.949608][ T27] audit: type=1800 audit(1788332202.787:16): pid=7257 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.374" name="file1" dev="loop3" ino=1346 res=0 errno=0 [ 610.893817][ T7265] loop1: detected capacity change from 0 to 32768 [ 611.563159][ T7285] loop0: detected capacity change from 0 to 256 [ 613.066173][ T7299] loop2: detected capacity change from 0 to 128 [ 617.515414][ T7311] EXT4-fs warning (device sda1): verify_group_input:151: Cannot add at group 0 (only 8 groups) [ 618.444753][ T7325] netlink: 36 bytes leftover after parsing attributes in process `syz.1.385'. [ 619.065163][ T7332] loop1: detected capacity change from 0 to 128 [ 620.220338][ T7338] loop2: detected capacity change from 0 to 128 [ 624.744092][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.750685][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 626.034346][ T7381] netlink: 36 bytes leftover after parsing attributes in process `syz.1.404'. [ 626.680080][ T7355] loop3: detected capacity change from 0 to 40427 [ 626.833982][ T7355] F2FS-fs (loop3): Found nat_bits in checkpoint [ 627.089302][ T7355] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 627.742969][ T7396] EXT4-fs warning (device sda1): verify_group_input:151: Cannot add at group 0 (only 8 groups) [ 634.168269][ T7421] loop0: detected capacity change from 0 to 40427 [ 634.208638][ T7438] loop3: detected capacity change from 0 to 512 [ 634.265994][ T7438] EXT4-fs (loop3): Test dummy encryption mode enabled [ 634.289121][ T7421] F2FS-fs (loop0): Found nat_bits in checkpoint [ 634.349193][ T7438] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 634.412083][ T7438] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 634.773744][ T7421] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 634.848837][ T7438] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2858: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 635.131720][ T7438] EXT4-fs (loop3): 1 truncate cleaned up [ 635.347934][ T7438] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 639.689776][ T5826] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 642.067508][ T7475] loop1: detected capacity change from 0 to 128 [ 644.458170][ T7481] kAFS: No cell specified [ 646.796448][ T7487] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 650.077572][ T7505] loop0: detected capacity change from 0 to 512 [ 651.962880][ T7505] EXT4-fs (loop0): Test dummy encryption mode enabled [ 651.999188][ T7505] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 652.281154][ T7505] EXT4-fs (loop0): 1 truncate cleaned up [ 652.374225][ T7505] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 653.163589][ T7517] loop3: detected capacity change from 0 to 2048 [ 653.176352][ T7517] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 653.301643][ T27] audit: type=1800 audit(1788332247.117:17): pid=7517 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.436" name="file1" dev="loop3" ino=1346 res=0 errno=0 [ 653.419742][ T27] audit: type=1800 audit(1788332247.117:18): pid=7517 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.436" name="file1" dev="loop3" ino=1346 res=0 errno=0 [ 653.611027][ T5820] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 653.778362][ T7523] loop0: detected capacity change from 0 to 256 [ 657.259309][ T5882] usb 3-1: new low-speed USB device number 8 using dummy_hcd [ 657.419263][ T5882] usb 3-1: device descriptor read/64, error -71 [ 657.689240][ T5882] usb 3-1: new low-speed USB device number 9 using dummy_hcd [ 657.737393][ T7534] kAFS: No cell specified [ 664.836012][ T7557] kAFS: bad VL server IP address [ 665.591308][ T7557] kAFS: No cell specified [ 667.608129][ T7563] loop2: detected capacity change from 0 to 256 [ 673.463040][ T7582] loop2: detected capacity change from 0 to 32768 [ 675.873671][ T7595] loop1: detected capacity change from 0 to 512 [ 675.932158][ T7595] EXT4-fs (loop1): Test dummy encryption mode enabled [ 675.972565][ T7595] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 676.016104][ T7598] loop0: detected capacity change from 0 to 256 [ 676.074935][ T7595] EXT4-fs (loop1): 1 truncate cleaned up [ 676.111285][ T7595] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 678.806881][ T5819] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 682.690003][ T7641] kAFS: bad VL server IP address [ 682.735157][ T7641] kAFS: No cell specified [ 685.004912][ T7645] netlink: 'syz.0.469': attribute type 2 has an invalid length. [ 685.053017][ T7648] loop1: detected capacity change from 0 to 2048 [ 685.066723][ T7648] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 685.133327][ T27] audit: type=1800 audit(1788332278.977:19): pid=7648 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.470" name="file1" dev="loop1" ino=1346 res=0 errno=0 [ 685.550468][ T7648] syz.1.470: attempt to access beyond end of device [ 685.550468][ T7648] loop1: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 685.564097][ T7648] Buffer I/O error on dev loop1, logical block 2048, lost async page write [ 685.572929][ T7648] syz.1.470: attempt to access beyond end of device [ 685.572929][ T7648] loop1: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 685.586513][ T7648] Buffer I/O error on dev loop1, logical block 2048, lost async page write [ 685.595251][ T7648] syz.1.470: attempt to access beyond end of device [ 685.595251][ T7648] loop1: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 685.608768][ T7648] Buffer I/O error on dev loop1, logical block 2048, lost async page write [ 685.617500][ T7648] syz.1.470: attempt to access beyond end of device [ 685.617500][ T7648] loop1: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 685.631075][ T7648] Buffer I/O error on dev loop1, logical block 2048, lost async page write [ 685.639748][ T7648] syz.1.470: attempt to access beyond end of device [ 685.639748][ T7648] loop1: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 685.654185][ T7648] Buffer I/O error on dev loop1, logical block 2048, lost async page write [ 685.662854][ T7648] syz.1.470: attempt to access beyond end of device [ 685.662854][ T7648] loop1: rw=2049, sector=2049, nr_sectors = 1 limit=2048 [ 685.676381][ T7648] Buffer I/O error on dev loop1, logical block 2049, lost async page write [ 685.843799][ T7653] loop2: detected capacity change from 0 to 256 [ 686.188841][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.195902][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 692.902545][ T7688] FAULT_INJECTION: forcing a failure. [ 692.902545][ T7688] name failslab, interval 1, probability 0, space 0, times 1 [ 692.956970][ T7688] CPU: 0 PID: 7688 Comm: syz.1.482 Not tainted syzkaller #0 [ 692.964363][ T7688] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 692.974491][ T7688] Call Trace: [ 692.977816][ T7688] [ 692.980788][ T7688] dump_stack_lvl+0x18c/0x250 [ 692.985603][ T7688] ? show_regs_print_info+0x20/0x20 [ 692.990863][ T7688] ? load_image+0x420/0x420 [ 692.995444][ T7688] ? __might_sleep+0xe0/0xe0 [ 693.000088][ T7688] ? __lock_acquire+0x7d80/0x7d80 [ 693.005165][ T7688] should_fail_ex+0x394/0x4c0 [ 693.009929][ T7688] should_failslab+0x9/0x20 [ 693.014487][ T7688] slab_pre_alloc_hook+0x59/0x300 [ 693.019580][ T7688] ? __rwlock_init+0x150/0x150 [ 693.024396][ T7688] kmem_cache_alloc_lru+0x4d/0x2b0 [ 693.029544][ T7688] ? iget_locked+0x205/0x8c0 [ 693.034197][ T7688] iget_locked+0x205/0x8c0 [ 693.038667][ T7688] kernfs_get_inode+0x4f/0x6e0 [ 693.043485][ T7688] kernfs_iop_lookup+0x263/0x380 [ 693.048466][ T7688] ? kernfs_dop_revalidate+0x570/0x570 [ 693.053963][ T7688] path_openat+0x1110/0x3270 [ 693.058605][ T7688] ? do_filp_open+0x430/0x430 [ 693.063327][ T7688] do_filp_open+0x1f2/0x430 [ 693.067920][ T7688] ? vfs_tmpfile+0x620/0x620 [ 693.072567][ T7688] ? _raw_spin_unlock+0x28/0x40 [ 693.077549][ T7688] ? alloc_fd+0x590/0x640 [ 693.081938][ T7688] do_sys_openat2+0x134/0x1d0 [ 693.086685][ T7688] ? init_peercred+0x263/0x2c0 [ 693.091558][ T7688] ? do_sys_open+0xe0/0xe0 [ 693.096012][ T7688] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 693.102035][ T7688] ? lock_chain_count+0x20/0x20 [ 693.106919][ T7688] ? lock_chain_count+0x20/0x20 [ 693.111795][ T7688] __x64_sys_openat+0x139/0x160 [ 693.116687][ T7688] do_syscall_64+0x55/0xb0 [ 693.121138][ T7688] ? clear_bhb_loop+0x40/0x90 [ 693.125955][ T7688] ? clear_bhb_loop+0x40/0x90 [ 693.130668][ T7688] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 693.136609][ T7688] RIP: 0033:0x7f5e0a55e98e [ 693.141057][ T7688] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 693.160689][ T7688] RSP: 002b:00007f5e0b5129b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 693.169138][ T7688] RAX: ffffffffffffffda RBX: 00007f5e0b5136c0 RCX: 00007f5e0a55e98e [ 693.177146][ T7688] RDX: 0000000000080001 RSI: 00007f5e0a609070 RDI: ffffffffffffff9c [ 693.185157][ T7688] RBP: 00007f5e0a609070 R08: 0000000000000000 R09: 0000000000000000 [ 693.193173][ T7688] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 693.201191][ T7688] R13: 00007f5e0b512a90 R14: 00007f5e0a825fa0 R15: 00007ffe5a89f0d8 [ 693.209215][ T7688] [ 693.538127][ T7692] loop0: detected capacity change from 0 to 256 [ 695.248168][ T7686] loop2: detected capacity change from 0 to 32768 [ 697.538859][ T7718] FAULT_INJECTION: forcing a failure. [ 697.538859][ T7718] name failslab, interval 1, probability 0, space 0, times 0 [ 697.604451][ T7718] CPU: 1 PID: 7718 Comm: syz.2.493 Not tainted syzkaller #0 [ 697.611836][ T7718] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 697.621934][ T7718] Call Trace: [ 697.625287][ T7718] [ 697.628251][ T7718] dump_stack_lvl+0x18c/0x250 [ 697.632950][ T7718] ? show_regs_print_info+0x20/0x20 [ 697.638182][ T7718] ? load_image+0x420/0x420 [ 697.642711][ T7718] ? __might_sleep+0xe0/0xe0 [ 697.647340][ T7718] ? __lock_acquire+0x7d80/0x7d80 [ 697.652421][ T7718] should_fail_ex+0x394/0x4c0 [ 697.657159][ T7718] should_failslab+0x9/0x20 [ 697.661723][ T7718] slab_pre_alloc_hook+0x59/0x300 [ 697.666813][ T7718] ? memcg_list_lru_alloc+0x335/0xb00 [ 697.672265][ T7718] ? memcg_list_lru_alloc+0x335/0xb00 [ 697.677695][ T7718] __kmem_cache_alloc_node+0x53/0x250 [ 697.683120][ T7718] ? memcg_list_lru_alloc+0x335/0xb00 [ 697.688523][ T7718] __kmalloc+0xa7/0x240 [ 697.692712][ T7718] memcg_list_lru_alloc+0x335/0xb00 [ 697.697934][ T7718] ? memcg_reparent_list_lrus+0x860/0x860 [ 697.703681][ T7718] ? get_obj_cgroup_from_current+0xd4/0x280 [ 697.709599][ T7718] ? get_obj_cgroup_from_current+0xd4/0x280 [ 697.715528][ T7718] slab_pre_alloc_hook+0x2ad/0x300 [ 697.720665][ T7718] ? slab_pre_alloc_hook+0xb1/0x300 [ 697.725890][ T7718] kmem_cache_alloc_lru+0x4d/0x2b0 [ 697.731028][ T7718] ? iget_locked+0x205/0x8c0 [ 697.735669][ T7718] iget_locked+0x205/0x8c0 [ 697.740112][ T7718] kernfs_get_inode+0x4f/0x6e0 [ 697.744906][ T7718] kernfs_iop_lookup+0x263/0x380 [ 697.749889][ T7718] ? kernfs_dop_revalidate+0x570/0x570 [ 697.755374][ T7718] path_openat+0x1110/0x3270 [ 697.760024][ T7718] ? do_filp_open+0x430/0x430 [ 697.764733][ T7718] do_filp_open+0x1f2/0x430 [ 697.769269][ T7718] ? vfs_tmpfile+0x620/0x620 [ 697.773908][ T7718] ? _raw_spin_unlock+0x28/0x40 [ 697.778770][ T7718] ? alloc_fd+0x590/0x640 [ 697.783147][ T7718] do_sys_openat2+0x134/0x1d0 [ 697.787850][ T7718] ? init_peercred+0x263/0x2c0 [ 697.792637][ T7718] ? do_sys_open+0xe0/0xe0 [ 697.797067][ T7718] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 697.803066][ T7718] ? lock_chain_count+0x20/0x20 [ 697.807934][ T7718] ? lock_chain_count+0x20/0x20 [ 697.812802][ T7718] __x64_sys_openat+0x139/0x160 [ 697.817676][ T7718] do_syscall_64+0x55/0xb0 [ 697.822122][ T7718] ? clear_bhb_loop+0x40/0x90 [ 697.826828][ T7718] ? clear_bhb_loop+0x40/0x90 [ 697.831536][ T7718] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 697.837490][ T7718] RIP: 0033:0x7fba5a75e98e [ 697.841960][ T7718] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 697.861597][ T7718] RSP: 002b:00007fba5b5a19b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 697.870031][ T7718] RAX: ffffffffffffffda RBX: 00007fba5b5a26c0 RCX: 00007fba5a75e98e [ 697.878035][ T7718] RDX: 0000000000080001 RSI: 00007fba5a809070 RDI: ffffffffffffff9c [ 697.886041][ T7718] RBP: 00007fba5a809070 R08: 0000000000000000 R09: 0000000000000000 [ 697.894082][ T7718] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 697.902099][ T7718] R13: 00007fba5b5a1a90 R14: 00007fba5aa25fa0 R15: 00007fff9ed02938 [ 697.910145][ T7718] [ 697.913280][ C1] vkms_vblank_simulate: vblank timer overrun [ 698.058187][ T7722] loop3: detected capacity change from 0 to 2048 [ 698.107292][ T7722] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 698.278642][ T27] audit: type=1800 audit(1788332292.117:20): pid=7722 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.494" name="file1" dev="loop3" ino=1346 res=0 errno=0 [ 698.318146][ T27] audit: type=1800 audit(1788332292.157:21): pid=7722 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.494" name="file1" dev="loop3" ino=1346 res=0 errno=0 [ 698.653977][ T7722] syz.3.494: attempt to access beyond end of device [ 698.653977][ T7722] loop3: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 698.667820][ T7722] Buffer I/O error on dev loop3, logical block 2048, lost async page write [ 698.676515][ T7722] syz.3.494: attempt to access beyond end of device [ 698.676515][ T7722] loop3: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 698.690043][ T7722] Buffer I/O error on dev loop3, logical block 2048, lost async page write [ 698.698751][ T7722] syz.3.494: attempt to access beyond end of device [ 698.698751][ T7722] loop3: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 698.712323][ T7722] Buffer I/O error on dev loop3, logical block 2048, lost async page write [ 698.720986][ T7722] syz.3.494: attempt to access beyond end of device [ 698.720986][ T7722] loop3: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 698.734516][ T7722] Buffer I/O error on dev loop3, logical block 2048, lost async page write [ 698.743189][ T7722] syz.3.494: attempt to access beyond end of device [ 698.743189][ T7722] loop3: rw=2049, sector=2048, nr_sectors = 1 limit=2048 [ 698.757041][ T7722] Buffer I/O error on dev loop3, logical block 2048, lost async page write [ 698.765815][ T7722] syz.3.494: attempt to access beyond end of device [ 698.765815][ T7722] loop3: rw=2049, sector=2049, nr_sectors = 1 limit=2048 [ 698.779333][ T7722] Buffer I/O error on dev loop3, logical block 2049, lost async page write [ 703.281020][ T7751] FAULT_INJECTION: forcing a failure. [ 703.281020][ T7751] name failslab, interval 1, probability 0, space 0, times 0 [ 703.319257][ T7751] CPU: 1 PID: 7751 Comm: syz.0.502 Not tainted syzkaller #0 [ 703.326652][ T7751] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 703.336764][ T7751] Call Trace: [ 703.340094][ T7751] [ 703.343066][ T7751] dump_stack_lvl+0x18c/0x250 [ 703.347882][ T7751] ? show_regs_print_info+0x20/0x20 [ 703.353150][ T7751] ? load_image+0x420/0x420 [ 703.357708][ T7751] ? __might_sleep+0xe0/0xe0 [ 703.362355][ T7751] ? __lock_acquire+0x7d80/0x7d80 [ 703.367436][ T7751] should_fail_ex+0x394/0x4c0 [ 703.372174][ T7751] should_failslab+0x9/0x20 [ 703.376746][ T7751] slab_pre_alloc_hook+0x59/0x300 [ 703.381856][ T7751] ? memcg_list_lru_alloc+0x335/0xb00 [ 703.387287][ T7751] ? memcg_list_lru_alloc+0x335/0xb00 [ 703.392725][ T7751] __kmem_cache_alloc_node+0x53/0x250 [ 703.398167][ T7751] ? memcg_list_lru_alloc+0x335/0xb00 [ 703.403603][ T7751] __kmalloc+0xa7/0x240 [ 703.407844][ T7751] memcg_list_lru_alloc+0x335/0xb00 [ 703.413136][ T7751] ? memcg_reparent_list_lrus+0x860/0x860 [ 703.418923][ T7751] ? get_obj_cgroup_from_current+0xd4/0x280 [ 703.424922][ T7751] ? get_obj_cgroup_from_current+0xd4/0x280 [ 703.430888][ T7751] slab_pre_alloc_hook+0x2ad/0x300 [ 703.436069][ T7751] ? slab_pre_alloc_hook+0xb1/0x300 [ 703.441369][ T7751] kmem_cache_alloc_lru+0x4d/0x2b0 [ 703.446527][ T7751] ? __d_alloc+0x31/0x710 [ 703.450893][ T7751] __d_alloc+0x31/0x710 [ 703.455082][ T7751] d_alloc_parallel+0xe0/0x1590 [ 703.459962][ T7751] ? __d_lookup+0x8f/0x7c0 [ 703.464422][ T7751] ? __lock_acquire+0x7d80/0x7d80 [ 703.469501][ T7751] ? __d_lookup+0x8f/0x7c0 [ 703.473960][ T7751] ? d_hash_and_lookup+0x1b0/0x1b0 [ 703.479115][ T7751] path_openat+0x955/0x3270 [ 703.483682][ T7751] ? do_filp_open+0x430/0x430 [ 703.488405][ T7751] do_filp_open+0x1f2/0x430 [ 703.492948][ T7751] ? vfs_tmpfile+0x620/0x620 [ 703.497623][ T7751] ? _raw_spin_unlock+0x28/0x40 [ 703.502505][ T7751] ? alloc_fd+0x590/0x640 [ 703.506876][ T7751] do_sys_openat2+0x134/0x1d0 [ 703.511589][ T7751] ? init_peercred+0x263/0x2c0 [ 703.516380][ T7751] ? do_sys_open+0xe0/0xe0 [ 703.520825][ T7751] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 703.526835][ T7751] ? lock_chain_count+0x20/0x20 [ 703.531716][ T7751] ? lock_chain_count+0x20/0x20 [ 703.536598][ T7751] __x64_sys_openat+0x139/0x160 [ 703.541490][ T7751] do_syscall_64+0x55/0xb0 [ 703.545941][ T7751] ? clear_bhb_loop+0x40/0x90 [ 703.550654][ T7751] ? clear_bhb_loop+0x40/0x90 [ 703.555370][ T7751] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 703.561311][ T7751] RIP: 0033:0x7fdf2f15e98e [ 703.565760][ T7751] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 703.585409][ T7751] RSP: 002b:00007fdf301399b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 703.593860][ T7751] RAX: ffffffffffffffda RBX: 00007fdf3013a6c0 RCX: 00007fdf2f15e98e [ 703.601857][ T7751] RDX: 0000000000080001 RSI: 00007fdf2f209070 RDI: ffffffffffffff9c [ 703.609853][ T7751] RBP: 00007fdf2f209070 R08: 0000000000000000 R09: 0000000000000000 [ 703.617853][ T7751] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 703.625846][ T7751] R13: 00007fdf30139a90 R14: 00007fdf2f425fa0 R15: 00007fff080dabe8 [ 703.633854][ T7751] [ 704.038348][ T7739] loop1: detected capacity change from 0 to 40427 [ 704.042619][ T7746] loop2: detected capacity change from 0 to 32768 [ 704.062473][ T7739] F2FS-fs (loop1): Found nat_bits in checkpoint [ 704.293937][ T7750] netlink: 36 bytes leftover after parsing attributes in process `syz.3.503'. [ 704.305586][ T7739] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 704.741841][ T7760] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 704.899744][ T7760] syz.1.499: attempt to access beyond end of device [ 704.899744][ T7760] loop1: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 705.342070][ T5819] syz-executor: attempt to access beyond end of device [ 705.342070][ T5819] loop1: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 705.408144][ T5819] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 705.419198][ T5819] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 706.147966][ T7764] loop0: detected capacity change from 0 to 40427 [ 706.231713][ T7768] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 706.238585][ T7768] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 706.249596][ T7764] F2FS-fs (loop0): Found nat_bits in checkpoint [ 706.295730][ T7768] vhci_hcd vhci_hcd.0: Device attached [ 706.320957][ T7772] vhci_hcd: connection closed [ 706.325043][ T6729] vhci_hcd: stop threads [ 706.341366][ T6729] vhci_hcd: release socket [ 706.357280][ T6729] vhci_hcd: disconnect device [ 706.381923][ T7764] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 706.404733][ T7770] netlink: 'syz.1.505': attribute type 2 has an invalid length. [ 706.599514][ T7778] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 706.774151][ T7778] syz.0.504: attempt to access beyond end of device [ 706.774151][ T7778] loop0: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 707.183660][ T5820] syz-executor: attempt to access beyond end of device [ 707.183660][ T5820] loop0: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 707.226490][ T5820] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 707.234406][ T5820] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 708.258086][ T7793] loop2: detected capacity change from 0 to 256 [ 711.746447][ T7810] loop3: detected capacity change from 0 to 2048 [ 711.893635][ T7812] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 711.900241][ T7812] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 712.025583][ T7810] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 712.157302][ T7812] vhci_hcd vhci_hcd.0: Device attached [ 712.401572][ T7813] vhci_hcd: connection closed [ 712.404799][ T5865] vhci_hcd: stop threads [ 712.478195][ T788] usb 35-1: new high-speed USB device number 2 using vhci_hcd [ 712.560718][ T5865] vhci_hcd: release socket [ 712.585596][ T5865] vhci_hcd: disconnect device [ 712.592612][ T788] usb 35-1: enqueue for inactive port 0 [ 712.652794][ T27] audit: type=1800 audit(1788332306.497:22): pid=7810 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.517" name="file1" dev="loop3" ino=1346 res=0 errno=0 [ 712.730864][ T788] vhci_hcd: vhci_device speed not set [ 714.737797][ T7830] loop3: detected capacity change from 0 to 256 [ 715.748529][ T7836] kAFS: No cell specified [ 718.787514][ T7849] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 718.794141][ T7849] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 719.181310][ T7849] vhci_hcd vhci_hcd.0: Device attached [ 719.297501][ T7851] vhci_hcd: connection closed [ 719.300021][ T6729] vhci_hcd: stop threads [ 719.331523][ T6729] vhci_hcd: release socket [ 719.366002][ T6729] vhci_hcd: disconnect device [ 719.592050][ T7857] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 724.747641][ T7870] loop0: detected capacity change from 0 to 256 [ 727.420038][ T7880] netlink: 36 bytes leftover after parsing attributes in process `syz.1.537'. [ 731.300224][ T7896] loop3: detected capacity change from 0 to 512 [ 731.327037][ T7896] EXT4-fs (loop3): Test dummy encryption mode enabled [ 731.340886][ T7896] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 731.413972][ T7896] EXT4-fs (loop3): 1 truncate cleaned up [ 731.422523][ T7896] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 732.352646][ T7904] loop1: detected capacity change from 0 to 512 [ 732.401315][ T7904] EXT4-fs (loop1): Test dummy encryption mode enabled [ 732.408189][ T7904] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 732.469177][ T7904] EXT4-fs (loop1): 1 truncate cleaned up [ 732.476376][ T7904] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 734.579002][ T5826] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 735.711903][ T5819] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 735.908998][ T7928] FAULT_INJECTION: forcing a failure. [ 735.908998][ T7928] name failslab, interval 1, probability 0, space 0, times 0 [ 735.934506][ T7928] CPU: 0 PID: 7928 Comm: syz.1.549 Not tainted syzkaller #0 [ 735.941889][ T7928] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 735.952001][ T7928] Call Trace: [ 735.955307][ T7928] [ 735.958266][ T7928] dump_stack_lvl+0x18c/0x250 [ 735.963009][ T7928] ? show_regs_print_info+0x20/0x20 [ 735.968300][ T7928] ? load_image+0x420/0x420 [ 735.972841][ T7928] ? __lock_acquire+0x7d80/0x7d80 [ 735.977933][ T7928] ? __asan_memset+0x22/0x40 [ 735.982566][ T7928] should_fail_ex+0x394/0x4c0 [ 735.987283][ T7928] should_failslab+0x9/0x20 [ 735.991828][ T7928] slab_pre_alloc_hook+0x59/0x300 [ 735.996892][ T7928] ? lockdep_softirqs_off+0x440/0x440 [ 736.002324][ T7928] kmem_cache_alloc+0x5a/0x2c0 [ 736.007132][ T7928] ? seq_open+0x62/0x140 [ 736.011431][ T7928] seq_open+0x62/0x140 [ 736.015535][ T7928] kernfs_fop_open+0x524/0xc60 [ 736.020335][ T7928] ? fsnotify_perm+0x271/0x5e0 [ 736.025204][ T7928] do_dentry_open+0x880/0x14b0 [ 736.030015][ T7928] ? kernfs_fop_mmap+0x570/0x570 [ 736.034992][ T7928] path_openat+0x284f/0x3270 [ 736.039640][ T7928] ? verify_lock_unused+0x140/0x140 [ 736.044877][ T7928] ? do_filp_open+0x430/0x430 [ 736.049594][ T7928] ? up_read+0x20/0x20 [ 736.053700][ T7928] do_filp_open+0x1f2/0x430 [ 736.058237][ T7928] ? vfs_tmpfile+0x620/0x620 [ 736.062884][ T7928] ? _raw_spin_unlock+0x28/0x40 [ 736.067768][ T7928] ? alloc_fd+0x590/0x640 [ 736.072144][ T7928] do_sys_openat2+0x134/0x1d0 [ 736.076860][ T7928] ? init_peercred+0x263/0x2c0 [ 736.081665][ T7928] ? do_sys_open+0xe0/0xe0 [ 736.086124][ T7928] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 736.092144][ T7928] ? lock_chain_count+0x20/0x20 [ 736.097025][ T7928] ? lock_chain_count+0x20/0x20 [ 736.101922][ T7928] __x64_sys_openat+0x139/0x160 [ 736.106823][ T7928] do_syscall_64+0x55/0xb0 [ 736.111285][ T7928] ? clear_bhb_loop+0x40/0x90 [ 736.116006][ T7928] ? clear_bhb_loop+0x40/0x90 [ 736.120721][ T7928] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 736.126649][ T7928] RIP: 0033:0x7f5e0a55e98e [ 736.131097][ T7928] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 736.150745][ T7928] RSP: 002b:00007f5e0b5129b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 736.159199][ T7928] RAX: ffffffffffffffda RBX: 00007f5e0b5136c0 RCX: 00007f5e0a55e98e [ 736.167211][ T7928] RDX: 0000000000080001 RSI: 00007f5e0a609070 RDI: ffffffffffffff9c [ 736.175213][ T7928] RBP: 00007f5e0a609070 R08: 0000000000000000 R09: 0000000000000000 [ 736.183224][ T7928] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 736.191219][ T7928] R13: 00007f5e0b512a90 R14: 00007f5e0a825fa0 R15: 00007ffe5a89f0d8 [ 736.199237][ T7928] [ 740.136119][ T7959] FAULT_INJECTION: forcing a failure. [ 740.136119][ T7959] name failslab, interval 1, probability 0, space 0, times 0 [ 740.211453][ T7959] CPU: 1 PID: 7959 Comm: syz.2.558 Not tainted syzkaller #0 [ 740.218892][ T7959] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 740.229024][ T7959] Call Trace: [ 740.232355][ T7959] [ 740.235341][ T7959] dump_stack_lvl+0x18c/0x250 [ 740.240101][ T7959] ? show_regs_print_info+0x20/0x20 [ 740.245367][ T7959] ? load_image+0x420/0x420 [ 740.249961][ T7959] ? __lock_acquire+0x7d80/0x7d80 [ 740.255040][ T7959] ? kasan_set_track+0x5f/0x70 [ 740.259877][ T7959] should_fail_ex+0x394/0x4c0 [ 740.264616][ T7959] should_failslab+0x9/0x20 [ 740.269160][ T7959] slab_pre_alloc_hook+0x59/0x300 [ 740.274226][ T7959] ? __kthread_create_on_node+0x1b4/0x3d0 [ 740.279968][ T7959] ? __kthread_create_on_node+0x1b4/0x3d0 [ 740.285709][ T7959] __kmem_cache_alloc_node+0x53/0x250 [ 740.291184][ T7959] ? __kthread_create_on_node+0x1b4/0x3d0 [ 740.297049][ T7959] __kmalloc_node_track_caller+0xa4/0x230 [ 740.302832][ T7959] kvasprintf+0xec/0x1a0 [ 740.307099][ T7959] ? bust_spinlocks+0xd0/0xd0 [ 740.311813][ T7959] __kthread_create_on_node+0x1b4/0x3d0 [ 740.317391][ T7959] ? kthread_create_on_node+0x140/0x140 [ 740.323001][ T7959] ? __fget_files+0x28/0x460 [ 740.327647][ T7959] ? pickup_urb_and_free_priv+0x360/0x360 [ 740.333535][ T7959] ? pickup_urb_and_free_priv+0x360/0x360 [ 740.339296][ T7959] kthread_create_on_node+0xec/0x140 [ 740.344619][ T7959] ? tsk_fork_get_node+0x70/0x70 [ 740.349587][ T7959] attach_store+0x405/0xac0 [ 740.354120][ T7959] ? kernfs_fop_write_iter+0x1dc/0x520 [ 740.359622][ T7959] ? detach_store+0x550/0x550 [ 740.364353][ T7959] ? sysfs_kf_write+0x187/0x2a0 [ 740.369232][ T7959] ? sysfs_kf_read+0x360/0x360 [ 740.374045][ T7959] kernfs_fop_write_iter+0x3a4/0x520 [ 740.379381][ T7959] vfs_write+0x474/0x9a0 [ 740.383680][ T7959] ? file_end_write+0x250/0x250 [ 740.388562][ T7959] ? __fget_files+0x3fc/0x460 [ 740.393270][ T7959] ? __fdget_pos+0x2a3/0x330 [ 740.397882][ T7959] ? ksys_write+0x74/0x260 [ 740.402326][ T7959] ksys_write+0x151/0x260 [ 740.406684][ T7959] ? __ia32_sys_read+0x90/0x90 [ 740.411547][ T7959] ? lockdep_hardirqs_on+0x98/0x150 [ 740.416801][ T7959] do_syscall_64+0x55/0xb0 [ 740.421250][ T7959] ? clear_bhb_loop+0x40/0x90 [ 740.425991][ T7959] ? clear_bhb_loop+0x40/0x90 [ 740.430803][ T7959] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 740.436743][ T7959] RIP: 0033:0x7fba5a75e98e [ 740.441176][ T7959] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 740.460829][ T7959] RSP: 002b:00007fba5b5a1a08 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 740.469320][ T7959] RAX: ffffffffffffffda RBX: 00007fba5b5a26c0 RCX: 00007fba5a75e98e [ 740.477339][ T7959] RDX: 0000000000000008 RSI: 00007fba5b5a1a90 RDI: 0000000000000006 [ 740.485328][ T7959] RBP: 00007fba5a809070 R08: 0000000000000000 R09: 0000000000000000 [ 740.493317][ T7959] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 740.501304][ T7959] R13: 00007fba5b5a1a90 R14: 00007fba5aa25fa0 R15: 00007fff9ed02938 [ 740.509329][ T7959] [ 740.727314][ T7948] loop3: detected capacity change from 0 to 40427 [ 740.796312][ T7948] F2FS-fs (loop3): Found nat_bits in checkpoint [ 740.807580][ T7968] loop0: detected capacity change from 0 to 256 [ 740.903841][ T7948] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 741.878676][ T7971] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 742.048864][ T7971] syz.3.555: attempt to access beyond end of device [ 742.048864][ T7971] loop3: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 742.336136][ T5826] syz-executor: attempt to access beyond end of device [ 742.336136][ T5826] loop3: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 742.366432][ T5826] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 742.376591][ T5826] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 744.785658][ T7983] netlink: 164 bytes leftover after parsing attributes in process `syz.1.566'. [ 744.891901][ T7985] binder_alloc: 7984: binder_alloc_buf, no vma [ 745.059627][ T7990] loop3: detected capacity change from 0 to 512 [ 745.072277][ T7990] EXT4-fs (loop3): Test dummy encryption mode enabled [ 745.079804][ T7990] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 745.119597][ T7990] EXT4-fs (loop3): 1 truncate cleaned up [ 745.129286][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 745.138624][ T7990] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 745.341584][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 746.003918][ T9] usb 2-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 746.017450][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 746.027508][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 746.045696][ T9] cdc_acm: probe of 2-1:1.0 failed with error -22 [ 746.275256][ T5826] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 746.333177][ T28] usb 2-1: USB disconnect, device number 2 [ 746.501796][ T8006] netlink: 164 bytes leftover after parsing attributes in process `syz.2.571'. [ 746.779304][ T5750] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 747.623568][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.630209][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.738606][ T8019] loop1: detected capacity change from 0 to 128 [ 747.806750][ T5750] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 749.815498][ T5750] usb 3-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 750.225068][ T5750] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 750.275535][ T5750] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 750.370660][ T5750] usb 3-1: can't set config #1, error -71 [ 750.397659][ T5750] usb 3-1: USB disconnect, device number 10 [ 750.501038][ T8025] loop0: detected capacity change from 0 to 512 [ 750.559281][ T8025] EXT4-fs (loop0): Test dummy encryption mode enabled [ 750.567511][ T8025] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 750.592280][ T8025] EXT4-fs (loop0): 1 truncate cleaned up [ 750.604300][ T8025] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 751.713074][ T5820] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 752.125342][ T8055] netlink: 36 bytes leftover after parsing attributes in process `syz.3.584'. [ 757.099754][ T8087] netlink: 44 bytes leftover after parsing attributes in process `syz.0.594'. [ 757.108799][ T8087] netlink: 8 bytes leftover after parsing attributes in process `syz.0.594'. [ 757.121579][ T8087] netlink: 36 bytes leftover after parsing attributes in process `syz.0.594'. [ 757.975891][ T8093] loop3: detected capacity change from 0 to 256 [ 760.052710][ T8105] loop2: detected capacity change from 0 to 512 [ 760.095550][ T8105] EXT4-fs (loop2): Test dummy encryption mode enabled [ 760.154618][ T8105] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 760.967374][ T8105] EXT4-fs (loop2): 1 truncate cleaned up [ 760.974572][ T8105] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 761.587001][ T5815] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 762.796790][ T8127] loop0: detected capacity change from 0 to 512 [ 762.961900][ T8127] EXT4-fs (loop0): Test dummy encryption mode enabled [ 762.979297][ T8127] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 763.040787][ T8127] EXT4-fs (loop0): 1 truncate cleaned up [ 763.120844][ T8127] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 764.609679][ T5820] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 764.887835][ T8159] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 766.352229][ T8167] netlink: 44 bytes leftover after parsing attributes in process `syz.1.615'. [ 766.361446][ T8167] netlink: 8 bytes leftover after parsing attributes in process `syz.1.615'. [ 766.373297][ T8167] netlink: 36 bytes leftover after parsing attributes in process `syz.1.615'. [ 770.004201][ T8170] loop0: detected capacity change from 0 to 32768 [ 776.217743][ T8234] fuse: Bad value for 'fd' [ 780.132943][ T8263] loop3: detected capacity change from 0 to 512 [ 780.207403][ T8263] EXT4-fs (loop3): Test dummy encryption mode enabled [ 780.256011][ T8263] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 780.363432][ T8263] EXT4-fs (loop3): 1 truncate cleaned up [ 780.369659][ T8271] fuse: Bad value for 'fd' [ 780.380776][ T8263] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 781.303915][ T5826] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 784.725801][ T8302] loop1: detected capacity change from 0 to 512 [ 784.847835][ T8302] EXT4-fs (loop1): Test dummy encryption mode enabled [ 784.921355][ T8302] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 785.069191][ T8302] EXT4-fs (loop1): 1 truncate cleaned up [ 785.114841][ T8302] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 785.231187][ T8312] loop0: detected capacity change from 0 to 512 [ 785.281072][ T8312] EXT4-fs (loop0): Test dummy encryption mode enabled [ 785.311373][ T8312] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 785.352611][ T8312] EXT4-fs (loop0): 1 truncate cleaned up [ 785.394383][ T8312] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 786.453439][ T5819] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 786.467667][ T5820] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 789.579357][ T8346] EXT4-fs warning (device sda1): verify_group_input:151: Cannot add at group 0 (only 8 groups) [ 790.508919][ T8366] loop0: detected capacity change from 0 to 512 [ 790.539516][ T8366] EXT4-fs (loop0): Test dummy encryption mode enabled [ 790.547602][ T8366] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 790.617732][ T8366] EXT4-fs (loop0): 1 truncate cleaned up [ 790.736155][ T8366] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 791.485437][ T8374] binder: BINDER_SET_CONTEXT_MGR already set [ 791.494321][ T8374] binder: 8373:8374 ioctl 4018620d 200000004a80 returned -16 [ 791.694020][ T8366] fscrypt (loop0): Missing crypto API support for AES-256-XTS (API name: "xts(aes)") [ 791.761989][ T5820] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 792.048034][ T8392] loop3: detected capacity change from 0 to 256 [ 795.269988][ T8421] loop3: detected capacity change from 0 to 256 [ 798.203004][ T8433] loop3: detected capacity change from 0 to 128 [ 801.852813][ T8465] binder: BINDER_SET_CONTEXT_MGR already set [ 801.858923][ T8465] binder: 8463:8465 ioctl 4018620d 200000004a80 returned -16 [ 802.988693][ T8477] loop1: detected capacity change from 0 to 128 [ 808.679197][ T8510] loop0: detected capacity change from 0 to 256 [ 809.065457][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 809.071961][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.893842][ T8499] loop3: detected capacity change from 0 to 32768 [ 814.335357][ T8543] loop3: detected capacity change from 0 to 32768 [ 818.514038][ T8576] loop1: detected capacity change from 0 to 512 [ 818.610528][ T8576] EXT4-fs (loop1): Test dummy encryption mode enabled [ 818.658745][ T8576] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 819.161375][ T8576] EXT4-fs (loop1): 1 truncate cleaned up [ 819.168495][ T8576] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 820.454476][ T8576] fscrypt (loop1): Missing crypto API support for AES-256-XTS (API name: "xts(aes)") [ 820.578070][ T5819] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 821.758226][ T8588] loop2: detected capacity change from 0 to 32768 [ 823.414154][ T8605] loop1: detected capacity change from 0 to 32768 [ 827.266445][ T8637] binder: BINDER_SET_CONTEXT_MGR already set [ 827.343156][ T8637] binder: 8633:8637 ioctl 4018620d 200000004a80 returned -16 [ 828.412905][ T8647] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 838.158623][ T8697] binder: BINDER_SET_CONTEXT_MGR already set [ 838.178945][ T8697] binder: 8696:8697 ioctl 4018620d 200000004a80 returned -16 [ 841.428323][ T8721] loop2: detected capacity change from 0 to 512 [ 841.503957][ T8721] EXT4-fs (loop2): Test dummy encryption mode enabled [ 841.511317][ T8721] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 841.570443][ T8721] EXT4-fs (loop2): 1 truncate cleaned up [ 841.764929][ T8721] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 843.518678][ T8727] fscrypt (loop2): Missing crypto API support for AES-256-XTS (API name: "xts(aes)") [ 843.618171][ T5815] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 843.805610][ T8718] loop1: detected capacity change from 0 to 32768 [ 843.980016][ T8742] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 846.334699][ T8747] loop1: detected capacity change from 0 to 512 [ 846.369221][ T8747] EXT4-fs (loop1): Test dummy encryption mode enabled [ 846.387735][ T8747] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 846.387916][ T8749] loop2: detected capacity change from 0 to 1024 [ 846.428790][ T8747] EXT4-fs (loop1): 1 truncate cleaned up [ 846.445052][ T8749] EXT4-fs: Ignoring removed bh option [ 846.462819][ T8747] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 846.677675][ T8749] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 847.350366][ T8752] fscrypt (loop1): Error allocating 'xts(aes)' transform: -4 [ 847.554896][ T5819] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 847.889946][ T5815] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 849.191101][ T8775] netlink: 17 bytes leftover after parsing attributes in process `syz.2.784'. [ 849.581464][ T8761] loop0: detected capacity change from 0 to 40427 [ 849.880434][ T8761] F2FS-fs (loop0): Found nat_bits in checkpoint [ 851.099164][ T8761] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 851.797948][ T8802] netlink: 12 bytes leftover after parsing attributes in process `syz.2.791'. [ 859.463869][ T8844] loop1: detected capacity change from 0 to 1024 [ 859.484129][ T8844] EXT4-fs: Ignoring removed bh option [ 859.538015][ T8846] loop0: detected capacity change from 0 to 1024 [ 859.546509][ T8846] EXT4-fs: Ignoring removed bh option [ 859.577007][ T8844] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 859.640668][ T8846] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 862.892794][ T5820] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 862.936784][ T5819] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 863.030429][ T8862] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 863.479275][ T8868] loop1: detected capacity change from 0 to 1024 [ 863.588808][ T8868] EXT4-fs: Ignoring removed bh option [ 864.160514][ T8868] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 865.602136][ T8888] netlink: 17 bytes leftover after parsing attributes in process `syz.2.814'. [ 865.868707][ T8897] FAULT_INJECTION: forcing a failure. [ 865.868707][ T8897] name failslab, interval 1, probability 0, space 0, times 0 [ 865.881970][ T8897] CPU: 0 PID: 8897 Comm: syz.3.817 Not tainted syzkaller #0 [ 865.889323][ T8897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 865.899429][ T8897] Call Trace: [ 865.902754][ T8897] [ 865.905745][ T8897] dump_stack_lvl+0x18c/0x250 [ 865.910489][ T8897] ? show_regs_print_info+0x20/0x20 [ 865.915755][ T8897] ? load_image+0x420/0x420 [ 865.920335][ T8897] ? __might_sleep+0xe0/0xe0 [ 865.924995][ T8897] ? __lock_acquire+0x7d80/0x7d80 [ 865.930082][ T8897] should_fail_ex+0x394/0x4c0 [ 865.934835][ T8897] should_failslab+0x9/0x20 [ 865.939407][ T8897] slab_pre_alloc_hook+0x59/0x300 [ 865.944515][ T8897] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 865.950345][ T8897] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 865.956121][ T8897] __kmem_cache_alloc_node+0x53/0x250 [ 865.961545][ T8897] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 865.967302][ T8897] __kmalloc+0xa7/0x240 [ 865.971499][ T8897] tomoyo_realpath_from_path+0xe6/0x5c0 [ 865.977088][ T8897] ? tomoyo_domain+0xd6/0x120 [ 865.981813][ T8897] tomoyo_path_number_perm+0x248/0x5e0 [ 865.987311][ T8897] ? tomoyo_path_number_perm+0x217/0x5e0 [ 865.992994][ T8897] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 865.998520][ T8897] ? __fget_files+0x28/0x460 [ 866.003155][ T8897] security_file_ioctl+0x70/0xa0 [ 866.008173][ T8897] __se_sys_ioctl+0x48/0x170 [ 866.012801][ T8897] do_syscall_64+0x55/0xb0 [ 866.017251][ T8897] ? clear_bhb_loop+0x40/0x90 [ 866.021962][ T8897] ? clear_bhb_loop+0x40/0x90 [ 866.026679][ T8897] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 866.032611][ T8897] RIP: 0033:0x7f1ac699e159 [ 866.037058][ T8897] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 866.056708][ T8897] RSP: 002b:00007f1ac4bf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 866.065159][ T8897] RAX: ffffffffffffffda RBX: 00007f1ac6c25fa0 RCX: 00007f1ac699e159 [ 866.073158][ T8897] RDX: 0000000000000000 RSI: 000000000000ab04 RDI: 0000000000000003 [ 866.081158][ T8897] RBP: 00007f1ac6a35024 R08: 0000000000000000 R09: 0000000000000000 [ 866.089170][ T8897] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 866.097182][ T8897] R13: 00007f1ac6c26038 R14: 00007f1ac6c25fa0 R15: 00007ffd213895e8 [ 866.105196][ T8897] [ 866.133760][ T8897] ERROR: Out of memory at tomoyo_realpath_from_path. [ 866.178810][ T8897] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 866.185429][ T8897] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 866.328754][ T8897] vhci_hcd vhci_hcd.0: Device attached [ 866.491141][ T8898] vhci_hcd: connection closed [ 866.524175][ T5933] vhci_hcd: stop threads [ 866.638872][ T5933] vhci_hcd: release socket [ 866.664486][ T8901] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 866.675731][ T5933] vhci_hcd: disconnect device [ 866.709170][ T5750] usb 39-1: new high-speed USB device number 2 using vhci_hcd [ 868.054647][ T5750] usb 39-1: enqueue for inactive port 0 [ 869.159183][ T5750] vhci_hcd: vhci_device speed not set [ 869.290569][ T8907] netlink: 12 bytes leftover after parsing attributes in process `syz.2.818'. [ 870.084815][ T5819] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 870.614197][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.624845][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 872.891022][ T8932] loop0: detected capacity change from 0 to 1024 [ 872.894454][ T8936] FAULT_INJECTION: forcing a failure. [ 872.894454][ T8936] name failslab, interval 1, probability 0, space 0, times 0 [ 872.910280][ T8936] CPU: 1 PID: 8936 Comm: syz.3.828 Not tainted syzkaller #0 [ 872.917633][ T8936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 872.927740][ T8936] Call Trace: [ 872.931053][ T8936] [ 872.934019][ T8936] dump_stack_lvl+0x18c/0x250 [ 872.938764][ T8936] ? show_regs_print_info+0x20/0x20 [ 872.943988][ T8936] ? load_image+0x420/0x420 [ 872.948504][ T8936] ? __might_sleep+0xe0/0xe0 [ 872.953151][ T8936] ? __lock_acquire+0x7d80/0x7d80 [ 872.958222][ T8936] should_fail_ex+0x394/0x4c0 [ 872.962962][ T8936] should_failslab+0x9/0x20 [ 872.967510][ T8936] slab_pre_alloc_hook+0x59/0x300 [ 872.972581][ T8936] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 872.978345][ T8936] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 872.984107][ T8936] __kmem_cache_alloc_node+0x53/0x250 [ 872.989561][ T8936] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 872.995345][ T8936] __kmalloc+0xa7/0x240 [ 872.999567][ T8936] tomoyo_realpath_from_path+0xe6/0x5c0 [ 873.005147][ T8936] ? tomoyo_domain+0xd6/0x120 [ 873.009870][ T8936] tomoyo_path_number_perm+0x248/0x5e0 [ 873.015420][ T8936] ? tomoyo_path_number_perm+0x217/0x5e0 [ 873.021101][ T8936] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 873.026643][ T8936] ? __fget_files+0x28/0x460 [ 873.031276][ T8936] security_file_ioctl+0x70/0xa0 [ 873.036260][ T8936] __se_sys_ioctl+0x48/0x170 [ 873.040897][ T8936] do_syscall_64+0x55/0xb0 [ 873.045367][ T8936] ? clear_bhb_loop+0x40/0x90 [ 873.050146][ T8936] ? clear_bhb_loop+0x40/0x90 [ 873.054869][ T8936] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 873.060814][ T8936] RIP: 0033:0x7f1ac699e159 [ 873.065262][ T8936] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 873.084888][ T8936] RSP: 002b:00007f1ac4bf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 873.093335][ T8936] RAX: ffffffffffffffda RBX: 00007f1ac6c25fa0 RCX: 00007f1ac699e159 [ 873.101341][ T8936] RDX: 0000000000000000 RSI: 000000000000ab04 RDI: 0000000000000003 [ 873.109370][ T8936] RBP: 00007f1ac6a35024 R08: 0000000000000000 R09: 0000000000000000 [ 873.117405][ T8936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 873.125423][ T8936] R13: 00007f1ac6c26038 R14: 00007f1ac6c25fa0 R15: 00007ffd213895e8 [ 873.133422][ T8936] [ 873.141730][ T8936] ERROR: Out of memory at tomoyo_realpath_from_path. [ 873.274078][ T8932] EXT4-fs: Ignoring removed bh option [ 873.299423][ T8927] Bluetooth: hci3: command 0x0406 tx timeout [ 873.658142][ T8932] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 873.831009][ T8936] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 873.837614][ T8936] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 873.853691][ T8936] vhci_hcd vhci_hcd.0: Device attached [ 873.867055][ T8943] vhci_hcd: connection closed [ 873.874385][ T3444] vhci_hcd: stop threads [ 873.900470][ T3444] vhci_hcd: release socket [ 873.905082][ T3444] vhci_hcd: disconnect device [ 875.379079][ T8927] Bluetooth: hci3: command 0x0406 tx timeout [ 875.492560][ T8955] nvme_fcloop: unknown parameter or missing value 'l' [ 879.310251][ T5820] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 879.636420][ T8970] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 879.915675][ T8972] netlink: 44 bytes leftover after parsing attributes in process `syz.0.833'. [ 880.041981][ T8972] netlink: 32 bytes leftover after parsing attributes in process `syz.0.833'. [ 885.593224][ T8986] nvme_fcloop: unknown parameter or missing value 'l' [ 891.863165][ T9017] loop0: detected capacity change from 0 to 1024 [ 891.870941][ T9017] EXT4-fs: Ignoring removed bh option [ 891.933952][ T9019] loop3: detected capacity change from 0 to 1024 [ 891.950301][ T9019] EXT4-fs: Ignoring removed bh option [ 891.980143][ T9017] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 892.146433][ T9026] FAULT_INJECTION: forcing a failure. [ 892.146433][ T9026] name failslab, interval 1, probability 0, space 0, times 0 [ 892.179682][ T9019] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 892.220780][ T9026] CPU: 0 PID: 9026 Comm: syz.1.851 Not tainted syzkaller #0 [ 892.228166][ T9026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 892.238273][ T9026] Call Trace: [ 892.241606][ T9026] [ 892.244593][ T9026] dump_stack_lvl+0x18c/0x250 [ 892.249345][ T9026] ? show_regs_print_info+0x20/0x20 [ 892.254611][ T9026] ? load_image+0x420/0x420 [ 892.259176][ T9026] ? __might_sleep+0xe0/0xe0 [ 892.263818][ T9026] ? __lock_acquire+0x7d80/0x7d80 [ 892.268900][ T9026] should_fail_ex+0x394/0x4c0 [ 892.273675][ T9026] should_failslab+0x9/0x20 [ 892.278251][ T9026] slab_pre_alloc_hook+0x59/0x300 [ 892.283355][ T9026] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 892.289162][ T9026] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 892.294958][ T9026] __kmem_cache_alloc_node+0x53/0x250 [ 892.300417][ T9026] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 892.306228][ T9026] __kmalloc+0xa7/0x240 [ 892.310453][ T9026] tomoyo_realpath_from_path+0xe6/0x5c0 [ 892.316054][ T9026] ? tomoyo_domain+0xd6/0x120 [ 892.320784][ T9026] tomoyo_path_number_perm+0x248/0x5e0 [ 892.326296][ T9026] ? tomoyo_path_number_perm+0x217/0x5e0 [ 892.331983][ T9026] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 892.337573][ T9026] ? __fget_files+0x28/0x460 [ 892.342218][ T9026] security_file_ioctl+0x70/0xa0 [ 892.347205][ T9026] __se_sys_ioctl+0x48/0x170 [ 892.351838][ T9026] do_syscall_64+0x55/0xb0 [ 892.356294][ T9026] ? clear_bhb_loop+0x40/0x90 [ 892.361045][ T9026] ? clear_bhb_loop+0x40/0x90 [ 892.365760][ T9026] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 892.371693][ T9026] RIP: 0033:0x7f5e0a59e159 [ 892.376141][ T9026] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 892.395783][ T9026] RSP: 002b:00007f5e0b513028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 892.404235][ T9026] RAX: ffffffffffffffda RBX: 00007f5e0a825fa0 RCX: 00007f5e0a59e159 [ 892.412259][ T9026] RDX: 0000000000000000 RSI: 000000000000ab04 RDI: 0000000000000003 [ 892.420269][ T9026] RBP: 00007f5e0a635024 R08: 0000000000000000 R09: 0000000000000000 [ 892.428279][ T9026] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 892.436285][ T9026] R13: 00007f5e0a826038 R14: 00007f5e0a825fa0 R15: 00007ffe5a89f0d8 [ 892.444311][ T9026] [ 892.552860][ T9030] netlink: 12 bytes leftover after parsing attributes in process `syz.2.852'. [ 892.768696][ T9026] ERROR: Out of memory at tomoyo_realpath_from_path. [ 893.132400][ T9029] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 893.139006][ T9029] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 893.231874][ T9029] vhci_hcd vhci_hcd.0: Device attached [ 893.239838][ T9032] vhci_hcd: connection closed [ 893.257651][ T6729] vhci_hcd: stop threads [ 893.278397][ T6729] vhci_hcd: release socket [ 893.303323][ T5826] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 893.324648][ T6729] vhci_hcd: disconnect device [ 894.857379][ T9051] netlink: 17 bytes leftover after parsing attributes in process `syz.1.855'. [ 900.226645][ T5820] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 900.580839][ T9081] netlink: 17 bytes leftover after parsing attributes in process `syz.0.863'. [ 903.861359][ T9095] loop2: detected capacity change from 0 to 1024 [ 903.885142][ T9095] EXT4-fs: Ignoring removed bh option [ 903.944609][ T9095] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 906.097579][ T9115] netlink: 17 bytes leftover after parsing attributes in process `syz.1.870'. [ 906.353334][ T5815] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 907.004812][ T9123] loop3: detected capacity change from 0 to 512 [ 907.291253][ T9123] EXT4-fs (loop3): Test dummy encryption mode enabled [ 907.487077][ T9123] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 907.955712][ T9123] EXT4-fs (loop3): 1 truncate cleaned up [ 907.961694][ T9137] FAULT_INJECTION: forcing a failure. [ 907.961694][ T9137] name failslab, interval 1, probability 0, space 0, times 0 [ 907.978495][ T9137] CPU: 0 PID: 9137 Comm: syz.1.875 Not tainted syzkaller #0 [ 907.985882][ T9137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 907.996019][ T9137] Call Trace: [ 907.999375][ T9137] [ 908.002357][ T9137] dump_stack_lvl+0x18c/0x250 [ 908.007111][ T9137] ? show_regs_print_info+0x20/0x20 [ 908.012377][ T9137] ? load_image+0x420/0x420 [ 908.013163][ T9123] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 908.016930][ T9137] ? __might_sleep+0xe0/0xe0 [ 908.033575][ T9137] ? __lock_acquire+0x7d80/0x7d80 [ 908.038639][ T9137] should_fail_ex+0x394/0x4c0 [ 908.043365][ T9137] should_failslab+0x9/0x20 [ 908.047916][ T9137] slab_pre_alloc_hook+0x59/0x300 [ 908.052990][ T9137] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 908.058759][ T9137] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 908.064545][ T9137] __kmem_cache_alloc_node+0x53/0x250 [ 908.069981][ T9137] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 908.075755][ T9137] __kmalloc+0xa7/0x240 [ 908.079952][ T9137] tomoyo_realpath_from_path+0xe6/0x5c0 [ 908.085544][ T9137] ? tomoyo_domain+0xd6/0x120 [ 908.090271][ T9137] tomoyo_path_number_perm+0x248/0x5e0 [ 908.095776][ T9137] ? tomoyo_path_number_perm+0x217/0x5e0 [ 908.101453][ T9137] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 908.107021][ T9137] ? __fget_files+0x28/0x460 [ 908.111660][ T9137] security_file_ioctl+0x70/0xa0 [ 908.116653][ T9137] __se_sys_ioctl+0x48/0x170 [ 908.121280][ T9137] do_syscall_64+0x55/0xb0 [ 908.125743][ T9137] ? clear_bhb_loop+0x40/0x90 [ 908.130485][ T9137] ? clear_bhb_loop+0x40/0x90 [ 908.135198][ T9137] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 908.141135][ T9137] RIP: 0033:0x7f5e0a59e159 [ 908.145581][ T9137] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 908.165226][ T9137] RSP: 002b:00007f5e0b513028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 908.173680][ T9137] RAX: ffffffffffffffda RBX: 00007f5e0a825fa0 RCX: 00007f5e0a59e159 [ 908.181683][ T9137] RDX: 0000000000000000 RSI: 000000000000ab04 RDI: 0000000000000003 [ 908.189686][ T9137] RBP: 00007f5e0a635024 R08: 0000000000000000 R09: 0000000000000000 [ 908.197690][ T9137] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 908.205695][ T9137] R13: 00007f5e0a826038 R14: 00007f5e0a825fa0 R15: 00007ffe5a89f0d8 [ 908.213722][ T9137] [ 908.275015][ T9135] loop0: detected capacity change from 0 to 1024 [ 908.298932][ T9135] EXT4-fs: Ignoring removed bh option [ 908.313776][ T9137] ERROR: Out of memory at tomoyo_realpath_from_path. [ 908.387499][ T9135] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 908.591922][ T9141] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 908.787873][ T9137] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 908.794493][ T9137] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 908.868165][ T9137] vhci_hcd vhci_hcd.0: Device attached [ 908.873988][ T9147] vhci_hcd: connection closed [ 909.010045][ T6019] vhci_hcd: stop threads [ 909.075697][ T6019] vhci_hcd: release socket [ 909.081431][ T6019] vhci_hcd: disconnect device [ 909.090225][ T5979] vhci_hcd: vhci_device speed not set [ 909.130857][ T5820] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 909.191172][ T5826] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 910.450553][ T9169] loop2: detected capacity change from 0 to 1024 [ 910.483525][ T9169] EXT4-fs: Ignoring removed bh option [ 910.546856][ T9169] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 911.819271][ T5818] Bluetooth: hci3: command 0x0406 tx timeout [ 913.745136][ T9175] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 914.128279][ T9198] FAULT_INJECTION: forcing a failure. [ 914.128279][ T9198] name fail_futex, interval 1, probability 0, space 0, times 1 [ 914.159133][ T9198] CPU: 1 PID: 9198 Comm: syz.0.885 Not tainted syzkaller #0 [ 914.166524][ T9198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 914.176632][ T9198] Call Trace: [ 914.179958][ T9198] [ 914.182931][ T9198] dump_stack_lvl+0x18c/0x250 [ 914.187675][ T9198] ? show_regs_print_info+0x20/0x20 [ 914.192937][ T9198] ? load_image+0x420/0x420 [ 914.197485][ T9198] ? stack_trace_save+0xaa/0x100 [ 914.202526][ T9198] ? stack_trace_snprint+0xf0/0xf0 [ 914.207686][ T9198] ? __stack_depot_save+0x575/0x660 [ 914.213010][ T9198] should_fail_ex+0x394/0x4c0 [ 914.217725][ T9198] get_futex_key+0x136/0x1030 [ 914.222437][ T9198] ? futex_setup_timer+0xc0/0xc0 [ 914.227412][ T9198] futex_wake+0x127/0x4f0 [ 914.231793][ T9198] ? futex_wake_mark+0x150/0x150 [ 914.236765][ T9198] ? lockdep_hardirqs_on+0x98/0x150 [ 914.242029][ T9198] do_futex+0x35d/0x3e0 [ 914.246219][ T9198] ? __ia32_sys_get_robust_list+0x110/0x110 [ 914.252150][ T9198] __se_sys_futex+0x3a9/0x440 [ 914.256854][ T9198] ? __x64_sys_fsconfig+0xc0/0xc0 [ 914.261917][ T9198] ? __x64_sys_futex+0xf0/0xf0 [ 914.266749][ T9198] ? __x64_sys_futex+0x21/0xf0 [ 914.271556][ T9198] do_syscall_64+0x55/0xb0 [ 914.276007][ T9198] ? clear_bhb_loop+0x40/0x90 [ 914.280718][ T9198] ? clear_bhb_loop+0x40/0x90 [ 914.285435][ T9198] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 914.291357][ T9198] RIP: 0033:0x7fdf2f19e159 [ 914.295802][ T9198] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 914.315449][ T9198] RSP: 002b:00007fdf3013a0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 914.323898][ T9198] RAX: ffffffffffffffda RBX: 00007fdf2f425fa8 RCX: 00007fdf2f19e159 [ 914.331906][ T9198] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fdf2f425fac [ 914.339908][ T9198] RBP: 00007fdf2f425fa0 R08: 0000000000745d1e R09: 0000000000000000 [ 914.348001][ T9198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 914.355993][ T9198] R13: 00007fdf2f426038 R14: 00007fff080dab00 R15: 00007fff080dabe8 [ 914.364000][ T9198] [ 914.367186][ C1] vkms_vblank_simulate: vblank timer overrun [ 914.900161][ T5815] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 915.714021][ T9246] binder: 9245:9246 unknown command 0 [ 915.724561][ T9246] binder: 9245:9246 ioctl c0306201 2000000004c0 returned -22 [ 915.930357][ T9233] syz.2.888 (9233) used greatest stack depth: 17896 bytes left [ 916.319300][ T28] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 916.519165][ T28] usb 4-1: Using ep0 maxpacket: 32 [ 916.537268][ T28] usb 4-1: unable to get BOS descriptor or descriptor too short [ 916.566840][ T28] usb 4-1: config 14 has an invalid interface number: 226 but max is 0 [ 916.588723][ T28] usb 4-1: config 14 has no interface number 0 [ 916.607483][ T28] usb 4-1: config 14 interface 226 has no altsetting 0 [ 916.620017][ T28] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice=16.9b [ 916.649014][ T28] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 916.657130][ T28] usb 4-1: Product: syz [ 916.672031][ T28] usb 4-1: Manufacturer: syz [ 916.676732][ T28] usb 4-1: SerialNumber: syz [ 916.828210][ T9279] netlink: 8 bytes leftover after parsing attributes in process `syz.2.905'. [ 917.175862][ T9284] overlayfs: overlapping lowerdir path [ 918.051298][ T9287] FAULT_INJECTION: forcing a failure. [ 918.051298][ T9287] name failslab, interval 1, probability 0, space 0, times 0 [ 918.064851][ T9287] CPU: 0 PID: 9287 Comm: syz.0.908 Not tainted syzkaller #0 [ 918.072223][ T9287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 918.082338][ T9287] Call Trace: [ 918.085672][ T9287] [ 918.088645][ T9287] dump_stack_lvl+0x18c/0x250 [ 918.093395][ T9287] ? show_regs_print_info+0x20/0x20 [ 918.098655][ T9287] ? load_image+0x420/0x420 [ 918.103235][ T9287] ? __lock_acquire+0x7d80/0x7d80 [ 918.108326][ T9287] should_fail_ex+0x394/0x4c0 [ 918.113106][ T9287] should_failslab+0x9/0x20 [ 918.117673][ T9287] slab_pre_alloc_hook+0x59/0x300 [ 918.122764][ T9287] ? handler_new_ref+0x244/0x920 [ 918.127847][ T9287] ? handler_new_ref+0x244/0x920 [ 918.132920][ T9287] __kmem_cache_alloc_node+0x53/0x250 [ 918.138353][ T9287] ? handler_new_ref+0x244/0x920 [ 918.143350][ T9287] __kmalloc+0xa7/0x240 [ 918.147575][ T9287] handler_new_ref+0x244/0x920 [ 918.152442][ T9287] ? v4l2_ctrl_type_op_equal+0x220/0x220 [ 918.158351][ T9287] v4l2_ctrl_new+0x11f3/0x16e0 [ 918.163178][ T9287] v4l2_ctrl_new_std+0x24b/0x300 [ 918.168179][ T9287] ? handler_new_ref+0x920/0x920 [ 918.173176][ T9287] ? kvmalloc_node+0x70/0x180 [ 918.177919][ T9287] ? kvmalloc_node+0x70/0x180 [ 918.182670][ T9287] ? media_request_object_init+0x8c/0xe0 [ 918.188485][ T9287] ? v4l2_ctrl_handler_init_class+0x208/0x2d0 [ 918.194716][ T9287] vim2m_open+0x17d/0x640 [ 918.199245][ T9287] v4l2_open+0x208/0x340 [ 918.203553][ T9287] chrdev_open+0x58c/0x600 [ 918.208045][ T9287] ? cd_forget+0x160/0x160 [ 918.212544][ T9287] ? fsnotify_perm+0x3ed/0x5e0 [ 918.217380][ T9287] do_dentry_open+0x880/0x14b0 [ 918.222209][ T9287] ? cd_forget+0x160/0x160 [ 918.226689][ T9287] path_openat+0x284f/0x3270 [ 918.231361][ T9287] ? do_sys_openat2+0xda/0x1d0 [ 918.236181][ T9287] ? __x64_sys_openat+0x139/0x160 [ 918.241260][ T9287] ? verify_lock_unused+0x140/0x140 [ 918.246523][ T9287] ? do_filp_open+0x430/0x430 [ 918.251277][ T9287] do_filp_open+0x1f2/0x430 [ 918.255828][ T9287] ? vfs_tmpfile+0x620/0x620 [ 918.260499][ T9287] ? _raw_spin_unlock+0x28/0x40 [ 918.265414][ T9287] ? alloc_fd+0x590/0x640 [ 918.269824][ T9287] do_sys_openat2+0x134/0x1d0 [ 918.274575][ T9287] ? do_sys_open+0xe0/0xe0 [ 918.279054][ T9287] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 918.285096][ T9287] ? lock_chain_count+0x20/0x20 [ 918.290007][ T9287] __x64_sys_openat+0x139/0x160 [ 918.294919][ T9287] do_syscall_64+0x55/0xb0 [ 918.299388][ T9287] ? clear_bhb_loop+0x40/0x90 [ 918.304114][ T9287] ? clear_bhb_loop+0x40/0x90 [ 918.308842][ T9287] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 918.314784][ T9287] RIP: 0033:0x7fdf2f19e159 [ 918.319242][ T9287] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 918.338911][ T9287] RSP: 002b:00007fdf3013a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 918.347398][ T9287] RAX: ffffffffffffffda RBX: 00007fdf2f425fa0 RCX: 00007fdf2f19e159 [ 918.355435][ T9287] RDX: 0000000000000002 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 918.363461][ T9287] RBP: 00007fdf2f235024 R08: 0000000000000000 R09: 0000000000000000 [ 918.371487][ T9287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 918.379596][ T9287] R13: 00007fdf2f426038 R14: 00007fdf2f425fa0 R15: 00007fff080dabe8 [ 918.387775][ T9287] [ 918.764803][ T9291] netlink: 'syz.0.910': attribute type 1 has an invalid length. [ 918.816855][ T9291] 8021q: adding VLAN 0 to HW filter on device bond1 [ 918.946909][ T9297] 8021q: adding VLAN 0 to HW filter on device bond1 [ 918.959633][ T9297] bond1: (slave gre1): The slave device specified does not support setting the MAC address [ 918.990511][ T9297] bond1: (slave gre1): Error -95 calling set_mac_address [ 919.055178][ T9291] gretap1: entered promiscuous mode [ 919.104983][ T9291] bond1: (slave gretap1): making interface the new active one [ 919.185806][ T9291] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 919.328222][ T9308] netlink: 'syz.1.916': attribute type 10 has an invalid length. [ 919.344563][ T9308] netlink: 40 bytes leftover after parsing attributes in process `syz.1.916'. [ 919.357250][ T9308] dummy0: entered promiscuous mode [ 919.367367][ T9308] bridge0: port 3(dummy0) entered blocking state [ 919.375411][ T9308] bridge0: port 3(dummy0) entered disabled state [ 919.387829][ T9308] dummy0: entered allmulticast mode [ 919.409710][ T9308] bridge0: port 3(dummy0) entered blocking state [ 919.416736][ T9308] bridge0: port 3(dummy0) entered forwarding state [ 919.724870][ T9312] FAULT_INJECTION: forcing a failure. [ 919.724870][ T9312] name failslab, interval 1, probability 0, space 0, times 0 [ 919.765290][ T9312] CPU: 0 PID: 9312 Comm: syz.1.917 Not tainted syzkaller #0 [ 919.772674][ T9312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 919.782806][ T9312] Call Trace: [ 919.786129][ T9312] [ 919.789132][ T9312] dump_stack_lvl+0x18c/0x250 [ 919.793867][ T9312] ? show_regs_print_info+0x20/0x20 [ 919.799130][ T9312] ? load_image+0x420/0x420 [ 919.803689][ T9312] ? __might_sleep+0xe0/0xe0 [ 919.808339][ T9312] ? __lock_acquire+0x7d80/0x7d80 [ 919.813447][ T9312] should_fail_ex+0x394/0x4c0 [ 919.818186][ T9312] should_failslab+0x9/0x20 [ 919.822839][ T9312] slab_pre_alloc_hook+0x59/0x300 [ 919.827935][ T9312] ? __rwlock_init+0x150/0x150 [ 919.832758][ T9312] ? key_user_lookup+0x1bc/0x450 [ 919.837754][ T9312] kmem_cache_alloc+0x5a/0x2c0 [ 919.842579][ T9312] ? key_alloc+0x306/0x1030 [ 919.847157][ T9312] key_alloc+0x306/0x1030 [ 919.851557][ T9312] __key_create_or_update+0x83a/0xa60 [ 919.856995][ T9312] ? key_validate+0xf0/0xf0 [ 919.861573][ T9312] ? key_create_or_update+0x60/0x60 [ 919.866826][ T9312] ? bpf_lsm_key_permission+0x9/0x10 [ 919.872223][ T9312] ? lookup_user_key+0xb66/0x1140 [ 919.877323][ T9312] ? search_process_keyrings_rcu+0x2b0/0x2b0 [ 919.883419][ T9312] key_create_or_update+0x42/0x60 [ 919.888510][ T9312] __se_sys_add_key+0x34f/0x410 [ 919.893445][ T9312] ? __x64_sys_add_key+0xc0/0xc0 [ 919.898456][ T9312] ? lockdep_hardirqs_on+0x98/0x150 [ 919.903749][ T9312] ? __x64_sys_add_key+0x20/0xc0 [ 919.908758][ T9312] do_syscall_64+0x55/0xb0 [ 919.913236][ T9312] ? clear_bhb_loop+0x40/0x90 [ 919.917972][ T9312] ? clear_bhb_loop+0x40/0x90 [ 919.922707][ T9312] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 919.928663][ T9312] RIP: 0033:0x7f5e0a59e159 [ 919.933124][ T9312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 919.952843][ T9312] RSP: 002b:00007f5e0b513028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 919.961325][ T9312] RAX: ffffffffffffffda RBX: 00007f5e0a825fa0 RCX: 00007f5e0a59e159 [ 919.969352][ T9312] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000200000000000 [ 919.977388][ T9312] RBP: 00007f5e0a635024 R08: fffffffffffffffc R09: 0000000000000000 [ 919.985439][ T9312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 919.993481][ T9312] R13: 00007f5e0a826038 R14: 00007f5e0a825fa0 R15: 00007ffe5a89f0d8 [ 920.001538][ T9312] [ 920.243124][ T28] usb 4-1: ath9k_htc: Device endpoint numbers are not the expected ones [ 920.292992][ T28] usb 4-1: USB disconnect, device number 2 [ 920.657848][ T9337] netlink: 28 bytes leftover after parsing attributes in process `syz.1.924'. [ 920.671850][ T9337] netlink: 28 bytes leftover after parsing attributes in process `syz.1.924'. [ 921.059806][ T9341] autofs4:pid:9341:autofs_fill_super: called with bogus options [ 921.176790][ T9344] IPVS: sync thread started: state = MASTER, mcast_ifn = wg1, syncid = 4, id = 0 [ 921.431371][ T9350] bonding: unable to delete non-existent b [ 922.009253][ T28] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 922.189828][ T8927] Bluetooth: hci3: command 0x0406 tx timeout [ 922.231211][ T28] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 922.251930][ T28] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 922.273265][ T28] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 922.286829][ T28] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 922.303975][ T28] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 922.331533][ T28] usb 1-1: config 0 descriptor?? [ 922.900278][ T9387] (null): rxe_set_mtu: Set mtu to 1024 [ 923.431231][ T9398] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 923.668281][ T9387] infiniband syz0: set active [ 923.684802][ T9398] overlayfs: failed to look up (tracing) for ino (-66) [ 923.708035][ T9387] infiniband syz0: added bond0 [ 923.783515][ T9387] syz0: rxe_create_cq: returned err = -12 [ 923.816263][ T9387] infiniband syz0: Couldn't create ib_mad CQ [ 923.844362][ T9387] infiniband syz0: Couldn't open port 1 [ 923.859235][ T9358] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 924.006464][ T9387] RDS/IB: syz0: added [ 924.014052][ T9387] smc: adding ib device syz0 with port count 1 [ 924.035065][ T9387] smc: ib device syz0 port 1 has pnetid [ 924.098476][ T9392] Bluetooth: hci4: Frame reassembly failed (-84) [ 924.730826][ T28] usbhid 1-1:0.0: can't add hid device: -71 [ 924.744798][ T28] usbhid: probe of 1-1:0.0 failed with error -71 [ 924.786413][ T28] usb 1-1: USB disconnect, device number 3 [ 925.162155][ T9420] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 925.661512][ T9427] tipc: Started in network mode [ 925.666721][ T9427] tipc: Node identity ac14140f, cluster identity 4711 [ 925.680243][ T9427] tipc: New replicast peer: 255.255.255.255 [ 925.688525][ T9427] tipc: Enabled bearer , priority 10 [ 925.905903][ T9434] netlink: 4 bytes leftover after parsing attributes in process `syz.0.944'. [ 926.103356][ T5818] Bluetooth: hci4: command 0x1003 tx timeout [ 926.113041][ T8927] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 926.390343][ T9449] mmap: syz.3.952 (9449) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 926.808321][ T5750] tipc: Node number set to 2886997007 [ 927.034701][ T9457] process 'syz.2.953' launched '/dev/fd/-1/./file2' with NULL argv: empty string added [ 928.384093][ T9465] bridge1: entered promiscuous mode [ 928.423922][ T9465] bridge1: entered allmulticast mode [ 928.698762][ T9469] block device autoloading is deprecated and will be removed. [ 929.262991][ T9473] nvmet: adding nsid 1 to subsystem testsubsys [ 929.565051][ T9475] input: PS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input5 [ 929.859432][ T172] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 929.927427][ T9491] netlink: 12 bytes leftover after parsing attributes in process `syz.2.967'. [ 930.082854][ T172] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 930.109275][ T172] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 930.139606][ T172] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 930.167892][ T172] usb 4-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 930.194155][ T172] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 930.245557][ T9481] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 930.279207][ T9481] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 930.295842][ T172] pl2303 4-1:1.0: pl2303 converter detected [ 930.367367][ T172] usb 4-1: pl2303 converter now attached to ttyUSB0 [ 930.679562][ T9475] pl2303 4-1:1.0: pl2303_vendor_write - failed to write [0007]: -110 [ 930.701246][ T9475] pl2303 ttyUSB0: pl2303_get_line_request - failed: -32 [ 930.715434][ T9475] pl2303 ttyUSB0: pl2303_set_line_request - failed: -32 [ 930.760157][ T9475] pl2303 4-1:1.0: pl2303_vendor_read - failed to read [000a]: -32 [ 930.780592][ T9475] pl2303 ttyUSB0: pl2303_set_control_lines - failed: -32 [ 930.902129][ T9503] netlink: 'syz.1.972': attribute type 2 has an invalid length. [ 930.910463][ T9503] netlink: 224 bytes leftover after parsing attributes in process `syz.1.972'. [ 931.950215][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.956728][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.353978][ T9511] netlink: 'syz.2.975': attribute type 10 has an invalid length. [ 932.380006][ T9511] netlink: 40 bytes leftover after parsing attributes in process `syz.2.975'. [ 932.399329][ T9511] dummy0: entered promiscuous mode [ 932.425491][ T9511] bridge0: port 3(dummy0) entered blocking state [ 932.456591][ T9511] bridge0: port 3(dummy0) entered disabled state [ 932.489640][ T9511] dummy0: entered allmulticast mode [ 932.510729][ T9511] bridge0: port 3(dummy0) entered blocking state [ 932.517321][ T9511] bridge0: port 3(dummy0) entered forwarding state [ 932.620888][ T9474] pl2303 ttyUSB0: pl2303_set_control_lines - failed: -32 [ 932.661230][ T9474] pl2303 ttyUSB0: error sending break = -32 [ 932.696092][ T23] usb 4-1: USB disconnect, device number 3 [ 932.730715][ T23] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 932.740902][ T23] pl2303 4-1:1.0: device disconnected [ 933.356762][ T9539] netlink: 28 bytes leftover after parsing attributes in process `syz.2.985'. [ 933.366734][ T9539] netlink: 28 bytes leftover after parsing attributes in process `syz.2.985'. [ 933.836871][ T9545] IPVS: sync thread started: state = MASTER, mcast_ifn = wg1, syncid = 4, id = 0 [ 933.898289][ T9546] netlink: 'syz.3.987': attribute type 10 has an invalid length. [ 933.939384][ T9546] netlink: 40 bytes leftover after parsing attributes in process `syz.3.987'. [ 933.948353][ T9546] dummy0: entered promiscuous mode [ 933.979573][ T9546] bridge0: port 3(dummy0) entered blocking state [ 933.986298][ T9546] bridge0: port 3(dummy0) entered disabled state [ 933.994416][ T9546] dummy0: entered allmulticast mode [ 934.002083][ T9546] bridge0: port 3(dummy0) entered blocking state [ 934.008667][ T9546] bridge0: port 3(dummy0) entered forwarding state [ 935.019603][ T9568] netlink: 'syz.1.997': attribute type 10 has an invalid length. [ 935.046567][ T9568] netlink: 40 bytes leftover after parsing attributes in process `syz.1.997'. [ 936.069918][ T9595] netlink: 'syz.3.1008': attribute type 10 has an invalid length. [ 936.094902][ T9595] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1008'. [ 936.294463][ T9603] ================================================================== [ 936.294478][ T9603] BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x2114/0x25d0 [ 936.294537][ T9603] Write of size 4 at addr ffffc900043b9fe8 by task syz.3.1011/9603 [ 936.294557][ T9603] [ 936.294563][ T9603] CPU: 1 PID: 9603 Comm: syz.3.1011 Not tainted syzkaller #0 [ 936.294585][ T9603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 936.294597][ T9603] Call Trace: [ 936.294606][ T9603] [ 936.294614][ T9603] dump_stack_lvl+0x18c/0x250 [ 936.294641][ T9603] ? sys_imageblit+0x2114/0x25d0 [ 936.294663][ T9603] ? show_regs_print_info+0x20/0x20 [ 936.294688][ T9603] ? load_image+0x420/0x420 [ 936.294714][ T9603] print_report+0xa8/0x210 [ 936.294747][ T9603] ? sys_imageblit+0x2114/0x25d0 [ 936.294766][ T9603] kasan_report+0x117/0x150 [ 936.294794][ T9603] ? sys_imageblit+0x2114/0x25d0 [ 936.294818][ T9603] sys_imageblit+0x2114/0x25d0 [ 936.294847][ T9603] ? sys_copyarea+0x2530/0x2530 [ 936.294870][ T9603] ? try_to_wake_up+0x6c3/0x10e0 [ 936.294896][ T9603] drm_fbdev_generic_defio_imageblit+0x2c/0x110 [ 936.294945][ T9603] cw_putcs+0x15f3/0x18a0 [ 936.294995][ T9603] ? cw_clear+0x250/0x250 [ 936.295028][ T9603] ? drm_fb_helper_set_suspend_unlocked+0x190/0x190 [ 936.295057][ T9603] ? fb_get_color_depth+0x162/0x280 [ 936.295084][ T9603] fbcon_putcs+0x35c/0x520 [ 936.295113][ T9603] ? cw_clear+0x250/0x250 [ 936.295144][ T9603] do_update_region+0x4e9/0x640 [ 936.295181][ T9603] ? __asan_memcpy+0x40/0x70 [ 936.295216][ T9603] ? hide_cursor+0x320/0x320 [ 936.295253][ T9603] redraw_screen+0xa30/0x1000 [ 936.295278][ T9603] ? _raw_spin_unlock+0x40/0x40 [ 936.295302][ T9603] ? slab_free_freelist_hook+0x130/0x1a0 [ 936.295325][ T9603] ? clear_buffer_attributes+0x320/0x320 [ 936.295354][ T9603] ? tty_do_resize+0xe1/0x120 [ 936.295383][ T9603] vc_do_resize+0x1256/0x17f0 [ 936.295422][ T9603] ? vc_resize+0x50/0x50 [ 936.295447][ T9603] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 936.295474][ T9603] ? lockdep_hardirqs_on+0x98/0x150 [ 936.295505][ T9603] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 936.295534][ T9603] fbcon_do_set_font+0xb5c/0x1ae0 [ 936.295575][ T9603] ? fbcon_blank+0xb40/0xb40 [ 936.295603][ T9603] con_font_op+0xc3c/0xf60 [ 936.295634][ T9603] ? reset_palette+0xdd0/0xdd0 [ 936.295665][ T9603] ? __might_fault+0xaa/0x120 [ 936.295688][ T9603] ? __lock_acquire+0x7d80/0x7d80 [ 936.295713][ T9603] ? apparmor_capable+0x137/0x1a0 [ 936.295736][ T9603] ? __might_fault+0xaa/0x120 [ 936.295757][ T9603] ? __might_fault+0xc6/0x120 [ 936.295778][ T9603] ? __might_fault+0xaa/0x120 [ 936.295803][ T9603] vt_ioctl+0x1a21/0x1f20 [ 936.295836][ T9603] ? __vt_event_wait+0x260/0x260 [ 936.295872][ T9603] ? __fget_files+0x28/0x460 [ 936.295903][ T9603] ? tty_jobctrl_ioctl+0x378/0xba0 [ 936.295931][ T9603] tty_ioctl+0x91e/0xdc0 [ 936.295957][ T9603] ? tty_get_icount+0xb0/0xb0 [ 936.295983][ T9603] __se_sys_ioctl+0xfd/0x170 [ 936.296012][ T9603] do_syscall_64+0x55/0xb0 [ 936.296036][ T9603] ? clear_bhb_loop+0x40/0x90 [ 936.296061][ T9603] ? clear_bhb_loop+0x40/0x90 [ 936.296087][ T9603] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 936.296112][ T9603] RIP: 0033:0x7f1ac699e159 [ 936.296131][ T9603] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 936.296149][ T9603] RSP: 002b:00007f1ac4bf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 936.296173][ T9603] RAX: ffffffffffffffda RBX: 00007f1ac6c25fa0 RCX: 00007f1ac699e159 [ 936.296190][ T9603] RDX: 0000200000000180 RSI: 0000000000004b72 RDI: 0000000000000003 [ 936.296205][ T9603] RBP: 00007f1ac6a35024 R08: 0000000000000000 R09: 0000000000000000 [ 936.296226][ T9603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 936.296240][ T9603] R13: 00007f1ac6c26038 R14: 00007f1ac6c25fa0 R15: 00007ffd213895e8 [ 936.296264][ T9603] [ 936.296272][ T9603] [ 936.296276][ T9603] The buggy address belongs to a 0-page vmalloc region starting at 0xffffc900043ba000 allocated at drm_gem_shmem_vmap+0x3c4/0x650 [ 936.296317][ T9603] Memory state around the buggy address: [ 936.296328][ T9603] ffffc900043b9e80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 936.296342][ T9603] ffffc900043b9f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 936.296355][ T9603] >ffffc900043b9f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 936.296367][ T9603] ^ [ 936.296379][ T9603] ffffc900043ba000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 936.296394][ T9603] ffffc900043ba080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 936.296404][ T9603] ================================================================== [ 936.296424][ T9603] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 936.296434][ T9603] CPU: 1 PID: 9603 Comm: syz.3.1011 Not tainted syzkaller #0 [ 936.296456][ T9603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 936.296468][ T9603] Call Trace: [ 936.296475][ T9603] [ 936.296483][ T9603] dump_stack_lvl+0x18c/0x250 [ 936.296510][ T9603] ? show_regs_print_info+0x20/0x20 [ 936.296535][ T9603] ? load_image+0x420/0x420 [ 936.296562][ T9603] panic+0x2ca/0x720 [ 936.296592][ T9603] ? lock_chain_count+0x20/0x20 [ 936.296617][ T9603] ? bpf_jit_dump+0xd0/0xd0 [ 936.296646][ T9603] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 936.296667][ T9603] ? lockdep_hardirqs_on+0x98/0x150 [ 936.296698][ T9603] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 936.296720][ T9603] ? _raw_spin_unlock+0x40/0x40 [ 936.296740][ T9603] ? print_memory_metadata+0x314/0x400 [ 936.296765][ T9603] ? sys_imageblit+0x2114/0x25d0 [ 936.296783][ T9603] check_panic_on_warn+0x84/0xa0 [ 936.296811][ T9603] ? sys_imageblit+0x2114/0x25d0 [ 936.296830][ T9603] end_report+0x6f/0x130 [ 936.296856][ T9603] kasan_report+0x128/0x150 [ 936.296882][ T9603] ? sys_imageblit+0x2114/0x25d0 [ 936.296906][ T9603] sys_imageblit+0x2114/0x25d0 [ 936.296933][ T9603] ? sys_copyarea+0x2530/0x2530 [ 936.296956][ T9603] ? try_to_wake_up+0x6c3/0x10e0 [ 936.296981][ T9603] drm_fbdev_generic_defio_imageblit+0x2c/0x110 [ 936.297010][ T9603] cw_putcs+0x15f3/0x18a0 [ 936.297058][ T9603] ? cw_clear+0x250/0x250 [ 936.297091][ T9603] ? drm_fb_helper_set_suspend_unlocked+0x190/0x190 [ 936.297119][ T9603] ? fb_get_color_depth+0x162/0x280 [ 936.297146][ T9603] fbcon_putcs+0x35c/0x520 [ 936.297175][ T9603] ? cw_clear+0x250/0x250 [ 936.297205][ T9603] do_update_region+0x4e9/0x640 [ 936.297237][ T9603] ? __asan_memcpy+0x40/0x70 [ 936.297272][ T9603] ? hide_cursor+0x320/0x320 [ 936.297302][ T9603] redraw_screen+0xa30/0x1000 [ 936.297327][ T9603] ? _raw_spin_unlock+0x40/0x40 [ 936.297350][ T9603] ? slab_free_freelist_hook+0x130/0x1a0 [ 936.297373][ T9603] ? clear_buffer_attributes+0x320/0x320 [ 936.297401][ T9603] ? tty_do_resize+0xe1/0x120 [ 936.297428][ T9603] vc_do_resize+0x1256/0x17f0 [ 936.297467][ T9603] ? vc_resize+0x50/0x50 [ 936.297492][ T9603] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 936.297518][ T9603] ? lockdep_hardirqs_on+0x98/0x150 [ 936.297549][ T9603] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 936.297578][ T9603] fbcon_do_set_font+0xb5c/0x1ae0 [ 936.297619][ T9603] ? fbcon_blank+0xb40/0xb40 [ 936.297646][ T9603] con_font_op+0xc3c/0xf60 [ 936.297676][ T9603] ? reset_palette+0xdd0/0xdd0 [ 936.297707][ T9603] ? __might_fault+0xaa/0x120 [ 936.297732][ T9603] ? __lock_acquire+0x7d80/0x7d80 [ 936.297757][ T9603] ? apparmor_capable+0x137/0x1a0 [ 936.297778][ T9603] ? __might_fault+0xaa/0x120 [ 936.297799][ T9603] ? __might_fault+0xc6/0x120 [ 936.297819][ T9603] ? __might_fault+0xaa/0x120 [ 936.297844][ T9603] vt_ioctl+0x1a21/0x1f20 [ 936.297876][ T9603] ? __vt_event_wait+0x260/0x260 [ 936.297912][ T9603] ? __fget_files+0x28/0x460 [ 936.297944][ T9603] ? tty_jobctrl_ioctl+0x378/0xba0 [ 936.297970][ T9603] tty_ioctl+0x91e/0xdc0 [ 936.297997][ T9603] ? tty_get_icount+0xb0/0xb0 [ 936.298022][ T9603] __se_sys_ioctl+0xfd/0x170 [ 936.298052][ T9603] do_syscall_64+0x55/0xb0 [ 936.298075][ T9603] ? clear_bhb_loop+0x40/0x90 [ 936.298099][ T9603] ? clear_bhb_loop+0x40/0x90 [ 936.298124][ T9603] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 936.298149][ T9603] RIP: 0033:0x7f1ac699e159 [ 936.298166][ T9603] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 936.298185][ T9603] RSP: 002b:00007f1ac4bf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 936.298207][ T9603] RAX: ffffffffffffffda RBX: 00007f1ac6c25fa0 RCX: 00007f1ac699e159 [ 936.298231][ T9603] RDX: 0000200000000180 RSI: 0000000000004b72 RDI: 0000000000000003 [ 936.298245][ T9603] RBP: 00007f1ac6a35024 R08: 0000000000000000 R09: 0000000000000000 [ 936.298259][ T9603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 936.298272][ T9603] R13: 00007f1ac6c26038 R14: 00007f1ac6c25fa0 R15: 00007ffd213895e8 [ 936.298296][ T9603] [ 936.298890][ T9603] Kernel Offset: disabled