last executing test programs: 3m7.160716235s ago: executing program 4 (id=178): syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f00000019c0)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001a00)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000001a40)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001ac0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000001b00)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000001b80), 0x651, 0x0) fcntl$lock(0xffffffffffffffff, 0x26, 0x0) recvmmsg(r0, &(0x7f0000001bc0), 0x4000087, 0x2, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x1) unshare(0x2020600) unshare(0x2020600) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r2 = add_key$keyring(&(0x7f0000001c00), &(0x7f0000001c40)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) r3 = add_key(&(0x7f0000001c80)='keyring\x00', &(0x7f0000001cc0)={'syz', 0x0}, 0x0, 0x0, r2) r4 = add_key(&(0x7f0000001d00)='asymmetric\x00', 0x0, &(0x7f0000001d40)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r3) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000022c0)={r4, 0x137}, &(0x7f0000002300)=ANY=[], &(0x7f0000002340)="929835e740d6a600000000000000010100000002000040", 0x0) 3m4.105636079s ago: executing program 4 (id=188): arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0x3) r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x8, 0x4, &(0x7f0000000640)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x1000000, 0x73, 0x11, 0x31}, [@ldst={0x6, 0x2}], {0x95, 0x0, 0x74}}, &(0x7f0000000680)='GPL\x00', 0x2, 0xfd90, &(0x7f00000006c0)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x48) pipe2(&(0x7f0000000080)={0x0, 0x0}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0xe41, 0x4142, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x1, 0xc0, 0x10, {0x8, 0xb, 0x0, 0x2, 0x1, 0x21, 0x30, 0x7}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x8, 0xa, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x9, 0xd4, 0x87, {0xa, 0x25, 0x25, 0x0, 0x1, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x210, 0xfa, 0x4, 0x4, {0xa, 0x25, 0x25, 0x80000000, 0x5, 0x9}}}}}}}}]}}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x2) sched_setscheduler(r3, 0x1, &(0x7f0000000240)=0x7) syz_emit_ethernet(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2b8f5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000340), 0x651, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000380)='./bus\x00', 0x0, 0x400) recvmmsg(r4, &(0x7f00000003c0), 0x4000087, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) creat(&(0x7f0000000440)='./bus\x00', 0x0) socket$pppl2tp(0x18, 0x1, 0x1) pipe(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r7, 0x0, 0x8000f28, 0x8) splice(r6, 0x0, r1, 0x0, 0x6, 0xb) close_range(r1, 0xffffffffffffffff, 0x0) sendmsg$nl_route(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[], 0x7c}}, 0x90) 2m59.590243291s ago: executing program 4 (id=198): syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f00000019c0)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001a00)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000001a40)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001ac0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000001b00)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000001b80), 0x651, 0x0) fcntl$lock(0xffffffffffffffff, 0x26, 0x0) recvmmsg(r0, &(0x7f0000001bc0), 0x4000087, 0x2, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x1) unshare(0x2020600) unshare(0x2020600) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r2 = add_key$keyring(&(0x7f0000001c00), &(0x7f0000001c40)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) r3 = add_key(&(0x7f0000001c80)='keyring\x00', &(0x7f0000001cc0)={'syz', 0x0}, 0x0, 0x0, r2) r4 = add_key(&(0x7f0000001d00)='asymmetric\x00', 0x0, &(0x7f0000001d40)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r3) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000022c0)={r4, 0x137}, &(0x7f0000002300)=ANY=[], &(0x7f0000002340)="929835e740d6a600000000000000010100000002000040", 0x0) 2m57.835808171s ago: executing program 4 (id=206): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0xe, &(0x7f0000000080), 0x1, 0x457, &(0x7f00000000c0)="$eJzs281rXFUbAPDnziTtm368SUv96IcarWLxI2nSWrtwoyi4UBB0UZcxSUvttJEmgi1Bo0hdSsG9uBT8C1zpRtSV4Fb3UiiSTasgjNyZe5OZycw0aWYysfP7wSTnzD2Tc56595k5957cAPrWaPojidgTEb9FxHC1Wt9gtPrr9vLi9F/Li9NJlMtv/plU2t1aXpzOm+av251XBiIKnyZxuEm/81euXpgqlWYvZ/XxhYvvjc9fufrs+YtT52bPzV6aPH365ImJ509NPteRONO4bh36cO7IwVffvv769Jnr7/z0TZLH3xBHh4y22/hEudzh7nprb005GejhQNiQYjVNY7CS/8NRjNWdNxyvfNLTwQFdVS6Xy/e32vhPLJWBe1gSvR4B0Bv5V316/ps/tmzysQ3cfLF6ApTGfTt7VLcMRCFrM9hwfttJoxFxZunvL9NHdOc6BABAne/S+c8zzeZ/hai9LvT/bA1lJCL2RcT+iDgVEQci4r6IStsHIuLBDfbfuEiydv5TuLH2VcUN9tJaOv97IVvbqp//5bO/GClmtb2V+AeTs+dLs8ez9+RYDO5M6xNt+vj+5V8/b7WtOv9L/3p1Dpj2n88Fs3HcGNhZ/5qZqYWpzcRc6+bHEYcGmsWfrKwEJBFxMCIO3WUf55/6+kirbbXz3+bxt9GBdabyVxFPVvf/UjTEn0var0+O/y9Ks8fH86NirZ9/ufZGq/43FX8HpPt/V9PjfyX+kaR2vXZ+431c+/2zluc0d46/+fG/I3mr7rkPphYWLk9E7Eheqw669vnJhnaTq+3T+I8dbZ7/+2P1nTgcEelB/FBEPBwRj2RjfzQiHouIo23i//Glx9+9+/i7K41/ZkP7f6WQZ1+TTfWF4oUfvq3rdGS1uL79f7JSOpY9s57PvzbDqSts5r0DAACA/4pCROyJpDC2Ui4Uxsaq/8N/IHYVSnPzC0+fnXv/0kz1HoGRGCzkV7qGa66HTmSn9Xl9sqF+Irtu/EVxqFIfm54rzfQ6eOhzu1vkf+qPzi2zANtV3TqapIe+4n5N6F/yH/qX/If+1ST/h3oxDmDrNfv+/6gH4wC2XkP+r28FYF93xgJsLef/0L/kP/Qv+Q99aX4o7nyTfGcKS9H1LloUhiJiyzu91wtR2BbDUOhSodefTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ3xbwAAAP//daHg9Q==") unlinkat(0xffffffffffffff9c, &(0x7f0000000580)='./file1\x00', 0x0) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000540)={0x2, 0x0, @initdev}, &(0x7f0000000640)=0x10) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001980)={0x6, 0x1f, &(0x7f00000006c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0xee71}, {}, {}, [@jmp={0x5, 0x0, 0x3, 0x2, 0x6, 0xffffffffffffffe0}, @printk={@ld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xffffffff}}, @alu={0x7, 0x1, 0x7, 0x4, 0x2, 0xfffffffffffffff8, 0x4}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2a6c3b76}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000007c0)='GPL\x00', 0x8, 0x1000, &(0x7f0000000800)=""/4096, 0x41000, 0x20, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000001800)={0x6, 0x2}, 0x8, 0x10, &(0x7f0000001840)={0x1, 0x0, 0x2, 0x1}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000001880)=[0xffffffffffffffff, 0xffffffffffffffff], &(0x7f00000018c0)=[{0x5, 0x1, 0x5}, {0x2, 0x3, 0xc, 0x9}, {0x0, 0x1, 0x2, 0x9}, {0x5, 0x3, 0xb, 0x1}, {0x1, 0x4, 0xf, 0x5}, {0x2, 0x2, 0x10, 0xc}, {0x2, 0x2, 0xe, 0x9}, {0x3, 0x3, 0x10, 0x9}, {0x3, 0x4, 0xa, 0xb}]}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000002d40)={0x16, 0x39, &(0x7f0000001a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x3}, {}, {}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x3}, @jmp={0x5, 0x0, 0xc, 0x8, 0xa, 0x80}, @printk={@s, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x60}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}, @btf_id={0x18, 0x0, 0x3, 0x0, 0x3}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x800}}, @map_val={0x18, 0xa, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x40}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffff8}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001c40)='GPL\x00', 0xf, 0x1000, &(0x7f0000001c80)=""/4096, 0x41000, 0x14, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000002c80)={0x0, 0x4, 0x1ff, 0x4}, 0x10, 0x0, 0xffffffffffffffff, 0x2, &(0x7f0000002cc0)=[0x1], &(0x7f0000002d00)=[{0x2, 0x2, 0x6, 0x3}, {0x3, 0x5, 0x10, 0x1}], 0x10, 0x9}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000002f00)={@cgroup, 0x20, 0x1, 0x7, &(0x7f0000002e00)=[0x0], 0x1, 0x0, &(0x7f0000002e40)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000002e80)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000002ec0)=[0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) r4 = openat$cgroup(0xffffffffffffffff, &(0x7f0000002f80)='syz0\x00', 0x200002, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000002fc0), 0x200, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000002f40)={@cgroup=r4, r1, 0x2a, 0x19, r2, @void, @value=r5, @void, @void, r3}, 0x20) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000680)={'veth1_virt_wifi\x00'}) pwritev2(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000600)="ff", 0xfdef}], 0x1, 0xe7b, 0x0, 0x0) syz_clone(0xa0248200, 0x0, 0x2cb916acd376029b, 0xffffffffffffffff, 0x0, 0x0) 2m57.814724253s ago: executing program 4 (id=207): arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0x3) r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x8, 0x4, &(0x7f0000000640)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x1000000, 0x73, 0x11, 0x31}, [@ldst={0x6, 0x2}], {0x95, 0x0, 0x74}}, &(0x7f0000000680)='GPL\x00', 0x2, 0xfd90, &(0x7f00000006c0)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x48) pipe2(&(0x7f0000000080)={0x0, 0x0}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0xe41, 0x4142, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x1, 0xc0, 0x10, {0x8, 0xb, 0x0, 0x2, 0x1, 0x21, 0x30, 0x7}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x8, 0xa, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x9, 0xd4, 0x87, {0xa, 0x25, 0x25, 0x0, 0x1, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x210, 0xfa, 0x4, 0x4, {0xa, 0x25, 0x25, 0x80000000, 0x5, 0x9}}}}}}}}]}}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x2) sched_setscheduler(r3, 0x1, &(0x7f0000000240)=0x7) syz_emit_ethernet(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2b8f5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000340), 0x651, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000380)='./bus\x00', 0x0, 0x400) recvmmsg(r4, &(0x7f00000003c0), 0x4000087, 0x2, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) pipe(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r7, 0x0, 0x8000f28, 0x8) splice(r6, 0x0, r1, 0x0, 0x6, 0xb) close_range(r1, 0xffffffffffffffff, 0x0) sendmsg$nl_route(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[], 0x7c}}, 0x90) 2m57.335820922s ago: executing program 4 (id=210): r0 = bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(r0, 0xf505, 0x0) gettid() mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8003, 0xc, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000540)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000580)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000005c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000600)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000680)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000700), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000740)=0x2) recvmmsg(r2, &(0x7f0000000780), 0x80002c1, 0x2, 0x0) syz_mount_image$erofs(&(0x7f00000007c0), &(0x7f0000000800)='./file0\x00', 0x2800091, &(0x7f0000000840)=ANY=[@ANYRESHEX=r1, @ANYBLOB="333ed5fca4fdc9da41dc5525a31e2eabcdf2226f58d7bbdaa080715a87526444f694c24bc9dcde8d7b23b254e1004eca8b8da13ab3013dd83f54c309d8aa225fc6f134488184e57f6d604e614457290fd158133e36ecff45f77a818df131c24d37d26a6d12c3debf91a303efb00be5c781ee1406efd1e6e194a04db64a13f8c019f54bcb0fc4d3b629670d76e9512b4a630436da7310", @ANYRES16=r3, @ANYBLOB="02dd6978c96a2adcd17b480dd7c95c793b4c3be399f57b497b531994c112687c918c6e8c0326cffd60614f831132734e3bc3574ba75f3f65eca668ed794c084e2aa5fb14bd52b629cf6c5128edf2ac06bdb32c563e7b045227688acf051b738ffbfb1d559489c90916160ad2558ccf6d04f1", @ANYRES8=r3, @ANYBLOB="7c0d13adf1802c70660fac916aeeb8caf1ec7ba19f6ee9fad7ac7a0211a45ecaacd3e86bdaec45c440f6f27b637740c978b53bbe25c2760bc7a87aedeb777f5584770a8095a8c606976895f9e84e2e20c645d2"], 0x52, 0x1be, &(0x7f0000001900)="$eJzsmDFv2lAUhc+zjS1XlejaLq1UJOhQY5u2KkMH1LFDK7Vq1Q1UXERrSgUegKn9A107d+6QGWXhfyRDkilDki1TpDh69jN+ITgRAiGk3G+4Pva7PB9f4CABgiBuLQf7p3tbxYLJ9V0UYIjrh2rao0j94/zZk5322+2/9snuePKmOrOdvuj9NQCTmopAnIdhGMrrBXH8ACXROdTT9U9gsISuQ8FHoT0wfBb6m6S7vN+yvrZ9z/rS9Ztc2Lw4vLi8VGb9Hf9maEr+mLTeH46+N3zf6y0vXnPb85ayZmck/moKXkn+5PcrmY2dzg8OFDhCV8DwXuiXMJLZxCORnv+Blu6vLvn8fH4rm9rGi/v5G3py2BSrGyvMNFnWeXfxRf+10KsYuDgy12t1VeK/CaxmwzQ/w38MRSmfNCk/ykHnZ7k/HD1tdxotr+X9cN3KC/uZbT93y1EQxTUrAqHBjPLpznR/Ncxl9OpMx6ARBD0nrtNzd2Ag6LnzEleP8k9B6XHsms35kYs+JvfYI34oqcB5GJNh40/mwxAEQRAEQRAEQRAEQRAEQVzLQzP+l/US1SuX3HdR90UAAAD//2C6a2w=") openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) getpgrp(r1) mount$cgroup(0x0, 0x0, &(0x7f0000003b40), 0x2208000, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000280)=0x6) r5 = io_uring_setup(0x3bde, &(0x7f0000000340)={0x0, 0x5, 0x10, 0x7, 0x135c}) close(r5) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x16, &(0x7f00000009c0)=ANY=[@ANYBLOB="61154c000000000061138c0000000000bfa000000000000007000000080000002d1501000000000095000000000000006916000000000000bf67000000000000350607000fff07206706000003000000160302000ee60060bf350000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dc725f431bcab0ef59b8f0e431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa0100000000000000b93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4ffcae1a8a793a7795a9214a92f66e9cc54db6c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc3086936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61dc18402cde8bf777b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154baa8e51489a614e69722bac30000000000000000000000000000a006b178438e930b2494db1bf624a70a19a45b8b71869afb13cb2ac1d2f3ec0d93a3e4fd0ad076c7d826f218aa6ba8ec5e58b7c64dc8616127087901dc65418a4b25bfa7ae8b5ad9642815f319230425e8bd89c6983d816d97d81a739917eecd26f9a3aecaf0acdaf6cffab38eae3b10b122b4bf521a46bf01a0c136f745113b589459fbe1666087a7c554a55e2b42ab7e405a77f405a348a64e356b7fb61e48ea9c87bf13f97052c51fdd49f3dbccf9874cf61807ae4b1665ccdd026d4580a068395e8cb851eeadb1da6d1009513ca73a685c66fb15f27eb74a7a4eb5966e3ef4be3ca8ba81b2d17d797265390ce616c3d7b566fe956fb93c6a43f4dc6bfc194daeb7b998d550773bc14aca"], &(0x7f0000001100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000001140), 0xffffffffffffffd2}, 0x48) openat$kvm(0xffffffffffffff9c, &(0x7f0000001180), 0x189881, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x8001000000000000, 0x40, &(0x7f00000011c0)=@raw={'raw\x00', 0x8, 0x3, 0x400, 0x260, 0x11, 0x148, 0x0, 0x0, 0x368, 0x2a8, 0x2a8, 0x368, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x218, 0x260, 0x0, {0x0, 0x100000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg1\x00', {0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x7}}}, @common=@inet=@hashlimit2={{0x150}, {'veth1_virt_wifi\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0xffff}}}, {{@ip={@loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 'vlan0\x00', 'macvlan1\x00'}, 0x0, 0xd8, 0x108, 0x0, {}, [@common=@addrtype={{0x30}, {0x90e, 0x1, 0x1, 0x1}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x0, {0xffffffff}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x460) add_key$keyring(&(0x7f0000001640), 0x0, 0x0, 0x0, 0xfffffffffffffff8) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000001680), 0x20182, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000016c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) 2m57.316697584s ago: executing program 32 (id=210): r0 = bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(r0, 0xf505, 0x0) gettid() mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8003, 0xc, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000540)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000580)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000005c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000600)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000680)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000700), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000740)=0x2) recvmmsg(r2, &(0x7f0000000780), 0x80002c1, 0x2, 0x0) syz_mount_image$erofs(&(0x7f00000007c0), &(0x7f0000000800)='./file0\x00', 0x2800091, &(0x7f0000000840)=ANY=[@ANYRESHEX=r1, @ANYBLOB="333ed5fca4fdc9da41dc5525a31e2eabcdf2226f58d7bbdaa080715a87526444f694c24bc9dcde8d7b23b254e1004eca8b8da13ab3013dd83f54c309d8aa225fc6f134488184e57f6d604e614457290fd158133e36ecff45f77a818df131c24d37d26a6d12c3debf91a303efb00be5c781ee1406efd1e6e194a04db64a13f8c019f54bcb0fc4d3b629670d76e9512b4a630436da7310", @ANYRES16=r3, @ANYBLOB="02dd6978c96a2adcd17b480dd7c95c793b4c3be399f57b497b531994c112687c918c6e8c0326cffd60614f831132734e3bc3574ba75f3f65eca668ed794c084e2aa5fb14bd52b629cf6c5128edf2ac06bdb32c563e7b045227688acf051b738ffbfb1d559489c90916160ad2558ccf6d04f1", @ANYRES8=r3, @ANYBLOB="7c0d13adf1802c70660fac916aeeb8caf1ec7ba19f6ee9fad7ac7a0211a45ecaacd3e86bdaec45c440f6f27b637740c978b53bbe25c2760bc7a87aedeb777f5584770a8095a8c606976895f9e84e2e20c645d2"], 0x52, 0x1be, &(0x7f0000001900)="$eJzsmDFv2lAUhc+zjS1XlejaLq1UJOhQY5u2KkMH1LFDK7Vq1Q1UXERrSgUegKn9A107d+6QGWXhfyRDkilDki1TpDh69jN+ITgRAiGk3G+4Pva7PB9f4CABgiBuLQf7p3tbxYLJ9V0UYIjrh2rao0j94/zZk5322+2/9snuePKmOrOdvuj9NQCTmopAnIdhGMrrBXH8ACXROdTT9U9gsISuQ8FHoT0wfBb6m6S7vN+yvrZ9z/rS9Ztc2Lw4vLi8VGb9Hf9maEr+mLTeH46+N3zf6y0vXnPb85ayZmck/moKXkn+5PcrmY2dzg8OFDhCV8DwXuiXMJLZxCORnv+Blu6vLvn8fH4rm9rGi/v5G3py2BSrGyvMNFnWeXfxRf+10KsYuDgy12t1VeK/CaxmwzQ/w38MRSmfNCk/ykHnZ7k/HD1tdxotr+X9cN3KC/uZbT93y1EQxTUrAqHBjPLpznR/Ncxl9OpMx6ARBD0nrtNzd2Ag6LnzEleP8k9B6XHsms35kYs+JvfYI34oqcB5GJNh40/mwxAEQRAEQRAEQRAEQRAEQVzLQzP+l/US1SuX3HdR90UAAAD//2C6a2w=") openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) getpgrp(r1) mount$cgroup(0x0, 0x0, &(0x7f0000003b40), 0x2208000, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000280)=0x6) r5 = io_uring_setup(0x3bde, &(0x7f0000000340)={0x0, 0x5, 0x10, 0x7, 0x135c}) close(r5) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x16, &(0x7f00000009c0)=ANY=[@ANYBLOB="61154c000000000061138c0000000000bfa000000000000007000000080000002d1501000000000095000000000000006916000000000000bf67000000000000350607000fff07206706000003000000160302000ee60060bf350000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dc725f431bcab0ef59b8f0e431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa0100000000000000b93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4ffcae1a8a793a7795a9214a92f66e9cc54db6c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc3086936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61dc18402cde8bf777b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154baa8e51489a614e69722bac30000000000000000000000000000a006b178438e930b2494db1bf624a70a19a45b8b71869afb13cb2ac1d2f3ec0d93a3e4fd0ad076c7d826f218aa6ba8ec5e58b7c64dc8616127087901dc65418a4b25bfa7ae8b5ad9642815f319230425e8bd89c6983d816d97d81a739917eecd26f9a3aecaf0acdaf6cffab38eae3b10b122b4bf521a46bf01a0c136f745113b589459fbe1666087a7c554a55e2b42ab7e405a77f405a348a64e356b7fb61e48ea9c87bf13f97052c51fdd49f3dbccf9874cf61807ae4b1665ccdd026d4580a068395e8cb851eeadb1da6d1009513ca73a685c66fb15f27eb74a7a4eb5966e3ef4be3ca8ba81b2d17d797265390ce616c3d7b566fe956fb93c6a43f4dc6bfc194daeb7b998d550773bc14aca"], &(0x7f0000001100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000001140), 0xffffffffffffffd2}, 0x48) openat$kvm(0xffffffffffffff9c, &(0x7f0000001180), 0x189881, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x8001000000000000, 0x40, &(0x7f00000011c0)=@raw={'raw\x00', 0x8, 0x3, 0x400, 0x260, 0x11, 0x148, 0x0, 0x0, 0x368, 0x2a8, 0x2a8, 0x368, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x218, 0x260, 0x0, {0x0, 0x100000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg1\x00', {0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x7}}}, @common=@inet=@hashlimit2={{0x150}, {'veth1_virt_wifi\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0xffff}}}, {{@ip={@loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 'vlan0\x00', 'macvlan1\x00'}, 0x0, 0xd8, 0x108, 0x0, {}, [@common=@addrtype={{0x30}, {0x90e, 0x1, 0x1, 0x1}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x0, {0xffffffff}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x460) add_key$keyring(&(0x7f0000001640), 0x0, 0x0, 0x0, 0xfffffffffffffff8) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000001680), 0x20182, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000016c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) 1m9.624958477s ago: executing program 1 (id=798): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x80, 0x4) close(0x3) socket$vsock_stream(0x28, 0x1, 0x0) sendto$packet(r0, 0x0, 0x0, 0x15, 0x0, 0x0) 1m9.512090059s ago: executing program 1 (id=800): r0 = creat(&(0x7f0000000080)='./file0\x00', 0xc7) close(r0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000), 0x101000, 0x800, 0x3, 0x1}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x13, 0x10, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0xf, &(0x7f00000004c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x40}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000540)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f00000003c0)=0x800, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'veth1_to_batadv\x00', 0x0}) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000200)=0x20, 0x4) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) syz_clone3(&(0x7f0000000340)={0x901400, &(0x7f0000000580)=0xffffffffffffffff, 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, 0x0}, 0x58) ppoll(&(0x7f00000005c0)=[{r5, 0x40}], 0x1, 0x0, 0x0, 0x0) bind$xdp(r1, &(0x7f00000001c0)={0x2c, 0x8, r4}, 0x10) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x4440, &(0x7f0000000700)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) write$P9_RSETATTR(r0, 0x0, 0x0) 1m9.290059391s ago: executing program 1 (id=801): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50) socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x7) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000280)=0x2, 0x4) sendmmsg$inet6(r0, &(0x7f00000002c0)=[{{&(0x7f0000000300)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='$\x00\x00\x00\x00\x00\x00\x00)\x00\x00\x002'], 0x28}}], 0x1, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, &(0x7f0000000380)=0x79cf, 0x4) recvfrom$inet6(r0, 0x0, 0x0, 0x10000, &(0x7f00000003c0)={0xa, 0x4e21, 0x9, @private0, 0x23}, 0x1c) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) open(&(0x7f00000001c0)='.\x00', 0x8000, 0x50) socket$nl_route(0x10, 0x3, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x1, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000640)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000006c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000700)=0x0) r2 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r2, r1, &(0x7f0000000740)={0x0, 0x3d27, 0x500, 0x3, 0xf3}, &(0x7f0000000b80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe703, 0x0, 0x3, 0x40092}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4519, 0x8, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7333, 0x8000, 0x40040085, 0xe6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x24b3, 0x1, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 1m9.221226969s ago: executing program 1 (id=802): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) recvmsg$unix(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)=""/195, 0xc3}], 0x1}, 0x2000) syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000300)='./file0\x00', 0x1808003, &(0x7f0000000340)={[], [{@seclabel}]}, 0x3, 0x523, &(0x7f0000000380)="$eJzs3d9rHFsdAPDvTLJpcm9qctWH6wXvDaL0XrSb5MZ7G3xoK4g+Va0VfIwx2YSQTTbkR9uEIik+iyCioi/65IvgHyBI/wQRCvpeRJSibX3woXZldmfTZLubpt7dbJt8PnA6Z87OzPmeaefsnpnpTACn1lhEXI6Ivoh4LyJG8vI0T7FbT9lyDx/cmstSEtXqtX8mkeRljW0l+fT1fLXBiPjW1yK+lyT1gn02tneWZ8vl0no+P765sja+sb1zfmlldrG0WFqdmpr8cPrC9AfTEx1r68Wv/O2nP/rNVy/+4Qs37s38493vZ/EO55/tb0cn1fdJobYvGvojYr0blfVAX/7vpHCUhZPuxwMAwOGy324fj4jPRMSjX/Q6GgAAAKAbqpeG43ESUX3W17+RLwIAAAC82tLaPbBJWszvBRiONC0W6/fwfjIuRbmysfn5hcrW6nz9XtnRKKQLS+XSRH6v8GgUkmx+spZ/Ov9+0/xURLwRET8ZGarNF+cq5flen/wAAACAUyIb5w+n9Xw2+fdImhYHeh0VAAAA0HGjvQ4AAAAA6DrjfwAAADj5nh3/j9UnSf/xBwMAAAB02jevXMlStfH+6/nr21vLlevn50sby8WVrbniXGV9rbhYqSzWntm3Ul+rEBFnWm6vXKmsfTFWt242niGwM7NS2VrdnKm913umdKT3RAMAAAAd9cY7d/6SRMTul4ZqKdMYuhurw8mWvtjiSbfiAI5f35ELgZPGDb5wejn+gWcG9k0dw+AxxgIAAHTHuU/tXf8fin3X/8/ec/0fTroXvP4PnCAu9cPp1XSa/1dHWulxtTvBAMfKGB943nmAttf//9j5WAAAgO4YrqUkLeZjgOFI02Ix4mzttQCFZGGpXJqIiI9FxJ9HCmey+cleBw0AAAAAAAAAAAAAAAAAAAAAAAAAr5hqNYkqAAAAcKJFpH9PIiKJwYiRzw43nx8YSP4zUptGxI1fXvvZzdnNzfXJrPxfe+WbP8/L3+/FGQwAAACgWWOc3hjHAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAnPXxwa66R9hV/rtv13v9yRIy2qr8/BmvTwShExGuPkujft14SEX0dqH/3dkS82ar+JAsrRvMomutPI2Kox/W/3oH64TS7k/U/l1sdf2mM1aatj7/+PH1U98fa9X/pXv/X16b/O/ucbQ/k07fu/m68bf23I97qb93/NOof+D/63+88qVYb+e9+e2en6eOrjb6z+uuIcy2/f5IDdY1vrqyNb2zvnF9amV0sLZZWp6YmP5y+MP3B9MT4wlK5lP/ZMpYff/r3Tw5r/2tt6h/N25/U2j94oPFZ2dMWHvRO0/x/79588IlWCyYR93+Y51v8/b95oP6D+78v/3JO8/1zrpHfref3e/u3f3q7ffv7Yr5N+wcPqT8re7fdRpu8d/UHf63nCkdcAwDopo3tneXZcrm0/qpnssa8BGF0MDPW8qMzvQ/sZGUao6iXJZ7uZZIXOt572y8BAACd9/RHf68jAQAAAAAAAAAAAAAAAAAAgNOr8f//G89y7sazx/bXt/cU5SQ59rYCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABzmfwEAAP//rSnHLA==") getgroups(0x0, &(0x7f00000002c0)) r2 = getpid() getpgrp(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000008c0), 0x2, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000900)={'syzkaller1\x00', 0x5001}) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010000000000000000000100000014000180060004004e220000070006"], 0x28}}, 0x44000) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000a00)={'syzkaller1\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r7, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000001ec0)={0x34, r8, 0x1, 0x70bd28, 0x25dfdbff, {}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40) sendmsg$nl_route_sched(r4, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000ac0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xfff3}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000fc0)=@newtfilter={0x44, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0xb, 0x7}, {0xfff2, 0xffff}, {0x300}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x5b7b}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}}, 0x4044004) r9 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r1, &(0x7f0000003e80)=[{{0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000080)=""/44, 0x2c}, {&(0x7f00000000c0)=""/74, 0x4a}, {&(0x7f0000000d00)=""/70, 0x46}, {&(0x7f0000001400)=""/190, 0xbe}, {&(0x7f00000014c0)=""/167, 0xa7}], 0x5, &(0x7f0000001600)=""/233, 0xe9}, 0x5}, {{0x0, 0x0, &(0x7f00000018c0)=[{&(0x7f0000001700)=""/99, 0x63}, {&(0x7f0000001780)=""/146, 0x92}, {&(0x7f0000001840)=""/71, 0x47}], 0x3, &(0x7f0000001900)=""/141, 0x8d}, 0x4}, {{&(0x7f00000019c0)=@pptp={0x18, 0x2, {0x0, @broadcast}}, 0x80, &(0x7f0000001d80)=[{&(0x7f0000001a40)=""/248, 0xf8}, {&(0x7f0000001b40)=""/38, 0x26}, {&(0x7f0000001b80)=""/214, 0xd6}, {&(0x7f0000001c80)=""/223, 0xdf}], 0x4, &(0x7f0000001dc0)=""/108, 0x6c}, 0x7}, {{&(0x7f0000001e40)=@l2={0x1f, 0x0, @none}, 0x80, &(0x7f0000001ec0)}, 0x2}, {{&(0x7f0000001f00)=@pptp={0x18, 0x2, {0x0, @dev}}, 0x80, &(0x7f00000031c0)=[{&(0x7f0000001f80)=""/70, 0x46}, {&(0x7f0000002000)=""/4096, 0x1000}, {&(0x7f0000003000)=""/159, 0x9f}, {&(0x7f00000030c0)=""/205, 0xcd}], 0x4, &(0x7f0000003200)=""/255, 0xff}, 0x5}, {{&(0x7f0000003300)=@can, 0x80, &(0x7f0000003500)=[{&(0x7f0000003380)=""/46, 0x2e}, {&(0x7f00000033c0)=""/62, 0x3e}, {&(0x7f0000003400)=""/195, 0xc3}], 0x3, &(0x7f0000003540)=""/73, 0x49}}, {{&(0x7f00000035c0)=@caif=@rfm, 0x80, &(0x7f0000003d00)=[{&(0x7f0000003640)=""/148, 0x94}, {&(0x7f0000003700)=""/173, 0xad}, {&(0x7f00000037c0)=""/35, 0x23}, {&(0x7f0000003800)=""/82, 0x52}, {&(0x7f0000003880)=""/255, 0xff}, {&(0x7f0000003980)=""/95, 0x5f}, {&(0x7f0000003a00)=""/78, 0x4e}, {&(0x7f0000003a80)=""/166, 0xa6}, {&(0x7f0000003b40)=""/191, 0xbf}, {&(0x7f0000003c00)=""/194, 0xc2}], 0xa, &(0x7f0000003dc0)=""/170, 0xaa}, 0x3bd}], 0x7, 0x1, &(0x7f0000004040)) ioctl$sock_inet_SIOCSIFFLAGS(r9, 0x8914, &(0x7f0000000c00)={'syzkaller1\x00', 0x1}) bpf$PROG_LOAD(0x5, &(0x7f0000000f00)={0x10, 0x4, &(0x7f0000000d80)=ANY=[@ANYBLOB="b4000000000000007910180000000000710045000000000095000300"], &(0x7f0000000dc0)='GPL\x00', 0x2, 0xc3, &(0x7f0000000e00)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) write$tun(r3, &(0x7f0000000c40)=ANY=[@ANYBLOB="03031b0030003200060063"], 0x76) shutdown(r0, 0x1) ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000c80)={0x9, {0x8, 0x0, 0x7, 0x1, 0x6}}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000cc0)='/sys/power/image_size', 0x2d4800, 0x2) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001140)={0x0, 0x0}, 0x8) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001180)=@bpf_lsm={0x1a, 0x3, &(0x7f0000001240)=@framed, &(0x7f0000001280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1a, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r10, 0x4}, 0x80) r11 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r11) 1m8.935077898s ago: executing program 1 (id=804): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000140), 0x20000328) r1 = syz_clone(0x80, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_GET_XSAVE(r2, 0x9000aea4, &(0x7f0000000580)) sendto$inet(r0, &(0x7f0000000180), 0x0, 0x40, 0x0, 0x0) wait4(r1, 0x0, 0x20000002, 0x0) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096231306e53f070c0000002a2502834492796d830007379202750d56ca55f870d500"], 0x0}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x37) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x2000003, 0x2013, r6, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1m6.756086351s ago: executing program 1 (id=820): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/fscreate\x00') writev(r0, &(0x7f0000000080)=[{&(0x7f0000000140), 0x17b}, {&(0x7f0000000180)="9b5937bbf46a0a752f10243253d99fbb3227121bb4836b8073322d1ac20976026ad7649ec309fb239ebb9c2cd94e3c0a9d3ae6ba455d59f9121db45c1e3f9819cdbc953deaafd98b8131db4b498bc0addfc7e4ee821a6bcee9b07b6b4c5e8997f930a6f3fd18d2eb7de5346e9a72baa07d1096a2cf190170c4afda7fa59bd94e11bb77019f82de797869753f2b1bebfed1fdbd0f1edc487e9bf6bb46a696fd31f957a4b9069df7026a6d091626387f9b551cdb820d568a83df198b9c4ec31516929c32f9294778c656d42591359cf5057865524d34723463a5eeff4a8d73cf4855269f931281e4a72770858c1e321e454d4de06b2689ce63ab625583cec82ce42ccfd6ddc1e2c266d34016d508ef38bfc5f89cce170e9cb662c1884499a82524ac9cd366da3dbd9a03bef7381dae4008ec14a7181d8f6ba4497cedfe80907720ed4fe71ea378264b431e483bc1dd1b782d9dcd4bb3b26fe5341098692102ffff4f19699d25da82320bfa0debb44622328b452c505d20e8f46bc73f", 0x17b}, {&(0x7f0000000300)="2a6dfe6b588f0649b7c62468b77834dbabbd4b954da4", 0x16}, {&(0x7f0000000340)="acf5964b4d2aba2c68c363b6bc49a8c7becac3bbb7dfcc8b79d6d4f52be12eeb2b79d208ff301d18aa1e5b70729f3b4aa941103981c5f58d8d4971d20b6aa6c7bc3d371b296f014d7bec9aed7f966e46d306d93dabbef889580d6d6e78ba9c72b644dfe391899db31310e59eb3e734ccda545701b2fc7dbb748af3f4f2f22510c8965985c95e73ec6c46ac80a4a74288351133b2890706681f10d66dec0d89e27fdd35fe7ddfe33b4a8d99acecc1586f6d1d257e22e1bf7e390d6d4dbe967e616ccaba4ce0491838ad8469dbfe3c4280330a5c7fc0192c113affde67d5805e2181281f44c32efa30", 0xe8}, {&(0x7f0000000440)="35b67d93a84d33eb70ff581e3a9d9d0da6dc5d9e513fd7f0d6a7e1a170a9fd02e1e8ab7be3d54f2942d30bb052ff1db99d44bbba505f4ec35bbda360e6b433a93f22eaa64d7024893d4a99395bd583c81e435a0b3c52004bf44246828d6b76a7bdae3a6cfbb9fb", 0x67}, {&(0x7f00000004c0)="3737510ba7998eb0a92eb479b9ac482e6adde06f82a7ed40961de2f2044db9ddc090c9ad2b99c28af1c0147e8302afcf6fdcf929bec6a1a7739a151623ff9e7b9f32748cb18596b18766bb9ec5d09bce07fd8016aeef37d95a4474f8c7a9299958fe", 0x62}, {0x0, 0x7b01}, {&(0x7f0000000540)="41c7c229ebe174b727f00ec3f1d02a27c4bab19ef5ff046bb5aaec1fa8b6d8b49c4ca80426f1d27aaa0a3a5f74b020a430b1cc1f485e8c9013fdfe42f6f11c3e2686e59c5a7738096c5826f4443b74e6640b8b42e5b049f8dd9b7ef8aca94c0a7f7553c48bca6b78498c8f52bea41749243422a96cabd158f601376639e11bd9acdcca6296ab8f4212d1c47c37329f2aa90197826b918c914e4d11f8a79eaaddf1", 0xa1}, {&(0x7f0000000600)="02e5570de9bd58f3ae924514eb95d3085d5b4ffc3ad1b8cdf7f7086f87dfad4ff604ecaacc625a44eea266710d093ac57e807436b57559bc78129208b4f028c7e81351dfef9e381d85c5d7f74e505af08f656fc416ece1fe515b610553eae1493e", 0x61}], 0x9) 1m6.755964241s ago: executing program 33 (id=820): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/fscreate\x00') writev(r0, &(0x7f0000000080)=[{&(0x7f0000000140), 0x17b}, {&(0x7f0000000180)="9b5937bbf46a0a752f10243253d99fbb3227121bb4836b8073322d1ac20976026ad7649ec309fb239ebb9c2cd94e3c0a9d3ae6ba455d59f9121db45c1e3f9819cdbc953deaafd98b8131db4b498bc0addfc7e4ee821a6bcee9b07b6b4c5e8997f930a6f3fd18d2eb7de5346e9a72baa07d1096a2cf190170c4afda7fa59bd94e11bb77019f82de797869753f2b1bebfed1fdbd0f1edc487e9bf6bb46a696fd31f957a4b9069df7026a6d091626387f9b551cdb820d568a83df198b9c4ec31516929c32f9294778c656d42591359cf5057865524d34723463a5eeff4a8d73cf4855269f931281e4a72770858c1e321e454d4de06b2689ce63ab625583cec82ce42ccfd6ddc1e2c266d34016d508ef38bfc5f89cce170e9cb662c1884499a82524ac9cd366da3dbd9a03bef7381dae4008ec14a7181d8f6ba4497cedfe80907720ed4fe71ea378264b431e483bc1dd1b782d9dcd4bb3b26fe5341098692102ffff4f19699d25da82320bfa0debb44622328b452c505d20e8f46bc73f", 0x17b}, {&(0x7f0000000300)="2a6dfe6b588f0649b7c62468b77834dbabbd4b954da4", 0x16}, {&(0x7f0000000340)="acf5964b4d2aba2c68c363b6bc49a8c7becac3bbb7dfcc8b79d6d4f52be12eeb2b79d208ff301d18aa1e5b70729f3b4aa941103981c5f58d8d4971d20b6aa6c7bc3d371b296f014d7bec9aed7f966e46d306d93dabbef889580d6d6e78ba9c72b644dfe391899db31310e59eb3e734ccda545701b2fc7dbb748af3f4f2f22510c8965985c95e73ec6c46ac80a4a74288351133b2890706681f10d66dec0d89e27fdd35fe7ddfe33b4a8d99acecc1586f6d1d257e22e1bf7e390d6d4dbe967e616ccaba4ce0491838ad8469dbfe3c4280330a5c7fc0192c113affde67d5805e2181281f44c32efa30", 0xe8}, {&(0x7f0000000440)="35b67d93a84d33eb70ff581e3a9d9d0da6dc5d9e513fd7f0d6a7e1a170a9fd02e1e8ab7be3d54f2942d30bb052ff1db99d44bbba505f4ec35bbda360e6b433a93f22eaa64d7024893d4a99395bd583c81e435a0b3c52004bf44246828d6b76a7bdae3a6cfbb9fb", 0x67}, {&(0x7f00000004c0)="3737510ba7998eb0a92eb479b9ac482e6adde06f82a7ed40961de2f2044db9ddc090c9ad2b99c28af1c0147e8302afcf6fdcf929bec6a1a7739a151623ff9e7b9f32748cb18596b18766bb9ec5d09bce07fd8016aeef37d95a4474f8c7a9299958fe", 0x62}, {0x0, 0x7b01}, {&(0x7f0000000540)="41c7c229ebe174b727f00ec3f1d02a27c4bab19ef5ff046bb5aaec1fa8b6d8b49c4ca80426f1d27aaa0a3a5f74b020a430b1cc1f485e8c9013fdfe42f6f11c3e2686e59c5a7738096c5826f4443b74e6640b8b42e5b049f8dd9b7ef8aca94c0a7f7553c48bca6b78498c8f52bea41749243422a96cabd158f601376639e11bd9acdcca6296ab8f4212d1c47c37329f2aa90197826b918c914e4d11f8a79eaaddf1", 0xa1}, {&(0x7f0000000600)="02e5570de9bd58f3ae924514eb95d3085d5b4ffc3ad1b8cdf7f7086f87dfad4ff604ecaacc625a44eea266710d093ac57e807436b57559bc78129208b4f028c7e81351dfef9e381d85c5d7f74e505af08f656fc416ece1fe515b610553eae1493e", 0x61}], 0x9) 6.472815387s ago: executing program 0 (id=1173): syz_emit_ethernet(0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x20842, 0x63) write$P9_RLERRORu(r0, &(0x7f0000000100)=ANY=[], 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)=[0x1], 0x0, 0x0, 0x1, 0x1}}, 0x40) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000001100)={0x1, &(0x7f0000001140)=[{0x6, 0x0, 0xfe, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x0) 6.167927038s ago: executing program 0 (id=1176): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/vm/nr_overcommit_hugepages\x00', 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') read$FUSE(r0, &(0x7f0000002540)={0x2020}, 0x2020) read$FUSE(r0, &(0x7f0000008d80)={0x2020}, 0x2020) 6.167348668s ago: executing program 0 (id=1178): r0 = syz_usb_connect(0x0, 0x202, &(0x7f00000004c0)=ANY=[@ANYBLOB="1201100152018b401e040740185d000000010902f00101040000030904"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000bc0)={0x2c, &(0x7f0000000940)={0x20, 0x14}, 0x0, 0x0, 0x0, 0x0}) 3.941342156s ago: executing program 6 (id=1189): socket$inet(0x2, 0x2, 0x1) socket$tipc(0x1e, 0x1, 0x0) socket$tipc(0x1e, 0x5, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) timerfd_create(0x0, 0x0) socket$tipc(0x1e, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$key(0xf, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x6) r0 = socket$key(0xf, 0x3, 0x2) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f0000000480)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r0, @ANYBLOB='\a'], 0x0) 3.075976705s ago: executing program 0 (id=1200): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r0, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000080)=0x8, 0x4) recvfrom(r0, 0x0, 0x0, 0x2040, 0x0, 0x0) 3.064738846s ago: executing program 0 (id=1201): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2}, 0x28) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = socket(0x10, 0x803, 0x0) sendto(r3, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1}, 0x2}], 0x1, 0x2040000, 0x0) 2.961677627s ago: executing program 3 (id=1204): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000080)=0x1, 0x2) 2.961405677s ago: executing program 3 (id=1206): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000700)=ANY=[@ANYBLOB="2c00000018000104000000000000000002180000fe030001"], 0x2c}}, 0x0) 2.925957241s ago: executing program 2 (id=1207): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt\x00', 0x1ff) chdir(&(0x7f0000000800)='./mnt\x00') openat(0xffffffffffffff9c, &(0x7f0000000840)='./file2\x00', 0x18d042, 0x15) 2.731034981s ago: executing program 3 (id=1208): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000580)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18020000801000000000000004000000850000007d00000095"], &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000780)=ANY=[@ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000007c0)={{r2}, &(0x7f0000000800), &(0x7f0000000840)=r1}, 0x20) sendmsg$inet(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000900)="0e77", 0x2}], 0x1}, 0x4050003) 2.695102414s ago: executing program 3 (id=1209): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mnt\x00', 0x1bb) chdir(0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000300)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000400), 0x651, 0x0) recvmmsg(r1, &(0x7f00000004c0), 0x10106, 0x2, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) listen(r3, 0xb) setsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, &(0x7f0000000580)=0x239, 0x4) io_destroy(0x0) 2.155852919s ago: executing program 2 (id=1210): r0 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r0, &(0x7f0000001940)={0xa, 0x4e24, 0x25a, @mcast2, 0x9}, 0x1c) 2.15067428s ago: executing program 5 (id=1211): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r0, 0x0, 0x0) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) 2.019979893s ago: executing program 6 (id=1212): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./tracefs\x00', &(0x7f0000000180)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='e:mygroup/myevent sched.sched_switch', 0x24) open(&(0x7f0000000580)='./tracefs/dynamic_events\x00', 0x14927e, 0x0) 1.975910318s ago: executing program 5 (id=1213): socket$netlink(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x7) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000380)={0x2, 0xfffffffe, 0x2, 0xfffffffc}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000200), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r2 = socket(0x10, 0x3, 0x0) fstatfs(r2, &(0x7f00000003c0)=""/49) 1.95717191s ago: executing program 6 (id=1214): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) fsopen(0x0, 0x1) 1.750013291s ago: executing program 5 (id=1215): prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000003c0)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000440)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000900), 0x0, 0x0) read$msr(r2, &(0x7f0000000940)=""/102392, 0x18ff8) socket$pppl2tp(0x18, 0x1, 0x1) 1.644793312s ago: executing program 0 (id=1216): syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12011003cb86e440f71d002579260102030109021b0002030c150509040506316fc37029c415"], &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0}) r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0) r1 = syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0) syz_usb_disconnect(r1) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_connect$midi(0x5, 0x31, 0x0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0}) r2 = syz_usb_connect(0x0, 0x2d, 0x0, 0x0) syz_usb_disconnect(r2) syz_usb_connect$cdc_ncm(0x5, 0x72, 0x0, 0x0) r3 = syz_usb_connect(0x5, 0x24, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2], 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$lan78xx(r3, 0x0, 0x0) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000300)={0x0, 0x8, &(0x7f0000000200)="952bb3e006ae9a4c"}) r4 = syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r4, 0x80104592, 0x0) syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0) r5 = syz_open_dev$evdev(0x0, 0x80000000002, 0x30004) ioctl$EVIOCGKEYCODE_V2(r5, 0x80284504, 0x0) syz_usb_connect$cdc_ncm(0x6, 0x0, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x8d, &(0x7f0000000500)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x48, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7b, 0x2, 0x1, 0x9, 0x60, 0x8, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x8, 0x24, 0x6, 0x0, 0x1, "db930a"}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0x2, 0xff, 0x1000, 0x3}, {0x6, 0x24, 0x1a, 0x7, 0x4}, [@network_terminal={0x7, 0x24, 0xa, 0x1, 0xa, 0xb, 0x5}, @mdlm={0x15, 0x24, 0x12, 0x5}]}, {{0x9, 0x5, 0x81, 0x3, 0x40, 0x6, 0xe, 0x3}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x5, 0xff, 0x40}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0xe, 0x6, 0x9}}}}}}}]}}, 0x0) 1.644203372s ago: executing program 3 (id=1217): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00'}) socket$inet6(0xa, 0x1, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000400)=""/172, 0xac, 0x38) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000004c0)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000500)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000580)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000600), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000640), 0x10106, 0x2, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000680), 0xf, 0x101301) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f00000006c0)) setpgid(r1, r1) ioctl$USBDEVFS_IOCTL(r4, 0x80045505, &(0x7f0000000700)=@usbdevfs_driver={0xffffffff, 0x5, 0x0}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(&(0x7f0000000f00)=@filename='127.0.0.1:/test\x00', &(0x7f0000000f40)='./mnt\x00', &(0x7f0000000f80)='nfs\x00', 0x0, &(0x7f0000000fc0)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x00') 1.424723474s ago: executing program 2 (id=1218): mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./sys\x00', &(0x7f0000000340)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:01.0/d3cold_allowed\x00', 0x1, 0x0) write$P9_RSTATu(r0, &(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYBLOB="c9"], 0xa9) 1.424307095s ago: executing program 6 (id=1219): accept4$vsock_stream(0xffffffffffffffff, 0x0, 0x0, 0x800) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000440), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f0000000400)={{0x1, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r4, 0x40505412, &(0x7f0000000040)={0x3, 0xf98, 0x80, 0x0, 0xd}) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000c00)=ANY=[], 0xfc}}, 0x0) sendmsg$nl_xfrm(r3, 0x0, 0x0) 1.424008615s ago: executing program 5 (id=1220): r0 = io_uring_setup(0x8, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x20002}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) io_uring_enter(r0, 0x0, 0x1, 0x9, &(0x7f0000001100), 0x18) 971.391731ms ago: executing program 2 (id=1221): prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000002c0), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000300), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000340)=0x2) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x7fffffff, 0x0, 0x2}, {0xfffffffffffffffe, 0xffffffffffffffff}, 0x0, 0x0, 0x1, 0x0, 0x1, 0x3}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x2b}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3, 0x4, 0x2, 0x0, 0x0, 0x0, 0x4000}]}]}, 0xfc}}, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x181002, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r4, 0x0, 0x0) r5 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f00000002c0)={0xa, 0x4e20, 0x400, @loopback, 0x7}, 0x1c) listen(r5, 0xb) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r6, &(0x7f0000000300)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) r7 = fcntl$dupfd(r6, 0x406, r6) setsockopt$inet6_buf(r6, 0x29, 0x39, &(0x7f0000000600)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) write$binfmt_elf64(r7, &(0x7f0000000640)=ANY=[], 0xfffffdcf) 964.503682ms ago: executing program 5 (id=1222): openat$null(0xffffffffffffff9c, 0x0, 0x101001, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./tracefs\x00', &(0x7f0000000180)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f00000002c0)='e:mygro', 0x7) open(&(0x7f0000000580)='./tracefs/dynamic_events\x00', 0x14927e, 0x0) 674.786761ms ago: executing program 5 (id=1223): socket$nl_route(0x10, 0x3, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/udp\x00') prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000004c0)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000500)=0x3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000580)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000600), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000640), 0x10106, 0x2, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000680), 0xf, 0x101301) ioctl$FS_IOC_READ_VERITY_METADATA(r3, 0xc0286687, 0x0) 576.104021ms ago: executing program 3 (id=1224): r0 = fsopen(&(0x7f0000000900)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000940)='./file0\x00', 0xdafbe5d6891b6e4) write$binfmt_elf32(r2, 0x0, 0x4f) 565.530252ms ago: executing program 6 (id=1225): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)={0x14, r1, 0x9a5dc12d545f23b9, 0x70bd28, 0x25dfdbfc}, 0x14}}, 0x2004c094) 508.628328ms ago: executing program 6 (id=1226): socket(0x1e, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="380100001000010000000000000000007f002001000000000000000000000000fe8000000000000000000000000000aa00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0], 0x138}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000001080)={0x50, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x50}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f00000500070084000000060005"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r6, &(0x7f0000000800)={'syz0\x00', {0x2, 0x10, 0x2, 0x4}, 0xf, [0x1, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x1, 0x2, 0x0, 0x0, 0x7, 0x1, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x29a, 0x1, 0x0, 0x0, 0x0, 0x2000, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x8000, 0x2, 0x9, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x200, 0x7, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x3, 0x0, 0xd, 0x0, 0x2, 0x0, 0x3, 0x5, 0xfffffffd, 0x4000000, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4, 0xffff], [0x4, 0xfc, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x4000000, 0x0, 0x1, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x0, 0xffffffff, 0x400000, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x20, 0x4, 0x0, 0x0, 0xfffffffe, 0x1, 0x0, 0x18c, 0x0, 0x6, 0x1, 0x0, 0xbda6, 0xe, 0x0, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x20, 0x100, 0x0, 0x0, 0x204, 0x0, 0x0, 0x4000, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x74e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x402, 0x40, 0x0, 0x0, 0xbd, 0x0, 0xff, 0x0, 0x0, 0x0, 0x2, 0xc9, 0x0, 0x8, 0x9, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x80000020, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x5cb9, 0xcaa, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r7 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000000)=0x13) io_setup(0x81, &(0x7f0000000400)) read$eventfd(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) 15.080989ms ago: executing program 2 (id=1227): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000001200)={@multicast2, @private=0xa010102}, 0xc) 0s ago: executing program 2 (id=1228): socket$inet6(0xa, 0x3, 0x6) sendto$packet(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x4008015, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000300)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000340)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000440), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000004c0), 0x10106, 0x2, 0x0) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000540)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680), 0x2010000, &(0x7f0000000a80)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000000ac0)='./file0\x00') r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000b00)='.\x00', 0x0, 0x80) getdents64(r3, &(0x7f0000001d00)=""/4096, 0x1000) 0s ago: executing program 3 (id=1229): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000002c0), 0x0, 0x0) read$msr(r3, &(0x7f0000001240)=""/102392, 0x18ff8) socket$netlink(0x10, 0x3, 0x9) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xf, 0x4, 0x4, 0x4, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xe, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="b702000001000000b703000000000000b7040000000000008500000032000000b7000000010000009500"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000440)={@map=r6, r7, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000480)={r6, &(0x7f00000004c0), &(0x7f0000000500)=@tcp=r4}, 0x20) sendto(r5, &(0x7f0000000540)="01", 0x1, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): id=1896 comm="syz.2.467" path="/93/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/memory.events.local" dev="loop2" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 118.884167][ T28] audit: type=1400 audit(1793850817.021:535): avc: denied { write } for pid=1896 comm="syz.2.467" path="/93/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/memory.events.local" dev="loop2" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 118.953382][ T1896] bio_check_eod: 409 callbacks suppressed [ 118.953460][ T1896] syz.2.467: attempt to access beyond end of device [ 118.953460][ T1896] loop2: rw=2049, sector=77824, nr_sectors = 552 limit=40427 [ 118.986817][ T1923] syz.2.467: attempt to access beyond end of device [ 118.986817][ T1923] loop2: rw=2049, sector=78376, nr_sectors = 1208 limit=40427 [ 119.133294][ T425] kworker/u4:4: attempt to access beyond end of device [ 119.133294][ T425] loop2: rw=1, sector=77824, nr_sectors = 8 limit=40427 [ 119.154853][ T425] kworker/u4:4: attempt to access beyond end of device [ 119.154853][ T425] loop2: rw=1, sector=77912, nr_sectors = 8 limit=40427 [ 120.697549][ T1939] loop0: detected capacity change from 0 to 256 [ 120.735871][ T319] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 121.895662][ T1949] loop0: detected capacity change from 0 to 1024 [ 121.902264][ T1949] ext4: Unknown parameter 'subj_role' [ 122.208770][ T1958] loop0: detected capacity change from 0 to 512 [ 122.404351][ T319] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 122.554452][ T458] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 122.767057][ T458] usb 3-1: New USB device found, idVendor=0582, idProduct=0005, bcdDevice= 0.40 [ 122.776545][ T458] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.784927][ T458] usb 3-1: Product: syz [ 122.789334][ T458] usb 3-1: Manufacturer: syz [ 122.794624][ T458] usb 3-1: SerialNumber: syz [ 123.040981][ T458] usb 3-1: USB disconnect, device number 15 [ 123.088880][ T1975] ip_tables: iptables: counters copy to user failed while replacing table [ 123.098688][ T1975] ip_tables: iptables: counters copy to user failed while replacing table [ 123.103291][ T28] audit: type=1326 audit(1793850821.281:536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1976 comm="syz.1.490" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1db9fb19 code=0x7ffc0000 [ 123.134639][ T28] audit: type=1326 audit(1793850821.321:537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1976 comm="syz.1.490" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1db9fb19 code=0x7ffc0000 [ 123.159974][ T28] audit: type=1326 audit(1793850821.321:538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1976 comm="syz.1.490" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1db9fb19 code=0x7ffc0000 [ 123.185120][ T28] audit: type=1326 audit(1793850821.321:539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1976 comm="syz.1.490" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=35 compat=0 ip=0x7f4f1db9fb19 code=0x7ffc0000 [ 123.211657][ T28] audit: type=1326 audit(1793850821.371:540): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1976 comm="syz.1.490" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1db9fb19 code=0x7ffc0000 [ 123.236473][ T28] audit: type=1326 audit(1793850821.371:541): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1976 comm="syz.1.490" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1db9fb19 code=0x7ffc0000 [ 123.261281][ T28] audit: type=1326 audit(1793850821.371:542): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1976 comm="syz.1.490" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1db9fb19 code=0x7ffc0000 [ 123.345028][ T1979] FAULT_INJECTION: forcing a failure. [ 123.345028][ T1979] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 123.358193][ T1979] CPU: 0 PID: 1979 Comm: syz.0.491 Not tainted syzkaller #0 [ 123.365499][ T1979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 123.375538][ T1979] Call Trace: [ 123.378812][ T1979] [ 123.381743][ T1979] __dump_stack+0x21/0x24 [ 123.386089][ T1979] dump_stack_lvl+0x110/0x170 [ 123.390761][ T1979] ? __cfi_dump_stack_lvl+0x8/0x8 [ 123.395773][ T1979] ? sock_do_ioctl+0x268/0x330 [ 123.400670][ T1979] dump_stack+0x15/0x24 [ 123.404862][ T1979] should_fail_ex+0x3bf/0x510 [ 123.409527][ T1979] should_fail+0xb/0x10 [ 123.413662][ T1979] should_fail_usercopy+0x1a/0x20 [ 123.418694][ T1979] _copy_from_user+0x1e/0xc0 [ 123.423272][ T1979] __x64_sys_io_uring_setup+0x10a/0x230 [ 123.428809][ T1979] ? __cfi___x64_sys_io_uring_setup+0x10/0x10 [ 123.434954][ T1979] ? __kasan_check_write+0x14/0x20 [ 123.440085][ T1979] ? fpregs_restore_userregs+0x128/0x260 [ 123.445705][ T1979] ? switch_fpu_return+0xe/0x10 [ 123.450559][ T1979] x64_sys_call+0x4ab/0x9a0 [ 123.455059][ T1979] do_syscall_64+0x4c/0xa0 [ 123.459465][ T1979] ? clear_bhb_loop+0x30/0x80 [ 123.464134][ T1979] ? clear_bhb_loop+0x30/0x80 [ 123.468806][ T1979] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 123.474686][ T1979] RIP: 0033:0x7f859019fb19 [ 123.479084][ T1979] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.498673][ T1979] RSP: 002b:00007f8591097028 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 123.507068][ T1979] RAX: ffffffffffffffda RBX: 00007f8590425fa0 RCX: 00007f859019fb19 [ 123.515029][ T1979] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 000000000000383a [ 123.523012][ T1979] RBP: 00007f8590237b70 R08: 0000000000000000 R09: 0000000000000000 [ 123.531070][ T1979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 123.539021][ T1979] R13: 00007f8590426038 R14: 00007f8590425fa0 R15: 00007ffc4e01c0a8 [ 123.546975][ T1979] [ 124.598653][ T2003] loop1: detected capacity change from 0 to 512 [ 125.609543][ T2023] loop0: detected capacity change from 0 to 256 [ 125.672046][ T28] kauditd_printk_skb: 68 callbacks suppressed [ 125.672063][ T28] audit: type=1326 audit(1793850823.851:611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2022 comm="syz.0.506" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f859019fb19 code=0x0 [ 126.056679][ T467] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 126.255503][ T467] usb 2-1: Using ep0 maxpacket: 16 [ 126.289941][ T467] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 126.370191][ T467] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 126.382644][ T467] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 126.395948][ T467] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 126.446481][ T467] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.477271][ T467] usb 2-1: config 0 descriptor?? [ 127.760575][ T2057] loop2: detected capacity change from 0 to 512 [ 127.844509][ T28] audit: type=1400 audit(1793850826.011:612): avc: denied { read } for pid=2054 comm="syz.3.515" path="socket:[22834]" dev="sockfs" ino=22834 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 127.896828][ T447] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 128.599519][ T467] usbhid 2-1:0.0: can't add hid device: -71 [ 128.613900][ T467] usbhid: probe of 2-1:0.0 failed with error -71 [ 128.631703][ T467] usb 2-1: USB disconnect, device number 9 [ 128.667305][ T2067] incfs: Error accessing: ./file1/file3. [ 128.680236][ T2067] incfs: mount failed -2 [ 128.828013][ T28] audit: type=1326 audit(1793850826.971:613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2074 comm="syz.5.521" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f10d419fb19 code=0x0 [ 128.831972][ T2073] loop1: detected capacity change from 0 to 128 [ 129.211577][ T2094] loop0: detected capacity change from 0 to 128 [ 129.507240][ T319] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 129.518122][ T780] kworker/u4:6: attempt to access beyond end of device [ 129.518122][ T780] loop1: rw=1, sector=145, nr_sectors = 6 limit=128 [ 129.780963][ T2108] loop2: detected capacity change from 0 to 512 [ 129.799863][ T2108] EXT4-fs: Ignoring removed bh option [ 129.813104][ T2108] EXT4-fs error (device loop2): ext4_iget_extra_inode:4765: inode #15: comm syz.2.532: corrupted in-inode xattr [ 129.849009][ T2108] EXT4-fs error (device loop2): ext4_orphan_get:1410: comm syz.2.532: couldn't read orphan inode 15 (err -117) [ 129.944527][ T659] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 130.016424][ T2108] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 130.128742][ T2108] EXT4-fs error (device loop2): ext4_iget_extra_inode:4765: inode #12: comm syz.2.532: corrupted in-inode xattr [ 130.215475][ T659] usb 1-1: Using ep0 maxpacket: 16 [ 130.226322][ T659] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 130.247314][ T659] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 130.257462][ T659] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 130.270809][ T659] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 130.280793][ T659] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.280873][ T28] audit: type=1400 audit(1793850828.461:614): avc: denied { create } for pid=2107 comm="syz.2.532" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 130.333224][ T659] usb 1-1: config 0 descriptor?? [ 130.352229][ T2125] loop1: detected capacity change from 0 to 1024 [ 130.419654][ T2125] EXT4-fs: Ignoring removed bh option [ 130.460698][ T2125] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 131.087074][ T292] EXT4-fs (loop1): unmounting filesystem. [ 133.150771][ T294] EXT4-fs (loop2): unmounting filesystem. [ 135.120374][ T28] audit: type=1326 audit(1793850833.301:615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2142 comm="syz.5.542" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f10d419fb19 code=0x0 [ 135.165730][ T659] usbhid 1-1:0.0: can't add hid device: -71 [ 135.171715][ T659] usbhid: probe of 1-1:0.0 failed with error -71 [ 135.184464][ T659] usb 1-1: USB disconnect, device number 6 [ 135.354455][ T1308] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 135.505765][ T2169] loop0: detected capacity change from 0 to 1024 [ 135.530502][ T2169] EXT4-fs: Ignoring removed bh option [ 135.559085][ T1308] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 135.568324][ T1308] usb 3-1: can't read configurations, error -71 [ 135.610389][ T2169] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 135.760045][ T2174] netlink: 12 bytes leftover after parsing attributes in process `syz.5.548'. [ 136.100162][ T2176] loop2: detected capacity change from 0 to 512 [ 136.275403][ T288] EXT4-fs (loop0): unmounting filesystem. [ 136.439215][ T2189] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 140.103344][ T2205] loop2: detected capacity change from 0 to 128 [ 140.165594][ T2207] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 140.175685][ T2205] FAULT_INJECTION: forcing a failure. [ 140.175685][ T2205] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 140.217575][ T2205] CPU: 0 PID: 2205 Comm: syz.2.557 Not tainted syzkaller #0 [ 140.224909][ T2205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 140.234978][ T2205] Call Trace: [ 140.238265][ T2205] [ 140.241207][ T2205] __dump_stack+0x21/0x24 [ 140.245558][ T2205] dump_stack_lvl+0x110/0x170 [ 140.250255][ T2205] ? __cfi_dump_stack_lvl+0x8/0x8 [ 140.255300][ T2205] dump_stack+0x15/0x24 [ 140.259470][ T2205] should_fail_ex+0x3bf/0x510 [ 140.264157][ T2205] should_fail+0xb/0x10 [ 140.268330][ T2205] should_fail_usercopy+0x1a/0x20 [ 140.273375][ T2205] _copy_to_user+0x1e/0x90 [ 140.277813][ T2205] simple_read_from_buffer+0xe9/0x160 [ 140.283206][ T2205] proc_fail_nth_read+0x1a6/0x220 [ 140.288244][ T2205] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 140.293805][ T2205] ? security_file_permission+0x94/0xb0 [ 140.299370][ T2205] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 140.304930][ T2205] vfs_read+0x286/0x930 [ 140.309102][ T2205] ? __cfi_vfs_read+0x10/0x10 [ 140.313792][ T2205] ? __kasan_check_write+0x14/0x20 [ 140.318914][ T2205] ? mutex_lock+0x93/0x1b0 [ 140.323337][ T2205] ? __cfi_mutex_lock+0x10/0x10 [ 140.328198][ T2205] ? __fdget_pos+0x2cd/0x380 [ 140.332823][ T2205] ? ksys_read+0x70/0x260 [ 140.337219][ T2205] ksys_read+0x14a/0x260 [ 140.341490][ T2205] ? __cfi_ksys_read+0x10/0x10 [ 140.346268][ T2205] ? __secure_computing+0xea/0x290 [ 140.351386][ T2205] __x64_sys_read+0x7b/0x90 [ 140.355898][ T2205] x64_sys_call+0x2f/0x9a0 [ 140.360324][ T2205] do_syscall_64+0x4c/0xa0 [ 140.364744][ T2205] ? clear_bhb_loop+0x30/0x80 [ 140.369449][ T2205] ? clear_bhb_loop+0x30/0x80 [ 140.374146][ T2205] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 140.380057][ T2205] RIP: 0033:0x7f832416034e [ 140.384483][ T2205] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 140.404357][ T2205] RSP: 002b:00007f8325073fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 140.412799][ T2205] RAX: ffffffffffffffda RBX: 00007f83250746c0 RCX: 00007f832416034e [ 140.420785][ T2205] RDX: 000000000000000f RSI: 00007f83250740a0 RDI: 0000000000000004 [ 140.428760][ T2205] RBP: 00007f8325074090 R08: 0000000000000000 R09: 0000000000000000 [ 140.436737][ T2205] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 140.444717][ T2205] R13: 00007f8324426038 R14: 00007f8324425fa0 R15: 00007fff4622de28 [ 140.452705][ T2205] [ 140.488128][ T2214] loop2: detected capacity change from 0 to 512 [ 140.507333][ T28] audit: type=1326 audit(1793850838.691:616): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2211 comm="syz.3.559" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe06679fb19 code=0x0 [ 140.535011][ T2207] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 140.597203][ T2215] ip_tables: iptables: counters copy to user failed while replacing table [ 141.084489][ T649] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 141.276196][ T649] usb 1-1: unable to get BOS descriptor or descriptor too short [ 141.285571][ T649] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 141.295894][ T649] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 141.315483][ T649] usb 1-1: string descriptor 0 read error: -22 [ 141.325818][ T649] usb 1-1: New USB device found, idVendor=041e, idProduct=3020, bcdDevice= 0.40 [ 141.339622][ T649] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 141.552979][ T2232] loop2: detected capacity change from 0 to 512 [ 141.566449][ T28] audit: type=1400 audit(1793850839.751:617): avc: denied { ioctl } for pid=2219 comm="syz.0.562" path="/dev/vhost-vsock" dev="devtmpfs" ino=268 ioctlcmd=0xaf12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 141.594798][ T649] usb 1-1: Audio class v2/v3 interfaces need an interface association [ 141.651259][ T649] snd-usb-audio: probe of 1-1:1.0 failed with error -22 [ 141.673970][ T2207] udevd[2207]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 141.694498][ T649] usb 1-1: USB disconnect, device number 7 [ 141.703535][ T2232] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 141.722436][ T2232] EXT4-fs (loop2): mounting ext2 file system using the ext4 subsystem [ 141.731769][ T2232] EXT4-fs (loop2): warning: checktime reached, running e2fsck is recommended [ 141.741670][ T2232] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a042c01c, mo2=0002] [ 141.749956][ T2232] System zones: 0-2, 18-18, 34-34 [ 141.945082][ T2232] EXT4-fs error (device loop2): ext4_orphan_get:1431: comm syz.2.564: bad orphan inode 15 [ 141.972281][ T2232] ext4_test_bit(bit=14, block=18) = 1 [ 142.002864][ T2232] is_bad_inode(inode)=0 [ 142.007448][ T2232] NEXT_ORPHAN(inode)=2264924160 [ 142.017257][ T2232] max_ino=32 [ 142.020506][ T2232] i_nlink=0 [ 142.023864][ T2232] EXT4-fs error (device loop2): ext4_do_update_inode:5281: inode #15: comm syz.2.564: corrupted inode contents [ 142.038657][ T2232] EXT4-fs error (device loop2): ext4_dirty_inode:6158: inode #15: comm syz.2.564: mark_inode_dirty error [ 142.050338][ T2232] EXT4-fs error (device loop2): ext4_do_update_inode:5281: inode #15: comm syz.2.564: corrupted inode contents [ 142.062381][ T2232] EXT4-fs error (device loop2): ext4_xattr_delete_inode:2947: inode #15: comm syz.2.564: mark_inode_dirty error [ 142.074939][ T2232] EXT4-fs error (device loop2): ext4_xattr_delete_inode:2950: inode #15: comm syz.2.564: mark inode dirty (error -117) [ 142.087609][ T2232] EXT4-fs warning (device loop2): ext4_evict_inode:301: xattr delete (err -117) [ 142.096713][ T2232] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 142.222922][ T294] EXT4-fs (loop2): unmounting filesystem. [ 142.274460][ T6] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 142.337564][ T2252] loop0: detected capacity change from 0 to 128 [ 142.464429][ T6] usb 2-1: Using ep0 maxpacket: 32 [ 142.470724][ T6] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 142.495484][ T6] usb 2-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice= 0.40 [ 142.513171][ T6] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.529838][ T6] usb 2-1: Product: syz [ 142.534059][ T6] usb 2-1: Manufacturer: syz [ 142.538991][ T6] usb 2-1: SerialNumber: syz [ 142.753453][ T28] audit: type=1326 audit(1793850840.931:618): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2259 comm="syz.5.574" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f10d419fb19 code=0x0 [ 144.089989][ T2262] loop2: detected capacity change from 0 to 256 [ 144.132645][ T8] kworker/u4:0: attempt to access beyond end of device [ 144.132645][ T8] loop0: rw=1, sector=145, nr_sectors = 6 limit=128 [ 144.211750][ T28] audit: type=1326 audit(1793850842.391:619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2261 comm="syz.2.575" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f832419fb19 code=0x0 [ 144.310849][ T6] usb 2-1: 1:1 : incorrect wMaxPacketSize for BADD profile [ 144.318490][ T6] usb 2-1: incorrect wMaxPacketSize 0x20 for BADD profile [ 144.329486][ T6] snd-usb-audio: probe of 2-1:1.0 failed with error -22 [ 144.342835][ T2268] udevd[2268]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 144.359271][ T6] usb 2-1: USB disconnect, device number 10 [ 145.033535][ T2276] loop1: detected capacity change from 0 to 16 [ 145.054907][ T2276] erofs: (device loop1): erofs_superblock_csum_verify: invalid checksum 0x7c752359, 0x02d6543f expected [ 145.258373][ T2268] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 145.293848][ T2279] loop2: detected capacity change from 0 to 256 [ 145.478097][ T28] audit: type=1400 audit(1793850843.661:620): avc: denied { ioctl } for pid=2294 comm="syz.2.585" path="/dev/loop-control" dev="devtmpfs" ino=117 ioctlcmd=0x4c80 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 145.507474][ T2295] loop2: detected capacity change from 0 to 512 [ 145.542123][ T2295] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 145.653637][ T2295] EXT4-fs (loop2): Cannot turn on journaled quota: type 1: error -2 [ 145.664767][ T2295] EXT4-fs error (device loop2): ext4_iget_extra_inode:4765: inode #15: comm syz.2.585: corrupted in-inode xattr [ 145.684617][ T2295] EXT4-fs error (device loop2): ext4_orphan_get:1410: comm syz.2.585: couldn't read orphan inode 15 (err -117) [ 145.752854][ T2301] netlink: 8 bytes leftover after parsing attributes in process `syz.5.586'. [ 146.005063][ T2295] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 146.051624][ T2295] EXT4-fs (loop2): shut down requested (0) [ 146.064798][ T28] audit: type=1400 audit(1793850844.251:621): avc: denied { read } for pid=85 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 146.089667][ T2295] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 146.104506][ T2295] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 146.116209][ T28] audit: type=1400 audit(1793850844.251:622): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 146.141355][ T2295] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 146.174876][ T28] audit: type=1400 audit(1793850844.251:623): avc: denied { write } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 146.228844][ T28] audit: type=1400 audit(1793850844.251:624): avc: denied { add_name } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 146.279262][ T28] audit: type=1400 audit(1793850844.251:625): avc: denied { create } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 146.333618][ T28] audit: type=1400 audit(1793850844.251:626): avc: denied { append open } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 146.380122][ T28] audit: type=1400 audit(1793850844.251:627): avc: denied { getattr } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 146.403189][ T294] EXT4-fs (loop2): unmounting filesystem. [ 146.433796][ T28] audit: type=1400 audit(1793850844.341:628): avc: denied { setattr } for pid=2294 comm="syz.2.585" name="/" dev="loop2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 146.474909][ T2314] ip_tables: iptables: counters copy to user failed while replacing table [ 146.495034][ T2314] raw_sendmsg: syz.2.589 forgot to set AF_INET. Fix it! [ 146.502008][ T2314] FAULT_INJECTION: forcing a failure. [ 146.502008][ T2314] name failslab, interval 1, probability 0, space 0, times 0 [ 146.539992][ T2314] CPU: 0 PID: 2314 Comm: syz.2.589 Not tainted syzkaller #0 [ 146.547322][ T2314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 146.557394][ T2314] Call Trace: [ 146.560687][ T2314] [ 146.563627][ T2314] __dump_stack+0x21/0x24 [ 146.567972][ T2314] dump_stack_lvl+0x110/0x170 [ 146.572663][ T2314] ? __cfi_dump_stack_lvl+0x8/0x8 [ 146.577700][ T2314] ? __kasan_check_write+0x14/0x20 [ 146.582820][ T2314] ? llist_add_batch+0x12b/0x180 [ 146.587775][ T2314] dump_stack+0x15/0x24 [ 146.591941][ T2314] should_fail_ex+0x3bf/0x510 [ 146.596635][ T2314] ? dst_alloc+0x16a/0x1e0 [ 146.601069][ T2314] __should_failslab+0xac/0xf0 [ 146.605869][ T2314] should_failslab+0x9/0x20 [ 146.610426][ T2314] kmem_cache_alloc+0x3b/0x320 [ 146.615216][ T2314] dst_alloc+0x16a/0x1e0 [ 146.619471][ T2314] ip_route_output_key_hash_rcu+0x13f8/0x2160 [ 146.625551][ T2314] ip_route_output_flow+0x143/0x300 [ 146.630763][ T2314] ? __cfi_ip_route_output_flow+0x10/0x10 [ 146.636496][ T2314] raw_sendmsg+0xb29/0x1430 [ 146.641011][ T2314] ? __cfi_raw_sendmsg+0x10/0x10 [ 146.645961][ T2314] ? do_user_addr_fault+0x9a5/0x1030 [ 146.651264][ T2314] ? refcount_dec_and_lock_irqsave+0x71/0x100 [ 146.657332][ T2314] ? inet_send_prepare+0x60/0x4d0 [ 146.662358][ T2314] inet_sendmsg+0xb6/0xd0 [ 146.666690][ T2314] __sys_sendto+0x4ac/0x660 [ 146.671206][ T2314] ? __cfi___sys_sendto+0x10/0x10 [ 146.676246][ T2314] ? ksys_write+0x1fa/0x260 [ 146.680752][ T2314] ? __cfi_ksys_write+0x10/0x10 [ 146.685610][ T2314] __x64_sys_sendto+0xe5/0x100 [ 146.690385][ T2314] x64_sys_call+0x83/0x9a0 [ 146.694805][ T2314] do_syscall_64+0x4c/0xa0 [ 146.699227][ T2314] ? clear_bhb_loop+0x30/0x80 [ 146.703910][ T2314] ? clear_bhb_loop+0x30/0x80 [ 146.708601][ T2314] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 146.714503][ T2314] RIP: 0033:0x7f832419fb19 [ 146.718919][ T2314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 146.738535][ T2314] RSP: 002b:00007f8325074028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 146.746947][ T2314] RAX: ffffffffffffffda RBX: 00007f8324425fa0 RCX: 00007f832419fb19 [ 146.754916][ T2314] RDX: 000000000000fdef RSI: 0000200000000a00 RDI: 0000000000000003 [ 146.762890][ T2314] RBP: 00007f8325074090 R08: 0000200000000a40 R09: 0000000000000010 [ 146.770863][ T2314] R10: 0000000060000000 R11: 0000000000000246 R12: 0000000000000001 [ 146.778844][ T2314] R13: 00007f8324426038 R14: 00007f8324425fa0 R15: 00007fff4622de28 [ 146.786844][ T2314] [ 146.944135][ T28] audit: type=1400 audit(1793850845.121:629): avc: denied { append } for pid=2319 comm="syz.0.591" name="001" dev="devtmpfs" ino=182 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 146.992265][ T28] audit: type=1400 audit(1793850845.171:630): avc: denied { read write } for pid=2322 comm="syz.0.593" name="uinput" dev="devtmpfs" ino=262 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 147.101564][ T2323] loop0: detected capacity change from 0 to 512 [ 147.119978][ T2323] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 147.133174][ T2323] ext4 filesystem being mounted at /108/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 147.144879][ T2323] EXT4-fs error (device loop0): ext4_xattr_block_get:543: inode #15: comm syz.0.593: corrupted xattr block 33 [ 147.161158][ T2323] SELinux: inode_doinit_use_xattr: getxattr returned 74 for dev=loop0 ino=15 [ 147.170152][ T2323] EXT4-fs error (device loop0): ext4_xattr_block_get:543: inode #15: comm syz.0.593: corrupted xattr block 33 [ 147.182399][ T2323] SELinux: inode_doinit_use_xattr: getxattr returned 74 for dev=loop0 ino=15 [ 147.191432][ T2323] EXT4-fs error (device loop0): ext4_xattr_block_get:543: inode #15: comm syz.0.593: corrupted xattr block 33 [ 147.198151][ T2334] netlink: 'syz.3.596': attribute type 4 has an invalid length. [ 147.207782][ T2330] input: syz0 as /devices/virtual/input/input6 [ 147.223797][ T2334] netlink: 'syz.3.596': attribute type 4 has an invalid length. [ 147.225031][ T2323] SELinux: inode_doinit_use_xattr: getxattr returned 74 for dev=loop0 ino=15 [ 147.287419][ T288] EXT4-fs (loop0): unmounting filesystem. [ 147.377541][ T2340] ip_tables: iptables: counters copy to user failed while replacing table [ 148.048946][ T2351] loop2: detected capacity change from 0 to 512 [ 148.764163][ T2365] loop1: detected capacity change from 0 to 40427 [ 148.775564][ T2365] F2FS-fs (loop1): Corrupted extension count (64 + 1 > 64) [ 148.784927][ T2365] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 148.812954][ T2365] F2FS-fs (loop1): Image doesn't support compression [ 148.827577][ T2365] F2FS-fs (loop1): Image doesn't support compression [ 148.882384][ T2365] F2FS-fs (loop1): invalid crc value [ 148.911096][ T2365] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 149.104614][ T2365] F2FS-fs (loop1): Start checkpoint disabled! [ 149.139551][ T2365] F2FS-fs (loop1): f2fs_disable_checkpoint() finish, err:0 [ 149.205570][ T2365] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 149.219854][ T2365] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 149.552412][ T234] kworker/u4:3: attempt to access beyond end of device [ 149.552412][ T234] loop1: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 150.495651][ T2407] loop1: detected capacity change from 0 to 256 [ 150.607891][ T2412] overlayfs: empty lowerdir [ 150.666427][ T2414] kvm: pic: non byte read [ 150.679633][ T2414] kvm: pic: non byte read [ 150.684295][ T2414] kvm: pic: non byte read [ 150.702964][ T2420] loop2: detected capacity change from 0 to 512 [ 150.709498][ T2414] kvm: pic: level sensitive irq not supported [ 150.709582][ T2414] kvm: pic: level sensitive irq not supported [ 150.746021][ T2268] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 150.767367][ T2425] loop1: detected capacity change from 0 to 16 [ 150.773890][ T2425] erofs: Unknown parameter '0x000000000000018e3>AU%."oX׻ڠqZRdDKލ{#T' [ 150.889441][ T2207] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 151.628616][ T2430] 9pnet_fd: Insufficient options for proto=fd [ 151.637005][ T234] tipc: Subscription rejected, illegal request [ 151.756811][ T2446] loop0: detected capacity change from 0 to 256 [ 151.895766][ T28] kauditd_printk_skb: 7 callbacks suppressed [ 151.895815][ T28] audit: type=1326 audit(1793850850.081:638): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2445 comm="syz.0.629" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f859019fb19 code=0x0 [ 152.760412][ T2465] fuse: Bad value for 'fd' [ 152.805787][ T2467] loop2: detected capacity change from 0 to 16 [ 152.816446][ T2467] erofs: (device loop2): mounted with root inode @ nid 36. [ 152.864707][ T2476] FAULT_INJECTION: forcing a failure. [ 152.864707][ T2476] name failslab, interval 1, probability 0, space 0, times 0 [ 152.971770][ T2476] CPU: 1 PID: 2476 Comm: syz.1.639 Not tainted syzkaller #0 [ 152.979111][ T2476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 152.989183][ T2476] Call Trace: [ 152.992473][ T2476] [ 152.995411][ T2476] __dump_stack+0x21/0x24 [ 152.999754][ T2476] dump_stack_lvl+0x110/0x170 [ 153.004440][ T2476] ? __cfi_dump_stack_lvl+0x8/0x8 [ 153.009475][ T2476] dump_stack+0x15/0x24 [ 153.013642][ T2476] should_fail_ex+0x3bf/0x510 [ 153.018335][ T2476] ? security_inode_alloc+0x33/0x120 [ 153.023640][ T2476] __should_failslab+0xac/0xf0 [ 153.028420][ T2476] should_failslab+0x9/0x20 [ 153.032936][ T2476] kmem_cache_alloc+0x3b/0x320 [ 153.037737][ T2476] security_inode_alloc+0x33/0x120 [ 153.042864][ T2476] inode_init_always+0x6ee/0x950 [ 153.047816][ T2476] new_inode_pseudo+0xa2/0x1f0 [ 153.052591][ T2476] new_inode+0x28/0x1e0 [ 153.056762][ T2476] shmem_get_inode+0x36d/0xba0 [ 153.061556][ T2476] __shmem_file_setup+0x113/0x2b0 [ 153.066617][ T2476] shmem_file_setup+0x2f/0x40 [ 153.071315][ T2476] __se_sys_memfd_create+0x1de/0x3c0 [ 153.076622][ T2476] __x64_sys_memfd_create+0x5b/0x70 [ 153.081841][ T2476] x64_sys_call+0x235/0x9a0 [ 153.086377][ T2476] do_syscall_64+0x4c/0xa0 [ 153.090811][ T2476] ? clear_bhb_loop+0x30/0x80 [ 153.095531][ T2476] ? clear_bhb_loop+0x30/0x80 [ 153.100230][ T2476] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 153.106136][ T2476] RIP: 0033:0x7f4f1db9fb19 [ 153.110560][ T2476] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 153.130175][ T2476] RSP: 002b:00007f4f1ea30e08 EFLAGS: 00000202 ORIG_RAX: 000000000000013f [ 153.138596][ T2476] RAX: ffffffffffffffda RBX: 0000000000000baf RCX: 00007f4f1db9fb19 [ 153.146578][ T2476] RDX: 00007f4f1ea30ee0 RSI: 0000000000000000 RDI: 00007f4f1dc37d63 [ 153.154559][ T2476] RBP: 0000200000000a00 R08: 00000000ffffffff R09: 0000000000000000 [ 153.162537][ T2476] R10: 0000000000000001 R11: 0000000000000202 R12: 0000200000000940 [ 153.170524][ T2476] R13: 00007f4f1ea30ee0 R14: 00007f4f1ea30ea0 R15: 00002000000009c0 [ 153.178510][ T2476] [ 153.283155][ T28] audit: type=1400 audit(1793850851.461:639): avc: denied { setopt } for pid=2486 comm="syz.0.640" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 153.365198][ T2492] fuse: Bad value for 'fd' [ 153.385495][ T2494] loop0: detected capacity change from 0 to 16 [ 153.391987][ T2494] erofs: Unknown parameter '0x00000000000001683>AU%."oX׻ڠqZRdDKލ{#T' [ 155.285327][ T2511] overlayfs: missing 'workdir' [ 155.295718][ T2515] loop0: detected capacity change from 0 to 256 [ 156.492946][ T28] audit: type=1326 audit(1793850854.671:640): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2514 comm="syz.0.651" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f859019fb19 code=0x0 [ 158.227219][ T2541] loop0: detected capacity change from 0 to 128 [ 158.817769][ T2532] syz.0.653 (2532) used greatest stack depth: 14408 bytes left [ 159.284173][ T28] audit: type=1326 audit(1793850857.461:641): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2558 comm="syz.3.662" exe="/root/ci2-android-6-1/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe06679fb19 code=0x0 [ 159.321828][ T2561] loop0: detected capacity change from 0 to 16 [ 159.329585][ T2561] erofs: (device loop0): EXPERIMENTAL compressed inline data feature in use. Use at your own risk! [ 159.341146][ T2561] erofs: (device loop0): EXPERIMENTAL compressed fragments feature in use. Use at your own risk! [ 159.352172][ T2561] erofs: (device loop0): EXPERIMENTAL global deduplication feature in use. Use at your own risk! [ 159.416456][ T2561] erofs: (device loop0): mounted with root inode @ nid 36. [ 159.448305][ T2561] erofs: (device loop0): z_erofs_fill_inode_lazy: per-inode big pcluster without sb feature for nid 36 [ 159.460142][ T2561] erofs: (device loop0): z_erofs_fill_inode_lazy: per-inode big pcluster without sb feature for nid 36 [ 159.472481][ T2561] erofs: (device loop0): z_erofs_read_folio: failed to read, err [-117] [ 159.605686][ T2564] bridge0: port 2(bridge_slave_1) entered disabled state [ 159.612949][ T2564] bridge0: port 1(bridge_slave_0) entered disabled state [ 161.189926][ T2598] netlink: 'syz.0.667': attribute type 9 has an invalid length. [ 161.254525][ T28] audit: type=1400 audit(1793850859.381:642): avc: denied { audit_write } for pid=2595 comm="syz.2.671" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 161.326572][ T28] audit: type=1107 audit(1793850859.381:643): pid=2595 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 161.344482][ T309] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 161.824715][ T309] usb 2-1: Using ep0 maxpacket: 16 [ 161.832713][ T309] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 161.863910][ T309] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 161.893538][ T309] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 161.933458][ T309] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 161.958269][ T309] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.024893][ T309] usb 2-1: config 0 descriptor?? [ 162.064003][ T2601] loop2: detected capacity change from 0 to 512 [ 162.264506][ T28] audit: type=1400 audit(1793850860.441:644): avc: denied { read write } for pid=2600 comm="syz.2.672" name="mtrr" dev="proc" ino=4026532003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 162.357468][ T28] audit: type=1400 audit(1793850860.441:645): avc: denied { open } for pid=2600 comm="syz.2.672" path="/134/proc/mtrr" dev="proc" ino=4026532003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 162.488902][ T2613] ip_tables: iptables: counters copy to user failed while replacing table [ 162.553566][ T2615] loop2: detected capacity change from 0 to 128 [ 162.796692][ T309] microsoft 0003:045E:07DA.0006: unknown main item tag 0x0 [ 162.804019][ T309] microsoft 0003:045E:07DA.0006: item fetching failed at offset 30/34 [ 162.812494][ T309] microsoft 0003:045E:07DA.0006: parse failed [ 162.818662][ T309] microsoft: probe of 0003:045E:07DA.0006 failed with error -22 [ 162.831289][ T28] audit: type=1400 audit(1793850860.441:646): avc: denied { ioctl } for pid=2600 comm="syz.2.672" path="/134/proc/mtrr" dev="proc" ino=4026532003 ioctlcmd=0x4d00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 165.725923][ T302] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 166.715515][ T302] usb 1-1: config 0 interface 0 has no altsetting 0 [ 166.722180][ T302] usb 1-1: New USB device found, idVendor=056a, idProduct=00b1, bcdDevice= 0.00 [ 166.770497][ T2665] loop2: detected capacity change from 0 to 512 [ 166.803374][ T302] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.937487][ T659] usb 2-1: USB disconnect, device number 11 [ 167.140762][ T2682] tipc: Enabling of bearer rejected, failed to enable media [ 167.163877][ T302] usb 1-1: config 0 descriptor?? [ 167.179548][ T2671] netlink: 'syz.1.693': attribute type 9 has an invalid length. [ 167.763314][ T302] usbhid 1-1:0.0: can't add hid device: -71 [ 167.778057][ T302] usbhid: probe of 1-1:0.0 failed with error -71 [ 167.794688][ T302] usb 1-1: USB disconnect, device number 8 [ 168.144467][ T659] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 168.530548][ T302] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 168.634467][ T659] usb 3-1: Using ep0 maxpacket: 32 [ 168.647975][ T659] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 168.689093][ T659] usb 3-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice= 0.40 [ 168.714446][ T659] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.757169][ T659] usb 3-1: Product: syz [ 168.761370][ T659] usb 3-1: Manufacturer: syz [ 168.784431][ T302] usb 1-1: Using ep0 maxpacket: 32 [ 168.790758][ T302] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 168.812177][ T659] usb 3-1: SerialNumber: syz [ 168.833770][ T302] usb 1-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice= 0.40 [ 168.863108][ T302] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.881363][ T302] usb 1-1: Product: syz [ 168.891001][ T302] usb 1-1: Manufacturer: syz [ 168.901106][ T302] usb 1-1: SerialNumber: syz [ 169.413187][ T659] usb 3-1: 1:1 : incorrect wMaxPacketSize for BADD profile [ 169.464186][ T659] usb 3-1: incorrect wMaxPacketSize 0x20 for BADD profile [ 169.677458][ T659] snd-usb-audio: probe of 3-1:1.0 failed with error -22 [ 169.822687][ T2207] udevd[2207]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 169.858560][ T302] usb 1-1: 1:1 : incorrect wMaxPacketSize for BADD profile [ 169.867514][ T659] usb 3-1: USB disconnect, device number 18 [ 169.992622][ T302] usb 1-1: incorrect wMaxPacketSize 0x20 for BADD profile [ 170.014874][ T302] snd-usb-audio: probe of 1-1:1.0 failed with error -22 [ 170.023475][ T302] usb 1-1: USB disconnect, device number 9 [ 170.032123][ T2268] udevd[2268]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 171.367880][ T28] audit: type=1400 audit(1793850869.551:647): avc: denied { accept } for pid=2739 comm="syz.3.710" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 172.235230][ T2761] loop1: detected capacity change from 0 to 1024 [ 172.245071][ T2761] EXT4-fs: Ignoring removed bh option [ 172.271165][ T2761] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 172.424436][ T659] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 172.614486][ T659] usb 3-1: Using ep0 maxpacket: 32 [ 172.621118][ T659] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 172.662910][ T659] usb 3-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice= 0.40 [ 172.681076][ T659] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 172.697189][ T659] usb 3-1: Product: syz [ 172.758915][ T659] usb 3-1: Manufacturer: syz [ 172.764629][ T659] usb 3-1: SerialNumber: syz [ 172.965162][ T292] EXT4-fs (loop1): unmounting filesystem. [ 173.375437][ T659] usb 3-1: 1:1 : incorrect wMaxPacketSize for BADD profile [ 174.090246][ T659] usb 3-1: incorrect wMaxPacketSize 0x20 for BADD profile [ 174.484437][ T309] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 174.654229][ T659] snd-usb-audio: probe of 3-1:1.0 failed with error -22 [ 174.663791][ T659] usb 3-1: USB disconnect, device number 19 [ 174.838598][ T2795] loop0: detected capacity change from 0 to 512 [ 174.864062][ T2793] loop2: detected capacity change from 0 to 512 [ 174.945003][ T2268] udevd[2268]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 175.904463][ T309] usb 2-1: Using ep0 maxpacket: 32 [ 175.910947][ T309] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 175.925066][ T2207] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 175.951334][ T309] usb 2-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice= 0.40 [ 175.983145][ T28] audit: type=1400 audit(1793850874.161:648): avc: denied { write } for pid=2802 comm="syz.2.724" name="control" dev="devtmpfs" ino=266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 176.014656][ T28] audit: type=1400 audit(1793850874.191:649): avc: denied { open } for pid=2802 comm="syz.2.724" path="/dev/mapper/control" dev="devtmpfs" ino=266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 176.050120][ T28] audit: type=1400 audit(1793850874.191:650): avc: denied { ioctl } for pid=2802 comm="syz.2.724" path="/dev/mapper/control" dev="devtmpfs" ino=266 ioctlcmd=0xfd03 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 176.280252][ T309] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.295317][ T2810] netlink: 280 bytes leftover after parsing attributes in process `syz.0.725'. [ 176.310999][ T309] usb 2-1: Product: syz [ 176.323932][ T309] usb 2-1: Manufacturer: syz [ 176.335554][ T309] usb 2-1: SerialNumber: syz [ 176.415996][ T2815] IPv6: NLM_F_CREATE should be specified when creating new route [ 176.425024][ T2813] overlayfs: statfs failed on './file0' [ 176.479299][ T28] audit: type=1326 audit(1793850874.651:651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2816 comm="syz.3.728" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe06679fb19 code=0x0 [ 177.564958][ T309] usb 2-1: 1:1 : incorrect wMaxPacketSize for BADD profile [ 177.574660][ T309] usb 2-1: incorrect wMaxPacketSize 0x20 for BADD profile [ 177.611082][ T2837] SELinux: Context Y7j [ 177.611082][ T2837] u/$2Sٟ2'ks2- vjd #,N< [ 177.611082][ T2837] :E]Y\?ͼ=ً1KIk{kL^0}4nr}pįNwyxiu?+H~F1Wjm &8UۂVN2)GxV%5xeRM4r4cJsHU&'p2EMMk&cbU,,f@8bD%$f=8@kI|w Ox&KCH;x-Ko4i!Oi%ڂ2 F"2E,P] k? is not valid (left unmapped). [ 177.655859][ T309] snd-usb-audio: probe of 2-1:1.0 failed with error -22 [ 177.670693][ T2268] udevd[2268]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 177.686748][ T309] usb 2-1: USB disconnect, device number 12 [ 177.706653][ T2837] SELinux: Context *mkXI$hx4۫KM is not valid (left unmapped). [ 177.739742][ T2841] loop2: detected capacity change from 0 to 512 [ 177.746331][ T2837] SELinux: Context KM*,hcIǾû̋y+.+y0[pr;JA9Iq jǼ=7)oM{nF=XmnxrD㑉垳4TW}t%ȖY^slFB53hm5};JXom%~"~9mM~alʺLI8i [ 178.803454][ T2891] __dump_stack+0x21/0x24 [ 178.807807][ T2891] dump_stack_lvl+0x110/0x170 [ 178.812507][ T2891] ? __cfi_dump_stack_lvl+0x8/0x8 [ 178.817573][ T2891] ? __stack_depot_save+0x36/0x490 [ 178.822719][ T2891] dump_stack+0x15/0x24 [ 178.826895][ T2891] should_fail_ex+0x3bf/0x510 [ 178.831604][ T2891] should_fail+0xb/0x10 [ 178.835780][ T2891] get_futex_key+0x170/0xb10 [ 178.840404][ T2891] ? __cfi_get_futex_key+0x10/0x10 [ 178.845635][ T2891] ? kstrtouint_from_user+0x113/0x170 [ 178.851047][ T2891] futex_wake+0x150/0x8e0 [ 178.855433][ T2891] ? __cfi_futex_wake+0x10/0x10 [ 178.860320][ T2891] ? proc_fail_nth_write+0x180/0x200 [ 178.865640][ T2891] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 178.871296][ T2891] ? security_file_permission+0x8a/0xb0 [ 178.876865][ T2891] ? vfs_write+0xa51/0xd00 [ 178.881301][ T2891] do_futex+0x2bf/0x430 [ 178.885471][ T2891] ? __cfi_do_futex+0x10/0x10 [ 178.890164][ T2891] ? __kasan_check_write+0x14/0x20 [ 178.895290][ T2891] ? mutex_unlock+0x8f/0x230 [ 178.899902][ T2891] __se_sys_futex+0x136/0x310 [ 178.904590][ T2891] ? __x64_sys_futex+0x100/0x100 [ 178.909541][ T2891] ? ksys_write+0x1fa/0x260 [ 178.914060][ T2891] ? __cfi_ksys_write+0x10/0x10 [ 178.918930][ T2891] __x64_sys_futex+0xe5/0x100 [ 178.923622][ T2891] x64_sys_call+0x7ec/0x9a0 [ 178.928152][ T2891] do_syscall_64+0x4c/0xa0 [ 178.932584][ T2891] ? clear_bhb_loop+0x30/0x80 [ 178.937302][ T2891] ? clear_bhb_loop+0x30/0x80 [ 178.942002][ T2891] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 178.947913][ T2891] RIP: 0033:0x7f4f1db9fb19 [ 178.952340][ T2891] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 178.972138][ T2891] RSP: 002b:00007f4f1e9ef028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 178.980573][ T2891] RAX: ffffffffffffffda RBX: 00007f4f1de26180 RCX: 00007f4f1db9fb19 [ 178.988565][ T2891] RDX: 0000000000000801 RSI: 000000000000000a RDI: 0000000000000000 [ 178.996554][ T2891] RBP: 00007f4f1e9ef090 R08: 0000000000000000 R09: 00000000fffffffc [ 179.004545][ T2891] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 179.012533][ T2891] R13: 00007f4f1de26218 R14: 00007f4f1de26180 R15: 00007ffcdec67d68 [ 179.020645][ T2891] [ 179.428544][ T2916] ip_tables: iptables: counters copy to user failed while replacing table [ 179.448647][ T2916] netlink: 16 bytes leftover after parsing attributes in process `syz.5.752'. [ 179.468302][ T2916] ip_tables: iptables: counters copy to user failed while replacing table [ 179.517407][ T2918] overlayfs: statfs failed on './file0' [ 179.642631][ T2926] loop1: detected capacity change from 0 to 2048 [ 179.719480][ T2926] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 179.728022][ T28] audit: type=1326 audit(1793850877.901:652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2921 comm="syz.5.755" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f10d419fb19 code=0x0 [ 180.010515][ T2936] loop0: detected capacity change from 0 to 512 [ 180.487186][ T28] audit: type=1400 audit(1793850878.671:653): avc: denied { mount } for pid=2944 comm="syz.5.761" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 180.540046][ T28] audit: type=1400 audit(1793850878.671:654): avc: denied { mounton } for pid=2944 comm="syz.5.761" path="/sys" dev="bpf" ino=27885 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=dir permissive=1 [ 180.851074][ T2960] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.875823][ T2960] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 180.900285][ T2960] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.924896][ T2960] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 180.952205][ T2960] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.975456][ T2960] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 180.994594][ T2960] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.024276][ T2962] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=2962 comm=syz.5.763 [ 181.039822][ T2960] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.060917][ T2960] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.079667][ T2960] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.114429][ T6] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 181.166668][ T292] EXT4-fs (loop1): unmounting filesystem. [ 181.315476][ T6] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 181.326070][ T6] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 181.336055][ T6] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 181.345855][ T6] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 181.364092][ T6] usb 1-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 181.373343][ T6] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.381568][ T6] usb 1-1: Product: syz [ 181.385874][ T6] usb 1-1: Manufacturer: syz [ 181.390518][ T6] usb 1-1: SerialNumber: syz [ 181.402510][ T6] usb 1-1: config 0 descriptor?? [ 181.412979][ T6] ums-isd200 1-1:0.0: USB Mass Storage device detected [ 181.612828][ T6] scsi host1: usb-storage 1-1:0.0 [ 181.622154][ T6] usb 1-1: USB disconnect, device number 10 [ 182.180235][ T3000] overlayfs: failed to resolve './bus': -2 [ 182.601973][ T3012] loop2: detected capacity change from 0 to 256 [ 182.612346][ T3012] exFAT-fs (loop2): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 184.041194][ T3034] netlink: 48 bytes leftover after parsing attributes in process `syz.5.789'. [ 184.087921][ T3041] netlink: 16 bytes leftover after parsing attributes in process `syz.1.791'. [ 184.109855][ T3044] netlink: 4 bytes leftover after parsing attributes in process `syz.5.789'. [ 184.172432][ T28] audit: type=1400 audit(1793850888.354:655): avc: denied { ioctl } for pid=3045 comm="syz.1.792" path="/dev/fuse" dev="devtmpfs" ino=93 ioctlcmd=0xe500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 185.096707][ T28] audit: type=1400 audit(1793850889.284:656): avc: denied { write } for pid=3063 comm="syz.1.798" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 185.233225][ T28] audit: type=1400 audit(1793850889.414:657): avc: denied { write } for pid=3067 comm="syz.1.800" path="socket:[28103]" dev="sockfs" ino=28103 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 185.544121][ T3077] loop1: detected capacity change from 0 to 512 [ 185.622539][ T3077] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 185.733953][ T292] EXT4-fs error (device loop1): ext4_readdir:263: inode #2: block 3: comm syz-executor: path /167/file0: bad entry in directory: rec_len is too small for name_len - offset=24, inode=11, rec_len=20, size=4096 fake=0 [ 186.877099][ T3096] incfs: Options parsing error. -22 [ 186.882603][ T3096] incfs: mount failed -22 [ 186.954492][ T659] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 187.624504][ T659] usb 3-1: Using ep0 maxpacket: 16 [ 187.630849][ T3108] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 187.631570][ T659] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 187.682242][ T659] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 187.701940][ T659] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 187.711234][ T659] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.719729][ T659] usb 3-1: Product: syz [ 187.723958][ T659] usb 3-1: Manufacturer: syz [ 187.728817][ T659] usb 3-1: SerialNumber: syz [ 187.846361][ T3082] EXT4-fs (loop1): unmounting filesystem. [ 187.973844][ T3092] 9pnet: p9_errstr2errno: server reported unknown error 18446744073709551615 [ 187.984370][ T3092] netlink: 48 bytes leftover after parsing attributes in process `syz.2.808'. [ 187.993814][ T3092] netlink: 20 bytes leftover after parsing attributes in process `syz.2.808'. [ 188.006069][ T659] usb 3-1: 0:2 : does not exist [ 188.011002][ T659] usb 3-1: unit 6 not found! [ 188.019061][ T659] usb 3-1: USB disconnect, device number 20 [ 188.036523][ T28] audit: type=1326 audit(1793850892.224:658): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3126 comm="syz.3.823" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe06679fb19 code=0x0 [ 188.068017][ T3125] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.075161][ T3125] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.082494][ T3125] device bridge_slave_0 entered promiscuous mode [ 188.089473][ T3125] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.096527][ T3125] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.103852][ T3125] device bridge_slave_1 entered promiscuous mode [ 188.163902][ T3125] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.170975][ T3125] bridge0: port 2(bridge_slave_1) entered forwarding state [ 188.178707][ T3125] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.185859][ T3125] bridge0: port 1(bridge_slave_0) entered forwarding state [ 188.203725][ T2909] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 188.211424][ T2909] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.218740][ T2909] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.229185][ T2909] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 188.237713][ T2909] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.244797][ T2909] bridge0: port 1(bridge_slave_0) entered forwarding state [ 188.253376][ T2909] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 188.255122][ T2268] udevd[2268]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 188.261864][ T2909] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.284117][ T2909] bridge0: port 2(bridge_slave_1) entered forwarding state [ 188.297328][ T2909] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 188.306353][ T2909] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 188.325958][ T2909] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 188.335327][ T2909] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 188.343293][ T2909] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 188.351145][ T2909] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 188.361306][ T3125] device veth0_vlan entered promiscuous mode [ 188.371195][ T2909] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 188.380351][ T3125] device veth1_macvtap entered promiscuous mode [ 188.403476][ T2909] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 188.477066][ T2909] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 188.498126][ T2903] device bridge_slave_1 left promiscuous mode [ 188.551945][ T2903] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.624656][ T2903] device bridge_slave_0 left promiscuous mode [ 188.648142][ T2903] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.694627][ T2903] device veth1_macvtap left promiscuous mode [ 188.700731][ T2903] device veth0_vlan left promiscuous mode [ 188.706045][ T3140] loop0: detected capacity change from 0 to 256 [ 188.725379][ T2268] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 188.778344][ T28] audit: type=1400 audit(1793850892.964:659): avc: denied { getopt } for pid=3139 comm="syz.0.826" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 188.799673][ T3142] loop0: detected capacity change from 0 to 256 [ 188.806327][ T3142] exfat: Unknown parameter 'exfat' [ 188.879494][ T3141] loop2: detected capacity change from 0 to 40427 [ 188.894181][ T3141] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 188.902231][ T3141] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 188.911356][ T3141] F2FS-fs (loop2): invalid crc value [ 188.918309][ T3141] F2FS-fs (loop2): Found nat_bits in checkpoint [ 188.940362][ T3141] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 188.947616][ T3141] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 189.104500][ T6] usb 7-1: new full-speed USB device number 2 using dummy_hcd [ 189.285556][ T6] usb 7-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 189.299681][ T6] usb 7-1: config 0 interface 0 has no altsetting 0 [ 189.306389][ T6] usb 7-1: New USB device found, idVendor=0810, idProduct=0001, bcdDevice= 0.00 [ 189.315543][ T6] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.329120][ T6] usb 7-1: config 0 descriptor?? [ 189.753113][ T6] input: HID 0810:0001 as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:0810:0001.0007/input/input7 [ 189.815769][ T6] pantherlord 0003:0810:0001.0007: input,hidraw0: USB HID v80.00 Joystick [HID 0810:0001] on usb-dummy_hcd.6-1/input0 [ 189.859808][ T6] pantherlord 0003:0810:0001.0007: no output reports found [ 190.243457][ T28] audit: type=1400 audit(1793850894.424:660): avc: denied { bind } for pid=3176 comm="syz.2.834" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 190.316418][ T28] audit: type=1400 audit(1793850894.454:661): avc: denied { name_bind } for pid=3176 comm="syz.2.834" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 190.467438][ T28] audit: type=1400 audit(1793850894.454:662): avc: denied { node_bind } for pid=3176 comm="syz.2.834" saddr=::ffff:0.0.0.0 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 190.634807][ T28] audit: type=1400 audit(1793850894.824:663): avc: denied { append } for pid=3143 comm="syz.6.821" name="event2" dev="devtmpfs" ino=277 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 190.774654][ T28] audit: type=1326 audit(1793850894.964:664): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3185 comm="syz.0.836" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f859019fb19 code=0x0 [ 191.053069][ T3183] loop2: detected capacity change from 0 to 512 [ 191.079732][ T3183] EXT4-fs: Ignoring removed nobh option [ 191.100595][ T3183] EXT4-fs: Ignoring removed mblk_io_submit option [ 191.125947][ T3183] EXT4-fs (loop2): can't mount with both data=journal and delalloc [ 191.653153][ T28] audit: type=1400 audit(1793850895.834:665): avc: denied { bind } for pid=3194 comm="syz.2.839" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 191.655067][ T3195] loop2: detected capacity change from 0 to 256 [ 191.688487][ T3195] exfat: Unknown parameter '' [ 191.770496][ T3195] loop2: detected capacity change from 0 to 512 [ 191.919734][ T3199] loop2: detected capacity change from 0 to 256 [ 191.966146][ T3199] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xcab3d314, utbl_chksum : 0xe619d30d) [ 192.120051][ T649] usb 7-1: USB disconnect, device number 2 [ 192.554707][ T28] audit: type=1400 audit(1793850896.744:666): avc: denied { read } for pid=3202 comm="syz.6.842" name="ppp" dev="devtmpfs" ino=158 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 192.607017][ T28] audit: type=1400 audit(1793850896.744:667): avc: denied { lock } for pid=3209 comm="syz.2.844" path="socket:[29247]" dev="sockfs" ino=29247 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 192.610197][ T3218] netlink: 24 bytes leftover after parsing attributes in process `syz.2.848'. [ 192.631562][ T28] audit: type=1400 audit(1793850896.764:668): avc: denied { open } for pid=3202 comm="syz.6.842" path="/dev/ppp" dev="devtmpfs" ino=158 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 192.669913][ T28] audit: type=1400 audit(1793850896.764:669): avc: denied { ioctl } for pid=3202 comm="syz.6.842" path="/dev/ppp" dev="devtmpfs" ino=158 ioctlcmd=0x743f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 192.735217][ T3223] loop2: detected capacity change from 0 to 256 [ 192.747152][ T3223] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d) [ 192.881401][ T3227] loop2: detected capacity change from 0 to 40427 [ 192.891709][ T3227] F2FS-fs (loop2): Wrong secs_per_zone / total_sections (262145, 24) [ 192.899947][ T3227] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 192.908272][ T3227] F2FS-fs (loop2): Unrecognized mount option "0x0000000000000000" or missing value [ 193.114709][ T649] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 193.264491][ T659] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 193.294445][ T649] usb 7-1: Using ep0 maxpacket: 32 [ 193.300745][ T649] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 193.313187][ T649] usb 7-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice= 0.40 [ 193.322274][ T649] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.330397][ T649] usb 7-1: Product: syz [ 193.334591][ T649] usb 7-1: Manufacturer: syz [ 193.339239][ T649] usb 7-1: SerialNumber: syz [ 193.414447][ T659] usb 3-1: device descriptor read/64, error -71 [ 193.548664][ T3244] xt_TCPMSS: Only works on TCP SYN packets [ 193.684532][ T659] usb 3-1: device descriptor read/64, error -71 [ 193.790074][ T3252] loop0: detected capacity change from 0 to 512 [ 193.801047][ T3252] EXT4-fs: Ignoring removed oldalloc option [ 193.805393][ T649] usb 7-1: 1:1 : incorrect wMaxPacketSize for BADD profile [ 193.820511][ T3252] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 193.825199][ T649] usb 7-1: incorrect wMaxPacketSize 0x20 for BADD profile [ 193.849019][ T3252] EXT4-fs (loop0): 1 truncate cleaned up [ 193.856387][ T649] snd-usb-audio: probe of 7-1:1.0 failed with error -22 [ 193.861272][ T3252] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 193.898455][ T649] usb 7-1: USB disconnect, device number 3 [ 193.904240][ T2268] udevd[2268]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 193.964850][ T659] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 194.031404][ T288] EXT4-fs (loop0): unmounting filesystem. [ 194.124615][ T659] usb 3-1: device descriptor read/64, error -71 [ 194.164537][ T3262] loop0: detected capacity change from 0 to 1024 [ 194.194976][ T3262] EXT4-fs (loop0): couldn't mount as ext2 due to feature incompatibilities [ 194.818713][ T3267] loop0: detected capacity change from 0 to 512 [ 194.824453][ T659] usb 3-1: device descriptor read/64, error -71 [ 194.839647][ T3267] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 194.882055][ T3267] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 194.960510][ T659] usb usb3-port1: attempt power cycle [ 194.960641][ T3267] ext4 filesystem being mounted at /162/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 195.081981][ T3267] EXT4-fs error (device loop0): ext4_lookup:1858: inode #12: comm syz.0.865: iget: bad i_size value: 2533274857506816 [ 195.132600][ T288] EXT4-fs (loop0): unmounting filesystem. [ 195.315473][ T3281] loop0: detected capacity change from 0 to 1024 [ 195.342429][ T3281] EXT4-fs: Ignoring removed bh option [ 195.385156][ T659] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 195.386058][ T3281] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 195.435713][ T659] usb 3-1: device descriptor read/8, error -71 [ 195.596092][ T659] usb 3-1: device descriptor read/8, error -71 [ 195.784273][ T3288] xt_hashlimit: size too large, truncated to 1048576 [ 195.809388][ T3288] xt_hashlimit: max too large, truncated to 1048576 [ 195.864457][ T659] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 196.063524][ T28] kauditd_printk_skb: 2 callbacks suppressed [ 196.063541][ T28] audit: type=1400 audit(1793850900.244:672): avc: denied { getopt } for pid=3294 comm="syz.6.873" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 196.091933][ T288] EXT4-fs (loop0): unmounting filesystem. [ 196.117861][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 196.324862][ T659] usb 3-1: device not accepting address 24, error -71 [ 196.327642][ T28] audit: type=1400 audit(1793850900.484:673): avc: denied { ioctl } for pid=3296 comm="syz.0.874" path="socket:[29357]" dev="sockfs" ino=29357 ioctlcmd=0x7436 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 196.384210][ T659] usb usb3-port1: unable to enumerate USB device [ 197.193745][ T3319] loop6: detected capacity change from 0 to 128 [ 197.207425][ T3320] device vti0 left promiscuous mode [ 197.227829][ T3319] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 197.514505][ T659] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 197.571422][ T3347] loop6: detected capacity change from 0 to 512 [ 197.578660][ T3347] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 197.590245][ T3347] EXT4-fs (loop6): 1 truncate cleaned up [ 197.608358][ T3347] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 197.626608][ T3125] EXT4-fs (loop6): unmounting filesystem. [ 197.669052][ T3354] 9pnet_fd: Insufficient options for proto=fd [ 197.691515][ T3356] loop6: detected capacity change from 0 to 256 [ 197.706248][ T3356] exfat: Deprecated parameter 'utf8' [ 197.712788][ T3356] exfat: Deprecated parameter 'namecase' [ 197.720468][ T3356] exfat: Deprecated parameter 'namecase' [ 197.725032][ T659] usb 1-1: Using ep0 maxpacket: 32 [ 197.734019][ T3356] exFAT-fs (loop6): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 197.746766][ T659] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 197.762032][ T28] audit: type=1400 audit(1793850901.944:674): avc: denied { setattr } for pid=3355 comm="syz.6.896" name="file0" dev="loop6" ino=1048691 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 197.787770][ T659] usb 1-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice= 0.40 [ 197.803340][ T659] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.819017][ T659] usb 1-1: Product: syz [ 197.824534][ T659] usb 1-1: Manufacturer: syz [ 197.829180][ T659] usb 1-1: SerialNumber: syz [ 198.339753][ T659] usb 1-1: 1:1 : incorrect wMaxPacketSize for BADD profile [ 198.351451][ T659] usb 1-1: incorrect wMaxPacketSize 0x20 for BADD profile [ 198.376745][ T659] snd-usb-audio: probe of 1-1:1.0 failed with error -22 [ 198.393922][ T659] usb 1-1: USB disconnect, device number 11 [ 198.425845][ T2268] udevd[2268]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 198.791139][ T28] audit: type=1400 audit(1793850902.974:675): avc: denied { mounton } for pid=3355 comm="syz.6.896" path=2F31352FE91F7189591E9233614B2F66696C6530 dev="loop6" ino=1048691 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 199.237172][ T28] audit: type=1400 audit(1793850903.424:676): avc: denied { execute_no_trans } for pid=3369 comm="syz.3.900" path="/180/file0" dev="tmpfs" ino=995 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 199.284440][ T19] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 199.770798][ T3384] loop6: detected capacity change from 0 to 1024 [ 199.844575][ T3384] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 199.956767][ T3384] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 200.015999][ T3384] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=39815 sclass=netlink_route_socket pid=3384 comm=syz.6.904 [ 200.028762][ T28] audit: type=1400 audit(1793850904.174:677): avc: denied { ioctl } for pid=3383 comm="syz.6.904" path="/18/file1/file1" dev="loop6" ino=15 ioctlcmd=0x7506 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 200.151727][ T3125] EXT4-fs (loop6): unmounting filesystem. [ 200.165180][ T3390] 9pnet_fd: Insufficient options for proto=fd [ 200.188680][ T3390] overlayfs: failed to clone upperpath [ 200.252370][ T3394] FAULT_INJECTION: forcing a failure. [ 200.252370][ T3394] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 200.254451][ T19] usb 3-1: Using ep0 maxpacket: 16 [ 200.284097][ T19] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 200.298723][ T3394] CPU: 1 PID: 3394 Comm: syz.6.908 Not tainted syzkaller #0 [ 200.306035][ T3394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 200.310726][ T19] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 200.316110][ T3394] Call Trace: [ 200.316122][ T3394] [ 200.316129][ T3394] __dump_stack+0x21/0x24 [ 200.316155][ T3394] dump_stack_lvl+0x110/0x170 [ 200.316171][ T3394] ? __cfi_dump_stack_lvl+0x8/0x8 [ 200.316189][ T3394] dump_stack+0x15/0x24 [ 200.316207][ T3394] should_fail_ex+0x3bf/0x510 [ 200.338117][ T19] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 200.341107][ T3394] should_fail+0xb/0x10 [ 200.352670][ T19] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 200.354946][ T3394] should_fail_usercopy+0x1a/0x20 [ 200.354972][ T3394] _copy_from_user+0x1e/0xc0 [ 200.354990][ T3394] __sys_sendto+0x30b/0x660 [ 200.395133][ T3394] ? __cfi___sys_sendto+0x10/0x10 [ 200.398355][ T19] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 200.400176][ T3394] ? ksys_write+0x1fa/0x260 [ 200.412631][ T3394] ? __cfi_ksys_write+0x10/0x10 [ 200.417512][ T3394] __x64_sys_sendto+0xe5/0x100 [ 200.422300][ T3394] x64_sys_call+0x83/0x9a0 [ 200.426741][ T3394] do_syscall_64+0x4c/0xa0 [ 200.431172][ T3394] ? clear_bhb_loop+0x30/0x80 [ 200.435873][ T3394] ? clear_bhb_loop+0x30/0x80 [ 200.440596][ T3394] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 200.446503][ T3394] RIP: 0033:0x7fe199f9fb19 [ 200.450926][ T3394] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 200.464799][ T19] usb 3-1: config 0 descriptor?? [ 200.470546][ T3394] RSP: 002b:00007fe19ae62028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 200.470574][ T3394] RAX: ffffffffffffffda RBX: 00007fe19a225fa0 RCX: 00007fe199f9fb19 [ 200.491888][ T3394] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 200.499881][ T3394] RBP: 00007fe19ae62090 R08: 0000200000000780 R09: 0000000000000010 [ 200.507870][ T3394] R10: 00000000200007fd R11: 0000000000000246 R12: 0000000000000001 [ 200.515861][ T3394] R13: 00007fe19a226038 R14: 00007fe19a225fa0 R15: 00007ffc236ba568 [ 200.523854][ T3394] [ 200.840959][ T3400] netlink: 'syz.3.909': attribute type 16 has an invalid length. [ 200.862762][ T3400] netlink: 'syz.3.909': attribute type 17 has an invalid length. [ 200.906502][ T19] microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 [ 200.929019][ T19] microsoft 0003:045E:07DA.0008: item fetching failed at offset 30/34 [ 200.934319][ T3400] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 200.947707][ T19] microsoft 0003:045E:07DA.0008: parse failed [ 200.957121][ T3409] loop6: detected capacity change from 0 to 40427 [ 200.963951][ T19] microsoft: probe of 0003:045E:07DA.0008 failed with error -22 [ 200.965225][ T3400] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 200.980255][ T3409] F2FS-fs (loop6): invalid crc value [ 200.991845][ T3409] F2FS-fs (loop6): Found nat_bits in checkpoint [ 201.070449][ T3409] F2FS-fs (loop6): Start checkpoint disabled! [ 201.086079][ T3400] device veth0_vlan left promiscuous mode [ 201.092851][ T3409] F2FS-fs (loop6): f2fs_disable_checkpoint() finish, err:0 [ 201.100833][ T3400] device veth0_vlan entered promiscuous mode [ 201.126429][ T3409] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e6 [ 201.152993][ T3400] device veth1_macvtap left promiscuous mode [ 201.180785][ T3400] device veth1_macvtap entered promiscuous mode [ 201.236564][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 201.248509][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 201.275797][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 201.300753][ T782] bridge0: port 1(bridge_slave_0) entered blocking state [ 201.307884][ T782] bridge0: port 1(bridge_slave_0) entered forwarding state [ 201.339271][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 201.363321][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 201.387293][ T782] bridge0: port 2(bridge_slave_1) entered blocking state [ 201.394404][ T782] bridge0: port 2(bridge_slave_1) entered forwarding state [ 201.414676][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 201.437652][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 201.459317][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 201.483201][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 201.506918][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 201.529812][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 201.551027][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 201.573563][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 201.593824][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 201.614875][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 201.631786][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 201.646871][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 201.662615][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 201.679823][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 201.697507][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 201.714434][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 201.731532][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 201.749825][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 201.774955][ T3426] 9pnet_fd: Insufficient options for proto=fd [ 201.785085][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 201.803045][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 201.823809][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 201.841493][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 201.855220][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 201.867560][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 201.882793][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 201.929023][ T2909] kworker/u4:21: attempt to access beyond end of device [ 201.929023][ T2909] loop6: rw=1, sector=45096, nr_sectors = 40 limit=40427 [ 201.975423][ T2909] kworker/u4:21: attempt to access beyond end of device [ 201.975423][ T2909] loop6: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 202.154497][ T649] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 202.273847][ T659] usb 3-1: USB disconnect, device number 25 [ 202.286751][ T28] audit: type=1400 audit(1793850906.474:678): avc: denied { getopt } for pid=3436 comm="syz.2.922" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 204.071127][ T3435] loop6: detected capacity change from 0 to 128 [ 204.078532][ T649] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 205.079791][ T649] usb 1-1: string descriptor 0 read error: -71 [ 205.090394][ T649] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 1.00 [ 205.099772][ T649] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.074484][ T649] usb 1-1: can't set config #1, error -71 [ 206.084698][ T3443] loop0: detected capacity change from 0 to 256 [ 206.093587][ T649] usb 1-1: USB disconnect, device number 12 [ 207.062007][ T3443] FAT-fs (loop0): Invalid FSINFO signature: 0x00fffff8, 0x00000000 (sector = 1) [ 207.114783][ T2903] kworker/u4:15: attempt to access beyond end of device [ 207.114783][ T2903] loop6: rw=1, sector=145, nr_sectors = 6 limit=128 [ 207.139523][ T28] audit: type=1400 audit(1793850911.324:679): avc: denied { write } for pid=3444 comm="syz.2.926" name="binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 207.163107][ T3445] binder: 3444:3445 ioctl c018620c 2000000000c0 returned -22 [ 207.211900][ T28] audit: type=1400 audit(1793850911.344:680): avc: denied { set_context_mgr } for pid=3444 comm="syz.2.926" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 207.236509][ T3453] overlayfs: failed to clone upperpath [ 207.247664][ T28] audit: type=1400 audit(1793850911.424:681): avc: denied { ioctl } for pid=3444 comm="syz.2.926" path="/dev/binderfs/binder_logs/state_hashed" dev="binder" ino=1048599 ioctlcmd=0x54a5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 207.546241][ T3451] loop0: detected capacity change from 0 to 512 [ 207.633603][ T3451] EXT4-fs (loop0): orphan cleanup on readonly fs [ 207.649331][ T3451] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -13 [ 207.667821][ T3451] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 207.693480][ T3451] EXT4-fs error (device loop0): ext4_clear_blocks:883: inode #13: comm syz.0.928: attempt to clear invalid blocks 2 len 1 [ 207.708887][ T3451] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.928: invalid indirect mapped block 1819239214 (level 0) [ 207.743155][ T3451] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.928: invalid indirect mapped block 1819239214 (level 1) [ 207.791397][ T3451] EXT4-fs (loop0): 1 truncate cleaned up [ 207.804345][ T3451] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 207.849267][ T288] EXT4-fs (loop0): unmounting filesystem. [ 207.878011][ T28] audit: type=1400 audit(1793850912.064:682): avc: denied { create } for pid=3472 comm="syz.0.933" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 208.084482][ T6] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 208.699084][ T3495] netlink: 'syz.2.939': attribute type 9 has an invalid length. [ 208.787812][ T3495] netlink: 36 bytes leftover after parsing attributes in process `syz.2.939'. [ 211.054619][ T6] usb 7-1: Using ep0 maxpacket: 16 [ 211.477906][ T28] audit: type=1326 audit(1793850915.664:683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3506 comm="syz.0.942" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f859019fb19 code=0x7ffc0000 [ 211.556850][ T28] audit: type=1326 audit(1793850915.694:684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3506 comm="syz.0.942" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f859019fb19 code=0x7ffc0000 [ 211.581680][ T28] audit: type=1326 audit(1793850915.704:685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3506 comm="syz.0.942" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f859019fb19 code=0x7ffc0000 [ 211.608118][ T6] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 211.634434][ T28] audit: type=1326 audit(1793850915.704:686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3506 comm="syz.0.942" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f859019fb19 code=0x7ffc0000 [ 211.659064][ T6] usb 7-1: can't read configurations, error -71 [ 211.691478][ T28] audit: type=1326 audit(1793850915.704:688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3506 comm="syz.0.942" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f859019fb19 code=0x7ffc0000 [ 211.698772][ T3503] loop2: detected capacity change from 0 to 40427 [ 211.723811][ T28] audit: type=1326 audit(1793850915.704:687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3506 comm="syz.0.942" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f859019fb19 code=0x7ffc0000 [ 211.750726][ T3503] F2FS-fs (loop2): invalid crc value [ 211.759624][ T28] audit: type=1326 audit(1793850915.704:689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3506 comm="syz.0.942" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f859019fb19 code=0x7ffc0000 [ 211.784516][ T28] audit: type=1326 audit(1793850915.714:690): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3506 comm="syz.0.942" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f859019fb19 code=0x7ffc0000 [ 211.809577][ T28] audit: type=1326 audit(1793850915.714:691): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3506 comm="syz.0.942" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=50 compat=0 ip=0x7f859019fb19 code=0x7ffc0000 [ 211.843281][ T3503] F2FS-fs (loop2): Found nat_bits in checkpoint [ 211.844461][ T3507] loop0: detected capacity change from 0 to 512 [ 211.889323][ T3503] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4 [ 213.289166][ T3568] loop2: detected capacity change from 0 to 256 [ 213.499378][ T3570] loop2: detected capacity change from 0 to 1024 [ 213.556736][ T3570] EXT4-fs (loop2): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 213.598085][ T3570] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 213.654556][ T3570] EXT4-fs (loop2): invalid journal inode [ 213.660796][ T3570] EXT4-fs (loop2): can't get journal size [ 213.701331][ T3570] EXT4-fs (loop2): corrupt root inode, run e2fsck [ 213.715226][ T3570] EXT4-fs (loop2): mount failed [ 216.059037][ T6] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 216.100110][ T28] kauditd_printk_skb: 119 callbacks suppressed [ 216.100125][ T28] audit: type=1400 audit(1793850920.284:811): avc: denied { ioctl } for pid=3581 comm="syz.2.963" path="socket:[30891]" dev="sockfs" ino=30891 ioctlcmd=0x52c8 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 216.195489][ T28] audit: type=1326 audit(1793850920.384:812): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3586 comm="syz.3.967" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe06679fb19 code=0x0 [ 216.309657][ T3593] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 217.087560][ T3603] pci 0000:00:01.0: MSI/MSI-X disallowed for future drivers [ 218.130426][ T3615] loop2: detected capacity change from 0 to 512 [ 218.215223][ T3615] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 218.229609][ T3615] ext4 filesystem being mounted at /185/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 218.290806][ T3615] EXT4-fs (loop2): shut down requested (1) [ 218.338492][ T294] EXT4-fs (loop2): unmounting filesystem. [ 218.444244][ T3617] netlink: 8 bytes leftover after parsing attributes in process `syz.0.974'. [ 218.455402][ T3608] loop6: detected capacity change from 0 to 40427 [ 218.458634][ T3628] device batadv_slave_1 entered promiscuous mode [ 218.466081][ T3608] F2FS-fs (loop6): Invalid log_blocksize (268), supports only 12 [ 218.476192][ T3608] F2FS-fs (loop6): Can't find valid F2FS filesystem in 1th superblock [ 218.485712][ T3608] F2FS-fs (loop6): invalid crc value [ 218.485781][ T3628] device macsec1 entered promiscuous mode [ 218.529187][ T3608] F2FS-fs (loop6): Found nat_bits in checkpoint [ 221.054303][ T3608] F2FS-fs (loop6): Try to recover 1th superblock, ret: 0 [ 221.061592][ T3608] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 222.627999][ T3659] loop2: detected capacity change from 0 to 256 [ 222.644609][ T3659] exfat: Deprecated parameter 'utf8' [ 222.655136][ T3659] exfat: Deprecated parameter 'utf8' [ 222.660541][ T3659] exfat: Unexpected value for 'utf8' [ 222.885355][ T28] audit: type=1400 audit(1793850927.074:813): avc: denied { execute } for pid=3672 comm="syz.6.992" path="/sys/power/pm_freeze_timeout" dev="sysfs" ino=1153 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=file permissive=1 [ 222.925655][ T3680] loop6: detected capacity change from 0 to 256 [ 223.039502][ T3684] netlink: 'syz.3.993': attribute type 4 has an invalid length. [ 223.096468][ T3684] netlink: 'syz.3.993': attribute type 4 has an invalid length. [ 223.306758][ T3514] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 223.405216][ T3675] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 223.419062][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 223.431359][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 223.440988][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 223.458110][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 223.471313][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 223.483752][ T3688] loop2: detected capacity change from 0 to 512 [ 223.495463][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 223.508627][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 223.516947][ T782] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 223.536390][ T3688] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 223.545463][ T3688] ext4 filesystem being mounted at /189/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 223.580603][ T3688] EXT4-fs (loop2): re-mounted. Quota mode: writeback. [ 223.595030][ T3688] EXT4-fs (loop2): re-mounted. Quota mode: writeback. [ 223.608874][ T294] EXT4-fs (loop2): unmounting filesystem. [ 224.623738][ T3704] tipc: Enabling of bearer rejected, failed to enable media [ 224.822231][ T28] audit: type=1400 audit(1793850929.004:814): avc: denied { shutdown } for pid=3708 comm="syz.0.1000" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 224.852285][ T3711] loop2: detected capacity change from 0 to 256 [ 224.858873][ T3715] netlink: 'syz.0.1002': attribute type 3 has an invalid length. [ 224.867679][ T3711] exFAT-fs (loop2): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 225.070383][ T3730] device ip6gre1 entered promiscuous mode [ 225.078059][ T309] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 225.086578][ T309] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 225.104531][ T309] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 225.194724][ T28] audit: type=1400 audit(1793850929.384:815): avc: denied { map } for pid=3731 comm="syz.0.1005" path="/dev/input/event0" dev="devtmpfs" ino=260 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 225.544504][ T28] audit: type=1400 audit(1793850929.724:816): avc: denied { map } for pid=3743 comm="syz.0.1009" path="/dev/ashmem" dev="devtmpfs" ino=269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 225.867426][ T309] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 225.875766][ T6] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 225.890608][ T28] audit: type=1400 audit(1793850930.074:817): avc: denied { accept } for pid=3745 comm="syz.3.1010" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 227.340626][ T3761] loop0: detected capacity change from 0 to 256 [ 227.369562][ T3765] binder: 3764:3765 ioctl c0306201 200000000240 returned -14 [ 227.386346][ T3514] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 227.398308][ T28] audit: type=1400 audit(1793850931.584:818): avc: denied { map } for pid=3764 comm="syz.6.1015" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 227.422964][ T3765] binder: BINDER_SET_CONTEXT_MGR already set [ 227.437152][ T3765] binder: 3764:3765 ioctl 4018620d 200000000300 returned -16 [ 227.461243][ T3765] binder: 3764:3765 ioctl c0306201 200000000340 returned -14 [ 227.479813][ T28] audit: type=1400 audit(1793850931.664:819): avc: denied { relabelfrom } for pid=3764 comm="syz.6.1015" name="" dev="pipefs" ino=30235 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 227.896016][ T3783] netlink: 84 bytes leftover after parsing attributes in process `syz.5.1021'. [ 228.003327][ T3774] loop0: detected capacity change from 0 to 40427 [ 228.022482][ T3774] F2FS-fs (loop0): invalid crc value [ 228.056040][ T3774] F2FS-fs (loop0): Found nat_bits in checkpoint [ 228.133147][ T3774] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 228.151758][ T3790] overlayfs: failed to clone upperpath [ 228.178988][ T288] syz-executor: attempt to access beyond end of device [ 228.178988][ T288] loop0: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 228.300917][ T3794] ip_tables: iptables: counters copy to user failed while replacing table [ 228.338259][ T3794] ip_tables: iptables: counters copy to user failed while replacing table [ 228.353121][ T3794] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1025'. [ 228.481433][ T3797] kvm: MONITOR instruction emulated as NOP! [ 228.485302][ T3805] fuse: Bad value for 'fd' [ 228.527203][ T3808] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1029'. [ 228.588437][ T3800] loop2: detected capacity change from 0 to 40427 [ 228.603954][ T3800] F2FS-fs (loop2): invalid crc value [ 228.635485][ T3800] F2FS-fs (loop2): Found nat_bits in checkpoint [ 228.684087][ T3800] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4 [ 228.701151][ T3814] loop0: detected capacity change from 0 to 128 [ 228.719494][ T3814] FAT-fs (loop0): Unrecognized mount option "0177777777777777777777718446744073709551615K;vvmYUbs؊m\*B| } gB|9)`q!9)d> HID v0.00 Device [syz1] on syz0 [ 236.123842][ T3981] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1086'. [ 236.149617][ T3981] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1086'. [ 236.447507][ T3993] loop2: detected capacity change from 0 to 128 [ 236.752931][ T3998] loop0: detected capacity change from 0 to 512 [ 236.767391][ T3998] ext3: Unknown parameter '.' [ 236.850145][ T4000] netlink: 'syz.5.1091': attribute type 3 has an invalid length. [ 236.881475][ T4002] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1092'. [ 236.969285][ T4004] loop0: detected capacity change from 0 to 256 [ 236.977185][ T4004] FAT-fs (loop0): Unrecognized mount option "nnonumtail=1" or missing value [ 237.206762][ T4006] ip_tables: iptables: counters copy to user failed while replacing table [ 237.309705][ T4007] netlink: 'syz.3.1093': attribute type 3 has an invalid length. [ 237.357980][ T2909] kworker/u4:21: attempt to access beyond end of device [ 237.357980][ T2909] loop2: rw=1, sector=145, nr_sectors = 6 limit=128 [ 237.717453][ T4019] loop2: detected capacity change from 0 to 512 [ 237.747183][ T4019] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 237.756318][ T4019] ext4 filesystem being mounted at /211/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 237.941869][ T4025] futex_wake_op: syz.3.1096 tries to shift op by 144; fix this program [ 238.026688][ T4018] EXT4-fs error (device loop2): ext4_xattr_block_get:543: inode #15: comm syz.2.1097: corrupted xattr block 33 [ 238.034542][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 238.076115][ T309] snd-usb-audio: probe of 7-1:1.0 failed with error -71 [ 238.089864][ T309] usb 7-1: USB disconnect, device number 6 [ 238.096994][ T4018] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop2 ino=15 [ 238.195495][ T4018] EXT4-fs error (device loop2): ext4_xattr_block_get:543: inode #15: comm syz.2.1097: corrupted xattr block 33 [ 238.262415][ T4031] loop0: detected capacity change from 0 to 256 [ 238.959303][ T4018] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop2 ino=15 [ 239.441794][ T28] kauditd_printk_skb: 5 callbacks suppressed [ 239.441813][ T28] audit: type=1400 audit(2000000006.640:868): avc: denied { bind } for pid=4033 comm="syz.3.1100" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 239.769588][ T4049] futex_wake_op: syz.3.1102 tries to shift op by 144; fix this program [ 240.148862][ T4059] loop6: detected capacity change from 0 to 512 [ 240.156564][ T4059] ext3: Unknown parameter '.' [ 240.313683][ T294] EXT4-fs (loop2): unmounting filesystem. [ 240.420665][ T4067] loop6: detected capacity change from 0 to 256 [ 240.512725][ T4066] device lo left promiscuous mode [ 240.551883][ T4069] netlink: 'syz.3.1110': attribute type 3 has an invalid length. [ 240.594580][ T659] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 240.617508][ T4066] device tunl0 left promiscuous mode [ 240.702793][ T4066] device gre0 left promiscuous mode [ 240.804480][ T659] usb 1-1: device descriptor read/64, error -71 [ 240.883402][ T4066] device gretap0 left promiscuous mode [ 241.415673][ T4066] device erspan0 left promiscuous mode [ 241.464467][ T659] usb 1-1: device descriptor read/64, error -71 [ 241.549441][ T4066] device ip_vti0 left promiscuous mode [ 241.583665][ T4066] device ip6_vti0 left promiscuous mode [ 241.594807][ T4066] device sit0 left promiscuous mode [ 241.612510][ T4066] device ip6tnl0 left promiscuous mode [ 241.640909][ T4079] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=123 sclass=netlink_route_socket pid=4079 comm=syz.3.1111 [ 241.656945][ T4066] device ip6gre0 left promiscuous mode [ 241.682850][ T4066] device syz_tun left promiscuous mode [ 241.689454][ T4066] device ip6gretap0 left promiscuous mode [ 241.696129][ T4066] device bridge0 left promiscuous mode [ 241.701993][ T4066] device vcan0 left promiscuous mode [ 241.707593][ T4066] device dummy0 left promiscuous mode [ 241.713301][ T4066] device veth0 left promiscuous mode [ 241.720634][ T4066] device veth1 left promiscuous mode [ 241.726276][ T4066] device wg0 left promiscuous mode [ 241.731639][ T4066] device wg1 left promiscuous mode [ 241.737627][ T4066] device wg2 left promiscuous mode [ 241.743091][ T4066] device veth0_to_bridge left promiscuous mode [ 241.858953][ T659] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 241.931674][ T4066] device veth1_to_bridge left promiscuous mode [ 242.162500][ T4066] device veth0_to_bond left promiscuous mode [ 242.244874][ T4066] device bond_slave_0 left promiscuous mode [ 242.430809][ T4066] device veth1_to_bond left promiscuous mode [ 242.441214][ T4066] device bond_slave_1 left promiscuous mode [ 242.448475][ T4066] device veth1_to_team left promiscuous mode [ 242.455101][ T4066] device team_slave_1 left promiscuous mode [ 242.461240][ T4066] device veth0_to_batadv left promiscuous mode [ 242.467483][ T659] usb 1-1: device descriptor read/64, error -71 [ 242.473866][ T4066] device batadv_slave_0 left promiscuous mode [ 242.480219][ T4066] device veth1_to_batadv left promiscuous mode [ 242.486687][ T4066] device batadv_slave_1 left promiscuous mode [ 242.492996][ T4066] device xfrm0 left promiscuous mode [ 242.498699][ T4066] device veth0_to_hsr left promiscuous mode [ 242.504720][ T4066] device hsr_slave_0 left promiscuous mode [ 242.510687][ T4066] device veth1_to_hsr left promiscuous mode [ 242.517381][ T4066] device hsr_slave_1 left promiscuous mode [ 242.523350][ T4066] device veth1_virt_wifi left promiscuous mode [ 242.529680][ T4066] device veth0_virt_wifi left promiscuous mode [ 242.535953][ T4066] device veth1_vlan left promiscuous mode [ 242.541835][ T4066] device vlan0 left promiscuous mode [ 242.547249][ T4066] device vlan1 left promiscuous mode [ 242.552663][ T4066] device ip6gre1 left promiscuous mode [ 242.646717][ T4098] loop6: detected capacity change from 0 to 128 [ 242.754411][ T659] usb 1-1: device descriptor read/64, error -71 [ 242.760756][ T28] audit: type=1400 audit(2000000009.990:869): avc: denied { accept } for pid=4090 comm="syz.2.1114" path="socket:[32878]" dev="sockfs" ino=32878 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 242.904467][ T659] usb usb1-port1: attempt power cycle [ 243.285070][ T28] audit: type=1326 audit(2000000010.520:870): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4105 comm="syz.3.1118" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe06679fb19 code=0x0 [ 243.314701][ T659] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 243.431580][ T2903] kworker/u4:15: attempt to access beyond end of device [ 243.431580][ T2903] loop6: rw=1, sector=145, nr_sectors = 6 limit=128 [ 243.770199][ T659] usb 1-1: device not accepting address 16, error -71 [ 244.206601][ T28] audit: type=1400 audit(2000000011.440:871): avc: denied { accept } for pid=4127 comm="syz.3.1126" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 244.674425][ T39] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 244.854489][ T39] usb 7-1: Using ep0 maxpacket: 8 [ 244.890371][ T39] usb 7-1: config 2 has an invalid interface number: 31 but max is 0 [ 244.899295][ T39] usb 7-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 244.910252][ T39] usb 7-1: config 2 has no interface number 0 [ 244.917355][ T39] usb 7-1: config 2 interface 31 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 244.930491][ T28] audit: type=1400 audit(2000000012.150:872): avc: denied { connect } for pid=4151 comm="syz.3.1137" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 244.951068][ T39] usb 7-1: config 2 interface 31 has no altsetting 0 [ 244.958037][ T659] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 244.966322][ T28] audit: type=1400 audit(2000000012.150:873): avc: denied { setopt } for pid=4151 comm="syz.3.1137" laddr=fe80::a8d0:2dff:fec0:7c17 lport=28 faddr=ff02::1 fport=20004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 244.994270][ T39] usb 7-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 245.003926][ T39] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.012542][ T39] usb 7-1: Product: syz [ 245.017501][ T659] usb 1-1: Using ep0 maxpacket: 16 [ 245.023214][ T39] usb 7-1: Manufacturer: syz [ 245.028761][ T39] usb 7-1: SerialNumber: syz [ 245.034143][ T659] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 245.077998][ T659] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 245.087226][ T659] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.095506][ T659] usb 1-1: Product: syz [ 245.099793][ T659] usb 1-1: Manufacturer: syz [ 245.104530][ T659] usb 1-1: SerialNumber: syz [ 245.112731][ T659] usb 1-1: config 0 descriptor?? [ 245.129395][ T4160] FAULT_INJECTION: forcing a failure. [ 245.129395][ T4160] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 245.142663][ T4160] CPU: 0 PID: 4160 Comm: syz.2.1140 Not tainted syzkaller #0 [ 245.150052][ T4160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 245.160204][ T4160] Call Trace: [ 245.163486][ T4160] [ 245.166407][ T4160] __dump_stack+0x21/0x24 [ 245.170728][ T4160] dump_stack_lvl+0x110/0x170 [ 245.175391][ T4160] ? __cfi_dump_stack_lvl+0x8/0x8 [ 245.180402][ T4160] ? __kasan_check_read+0x11/0x20 [ 245.185407][ T4160] dump_stack+0x15/0x24 [ 245.189556][ T4160] should_fail_ex+0x3bf/0x510 [ 245.194232][ T4160] should_fail+0xb/0x10 [ 245.198384][ T4160] should_fail_usercopy+0x1a/0x20 [ 245.203408][ T4160] _copy_from_user+0x1e/0xc0 [ 245.208010][ T4160] input_event_from_user+0xae/0x290 [ 245.213366][ T4160] ? __cfi_input_event_from_user+0x10/0x10 [ 245.219171][ T4160] ? _raw_spin_unlock_irqrestore+0x5a/0x80 [ 245.224964][ T4160] ? input_inject_event+0x10d/0x120 [ 245.230150][ T4160] evdev_write+0x2fe/0x470 [ 245.234551][ T4160] ? __cfi_evdev_write+0x10/0x10 [ 245.239505][ T4160] ? fsnotify_perm+0x67/0x5b0 [ 245.244170][ T4160] ? security_file_permission+0x8a/0xb0 [ 245.249713][ T4160] ? security_file_permission+0x94/0xb0 [ 245.255242][ T4160] ? __cfi_evdev_write+0x10/0x10 [ 245.260172][ T4160] vfs_write+0x3fb/0xd00 [ 245.264410][ T4160] ? __cfi_vfs_write+0x10/0x10 [ 245.269162][ T4160] ? __fget_files+0x2d1/0x330 [ 245.273849][ T4160] ? __fdget_pos+0x1f2/0x380 [ 245.278429][ T4160] ? ksys_write+0x70/0x260 [ 245.282836][ T4160] ksys_write+0x14a/0x260 [ 245.287154][ T4160] ? __cfi_ksys_write+0x10/0x10 [ 245.291991][ T4160] ? fpregs_restore_userregs+0x128/0x260 [ 245.297610][ T4160] __x64_sys_write+0x7b/0x90 [ 245.302203][ T4160] x64_sys_call+0x27b/0x9a0 [ 245.306709][ T4160] do_syscall_64+0x4c/0xa0 [ 245.311106][ T4160] ? clear_bhb_loop+0x30/0x80 [ 245.315764][ T4160] ? clear_bhb_loop+0x30/0x80 [ 245.320433][ T4160] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 245.326308][ T4160] RIP: 0033:0x7f832419fb19 [ 245.330705][ T4160] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 245.350301][ T4160] RSP: 002b:00007f8325074028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 245.358704][ T4160] RAX: ffffffffffffffda RBX: 00007f8324425fa0 RCX: 00007f832419fb19 [ 245.366664][ T4160] RDX: 000000000000ff0f RSI: 0000200000000040 RDI: 0000000000000004 [ 245.374620][ T4160] RBP: 00007f8324237b70 R08: 0000000000000000 R09: 0000000000000000 [ 245.382569][ T4160] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 245.390524][ T4160] R13: 00007f8324426038 R14: 00007f8324425fa0 R15: 00007fff4622de28 [ 245.398480][ T4160] [ 245.430074][ T659] usb 7-1: USB disconnect, device number 7 [ 245.503736][ T4164] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=262 sclass=netlink_route_socket pid=4164 comm=syz.2.1142 [ 245.685666][ T4172] hub 5-0:1.0: USB hub found [ 245.690502][ T4172] hub 5-0:1.0: 1 port detected [ 245.948851][ T28] audit: type=1400 audit(2000000013.180:874): avc: denied { watch watch_reads } for pid=4184 comm="syz.6.1151" path="/58/file0" dev="tmpfs" ino=337 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 247.536749][ T28] audit: type=1400 audit(2000000014.752:875): avc: denied { getopt } for pid=4218 comm="syz.5.1165" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 247.603307][ T659] usb 1-1: USB disconnect, device number 17 [ 247.959395][ T4233] ip_tables: iptables: counters copy to user failed while replacing table [ 248.186214][ T4238] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 248.421902][ T467] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 248.629054][ T4241] ip_tables: iptables: counters copy to user failed while replacing table [ 249.086035][ T467] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 18 [ 249.112694][ T467] usb 3-1: config 1 interface 1 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 249.142139][ T467] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 249.173035][ T467] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 249.209634][ T467] cdc_acm: probe of 3-1:1.0 failed with error -12 [ 249.216287][ T39] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 249.406286][ T659] usb 3-1: USB disconnect, device number 26 [ 249.485625][ T39] usb 1-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 249.495865][ T39] usb 1-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 249.505277][ T39] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 249.664447][ T467] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 249.844423][ T467] usb 7-1: Using ep0 maxpacket: 16 [ 249.851727][ T467] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 249.862147][ T467] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 249.872632][ T467] usb 7-1: New USB device found, idVendor=17cc, idProduct=1021, bcdDevice= 0.40 [ 249.882148][ T467] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 249.890465][ T467] usb 7-1: Product: syz [ 249.894928][ T467] usb 7-1: Manufacturer: syz [ 249.899858][ T467] usb 7-1: SerialNumber: syz [ 250.123658][ T467] usb 7-1: unable to issue vendor read request (ret = -71) [ 250.131643][ T467] usb 7-1: unable to issue vendor read request (ret = -71) [ 250.139839][ T467] usb 7-1: unable to issue vendor read request (ret = -71) [ 250.148303][ T467] usb 7-1: unable to issue vendor read request (ret = -71) [ 250.156617][ T467] usb 7-1: unable to issue vendor read request (ret = -71) [ 250.165076][ T467] usb 7-1: unable to issue vendor read request (ret = -71) [ 250.173054][ T467] usb 7-1: unable to issue vendor read request (ret = -71) [ 250.181327][ T467] usb 7-1: unable to issue vendor read request (ret = -71) [ 250.209693][ T467] usb 7-1: USB disconnect, device number 8 [ 250.780378][ T28] audit: type=1400 audit(2000000018.012:876): avc: denied { read } for pid=4291 comm="syz.2.1195" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 250.833916][ T28] audit: type=1400 audit(2000000018.062:877): avc: denied { setopt } for pid=4291 comm="syz.2.1195" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 250.994439][ T39] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 251.135908][ T4300] cgroup: fork rejected by pids controller in /syz2 [ 251.234570][ T39] usb 7-1: Using ep0 maxpacket: 16 [ 251.240983][ T39] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 251.252653][ T39] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 251.263604][ T39] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 251.273896][ T39] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.282895][ T39] usb 7-1: Product: syz [ 251.287563][ T39] usb 7-1: Manufacturer: syz [ 251.292350][ T39] usb 7-1: SerialNumber: syz [ 251.470774][ T28] audit: type=1400 audit(2000000018.702:878): avc: denied { read } for pid=5316 comm="syz.2.1198" name="control" dev="devtmpfs" ino=266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 251.504713][ T39] usb 7-1: 0:2 : does not exist [ 251.511437][ T659] usb 1-1: USB disconnect, device number 18 [ 251.526478][ T39] usb 7-1: 5:0: failed to get current value for ch 0 (-22) [ 251.631774][ T39] usb 7-1: USB disconnect, device number 9 [ 251.716298][ T5336] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1206'. [ 252.698002][ T28] audit: type=1400 audit(2000000019.932:879): avc: denied { search } for pid=5352 comm="syz.6.1212" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 252.720587][ T28] audit: type=1400 audit(2000000019.932:880): avc: denied { read write } for pid=5352 comm="syz.6.1212" name="dynamic_events" dev="tracefs" ino=1051 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 252.761303][ T28] audit: type=1400 audit(2000000019.932:881): avc: denied { open } for pid=5352 comm="syz.6.1212" path="/73/tracefs/dynamic_events" dev="tracefs" ino=1051 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 253.053420][ T28] audit: type=1400 audit(2000000019.932:882): avc: denied { unmount } for pid=3125 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 254.096648][ T28] audit: type=1400 audit(2000000021.332:883): avc: denied { mount } for pid=5390 comm="syz.3.1224" name="/" dev="ramfs" ino=33897 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 254.674601][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 254.700791][ T309] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 254.781882][ T5401] ================================================================== [ 254.789994][ T5401] BUG: KASAN: use-after-free in sk_skb_adjust_room+0x34e/0x610 [ 254.797589][ T5401] Read of size 8 at addr ffff88811ce82848 by task syz.3.1229/5401 [ 254.805415][ T5401] [ 254.807758][ T5401] CPU: 0 PID: 5401 Comm: syz.3.1229 Not tainted syzkaller #0 [ 254.815170][ T5401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 254.825244][ T5401] Call Trace: [ 254.828549][ T5401] [ 254.831496][ T5401] __dump_stack+0x21/0x24 [ 254.835853][ T5401] dump_stack_lvl+0x110/0x170 [ 254.840549][ T5401] ? __cfi_dump_stack_lvl+0x8/0x8 [ 254.845595][ T5401] ? pskb_expand_head+0x436/0x12b0 [ 254.850740][ T5401] ? sk_skb_adjust_room+0x34e/0x610 [ 254.855973][ T5401] print_address_description+0x71/0x200 [ 254.861557][ T5401] print_report+0x4a/0x60 [ 254.865930][ T5401] kasan_report+0x122/0x150 [ 254.870461][ T5401] ? sk_skb_adjust_room+0x34e/0x610 [ 254.875691][ T5401] __asan_report_load8_noabort+0x14/0x20 [ 254.881351][ T5401] sk_skb_adjust_room+0x34e/0x610 [ 254.886425][ T5401] bpf_prog_e15ab8bd9cea3c06+0x19/0x20 [ 254.891911][ T5401] sk_psock_verdict_recv+0x1c8/0x7b0 [ 254.897223][ T5401] ? skb_recv_datagram+0x140/0x180 [ 254.902373][ T5401] unix_stream_read_skb+0x13d/0x300 [ 254.907596][ T5401] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 254.913770][ T5401] ? __cfi_sk_psock_verdict_recv+0x10/0x10 [ 254.919607][ T5401] ? __cfi_unix_stream_read_skb+0x10/0x10 [ 254.925353][ T5401] ? __kasan_check_write+0x14/0x20 [ 254.930587][ T5401] ? _raw_spin_lock+0x94/0xf0 [ 254.935294][ T5401] ? _raw_spin_unlock_irqrestore+0x5a/0x80 [ 254.941123][ T5401] sk_psock_verdict_data_ready+0xaf/0x1d0 [ 254.946884][ T5401] unix_stream_sendmsg+0x631/0xa80 [ 254.952047][ T5401] ? __cfi_unix_stream_sendmsg+0x10/0x10 [ 254.957737][ T5401] ? security_socket_sendmsg+0x93/0xb0 [ 254.963230][ T5401] __sys_sendto+0x4ac/0x660 [ 254.967767][ T5401] ? __cfi___sys_sendto+0x10/0x10 [ 254.972835][ T5401] ? __this_cpu_preempt_check+0x13/0x20 [ 254.978419][ T5401] ? xfd_validate_state+0x70/0x150 [ 254.983564][ T5401] ? __kasan_check_write+0x14/0x20 [ 254.988697][ T5401] __x64_sys_sendto+0xe5/0x100 [ 254.993491][ T5401] x64_sys_call+0x83/0x9a0 [ 254.997943][ T5401] do_syscall_64+0x4c/0xa0 [ 255.002381][ T5401] ? clear_bhb_loop+0x30/0x80 [ 255.007092][ T5401] ? clear_bhb_loop+0x30/0x80 [ 255.011800][ T5401] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 255.017722][ T5401] RIP: 0033:0x7fe06679fb19 [ 255.022248][ T5401] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 255.041879][ T5401] RSP: 002b:00007fe0675ea028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 255.050327][ T5401] RAX: ffffffffffffffda RBX: 00007fe066a25fa0 RCX: 00007fe06679fb19 [ 255.058346][ T5401] RDX: 0000000000000001 RSI: 0000200000000540 RDI: 0000000000000005 [ 255.066342][ T5401] RBP: 00007fe066837b70 R08: 0000000000000000 R09: 0000000000000000 [ 255.074346][ T5401] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 255.082523][ T5401] R13: 00007fe066a26038 R14: 00007fe066a25fa0 R15: 00007ffd6a99b078 [ 255.090526][ T5401] [ 255.093564][ T5401] [ 255.095903][ T5401] Allocated by task 5342: [ 255.100245][ T5401] kasan_set_track+0x4b/0x70 [ 255.104863][ T5401] kasan_save_alloc_info+0x1f/0x30 [ 255.109996][ T5401] __kasan_slab_alloc+0x72/0x80 [ 255.114885][ T5401] slab_post_alloc_hook+0x4f/0x2d0 [ 255.120042][ T5401] kmem_cache_alloc+0x166/0x320 [ 255.124925][ T5401] sk_prot_alloc+0x5f/0x320 [ 255.129460][ T5401] sk_alloc+0x3b/0x460 [ 255.133554][ T5401] unix_create1+0xb8/0x710 [ 255.137992][ T5401] unix_create+0x149/0x200 [ 255.142431][ T5401] __sock_create+0x39e/0x7c0 [ 255.147044][ T5401] __sys_socketpair+0x218/0x5b0 [ 255.151918][ T5401] __x64_sys_socketpair+0x9b/0xb0 [ 255.156963][ T5401] x64_sys_call+0x6e/0x9a0 [ 255.161435][ T5401] do_syscall_64+0x4c/0xa0 [ 255.165871][ T5401] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 255.171789][ T5401] [ 255.174124][ T5401] Freed by task 6: [ 255.177859][ T5401] kasan_set_track+0x4b/0x70 [ 255.182468][ T5401] kasan_save_free_info+0x2b/0x40 [ 255.187506][ T5401] ____kasan_slab_free+0x132/0x180 [ 255.192642][ T5401] __kasan_slab_free+0x11/0x20 [ 255.197430][ T5401] slab_free_freelist_hook+0xc2/0x190 [ 255.202817][ T5401] kmem_cache_free+0x12d/0x300 [ 255.207612][ T5401] __sk_destruct+0x4b4/0x5e0 [ 255.212230][ T5401] __sk_free+0x30a/0x400 [ 255.216498][ T5401] sk_free+0x54/0x90 [ 255.220413][ T5401] sk_psock_destroy+0xd4b/0xdf0 [ 255.225284][ T5401] process_one_work+0x717/0xc30 [ 255.230153][ T5401] worker_thread+0xa4d/0x11d0 [ 255.234842][ T5401] kthread+0x281/0x320 [ 255.238930][ T5401] ret_from_fork+0x1f/0x30 [ 255.243363][ T5401] [ 255.245694][ T5401] The buggy address belongs to the object at ffff88811ce82800 [ 255.245694][ T5401] which belongs to the cache UNIX-STREAM of size 1152 [ 255.260019][ T5401] The buggy address is located 72 bytes inside of [ 255.260019][ T5401] 1152-byte region [ffff88811ce82800, ffff88811ce82c80) [ 255.273305][ T5401] [ 255.275637][ T5401] The buggy address belongs to the physical page: [ 255.282053][ T5401] page:ffffea000473a000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11ce80 [ 255.292306][ T5401] head:ffffea000473a000 order:2 compound_mapcount:0 compound_pincount:0 [ 255.300641][ T5401] flags: 0x4000000000010200(slab|head|zone=1) [ 255.306750][ T5401] raw: 4000000000010200 0000000000000000 dead000000000122 ffff8881088ae480 [ 255.315350][ T5401] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 255.324116][ T5401] page dumped because: kasan: bad access detected [ 255.330531][ T5401] page_owner tracks the page as allocated [ 255.336334][ T5401] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4110, tgid 4109 (syz.0.1120), ts 243918056840, free_ts 243544868819 [ 255.359102][ T5401] post_alloc_hook+0x1f5/0x210 [ 255.363899][ T5401] prep_new_page+0x1c/0x110 [ 255.368419][ T5401] get_page_from_freelist+0x2ca9/0x2d20 [ 255.373986][ T5401] __alloc_pages+0x1fa/0x610 [ 255.378603][ T5401] alloc_slab_page+0x6e/0xf0 [ 255.383208][ T5401] new_slab+0x98/0x3e0 [ 255.387287][ T5401] ___slab_alloc+0x70f/0xb70 [ 255.391895][ T5401] __slab_alloc+0x5e/0xa0 [ 255.396245][ T5401] kmem_cache_alloc+0x1a8/0x320 [ 255.401115][ T5401] sk_prot_alloc+0x5f/0x320 [ 255.405635][ T5401] sk_alloc+0x3b/0x460 [ 255.409723][ T5401] unix_create1+0xb8/0x710 [ 255.414157][ T5401] unix_stream_connect+0x1cd/0xda0 [ 255.419283][ T5401] __sys_connect+0x3da/0x460 [ 255.423892][ T5401] __x64_sys_connect+0x7a/0x90 [ 255.428672][ T5401] x64_sys_call+0x88d/0x9a0 [ 255.433191][ T5401] page last free stack trace: [ 255.437898][ T5401] free_unref_page_prepare+0x81b/0x820 [ 255.443379][ T5401] free_unref_page+0x93/0x530 [ 255.448074][ T5401] __free_pages+0x67/0x100 [ 255.452503][ T5401] free_large_kmalloc+0xae/0xf0 [ 255.457368][ T5401] kfree+0x8b/0xf0 [ 255.461110][ T5401] io_ring_ctx_free+0x856/0x987 [ 255.465985][ T5401] io_ring_exit_work+0x6cd/0x724 [ 255.470954][ T5401] process_one_work+0x717/0xc30 [ 255.475819][ T5401] worker_thread+0xa4d/0x11d0 [ 255.480508][ T5401] kthread+0x281/0x320 [ 255.484605][ T5401] ret_from_fork+0x1f/0x30 [ 255.489127][ T5401] [ 255.491462][ T5401] Memory state around the buggy address: [ 255.497098][ T5401] ffff88811ce82700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 255.505173][ T5401] ffff88811ce82780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 255.513247][ T5401] >ffff88811ce82800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 255.521318][ T5401] ^ [ 255.527738][ T5401] ffff88811ce82880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 255.535809][ T5401] ffff88811ce82900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 255.543965][ T5401] ================================================================== [ 255.552463][ T5401] Disabling lock debugging due to kernel taint [ 255.610763][ T5406] netlink: 72 bytes leftover after parsing attributes in process `syz.6.1226'. [ 255.748265][ T28] audit: type=1400 audit(2000000022.832:884): avc: denied { mounton } for pid=5398 comm="syz.2.1228" path="/243/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 255.770769][ T28] audit: type=1400 audit(2000000022.842:885): avc: denied { create } for pid=5394 comm="syz.6.1226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 255.791216][ T28] audit: type=1400 audit(2000000022.842:886): avc: denied { write } for pid=5394 comm="syz.6.1226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 255.811775][ T28] audit: type=1400 audit(2000000022.842:887): avc: denied { nlmsg_write } for pid=5394 comm="syz.6.1226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 255.842642][ T28] audit: type=1400 audit(2000000022.942:888): avc: denied { execmem } for pid=5394 comm="syz.6.1226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 255.845870][ T309] usb 1-1: unable to get BOS descriptor or descriptor too short [ 255.862124][ T28] audit: type=1400 audit(2000000022.982:889): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 255.890422][ T309] usb 1-1: not running at top speed; connect to a high speed hub [ 255.899892][ T309] usb 1-1: config 3 has an invalid interface number: 5 but max is 1 [ 255.908342][ T309] usb 1-1: config 3 has an invalid descriptor of length 196, skipping remainder of the config [ 255.918684][ T309] usb 1-1: config 3 has 1 interface, different from the descriptor's value: 2 [ 255.927584][ T309] usb 1-1: config 3 has no interface number 0 [ 255.933675][ T309] usb 1-1: too many endpoints for config 3 interface 5 altsetting 6: 49, using maximum allowed: 30 [ 255.944518][ T309] usb 1-1: config 3 interface 5 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 49 [ 255.957479][ T309] usb 1-1: config 3 interface 5 has no altsetting 0 [ 255.965931][ T309] usb 1-1: New USB device found, idVendor=1df7, idProduct=2500, bcdDevice=26.79 [ 255.974991][ T309] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.982967][ T309] usb 1-1: Product: syz [ 255.987120][ T309] usb 1-1: Manufacturer: syz [ 255.991701][ T309] usb 1-1: SerialNumber: syz [ 256.090784][ T309] usb 1-1: USB disconnect, device number 19