last executing test programs: 9.602548935s ago: executing program 0 (id=1): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x10, &(0x7f0000000100)={[{@dioread_lock}]}, 0x5, 0x7e5, &(0x7f00000018c0)="$eJzs3ctrW9kZAPDvyvKjTlK7UGjSlaHQGoLlOnWTFrpI6aIUGgi06yZCVkxq2QqWHGJjSEMpdFNoQxeFdpN12qa7btuZ7cy/MLMZhiEhM+OESZjF4OHqEcu25MgZWZqJfz+49jn3oXO++zj3yPdwHcCxNZX+yESciYg/JxETjflJRAzXUtmIi/X1nm1tFtIpie3tX32U1NZ5urVZiJZtYnw8TjQypyPijT9EnM3sL7eyvrGUL5WKq438bHX5xmxlfWPm+nJ+sbhYXDk/Nz9/7sIPL4z2LtZP3t44+egvP//evy9++vtvPfjTm0lcjJONZa1x9MpUTNX3SQynu3CXn/W6sAFLBl0BXkl6aQ7Vr/I4ExPZGOl+2+xRVgwAODK3I2IbADhmEvd/ADhmmn8HeLq1WUin7duD/XtEvz3+aUSM1eNvPt+sL8k2ntmN1Z6Djj9Ndj3vSCJisgflT0XEP/77m3+mUxzRc0iAdn53JyKuTk412/+d9ifZN2ahrvsBGd9vJg4YHDC1J6/9g/75X9r/+dFO/2/n+su86P9Em/7PaJtr91VMxe4RJ/uv/8zDHhTTUdr/+8nwzti2Zy3xN0wONXKnan2+4eTa9VIxbdu+HhHTMTya5ufaf3xteNn0k8+e7JrbEnFr/+/ju7+9n5af/t5ZI/Mwu6fJXchX872IPfX4TsS3s+3iT14c/6RD//dyl2X84sd//HunZWn8abzNaXf8Rz+qbPtexHejffxNyUHjE8/P1k6H2eZJ0cZ/3vvbeKfyW49/OqXl178LnOp9sG2kx3/84Pgnk9bxmpXDl/HWvYn/d1rWOf6m9uf/SPLrWrp5Kd3KV6urcxEjyS/3zz+3s20z31w/jX/6O+2v/4PO//Q74dUu488++vBfL42/OWNf/A1jXRZ2SGn8C4c6/m0T6VfhDovypQfPloY6ld/d8Z9PE0PTjTndtH8da5ovlUZa1nnlHQcAAAAAAAAAAAAAAAAAAAAAAAAAh5CpvaQ0yeRepDOZXC5q/8P7mzGeKZUr1bPXymsrC/WXmU7G8GhE1F51OdHyPtS5xvvwm/lze/I/iIhvRMRfR79Wy+cK5dLCoIMHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIYTHf7/f+qD0frv5wOtIQBwJMZeusaTYl8qAgD0zcvv/xExevT1AAD6p6v7PwDwWnH/B4DjZywz6BoAAP02FpEddB0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4rV2+dCmdtp9vbRbS/MLN9bWl8s2ZhWJlKbe8VsgVyqs3covl8mKpmCuUl1s2fafd55XK5RvzsbJ2a7ZarFRnK+sbV5bLayvVK9eX84vFK8XhvkUGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN2rrG8s5Uul4mojcX88YvecPiWGGhXq5SfPnOx3FP1IbE/U99SXpT49T4ztnfP+zLunD9rq7r7TWOILJwbZKgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8dXweAAD//9GqGUs=") syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x0, 0x3e, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000002c0)='./file0/file1\x00', 0x0, 0x0, 0x1, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000740)='./bus\x00', 0xa82086, 0x0, 0x31, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f00000003c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) unlinkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0x200) 9.365203879s ago: executing program 0 (id=7): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000400)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000440)=0x7, 0x4) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000540)=[{&(0x7f0000000580)="580000001500add427323b470c45b4560a067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a98000000ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) 8.56124358s ago: executing program 0 (id=8): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000980)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xffff}, {0xffff, 0xd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r1, {0x0, 0xd}, {0xffe0, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r2 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r2, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756", 0xe, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r1, 0x1, 0xd8, 0x6, @random="2abcd265829d"}, 0x14) 8.478370299s ago: executing program 32 (id=8): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000980)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xffff}, {0xffff, 0xd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r1, {0x0, 0xd}, {0xffe0, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r2 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r2, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756", 0xe, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r1, 0x1, 0xd8, 0x6, @random="2abcd265829d"}, 0x14) 3.065883069s ago: executing program 3 (id=131): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x64}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$UFFDIO_COPY(r0, 0xc028aa03, 0xfffffffffffffffe) 2.1736791s ago: executing program 3 (id=163): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000a00)=0x8000, 0x4) bind$inet6(r0, &(0x7f0000000a40)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000a80)=0x8, 0x4) recvmmsg(r0, &(0x7f0000000ac0), 0x400000000000284, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000b00)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 2.073700659s ago: executing program 3 (id=170): r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000640)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000680)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x20, 0x0, 0xffffff75, 0x10}}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pread64(r1, 0x0, 0x0, 0x4000) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000700)={0x1, &(0x7f0000003f80)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 1.461816392s ago: executing program 5 (id=187): munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e21, 0x5, @ipv4={'\x00', '\xff\xff', @empty}, 0x7}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e21, 0x659, @empty, 0xff}, 0x1c) r1 = fcntl$dupfd(r0, 0x406, r0) write$cgroup_pid(r1, &(0x7f0000000240), 0xb375) 1.447919133s ago: executing program 5 (id=188): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x0, &(0x7f0000000100), 0x1, 0x490, &(0x7f0000000580)="$eJzs3UFrXNUeAPD/nSR9aZu+pO+9RV/BWmwlLdqZpLFtcFEriK4Kat3HmExCyCQTMpO2CUVS/ACCiAquXLkR/ACC9COIUNC9iCiirS5cqCMzudPWOJMETHNx5veD03vOPTPzP6eTOXPPPZe5AXSt4xFxKSJ6IuJ0RAym+3NpivWNVH/c3Ts3puopiVrtyg9JJOm+5msl6fZg+rT+iHj5hYjXkr/GrayuzU+WSsXltFyoLiwVKqtrZ+YWJmeLs8XFsbHR8+MXxs+Nj+xaXy8+9807b374/MVPn7z21cR3p16vN2sgrXuwH7tpo+t9jf+Lpt6IWH4YwTLQk/anL+uGAACwI/Vj/P9ExGON4//B6GkczQEAAACdpPbMQPyaRNQAAACAjpVrXAOb5PLptQADkcvl8xvX8P4vDuRK5Ur1iZnyyuL0xrWyQ9GXm5krFUfSa4WHoi+pl0cb+fvls5vKYxFxOCLeHtzfKOenyqXprE9+AAAAQJc4uGn+//PgxvwfAAAA6DBDWTcAAAAAeOjM/wEAAKDzmf8DAABAR3vx8uV6qjXvfz19dXVlvnz1zHSxMp9fWJnKT5WXl/Kz5fJs4zf7FrZ7vVK5vPRULK5cL1SLlWqhsro2sVBeWaxONO7rPVF0n2gAAADYe4cfvfVlEhHrT+9vpLp9aZ25OnS2XNYNADLTk3UDgMz0Zt0AIDPm+ECyTX1/u4rPdr8tAADAwzH8f+v/0K2s/0P3sv4P3cv6P3Qvc3zA+j8AAHS+gUZKcvl0LXAgcrl8PuJQ47YAfcnMXKk4EhH/jogvBvv+VS+PZt1oAAAAAAAAAAAAAAAAAAAAAAAAAPiHqdWSqAEAAAAdLSL3bZLe/2t48OTA5vMD+5JfBhvbiLj2/pV3r09Wq8uj9f0/3ttffS/dfzaLMxgAAADAZs15enMeDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC76e6dG1PNtJdxv382IoZaxe+N/sa2P/oi4sBPSfQ+8LwkInp2If76zYg40ip+Um9WDKWt2Bw/FxH7M45/cBfiQze7VR9/LrX6/OXieGPb+vPXm6a/q/34l7s3/vW0Gf8O7TDG0dsfF9rGvxlxtLf1+NOMn7SJf2KH8V99ZW2tXV3tg4jhlt8/yZ9iFaoLS4XK6tqZuYXJ2eJscXFsbPT8+IXxc+MjhZm5UjH9t2WMtx755Pet+n+gTfyhbfp/cof9/+329Tv/3SL+qROt3/8jW8Sv/008nn4P1OuHm/n1jfyDjn30+bGt+j/dpv/bvf+ndtj/0y+98fUOHwoA7IHK6tr8ZKlUXJaRkZG5l8l6ZAIAAHbb/YP+rFsCAAAAAAAAAAAAAAAAAAAA3Wsvfk4s6z4CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOzEHwEAAP//0wfUAw==") rt_sigprocmask(0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000240)='./control\x00', 0x111) r0 = inotify_init1(0x80000) inotify_add_watch(r0, &(0x7f0000000280)='./control\x00', 0x80000960) rmdir(&(0x7f00000002c0)='./control\x00') 1.362992142s ago: executing program 5 (id=192): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc0000001900010000000000fcdbdf2500000000000000000000000000000000fe8000000002000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050000000000000000000000000000000000000000022b0000000a000000fe8000000000000000000000000000aa0000000004"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) r2 = socket$inet6(0xa, 0x3, 0x84) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4000, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xff}}}, 0x1c) 1.321781536s ago: executing program 5 (id=195): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) openat$dir(0xffffffffffffff9c, 0x0, 0x20080, 0x10) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f00000000c0)={0x2, {{0x2, 0x8000, @multicast2}}, 0x1, 0x3, [{{0x2, 0x0, @local}}, {{0x2, 0x0, @multicast2}}, {{0x2, 0x1, @remote}}]}, 0x210) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000b80)=@newlink={0x28, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x32095}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) 1.152237643s ago: executing program 2 (id=200): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_mount_image$fuse(&(0x7f00000000c0), &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) statx(r1, 0x0, 0x100, 0x40, 0x0) write$FUSE_INIT(r0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000022c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_IOCTL(r0, &(0x7f0000004300)={0x20, 0x40000, r2, {0x403, 0x0, 0x8, 0xfff}}, 0x20) 1.046286604s ago: executing program 5 (id=203): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000001180), 0x10) listen(r0, 0x5) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f00000011c0)={0x28, 0x0, 0x0, @local}, 0x10) sendto$packet(r1, 0x0, 0x0, 0x408c4, 0x0, 0x0) 1.001035729s ago: executing program 5 (id=204): r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0xb, 0x101301) syz_mount_image$vfat(&(0x7f0000000100), &(0x7f0000000180)='./file0\x00', 0x4000, &(0x7f00000001c0)=ANY=[], 0xff, 0x2c5, &(0x7f0000000200)="$eJzs3E9rE08YwPGnaZOmKW1y+PEDBfFBL3pZ2vgKFmlBDCi1EfUgbO1GQ9akZGMkIrY3r76O4tGboL6BXrx5Fy9FELwUka5kN9tsYsS2Nt3++X6g7HRnn87MZhqeWdjZvPPqcaXkGjlpSCKtkhBZky2RXLvUMdI5JvxySqLW5PLk90/nbt29d90sFOYWVMVcvJJX1enz754+f33hQ2Py9pvpt+Oykbu/+S3/eeP/jTOb24vhX6811NKlWq1hLTm2LpfdiqF607Et19Zy1bXrPfUlp7ay0lKrujyVWanbrqtWtaUVu6WNmjbqLbUeWuWqGoahUxk5bUb3HFFcX1iwzKF0BnGYGHSyXjet0YGVxfXD6BQAADhawvy/ZB1U/j9vjuwi/39UdrXsavVv+X9CyP+Hx8//twcmjTgZku0FgGllOv+/vcj/AQAAAAAAAAAAAAAAAAAAAAA4DrY8L+t5XjY8hj/jIpIWkfD3uPuJ4djH5z8SY3dxwCIv7qVFnJfNYrMYHIN6syRlccSWmaTIz/Z8+OEF/LnhzV8rzM2oLyfvndVOvP+S4HgYH8oFMf3xs0G8RuJXm8WkZKLt5yUr/w2Oz/fFJ0WkWUzJpYuReEOy8vGB1MSRZX9ed+NfzKpevVHoa3/Cvw4AAAAAgJPA0B253vVvsJukYWi4bUhffXCy+3xAssHzgd/X5zM76/OUdOPH5OxYfOMGAAAAAOA0cVvPKpbj2PXjWkh2BnLYre/31qVE5Ijcuj0XjHRwrwdUpSU843neavuif280ISIxjfTrn2dU+NDqqHwoeyl8eRL0fTcXx/FtBAAAAGCYukl/3D0BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOD02u3mYeH1+9l7LNLcaG/rk4c4UgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACB+vwIAAP//fgUQfw==") r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x107042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) fsopen(0x0, 0x0) ioctl$USBDEVFS_BULK(r0, 0xc0185502, 0x0) 515.415958ms ago: executing program 4 (id=210): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x22000406, &(0x7f0000000080)={[{@dioread_lock}, {@noblock_validity}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x9}}, {@jqfmt_vfsold}, {@errors_remount}, {@grpjquota, 0x2e}, {@journal_async_commit}, {@resuid}, {@barrier_val}, {@grpid}], [], 0x2c}, 0x84, 0x4f3, &(0x7f0000000140)="$eJzs3M1vFOUfAPDvTOkbFFr4kZ/yolTR2Ii2tKBy8KBGEy4aEz3gsZZKkAKG1kQIkWIMHo1/AXo0MfHkRS+aqFEvarzq3ZgQwwXUxNTM7kx32+5ut1torfv5JNt9nplnXr7PzDP77DzbCaBtDWZ/koi+iPg5IvrL2YUFBstvN69fnPjj+sWJJObmXvg9KZW7cf3iRFG0WG5LnhlKI9K3k9hTY7vT5y+cGp+amjyX50dmTr82Mn3+wsMnT4+fmDwxeWbsyJHDh0Yfe3TskabiuLTM/CyuG7vfPLt319GX3nt2Yi5e/vajbH/78vnVcZQNNLXdRgZjMOZylaldpb/3r3rt/y5boze683SyafHcy2u/QzSlIyKyw9VZav/90RGVg9cfz7w1n/lynXYQuG2yz6btS6Z25O/p/OcX8F+UaOPQpopP/Oz7b/Fay/7Herv2ZPZ3shT/zfz1/XPlukmz77IDEV299Zf/f41pPZXkXP8y2++rdLauRs37EA0kTZcEAJj3edb/eahW/y9d0LfZlo+hDETEgYjYERH/i4idkc6XuSMi7lzh9gcX5Zf2f35s0Ptavaz/93g+tlW8ynOKuJL53NZS/J3JKyenJg/mdTIUnd1ZfrTBNr54+qd3683L4j82++fV4pVtP3uvlEh/29S9cJnj4zPjqwh5gWuXI4lNteJP5kcCshrYFRG7W1h/VmcnH/xwb5betmXp/OXjb2DJONPKzX0Q8UD5+M/GovgLSXlL9cYnR3piavLgSHFWLPXdD1eer853VqUXxN/TXEw9rQZbw7XLEZtrnv95/EUzKMZrp/P8V31Nb+PKL+/U/U6z9PgncWy2ukR+/vdWqi07/7uSF0vprnzaG+MzM+dGIz7LJyyYPlZZW5EvymfxD+1fGH/5e3GaXeP+fj9fbk9EZCfxXRFxd0Tsy/f9noi4NyL2N4j/m6fue7VxDbV4/t8CWfzHGx3/iIGkery+hUTHqa8/rbf95q5/h0upoXxK9fWvq856m93B1dYfAAAAbARpaQw6SYcjYtFtxtgZm9Ops9MzBwbj9TPHy7+VH4jOtLjT1V91P3Q0vzdc5McW5Q9FxPbSL416S/nhibNTW9cpZqBsS1X7L18L0nR4uDzv14713jvgtlvROFr1j84+/uTW7wywpm7BODqwQWn/0L60f2hf2j+0r1rt/1LEzXXYFWCNtfr5v/gHA8DGo/8P7Uv7h/al/UNbWvov8fnjVrJrQuv/8j+14+hqnhhw+xNz/a0vHvVnza58hR3NFS6eftH0mpsrnEQU4aQN4qqRiLQy5a/8aZKlKZ3lMl3N7+raJ9JlyzyxXG10ruiZGD01amNfnuiOiGbXc2nNarW4QiSeMgkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGxo/wQAAP//HfHjTg==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='.\x00', 0x0, 0x42) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0x8004587d, &(0x7f0000000680)={@id={0x2, 0x0, @d}}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000001600)='.\x00', 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r1, 0x8004587d, 0x0) 463.597263ms ago: executing program 3 (id=212): r0 = openat$kvm(0x0, &(0x7f0000000480), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000004c0)={0x0, &(0x7f0000000700)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x4d, {0x0, "48b800800000000000000f23c80f21f8350c0020000f23f86d3266b864000f00d03500010000b8050002000f006080000f01b00f30"}}, @nested_vmlaunch={0x12f, 0x18}], 0x95}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 338.326436ms ago: executing program 4 (id=213): inotify_init1(0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000080)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) preadv(r0, &(0x7f0000000200)=[{&(0x7f0000000240)=""/2, 0x2}], 0x1, 0x10, 0x1) 297.00208ms ago: executing program 2 (id=214): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x1, 0x8003}}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x2, 0xf5ff}, 0x10) sendmsg$tipc(r1, &(0x7f0000000540)={&(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x2, {0x0, 0x1, 0x1}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000004}, 0x0) close(0x3) 276.026922ms ago: executing program 1 (id=215): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0) 229.867097ms ago: executing program 3 (id=216): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000940)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0xfffc, 0x0, 0x0, 0xa, 0x20, 0x80}, {0x20008, 0x10, 0x100000002, 0x0, 0x6, 0xffffffffffffb475, 0xffffffffffffffff, 0x4}, {0x1000000003, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0x5, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}}}, 0xb8}}, 0x2c000010) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2, 0x0, 0x0, 0x0, 0x4}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 212.182289ms ago: executing program 2 (id=217): r0 = socket$inet(0x2, 0x801, 0x0) bind$inet(r0, &(0x7f0000000680)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000a40)={0x2, 0x4e23, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000a80)="5c2e91", 0x3, 0x10044041, 0x0, 0x0) pipe2(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r0, 0x0, r1, 0x0, 0x2, 0x0) 200.56514ms ago: executing program 1 (id=218): rt_sigprocmask(0x0, &(0x7f0000000240)={[0xfffffffffffffffd]}, 0x0, 0x8) r0 = gettid() r1 = getpid() rt_tgsigqueueinfo(r1, r0, 0x1a, &(0x7f0000000080)={0x10011, 0x0, 0x2}) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xfffffffffffffff5]}, 0x8, 0x80000) readv(r2, &(0x7f0000000180)=[{&(0x7f0000000380)=""/4096, 0x1000}], 0x1) 197.07564ms ago: executing program 3 (id=219): r0 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x1, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x200008, &(0x7f0000000c40)=ANY=[@ANYRES8=r0, @ANYRES32, @ANYRESOCT], 0x1, 0x392, &(0x7f0000000f40)="$eJzs3T1vW2UUAOATt/mExBkQEiDEq24sVhL+QCPUSohIoFCj0gFxS5xixY0j2wpyhaADEiv/gL1iZENC/IEMsLOxZWHsUNXIX6mdul+kyaXq80jRPfZ7jvO+tnx1FuscXv3x5s52s7SdtaJwMUUhIgp3I5Z7Ud/U4FroxTMx6na8W7z619uffHbtw/WNjUubKV1ev/LeWkpp6Z3fvv7m5wu/t1759JelX2fjYPnzw3/W/j54/eCNw/tXvqo2U7WZduutlKXr9Xoru16rpK1qc6eU0se1StaspOpus9IYW9+u1ff22inb3Vpc2GtUms2U7bbTTqWdWvXUarRTdiOr7qZSqZQWF4InKd/Z3MzW+/HcY/IuntWGOAWNxnrW/Q7PPrRSvpPLhgCAXJ20/595qv7/WmGk/5+LR/b/06H/fy6mny5ttP//zy/C/1y3/58ZfH/H6f8BAAAAAAAAAAAAAOBFcLfTKXY6neLw2hn+SHjwOOftccoe+vyP/eW9P07XyA/35iJqP+yX98v9a399fTuqUYtKrEQx7nVvC0P9+PIHG5dWUs9yLN78rld/4Y+I8rnx+tUoxvLk+tV+fTqqj+51OhZG69fii3htcv3axPqZWPlppL4Uxfjzy6hHLbZ6t7cH9d+upvT+RxvH6md7eQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC8HEpp6K3oz73fL0fMx/5gfn/pQcLy+Hz8fv3RfP2VKMa9yfP5VybO5z8fb57P9+wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMNRs39rJarVK46yC4cz/3jMzw+DRVVP99NvHluZjPHn2Sa9zwqDwTFXzg0NOWLrf6XR6wY3vn/tW5872ozxJMB0Rj8npDN7Ak/+vVyNi9Jlz4zmzEXGqJ13qBoX83/BnDvK4GwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEC+joZ+dx9M5b0bAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8tJs39rJarVK4xSDvM8IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwIvk3AAD//8s8Cyw=") r1 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./file2\x00', 0x101042, 0x15) mount$bpf(0x0, &(0x7f0000000640)='./file0\x00', 0x0, 0x2984033, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) 188.265391ms ago: executing program 2 (id=220): getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, 0x0, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, 0x0) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000000280)={@loopback, 0x80, r2}) 177.077582ms ago: executing program 4 (id=221): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x100bf28, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3e}}, 0xfffff805}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x140c8050, 0x0, 0x0) 159.198714ms ago: executing program 1 (id=222): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000200)='./bus\x00', 0x283016, 0x0, 0x11, 0x0, 0x0) mount(0x0, &(0x7f0000000940)='./bus\x00', &(0x7f0000000a00)='devtmpfs\x00', 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000140)='./file0/file0\x00', 0x4002, 0x0, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000340)='./bus\x00', &(0x7f0000000b80), 0x8, &(0x7f00000000c0)={[{@lowerdir={'lowerdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0/file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@index_on}]}) 128.197748ms ago: executing program 4 (id=223): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc_mnt\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) mount$bind(&(0x7f0000000180)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', &(0x7f00000001c0)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', 0x0, 0x221490, 0x0) unshare(0x6020400) r0 = socket(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x8922, &(0x7f0000000280)={'lo\x00', {0x2, 0x0, @rand_addr=0xff}}) 112.178529ms ago: executing program 2 (id=224): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xd, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000008"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1802000000000000000000000000020085000000a800000095"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r1, 0x0, 0x0}, 0x10) 110.042279ms ago: executing program 1 (id=225): r0 = memfd_create(&(0x7f0000000240)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xef-\xa6m\xa1\xc4\xb5{\xf2\\\x8d[7k~\x04\x03~K\xfbP\x84=\xfa\x81\x8c\x1et\x10', 0x0) pwrite64(r0, &(0x7f00000008c0)='/', 0x1, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000880), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000900), 0x10106, 0x2, 0x0) 73.280513ms ago: executing program 2 (id=226): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000580)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x755, 0x2626, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x4, 0x50, 0x9, "", [{{0x9, 0x4, 0x0, 0xd, 0x1, 0x3, 0x1, 0x3, 0x4, {0x9, 0x21, 0x22, 0x77, 0x1, {0x22, 0x4be}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x3, 0x8, 0xff}}}}}]}}]}}, &(0x7f00000005c0)={0x0, 0x0, 0xffffffdb, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000600)={0x14, &(0x7f0000000640)=ANY=[@ANYBLOB="200d350000003500801c95bb157f92c99d951a045bfd463a8d3b2a212a"], 0x0}, 0x0) 63.627284ms ago: executing program 1 (id=227): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="1900000004000000080000000a"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000100002020207b1af8ff00000000bf86a26db800000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa1000000"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2}, 0xc) 34.466867ms ago: executing program 4 (id=228): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000cc0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = eventfd2(0x10, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000d00)={0x0, r1}) r2 = eventfd2(0x6, 0x1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000d40)={0x0, r2}) 17.009859ms ago: executing program 1 (id=229): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x3, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20}, {0x8, 0x10, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020004000000000000000000000000000000000000000000000000001b00000000000000000a00"], 0xb8}}, 0x2c000010) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 0s ago: executing program 4 (id=230): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000400)={0x1, &(0x7f0000000440)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x22000406, &(0x7f0000000240)={[{@minixdf}, {@noblock_validity}, {@abort}, {@dioread_lock}, {@stripe={'stripe', 0x3d, 0xe3}}, {@grpjquota, 0x2e}, {@nouser_xattr}, {@nolazytime}, {@jqfmt_vfsv1}, {@grpid}], [], 0x2c}, 0x84, 0x4ab, &(0x7f0000000480)="$eJzs3M1vFOUfAPDvTF94p4UfP5UXZRWNjWhLCyoHD2g04WJiogc81lIJUsDQmgghUo3Bo/EvUI8mJp68eNLEGPWk8ap3Y0IMF9CDqZndmXa23ZbtdttV9/NJdnmemWf2eb4z8+w+Mw/TALpWJXtLIrZHxM8RMVDL1heo1P65ffPqxB83r04kMTf34u9Jtdytm1cniqLFdtvyzFAakb6bxP4G9U5fvnJufGpq8lKeH5k5//rI9OUrj509P35m8szkhbHjx48dHX3yibHH2xJnFtetfW9dPLD35MsfPD8xF69892nW3u35+nIcNYNrrrMSlZjLLSztr74/tOZP/2fZUUonvR1sCKvSExHZ4eqr9v+B6ImFgzcQz70zn/m6Qw0E1k3227RrydKe/N90/vcL+C9K9HHoUsUvfnb9W7w2cvzRaTeezt4nq/Hfzl+1Nb2RZteyg7Ur9uUuaU+ssf7tEXFq9s8Ps1c0vA8BANBeX2bjn0cbjf/SuKtUbmc+hzIYEYcjYndE/C8i9kTE/yOqZe+OiHtWWX9lUX7p+OfHLS0F1qRs/PdUPrdVP/5L8xLJfG5HNf6+5NWzU5NH8n0yFH2bsvzoCnV89exP7y+3rlIa/2WvrP5iLJi347feTfXbnB6fGV9DyHVuvB2xr7dR/Mn8mDfbA3sjYl8Ln5/ts7OPfHIgS+/ctnT9neNfQRvmmeY+jni4dvxnY1H8haRW03LzkyObY2ryyEhxViz1/Q/XXyjn+0rpuvg3NxfT5laDbSA7/lsbnv95/EU3KOZrp1dfx/Vf3lv2mmbp8U/i1Gy5RO38T0tLsvO/P3mpmu7Pl705PjNzaTSiP19Qt3xsYdsiX5TP4h861Lj/747466N8u/0RkZ3E90bEfRFxMG/7/RHxQEQcWiH+b5958LWV91CL538bZPGfXun4Rwwm5fn6FhI95775Yrn6m/v+O1ZNDeVLmvn+a7aBa9l3AAAA8G+RVuegk3S4SJduTu2JrenUxemZw5V448Lp2lz1YPSlxZ2ugdL90NH83nCRH1uUPxoRu6r/02hLNT88cXFqRycDB6rP6tT1/0jT4eHaul97Ot06YN2tah6t/HTgZ5+3vzHAhvK8JnQv/R+6l/4P3Uv/h+7VqP9fi7jdgaYAG8zvP3Qv/R+6l/4P3Uv/h6609JH44s+ttPKk/0Ji98k1bb7uibmBdfnk2dVv1bNOkUb5j3Ysm0giorUqIl25TH8TtXcskd6xzIkWd8sqEgfzxKaIaHaraxu2Vzv7vQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANAufwcAAP//eDnc9Q==") bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000940)='\x00', 0x89901) fspick(r0, &(0x7f0000000980)='.\x00', 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.90' (ED25519) to the list of known hosts. [ 23.850785][ T28] audit: type=1400 audit(1793710188.227:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.854231][ T279] cgroup: Unknown subsys name 'net' [ 23.873470][ T28] audit: type=1400 audit(1793710188.227:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.900840][ T28] audit: type=1400 audit(1793710188.257:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.901220][ T279] cgroup: Unknown subsys name 'devices' [ 24.022263][ T279] cgroup: Unknown subsys name 'hugetlb' [ 24.027888][ T279] cgroup: Unknown subsys name 'rlimit' [ 24.132812][ T28] audit: type=1400 audit(1793710188.507:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.156036][ T28] audit: type=1400 audit(1793710188.507:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.180941][ T28] audit: type=1400 audit(1793710188.507:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 24.188305][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 24.213502][ T28] audit: type=1400 audit(1793710188.587:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.239558][ T28] audit: type=1400 audit(1793710188.587:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.268838][ T28] audit: type=1400 audit(1793710188.647:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.270001][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.294442][ T28] audit: type=1400 audit(1793710188.647:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.092352][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.099440][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.107089][ T288] device bridge_slave_0 entered promiscuous mode [ 25.132310][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.139377][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.147104][ T288] device bridge_slave_1 entered promiscuous mode [ 25.187640][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.194787][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.202420][ T287] device bridge_slave_0 entered promiscuous mode [ 25.222023][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.229092][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.236638][ T287] device bridge_slave_1 entered promiscuous mode [ 25.254939][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.262062][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.269436][ T289] device bridge_slave_0 entered promiscuous mode [ 25.279435][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.286531][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.294057][ T289] device bridge_slave_1 entered promiscuous mode [ 25.328978][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.336120][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.343796][ T291] device bridge_slave_0 entered promiscuous mode [ 25.353652][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.360753][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.368240][ T291] device bridge_slave_1 entered promiscuous mode [ 25.406230][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.413352][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.420914][ T290] device bridge_slave_0 entered promiscuous mode [ 25.428454][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.435577][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.443214][ T290] device bridge_slave_1 entered promiscuous mode [ 25.596097][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.603383][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.610744][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.617792][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.629723][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.636830][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.644152][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.651216][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.677825][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.684919][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.692233][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.699269][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.719188][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.726300][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.733639][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.740706][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.770971][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.778383][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.785874][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.793844][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.801134][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.808299][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.815623][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.822918][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.831183][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.838608][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.857860][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.871524][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.879157][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.887457][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.894526][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.905046][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.913968][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.921057][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.950392][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.959847][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.968076][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.975253][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.983879][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.992138][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.999165][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.006559][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.014816][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.021882][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.029371][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.037618][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.044678][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.052185][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.060195][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.096133][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.104393][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.111455][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.118939][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.129173][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.137328][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.145377][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.153583][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.160655][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.168028][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.176403][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.184460][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.192812][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.207575][ T288] device veth0_vlan entered promiscuous mode [ 26.218226][ T289] device veth0_vlan entered promiscuous mode [ 26.224659][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.233129][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.241771][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.249674][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.258034][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.266113][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.275401][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.282972][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.290444][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.297879][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.315458][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.323686][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.331827][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.341130][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.352416][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.360684][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.377924][ T289] device veth1_macvtap entered promiscuous mode [ 26.385610][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.393931][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.402520][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.410815][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.418925][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.431709][ T291] device veth0_vlan entered promiscuous mode [ 26.440855][ T288] device veth1_macvtap entered promiscuous mode [ 26.448342][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.456285][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.464074][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.472247][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.480219][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.488271][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 26.497016][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.505452][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.512525][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.520034][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.527591][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.535250][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 26.544776][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 26.553318][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.561623][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.568652][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.588961][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.597540][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.606187][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.614734][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.623301][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.631720][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.640095][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.648134][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.667920][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.676224][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.684934][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.693994][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.694295][ T289] request_module fs-gadgetfs succeeded, but still no fs? [ 26.727268][ T291] device veth1_macvtap entered promiscuous mode [ 26.746433][ T287] device veth0_vlan entered promiscuous mode [ 26.754246][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.762778][ T310] loop0: detected capacity change from 0 to 2048 [ 26.765000][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.786537][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.795154][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.810396][ T288] ------------[ cut here ]------------ [ 26.811987][ T310] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 26.815984][ T288] WARNING: CPU: 1 PID: 288 at fs/overlayfs/util.c:489 ovl_dir_modified+0x189/0x1c0 [ 26.833737][ T288] Modules linked in: [ 26.837666][ T288] CPU: 1 PID: 288 Comm: syz-executor Not tainted syzkaller #0 [ 26.842092][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.845216][ T288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 26.853637][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.862908][ T288] RIP: 0010:ovl_dir_modified+0x189/0x1c0 [ 26.872641][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.876209][ T288] Code: 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 be 78 a3 ff 49 ff 06 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 67 dc 5d ff <0f> 0b e9 17 ff ff ff e8 5b dc 5d ff 0f 0b e9 51 ff ff ff 44 89 e1 [ 26.884247][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.903195][ T288] RSP: 0018:ffffc90000e27b60 EFLAGS: 00010293 [ 26.916466][ T288] RAX: ffffffff821395b9 RBX: 1ffff11022ec00d2 RCX: ffff88810d443cc0 [ 26.924500][ T288] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.932537][ T288] RBP: ffffc90000e27b90 R08: ffff8881177c61af R09: 1ffff11022ef8c35 [ 26.940575][ T288] R10: dffffc0000000000 R11: ffffed1022ef8c36 R12: ffff888117600660 [ 26.948577][ T288] R13: 0000000000000000 R14: ffff8881177c6108 R15: ffff888117600690 [ 26.956653][ T288] FS: 000055557dc99500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 26.965644][ T288] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.972284][ T288] CR2: 00007fff24eab988 CR3: 000000012ff90000 CR4: 00000000003506a0 [ 26.980360][ T288] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.988362][ T288] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.996488][ T288] Call Trace: [ 26.999864][ T288] [ 27.002823][ T288] ovl_do_remove+0x6d3/0xa60 [ 27.007450][ T288] ? ovl_set_redirect+0x6b0/0x6b0 [ 27.012555][ T288] ? selinux_inode_rmdir+0x22/0x30 [ 27.017708][ T288] ovl_rmdir+0x1a/0x20 [ 27.021882][ T288] vfs_rmdir+0x381/0x4f0 [ 27.026164][ T288] incfs_kill_sb+0xfe/0x210 [ 27.030729][ T288] deactivate_locked_super+0xb5/0x120 [ 27.036141][ T288] deactivate_super+0xaf/0xe0 [ 27.037380][ T290] device veth0_vlan entered promiscuous mode [ 27.040900][ T288] cleanup_mnt+0x45e/0x4e0 [ 27.051318][ T288] __cleanup_mnt+0x19/0x20 [ 27.055765][ T288] task_work_run+0x1e1/0x250 [ 27.060430][ T288] ? __cfi_task_work_run+0x10/0x10 [ 27.065581][ T288] ? __x64_sys_umount+0x12d/0x170 [ 27.070706][ T288] ? __cfi___x64_sys_umount+0x10/0x10 [ 27.076125][ T288] exit_to_user_mode_loop+0x9b/0xb0 [ 27.081859][ T288] exit_to_user_mode_prepare+0x87/0xd0 [ 27.087404][ T288] syscall_exit_to_user_mode+0x1a/0x30 [ 27.092933][ T288] do_syscall_64+0x58/0xa0 [ 27.097397][ T288] ? clear_bhb_loop+0x30/0x80 [ 27.101481][ T287] device veth1_macvtap entered promiscuous mode [ 27.102154][ T288] ? clear_bhb_loop+0x30/0x80 [ 27.113109][ T288] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.119037][ T288] RIP: 0033:0x7f58271a0d57 [ 27.123522][ T288] Code: a2 c7 05 9c a9 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 27.143214][ T288] RSP: 002b:00007ffe5b8ca348 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 27.151765][ T288] RAX: 0000000000000000 RBX: 00007f5827236fb3 RCX: 00007f58271a0d57 [ 27.159791][ T288] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe5b8ca400 [ 27.167792][ T288] RBP: 00007ffe5b8ca400 R08: 00007ffe5b8cb400 R09: 00000000ffffffff [ 27.175837][ T288] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe5b8cb490 [ 27.183893][ T288] R13: 00007f5827236fb3 R14: 000000000000687d R15: 00007ffe5b8cb4d0 [ 27.191961][ T288] [ 27.195007][ T288] ---[ end trace 0000000000000000 ]--- [ 27.203922][ T288] ------------[ cut here ]------------ [ 27.205003][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.209422][ T288] WARNING: CPU: 1 PID: 288 at fs/overlayfs/util.c:489 ovl_dir_modified+0x189/0x1c0 [ 27.227001][ T288] Modules linked in: [ 27.231081][ T288] CPU: 1 PID: 288 Comm: syz-executor Tainted: G W syzkaller #0 [ 27.231169][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.240344][ T288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 27.251895][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.258534][ T288] RIP: 0010:ovl_dir_modified+0x189/0x1c0 [ 27.267277][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 27.271753][ T288] Code: 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 be 78 a3 ff 49 ff 06 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 67 dc 5d ff <0f> 0b e9 17 ff ff ff e8 5b dc 5d ff 0f 0b e9 51 ff ff ff 44 89 e1 [ 27.299217][ T288] RSP: 0018:ffffc90000e27b60 EFLAGS: 00010293 [ 27.302394][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.305357][ T288] RAX: ffffffff821395b9 RBX: 1ffff11022ec00d2 RCX: ffff88810d443cc0 [ 27.315402][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.321382][ T288] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.330133][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.336767][ T288] RBP: ffffc90000e27b90 R08: ffff8881177c61af R09: 1ffff11022ef8c35 [ 27.352747][ T288] R10: dffffc0000000000 R11: ffffed1022ef8c36 R12: ffff888117600660 [ 27.360764][ T288] R13: 0000000000000000 R14: ffff8881177c6108 R15: ffff888117600690 [ 27.362634][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.368761][ T288] FS: 000055557dc99500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 27.385871][ T288] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.386873][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.392581][ T288] CR2: 00007fff24eab988 CR3: 000000012ff90000 CR4: 00000000003506a0 [ 27.392602][ T288] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.402593][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.408587][ T288] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.432721][ T288] Call Trace: [ 27.436005][ T288] [ 27.438936][ T288] ovl_do_remove+0x6d3/0xa60 [ 27.443587][ T288] ? ovl_set_redirect+0x6b0/0x6b0 [ 27.448661][ T288] ? selinux_inode_rmdir+0x22/0x30 [ 27.453844][ T288] ovl_rmdir+0x1a/0x20 [ 27.457962][ T288] vfs_rmdir+0x381/0x4f0 [ 27.462252][ T288] incfs_kill_sb+0x18f/0x210 [ 27.466868][ T288] deactivate_locked_super+0xb5/0x120 [ 27.472395][ T288] deactivate_super+0xaf/0xe0 [ 27.477109][ T288] cleanup_mnt+0x45e/0x4e0 [ 27.481574][ T288] __cleanup_mnt+0x19/0x20 [ 27.486010][ T288] task_work_run+0x1e1/0x250 [ 27.490647][ T288] ? __cfi_task_work_run+0x10/0x10 [ 27.495785][ T288] ? __x64_sys_umount+0x12d/0x170 [ 27.500889][ T288] ? __cfi___x64_sys_umount+0x10/0x10 [ 27.506289][ T288] exit_to_user_mode_loop+0x9b/0xb0 [ 27.511539][ T288] exit_to_user_mode_prepare+0x87/0xd0 [ 27.517027][ T288] syscall_exit_to_user_mode+0x1a/0x30 [ 27.522540][ T288] do_syscall_64+0x58/0xa0 [ 27.526975][ T288] ? clear_bhb_loop+0x30/0x80 [ 27.531699][ T288] ? clear_bhb_loop+0x30/0x80 [ 27.536426][ T288] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.542390][ T288] RIP: 0033:0x7f58271a0d57 [ 27.546825][ T288] Code: a2 c7 05 9c a9 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 27.566585][ T288] RSP: 002b:00007ffe5b8ca348 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 27.575064][ T288] RAX: 0000000000000000 RBX: 00007f5827236fb3 RCX: 00007f58271a0d57 [ 27.583073][ T288] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe5b8ca400 [ 27.591090][ T288] RBP: 00007ffe5b8ca400 R08: 00007ffe5b8cb400 R09: 00000000ffffffff [ 27.599082][ T288] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe5b8cb490 [ 27.607181][ T288] R13: 00007f5827236fb3 R14: 000000000000687d R15: 00007ffe5b8cb4d0 [ 27.615516][ T288] [ 27.618565][ T288] ---[ end trace 0000000000000000 ]--- [ 27.638074][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.645738][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.649649][ T318] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 27.654456][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.677651][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.691274][ T289] EXT4-fs (loop0): unmounting filesystem. [ 27.727289][ T289] syz-executor (289) used greatest stack depth: 21184 bytes left [ 27.747918][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 27.759671][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.768011][ T322] using random self ethernet address [ 27.775475][ T322] using random host ethernet address [ 27.823353][ T290] device veth1_macvtap entered promiscuous mode [ 27.836746][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.845620][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.854449][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.868745][ T330] loop2: detected capacity change from 0 to 16 [ 27.889895][ T330] erofs: (device loop2): mounted with root inode @ nid 36. [ 27.908917][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.919270][ T333] FAULT_INJECTION: forcing a failure. [ 27.919270][ T333] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 27.950955][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.960487][ T333] CPU: 0 PID: 333 Comm: syz.1.12 Tainted: G W syzkaller #0 [ 27.969129][ T333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 27.979236][ T333] Call Trace: [ 27.982540][ T333] [ 27.985522][ T333] __dump_stack+0x21/0x24 [ 27.989884][ T333] dump_stack_lvl+0x110/0x170 [ 27.994612][ T333] ? __cfi_dump_stack_lvl+0x8/0x8 [ 27.999668][ T333] ? reweight_entity+0x73/0x5c0 [ 28.004560][ T333] ? kvm_sched_clock_read+0x18/0x40 [ 28.009797][ T333] dump_stack+0x15/0x24 [ 28.013980][ T333] should_fail_ex+0x3bf/0x510 [ 28.018691][ T333] should_fail_alloc_page+0x61/0x90 [ 28.023930][ T333] prepare_alloc_pages+0x131/0x570 [ 28.029088][ T333] ? __alloc_pages_bulk+0x9d0/0x9d0 [ 28.034339][ T333] __alloc_pages+0x15b/0x610 [ 28.039004][ T333] ? __cfi___alloc_pages+0x10/0x10 [ 28.044157][ T333] ? switch_mm_irqs_off+0x2fb/0x960 [ 28.049393][ T333] ? __schedule+0xcbb/0x1700 [ 28.054025][ T333] __pmd_alloc+0xa1/0x4b0 [ 28.058421][ T333] ? mas_state_walk+0x7ab/0xa80 [ 28.063316][ T333] ? __cfi___pmd_alloc+0x10/0x10 [ 28.068286][ T333] ? __kasan_check_read+0x11/0x20 [ 28.073344][ T333] handle_mm_fault+0xa7a/0x26b0 [ 28.078232][ T333] ? __cfi_handle_mm_fault+0x10/0x10 [ 28.083540][ T333] ? down_read_trylock+0x27f/0x660 [ 28.088689][ T333] ? vfs_write+0xa51/0xd00 [ 28.093141][ T333] ? lock_mm_and_find_vma+0x9e/0x320 [ 28.098825][ T333] ? do_user_addr_fault+0x2eb/0x1030 [ 28.104148][ T333] do_user_addr_fault+0x61e/0x1030 [ 28.109311][ T333] exc_page_fault+0x51/0xb0 [ 28.113857][ T333] asm_exc_page_fault+0x27/0x30 [ 28.118740][ T333] RIP: 0010:__put_user_nocheck_8+0x3/0x21 [ 28.124527][ T333] Code: 00 00 48 39 d9 73 34 0f 01 cb 89 01 31 c9 0f 01 ca c3 90 90 90 90 90 90 48 bb f9 ef ff ff ff 7f 00 00 48 39 d9 73 14 0f 01 cb <48> 89 01 31 c9 0f 01 ca c3 90 90 90 90 90 0f 01 ca b9 f2 ff ff ff [ 28.144164][ T333] RSP: 0018:ffffc9000dcbfed8 EFLAGS: 00050293 [ 28.150276][ T333] RAX: 0000000000000018 RBX: 00007fffffffeff9 RCX: 0000000000000000 [ 28.158277][ T333] RDX: ffffc900016aa000 RSI: 0000000000000007 RDI: 0000000000000008 [ 28.166279][ T333] RBP: ffffc9000dcbff00 R08: ffff88810f6dd12b R09: 1ffff11021edba25 [ 28.174278][ T333] R10: dffffc0000000000 R11: ffffed1021edba26 R12: dffffc0000000000 [ 28.182294][ T333] R13: 0000000000000000 R14: 0000000000000000 R15: 00007f58280669a0 [ 28.190305][ T333] ? __x64_sys_get_robust_list+0x99/0xf0 [ 28.195977][ T333] x64_sys_call+0x450/0x9a0 [ 28.200516][ T333] do_syscall_64+0x4c/0xa0 [ 28.204969][ T333] ? clear_bhb_loop+0x30/0x80 [ 28.209764][ T333] ? clear_bhb_loop+0x30/0x80 [ 28.214507][ T333] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.220438][ T333] RIP: 0033:0x7f582719fb19 [ 28.224885][ T333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.244618][ T333] RSP: 002b:00007f5828066028 EFLAGS: 00000246 ORIG_RAX: 0000000000000112 [ 28.253064][ T333] RAX: ffffffffffffffda RBX: 00007f5827425fa0 RCX: 00007f582719fb19 [ 28.261069][ T333] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 28.269074][ T333] RBP: 00007f5827237b70 R08: 0000000000000000 R09: 0000000000000000 [ 28.277071][ T333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 28.285068][ T333] R13: 00007f5827426038 R14: 00007f5827425fa0 R15: 00007ffe5b8cb0d8 [ 28.293070][ T333] [ 28.420132][ T348] loop3: detected capacity change from 0 to 2048 [ 28.426661][ T355] capability: warning: `syz.4.17' uses 32-bit capabilities (legacy support in use) [ 28.432262][ T340] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.464426][ T340] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.474600][ T340] device bridge_slave_0 entered promiscuous mode [ 28.486015][ T340] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.500804][ T348] loop3: p1 < > p3 p4 < p5 > [ 28.507268][ T348] loop3: p3 size 467968 extends beyond EOD, truncated [ 28.514730][ T340] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.523630][ T340] device bridge_slave_1 entered promiscuous mode [ 28.530524][ T348] loop3: p5 size 467968 extends beyond EOD, truncated [ 28.621270][ T313] I/O error, dev loop3, sector 8 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 28.621483][ T357] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 28.630953][ T356] I/O error, dev loop3, sector 8 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 28.640690][ T323] I/O error, dev loop3, sector 775 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 28.650535][ T287] __loop_clr_fd: partition scan of loop3 failed (rc=-16) [ 28.675476][ T313] I/O error, dev loop3, sector 8 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 28.685912][ T323] I/O error, dev loop3, sector 775 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 28.704044][ T313] Buffer I/O error on dev loop3p5, logical block 1, async page read [ 28.713282][ T323] Buffer I/O error on dev loop3p1, logical block 0, async page read [ 28.724199][ T357] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 28.724777][ T356] I/O error, dev loop3, sector 8 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 28.742747][ T356] Buffer I/O error on dev loop3p3, logical block 1, async page read [ 28.743754][ T357] Buffer I/O error on dev loop3p4, logical block 0, async page read [ 28.795753][ T323] I/O error, dev loop3, sector 775 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 28.800693][ T357] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 28.829996][ T323] Buffer I/O error on dev loop3p1, logical block 0, async page read [ 28.846962][ T357] Buffer I/O error on dev loop3p4, logical block 0, async page read [ 28.859554][ T363] netlink: 'syz.2.19': attribute type 4 has an invalid length. [ 28.867576][ T323] Buffer I/O error on dev loop3p1, logical block 0, async page read [ 28.870829][ T364] kvm [358]: vcpu0, guest rIP: 0x9101 Unhandled WRMSR(0x1d9) = 0x1 [ 28.876512][ T357] Buffer I/O error on dev loop3p4, logical block 0, async page read [ 28.899959][ T323] Buffer I/O error on dev loop3p1, logical block 0, async page read [ 28.908163][ T323] Buffer I/O error on dev loop3p1, logical block 0, async page read [ 28.917033][ T363] netlink: 'syz.2.19': attribute type 4 has an invalid length. [ 28.931086][ T308] device bridge_slave_1 left promiscuous mode [ 28.937270][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.951617][ T308] device bridge_slave_0 left promiscuous mode [ 28.964785][ T308] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.974575][ T308] device veth1_macvtap left promiscuous mode [ 28.987875][ T308] device veth0_vlan left promiscuous mode [ 29.001180][ T28] kauditd_printk_skb: 86 callbacks suppressed [ 29.001196][ T28] audit: type=1400 audit(1793710193.377:160): avc: denied { append } for pid=365 comm="syz.3.20" name="kvm" dev="devtmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 29.154994][ T369] loop3: detected capacity change from 0 to 256 [ 29.173301][ T369] exFAT-fs (loop3): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x196362d4, utbl_chksum : 0xe619d30d) [ 29.195871][ T340] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.202971][ T340] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.210329][ T340] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.217388][ T340] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.228739][ T28] audit: type=1400 audit(1793710193.567:161): avc: denied { create } for pid=340 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 29.255904][ T28] audit: type=1400 audit(1793710193.567:162): avc: denied { write } for pid=340 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 29.276656][ T28] audit: type=1400 audit(1793710193.567:163): avc: denied { read } for pid=340 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 29.309672][ T363] syz.2.19 (363) used greatest stack depth: 20384 bytes left [ 29.319123][ T369] syz.3.21: attempt to access beyond end of device [ 29.319123][ T369] loop3: rw=0, sector=184, nr_sectors = 4101 limit=256 [ 29.337451][ T28] audit: type=1400 audit(1793710193.597:164): avc: denied { add_name } for pid=368 comm="syz.3.21" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 29.398013][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.417427][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.430356][ T28] audit: type=1400 audit(1793710193.597:165): avc: denied { associate } for pid=368 comm="syz.3.21" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 29.476812][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 29.490041][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.508116][ T376] netlink: 4 bytes leftover after parsing attributes in process `syz.4.24'. [ 29.529576][ T28] audit: type=1400 audit(1793710193.607:166): avc: denied { write open } for pid=368 comm="syz.3.21" path="/6/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop3" ino=1048645 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 29.598661][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 29.610311][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.628828][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.635956][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.638757][ T28] audit: type=1400 audit(1793710193.627:167): avc: denied { read append } for pid=368 comm="syz.3.21" name="file1" dev="loop3" ino=1048646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 29.676368][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 29.685798][ T28] audit: type=1400 audit(1793710193.677:168): avc: denied { create } for pid=370 comm="syz.4.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 29.706036][ T28] audit: type=1400 audit(1793710193.687:169): avc: denied { bind } for pid=370 comm="syz.4.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 29.711017][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.738093][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.745209][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.752857][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 29.761203][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.769452][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 29.777894][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.811206][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 29.828225][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.843106][ T340] device veth0_vlan entered promiscuous mode [ 29.849578][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 29.858280][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.865185][ T385] ======================================================= [ 29.865185][ T385] WARNING: The mand mount option has been deprecated and [ 29.865185][ T385] and is ignored by this kernel. Remove the mand [ 29.865185][ T385] option from the mount to silence this warning. [ 29.865185][ T385] ======================================================= [ 29.877578][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.909488][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.928364][ T340] device veth1_macvtap entered promiscuous mode [ 29.943500][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 29.956477][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.971040][ T391] loop4: detected capacity change from 0 to 1024 [ 29.980234][ T391] EXT4-fs: Ignoring removed oldalloc option [ 29.998421][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 30.025909][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 30.034839][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.041650][ T391] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 30.046456][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 30.060559][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.078972][ T391] ext4 filesystem being mounted at /5/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 30.105750][ T391] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.30: bg 0: block 112: padding at end of block bitmap is not set [ 30.132864][ T10] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #15: comm kworker/u4:1: lblock 0 mapped to illegal pblock 0 (length 1) [ 30.147045][ T10] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 30.170635][ T10] EXT4-fs (loop4): This should not happen!! Data will be lost [ 30.170635][ T10] [ 30.187338][ T290] EXT4-fs (loop4): unmounting filesystem. [ 30.509842][ T424] loop4: detected capacity change from 0 to 512 [ 30.565482][ T373] loop2: detected capacity change from 0 to 131072 [ 30.573568][ T373] F2FS-fs (loop2): invalid crc value [ 30.604607][ T373] F2FS-fs (loop2): Found nat_bits in checkpoint [ 30.673409][ T373] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4 [ 30.814088][ T439] netlink: 'syz.3.48': attribute type 4 has an invalid length. [ 30.826522][ T439] netlink: 'syz.3.48': attribute type 4 has an invalid length. [ 30.883787][ T445] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 30.898544][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 30.910362][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 30.925962][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 30.936797][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 30.945373][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 30.953882][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 30.962664][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 30.971261][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 31.023367][ T453] loop2: detected capacity change from 0 to 256 [ 31.043020][ T453] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 31.194485][ T464] 9pnet: p9_errstr2errno: server reported unknown error õ€ÿ0xffffffffffffffff [ 31.380130][ T482] loop5: detected capacity change from 0 to 8192 [ 31.393757][ T482] FAT-fs (loop5): error, invalid access to FAT (entry 0x0000e1b1) [ 31.401725][ T482] FAT-fs (loop5): Filesystem has been set read-only [ 31.453456][ T487] loop5: detected capacity change from 0 to 1024 [ 31.464022][ T487] EXT4-fs (loop5): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 31.480229][ T491] netlink: 8 bytes leftover after parsing attributes in process `syz.4.70'. [ 31.481133][ T487] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (38281!=20869) [ 31.498866][ T491] Zero length message leads to an empty skb [ 31.500853][ T487] EXT4-fs (loop5): failed to open journal device unknown-block(11,8) -6 [ 31.505024][ T60] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 31.678969][ T518] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 31.693353][ T518] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #3: block 1: comm syz.4.83: lblock 1 mapped to illegal pblock 1 (length 1) [ 31.708747][ T518] EXT4-fs error (device loop4): ext4_acquire_dquot:6828: comm syz.4.83: Failed to acquire dquot type 0 [ 31.728605][ T60] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 31.739228][ T518] EXT4-fs error (device loop4): ext4_free_blocks:6220: comm syz.4.83: Freeing blocks not in datazone - block = 0, count = 4096 [ 31.758262][ T60] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 31.772673][ T60] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 31.786796][ T518] EXT4-fs error (device loop4): ext4_read_inode_bitmap:140: comm syz.4.83: Invalid inode bitmap blk 0 in block_group 0 [ 31.799580][ T60] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 31.802700][ T518] EXT4-fs error (device loop4) in ext4_free_inode:362: Corrupt filesystem [ 31.808235][ T60] usb 3-1: SerialNumber: syz [ 31.818554][ T518] EXT4-fs (loop4): 1 orphan inode deleted [ 31.824469][ T334] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:4: lblock 1 mapped to illegal pblock 1 (length 1) [ 31.827971][ T518] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 31.858431][ T334] EXT4-fs error (device loop4): ext4_release_dquot:6864: comm kworker/u4:4: Failed to release dquot type 0 [ 31.888941][ T290] EXT4-fs (loop4): unmounting filesystem. [ 31.995031][ T543] FAULT_INJECTION: forcing a failure. [ 31.995031][ T543] name failslab, interval 1, probability 0, space 0, times 1 [ 32.008535][ T543] CPU: 1 PID: 543 Comm: syz.1.93 Tainted: G W syzkaller #0 [ 32.017193][ T543] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 32.027321][ T543] Call Trace: [ 32.030630][ T543] [ 32.033596][ T543] __dump_stack+0x21/0x24 [ 32.037966][ T543] dump_stack_lvl+0x110/0x170 [ 32.042819][ T543] ? __cfi_dump_stack_lvl+0x8/0x8 [ 32.047887][ T543] dump_stack+0x15/0x24 [ 32.052078][ T543] should_fail_ex+0x3bf/0x510 [ 32.056796][ T543] ? security_file_alloc+0x33/0x130 [ 32.062038][ T543] __should_failslab+0xac/0xf0 [ 32.062662][ T60] usb 3-1: 0:2 : does not exist [ 32.066842][ T543] should_failslab+0x9/0x20 [ 32.076229][ T543] kmem_cache_alloc+0x3b/0x320 [ 32.081043][ T543] ? __alloc_file+0x28/0x2a0 [ 32.085670][ T543] security_file_alloc+0x33/0x130 [ 32.090745][ T543] __alloc_file+0xb5/0x2a0 [ 32.095195][ T543] alloc_empty_file+0x97/0x180 [ 32.099619][ T60] usb 3-1: USB disconnect, device number 2 [ 32.100009][ T543] alloc_file+0x59/0x600 [ 32.100041][ T543] ? _raw_spin_unlock+0x4c/0x70 [ 32.115109][ T543] alloc_file_pseudo+0x180/0x200 [ 32.120106][ T543] ? __cfi_alloc_file_pseudo+0x10/0x10 [ 32.125619][ T543] ? __kasan_check_write+0x14/0x20 [ 32.130770][ T543] ? clear_nlink+0x8a/0xe0 [ 32.135266][ T543] __shmem_file_setup+0x1df/0x2b0 [ 32.140336][ T543] shmem_file_setup+0x2f/0x40 [ 32.145061][ T543] __se_sys_memfd_create+0x1de/0x3c0 [ 32.150383][ T543] __x64_sys_memfd_create+0x5b/0x70 [ 32.155624][ T543] x64_sys_call+0x235/0x9a0 [ 32.160200][ T543] do_syscall_64+0x4c/0xa0 [ 32.164652][ T543] ? clear_bhb_loop+0x30/0x80 [ 32.169371][ T543] ? clear_bhb_loop+0x30/0x80 [ 32.174089][ T543] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.180022][ T543] RIP: 0033:0x7f582719fb19 [ 32.184472][ T543] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.204140][ T543] RSP: 002b:00007f5828065e08 EFLAGS: 00000202 ORIG_RAX: 000000000000013f [ 32.212591][ T543] RAX: ffffffffffffffda RBX: 0000000000005505 RCX: 00007f582719fb19 [ 32.220598][ T543] RDX: 00007f5828065ee0 RSI: 0000000000000000 RDI: 00007f5827237d63 [ 32.228615][ T543] RBP: 0000200000002480 R08: 00000000ffffffff R09: 0000000000000000 [ 32.236623][ T543] R10: 0000000000000001 R11: 0000000000000202 R12: 0000200000001380 [ 32.244633][ T543] R13: 00007f5828065ee0 R14: 00007f5828065ea0 R15: 0000200000000280 [ 32.252652][ T543] [ 32.276639][ T546] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.300689][ T546] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.329554][ T551] netlink: 'syz.3.94': attribute type 16 has an invalid length. [ 32.337946][ T551] netlink: 'syz.3.94': attribute type 17 has an invalid length. [ 32.353871][ T551] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 32.369865][ T551] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 32.387581][ T551] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.394711][ T551] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.402508][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 32.405167][ T551] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.425293][ T551] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.446866][ T551] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0.257: link becomes ready [ 32.671683][ T576] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 32.729963][ T588] syz.1.112 uses obsolete (PF_INET,SOCK_PACKET) [ 32.798759][ T593] kvm [592]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 32.809454][ T593] kvm [592]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 32.816375][ T596] Illegal XDP return value 4294967274 on prog (id 9) dev N/A, expect packet loss! [ 33.130279][ T622] set_capacity_and_notify: 1 callbacks suppressed [ 33.130308][ T622] loop3: detected capacity change from 0 to 512 [ 33.145576][ T624] netlink: 1363 bytes leftover after parsing attributes in process `syz.5.127'. [ 33.159969][ T40] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 33.170414][ T622] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 33.179442][ T622] ext4 filesystem being mounted at /36/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 33.182657][ T628] netlink: 8 bytes leftover after parsing attributes in process `syz.5.128'. [ 33.200827][ T628] IPv6: ADDRCONF(NETDEV_CHANGE): gre1: link becomes ready [ 33.212195][ T628] IPv6: ADDRCONF(NETDEV_CHANGE): gre1: link becomes ready [ 33.220283][ T287] EXT4-fs (loop3): unmounting filesystem. [ 33.249827][ T60] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 33.324783][ T637] netlink: 27 bytes leftover after parsing attributes in process `syz.5.132'. [ 33.349804][ T40] usb 3-1: Using ep0 maxpacket: 32 [ 33.356197][ T40] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 33.364475][ T40] usb 3-1: config 0 has no interface number 0 [ 33.370632][ T40] usb 3-1: config 0 interface 184 has no altsetting 0 [ 33.378782][ T40] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 33.388175][ T40] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.396257][ T40] usb 3-1: Product: syz [ 33.400639][ T40] usb 3-1: Manufacturer: syz [ 33.405468][ T40] usb 3-1: SerialNumber: syz [ 33.417217][ T40] usb 3-1: config 0 descriptor?? [ 33.427704][ T40] smsc75xx v1.0.0 [ 33.440949][ T60] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 33.462087][ T60] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.477476][ T647] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 33.486262][ T60] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 33.496393][ T649] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 33.506343][ T60] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 33.539053][ T60] usb 2-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 33.550904][ T60] usb 2-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 33.559097][ T60] usb 2-1: Manufacturer: syz [ 33.564852][ T60] usb 2-1: config 0 descriptor?? [ 33.628393][ T658] loop4: detected capacity change from 0 to 8192 [ 33.639667][ T658] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 33.798354][ T676] netlink: 240 bytes leftover after parsing attributes in process `syz.4.149'. [ 33.968066][ T692] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 33.976834][ T60] appleir 0003:05AC:8243.0001: unknown main item tag 0x0 [ 33.991729][ T60] appleir 0003:05AC:8243.0001: No inputs registered, leaving [ 34.001551][ T60] appleir 0003:05AC:8243.0001: hiddev96,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.1-1/input0 [ 34.018078][ T28] kauditd_printk_skb: 121 callbacks suppressed [ 34.018093][ T28] audit: type=1400 audit(1793710198.387:288): avc: denied { mounton } for pid=695 comm="syz.4.157" path="/38/file0" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 34.047514][ T40] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 34.061498][ T40] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 34.105182][ T28] audit: type=1400 audit(1793710198.467:289): avc: denied { map } for pid=703 comm="syz.4.160" path="socket:[18265]" dev="sockfs" ino=18265 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 34.137435][ T28] audit: type=1400 audit(1793710198.467:290): avc: denied { read } for pid=703 comm="syz.4.160" path="socket:[18265]" dev="sockfs" ino=18265 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 34.186564][ T712] ip_tables: iptables: counters copy to user failed while replacing table [ 34.214191][ T717] netlink: 24 bytes leftover after parsing attributes in process `syz.4.166'. [ 34.241894][ T28] audit: type=1400 audit(1793710198.617:291): avc: denied { read } for pid=721 comm="syz.5.168" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 34.272916][ T688] usb 2-1: USB disconnect, device number 2 [ 34.309972][ T28] audit: type=1400 audit(1793710198.687:292): avc: denied { execute } for pid=720 comm="syz.4.169" path=2F6D656D66643A0241BBCC960E6F1FE240CCB15967202864656C6574656429 dev="tmpfs" ino=1048 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 34.365396][ T28] audit: type=1400 audit(1793710198.737:293): avc: denied { search } for pid=733 comm="syz.5.174" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 34.399572][ T28] audit: type=1400 audit(1793710198.737:294): avc: denied { read write } for pid=733 comm="syz.5.174" name="trace_options" dev="tracefs" ino=12884 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 34.425215][ T28] audit: type=1400 audit(1793710198.737:295): avc: denied { open } for pid=733 comm="syz.5.174" path="/49/tracefs/trace_options" dev="tracefs" ino=12884 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 34.450328][ T28] audit: type=1400 audit(1793710198.797:296): avc: denied { append } for pid=735 comm="syz.5.175" name="001" dev="devtmpfs" ino=164 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 34.486533][ T40] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000010: -71 [ 34.500356][ T40] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to write HW_CFG: -71 [ 34.510693][ T40] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 34.521326][ T40] smsc75xx: probe of 3-1:0.184 failed with error -71 [ 34.532426][ T40] usb 3-1: USB disconnect, device number 3 [ 34.539915][ T60] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 34.631483][ T28] audit: type=1400 audit(1793710199.007:297): avc: denied { create } for pid=747 comm="syz.5.181" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 34.729770][ T60] usb 4-1: Using ep0 maxpacket: 32 [ 34.736186][ T60] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 34.744829][ T60] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 34.753767][ T60] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 34.763157][ T60] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 34.772977][ T60] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 34.799766][ T60] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 34.812973][ T60] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 34.829391][ T60] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.840991][ T60] usb 4-1: config 0 descriptor?? [ 34.850876][ T759] device pim6reg1 entered promiscuous mode [ 34.896786][ T765] loop5: detected capacity change from 0 to 512 [ 34.932504][ T765] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 34.941865][ T765] ext4 filesystem being mounted at /62/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 34.963375][ T774] overlayfs: upper fs does not support file handles, falling back to index=off. [ 34.972776][ T774] overlayfs: NFS export requires "index=on", falling back to nfs_export=off. [ 34.974642][ T340] EXT4-fs (loop5): unmounting filesystem. [ 35.043030][ T785] loop4: detected capacity change from 0 to 256 [ 35.053300][ T60] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 2 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 35.064560][ T40] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 35.084326][ T40] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 35.098608][ T783] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.105872][ T783] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.153786][ T785] syz.4.196: attempt to access beyond end of device [ 35.153786][ T785] loop4: rw=2049, sector=256, nr_sectors = 4 limit=256 [ 35.297351][ T801] xt_hashlimit: size too large, truncated to 1048576 [ 35.315569][ C0] usblp0: nonzero read bulk status received: -71 [ 35.321623][ T40] usb 4-1: USB disconnect, device number 2 [ 35.323382][ T725] usblp0: error -71 reading from printer [ 35.339846][ T725] usblp0: removed [ 35.347503][ T805] loop5: detected capacity change from 0 to 128 [ 35.363929][ T805] FAT-fs (loop5): error, fat_get_cluster: invalid start cluster (i_pos 550, start 00050006) [ 35.375599][ T805] FAT-fs (loop5): Filesystem has been set read-only [ 35.382745][ T805] FAT-fs (loop5): error, fat_get_cluster: invalid start cluster (i_pos 550, start 00050006) [ 35.394629][ T805] FAT-fs (loop5): error, fat_get_cluster: invalid start cluster (i_pos 550, start 00050006) [ 35.404989][ T805] FAT-fs (loop5): error, fat_get_cluster: invalid start cluster (i_pos 550, start 00050006) [ 35.416918][ T805] FAT-fs (loop5): error, fat_get_cluster: invalid start cluster (i_pos 550, start 00050006) [ 35.427438][ T805] FAT-fs (loop5): error, fat_get_cluster: invalid start cluster (i_pos 550, start 00050006) [ 35.444209][ T805] FAT-fs (loop5): error, fat_get_cluster: invalid start cluster (i_pos 550, start 00050006) [ 35.466251][ T805] FAT-fs (loop5): error, fat_get_cluster: invalid start cluster (i_pos 550, start 00050006) [ 35.488367][ T805] FAT-fs (loop5): error, fat_get_cluster: invalid start cluster (i_pos 550, start 00050006) [ 35.509356][ T805] FAT-fs (loop5): error, fat_get_cluster: invalid start cluster (i_pos 550, start 00050006) [ 35.591852][ T816] loop1: detected capacity change from 0 to 512 [ 35.630187][ T816] EXT4-fs (loop1): Test dummy encryption mode enabled [ 35.646901][ T816] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 35.683682][ T816] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 35.713182][ T816] EXT4-fs warning (device loop1): ext4_expand_extra_isize_ea:2802: Unable to expand inode 11. Delete some EAs or run e2fsck. [ 35.726391][ T816] EXT4-fs (loop1): 1 truncate cleaned up [ 35.732120][ T816] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 35.753296][ T816] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 35.830951][ T823] loop4: detected capacity change from 0 to 512 [ 35.858830][ T288] EXT4-fs (loop1): unmounting filesystem. [ 35.883286][ T823] EXT4-fs error (device loop4): dx_probe:823: inode #2: comm syz.4.210: Directory hole found for htree index block 0 [ 35.899882][ T823] EXT4-fs (loop4): Remounting filesystem read-only [ 35.910950][ T829] loop1: detected capacity change from 0 to 512 [ 35.917301][ T823] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -117 [ 35.930158][ T823] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 35.953085][ T823] EXT4-fs (loop4): shut down requested (2) [ 35.970513][ T829] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 35.986194][ T829] ext4 filesystem being mounted at /30/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 35.988151][ T290] EXT4-fs (loop4): unmounting filesystem. [ 36.060725][ T288] EXT4-fs (loop1): unmounting filesystem. [ 36.166581][ T848] loop3: detected capacity change from 0 to 512 [ 36.210208][ T848] FAT-fs (loop3): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 36.246913][ T848] FAT-fs (loop3): Filesystem has been set read-only [ 36.263859][ T861] syz.3.219: attempt to access beyond end of device [ 36.263859][ T861] loop3: rw=524288, sector=17179852706, nr_sectors = 16 limit=512 [ 36.319322][ T861] syz.3.219: attempt to access beyond end of device [ 36.319322][ T861] loop3: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 36.339928][ C0] ================================================================== [ 36.341027][ T861] syz.3.219: attempt to access beyond end of device [ 36.341027][ T861] loop3: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 36.348062][ C0] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 36.362147][ T861] syz.3.219: attempt to access beyond end of device [ 36.362147][ T861] loop3: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 36.369157][ C0] Read of size 8 at addr ffff88811e200590 by task syz-executor/290 [ 36.383182][ T861] syz.3.219: attempt to access beyond end of device [ 36.383182][ T861] loop3: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 36.390856][ C0] [ 36.390866][ C0] CPU: 0 PID: 290 Comm: syz-executor Tainted: G W syzkaller #0 [ 36.390890][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 36.404861][ T861] syz.3.219: attempt to access beyond end of device [ 36.404861][ T861] loop3: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 36.406960][ C0] Call Trace: [ 36.406973][ C0] [ 36.416226][ T861] syz.3.219: attempt to access beyond end of device [ 36.416226][ T861] loop3: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 36.425986][ C0] __dump_stack+0x21/0x24 [ 36.426015][ C0] dump_stack_lvl+0x110/0x170 [ 36.426032][ C0] ? __cfi_dump_stack_lvl+0x8/0x8 [ 36.426050][ C0] ? debug_smp_processor_id+0x17/0x20 [ 36.426079][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 36.448641][ T861] syz.3.219: attempt to access beyond end of device [ 36.448641][ T861] loop3: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 36.459679][ C0] print_address_description+0x71/0x200 [ 36.459719][ C0] print_report+0x4a/0x60 [ 36.465050][ T861] syz.3.219: attempt to access beyond end of device [ 36.465050][ T861] loop3: rw=0, sector=17179852706, nr_sectors = 8 limit=512 [ 36.468780][ C0] kasan_report+0x122/0x150 [ 36.526094][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 36.531158][ C0] __asan_report_load8_noabort+0x14/0x20 [ 36.536828][ C0] rcu_cblist_dequeue+0x6c/0xb0 [ 36.541712][ C0] rcu_do_batch+0x40d/0xc30 [ 36.546245][ C0] ? __this_cpu_preempt_check+0x13/0x20 [ 36.551826][ C0] ? __raise_softirq_irqoff+0x17/0xd0 [ 36.557232][ C0] ? __cfi_raise_softirq+0x10/0x10 [ 36.562379][ C0] ? rcu_core+0xf00/0xf00 [ 36.566751][ C0] ? _raw_spin_unlock_irqrestore+0x5a/0x80 [ 36.572583][ C0] ? rcu_report_qs_rnp+0x2b9/0x390 [ 36.577738][ C0] rcu_core+0x486/0xf00 [ 36.581931][ C0] ? rcu_cpu_kthread_park+0x90/0x90 [ 36.587165][ C0] ? kvm_sched_clock_read+0x18/0x40 [ 36.592411][ C0] rcu_core_si+0x9/0x10 [ 36.596614][ C0] handle_softirqs+0x1dd/0x5f0 [ 36.601413][ C0] __irq_exit_rcu+0x52/0xf0 [ 36.605959][ C0] irq_exit_rcu+0x9/0x10 [ 36.610233][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 36.615899][ C0] [ 36.618854][ C0] [ 36.621823][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 36.627853][ C0] RIP: 0010:kasan_check_range+0x6d/0x2a0 [ 36.633535][ C0] Code: 89 fe 49 c1 ee 03 49 ba 00 00 00 00 00 fc ff df 4f 8d 1c 16 4c 8d 44 3e ff 4d 89 c1 49 c1 e9 03 4b 8d 1c 29 49 89 dc 4d 29 dc <49> 83 fc 10 7f 29 4d 85 e4 0f 84 45 01 00 00 4c 89 cb 48 f7 d3 4c [ 36.653174][ C0] RSP: 0018:ffffc9000daff678 EFLAGS: 00000202 [ 36.659272][ C0] RAX: ffffffff81aafc01 RBX: fffff9400097b519 RCX: ffffffff81aafff3 [ 36.667278][ C0] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffea0004bda8c0 [ 36.675275][ C0] RBP: ffffc9000daff6a0 R08: ffffea0004bda8c7 R09: 1ffffd400097b518 [ 36.683291][ C0] R10: dffffc0000000000 R11: fffff9400097b518 R12: 0000000000000001 [ 36.691299][ C0] R13: dffffc0000000001 R14: 1ffffd400097b518 R15: 00000000100400fb [ 36.699307][ C0] ? copy_page_range+0x10f1/0x27f0 [ 36.704464][ C0] ? copy_page_range+0x14e3/0x27f0 [ 36.709624][ C0] __kasan_check_read+0x11/0x20 [ 36.714505][ C0] copy_page_range+0x14e3/0x27f0 [ 36.719489][ C0] ? __cfi_copy_page_range+0x10/0x10 [ 36.724815][ C0] ? rwsem_write_trylock+0x136/0x300 [ 36.730138][ C0] copy_mm+0xf90/0x1ad0 [ 36.734330][ C0] ? copy_signal+0x630/0x630 [ 36.738963][ C0] ? _raw_spin_lock+0x94/0xf0 [ 36.743688][ C0] ? __init_rwsem+0x11b/0x1f0 [ 36.748429][ C0] ? copy_signal+0x4eb/0x630 [ 36.753058][ C0] copy_process+0x12d8/0x3500 [ 36.757784][ C0] ? cgroup_rstat_updated+0xf0/0x360 [ 36.763125][ C0] ? idle_dummy+0x10/0x10 [ 36.767493][ C0] ? __count_memcg_events+0x8f/0xe0 [ 36.772727][ C0] kernel_clone+0x22f/0x7f0 [ 36.777269][ C0] ? __kasan_check_write+0x14/0x20 [ 36.782424][ C0] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 36.788013][ C0] ? __cfi_kernel_clone+0x10/0x10 [ 36.793089][ C0] ? recalc_sigpending+0x168/0x1c0 [ 36.798235][ C0] __x64_sys_clone+0x193/0x200 [ 36.803056][ C0] ? __cfi___x64_sys_clone+0x10/0x10 [ 36.808386][ C0] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 36.814657][ C0] x64_sys_call+0x990/0x9a0 [ 36.819198][ C0] do_syscall_64+0x4c/0xa0 [ 36.823644][ C0] ? clear_bhb_loop+0x30/0x80 [ 36.828355][ C0] ? clear_bhb_loop+0x30/0x80 [ 36.833066][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 36.838997][ C0] RIP: 0033:0x7f4846bc8592 [ 36.843444][ C0] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 36.863119][ C0] RSP: 002b:00007ffc614a2470 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 36.871588][ C0] RAX: ffffffffffffffda RBX: 00007ffc614a2470 RCX: 00007f4846bc8592 [ 36.879602][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 36.887614][ C0] RBP: 00007ffc614a25fc R08: 0000000000000000 R09: 0000000000000001 [ 36.895632][ C0] R10: 000055556486e7d0 R11: 0000000000000246 R12: 0000000000000000 [ 36.903642][ C0] R13: 00000000000927c0 R14: 0000000000008dbc R15: 00007ffc614a2650 [ 36.911663][ C0] [ 36.914716][ C0] [ 36.917070][ C0] Allocated by task 839: [ 36.921364][ C0] kasan_set_track+0x4b/0x70 [ 36.926028][ C0] kasan_save_alloc_info+0x1f/0x30 [ 36.931177][ C0] __kasan_kmalloc+0x95/0xb0 [ 36.935810][ C0] __kmalloc+0xb4/0x1e0 [ 36.940003][ C0] l2tp_session_create+0x38/0xbd0 [ 36.945066][ C0] pppol2tp_connect+0xbf5/0x1640 [ 36.950059][ C0] __sys_connect+0x3da/0x460 [ 36.954682][ C0] __x64_sys_connect+0x7a/0x90 [ 36.959495][ C0] x64_sys_call+0x88d/0x9a0 [ 36.964028][ C0] do_syscall_64+0x4c/0xa0 [ 36.968477][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 36.974397][ C0] [ 36.976736][ C0] Freed by task 308: [ 36.980648][ C0] kasan_set_track+0x4b/0x70 [ 36.985275][ C0] kasan_save_free_info+0x2b/0x40 [ 36.990329][ C0] ____kasan_slab_free+0x132/0x180 [ 36.995481][ C0] __kasan_slab_free+0x11/0x20 [ 37.000278][ C0] slab_free_freelist_hook+0xc2/0x190 [ 37.005679][ C0] __kmem_cache_free+0xb7/0x1b0 [ 37.010563][ C0] kfree+0x6f/0xf0 [ 37.014311][ C0] l2tp_session_put+0xaf/0x1a0 [ 37.019106][ C0] l2tp_session_delete+0x3df/0x4d0 [ 37.024248][ C0] l2tp_tunnel_del_work+0x199/0x410 [ 37.029485][ C0] process_one_work+0x717/0xc30 [ 37.034367][ C0] worker_thread+0xa4d/0x11d0 [ 37.039074][ C0] kthread+0x281/0x320 [ 37.043168][ C0] ret_from_fork+0x1f/0x30 [ 37.047615][ C0] [ 37.049965][ C0] Last potentially related work creation: [ 37.055699][ C0] kasan_save_stack+0x3a/0x60 [ 37.060409][ C0] __kasan_record_aux_stack+0xb6/0xc0 [ 37.065821][ C0] kasan_record_aux_stack_noalloc+0xb/0x10 [ 37.071655][ C0] call_rcu+0xcf/0xf50 [ 37.075757][ C0] pppol2tp_release+0x1e3/0x2b0 [ 37.080644][ C0] sock_close+0xc9/0x220 [ 37.084915][ C0] __fput+0x1fd/0x8f0 [ 37.088930][ C0] ____fput+0x15/0x20 [ 37.092939][ C0] task_work_run+0x1e1/0x250 [ 37.097557][ C0] do_exit+0xb0d/0x29f0 [ 37.101747][ C0] __cfi___ia32_sys_exit+0x0/0x10 [ 37.106804][ C0] x64_sys_call+0x67/0x9a0 [ 37.111270][ C0] do_syscall_64+0x4c/0xa0 [ 37.115714][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 37.121656][ C0] [ 37.124008][ C0] The buggy address belongs to the object at ffff88811e200400 [ 37.124008][ C0] which belongs to the cache kmalloc-512 of size 512 [ 37.138089][ C0] The buggy address is located 400 bytes inside of [ 37.138089][ C0] 512-byte region [ffff88811e200400, ffff88811e200600) [ 37.151399][ C0] [ 37.153756][ C0] The buggy address belongs to the physical page: [ 37.160182][ C0] page:ffffea0004788000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11e200 [ 37.170452][ C0] head:ffffea0004788000 order:2 compound_mapcount:0 compound_pincount:0 [ 37.178799][ C0] flags: 0x4000000000010200(slab|head|zone=1) [ 37.184920][ C0] raw: 4000000000010200 ffffea0004772600 dead000000000003 ffff888100042f00 [ 37.193550][ C0] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 37.202248][ C0] page dumped because: kasan: bad access detected [ 37.208690][ C0] page_owner tracks the page as allocated [ 37.214426][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 141, tgid 141 (dhcpcd), ts 7002049555, free_ts 0 [ 37.234184][ C0] post_alloc_hook+0x1f5/0x210 [ 37.238999][ C0] prep_new_page+0x1c/0x110 [ 37.243535][ C0] get_page_from_freelist+0x2ca9/0x2d20 [ 37.249130][ C0] __alloc_pages+0x1fa/0x610 [ 37.253757][ C0] alloc_slab_page+0x6e/0xf0 [ 37.258375][ C0] new_slab+0x98/0x3e0 [ 37.262478][ C0] ___slab_alloc+0x70f/0xb70 [ 37.267106][ C0] __slab_alloc+0x5e/0xa0 [ 37.271473][ C0] __kmem_cache_alloc_node+0x204/0x2d0 [ 37.277099][ C0] __kmalloc_node_track_caller+0xa1/0x1e0 [ 37.282874][ C0] __alloc_skb+0x226/0x4a0 [ 37.287328][ C0] alloc_skb_with_frags+0xa8/0x620 [ 37.292475][ C0] sock_alloc_send_pskb+0x87f/0x9a0 [ 37.297702][ C0] unix_dgram_sendmsg+0x5c1/0x1710 [ 37.302872][ C0] unix_seqpacket_sendmsg+0x118/0x1e0 [ 37.308276][ C0] sock_write_iter+0x2ea/0x3f0 [ 37.313075][ C0] page_owner free stack trace missing [ 37.318469][ C0] [ 37.320818][ C0] Memory state around the buggy address: [ 37.326462][ C0] ffff88811e200480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.334552][ C0] ffff88811e200500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.342646][ C0] >ffff88811e200580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.350726][ C0] ^ [ 37.355333][ C0] ffff88811e200600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.363438][ C0] ffff88811e200680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.371517][ C0] ================================================================== [ 37.379681][ C0] Disabling lock debugging due to kernel taint [ 37.396539][ T872] loop4: detected capacity change from 0 to 512 [ 37.421780][ T872] EXT4-fs warning (device loop4): dx_probe:833: inode #2: comm syz.4.230: Unrecognised inode hash code 255 [ 37.453708][ T872] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.230: Corrupt directory, running e2fsck is recommended [ 37.479812][ T872] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -117 [ 37.488289][ T872] EXT4-fs error (device loop4): ext4_iget_extra_inode:4765: inode #15: comm syz.4.230: corrupted in-inode xattr [ 37.500475][ T872] EXT4-fs error (device loop4): ext4_orphan_get:1410: comm syz.4.230: couldn't read orphan inode 15 (err -117) [ 37.512479][ T872] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 37.535156][ T290] EXT4-fs (loop4): unmounting filesystem. [ 37.539919][ T60] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 37.679800][ T295] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 37.720825][ T60] usb 3-1: config 1 interface 0 altsetting 13 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 37.731759][ T60] usb 3-1: config 1 interface 0 has no altsetting 0 [ 37.740321][ T60] usb 3-1: string descriptor 0 read error: -22 [ 37.746527][ T60] usb 3-1: New USB device found, idVendor=0755, idProduct=2626, bcdDevice= 0.40 [ 37.755636][ T60] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.764683][ T863] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 37.860931][ T295] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 37.872218][ T295] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 37.882049][ T295] usb 6-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 37.891145][ T295] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.900207][ T295] usb 6-1: config 0 descriptor?? [ 38.176428][ T60] aureal 0003:0755:2626.0003: item 0 2 0 9 parsing failed [ 38.183923][ T60] aureal: probe of 0003:0755:2626.0003 failed with error -22 [ 38.308897][ T295] playstation 0003:054C:0DF2.0004: unknown main item tag 0x0 [ 38.316430][ T295] playstation 0003:054C:0DF2.0004: unknown main item tag 0x0 [ 38.323873][ T295] playstation 0003:054C:0DF2.0004: unknown main item tag 0x0 [ 38.331339][ T295] playstation 0003:054C:0DF2.0004: unknown main item tag 0x0 [ 38.338729][ T295] playstation 0003:054C:0DF2.0004: unknown main item tag 0x0 [ 38.346944][ T295] playstation 0003:054C:0DF2.0004: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.5-1/input0 [ 38.380375][ T40] usb 3-1: USB disconnect, device number 4 [ 38.508351][ T295] playstation 0003:054C:0DF2.0004: Invalid byte count transferred, expected 20 got 0 [ 38.518341][ T295] playstation 0003:054C:0DF2.0004: Failed to retrieve DualSense pairing info: -22 [ 38.527643][ T295] playstation 0003:054C:0DF2.0004: Failed to get MAC address from DualSense [ 38.536405][ T295] playstation 0003:054C:0DF2.0004: Failed to create dualsense. [ 38.544722][ T295] playstation: probe of 0003:054C:0DF2.0004 failed with error -22 [ 38.715629][ T60] usb 6-1: USB disconnect, device number 2