last executing test programs: 10.299340682s ago: executing program 5 (id=563): socket$inet_udp(0x2, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x6, 0x0) r1 = syz_usb_connect(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$sierra_net(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80a, &(0x7f00000006c0), 0x3, 0x79d, &(0x7f0000006a80)="$eJzs3c1rXFUbAPDnTpImTfu+zQsv2LppVloonbQ1tgqCERciWCjo2jZMpiFmkimZSWlCFhYRBBG0uBB049qPunMruvZvcCMiLVXTYsWFjNz5SKb5TpqZaZvfD25yzp1z55xn7txzz8w9zA1gzxpM/2QijkTEh0nEofr6JCJ6qqnuiJFauXuLC7l0SaJSef33pFrm7uJCLpq2SR2oZw5HxPfvRhzPrK63NDc/OVoo5Gfq+aHy1OWh0tz8iYmp0fH8eH76zKnh4dNnnz17Zvdi/fPH+YO3Pnrl6a9H/n7niRsf/JDESBysP9Ycx24ZjMH6a9KTvoT3eXm3K+uwpNMNYEfSQ7OrdpTHkTgUXdUUAPA4S8//FQBgj0mc/wFgj2l8D3B3cSHXWDr7jUR73X4pIvpq8Teub9Ye6a5fs+urXgftv5tEd/2KaOzi9a7BiPjs2ze/TJdo0XVIgLW8fS0iLg4Mru7/k1VzFrbr5BbKDK7I6/+gfb5Lxz/PrTX+yyyNf2Jp/LOsd41jdycGI/Y151cf/5mba2744i5UXh//vVCb25YG2jT+W5q0NtBVz/0nzRyNiIlCPu3b/hsRx6Kn99JEIX9qgzqO3fnnznqPNY///rj+1hdp/en/5RKZm929928zNloefZCYm92+FvFk9/Lcvnur+v++6lh35f5P153f6ImPLidfff69T9crlsafxttYVsffWpXPI56KteNvSDacnziU7v6Ttb9r1/HNz5/0r1d/8/5Pl7T+xmeBdkj3f//G8Q8kzfM1S7tb/+bxr/3+35e8UU03Oo+ro+XyzKmIfclrq9efXt62kW+UT+OvRboy/syG7//0k+DFLcbYfeu3r3YYf3Pf2JIplmn8Y9va/9tP3Lg32bXD+Ov7f7iaOlZfs5X+b6sNfJDXDgAAAAAAAAAAAAAAAAAAAAAAAAC2KhMRByPJZJfSmUw2W7uH9/+jP1MolsrHLxVnp8eieq/sgejJNH7q8lAtnzR+/3SgKX96Rf6ZiPhfRHzcu7+az+aKhbFOBw8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdQfWuf9/6tfeTrcOAGiZvsxmJe7k78tWKpVKKxsEALRcX6cbAAC03Qbn//3tbAcA0D4+/wPA3uP8DwB7j/M/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALXb+3Ll0qfy1uJBL82NX5mYni1dOjOVLk9mp2Vw2V5y5nB0vFscL+WyuOLXZ8xWKxcvDMT17daicL5WHSnPzF6aKs9PlCxNTo+P5C/metkQFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANtTmpufHC0U8jOPReL9iHgImtGKRBIPRTM6kvjlxE+HNypzfZO38chDEcUjluh0zwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwaPg3AAD//+jrJa4=") openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x1, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x800704, &(0x7f0000000500), 0xf7, 0x485, &(0x7f0000001040)="$eJzs3M9rHFUcAPDvTJL+bhNrrba2Gq1i8UfSpFV78KCi4EFB0EM9xiSttdtGmgi2BI0i9SgF7+JR8C/w5kXUgwheFTxKoWgQmnqKzK9mu9mkSZpkbfbzgc2+t/Nm3/vOzNt9My+zAbSt3uxPErEjIn6LiO4ie3OB3uJpZnpy+Pr05HASs7Nv/JXk5a5NTw5XRav1tpeZw2lE+mkSzyfz6x2/cPHMUK02er7M90+cfa9//MLFp06fHTo1emr03ODx48eODjz7zODTqxJnFte1/R+OHdj3yluXXxs+cfntH7/JmrX3YLG8Po5but4koCZ6s63292yucdmjy2j7nWBnXTrpbGFDWJaOiMh2V1fe/7ujI+Z2Xne8/ElLGwesqey7afPCi6dmgQ0siVa3AGiN6os+O/+tHus09PhfuPpCxKYyPTM9OTxzI/7OSMvXu9aw/t6IODH175fZI5Z7HQIAYAXysc2TzcZ/aezNn4u5jl3lHEpPRNwVEbsj4u6I2BMR90TkZe+NiPuKlWe7l1h/b0N+/vgnvdK0zaskG/89Vzf2m6mLv3zq6ShzO/P4u5KTp2ujR8ptcji6Nmf5gUXq+O6lXz9faFn9+C97ZPVXY8GyAVc6Gy7QjQxNDK3WRrj6ccT+zmbxJzdmArIjYF9E7F/eW++qEqcf//rAQoVuHf8iVmGeafariMeK/T8VDfFXksXnJ/u3RG30SH91VMz30y+XXl+o/tuKfxVk+3/bzcd/Q4nuf5JivrYrarXR8+PLr+PS758teE6z0uN/U/JmPmf98zvFax8MTUycH4jYlLya56tzuvz1wbl1q3xVPov/8KHm/X93uU4W//0RkR3EByPigYh4sGz7QxHxcEQcWiT+H1585N1F4k8iiZbu/5Gmn383jv+epH6+fgWJjjPff7vQjPnS9v+xmMo/awv5598tLLWBt7n5AAAA4I6QRsSOSNK+It27I9K0r6/4H/49sS2tjY1PPHFy7P1zI8U9Aj3RlVZXurrrrocOJFPlOxb5wfJacbX8aHnd+IuOrXm+b3isNtLi2KHdbb+5/0fV/zN/drS6dcCac78WtK/G/p+2qB3A+lvK979zAdiYmvT/ra1oB7D+nP9D+2rW/z9qyBv/w8Y0v///0eQn64CNyPgf2pf+D+1L/4e2dDv39a88Ud0ssPL32bLkO/zbJVH94sVa1rU15l6JtOUht1Ei6zHrW+ncb6gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADcyf4LAAD///ss5ts=") openat(0xffffffffffffff9c, 0x0, 0x26e1, 0x109) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x7, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="850000009e0000006a0a00ff000000006900a40500000000950000000000000018100000", @ANYRES32, @ANYBLOB="000000000000000005000000000000009500000000"], &(0x7f0000000140)='GPL\x00', 0x2, 0x95, &(0x7f0000000180)=""/149}, 0x94) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000780)={0x44, 0x0, &(0x7f0000000580)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x50, 0x0, &(0x7f00000006c0)="393401b244839cb07f59ec2e8596aa780930dfd0472bfe8ca0388acb08706ab60decffc8cf73e13a39fe50ca58b8fc563c30ff28515e27a6223a1f446cd319d0f777831cd0a73dfd5f07eb682b43bb15"}) 7.622839295s ago: executing program 1 (id=575): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$unix(r2, &(0x7f0000000e00)={&(0x7f0000000180)=@abs={0x0, 0x0, 0x4e22}, 0x6e, 0x0, 0x0, &(0x7f0000000d00)=[@rights={{0x24, 0x1, 0x1, [r1, r2, r1, r1, r2]}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff}}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [r2, r2]}}, @rights={{0x10}}, @cred={{0x1c, 0x1, 0x2, {r0, 0x0, 0xffffffffffffffff}}}, @rights={{0x18, 0x1, 0x1, [r1, r3]}}], 0xc0, 0x20004044}, 0x20000840) chdir(&(0x7f0000000140)='./file0\x00') r4 = open(&(0x7f0000000040)='./bus\x00', 0x4c27e, 0x10) fallocate(r4, 0x0, 0x0, 0x1000f4) sendfile(r4, r4, 0x0, 0x40000000800) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x4d) fallocate(r5, 0x100000000000011, 0x2000, 0x2f93) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x141a42, 0x15) 6.383907385s ago: executing program 5 (id=579): r0 = inotify_init() syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 6.375661304s ago: executing program 1 (id=580): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x0, 0x101400) ioctl$FE_GET_PROPERTY(r0, 0x80106f53, &(0x7f00000002c0)={0x21, &(0x7f0000000380)=[{0x45, '\x00', @st={0x4, [{0x1, @svalue=0x8}, {0x0, @svalue=0x1}, {0x3, @svalue=0x6}, {0x2, @uvalue=0x7}]}, 0xffa}, {0x33, '\x00', @st={0x4, [{0x1, @svalue=0x5}, {0x3, @svalue}, {0x0, @uvalue=0x2d}, {0x2, @svalue=0x8000000000}]}, 0x9}]}) r1 = syz_usb_connect(0x0, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd010203010902"], 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) r2 = socket$kcm(0x23, 0x0, 0x0) listen(r2, 0x800) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, 0x0, 0x240040c4) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r4, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10) pselect6(0x40, &(0x7f0000000080)={0xe, 0x9ab, 0xc, 0x10000000, 0x9, 0x8, 0x4, 0x7ff}, 0x0, 0x0, 0x0, 0x0) 6.280272935s ago: executing program 0 (id=581): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x40) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) 5.930016087s ago: executing program 5 (id=584): r0 = io_uring_setup(0x136a, &(0x7f0000000400)={0x0, 0x1f8a, 0x40, 0x1, 0x100028c}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TCGETA(r1, 0x89f0, &(0x7f00000029c0)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r2, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,,ers=3.0,nodfs\x00') r3 = accept(r2, 0x0, 0x0) sendto$inet(r3, &(0x7f0000002000)="00000080fe534d4240000100000000000000010001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041000100000300000000000000000000000000000000000000000000000010000000100000001000000000000000000000000000000000000000800000000000", 0x84, 0x0, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 5.848623966s ago: executing program 3 (id=585): r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VIDIOC_ENUMOUTPUT(r0, 0xc0485630, &(0x7f0000000400)={0x5, "9271ff495cfd7e9e901c80cff11e3fa465cf8ab2b95f4d461f75cb4dacef26b5", 0x3, 0xec61, 0x8000, 0xffffff, 0x4}) 5.718385197s ago: executing program 3 (id=586): r0 = socket$kcm(0xa, 0x2, 0x73) accept4$vsock_stream(0xffffffffffffffff, &(0x7f00000010c0)={0x28, 0x0, 0x2711}, 0x10, 0x800) sendmsg$inet(r0, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x0, @empty}, 0xffac, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764d8ab49d7dc68e5b0556c9e7ffb6fef442776d86fbd458741830e57f22a1f8513b92abd5b2df93a67cc560134078f0b8ecc3276e40aadef5cd579888b86b4988f396679250701f3869e7493b33692035ecd94aca5189fd0a0893ccc5bb19c0b4caca86cf90ebc2a5558f39cccb33f6773a4e425bf551fb3b6456ee1cc62fa1843a9e5539bb2d02ae6ef82533a9dbcfb562c1ab18c1f639ae7ff02083746f74a15ba2d10e4b955940a5d6f488d326a99f287c48ad463ce40367aeeff519cbad0a2d7fdbfa48bff75955467977764c2be2bd2ffa18396c46920c40c50a4037003666406d177e2cd20aee423d07169d8f611f635ba0b62b61265ff2c5548446a2423dd1038482b6852b2d9d2f90aa05d82c5e2c3d1af0c7aad72d82b3da67471af7b037bb0424a785e73f35b5a10a2ab300a195c20cd119a5390e0cd5d49c70bd80883b933e843d0d2902749dcf3c140c708a0f004b7a2f50bf311305dc01719016fcce5863815ca7951de710fcb71cd177551ff6fcd9f8bf01b93868f24c6129b6d7917125338cf62110083093fc7f862015d48450d992f2bb43e601cab19b2ea7b83962a382fc2a31fdf2358bf8a9a9e506eaa7b6eb5e7444d1ef459b24ffa51362abce902dfd84201a0e4b5a3b62757aad54fb65b83821c6bba663886de092065a565921ea3eb6781bb8ed4f4db3abcfeeb379b7e52fca790bea719918e299ab01bf5e92177d134360bf7a16a59e9d03d3dcfb0a25599237e3d41b3f0026c9402b1fb1894426303413a2cbcf7c72807ca694afa285990d07c3bca26413c9947b3b344aafc04544b8c11416e0312b028da7302e316c3966d41884b15055a49a4a0b3eac8e11f88a5615fb0af582f065d28e5a454447e9d0cfc60356439ebf7e1d0a00f5b9cc6daf2bd7195ba96b4d1a0679ff0fb1c01282c378a880f90f460889b67d76d4d0e8db6c928d113533d1d10b810303c43d8ff622c5bab7f095b96e64bf9daa48a2bdf3d9d40bac00cf1b66df61a4f7c3e21938e876f81b1179dce6a008f28eb682cae690ced0ea0d542da604d8056f2b1813ed36683c4c51aeb2650772cfb1c55d4e60604ff06344cfc271b2175a6c94defb807af240b483e24298ca73bfc743ca2ca2e77e6d5b817b3c1986601537faf59ac84c74d8bd0c068cb8e6bd03ac2dcf5793fb4a00b3c901a33aa3ee86e4f0db317b94bb8678ab26e36d305ebac4b0f7f164947148255b562dd0f87648499d45bccfb7d8c9d5624cadf8160a396e79fbcdc100058ba4606e41c02fb2cc0dc6c36196bd28acfde82a18cda2321d2d83fecd3b85380667cd1d0bc68298c6c8f10421a80c8fa86912b6c3e8ddd9d9668520d5151409e6b77f0d7730b374a68a744151bfbd123cfdf871e8c24e70d2ca3b50e84a48e0b78c1781000cfc848d43584985763a76c0ab9ba882c55e3e4aa8f2174255db38adb8350b48a77be22a869d13d183325f859b883464e5e46de5ea8a92532b9a794daaeff657cd361f7f158f8bebe36e9de1f5b9721d4263dcc9472229bc02d3f552180abfb25ca7aa36cb914d99c09fd5bb99dcab9b4e3c634d18fc7dfe84dc4425ad1e39c3e7410d49b4ea0a8a2958688c7725822f6dfc0827d19dc385e0e35a949941e4dd1aaeaab9ebe402f8c584bca7efc829f2ccfb63fd7bde1c182a67c14f9d3f033ca674e2604e89cd55a15419f956cd61a755c1b13554dae98e77be078aadfc131c9677381f1dbe6ef194eb17603a463e8b844ab46a6046e1f07d96d66de669359bff4c3d80948a4de3abb2f171a09b5d8999c379fb62244114e218c79805df7d899e5661320ee6721d652b95f09e4dfe69bd67099c73294b17ab574e0b966aa3ab44478965b9dca3cb3b9282945f24ccdd07c638ae25a84a728ca24f87ff49d718121a694be46f3616e27b1041b3c6cd24b9cf775bfc28dfbe0a009048f0599f2d5d6586cfd1e7f7fe69872d08b98f60d28e6af0d49d7f06ad71a7b5c41df261aba5de114022c7288bc265cc17909fdeadc3d7b256d7ab3b96e40f857060f16b54a6bb7248ee571f87ace5ee39eab412706cf52fa711468b21ea129c3f44bceb429fcc1a0ac2aa87b9365077dcfcfa9a1b32a0a09699197c20019a66cbd0a897feab3706c23123b888ada643d4560082033e31596b0483578968e3c9593ebd97141c228a42fc7645f92171c120aabca36657683fd7c72fcb87217f124d6fabc52f1d221d8410b47b0ad4bd944bf4085365e9b52a53911ab4ee142c5a1ebbe034c9d98c538c066f2dc0acf372eb2397dcac765055123e0ba19be22b18c886bf0f7490abe9fde91ffa62e059962bd134be8501cb5b715a744b1398e2c4c7e8afe72e189dda0654296afa1c1f99ab7d800fa40f72a758625c833b6fc7b7d42250522b456e1e7de815350c36c9cb2f4d1c9cb99109f89b456c559463f11b8b58247809b17a4ed4912bd0a47a529f1364d6dc593ea7f3eb98962078ac90e5012ee1c7b4b9ed5a8c7a9c0231b4ce425693faab64fa0f3482a04d4be2e06ee5d103694d288810a1a7f4d1e908dd82dd2016a064ece5cd67ef1dd5f4cda728fc6f1ccdd949dd8f775d862621507248ef4c83ae274969d19c7ddb02a4e8a1ab2b7aa539a442b22735ceedeefe60a1059dfaaa0979ce8d5387b5a047841fd9749b88ca91216b02d7926408a01916b7781bb7167528ccdb9a486d173437a5ba3e552c8674dff2cc9b21054e0e4f86b61b8723fca58ceef4413bffae9e9be79c5b9788f5449811ce78be9bc7a86375a670197baaef751beabcba0aa6c7c33f1cd702cb78ec39fa1f17d9da733d6abf2b80f9c51ac8f6f664b24edc53a7c9525c3016bd05c67272375fe816b2b121f2de68b885a0fd8f8b8c6c342237b632f6414a3eb3480f5f42106c5812e9bfd4e8c8dea8d08525d9aa1da7c7c2ee7ff3d31b79b211dd01e304a8ffc83a89a59f3b1e2ef5e969b6d90bea7e161066f25622fad914bff52bacd2807093dda1838b529ee57f718b374ce2841b924a42457867547a6edcb8412d85f11796742bf640b5819a9546357df778c332af5983c4373a95d9c58b52dba445eee92e6911824f0c534e7a5934d9eac9b7f6fec22002fc53a3003a3304217f567b47cd326edc5f48eb1f46bb20d1e10e72239afc9769344590cf48902aba5405b7d4baa31a912ab398a2f2d3f037614bb56a89244ece50f3a1e058d274f1e70f944eb8a305be91e561e5eb843d057a81f4deb84a6335ec81ca964cdae5f318d4e9aaea2c477cc279c00c698bcfe4b8e04c09079d8f3f5438d9d45a00f50d2f9b245c8c68eebf247e25ba8d26f8b95b21ac9ceb50c0aa2e4bdc032024db216b92f9350a90ac79341af14d3fa8ba908096e1b503341aed667bb184c672dac85fc4f335b3871c3b4e55ea219a857d2d2e135358f6b45a20b3e7de8e09b2041eb7c5084a80258fb524a983752659298a251e178b56f96bc67ae0a78ec92f92d92c9cf0edb5dcb11e739d69410ad44c8df00caa030d7d89f2ec38bd7698115c423cf3e6048793aca08ffbcdac766f1553773fa00031c1d75246e4e1eddf8948d02a3de6d67fd7329e45070f29044587f1e0db50d04e673191a63e30f96ee0d8d52738fab36a7fe2c6ab9301d401e7ca5b1f039193a580e40abbdf40c2d7e27809dec80815d37adae9fe7fb9d3a974c9fc03944d7338d000b81170be4c6792ed6b3b827194b3ae11e2acfca48498d1126aacf80f3d574256ef7f75552ff087a819e", 0x1000}, {&(0x7f0000001040)="9d7fcf3efc63f4a6a555ba8b4726d7ccaf8a207100e69cfac4377876021d7131b838059f96bd206d4776368ed2a92432e5af71", 0x33}], 0x8, &(0x7f00000011c0)=ANY=[@ANYBLOB="1400000000000000010000002500000002010000000000004800000000000000080000000700000010000034366567f2219787566400007300000000000000000000000008000000ef3820f3439cb150a3651e799e1459c9c9a7521737a8879e3ef4dca1e3c32158996e4b2abde5342e22f2ba8b679121ac0b0ad62ade31fb2c47f0bbf781eb8bd1e3064141e90e9eac25b189c0da98b676571bbeefba392c3e15a10e03dee4ae1dfe99793e51ec0c6bb5fa6d7b357d249502f5919ef251e5d0e5bed378265b8bd55fde4689cb509b14fa754813a27e72d175e8d677420e10d651833e6e2ab8168b1d633b1bb9a7d4d59ebdc7083d93d35cd469de", @ANYRES32=0x0, @ANYBLOB="e1212f0409000000e70bcf35ac837225dd355ad309a5ec6096633ba38e1ef5baf006020e5f45c993cb5680017c6720bea9b7c451516a8cff7f00000000000019f20b784b2336d43c8a0f7347801a596dfb0b078a967980ccec1d115c7a0000000000000000000000fed6260fdf140498f1274bc569d0d87656d0d18d903580f0ec0915e89bd286b2c25165043f6a001d53f84eaabf01cc310ff28c7c76867ce1a2c9c91b1db7295614e2a4f8711ec37ae999180cb5bbb9c5382120076e117539d423a2ec0f468db35960831f5f884c1fa9f46b3472327697495b8e8ba8e2f3defbe93e1fc733b06dfc74890a3f63b154e9681d69cdd9894c914ee45c286462888ff84e401a6d8895ffda88a171b7359f815d7b6f7562fba1bbff4cba08f7a39a8e88b66a4717b3c318f85aecbe8b5f3485f8d31bf5a57b9dd53b382ec017a33d1fabe09daf76b3b0"], 0x6b}, 0x0) 5.523737236s ago: executing program 5 (id=589): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r0, &(0x7f00000006c0), &(0x7f0000000000)=""/3, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000400)={r0, &(0x7f0000000380), 0x0}, 0x20) 5.418331082s ago: executing program 3 (id=590): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000"], 0x48) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, 0x0) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0xf0ff, 0x0) write(0xffffffffffffffff, &(0x7f00000005c0), 0x0) write(0xffffffffffffffff, &(0x7f0000000300)='1', 0x1) write(0xffffffffffffffff, &(0x7f0000000300)='1', 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xc, 0x1c, &(0x7f0000000b40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0x17}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x100}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_mount_image$erofs(&(0x7f00000001c0), &(0x7f0000000200)='./file2\x00', 0x0, &(0x7f0000000000)=ANY=[], 0x1, 0x1f8, &(0x7f0000001300)="$eJzslc2K01AUx/83SZPWETfuZuPCAceFaZL6tRkYN64EBT8GdxYnLdXUSpuFLaj4BC5du3DjK4hQtz6EVEFURDfq+srNvUluqyltbSky5wc9+d+Pnpx7TnICgiAOLB/e/xrxnzufygAOYwuOmv9sCltKtKHtf1f+/vDNpYt7T60Xb52RWxn35sx9fwvA8IKJWI0551xf31LXazAyfR0GTiq9BwZX6VswcEPpEAw3lb6j6U5JiSh0b3ei/UYrCj1hfGECYWqT8X17wrCvxce09V5/cLceRWF3ZcIuyNzwaxZfGdjR4tPr5UJG62n5848AvtI1MFxV+jwcuK6bp0Q7/6aV+zennt/G/Ifc0Gc+JtVJZxoTm03MmcfSlD0it4sVBmB/r/2r1T4NiwgbYzN4mS+Zcimt6NpDXbqANX7Sf3DIHRPLj/Ccs4Qm8npX1i8L9bEcd3uPNp9dTt/Tzsb0Ku/O9vzMmvmsf/LnDCe0/vRFa2nVuH2/2usPTrXa9WbYDO8FQe2sd9rzzgTVpBFJW9ADhf9K0p8OSdeCStFem9l4UI/jri9tNg6kzQ+Q/8dI+p+B7ePyY8hw9Mqk3x8A0psy9TOSq1DbZmHwBEEQa+QYWNY4rVSor4lasDnnwR9NjyAIgiAIgiAIgiCI/4bfAQAA//+Tt1f4") openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2000, 0x1e1) syz_mount_image$vfat(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x10842, &(0x7f00000001c0)=ANY=[@ANYBLOB='iocharset=utf8,shortname=winnt,shortname=win95,uni_xlate=1,shortname=winnt,shortname=winnt,uid=', @ANYRESHEX=0x0, @ANYBLOB="2c73686f72746e616d653d77696e6e742c000000000000009e5fcf6469722c73687865d2068a008e48488cc8642c6e66733d6e6f73"], 0x1, 0x28a, &(0x7f00000002c0)="$eJzs3U9rY1UYB+A3TWrSgiQLoSiCV9y4Km3FfYpUEAOKkoWuLDZFaWqhhUK7aLsrfgf9Crp0K7gQt34BEaQOzGY6qw4MZMjcJE2aNJN0Js3QeZ5NX855fz3n3l7SP9CTb97e3trY2ds8Pz+LQiETuXKU4yITpZiJbKROAgC4Sy4ajXjQSE17LwDA7ej7/v/IjwEAcNcN+/0/c9IZ+/z2dwYATMpz/f1/ZiJbAgAm7Muvvv50tVJZ+yJJChHbp/vV/Wr6MZ1f3Yzvox61WIpiPI5odKT1x59U1paSpv9LUdg+nknzx/vVbG9+OYpRGpxfTlJRbeba+dmYb+X/mY9arEQx3hicXxmYfy3ef69r/cUoxt/fxk7UYyOa2TSfj4ij5ST56LPKlXz+aR8AAAAAAAAAAAAAAAAAAAAAAEzCYtJR6j3/Jj2/Z7HTkIt0vD2f5rvPB5obdj5Q4/jK+Tq5eCs33WsHAAAAAAAAAAAAAAAAAACAl8XeweHWer1e2x1W/PDXL3+c5dPAlansOJ/n4HAr0+ofqblTnA7tmRt59e7i9Xf/+2nQVD7y496fviIfIzTPRkT3SNJa8vd3brborRZ/nn335gd7Cx9e1xO57pEfm5fa09P3IKVF7oY3/JnF/WJE78hs63bX67XC2A9kd/Fruyg/7OtpP0q13blpf+EWfi6v/3b0771RU0NeNBrZF/kSBAAAAAAAAAAAAAAAAAAAtFz+0++0dwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA03P5/v/jFvnoGSlc25w5mfZFAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwynsSAAD//yNhjt0=") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000009840)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) 5.113098629s ago: executing program 5 (id=591): socket$inet_udp(0x2, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x6, 0x0) r1 = syz_usb_connect(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$sierra_net(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80a, &(0x7f00000006c0), 0x3, 0x79d, &(0x7f0000006a80)="$eJzs3c1rXFUbAPDnTpImTfu+zQsv2LppVloonbQ1tgqCERciWCjo2jZMpiFmkimZSWlCFhYRBBG0uBB049qPunMruvZvcCMiLVXTYsWFjNz5SKb5TpqZaZvfD25yzp1z55xn7txzz8w9zA1gzxpM/2QijkTEh0nEofr6JCJ6qqnuiJFauXuLC7l0SaJSef33pFrm7uJCLpq2SR2oZw5HxPfvRhzPrK63NDc/OVoo5Gfq+aHy1OWh0tz8iYmp0fH8eH76zKnh4dNnnz17Zvdi/fPH+YO3Pnrl6a9H/n7niRsf/JDESBysP9Ycx24ZjMH6a9KTvoT3eXm3K+uwpNMNYEfSQ7OrdpTHkTgUXdUUAPA4S8//FQBgj0mc/wFgj2l8D3B3cSHXWDr7jUR73X4pIvpq8Teub9Ye6a5fs+urXgftv5tEd/2KaOzi9a7BiPjs2ze/TJdo0XVIgLW8fS0iLg4Mru7/k1VzFrbr5BbKDK7I6/+gfb5Lxz/PrTX+yyyNf2Jp/LOsd41jdycGI/Y151cf/5mba2744i5UXh//vVCb25YG2jT+W5q0NtBVz/0nzRyNiIlCPu3b/hsRx6Kn99JEIX9qgzqO3fnnznqPNY///rj+1hdp/en/5RKZm929928zNloefZCYm92+FvFk9/Lcvnur+v++6lh35f5P153f6ImPLidfff69T9crlsafxttYVsffWpXPI56KteNvSDacnziU7v6Ttb9r1/HNz5/0r1d/8/5Pl7T+xmeBdkj3f//G8Q8kzfM1S7tb/+bxr/3+35e8UU03Oo+ro+XyzKmIfclrq9efXt62kW+UT+OvRboy/syG7//0k+DFLcbYfeu3r3YYf3Pf2JIplmn8Y9va/9tP3Lg32bXD+Ov7f7iaOlZfs5X+b6sNfJDXDgAAAAAAAAAAAAAAAAAAAAAAAAC2KhMRByPJZJfSmUw2W7uH9/+jP1MolsrHLxVnp8eieq/sgejJNH7q8lAtnzR+/3SgKX96Rf6ZiPhfRHzcu7+az+aKhbFOBw8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdQfWuf9/6tfeTrcOAGiZvsxmJe7k78tWKpVKKxsEALRcX6cbAAC03Qbn//3tbAcA0D4+/wPA3uP8DwB7j/M/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALXb+3Ll0qfy1uJBL82NX5mYni1dOjOVLk9mp2Vw2V5y5nB0vFscL+WyuOLXZ8xWKxcvDMT17daicL5WHSnPzF6aKs9PlCxNTo+P5C/metkQFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANtTmpufHC0U8jOPReL9iHgImtGKRBIPRTM6kvjlxE+HNypzfZO38chDEcUjluh0zwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwaPg3AAD//+jrJa4=") openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x1, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x800704, &(0x7f0000000500), 0xf7, 0x485, &(0x7f0000001040)="$eJzs3M9rHFUcAPDvTJL+bhNrrba2Gq1i8UfSpFV78KCi4EFB0EM9xiSttdtGmgi2BI0i9SgF7+JR8C/w5kXUgwheFTxKoWgQmnqKzK9mu9mkSZpkbfbzgc2+t/Nm3/vOzNt9My+zAbSt3uxPErEjIn6LiO4ie3OB3uJpZnpy+Pr05HASs7Nv/JXk5a5NTw5XRav1tpeZw2lE+mkSzyfz6x2/cPHMUK02er7M90+cfa9//MLFp06fHTo1emr03ODx48eODjz7zODTqxJnFte1/R+OHdj3yluXXxs+cfntH7/JmrX3YLG8Po5but4koCZ6s63292yucdmjy2j7nWBnXTrpbGFDWJaOiMh2V1fe/7ujI+Z2Xne8/ElLGwesqey7afPCi6dmgQ0siVa3AGiN6os+O/+tHus09PhfuPpCxKYyPTM9OTxzI/7OSMvXu9aw/t6IODH175fZI5Z7HQIAYAXysc2TzcZ/aezNn4u5jl3lHEpPRNwVEbsj4u6I2BMR90TkZe+NiPuKlWe7l1h/b0N+/vgnvdK0zaskG/89Vzf2m6mLv3zq6ShzO/P4u5KTp2ujR8ptcji6Nmf5gUXq+O6lXz9faFn9+C97ZPVXY8GyAVc6Gy7QjQxNDK3WRrj6ccT+zmbxJzdmArIjYF9E7F/eW++qEqcf//rAQoVuHf8iVmGeafariMeK/T8VDfFXksXnJ/u3RG30SH91VMz30y+XXl+o/tuKfxVk+3/bzcd/Q4nuf5JivrYrarXR8+PLr+PS758teE6z0uN/U/JmPmf98zvFax8MTUycH4jYlLya56tzuvz1wbl1q3xVPov/8KHm/X93uU4W//0RkR3EByPigYh4sGz7QxHxcEQcWiT+H1585N1F4k8iiZbu/5Gmn383jv+epH6+fgWJjjPff7vQjPnS9v+xmMo/awv5598tLLWBt7n5AAAA4I6QRsSOSNK+It27I9K0r6/4H/49sS2tjY1PPHFy7P1zI8U9Aj3RlVZXurrrrocOJFPlOxb5wfJacbX8aHnd+IuOrXm+b3isNtLi2KHdbb+5/0fV/zN/drS6dcCac78WtK/G/p+2qB3A+lvK979zAdiYmvT/ra1oB7D+nP9D+2rW/z9qyBv/w8Y0v///0eQn64CNyPgf2pf+D+1L/4e2dDv39a88Ud0ssPL32bLkO/zbJVH94sVa1rU15l6JtOUht1Ei6zHrW+ncb6gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADcyf4LAAD///ss5ts=") openat(0xffffffffffffff9c, 0x0, 0x26e1, 0x109) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x7, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="850000009e0000006a0a00ff000000006900a40500000000950000000000000018100000", @ANYRES32, @ANYBLOB="000000000000000005000000000000009500000000"], &(0x7f0000000140)='GPL\x00', 0x2, 0x95, &(0x7f0000000180)=""/149}, 0x94) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000780)={0x44, 0x0, &(0x7f0000000580)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x50, 0x0, &(0x7f00000006c0)="393401b244839cb07f59ec2e8596aa780930dfd0472bfe8ca0388acb08706ab60decffc8cf73e13a39fe50ca58b8fc563c30ff28515e27a6223a1f446cd319d0f777831cd0a73dfd5f07eb682b43bb15"}) 5.084928992s ago: executing program 4 (id=592): symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0xa14000, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file7\x00', 0x1c0) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0) 4.807231133s ago: executing program 0 (id=593): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000005c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000e00)=[@increfs], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 4.260475458s ago: executing program 3 (id=594): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc3c0000000c0a01010000000f000000000a0000060900020073797a31000000000900010073797a3100000000100003800c000080080003400000000214000000110001"], 0xa0}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a480000000e0a050000000000000000000a0000050900010073797a31000000001c0003cdce2aef9e42ebcd40000000020c00008008000340000000020900020073797a3100000000140000001100010000"], 0x70}, 0x1, 0x0, 0x0, 0x8080}, 0x24008040) 4.100976275s ago: executing program 4 (id=596): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) 3.657417614s ago: executing program 0 (id=598): r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f0000000080)) 3.649732678s ago: executing program 3 (id=599): socket$igmp(0x2, 0x3, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004051045f500001010203020902350001020080300904000005ff0000000705810200020007050102000200070582020002000705020200020007058303"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/ttyUSB0\x00', 0x2043, 0x20) 3.607656385s ago: executing program 4 (id=600): creat(&(0x7f0000000000)='./file0\x00', 0x78) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) 3.607387845s ago: executing program 2 (id=601): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000500), r0) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000540)={0x1c, r1, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc0c0}, 0x4000000) 3.031606069s ago: executing program 1 (id=602): openat$sndseq(0xffffffffffffff9c, 0x0, 0xc8d04) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x6) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0xb, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000070000100000000008"], &(0x7f0000000240)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in6=@dev, 0x0, 0x1, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private, 0x0, 0x33}, 0x0, @in6=@remote, 0x0, 0x3, 0x1, 0x7}}, 0xe8) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x2, 0x6, 0x2, 0x0, 0x2, 0x0, 0x2}, 0x10}}, 0x0) 2.970466465s ago: executing program 0 (id=603): mount$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0) chdir(0x0) socket(0x40000000015, 0x5, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, 0x0) syz_emit_vhci(&(0x7f0000000340)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0xc}, @l2cap_cid_le_signaling={{0x8}, @l2cap_disconn_req={{0x6, 0x4, 0x4}, {0xd11, 0x3}}}}, 0x11) socket$phonet_pipe(0x23, 0x5, 0x2) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$tcp_congestion(0xffffffffffffff9c, 0x0, 0x35c, 0x0) readv(r0, &(0x7f0000000400)=[{&(0x7f0000000580)=""/117, 0x75}], 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f00000002c0)={0x3fc, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) symlink(0x0, 0x0) 2.970233905s ago: executing program 4 (id=604): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x5001}) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000200)=0xc) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000600)={'syzkaller1\x00', 0x41}) write$tun(r0, 0x0, 0x64) 2.970028591s ago: executing program 2 (id=605): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) unshare(0x22020400) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x40100) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0xc133d48dca3af359, 0x401d031, 0xffffffffffffffff, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$XFS_IOC_FSINUMBERS(0xffffffffffffffff, 0xc0205867, 0x0) getsockopt$inet_int(r1, 0x0, 0x22, 0x0, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x0, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x129a02, 0x0) sendfile(r3, r2, &(0x7f0000000080)=0xb, 0x8) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x5422) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) gettid() timer_settime(0x0, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x6a, 0x4) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) 2.696556201s ago: executing program 2 (id=606): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x30, r1, 0x1, 0x70bd2b, 0x1010, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_TIMEOUT={0xc}]}, 0x30}}, 0xb55f51f335625f92) 2.68228423s ago: executing program 1 (id=607): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000"], 0x48) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, 0x0) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0xf0ff, 0x0) write(0xffffffffffffffff, &(0x7f00000005c0), 0x0) write(0xffffffffffffffff, &(0x7f0000000300)='1', 0x1) write(0xffffffffffffffff, &(0x7f0000000300)='1', 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xc, 0x1c, &(0x7f0000000b40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0x17}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x100}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_mount_image$erofs(&(0x7f00000001c0), &(0x7f0000000200)='./file2\x00', 0x0, &(0x7f0000000000)=ANY=[], 0x1, 0x1f8, &(0x7f0000001300)="$eJzslc2K01AUx/83SZPWETfuZuPCAceFaZL6tRkYN64EBT8GdxYnLdXUSpuFLaj4BC5du3DjK4hQtz6EVEFURDfq+srNvUluqyltbSky5wc9+d+Pnpx7TnICgiAOLB/e/xrxnzufygAOYwuOmv9sCltKtKHtf1f+/vDNpYt7T60Xb52RWxn35sx9fwvA8IKJWI0551xf31LXazAyfR0GTiq9BwZX6VswcEPpEAw3lb6j6U5JiSh0b3ei/UYrCj1hfGECYWqT8X17wrCvxce09V5/cLceRWF3ZcIuyNzwaxZfGdjR4tPr5UJG62n5848AvtI1MFxV+jwcuK6bp0Q7/6aV+zennt/G/Ifc0Gc+JtVJZxoTm03MmcfSlD0it4sVBmB/r/2r1T4NiwgbYzN4mS+Zcimt6NpDXbqANX7Sf3DIHRPLj/Ccs4Qm8npX1i8L9bEcd3uPNp9dTt/Tzsb0Ku/O9vzMmvmsf/LnDCe0/vRFa2nVuH2/2usPTrXa9WbYDO8FQe2sd9rzzgTVpBFJW9ADhf9K0p8OSdeCStFem9l4UI/jri9tNg6kzQ+Q/8dI+p+B7ePyY8hw9Mqk3x8A0psy9TOSq1DbZmHwBEEQa+QYWNY4rVSor4lasDnnwR9NjyAIgiAIgiAIgiCI/4bfAQAA//+Tt1f4") openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2000, 0x1e1) syz_mount_image$vfat(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x10842, &(0x7f00000001c0)=ANY=[@ANYBLOB='iocharset=utf8,shortname=winnt,shortname=win95,uni_xlate=1,shortname=winnt,shortname=winnt,uid=', @ANYRESHEX=0x0, @ANYBLOB="2c73686f72746e616d653d77696e6e742c000000000000009e5fcf6469722c73687865d2068a008e48488cc8642c6e66733d6e6f73"], 0x1, 0x28a, &(0x7f00000002c0)="$eJzs3U9rY1UYB+A3TWrSgiQLoSiCV9y4Km3FfYpUEAOKkoWuLDZFaWqhhUK7aLsrfgf9Crp0K7gQt34BEaQOzGY6qw4MZMjcJE2aNJN0Js3QeZ5NX855fz3n3l7SP9CTb97e3trY2ds8Pz+LQiETuXKU4yITpZiJbKROAgC4Sy4ajXjQSE17LwDA7ej7/v/IjwEAcNcN+/0/c9IZ+/z2dwYATMpz/f1/ZiJbAgAm7Muvvv50tVJZ+yJJChHbp/vV/Wr6MZ1f3Yzvox61WIpiPI5odKT1x59U1paSpv9LUdg+nknzx/vVbG9+OYpRGpxfTlJRbeba+dmYb+X/mY9arEQx3hicXxmYfy3ef69r/cUoxt/fxk7UYyOa2TSfj4ij5ST56LPKlXz+aR8AAAAAAAAAAAAAAAAAAAAAAEzCYtJR6j3/Jj2/Z7HTkIt0vD2f5rvPB5obdj5Q4/jK+Tq5eCs33WsHAAAAAAAAAAAAAAAAAACAl8XeweHWer1e2x1W/PDXL3+c5dPAlansOJ/n4HAr0+ofqblTnA7tmRt59e7i9Xf/+2nQVD7y496fviIfIzTPRkT3SNJa8vd3brborRZ/nn335gd7Cx9e1xO57pEfm5fa09P3IKVF7oY3/JnF/WJE78hs63bX67XC2A9kd/Fruyg/7OtpP0q13blpf+EWfi6v/3b0771RU0NeNBrZF/kSBAAAAAAAAAAAAAAAAAAAtFz+0++0dwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA03P5/v/jFvnoGSlc25w5mfZFAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwynsSAAD//yNhjt0=") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000009840)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) 2.490533277s ago: executing program 2 (id=608): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1002}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x20, 0x1, {{0x0, 0x0, 0x2}}}]}}}]}]}}]}, 0x8c}}, 0x0) write$tun(r0, &(0x7f0000000140)={@void, @val={0x3, 0x4, 0xb, 0x6, 0x2, 0x4}, @x25={0x3, 0x7, 0xff, "579dbb"}}, 0x9dd7) 1.43195568s ago: executing program 1 (id=609): symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0xa14000, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file7\x00', 0x1c0) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0) 1.431716893s ago: executing program 4 (id=610): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$unix(r2, &(0x7f0000000e00)={&(0x7f0000000180)=@abs={0x0, 0x0, 0x4e22}, 0x6e, 0x0, 0x0, &(0x7f0000000d00)=[@rights={{0x24, 0x1, 0x1, [r1, r2, r1, r1, r2]}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff}}}, @rights={{0x14, 0x1, 0x1, [r2]}}, @rights={{0x18, 0x1, 0x1, [r2, r2]}}, @rights={{0x10}}, @cred={{0x1c, 0x1, 0x2, {r0, 0x0, 0xffffffffffffffff}}}, @rights={{0x18, 0x1, 0x1, [r1, r3]}}], 0xc0, 0x20004044}, 0x20000840) chdir(&(0x7f0000000140)='./file0\x00') r4 = open(&(0x7f0000000040)='./bus\x00', 0x4c27e, 0x10) fallocate(r4, 0x0, 0x0, 0x1000f4) sendfile(r4, r4, 0x0, 0x40000000800) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x4d) fallocate(r5, 0x100000000000011, 0x2000, 0x2f93) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x141a42, 0x15) 1.350301904s ago: executing program 0 (id=611): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000005c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000e00)=[@increfs], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.207164438s ago: executing program 2 (id=612): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc3c0000000c0a01010000000f000000000a0000060900020073797a31000000000900010073797a3100000000100003800c000080080003400000000214000000110001"], 0xa0}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a480000000e0a050000000000000000000a0000050900010073797a31000000001c0003cdce2aef9e42ebcd40000000020c00008008000340000000020900020073797a3100000000140000001100010000"], 0x70}, 0x1, 0x0, 0x0, 0x8080}, 0x24008040) 1.206853308s ago: executing program 3 (id=613): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000840)=@newtfilter={0x87c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x84c, 0x2, [@TCA_BASIC_POLICE={0x848, 0x4, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x5, 0x0, 0x2, 0x3ff, 0xd, 0xffffff81, 0xc0, 0x1, 0x2fa, 0x6, 0x4, 0x2, 0x8, 0x1ff, 0x1a7, 0xce, 0x6, 0x4, 0x7, 0x1, 0x7, 0x0, 0x8, 0x8001, 0x8001, 0x2, 0x7, 0x3, 0x8, 0x1, 0x66, 0x10000, 0x0, 0x8, 0xa3, 0x0, 0x0, 0x1, 0x0, 0xd1c8, 0x88c9, 0x1000, 0x7, 0x800, 0x8007, 0xc76, 0xdd, 0x386, 0x101, 0x5, 0xfd, 0x21, 0x66b6, 0xd4, 0x9, 0x8, 0x933, 0x10000, 0x0, 0x7, 0x7, 0x3fd, 0x8, 0x7, 0x66c53844, 0xb7, 0x5, 0x9140, 0x7fffffff, 0x401, 0x7, 0x7, 0x8, 0x9, 0xfffffffe, 0x5, 0x63, 0x9, 0x4, 0xffffff6a, 0x4, 0x401, 0x2, 0x5, 0x800, 0x8, 0x10001, 0x7, 0x6, 0x3, 0x5, 0x81, 0x3b932d, 0x8000, 0x4, 0x44c0, 0x8001, 0x5, 0x8, 0xa2e, 0xd, 0x3c8b, 0x3, 0x8001, 0x2, 0x40, 0x0, 0x0, 0x2, 0x101, 0x3ff, 0x2, 0x6, 0x7f, 0x37d8, 0x8, 0xd, 0x8, 0x3, 0x4, 0x40, 0x1, 0x22af662d, 0x7, 0x5, 0x387, 0x400, 0x81, 0x0, 0xffff, 0xa5e, 0x7ff, 0x8, 0x4, 0xf1, 0xffff, 0xa849, 0x2, 0x0, 0x400, 0x1ff, 0x6c, 0x0, 0x7b, 0x400, 0xd33c, 0x8, 0x56, 0x3, 0x800, 0x7, 0x6, 0x2, 0x4, 0x1, 0x1, 0x7, 0x7, 0x4, 0xaee, 0x5, 0x8, 0xef19, 0x7, 0x2, 0x7f, 0x5, 0x7, 0x800, 0xfff, 0x6, 0x4, 0x800, 0x800, 0x4, 0xffffffff, 0x4338, 0xb, 0x7, 0xea, 0x8, 0xffff33fd, 0x80000, 0x8000, 0xa, 0x9, 0x0, 0x8, 0x30aa0000, 0x7, 0x6, 0x8, 0x60000000, 0x7f, 0x3, 0x5, 0x9, 0x5, 0xfffffffd, 0x4, 0x0, 0x9, 0xffffff91, 0x80000000, 0x1, 0x5, 0x51, 0x10, 0x7, 0x1, 0x9, 0xed, 0x1, 0xac39, 0xb, 0x6, 0x0, 0x2, 0x1, 0x0, 0x1, 0xc6, 0xfff, 0xffffffff, 0x8, 0x400, 0x2, 0x0, 0x1, 0x5, 0xb, 0x73073418, 0x2, 0x9, 0x3, 0x4, 0x40, 0x18000000, 0xa, 0x5, 0x9, 0x0, 0x2, 0xf1, 0x0, 0x3, 0x1, 0x8000, 0x1, 0x9, 0x7fffffff, 0x7, 0x5, 0x1, 0xffff2581]}, @TCA_POLICE_RATE={0x404, 0x2, [0x7, 0xfffffffe, 0x9, 0x2, 0x73b5, 0x80000000, 0x400, 0x8, 0x8000, 0x4, 0x8, 0x100, 0x217, 0x1000, 0x99, 0x6, 0x6, 0x7, 0x0, 0x7, 0x5, 0x1, 0x3, 0x4, 0xc22, 0xf14, 0x8092, 0x7, 0x10004, 0x80, 0xec, 0xeff, 0x7, 0x3, 0x2, 0x0, 0x3, 0x2, 0x4, 0x0, 0xd010, 0xffffff0b, 0x2, 0x1, 0x400, 0x0, 0x1, 0x5, 0x228, 0x29, 0x80000001, 0x7000000, 0x1, 0xffff, 0x9, 0xf, 0xd, 0x9, 0x9, 0x7, 0x7, 0x10, 0x5, 0xe7b, 0x4, 0x3, 0x7, 0x6, 0x7, 0x5, 0x4, 0x100, 0x0, 0x3, 0x9, 0x5, 0x80000001, 0x10, 0x2, 0x9, 0x9, 0x7ff, 0x401, 0x8, 0x8, 0x99c2, 0x4, 0x7, 0x61, 0xa40a, 0xc, 0x5, 0x7fff, 0x100, 0x76, 0x9, 0xc, 0xf, 0x50, 0x0, 0xffffffff, 0x3, 0x1, 0x767c, 0x6, 0x8000, 0x8, 0xd, 0x6, 0xffffffc0, 0x7, 0x101, 0x8, 0x3, 0x7066211e, 0x2, 0x6, 0x5, 0x3, 0x5, 0x8, 0x400, 0x2a4, 0xd, 0x10001, 0xfffffffa, 0x6, 0x80000000, 0x3, 0x9, 0x8, 0x0, 0x40000040, 0x2, 0xfffff801, 0x6, 0x7, 0xcc0, 0xfffffff4, 0x8, 0x5, 0x9, 0x9, 0x1, 0x17, 0x1, 0x0, 0x400, 0x9, 0x5, 0x100, 0xffff8000, 0x2, 0x6, 0x10, 0x4, 0x80, 0xfff, 0x5, 0xfffffffb, 0x8, 0x4, 0x24, 0x3, 0x0, 0x3ff, 0x4, 0xdd5, 0x7fffffff, 0x0, 0x4fcf, 0x1, 0xe0000000, 0x2, 0x8, 0x6, 0x4, 0x3, 0x80, 0x4, 0x8, 0x81, 0x0, 0x6, 0x5, 0x8, 0x5, 0xfffffffb, 0x8, 0x80000, 0x0, 0x9, 0x8, 0x44ca0699, 0x6, 0x3b326896, 0x495, 0x52, 0x8, 0x3, 0x1, 0x101, 0x4, 0x5, 0x2, 0x6e, 0x5, 0x40, 0x7, 0x0, 0x4, 0xd, 0x0, 0x1, 0x3, 0x5, 0xe0ae, 0x10001, 0x7, 0x4, 0xa4, 0x1000, 0xd, 0x7f, 0x864, 0xfa, 0x0, 0x81, 0x0, 0x9, 0x1, 0x0, 0x3, 0x3, 0x6, 0xd, 0x1, 0x42, 0xaa, 0x4, 0x101, 0x8, 0x7, 0x4, 0x3, 0x40, 0xfff, 0xfffffff8, 0x30000, 0x400000f, 0x4, 0x2, 0x9, 0x8, 0x6, 0x90000000]}, @TCA_POLICE_TBF={0x3c, 0x1, {0xfffffffd, 0x2, 0x1, 0x9, 0x66e2, {0x2, 0x2, 0x1, 0x7ff, 0x84cc, 0x5}, {0x2, 0x1, 0x4, 0x5, 0x1, 0x6}, 0x100, 0x2, 0x7}}]}]}}]}, 0x87c}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) io_uring_enter(0xffffffffffffffff, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) timer_create(0x7, 0x0, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8923, &(0x7f00000000c0)={'lo\x00', @random="01300134b1ff"}) write$tun(r0, &(0x7f0000001300)=ANY=[], 0xf6) 375.14587ms ago: executing program 5 (id=614): r0 = io_uring_setup(0x136a, &(0x7f0000000400)={0x0, 0x1f8a, 0x40, 0x1, 0x100028c}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r1, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,,ers=3.0,nodfs\x00') r2 = accept(r1, 0x0, 0x0) sendto$inet(r2, &(0x7f0000002000)="00000080fe534d4240000100000000000000010001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041000100000300000000000000000000000000000000000000000000000010000000100000001000000000000000000000000000000000000000800000000000", 0x84, 0x0, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 313.443628ms ago: executing program 4 (id=615): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x0, 0x101400) ioctl$FE_GET_PROPERTY(r0, 0x80106f53, &(0x7f00000002c0)={0x21, &(0x7f0000000380)=[{0x45, '\x00', @st={0x4, [{0x1, @svalue=0x8}, {0x0, @svalue=0x1}, {0x3, @svalue=0x6}, {0x2, @uvalue=0x7}]}, 0xffa}, {0x33, '\x00', @st={0x4, [{0x1, @svalue=0x5}, {0x3, @svalue}, {0x0, @uvalue=0x2d}, {0x2, @svalue=0x8000000000}]}, 0x9}]}) r1 = syz_usb_connect(0x0, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd010203010902"], 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) r2 = socket$kcm(0x23, 0x0, 0x0) listen(r2, 0x800) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00c00e}, 0x240040c4) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r4, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10) pselect6(0x40, &(0x7f0000000080)={0xe, 0x9ab, 0xc, 0x10000000, 0x9, 0x8, 0x4, 0x7ff}, 0x0, 0x0, 0x0, 0x0) 45.556985ms ago: executing program 2 (id=616): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0xe0302, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000380)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000040)={0x48, 0x2, r1, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r0, 0x3ba0, &(0x7f0000000180)={0x48, 0x14, r2}) 26.912351ms ago: executing program 1 (id=617): mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000080)='./file0\x00') r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='.\x00', 0x101000, 0x102) getdents64(r0, &(0x7f0000001f80)=""/4108, 0x100c) 0s ago: executing program 0 (id=618): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.30' (ED25519) to the list of known hosts. [ 86.045283][ T10] cfg80211: failed to load regulatory.db [ 87.328932][ T5601] cgroup: Unknown subsys name 'net' [ 87.414798][ T5601] cgroup: Unknown subsys name 'cpuset' [ 87.418836][ T5601] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 89.027706][ T5601] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 91.673521][ T5628] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 91.675563][ T5628] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 91.678122][ T5629] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 91.678514][ T5629] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 91.681545][ T5629] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 91.682485][ T5633] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 91.684991][ T5633] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 91.685379][ T5633] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 91.687110][ T5633] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 91.688517][ T5633] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 91.689746][ T5633] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 91.690563][ T5633] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 91.691351][ T5633] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 91.691730][ T5633] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 91.694807][ T4930] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 91.719374][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 91.734248][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 91.742573][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 91.777820][ T4930] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 91.780711][ T4930] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 91.789255][ T5633] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 91.798613][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 91.804663][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 91.815227][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 91.815755][ T52] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 91.823523][ T4930] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 91.824071][ T4930] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 91.830340][ T52] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 91.853043][ T52] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 91.867780][ T5625] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 93.721119][ T5628] Bluetooth: hci0: command tx timeout [ 93.800864][ T5625] Bluetooth: hci2: command tx timeout [ 93.801049][ T5628] Bluetooth: hci5: command tx timeout [ 93.880853][ T5625] Bluetooth: hci1: command tx timeout [ 93.882196][ T5628] Bluetooth: hci3: command tx timeout [ 93.960566][ T5628] Bluetooth: hci4: command tx timeout [ 94.489547][ T5619] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.490152][ T5619] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.505566][ T5619] bridge_slave_0: entered allmulticast mode [ 94.507814][ T5619] bridge_slave_0: entered promiscuous mode [ 94.575658][ T5619] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.575821][ T5619] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.575944][ T5619] bridge_slave_1: entered allmulticast mode [ 94.577615][ T5619] bridge_slave_1: entered promiscuous mode [ 94.595536][ T5620] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.595653][ T5620] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.595804][ T5620] bridge_slave_0: entered allmulticast mode [ 94.597986][ T5620] bridge_slave_0: entered promiscuous mode [ 94.620002][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.620118][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.620266][ T5615] bridge_slave_0: entered allmulticast mode [ 94.623259][ T5615] bridge_slave_0: entered promiscuous mode [ 94.643990][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.644106][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.644543][ T5616] bridge_slave_0: entered allmulticast mode [ 94.646595][ T5616] bridge_slave_0: entered promiscuous mode [ 94.650278][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.650672][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.650822][ T5616] bridge_slave_1: entered allmulticast mode [ 94.652974][ T5616] bridge_slave_1: entered promiscuous mode [ 94.702023][ T5620] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.703290][ T5620] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.703459][ T5620] bridge_slave_1: entered allmulticast mode [ 94.705651][ T5620] bridge_slave_1: entered promiscuous mode [ 94.745670][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.745777][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.745957][ T5615] bridge_slave_1: entered allmulticast mode [ 94.747942][ T5615] bridge_slave_1: entered promiscuous mode [ 94.770977][ T5619] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.840858][ T5619] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.843696][ T5620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.882940][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.912570][ T5620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.919795][ T5618] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.919960][ T5618] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.920331][ T5618] bridge_slave_0: entered allmulticast mode [ 94.922577][ T5618] bridge_slave_0: entered promiscuous mode [ 94.926137][ T5618] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.926253][ T5618] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.926401][ T5618] bridge_slave_1: entered allmulticast mode [ 94.928491][ T5618] bridge_slave_1: entered promiscuous mode [ 94.949300][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.954152][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.982952][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.015119][ T5619] team0: Port device team_slave_0 added [ 95.076242][ T5619] team0: Port device team_slave_1 added [ 95.105066][ T5618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.107325][ T5615] team0: Port device team_slave_0 added [ 95.109607][ T5616] team0: Port device team_slave_0 added [ 95.129570][ T5620] team0: Port device team_slave_0 added [ 95.147440][ T5618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.149428][ T5615] team0: Port device team_slave_1 added [ 95.152301][ T5616] team0: Port device team_slave_1 added [ 95.172382][ T5620] team0: Port device team_slave_1 added [ 95.173540][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.173556][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.173589][ T5619] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.174702][ T5617] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.174889][ T5617] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.175047][ T5617] bridge_slave_0: entered allmulticast mode [ 95.177052][ T5617] bridge_slave_0: entered promiscuous mode [ 95.269878][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.269899][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.269939][ T5619] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.282345][ T5617] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.282462][ T5617] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.282895][ T5617] bridge_slave_1: entered allmulticast mode [ 95.285811][ T5617] bridge_slave_1: entered promiscuous mode [ 95.305263][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.305284][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.305328][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.356260][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.356282][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.356325][ T5620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.431251][ T5618] team0: Port device team_slave_0 added [ 95.432047][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.432068][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.432113][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.433649][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.433668][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.433707][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.463865][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.463886][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.463929][ T5620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.483844][ T5617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.489240][ T5618] team0: Port device team_slave_1 added [ 95.507949][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.507970][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.508020][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.527451][ T5617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.546752][ T5619] hsr_slave_0: entered promiscuous mode [ 95.549480][ T5619] hsr_slave_1: entered promiscuous mode [ 95.653097][ T5618] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.653119][ T5618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.653163][ T5618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.711472][ T5618] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.711494][ T5618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.711534][ T5618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.714198][ T5617] team0: Port device team_slave_0 added [ 95.722887][ T5615] hsr_slave_0: entered promiscuous mode [ 95.724822][ T5615] hsr_slave_1: entered promiscuous mode [ 95.725616][ T5615] debugfs: 'hsr0' already exists in 'hsr' [ 95.725685][ T5615] Cannot create hsr debugfs directory [ 95.734771][ T5620] hsr_slave_0: entered promiscuous mode [ 95.736206][ T5620] hsr_slave_1: entered promiscuous mode [ 95.736982][ T5620] debugfs: 'hsr0' already exists in 'hsr' [ 95.737013][ T5620] Cannot create hsr debugfs directory [ 95.800580][ T5628] Bluetooth: hci0: command tx timeout [ 95.802969][ T5617] team0: Port device team_slave_1 added [ 95.866290][ T5616] hsr_slave_0: entered promiscuous mode [ 95.867146][ T5616] hsr_slave_1: entered promiscuous mode [ 95.867756][ T5616] debugfs: 'hsr0' already exists in 'hsr' [ 95.867783][ T5616] Cannot create hsr debugfs directory [ 95.881184][ T5625] Bluetooth: hci2: command tx timeout [ 95.881277][ T5628] Bluetooth: hci5: command tx timeout [ 95.961599][ T5625] Bluetooth: hci1: command tx timeout [ 95.961689][ T5628] Bluetooth: hci3: command tx timeout [ 96.003593][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 96.003613][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 96.003653][ T5617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.027710][ T5618] hsr_slave_0: entered promiscuous mode [ 96.028999][ T5618] hsr_slave_1: entered promiscuous mode [ 96.029852][ T5618] debugfs: 'hsr0' already exists in 'hsr' [ 96.029878][ T5618] Cannot create hsr debugfs directory [ 96.040510][ T5628] Bluetooth: hci4: command tx timeout [ 96.068369][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.068390][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 96.068433][ T5617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.274553][ T5617] hsr_slave_0: entered promiscuous mode [ 96.275443][ T5617] hsr_slave_1: entered promiscuous mode [ 96.276136][ T5617] debugfs: 'hsr0' already exists in 'hsr' [ 96.276163][ T5617] Cannot create hsr debugfs directory [ 96.725501][ T5619] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 96.732075][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 96.734470][ T5619] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 96.752231][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 96.777457][ T5619] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 96.781244][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 96.782223][ T5619] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 96.793613][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 96.874532][ T5615] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 96.879871][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 96.890296][ T5615] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 96.899620][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 96.911092][ T5615] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 96.915598][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 96.917269][ T5615] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 96.922182][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 97.035763][ T5620] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 97.041496][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 97.042543][ T5620] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 97.057168][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 97.064058][ T5620] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 97.073297][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 97.087498][ T5620] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 97.091900][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 97.144243][ T5619] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.200070][ T5619] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.217804][ T5616] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 97.225574][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 97.226578][ T5616] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 97.233166][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 97.259262][ T5616] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 97.268524][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 97.269963][ T5616] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 97.284078][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 97.297291][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.297652][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.342727][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.342817][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.470251][ T5618] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 97.475707][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 97.476722][ T5618] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 97.488944][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 97.513890][ T5618] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 97.517683][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 97.534667][ T5618] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 97.544862][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 97.618742][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.689789][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.728273][ T5617] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 97.746136][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 97.764453][ T1007] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.764575][ T1007] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.789131][ T5617] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 97.801254][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 97.822708][ T5617] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 97.826199][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 97.829938][ T5617] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 97.844514][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 97.858770][ T5620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.872371][ T1007] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.872488][ T1007] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.887930][ T5628] Bluetooth: hci0: command tx timeout [ 97.960009][ T5620] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.961023][ T5625] Bluetooth: hci2: command tx timeout [ 97.961112][ T5628] Bluetooth: hci5: command tx timeout [ 97.995722][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.995832][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.034293][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.040748][ T5625] Bluetooth: hci1: command tx timeout [ 98.040837][ T5628] Bluetooth: hci3: command tx timeout [ 98.086857][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.086994][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.120707][ T5628] Bluetooth: hci4: command tx timeout [ 98.164574][ T5616] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.250199][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.250339][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.325362][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.325485][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.443642][ T5618] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.596805][ T5619] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.607152][ T5617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.620089][ T5618] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.668002][ T5617] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.697379][ T1007] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.697500][ T1007] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.700216][ T1007] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.700333][ T1007] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.787011][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.787152][ T362] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.790187][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.790337][ T362] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.130049][ T5619] veth0_vlan: entered promiscuous mode [ 99.243542][ T5619] veth1_vlan: entered promiscuous mode [ 99.409136][ T5619] veth0_macvtap: entered promiscuous mode [ 99.429785][ T5619] veth1_macvtap: entered promiscuous mode [ 99.497485][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.568672][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.674419][ T1157] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.703920][ T754] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.782209][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.782281][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.797895][ T5620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.960835][ T5628] Bluetooth: hci0: command tx timeout [ 100.041144][ T5625] Bluetooth: hci2: command tx timeout [ 100.041203][ T5628] Bluetooth: hci5: command tx timeout [ 100.054310][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.121450][ T5625] Bluetooth: hci1: command tx timeout [ 100.121507][ T5628] Bluetooth: hci3: command tx timeout [ 100.210505][ T5628] Bluetooth: hci4: command tx timeout [ 100.229426][ T1007] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.229456][ T1007] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.333096][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.448362][ T362] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.448393][ T362] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.595333][ T5615] veth0_vlan: entered promiscuous mode [ 100.696453][ T5615] veth1_vlan: entered promiscuous mode [ 100.855531][ T5619] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 100.888460][ T5618] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.933414][ T5617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.973003][ T5620] veth0_vlan: entered promiscuous mode [ 100.978180][ T5615] veth0_macvtap: entered promiscuous mode [ 100.993666][ T5615] veth1_macvtap: entered promiscuous mode [ 101.085013][ T5620] veth1_vlan: entered promiscuous mode [ 101.134993][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.200871][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.253657][ T5848] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7'. [ 101.253745][ T5848] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7'. [ 101.253772][ T5848] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7'. [ 101.319186][ T5618] veth0_vlan: entered promiscuous mode [ 101.361780][ T38] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.361849][ T38] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.361910][ T38] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.361970][ T38] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.449172][ T5617] veth0_vlan: entered promiscuous mode [ 101.458572][ T5618] veth1_vlan: entered promiscuous mode [ 101.559737][ T5620] veth0_macvtap: entered promiscuous mode [ 101.576134][ T5620] veth1_macvtap: entered promiscuous mode [ 101.588240][ T5851] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 101.605839][ T5617] veth1_vlan: entered promiscuous mode [ 101.625504][ T362] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.625533][ T362] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.750055][ T5616] veth0_vlan: entered promiscuous mode [ 101.779445][ T5618] veth0_macvtap: entered promiscuous mode [ 101.789124][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.808980][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.809010][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.817280][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.824163][ T5618] veth1_macvtap: entered promiscuous mode [ 101.840047][ T5616] veth1_vlan: entered promiscuous mode [ 101.896024][ T5617] veth0_macvtap: entered promiscuous mode [ 101.911621][ T5618] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.933830][ T5618] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.937267][ T5617] veth1_macvtap: entered promiscuous mode [ 101.962916][ T1007] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.010760][ T9] usb 3-1: new low-speed USB device number 2 using dummy_hcd [ 102.061923][ T362] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.061996][ T362] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.062057][ T362] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.062119][ T362] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.062180][ T362] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.062240][ T362] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.062543][ T362] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.075881][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.086641][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.175250][ T5616] veth0_macvtap: entered promiscuous mode [ 102.211638][ T4338] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.213363][ T38] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.213427][ T38] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.213485][ T38] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.213933][ T5616] veth1_macvtap: entered promiscuous mode [ 102.219350][ T4338] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.219376][ T4338] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.360685][ T1157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.360714][ T1157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.438121][ T1007] nvmet: connect request for invalid subsystem testsubsys! [ 102.448087][ T5856] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 102.460276][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.597417][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.656340][ T1157] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.656372][ T1157] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.813891][ T362] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.813923][ T362] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.880510][ T1007] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.883086][ T1007] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.883558][ T4338] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.883624][ T4338] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.096373][ T4338] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.096402][ T4338] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.211648][ T5864] block2mtd: parameter too long [ 103.299773][ T1157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.300154][ T1157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.597769][ T362] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.597801][ T362] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.768905][ T5867] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 103.769135][ T5867] CIFS: Attempting to mount //127.0.0.1/share [ 103.872927][ T362] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.872959][ T362] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.906203][ T5867] CIFS: VFS: \\127.0.0.1 failed to create a new SMB session with Unknown: -11 [ 103.906427][ T5867] CIFS: VFS: cifs_mount failed w/return code = -11 [ 104.672639][ T5886] process 'syz.2.17' launched './file0' with NULL argv: empty string added [ 105.236596][ T5898] Config c/1 of g1 needs at least one function. [ 105.245196][ T5898] udc dummy_udc.0: failed to start g1: -22 [ 105.245231][ T5898] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 105.302869][ T5898] UDC core: g1: couldn't find an available UDC or it's busy [ 105.611824][ T5913] FAULT_INJECTION: forcing a failure. [ 105.611824][ T5913] name failslab, interval 1, probability 0, space 0, times 1 [ 105.611903][ T5913] CPU: 0 UID: 0 PID: 5913 Comm: syz.1.26 Not tainted syzkaller #0 PREEMPT(full) [ 105.611949][ T5913] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 105.611972][ T5913] Call Trace: [ 105.611984][ T5913] [ 105.611998][ T5913] dump_stack_lvl+0x100/0x190 [ 105.612059][ T5913] should_fail_ex.cold+0x5/0xa [ 105.612103][ T5913] ? srso_alias_return_thunk+0x5/0xfbef5 [ 105.612156][ T5913] should_failslab+0xc2/0x120 [ 105.612197][ T5913] kmem_cache_alloc_noprof+0x92/0x6a0 [ 105.612256][ T5913] ? do_getname+0x35/0x390 [ 105.612311][ T5913] do_getname+0x35/0x390 [ 105.612361][ T5913] __x64_sys_mkdirat+0x78/0xc0 [ 105.612402][ T5913] do_syscall_64+0x123/0x790 [ 105.612470][ T5913] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.612511][ T5913] RIP: 0033:0x7ff21379e159 [ 105.612541][ T5913] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.612577][ T5913] RSP: 002b:00007ff21465b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 105.612612][ T5913] RAX: ffffffffffffffda RBX: 00007ff213a25fa0 RCX: 00007ff21379e159 [ 105.612638][ T5913] RDX: 00000000000001ff RSI: 0000000000000000 RDI: ffffffffffffff9c [ 105.612662][ T5913] RBP: 00007ff21383506b R08: 0000000000000000 R09: 0000000000000000 [ 105.612686][ T5913] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.612710][ T5913] R13: 00007ff213a26038 R14: 00007ff213a25fa0 R15: 00007fffe433a308 [ 105.612759][ T5913] [ 105.614985][ T5913] jffs2: notice: (5913) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 106.041230][ T30] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 106.146575][ T5922] CIFS: Attempting to mount //127.0.0.1/share [ 106.198385][ T30] usb 5-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 106.230281][ T30] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 106.230350][ T30] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 106.253304][ T30] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 106.253359][ T30] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 106.275804][ T30] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.275848][ T30] usb 5-1: Product: syz [ 106.275874][ T30] usb 5-1: Manufacturer: syz [ 106.275900][ T30] usb 5-1: SerialNumber: syz [ 106.468567][ T30] ti_usb_3410_5052 5-1:2.0: TI USB 5052 2 port adapter converter detected [ 106.579816][ T30] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 106.686181][ T30] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 106.806627][ T5922] CIFS: VFS: cifs_mount failed w/return code = -112 [ 106.989848][ T5939] ti_usb_3410_5052_2 ttyUSB0: ti_open - submit interrupt urb failed, -90 [ 107.274666][ T5948] Config c/1 of g1 needs at least one function. [ 107.274868][ T5948] udc dummy_udc.0: failed to start g1: -22 [ 107.274902][ T5948] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 107.296547][ T5948] UDC core: g1: couldn't find an available UDC or it's busy [ 107.321431][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 107.321492][ T9] usb 3-1: New USB device found, idVendor=0582, idProduct=000c, bcdDevice= 0.40 [ 107.323386][ T9] usb 3-1: unable to read config index 0 descriptor/start: -32 [ 107.323422][ T9] usb 3-1: chopping to 0 config(s) [ 107.323459][ T9] usb 3-1: can't read configurations, error -32 [ 107.450489][ T9] usb 3-1: new low-speed USB device number 3 using dummy_hcd [ 107.580711][ T9] usb 3-1: device descriptor read/64, error -32 [ 107.696000][ T9] usb usb3-port1: attempt power cycle [ 107.788962][ T5960] FAULT_INJECTION: forcing a failure. [ 107.788962][ T5960] name failslab, interval 1, probability 0, space 0, times 0 [ 107.789010][ T5960] CPU: 0 UID: 0 PID: 5960 Comm: syz.5.48 Not tainted syzkaller #0 PREEMPT(full) [ 107.789059][ T5960] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 107.789081][ T5960] Call Trace: [ 107.789093][ T5960] [ 107.789107][ T5960] dump_stack_lvl+0x100/0x190 [ 107.789165][ T5960] should_fail_ex.cold+0x5/0xa [ 107.789209][ T5960] ? srso_alias_return_thunk+0x5/0xfbef5 [ 107.789261][ T5960] should_failslab+0xc2/0x120 [ 107.789301][ T5960] kmem_cache_alloc_noprof+0x92/0x6a0 [ 107.789367][ T5960] ? do_getname+0x35/0x390 [ 107.789423][ T5960] do_getname+0x35/0x390 [ 107.789474][ T5960] __x64_sys_mkdirat+0x78/0xc0 [ 107.789515][ T5960] do_syscall_64+0x123/0x790 [ 107.789582][ T5960] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.789623][ T5960] RIP: 0033:0x7f9ab019e159 [ 107.789653][ T5960] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 107.789689][ T5960] RSP: 002b:00007f9ab1072028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 107.789726][ T5960] RAX: ffffffffffffffda RBX: 00007f9ab0425fa0 RCX: 00007f9ab019e159 [ 107.789752][ T5960] RDX: 00000000000001ff RSI: 0000000000000000 RDI: ffffffffffffff9c [ 107.789776][ T5960] RBP: 00007f9ab023506b R08: 0000000000000000 R09: 0000000000000000 [ 107.789800][ T5960] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 107.789823][ T5960] R13: 00007f9ab0426038 R14: 00007f9ab0425fa0 R15: 00007ffe28a90228 [ 107.789871][ T5960] [ 107.918775][ T5960] jffs2: notice: (5960) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 107.971987][ T5628] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 107.972214][ T5628] Bluetooth: hci4: Injecting HCI hardware error event [ 107.973326][ T5625] Bluetooth: hci4: hardware error 0x00 [ 108.302405][ T5973] CIFS: Attempting to mount //127.0.0.1/share [ 108.608917][ T5854] usb 5-1: USB disconnect, device number 2 [ 109.385624][ T5973] CIFS: VFS: cifs_mount failed w/return code = -512 [ 109.391974][ T5984] Illegal XDP return value 782802752 on prog (id 5) dev N/A, expect packet loss! [ 109.434737][ T5987] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 109.868669][ T5854] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 109.875313][ T5854] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 109.877908][ T5854] ti_usb_3410_5052 5-1:2.0: device disconnected [ 110.040925][ T5628] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0 [ 110.041246][ T5628] Bluetooth: hci5: Injecting HCI hardware error event [ 110.042092][ T5628] Bluetooth: hci5: hardware error 0x00 [ 110.121192][ T5625] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 110.125386][ T5998] Config c/1 of g1 needs at least one function. [ 110.125519][ T5998] udc dummy_udc.0: failed to start g1: -22 [ 110.125552][ T5998] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 110.129440][ T5998] UDC core: g1: couldn't find an available UDC or it's busy [ 110.433174][ T5985] loop3: detected capacity change from 0 to 131072 [ 110.437895][ T5985] F2FS-fs (loop3): Invalid log sectorsize (67108873) [ 110.437921][ T5985] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 110.473969][ T5985] F2FS-fs (loop3): invalid crc value [ 110.642669][ T31] audit: type=1800 audit(1789692389.537:2): pid=6003 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.62" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 111.179915][ T5985] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 111.184050][ T5985] F2FS-fs (loop3): Try to recover 1th superblock, ret: -30 [ 111.184187][ T5985] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 111.434708][ T5625] Bluetooth: hci5: unexpected event for opcode 0xff0d [ 111.488581][ T6006] FAULT_INJECTION: forcing a failure. [ 111.488581][ T6006] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 111.488630][ T6006] CPU: 1 UID: 0 PID: 6006 Comm: syz.4.66 Not tainted syzkaller #0 PREEMPT(full) [ 111.488673][ T6006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 111.488695][ T6006] Call Trace: [ 111.488706][ T6006] [ 111.488720][ T6006] dump_stack_lvl+0x100/0x190 [ 111.488778][ T6006] should_fail_ex.cold+0x5/0xa [ 111.488828][ T6006] strncpy_from_user+0x3b/0x2d0 [ 111.488887][ T6006] do_getname+0x78/0x390 [ 111.488939][ T6006] __x64_sys_mkdirat+0x78/0xc0 [ 111.488980][ T6006] do_syscall_64+0x123/0x790 [ 111.489048][ T6006] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.489090][ T6006] RIP: 0033:0x7f0e04f9e159 [ 111.489119][ T6006] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 111.489155][ T6006] RSP: 002b:00007f0e05e90028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 111.489191][ T6006] RAX: ffffffffffffffda RBX: 00007f0e05225fa0 RCX: 00007f0e04f9e159 [ 111.489217][ T6006] RDX: 00000000000001ff RSI: 0000000000000000 RDI: ffffffffffffff9c [ 111.489241][ T6006] RBP: 00007f0e0503506b R08: 0000000000000000 R09: 0000000000000000 [ 111.489265][ T6006] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 111.489288][ T6006] R13: 00007f0e05226038 R14: 00007f0e05225fa0 R15: 00007ffd72da7518 [ 111.489347][ T6006] [ 111.664510][ T6006] jffs2: notice: (6006) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 111.880663][ T5625] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 111.880733][ T5625] Bluetooth: hci1: Injecting HCI hardware error event [ 111.881892][ T52] Bluetooth: hci1: hardware error 0x00 [ 112.157303][ T6027] CIFS: Attempting to mount //127.0.0.1/share [ 112.160526][ T982] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 112.330226][ T982] usb 1-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 112.342535][ T982] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 112.342584][ T982] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 112.344842][ T982] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 112.344891][ T982] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 112.371895][ T5628] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 112.384288][ T982] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.384328][ T982] usb 1-1: Product: syz [ 112.384362][ T982] usb 1-1: Manufacturer: syz [ 112.384388][ T982] usb 1-1: SerialNumber: syz [ 112.477469][ T982] ti_usb_3410_5052 1-1:2.0: TI USB 5052 2 port adapter converter detected [ 112.505881][ T982] usb 1-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 112.523086][ T982] usb 1-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 113.117383][ T31] audit: type=1800 audit(1789692391.687:3): pid=6042 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.81" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 113.438884][ T6019] ti_usb_3410_5052_2 ttyUSB0: ti_open - submit interrupt urb failed, -90 [ 113.495241][ T5752] usb 1-1: USB disconnect, device number 2 [ 113.513789][ T6027] CIFS: VFS: cifs_mount failed w/return code = -112 [ 113.885764][ T5752] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 113.916253][ T5752] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 114.041335][ T52] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 114.602913][ T5752] ti_usb_3410_5052 1-1:2.0: device disconnected [ 115.182907][ T6060] FAULT_INJECTION: forcing a failure. [ 115.182907][ T6060] name failslab, interval 1, probability 0, space 0, times 0 [ 115.182957][ T6060] CPU: 0 UID: 0 PID: 6060 Comm: syz.5.87 Not tainted syzkaller #0 PREEMPT(full) [ 115.183002][ T6060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 115.183025][ T6060] Call Trace: [ 115.183037][ T6060] [ 115.183051][ T6060] dump_stack_lvl+0x100/0x190 [ 115.183111][ T6060] should_fail_ex.cold+0x5/0xa [ 115.183154][ T6060] ? srso_alias_return_thunk+0x5/0xfbef5 [ 115.183215][ T6060] should_failslab+0xc2/0x120 [ 115.183255][ T6060] kmem_cache_alloc_noprof+0x92/0x6a0 [ 115.183316][ T6060] ? do_getname+0x35/0x390 [ 115.183372][ T6060] do_getname+0x35/0x390 [ 115.183425][ T6060] __x64_sys_mkdirat+0x78/0xc0 [ 115.183468][ T6060] do_syscall_64+0x123/0x790 [ 115.183538][ T6060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.183578][ T6060] RIP: 0033:0x7f9ab019e159 [ 115.183609][ T6060] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 115.183645][ T6060] RSP: 002b:00007f9ab1072028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 115.183683][ T6060] RAX: ffffffffffffffda RBX: 00007f9ab0425fa0 RCX: 00007f9ab019e159 [ 115.183709][ T6060] RDX: 00000000000001ff RSI: 0000000000000000 RDI: ffffffffffffff9c [ 115.183733][ T6060] RBP: 00007f9ab023506b R08: 0000000000000000 R09: 0000000000000000 [ 115.183758][ T6060] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 115.183781][ T6060] R13: 00007f9ab0426038 R14: 00007f9ab0425fa0 R15: 00007ffe28a90228 [ 115.183838][ T6060] [ 115.321668][ T6060] jffs2: notice: (6060) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 116.402772][ T5752] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 116.494675][ T6077] loop0: detected capacity change from 0 to 2048 [ 116.550519][ T5752] usb 2-1: device descriptor read/64, error -71 [ 116.679428][ T6077] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 116.790536][ T5752] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 116.930543][ T5752] usb 2-1: device descriptor read/64, error -71 [ 117.359430][ T31] audit: type=1800 audit(1789692396.197:4): pid=6099 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.96" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 117.475458][ T5752] usb usb2-port1: attempt power cycle [ 117.814407][ T5752] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 117.832604][ T5752] usb 2-1: device descriptor read/8, error -71 [ 117.960721][ T52] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 117.960783][ T52] Bluetooth: hci3: Injecting HCI hardware error event [ 117.961664][ T52] Bluetooth: hci3: hardware error 0x00 [ 118.002347][ T982] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 118.070492][ T5752] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 118.095756][ T5752] usb 2-1: device descriptor read/8, error -71 [ 118.153134][ T982] usb 4-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 118.157795][ T982] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 118.157845][ T982] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 118.162797][ T982] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 118.162844][ T982] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 118.174592][ T982] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.174630][ T982] usb 4-1: Product: syz [ 118.174655][ T982] usb 4-1: Manufacturer: syz [ 118.174681][ T982] usb 4-1: SerialNumber: syz [ 118.202462][ T5752] usb usb2-port1: unable to enumerate USB device [ 118.222698][ T982] ti_usb_3410_5052 4-1:2.0: TI USB 5052 2 port adapter converter detected [ 118.287045][ T982] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 118.328118][ T982] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 118.328247][ T6121] FAULT_INJECTION: forcing a failure. [ 118.328247][ T6121] name failslab, interval 1, probability 0, space 0, times 0 [ 118.328291][ T6121] CPU: 1 UID: 0 PID: 6121 Comm: syz.4.106 Not tainted syzkaller #0 PREEMPT(full) [ 118.328334][ T6121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 118.328356][ T6121] Call Trace: [ 118.328369][ T6121] [ 118.328383][ T6121] dump_stack_lvl+0x100/0x190 [ 118.328442][ T6121] should_fail_ex.cold+0x5/0xa [ 118.328485][ T6121] ? srso_alias_return_thunk+0x5/0xfbef5 [ 118.328539][ T6121] should_failslab+0xc2/0x120 [ 118.328580][ T6121] kmem_cache_alloc_noprof+0x92/0x6a0 [ 118.328641][ T6121] ? do_getname+0x35/0x390 [ 118.328698][ T6121] do_getname+0x35/0x390 [ 118.328749][ T6121] __x64_sys_mkdirat+0x78/0xc0 [ 118.328792][ T6121] do_syscall_64+0x123/0x790 [ 118.328871][ T6121] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.328911][ T6121] RIP: 0033:0x7f0e04f9e159 [ 118.328941][ T6121] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 118.328977][ T6121] RSP: 002b:00007f0e05e90028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 118.329015][ T6121] RAX: ffffffffffffffda RBX: 00007f0e05225fa0 RCX: 00007f0e04f9e159 [ 118.329041][ T6121] RDX: 00000000000001ff RSI: 0000000000000000 RDI: ffffffffffffff9c [ 118.329066][ T6121] RBP: 00007f0e0503506b R08: 0000000000000000 R09: 0000000000000000 [ 118.329090][ T6121] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 118.329113][ T6121] R13: 00007f0e05226038 R14: 00007f0e05225fa0 R15: 00007ffd72da7518 [ 118.329163][ T6121] [ 118.381926][ T6121] jffs2: notice: (6121) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 118.454763][ T6108] ti_usb_3410_5052_2 ttyUSB0: ti_open - submit interrupt urb failed, -90 [ 118.478283][ T982] usb 4-1: USB disconnect, device number 2 [ 118.549858][ T982] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 118.588664][ T982] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 118.601346][ T982] ti_usb_3410_5052 4-1:2.0: device disconnected [ 118.865570][ T6134] No control pipe specified [ 119.851937][ T6083] EXT4-fs error (device loop0): ext4_validate_block_bitmap:435: comm ext4lazyinit: bg 0: block 2: invalid block bitmap [ 120.137752][ T52] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 120.219387][ T5617] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 120.840698][ T52] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 120.840757][ T52] Bluetooth: hci0: Injecting HCI hardware error event [ 120.841769][ T52] Bluetooth: hci0: hardware error 0x00 [ 121.452436][ T31] audit: type=1800 audit(1789692400.377:5): pid=6156 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.116" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 122.118227][ T6164] FAULT_INJECTION: forcing a failure. [ 122.118227][ T6164] name failslab, interval 1, probability 0, space 0, times 0 [ 122.118278][ T6164] CPU: 1 UID: 0 PID: 6164 Comm: syz.3.124 Not tainted syzkaller #0 PREEMPT(full) [ 122.118322][ T6164] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 122.118345][ T6164] Call Trace: [ 122.118357][ T6164] [ 122.118371][ T6164] dump_stack_lvl+0x100/0x190 [ 122.118430][ T6164] should_fail_ex.cold+0x5/0xa [ 122.118474][ T6164] ? srso_alias_return_thunk+0x5/0xfbef5 [ 122.118528][ T6164] should_failslab+0xc2/0x120 [ 122.118567][ T6164] kmem_cache_alloc_noprof+0x92/0x6a0 [ 122.118627][ T6164] ? do_getname+0x35/0x390 [ 122.118683][ T6164] do_getname+0x35/0x390 [ 122.118735][ T6164] __x64_sys_mkdirat+0x78/0xc0 [ 122.118776][ T6164] do_syscall_64+0x123/0x790 [ 122.118850][ T6164] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.118890][ T6164] RIP: 0033:0x7f7011b9e159 [ 122.118920][ T6164] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 122.118956][ T6164] RSP: 002b:00007f70129e9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 122.118992][ T6164] RAX: ffffffffffffffda RBX: 00007f7011e25fa0 RCX: 00007f7011b9e159 [ 122.119018][ T6164] RDX: 00000000000001ff RSI: 0000000000000000 RDI: ffffffffffffff9c [ 122.119043][ T6164] RBP: 00007f7011c3506b R08: 0000000000000000 R09: 0000000000000000 [ 122.119067][ T6164] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 122.119091][ T6164] R13: 00007f7011e26038 R14: 00007f7011e25fa0 R15: 00007fff0dafd108 [ 122.119142][ T6164] [ 122.185550][ T6164] jffs2: notice: (6164) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 122.356413][ T6169] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 122.417299][ T6168] No control pipe specified [ 122.813203][ T6182] loop3: detected capacity change from 0 to 2048 [ 122.884254][ T6182] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 123.145185][ T5792] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 124.161198][ T52] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 124.190533][ T5792] usb 1-1: device descriptor read/64, error -71 [ 126.201711][ T5792] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 127.721631][ T6193] EXT4-fs error (device loop3): ext4_validate_block_bitmap:435: comm ext4lazyinit: bg 0: block 2: invalid block bitmap [ 128.026808][ T5615] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 128.343054][ T6217] FAULT_INJECTION: forcing a failure. [ 128.343054][ T6217] name failslab, interval 1, probability 0, space 0, times 0 [ 128.343103][ T6217] CPU: 0 UID: 0 PID: 6217 Comm: syz.0.142 Not tainted syzkaller #0 PREEMPT(full) [ 128.343147][ T6217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 128.343170][ T6217] Call Trace: [ 128.343182][ T6217] [ 128.343196][ T6217] dump_stack_lvl+0x100/0x190 [ 128.343254][ T6217] should_fail_ex.cold+0x5/0xa [ 128.343297][ T6217] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.343357][ T6217] should_failslab+0xc2/0x120 [ 128.343397][ T6217] kmem_cache_alloc_noprof+0x92/0x6a0 [ 128.343456][ T6217] ? do_getname+0x35/0x390 [ 128.343511][ T6217] do_getname+0x35/0x390 [ 128.343564][ T6217] __x64_sys_mkdirat+0x78/0xc0 [ 128.343606][ T6217] do_syscall_64+0x123/0x790 [ 128.343674][ T6217] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.343717][ T6217] RIP: 0033:0x7f1a7299e159 [ 128.343745][ T6217] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.343781][ T6217] RSP: 002b:00007f1a73886028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 128.343818][ T6217] RAX: ffffffffffffffda RBX: 00007f1a72c25fa0 RCX: 00007f1a7299e159 [ 128.343843][ T6217] RDX: 00000000000001ff RSI: 0000000000000000 RDI: ffffffffffffff9c [ 128.343868][ T6217] RBP: 00007f1a72a3506b R08: 0000000000000000 R09: 0000000000000000 [ 128.343891][ T6217] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 128.343914][ T6217] R13: 00007f1a72c26038 R14: 00007f1a72c25fa0 R15: 00007ffdeb6af138 [ 128.343964][ T6217] [ 128.345597][ T6217] jffs2: notice: (6217) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 128.798374][ T6228] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 128.847914][ T6230] No control pipe specified [ 129.045294][ T6235] netlink: 40 bytes leftover after parsing attributes in process `syz.2.150'. [ 129.097374][ T6240] CIFS: Attempting to mount //127.0.0.1/share [ 130.420911][ T31] audit: type=1800 audit(1789692409.077:6): pid=6258 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.157" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 130.455261][ T6240] CIFS: VFS: \\127.0.0.1 failed to create a new SMB session with Unknown: -11 [ 130.455366][ T6240] CIFS: VFS: cifs_mount failed w/return code = -11 [ 131.284245][ T6257] loop3: detected capacity change from 0 to 131072 [ 131.432353][ T5739] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 131.483275][ T6257] F2FS-fs (loop3): Invalid log sectorsize (67108873) [ 131.483310][ T6257] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 131.686700][ T6257] F2FS-fs (loop3): invalid crc value [ 131.824153][ T6257] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 131.826874][ T6257] F2FS-fs (loop3): Try to recover 1th superblock, ret: -30 [ 131.826907][ T6257] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 131.834009][ T5739] usb 2-1: Using ep0 maxpacket: 32 [ 131.835181][ T5739] usb 2-1: New USB device found, idVendor=15c2, idProduct=0000, bcdDevice= 0.00 [ 131.835231][ T5739] usb 2-1: no configurations [ 131.835251][ T5739] usb 2-1: can't read configurations, error -22 [ 131.935580][ T6262] netlink: 24 bytes leftover after parsing attributes in process `syz.2.158'. [ 131.970498][ T5739] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 132.124268][ T5739] usb 2-1: Using ep0 maxpacket: 32 [ 132.126472][ T5739] usb 2-1: New USB device found, idVendor=15c2, idProduct=0000, bcdDevice= 0.00 [ 132.126524][ T5739] usb 2-1: no configurations [ 132.126545][ T5739] usb 2-1: can't read configurations, error -22 [ 132.129919][ T5739] usb usb2-port1: attempt power cycle [ 132.153097][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.153189][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.172099][ T6268] FAULT_INJECTION: forcing a failure. [ 132.172099][ T6268] name failslab, interval 1, probability 0, space 0, times 0 [ 132.172174][ T6268] CPU: 1 UID: 0 PID: 6268 Comm: syz.4.159 Not tainted syzkaller #0 PREEMPT(full) [ 132.172217][ T6268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 132.172239][ T6268] Call Trace: [ 132.172252][ T6268] [ 132.172266][ T6268] dump_stack_lvl+0x100/0x190 [ 132.172324][ T6268] should_fail_ex.cold+0x5/0xa [ 132.172368][ T6268] ? srso_alias_return_thunk+0x5/0xfbef5 [ 132.172424][ T6268] should_failslab+0xc2/0x120 [ 132.172463][ T6268] kmem_cache_alloc_noprof+0x92/0x6a0 [ 132.172522][ T6268] ? do_getname+0x35/0x390 [ 132.172577][ T6268] do_getname+0x35/0x390 [ 132.172628][ T6268] __x64_sys_mkdirat+0x78/0xc0 [ 132.172670][ T6268] do_syscall_64+0x123/0x790 [ 132.172736][ T6268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.172775][ T6268] RIP: 0033:0x7f0e04f9e159 [ 132.172805][ T6268] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 132.172846][ T6268] RSP: 002b:00007f0e05e90028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 132.172882][ T6268] RAX: ffffffffffffffda RBX: 00007f0e05225fa0 RCX: 00007f0e04f9e159 [ 132.172907][ T6268] RDX: 00000000000001ff RSI: 0000000000000000 RDI: ffffffffffffff9c [ 132.172931][ T6268] RBP: 00007f0e0503506b R08: 0000000000000000 R09: 0000000000000000 [ 132.172954][ T6268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 132.172977][ T6268] R13: 00007f0e05226038 R14: 00007f0e05225fa0 R15: 00007ffd72da7518 [ 132.173027][ T6268] [ 132.177573][ T6268] jffs2: notice: (6268) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 133.009739][ T6289] loop1: detected capacity change from 0 to 128 [ 133.066006][ T6289] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 133.098480][ T6289] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 133.167523][ T6294] CIFS: Attempting to mount //127.0.0.1/share [ 133.308166][ T31] audit: type=1800 audit(1789692412.177:7): pid=6298 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.174" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 134.083438][ T6303] netlink: 24 bytes leftover after parsing attributes in process `syz.4.175'. [ 134.168644][ T6294] CIFS: VFS: \\127.0.0.1 failed to create a new SMB session with Unknown: -11 [ 134.169256][ T6294] CIFS: VFS: cifs_mount failed w/return code = -11 [ 134.229948][ T6307] jffs2: notice: (6307) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 135.880479][ T10] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 136.031763][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 136.032667][ T10] usb 1-1: New USB device found, idVendor=15c2, idProduct=0000, bcdDevice= 0.00 [ 136.032721][ T10] usb 1-1: no configurations [ 136.032744][ T10] usb 1-1: can't read configurations, error -22 [ 136.164706][ T10] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 136.298182][ T6311] loop4: detected capacity change from 0 to 131072 [ 136.330461][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 136.333026][ T10] usb 1-1: New USB device found, idVendor=15c2, idProduct=0000, bcdDevice= 0.00 [ 136.333079][ T10] usb 1-1: no configurations [ 136.333101][ T10] usb 1-1: can't read configurations, error -22 [ 136.334959][ T10] usb usb1-port1: attempt power cycle [ 136.336068][ T6311] F2FS-fs (loop4): Invalid log sectorsize (67108873) [ 136.336094][ T6311] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 136.345164][ T6311] F2FS-fs (loop4): invalid crc value [ 136.490349][ T6311] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 136.493959][ T6311] F2FS-fs (loop4): Try to recover 1th superblock, ret: -30 [ 136.493992][ T6311] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 136.782431][ T10] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 136.803939][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 136.807445][ T10] usb 1-1: New USB device found, idVendor=15c2, idProduct=0000, bcdDevice= 0.00 [ 136.807499][ T10] usb 1-1: no configurations [ 136.807522][ T10] usb 1-1: can't read configurations, error -22 [ 136.931653][ T10] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 136.957603][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 136.968726][ T10] usb 1-1: New USB device found, idVendor=15c2, idProduct=0000, bcdDevice= 0.00 [ 136.968780][ T10] usb 1-1: no configurations [ 136.968802][ T10] usb 1-1: can't read configurations, error -22 [ 136.969778][ T10] usb usb1-port1: unable to enumerate USB device [ 137.050642][ T6338] netlink: 24 bytes leftover after parsing attributes in process `syz.5.190'. [ 137.086823][ T6342] jffs2: notice: (6342) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 137.503445][ T31] audit: type=1800 audit(1789692416.417:8): pid=6353 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.189" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 138.321038][ T6356] CIFS: Attempting to mount //127.0.0.1/share [ 138.390475][ T5770] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 138.554510][ T5770] usb 6-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 138.569899][ T5770] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 138.569948][ T5770] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 138.592796][ T5770] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 138.592860][ T5770] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 138.598848][ T5770] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.598886][ T5770] usb 6-1: Product: syz [ 138.598913][ T5770] usb 6-1: Manufacturer: syz [ 138.598940][ T5770] usb 6-1: SerialNumber: syz [ 138.675866][ T5770] ti_usb_3410_5052 6-1:2.0: TI USB 5052 2 port adapter converter detected [ 138.705752][ T5770] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 138.724932][ T5770] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 138.780186][ T6369] ======================================================= [ 138.780186][ T6369] WARNING: The mand mount option has been deprecated and [ 138.780186][ T6369] and is ignored by this kernel. Remove the mand [ 138.780186][ T6369] option from the mount to silence this warning. [ 138.780186][ T6369] ======================================================= [ 138.939543][ T5752] usb 6-1: USB disconnect, device number 2 [ 139.034472][ T5752] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 139.084872][ T5752] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 139.110780][ T5752] ti_usb_3410_5052 6-1:2.0: device disconnected [ 139.149363][ T6356] CIFS: VFS: \\127.0.0.1 failed to create a new SMB session with Unknown: -11 [ 139.165120][ T6356] CIFS: VFS: cifs_mount failed w/return code = -11 [ 140.386707][ T6373] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 141.074043][ T6380] loop1: detected capacity change from 0 to 131072 [ 141.075886][ T6380] F2FS-fs (loop1): Invalid log sectorsize (67108873) [ 141.075916][ T6380] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 141.087273][ T6380] F2FS-fs (loop1): invalid crc value [ 141.211320][ T6380] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 141.218243][ T31] audit: type=1800 audit(1789692420.117:9): pid=6401 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.211" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 141.283461][ T6380] F2FS-fs (loop1): Try to recover 1th superblock, ret: -30 [ 141.283499][ T6380] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 142.066897][ T6409] jffs2: notice: (6409) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 142.151111][ T6413] netlink: 'syz.2.216': attribute type 2 has an invalid length. [ 142.508849][ T6422] CIFS: Attempting to mount //127.0.0.1/share [ 142.536753][ T6424] use of bytesused == 0 is deprecated and will be removed in the future, [ 142.536773][ T6424] use the actual size instead. [ 142.569878][ T6422] CIFS: VFS: cifs_mount failed w/return code = -112 [ 142.578486][ T5752] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 142.723051][ T5752] usb 5-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 142.726634][ T5752] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 142.726684][ T5752] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 142.728309][ T5752] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 142.728356][ T5752] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 142.787503][ T5752] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.787544][ T5752] usb 5-1: Product: syz [ 142.787571][ T5752] usb 5-1: Manufacturer: syz [ 142.787598][ T5752] usb 5-1: SerialNumber: syz [ 142.827245][ T5752] ti_usb_3410_5052 5-1:2.0: TI USB 5052 2 port adapter converter detected [ 142.843785][ T5752] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 142.847734][ T5752] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 142.990554][ T6429] bond0: ARP target 192.0.2.1 is already present [ 142.990593][ T6429] bond0: option arp_ip_target: invalid value (+192.0.2.1) [ 143.035285][ T6429] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 143.070844][ T10] usb 5-1: USB disconnect, device number 3 [ 143.149325][ T10] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 143.178605][ T10] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 143.199575][ T10] ti_usb_3410_5052 5-1:2.0: device disconnected [ 143.264295][ T6432] netlink: 28 bytes leftover after parsing attributes in process `syz.3.223'. [ 143.264332][ T6432] netlink: 28 bytes leftover after parsing attributes in process `syz.3.223'. [ 143.264363][ T6432] netlink: 8 bytes leftover after parsing attributes in process `syz.3.223'. [ 143.577957][ T6438] loop5: detected capacity change from 0 to 2048 [ 144.613523][ T6452] loop3: detected capacity change from 0 to 16 [ 144.646530][ T6438] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 144.678918][ T6452] erofs: Unknown parameter './sys' [ 145.669091][ T6459] Zero length message leads to an empty skb [ 146.093894][ T6464] netlink: 20 bytes leftover after parsing attributes in process `syz.4.230'. [ 146.520689][ T6445] EXT4-fs error (device loop5): ext4_validate_block_bitmap:435: comm ext4lazyinit: bg 0: block 2: invalid block bitmap [ 146.558337][ T6476] binder: BINDER_SET_CONTEXT_MGR already set [ 146.558357][ T6476] binder: 6475:6476 ioctl 4018620d 2000000002c0 returned -16 [ 146.948591][ T5620] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 148.029421][ T6492] Config c/1 of g1 needs at least one function. [ 148.029561][ T6492] udc dummy_udc.0: failed to start g1: -22 [ 148.044868][ T6492] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 148.050259][ T6492] UDC core: g1: couldn't find an available UDC or it's busy [ 151.296934][ T5792] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 151.335959][ T6507] netlink: 'syz.3.246': attribute type 2 has an invalid length. [ 151.748413][ T6509] loop0: detected capacity change from 0 to 16 [ 151.760746][ T6509] erofs: Unknown parameter './sys' [ 151.847655][ T6509] loop0: detected capacity change from 0 to 256 [ 151.864760][ T6509] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 152.410443][ T5792] usb 4-1: Using ep0 maxpacket: 32 [ 152.851470][ T5792] usb 4-1: device descriptor read/all, error -71 [ 152.885012][ T6517] jffs2: notice: (6517) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 154.097421][ T6534] loop1: detected capacity change from 0 to 2048 [ 154.181921][ T6549] FAULT_INJECTION: forcing a failure. [ 154.181921][ T6549] name failslab, interval 1, probability 0, space 0, times 0 [ 154.181970][ T6549] CPU: 1 UID: 0 PID: 6549 Comm: syz.4.260 Not tainted syzkaller #0 PREEMPT(full) [ 154.182015][ T6549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 154.182037][ T6549] Call Trace: [ 154.182049][ T6549] [ 154.182063][ T6549] dump_stack_lvl+0x100/0x190 [ 154.182122][ T6549] should_fail_ex.cold+0x5/0xa [ 154.182165][ T6549] ? srso_alias_return_thunk+0x5/0xfbef5 [ 154.182219][ T6549] should_failslab+0xc2/0x120 [ 154.182259][ T6549] __kmalloc_cache_noprof+0x91/0x6d0 [ 154.182309][ T6549] ? lock_acquire+0x1d1/0x380 [ 154.182346][ T6549] ? snd_pcm_oss_change_params_locked+0x211/0x39f0 [ 154.182424][ T6549] snd_pcm_oss_change_params_locked+0x211/0x39f0 [ 154.182495][ T6549] ? srso_alias_safe_ret+0x1/0x7 [ 154.182543][ T6549] ? srso_alias_return_thunk+0x5/0xfbef5 [ 154.182593][ T6549] ? snd_pcm_oss_make_ready+0xcb/0x1b0 [ 154.182659][ T6549] ? tomoyo_path_number_perm+0x188/0x580 [ 154.182723][ T6549] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 154.182789][ T6549] ? __pfx___mutex_lock+0x10/0x10 [ 154.182842][ T6549] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 154.182892][ T6549] ? srso_alias_return_thunk+0x5/0xfbef5 [ 154.182939][ T6549] ? do_vfs_ioctl+0x226/0x13e0 [ 154.183003][ T6549] snd_pcm_oss_make_ready+0xeb/0x1b0 [ 154.183072][ T6549] snd_pcm_oss_ioctl+0x2385/0x3790 [ 154.183109][ T6549] ? srso_alias_return_thunk+0x5/0xfbef5 [ 154.183155][ T6549] ? find_held_lock+0x2b/0x80 [ 154.183205][ T6549] ? srso_alias_return_thunk+0x5/0xfbef5 [ 154.183251][ T6549] ? hook_file_ioctl_common+0x140/0x440 [ 154.183317][ T6549] ? __pfx_snd_pcm_oss_ioctl+0x10/0x10 [ 154.183360][ T6549] ? srso_alias_return_thunk+0x5/0xfbef5 [ 154.183407][ T6549] ? __fget_files+0x21f/0x3d0 [ 154.183451][ T6549] ? __pfx_snd_pcm_oss_ioctl+0x10/0x10 [ 154.183493][ T6549] __x64_sys_ioctl+0x18e/0x210 [ 154.183552][ T6549] do_syscall_64+0x123/0x790 [ 154.183620][ T6549] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.183660][ T6549] RIP: 0033:0x7f0e04f9e159 [ 154.183690][ T6549] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 154.183726][ T6549] RSP: 002b:00007f0e05e90028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 154.183763][ T6549] RAX: ffffffffffffffda RBX: 00007f0e05225fa0 RCX: 00007f0e04f9e159 [ 154.183789][ T6549] RDX: 0000000000000000 RSI: 0000000080045017 RDI: 0000000000000004 [ 154.183813][ T6549] RBP: 00007f0e0503506b R08: 0000000000000000 R09: 0000000000000000 [ 154.183837][ T6549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 154.183866][ T6549] R13: 00007f0e05226038 R14: 00007f0e05225fa0 R15: 00007ffd72da7518 [ 154.183917][ T6549] [ 154.205651][ T6540] UDC core: g1: couldn't find an available UDC or it's busy [ 154.216969][ T6534] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 154.375397][ T5792] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 155.048312][ T5792] usb 1-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 155.059760][ T5792] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 155.059810][ T5792] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 155.074161][ T5792] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 155.074210][ T5792] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 155.116638][ T5792] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.116708][ T5792] usb 1-1: Product: syz [ 155.116734][ T5792] usb 1-1: Manufacturer: syz [ 155.116761][ T5792] usb 1-1: SerialNumber: syz [ 155.172599][ T5792] ti_usb_3410_5052 1-1:2.0: TI USB 5052 2 port adapter converter detected [ 155.242074][ T5792] usb 1-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 155.276076][ T5792] usb 1-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 155.316762][ T6557] netlink: 24 bytes leftover after parsing attributes in process `syz.4.261'. [ 155.424990][ T31] audit: type=1800 audit(1789692434.347:10): pid=6562 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.262" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 156.230514][ T31] audit: type=1326 audit(1789692435.137:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6559 comm="syz.5.263" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9ab019e159 code=0x0 [ 156.240894][ T5753] usb 1-1: USB disconnect, device number 9 [ 156.424852][ T5753] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 156.442090][ T982] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 156.448695][ T5753] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 156.455019][ T5753] ti_usb_3410_5052 1-1:2.0: device disconnected [ 156.573610][ T6569] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 156.596207][ T982] usb 6-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice= 1.00 [ 156.618870][ T982] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 156.618938][ T982] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.061520][ T982] metro_usb 6-1:1.0: Metrologic USB to Serial converter detected [ 157.080155][ T982] usb 6-1: Metrologic USB to Serial converter now attached to ttyUSB0 [ 157.122218][ T5618] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 157.389365][ T5753] usb 6-1: USB disconnect, device number 3 [ 157.434403][ T5753] metro-usb ttyUSB0: Metrologic USB to Serial converter now disconnected from ttyUSB0 [ 157.439421][ T5753] metro_usb 6-1:1.0: device disconnected [ 158.952860][ T6614] netlink: 20 bytes leftover after parsing attributes in process `syz.5.277'. [ 159.282810][ T31] audit: type=1800 audit(1789692438.157:12): pid=6623 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.278" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 160.012253][ T6626] bond0: ARP target 192.0.2.1 is already present [ 160.012291][ T6626] bond0: option arp_ip_target: invalid value (+192.0.2.1) [ 160.014031][ T6626] bond0: (slave dummy0): Error: Device is in use and cannot be enslaved [ 160.014064][ T6626] bond0: option slaves: unable to set because the bond device is up [ 160.123181][ T6620] loop0: detected capacity change from 0 to 2048 [ 160.203954][ T6620] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 160.380545][ T30] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 161.421933][ T30] usb 4-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 161.424191][ T30] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 161.424240][ T30] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 161.425568][ T30] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 161.425616][ T30] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 161.939886][ T6645] loop5: detected capacity change from 0 to 16 [ 161.951447][ T6645] erofs: Unknown parameter './sys' [ 162.456688][ T30] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.456732][ T30] usb 4-1: Product: syz [ 162.456758][ T30] usb 4-1: Manufacturer: syz [ 162.456784][ T30] usb 4-1: SerialNumber: syz [ 162.489234][ T30] usb 4-1: can't set config #2, error -71 [ 162.502568][ T30] usb 4-1: USB disconnect, device number 5 [ 162.522514][ T6632] EXT4-fs error (device loop0): ext4_validate_block_bitmap:435: comm ext4lazyinit: bg 0: block 2: invalid block bitmap [ 164.359364][ T6653] loop4: detected capacity change from 0 to 131072 [ 164.500245][ T5617] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 164.529808][ T6653] F2FS-fs (loop4): Invalid log sectorsize (67108873) [ 164.529844][ T6653] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 164.828504][ T6653] F2FS-fs (loop4): invalid crc value [ 165.061877][ T6653] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 165.064272][ T6653] F2FS-fs (loop4): Try to recover 1th superblock, ret: -30 [ 165.064307][ T6653] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 165.336567][ T6670] 9pnet_virtio: no channels available for device syz [ 165.363837][ T6667] Config c/1 of g1 needs at least one function. [ 165.363985][ T6667] udc dummy_udc.0: failed to start g1: -22 [ 165.364018][ T6667] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 165.416530][ T6667] UDC core: g1: couldn't find an available UDC or it's busy [ 165.629261][ T6675] netlink: 28 bytes leftover after parsing attributes in process `syz.3.297'. [ 165.629298][ T6675] netlink: 28 bytes leftover after parsing attributes in process `syz.3.297'. [ 165.629323][ T6675] netlink: 8 bytes leftover after parsing attributes in process `syz.3.297'. [ 165.936105][ T31] audit: type=1800 audit(1789692444.857:13): pid=6683 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.299" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 167.340525][ T5753] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 167.510508][ T6706] loop1: detected capacity change from 0 to 16 [ 167.520693][ T6706] erofs: Unknown parameter './sys' [ 167.596991][ T6706] loop1: detected capacity change from 0 to 256 [ 167.613076][ T6706] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 168.146187][ T5753] usb 6-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 168.147687][ T5753] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 168.147737][ T5753] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 168.149088][ T5753] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 168.149136][ T5753] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 168.159630][ T5753] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.159670][ T5753] usb 6-1: Product: syz [ 168.159697][ T5753] usb 6-1: Manufacturer: syz [ 168.159723][ T5753] usb 6-1: SerialNumber: syz [ 168.274288][ T5753] ti_usb_3410_5052 6-1:2.0: TI USB 5052 2 port adapter converter detected [ 168.303189][ T5753] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 168.321833][ T5753] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 168.496237][ T5753] usb 6-1: USB disconnect, device number 4 [ 168.555024][ T5753] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 168.599662][ T5753] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 168.615406][ T5753] ti_usb_3410_5052 6-1:2.0: device disconnected [ 168.703793][ T6719] Config c/1 of g1 needs at least one function. [ 168.704273][ T6719] udc dummy_udc.0: failed to start g1: -22 [ 168.704306][ T6719] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 169.148464][ T6719] UDC core: g1: couldn't find an available UDC or it's busy [ 169.661563][ T6728] netlink: 8 bytes leftover after parsing attributes in process `syz.1.316'. [ 169.662643][ T6728] netlink: 8 bytes leftover after parsing attributes in process `syz.1.316'. [ 171.306433][ T6760] overlayfs: missing 'lowerdir' [ 171.477974][ T6763] Config c/1 of g1 needs at least one function. [ 171.479992][ T6763] udc dummy_udc.0: failed to start g1: -22 [ 171.480033][ T6763] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 171.513382][ T6763] UDC core: g1: couldn't find an available UDC or it's busy [ 171.545163][ T6765] netlink: 8 bytes leftover after parsing attributes in process `syz.5.330'. [ 171.545622][ T6765] netlink: 8 bytes leftover after parsing attributes in process `syz.5.330'. [ 171.727101][ T6773] bond0: (slave dummy0): Error: Device is in use and cannot be enslaved [ 171.727140][ T6773] bond0: option slaves: unable to set because the bond device is up [ 171.910193][ T6777] CIFS: Attempting to mount //127.0.0.1/share [ 171.992230][ T6777] CIFS: VFS: cifs_mount failed w/return code = -112 [ 172.921661][ T6798] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 173.187093][ T6804] binder: 6803:6804 ioctl c00c620f 200000000580 returned -22 [ 173.219308][ T6806] overlayfs: missing 'lowerdir' [ 173.300046][ T6808] Config c/1 of g1 needs at least one function. [ 173.300185][ T6808] udc dummy_udc.0: failed to start g1: -22 [ 173.300218][ T6808] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 173.331230][ T6808] UDC core: g1: couldn't find an available UDC or it's busy [ 173.419832][ T6810] netlink: 8 bytes leftover after parsing attributes in process `syz.5.349'. [ 173.420172][ T6810] netlink: 8 bytes leftover after parsing attributes in process `syz.5.349'. [ 173.633306][ T6800] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input6 [ 173.668994][ T6818] bond0: (slave dummy0): Error: Device is in use and cannot be enslaved [ 173.669030][ T6818] bond0: option slaves: unable to set because the bond device is up [ 174.425560][ T31] audit: type=1807 audit(1789692453.357:14): UNKNOWN=me res=0 [ 174.432913][ T6837] ima: policy update failed [ 174.438148][ T31] audit: type=1802 audit(1789692453.367:15): pid=6839 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=update_policy cause=invalid-policy comm="syz.1.360" res=0 errno=0 [ 174.438214][ T31] audit: type=1802 audit(1789692453.367:16): pid=6837 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.1.360" res=0 errno=0 [ 174.545891][ T6842] Config c/1 of g1 needs at least one function. [ 174.546027][ T6842] udc dummy_udc.0: failed to start g1: -22 [ 174.546060][ T6842] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 174.548796][ T6842] UDC core: g1: couldn't find an available UDC or it's busy [ 174.639418][ T6844] netlink: 8 bytes leftover after parsing attributes in process `syz.5.363'. [ 174.639750][ T6844] netlink: 8 bytes leftover after parsing attributes in process `syz.5.363'. [ 174.710769][ T5752] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 174.874727][ T5752] usb 5-1: Using ep0 maxpacket: 32 [ 174.875483][ T5752] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 174.877748][ T5752] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 174.877786][ T5752] usb 5-1: config 0 has no interface number 0 [ 175.079193][ T5752] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 175.079237][ T5752] usb 5-1: Product: syz [ 175.079264][ T5752] usb 5-1: Manufacturer: syz [ 175.079291][ T5752] usb 5-1: SerialNumber: syz [ 175.135960][ T5752] usb 5-1: config 0 descriptor?? [ 176.004023][ T6854] loop1: detected capacity change from 0 to 128 [ 176.022822][ T6854] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 176.043470][ T6854] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 176.101939][ T6860] bond0: (slave dummy0): Error: Device is in use and cannot be enslaved [ 176.102012][ T6860] bond0: option slaves: unable to set because the bond device is up [ 176.938342][ T6856] loop3: detected capacity change from 0 to 131072 [ 176.951187][ T6856] F2FS-fs (loop3): Invalid log sectorsize (67108873) [ 176.951219][ T6856] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 176.954200][ T6856] F2FS-fs (loop3): invalid crc value [ 177.064737][ T6856] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 177.071517][ T6856] F2FS-fs (loop3): Try to recover 1th superblock, ret: -30 [ 177.071553][ T6856] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 177.735825][ T5752] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 177.735884][ T5752] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 177.737976][ T5752] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 177.738528][ T5752] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -71 [ 177.824533][ T5752] usb 5-1: USB disconnect, device number 4 [ 178.504180][ T6889] Config c/1 of g1 needs at least one function. [ 178.504315][ T6889] udc dummy_udc.0: failed to start g1: -22 [ 178.504349][ T6889] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 178.505170][ T6889] UDC core: g1: couldn't find an available UDC or it's busy [ 178.606926][ T6891] loop0: detected capacity change from 0 to 2048 [ 178.694337][ T6891] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 179.663902][ T6894] EXT4-fs error (device loop0): ext4_validate_block_bitmap:435: comm ext4lazyinit: bg 0: block 2: invalid block bitmap [ 179.789163][ T6902] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 179.885797][ T6908] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 179.885862][ T6908] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 179.987482][ T6912] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 5 out of range (51000000..2150000000) [ 180.027753][ T6909] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 180.082030][ T6915] jffs2: notice: (6915) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 180.126911][ T6918] netlink: 8 bytes leftover after parsing attributes in process `syz.5.388'. [ 180.367615][ T6921] netlink: 8 bytes leftover after parsing attributes in process `syz.3.391'. [ 180.435981][ T6924] Config c/1 of g1 needs at least one function. [ 180.436119][ T6924] udc dummy_udc.0: failed to start g1: -22 [ 180.436152][ T6924] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 180.437010][ T6924] UDC core: g1: couldn't find an available UDC or it's busy [ 180.880937][ T6935] binder: 6934:6935 ioctl 4018620d 0 returned -22 [ 182.064427][ T5617] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 182.815194][ T6959] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 182.815259][ T6959] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 182.904710][ T6962] 9pnet_virtio: no channels available for device syz [ 183.147406][ T6965] Config c/1 of g1 needs at least one function. [ 183.147544][ T6965] udc dummy_udc.0: failed to start g1: -22 [ 183.147579][ T6965] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 183.170946][ T6965] UDC core: g1: couldn't find an available UDC or it's busy [ 184.274993][ T6978] binder: 6976:6978 ioctl 4018620d 0 returned -22 [ 184.359593][ T6979] loop0: detected capacity change from 0 to 2048 [ 184.440712][ T6979] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 186.163186][ T6991] autofs: Unknown parameter '0x0000000000000000' [ 186.180451][ T30] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 186.273296][ T31] audit: type=1800 audit(1789692465.197:17): pid=6996 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.417" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 186.284108][ T6982] EXT4-fs error (device loop0): ext4_validate_block_bitmap:435: comm ext4lazyinit: bg 0: block 2: invalid block bitmap [ 187.136096][ T30] usb 2-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 187.137460][ T30] usb 2-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 187.137507][ T30] usb 2-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 187.139847][ T30] usb 2-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 187.139901][ T30] usb 2-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 187.170233][ T30] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.170275][ T30] usb 2-1: Product: syz [ 187.170301][ T30] usb 2-1: Manufacturer: syz [ 187.170327][ T30] usb 2-1: SerialNumber: syz [ 187.190823][ T30] ti_usb_3410_5052 2-1:2.0: TI USB 5052 2 port adapter converter detected [ 187.214646][ T30] usb 2-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 187.229719][ T30] usb 2-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 187.458618][ T5617] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 187.469458][ T30] usb 2-1: USB disconnect, device number 9 [ 187.547971][ T30] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 187.567131][ T30] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 187.568207][ T30] ti_usb_3410_5052 2-1:2.0: device disconnected [ 187.902597][ T7014] netlink: 16 bytes leftover after parsing attributes in process `syz.2.425'. [ 187.935391][ T7012] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 187.935453][ T7012] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 187.988962][ T30] wiimote 0005:057E:0306.0001: hidraw0: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 188.001626][ T5854] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 188.002698][ T30] wiimote 0005:057E:0306.0001: New device registered [ 188.100537][ T5632] usb 6-1: new full-speed USB device number 5 using dummy_hcd [ 188.165573][ T5854] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 188.167026][ T5854] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 188.167088][ T5854] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 188.167132][ T5854] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 188.169103][ T5854] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 188.169140][ T5854] usb 5-1: Product: syz [ 188.169167][ T5854] usb 5-1: Manufacturer: syz [ 188.247621][ T7007] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 188.249918][ T5854] garmin_gps 5-1:1.0: Garmin GPS usb/tty converter detected [ 188.283265][ T5632] usb 6-1: unable to get BOS descriptor or descriptor too short [ 188.284341][ T5632] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 188.285401][ T5632] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 188.285449][ T5632] usb 6-1: can't read configurations, error -71 [ 188.286242][ T7008] wiimote 0005:057E:0306.0001: Device removed [ 188.290076][ T5854] usb 5-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 188.372188][ T7016] fido_id[7016]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 188.586432][ T5753] usb 5-1: USB disconnect, device number 5 [ 188.636484][ T5753] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 188.648137][ T5753] garmin_gps 5-1:1.0: device disconnected [ 188.701360][ T7029] autofs: Unknown parameter '0x0000000000000000' [ 189.266526][ T30] wiimote 0005:057E:0306.0001: detected device: Nintendo Wii Remote (Gen 1) [ 189.848989][ T30] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.0001/input/input8 [ 189.895567][ T30] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.0001/input/input9 [ 189.939006][ T30] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.0001/input/input7 [ 190.336247][ T7055] loop1: detected capacity change from 0 to 128 [ 190.337314][ T7054] overlayfs: missing 'lowerdir' [ 190.349607][ T7055] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 190.350283][ T7055] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 190.540491][ T1215] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 190.711577][ T1215] usb 4-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 190.713684][ T1215] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 190.713733][ T1215] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 190.717139][ T1215] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 190.717188][ T1215] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 190.729918][ T1215] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 190.729957][ T1215] usb 4-1: Product: syz [ 190.729982][ T1215] usb 4-1: Manufacturer: syz [ 190.730009][ T1215] usb 4-1: SerialNumber: syz [ 190.790114][ T7060] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 190.790153][ T7060] FAT-fs (loop1): Filesystem has been set read-only [ 190.805436][ T7060] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 190.821576][ T7060] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 190.867078][ T1215] ti_usb_3410_5052 4-1:2.0: TI USB 5052 2 port adapter converter detected [ 190.892761][ T1215] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 190.916425][ T1215] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 191.066334][ T5752] usb 4-1: USB disconnect, device number 6 [ 191.099553][ T5752] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 191.115283][ T5752] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 191.122729][ T5752] ti_usb_3410_5052 4-1:2.0: device disconnected [ 191.552498][ T7068] autofs: Unknown parameter '0x0000000000000000' [ 191.770241][ T7076] netlink: 8 bytes leftover after parsing attributes in process `syz.4.450'. [ 192.015701][ T7084] overlayfs: missing 'lowerdir' [ 192.343145][ T7098] loop1: detected capacity change from 0 to 128 [ 192.351902][ T7098] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 192.373337][ T7098] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 192.786268][ T7106] netlink: 4 bytes leftover after parsing attributes in process `syz.3.463'. [ 192.841113][ T7107] autofs: Unknown parameter '0x0000000000000000' [ 192.983471][ T7110] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 192.983512][ T7110] FAT-fs (loop1): Filesystem has been set read-only [ 192.984675][ T7110] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 192.985193][ T7110] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 193.320775][ T1215] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 193.566506][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.566618][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.691510][ T1215] usb 1-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 193.763312][ T1215] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 193.763640][ T1215] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 193.858540][ T1215] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 193.872959][ T1215] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 194.039533][ T1215] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.039576][ T1215] usb 1-1: Product: syz [ 194.039603][ T1215] usb 1-1: Manufacturer: syz [ 194.039629][ T1215] usb 1-1: SerialNumber: syz [ 194.105034][ T7122] loop3: detected capacity change from 0 to 2048 [ 194.185946][ T1215] ti_usb_3410_5052 1-1:2.0: TI USB 5052 2 port adapter converter detected [ 194.197827][ T7122] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 194.213523][ T1215] usb 1-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 194.229000][ T1215] usb 1-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 194.434489][ T1215] usb 1-1: USB disconnect, device number 10 [ 194.451479][ T7130] overlayfs: missing 'lowerdir' [ 194.508712][ T7131] bond0: (slave dummy0): Error: Device is in use and cannot be enslaved [ 194.508751][ T7131] bond0: option slaves: unable to set because the bond device is up [ 194.509430][ T1215] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 194.982781][ T5632] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 195.016306][ T1215] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 195.031659][ T1215] ti_usb_3410_5052 1-1:2.0: device disconnected [ 195.163904][ T5632] usb 2-1: Using ep0 maxpacket: 32 [ 195.166058][ T5632] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 195.168758][ T5632] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 195.168807][ T5632] usb 2-1: can't read configurations, error -61 [ 195.290509][ T5632] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 195.463444][ T5632] usb 2-1: Using ep0 maxpacket: 32 [ 195.464189][ T5632] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 195.464246][ T7148] autofs: Unknown parameter 'fd0x0000000000000000' [ 195.466290][ T5632] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 195.466336][ T5632] usb 2-1: can't read configurations, error -61 [ 195.466691][ T5632] usb usb2-port1: attempt power cycle [ 195.805720][ T5632] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 195.832289][ T5632] usb 2-1: Using ep0 maxpacket: 32 [ 195.835108][ T5632] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 195.843158][ T5632] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 195.843210][ T5632] usb 2-1: can't read configurations, error -61 [ 195.980462][ T5632] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 196.023829][ T5632] usb 2-1: Using ep0 maxpacket: 32 [ 196.032873][ T5632] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 196.061503][ T31] audit: type=1800 audit(1789692474.987:18): pid=7165 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.484" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 196.069331][ T5632] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 196.069379][ T5632] usb 2-1: can't read configurations, error -61 [ 196.069692][ T5632] usb usb2-port1: unable to enumerate USB device [ 196.971249][ T7125] EXT4-fs error (device loop3): ext4_validate_block_bitmap:435: comm ext4lazyinit: bg 0: block 2: invalid block bitmap [ 197.056035][ T5615] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 197.154880][ T7168] bond0: (slave dummy0): Error: Device is in use and cannot be enslaved [ 197.154918][ T7168] bond0: option slaves: unable to set because the bond device is up [ 197.407233][ T7176] overlayfs: missing 'workdir' [ 197.536893][ T7178] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 197.648810][ T7184] autofs: Unknown parameter 'fd0x0000000000000000' [ 198.707500][ T7195] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 199.668764][ T7190] loop4: detected capacity change from 0 to 131072 [ 199.689670][ T31] audit: type=1800 audit(1789692478.607:19): pid=7210 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.499" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 200.414472][ T7190] F2FS-fs (loop4): Invalid log sectorsize (67108873) [ 200.414509][ T7190] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 200.415105][ T7190] F2FS-fs (loop4): invalid crc value [ 200.515742][ T7190] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 200.519536][ T7190] F2FS-fs (loop4): Try to recover 1th superblock, ret: -30 [ 200.519571][ T7190] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 200.775815][ T7217] loop0: detected capacity change from 0 to 2048 [ 200.803282][ T7220] bond0: (slave dummy0): Error: Device is in use and cannot be enslaved [ 200.803327][ T7220] bond0: option slaves: unable to set because the bond device is up [ 200.880101][ T7217] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 201.184549][ T7228] overlayfs: missing 'workdir' [ 201.773587][ T7231] autofs: Unknown parameter 'fd0x0000000000000000' [ 202.169300][ T7244] FAULT_INJECTION: forcing a failure. [ 202.169300][ T7244] name failslab, interval 1, probability 0, space 0, times 0 [ 202.169350][ T7244] CPU: 1 UID: 0 PID: 7244 Comm: syz.4.504 Not tainted syzkaller #0 PREEMPT(full) [ 202.169403][ T7244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 202.169425][ T7244] Call Trace: [ 202.169436][ T7244] [ 202.169451][ T7244] dump_stack_lvl+0x100/0x190 [ 202.169509][ T7244] should_fail_ex.cold+0x5/0xa [ 202.169552][ T7244] ? srso_alias_return_thunk+0x5/0xfbef5 [ 202.169605][ T7244] should_failslab+0xc2/0x120 [ 202.169646][ T7244] __kmalloc_cache_noprof+0x91/0x6d0 [ 202.169698][ T7244] ? alloc_netdev_mqs+0xe3c/0x15c0 [ 202.169766][ T7244] alloc_netdev_mqs+0xe3c/0x15c0 [ 202.169836][ T7244] __tun_chr_ioctl+0x197b/0x4880 [ 202.169892][ T7244] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 202.169957][ T7244] ? __pfx___tun_chr_ioctl+0x10/0x10 [ 202.170007][ T7244] ? __fget_files+0x34/0x3d0 [ 202.170044][ T7244] ? find_held_lock+0x2b/0x80 [ 202.170099][ T7244] ? hook_file_ioctl_common+0x140/0x440 [ 202.170172][ T7244] ? srso_alias_return_thunk+0x5/0xfbef5 [ 202.170219][ T7244] ? __fget_files+0x21f/0x3d0 [ 202.170264][ T7244] ? __pfx_tun_chr_ioctl+0x10/0x10 [ 202.170320][ T7244] __x64_sys_ioctl+0x18e/0x210 [ 202.170402][ T7244] do_syscall_64+0x123/0x790 [ 202.170471][ T7244] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 202.170516][ T7244] RIP: 0033:0x7f0e04f9e159 [ 202.170547][ T7244] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 202.170584][ T7244] RSP: 002b:00007f0e05e90028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 202.170621][ T7244] RAX: ffffffffffffffda RBX: 00007f0e05225fa0 RCX: 00007f0e04f9e159 [ 202.170647][ T7244] RDX: 0000200000000200 RSI: 00000000400454ca RDI: 0000000000000004 [ 202.170672][ T7244] RBP: 00007f0e0503506b R08: 0000000000000000 R09: 0000000000000000 [ 202.170696][ T7244] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 202.170720][ T7244] R13: 00007f0e05226038 R14: 00007f0e05225fa0 R15: 00007ffd72da7518 [ 202.170772][ T7244] [ 202.757790][ T7248] 9pnet_virtio: no channels available for device syz [ 202.776234][ T7252] loop1: detected capacity change from 0 to 128 [ 202.793457][ T7252] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 202.818517][ T7252] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 203.268705][ T7260] loop4: detected capacity change from 0 to 16 [ 203.282783][ T7260] erofs: Unknown parameter './sys' [ 203.363250][ T7260] loop4: detected capacity change from 0 to 256 [ 203.383204][ T7260] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 203.471429][ T7225] EXT4-fs error (device loop0): ext4_validate_block_bitmap:435: comm ext4lazyinit: bg 0: block 2: invalid block bitmap [ 204.019072][ T5617] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 204.537455][ T7268] bond0: (slave dummy0): Error: Device is in use and cannot be enslaved [ 204.537495][ T7268] bond0: option slaves: unable to set because the bond device is up [ 205.074068][ T7282] syz.2.523 uses obsolete (PF_INET,SOCK_PACKET) [ 205.250534][ T5854] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 205.297539][ T7255] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 205.297579][ T7255] FAT-fs (loop1): Filesystem has been set read-only [ 205.300143][ T7255] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 205.328488][ T7255] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 205.411515][ T5854] usb 5-1: Using ep0 maxpacket: 32 [ 205.415696][ T5854] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 205.417529][ T5854] usb 5-1: config 0 has no interfaces? [ 205.453613][ T5854] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.453653][ T5854] usb 5-1: Product: syz [ 205.453680][ T5854] usb 5-1: Manufacturer: syz [ 205.453706][ T5854] usb 5-1: SerialNumber: syz [ 205.515561][ T5854] usb 5-1: config 0 descriptor?? [ 205.526352][ T7292] netlink: 20 bytes leftover after parsing attributes in process `syz.5.527'. [ 206.073799][ T7303] bridge0: port 3(syz_tun) entered blocking state [ 206.073928][ T7303] bridge0: port 3(syz_tun) entered disabled state [ 206.113063][ T7303] syz_tun: entered allmulticast mode [ 206.209964][ T7303] FAULT_INJECTION: forcing a failure. [ 206.209964][ T7303] name failslab, interval 1, probability 0, space 0, times 0 [ 206.210015][ T7303] CPU: 0 UID: 0 PID: 7303 Comm: syz.5.531 Not tainted syzkaller #0 PREEMPT(full) [ 206.210063][ T7303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 206.210087][ T7303] Call Trace: [ 206.210098][ T7303] [ 206.210113][ T7303] dump_stack_lvl+0x100/0x190 [ 206.210173][ T7303] should_fail_ex.cold+0x5/0xa [ 206.210216][ T7303] ? srso_alias_return_thunk+0x5/0xfbef5 [ 206.210270][ T7303] should_failslab+0xc2/0x120 [ 206.210310][ T7303] kmem_cache_alloc_noprof+0x92/0x6a0 [ 206.210392][ T7303] ? __kernfs_new_node+0xd2/0xa10 [ 206.210450][ T7303] __kernfs_new_node+0xd2/0xa10 [ 206.210509][ T7303] ? __pfx___kernfs_new_node+0x10/0x10 [ 206.210562][ T7303] ? srso_alias_return_thunk+0x5/0xfbef5 [ 206.210608][ T7303] ? lock_acquire+0x1d1/0x380 [ 206.210645][ T7303] ? kernfs_root+0x23/0x2a0 [ 206.210687][ T7303] ? srso_alias_return_thunk+0x5/0xfbef5 [ 206.210734][ T7303] ? find_held_lock+0x2b/0x80 [ 206.210785][ T7303] ? kernfs_root+0xee/0x2a0 [ 206.210824][ T7303] ? kernfs_root+0xee/0x2a0 [ 206.210869][ T7303] ? srso_alias_return_thunk+0x5/0xfbef5 [ 206.210931][ T7303] kernfs_new_node+0x117/0x150 [ 206.210989][ T7303] __kernfs_create_file+0x53/0x350 [ 206.211061][ T7303] sysfs_add_file_mode_ns+0x207/0x3c0 [ 206.211113][ T7303] sysfs_create_file_ns+0x145/0x1e0 [ 206.211153][ T7303] ? __pfx_sysfs_create_file_ns+0x10/0x10 [ 206.211192][ T7303] ? srso_alias_return_thunk+0x5/0xfbef5 [ 206.211239][ T7303] ? kernfs_create_link+0x1bd/0x240 [ 206.211301][ T7303] ? kernfs_put+0x3f/0x60 [ 206.211344][ T7303] ? srso_alias_return_thunk+0x5/0xfbef5 [ 206.211391][ T7303] ? sysfs_do_create_link_sd+0xbb/0x140 [ 206.211441][ T7303] br_sysfs_addif+0xe4/0x210 [ 206.211493][ T7303] br_add_if+0x82c/0x1c80 [ 206.211560][ T7303] ? security_capable+0x80/0x260 [ 206.211617][ T7303] add_del_if+0x114/0x160 [ 206.211656][ T7303] br_ioctl_stub+0x384/0x4d0 [ 206.211697][ T7303] ? __pfx_br_ioctl_stub+0x10/0x10 [ 206.211748][ T7303] ? srso_alias_return_thunk+0x5/0xfbef5 [ 206.211795][ T7303] ? do_vfs_ioctl+0x226/0x13e0 [ 206.211851][ T7303] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 206.211919][ T7303] ? __pfx_br_ioctl_stub+0x10/0x10 [ 206.211959][ T7303] br_ioctl_call+0x53/0xa0 [ 206.212006][ T7303] sock_ioctl+0x616/0x6b0 [ 206.212051][ T7303] ? __pfx_sock_ioctl+0x10/0x10 [ 206.212107][ T7303] ? srso_alias_return_thunk+0x5/0xfbef5 [ 206.212154][ T7303] ? __fget_files+0x21f/0x3d0 [ 206.212199][ T7303] ? __pfx_sock_ioctl+0x10/0x10 [ 206.212245][ T7303] __x64_sys_ioctl+0x18e/0x210 [ 206.212304][ T7303] do_syscall_64+0x123/0x790 [ 206.212371][ T7303] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 206.212412][ T7303] RIP: 0033:0x7f9ab019e159 [ 206.212442][ T7303] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 206.212483][ T7303] RSP: 002b:00007f9ab1072028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 206.212520][ T7303] RAX: ffffffffffffffda RBX: 00007f9ab0425fa0 RCX: 00007f9ab019e159 [ 206.212546][ T7303] RDX: 0000200000000000 RSI: 00000000000089a2 RDI: 0000000000000004 [ 206.212571][ T7303] RBP: 00007f9ab023506b R08: 0000000000000000 R09: 0000000000000000 [ 206.212594][ T7303] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 206.212618][ T7303] R13: 00007f9ab0426038 R14: 00007f9ab0425fa0 R15: 00007ffe28a90228 [ 206.212668][ T7303] [ 206.607750][ T7303] syz_tun: left allmulticast mode [ 207.619557][ T7320] bond0: (slave dummy0): Error: Device is in use and cannot be enslaved [ 207.619595][ T7320] bond0: option slaves: unable to set because the bond device is up [ 208.005733][ T982] usb 5-1: USB disconnect, device number 6 [ 208.253890][ T7337] netlink: 20 bytes leftover after parsing attributes in process `syz.4.540'. [ 208.658195][ T7349] bond0: (slave dummy0): Error: Device is in use and cannot be enslaved [ 208.658235][ T7349] bond0: option slaves: unable to set because the bond device is up [ 208.811751][ T5753] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 209.781905][ T5753] usb 6-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 209.785605][ T5753] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 209.785654][ T5753] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 209.786836][ T5753] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 209.786884][ T5753] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 209.805864][ T7355] CIFS: Attempting to mount //127.0.0.1/share [ 209.811607][ T5753] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.811645][ T5753] usb 6-1: Product: syz [ 209.811670][ T5753] usb 6-1: Manufacturer: syz [ 209.811696][ T5753] usb 6-1: SerialNumber: syz [ 209.813473][ T7355] CIFS: VFS: Error connecting to socket. Aborting operation. [ 209.813526][ T7355] CIFS: VFS: cifs_mount failed w/return code = -111 [ 209.935783][ T5753] ti_usb_3410_5052 6-1:2.0: TI USB 5052 2 port adapter converter detected [ 209.975602][ T5753] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 209.998033][ T5753] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 210.020470][ T5752] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 210.155096][ T5854] usb 6-1: USB disconnect, device number 7 [ 210.170437][ T5752] usb 4-1: Using ep0 maxpacket: 32 [ 210.172653][ T5752] usb 4-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 210.180106][ T5752] usb 4-1: config 0 has no interfaces? [ 210.205672][ T5752] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.205713][ T5752] usb 4-1: Product: syz [ 210.205739][ T5752] usb 4-1: Manufacturer: syz [ 210.205765][ T5752] usb 4-1: SerialNumber: syz [ 210.252024][ T7371] netlink: 20 bytes leftover after parsing attributes in process `syz.4.557'. [ 210.258560][ T5752] usb 4-1: config 0 descriptor?? [ 210.278887][ T5854] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 210.317674][ T5854] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 210.325850][ T5854] ti_usb_3410_5052 6-1:2.0: device disconnected [ 210.370514][ T7375] netlink: 20 bytes leftover after parsing attributes in process `syz.4.559'. [ 210.683862][ T31] audit: type=1800 audit(1789692489.607:20): pid=7381 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.561" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 211.441975][ T5753] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 211.641732][ T5753] usb 5-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 211.643122][ T5753] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 211.643183][ T5753] usb 5-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 211.643226][ T5753] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 211.643288][ T5753] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.754025][ T5753] spcp8x5 5-1:1.0: required endpoints missing [ 211.760024][ T7387] loop5: detected capacity change from 0 to 2048 [ 211.826122][ T7387] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 211.999114][ T5632] usb 5-1: USB disconnect, device number 7 [ 212.929781][ T5753] usb 4-1: USB disconnect, device number 7 [ 212.956016][ T7403] CIFS: Attempting to mount //127.0.0.1/share [ 213.016852][ T7403] CIFS: VFS: cifs_mount failed w/return code = -112 [ 213.614721][ T7422] loop3: detected capacity change from 0 to 16 [ 213.628929][ T7422] erofs: Unknown parameter './sys' [ 213.709514][ T7422] loop3: detected capacity change from 0 to 256 [ 213.727355][ T7422] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 214.016882][ T7393] EXT4-fs error (device loop5): ext4_validate_block_bitmap:435: comm ext4lazyinit: bg 0: block 2: invalid block bitmap [ 214.465948][ T7424] binder: 7421:7424 ioctl c0306201 0 returned -14 [ 214.587381][ T31] audit: type=1800 audit(1789692493.507:21): pid=7428 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.575" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 215.503007][ T5620] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 215.950486][ T5632] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 216.017957][ T7451] CIFS: Attempting to mount //127.0.0.1/share [ 216.100485][ T5632] usb 2-1: Using ep0 maxpacket: 32 [ 216.101240][ T5632] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 216.102739][ T5632] usb 2-1: config 0 has no interfaces? [ 216.107586][ T5632] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.107624][ T5632] usb 2-1: Product: syz [ 216.107650][ T5632] usb 2-1: Manufacturer: syz [ 216.107676][ T5632] usb 2-1: SerialNumber: syz [ 216.130136][ T5628] Bluetooth: hci2: command 0x0406 tx timeout [ 216.160003][ T7451] CIFS: VFS: \\127.0.0.1 failed to create a new SMB session with Unknown: -11 [ 216.160112][ T7451] CIFS: VFS: cifs_mount failed w/return code = -11 [ 216.166136][ T7451] syz.5.584 (7451) used greatest stack depth: 19672 bytes left [ 216.198454][ T5632] usb 2-1: config 0 descriptor?? [ 216.872499][ T7476] loop3: detected capacity change from 0 to 16 [ 216.883279][ T7476] erofs: Unknown parameter './sys' [ 216.958161][ T7476] loop3: detected capacity change from 0 to 256 [ 216.974282][ T7476] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 217.739992][ T7483] binder: 7482:7483 ioctl c0306201 0 returned -14 [ 217.784425][ T7486] netlink: 8 bytes leftover after parsing attributes in process `syz.2.595'. [ 217.814918][ T7481] loop5: detected capacity change from 0 to 2048 [ 217.892889][ T7481] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 218.570896][ T1215] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 218.709283][ T7500] overlay: ./file0 is not a directory [ 218.790517][ T5632] usb 2-1: USB disconnect, device number 14 [ 218.813251][ T1215] usb 4-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 218.816528][ T1215] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 218.816578][ T1215] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 218.856126][ T1215] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 218.856180][ T1215] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 218.889387][ T1215] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.889431][ T1215] usb 4-1: Product: syz [ 218.889458][ T1215] usb 4-1: Manufacturer: syz [ 218.889484][ T1215] usb 4-1: SerialNumber: syz [ 218.921795][ T7490] EXT4-fs error (device loop5): ext4_validate_block_bitmap:435: comm ext4lazyinit: bg 0: block 2: invalid block bitmap [ 218.976196][ T1215] ti_usb_3410_5052 4-1:2.0: TI USB 5052 2 port adapter converter detected [ 219.012015][ T1215] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 219.032229][ T1215] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 219.208653][ T5632] usb 4-1: USB disconnect, device number 8 [ 219.262227][ T5632] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 219.269237][ T5632] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 219.542299][ T5632] ti_usb_3410_5052 4-1:2.0: device disconnected [ 219.703253][ T7525] loop1: detected capacity change from 0 to 16 [ 219.714888][ T7525] erofs: Unknown parameter './sys' [ 219.797299][ T7525] loop1: detected capacity change from 0 to 256 [ 219.813859][ T7525] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 220.750762][ T31] audit: type=1800 audit(1789692499.667:22): pid=7531 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.610" name=08 dev="sda1" ino=2051 res=0 errno=0 [ 221.570931][ T5620] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 221.788910][ T7544] CIFS: Attempting to mount //127.0.0.1/share [ 221.898205][ T7544] CIFS: VFS: \\127.0.0.1 Error -104 sending data on socket to server [ 221.916486][ T7544] ------------[ cut here ]------------ [ 221.916504][ T7544] server->in_flight == 0 [ 221.916516][ T7544] WARNING: fs/smb/client/smb2ops.c:104 at smb2_add_credits+0x1213/0x1790, CPU#0: syz.5.614/7544 [ 221.936983][ T7544] Modules linked in: [ 221.940973][ T7544] CPU: 0 UID: 0 PID: 7544 Comm: syz.5.614 Not tainted syzkaller #0 PREEMPT(full) [ 221.950198][ T7544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 221.960554][ T5854] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 221.960551][ T7544] RIP: 0010:smb2_add_credits+0x1213/0x1790 [ 221.975025][ T7544] Code: c6 e8 c1 65 b1 fe 84 db 0f 85 0a fb ff ff e8 a4 6b b1 fe 48 8d 3d 4d 14 f2 0d 67 48 0f b9 3a e9 f4 fa ff ff e8 8e 6b b1 fe 90 <0f> 0b 90 0f b6 05 59 8e d2 0d 31 ff 89 c6 88 44 24 28 e8 86 65 b1 [ 221.994999][ T7544] RSP: 0018:ffffc900031bf1d8 EFLAGS: 00010283 [ 222.001164][ T7544] RAX: 0000000000007af2 RBX: ffff888034e78300 RCX: ffffc9000e441000 [ 222.005804][ T7550] 9pnet_virtio: no channels available for device syz [ 222.016347][ T7544] RDX: 0000000000080000 RSI: ffffffff835aa302 RDI: ffff88802a470000 [ 222.024995][ T7544] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 [ 222.033132][ T7544] R10: 0000000000000000 R11: 0000000000000000 R12: ffffc900031bf418 [ 222.041214][ T7544] R13: 0000000000002000 R14: 0000000000000001 R15: ffff888034e78000 [ 222.049226][ T7544] FS: 00007f9ab10726c0(0000) GS:ffff888123b56000(0000) knlGS:0000000000000000 [ 222.058303][ T7544] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 222.066076][ T7544] CR2: 00007ff2145556c8 CR3: 000000002a421000 CR4: 0000000000350ef0 [ 222.074134][ T7544] Call Trace: [ 222.077447][ T7544] [ 222.080520][ T7544] ? compound_send_recv+0xe50/0x2a10 [ 222.085843][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.091581][ T7544] compound_send_recv+0x1030/0x2a10 [ 222.096843][ T7544] ? __pfx_compound_send_recv+0x10/0x10 [ 222.102512][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.108194][ T7544] ? stack_trace_save+0x8e/0xc0 [ 222.113173][ T7544] ? __pfx_stack_trace_save+0x10/0x10 [ 222.119067][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.125166][ T7544] ? __kasan_kmalloc+0xaa/0xb0 [ 222.129989][ T7544] ? __kmalloc_noprof+0x32f/0x840 [ 222.130563][ T5854] usb 5-1: Using ep0 maxpacket: 32 [ 222.131538][ T5854] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 222.132397][ T5854] usb 5-1: config 0 has no interfaces? [ 222.135072][ T5854] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.135110][ T5854] usb 5-1: Product: syz [ 222.135136][ T5854] usb 5-1: Manufacturer: syz [ 222.135162][ T5854] usb 5-1: SerialNumber: syz [ 222.140213][ T5854] usb 5-1: config 0 descriptor?? [ 222.181236][ T7544] ? build_ntlmssp_smb3_negotiate_blob+0x40/0x5c0 [ 222.187713][ T7544] ? SMB2_sess_auth_rawntlmssp_negotiate+0x2a4/0xbf0 [ 222.194559][ T7544] cifs_send_recv+0x43/0x60 [ 222.199094][ T7544] SMB2_sess_sendreceive+0x235/0x950 [ 222.204521][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.210187][ T7544] ? rcu_is_watching+0x13/0xc0 [ 222.215012][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.221233][ T7544] ? __pfx_SMB2_sess_sendreceive+0x10/0x10 [ 222.227097][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.233207][ T7544] ? __kmalloc_noprof+0x350/0x840 [ 222.238285][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.243978][ T7544] ? __asan_memcpy+0x3c/0x60 [ 222.248606][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.254297][ T7544] ? build_ntlmssp_smb3_negotiate_blob+0x44c/0x5c0 [ 222.260908][ T7544] SMB2_sess_auth_rawntlmssp_negotiate+0x775/0xbf0 [ 222.267427][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.273164][ T7544] ? __pfx_SMB2_sess_auth_rawntlmssp_negotiate+0x10/0x10 [ 222.280216][ T7544] ? __entry_text_end+0xfdf61/0x102039 [ 222.285819][ T7544] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 222.291462][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.297130][ T7544] ? SMB2_sess_setup+0xb8/0x640 [ 222.302090][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.307767][ T7544] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 222.313776][ T7544] ? __pfx_SMB2_sess_auth_rawntlmssp_negotiate+0x10/0x10 [ 222.321358][ T7544] SMB2_sess_setup+0x314/0x640 [ 222.326157][ T7544] ? __pfx_SMB2_sess_setup+0x10/0x10 [ 222.331894][ T7544] cifs_setup_session+0x434/0xfe0 [ 222.336968][ T7544] cifs_get_smb_ses+0x1813/0x2170 [ 222.342126][ T7544] cifs_mount_get_session+0xf8/0x460 [ 222.347454][ T7544] dfs_mount_share+0x200/0x1e20 [ 222.352406][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.358070][ T7544] ? do_raw_spin_lock+0x128/0x260 [ 222.363205][ T7544] ? __pfx_dfs_mount_share+0x10/0x10 [ 222.368542][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.374236][ T7544] ? __lock_acquire+0x5c0/0x1f40 [ 222.379196][ T7544] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 222.385101][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.390811][ T7544] ? lockdep_hardirqs_on+0x7d/0x110 [ 222.396038][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.401745][ T7544] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 222.407595][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.413299][ T7544] ? __debug_object_init+0x2de/0x3d0 [ 222.418621][ T7544] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 222.424970][ T7544] cifs_mount+0xc4/0xdb0 [ 222.429251][ T7544] ? find_held_lock+0x2b/0x80 [ 222.434360][ T7544] ? find_nls+0x125/0x170 [ 222.438758][ T7544] ? find_nls+0x125/0x170 [ 222.443202][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.448885][ T7544] ? __pfx_cifs_mount+0x10/0x10 [ 222.453874][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.459546][ T7544] ? do_raw_spin_unlock+0x145/0x1e0 [ 222.464815][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.470547][ T7544] ? cifs_setup_cifs_sb+0x519/0x8d0 [ 222.475764][ T7544] cifs_smb3_do_mount+0x2c0/0x1b10 [ 222.480998][ T7544] ? __pfx_cifs_smb3_do_mount+0x10/0x10 [ 222.486584][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.492305][ T7544] ? rcu_is_watching+0x13/0xc0 [ 222.497129][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.502849][ T7544] smb3_get_tree+0x1fd/0x440 [ 222.507478][ T7544] vfs_get_tree+0x92/0x320 [ 222.512006][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.517674][ T7544] path_mount+0x7d0/0x24c0 [ 222.522201][ T7544] ? __pfx_path_mount+0x10/0x10 [ 222.527585][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.533648][ T7544] ? lockdep_hardirqs_on+0x7d/0x110 [ 222.538912][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.544625][ T7544] ? kmem_cache_free+0x127/0x6c0 [ 222.549613][ T7544] ? __x64_sys_mount+0x293/0x310 [ 222.554651][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.560319][ T7544] __x64_sys_mount+0x293/0x310 [ 222.565243][ T7544] ? __pfx___x64_sys_mount+0x10/0x10 [ 222.570646][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.576359][ T7544] do_syscall_64+0x123/0x790 [ 222.581094][ T7544] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 222.587038][ T7544] RIP: 0033:0x7f9ab019e159 [ 222.591543][ T7544] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 222.611260][ T7544] RSP: 002b:00007f9ab1072028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 222.619686][ T7544] RAX: ffffffffffffffda RBX: 00007f9ab0425fa0 RCX: 00007f9ab019e159 [ 222.627758][ T7544] RDX: 0000200000000200 RSI: 0000200000000100 RDI: 0000200000000500 [ 222.636194][ T7544] RBP: 00007f9ab023506b R08: 0000200000000300 R09: 0000000000000000 [ 222.644572][ T7544] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 222.652614][ T7544] R13: 00007f9ab0426038 R14: 00007f9ab0425fa0 R15: 00007ffe28a90228 [ 222.660712][ T7544] [ 222.663742][ T7544] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 222.671017][ T7544] CPU: 0 UID: 0 PID: 7544 Comm: syz.5.614 Not tainted syzkaller #0 PREEMPT(full) [ 222.680214][ T7544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 222.690264][ T7544] Call Trace: [ 222.693537][ T7544] [ 222.696465][ T7544] dump_stack_lvl+0x100/0x190 [ 222.701187][ T7544] vpanic+0x553/0x970 [ 222.705180][ T7544] ? __pfx_vpanic+0x10/0x10 [ 222.709716][ T7544] panic+0xd1/0xe0 [ 222.713443][ T7544] ? __pfx_panic+0x10/0x10 [ 222.717889][ T7544] check_panic_on_warn.cold+0x19/0x34 [ 222.723273][ T7544] ? smb2_add_credits+0x1213/0x1790 [ 222.728507][ T7544] __warn.cold+0x191/0x318 [ 222.732954][ T7544] __report_bug+0x30f/0x440 [ 222.737510][ T7544] ? smb2_add_credits+0x1213/0x1790 [ 222.742738][ T7544] ? __pfx___report_bug+0x10/0x10 [ 222.747806][ T7544] ? lockdep_hardirqs_on+0x7d/0x110 [ 222.753050][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.758711][ T7544] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 222.764559][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.770225][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.775895][ T7544] ? __lock_acquire+0x5c0/0x1f40 [ 222.780860][ T7544] ? smb2_add_credits+0x1213/0x1790 [ 222.786087][ T7544] report_bug+0xb3/0x220 [ 222.790386][ T7544] ? smb2_add_credits+0x1213/0x1790 [ 222.795612][ T7544] handle_bug+0x16a/0x2a0 [ 222.799965][ T7544] exc_invalid_op+0x17/0x50 [ 222.804492][ T7544] asm_exc_invalid_op+0x1a/0x20 [ 222.809363][ T7544] RIP: 0010:smb2_add_credits+0x1213/0x1790 [ 222.815197][ T7544] Code: c6 e8 c1 65 b1 fe 84 db 0f 85 0a fb ff ff e8 a4 6b b1 fe 48 8d 3d 4d 14 f2 0d 67 48 0f b9 3a e9 f4 fa ff ff e8 8e 6b b1 fe 90 <0f> 0b 90 0f b6 05 59 8e d2 0d 31 ff 89 c6 88 44 24 28 e8 86 65 b1 [ 222.834828][ T7544] RSP: 0018:ffffc900031bf1d8 EFLAGS: 00010283 [ 222.840945][ T7544] RAX: 0000000000007af2 RBX: ffff888034e78300 RCX: ffffc9000e441000 [ 222.848929][ T7544] RDX: 0000000000080000 RSI: ffffffff835aa302 RDI: ffff88802a470000 [ 222.856911][ T7544] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 [ 222.864895][ T7544] R10: 0000000000000000 R11: 0000000000000000 R12: ffffc900031bf418 [ 222.872879][ T7544] R13: 0000000000002000 R14: 0000000000000001 R15: ffff888034e78000 [ 222.880883][ T7544] ? smb2_add_credits+0x1212/0x1790 [ 222.886114][ T7544] ? smb2_add_credits+0x1212/0x1790 [ 222.891337][ T7544] ? compound_send_recv+0xe50/0x2a10 [ 222.896647][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.902314][ T7544] compound_send_recv+0x1030/0x2a10 [ 222.907570][ T7544] ? __pfx_compound_send_recv+0x10/0x10 [ 222.913141][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.918799][ T7544] ? stack_trace_save+0x8e/0xc0 [ 222.923691][ T7544] ? __pfx_stack_trace_save+0x10/0x10 [ 222.929109][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.934791][ T7544] ? __kasan_kmalloc+0xaa/0xb0 [ 222.939594][ T7544] ? __kmalloc_noprof+0x32f/0x840 [ 222.944660][ T7544] ? build_ntlmssp_smb3_negotiate_blob+0x40/0x5c0 [ 222.951111][ T7544] ? SMB2_sess_auth_rawntlmssp_negotiate+0x2a4/0xbf0 [ 222.957851][ T7544] cifs_send_recv+0x43/0x60 [ 222.962391][ T7544] SMB2_sess_sendreceive+0x235/0x950 [ 222.967721][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.973381][ T7544] ? rcu_is_watching+0x13/0xc0 [ 222.978174][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.983834][ T7544] ? __pfx_SMB2_sess_sendreceive+0x10/0x10 [ 222.989691][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 222.995347][ T7544] ? __kmalloc_noprof+0x350/0x840 [ 223.000416][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.006079][ T7544] ? __asan_memcpy+0x3c/0x60 [ 223.010711][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.016370][ T7544] ? build_ntlmssp_smb3_negotiate_blob+0x44c/0x5c0 [ 223.022922][ T7544] SMB2_sess_auth_rawntlmssp_negotiate+0x775/0xbf0 [ 223.029448][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.035109][ T7544] ? __pfx_SMB2_sess_auth_rawntlmssp_negotiate+0x10/0x10 [ 223.042165][ T7544] ? __entry_text_end+0xfdf61/0x102039 [ 223.047656][ T7544] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 223.053227][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.058885][ T7544] ? SMB2_sess_setup+0xb8/0x640 [ 223.063749][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.069403][ T7544] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 223.075314][ T7544] ? __pfx_SMB2_sess_auth_rawntlmssp_negotiate+0x10/0x10 [ 223.082361][ T7544] SMB2_sess_setup+0x314/0x640 [ 223.087148][ T7544] ? __pfx_SMB2_sess_setup+0x10/0x10 [ 223.092450][ T7544] cifs_setup_session+0x434/0xfe0 [ 223.097511][ T7544] cifs_get_smb_ses+0x1813/0x2170 [ 223.102575][ T7544] cifs_mount_get_session+0xf8/0x460 [ 223.107897][ T7544] dfs_mount_share+0x200/0x1e20 [ 223.112793][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.118477][ T7544] ? do_raw_spin_lock+0x128/0x260 [ 223.123527][ T7544] ? __pfx_dfs_mount_share+0x10/0x10 [ 223.128849][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.134507][ T7544] ? __lock_acquire+0x5c0/0x1f40 [ 223.139465][ T7544] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 223.145303][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.150961][ T7544] ? lockdep_hardirqs_on+0x7d/0x110 [ 223.156197][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.161854][ T7544] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 223.167697][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.173352][ T7544] ? __debug_object_init+0x2de/0x3d0 [ 223.178674][ T7544] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 223.184529][ T7544] cifs_mount+0xc4/0xdb0 [ 223.188798][ T7544] ? find_held_lock+0x2b/0x80 [ 223.193505][ T7544] ? find_nls+0x125/0x170 [ 223.197848][ T7544] ? find_nls+0x125/0x170 [ 223.202193][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.207849][ T7544] ? __pfx_cifs_mount+0x10/0x10 [ 223.212729][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.218382][ T7544] ? do_raw_spin_unlock+0x145/0x1e0 [ 223.223618][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.229281][ T7544] ? cifs_setup_cifs_sb+0x519/0x8d0 [ 223.234524][ T7544] cifs_smb3_do_mount+0x2c0/0x1b10 [ 223.239682][ T7544] ? __pfx_cifs_smb3_do_mount+0x10/0x10 [ 223.245263][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.250934][ T7544] ? rcu_is_watching+0x13/0xc0 [ 223.255723][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.261400][ T7544] smb3_get_tree+0x1fd/0x440 [ 223.266014][ T7544] vfs_get_tree+0x92/0x320 [ 223.270459][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.276126][ T7544] path_mount+0x7d0/0x24c0 [ 223.280584][ T7544] ? __pfx_path_mount+0x10/0x10 [ 223.285465][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.291119][ T7544] ? lockdep_hardirqs_on+0x7d/0x110 [ 223.296360][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.302017][ T7544] ? kmem_cache_free+0x127/0x6c0 [ 223.306994][ T7544] ? __x64_sys_mount+0x293/0x310 [ 223.311955][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.317613][ T7544] __x64_sys_mount+0x293/0x310 [ 223.322408][ T7544] ? __pfx___x64_sys_mount+0x10/0x10 [ 223.327732][ T7544] ? srso_alias_return_thunk+0x5/0xfbef5 [ 223.333399][ T7544] do_syscall_64+0x123/0x790 [ 223.338035][ T7544] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 223.343956][ T7544] RIP: 0033:0x7f9ab019e159 [ 223.348385][ T7544] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 223.368040][ T7544] RSP: 002b:00007f9ab1072028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 223.376473][ T7544] RAX: ffffffffffffffda RBX: 00007f9ab0425fa0 RCX: 00007f9ab019e159 [ 223.384458][ T7544] RDX: 0000200000000200 RSI: 0000200000000100 RDI: 0000200000000500 [ 223.392442][ T7544] RBP: 00007f9ab023506b R08: 0000200000000300 R09: 0000000000000000 [ 223.400458][ T7544] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 223.408436][ T7544] R13: 00007f9ab0426038 R14: 00007f9ab0425fa0 R15: 00007ffe28a90228 [ 223.416439][ T7544] [ 223.419679][ T7544] Kernel Offset: disabled [ 223.423995][ T7544] Rebooting in 86400 seconds..