last executing test programs: 5m54.042632294s ago: executing program 0 (id=26): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000000)="fc0000001d000724ab09254ec100070007ab08001b000000f0ffff002100057e0000000000000e000039000000039815fad151ba0101099cecb94b46fe0000000a00020025", 0xffffff0c) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r1, 0x0, 0xffffffffffff8000, 0x0) close(r3) close(r0) 5m53.645292692s ago: executing program 0 (id=27): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000ac0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_USERDATA={0x4}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4008810}, 0x40) 5m53.449911192s ago: executing program 0 (id=28): r0 = open(&(0x7f0000000600)='./file0\x00', 0x1e1142, 0xfb) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)="ba5cf706618b40b0d0024215d56483b9deb7c3755238043c8e68323888b9861847c7c84039027de0b8f728bd6e4489aafaf46ad20bffe05a8b3b0676e2364174018476e2cbb7329745766c53a3a1706726b2", 0x52}, {&(0x7f00000003c0)="22517920d1", 0x5}], 0x2) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'crc32c-generic\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x80000) sendfile(r2, r0, &(0x7f0000000280)=0x7, 0xff9) 5m53.293066289s ago: executing program 0 (id=29): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x200) 5m53.05573569s ago: executing program 0 (id=30): prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r0 = epoll_create1(0x80000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0x1, 0x7, 0x7fffffff}]}) epoll_pwait2(r0, &(0x7f0000000180)=[{}], 0x1, &(0x7f00000001c0)={0x0, 0x3938700}, 0x0, 0x0) 5m52.497971176s ago: executing program 0 (id=34): rt_sigprocmask(0x0, &(0x7f0000000100)={[0xfffffffffffe]}, 0x0, 0x8) r0 = gettid() timer_create(0x2, &(0x7f0000000040)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000080)=0x0) timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000140)={{0x77359400}, {0x0, 0xe4c}}, 0x0) timer_settime(r1, 0x0, &(0x7f00000000c0), 0x0) rt_sigtimedwait(&(0x7f0000000240)={[0xffffffffffffffff]}, 0x0, 0x0, 0x8) 5m51.917326413s ago: executing program 32 (id=34): rt_sigprocmask(0x0, &(0x7f0000000100)={[0xfffffffffffe]}, 0x0, 0x8) r0 = gettid() timer_create(0x2, &(0x7f0000000040)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000080)=0x0) timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000140)={{0x77359400}, {0x0, 0xe4c}}, 0x0) timer_settime(r1, 0x0, &(0x7f00000000c0), 0x0) rt_sigtimedwait(&(0x7f0000000240)={[0xffffffffffffffff]}, 0x0, 0x0, 0x8) 5m51.904384644s ago: executing program 2 (id=37): r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x129942, 0x18) fcntl$setlease(r0, 0x400, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/locks\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x80140, 0x10) pread64(r1, &(0x7f00000000c0)=""/23, 0x17, 0x1) 5m50.948439148s ago: executing program 2 (id=44): bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xc, 0x1d, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000005000000000000000500000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000050000008500000006000000b7080000000000007b8af8ff00000000b7080000010000007b8af0ff00000000bfa100000000000007010000f8ffffffbf"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r1, 0x11c, 0x2, &(0x7f00000000c0)=""/141, &(0x7f0000000080)=0x8d) 5m50.68761766s ago: executing program 2 (id=46): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f00000000c0)=@gettaction={0x3c, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x80000000}]}, 0x3c}}, 0x0) r1 = socket(0x10, 0x803, 0x0) setresgid(0xee01, 0xffffffffffffffff, 0xffffffffffffffff) setregid(0xffffffffffffffff, 0x0) sendmsg$IPSET_CMD_RENAME(r1, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000b00)={0x14, 0x5, 0x6, 0x5, 0x0, 0x0, {0x7, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x5) 5m50.515105649s ago: executing program 2 (id=47): syz_mount_image$ext4(&(0x7f00000005c0)='ext4\x00', &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xc0ed000e, &(0x7f00000013c0)={[{@jqfmt_vfsold}, {@jqfmt_vfsv0}, {@min_batch_time={'min_batch_time', 0x3d, 0x3ff}}, {@noload}, {@grpjquota_path={'grpjquota', 0x3d, '.'}}, {@noblock_validity}, {@resgid}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000}}, {@errors_continue}]}, 0xfa, 0x491, &(0x7f0000000f00)="$eJzs3c9vFFUcAPDvTLulgNiK+AMEqaKR+KOl5YccvGg04aCJiR4wnmpbSKVQQ2sihGj1gEdD4p149S8wnvRi1IsmXvVuSIjhAuJlzezMQGl32y3dsqX7+SS7fW/mte99Z+Z13ryZbgPoWAPZWxLxQET8GRF9efbOAgP5lxvXLoz9e+3CWBLV6jv/JLVy169dGCuLlt+3Nc9Uq0V+U516L74fMTo1NXG2yA/Nnv5oaObc+ZcmT4+enDg5cWbk6NFDB/f0HBk53JI4s7iu7/p0evfOY+9demvs+KUPfknSyOOOBXG0ykC+det6ttWVtdm2eemkO3vvLXJ7fyuX993zVrGcrojIdlel1v/7ois231rXF2980dbGAWuqWq1W652fC3NVYANLot0tANqjPNFn17/l6x4NPdaFq6/mF0BZ3DeKV76mO9I8sbey4Pq2lQYi4vjczcvZK9ZoHgIAYL4fsvHPi/XGf2k8mid6srcHi/n7/oh4KCK2R8TDEbEjIh6JqJV9LCIeX2H9C++QLB7/pFfuOrgmZOO/V4p7W3eO/9KySH9XkdtWi7+SnJicmjhQbJP9Udl0YjKZGF6ijh9f/+OrRutq479yMD5383JWfzkWLNpxpXvBBN346OzoamKe7+rnEbu668Wf1O4LRHFfb2dE7LrLOiaf7264bv7493jd+JfQ+Mc2rfpNxHP5/p+LBfGXkob3J4dfPjJyeKg3piYODJVHxWK//n7x7Ub1ryr+Fsj2/5a6x/+t+PuT3oiZc+dP1e7Xzqy8jot/fdnwmmb5+O84/o9tK47/nuTd2oKeYsUno7OzZ4cjepI3Fy8fuf3TynxZPot//776/X973N4ST0TE7ojYExFPZheFRdufioinI2LfEvH//NozH648/vqz8pUl6rkbWfzjy+3/mL//V57oOvXT98vH3xsRjfb/oVpqf7Gkmd9/zTZwNdsOAAAA7hf5M/BJOng7nQwO5s/w74gt6dT0zOwLJ6Y/PjOePyvfH5W0nOnqmzcfOlzMDZf5kQX5g8W88dddm2v5wbHpqfF2Bw8dbuui/p+mWf/P/N3V7tYBa64F99GA+5T+D51L/4fOlCzb/1v9yBGwnjj/Q+eq1/8/a1h68Ls1bQxwTzn/Q+dqov/P5V8ajwqA+5PzP3Qu/R86UsO/jU9X9Sf/LU3s+TZv61Jl/is+QmW9tHnjJyJdF83Y+Inupj/MolGisrgvV4t/xpAt2VT3u9r6awkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKBl/g8AAP//RrLleA==") syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f0000000240)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000080)=""/234, 0xea) 5m49.667554048s ago: executing program 2 (id=52): mkdir(&(0x7f0000000000)='./file0\x00', 0x130) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_inode_hardlimit=1']) chdir(&(0x7f0000000100)='./file0\x00') setresuid(0x0, 0xee01, 0x0) creat(&(0x7f0000000400)='./bus\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) 5m45.617858377s ago: executing program 2 (id=70): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x2000c015}, 0x2404c8c0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0xd, 0x20000000000000bb, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb714000008"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a600000000000000500000014000500200100000000000000000300000000001c00090008000000", @ANYRES32=r0], 0x4c}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 5m45.051091264s ago: executing program 33 (id=70): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x2000c015}, 0x2404c8c0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0xd, 0x20000000000000bb, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb714000008"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a600000000000000500000014000500200100000000000000000300000000001c00090008000000", @ANYRES32=r0], 0x4c}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 3m40.195406048s ago: executing program 3 (id=770): r0 = socket(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)=ANY=[@ANYBLOB="1400000010000100ffef0000000000000300000a440000000c0a010100000000000000000a0000060900020073797a3100000000090087bf485a2b903cc71542f23742f79a0171c5797a3100000000801400008004000180"], 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000010011a801000f4800400058008000900000000000800038030000180050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d80500060000000000130002006272696467655f736c6176655f30000007000200293a00000500060000000000080001000000000018000180140004004d2906d0880fc8acc30fe2020f9849675000018014000500a1085e7df341b9dc3d8008a2fe5bdaad140004009c7e472c916020fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af080001000000000008000100000000006000018005000600000000000500060000000000080001000000000005000600000000000c00020073797a746e6c30000800010000000000130002006272696467655f736c6176655f30000014000500e078d277f38ed3a40a448f3f6b6763e83c000c8008002c"], 0x270}}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 3m39.958042489s ago: executing program 3 (id=772): rt_sigprocmask(0x0, &(0x7f0000000040)={[0xfbfffffffffffffd]}, 0x0, 0x8) r0 = gettid() prlimit64(0x0, 0xb, &(0x7f0000000000)={0x0, 0x6}, 0x0) r1 = gettid() tkill(r1, 0x14) tkill(r0, 0x12) 3m39.839886055s ago: executing program 3 (id=773): socket$inet_icmp_raw(0x2, 0x3, 0x1) preadv(0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FD_FRAMES(r0, 0x65, 0x5, 0x0, 0x0) 3m39.674986392s ago: executing program 3 (id=775): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) chdir(&(0x7f0000000200)='./file0/file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) mount(0x0, &(0x7f00000000c0)='./file0/../file0\x00', &(0x7f0000000000)='sysfs\x00', 0x1214040, 0x0) 3m39.4986871s ago: executing program 3 (id=776): syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f00000000c0)='./bus\x00', 0x1001a, &(0x7f0000000b00)={[{@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x80000000}}, {@nojournal_checksum}, {@inlinecrypt}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@nogrpid}, {@jqfmt_vfsv1}, {@errors_remount}, {@journal_dev={'journal_dev', 0x3d, 0x80000001}}]}, 0xff, 0x439, &(0x7f00000004c0)="$eJzs20tvG0UcAPD/rp30TUIpjz6AQEFEPJImLdADQgKBxAUJCQ7lGJK0KnUb1ASJVhEEhLiiStwRRyQ+ASe4IOCExJUPgCpVKJcWTkZr7yaO4zycOnHAv5+09czuuDN/74w9u5MNoGcNZf8kEQcj4o+IGKhnVxYYqr/cWZyf/HtxfjKJavXtv5JauduL85NF0eJ9B/LMcBqRfp7E8Rb1zl67fmmiUpm+mufL+etzFy9PXJi+MH1l/OzZM6fHXnxh/PmOxJm16faxj2dOHH3j3RtvTp678d4v3yVF/E1xdMjQy+scfLJa7XB13XWoIZ2Uu9gQ2lLKx15fbfwPRCmWT95AvP5ZVxsHbKtqtVo9sPbhhSrwP5ZEt1sAdEfxQ59d/xbbDk09doVbr9QvgLK47+Rb/Ug50rxMX9P1bScNRcS5hX++zrbYnvsQAAAr/JDNf55tNf9L44GGcvfka0ODEXFvRByOiPsi4khE3B9RK/tgRDzUZv1DTfnV85/05pYC26Rs/vdSvra1cv5XzP5isJTnDtXi70vOX6xMn8o/k+Ho25Plx9ap48fXfv9yrWON879sy+ov5oJ5O26W96x8z9TE3MTdxNzo1qcRx8qt4k+WVgKSiDgaEce2WMfFp789sdaxjeNfRwfWmarfRDxVP/8L0RR/IUuNzl3+YHT22vUW65Oje6MyfWq06BWr/frbF2+tVf9dxd8B2fnf37L/L8U/mDSu18629//v2eD4Vvt/f/JOLd2f7/toYm7u6lhE/6WVnaK2f3x1viifxT98svX4PxzLn8TxiMg68cMR8UhEPJq3/bGIeDwiTq4T48+vPvH+1uPfXln8U22d/+VEfzTvaZ0oXfrp+9jbUOlgO/Fn5/9MLTWc79nM999m2tV+bwYAAID/pjQiDkaSjiyl03RkpP738kdif1qZmZ175vzMh1em6s8IDEZfWtzpGmi4HzqWX9YX+fGm/On8vvFXpX21/MjkTGWq28FDjzuwxvjP/FnqduuAbed5Lehdxj/0LuMfepfxD72rxfjf1412ADuv1e//J11oB7Dzmsa/ZT/oIa7/oXcZ/9C7jH/oSbP7YuOH5CUkViUi3RXN2MZEUt4VzehSotvfTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ3xbwAAAP//Eg/hCA==") chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x2) syz_mount_image$nilfs2(&(0x7f0000000180), &(0x7f0000000300)='./file3\x00', 0x400, &(0x7f0000000240)=ANY=[], 0x1, 0xadc, &(0x7f0000001900)="$eJzs3V2IXFcBAOBzd3c2u2lrpjW1axrbpNW2/nTTbNb4EzQpCYKhKeJLofgS0rQGYwQrqKXQJE++2VJS8MkffOpLqSJYEAl98qVgA0XoUxX0oSFiwYcaTUayc87MnZOZzMxmd+7O7vfB3TPnnnPnnDt75879O+cEYMOaWPq7uDhXhHDujZcPvf/AP2avzdnfylFf+jtVitVCCEWMT2Xv995kM7zywfPHuoVFWFj6m+Lh8UutZW8JIZwOO8L5UA/bzl146a2Fx46cOXx259uv7ru4OmsPAAAbyzfO71u8869/vvv2y6/dcyBsas1Px+f1NGOmedx/IB74p+P/idAZL0pT2XSWbypOE7Od+Sa75CuXU8vyTfUofzorv9Yj36Zw4/InS/O6rTeMs7Qd10MxMR9C2NyKT0zMzzfPycPSef10MX/qxMmnn62oosCK+/e9IYQdpeng2c74Wpv2r4E6LHNqrIE6jOV0YHRlXW40Vb7OI5oaW6reAwE05fcLr3M6v7Jwc1rvNjVY+Zcenei+PKyAUW//Q5U/XXH5Qfm/PmOPw8pZr1tTWq/0Pbo1xvP7CPnzS6/8oXO5tvxOR+fc/H5EbcB69rqPMC73F3rVc3LE9ViuXvXPt4v16isxTJ/DVztS7+34/uT/03H5HwPdfZhf/zeZTGt7Ch3x2s28V6Pi/Q+wduXPzTXS/dEof64vT9/UJ32mT/psn/TNfdJv6ZMOG9lvf/DT8GLRvt6Vn9MPez08XWe7LYYfGbI++fXIYcvPn/sd1s2Wnz9PDGvZ748+cfyLTz15ofn8f9Ha/q/G7T2dbtTjd+t8zJCuF+bX1VvP/tc7y5noke+OrD63dcm/9HprZ75ia/t9Qmk/c1095jqX29Ir3/bOfPUs32ycZrL65scnm7Pl0vFH2q+mz2sqW99ath7TWT3SfuX2GOb1gOVI22N6/r/dHqD5/H/aPudCrXj6xMnjj8R42k7/NFnbdG3+7hHXG1g5vb7/6fdrLnS2/7m1Nb82Ud4vbGnPL5r7hdfj+3XOX2iVU5pf+lFLv3Pfnpxdyj9/7Hsnn1qF9YaN7NkfP/edoydPHv++F8t+8bW1UY1hXqTTlrVSHy+GfbFjtYuoeMcErLpdLzQPAh4+8d2jzxx/5vipPXv37llY2PulPYu7lo7rd5WP7stOV1BbYCW1f/SrrgkAAAAAAAAAAAAwqB8ePnThnTe/8G6z/X+7/V9q/5+e/E3t/3+Stf/P28mndvCpHeDtXdKX8mQdrE5n+Wpx+mhW39QNQPFCM7wzW+5jMWyN4xfb/6fi8n5dU33uyubXekSz7gSu6y9lOuuDJB8v8L4Yno3hrwJUqJjtPjuGN+jfuviwtK2n/ilKTXgb+gceH+n/lvdflNp/d+3XqUt7bcbLKFosVr2OQHf/3FD9f/+rveKV18XUe5oabXk/27jbRKPnUfqgI9gArIyqx//8e2iWm65/nvrj12euTSnbpUc795d5/6UwjL+80xlf6+NPrnb5+bh9oy6/6vUf9fifrfHv4v4v7fd67/+yEfPqyyv3Pz+/+G6p2LBt0PLz9U/9QG8drvzLsfy0Ng+Gwcpv/DIrP78hNKD/ZuVvHrD869Z/+/LK/18sP31sD90/aPnNGhcTnfWYzdYj3f/LrxsnV7L1T3173qD8bz7Xbf2XOVDj1Vg+bGTjMs7ssLLjiNZBe7/xf4f9/b/Z8X9blc12a/lzGJ+P8bQjTs855OOdDFv/9HxF+h24M3v/os/vm/F/x9uXY9jv+5DG/03bYz3+5JfiS59lite6fLbrdV8D4+q9DXX/b1TTxeZp0PKWn6m+/qYhpsbkMpZrPWdVcf0bjcbqXtDqo9LCqfzzr/ruc9XnKfdVXH4/+fi/+TF8Pv5vnp6P/5un5+P/5umz8T/0fo/0fPzffHvOx//N0+/K3jcfH3iuT/rHu6QXoZ2+rfvyrdP2u/u8//Y+6Z/ok76zlb6/I0dKv+eGy7fz9Xr/O/qk398n/ZN90j/VJ/2BPukPldLLY0Cn9E9nyxdZ+nqX9j+9Pj9g/crb5/n+w8aR7v/0+v5vbadPl7OMtpbAanjltd0Hn/zNt+rN9v/Tresh6T7egRivxXOjH8V4ft87lOLX0t6M8b9l6VVfbwLa8v4z8t//B/ukA+MrPefl+w0bUDHTfXYM+/Vb1es4n/HymRh+Noafi+HDMZyP4a4Y7o7hwojqx+o4+Prv9r1YtM/3t2Tpgz5PnrcH6ugnKoSwZ8D65NcHhn2ePe/Hb1g3W/4ym4MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABUZmLp7+LiXBHCuTdePvTEkRO7rs3Z38pRX/o7VYrVWsuF8EgMJ2P4i/jiygfPHyuHV2NYhIVQhKI1Pzx+qVXSLSGE02FHOB/qYdu5Cy+9tfDYkTOHz+58+9V9F1fvEwAAAID17/8BAAD//092Bzk=") mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='A\x00', 0x1ff) getdents64(r0, 0x0, 0x0) 3m39.122045898s ago: executing program 3 (id=778): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x10008, &(0x7f0000000080)={[{@nombcache}, {@nogrpid}]}, 0xff, 0x49e, &(0x7f0000000f40)="$eJzs3M9vFFUcAPDvbH/Qyo9WRBQEraCR+KOlBZWDBzSaeNDERA94rG1BZKGG1gRIo8UYPBoS78ajiX+BNy9GPRgTr5p4NCREe6F4qpmdGbpsd0u3tF3pfj7Jdt+bH/ved+a93TcznQmgbQ2kf5KIbRHxe0T0ZdnbFxjI3ubnZsZuzs2MJbGw8PbfSWW5G3MzY8WixXpb88yhUkTpsySOJ0vLnbp46cxouTxxPs8PTZ/9cGjq4qXnTp8dPTVxauLcyLFjR48Mv/jCyPNrEmca1429H0/u2/P6u1ffHDtx9b2fvk2rtXt/Nr86jju6WSegOgbSrfbPQkXtvCebqPu9YHtVOulsYUVoSkdEpLurq9L/+6IjFndeX7z2aUsrB6yr9LdpS+PZswvAJpZEq2sAtEbxQ58e/xavDRp6/C9cfzmiO0/Pz82Mzd+KvzNK+fSudSx/ICJOzP77VfqKZs9DAACsQmVs82y98V8pdlfes2sdO/JrKP0RcX9E7IyIByJiV0Q8GFFZ9qGIeDhbeaFvheUP1OSXjn9K1+rWeY2k47+XqsZ+81Xx52/9HXlueyX+ruTk6fLE4XybHIquLWl+eJkyvn/1ty8azase/6WvtPxiLJhX4FpnzQm68dHp0bXaCNcvR+ztrBd/cutKQNoC9kTE3uY+ekeROP30N/saLXTn+JexBteZFr6OeCrb/7NRE38hWf765FBPlCcODxWtYqmff73yVqPy7yr+NXD9wCNZYnH/1yxR1dDK5YnzU82XceWPzxse06y2/Xcn71T65C/vZ9MujE5Pnx+O6E7eqOSLY7rK9JHFdS+MTvem+WL5tP0fOli//+/M10n3f7qV0ka8PyIejYjH8ro/HhEHIuLgMvH/+MoTHywTfxJJtG7/X44Yr/v9d6v99yfV1+tXkeg488N3ja6Yr2z/H43ZyndtpvL9dwcrreBdbj4AAAC4J5QiYlskpcEsPbAtSqXBwex/+HfFfaXy5NT0MycnPzo3nt0j0B9dpeJMV1/V+dDhZDb/xCw/kp8rLuYfyc8bf9nRW8kPjk2Wx1scO7S7rbf3/yj6f+qvjlbXDlh37teC9lXb/0stqgew8Vby++9YADan2/t/T/qnt1V1ATaW439oX/X6/yc1eeN/2JyW9v8/6zyyDtiMjP+hfen/0L70f2hLzdzOH8cbzeqJiGYeC1DcLLD6pwr0rPgO/3ZJFE+8WM+yeuPSme58SpRaFGlHk41tUyTSHrOxhS4+QwUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBe9l8AAAD//3ow3kU=") mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x109342, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000340)={'#! ', './file0', [], 0xa, "631e1db8171cd5ec6f4866917664aeec79d6df583b6ee2895fe9a149818483f39c93a1ff5d2334d0cecd4aeb5ef628af152fc9014ea9503c4ef00917d9eef7e15c9b7a1d14f5c54361657d8560855cb21c203a99e2dc14d695961bbf577fc76ed5bc616ea0c782243c0272cdd6e0b15ee1b486f46954c22cd4237eed8ae3ff77a56e66e3f95daf76e2a286db73630adc3443585d402a6c9ed2ed2d4a63f6383cc36c30d9d9d963ad628295521c794e29c9620da2f73bad201961f134755a9253ad0abf66bab6c936d2e07b6998b07a35592a64cd4b530894e060aabea18c4abeeeb5ce3d2636591802b468817627978e32814b014ba33f201baf669d5649f0b89c920e00000000"}, 0xfffffcaa) pwrite64(r0, &(0x7f0000000300)='2', 0x1, 0x8080c60) 3m38.823326852s ago: executing program 34 (id=778): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x10008, &(0x7f0000000080)={[{@nombcache}, {@nogrpid}]}, 0xff, 0x49e, &(0x7f0000000f40)="$eJzs3M9vFFUcAPDvbH/Qyo9WRBQEraCR+KOlBZWDBzSaeNDERA94rG1BZKGG1gRIo8UYPBoS78ajiX+BNy9GPRgTr5p4NCREe6F4qpmdGbpsd0u3tF3pfj7Jdt+bH/ved+a93TcznQmgbQ2kf5KIbRHxe0T0ZdnbFxjI3ubnZsZuzs2MJbGw8PbfSWW5G3MzY8WixXpb88yhUkTpsySOJ0vLnbp46cxouTxxPs8PTZ/9cGjq4qXnTp8dPTVxauLcyLFjR48Mv/jCyPNrEmca1429H0/u2/P6u1ffHDtx9b2fvk2rtXt/Nr86jju6WSegOgbSrfbPQkXtvCebqPu9YHtVOulsYUVoSkdEpLurq9L/+6IjFndeX7z2aUsrB6yr9LdpS+PZswvAJpZEq2sAtEbxQ58e/xavDRp6/C9cfzmiO0/Pz82Mzd+KvzNK+fSudSx/ICJOzP77VfqKZs9DAACsQmVs82y98V8pdlfes2sdO/JrKP0RcX9E7IyIByJiV0Q8GFFZ9qGIeDhbeaFvheUP1OSXjn9K1+rWeY2k47+XqsZ+81Xx52/9HXlueyX+ruTk6fLE4XybHIquLWl+eJkyvn/1ty8azase/6WvtPxiLJhX4FpnzQm68dHp0bXaCNcvR+ztrBd/cutKQNoC9kTE3uY+ekeROP30N/saLXTn+JexBteZFr6OeCrb/7NRE38hWf765FBPlCcODxWtYqmff73yVqPy7yr+NXD9wCNZYnH/1yxR1dDK5YnzU82XceWPzxse06y2/Xcn71T65C/vZ9MujE5Pnx+O6E7eqOSLY7rK9JHFdS+MTvem+WL5tP0fOli//+/M10n3f7qV0ka8PyIejYjH8ro/HhEHIuLgMvH/+MoTHywTfxJJtG7/X44Yr/v9d6v99yfV1+tXkeg488N3ja6Yr2z/H43ZyndtpvL9dwcrreBdbj4AAAC4J5QiYlskpcEsPbAtSqXBwex/+HfFfaXy5NT0MycnPzo3nt0j0B9dpeJMV1/V+dDhZDb/xCw/kp8rLuYfyc8bf9nRW8kPjk2Wx1scO7S7rbf3/yj6f+qvjlbXDlh37teC9lXb/0stqgew8Vby++9YADan2/t/T/qnt1V1ATaW439oX/X6/yc1eeN/2JyW9v8/6zyyDtiMjP+hfen/0L70f2hLzdzOH8cbzeqJiGYeC1DcLLD6pwr0rPgO/3ZJFE+8WM+yeuPSme58SpRaFGlHk41tUyTSHrOxhS4+QwUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBe9l8AAAD//3ow3kU=") mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x109342, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000340)={'#! ', './file0', [], 0xa, "631e1db8171cd5ec6f4866917664aeec79d6df583b6ee2895fe9a149818483f39c93a1ff5d2334d0cecd4aeb5ef628af152fc9014ea9503c4ef00917d9eef7e15c9b7a1d14f5c54361657d8560855cb21c203a99e2dc14d695961bbf577fc76ed5bc616ea0c782243c0272cdd6e0b15ee1b486f46954c22cd4237eed8ae3ff77a56e66e3f95daf76e2a286db73630adc3443585d402a6c9ed2ed2d4a63f6383cc36c30d9d9d963ad628295521c794e29c9620da2f73bad201961f134755a9253ad0abf66bab6c936d2e07b6998b07a35592a64cd4b530894e060aabea18c4abeeeb5ce3d2636591802b468817627978e32814b014ba33f201baf669d5649f0b89c920e00000000"}, 0xfffffcaa) pwrite64(r0, &(0x7f0000000300)='2', 0x1, 0x8080c60) 2m54.795845055s ago: executing program 1 (id=1069): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r0, 0x0, 0x0) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f00000000c0)={0x24, r1, 0x5, 0x0, 0x4000000, {{}, {@val={0x8, 0x3, r2}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x985}]]}, 0x24}}, 0x0) 2m54.001357993s ago: executing program 1 (id=1074): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x458, 0x5015, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x7, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x8d, 0x0, 0x40}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a1007508950155d49102c0c0"], 0x0}, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) 2m50.274202787s ago: executing program 1 (id=1086): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x200000000000000) 2m47.712691096s ago: executing program 1 (id=1096): mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x20000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0\x00', 0x0, 0x98d046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x10454ca, 0x0) 2m46.813639368s ago: executing program 1 (id=1101): sendmmsg$unix(0xffffffffffffffff, &(0x7f0000009ec0)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000540)="fa9679fecf107d0853e46d029d6292fdec92fa31c3fb01149ab60bb27a0b2fc7ca3afaca1c3427d581a0ba949c007d57eff49a295c1491b5535f46dde1b88a4a8b42e9202ddef2d382a39e700150218ae5ece4a248793dc91a34a0c0b6c00f856a942e8680039750b735e23b725e83ce544cf1f5ef55b473a29656b9bc55ab5c3ae6a6f3df6b66cc3877545f65f46ec2360bf78f05d7ee20c27b3f6f9b6f90d617d35326326cbe16dc7452", 0xab}], 0x1, 0x0, 0x0, 0x4000}}], 0x1, 0x4004) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x101042, 0x15) pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xe7c) 2m45.817939655s ago: executing program 1 (id=1109): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x6, 0x0, 0x0, 0x40000}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000000)=@framed={{0x18, 0x6}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) close(r1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r0}, &(0x7f0000000080), &(0x7f00000000c0)=r2}, 0x20) 2m45.103877958s ago: executing program 35 (id=1109): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x6, 0x0, 0x0, 0x40000}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000000)=@framed={{0x18, 0x6}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) close(r1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r0}, &(0x7f0000000080), &(0x7f00000000c0)=r2}, 0x20) 1m8.3772842s ago: executing program 7 (id=1561): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x770, 0x0, 0xbabd}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'veth0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000100)="094a9e5203eb4a", 0x1, 0x100400c1, &(0x7f0000000200)={0x11, 0x8100, r2, 0x1, 0xf3, 0x6, @random="924996884a2b"}, 0x14) 1m8.281931465s ago: executing program 7 (id=1562): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d797468696e") write(0xffffffffffffffff, &(0x7f0000000138)="0000000000000000008000000000000000000000000000007468696e00", 0x1d) ioctl(r0, 0xc138fd09, &(0x7f0000000000)="0400000000000000000000006e010000380100000100"/42) 1m7.960704399s ago: executing program 7 (id=1564): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1011}) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000280)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/net/tun0/gro_flush_timeout\x00', 0x1, 0x0) write$binfmt_aout(r1, &(0x7f0000000340)={{0x107, 0x1, 0x8, 0x3cb, 0x13c, 0xe, 0x2e7, 0x2d8}}, 0x20) 1m7.610618036s ago: executing program 7 (id=1566): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000000)=0x4011, 0x4) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) recvmmsg(r0, &(0x7f00000099c0)=[{{0x0, 0x0, &(0x7f0000007040)=[{&(0x7f0000006040)=""/4086, 0xff6}], 0x1}, 0x8000}], 0x1, 0x10002, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES8], 0x48}}, 0x0) 1m7.31539825s ago: executing program 7 (id=1567): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:05.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x4000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0, 0x3f}, 0x58) 1m7.072477371s ago: executing program 7 (id=1569): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) r1 = syz_io_uring_setup(0x34ba, &(0x7f0000000540)={0x0, 0xcf0b, 0x0, 0x3, 0x11}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x4, 0x8, 0x0, 0x0, 0x4, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x101, 0x11, 0x5, 0x0, 0x0) 51.87491889s ago: executing program 36 (id=1569): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) r1 = syz_io_uring_setup(0x34ba, &(0x7f0000000540)={0x0, 0xcf0b, 0x0, 0x3, 0x11}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x4, 0x8, 0x0, 0x0, 0x4, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x101, 0x11, 0x5, 0x0, 0x0) 6.484415428s ago: executing program 6 (id=1815): r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$llc(r0, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0xffffff6a) sendfile(r0, r1, 0x0, 0xffffffff000) recvmmsg(r0, &(0x7f0000000640), 0x3fffffffffffce3, 0x0, 0x0) 6.276052437s ago: executing program 5 (id=1817): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$can_raw(r0, &(0x7f00000001c0)={0x1d, r1}, 0x10) r2 = socket(0x10, 0x3, 0x0) write(r2, &(0x7f0000000000)="2400000011005f0414f9f4070009041f810000000e0000000000000008000f0001000000", 0x24) read(r0, &(0x7f0000000900)=""/105, 0x69) 4.997746247s ago: executing program 5 (id=1823): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) read(r0, &(0x7f0000000100)=""/9, 0xfffffd87) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000f40)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000e00)={0x40, 0x19, 0x2, "b156"}, 0x0, 0x0, 0x0, 0x0}) write$tun(r0, &(0x7f00000000c0)=ANY=[], 0xffe) 4.917354971s ago: executing program 8 (id=1824): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff000000009408000000001700638af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000008000000850000006900000095"], &(0x7f0000005d80)='syzkaller\x00', 0xc}, 0x94) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r1, 0x4) r3 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xffffffffffff0000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)="8bcd", 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) 4.7213642s ago: executing program 8 (id=1825): r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000002c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000180)={@multicast2, @loopback}, 0xc) 4.590694036s ago: executing program 4 (id=1826): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000940)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0xfffc, 0x0, 0x0, 0xa, 0x20}, {0x20008, 0x10, 0x100000002, 0x0, 0x6, 0xffffffffffffb475, 0xffffffffffffffff, 0x4}, {0x1000000003, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}}}, 0xb8}}, 0x2c000010) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2, 0x0, 0x0, 0x0, 0x4}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 4.334299978s ago: executing program 8 (id=1827): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) pwritev(r1, &(0x7f0000000740)=[{&(0x7f0000000000)='3', 0x1}], 0x1, 0x800, 0x0) write$nci(r0, 0x0, 0x14) 4.333254808s ago: executing program 6 (id=1828): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x85, 0x7, 0x7ffc0001}]}) clock_nanosleep(0x2, 0x0, &(0x7f0000000500)={0x77359400}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)=0x0) timer_settime(r0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) timer_create(0x7, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) timer_settime(r1, 0x0, &(0x7f0000000340)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) 4.137096507s ago: executing program 4 (id=1829): syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0xe, &(0x7f0000000040)={[{@barrier_val={'barrier', 0x3d, 0x101}}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x6}}]}, 0x1, 0x453, &(0x7f0000000300)="$eJzs3M2PE+UfAPDvTLfw2x/grogvvKiraNz4sssCKgcPajTxgImJHvS42V0IUljDrokQomAMnowx8W48+i940osxnky86t2QEMMF8FQz7czSlrbslnaL9vNJBp5n5pk+z7czT/vMPJ0NYGRNZf8kEdsj4veImKhnmwtM1f+7fvX8wo2r5xeSqFbf/iuplbt29fxCUbTYb1uemU4j0s+S2Num3pWz507OVypLZ/L87OqpD2ZXzp577sSp+eNLx5dOHzxy5PChuRdfOPh8X+LM2nRtz8fL+3a/8d5Xbx79oin+ljj6ZKrbxier1T5XN1w7GtLJ2BAbwoaUIiI7XOVa/5+IUtw8eBPx+qdDbRwwUNVqtbqt8+YLVeA/LInmvC4Po6L4os+uf4uldRDw8uCGH0N35ZX6BVAW9/V8qW8ZizQvU265vu2nqYh498Lf32RLDOY+BABAkx+y8c+z7cZ/aTzQUO6efG5oMiLujYidEXFfROyKiPsjamUfjIiHNlh/6yTJreOf9HJPga1TNv57KZ/bah7/FaO/mCzluR21+MvJsROVpQP5ezId5a1Zfq5LHT++9tuXnbY1jv+yJau/GAvm7bg8trV5n8X51fk7ibnRlYsRe8baxZ+szQQkEbE7Ivb0WMeJp7/b12nb7ePvog/zTNVvI56qH/8L0RJ/Iek+Pzn7v6gsHZgtzopb/fLrpbc61X9H8fdBdvz/3/b8X4t/Mmmcr13ZeB2X/vi84zVNr+f/luSdWnpLvu6j+dXVM3MRW5Kj9UY3rj94c98iX5TP4p/e377/74yb78TeiMhO4ocj4pGIeDRv+2MR8XhE7O8S/8+vPvF+7/EPVhb/4oaO/1piPKJlTYdE6eRP3zdVOnlL/De6H//DtdR0vmY9n3/raVdvZzMAAAD8+6QRsT2SdGYtnaYzM/Xfy++KSCvLK6vPHFv+8PRi/RmBySinxZ2uiYb7oXP5ZX09fzEi6j8tKLYfyu8bf10ar+VnFpYri8MOHkbcttosRl1j/8/8WRpeu4BN4nktGF36P4wu/R9Gl/4Po6tN/x8fRjuAzZf1/9Y/s/XJkNoCbK6W73/TfjBCXP/D6NL/YXTp/zCSVsbj9g/Jd00Ur9Tj7ndTotrPF4zysMMZbCLSu6IZEgNKDPdzCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoF/+CQAA///E5ODv") mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x181) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000180)='./file0\x00', 0x14a0, &(0x7f0000000200)=ANY=[], 0x1, 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) getdents64(r0, 0x0, 0x0) 3.953524136s ago: executing program 5 (id=1830): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000003c0)=0x914, 0x4) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) recvmmsg(r0, &(0x7f0000000340)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x45833af92e4b38ff, 0x0) 3.4295573s ago: executing program 4 (id=1831): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000000380)={0x1c, r3, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40480d0}, 0x40) 3.342446404s ago: executing program 8 (id=1832): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x4e7, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe0, 0x9, "", [{{0x9, 0x4, 0x0, 0x7, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0xc1, 0xf, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x3, 0xc8, 0x5}}}}}]}}]}}, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x80000, 0x4) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000000)={0x20, 0xa, 0x2f, {0x2f, 0xa, "c2a5631385126eb63747a739960044380000000ba2b93b369f7000000000000000001f0000d65a0968823eecb6"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_connect$uac3(0x0, 0xc7, &(0x7f0000000480)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x10, 0x582, 0x10f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xb5, 0x3, 0x1, 0x5, 0x10, 0xff, {0x8, 0xb, 0x0, 0x0, 0x1, 0x0, 0x30, 0x5}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0x29, 0x4}, [@multiply_unit={0xb, 0x24, 0xd, 0xb, 0x2, 0x3, 0x6}, @input_terminal={0x14, 0x24, 0x2, 0x5, 0x201, 0x4, 0x7, 0x200, 0x5a98, 0x5, 0x1, 0x8}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x0, 0x89, 0xbd, 0x1, 0x7}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0xa, 0x1000, 0x2, "5794a348"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x4, 0x8}, @format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0xff, 0x1, 0x6f, 0x7, "ea38", "c5a7"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xa4, 0x2, 0xff, {0xa, 0x25, 0x25, 0x8, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x10, 0x2, 0x58, {0xa, 0x25, 0x25, 0x80, 0x2, 0xfa6}}}}}}}}]}}, &(0x7f0000000680)={0xa, &(0x7f0000000580)={0xa, 0x6, 0x110, 0xc, 0x4, 0x23, 0x40, 0x8}, 0x11, &(0x7f00000005c0)={0x5, 0xf, 0x11, 0x1, [@ssp_cap={0xc, 0x10, 0xa, 0x5, 0x0, 0x7, 0x780, 0x5}]}}) 2.857419997s ago: executing program 4 (id=1833): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = eventfd2(0x43, 0x1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000000)={0x1, r1}) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f00000005c0)={0x0, r1}) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000500)=' ,1\t#|^q', 0x8}], 0x1) 2.751625521s ago: executing program 6 (id=1834): r0 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000180)=0x80000001, 0x4) setsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000140)=0x6, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000001140)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv4={0x800, @udp={{0x6, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty, {[@timestamp={0x44, 0x4, 0x5e}]}}, {0x1, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) 2.485126964s ago: executing program 4 (id=1835): r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$llc(r0, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0xffffff6a) sendfile(r0, r1, 0x0, 0xffffffff000) recvmmsg(r0, &(0x7f0000000640), 0x3fffffffffffce3, 0x0, 0x0) 2.321428112s ago: executing program 6 (id=1836): r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000002c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000180)={@multicast2, @loopback}, 0xc) 1.173132965s ago: executing program 8 (id=1837): io_setup(0xce2, &(0x7f0000000080)=0x0) io_submit(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 1.166618576s ago: executing program 6 (id=1838): socket(0xa, 0x3, 0xff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0x6d1, 0x0, 0x0, 0x1000, 0x5}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_queues(r0, r6, &(0x7f0000000540)={0x0, 0x1aa5, 0x80, 0x2, 0x20000, 0x0, r1}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x1, 0x1, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x200, 0x0, 0x69, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffe, 0x4, 0x10000, 0xea}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6253, 0x2000, 0x3, 0x0, 0x0, r0}}], 0x1, &(0x7f00000003c0)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r5, '\x00', {0x100, 0xdbd, 0x0, 0x0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0x0, 0xffffffdb, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, 0x94) 1.029421592s ago: executing program 5 (id=1839): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x4004880}, 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x40002, 0x16c) write(r0, &(0x7f0000000000)='3', 0x4e) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./proc\x00', &(0x7f0000000300), 0x1000000, &(0x7f0000000340)={'trans=rdma,', {'port', 0x3d, 0x4e20}}) 547.548035ms ago: executing program 5 (id=1840): capset(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0) write(r0, &(0x7f0000000000)='6', 0x32) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={0x0, 0x0, 0x58}, 0x28) 504.213247ms ago: executing program 6 (id=1841): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) syz_io_uring_setup(0x21c1, &(0x7f0000000340)={0x0, 0xca23, 0x200, 0xfffffff7, 0x182}, &(0x7f0000000300), &(0x7f0000ff4000), 0x0) readv(r0, &(0x7f0000000580)=[{&(0x7f00000003c0)=""/144, 0x90}], 0x1) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f0000000280)={{&(0x7f0000ff0000/0xd000)=nil, 0xd000}}) 353.805314ms ago: executing program 4 (id=1842): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r0, &(0x7f0000000000)='7', 0x1) bpf$MAP_CREATE(0x0, 0x0, 0x50) clock_adjtime(0x0, &(0x7f0000000040)={0x37db, 0xf423b, 0xfffffffffffffffc, 0x0, 0x0, 0x9, 0xfffffffffffffffc, 0x1, 0x3, 0x80000, 0x7ff, 0x0, 0x0, 0xfffffffffffffffd, 0x2, 0xf11b, 0x1, 0x8, 0x0, 0x0, 0x2, 0xb17, 0xffffffffffffffff, 0x5c43, 0x1, 0x6}) 253.209758ms ago: executing program 8 (id=1843): syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0xe, &(0x7f0000000040)={[{@barrier_val={'barrier', 0x3d, 0x101}}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x6}}]}, 0x1, 0x453, &(0x7f0000000300)="$eJzs3M2PE+UfAPDvTLfw2x/grogvvKiraNz4sssCKgcPajTxgImJHvS42V0IUljDrokQomAMnowx8W48+i940osxnky86t2QEMMF8FQz7czSlrbslnaL9vNJBp5n5pk+z7czT/vMPJ0NYGRNZf8kEdsj4veImKhnmwtM1f+7fvX8wo2r5xeSqFbf/iuplbt29fxCUbTYb1uemU4j0s+S2Num3pWz507OVypLZ/L87OqpD2ZXzp577sSp+eNLx5dOHzxy5PChuRdfOPh8X+LM2nRtz8fL+3a/8d5Xbx79oin+ljj6ZKrbxier1T5XN1w7GtLJ2BAbwoaUIiI7XOVa/5+IUtw8eBPx+qdDbRwwUNVqtbqt8+YLVeA/LInmvC4Po6L4os+uf4uldRDw8uCGH0N35ZX6BVAW9/V8qW8ZizQvU265vu2nqYh498Lf32RLDOY+BABAkx+y8c+z7cZ/aTzQUO6efG5oMiLujYidEXFfROyKiPsjamUfjIiHNlh/6yTJreOf9HJPga1TNv57KZ/bah7/FaO/mCzluR21+MvJsROVpQP5ezId5a1Zfq5LHT++9tuXnbY1jv+yJau/GAvm7bg8trV5n8X51fk7ibnRlYsRe8baxZ+szQQkEbE7Ivb0WMeJp7/b12nb7ePvog/zTNVvI56qH/8L0RJ/Iek+Pzn7v6gsHZgtzopb/fLrpbc61X9H8fdBdvz/3/b8X4t/Mmmcr13ZeB2X/vi84zVNr+f/luSdWnpLvu6j+dXVM3MRW5Kj9UY3rj94c98iX5TP4p/e377/74yb78TeiMhO4ocj4pGIeDRv+2MR8XhE7O8S/8+vPvF+7/EPVhb/4oaO/1piPKJlTYdE6eRP3zdVOnlL/De6H//DtdR0vmY9n3/raVdvZzMAAAD8+6QRsT2SdGYtnaYzM/Xfy++KSCvLK6vPHFv+8PRi/RmBySinxZ2uiYb7oXP5ZX09fzEi6j8tKLYfyu8bf10ar+VnFpYri8MOHkbcttosRl1j/8/8WRpeu4BN4nktGF36P4wu/R9Gl/4Po6tN/x8fRjuAzZf1/9Y/s/XJkNoCbK6W73/TfjBCXP/D6NL/YXTp/zCSVsbj9g/Jd00Ur9Tj7ndTotrPF4zysMMZbCLSu6IZEgNKDPdzCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoF/+CQAA///E5ODv") mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x181) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000180)='./file0\x00', 0x14a0, &(0x7f0000000200)=ANY=[], 0x1, 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) getdents64(r0, 0x0, 0x0) 0s ago: executing program 5 (id=1844): syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000700)='./file1\x00', 0x0, &(0x7f0000000000), 0xfe, 0x250, &(0x7f0000000300)="$eJzs3T9oJFUcB/DvzO565m7RUxtB/AMiooFwdoLN2SgcyHGICCqciNgod8J5h11iZWOhtUoqmyB2RktJE2wUwSpqitgIGiwMFlqs7M4G8mc1ZnfdkcznA5OZybyZ3xt2vm+3ebsBGutskvNJWknmk3SSFHsb3FctZ4e7y3Prl5Ne7+lfi0G7ar+ye96ZJEtJHk2yVhZ5tZ3cWH1+6/eNJx9853rngY9Wn5ub6U0ObW9tPrXz4cW3P73wyI2vv/35YpHz6e67r+krRvyvXSS3/xfF/ieKdt094N+49OYn3/Vzf0eS+wf576RM9eK9e+2mtU4e/uDvzn3vl2/ummVfgenr9Tr998ClHtA4ZZJuinIhSbVdlgsL1Wf471uny9euXntj/pWr16+8XPdIBUxLN9l84vNTn505kP+fWlX+gZOrn/9nLq380N/eadXdG2Am7q5W/fzPv7j4UOQfGkf+obnkH5pL/qG55B+aS/6hueQfTrDOPx+Wf2gu+Yfmkn9orr35BwCapXdqnFnDt05/IjIwc3WPPwAAAAAAAAAAAAAAAAAAwGHLc+uXd5dxr1Ecs/2X7yfbjydpj6rfGvwecXLz4O/p34p+s3212uN2dOiFeye8wIQ+rnn29S0/1lv/q3vqrb94JVl6K8m5dvvw81cMn7/x3XbE8c5LExY4poP5fOzZ2dY/6M+Veutf2Ei+6I8/50aNP2XuHKxHjz/do79i+Uiv/zHhBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJiZvwIAAP//1rxsXQ==") r0 = creat(&(0x7f0000000080)='./file1\x00', 0xea) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x109342, 0x0) pwrite64(r1, &(0x7f0000000300)='2', 0x1, 0x8080c60) fallocate(r1, 0x3, 0x3f, 0x8000c62) lseek(r0, 0x3ff, 0x3) kernel console output (not intermixed with test programs): T6752] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 228.619986][ T6752] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 228.629610][ T6752] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 228.637955][ T6752] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 228.646836][ T6752] bridge_slave_1: left allmulticast mode [ 228.652530][ T6752] bridge_slave_1: left promiscuous mode [ 228.658845][ T6752] bridge0: port 2(bridge_slave_1) entered disabled state [ 228.674929][ T6752] bridge_slave_0: left allmulticast mode [ 228.681161][ T6752] bridge_slave_0: left promiscuous mode [ 228.693667][ T6752] bridge0: port 1(bridge_slave_0) entered disabled state [ 228.735190][ T6752] veth1_macvtap: left promiscuous mode [ 228.742334][ T6752] veth0_macvtap: left promiscuous mode [ 228.748809][ T6752] veth1_vlan: left promiscuous mode [ 228.754221][ T6752] veth0_vlan: left promiscuous mode [ 228.966742][ T51] Bluetooth: hci1: command tx timeout [ 229.505262][ T8951] netlink: 'syz.4.804': attribute type 8 has an invalid length. [ 229.519258][ T8951] netlink: 4 bytes leftover after parsing attributes in process `syz.4.804'. [ 229.529062][ T8951] netlink: 8 bytes leftover after parsing attributes in process `syz.4.804'. [ 229.728296][ T8] usb 2-1: USB disconnect, device number 9 [ 230.079484][ T6752] team0 (unregistering): Port device team_slave_1 removed [ 230.148370][ T6752] team0 (unregistering): Port device team_slave_0 removed [ 230.213784][ T6752] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 230.295934][ T6752] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 230.661767][ T8969] 9pnet_fd: Insufficient options for proto=fd [ 231.067960][ T51] Bluetooth: hci1: command tx timeout [ 231.153723][ T6752] bond0 (unregistering): Released all slaves [ 231.340867][ T8888] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 231.357511][ T8888] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 231.409819][ T8888] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 231.576027][ T8888] hsr_slave_0: entered promiscuous mode [ 231.583468][ T8888] hsr_slave_1: entered promiscuous mode [ 231.590571][ T8888] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 231.598918][ T8888] Cannot create hsr debugfs directory [ 232.220304][ T8888] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 232.235986][ T8888] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 232.261830][ T8888] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 232.285353][ T8888] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 232.601256][ T8888] 8021q: adding VLAN 0 to HW filter on device bond0 [ 232.671827][ T8888] 8021q: adding VLAN 0 to HW filter on device team0 [ 232.728674][ T2901] bridge0: port 1(bridge_slave_0) entered blocking state [ 232.736066][ T2901] bridge0: port 1(bridge_slave_0) entered forwarding state [ 232.788291][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 232.795527][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 232.955475][ T9023] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 233.127428][ T51] Bluetooth: hci1: command tx timeout [ 233.461440][ T8888] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 233.728196][ T9042] overlayfs: failed to clone upperpath [ 234.269748][ T8888] veth0_vlan: entered promiscuous mode [ 234.323991][ T8888] veth1_vlan: entered promiscuous mode [ 234.422082][ T8888] veth0_macvtap: entered promiscuous mode [ 234.443561][ T8888] veth1_macvtap: entered promiscuous mode [ 234.502474][ T8888] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 234.540542][ T8888] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 234.566512][ T8888] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 234.595923][ T8888] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 234.633933][ T8888] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 234.682001][ T8888] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 234.721994][ T8888] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 234.732650][ T8888] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 234.744013][ T8888] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 234.756816][ T8888] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 234.782197][ T8888] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 234.794090][ T8888] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 234.804434][ T8888] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 234.829334][ T8888] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.005315][ T6750] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 235.042477][ T6750] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 235.115665][ T6752] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 235.123044][ T9072] overlayfs: failed to clone upperpath [ 235.155359][ T6752] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 235.207457][ T51] Bluetooth: hci1: command tx timeout [ 236.167535][ T28] audit: type=1326 audit(1790065921.100:177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9102 comm="syz.5.847" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 236.222314][ T28] audit: type=1326 audit(1790065921.100:178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9102 comm="syz.5.847" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 236.332394][ T28] audit: type=1326 audit(1790065921.150:179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9102 comm="syz.5.847" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 236.378427][ T9077] loop1: detected capacity change from 0 to 32768 [ 236.402666][ T28] audit: type=1326 audit(1790065921.150:180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9102 comm="syz.5.847" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 236.473009][ T9077] JBD2: Ignoring recovery information on journal [ 236.522716][ T28] audit: type=1326 audit(1790065921.150:181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9102 comm="syz.5.847" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 236.592473][ T28] audit: type=1326 audit(1790065921.150:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9102 comm="syz.5.847" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 236.663016][ T28] audit: type=1326 audit(1790065921.150:183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9102 comm="syz.5.847" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 236.690119][ T9077] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 236.773980][ T28] audit: type=1326 audit(1790065921.160:184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9102 comm="syz.5.847" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 236.844430][ T28] audit: type=1326 audit(1790065921.160:185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9102 comm="syz.5.847" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 236.940217][ T28] audit: type=1326 audit(1790065921.170:186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9102 comm="syz.5.847" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 236.981857][ T9127] netlink: 44 bytes leftover after parsing attributes in process `syz.4.855'. [ 237.031295][ T9127] bridge0: port 2(bridge_slave_1) entered disabled state [ 237.040098][ T9127] bridge0: port 1(bridge_slave_0) entered disabled state [ 237.074941][ T9130] FAULT_INJECTION: forcing a failure. [ 237.074941][ T9130] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 237.096140][ T9128] netlink: 44 bytes leftover after parsing attributes in process `syz.4.855'. [ 237.096503][ T9130] CPU: 1 PID: 9130 Comm: syz.6.856 Not tainted syzkaller #0 [ 237.113189][ T9130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 237.123690][ T9130] Call Trace: [ 237.127220][ T9130] [ 237.130298][ T9130] dump_stack_lvl+0x18c/0x250 [ 237.135131][ T9130] ? show_regs_print_info+0x20/0x20 [ 237.140420][ T9130] ? load_image+0x420/0x420 [ 237.145267][ T9130] ? __might_fault+0xaa/0x120 [ 237.150177][ T9130] ? __lock_acquire+0x7d80/0x7d80 [ 237.155380][ T9130] ? __virt_addr_valid+0x10c/0x380 [ 237.160649][ T9130] should_fail_ex+0x394/0x4c0 [ 237.166150][ T9130] _copy_to_user+0x2f/0xa0 [ 237.171202][ T9130] bpf_verifier_vlog+0x432/0x840 [ 237.176502][ T9130] __btf_verifier_log+0xe3/0x140 [ 237.181711][ T9130] ? __kernel_text_address+0xd/0x30 [ 237.187062][ T9130] ? unwind_get_return_address+0x91/0xc0 [ 237.193282][ T9130] ? btf_check_sec_info+0x350/0x350 [ 237.198590][ T9130] __btf_verifier_log_type+0x4f7/0x690 [ 237.204290][ T9130] ? __x64_sys_bpf+0x7c/0x90 [ 237.210247][ T9130] ? btf_int_show+0x2810/0x2810 [ 237.215950][ T9130] ? __kasan_kmalloc+0x8f/0xa0 [ 237.220779][ T9130] ? btf_new_fd+0x440/0x9e0 [ 237.225403][ T9130] ? __sys_bpf+0x670/0x890 [ 237.229977][ T9130] ? __x64_sys_bpf+0x7c/0x90 [ 237.238093][ T9130] ? do_syscall_64+0x55/0xb0 [ 237.242929][ T9130] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 237.249505][ T9130] btf_verifier_log_member+0x1c7/0x800 [ 237.255622][ T9130] ? __btf_verifier_log_type+0x690/0x690 [ 237.261349][ T9130] btf_struct_resolve+0xba6/0x1270 [ 237.266550][ T9130] btf_resolve+0x423/0x14a0 [ 237.271212][ T9130] btf_parse_type_sec+0x576/0x1960 [ 237.276486][ T9130] ? btf_verifier_log+0x1a0/0x1a0 [ 237.281715][ T9130] ? btf_parse_str_sec+0x20d/0x2a0 [ 237.286993][ T9130] btf_new_fd+0x440/0x9e0 [ 237.291413][ T9130] ? bpf_btf_show_fdinfo+0x80/0x80 [ 237.296771][ T9130] ? capable+0x88/0xe0 [ 237.300971][ T9130] __sys_bpf+0x670/0x890 [ 237.306011][ T9130] ? bpf_link_show_fdinfo+0x560/0x560 [ 237.312253][ T9130] ? lock_chain_count+0x20/0x20 [ 237.317355][ T9130] __x64_sys_bpf+0x7c/0x90 [ 237.322153][ T9130] do_syscall_64+0x55/0xb0 [ 237.326899][ T9130] ? clear_bhb_loop+0x40/0x90 [ 237.332776][ T9130] ? clear_bhb_loop+0x40/0x90 [ 237.337780][ T9130] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 237.344254][ T9130] RIP: 0033:0x7fb764b9e159 [ 237.349347][ T9130] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 237.370592][ T9130] RSP: 002b:00007fb7659ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 237.380283][ T9130] RAX: ffffffffffffffda RBX: 00007fb764e25fa0 RCX: 00007fb764b9e159 [ 237.388589][ T9130] RDX: 0000000000000028 RSI: 0000200000000100 RDI: 0000000000000012 [ 237.396787][ T9130] RBP: 00007fb764c3506b R08: 0000000000000000 R09: 0000000000000000 [ 237.404823][ T9130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 237.413028][ T9130] R13: 00007fb764e26038 R14: 00007fb764e25fa0 R15: 00007ffdc6501cd8 [ 237.422278][ T9130] [ 237.553054][ T5787] ocfs2: Unmounting device (7,1) on (node local) [ 237.886416][ T9151] loop6: detected capacity change from 0 to 764 [ 237.975110][ T9151] rock: directory entry would overflow storage [ 237.990602][ T9151] rock: sig=0x4654, size=5, remaining=4 [ 238.312134][ T9164] netlink: 44 bytes leftover after parsing attributes in process `syz.5.867'. [ 238.367752][ T9164] netlink: 44 bytes leftover after parsing attributes in process `syz.5.867'. [ 240.683637][ T9233] FAULT_INJECTION: forcing a failure. [ 240.683637][ T9233] name failslab, interval 1, probability 0, space 0, times 0 [ 240.715973][ T9233] CPU: 1 PID: 9233 Comm: syz.6.892 Not tainted syzkaller #0 [ 240.723530][ T9233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 240.734263][ T9233] Call Trace: [ 240.737690][ T9233] [ 240.740668][ T9233] dump_stack_lvl+0x18c/0x250 [ 240.745677][ T9233] ? show_regs_print_info+0x20/0x20 [ 240.751039][ T9233] ? load_image+0x420/0x420 [ 240.755610][ T9233] ? __might_sleep+0xe0/0xe0 [ 240.760302][ T9233] ? __lock_acquire+0x7d80/0x7d80 [ 240.765403][ T9233] should_fail_ex+0x394/0x4c0 [ 240.770325][ T9233] should_failslab+0x9/0x20 [ 240.774901][ T9233] slab_pre_alloc_hook+0x59/0x300 [ 240.780077][ T9233] ? __lock_acquire+0x7d80/0x7d80 [ 240.785164][ T9233] ? security_prepare_creds+0x4b/0x130 [ 240.790787][ T9233] ? security_prepare_creds+0x4b/0x130 [ 240.796304][ T9233] __kmem_cache_alloc_node+0x53/0x250 [ 240.801827][ T9233] ? security_prepare_creds+0x4b/0x130 [ 240.807363][ T9233] __kmalloc+0xa7/0x240 [ 240.811676][ T9233] security_prepare_creds+0x4b/0x130 [ 240.817113][ T9233] prepare_creds+0x427/0x5d0 [ 240.821768][ T9233] __sys_setreuid+0x105/0x980 [ 240.826502][ T9233] ? syscall_enter_from_user_mode+0x25/0x80 [ 240.832713][ T9233] ? lockdep_hardirqs_on+0x98/0x150 [ 240.839979][ T9233] do_syscall_64+0x55/0xb0 [ 240.844461][ T9233] ? clear_bhb_loop+0x40/0x90 [ 240.849381][ T9233] ? clear_bhb_loop+0x40/0x90 [ 240.854206][ T9233] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 240.860150][ T9233] RIP: 0033:0x7fb764b9e159 [ 240.864636][ T9233] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 240.884905][ T9233] RSP: 002b:00007fb7659ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000071 [ 240.893608][ T9233] RAX: ffffffffffffffda RBX: 00007fb764e25fa0 RCX: 00007fb764b9e159 [ 240.901808][ T9233] RDX: 0000000000000000 RSI: 000000000000ee00 RDI: ffffffffffffffff [ 240.909822][ T9233] RBP: 00007fb764c3506b R08: 0000000000000000 R09: 0000000000000000 [ 240.917935][ T9233] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 240.926479][ T9233] R13: 00007fb764e26038 R14: 00007fb764e25fa0 R15: 00007ffdc6501cd8 [ 240.934708][ T9233] [ 240.965522][ T9242] netlink: 8 bytes leftover after parsing attributes in process `syz.1.895'. [ 241.006551][ T9242] netlink: 1148 bytes leftover after parsing attributes in process `syz.1.895'. [ 241.093356][ T9248] overlayfs: failed to resolve './cgroup': -2 [ 241.812224][ T9279] netlink: 'syz.1.904': attribute type 12 has an invalid length. [ 243.445961][ T5844] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 243.647316][ T5844] usb 7-1: Using ep0 maxpacket: 8 [ 243.660745][ T5844] usb 7-1: config index 0 descriptor too short (expected 74, got 45) [ 243.685339][ T5844] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 243.703523][ T5844] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 243.714589][ T5844] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 243.731229][ T5844] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 243.751713][ T5844] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 243.794029][ T5844] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 243.821517][ T5844] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.828093][ T9338] fuse: Bad value for 'fd' [ 244.051336][ T5844] usb 7-1: usb_control_msg returned -32 [ 244.060906][ T9346] fuse: Bad value for 'fd' [ 244.069983][ T5844] usbtmc 7-1:16.0: can't read capabilities [ 244.417541][ C1] usbtmc 7-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 244.434616][ T9358] usbtmc 7-1:16.0: Unable to send data, error -71 [ 244.444544][ T9358] usbtmc 7-1:16.0: usb_control_msg returned -32 [ 244.462996][ T5814] usb 7-1: USB disconnect, device number 2 [ 245.750636][ T9402] loop1: detected capacity change from 0 to 512 [ 245.777482][ T9402] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 245.808301][ T5814] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 245.891105][ T9402] EXT4-fs (loop1): 1 truncate cleaned up [ 245.917905][ T9402] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 246.079184][ T5844] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 246.374625][ C0] hrtimer: interrupt took 1042183 ns [ 246.597314][ T5844] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 246.681909][ T5787] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 246.885899][ T9404] ceph: No mds server is up or the cluster is laggy [ 248.216012][ T5844] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 248.417652][ T5844] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 32 [ 248.435268][ T5844] usb 7-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 248.444468][ T5844] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.463559][ T5844] usb 7-1: Product: syz [ 248.470907][ T5844] usb 7-1: Manufacturer: syz [ 248.475755][ T5844] usb 7-1: SerialNumber: syz [ 248.493092][ T9448] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 248.930087][ T5844] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 3 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 249.301598][ C1] usblp0: nonzero write bulk status received: -71 [ 249.428061][ T9434] loop1: detected capacity change from 0 to 40427 [ 249.477894][ T9434] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 249.536156][ T9434] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 249.603586][ T9434] F2FS-fs (loop1): invalid crc value [ 249.636795][ T9434] F2FS-fs (loop1): Found nat_bits in checkpoint [ 249.931091][ T9434] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 249.967630][ T9434] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 250.999024][ T5814] usb 7-1: USB disconnect, device number 3 [ 251.054020][ T5814] usblp0: removed [ 251.617079][ T9503] netlink: 4 bytes leftover after parsing attributes in process `syz.6.979'. [ 251.655726][ T9500] overlayfs: failed to clone upperpath [ 251.806740][ T9503] hsr_slave_1 (unregistering): left promiscuous mode [ 251.841094][ T9504] netlink: 4 bytes leftover after parsing attributes in process `syz.1.970'. [ 252.091440][ T9509] overlayfs: failed to clone upperpath [ 252.749747][ T9520] overlayfs: failed to resolve './file0': -2 [ 253.921542][ T9548] FAULT_INJECTION: forcing a failure. [ 253.921542][ T9548] name failslab, interval 1, probability 0, space 0, times 0 [ 253.935013][ T9548] CPU: 1 PID: 9548 Comm: syz.6.998 Not tainted syzkaller #0 [ 253.942384][ T9548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 253.952931][ T9548] Call Trace: [ 253.956693][ T9548] [ 253.959757][ T9548] dump_stack_lvl+0x18c/0x250 [ 253.964494][ T9548] ? show_regs_print_info+0x20/0x20 [ 253.969752][ T9548] ? load_image+0x420/0x420 [ 253.974399][ T9548] should_fail_ex+0x394/0x4c0 [ 253.979224][ T9548] should_failslab+0x9/0x20 [ 253.983909][ T9548] slab_pre_alloc_hook+0x59/0x300 [ 253.989085][ T9548] kmem_cache_alloc+0x5a/0x2c0 [ 253.994074][ T9548] ? radix_tree_node_alloc+0x7e/0x3a0 [ 253.999852][ T9548] radix_tree_node_alloc+0x7e/0x3a0 [ 254.005284][ T9548] idr_get_free+0x28f/0xa10 [ 254.009937][ T9548] idr_alloc_cyclic+0x28a/0x610 [ 254.014937][ T9548] ? idr_alloc+0x2e0/0x2e0 [ 254.019432][ T9548] ? do_raw_spin_lock+0x11f/0x2b0 [ 254.024525][ T9548] ? bpf_map_alloc_id+0x21/0xd0 [ 254.029441][ T9548] bpf_map_alloc_id+0x40/0xd0 [ 254.034171][ T9548] map_create+0xe24/0x12f0 [ 254.038644][ T9548] __sys_bpf+0x651/0x890 [ 254.042931][ T9548] ? bpf_link_show_fdinfo+0x560/0x560 [ 254.048368][ T9548] ? lock_chain_count+0x20/0x20 [ 254.053287][ T9548] __x64_sys_bpf+0x7c/0x90 [ 254.057762][ T9548] do_syscall_64+0x55/0xb0 [ 254.062325][ T9548] ? clear_bhb_loop+0x40/0x90 [ 254.067069][ T9548] ? clear_bhb_loop+0x40/0x90 [ 254.071809][ T9548] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 254.077839][ T9548] RIP: 0033:0x7fb764b9e159 [ 254.082301][ T9548] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 254.101955][ T9548] RSP: 002b:00007fb7659ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 254.110612][ T9548] RAX: ffffffffffffffda RBX: 00007fb764e25fa0 RCX: 00007fb764b9e159 [ 254.118721][ T9548] RDX: 0000000000000048 RSI: 00002000000009c0 RDI: 0000000000000000 [ 254.126740][ T9548] RBP: 00007fb764c3506b R08: 0000000000000000 R09: 0000000000000000 [ 254.134925][ T9548] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 254.142926][ T9548] R13: 00007fb764e26038 R14: 00007fb764e25fa0 R15: 00007ffdc6501cd8 [ 254.150989][ T9548] [ 254.714947][ T9564] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1001'. [ 255.242563][ T9577] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1004'. [ 255.773323][ T9587] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1005'. [ 256.103718][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.112566][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.476138][ T5844] usb 7-1: new full-speed USB device number 4 using dummy_hcd [ 256.589190][ T9602] overlayfs: failed to clone lowerpath [ 256.677371][ T5844] usb 7-1: not running at top speed; connect to a high speed hub [ 256.693678][ T5844] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 256.713619][ T5844] usb 7-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice= 1.00 [ 256.723365][ T5844] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.756013][ T5844] usb 7-1: Product: syz [ 256.760374][ T5844] usb 7-1: Manufacturer: syz [ 256.764997][ T5844] usb 7-1: SerialNumber: syz [ 256.811605][ T5844] keyspan 7-1:1.0: Keyspan 4 port adapter converter detected [ 256.832242][ T5844] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 81 [ 256.861535][ T5844] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 88 [ 256.889513][ T5844] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 1 [ 256.921004][ T5844] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 256.948403][ T5844] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 2 [ 256.980679][ T5844] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 257.030857][ T5844] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 4 [ 257.096415][ T5844] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 257.135587][ T5844] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 6 [ 257.206481][ T5844] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 257.495978][ T5844] usb 7-1: USB disconnect, device number 4 [ 257.603098][ T5844] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 257.651714][ T5844] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 257.688062][ T5844] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 257.726461][ T5844] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 257.763115][ T5844] keyspan 7-1:1.0: device disconnected [ 259.094263][ T9643] loop6: detected capacity change from 0 to 512 [ 259.161370][ T9643] EXT4-fs (loop6): orphan cleanup on readonly fs [ 259.200059][ T9643] EXT4-fs error (device loop6): ext4_ext_check_inode:532: inode #4: comm syz.6.1018: pblk 0 bad header/extent: too large eh_depth - magic f30a, entries 1, max 4(4), depth 2048(2048) [ 259.341433][ T9643] EXT4-fs error (device loop6): ext4_quota_enable:7147: comm syz.6.1018: Bad quota inode: 4, type: 1 [ 259.378319][ T9643] EXT4-fs warning (device loop6): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 259.415172][ T9643] EXT4-fs (loop6): Cannot turn on quotas: error -117 [ 259.440790][ T9643] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 259.683202][ T8888] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 261.592333][ T9674] loop6: detected capacity change from 0 to 32768 [ 261.733389][ T9674] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode. [ 262.148581][ T8888] ocfs2: Unmounting device (7,6) on (node local) [ 262.384270][ T9707] loop6: detected capacity change from 0 to 1024 [ 262.427233][ T9707] EXT4-fs: Ignoring removed bh option [ 262.507471][ T9707] EXT4-fs (loop6): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 262.564771][ T9707] ext4 filesystem being mounted at /52/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 262.762856][ T9707] EXT4-fs error (device loop6): ext4_map_blocks:720: inode #15: block 3: comm syz.6.1030: lblock 3 mapped to illegal pblock 3 (length 3) [ 262.868200][ T9707] EXT4-fs (loop6): Remounting filesystem read-only [ 264.461617][ T8888] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 265.494716][ T9762] loop6: detected capacity change from 0 to 4096 [ 265.652074][ T9762] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 266.080682][ T8888] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 267.165563][ T9802] loop6: detected capacity change from 0 to 64 [ 268.886640][ T9833] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1058'. [ 269.669262][ T9842] 9pnet: p9_errstr2errno: server reported unknown error n$Ž[ [ 269.669262][ T9842] Q&|xù6 [ 271.687045][ T7673] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 271.943102][ T7673] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 141, changing to 11 [ 272.016440][ T7673] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 272.116449][ T7673] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 272.214297][ T7673] usb 2-1: New USB device found, idVendor=0458, idProduct=5015, bcdDevice= 0.00 [ 272.316042][ T7673] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.427296][ T7673] usb 2-1: config 0 descriptor?? [ 273.191665][ T7673] kye 0003:0458:5015.0006: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 273.312976][ T7673] kye 0003:0458:5015.0006: No inputs registered, leaving [ 273.428587][ T7673] kye 0003:0458:5015.0006: hidraw0: USB HID v0.00 Joystick [HID 0458:5015] on usb-dummy_hcd.1-1/input0 [ 273.526035][ T7673] kye 0003:0458:5015.0006: tablet-enabling feature report not found [ 273.617921][ T7673] kye 0003:0458:5015.0006: tablet enabling failed [ 273.783834][ T9894] tipc: Resetting bearer [ 273.792120][ T7673] usb 2-1: USB disconnect, device number 10 [ 273.993097][ T9893] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 274.399172][ T9893] infiniband s`z1: RDMA CMA: cma_listen_on_dev, error -98 [ 274.889224][ T9894] tipc: Disabling bearer [ 275.312644][ T9893] siw: device registration error -19 [ 275.336906][ T5765] usb 7-1: new full-speed USB device number 5 using dummy_hcd [ 275.517874][ T5765] usb 7-1: config 0 interface 0 altsetting 255 endpoint 0x3 has invalid wMaxPacketSize 0 [ 275.523866][ T972] usb 2-1: new full-speed USB device number 11 using dummy_hcd [ 275.527907][ T5765] usb 7-1: config 0 interface 0 has no altsetting 0 [ 275.530466][ T5765] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 275.564000][ T5765] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 275.573419][ T5765] usb 7-1: Product: syz [ 275.582537][ T5765] usb 7-1: Manufacturer: syz [ 275.587589][ T5765] usb 7-1: SerialNumber: syz [ 275.606799][ T5765] usb 7-1: config 0 descriptor?? [ 275.629096][ T5765] usb 7-1: selecting invalid altsetting 0 [ 275.774807][ T972] usb 2-1: not running at top speed; connect to a high speed hub [ 275.828715][ T972] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 275.884754][ T972] usb 2-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice= 1.00 [ 275.944313][ T5765] usb 7-1: USB disconnect, device number 5 [ 275.976007][ T972] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 276.066049][ T972] usb 2-1: Product: syz [ 276.086737][ T972] usb 2-1: Manufacturer: syz [ 276.123623][ T972] usb 2-1: SerialNumber: syz [ 276.188410][ T972] keyspan 2-1:1.0: Keyspan 4 port adapter converter detected [ 276.247828][ T972] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 81 [ 276.301998][ T972] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 88 [ 276.357834][ T972] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 1 [ 276.473375][ T972] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 276.531934][ T972] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 2 [ 276.607532][ T972] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 276.681190][ T972] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 4 [ 276.784295][ T972] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 276.860937][ T972] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 6 [ 276.937769][ T972] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 277.071971][ T972] usb 2-1: USB disconnect, device number 11 [ 277.180895][ T972] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 277.319904][ T972] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 277.508915][ T972] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 277.513581][ T9920] loop6: detected capacity change from 0 to 128 [ 277.652209][ T972] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 277.769949][ T972] keyspan 2-1:1.0: device disconnected [ 277.874374][ T9925] netlink: 208052 bytes leftover after parsing attributes in process `syz.6.1099'. [ 278.987892][ T9944] device-mapper: table: 248:0: thin-pool: target type may not be included in a read-only table (-EINVAL) [ 279.013443][ T9944] device-mapper: ioctl: error adding target to table [ 279.519322][ T6750] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 279.576297][ T6750] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.760552][ T6750] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 279.795755][ T6750] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 280.066187][ T6750] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 280.120641][ T6750] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 280.369014][ T6750] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 280.416797][ T6750] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 281.079920][ T5087] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 281.098869][ T5087] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 281.126623][ T5087] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 281.142027][ T5087] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 281.151900][ T5087] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 281.168362][ T5087] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 281.312495][ T6750] tipc: Left network mode [ 282.712433][ T9972] chnl_net:caif_netlink_parms(): no params data found [ 283.286035][ T51] Bluetooth: hci3: command tx timeout [ 283.466319][ T9972] bridge0: port 1(bridge_slave_0) entered blocking state [ 283.473788][ T9972] bridge0: port 1(bridge_slave_0) entered disabled state [ 283.536939][ T9972] bridge_slave_0: entered allmulticast mode [ 283.544657][ T9972] bridge_slave_0: entered promiscuous mode [ 283.593052][ T9972] bridge0: port 2(bridge_slave_1) entered blocking state [ 283.625976][ T9972] bridge0: port 2(bridge_slave_1) entered disabled state [ 283.643815][ T9972] bridge_slave_1: entered allmulticast mode [ 283.667780][ T9972] bridge_slave_1: entered promiscuous mode [ 284.151254][ T9972] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 284.310196][ T9972] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 284.480500][ T6750] hsr_slave_0: left promiscuous mode [ 284.541471][ T6750] hsr_slave_1: left promiscuous mode [ 284.573349][ T6750] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 284.615966][ T6750] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 284.649211][ T6750] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 284.692037][ T6750] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 284.737894][ T6750] bridge_slave_1: left allmulticast mode [ 284.743608][ T6750] bridge_slave_1: left promiscuous mode [ 284.778481][ T6750] bridge0: port 2(bridge_slave_1) entered disabled state [ 284.810951][ T6750] bridge_slave_0: left allmulticast mode [ 284.839141][ T6750] bridge_slave_0: left promiscuous mode [ 284.845214][ T6750] bridge0: port 1(bridge_slave_0) entered disabled state [ 285.049537][ T6750] veth1_macvtap: left promiscuous mode [ 285.055162][ T6750] veth0_macvtap: left promiscuous mode [ 285.087207][ T6750] veth1_vlan: left promiscuous mode [ 285.092645][ T6750] veth0_vlan: left promiscuous mode [ 285.366032][ T51] Bluetooth: hci3: command tx timeout [ 287.446078][ T51] Bluetooth: hci3: command tx timeout [ 287.494020][ T6750] team0 (unregistering): Port device team_slave_1 removed [ 287.619884][ T6750] team0 (unregistering): Port device team_slave_0 removed [ 287.774029][ T6750] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 287.849441][T10039] loop6: detected capacity change from 0 to 32768 [ 287.869621][T10039] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop6 scanned by syz.6.1129 (10039) [ 287.942159][T10039] BTRFS info (device loop6): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 287.943414][ T6750] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 288.005993][T10039] BTRFS info (device loop6): using blake2b (blake2b-256-generic) checksum algorithm [ 288.036428][T10039] BTRFS info (device loop6): using free space tree [ 288.379541][T10039] BTRFS info (device loop6): enabling ssd optimizations [ 288.387127][T10039] BTRFS info (device loop6): auto enabling async discard [ 288.566936][ T28] kauditd_printk_skb: 19 callbacks suppressed [ 288.566997][ T28] audit: type=1800 audit(1790065973.510:206): pid=10039 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.1129" name="file1" dev="loop6" ino=260 res=0 errno=0 [ 289.244636][ T8888] BTRFS info (device loop6): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 289.421402][ T6750] bond0 (unregistering): Released all slaves [ 289.537877][ T51] Bluetooth: hci3: command tx timeout [ 289.883286][ T9972] team0: Port device team_slave_0 added [ 289.968659][T10014] bridge_slave_0: left allmulticast mode [ 289.977115][T10014] bridge_slave_0: left promiscuous mode [ 289.984843][T10014] bridge0: port 1(bridge_slave_0) entered disabled state [ 289.995636][T10014] bridge_slave_1: left allmulticast mode [ 290.002482][T10014] bridge_slave_1: left promiscuous mode [ 290.010209][T10014] bridge0: port 2(bridge_slave_1) entered disabled state [ 290.036134][T10014] bond0: (slave bond_slave_0): Releasing backup interface [ 290.052064][T10014] bond0: (slave bond_slave_1): Releasing backup interface [ 290.073283][T10014] team0: Port device team_slave_0 removed [ 290.085177][T10014] team0: Port device team_slave_1 removed [ 290.106347][T10014] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 290.115599][T10014] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 290.142052][T10037] all: renamed from bridge_slave_0 (while UP) [ 290.192587][ T9972] team0: Port device team_slave_1 added [ 290.251622][ T9972] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 290.263514][ T9972] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 290.341977][ T9972] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 290.392326][ T9972] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 290.414228][ T9972] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 290.464473][ T9972] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 290.717601][ T9972] hsr_slave_0: entered promiscuous mode [ 290.747922][ T9972] hsr_slave_1: entered promiscuous mode [ 290.786077][ T9972] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 290.793979][ T9972] Cannot create hsr debugfs directory [ 290.994590][ T6750] IPVS: stop unused estimator thread 0... [ 291.042918][T10071] loop6: detected capacity change from 0 to 512 [ 291.111058][T10071] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 291.228577][T10071] EXT4-fs (loop6): 1 truncate cleaned up [ 291.245027][T10071] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 291.301804][T10071] EXT4-fs warning (device loop6): ext4_expand_extra_isize_ea:2858: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 291.536905][ T8888] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 291.999274][ T9972] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 292.046393][ T9972] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 292.093240][ T9972] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 292.154980][ T9972] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 292.520902][ T9972] 8021q: adding VLAN 0 to HW filter on device bond0 [ 292.611081][ T9972] 8021q: adding VLAN 0 to HW filter on device team0 [ 292.673979][ T70] bridge0: port 1(bridge_slave_0) entered blocking state [ 292.681313][ T70] bridge0: port 1(bridge_slave_0) entered forwarding state [ 292.772620][ T2901] bridge0: port 2(bridge_slave_1) entered blocking state [ 292.779953][ T2901] bridge0: port 2(bridge_slave_1) entered forwarding state [ 293.774312][ T9972] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 295.078817][ T9972] veth0_vlan: entered promiscuous mode [ 295.110479][T10141] loop6: detected capacity change from 0 to 8192 [ 295.150572][ T9972] veth1_vlan: entered promiscuous mode [ 295.163930][T10146] device-mapper: ioctl: device name cannot contain '/' [ 295.221274][T10148] device-mapper: ioctl: Invalid ioctl structure: name >ª W•tÉ¥ìÿŸ¿%Uó./dev, dev 178f517437743bef [ 295.291839][T10141] loop6: p1 p2 p3 p4 [ 295.299821][ T9972] veth0_macvtap: entered promiscuous mode [ 295.320892][T10141] loop6: partition table partially beyond EOD, truncated [ 295.361456][ T9972] veth1_macvtap: entered promiscuous mode [ 295.404834][T10141] loop6: p3 start 117772289 is beyond EOD, truncated [ 295.471470][T10141] loop6: p4 size 720896 extends beyond EOD, truncated [ 295.505413][ T9972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 295.583570][ T9972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 295.636018][ T9972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 295.688403][ T9972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 295.750086][ T9972] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 295.868577][ T9972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 295.913651][ T9972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 295.946676][ T9972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 295.986236][ T9972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 296.019254][ T9972] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 296.089997][ T5789] udevd[5789]: inotify_add_watch(7, /dev/loop6p2, 10) failed: No such file or directory [ 296.105000][ T5786] udevd[5786]: inotify_add_watch(7, /dev/loop6p4, 10) failed: No such file or directory [ 296.123653][ T5777] udevd[5777]: inotify_add_watch(7, /dev/loop6p1, 10) failed: No such file or directory [ 296.141721][ T9972] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 296.157092][ T9972] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 296.177684][ T9972] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 296.206286][ T9972] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 296.249235][T10154] bridge_slave_0: left allmulticast mode [ 296.261787][T10154] bridge0: port 1(bridge_slave_0) entered disabled state [ 296.280097][T10154] bridge_slave_1: left allmulticast mode [ 296.291026][T10154] bridge_slave_1: left promiscuous mode [ 296.299179][T10154] bridge0: port 2(bridge_slave_1) entered disabled state [ 296.317560][T10154] bond0: (slave bond_slave_0): Releasing backup interface [ 296.367151][T10154] bond0: (slave bond_slave_1): Releasing backup interface [ 296.487851][T10154] team0: Port device team_slave_0 removed [ 296.522235][T10154] team0: Port device team_slave_1 removed [ 296.535673][T10154] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 296.549141][T10154] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 296.563044][T10154] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 296.585693][T10154] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 296.968896][ T3435] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 297.050889][ T3435] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 297.143740][T10162] loop6: detected capacity change from 0 to 512 [ 297.159892][ T70] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 297.191661][ T70] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 297.261833][T10162] EXT4-fs (loop6): Test dummy encryption mode enabled [ 297.333603][T10162] EXT4-fs error (device loop6): ext4_orphan_get:1408: inode #15: comm syz.6.1156: inode has both inline data and extents flags [ 297.347503][T10162] EXT4-fs error (device loop6): ext4_orphan_get:1413: comm syz.6.1156: couldn't read orphan inode 15 (err -117) [ 297.367898][T10162] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 297.733502][T10168] netlink: 'syz.7.1112': attribute type 15 has an invalid length. [ 297.751626][ T8888] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 297.788630][T10168] netdevsim netdevsim7 netdevsim0: set [0, 0] type 1 family 0 port 2816 - 0 [ 297.798101][T10168] netdevsim netdevsim7 netdevsim1: set [0, 0] type 1 family 0 port 2816 - 0 [ 297.807582][T10168] netdevsim netdevsim7 netdevsim2: set [0, 0] type 1 family 0 port 2816 - 0 [ 297.817857][T10168] netdevsim netdevsim7 netdevsim3: set [0, 0] type 1 family 0 port 2816 - 0 [ 297.869523][T10168] netlink: 'syz.7.1112': attribute type 15 has an invalid length. [ 298.595183][T10183] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1159'. [ 300.041318][T10217] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1170'. [ 300.216144][T10222] ip_tables: iptables: counters copy to user failed while replacing table [ 301.281495][T10245] loop6: detected capacity change from 0 to 256 [ 301.378599][T10245] FAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 302.564129][T10267] loop6: detected capacity change from 0 to 1024 [ 302.671088][T10267] hfsplus: wrong filesystem version [ 303.391208][T10291] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1193'. [ 303.927734][T10301] loop7: detected capacity change from 0 to 164 [ 306.436328][ T9972] ffs_data_put(): freeing [ 308.608221][T10385] 9pnet: p9_errstr2errno: server reported unknown error [ 308.876030][ T5814] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 309.078705][ T5814] usb 7-1: Using ep0 maxpacket: 16 [ 309.091711][ T5814] usb 7-1: config 0 has an invalid interface number: 34 but max is 0 [ 309.110278][ T5814] usb 7-1: config 0 has no interface number 0 [ 309.125479][ T5814] usb 7-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 309.156108][ T5814] usb 7-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 309.185176][ T5814] usb 7-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 309.215069][ T5814] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 309.242165][ T5814] usb 7-1: Product: syz [ 309.252524][ T5814] usb 7-1: Manufacturer: syz [ 309.265441][ T5814] usb 7-1: SerialNumber: syz [ 309.288545][ T5814] usb 7-1: config 0 descriptor?? [ 309.322270][T10388] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 309.341192][T10388] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 309.607436][T10400] block nbd7: NBD_DISCONNECT [ 309.617698][T10388] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 309.634090][T10400] block nbd7: Disconnected due to user request. [ 309.653139][T10388] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 309.661329][T10400] block nbd7: shutting down sockets [ 309.895330][ T5814] asix 7-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 310.688442][ T5814] asix 7-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 310.735654][ T5814] asix: probe of 7-1:0.34 failed with error -71 [ 310.788809][ T5814] usb 7-1: USB disconnect, device number 6 [ 310.845262][ T5777] udevd[5777]: setting owner of /dev/bus/usb/007/006 to uid=0, gid=0 failed: No such file or directory [ 311.249488][T10420] loop7: detected capacity change from 0 to 32768 [ 311.271566][T10420] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop7 scanned by syz.7.1229 (10420) [ 311.320405][T10420] BTRFS info (device loop7): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 311.361172][T10420] BTRFS info (device loop7): using sha256 (sha256-avx2) checksum algorithm [ 311.436003][T10420] BTRFS info (device loop7): disabling tree log [ 311.442351][T10420] BTRFS info (device loop7): using free space tree [ 311.449351][ T28] audit: type=1326 audit(1790065996.380:207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10425 comm="syz.4.1231" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f588559e159 code=0x0 [ 311.719109][T10420] BTRFS info (device loop7): enabling ssd optimizations [ 311.729567][T10420] BTRFS info (device loop7): auto enabling async discard [ 312.297133][ T6755] BTRFS info (device loop7): qgroup scan completed (inconsistency flag cleared) [ 312.324621][ T9972] BTRFS info (device loop7): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 313.742137][T10470] loop7: detected capacity change from 0 to 32768 [ 313.788270][T10482] ip_tables: iptables: counters copy to user failed while replacing table [ 313.795325][T10470] loop7: p1 p3 < > [ 313.846375][ T5778] Bluetooth: hci4: command 0x1003 tx timeout [ 313.846893][ T51] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 314.086110][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 314.348531][T10490] FAULT_INJECTION: forcing a failure. [ 314.348531][T10490] name failslab, interval 1, probability 0, space 0, times 0 [ 314.416063][T10490] CPU: 1 PID: 10490 Comm: syz.6.1245 Not tainted syzkaller #0 [ 314.423610][T10490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 314.433791][T10490] Call Trace: [ 314.437109][T10490] [ 314.440077][T10490] dump_stack_lvl+0x18c/0x250 [ 314.444830][T10490] ? show_regs_print_info+0x20/0x20 [ 314.450082][T10490] ? load_image+0x420/0x420 [ 314.454638][T10490] ? __might_sleep+0xe0/0xe0 [ 314.459271][T10490] ? __lock_acquire+0x7d80/0x7d80 [ 314.464349][T10490] should_fail_ex+0x394/0x4c0 [ 314.469088][T10490] should_failslab+0x9/0x20 [ 314.473636][T10490] slab_pre_alloc_hook+0x59/0x300 [ 314.478712][T10490] ? kstrdup_quotable_cmdline+0x5a/0x3c0 [ 314.484392][T10490] __kmem_cache_alloc_node+0x53/0x250 [ 314.489815][T10490] ? kstrdup_quotable_cmdline+0x5a/0x3c0 [ 314.495499][T10490] kmalloc_trace+0x2a/0xe0 [ 314.499979][T10490] kstrdup_quotable_cmdline+0x5a/0x3c0 [ 314.505485][T10490] ? _raw_spin_lock_irq+0xbb/0xf0 [ 314.510638][T10490] ? _raw_spin_lock_irqsave+0x100/0x100 [ 314.516232][T10490] __report_access+0x49/0x380 [ 314.520961][T10490] ? lockdep_hardirqs_on+0x98/0x150 [ 314.526205][T10490] task_work_run+0x1d4/0x260 [ 314.530851][T10490] ? task_work_cancel+0x220/0x220 [ 314.535925][T10490] ? __se_sys_ptrace+0x3af/0x410 [ 314.540927][T10490] ? exit_to_user_mode_loop+0x3b/0x110 [ 314.546440][T10490] exit_to_user_mode_loop+0xe6/0x110 [ 314.551782][T10490] exit_to_user_mode_prepare+0xee/0x180 [ 314.557555][T10490] syscall_exit_to_user_mode+0x1a/0x50 [ 314.563071][T10490] do_syscall_64+0x61/0xb0 [ 314.567538][T10490] ? clear_bhb_loop+0x40/0x90 [ 314.572258][T10490] ? clear_bhb_loop+0x40/0x90 [ 314.577075][T10490] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 314.583011][T10490] RIP: 0033:0x7fb764b9e159 [ 314.587475][T10490] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 314.607137][T10490] RSP: 002b:00007fb7659ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000065 [ 314.615601][T10490] RAX: ffffffffffffffff RBX: 00007fb764e25fa0 RCX: 00007fb764b9e159 [ 314.623616][T10490] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000010 [ 314.631819][T10490] RBP: 00007fb764c3506b R08: 0000000000000000 R09: 0000000000000000 [ 314.639827][T10490] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 314.647925][T10490] R13: 00007fb764e26038 R14: 00007fb764e25fa0 R15: 00007ffdc6501cd8 [ 314.656045][T10490] [ 314.776429][T10490] ptrace attach of "(null)"[8888] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[10490] [ 315.187808][T10499] syz_tun: entered allmulticast mode [ 315.210959][ T5777] udevd[5777]: inotify_add_watch(7, /dev/loop7p1, 10) failed: No such file or directory [ 315.218317][T10499] lo: entered allmulticast mode [ 315.250661][ T5789] udevd[5789]: inotify_add_watch(7, /dev/loop7p3, 10) failed: No such file or directory [ 315.296142][T10499] lo: left allmulticast mode [ 315.304725][T10498] syz_tun: left allmulticast mode [ 315.682886][T10489] loop7: detected capacity change from 0 to 32768 [ 315.776084][T10489] XFS (loop7): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 315.902889][T10489] XFS (loop7): Ending clean mount [ 316.174543][ T9972] XFS (loop7): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 316.838312][T10527] loop6: detected capacity change from 0 to 16 [ 316.864435][T10527] erofs: (device loop6): mounted with root inode @ nid 36. [ 316.925649][T10527] erofs: (device loop6): z_erofs_readahead: readahead error at folio 155 @ nid 36 [ 316.935067][T10527] erofs: (device loop6): z_erofs_readahead: readahead error at folio 154 @ nid 36 [ 316.944452][T10527] erofs: (device loop6): z_erofs_readahead: readahead error at folio 153 @ nid 36 [ 316.953868][T10527] erofs: (device loop6): z_erofs_readahead: readahead error at folio 152 @ nid 36 [ 316.964562][T10527] erofs: (device loop6): z_erofs_readahead: readahead error at folio 139 @ nid 36 [ 316.973994][T10527] erofs: (device loop6): z_erofs_readahead: readahead error at folio 138 @ nid 36 [ 316.983804][T10527] erofs: (device loop6): z_erofs_readahead: readahead error at folio 137 @ nid 36 [ 316.993344][T10527] erofs: (device loop6): z_erofs_readahead: readahead error at folio 136 @ nid 36 [ 317.003030][T10527] erofs: (device loop6): z_erofs_readahead: readahead error at folio 128 @ nid 36 [ 317.012636][T10527] erofs: (device loop6): z_erofs_readahead: readahead error at folio 120 @ nid 36 [ 317.023190][T10527] bio_check_eod: 2 callbacks suppressed [ 317.023207][T10527] syz.6.1258: attempt to access beyond end of device [ 317.023207][T10527] loop6: rw=524288, sector=13478624032, nr_sectors = 32 limit=16 [ 317.044045][T10527] syz.6.1258: attempt to access beyond end of device [ 317.044045][T10527] loop6: rw=524288, sector=13478624040, nr_sectors = 32 limit=16 [ 317.059612][T10527] syz.6.1258: attempt to access beyond end of device [ 317.059612][T10527] loop6: rw=524288, sector=14550774152, nr_sectors = 32 limit=16 [ 317.075202][T10527] syz.6.1258: attempt to access beyond end of device [ 317.075202][T10527] loop6: rw=524288, sector=14550774160, nr_sectors = 32 limit=16 [ 317.089767][T10527] syz.6.1258: attempt to access beyond end of device [ 317.089767][T10527] loop6: rw=524288, sector=13716630376, nr_sectors = 32 limit=16 [ 317.104460][T10527] syz.6.1258: attempt to access beyond end of device [ 317.104460][T10527] loop6: rw=524288, sector=13716630384, nr_sectors = 32 limit=16 [ 317.119045][T10527] syz.6.1258: attempt to access beyond end of device [ 317.119045][T10527] loop6: rw=524288, sector=790384, nr_sectors = 32 limit=16 [ 317.133325][T10527] syz.6.1258: attempt to access beyond end of device [ 317.133325][T10527] loop6: rw=524288, sector=790392, nr_sectors = 32 limit=16 [ 317.147465][T10527] syz.6.1258: attempt to access beyond end of device [ 317.147465][T10527] loop6: rw=524288, sector=72, nr_sectors = 32 limit=16 [ 317.161610][T10527] syz.6.1258: attempt to access beyond end of device [ 317.161610][T10527] loop6: rw=524288, sector=80, nr_sectors = 32 limit=16 [ 317.542553][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.550968][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.575567][T10536] loop7: detected capacity change from 0 to 2048 [ 317.727622][T10536] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 319.598317][T10570] loop6: detected capacity change from 0 to 4096 [ 319.660456][ T9972] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 319.691786][T10570] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 319.801709][ T8888] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 320.409771][T10586] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1272'. [ 320.465377][T10586] netlink: 14 bytes leftover after parsing attributes in process `syz.5.1272'. [ 321.184851][T10602] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1277'. [ 321.232045][T10602] ipvlan2: entered allmulticast mode [ 321.277116][T10602] syz_tun: entered allmulticast mode [ 323.783084][T10652] netlink: 'syz.6.1290': attribute type 1 has an invalid length. [ 324.293648][T10660] netlink: 'syz.4.1291': attribute type 10 has an invalid length. [ 324.346800][ T5814] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 324.359901][T10660] bridge0: port 2(bridge_slave_1) entered blocking state [ 324.368750][T10660] bridge0: port 2(bridge_slave_1) entered listening state [ 324.377882][T10660] bridge0: port 1(bridge_slave_0) entered blocking state [ 324.386914][T10660] bridge0: port 1(bridge_slave_0) entered listening state [ 324.498232][T10660] bridge0: entered promiscuous mode [ 324.545880][ T5814] usb 7-1: Using ep0 maxpacket: 16 [ 324.546501][T10660] bridge0: port 2(bridge_slave_1) entered disabled state [ 324.561139][T10660] bridge0: port 1(bridge_slave_0) entered disabled state [ 324.565715][ T5814] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 324.618108][ T5814] usb 7-1: config 0 interface 0 has no altsetting 0 [ 324.650504][ T5814] usb 7-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 324.664054][ T5814] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.700539][ T5814] usb 7-1: Product: syz [ 324.725246][ T5814] usb 7-1: Manufacturer: syz [ 324.744751][ T5814] usb 7-1: SerialNumber: syz [ 324.767279][ T5814] usb 7-1: config 0 descriptor?? [ 324.981691][T10648] loop7: detected capacity change from 0 to 32768 [ 325.062955][ T5814] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/input/input9 [ 325.143089][T10648] XFS (loop7): DAX unsupported by block device. Turning off DAX. [ 325.213446][T10648] XFS (loop7): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 325.424474][T10648] XFS (loop7): Ending clean mount [ 325.472855][T10648] XFS (loop7): Quotacheck needed: Please wait. [ 325.710924][T10648] XFS (loop7): Quotacheck: Done. [ 325.756828][ T5814] rc_core: IR keymap rc-imon-pad not found [ 325.785423][ T5814] Registered IR keymap rc-empty [ 325.795403][ T5814] imon 7-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 325.848454][ T5814] imon 7-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 325.930997][ T5814] rc rc0: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0 [ 326.004912][ T5814] input: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0/input10 [ 326.063187][ T5814] imon 7-1:0.0: iMON device (15c2:0041, intf0) on usb<7:7> initialized [ 326.112867][ T9972] XFS (loop7): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 326.571383][ C1] imon 7-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 326.594448][ T5844] usb 7-1: USB disconnect, device number 7 [ 331.696790][ T5816] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 331.992232][ T5816] usb 7-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 332.046074][ T5816] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 332.055809][ T5816] usb 7-1: Product: syz [ 332.116104][ T5816] usb 7-1: Manufacturer: syz [ 332.121843][ T5816] usb 7-1: SerialNumber: syz [ 332.452444][ T5816] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -32 [ 332.600296][ T5816] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -32 [ 333.326325][ T5816] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -71 [ 333.416211][ T5816] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 333.509671][ T5816] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 333.683637][ T5816] lan78xx: probe of 7-1:1.0 failed with error -71 [ 333.877232][ T5816] usb 7-1: USB disconnect, device number 8 [ 336.841828][T10864] tls_set_device_offload: netdev not found [ 337.580468][T10876] loop7: detected capacity change from 0 to 128 [ 337.648580][ T5777] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 337.687224][T10876] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1348'. [ 337.718446][T10876] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1348'. [ 338.006346][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 338.841005][ T28] audit: type=1326 audit(1790066023.790:208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10894 comm="syz.7.1356" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 338.905695][ T28] audit: type=1326 audit(1790066023.790:209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10894 comm="syz.7.1356" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 338.974471][ T28] audit: type=1326 audit(1790066023.830:210): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10894 comm="syz.7.1356" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 339.070989][ T28] audit: type=1326 audit(1790066023.830:211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10894 comm="syz.7.1356" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 339.170466][ T28] audit: type=1326 audit(1790066023.830:212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10894 comm="syz.7.1356" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 339.260901][ T28] audit: type=1326 audit(1790066023.830:213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10894 comm="syz.7.1356" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=290 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 339.348045][ T28] audit: type=1326 audit(1790066023.830:214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10894 comm="syz.7.1356" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 339.413956][ T28] audit: type=1326 audit(1790066023.830:215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10894 comm="syz.7.1356" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 339.503015][ T28] audit: type=1326 audit(1790066023.830:216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10894 comm="syz.7.1356" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=206 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 339.613301][ T28] audit: type=1326 audit(1790066023.830:217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10894 comm="syz.7.1356" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 341.463805][T10911] loop7: detected capacity change from 0 to 32768 [ 341.620745][T10911] XFS (loop7): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 341.764889][T10911] XFS (loop7): Ending clean mount [ 342.078152][ T9972] XFS (loop7): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 343.070174][T10950] netlink: 'syz.7.1373': attribute type 3 has an invalid length. [ 343.488251][T10956] netlink: 'syz.6.1375': attribute type 25 has an invalid length. [ 343.519487][T10956] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1375'. [ 343.590560][T10956] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 343.599727][T10956] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 343.608573][T10956] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 343.617535][T10956] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 343.901139][T10960] overlayfs: failed to clone upperpath [ 343.977999][T10956] netlink: 'syz.6.1375': attribute type 25 has an invalid length. [ 344.000982][ T28] kauditd_printk_skb: 3 callbacks suppressed [ 344.001005][ T28] audit: type=1326 audit(1790066028.950:221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10962 comm="syz.7.1379" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 344.079491][T10956] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1375'. [ 344.113927][ T28] audit: type=1326 audit(1790066028.950:222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10962 comm="syz.7.1379" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 344.210841][ T28] audit: type=1326 audit(1790066028.950:223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10962 comm="syz.7.1379" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 344.282323][ T28] audit: type=1326 audit(1790066028.950:224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10962 comm="syz.7.1379" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 344.380589][ T28] audit: type=1326 audit(1790066028.990:225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10962 comm="syz.7.1379" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 344.536032][ T28] audit: type=1326 audit(1790066028.990:226): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10962 comm="syz.7.1379" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 344.634181][ T28] audit: type=1326 audit(1790066028.990:227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10962 comm="syz.7.1379" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 344.744968][ T28] audit: type=1326 audit(1790066028.990:228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10962 comm="syz.7.1379" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 344.838007][ T28] audit: type=1326 audit(1790066028.990:229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10962 comm="syz.7.1379" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=434 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 344.944601][ T28] audit: type=1326 audit(1790066028.990:230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10962 comm="syz.7.1379" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4b39e159 code=0x7ffc0000 [ 345.051770][T10977] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1384'. [ 345.107335][T10977] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1384'. [ 345.662138][T10973] loop7: detected capacity change from 0 to 32768 [ 345.706302][T10973] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop7 scanned by syz.7.1383 (10973) [ 345.795054][T10973] BTRFS info (device loop7): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 345.830609][T10973] BTRFS info (device loop7): using blake2b (blake2b-256-generic) checksum algorithm [ 345.878002][T10973] BTRFS info (device loop7): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 345.919849][T10973] BTRFS info (device loop7): use zstd compression, level 3 [ 345.954870][T10973] BTRFS info (device loop7): using free space tree [ 346.162519][T10973] BTRFS info (device loop7): enabling ssd optimizations [ 346.169745][T10973] BTRFS info (device loop7): auto enabling async discard [ 346.611427][ T9972] BTRFS info (device loop7): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 347.086213][T11014] loop7: detected capacity change from 0 to 512 [ 347.195848][T11014] EXT4-fs warning (device loop7): dx_probe:869: inode #2: comm syz.7.1392: Unimplemented hash flags: 0x0001 [ 347.256083][ T5765] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 347.279361][T11014] EXT4-fs warning (device loop7): dx_probe:966: inode #2: comm syz.7.1392: Corrupt directory, running e2fsck is recommended [ 347.379547][T11014] EXT4-fs (loop7): Cannot turn on journaled quota: type 1: error -117 [ 347.439205][T11014] EXT4-fs error (device loop7): ext4_iget_extra_inode:4752: inode #15: comm syz.7.1392: corrupted in-inode xattr: invalid ea_ino [ 347.512956][T11014] EXT4-fs error (device loop7): ext4_orphan_get:1413: comm syz.7.1392: couldn't read orphan inode 15 (err -117) [ 347.585569][ T5765] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 347.617618][T11014] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 347.638029][ T5765] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 347.691786][ T5765] usb 7-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 347.735419][T11014] EXT4-fs warning (device loop7): dx_probe:869: inode #2: comm syz.7.1392: Unimplemented hash flags: 0x0001 [ 347.756141][ T5765] usb 7-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 347.765259][ T5765] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 347.820667][T11014] EXT4-fs warning (device loop7): dx_probe:966: inode #2: comm syz.7.1392: Corrupt directory, running e2fsck is recommended [ 347.896313][T11014] EXT4-fs error (device loop7): ext4_readdir:263: inode #2: block 3: comm syz.7.1392: path /72/file0: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=4294967295, rec_len=17, size=1024 fake=0 [ 348.137701][ T9972] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 348.167788][T11024] 9pnet_fd: Insufficient options for proto=fd [ 348.619969][ T5765] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 348.636936][ T5765] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 348.668179][ T5765] cxacru: probe of 7-1:1.0 failed with error -71 [ 348.724487][ T5765] usb 7-1: USB disconnect, device number 9 [ 350.326026][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 350.870720][T11051] netlink: 27 bytes leftover after parsing attributes in process `syz.7.1406'. [ 351.432891][T11061] ptrace attach of ""[11062] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[11061] [ 354.869741][T11097] gadgetfs: bound to dummy_udc driver [ 355.367855][ T8] IPVS: starting estimator thread 0... [ 355.496581][T11107] IPVS: using max 21 ests per chain, 50400 per kthread [ 356.592076][ T28] kauditd_printk_skb: 41 callbacks suppressed [ 356.592235][ T28] audit: type=1326 audit(1790066041.540:271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11122 comm="syz.4.1436" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f588559e159 code=0x0 [ 357.436765][T11137] loop7: detected capacity change from 0 to 4096 [ 357.658276][T11137] ntfs3: loop7: ino=19, mi_enum_attr [ 357.663767][T11137] ntfs3: loop7: Mark volume as dirty due to NTFS errors [ 357.850544][ T28] audit: type=1800 audit(1790066042.800:272): pid=11137 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.1441" name="file2" dev="loop7" ino=31 res=0 errno=0 [ 359.485957][ T5844] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 359.679901][ T5844] usb 8-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 359.692420][ T5844] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.715219][ T5844] usb 8-1: config 0 descriptor?? [ 359.730432][ T5844] cp210x 8-1:0.0: cp210x converter detected [ 360.396059][ T5844] cp210x 8-1:0.0: failed to get vendor val 0x370c size 73: -71 [ 360.403714][ T5844] cp210x 8-1:0.0: GPIO initialisation failed: -71 [ 360.455967][ T5844] usb 8-1: cp210x converter now attached to ttyUSB0 [ 360.475306][ T5844] usb 8-1: USB disconnect, device number 2 [ 360.539395][ T5844] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 360.587949][ T5844] cp210x 8-1:0.0: device disconnected [ 363.464564][T11240] loop6: detected capacity change from 0 to 1024 [ 364.346780][T11267] "syz.7.1485" (11267) uses obsolete ecb(arc4) skcipher [ 364.562750][T11272] loop7: detected capacity change from 0 to 128 [ 364.613639][ T28] audit: type=1800 audit(1790066049.560:273): pid=11272 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.1489" name="bus" dev="loop7" ino=1048623 res=0 errno=0 [ 364.777951][ T9972] FAT-fs (loop7): error, fat_free_clusters: deleting FAT entry beyond EOF [ 364.811267][ T9972] FAT-fs (loop7): Filesystem has been set read-only [ 365.216677][ T5765] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 365.378255][T11286] size and base must be multiples of 4 kiB [ 365.378271][T11286] CPU: 1 PID: 11286 Comm: syz.6.1495 Not tainted syzkaller #0 [ 365.378304][T11286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 365.378315][T11286] Call Trace: [ 365.378380][T11286] [ 365.378423][T11286] dump_stack_lvl+0x18c/0x250 [ 365.378585][T11286] ? show_regs_print_info+0x20/0x20 [ 365.378630][T11286] ? load_image+0x420/0x420 [ 365.378670][T11286] ? __lock_acquire+0x7d80/0x7d80 [ 365.378743][T11286] mtrr_add+0xd0/0x100 [ 365.378785][T11286] mtrr_ioctl+0xc96/0x13a0 [ 365.378816][T11286] ? mtrr_close+0x200/0x200 [ 365.378851][T11286] ? __fget_files+0x28/0x460 [ 365.378910][T11286] ? mtrr_close+0x200/0x200 [ 365.378934][T11286] proc_reg_unlocked_ioctl+0x1d2/0x2c0 [ 365.378974][T11286] ? proc_reg_poll+0x290/0x290 [ 365.378998][T11286] __se_sys_ioctl+0xfd/0x170 [ 365.379027][T11286] do_syscall_64+0x55/0xb0 [ 365.379052][T11286] ? clear_bhb_loop+0x40/0x90 [ 365.379139][T11286] ? clear_bhb_loop+0x40/0x90 [ 365.379169][T11286] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 365.379196][T11286] RIP: 0033:0x7fb764b9e159 [ 365.379237][T11286] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 365.379282][T11286] RSP: 002b:00007fb7659cc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 365.379307][T11286] RAX: ffffffffffffffda RBX: 00007fb764e26090 RCX: 00007fb764b9e159 [ 365.379323][T11286] RDX: 0000200000000a00 RSI: 00000000400c4d01 RDI: 0000000000000004 [ 365.379337][T11286] RBP: 00007fb764c3506b R08: 0000000000000000 R09: 0000000000000000 [ 365.379350][T11286] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 365.379363][T11286] R13: 00007fb764e26128 R14: 00007fb764e26090 R15: 00007ffdc6501cd8 [ 365.379395][T11286] [ 365.456270][ T5765] usb 8-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 365.456312][ T5765] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 365.456333][ T5765] usb 8-1: Product: syz [ 365.456349][ T5765] usb 8-1: Manufacturer: syz [ 365.456364][ T5765] usb 8-1: SerialNumber: syz [ 365.458888][ T5765] usb 8-1: config 0 descriptor?? [ 365.463044][ T5765] ch341 8-1:0.0: ch341-uart converter detected [ 366.211759][ T5815] IPVS: starting estimator thread 0... [ 366.316054][T11297] IPVS: using max 18 ests per chain, 43200 per kthread [ 366.366732][T11302] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1499'. [ 366.422170][T11304] loop6: detected capacity change from 0 to 1024 [ 366.456194][T11304] EXT4-fs: Ignoring removed bh option [ 366.505510][ T5765] ch341-uart ttyUSB0: break control not supported, using simulated break [ 366.546267][ T5765] usb 8-1: ch341-uart converter now attached to ttyUSB0 [ 366.561716][T11304] EXT4-fs (loop6): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 366.595509][ T5765] usb 8-1: USB disconnect, device number 3 [ 366.636688][ T5765] ch341-uart ttyUSB0: ch341-uart converter now disconnected from ttyUSB0 [ 366.661584][T11304] ext4 filesystem being mounted at /206/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 366.687205][ T5765] ch341 8-1:0.0: device disconnected [ 366.881770][ T8888] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 368.720898][T11322] loop7: detected capacity change from 0 to 131072 [ 368.781482][T11322] F2FS-fs (loop7): invalid crc value [ 368.806553][T11322] F2FS-fs (loop7): Found nat_bits in checkpoint [ 368.875366][T11322] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e4 [ 369.800517][T11350] bridge1: entered promiscuous mode [ 369.825407][T11350] bridge1: entered allmulticast mode [ 371.204001][T11367] loop6: detected capacity change from 0 to 1024 [ 371.403608][T11367] hfsplus: found bad thread record in catalog [ 371.592674][T11367] hfsplus: bad catalog folder thread [ 371.837654][ T70] hfsplus: found bad thread record in catalog [ 371.866709][ T70] hfsplus: b-tree write err: -5, ino 8 [ 372.191716][T11379] 9pnet: p9_errstr2errno: server reported unknown error 18446744073709551615ÿÿ0x0000000000000003 [ 372.207645][T11381] loop7: detected capacity change from 0 to 512 [ 372.251104][T11381] EXT4-fs: Ignoring removed mblk_io_submit option [ 372.334383][T11381] EXT4-fs error (device loop7): ext4_iget_extra_inode:4752: inode #15: comm syz.7.1527: corrupted in-inode xattr: e_value size too large [ 372.424970][T11381] EXT4-fs error (device loop7): ext4_orphan_get:1413: comm syz.7.1527: couldn't read orphan inode 15 (err -117) [ 372.500853][T11381] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 372.686294][T11381] EXT4-fs error (device loop7): ext4_append:79: inode #2: comm syz.7.1527: Logical block already allocated [ 372.856635][ T9972] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 373.092861][T11398] netlink: 'syz.7.1532': attribute type 30 has an invalid length. [ 373.135269][T11398] netdevsim netdevsim7 netdevsim0: set [0, 1] type 1 family 0 port 8472 - 0 [ 373.144652][T11398] netdevsim netdevsim7 netdevsim1: set [0, 1] type 1 family 0 port 8472 - 0 [ 373.153915][T11398] netdevsim netdevsim7 netdevsim2: set [0, 1] type 1 family 0 port 8472 - 0 [ 373.162932][T11398] netdevsim netdevsim7 netdevsim3: set [0, 1] type 1 family 0 port 8472 - 0 [ 373.226401][T11398] netdevsim netdevsim7 netdevsim0: unset [0, 1] type 1 family 0 port 8472 - 0 [ 373.235517][T11398] netdevsim netdevsim7 netdevsim1: unset [0, 1] type 1 family 0 port 8472 - 0 [ 373.245217][T11398] netdevsim netdevsim7 netdevsim2: unset [0, 1] type 1 family 0 port 8472 - 0 [ 373.254594][T11398] netdevsim netdevsim7 netdevsim3: unset [0, 1] type 1 family 0 port 8472 - 0 [ 373.528273][T11398] netlink: 'syz.7.1532': attribute type 30 has an invalid length. [ 373.543150][T11398] netdevsim netdevsim7 netdevsim0: set [0, 1] type 1 family 0 port 8472 - 0 [ 373.552462][T11398] netdevsim netdevsim7 netdevsim1: set [0, 1] type 1 family 0 port 8472 - 0 [ 373.561782][T11398] netdevsim netdevsim7 netdevsim2: set [0, 1] type 1 family 0 port 8472 - 0 [ 373.570677][T11398] netdevsim netdevsim7 netdevsim3: set [0, 1] type 1 family 0 port 8472 - 0 [ 373.648408][T11398] netdevsim netdevsim7 netdevsim0: unset [0, 1] type 1 family 0 port 8472 - 0 [ 373.658340][T11398] netdevsim netdevsim7 netdevsim1: unset [0, 1] type 1 family 0 port 8472 - 0 [ 373.668091][T11398] netdevsim netdevsim7 netdevsim2: unset [0, 1] type 1 family 0 port 8472 - 0 [ 373.677657][T11398] netdevsim netdevsim7 netdevsim3: unset [0, 1] type 1 family 0 port 8472 - 0 [ 373.783092][T11410] pim6reg1: entered promiscuous mode [ 373.794466][T11410] pim6reg1: entered allmulticast mode [ 374.499848][ T5765] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 374.728160][ T5765] usb 7-1: config 0 has an invalid interface number: 64 but max is 0 [ 374.756599][ T5765] usb 7-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 374.800800][ T5765] usb 7-1: config 0 has no interface number 0 [ 374.839597][ T5765] usb 7-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 374.855569][ T5765] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 374.892921][ T5765] usb 7-1: Product: syz [ 374.910014][ T5765] usb 7-1: Manufacturer: syz [ 374.931883][ T5765] usb 7-1: SerialNumber: syz [ 374.958888][ T5765] usb 7-1: config 0 descriptor?? [ 375.141919][T11438] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1548'. [ 375.157935][T11438] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1548'. [ 375.426128][ T5765] usb 7-1: Found UVC 0.00 device syz (046d:0823) [ 375.444239][ T5765] usb 7-1: No valid video chain found. [ 375.674826][ T5765] usb 7-1: USB disconnect, device number 10 [ 376.566141][ T5765] usb 7-1: new full-speed USB device number 11 using dummy_hcd [ 376.780716][ T5765] usb 7-1: config 4 has an invalid interface number: 44 but max is 0 [ 376.790858][T11469] device-mapper: table: 248:2: thin: Invalid argument count (-EINVAL) [ 376.805914][ T5765] usb 7-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 376.819228][ T5765] usb 7-1: config 4 has no interface number 0 [ 376.826428][T11469] device-mapper: ioctl: error adding target to table [ 376.827935][ T5765] usb 7-1: config 4 interface 44 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 376.850731][ T5765] usb 7-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice= 5.20 [ 376.860565][ T5765] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 376.869869][ T5765] usb 7-1: Product: syz [ 376.874168][ T5765] usb 7-1: Manufacturer: syz [ 376.879077][ T5765] usb 7-1: SerialNumber: syz [ 377.336033][ T5765] dvb-usb: found a 'Gigabyte U7000' in warm state. [ 377.378800][ T5765] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 377.431516][ T5765] dvbdev: DVB: registering new adapter (Gigabyte U7000) [ 377.445284][ T5765] usb 7-1: media controller created [ 377.462303][ T5765] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 377.586219][T11461] i2c i2c-1: Invalid block size returned: 70 [ 377.623685][ T5765] DVB: Unable to find symbol dib7000p_attach() [ 377.642384][ T5765] dvb-usb: no frontend was attached by 'Gigabyte U7000' [ 377.897859][ T5765] rc_core: IR keymap rc-dib0700-rc5 not found [ 377.919422][ T5765] Registered IR keymap rc-empty [ 377.946214][ T5765] dvb-usb: could not initialize remote control. [ 377.952538][ T5765] dvb-usb: Gigabyte U7000 successfully initialized and connected. [ 378.015673][ T5765] usb 7-1: USB disconnect, device number 11 [ 378.022700][T11488] x86/PAT: syz.7.1567:11488 freeing invalid memtype [mem 0xfe004000-0xfe004fff] [ 378.136518][ T5765] dvb-usb: Gigabyte U7000 successfully deinitialized and disconnected. [ 378.997534][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.004867][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.058172][T11517] xt_CT: You must specify a L4 protocol and not use inversions on it [ 381.394028][T11537] loop6: detected capacity change from 0 to 2048 [ 381.490184][T11537] loop6: p3 < > p4 < > [ 381.494795][T11537] loop6: partition table partially beyond EOD, truncated [ 381.519733][T11537] loop6: p3 start 4284289 is beyond EOD, truncated [ 381.824738][ T5777] udevd[5777]: inotify_add_watch(7, /dev/loop6p4, 10) failed: No such file or directory [ 381.984856][T11546] netlink: 'syz.6.1591': attribute type 1 has an invalid length. [ 384.842059][T11574] FAULT_INJECTION: forcing a failure. [ 384.842059][T11574] name failslab, interval 1, probability 0, space 0, times 0 [ 384.896047][T11574] CPU: 1 PID: 11574 Comm: syz.6.1603 Not tainted syzkaller #0 [ 384.904197][T11574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 384.914287][T11574] Call Trace: [ 384.917854][T11574] [ 384.920818][T11574] dump_stack_lvl+0x18c/0x250 [ 384.925554][T11574] ? show_regs_print_info+0x20/0x20 [ 384.930909][T11574] ? load_image+0x420/0x420 [ 384.935466][T11574] ? __lock_acquire+0x7d80/0x7d80 [ 384.940539][T11574] ? trace_raw_output_contention_end+0xd0/0xd0 [ 384.946856][T11574] should_fail_ex+0x394/0x4c0 [ 384.951819][T11574] should_failslab+0x9/0x20 [ 384.956413][T11574] slab_pre_alloc_hook+0x59/0x300 [ 384.961571][T11574] ? __inet_diag_dump_start+0x8b/0x9f0 [ 384.967217][T11574] __kmem_cache_alloc_node+0x53/0x250 [ 384.972762][T11574] ? __inet_diag_dump_start+0x8b/0x9f0 [ 384.978449][T11574] kmalloc_trace+0x2a/0xe0 [ 384.983010][T11574] __inet_diag_dump_start+0x8b/0x9f0 [ 384.988445][T11574] ? netlink_lookup+0x30/0x200 [ 384.993338][T11574] ? netlink_lookup+0x30/0x200 [ 384.998262][T11574] __netlink_dump_start+0x43c/0x7a0 [ 385.003900][T11574] inet_diag_handler_cmd+0x1e0/0x2c0 [ 385.009587][T11574] ? sock_diag_lock_handler+0x19/0x280 [ 385.015489][T11574] ? inet_diag_unregister+0xb0/0xb0 [ 385.020978][T11574] ? inet_diag_handler_get_info+0x790/0x790 [ 385.026922][T11574] ? inet_diag_dump_start+0x20/0x20 [ 385.032198][T11574] ? inet_diag_dump+0x50/0x50 [ 385.036918][T11574] ? sock_diag_lock_handler+0x19/0x280 [ 385.042508][T11574] ? inet_diag_unregister+0xb0/0xb0 [ 385.048014][T11574] sock_diag_rcv_msg+0x3d3/0x5f0 [ 385.052991][T11574] netlink_rcv_skb+0x235/0x4c0 [ 385.057979][T11574] ? sock_diag_bind+0xb0/0xb0 [ 385.062705][T11574] ? netlink_ack+0x1160/0x1160 [ 385.067541][T11574] ? __lock_acquire+0x7d80/0x7d80 [ 385.072648][T11574] ? netlink_deliver_tap+0x2e/0x1b0 [ 385.078093][T11574] sock_diag_rcv+0x2a/0x40 [ 385.082554][T11574] netlink_unicast+0x7b1/0x930 [ 385.087469][T11574] netlink_sendmsg+0x8d0/0xbf0 [ 385.092284][T11574] ? netlink_getsockopt+0x590/0x590 [ 385.097623][T11574] ? apparmor_socket_sendmsg+0x8e/0x330 [ 385.103436][T11574] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 385.109327][T11574] ? security_socket_sendmsg+0x80/0xa0 [ 385.115063][T11574] sock_write_iter+0x2dc/0x420 [ 385.119971][T11574] ? sock_read_iter+0x3f0/0x3f0 [ 385.124887][T11574] ? common_file_perm+0x198/0x1f0 [ 385.130075][T11574] do_iter_write+0x747/0xc50 [ 385.134904][T11574] ? __asan_memset+0x22/0x40 [ 385.139546][T11574] ? vfs_iter_write+0xa0/0xa0 [ 385.144373][T11574] ? __import_iovec+0x5f2/0x850 [ 385.149313][T11574] ? import_iovec+0x73/0xa0 [ 385.153883][T11574] do_writev+0x27f/0x480 [ 385.158217][T11574] ? do_readv+0x460/0x460 [ 385.162770][T11574] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 385.168959][T11574] ? lock_chain_count+0x20/0x20 [ 385.173866][T11574] ? lockdep_hardirqs_on+0x98/0x150 [ 385.179164][T11574] do_syscall_64+0x55/0xb0 [ 385.183785][T11574] ? clear_bhb_loop+0x40/0x90 [ 385.188677][T11574] ? clear_bhb_loop+0x40/0x90 [ 385.193613][T11574] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 385.199620][T11574] RIP: 0033:0x7fb764b9e159 [ 385.204067][T11574] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 385.223989][T11574] RSP: 002b:00007fb7659ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 385.232448][T11574] RAX: ffffffffffffffda RBX: 00007fb764e25fa0 RCX: 00007fb764b9e159 [ 385.240589][T11574] RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000003 [ 385.248784][T11574] RBP: 00007fb764c3506b R08: 0000000000000000 R09: 0000000000000000 [ 385.257403][T11574] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 385.265876][T11574] R13: 00007fb764e26038 R14: 00007fb764e25fa0 R15: 00007ffdc6501cd8 [ 385.274159][T11574] [ 385.526733][ T28] audit: type=1326 audit(1790066070.310:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11579 comm="syz.5.1604" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5fe859e159 code=0x0 [ 385.832500][T11585] loop6: detected capacity change from 0 to 2048 [ 385.928321][T11585] loop6: p2 p4 [ 385.928321][T11585] p4: [ 385.946504][T11585] loop6: p2 size 851968 extends beyond EOD, truncated [ 385.967837][T11585] loop6: p4 size 722688 extends beyond EOD, truncated [ 387.708158][T11598] netlink: 'syz.5.1611': attribute type 5 has an invalid length. [ 387.776616][T11598] netlink: 'syz.5.1611': attribute type 8 has an invalid length. [ 392.328716][T11624] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1622'. [ 394.121076][ T51] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 394.161912][ T51] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 394.173550][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 394.185106][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 394.194125][ T51] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 394.202713][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 394.819992][ T70] netdevsim netdevsim7 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 394.832681][ T70] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 395.140234][ T70] netdevsim netdevsim7 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 395.155930][ T70] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 395.354585][ T70] netdevsim netdevsim7 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 395.372943][ T70] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 395.521100][T11647] chnl_net:caif_netlink_parms(): no params data found [ 395.530900][T11663] loop7: detected capacity change from 0 to 16384 [ 395.724760][ T70] netdevsim netdevsim7 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 395.776021][ T70] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 395.946661][T11665] loop7: detected capacity change from 16384 to 0 [ 396.146240][T11647] bridge0: port 1(bridge_slave_0) entered blocking state [ 396.174507][T11647] bridge0: port 1(bridge_slave_0) entered disabled state [ 396.206239][T11647] bridge_slave_0: entered allmulticast mode [ 396.227417][T11647] bridge_slave_0: entered promiscuous mode [ 396.246468][ T5087] Bluetooth: hci4: command tx timeout [ 396.329372][T11647] bridge0: port 2(bridge_slave_1) entered blocking state [ 396.360571][T11647] bridge0: port 2(bridge_slave_1) entered disabled state [ 396.383584][T11647] bridge_slave_1: entered allmulticast mode [ 396.423206][T11647] bridge_slave_1: entered promiscuous mode [ 396.692738][T11647] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 396.770285][T11647] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 397.276856][T11647] team0: Port device team_slave_0 added [ 397.588319][T11647] team0: Port device team_slave_1 added [ 398.169454][T11647] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 398.191860][T11647] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 398.224601][T11647] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 398.241035][T11647] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 398.274961][T11647] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 398.330442][ T5087] Bluetooth: hci4: command tx timeout [ 398.350544][T11647] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 398.944179][T11647] hsr_slave_0: entered promiscuous mode [ 399.073479][T11647] hsr_slave_1: entered promiscuous mode [ 399.181348][T11647] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 399.219755][T11647] Cannot create hsr debugfs directory [ 399.285049][T11719] FAULT_INJECTION: forcing a failure. [ 399.285049][T11719] name failslab, interval 1, probability 0, space 0, times 0 [ 399.336027][T11719] CPU: 1 PID: 11719 Comm: syz.6.1648 Not tainted syzkaller #0 [ 399.343793][T11719] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 399.354060][T11719] Call Trace: [ 399.357530][T11719] [ 399.360501][T11719] dump_stack_lvl+0x18c/0x250 [ 399.365234][T11719] ? show_regs_print_info+0x20/0x20 [ 399.370475][T11719] ? load_image+0x420/0x420 [ 399.375120][T11719] ? __might_sleep+0xe0/0xe0 [ 399.379777][T11719] ? __lock_acquire+0x7d80/0x7d80 [ 399.384857][T11719] should_fail_ex+0x394/0x4c0 [ 399.389690][T11719] should_failslab+0x9/0x20 [ 399.394254][T11719] slab_pre_alloc_hook+0x59/0x300 [ 399.400121][T11719] ? sk_prot_alloc+0xe7/0x210 [ 399.404855][T11719] ? sk_prot_alloc+0xe7/0x210 [ 399.409562][T11719] __kmem_cache_alloc_node+0x53/0x250 [ 399.414990][T11719] ? sk_prot_alloc+0xe7/0x210 [ 399.420051][T11719] __kmalloc+0xa7/0x240 [ 399.424285][T11719] sk_prot_alloc+0xe7/0x210 [ 399.428940][T11719] ? sk_alloc+0x24/0x350 [ 399.433222][T11719] sk_alloc+0x3a/0x350 [ 399.437398][T11719] pppoe_create+0x32/0x2a0 [ 399.441918][T11719] pppox_create+0x12b/0x1a0 [ 399.446470][T11719] __sock_create+0x49e/0x940 [ 399.451199][T11719] __sys_socket+0xd7/0x1b0 [ 399.455924][T11719] __x64_sys_socket+0x7a/0x90 [ 399.460650][T11719] do_syscall_64+0x55/0xb0 [ 399.465118][T11719] ? clear_bhb_loop+0x40/0x90 [ 399.470021][T11719] ? clear_bhb_loop+0x40/0x90 [ 399.474755][T11719] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 399.480693][T11719] RIP: 0033:0x7fb764b9e159 [ 399.485152][T11719] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 399.506013][T11719] RSP: 002b:00007fb7659ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 399.514660][T11719] RAX: ffffffffffffffda RBX: 00007fb764e25fa0 RCX: 00007fb764b9e159 [ 399.522965][T11719] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000018 [ 399.530985][T11719] RBP: 00007fb764c3506b R08: 0000000000000000 R09: 0000000000000000 [ 399.539354][T11719] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 399.547394][T11719] R13: 00007fb764e26038 R14: 00007fb764e25fa0 R15: 00007ffdc6501cd8 [ 399.555619][T11719] [ 400.406004][ T5087] Bluetooth: hci4: command tx timeout [ 400.522700][ T28] audit: type=1326 audit(1790066085.470:275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11733 comm="syz.4.1652" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f588559e159 code=0x0 [ 401.029459][T11647] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 401.117564][T11647] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 401.166486][ T70] hsr_slave_0: left promiscuous mode [ 401.238780][ T70] hsr_slave_1: left promiscuous mode [ 401.326139][ T70] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 401.333629][ T70] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 401.409536][ T70] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 401.447911][ T70] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 401.506828][ T70] bridge_slave_1: left allmulticast mode [ 401.512646][ T70] bridge_slave_1: left promiscuous mode [ 401.564964][ T70] bridge0: port 2(bridge_slave_1) entered disabled state [ 401.621651][ T70] bridge_slave_0: left allmulticast mode [ 401.644976][ T70] bridge_slave_0: left promiscuous mode [ 401.661623][ T70] bridge0: port 1(bridge_slave_0) entered disabled state [ 401.797380][T11755] 9pnet: p9_errstr2errno: server reported unknown error 0xffffffffffffffff [ 401.824193][ T70] veth1_macvtap: left promiscuous mode [ 401.829938][ T70] veth0_macvtap: left promiscuous mode [ 401.835711][ T70] veth1_vlan: left promiscuous mode [ 401.854810][ T70] veth0_vlan: left promiscuous mode [ 402.486023][ T5087] Bluetooth: hci4: command tx timeout [ 404.817764][ T70] team0 (unregistering): Port device team_slave_1 removed [ 405.111667][ T70] team0 (unregistering): Port device team_slave_0 removed [ 405.123919][T11775] overlayfs: failed to resolve './file0': -2 [ 405.381994][ T70] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 405.683483][ T70] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 407.838672][ T70] bond0 (unregistering): Released all slaves [ 408.254466][T11647] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 408.289740][T11647] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 408.369630][T11763] netlink: 'syz.4.1659': attribute type 25 has an invalid length. [ 408.436937][T11763] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1659'. [ 408.569322][T11763] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 408.580326][T11763] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 408.591015][T11763] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 408.601711][T11763] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 408.784778][T11791] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1672'. [ 408.860147][T11763] netlink: 'syz.4.1659': attribute type 25 has an invalid length. [ 408.879999][T11763] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1659'. [ 408.966116][ T5815] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 409.251564][T11647] 8021q: adding VLAN 0 to HW filter on device bond0 [ 409.278002][ T5815] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 409.350201][ T5815] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 409.410444][ T5815] usb 7-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 409.424233][T11647] 8021q: adding VLAN 0 to HW filter on device team0 [ 409.461838][ T5815] usb 7-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 409.497093][T11238] bridge0: port 1(bridge_slave_0) entered blocking state [ 409.504403][T11238] bridge0: port 1(bridge_slave_0) entered forwarding state [ 409.541629][ T5815] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 409.666654][T11249] bridge0: port 2(bridge_slave_1) entered blocking state [ 409.675283][T11249] bridge0: port 2(bridge_slave_1) entered forwarding state [ 409.964714][T11647] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 409.984191][T11805] overlayfs: failed to clone upperpath [ 410.102042][ T5815] cxacru 7-1:1.0: send of cm 0x91 failed (-71) [ 410.132238][ T5815] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 410.162503][ T5815] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 410.208975][ T5815] cxacru: probe of 7-1:1.0 failed with error -71 [ 410.287190][ T5815] usb 7-1: USB disconnect, device number 12 [ 411.009073][T11647] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 412.193385][T11647] veth0_vlan: entered promiscuous mode [ 412.241934][T11647] veth1_vlan: entered promiscuous mode [ 412.252109][T11853] loop6: detected capacity change from 0 to 512 [ 412.290507][T11853] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 412.582756][T11647] veth0_macvtap: entered promiscuous mode [ 412.634562][T11647] veth1_macvtap: entered promiscuous mode [ 412.773800][T11647] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 412.814849][T11647] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 412.857618][T11862] netlink: 'syz.6.1687': attribute type 3 has an invalid length. [ 412.874490][T11647] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 412.915664][T11862] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1687'. [ 412.927084][T11647] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 412.964866][T11647] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 412.991616][T11647] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 413.050698][T11647] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.096150][T11647] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.104962][T11647] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.159111][ T28] audit: type=1326 audit(1790066098.110:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11867 comm="syz.4.1689" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f588559e159 code=0x7ffc0000 [ 413.163340][T11647] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.321464][ T28] audit: type=1326 audit(1790066098.140:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11867 comm="syz.4.1689" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f588559e159 code=0x7ffc0000 [ 413.468910][ T28] audit: type=1326 audit(1790066098.140:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11867 comm="syz.4.1689" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f588559e159 code=0x7ffc0000 [ 413.597405][ T28] audit: type=1326 audit(1790066098.140:279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11867 comm="syz.4.1689" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f588559e159 code=0x7ffc0000 [ 413.649271][T11249] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.693821][T11249] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 413.732958][ T28] audit: type=1326 audit(1790066098.140:280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11867 comm="syz.4.1689" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f588559e159 code=0x7ffc0000 [ 413.851659][ T6762] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.887564][ T28] audit: type=1326 audit(1790066098.160:281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11867 comm="syz.4.1689" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=285 compat=0 ip=0x7f588559e159 code=0x7ffc0000 [ 413.934603][ T6762] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 413.987581][ T28] audit: type=1326 audit(1790066098.210:282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11867 comm="syz.4.1689" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f588559e159 code=0x7ffc0000 [ 414.139831][ T28] audit: type=1326 audit(1790066098.210:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11867 comm="syz.4.1689" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f588559e159 code=0x7ffc0000 [ 414.238091][ T28] audit: type=1326 audit(1790066098.280:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11867 comm="syz.4.1689" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=326 compat=0 ip=0x7f588559e159 code=0x7ffc0000 [ 415.736649][T11919] capability: warning: `syz.5.1700' uses deprecated v2 capabilities in a way that may be insecure [ 416.541321][ T28] kauditd_printk_skb: 4 callbacks suppressed [ 416.541340][ T28] audit: type=1800 audit(1790066101.490:289): pid=11930 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.1702" name="file1" dev="overlay" ino=35 res=0 errno=0 [ 418.200886][ T28] audit: type=1326 audit(1790066103.150:290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11960 comm="syz.6.1712" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb764b9e159 code=0x0 [ 422.916086][ T5814] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 423.109030][ T5814] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 423.123916][ T5814] usb 9-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 423.142693][ T5814] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.402572][ T5814] qmi_wwan 9-1:1.0: cdc-wdm0: USB WDM device [ 423.443460][ T5814] wwan wwan0: port wwan0qmi0 attached [ 423.637827][ T5814] qmi_wwan 9-1:1.0 wwan0: register 'qmi_wwan' at usb-dummy_hcd.8-1, WWAN/QMI device, 72:30:09:c4:a9:0f [ 423.895950][ T5814] usb 9-1: USB disconnect, device number 2 [ 423.914658][ T5814] qmi_wwan 9-1:1.0 wwan0: unregister 'qmi_wwan' usb-dummy_hcd.8-1, WWAN/QMI device [ 424.030176][ T5814] wwan wwan0: port wwan0qmi0 disconnected [ 424.634806][T12024] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 425.505681][ T28] audit: type=1326 audit(1790066110.450:291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12079 comm="syz.5.1745" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 425.595255][ T28] audit: type=1326 audit(1790066110.450:292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12079 comm="syz.5.1745" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 425.690702][ T28] audit: type=1326 audit(1790066110.490:293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12079 comm="syz.5.1745" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 425.809869][ T28] audit: type=1326 audit(1790066110.490:294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12079 comm="syz.5.1745" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 425.976142][ T28] audit: type=1326 audit(1790066110.500:295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12079 comm="syz.5.1745" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 426.142774][ T28] audit: type=1326 audit(1790066110.510:296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12079 comm="syz.5.1745" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=285 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 426.252844][ T28] audit: type=1326 audit(1790066110.570:297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12079 comm="syz.5.1745" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 426.376267][ T28] audit: type=1326 audit(1790066110.630:298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12079 comm="syz.5.1745" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 426.486363][ T28] audit: type=1326 audit(1790066110.660:299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12079 comm="syz.5.1745" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 426.610994][ T28] audit: type=1326 audit(1790066110.660:300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12079 comm="syz.5.1745" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fe859e159 code=0x7ffc0000 [ 427.109353][T12110] netlink: 'syz.6.1754': attribute type 20 has an invalid length. [ 427.120565][T12110] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1754'. [ 427.144637][T12110] netlink: 'syz.6.1754': attribute type 20 has an invalid length. [ 427.178422][T12110] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1754'. [ 428.084257][T12129] loop8: detected capacity change from 0 to 1024 [ 429.827487][T12154] loop6: detected capacity change from 0 to 4096 [ 429.931825][T12154] ntfs3: loop6: ino=19, mi_enum_attr [ 429.954714][T12154] ntfs3: loop6: Mark volume as dirty due to NTFS errors [ 430.547077][T12166] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1775'. [ 430.817004][T12173] loop6: detected capacity change from 0 to 128 [ 430.898521][T12173] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 430.961834][T12173] hpfs: filesystem error: improperly stopped [ 430.976553][T12173] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 430.998347][T12173] hpfs: You really don't want any checks? You are crazy... [ 431.014108][T12173] hpfs: Code page index out of array [ 431.028447][T12173] hpfs: code page support is disabled [ 431.042755][T12173] hpfs: hpfs_map_4sectors(): unaligned read [ 431.069513][T12173] hpfs: hpfs_map_4sectors(): unaligned read [ 431.085853][T12173] hpfs: filesystem error: unable to find root dir [ 433.242109][T12218] size and base must be multiples of 4 kiB [ 433.242174][T12218] CPU: 0 PID: 12218 Comm: syz.8.1787 Not tainted syzkaller #0 [ 433.242203][T12218] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 433.242216][T12218] Call Trace: [ 433.242225][T12218] [ 433.242234][T12218] dump_stack_lvl+0x18c/0x250 [ 433.242274][T12218] ? show_regs_print_info+0x20/0x20 [ 433.242303][T12218] ? load_image+0x420/0x420 [ 433.242332][T12218] ? __lock_acquire+0x7d80/0x7d80 [ 433.242368][T12218] mtrr_add+0xd0/0x100 [ 433.242395][T12218] mtrr_ioctl+0xc96/0x13a0 [ 433.242427][T12218] ? mtrr_close+0x200/0x200 [ 433.242464][T12218] ? __fget_files+0x28/0x460 [ 433.242512][T12218] ? mtrr_close+0x200/0x200 [ 433.242538][T12218] proc_reg_unlocked_ioctl+0x1d2/0x2c0 [ 433.242566][T12218] ? proc_reg_poll+0x290/0x290 [ 433.242591][T12218] __se_sys_ioctl+0xfd/0x170 [ 433.242622][T12218] do_syscall_64+0x55/0xb0 [ 433.242649][T12218] ? clear_bhb_loop+0x40/0x90 [ 433.242677][T12218] ? clear_bhb_loop+0x40/0x90 [ 433.242707][T12218] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 433.242734][T12218] RIP: 0033:0x7f5112b9e159 [ 433.242756][T12218] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 433.242775][T12218] RSP: 002b:00007f51139a1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 433.242801][T12218] RAX: ffffffffffffffda RBX: 00007f5112e26090 RCX: 00007f5112b9e159 [ 433.242817][T12218] RDX: 0000200000000a00 RSI: 00000000400c4d01 RDI: 0000000000000004 [ 433.242832][T12218] RBP: 00007f5112c3506b R08: 0000000000000000 R09: 0000000000000000 [ 433.242845][T12218] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 433.242859][T12218] R13: 00007f5112e26128 R14: 00007f5112e26090 R15: 00007ffdecbe7c28 [ 433.242892][T12218] [ 434.112348][T12210] loop6: detected capacity change from 0 to 32768 [ 434.151138][T12210] BTRFS: device fsid a6a605fc-d5f1-4e66-8595-3726e2b761d6 devid 1 transid 8 /dev/loop6 scanned by syz.6.1786 (12210) [ 434.184781][T12210] BTRFS info (device loop6): first mount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 434.184909][T12210] BTRFS info (device loop6): using blake2b (blake2b-256-generic) checksum algorithm [ 434.185120][T12210] BTRFS info (device loop6): turning off barriers [ 434.185142][T12210] BTRFS info (device loop6): turning on async discard [ 434.185165][T12210] BTRFS info (device loop6): doing ref verification [ 434.185201][T12210] BTRFS info (device loop6): using free space tree [ 434.299284][T12210] BTRFS info (device loop6): enabling ssd optimizations [ 435.103069][ T8888] BTRFS info (device loop6): last unmount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 435.476212][T12264] 9pnet_fd: Insufficient options for proto=fd [ 435.677013][T12271] FAULT_INJECTION: forcing a failure. [ 435.677013][T12271] name failslab, interval 1, probability 0, space 0, times 0 [ 435.754252][T12271] CPU: 1 PID: 12271 Comm: syz.6.1792 Not tainted syzkaller #0 [ 435.761808][T12271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 435.772170][T12271] Call Trace: [ 435.775492][T12271] [ 435.778470][T12271] dump_stack_lvl+0x18c/0x250 [ 435.783207][T12271] ? show_regs_print_info+0x20/0x20 [ 435.788466][T12271] ? load_image+0x420/0x420 [ 435.793024][T12271] ? __lock_acquire+0x7d80/0x7d80 [ 435.798104][T12271] should_fail_ex+0x394/0x4c0 [ 435.802848][T12271] should_failslab+0x9/0x20 [ 435.807406][T12271] slab_pre_alloc_hook+0x59/0x300 [ 435.812493][T12271] ? __kmem_cache_alloc_node+0x194/0x250 [ 435.818363][T12271] kmem_cache_alloc+0x5a/0x2c0 [ 435.823177][T12271] ? copy_net_ns+0x144/0x530 [ 435.827901][T12271] copy_net_ns+0x144/0x530 [ 435.832384][T12271] create_new_namespaces+0x3ce/0x700 [ 435.837820][T12271] unshare_nsproxy_namespaces+0x11a/0x160 [ 435.843596][T12271] ksys_unshare+0x4fa/0x8f0 [ 435.848152][T12271] ? sighand_ctor+0x50/0x50 [ 435.852760][T12271] ? lock_chain_count+0x20/0x20 [ 435.857670][T12271] ? syscall_enter_from_user_mode+0x25/0x80 [ 435.863614][T12271] __x64_sys_unshare+0x38/0x40 [ 435.868795][T12271] do_syscall_64+0x55/0xb0 [ 435.873265][T12271] ? clear_bhb_loop+0x40/0x90 [ 435.878075][T12271] ? clear_bhb_loop+0x40/0x90 [ 435.883064][T12271] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 435.889016][T12271] RIP: 0033:0x7fb764b9e159 [ 435.893478][T12271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 435.913229][T12271] RSP: 002b:00007fb7659ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 435.921707][T12271] RAX: ffffffffffffffda RBX: 00007fb764e25fa0 RCX: 00007fb764b9e159 [ 435.929727][T12271] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000062040200 [ 435.937914][T12271] RBP: 00007fb764c3506b R08: 0000000000000000 R09: 0000000000000000 [ 435.946017][T12271] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 435.954136][T12271] R13: 00007fb764e26038 R14: 00007fb764e25fa0 R15: 00007ffdc6501cd8 [ 435.962355][T12271] [ 435.965490][ C1] vkms_vblank_simulate: vblank timer overrun [ 438.974424][T12345] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1817'. [ 439.216518][T12353] FAULT_INJECTION: forcing a failure. [ 439.216518][T12353] name failslab, interval 1, probability 0, space 0, times 0 [ 439.255542][T12353] CPU: 1 PID: 12353 Comm: syz.8.1820 Not tainted syzkaller #0 [ 439.263270][T12353] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 439.273455][T12353] Call Trace: [ 439.276777][T12353] [ 439.279738][T12353] dump_stack_lvl+0x18c/0x250 [ 439.284499][T12353] ? show_regs_print_info+0x20/0x20 [ 439.289955][T12353] ? load_image+0x420/0x420 [ 439.294506][T12353] ? __might_sleep+0xe0/0xe0 [ 439.299141][T12353] ? __lock_acquire+0x7d80/0x7d80 [ 439.304655][T12353] should_fail_ex+0x394/0x4c0 [ 439.309386][T12353] should_failslab+0x9/0x20 [ 439.314022][T12353] slab_pre_alloc_hook+0x59/0x300 [ 439.319106][T12353] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 439.325131][T12353] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 439.331068][T12353] __kmem_cache_alloc_node+0x53/0x250 [ 439.336499][T12353] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 439.342349][T12353] __kmalloc+0xa7/0x240 [ 439.346648][T12353] tomoyo_realpath_from_path+0xe6/0x5c0 [ 439.352273][T12353] tomoyo_check_open_permission+0x224/0x460 [ 439.358658][T12353] ? tomoyo_check_open_permission+0x1cf/0x460 [ 439.364784][T12353] ? tomoyo_check_path_number_acl+0x280/0x280 [ 439.370918][T12353] ? __asan_memset+0x22/0x40 [ 439.375605][T12353] ? __rwlock_init+0x150/0x150 [ 439.380500][T12353] ? tomoyo_file_open+0xed/0x180 [ 439.385505][T12353] security_file_open+0x62/0xa0 [ 439.390581][T12353] do_dentry_open+0x32b/0x14b0 [ 439.395403][T12353] ? __asan_memcpy+0x40/0x70 [ 439.400130][T12353] path_openat+0x284f/0x3270 [ 439.404790][T12353] ? do_sys_openat2+0xda/0x1d0 [ 439.409699][T12353] ? __x64_sys_openat+0x139/0x160 [ 439.414788][T12353] ? verify_lock_unused+0x140/0x140 [ 439.420215][T12353] ? do_filp_open+0x430/0x430 [ 439.424964][T12353] do_filp_open+0x1f2/0x430 [ 439.429513][T12353] ? vfs_tmpfile+0x620/0x620 [ 439.434183][T12353] ? _raw_spin_unlock+0x28/0x40 [ 439.439192][T12353] ? alloc_fd+0x590/0x640 [ 439.443635][T12353] do_sys_openat2+0x134/0x1d0 [ 439.448634][T12353] ? do_sys_open+0xe0/0xe0 [ 439.453103][T12353] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 439.459219][T12353] ? lock_chain_count+0x20/0x20 [ 439.464209][T12353] __x64_sys_openat+0x139/0x160 [ 439.469298][T12353] do_syscall_64+0x55/0xb0 [ 439.473759][T12353] ? clear_bhb_loop+0x40/0x90 [ 439.478577][T12353] ? clear_bhb_loop+0x40/0x90 [ 439.483395][T12353] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 439.489354][T12353] RIP: 0033:0x7f5112b9e159 [ 439.493815][T12353] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 439.513730][T12353] RSP: 002b:00007f51139c2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 439.522554][T12353] RAX: ffffffffffffffda RBX: 00007f5112e25fa0 RCX: 00007f5112b9e159 [ 439.530576][T12353] RDX: 0000000000000001 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 439.538686][T12353] RBP: 00007f5112c3506b R08: 0000000000000000 R09: 0000000000000000 [ 439.546703][T12353] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 439.554732][T12353] R13: 00007f5112e26038 R14: 00007f5112e25fa0 R15: 00007ffdecbe7c28 [ 439.562869][T12353] [ 439.631701][T12353] ERROR: Out of memory at tomoyo_realpath_from_path. [ 440.363425][T12362] netlink: 'syz.8.1825': attribute type 4 has an invalid length. [ 440.425262][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.434407][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.456075][T12363] netlink: 'syz.8.1825': attribute type 4 has an invalid length. [ 440.925237][T12369] FAULT_INJECTION: forcing a failure. [ 440.925237][T12369] name failslab, interval 1, probability 0, space 0, times 0 [ 440.977513][T12369] CPU: 1 PID: 12369 Comm: syz.8.1827 Not tainted syzkaller #0 [ 440.985095][T12369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 440.995556][T12369] Call Trace: [ 440.998883][T12369] [ 441.001853][T12369] dump_stack_lvl+0x18c/0x250 [ 441.006601][T12369] ? show_regs_print_info+0x20/0x20 [ 441.011955][T12369] ? load_image+0x420/0x420 [ 441.016505][T12369] ? __lock_acquire+0x7d80/0x7d80 [ 441.021576][T12369] should_fail_ex+0x394/0x4c0 [ 441.026305][T12369] should_failslab+0x9/0x20 [ 441.030848][T12369] slab_pre_alloc_hook+0x59/0x300 [ 441.035922][T12369] ? aa_path_link+0xf80/0xf80 [ 441.040655][T12369] kmem_cache_alloc_node+0x5e/0x310 [ 441.045984][T12369] ? __alloc_skb+0x103/0x2c0 [ 441.050621][T12369] __alloc_skb+0x103/0x2c0 [ 441.055344][T12369] virtual_ncidev_write+0x58/0x120 [ 441.060603][T12369] ? virtual_ncidev_read+0x4d0/0x4d0 [ 441.065932][T12369] vfs_write+0x299/0x9a0 [ 441.070228][T12369] ? file_end_write+0x250/0x250 [ 441.075125][T12369] ? __fget_files+0x28/0x460 [ 441.079760][T12369] ? __fget_files+0x3fc/0x460 [ 441.084485][T12369] ? __fdget_pos+0x1d8/0x330 [ 441.089116][T12369] ? ksys_write+0x74/0x260 [ 441.093580][T12369] ksys_write+0x151/0x260 [ 441.097955][T12369] ? __ia32_sys_read+0x90/0x90 [ 441.102772][T12369] ? lockdep_hardirqs_on+0x98/0x150 [ 441.108019][T12369] do_syscall_64+0x55/0xb0 [ 441.112477][T12369] ? clear_bhb_loop+0x40/0x90 [ 441.117196][T12369] ? clear_bhb_loop+0x40/0x90 [ 441.121910][T12369] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 441.127850][T12369] RIP: 0033:0x7f5112b9e159 [ 441.132302][T12369] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 441.152052][T12369] RSP: 002b:00007f51139c2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 441.160523][T12369] RAX: ffffffffffffffda RBX: 00007f5112e25fa0 RCX: 00007f5112b9e159 [ 441.168547][T12369] RDX: 0000000000000014 RSI: 0000000000000000 RDI: 0000000000000003 [ 441.176741][T12369] RBP: 00007f5112c3506b R08: 0000000000000000 R09: 0000000000000000 [ 441.185016][T12369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 441.193032][T12369] R13: 00007f5112e26038 R14: 00007f5112e25fa0 R15: 00007ffdecbe7c28 [ 441.201076][T12369] [ 441.265074][ T28] kauditd_printk_skb: 8 callbacks suppressed [ 441.265090][ T28] audit: type=1326 audit(1790066126.210:309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12377 comm="syz.6.1828" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb764b9e159 code=0x7ffc0000 [ 441.311573][ T28] audit: type=1326 audit(1790066126.260:310): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12377 comm="syz.6.1828" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb764b9e159 code=0x7ffc0000 [ 441.401792][ T28] audit: type=1326 audit(1790066126.260:311): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12377 comm="syz.6.1828" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb764b9e159 code=0x7ffc0000 [ 441.516016][ T28] audit: type=1326 audit(1790066126.260:312): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12377 comm="syz.6.1828" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb764b9e159 code=0x7ffc0000 [ 441.677166][ T28] audit: type=1326 audit(1790066126.260:313): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12377 comm="syz.6.1828" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fb764b9e159 code=0x7ffc0000 [ 441.795978][ T28] audit: type=1326 audit(1790066126.310:314): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12377 comm="syz.6.1828" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb764b9e159 code=0x7ffc0000 [ 441.871740][ T28] audit: type=1326 audit(1790066126.310:315): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12377 comm="syz.6.1828" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb764b9e159 code=0x7ffc0000 [ 441.931331][ T28] audit: type=1326 audit(1790066126.310:316): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12377 comm="syz.6.1828" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fb764b9dec2 code=0x7ffc0000 [ 442.003049][ T28] audit: type=1326 audit(1790066126.310:317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12377 comm="syz.6.1828" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7fb764b9df57 code=0x7ffc0000 [ 442.050526][ T28] audit: type=1326 audit(1790066126.310:318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12377 comm="syz.6.1828" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7fb764b5ae51 code=0x7ffc0000 [ 442.105883][ T790] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 442.305799][ T790] usb 9-1: Using ep0 maxpacket: 16 [ 442.313510][ T790] usb 9-1: config 0 interface 0 has no altsetting 0 [ 442.335992][ T790] usb 9-1: New USB device found, idVendor=04e7, idProduct=0009, bcdDevice= 0.00 [ 442.385948][ T790] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 442.417005][ T790] usb 9-1: config 0 descriptor?? [ 442.733346][T12403] netlink: 'syz.6.1836': attribute type 4 has an invalid length. [ 442.840186][ T790] elo 0003:04E7:0009.0007: unknown main item tag 0x1 [ 442.847778][T12403] netlink: 'syz.6.1836': attribute type 4 has an invalid length. [ 442.873878][ T790] elo 0003:04E7:0009.0007: unknown main item tag 0x0 [ 442.891416][ T790] elo 0003:04E7:0009.0007: unknown main item tag 0x0 [ 442.924399][ T790] elo 0003:04E7:0009.0007: unknown main item tag 0x0 [ 442.956508][ T790] elo 0003:04E7:0009.0007: unknown main item tag 0x0 [ 442.983744][ T790] elo 0003:04E7:0009.0007: unknown main item tag 0x0 [ 443.011182][ T790] elo 0003:04E7:0009.0007: unknown main item tag 0x0 [ 443.038446][T12390] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 443.065996][ T790] elo 0003:04E7:0009.0007: unknown main item tag 0x0 [ 443.072879][ T790] elo 0003:04E7:0009.0007: unknown main item tag 0x0 [ 443.086246][T12390] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 443.146115][ T790] elo 0003:04E7:0009.0007: unknown main item tag 0x0 [ 443.152930][ T790] elo 0003:04E7:0009.0007: item fetching failed at offset 36/40 [ 443.204246][ T790] elo 0003:04E7:0009.0007: parse failed [ 443.216754][ T790] elo: probe of 0003:04E7:0009.0007 failed with error -22 [ 443.270199][ T790] usb 9-1: USB disconnect, device number 3 [ 444.867151][T12442] loop8: detected capacity change from 0 to 512 [ 444.907435][T12442] EXT4-fs (loop8): encrypted files will use data=ordered instead of data journaling mode [ 444.969409][T12442] EXT4-fs (loop8): 1 truncate cleaned up [ 445.007800][T12442] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 481.377897][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 550.375674][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 550.382699][ C1] rcu: 0-...!: (1 GPs behind) idle=9f14/1/0x4000000000000000 softirq=49661/49662 fqs=133 [ 550.395131][ C1] rcu: (detected by 1, t=10506 jiffies, g=67193, q=5076 ncpus=2) [ 550.403074][ C1] Sending NMI from CPU 1 to CPUs 0: [ 550.408318][ C0] NMI backtrace for cpu 0 [ 550.408328][ C0] CPU: 0 PID: 12450 Comm: syz.4.1842 Not tainted syzkaller #0 [ 550.408344][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 550.408352][ C0] RIP: 0010:kasan_check_range+0x7f/0x290 [ 550.408383][ C0] Code: 49 c1 e9 03 48 bb 01 00 00 00 00 fc ff df 4d 8d 34 19 4d 89 f4 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 3d 01 00 00 4c 89 cb <48> f7 d3 4c 01 fb 41 80 3b 00 0f 85 8d 01 00 00 49 ff c3 48 ff c3 [ 550.408398][ C0] RSP: 0018:ffffc90000007b68 EFLAGS: 00000002 [ 550.408413][ C0] RAX: 0000000000000001 RBX: 1ffffffff1d1862d RCX: ffffffff81689737 [ 550.408425][ C0] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8e8c3168 [ 550.408436][ C0] RBP: ffffc90000007ca8 R08: ffffffff8e8c316f R09: 1ffffffff1d1862d [ 550.408447][ C0] R10: dffffc0000000000 R11: fffffbfff1d1862d R12: 0000000000000001 [ 550.408458][ C0] R13: ffff8880b8e2b758 R14: fffffbfff1d1862e R15: 1ffffffff1d1862d [ 550.408470][ C0] FS: 00007f58864ed6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 550.408485][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 550.408497][ C0] CR2: 0000000000000000 CR3: 000000007e5b1000 CR4: 00000000003506f0 [ 550.408530][ C0] Call Trace: [ 550.408538][ C0] [ 550.408548][ C0] lock_acquire+0xb7/0x420 [ 550.408573][ C0] ? __lock_acquire+0x7d80/0x7d80 [ 550.408592][ C0] ? read_lock_is_recursive+0x20/0x20 [ 550.408612][ C0] ? advance_sched+0x9d7/0xc70 [ 550.408706][ C0] _raw_spin_lock_irq+0xaf/0xf0 [ 550.408729][ C0] ? __hrtimer_run_queues+0x5da/0xc10 [ 550.408747][ C0] ? _raw_spin_lock_irqsave+0x100/0x100 [ 550.408771][ C0] __hrtimer_run_queues+0x5da/0xc10 [ 550.408788][ C0] ? ktime_get_update_offsets_now+0x99/0x3f0 [ 550.408806][ C0] ? ktime_get_update_offsets_now+0x99/0x3f0 [ 550.408834][ C0] ? hrtimer_interrupt+0x980/0x980 [ 550.408851][ C0] ? read_tsc+0x9/0x20 [ 550.408868][ C0] ? ktime_get_update_offsets_now+0x3d2/0x3f0 [ 550.408892][ C0] hrtimer_interrupt+0x39d/0x980 [ 550.408921][ C0] __sysvec_apic_timer_interrupt+0xfb/0x3b0 [ 550.408943][ C0] sysvec_apic_timer_interrupt+0x9f/0xc0 [ 550.408963][ C0] [ 550.408968][ C0] [ 550.408974][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 550.408997][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 [ 550.409016][ C0] Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 3b f7 c1 f6 65 8b 05 ec b4 68 75 85 c0 74 3c 48 c7 04 24 0e 36 [ 550.409029][ C0] RSP: 0018:ffffc9000d54fa20 EFLAGS: 00000206 [ 550.409043][ C0] RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: d1589b64a9ccd200 [ 550.409054][ C0] RDX: dffffc0000000000 RSI: ffffffff8acacce0 RDI: 0000000000000001 [ 550.409065][ C0] RBP: ffffc9000d54fab0 R08: ffffffff8e8c316f R09: 1ffffffff1d1862d [ 550.409076][ C0] R10: dffffc0000000000 R11: fffffbfff1d1862e R12: dffffc0000000000 [ 550.409087][ C0] R13: dffffc0000000000 R14: ffffffff8d14b900 R15: 1ffff92001aa9f44 [ 550.409108][ C0] ? _raw_spin_unlock+0x40/0x40 [ 550.409126][ C0] ? __asan_memcpy+0x40/0x70 [ 550.409150][ C0] timekeeping_inject_offset+0x5c6/0x670 [ 550.409171][ C0] ? do_adjtimex+0x47c/0xa10 [ 550.409190][ C0] ? timekeeping_warp_clock+0xc0/0xc0 [ 550.409209][ C0] ? add_device_randomness+0xc6/0x110 [ 550.409250][ C0] ? crng_reseed+0x230/0x230 [ 550.409276][ C0] ? security_capable+0x89/0xb0 [ 550.409300][ C0] do_adjtimex+0x47c/0xa10 [ 550.409322][ C0] ? random_get_entropy_fallback+0x80/0x80 [ 550.409348][ C0] ? __might_fault+0xaa/0x120 [ 550.409365][ C0] ? __might_fault+0xc6/0x120 [ 550.409380][ C0] ? __might_fault+0xaa/0x120 [ 550.409399][ C0] __x64_sys_clock_adjtime+0x244/0x320 [ 550.409425][ C0] ? do_clock_adjtime+0x120/0x120 [ 550.409450][ C0] ? lock_chain_count+0x20/0x20 [ 550.409471][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 550.409489][ C0] do_syscall_64+0x55/0xb0 [ 550.409516][ C0] ? clear_bhb_loop+0x40/0x90 [ 550.409535][ C0] ? clear_bhb_loop+0x40/0x90 [ 550.409555][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 550.409574][ C0] RIP: 0033:0x7f588559e159 [ 550.409589][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 550.409602][ C0] RSP: 002b:00007f58864ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000131 [ 550.409618][ C0] RAX: ffffffffffffffda RBX: 00007f5885825fa0 RCX: 00007f588559e159 [ 550.409629][ C0] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000000 [ 550.409639][ C0] RBP: 00007f588563506b R08: 0000000000000000 R09: 0000000000000000 [ 550.409649][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 550.409659][ C0] R13: 00007f5885826038 R14: 00007f5885825fa0 R15: 00007ffeb5d074e8 [ 550.409678][ C0] [ 550.410313][ C1] rcu: rcu_preempt kthread starved for 9840 jiffies! g67193 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 [ 550.895739][ C1] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 550.905931][ C1] rcu: RCU grace-period kthread stack dump: [ 550.912023][ C1] task:rcu_preempt state:R running task stack:26504 pid:17 ppid:2 flags:0x00004000 [ 550.922841][ C1] Call Trace: [ 550.926149][ C1] [ 550.929199][ C1] __schedule+0x15ae/0x4660 [ 550.933820][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 550.938879][ C1] ? lock_chain_count+0x20/0x20 [ 550.943760][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 550.948996][ C1] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 550.954923][ C1] ? asan.module_dtor+0x20/0x20 [ 550.959892][ C1] ? rcu_is_watching+0x15/0xb0 [ 550.964728][ C1] schedule+0xbd/0x170 [ 550.968845][ C1] schedule_timeout+0x188/0x2d0 [ 550.973813][ C1] ? console_conditional_schedule+0x40/0x40 [ 550.979819][ C1] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 550.985744][ C1] ? update_process_times+0x1b0/0x1b0 [ 550.991169][ C1] ? prepare_to_swait_event+0x344/0x360 [ 550.996756][ C1] rcu_gp_fqs_loop+0x30d/0x1590 [ 551.001666][ C1] ? dyntick_save_progress_counter+0x2b0/0x2b0 [ 551.007851][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 551.013170][ C1] ? rcu_gp_init+0x1530/0x1530 [ 551.017989][ C1] ? rcu_gp_cleanup+0xade/0xc30 [ 551.022910][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 551.028239][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 551.033466][ C1] rcu_gp_kthread+0x9d/0x3b0 [ 551.038087][ C1] ? rcu_report_qs_rsp+0x1a0/0x1a0 [ 551.043225][ C1] ? __kthread_parkme+0x71/0x1c0 [ 551.048188][ C1] ? __kthread_parkme+0x15b/0x1c0 [ 551.053241][ C1] kthread+0x2fa/0x390 [ 551.057339][ C1] ? rcu_report_qs_rsp+0x1a0/0x1a0 [ 551.062596][ C1] ? kthread_blkcg+0xd0/0xd0 [ 551.067304][ C1] ret_from_fork+0x48/0x80 [ 551.071757][ C1] ? kthread_blkcg+0xd0/0xd0 [ 551.076382][ C1] ret_from_fork_asm+0x11/0x20 [ 551.081225][ C1] [ 551.084278][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 551.090621][ C1] CPU: 1 PID: 11238 Comm: kworker/u4:23 Not tainted syzkaller #0 [ 551.098453][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 551.108538][ C1] Workqueue: writeback wb_workfn (flush-8:0) [ 551.114572][ C1] RIP: 0010:smp_call_function_many_cond+0xd8a/0x1190 [ 551.121297][ C1] Code: 89 f6 83 e6 01 31 ff e8 34 01 0b 00 41 83 e6 01 49 be 00 00 00 00 00 fc ff df 75 07 e8 6f fd 0a 00 eb 38 f3 90 42 0f b6 04 33 <84> c0 75 11 41 f7 04 24 01 00 00 00 74 1e e8 53 fd 0a 00 eb e4 44 [ 551.141109][ C1] RSP: 0018:ffffc9000bb8e320 EFLAGS: 00000293 [ 551.147212][ C1] RAX: 0000000000000000 RBX: 1ffffd1ffff8a03d RCX: ffff88802d593c00 [ 551.155318][ C1] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 551.163418][ C1] RBP: ffffc9000bb8e4a0 R08: ffffc9000bb8e2a7 R09: 1ffff92001771c54 [ 551.171619][ C1] R10: dffffc0000000000 R11: fffff52001771c55 R12: ffffe8ffffc501e8 [ 551.179711][ C1] R13: ffff8880b8f3d380 R14: dffffc0000000000 R15: 0000000000000000 [ 551.187796][ C1] FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 551.196854][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 551.203464][ C1] CR2: 00007ffdb2940d94 CR3: 000000000cf32000 CR4: 00000000003506e0 [ 551.211477][ C1] Call Trace: [ 551.214908][ C1] [ 551.217871][ C1] ? flush_tlb_func+0x660/0x660 [ 551.222784][ C1] ? smp_call_function_many+0x40/0x40 [ 551.228379][ C1] ? rcu_is_watching+0x15/0xb0 [ 551.233524][ C1] ? flush_tlb_func+0x660/0x660 [ 551.238407][ C1] ? native_flush_tlb_multi+0xd0/0xd0 [ 551.243824][ C1] on_each_cpu_cond_mask+0x3f/0x80 [ 551.249157][ C1] flush_tlb_mm_range+0x417/0x680 [ 551.254234][ C1] ? flush_tlb_multi+0x50/0x50 [ 551.259118][ C1] ? page_ext_get+0x1e2/0x2b0 [ 551.263934][ C1] ptep_clear_flush+0x120/0x170 [ 551.268822][ C1] page_vma_mkclean_one+0x43c/0x730 [ 551.274066][ C1] ? pfn_mkclean_range+0x2d0/0x2d0 [ 551.279221][ C1] page_mkclean_one+0x202/0x3e0 [ 551.284103][ C1] ? folio_mkclean+0x360/0x360 [ 551.288904][ C1] ? __init_rwsem+0x160/0x160 [ 551.293612][ C1] ? page_to_pgoff+0xcb/0x3f0 [ 551.298411][ C1] ? vma_address+0x1e6/0x300 [ 551.303026][ C1] ? folio_mkclean+0x360/0x360 [ 551.307834][ C1] rmap_walk_file+0x38d/0x770 [ 551.312564][ C1] folio_mkclean+0x1e5/0x360 [ 551.317176][ C1] ? rmap_walk+0xc0/0xc0 [ 551.321449][ C1] ? ret_from_fork_asm+0x11/0x20 [ 551.326418][ C1] ? folio_mkclean+0x360/0x360 [ 551.331296][ C1] ? page_mkclean_one+0x3e0/0x3e0 [ 551.336355][ C1] ? folio_mapping+0x1bd/0x4e0 [ 551.341242][ C1] folio_clear_dirty_for_io+0x20c/0xca0 [ 551.346908][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 551.351968][ C1] ? folio_wait_writeback+0x1e0/0x1e0 [ 551.357484][ C1] mpage_submit_folio+0x77/0x3c0 [ 551.362452][ C1] ? mpage_process_page_bufs+0x685/0x8c0 [ 551.368289][ C1] mpage_process_page_bufs+0x6bf/0x8c0 [ 551.373880][ C1] mpage_prepare_extent_to_map+0xecd/0x1f80 [ 551.379859][ C1] ? trace_ext4_writepages+0x1c0/0x1c0 [ 551.385365][ C1] ? kmem_cache_alloc+0x1a6/0x2c0 [ 551.390522][ C1] ext4_do_writepages+0xb46/0x3990 [ 551.395695][ C1] ? xas_find_marked+0x194/0x1060 [ 551.400960][ C1] ? ext4_normal_submit_inode_data_buffers+0x240/0x240 [ 551.407870][ C1] ? rcu_read_lock_any_held+0xb4/0x140 [ 551.413364][ C1] ? __lock_acquire+0x1336/0x7d80 [ 551.418429][ C1] ext4_writepages+0x1dd/0x350 [ 551.423251][ C1] ? ext4_read_folio+0x2f0/0x2f0 [ 551.428227][ C1] ? reacquire_held_locks+0x31f/0x5c0 [ 551.433639][ C1] ? writeback_sb_inodes+0x35e/0x1020 [ 551.439139][ C1] ? ext4_read_folio+0x2f0/0x2f0 [ 551.444105][ C1] do_writepages+0x351/0x590 [ 551.448843][ C1] ? folio_clear_dirty_for_io+0xca0/0xca0 [ 551.454688][ C1] ? writeback_sb_inodes+0x4bd/0x1020 [ 551.460095][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 551.465237][ C1] ? do_raw_spin_lock+0x11f/0x2b0 [ 551.470300][ C1] __writeback_single_inode+0x14e/0xee0 [ 551.475884][ C1] writeback_sb_inodes+0x813/0x1020 [ 551.481335][ C1] ? queue_io+0x530/0x530 [ 551.485728][ C1] __writeback_inodes_wb+0x114/0x240 [ 551.491085][ C1] wb_writeback+0x472/0xbe0 [ 551.495666][ C1] ? queue_io+0x2d1/0x530 [ 551.500035][ C1] ? percpu_ref_tryget+0x250/0x250 [ 551.505273][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 551.510431][ C1] wb_workfn+0xb8e/0xe60 [ 551.514810][ C1] ? inode_wait_for_writeback+0x230/0x230 [ 551.520769][ C1] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 551.526894][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 551.531952][ C1] ? read_lock_is_recursive+0x20/0x20 [ 551.537365][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 551.542644][ C1] ? process_scheduled_works+0x975/0x1600 [ 551.548394][ C1] ? process_scheduled_works+0x975/0x1600 [ 551.554151][ C1] process_scheduled_works+0xa60/0x1600 [ 551.559857][ C1] ? worker_attach_to_pool+0x370/0x370 [ 551.565360][ C1] ? assign_work+0x3cc/0x5d0 [ 551.570165][ C1] worker_thread+0xa5e/0xfe0 [ 551.574800][ C1] ? _raw_spin_unlock+0x40/0x40 [ 551.579685][ C1] ? __kthread_parkme+0x71/0x1c0 [ 551.584658][ C1] kthread+0x2fa/0x390 [ 551.588847][ C1] ? pr_cont_work+0x550/0x550 [ 551.593557][ C1] ? kthread_blkcg+0xd0/0xd0 [ 551.598179][ C1] ret_from_fork+0x48/0x80 [ 551.602630][ C1] ? kthread_blkcg+0xd0/0xd0 [ 551.607296][ C1] ret_from_fork_asm+0x11/0x20 [ 551.612107][ C1]