last executing test programs: 10.208021877s ago: executing program 0 (id=2066): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000500)=ANY=[@ANYRES32, @ANYBLOB="0100000004007bff1275fb118f91ba75404624e7175144956f6439b173862c440cf1c0ea7960e772bfdb85"]) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r2 = syz_usb_connect$printer(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSIGACCEPT(r3, 0x4b4e, 0x9) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) syz_usb_disconnect(r2) ioctl$XFS_IOC_SCRUBV_METADATA(r4, 0xc0285840, 0x0) 9.387268276s ago: executing program 0 (id=2083): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r2, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, 0x0, 0x0) write$tun(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="000103000f0b07"], 0x103) 9.184071625s ago: executing program 0 (id=2085): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) socket$kcm(0x21, 0x2, 0x2) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000007d40)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) socket$kcm(0x2, 0x200000000000001, 0x0) setns(0xc9, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) socket$kcm(0x2c, 0x3, 0x0) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r0, @ANYBLOB], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x3e8, 0xe, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68888a8", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 9.062578681s ago: executing program 0 (id=2088): socket$nl_route(0x10, 0x3, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) vmsplice(r1, &(0x7f0000000040)=[{&(0x7f0000000000)="e3", 0x1}], 0x1, 0x1) fcntl$setpipe(r0, 0x407, 0x176) vmsplice(r1, &(0x7f0000000480)=[{&(0x7f00000000c0)='{', 0x1}], 0x1, 0xd) vmsplice(r0, &(0x7f0000002a80)=[{&(0x7f0000000340)="b9", 0x1}], 0x1, 0x8) 4.873081889s ago: executing program 1 (id=2132): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r2, &(0x7f0000000000)='7', 0x1) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, 0x0, 0x0) write$tun(r1, 0x0, 0x103) 4.739409235s ago: executing program 1 (id=2133): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in=@rand_addr=0x64010100, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3, 0x0, 0x0, 0x0, 0x0, 0x80, 0xa0, 0x73}, {@in6=@dev={0xfe, 0x80, '\x00', 0x21}, 0x0, 0x33}, @in6=@dev={0xfe, 0x80, '\x00', 0xe}, {0x0, 0x0, 0xfffffffffff7fffd, 0x0, 0x10000, 0xffffffffffffffed, 0x3}, {0x0, 0x0, 0x2, 0xfffbfffffffffffe}, {0x0, 0x0, 0x796}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xe55286f1921f74bc}, 0x0, 0x1a0b0}}, 0xf8}, 0x1, 0x0, 0x0, 0x40040}, 0x0) write$binfmt_register(0xffffffffffffffff, &(0x7f0000000180)={0x3a, 'syz3', 0x3a, 'M', 0x3a, 0x80000000, 0x3a, 'veth1\x00', 0x3a, '/dev/kvm\x00', 0x3a, './file0'}, 0x36) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="20010000120013070000000000000000e0000001000000000000000000000000fc00"/64, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fc020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000072c42572f64a264410b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbc18c8582fc780000000000000000000000005001900000000002800"], 0x120}}, 0x0) 4.583057872s ago: executing program 0 (id=2091): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000500)=ANY=[@ANYRES32, @ANYBLOB="0100000004007bff1275fb118f91ba75404624e7175144956f6439b173862c440cf1c0ea7960e772bfdb85"]) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r2 = syz_usb_connect$printer(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000030020f003176c4000000000010902247251000000"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSIGACCEPT(r3, 0x4b4e, 0x9) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) syz_usb_disconnect(r2) ioctl$XFS_IOC_SCRUBV_METADATA(r4, 0xc0285840, 0x0) 4.525391465s ago: executing program 1 (id=2136): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1c, 0xe, &(0x7f0000004000)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x200000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r0 = io_uring_setup(0x1b7f, &(0x7f0000000040)={0x0, 0x40d1, 0x1f480, 0x1, 0x325}) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e21, 0x5, @remote, 0x6e}, 0x1c) io_uring_enter(r0, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) 1.225968822s ago: executing program 0 (id=2139): syz_mount_image$ocfs2(&(0x7f0000004740), &(0x7f0000004780)='./file0\x00', 0x100000a, &(0x7f00000000c0)=ANY=[@ANYBLOB="6a6f75726e616c5f6173796e635f636f6d6d69742c6865617274626561743d6e6f6e652c67727071756f74612c696e6f646536342c6469725f726573765f6c6576656c3d30303030303030303030303030303030303030332c6c6f63616c666c6f636b732c00a5ac95942a38e6bfeea96108fa50b58440ef6041bea5aa31e2dd2532458d802e41aa4599ba680aa7bd6d04004258b7a8902f078e686e0ad0017a9f40cab7e8ed9483c468cbe8b5111b52c62ae7bd99dde7768746459302ef1adff359935a901d9a93c2ee3190699fae61911c9956efa1b72ad683a0acc6d36539173f0f11dd2011263c662522d12cca07a4a3d593ee6ca5954cd0b5674f92faa9f828438f930b721d144e46001a56724219f14c2c58ef31aee3852b15bddc24bade32ed8f3cba254e2dbc6baf27"], 0x0, 0x4703, &(0x7f0000004800)="$eJzs212IXFcBB/BzJ6vZpMl2P9ImafoxSQQXLcumT9X6ENeqjabNh7bVVFlnN9vN6uzMujujBYPUIIiCoARBxQ+qQulLLYiBvtQiFPxAWoVSUbS+iBSq4INBG+jKzNybnXtntneyk7S0/f2gnb3n3nPumf3vPXfOPZNCrHZqYaW4sFIsVYrV2ftXbil+rlquL86FwqvktT4/vbkSOcn+tXPkfR/4yD23hPCHY1/70Orq6mpoGA5dHWj7+fy/T8+2vyYKmTqNdru31vLH+iMv/fwtr3REnhMhhB0d/WrYFEL42C9C2BxCGInLRuPXLSGEbSGEKITw6G/+9ePBfrrQ5uy9Lzx37MzhfWemHn/smQvzR9c9MArhu+XdN88vvrh/023Pv+MynR4AAF7RB48fufvo5IHwZBSGzg10fl7fGb8mn4/vfNun7np4YG3/Kr3Z9CqGCgAAABlr8//h6OUu63XJylqyJPjEAyfufipa229i+/p26K4jt79/8kC8/ht17L81Lvrnezc111Cz677Z9d+RTP3u679r53n4q8/+svLWjfc/6V9y3uEQFSZS24XCxEQIx6Za27uirYVydaX2zvur9crJjZ/3jSKdf3b1fm1Bv9f8RzPV89b/d3/i8z/bMtDPOxgL2b/axnax80+ZLtL5rz+W/+RLUU/5j2Xq5eV/x9Pbz/9qcz/vIHtGLkU6/9aFuK/9gGJrAGjk/82B/Px3ZNrPy//7U+cePbGB7/80xpnhqNHXwdQI8HJcvs5XmMhI598KIjV0xr/I9a7//2XyvybTfl7+d1b/8bu/9XH/X2/8H5/qp803j3T+rSCKqSPWrv+RQv71f22m/bz8f3vqz89+sq97dWf+jf6Pu//3JJ1/fCNOD57N32Sv4//OTPt5+e8au++hhQ30+8Nb4n4ORWGs7Vun5xq3sKG19ermlKaxe2kDJ3kTSOff+q2lLp2h1kvz+h/OH/93ZdrPy/+hPV9/z+m+vv/bffyfNP73JJ3/lmbZpeT/Uib/3Zn28/L/4em//+W+yzz+N7YPyr8n6fy3duxfe/5T6Gn+d12mft7zn32jTz3y1z7m/0n/kvMmz3+S5xDjUev5D92l879q3eN6vf/vydTLu/6/9Z/nn97fz/gfDXoC0Id0/ttahV0mgL3mf32m/bz8v3DPlz/+pw3M/5qf+AaT/Nvm/5tb5UeN/z1J57+9VZj6x1APNv/fvP9Hnbn/N5P/DZn28/K/cGhi4CuX+f7f6P94l0fZdErnP7TucY38f9/D/f/GTL28/L+496cv3tzX5/8QJs31Nyyd/9XrHte8/gfz878pUy8v/+9849dPPNhH/9/eR12y+bfu9anLKf5s3uv8v5hpPy//H42fP7v/Csz/bnX/70k6/9aq+aXkn53/7820n5f/9478YHngCjz/uUP+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGzIavw6HqDCR2i4UJiZCGIu3d4Wt0Uzp5PRMuTr7mZUQdsTlxTAazZerM6Xy9EKlenJuulQuV2dDuCbevyMMRivlam16sbR07cW2tkSn5krLtZm5Ui2EsDMuvz5sT9qaWagtlpaaxyZ1ropKn61Xa6WJ+srccth9sXxbUj6/XK0vXXexrasL1eWlU6XK9MmF5XdPTk5Ohj0X+zwSzT1Qm6vUWr1t7W3USeoOR21vprn7hrbzfbpaX66Uys3yG9vqlKuzpXJbnZvazldbrldmS7W56XJ1Pjlfsa1u23tr7t4b7xsPI6n3l9TNOhi/3n7o+EePHz7Qsb8YpfOu1BfnJrd3/5sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4I3rydve9e0QwkBrqxBCOJj8EMX/pZy994Xnjp05vO/M1OOPPXNh/mi3YwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4PztwIAAAAAAA5P/aCFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXYuZ+XKro4DsBnxve+FkgpbYRcBoaI6E7Cgn4RSeU1smWb1kGtEjIoCgwjWhYEQVC7qCBoFVT+BVELl62qTS1aGERQMTqTlzvCDS90zHkeGM4Mc++ZLwzcO3M+hwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALB+nN2x2JW1l3ZtXtq6+0PozM/9H0IYTZb3P+/tCD0hhK9fZk6HVdpCT1P/bybnxstXTX7v7R9/eH00WXv9xXeL63aHJB1qON6ZpOnQ0Nr736juDD6bHkxCSGMXQhQLY0/O1EIIHbELIYqfH+cvZr/v/8UuhCj6P9ztyu5/LXYhRLF196e+Wv6MR/Wcr18YbPzvb/UI3sYjOuvQ25NX3qVuauW9zN//k3zzPlgNsyeOvH8euwiimZ2bOhq7BgAA4O861yL/D1uW9+9fTkJPdzn3/9aU//c29b96/r/i3vYbYzNthRDbSmOT2fHwvnb63PhODVy9/bpmvKeq5P/VJv+vNvl/tcn/q03+X23yfzKv5P+V9PjmnsUXsYsgGvk/AABUz6HjE1P14ZHs5X/Tj85yXt+Xt/U8T39wa3rgUcO4kfzw33b42MSBg8Mj+X0vDwiurP+QLp39ns/3aG4Lk03zLlqt/9D7dGH+Wmf5E/U/nL9R1Fdc1/oPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAvdueehkEwCsPod1sRtdGqaMLCT4IPNDAiACnMaEAHEwZgIAQUMJBzlnuTZ3kBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA5/tXeV18f2mM9Foj0lR22bV/jqfZz9y3w/I+e9y4FQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADZ24EAGAAAAQJi/dR7tBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4KkAAAD//8Oayzs=") r0 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x3, 0x4, 0x0, 0x0, 0x12, 0x3, "d2273078cf6175866187bbf62372bbb65d940f27bc28a5a442ff5a8d374a182008a1fd92701ce53ee6aa5d922917aeecbfb3db24b09909c24cc157a3780cf5d5", "09b49809fc32a5fc7be9f88c6b84907998105e3111daa2bd51b0d0c3bc93fb2d0f0244a8c7a99a75e76613c745458f5c1212e72d93b272fed81941f04edd0059", "a960f08042e09119b6f87de59f19912c538884e7a95c3d50e4be66184e295eb1", [0x4, 0x6c]}) ioctl$BLKFLSBUF(r0, 0x1261, 0x0) quotactl$Q_SETINFO(0xffffffff80000600, &(0x7f0000000000)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000180)={0xfffffffffffffffb, 0x9, 0x0, 0x1}) 1.225750222s ago: executing program 1 (id=2140): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r2, &(0x7f0000000000)='7', 0x1) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, 0x0, 0x0) write$tun(r1, 0x0, 0x103) 1.225540512s ago: executing program 2 (id=2141): setns(0xc9, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000000, &(0x7f0000001840)={0xa, 0x4e21, 0xff, @remote, 0x2}, 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) 1.04818083s ago: executing program 1 (id=2143): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x10}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x80, 0x7fffffff, 0x8, 0xfff}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40088c1}, 0x4040840) sendmsg$nl_route_sched(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x8170b922, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x0, 0x2}, {0x8, 0xb}, {0xfff2, 0xffe0}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0xb32019a74e55d2de) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x24048840}, 0x40004) 1.017674602s ago: executing program 2 (id=2144): r0 = openat(0xffffffffffffff9c, 0x0, 0xc842, 0x1) ioctl$EVIOCGSW(r0, 0x8040451b, 0x0) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x890c, 0x0) socket$unix(0x1, 0x5, 0x0) syz_mount_image$msdos(&(0x7f00000002c0), &(0x7f0000000280)='./file0\x00', 0x88c8, &(0x7f00000006c0)=ANY=[@ANYBLOB="6e66732c646f74732c636865636b3d7374726963742c646f74732c6572726f72733d72656d6f756e742d726f2c00f8403bb14281bbfb9b8213bd6284536d64789a24dd73b98b3e33cb47fed8a7364664b62e9e891aa832722dfc28bfa4489b3a127a503e72326b737d0f67c97be6f37ef46154dec39ef8718946ffc8cd4d735a0b101c1722477bbe2f923577ea51f7116f17c3ddf5c497fba2d0bb3272d123b31e9461d4e2d65a42e1174fa269de92e463fc1cde2367bdb50cc5b2b462e1d45fc3265f1a88561ab6afb1b73a3b340b5c73055fc6e601843a59f3cdeb36991cfa985453287d4c9d2d6e21adddc57a607369c682e821b20dc0efd51d12f386f3f8e53c05e696e50c7c3f79b1b0bd7e5cfaf3f63d8949c8dd2fd94aa0f259a4cb9412c30c45f9d4d63d267d2a43f03a47fa56b3000000f9ffffffffffffff000000"], 0x9, 0x260, &(0x7f0000000a80)="$eJzs3b9uUmEYB+DXQgvpYmfjcBIXJ6JOrsTUxEhigmHQSZLq0hqT0wWduAyvwUvyBty72Mlj7Ielf7AOBb4DPE9Czpv8Djnvx8CB5P3g3f2Phwefjj9U379Gu11EM2JcVRF7sRWNSO5Mjltn9U5cNA4AYNX0+8Nu7h5YrLLsDrcjonUtGXzL0hAAAAAAAAAAAAC3Nmv+P07N/wPAOjP/v/7KsjvcnXx+u8z8PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJDPaVXdrW545O4PAJi/G+7/P6vk76nTCgBYab7/A8Dmcf8HgM3z+s3bl91eb79fFO2Ik/FoMBqkY8qfv+jtPyrO7E2fdTIaDRrn+eOUF5fz7did5E9m5jvx8EHK/2TPXvWu5K04WPzyAQAAAAAAAAAAAAAAAAAAoBY6xbmZ+/s7nX/lqbrw+wBX9u83415zacsAAAAAAAAAAAAAAAAAAACAlXb8+cvh8OjofVnf4ke2q7ci4j/n1PE1jKe1aGPZRcRSL/qrBkueW9G4HuV+ZwIAAAAAAAAAAAAAAAAAgM0z3fSbuxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyGf6//+LKyJiXCW5lwsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACssd8BAAD//xg9nuE=") r1 = creat(&(0x7f0000000040)='./bus\x00', 0x0) r2 = open(&(0x7f0000000340)='./file1\x00', 0x86442, 0x10) dup3(r2, r1, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x42, 0x0) pwrite64(r3, &(0x7f0000000340)="f5", 0x1, 0x8080c61) io_setup(0x91, &(0x7f0000000400)=0x0) io_submit(r4, 0x3f0a, &(0x7f0000000540)=[&(0x7f00000000c0)={0xf04aef, 0x3d8, 0x4, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 830.87544ms ago: executing program 3 (id=2146): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in=@rand_addr=0x64010100, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3, 0x0, 0x0, 0x0, 0x0, 0x80, 0xa0, 0x73}, {@in6=@dev={0xfe, 0x80, '\x00', 0x21}, 0x0, 0x33}, @in6=@dev={0xfe, 0x80, '\x00', 0xe}, {0x0, 0x0, 0xfffffffffff7fffd, 0x0, 0x10000, 0xffffffffffffffed, 0x3}, {0x0, 0x0, 0x2, 0xfffbfffffffffffe}, {0x0, 0x0, 0x796}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xe55286f1921f74bc}, 0x0, 0x1a0b0}}, 0xf8}, 0x1, 0x0, 0x0, 0x40040}, 0x0) write$binfmt_register(0xffffffffffffffff, &(0x7f0000000180)={0x3a, 'syz3', 0x3a, 'M', 0x3a, 0x80000000, 0x3a, 'veth1\x00', 0x3a, '/dev/kvm\x00', 0x3a, './file0'}, 0x36) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="20010000120013070000000000000000e0000001000000000000000000000000fc00"/64, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fc020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000072c42572f64a264410b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbc18c8582fc780000000000000000000000005001900000000002800"], 0x120}}, 0x0) 803.747092ms ago: executing program 1 (id=2147): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000500)=ANY=[@ANYRES32, @ANYBLOB="0100000004007bff1275fb118f91ba75404624e7175144956f6439b173862c440cf1c0ea7960e772bfdb85"]) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r2 = syz_usb_connect$printer(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000030020f003176c4000000000010902247251000000"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSIGACCEPT(r3, 0x4b4e, 0x9) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) syz_usb_disconnect(r2) ioctl$XFS_IOC_SCRUBV_METADATA(r4, 0xc0285840, 0x0) 684.771528ms ago: executing program 3 (id=2148): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'netdevsim0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newtfilter={0x30, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r0, {}, {0xfff1, 0xffff}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x2c}}, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(0xffffffffffffffff, 0xc0f85403, &(0x7f00000003c0)={{0x3, 0x1, 0x2, 0x2, 0x8}, 0x8001, 0x6c, 'id0\x00', 'timer1\x00', 0x0, 0x5, 0xc, 0xffff, 0x1}) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) ioctl$EVIOCGPROP(r2, 0x40047438, &(0x7f0000000180)=""/246) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000280)="c021", 0x1700}], 0x20) 607.654081ms ago: executing program 2 (id=2149): r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, 0x0, 0x0, 0x1, 0x5}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000000000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r1}, 0x64) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1c, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="2ff000fea0"], 0x0, 0xb, 0x0, 0x0, 0x41100, 0x6e, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) io_uring_enter(0xffffffffffffffff, 0x2219, 0x7721, 0x16, 0x0, 0x0) listen(r0, 0xda90) accept(r0, 0x0, 0x0) 532.063584ms ago: executing program 3 (id=2150): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1c, 0xe, &(0x7f0000004000)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x200000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r0 = io_uring_setup(0x1b7f, &(0x7f0000000040)={0x0, 0x40d1, 0x1f480, 0x1, 0x325}) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e21, 0x5, @remote, 0x6e}, 0x1c) io_uring_enter(r0, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) 473.158307ms ago: executing program 3 (id=2151): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r2, &(0x7f0000000000)='7', 0x1) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, 0x0, 0x0) write$tun(r1, &(0x7f0000000040)=ANY=[], 0x103) 416.29273ms ago: executing program 2 (id=2152): timer_create(0x0, 0x0, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) vmsplice(r2, &(0x7f0000000040)=[{&(0x7f0000000000)="e3", 0x1}], 0x1, 0x1) fcntl$setpipe(r1, 0x407, 0x176) vmsplice(r2, &(0x7f0000000480)=[{&(0x7f00000000c0)='{', 0x1}], 0x1, 0xd) vmsplice(r1, &(0x7f0000002a80)=[{&(0x7f0000000340)="b9", 0x1}], 0x1, 0x8) 268.027767ms ago: executing program 3 (id=2153): setns(0xc9, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000000, &(0x7f0000001840)={0xa, 0x4e21, 0xff, @remote, 0x2}, 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) 181.784091ms ago: executing program 2 (id=2154): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) socket$kcm(0x21, 0x2, 0x2) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000007d40)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) socket$kcm(0x2, 0x200000000000001, 0x0) setns(0xc9, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) socket$kcm(0x2c, 0x3, 0x0) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000d000000b7"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x3e8, 0xe, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68888a8", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 121.914044ms ago: executing program 3 (id=2155): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x10}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x80, 0x7fffffff, 0x8, 0xfff}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40088c1}, 0x4040840) sendmsg$nl_route_sched(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x8170b922, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x0, 0x2}, {0x8, 0xb}, {0xfff2, 0xffe0}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0xb32019a74e55d2de) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x24048840}, 0x40004) 0s ago: executing program 2 (id=2156): mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x8000000000000002, 0x0) ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x260143, 0x0) kernel console output (not intermixed with test programs): VS: starting estimator thread 0... [ 211.010587][ T8104] IPVS: using max 22 ests per chain, 52800 per kthread [ 211.381484][ T8118] netlink: 8 bytes leftover after parsing attributes in process `syz.3.930'. [ 211.549279][ T5879] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 211.766993][ T5879] usb 3-1: Using ep0 maxpacket: 32 [ 211.798780][ T5879] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 211.820003][ T5879] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 211.844705][ T5879] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 211.885843][ T5879] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 211.928594][ T5879] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 211.971044][ T5879] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 212.018645][ T5879] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 212.068983][ T5879] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.122459][ T5879] usb 3-1: config 0 descriptor?? [ 212.205655][ T8128] loop3: detected capacity change from 0 to 2048 [ 212.228019][ T8130] ieee802154 phy0 wpan0: encryption failed: -22 [ 212.270284][ T8128] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 212.357088][ T28] audit: type=1800 audit(1789383249.789:18): pid=8128 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.935" name="file1" dev="loop3" ino=15 res=0 errno=0 [ 212.401473][ T5879] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 10 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 212.469128][ T5879] usb 3-1: USB disconnect, device number 10 [ 212.498212][ T5776] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 212.510932][ T5879] usblp0: removed [ 212.609020][ T8138] loop1: detected capacity change from 0 to 164 [ 212.641094][ T8140] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 212.650455][ T8140] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 212.659292][ T8140] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 212.668132][ T8140] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 212.720869][ T5788] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 212.902385][ T8147] bridge_slave_1 (unregistering): left allmulticast mode [ 212.911929][ T8147] bridge_slave_1 (unregistering): left promiscuous mode [ 212.931725][ T8147] bridge0: port 2(bridge_slave_1) entered disabled state [ 213.125647][ T8158] loop1: detected capacity change from 0 to 1764 [ 213.275561][ T28] audit: type=1326 audit(1789383250.638:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8161 comm="syz.1.947" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 213.304547][ T28] audit: type=1326 audit(1789383250.638:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8161 comm="syz.1.947" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 213.333828][ T28] audit: type=1326 audit(1789383250.648:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8161 comm="syz.1.947" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 213.362368][ T28] audit: type=1326 audit(1789383250.648:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8161 comm="syz.1.947" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=276 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 213.421415][ T28] audit: type=1326 audit(1789383250.648:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8161 comm="syz.1.947" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 213.459615][ T28] audit: type=1326 audit(1789383250.657:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8161 comm="syz.1.947" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 213.489030][ T28] audit: type=1326 audit(1789383250.648:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8161 comm="syz.1.947" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 213.517237][ T28] audit: type=1326 audit(1789383250.657:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8161 comm="syz.1.947" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 213.545623][ T28] audit: type=1326 audit(1789383250.657:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8161 comm="syz.1.947" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 213.656147][ T8170] 9pnet_fd: Insufficient options for proto=fd [ 213.956511][ T8182] xt_hashlimit: max too large, truncated to 1048576 [ 214.100066][ T8186] syzkaller0: entered promiscuous mode [ 214.105989][ T8186] syzkaller0: entered allmulticast mode [ 214.234719][ T5884] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 214.451291][ T5884] usb 3-1: Using ep0 maxpacket: 32 [ 214.464152][ T5884] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 214.482953][ T5884] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 214.499326][ T5884] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 214.512354][ T8194] FAULT_INJECTION: forcing a failure. [ 214.512354][ T8194] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 214.525948][ T5884] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 214.535801][ T5884] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 214.545673][ T8194] CPU: 0 PID: 8194 Comm: syz.1.964 Not tainted syzkaller #0 [ 214.552983][ T8194] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 214.563041][ T8194] Call Trace: [ 214.566323][ T8194] [ 214.569255][ T8194] dump_stack_lvl+0x18c/0x250 [ 214.573967][ T8194] ? show_regs_print_info+0x20/0x20 [ 214.579200][ T8194] ? load_image+0x420/0x420 [ 214.583719][ T8194] ? __might_fault+0xaa/0x120 [ 214.588419][ T8194] ? __lock_acquire+0x7d80/0x7d80 [ 214.593456][ T8194] should_fail_ex+0x394/0x4c0 [ 214.598155][ T8194] _copy_from_iter+0x1cd/0x1290 [ 214.603034][ T8194] ? __virt_addr_valid+0x10c/0x380 [ 214.608221][ T8194] ? __lock_acquire+0x7d80/0x7d80 [ 214.613296][ T8194] ? copyout_mc+0x70/0x70 [ 214.617698][ T8194] ? __virt_addr_valid+0x10c/0x380 [ 214.622817][ T8194] ? __virt_addr_valid+0x10c/0x380 [ 214.627948][ T8194] ? __virt_addr_valid+0x10c/0x380 [ 214.633104][ T8194] ? __check_object_size+0x4fc/0xa40 [ 214.638431][ T8194] kernfs_fop_write_iter+0x19e/0x520 [ 214.643721][ T8194] vfs_write+0x474/0x9a0 [ 214.647979][ T8194] ? file_end_write+0x250/0x250 [ 214.652879][ T8194] ? __fget_files+0x3fc/0x460 [ 214.657592][ T8194] ? __fdget_pos+0x2a3/0x330 [ 214.662221][ T8194] ? ksys_write+0x74/0x260 [ 214.666663][ T8194] ksys_write+0x151/0x260 [ 214.671018][ T8194] ? __ia32_sys_read+0x90/0x90 [ 214.675812][ T8194] ? lockdep_hardirqs_on+0x98/0x150 [ 214.681155][ T8194] do_syscall_64+0x55/0xb0 [ 214.685599][ T8194] ? clear_bhb_loop+0x40/0x90 [ 214.690324][ T8194] ? clear_bhb_loop+0x40/0x90 [ 214.695046][ T8194] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 214.700962][ T8194] RIP: 0033:0x7f2a9495e98e [ 214.705395][ T8194] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 214.725116][ T8194] RSP: 002b:00007f2a9579ea08 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 214.733575][ T8194] RAX: ffffffffffffffda RBX: 00007f2a9579f6c0 RCX: 00007f2a9495e98e [ 214.741572][ T8194] RDX: 0000000000000008 RSI: 00007f2a9579ea90 RDI: 0000000000000009 [ 214.749588][ T8194] RBP: 00007f2a94a090a0 R08: 0000000000000000 R09: 0000000000000000 [ 214.757589][ T8194] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 214.765596][ T8194] R13: 00007f2a9579ea90 R14: 00007f2a94c25fa0 R15: 00007ffc13d5fb98 [ 214.773608][ T8194] [ 214.777354][ T5884] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 214.790428][ T5884] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 214.799572][ T5884] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 214.812098][ T5884] usb 3-1: config 0 descriptor?? [ 215.047270][ T5884] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 11 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 215.079871][ T5884] usb 3-1: USB disconnect, device number 11 [ 215.088490][ T5884] usblp0: removed [ 215.417468][ T8196] x_tables: duplicate underflow at hook 2 [ 215.526397][ T8200] netlink: 'syz.1.967': attribute type 1 has an invalid length. [ 215.554539][ T8200] 8021q: adding VLAN 0 to HW filter on device bond1 [ 215.573407][ T8200] bond1: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 215.586273][ T8200] bond1: entered promiscuous mode [ 215.591402][ T8200] bond1: entered allmulticast mode [ 215.886484][ T8209] netlink: 'syz.2.971': attribute type 7 has an invalid length. [ 216.023953][ T8214] loop1: detected capacity change from 0 to 2048 [ 216.088477][ T8214] loop1: p1 < > p4 [ 216.094836][ T8214] loop1: p4 size 8388608 extends beyond EOD, truncated [ 216.114738][ T8214] EXT4-fs (loop1p1): unable to read superblock [ 216.125663][ T8148] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 216.356102][ T5786] udevd[5786]: inotify_add_watch(7, /dev/loop1p1, 10) failed: No such file or directory [ 216.385503][ T5788] udevd[5788]: inotify_add_watch(7, /dev/loop1p4, 10) failed: No such file or directory [ 216.412999][ T8223] loop2: detected capacity change from 0 to 512 [ 216.450064][ T8223] EXT4-fs: inline encryption not supported [ 216.482079][ T8223] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 216.537049][ T8223] EXT4-fs (loop2): 1 truncate cleaned up [ 216.575488][ T8223] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 216.755523][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 216.768791][ T5879] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 216.974978][ T5879] usb 1-1: Using ep0 maxpacket: 32 [ 216.989840][ T5879] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 217.017521][ T5879] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 217.050379][ T5879] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 217.085663][ T5879] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 217.122085][ T5879] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 217.162105][ T5879] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 217.202931][ T5879] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 217.231498][ T5879] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.264094][ T5879] usb 1-1: config 0 descriptor?? [ 217.508302][ T5879] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 11 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 217.556845][ T5879] usb 1-1: USB disconnect, device number 11 [ 217.583085][ T5879] usblp0: removed [ 217.674277][ T8260] loop2: detected capacity change from 0 to 512 [ 217.698242][ T8260] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 218.023366][ T8273] loop1: detected capacity change from 0 to 128 [ 218.035106][ T8273] EXT4-fs: Ignoring removed nobh option [ 218.082327][ T8273] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 218.144449][ T8273] ext4 filesystem being mounted at /250/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 218.281084][ T8273] EXT4-fs error (device loop1): dx_make_map:1328: inode #2: block 20: comm syz.1.1000: bad entry in directory: inode out of bounds - offset=988, inode=128, rec_len=36, size=1024 fake=1 [ 218.382846][ T8273] EXT4-fs (loop1): Remounting filesystem read-only [ 218.478114][ T5775] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 218.662830][ T8293] MTRR 1 not used [ 218.711618][ T8290] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1007'. [ 218.750241][ T8290] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1007'. [ 218.787862][ T8290] 8021q: adding VLAN 0 to HW filter on device bond0 [ 218.845388][ T8290] bond1: (slave bond0): making interface the new active one [ 218.879373][ T8290] bond1: (slave bond0): Enslaving as an active interface with an up link [ 218.918859][ T8296] netlink: 'syz.2.1007': attribute type 4 has an invalid length. [ 218.958044][ T8296] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1007'. [ 219.013469][ T8296] .`: renamed from bond0 (while UP) [ 219.063070][ T5884] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 219.098643][ T5884] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 219.210250][ T8306] fido_id[8306]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 219.252869][ T8309] loop1: detected capacity change from 0 to 1024 [ 219.272005][ T8309] EXT4-fs: inline encryption not supported [ 219.285739][ T8309] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 219.320248][ T8309] EXT4-fs (loop1): orphan cleanup on readonly fs [ 219.344112][ T8309] EXT4-fs error (device loop1): ext4_map_blocks:720: inode #3: block 1: comm syz.1.1013: lblock 1 mapped to illegal pblock 1 (length 1) [ 219.374622][ T8309] EXT4-fs (loop1): Remounting filesystem read-only [ 219.381352][ T5879] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 219.397575][ T8309] __quota_error: 52 callbacks suppressed [ 219.397589][ T8309] Quota error (device loop1): write_blk: dquota write failed [ 219.425143][ T8309] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 219.446768][ T8309] Quota error (device loop1): v2_write_file_info: Can't write info structure [ 219.461814][ T28] audit: type=1326 audit(1789383256.345:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8315 comm="syz.3.1016" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f59c399e159 code=0x0 [ 219.462697][ T8309] EXT4-fs (loop1): 1 orphan inode deleted [ 219.493757][ T8309] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 219.540179][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 219.594850][ T5879] usb 1-1: Using ep0 maxpacket: 32 [ 219.606382][ T5879] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 219.614882][ T5879] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 219.631718][ T5879] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 219.650992][ T5879] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 219.670665][ T5879] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 219.691253][ T5879] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 219.719084][ T5879] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 219.741116][ T5879] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.763138][ T5879] usb 1-1: config 0 descriptor?? [ 219.927867][ T8325] loop1: detected capacity change from 0 to 2048 [ 219.997241][ T5879] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 12 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 220.041408][ T5879] usb 1-1: USB disconnect, device number 12 [ 220.066282][ T5879] usblp0: removed [ 220.491056][ T8337] loop3: detected capacity change from 0 to 1024 [ 220.512147][ T8337] EXT4-fs: inline encryption not supported [ 220.707480][ T8337] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 220.741056][ T8337] EXT4-fs (loop3): orphan cleanup on readonly fs [ 220.781377][ T8337] EXT4-fs error (device loop3): ext4_map_blocks:720: inode #3: block 1: comm syz.3.1025: lblock 1 mapped to illegal pblock 1 (length 1) [ 220.838297][ T8337] EXT4-fs (loop3): Remounting filesystem read-only [ 220.855931][ T8337] Quota error (device loop3): write_blk: dquota write failed [ 220.880952][ T8337] Quota error (device loop3): qtree_write_dquot: Error -117 occurred while creating quota [ 220.927230][ T8337] Quota error (device loop3): v2_write_file_info: Can't write info structure [ 220.964138][ T8337] EXT4-fs (loop3): 1 orphan inode deleted [ 220.997074][ T8337] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 221.189104][ T5776] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 221.800402][ T8377] loop2: detected capacity change from 0 to 1024 [ 221.815045][ T8377] EXT4-fs: inline encryption not supported [ 221.829963][ T8377] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 221.862158][ T8377] EXT4-fs (loop2): orphan cleanup on readonly fs [ 221.880034][ T5884] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 221.892585][ T8377] EXT4-fs error (device loop2): ext4_map_blocks:720: inode #3: block 1: comm syz.2.1043: lblock 1 mapped to illegal pblock 1 (length 1) [ 221.925417][ T8377] EXT4-fs (loop2): Remounting filesystem read-only [ 221.939049][ T8377] Quota error (device loop2): write_blk: dquota write failed [ 221.954980][ T8377] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 221.975488][ T8377] Quota error (device loop2): v2_write_file_info: Can't write info structure [ 221.995530][ T8377] EXT4-fs (loop2): 1 orphan inode deleted [ 222.015352][ T8377] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 222.118284][ T5884] usb 2-1: Using ep0 maxpacket: 32 [ 222.124185][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 222.141178][ T5884] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 222.152811][ T5884] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 222.173711][ T5884] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 222.208172][ T5884] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 222.241227][ T5884] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 222.284193][ T5884] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 222.337985][ T8388] syzkaller0: entered promiscuous mode [ 222.343591][ T5884] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 222.365411][ T8388] syzkaller0: entered allmulticast mode [ 222.387181][ T5884] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.414745][ T5884] usb 2-1: config 0 descriptor?? [ 222.660075][ T5884] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 15 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 222.719352][ T5884] usb 2-1: USB disconnect, device number 15 [ 222.767459][ T5884] usblp0: removed [ 222.954081][ T8405] FAULT_INJECTION: forcing a failure. [ 222.954081][ T8405] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 222.967572][ T8405] CPU: 0 PID: 8405 Comm: syz.0.1055 Not tainted syzkaller #0 [ 222.975008][ T8405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 222.985190][ T8405] Call Trace: [ 222.988498][ T8405] [ 222.991456][ T8405] dump_stack_lvl+0x18c/0x250 [ 222.996191][ T8405] ? show_regs_print_info+0x20/0x20 [ 223.001449][ T8405] ? load_image+0x420/0x420 [ 223.006015][ T8405] ? __might_fault+0xaa/0x120 [ 223.010728][ T8405] ? __lock_acquire+0x7d80/0x7d80 [ 223.015785][ T8405] ? __up_read+0x2b8/0x6b0 [ 223.020241][ T8405] ? __virt_addr_valid+0x10c/0x380 [ 223.025403][ T8405] should_fail_ex+0x394/0x4c0 [ 223.030135][ T8405] _copy_to_user+0x2f/0xa0 [ 223.034594][ T8405] __se_sys_mincore+0x4fb/0x600 [ 223.039489][ T8405] ? lockdep_hardirqs_on+0x98/0x150 [ 223.044790][ T8405] do_syscall_64+0x55/0xb0 [ 223.049240][ T8405] ? clear_bhb_loop+0x40/0x90 [ 223.053973][ T8405] ? clear_bhb_loop+0x40/0x90 [ 223.058700][ T8405] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 223.064637][ T8405] RIP: 0033:0x7f3834b9e159 [ 223.069084][ T8405] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 223.088728][ T8405] RSP: 002b:00007f3835b1b028 EFLAGS: 00000246 ORIG_RAX: 000000000000001b [ 223.097191][ T8405] RAX: ffffffffffffffda RBX: 00007f3834e26090 RCX: 00007f3834b9e159 [ 223.105202][ T8405] RDX: 0000000000000000 RSI: 0000000000004000 RDI: 00002000000ef000 [ 223.113227][ T8405] RBP: 00007f3834c3503b R08: 0000000000000000 R09: 0000000000000000 [ 223.121229][ T8405] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 223.129245][ T8405] R13: 00007f3834e26128 R14: 00007f3834e26090 R15: 00007ffcead0c7f8 [ 223.137274][ T8405] [ 223.283764][ T8412] loop0: detected capacity change from 0 to 1024 [ 223.308784][ T8412] EXT4-fs: inline encryption not supported [ 223.343410][ T8412] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 223.378182][ T8412] EXT4-fs (loop0): orphan cleanup on readonly fs [ 223.419973][ T8412] EXT4-fs error (device loop0): ext4_map_blocks:720: inode #3: block 1: comm syz.0.1056: lblock 1 mapped to illegal pblock 1 (length 1) [ 223.493035][ T8412] EXT4-fs (loop0): Remounting filesystem read-only [ 223.514640][ T8412] EXT4-fs (loop0): 1 orphan inode deleted [ 223.539706][ T8412] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 223.557388][ T8419] loop3: detected capacity change from 0 to 764 [ 223.781858][ T5778] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 223.870799][ T8427] loop3: detected capacity change from 0 to 512 [ 223.985205][ T8429] loop0: detected capacity change from 0 to 512 [ 224.023587][ T8429] EXT4-fs: Ignoring removed nobh option [ 224.075314][ T8429] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 224.115754][ T8429] ext4 filesystem being mounted at /314/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 224.280691][ T8440] loop2: detected capacity change from 0 to 512 [ 224.297194][ T5778] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 224.317937][ T8440] EXT4-fs: Ignoring removed oldalloc option [ 224.381484][ T8440] EXT4-fs (loop2): 1 truncate cleaned up [ 224.388796][ T8440] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 224.461069][ T8440] EXT4-fs error (device loop2): htree_dirblock_to_tree:1112: inode #2: block 13: comm syz.2.1069: bad entry in directory: rec_len is smaller than minimal - offset=76, inode=0, rec_len=0, size=1024 fake=0 [ 224.518588][ T8440] EXT4-fs (loop2): Remounting filesystem read-only [ 224.594093][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 224.794068][ T5884] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 224.914383][ T8459] loop1: detected capacity change from 0 to 512 [ 224.930631][ T8459] EXT4-fs: Ignoring removed nobh option [ 225.000246][ T8459] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 225.021330][ T5884] usb 1-1: Using ep0 maxpacket: 32 [ 225.039301][ T5884] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 225.053416][ T8459] ext4 filesystem being mounted at /272/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 225.074006][ T5884] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 225.099895][ T5884] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 225.142638][ T5884] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 225.194129][ T5884] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 225.203882][ T5884] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 225.263370][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 225.275354][ T5884] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 225.310772][ T5884] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.347056][ T5884] usb 1-1: config 0 descriptor?? [ 225.528782][ T8476] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1085'. [ 225.581377][ T5884] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 13 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 225.635243][ T5884] usb 1-1: USB disconnect, device number 13 [ 225.668238][ T5884] usblp0: removed [ 225.762013][ T8483] loop2: detected capacity change from 0 to 128 [ 225.868265][ T8489] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1091'. [ 225.982544][ T8491] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1092'. [ 225.999440][ T8493] loop3: detected capacity change from 0 to 512 [ 226.012492][ T8493] EXT4-fs: Ignoring removed nobh option [ 226.068660][ T8493] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 226.102823][ T8493] ext4 filesystem being mounted at /240/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 226.200990][ T5776] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 226.454433][ T8504] loop2: detected capacity change from 0 to 512 [ 226.516877][ T28] kauditd_printk_skb: 3 callbacks suppressed [ 226.516894][ T28] audit: type=1800 audit(1789383262.864:81): pid=8504 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1096" name="file1" dev="loop2" ino=1048597 res=0 errno=0 [ 226.820974][ T8513] syzkaller0: entered promiscuous mode [ 226.843593][ T8516] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1101'. [ 226.852684][ T8513] syzkaller0: entered allmulticast mode [ 227.327230][ T8509] syz.2.1096: attempt to access beyond end of device [ 227.327230][ T8509] loop2: rw=2049, sector=1760, nr_sectors = 2048 limit=512 [ 227.389927][ T8509] syz.2.1096: attempt to access beyond end of device [ 227.389927][ T8509] loop2: rw=2049, sector=3808, nr_sectors = 600 limit=512 [ 227.533462][ T5879] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 227.569590][ T34] kworker/u4:2: attempt to access beyond end of device [ 227.569590][ T34] loop2: rw=1, sector=4408, nr_sectors = 2048 limit=512 [ 227.617892][ T34] kworker/u4:2: attempt to access beyond end of device [ 227.617892][ T34] loop2: rw=1, sector=6456, nr_sectors = 2048 limit=512 [ 227.659657][ T34] kworker/u4:2: attempt to access beyond end of device [ 227.659657][ T34] loop2: rw=1, sector=8504, nr_sectors = 2048 limit=512 [ 227.686649][ T34] kworker/u4:2: attempt to access beyond end of device [ 227.686649][ T34] loop2: rw=1, sector=10552, nr_sectors = 2048 limit=512 [ 227.705667][ T34] kworker/u4:2: attempt to access beyond end of device [ 227.705667][ T34] loop2: rw=1, sector=12600, nr_sectors = 2048 limit=512 [ 227.724077][ T34] kworker/u4:2: attempt to access beyond end of device [ 227.724077][ T34] loop2: rw=1, sector=14648, nr_sectors = 1816 limit=512 [ 227.772125][ T5879] usb 2-1: Using ep0 maxpacket: 32 [ 227.784143][ T5879] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 227.792528][ T5879] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 227.842677][ T5879] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 227.866010][ T8538] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1113'. [ 227.883021][ T5879] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 227.926076][ T5879] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 227.970355][ T5879] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 228.019473][ T5879] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 228.053291][ T5879] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.100244][ T5879] usb 2-1: config 0 descriptor?? [ 228.359674][ T5879] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 16 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 228.426627][ T5879] usb 2-1: USB disconnect, device number 16 [ 228.453005][ T5879] usblp0: removed [ 228.480869][ T8556] set_capacity_and_notify: 1 callbacks suppressed [ 228.480884][ T8556] loop3: detected capacity change from 0 to 512 [ 228.553138][ T28] audit: type=1800 audit(1789383264.748:82): pid=8556 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1119" name="file1" dev="loop3" ino=1048599 res=0 errno=0 [ 228.673758][ T8559] syz.3.1119: attempt to access beyond end of device [ 228.673758][ T8559] loop3: rw=2049, sector=2384, nr_sectors = 112 limit=512 [ 229.277745][ T8576] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1125'. [ 229.384605][ T8580] FAULT_INJECTION: forcing a failure. [ 229.384605][ T8580] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 229.423118][ T2907] kworker/u4:7: attempt to access beyond end of device [ 229.423118][ T2907] loop3: rw=1, sector=2496, nr_sectors = 2048 limit=512 [ 229.425053][ T8580] CPU: 0 PID: 8580 Comm: syz.2.1128 Not tainted syzkaller #0 [ 229.444217][ T8580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 229.454315][ T8580] Call Trace: [ 229.457634][ T8580] [ 229.460610][ T8580] dump_stack_lvl+0x18c/0x250 [ 229.465332][ T8580] ? show_regs_print_info+0x20/0x20 [ 229.470576][ T8580] ? load_image+0x420/0x420 [ 229.475122][ T8580] ? __lock_acquire+0x7d80/0x7d80 [ 229.480184][ T8580] should_fail_ex+0x394/0x4c0 [ 229.484893][ T8580] prepare_alloc_pages+0x1e1/0x5b0 [ 229.490054][ T8580] __alloc_pages+0x134/0x460 [ 229.494706][ T8580] ? zone_statistics+0x170/0x170 [ 229.499667][ T8580] ? do_raw_spin_lock+0x11f/0x2b0 [ 229.504724][ T8580] ? __rwlock_init+0x150/0x150 [ 229.509510][ T8580] ? __mod_lruvec_page_state+0xa5/0x410 [ 229.515089][ T8580] pte_alloc_one+0x84/0x540 [ 229.519612][ T8580] ? pfn_modify_allowed+0x560/0x560 [ 229.524860][ T8580] ? __pud_alloc+0x200/0x200 [ 229.529489][ T8580] __pte_alloc+0x22/0x2a0 [ 229.533865][ T8580] handle_mm_fault+0x3dc6/0x4a50 [ 229.538826][ T8580] ? handle_mm_fault+0xe6/0x4a50 [ 229.543794][ T8580] ? numa_migrate_prep+0x350/0x350 [ 229.548935][ T8580] ? lock_chain_count+0x20/0x20 [ 229.553812][ T8580] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 229.559123][ T8580] do_user_addr_fault+0x736/0x12d0 [ 229.564274][ T8580] exc_page_fault+0x64/0x100 [ 229.568891][ T8580] asm_exc_page_fault+0x26/0x30 [ 229.573788][ T8580] RIP: 0010:__get_user_8+0x11/0x20 [ 229.578923][ T8580] Code: 48 c1 fa 3f 48 09 d0 0f 01 cb 8b 10 31 c0 0f 01 ca c3 90 90 90 90 90 90 90 f3 0f 1e fa 48 89 c2 48 c1 fa 3f 48 09 d0 0f 01 cb <48> 8b 10 31 c0 0f 01 ca c3 90 90 90 90 90 90 f3 0f 1e fa 0f 01 cb [ 229.598567][ T8580] RSP: 0018:ffffc9001aaafee8 EFLAGS: 00050246 [ 229.604662][ T8580] RAX: 0000000000000000 RBX: 0000000000000000 RCX: e874d2f10f992600 [ 229.612652][ T8580] RDX: 0000000000000000 RSI: ffffffff8acade60 RDI: ffffffff8b1d35e0 [ 229.620637][ T8580] RBP: ffffc9001aaaff48 R08: ffffffff8e8c8daf R09: 1ffffffff1d191b5 [ 229.628647][ T8580] R10: dffffc0000000000 R11: fffffbfff1d191b6 R12: 0000000000000000 [ 229.636634][ T8580] R13: 0000000000000000 R14: 0000000000008001 R15: 00000000000000ce [ 229.644644][ T8580] __se_sys_io_setup+0x2d/0x190 [ 229.649527][ T8580] do_syscall_64+0x55/0xb0 [ 229.653977][ T8580] ? clear_bhb_loop+0x40/0x90 [ 229.658674][ T8580] ? clear_bhb_loop+0x40/0x90 [ 229.663373][ T8580] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 229.669290][ T8580] RIP: 0033:0x7fb995f9e159 [ 229.673947][ T8580] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 229.693743][ T8580] RSP: 002b:00007fb996e30028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ce [ 229.702187][ T8580] RAX: ffffffffffffffda RBX: 00007fb996225fa0 RCX: 00007fb995f9e159 [ 229.710192][ T8580] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000008001 [ 229.718181][ T8580] RBP: 00007fb99603503b R08: 0000000000000000 R09: 0000000000000000 [ 229.726179][ T8580] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 229.734184][ T8580] R13: 00007fb996226038 R14: 00007fb996225fa0 R15: 00007ffcf6cef988 [ 229.742184][ T8580] [ 230.336982][ T8599] loop0: detected capacity change from 0 to 764 [ 230.376797][ T8601] loop1: detected capacity change from 0 to 512 [ 230.409037][ T8601] EXT4-fs: Ignoring removed nobh option [ 230.468946][ T5979] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 230.500798][ T8601] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 230.552083][ T8601] ext4 filesystem being mounted at /282/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 230.582925][ T8608] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1140'. [ 230.696361][ T5979] usb 3-1: Using ep0 maxpacket: 32 [ 230.711470][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 230.729847][ T5979] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 230.749361][ T5979] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 230.761417][ T5979] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 230.781926][ T5979] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 230.813948][ T5979] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 230.847342][ T5979] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 230.923873][ T5979] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 230.932993][ T5979] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.954271][ T8617] loop1: detected capacity change from 0 to 512 [ 231.002584][ T5979] usb 3-1: config 0 descriptor?? [ 231.047929][ T28] audit: type=1800 audit(1789383267.047:83): pid=8617 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1143" name="file1" dev="loop1" ino=1048601 res=0 errno=0 [ 231.256593][ T5979] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 12 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 231.298355][ T5979] usb 3-1: USB disconnect, device number 12 [ 231.331348][ T8624] loop3: detected capacity change from 0 to 164 [ 231.338115][ T5979] usblp0: removed [ 231.650825][ T8634] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1150'. [ 231.795444][ T8636] loop3: detected capacity change from 0 to 512 [ 231.807481][ T8636] EXT4-fs: Ignoring removed nobh option [ 231.838715][ T8636] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 231.859003][ T8636] ext4 filesystem being mounted at /258/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 231.927540][ T5776] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 232.611756][ T8653] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 232.793703][ T8661] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1160'. [ 232.914560][ T8665] loop3: detected capacity change from 0 to 512 [ 232.926161][ T8667] loop0: detected capacity change from 0 to 512 [ 232.933616][ T8665] EXT4-fs: Ignoring removed nobh option [ 232.979163][ T28] audit: type=1800 audit(1789383268.829:84): pid=8667 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1161" name="file1" dev="loop0" ino=1048603 res=0 errno=0 [ 233.027118][ T8665] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 233.078490][ T8665] ext4 filesystem being mounted at /263/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 233.133240][ T8670] bio_check_eod: 14 callbacks suppressed [ 233.133283][ T8670] syz.0.1161: attempt to access beyond end of device [ 233.133283][ T8670] loop0: rw=2049, sector=2616, nr_sectors = 120 limit=512 [ 233.187337][ T5979] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 233.236087][ T5776] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 233.414842][ T5979] usb 2-1: Using ep0 maxpacket: 32 [ 233.433043][ T5979] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 233.447213][ T5979] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 233.471694][ T5979] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 233.524510][ T5979] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 233.568814][ T5979] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 233.592464][ T8676] netlink: 'syz.2.1166': attribute type 1 has an invalid length. [ 233.608354][ T5979] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 233.629573][ T8676] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1166'. [ 233.656329][ T5979] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 233.696393][ T5979] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.743321][ T5979] usb 2-1: config 0 descriptor?? [ 233.991172][ T5979] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 17 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 234.041399][ T5979] usb 2-1: USB disconnect, device number 17 [ 234.065717][ T5979] usblp0: removed [ 234.078376][ T2927] kworker/u4:8: attempt to access beyond end of device [ 234.078376][ T2927] loop0: rw=1, sector=2736, nr_sectors = 2048 limit=512 [ 234.107865][ T2927] kworker/u4:8: attempt to access beyond end of device [ 234.107865][ T2927] loop0: rw=1, sector=4784, nr_sectors = 2048 limit=512 [ 234.165962][ T2927] kworker/u4:8: attempt to access beyond end of device [ 234.165962][ T2927] loop0: rw=1, sector=6832, nr_sectors = 2048 limit=512 [ 234.194023][ T2927] kworker/u4:8: attempt to access beyond end of device [ 234.194023][ T2927] loop0: rw=1, sector=8880, nr_sectors = 2048 limit=512 [ 234.214022][ T2927] kworker/u4:8: attempt to access beyond end of device [ 234.214022][ T2927] loop0: rw=1, sector=10928, nr_sectors = 2048 limit=512 [ 234.240310][ T8693] loop2: detected capacity change from 0 to 512 [ 234.243002][ T2927] kworker/u4:8: attempt to access beyond end of device [ 234.243002][ T2927] loop0: rw=1, sector=12976, nr_sectors = 2048 limit=512 [ 234.250488][ T8693] EXT4-fs: Ignoring removed nobh option [ 234.274596][ T2927] kworker/u4:8: attempt to access beyond end of device [ 234.274596][ T2927] loop0: rw=1, sector=15024, nr_sectors = 1440 limit=512 [ 234.310321][ T8693] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 234.334000][ T8693] ext4 filesystem being mounted at /275/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 234.354283][ T8694] loop3: detected capacity change from 0 to 164 [ 234.472804][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 234.664487][ T8701] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1172'. [ 235.302399][ T8723] loop3: detected capacity change from 0 to 512 [ 235.332507][ T8723] EXT4-fs: Ignoring removed nobh option [ 235.378218][ T8723] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 235.395824][ T8723] ext4 filesystem being mounted at /269/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 235.517980][ T5776] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 235.547519][ T8730] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1187'. [ 235.689694][ T5979] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 235.896015][ T5979] usb 3-1: Using ep0 maxpacket: 32 [ 235.918480][ T5979] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 235.937913][ T5979] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 235.976567][ T5979] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 236.006456][ T5979] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 236.042879][ T5979] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 236.087040][ T5979] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 236.143793][ T5979] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 236.186916][ T5979] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 236.219842][ T5979] usb 3-1: config 0 descriptor?? [ 236.234230][ T8755] loop1: detected capacity change from 0 to 512 [ 236.265186][ T8755] EXT4-fs: Ignoring removed nobh option [ 236.358339][ T8755] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 236.407742][ T8755] ext4 filesystem being mounted at /293/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 236.484651][ T5979] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 13 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 236.545542][ T5979] usb 3-1: USB disconnect, device number 13 [ 236.564809][ T5979] usblp0: removed [ 236.583764][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 237.283833][ T8787] loop1: detected capacity change from 0 to 512 [ 237.325722][ T8787] EXT4-fs: Ignoring removed nobh option [ 237.405004][ T8787] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 237.448460][ T8787] ext4 filesystem being mounted at /298/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 237.496444][ T8787] EXT4-fs error (device loop1): ext4_find_dest_de:2115: inode #2: block 3: comm syz.1.1210: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 237.524769][ T8787] EXT4-fs error (device loop1): ext4_find_dest_de:2115: inode #2: block 3: comm syz.1.1210: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 237.598427][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 237.933550][ T8810] netlink: 1936 bytes leftover after parsing attributes in process `syz.3.1218'. [ 238.230265][ T8819] loop1: detected capacity change from 0 to 512 [ 238.252105][ T8819] EXT4-fs: Ignoring removed nobh option [ 238.287472][ T8819] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 238.327168][ T8819] ext4 filesystem being mounted at /300/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 238.392866][ T8819] EXT4-fs error (device loop1): ext4_find_dest_de:2115: inode #2: block 3: comm syz.1.1223: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 238.463162][ T5979] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 238.494218][ T8831] EXT4-fs error (device loop1): ext4_find_dest_de:2115: inode #2: block 3: comm syz.1.1223: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 238.526599][ T8832] loop3: detected capacity change from 0 to 512 [ 238.581230][ T28] audit: type=1800 audit(1789383273.999:85): pid=8832 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1226" name="file1" dev="loop3" ino=1048605 res=0 errno=0 [ 238.662098][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 238.671388][ T5979] usb 3-1: Using ep0 maxpacket: 32 [ 238.700106][ T5979] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 238.719328][ T5979] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 238.750004][ T5979] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 238.793798][ T5979] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 238.838284][ T5979] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 238.882107][ T5979] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 238.936749][ T5979] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 238.971460][ T5979] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 239.009233][ T5979] usb 3-1: config 0 descriptor?? [ 239.262486][ T5979] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 14 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 239.306684][ T5979] usb 3-1: USB disconnect, device number 14 [ 239.339325][ T5979] usblp0: removed [ 239.423828][ T8849] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1234'. [ 239.453200][ T11] kworker/u4:0: attempt to access beyond end of device [ 239.453200][ T11] loop3: rw=1, sector=2384, nr_sectors = 2048 limit=512 [ 239.486902][ T11] kworker/u4:0: attempt to access beyond end of device [ 239.486902][ T11] loop3: rw=1, sector=4432, nr_sectors = 2048 limit=512 [ 239.510596][ T11] kworker/u4:0: attempt to access beyond end of device [ 239.510596][ T11] loop3: rw=1, sector=6480, nr_sectors = 2048 limit=512 [ 239.551344][ T11] kworker/u4:0: attempt to access beyond end of device [ 239.551344][ T11] loop3: rw=1, sector=8528, nr_sectors = 2048 limit=512 [ 239.574050][ T11] kworker/u4:0: attempt to access beyond end of device [ 239.574050][ T11] loop3: rw=1, sector=10576, nr_sectors = 2048 limit=512 [ 239.597463][ T11] kworker/u4:0: attempt to access beyond end of device [ 239.597463][ T11] loop3: rw=1, sector=12624, nr_sectors = 2048 limit=512 [ 239.624474][ T8853] loop0: detected capacity change from 0 to 512 [ 239.627000][ T11] kworker/u4:0: attempt to access beyond end of device [ 239.627000][ T11] loop3: rw=1, sector=14672, nr_sectors = 1792 limit=512 [ 239.655848][ T8853] EXT4-fs: Ignoring removed nobh option [ 239.712164][ T8853] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 239.758242][ T8853] ext4 filesystem being mounted at /363/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 239.834250][ T8853] EXT4-fs error (device loop0): ext4_find_dest_de:2115: inode #2: block 3: comm syz.0.1237: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 239.914533][ T8860] EXT4-fs error (device loop0): ext4_find_dest_de:2115: inode #2: block 3: comm syz.0.1237: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 240.019865][ T5778] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 240.396214][ T8872] loop2: detected capacity change from 0 to 512 [ 240.461285][ T8876] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1246'. [ 240.485495][ T28] audit: type=1800 audit(1789383275.762:86): pid=8872 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1244" name="file1" dev="loop2" ino=1048607 res=0 errno=0 [ 240.823833][ T8891] loop0: detected capacity change from 0 to 512 [ 240.839430][ T8891] EXT4-fs: Ignoring removed nobh option [ 240.910106][ T8891] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 240.937227][ T8891] ext4 filesystem being mounted at /367/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 240.993860][ T8891] EXT4-fs error (device loop0): ext4_find_dest_de:2115: inode #2: block 3: comm syz.0.1251: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 241.013275][ T5979] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 241.046843][ T8894] EXT4-fs error (device loop0): ext4_find_dest_de:2115: inode #2: block 3: comm syz.0.1251: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 241.086318][ T2990] kworker/u4:10: attempt to access beyond end of device [ 241.086318][ T2990] loop2: rw=1, sector=2384, nr_sectors = 2048 limit=512 [ 241.109113][ T2990] kworker/u4:10: attempt to access beyond end of device [ 241.109113][ T2990] loop2: rw=1, sector=4432, nr_sectors = 2048 limit=512 [ 241.131401][ T2990] kworker/u4:10: attempt to access beyond end of device [ 241.131401][ T2990] loop2: rw=1, sector=6480, nr_sectors = 2048 limit=512 [ 241.146607][ T5778] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 241.236410][ T5979] usb 4-1: Using ep0 maxpacket: 32 [ 241.243373][ T5979] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 241.257025][ T5979] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 241.280842][ T5979] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 241.301456][ T5979] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 241.329415][ T8896] ieee802154 phy0 wpan0: encryption failed: -22 [ 241.343186][ T5979] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 241.376627][ T5979] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 241.414695][ T5979] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 241.441443][ T5979] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.468353][ T5979] usb 4-1: config 0 descriptor?? [ 241.714521][ T5979] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 12 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 241.741817][ T5979] usb 4-1: USB disconnect, device number 12 [ 241.753674][ T5979] usblp0: removed [ 241.977710][ T8917] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1259'. [ 242.049612][ T8919] loop0: detected capacity change from 0 to 512 [ 242.077015][ T28] audit: type=1800 audit(1789383277.230:87): pid=8919 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1260" name="file1" dev="loop0" ino=1048609 res=0 errno=0 [ 242.562696][ T8924] loop3: detected capacity change from 0 to 512 [ 242.579992][ T8924] EXT4-fs: Ignoring removed nobh option [ 242.639959][ T8924] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 242.676346][ T8924] ext4 filesystem being mounted at /285/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 242.718513][ T8924] EXT4-fs error (device loop3): ext4_find_dest_de:2115: inode #2: block 3: comm syz.3.1262: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 242.777410][ T8932] EXT4-fs error (device loop3): ext4_find_dest_de:2115: inode #2: block 3: comm syz.3.1262: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 242.874086][ T5776] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 243.241883][ T8943] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1269'. [ 243.662009][ T5979] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 243.867597][ T5979] usb 4-1: Using ep0 maxpacket: 32 [ 243.874748][ T5979] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 243.883361][ T5979] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 243.892084][ T5979] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 243.911288][ T8881] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 243.920971][ T5979] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 243.955069][ T5979] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 243.988127][ T5979] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 244.038013][ T5979] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 244.073899][ T5979] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.115597][ T5979] usb 4-1: config 0 descriptor?? [ 244.161325][ T8948] loop1: detected capacity change from 0 to 512 [ 244.244180][ T28] audit: type=1800 audit(1789383279.233:88): pid=8948 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1271" name="file1" dev="loop1" ino=1048611 res=0 errno=0 [ 244.366426][ T5979] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 13 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 244.431121][ T5979] usb 4-1: USB disconnect, device number 13 [ 244.453388][ T5979] usblp0: removed [ 244.521985][ T8958] loop2: detected capacity change from 0 to 512 [ 244.541164][ T8958] EXT4-fs: Ignoring removed nobh option [ 244.600284][ T8958] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 244.614245][ T8958] ext4 filesystem being mounted at /291/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 244.645977][ T8958] EXT4-fs error (device loop2): ext4_find_dest_de:2115: inode #2: block 3: comm syz.2.1275: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 244.670547][ T8958] EXT4-fs error (device loop2): ext4_find_dest_de:2115: inode #2: block 3: comm syz.2.1275: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 244.762865][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 244.904027][ T8970] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1279'. [ 245.546673][ T5979] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 245.763231][ T5979] usb 3-1: Using ep0 maxpacket: 32 [ 245.771052][ T5979] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 245.779825][ T5979] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 245.788631][ T5979] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 245.797848][ T5979] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 245.807708][ T5979] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 245.817640][ T5979] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 245.830994][ T5979] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 245.845279][ T5979] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 245.857381][ T5979] usb 3-1: config 0 descriptor?? [ 246.087000][ T5979] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 15 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 246.102007][ T5979] usb 3-1: USB disconnect, device number 15 [ 246.120942][ T5979] usblp0: removed [ 246.495000][ T8991] loop3: detected capacity change from 0 to 512 [ 246.532324][ T28] audit: type=1800 audit(1789383281.338:89): pid=8991 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1286" name="file1" dev="loop3" ino=1048613 res=0 errno=0 [ 246.932710][ T9002] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1290'. [ 247.688471][ T8953] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 247.890484][ T9014] loop0: detected capacity change from 0 to 512 [ 247.949273][ T28] audit: type=1800 audit(1789383282.649:90): pid=9014 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1297" name="file1" dev="loop0" ino=1048615 res=0 errno=0 [ 248.471625][ T5979] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 248.507551][ T9030] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1303'. [ 248.698807][ T5979] usb 4-1: Using ep0 maxpacket: 32 [ 248.725635][ T5979] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 248.753591][ T5979] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 248.762252][ T5979] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 248.825813][ T5979] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 248.861381][ T5979] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 248.918351][ T5979] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 248.948072][ T9040] loop2: detected capacity change from 0 to 512 [ 248.958790][ T5979] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 248.980290][ T5979] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 249.009941][ T9040] EXT4-fs error (device loop2): ext4_iget_extra_inode:4740: inode #15: comm syz.2.1308: corrupted in-inode xattr: invalid ea_ino [ 249.038441][ T5979] usb 4-1: config 0 descriptor?? [ 249.080128][ T9040] EXT4-fs error (device loop2): ext4_orphan_get:1413: comm syz.2.1308: couldn't read orphan inode 15 (err -117) [ 249.126691][ T9040] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 249.283469][ T5979] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 14 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 249.296886][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 249.328011][ T5979] usb 4-1: USB disconnect, device number 14 [ 249.378438][ T5979] usblp0: removed [ 249.438617][ T9045] loop2: detected capacity change from 0 to 512 [ 249.513195][ T28] audit: type=1800 audit(1789383284.098:91): pid=9045 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1310" name="file1" dev="loop2" ino=1048617 res=0 errno=0 [ 249.709734][ T9053] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1314'. [ 250.014784][ T9067] FAULT_INJECTION: forcing a failure. [ 250.014784][ T9067] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 250.028410][ T9067] CPU: 0 PID: 9067 Comm: syz.2.1319 Not tainted syzkaller #0 [ 250.035800][ T9067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 250.045896][ T9067] Call Trace: [ 250.049266][ T9067] [ 250.052286][ T9067] dump_stack_lvl+0x18c/0x250 [ 250.057132][ T9067] ? show_regs_print_info+0x20/0x20 [ 250.062401][ T9067] ? load_image+0x420/0x420 [ 250.066934][ T9067] ? shmem_get_folio_gfp+0x14ae/0x2b40 [ 250.072452][ T9067] ? __lock_acquire+0x7d80/0x7d80 [ 250.077524][ T9067] ? __rwlock_init+0x150/0x150 [ 250.082329][ T9067] should_fail_ex+0x394/0x4c0 [ 250.087057][ T9067] copy_page_from_iter_atomic+0x29e/0x13d0 [ 250.092910][ T9067] ? shmem_get_folio_gfp+0x2780/0x2b40 [ 250.098413][ T9067] ? iov_iter_zero+0x1160/0x1160 [ 250.103382][ T9067] ? shmem_write_begin+0x1cf/0x430 [ 250.108512][ T9067] generic_perform_write+0x353/0x5c0 [ 250.113857][ T9067] ? generic_file_direct_write+0x3e0/0x3e0 [ 250.119710][ T9067] ? file_update_time+0x192/0x1a0 [ 250.124783][ T9067] shmem_file_write_iter+0xfb/0x120 [ 250.130012][ T9067] vfs_write+0x474/0x9a0 [ 250.134322][ T9067] ? file_end_write+0x250/0x250 [ 250.139225][ T9067] ? __fget_files+0x3fc/0x460 [ 250.143970][ T9067] ? __fdget+0x180/0x210 [ 250.148239][ T9067] ? __x64_sys_pwrite64+0xf7/0x220 [ 250.153449][ T9067] __x64_sys_pwrite64+0x198/0x220 [ 250.158520][ T9067] ? ksys_pwrite64+0x1c0/0x1c0 [ 250.163314][ T9067] ? lockdep_hardirqs_on+0x98/0x150 [ 250.168568][ T9067] do_syscall_64+0x55/0xb0 [ 250.173007][ T9067] ? clear_bhb_loop+0x40/0x90 [ 250.177786][ T9067] ? clear_bhb_loop+0x40/0x90 [ 250.182511][ T9067] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 250.188426][ T9067] RIP: 0033:0x7fb995f9e159 [ 250.192910][ T9067] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 250.212592][ T9067] RSP: 002b:00007fb996e30028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 250.221034][ T9067] RAX: ffffffffffffffda RBX: 00007fb996225fa0 RCX: 00007fb995f9e159 [ 250.229039][ T9067] RDX: 0000000000000001 RSI: 0000200000000140 RDI: 0000000000000003 [ 250.237024][ T9067] RBP: 00007fb99603503b R08: 0000000000000000 R09: 0000000000000000 [ 250.245013][ T9067] R10: 0000000000000e7c R11: 0000000000000246 R12: 0000000000000000 [ 250.253007][ T9067] R13: 00007fb996226038 R14: 00007fb996225fa0 R15: 00007ffcf6cef988 [ 250.261019][ T9067] [ 250.510475][ T9075] loop2: detected capacity change from 0 to 512 [ 250.524793][ T9075] EXT4-fs: Ignoring removed nobh option [ 250.574517][ T9075] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 250.615771][ T9075] ext4 filesystem being mounted at /308/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 250.696141][ T9082] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1325'. [ 250.716340][ T9075] EXT4-fs error (device loop2): ext4_find_dest_de:2115: inode #2: block 3: comm syz.2.1323: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 250.737340][ T9081] loop1: detected capacity change from 0 to 512 [ 250.782123][ T9083] EXT4-fs error (device loop2): ext4_find_dest_de:2115: inode #2: block 3: comm syz.2.1323: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 250.817954][ T28] audit: type=1800 audit(1789383285.298:92): pid=9081 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1324" name="file1" dev="loop1" ino=1048619 res=0 errno=0 [ 250.963951][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 251.461647][ T5884] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 251.599530][ T9110] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1336'. [ 251.680074][ T9112] loop0: detected capacity change from 0 to 512 [ 251.697004][ T9112] EXT4-fs: Ignoring removed nobh option [ 251.704127][ T5884] usb 3-1: Using ep0 maxpacket: 32 [ 251.715924][ T5884] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 251.732813][ T5884] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 251.744109][ T9114] loop1: detected capacity change from 0 to 512 [ 251.756132][ T5884] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 251.769130][ T28] audit: type=1800 audit(1789383286.184:93): pid=9114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1338" name="file1" dev="loop1" ino=1048621 res=0 errno=0 [ 251.778304][ T5884] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 251.817157][ T5884] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 251.817714][ T9112] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 251.841008][ T5884] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 251.854224][ T5884] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 251.863934][ T9112] ext4 filesystem being mounted at /395/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 251.876296][ T5884] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 251.926509][ T9112] EXT4-fs error (device loop0): ext4_find_dest_de:2115: inode #2: block 3: comm syz.0.1337: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 251.949716][ T5884] usb 3-1: config 0 descriptor?? [ 251.984294][ T9117] EXT4-fs error (device loop0): ext4_find_dest_de:2115: inode #2: block 3: comm syz.0.1337: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 252.033543][ T9119] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1339'. [ 252.055331][ T9119] tipc: Enabling of bearer rejected, media not registered [ 252.094552][ T5778] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 252.179567][ T5884] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 16 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 252.245107][ T5884] usb 3-1: USB disconnect, device number 16 [ 252.284149][ T5884] usblp0: removed [ 252.691238][ T9139] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1347'. [ 252.755183][ T9141] loop0: detected capacity change from 0 to 512 [ 252.833159][ T28] audit: type=1800 audit(1789383287.163:94): pid=9141 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1348" name="file1" dev="loop0" ino=1048623 res=0 errno=0 [ 252.910824][ T9143] loop3: detected capacity change from 0 to 512 [ 252.933304][ T9143] EXT4-fs: Ignoring removed nobh option [ 253.024319][ T9143] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 253.069957][ T9143] ext4 filesystem being mounted at /307/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 253.161281][ T9143] EXT4-fs error (device loop3): ext4_find_dest_de:2115: inode #2: block 3: comm syz.3.1349: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 253.227309][ T9152] EXT4-fs error (device loop3): ext4_find_dest_de:2115: inode #2: block 3: comm syz.3.1349: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 253.351189][ T5776] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 253.763191][ T2907] bio_check_eod: 11 callbacks suppressed [ 253.763208][ T2907] kworker/u4:7: attempt to access beyond end of device [ 253.763208][ T2907] loop0: rw=1, sector=2384, nr_sectors = 2048 limit=512 [ 253.793689][ T9167] loop3: detected capacity change from 0 to 512 [ 253.799682][ T2907] kworker/u4:7: attempt to access beyond end of device [ 253.799682][ T2907] loop0: rw=1, sector=4432, nr_sectors = 2048 limit=512 [ 253.863820][ T2907] kworker/u4:7: attempt to access beyond end of device [ 253.863820][ T2907] loop0: rw=1, sector=6480, nr_sectors = 2048 limit=512 [ 253.879260][ T9167] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 253.909519][ T9167] ext4 filesystem being mounted at /309/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 253.931993][ T2907] kworker/u4:7: attempt to access beyond end of device [ 253.931993][ T2907] loop0: rw=1, sector=8528, nr_sectors = 2048 limit=512 [ 253.978614][ T9167] EXT4-fs error (device loop3): ext4_do_update_inode:5256: inode #2: comm syz.3.1356: corrupted inode contents [ 253.993432][ T2907] kworker/u4:7: attempt to access beyond end of device [ 253.993432][ T2907] loop0: rw=1, sector=10576, nr_sectors = 2056 limit=512 [ 254.022956][ T2907] kworker/u4:7: attempt to access beyond end of device [ 254.022956][ T2907] loop0: rw=1, sector=12632, nr_sectors = 2048 limit=512 [ 254.040012][ T9167] EXT4-fs error (device loop3): ext4_dirty_inode:6144: inode #2: comm syz.3.1356: mark_inode_dirty error [ 254.076752][ T9167] EXT4-fs error (device loop3): ext4_do_update_inode:5256: inode #2: comm syz.3.1356: corrupted inode contents [ 254.077779][ T2907] kworker/u4:7: attempt to access beyond end of device [ 254.077779][ T2907] loop0: rw=1, sector=14680, nr_sectors = 1784 limit=512 [ 254.111257][ T9167] EXT4-fs error (device loop3): __ext4_ext_dirty:208: inode #2: comm syz.3.1356: mark_inode_dirty error [ 254.157039][ T9172] EXT4-fs error (device loop3): ext4_do_update_inode:5256: inode #2: comm syz.3.1356: corrupted inode contents [ 254.201089][ T9172] EXT4-fs error (device loop3): ext4_append:88: inode #2: comm syz.3.1356: mark_inode_dirty error [ 254.228994][ T9172] EXT4-fs error (device loop3) in ext4_append:100: Corrupt filesystem [ 254.301035][ T5776] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 254.386050][ T5979] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 254.435183][ T9179] loop2: detected capacity change from 0 to 512 [ 254.466142][ T9179] EXT4-fs: Ignoring removed nobh option [ 254.524702][ T9184] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1358'. [ 254.534891][ T9179] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 254.567074][ T9179] ext4 filesystem being mounted at /316/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 254.613672][ T5979] usb 2-1: Using ep0 maxpacket: 32 [ 254.624040][ T5979] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 254.632783][ T5979] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 254.655655][ T9179] EXT4-fs error (device loop2): ext4_find_dest_de:2115: inode #2: block 3: comm syz.2.1362: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 254.686175][ T5979] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 254.711008][ T5979] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 254.738345][ T9190] EXT4-fs error (device loop2): ext4_find_dest_de:2115: inode #2: block 3: comm syz.2.1362: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 254.765248][ T5979] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 254.781608][ T5979] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 254.808109][ T5979] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 254.837918][ T5979] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 254.882953][ T5979] usb 2-1: config 0 descriptor?? [ 254.899126][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 255.122918][ T5979] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 18 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 255.157578][ T9203] loop3: detected capacity change from 0 to 512 [ 255.193565][ T5979] usb 2-1: USB disconnect, device number 18 [ 255.235407][ T5979] usblp0: removed [ 255.241381][ T28] audit: type=1800 audit(1789383289.378:95): pid=9203 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1367" name="file1" dev="loop3" ino=1048625 res=0 errno=0 [ 255.459504][ T9210] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.782283][ T9216] EXT4-fs warning (device sda1): ext4_dirblock_csum_verify:406: inode #1262: comm syz.0.1372: No space for directory leaf checksum. Please run e2fsck -D. [ 255.799071][ T9216] EXT4-fs error (device sda1): ext4_empty_dir:3139: inode #1262: comm syz.0.1372: Directory block failed checksum [ 255.881397][ T2907] kworker/u4:7: attempt to access beyond end of device [ 255.881397][ T2907] loop3: rw=1, sector=2384, nr_sectors = 2056 limit=512 [ 255.906517][ T2907] kworker/u4:7: attempt to access beyond end of device [ 255.906517][ T2907] loop3: rw=1, sector=4440, nr_sectors = 2048 limit=512 [ 255.929666][ T2907] kworker/u4:7: attempt to access beyond end of device [ 255.929666][ T2907] loop3: rw=1, sector=6488, nr_sectors = 2048 limit=512 [ 256.074033][ T9222] loop1: detected capacity change from 0 to 512 [ 256.089996][ T9222] EXT4-fs: Ignoring removed nobh option [ 256.145888][ T9222] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 256.188432][ T9222] ext4 filesystem being mounted at /332/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 256.305103][ T9222] EXT4-fs error (device loop1): ext4_find_dest_de:2115: inode #2: block 3: comm syz.1.1375: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 256.396132][ T9231] EXT4-fs error (device loop1): ext4_find_dest_de:2115: inode #2: block 3: comm syz.1.1375: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 256.555062][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 256.946374][ T9250] loop3: detected capacity change from 0 to 512 [ 256.991582][ T28] audit: type=1800 audit(1789383291.003:96): pid=9250 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1384" name="file1" dev="loop3" ino=1048627 res=0 errno=0 [ 257.210263][ T9260] loop2: detected capacity change from 0 to 512 [ 257.217230][ T5879] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 257.244006][ T9260] EXT4-fs: Ignoring removed nobh option [ 257.316380][ T9260] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 257.354015][ T9260] ext4 filesystem being mounted at /323/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 257.412173][ T9260] EXT4-fs error (device loop2): ext4_find_dest_de:2115: inode #2: block 3: comm syz.2.1389: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 257.440694][ T5879] usb 2-1: Using ep0 maxpacket: 32 [ 257.453679][ T5879] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 257.465931][ T5879] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 257.486915][ T5879] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 257.499712][ T9268] EXT4-fs error (device loop2): ext4_find_dest_de:2115: inode #2: block 3: comm syz.2.1389: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 257.525006][ T5879] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 257.546836][ T5879] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 257.591428][ T5879] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 257.637431][ T5879] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 257.665869][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 257.677621][ T5879] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.703054][ T5879] usb 2-1: config 0 descriptor?? [ 257.839711][ T9272] ip_tables: iptables: counters copy to user failed while replacing table [ 257.940285][ T5879] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 19 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 258.004195][ T5879] usb 2-1: USB disconnect, device number 19 [ 258.043411][ T5879] usblp0: removed [ 258.463769][ T9291] loop2: detected capacity change from 0 to 512 [ 258.479362][ T9291] EXT4-fs: Ignoring removed nobh option [ 258.540952][ T9291] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 258.578209][ T9291] ext4 filesystem being mounted at /327/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 258.642565][ T9291] EXT4-fs error (device loop2): ext4_find_dest_de:2115: inode #2: block 3: comm syz.2.1400: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 258.717751][ T9301] EXT4-fs error (device loop2): ext4_find_dest_de:2115: inode #2: block 3: comm syz.2.1400: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 258.757446][ T9300] loop0: detected capacity change from 0 to 512 [ 258.874807][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 259.590734][ T9329] loop1: detected capacity change from 0 to 512 [ 259.611265][ T9329] EXT4-fs: Ignoring removed nobh option [ 259.670690][ T9329] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 259.705132][ T9329] ext4 filesystem being mounted at /338/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 259.733195][ T2990] bio_check_eod: 11 callbacks suppressed [ 259.733210][ T2990] kworker/u4:10: attempt to access beyond end of device [ 259.733210][ T2990] loop0: rw=1, sector=2384, nr_sectors = 2048 limit=512 [ 259.759234][ T5879] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 259.767482][ T9329] EXT4-fs error (device loop1): ext4_find_dest_de:2115: inode #2: block 3: comm syz.1.1414: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 259.794532][ T2990] kworker/u4:10: attempt to access beyond end of device [ 259.794532][ T2990] loop0: rw=1, sector=4432, nr_sectors = 2048 limit=512 [ 259.821895][ T9336] EXT4-fs error (device loop1): ext4_find_dest_de:2115: inode #2: block 3: comm syz.1.1414: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 259.844283][ T2990] kworker/u4:10: attempt to access beyond end of device [ 259.844283][ T2990] loop0: rw=1, sector=6480, nr_sectors = 2048 limit=512 [ 259.867780][ T2990] kworker/u4:10: attempt to access beyond end of device [ 259.867780][ T2990] loop0: rw=1, sector=8528, nr_sectors = 2048 limit=512 [ 259.891729][ T2990] kworker/u4:10: attempt to access beyond end of device [ 259.891729][ T2990] loop0: rw=1, sector=10576, nr_sectors = 2048 limit=512 [ 259.914773][ T2990] kworker/u4:10: attempt to access beyond end of device [ 259.914773][ T2990] loop0: rw=1, sector=12624, nr_sectors = 2048 limit=512 [ 259.935555][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 259.946567][ T2990] kworker/u4:10: attempt to access beyond end of device [ 259.946567][ T2990] loop0: rw=1, sector=14672, nr_sectors = 1792 limit=512 [ 259.997672][ T5879] usb 3-1: Using ep0 maxpacket: 32 [ 260.010820][ T5879] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 260.041846][ T5879] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 260.050533][ T5879] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 260.108424][ T5879] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 260.149203][ T5879] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 260.182638][ T5879] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 260.239679][ T5879] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 260.281361][ T5879] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 260.321781][ T5879] usb 3-1: config 0 descriptor?? [ 260.566794][ T5879] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 17 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 260.616920][ T5879] usb 3-1: USB disconnect, device number 17 [ 260.667018][ T5879] usblp0: removed [ 260.738722][ T9358] loop1: detected capacity change from 0 to 512 [ 260.890843][ T9361] loop3: detected capacity change from 0 to 512 [ 260.908682][ T9361] EXT4-fs: Ignoring removed nobh option [ 260.964627][ T9361] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 261.010442][ T9361] ext4 filesystem being mounted at /327/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 261.085612][ T9361] EXT4-fs error (device loop3): ext4_find_dest_de:2115: inode #2: block 3: comm syz.3.1426: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 261.141356][ T9371] EXT4-fs error (device loop3): ext4_find_dest_de:2115: inode #2: block 3: comm syz.3.1426: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 261.243842][ T5776] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 261.531875][ T9379] loop2: detected capacity change from 0 to 1024 [ 261.564476][ T9379] EXT4-fs: Ignoring removed oldalloc option [ 261.580276][ T9379] EXT4-fs: Ignoring removed oldalloc option [ 261.605620][ T9379] EXT4-fs: Mount option(s) incompatible with ext2 [ 261.707153][ T59] kworker/u4:4: attempt to access beyond end of device [ 261.707153][ T59] loop1: rw=1, sector=2384, nr_sectors = 2048 limit=512 [ 261.771620][ T59] kworker/u4:4: attempt to access beyond end of device [ 261.771620][ T59] loop1: rw=1, sector=4432, nr_sectors = 2048 limit=512 [ 261.792209][ T59] kworker/u4:4: attempt to access beyond end of device [ 261.792209][ T59] loop1: rw=1, sector=6480, nr_sectors = 2048 limit=512 [ 261.986973][ T9394] loop0: detected capacity change from 0 to 512 [ 262.002574][ T9394] EXT4-fs: Ignoring removed nobh option [ 262.068111][ T9394] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 262.142495][ T9394] ext4 filesystem being mounted at /428/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 262.220018][ T9394] EXT4-fs error (device loop0): ext4_find_dest_de:2115: inode #2: block 3: comm syz.0.1437: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 262.298173][ T9402] EXT4-fs error (device loop0): ext4_find_dest_de:2115: inode #2: block 3: comm syz.0.1437: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 262.428638][ T5778] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 262.543682][ T5884] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 262.622687][ T9414] loop1: detected capacity change from 0 to 512 [ 262.749009][ T5884] usb 3-1: Using ep0 maxpacket: 32 [ 262.775735][ T5884] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 262.795410][ T5884] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 262.839022][ T5884] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 262.872828][ T5884] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 262.914644][ T5884] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 262.954186][ T5884] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 263.008817][ T5884] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 263.055433][ T5884] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 263.091154][ T5884] usb 3-1: config 0 descriptor?? [ 263.333776][ T5884] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 18 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 263.388485][ T5884] usb 3-1: USB disconnect, device number 18 [ 263.420881][ T5884] usblp0: removed [ 263.820631][ T9444] loop3: detected capacity change from 0 to 512 [ 263.842024][ T9444] EXT4-fs: Ignoring removed nobh option [ 263.935246][ T9444] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 263.973306][ T9444] ext4 filesystem being mounted at /339/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 264.031938][ T9444] EXT4-fs error (device loop3): ext4_find_dest_de:2115: inode #2: block 3: comm syz.3.1456: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 264.102256][ T9455] EXT4-fs error (device loop3): ext4_find_dest_de:2115: inode #2: block 3: comm syz.3.1456: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 264.271210][ T5776] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 264.302606][ T9459] loop0: detected capacity change from 0 to 512 [ 264.354095][ T28] audit: type=1800 audit(1789383297.797:97): pid=9459 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1461" name="file1" dev="loop0" ino=1048634 res=0 errno=0 [ 264.832941][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 264.846133][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 265.055589][ T9483] loop2: detected capacity change from 0 to 512 [ 265.087965][ T9483] EXT4-fs: Ignoring removed nobh option [ 265.145041][ T9483] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 265.181500][ T9483] ext4 filesystem being mounted at /337/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 265.209861][ T5879] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 265.233018][ T9483] EXT4-fs error (device loop2): ext4_find_dest_de:2115: inode #2: block 3: comm syz.2.1471: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 265.267342][ T9483] EXT4-fs error (device loop2): ext4_find_dest_de:2115: inode #2: block 3: comm syz.2.1471: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 265.304856][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 265.357050][ T2990] bio_check_eod: 11 callbacks suppressed [ 265.357065][ T2990] kworker/u4:10: attempt to access beyond end of device [ 265.357065][ T2990] loop0: rw=1, sector=2384, nr_sectors = 2048 limit=512 [ 265.394992][ T2990] kworker/u4:10: attempt to access beyond end of device [ 265.394992][ T2990] loop0: rw=1, sector=4432, nr_sectors = 2048 limit=512 [ 265.418761][ T2990] kworker/u4:10: attempt to access beyond end of device [ 265.418761][ T2990] loop0: rw=1, sector=6480, nr_sectors = 2048 limit=512 [ 265.435315][ T5879] usb 4-1: Using ep0 maxpacket: 32 [ 265.444632][ T2990] kworker/u4:10: attempt to access beyond end of device [ 265.444632][ T2990] loop0: rw=1, sector=8528, nr_sectors = 2048 limit=512 [ 265.459872][ T5879] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 265.472289][ T2990] kworker/u4:10: attempt to access beyond end of device [ 265.472289][ T2990] loop0: rw=1, sector=10576, nr_sectors = 2048 limit=512 [ 265.486240][ T5879] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 265.486265][ T5879] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 265.486313][ T5879] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 265.529120][ T2990] kworker/u4:10: attempt to access beyond end of device [ 265.529120][ T2990] loop0: rw=1, sector=12624, nr_sectors = 2048 limit=512 [ 265.552091][ T2990] kworker/u4:10: attempt to access beyond end of device [ 265.552091][ T2990] loop0: rw=1, sector=14672, nr_sectors = 1792 limit=512 [ 265.565256][ T5879] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 265.579075][ T5879] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 265.630222][ T5879] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 265.672034][ T5879] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.711382][ T5879] usb 4-1: config 0 descriptor?? [ 265.965353][ T5879] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 15 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 266.019789][ T5879] usb 4-1: USB disconnect, device number 15 [ 266.058261][ T5879] usblp0: removed [ 266.242108][ T9510] loop0: detected capacity change from 0 to 512 [ 266.264393][ T9510] EXT4-fs: Ignoring removed nobh option [ 266.330057][ T9510] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 266.354081][ T9510] ext4 filesystem being mounted at /439/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 266.443105][ T5778] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 266.559172][ T9521] loop1: detected capacity change from 0 to 512 [ 266.623007][ T28] audit: type=1800 audit(1789383299.893:98): pid=9521 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1487" name="file1" dev="loop1" ino=1048635 res=0 errno=0 [ 267.163265][ T9544] loop0: detected capacity change from 0 to 512 [ 267.198404][ T9544] EXT4-fs: Ignoring removed nobh option [ 267.263832][ T9544] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 267.339211][ T9544] ext4 filesystem being mounted at /443/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 267.481148][ T5778] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 267.653836][ T2907] kworker/u4:7: attempt to access beyond end of device [ 267.653836][ T2907] loop1: rw=1, sector=2384, nr_sectors = 2048 limit=512 [ 267.679516][ T2907] kworker/u4:7: attempt to access beyond end of device [ 267.679516][ T2907] loop1: rw=1, sector=4432, nr_sectors = 2048 limit=512 [ 267.708053][ T2907] kworker/u4:7: attempt to access beyond end of device [ 267.708053][ T2907] loop1: rw=1, sector=6480, nr_sectors = 2048 limit=512 [ 267.981382][ T5979] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 268.080342][ T9571] loop3: detected capacity change from 0 to 512 [ 268.101566][ T9571] EXT4-fs: Ignoring removed nobh option [ 268.184800][ T9571] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 268.197611][ T5979] usb 1-1: Using ep0 maxpacket: 32 [ 268.205252][ T9571] ext4 filesystem being mounted at /349/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 268.227278][ T5979] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 268.236084][ T5979] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 268.260285][ T5979] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 268.302199][ T5979] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 268.346643][ T5979] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 268.393324][ T5979] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 268.420632][ T5776] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 268.444075][ T5979] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 268.476147][ T5979] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 268.509241][ T5979] usb 1-1: config 0 descriptor?? [ 268.595825][ T9584] loop2: detected capacity change from 0 to 512 [ 268.645833][ T28] audit: type=1800 audit(1789383301.748:99): pid=9584 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1513" name="file1" dev="loop2" ino=1048636 res=0 errno=0 [ 268.718794][ T9588] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1514'. [ 268.772437][ T5979] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 14 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 268.833764][ T5979] usb 1-1: USB disconnect, device number 14 [ 268.878930][ T5979] usblp0: removed [ 269.420973][ T9608] loop1: detected capacity change from 0 to 512 [ 269.448341][ T9608] EXT4-fs: Ignoring removed nobh option [ 269.511675][ T9608] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 269.572582][ T9608] ext4 filesystem being mounted at /365/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 269.715383][ T9614] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1525'. [ 269.749453][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 270.395796][ T9637] loop0: detected capacity change from 0 to 512 [ 270.471570][ T28] audit: type=1800 audit(1789383303.438:100): pid=9637 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1534" name="file1" dev="loop0" ino=1048638 res=0 errno=0 [ 270.596507][ T9644] sg_write: data in/out 461547/217 bytes for SCSI command 0x0-- guessing data in; [ 270.596507][ T9644] program syz.3.1537 not setting count and/or reply_len properly [ 270.722618][ T5979] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 270.737440][ T9648] loop1: detected capacity change from 0 to 512 [ 270.759922][ T9648] EXT4-fs: Ignoring removed nobh option [ 270.824255][ T9648] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 270.867180][ T9648] ext4 filesystem being mounted at /369/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 270.938370][ T5979] usb 3-1: Using ep0 maxpacket: 32 [ 270.962243][ T5979] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 270.991708][ T5979] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 271.019223][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 271.030711][ T5979] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 271.069005][ T5979] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 271.098714][ T5979] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 271.126034][ T5979] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 271.169379][ T5979] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 271.195203][ T9642] bio_check_eod: 11 callbacks suppressed [ 271.195214][ T9642] syz.0.1534: attempt to access beyond end of device [ 271.195214][ T9642] loop0: rw=2049, sector=1992, nr_sectors = 2048 limit=512 [ 271.215606][ T5979] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.227342][ T9657] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1541'. [ 271.249054][ T5979] usb 3-1: config 0 descriptor?? [ 271.291216][ T9642] syz.0.1534: attempt to access beyond end of device [ 271.291216][ T9642] loop0: rw=2049, sector=4040, nr_sectors = 368 limit=512 [ 271.461068][ T2907] kworker/u4:7: attempt to access beyond end of device [ 271.461068][ T2907] loop0: rw=1, sector=4408, nr_sectors = 2048 limit=512 [ 271.483745][ T2907] kworker/u4:7: attempt to access beyond end of device [ 271.483745][ T2907] loop0: rw=1, sector=6456, nr_sectors = 2048 limit=512 [ 271.503955][ T5979] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 19 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 271.532106][ T2907] kworker/u4:7: attempt to access beyond end of device [ 271.532106][ T2907] loop0: rw=1, sector=8504, nr_sectors = 2048 limit=512 [ 271.548622][ T5979] usb 3-1: USB disconnect, device number 19 [ 271.562321][ T2907] kworker/u4:7: attempt to access beyond end of device [ 271.562321][ T2907] loop0: rw=1, sector=10552, nr_sectors = 2048 limit=512 [ 271.596358][ T5979] usblp0: removed [ 271.607530][ T2907] kworker/u4:7: attempt to access beyond end of device [ 271.607530][ T2907] loop0: rw=1, sector=12600, nr_sectors = 2048 limit=512 [ 271.640139][ T2907] kworker/u4:7: attempt to access beyond end of device [ 271.640139][ T2907] loop0: rw=1, sector=14648, nr_sectors = 1816 limit=512 [ 272.101106][ T9676] loop1: detected capacity change from 0 to 512 [ 272.124022][ T9676] EXT4-fs: Ignoring removed nobh option [ 272.143040][ T9679] sg_write: data in/out 461547/217 bytes for SCSI command 0x0-- guessing data in; [ 272.143040][ T9679] program syz.0.1550 not setting count and/or reply_len properly [ 272.192358][ T9676] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 272.216259][ T9676] ext4 filesystem being mounted at /374/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 272.381363][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 272.428020][ T9687] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1554'. [ 272.826660][ T9701] loop3: detected capacity change from 0 to 512 [ 272.860438][ T9703] sg_write: data in/out 461547/217 bytes for SCSI command 0x0-- guessing data in; [ 272.860438][ T9703] program syz.2.1562 not setting count and/or reply_len properly [ 272.913730][ T28] audit: type=1800 audit(1789383305.699:101): pid=9701 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1563" name="file1" dev="loop3" ino=1048640 res=0 errno=0 [ 273.037679][ T9706] syz.3.1563: attempt to access beyond end of device [ 273.037679][ T9706] loop3: rw=2049, sector=2384, nr_sectors = 400 limit=512 [ 273.273271][ T9712] loop2: detected capacity change from 0 to 512 [ 273.295936][ T9712] EXT4-fs: Ignoring removed nobh option [ 273.355176][ T5979] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 273.368903][ T9712] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 273.402120][ T9712] ext4 filesystem being mounted at /362/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 273.519000][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 273.603269][ T5979] usb 2-1: Using ep0 maxpacket: 32 [ 273.618809][ T5979] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 273.645516][ T5979] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 273.683689][ T5979] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 273.711547][ T5979] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 273.743102][ T5979] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 273.787759][ T5979] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 273.826887][ T59] kworker/u4:4: attempt to access beyond end of device [ 273.826887][ T59] loop3: rw=1, sector=2784, nr_sectors = 2048 limit=512 [ 273.832778][ T5979] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 273.893388][ T5979] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 273.919280][ T5979] usb 2-1: config 0 descriptor?? [ 274.176274][ T5979] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 20 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 274.211797][ T9732] sg_write: data in/out 461547/217 bytes for SCSI command 0x0-- guessing data in; [ 274.211797][ T9732] program syz.2.1578 not setting count and/or reply_len properly [ 274.247424][ T5979] usb 2-1: USB disconnect, device number 20 [ 274.275583][ T5979] usblp0: removed [ 274.335579][ T9734] loop0: detected capacity change from 0 to 512 [ 274.373291][ T9734] EXT4-fs: Ignoring removed nobh option [ 274.422051][ T9736] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1574'. [ 274.439234][ T9734] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 274.473810][ T9734] ext4 filesystem being mounted at /461/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 274.616989][ T5778] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 275.153425][ T9761] sg_write: data in/out 461547/217 bytes for SCSI command 0x0-- guessing data in; [ 275.153425][ T9761] program syz.0.1589 not setting count and/or reply_len properly [ 275.202921][ T9765] loop2: detected capacity change from 0 to 512 [ 275.230593][ T9765] EXT4-fs: Ignoring removed nobh option [ 275.349965][ T9765] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 275.402799][ T9765] ext4 filesystem being mounted at /372/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 275.559895][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 275.685239][ T9779] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1599'. [ 275.867537][ T5979] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 276.086174][ T5979] usb 2-1: Using ep0 maxpacket: 32 [ 276.106564][ T5979] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 276.120833][ T5979] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 276.149229][ T5979] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 276.180667][ T5979] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 276.209634][ T5979] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 276.241462][ T9799] sg_write: data in/out 461547/217 bytes for SCSI command 0x0-- guessing data in; [ 276.241462][ T9799] program syz.0.1606 not setting count and/or reply_len properly [ 276.263879][ T5979] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 276.289848][ T5979] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 276.315036][ T5979] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.348149][ T5979] usb 2-1: config 0 descriptor?? [ 276.423200][ T9803] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1610'. [ 276.585754][ T5979] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 21 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 276.615053][ T5979] usb 2-1: USB disconnect, device number 21 [ 276.657620][ T5979] usblp0: removed [ 276.934844][ T9817] loop0: detected capacity change from 0 to 512 [ 276.969108][ T9819] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1618'. [ 276.999100][ T9817] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 277.118148][ T9817] loop0: detected capacity change from 512 to 64 [ 277.157534][ T9817] Quota error (device loop0): qtree_write_dquot: dquota write failed [ 277.194085][ T9817] EXT4-fs error (device loop0): ext4_write_dquot:6933: comm syz.0.1617: Failed to commit dquot type 0 [ 277.232611][ T9817] Quota error (device loop0): qtree_write_dquot: dquota write failed [ 277.254332][ T9817] EXT4-fs error (device loop0): ext4_write_dquot:6933: comm syz.0.1617: Failed to commit dquot type 1 [ 277.293305][ T9817] Quota error (device loop0): qtree_write_dquot: dquota write failed [ 277.325931][ T9817] EXT4-fs error (device loop0): ext4_write_dquot:6933: comm syz.0.1617: Failed to commit dquot type 0 [ 277.362325][ T9817] Quota error (device loop0): qtree_write_dquot: dquota write failed [ 277.411408][ T9817] EXT4-fs error (device loop0): ext4_write_dquot:6933: comm syz.0.1617: Failed to commit dquot type 1 [ 277.464782][ T9817] Quota error (device loop0): qtree_write_dquot: dquota write failed [ 277.503209][ T9817] EXT4-fs error (device loop0): ext4_write_dquot:6933: comm syz.0.1617: Failed to commit dquot type 0 [ 277.568215][ T9817] Quota error (device loop0): qtree_write_dquot: dquota write failed [ 277.579010][ T9817] EXT4-fs error (device loop0): ext4_write_dquot:6933: comm syz.0.1617: Failed to commit dquot type 1 [ 277.644612][ T9817] Quota error (device loop0): qtree_write_dquot: dquota write failed [ 277.663696][ T9817] EXT4-fs error (device loop0): ext4_write_dquot:6933: comm syz.0.1617: Failed to commit dquot type 0 [ 277.729343][ T9817] Quota error (device loop0): qtree_write_dquot: dquota write failed [ 277.748877][ T9817] EXT4-fs error (device loop0): ext4_write_dquot:6933: comm syz.0.1617: Failed to commit dquot type 1 [ 277.803626][ T9817] Quota error (device loop0): qtree_write_dquot: dquota write failed [ 277.828174][ T9817] EXT4-fs error (device loop0): ext4_write_dquot:6933: comm syz.0.1617: Failed to commit dquot type 0 [ 277.885623][ T9817] Quota error (device loop0): qtree_write_dquot: dquota write failed [ 277.920706][ T9826] loop2: detected capacity change from 0 to 32768 [ 277.927584][ T9817] EXT4-fs error (device loop0): ext4_write_dquot:6933: comm syz.0.1617: Failed to commit dquot type 1 [ 277.974478][ T9826] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.1620 (9826) [ 278.093737][ T9826] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 278.142686][ T9826] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 278.151603][ T9826] BTRFS info (device loop2): using free space tree [ 278.199166][ T5778] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 278.277923][ T9820] bio_check_eod: 6 callbacks suppressed [ 278.277937][ T9820] kmmpd-loop0: attempt to access beyond end of device [ 278.277937][ T9820] loop0: rw=14337, sector=68, nr_sectors = 2 limit=64 [ 278.310080][ T9830] loop3: detected capacity change from 0 to 32768 [ 278.330764][ T9820] Buffer I/O error on dev loop0, logical block 34, lost sync page write [ 278.366513][ T9832] loop1: detected capacity change from 0 to 32768 [ 278.381785][ T9830] (syz.3.1622,9830,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 278.419628][ T9826] BTRFS info (device loop2): enabling ssd optimizations [ 278.446348][ T9832] BTRFS warning: duplicate device /dev/loop1 devid 1 generation 8 scanned by syz.1.1623 (9832) [ 278.457735][ T9826] BTRFS info (device loop2): auto enabling async discard [ 278.476234][ T9830] (syz.3.1622,9830,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 278.528940][ T5787] I/O error, dev loop1, sector 32640 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 278.646956][ T9830] JBD2: Ignoring recovery information on journal [ 278.783706][ T9830] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 279.020982][ T5979] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 279.100589][ T5776] ocfs2: Unmounting device (7,3) on (node local) [ 279.258040][ T5979] usb 3-1: Using ep0 maxpacket: 8 [ 279.276240][ T5979] usb 3-1: config 0 has no interfaces? [ 279.282001][ T5979] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 279.312319][ T5779] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 279.323131][ T5979] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.353443][ T5979] usb 3-1: config 0 descriptor?? [ 279.403044][ T9865] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1627'. [ 279.539717][ T5779] usb 2-1: Using ep0 maxpacket: 8 [ 279.553567][ T5779] usb 2-1: config 0 has no interfaces? [ 279.559266][ T5779] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 279.579522][ T5779] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.610635][ T5884] usb 3-1: USB disconnect, device number 20 [ 279.618641][ T5779] usb 2-1: config 0 descriptor?? [ 279.655732][ T9826] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 279.815540][ T5879] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 279.878253][ T5779] usb 2-1: USB disconnect, device number 22 [ 280.016565][ T5879] usb 4-1: Using ep0 maxpacket: 32 [ 280.034718][ T5879] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 280.055758][ T5879] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 280.082126][ T5879] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 280.114010][ T5879] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 280.141919][ T5879] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 280.168025][ T5879] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 280.192651][ T5879] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 280.210979][ T5879] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 280.243622][ T5879] usb 4-1: config 0 descriptor?? [ 280.482519][ T5879] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 16 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 280.523556][ T5879] usb 4-1: USB disconnect, device number 16 [ 280.546196][ T5879] usblp0: removed [ 281.588015][ T9920] sg_write: data in/out 461547/217 bytes for SCSI command 0x0-- guessing data in; [ 281.588015][ T9920] program syz.3.1654 not setting count and/or reply_len properly [ 282.093667][ T9916] loop0: detected capacity change from 0 to 32768 [ 282.148915][ T9916] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 scanned by syz.0.1652 (9916) [ 282.240325][ T9916] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 282.300162][ T9916] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 282.345491][ T9916] BTRFS info (device loop0): using free space tree [ 282.513873][ T9916] BTRFS info (device loop0): enabling ssd optimizations [ 282.536247][ T9916] BTRFS info (device loop0): auto enabling async discard [ 283.045615][ T9964] sg_write: data in/out 461547/217 bytes for SCSI command 0x0-- guessing data in; [ 283.045615][ T9964] program syz.3.1668 not setting count and/or reply_len properly [ 283.063761][ T5979] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 283.277093][ T5979] usb 1-1: Using ep0 maxpacket: 8 [ 283.289581][ T5979] usb 1-1: config 0 has no interfaces? [ 283.295430][ T5979] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 283.316271][ T5979] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 283.332310][ T5979] usb 1-1: config 0 descriptor?? [ 283.583256][ T5979] usb 1-1: USB disconnect, device number 15 [ 283.596653][ T9916] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 284.063634][ T28] kauditd_printk_skb: 49 callbacks suppressed [ 284.063681][ T28] audit: type=1326 audit(1789383315.992:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9992 comm="syz.1.1682" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 284.098663][ T28] audit: type=1326 audit(1789383315.992:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9992 comm="syz.1.1682" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 284.127177][ T28] audit: type=1326 audit(1789383316.001:121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9992 comm="syz.1.1682" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 284.163471][ T28] audit: type=1326 audit(1789383316.001:122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9992 comm="syz.1.1682" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 284.191896][ T28] audit: type=1326 audit(1789383316.020:123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9992 comm="syz.1.1682" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=442 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 284.220632][ T28] audit: type=1326 audit(1789383316.020:124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9992 comm="syz.1.1682" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 284.249286][ T28] audit: type=1326 audit(1789383316.020:125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9992 comm="syz.1.1682" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 284.278501][ T28] audit: type=1326 audit(1789383316.020:126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9992 comm="syz.1.1682" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 284.306836][ T28] audit: type=1326 audit(1789383316.020:127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9992 comm="syz.1.1682" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f2a9499e159 code=0x7ffc0000 [ 284.475242][ T9985] loop3: detected capacity change from 0 to 32768 [ 284.500407][ T9985] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by syz.3.1678 (9985) [ 284.524861][ T9985] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 284.541530][ T9985] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 284.570253][ T9985] BTRFS info (device loop3): using free space tree [ 284.674667][ T9985] BTRFS info (device loop3): enabling ssd optimizations [ 284.692002][ T9985] BTRFS info (device loop3): auto enabling async discard [ 285.107933][ T5979] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 285.324489][ T5979] usb 4-1: Using ep0 maxpacket: 8 [ 285.348283][ T5979] usb 4-1: config 0 has no interfaces? [ 285.367601][ T5979] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 285.394337][ T5979] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.417536][ T5979] usb 4-1: config 0 descriptor?? [ 285.678958][ T5979] usb 4-1: USB disconnect, device number 17 [ 285.686108][ T9985] BTRFS info (device loop3): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 290.061991][T10192] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1760'. [ 290.728646][T10217] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1771'. [ 291.202094][T10238] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1780'. [ 291.781636][T10263] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1791'. [ 292.910495][T10286] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1801'. [ 293.382256][T10310] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1811'. [ 294.484459][T10340] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1822'. [ 295.297190][T10370] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1832'. [ 296.169933][T10399] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1844'. [ 297.361424][T10426] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1857'. [ 297.626106][T10432] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1870'. [ 298.505066][T10457] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1874'. [ 300.424896][T10529] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1906'. [ 301.294685][T10558] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1917'. [ 302.097629][T10584] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1930'. [ 302.856545][T10617] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1942'. [ 303.983165][T10650] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1955'. [ 304.800983][T10686] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1969'. [ 306.125495][T10721] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1983'. [ 308.224981][T10767] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2002'. [ 309.573810][T10793] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2015'. [ 310.315653][T10830] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2029'. [ 311.109821][T10860] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2042'. [ 311.720114][T10891] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2055'. [ 312.274583][T10919] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2065'. [ 313.005857][T10953] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2080'. [ 313.782612][T10981] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2092'. [ 314.016979][ T51] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 314.043055][ T51] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 314.056613][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 314.068775][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 314.090543][ T51] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 314.098460][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 314.312708][T10986] chnl_net:caif_netlink_parms(): no params data found [ 314.434688][T10986] bridge0: port 1(bridge_slave_0) entered blocking state [ 314.443890][T10986] bridge0: port 1(bridge_slave_0) entered disabled state [ 314.454956][T10986] bridge_slave_0: entered allmulticast mode [ 314.462273][T10986] bridge_slave_0: entered promiscuous mode [ 314.491991][T10986] bridge0: port 2(bridge_slave_1) entered blocking state [ 314.520193][T10986] bridge0: port 2(bridge_slave_1) entered disabled state [ 314.527511][T10986] bridge_slave_1: entered allmulticast mode [ 314.549222][T10986] bridge_slave_1: entered promiscuous mode [ 314.603378][T10986] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 314.615871][T10986] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 314.635338][T11013] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2101'. [ 314.677802][T10986] team0: Port device team_slave_0 added [ 314.686950][T10986] team0: Port device team_slave_1 added [ 314.726897][T10986] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 314.733891][T10986] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 314.765528][T10986] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 314.778898][T10986] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 314.791670][T10986] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 314.823187][T10986] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 314.883149][T10986] hsr_slave_0: entered promiscuous mode [ 314.895435][T10986] hsr_slave_1: entered promiscuous mode [ 314.915332][T10986] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 314.924168][T10986] Cannot create hsr debugfs directory [ 315.145790][T10986] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 315.318193][T10986] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 315.513460][T10986] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 315.543267][T11037] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2111'. [ 315.652754][T10986] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 315.931261][T10986] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 315.957212][T10986] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 315.991402][T10986] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 316.002889][T10986] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 316.129744][T10986] 8021q: adding VLAN 0 to HW filter on device bond0 [ 316.161364][T10986] 8021q: adding VLAN 0 to HW filter on device team0 [ 316.183309][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 316.191403][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 316.226459][ T34] bridge0: port 2(bridge_slave_1) entered blocking state [ 316.233649][ T34] bridge0: port 2(bridge_slave_1) entered forwarding state [ 316.314558][ T5782] Bluetooth: hci4: command tx timeout [ 316.719408][T11071] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2122'. [ 316.859290][T10986] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 317.004129][T10986] veth0_vlan: entered promiscuous mode [ 317.025643][T10986] veth1_vlan: entered promiscuous mode [ 317.114803][T10986] veth0_macvtap: entered promiscuous mode [ 317.129476][T10986] veth1_macvtap: entered promiscuous mode [ 317.203803][T10986] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 317.226813][T10986] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 317.280133][T10986] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 317.294449][T10986] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 317.303205][T10986] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 317.315460][T10986] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 317.593921][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 317.629031][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 317.723614][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 317.733137][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 317.827588][T11098] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2133'. [ 318.106943][ T2990] hsr_slave_0: left promiscuous mode [ 318.113258][ T2990] hsr_slave_1: left promiscuous mode [ 318.120579][ T2990] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 318.132491][ T2990] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 318.164859][ T2990] bridge_slave_1: left allmulticast mode [ 318.173100][ T2990] bridge_slave_1: left promiscuous mode [ 318.180524][ T2990] bridge0: port 2(bridge_slave_1) entered disabled state [ 318.197200][ T2990] bridge_slave_0: left allmulticast mode [ 318.209034][ T2990] bridge_slave_0: left promiscuous mode [ 318.215954][ T2990] bridge0: port 1(bridge_slave_0) entered disabled state [ 318.321911][ T5884] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 318.390465][ T2990] bond2 (unregistering): Released all slaves [ 318.491369][ T2990] bond1 (unregistering): (slave veth0_to_bond): Releasing active interface [ 318.500996][ T2990] bond1 (unregistering): Released all slaves [ 318.519214][ T5884] usb 1-1: Using ep0 maxpacket: 32 [ 318.533846][ T5884] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 318.548948][ T5884] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 318.560660][ T5782] Bluetooth: hci4: command tx timeout [ 318.574335][ T5884] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 318.586774][ T5884] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 81 [ 318.611020][ T5884] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 318.625537][ T5884] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 318.640999][ T5884] usb 1-1: config 0 descriptor?? [ 318.985438][ T2990] team0 (unregistering): Port device team_slave_1 removed [ 319.041574][ T2990] team0 (unregistering): Port device team_slave_0 removed [ 319.085687][ T2990] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 319.132133][ T2990] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 319.450455][ T2990] bond0 (unregistering): Released all slaves [ 319.855395][ T2990] IPVS: stop unused estimator thread 0... [ 320.813817][ T5782] Bluetooth: hci4: command tx timeout [ 321.214034][ T5779] usb 1-1: USB disconnect, device number 16 [ 321.736997][T11133] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2146'. [ 322.024420][T11122] loop0: detected capacity change from 0 to 32768 [ 322.075602][T11122] (syz.0.2139,11122,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 322.114321][T11122] (syz.0.2139,11122,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 322.186892][T11122] JBD2: Ignoring recovery information on journal [ 322.272150][T11122] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 322.491617][T11160] [ 322.494007][T11160] ====================================================== [ 322.501042][T11160] WARNING: possible circular locking dependency detected [ 322.508093][T11160] syzkaller #0 Not tainted [ 322.512540][T11160] ------------------------------------------------------ [ 322.519585][T11160] syz.0.2139/11160 is trying to acquire lock: [ 322.525674][T11160] ffff88807d1ea0e0 (&type->s_umount_key#69){++++}-{3:3}, at: super_lock+0x189/0x390 [ 322.535154][T11160] [ 322.535154][T11160] but task is already holding lock: [ 322.542543][T11160] ffff888148d7d348 (&bdev->bd_holder_lock){+.+.}-{3:3}, at: blkdev_common_ioctl+0x838/0x2580 [ 322.552814][T11160] [ 322.552814][T11160] which lock already depends on the new lock. [ 322.552814][T11160] [ 322.563288][T11160] [ 322.563288][T11160] the existing dependency chain (in reverse order) is: [ 322.572330][T11160] [ 322.572330][T11160] -> #4 (&bdev->bd_holder_lock){+.+.}-{3:3}: [ 322.580520][T11160] __mutex_lock+0x135/0xc80 [ 322.585664][T11160] bd_finish_claiming+0x229/0x3f0 [ 322.591236][T11160] blkdev_get_by_dev+0x469/0x610 [ 322.596711][T11160] bdev_open_by_dev+0x77/0x100 [ 322.602021][T11160] setup_bdev_super+0x59/0x660 [ 322.607327][T11160] mount_bdev+0x1ce/0x2c0 [ 322.612298][T11160] legacy_get_tree+0xea/0x180 [ 322.617532][T11160] vfs_get_tree+0x8c/0x280 [ 322.622482][T11160] do_new_mount+0x24a/0xa40 [ 322.627521][T11160] init_mount+0xde/0x130 [ 322.632490][T11160] do_mount_root+0x97/0x230 [ 322.637544][T11160] mount_root_generic+0x1a6/0x3e0 [ 322.643100][T11160] prepare_namespace+0xc2/0x100 [ 322.648505][T11160] kernel_init_freeable+0x41a/0x560 [ 322.654234][T11160] kernel_init+0x1d/0x1c0 [ 322.659108][T11160] ret_from_fork+0x48/0x80 [ 322.664076][T11160] ret_from_fork_asm+0x11/0x20 [ 322.669402][T11160] [ 322.669402][T11160] -> #3 (bdev_lock){+.+.}-{3:3}: [ 322.676540][T11160] __mutex_lock+0x135/0xc80 [ 322.681610][T11160] bd_prepare_to_claim+0x1d9/0x4a0 [ 322.687258][T11160] truncate_bdev_range+0x4e/0x260 [ 322.692823][T11160] blkdev_fallocate+0x50d/0x6a0 [ 322.698200][T11160] vfs_fallocate+0x585/0x6f0 [ 322.703318][T11160] __x64_sys_fallocate+0xc1/0x110 [ 322.708888][T11160] do_syscall_64+0x55/0xb0 [ 322.713842][T11160] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 322.720273][T11160] [ 322.720273][T11160] -> #2 (mapping.invalidate_lock){++++}-{3:3}: [ 322.728644][T11160] down_write+0x97/0x200 [ 322.733431][T11160] set_blocksize+0x247/0x4b0 [ 322.738573][T11160] sb_min_blocksize+0xbe/0x190 [ 322.743870][T11160] ext4_fill_super+0x6e7/0x6870 [ 322.749279][T11160] get_tree_bdev+0x3e5/0x520 [ 322.754403][T11160] vfs_get_tree+0x8c/0x280 [ 322.759349][T11160] do_new_mount+0x24a/0xa40 [ 322.764384][T11160] init_mount+0xde/0x130 [ 322.769160][T11160] do_mount_root+0x97/0x230 [ 322.774210][T11160] mount_root_generic+0x1a6/0x3e0 [ 322.779768][T11160] prepare_namespace+0xc2/0x100 [ 322.785151][T11160] kernel_init_freeable+0x41a/0x560 [ 322.790929][T11160] kernel_init+0x1d/0x1c0 [ 322.795829][T11160] ret_from_fork+0x48/0x80 [ 322.800806][T11160] ret_from_fork_asm+0x11/0x20 [ 322.806116][T11160] [ 322.806116][T11160] -> #1 (&sb->s_type->i_mutex_key#8){++++}-{3:3}: [ 322.814755][T11160] down_write+0x97/0x200 [ 322.819562][T11160] set_blocksize+0x1ff/0x4b0 [ 322.824719][T11160] sb_set_blocksize+0x4a/0x100 [ 322.830058][T11160] ocfs2_get_sector+0x96/0x440 [ 322.835398][T11160] ocfs2_fill_super+0x422/0x5010 [ 322.840872][T11160] mount_bdev+0x21c/0x2c0 [ 322.845744][T11160] legacy_get_tree+0xea/0x180 [ 322.850982][T11160] vfs_get_tree+0x8c/0x280 [ 322.855936][T11160] do_new_mount+0x24a/0xa40 [ 322.861045][T11160] __se_sys_mount+0x2e7/0x3d0 [ 322.866271][T11160] do_syscall_64+0x55/0xb0 [ 322.871229][T11160] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 322.877669][T11160] [ 322.877669][T11160] -> #0 (&type->s_umount_key#69){++++}-{3:3}: [ 322.885948][T11160] __lock_acquire+0x37ef/0x7d80 [ 322.891349][T11160] lock_acquire+0x19e/0x420 [ 322.896410][T11160] down_read+0x46/0x2e0 [ 322.901109][T11160] super_lock+0x189/0x390 [ 322.905982][T11160] fs_bdev_sync+0xa4/0x170 [ 322.910934][T11160] blkdev_common_ioctl+0x8a9/0x2580 [ 322.916668][T11160] blkdev_ioctl+0x512/0x730 [ 322.921713][T11160] __se_sys_ioctl+0xfd/0x170 [ 322.926863][T11160] do_syscall_64+0x55/0xb0 [ 322.931833][T11160] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 322.938276][T11160] [ 322.938276][T11160] other info that might help us debug this: [ 322.938276][T11160] [ 322.948518][T11160] Chain exists of: [ 322.948518][T11160] &type->s_umount_key#69 --> bdev_lock --> &bdev->bd_holder_lock [ 322.948518][T11160] [ 322.962190][T11160] Possible unsafe locking scenario: [ 322.962190][T11160] [ 322.969656][T11160] CPU0 CPU1 [ 322.975051][T11160] ---- ---- [ 322.980431][T11160] lock(&bdev->bd_holder_lock); [ 322.985419][T11160] lock(bdev_lock); [ 322.991861][T11160] lock(&bdev->bd_holder_lock); [ 322.999363][T11160] rlock(&type->s_umount_key#69); [ 323.004499][T11160] [ 323.004499][T11160] *** DEADLOCK *** [ 323.004499][T11160] [ 323.012662][T11160] 1 lock held by syz.0.2139/11160: [ 323.017788][T11160] #0: ffff888148d7d348 (&bdev->bd_holder_lock){+.+.}-{3:3}, at: blkdev_common_ioctl+0x838/0x2580 [ 323.028435][T11160] [ 323.028435][T11160] stack backtrace: [ 323.034332][T11160] CPU: 0 PID: 11160 Comm: syz.0.2139 Not tainted syzkaller #0 [ 323.041810][T11160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 323.051890][T11160] Call Trace: [ 323.055178][T11160] [ 323.058120][T11160] dump_stack_lvl+0x18c/0x250 [ 323.062847][T11160] ? load_image+0x420/0x420 [ 323.067412][T11160] ? show_regs_print_info+0x20/0x20 [ 323.072627][T11160] ? print_circular_bug+0x12b/0x1a0 [ 323.077854][T11160] check_noncircular+0x2fc/0x400 [ 323.082811][T11160] ? print_deadlock_bug+0x5d0/0x5d0 [ 323.088028][T11160] ? lockdep_lock+0xf5/0x230 [ 323.092638][T11160] ? _find_first_zero_bit+0xd6/0x100 [ 323.097990][T11160] __lock_acquire+0x37ef/0x7d80 [ 323.102872][T11160] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 323.108984][T11160] ? arch_stack_walk+0x160/0x190 [ 323.113971][T11160] ? verify_lock_unused+0x140/0x140 [ 323.119189][T11160] ? verify_lock_unused+0x140/0x140 [ 323.124403][T11160] ? stack_trace_save+0xaa/0x100 [ 323.129367][T11160] ? stack_trace_snprint+0xf0/0xf0 [ 323.134504][T11160] ? __stack_depot_save+0x1f/0x660 [ 323.139626][T11160] ? do_syscall_64+0x55/0xb0 [ 323.144243][T11160] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 323.150343][T11160] lock_acquire+0x19e/0x420 [ 323.154868][T11160] ? super_lock+0x189/0x390 [ 323.159391][T11160] ? __might_sleep+0xe0/0xe0 [ 323.164052][T11160] ? read_lock_is_recursive+0x20/0x20 [ 323.169443][T11160] ? __mutex_trylock_common+0x160/0x270 [ 323.175003][T11160] ? trace_raw_output_contention_end+0xd0/0xd0 [ 323.181190][T11160] down_read+0x46/0x2e0 [ 323.185405][T11160] ? super_lock+0x189/0x390 [ 323.189930][T11160] super_lock+0x189/0x390 [ 323.194294][T11160] ? end_current_label_crit_section+0x170/0x170 [ 323.200577][T11160] ? user_get_super+0x180/0x180 [ 323.205456][T11160] ? mutex_lock_nested+0x20/0x20 [ 323.210432][T11160] fs_bdev_sync+0xa4/0x170 [ 323.214862][T11160] ? fs_bdev_mark_dead+0x1f0/0x1f0 [ 323.219988][T11160] blkdev_common_ioctl+0x8a9/0x2580 [ 323.225205][T11160] ? tomoyo_path_number_perm+0x56b/0x5e0 [ 323.230859][T11160] ? blkdev_bszset+0x1f0/0x1f0 [ 323.235651][T11160] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 323.241139][T11160] blkdev_ioctl+0x512/0x730 [ 323.245665][T11160] ? blkdev_compat_ptr_ioctl+0xd0/0xd0 [ 323.251148][T11160] ? bpf_lsm_file_ioctl+0x9/0x10 [ 323.256121][T11160] ? security_file_ioctl+0x80/0xa0 [ 323.261256][T11160] ? blkdev_compat_ptr_ioctl+0xd0/0xd0 [ 323.266734][T11160] __se_sys_ioctl+0xfd/0x170 [ 323.271344][T11160] do_syscall_64+0x55/0xb0 [ 323.275807][T11160] ? clear_bhb_loop+0x40/0x90 [ 323.280514][T11160] ? clear_bhb_loop+0x40/0x90 [ 323.285205][T11160] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 323.291125][T11160] RIP: 0033:0x7fd82c39e159 [ 323.295560][T11160] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 323.315180][T11160] RSP: 002b:00007fd82a5d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 323.323612][T11160] RAX: ffffffffffffffda RBX: 00007fd82c626090 RCX: 00007fd82c39e159 [ 323.331606][T11160] RDX: 0000000000000000 RSI: 0000000000001261 RDI: 0000000000000004 [ 323.339601][T11160] RBP: 00007fd82c43503b R08: 0000000000000000 R09: 0000000000000000 [ 323.347588][T11160] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 323.355591][T11160] R13: 00007fd82c626128 R14: 00007fd82c626090 R15: 00007fff46dc4778 [ 323.363588][T11160] [ 323.393023][ T5782] Bluetooth: hci4: command tx timeout [ 323.425919][T11122] loop0: detected capacity change from 32768 to 0 [ 323.434299][T11163] syz.0.2139: attempt to access beyond end of device [ 323.434299][T11163] loop0: rw=0, sector=16944, nr_sectors = 1 limit=0 [ 323.447999][T11163] (syz.0.2139,11163,0):ocfs2_read_quota_phys_block:160 ERROR: status = -5 [ 323.456628][T11163] (syz.0.2139,11163,0):ocfs2_quota_write:269 ERROR: status = -5 [ 323.466567][T11163] (syz.0.2139,11163,0):ocfs2_quota_write:290 ERROR: status = -5 [ 323.474387][T11163] (syz.0.2139,11163,0):__ocfs2_global_write_info:437 ERROR: Cannot write global quota info structure [ 323.485476][T11163] (syz.0.2139,11163,0):ocfs2_write_info:994 ERROR: status = -5 [ 323.485640][T11151] jbd2/loop0-29: attempt to access beyond end of device [ 323.485640][T11151] loop0: rw=38913, sector=554, nr_sectors = 1 limit=0 [ 323.509333][T11151] jbd2/loop0-29: attempt to access beyond end of device [ 323.509333][T11151] loop0: rw=38913, sector=555, nr_sectors = 1 limit=0 [ 323.525037][T11151] jbd2/loop0-29: attempt to access beyond end of device [ 323.525037][T11151] loop0: rw=38913, sector=556, nr_sectors = 1 limit=0 [ 323.538749][T11151] jbd2/loop0-29: attempt to access beyond end of device [ 323.538749][T11151] loop0: rw=38913, sector=557, nr_sectors = 1 limit=0 [ 323.552504][T11151] Aborting journal on device loop0-29. [ 323.558103][T11151] jbd2/loop0-29: attempt to access beyond end of device [ 323.558103][T11151] loop0: rw=38913, sector=552, nr_sectors = 1 limit=0 [ 323.571742][T11151] Buffer I/O error on dev loop0, logical block 552, lost sync page write [ 323.582354][T11151] JBD2: I/O error when updating journal superblock for loop0-29. [ 323.620400][T10986] (syz-executor,10986,0):ocfs2_start_trans:379 ERROR: status = -30 [ 323.628424][T10986] OCFS2: abort (device loop0): handle_t *ocfs2_start_trans(struct ocfs2_super *, int): Detected aborted journal [ 323.641484][T10986] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 323.651332][T10986] OCFS2: File system is now read-only. [ 323.657796][T10986] (syz-executor,10986,0):ocfs2_modify_bh:105 ERROR: status = -30 [ 323.666578][T10986] (syz-executor,10986,0):ocfs2_local_free_info:856 ERROR: status = -30 [ 323.675151][T10986] (syz-executor,10986,0):ocfs2_start_trans:379 ERROR: status = -30 [ 323.683071][T10986] OCFS2: abort (device loop0): handle_t *ocfs2_start_trans(struct ocfs2_super *, int): Detected aborted journal [ 323.695060][T10986] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 323.704870][T10986] (syz-executor,10986,0):ocfs2_modify_bh:105 ERROR: status = -30 [ 323.712648][T10986] (syz-executor,10986,0):ocfs2_local_free_info:856 ERROR: status = -30 [ 323.721193][T10986] syz-executor: attempt to access beyond end of device [ 323.721193][T10986] loop0: rw=0, sector=23, nr_sectors = 1 limit=0 [ 323.734460][T10986] (syz-executor,10986,0):ocfs2_assign_bh:2416 ERROR: status = -5 [ 323.742250][T10986] (syz-executor,10986,0):ocfs2_inode_lock_full_nested:2511 ERROR: status = -5 [ 323.752292][T10986] (syz-executor,10986,0):ocfs2_shutdown_local_alloc:411 ERROR: status = -5 [ 323.761137][T10986] syz-executor: attempt to access beyond end of device [ 323.761137][T10986] loop0: rw=1, sector=16936, nr_sectors = 1 limit=0 [ 323.775119][T10986] Buffer I/O error on dev loop0, logical block 16936, lost sync page write [ 323.783858][T10986] (syz-executor,10986,0):ocfs2_write_block:78 ERROR: status = -5 [ 323.791672][T10986] (syz-executor,10986,0):ocfs2_update_disk_slot:199 ERROR: status = -5 [ 323.800150][T10986] (syz-executor,10986,0):ocfs2_put_slot:517 ERROR: status = -5 [ 323.808574][T10986] (syz-executor,10986,0):ocfs2_journal_shutdown:1108 ERROR: status = -5 [ 323.824682][T10986] ocfs2: Unmounting device (7,0) on (node local) [ 331.378895][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 331.385327][ T1289] ieee802154 phy1 wpan1: encryption failed: -22