last executing test programs: 10.095372899s ago: executing program 2 (id=1145): r0 = syz_open_dev$loop(&(0x7f0000000440), 0x791, 0x2002) ioctl$BLKGETSIZE64(r0, 0x80081272, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r1, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0xd8d0481}], 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'dvmrp1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@ipv6_deladdr={0x18, 0x15, 0x10, 0x70bd27, 0x25dfdbfe, {0xa, 0x1, 0x40, 0xfd, r2}}, 0x18}, 0x1, 0x0, 0x0, 0x20048890}, 0x20000040) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYRES32=0x0, @ANYBLOB="fffe01000100000008001b000000000058001a8054000a80050008"], 0x80}}, 0x0) 6.699582904s ago: executing program 2 (id=1154): write(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) recvfrom(r1, &(0x7f00000022c0)=""/4089, 0xff9, 0x10002, 0x0, 0x0) 4.870659549s ago: executing program 2 (id=1172): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@newtfilter={0x30, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xa, 0x1}, {0x1}, {0xf, 0x4}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x0) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002340)={0x3, 0x5, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000000000000000000000000000085"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FD_FRAMES(r5, 0x65, 0x5, 0x0, 0x0) sendmsg$can_raw(r5, &(0x7f0000000000)={&(0x7f00000000c0), 0x10, &(0x7f00000003c0)={&(0x7f0000000200)=@can={{0x0, 0x1, 0x1}, 0x1, 0x3, 0x0, 0x0, "0000000000000005"}, 0x10}, 0x2, 0x0, 0x0, 0x24000884}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) getrlimit(0xa, 0x0) read(r6, &(0x7f00000000c0), 0x3) ioctl$KVM_CREATE_VM(r0, 0xae03, 0x62) 4.781447111s ago: executing program 3 (id=1174): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f00000002c0)='./file1\x00', 0x400, &(0x7f0000000300)=ANY=[], 0x1, 0x127a, &(0x7f0000000680)="$eJzs3U1rXFUcB+D/JJPXmhe1VlsQD7pRhLHJwpULg7QgBpRoCioIt2aiQyYzITMERsTGlSvBjyHq0p0gfoFs3AjuBEEkG5ddiFcmM7WZzKSNjZ1geZ7NPZxzfvfcl9wLN9wzd/+lLzY31hul9awZI4VCFLfGongzRYqRGI2O3Xju2k+/PPnm2++8trS8fGUlpatLby28mFKafer7dz/+5ukfmueufTv73UTszb+3/8fir3sX9i7u//V1VBqp0ki1ejNl6Xq93syuV8tprdLYKKX0RrWcNcqpUmuUt3va16v1ra1WymprM9Nb2+VGI2W1Vtoot1KzkJrbrZR9kFVqqVQqpZnp4DRWv7qZ53lEno/FeOR5nk/FdJyLh2ImZmMu5uPheCQejfPxWFyIx+OJuHjQ66y3GwAAAAAAAAAAAAAAAAAAAB4sd5n/XzD/HwAAAAAAAAAAAAAAAAAAAO6/o/P/ixG+/w8AAAAAAAAAAAAAAAAAAABDdpfv/x+Z///8ofn/o2e96QAAAAAAAAAAAAAAAAAAAPDgmOwsVlKajNj8bGd1Z7Wz7NQvrUclqlGOyzEXf8bB7P+OTvnqq8tXLqcD8/HC5o1u/sbO6mhvfmFsLuYLA/MLnXzqzU/E9OH8YszF+cHjLw7MT8azz7Tzn3bypZiLH9+PelRjLaLQ3fuD/CcLKb3y+vJUb/5Su9+x/PoBAAAA/yel9I/+5/fdbqeB7Z2m7vN56vYs3OH/A0eez4txqXhWe80tjdZHG1m1Wt6+x8L48esZP92a+wqFiMjicM3s9G8r7cH/syHutTA61EHH7tznFOc0ivf3YLZP4TAO1O9fHqqZjOH+SYx0L4ms2r5/niwVu3ne1/TyieMnuE4HNU3crvm5L3X8PaMwhPsSw3H7pJ/1lgAAAAAAAAAAAPBvDHxncCoi+t4H/LCv5tbr4b3x/jUfP/rnQ9hDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPibHTgWAAAAABDmb51GxwYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8FUAAAD//8DezoA=") r0 = openat(0xffffffffffffffff, &(0x7f0000000480)='./file1\x00', 0x177a42, 0x15) close(0xffffffffffffffff) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @any, 0xb}, 0xe) shutdown(r1, 0x1) set_mempolicy(0x4005, &(0x7f0000000080)=0x8, 0x8) r4 = syz_open_dev$sg(&(0x7f0000001800), 0xcc60, 0xa002) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="060000080000000000000000"]) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r6 = mq_open(&(0x7f0000000240)='/dev/cpu/#/msr\x00', 0x40, 0x17, &(0x7f0000000280)={0xfffffffffffffffe, 0x0, 0xffffffffffffff65, 0x3}) mq_notify(r6, &(0x7f0000000440)={0x0, 0xc, 0x4, @thr={&(0x7f0000000340)="b9c76c2924ac9490fe0888948a1483d8", &(0x7f0000000380)="8aad4f3cab2284323f35c037cf0432ea18c6ee6d262aa737bab73d0f9dad5e6c61693217b8ee270cb130c6696d9af5c0a9aa450027ecc19c9d2e4fa02a447139970a27c1dfae536365da6bf810d9bf30a90bdea6e8c41a5eb96f4a0cb7e83bd442b7f0c3f7b09ecc4fbf2a5c14bb1321e7f71aee96bb3aecc13393fb18f4e6766ddace205ce8f21b61cb3a635f49e736721d1072bcfa5fe754f924e2fcf96cdb742a038ad8a800192dcafc1af2212725"}}) getgroups(0x2, &(0x7f0000000000)=[0xffffffffffffffff, 0xee00]) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000540)={0x0, @local, @initdev}, &(0x7f0000000180)=0xc) fcntl$dupfd(0xffffffffffffffff, 0x406, r5) socket$packet(0x11, 0x3, 0x300) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0xb, 0x80000, 0x4274) sendmsg$nl_route_sched(r8, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r6, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x14) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES64=0x0, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) 3.658171909s ago: executing program 2 (id=1176): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$tipc(0x1e, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a80)=@newtfilter={0xb4, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {}, {0x8, 0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x80, 0x2, [@TCA_MATCHALL_ACT={0x7c, 0x2, [@m_tunnel_key={0x78, 0x1, 0x0, 0x0, {{0xf}, {0x48, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @empty}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @remote}}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x3, 0x8, 0x4, 0x7fff, 0x7}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}}]}, 0xb4}, 0x1, 0x0, 0x0, 0x8080}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, 0x0, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000000)="27030200000214000e00002fb96dffff1144ee163cddcb000000800000827600000000000000", 0x26}, {&(0x7f00000004c0)="f058050000007f8f", 0x300}], 0x2}, 0x5) 3.645706569s ago: executing program 4 (id=1177): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x0) accept$inet6(r1, 0x0, 0x0) accept(r1, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a04000800ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) 2.566065126s ago: executing program 4 (id=1178): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x8e40, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x4}}]}, 0x30}}, 0x20040084) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x1, 0x4], 0x3, [0xb, 0x3, 0x1, 0x2002, 0x1, 0x4, 0x2, 0xd09, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x2, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x3ff, 0x2, 0xc, 0x42, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r8, {0x4}, {0xffff}, {0x2, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x9, 0x0, 0xf, 0x10, 0x2, 0x6, 0x2, 0x8, 0x2, 0x0, 0x1, 0x8, 0x1, 0xd, 0x4], 0x3, [0xc, 0x101, 0x7fff, 0x2002, 0x1, 0x4, 0x8, 0xd03, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x7, 0x2a, 0x401, 0x2, 0xc, 0x40, 0xfff9, 0x3, 0x4]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r9, 0x0, 0x0, 0x48040, &(0x7f00000001c0)={0x11, 0x7, r8, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) 2.564477836s ago: executing program 3 (id=1179): fsopen(&(0x7f0000000300)='debugfs\x00', 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) socket$kcm(0x29, 0x2, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) r1 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000002c0), 0x200000, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @private=0xa0100ff}, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x36}}, {0x2, 0x4e24, @rand_addr=0x64010100}, 0x1e3, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x7, 0xb, 0x20}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r1], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r2, &(0x7f0000000000), 0xd) 2.549343517s ago: executing program 0 (id=1180): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./proc/net/pppol2tp\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) read(r0, &(0x7f0000004000), 0x100) 2.318815263s ago: executing program 0 (id=1181): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000740)='./file0\x00', 0x10040, &(0x7f0000000040), 0xfd, 0x269, &(0x7f0000000a00)="$eJzs3U9oHFUcB/Df7B/jJotEvQjiHxARDYR4E7zEi0JAQhARVIiIeJJEiAnesp68eNCzSkDwEkpvTXssvYReWgo9pW0O6aXQhh4aemgPW3Znt2ySDW33b9n5fGCYmbz35r0J832zLMxsAJk1GRGzEZGPiKmIKEZE0lrh7XSZbOxulLYXI6rVL+4m9XrpfqrZbiIiKhHxUUShWba29c3e/Z3P3vtjtfju/1tflwZ1fq3293Y/P/h3/vczcx+uXb56ez6J2Sg3ylrPo5eSNn8rJBGv9KOz50RSGPYIeBoLv56+Vsv9qxHxTj3/xcg1IvvnygsXivHBPye1/evOldcHOVag96rVYu0eWKkCmZOLiHIkuemISLdzuenp9DP89fx47qfllV+mflxeXfph2DMV0CvlSHY/PTd2duJI/m/l0/wDo6scsfvlwuaN2vZBftijAfqm9dv2N9JVLf9T362/H/IPmSP/kF3yD9kl/zACOsyu/EN2dZP/F/s0JmAw3P9hhBWbG5W2xfIP2SX/MKL+a/fU6WHyD9nVmn8AIFuqY8N+AhkYlmHPPwAAAAAAAAAAAAAAAAAAwHEbpe3F5jKoPi/+HbH/SUQU2vWfr/8ecfNt4+P3klq1x5K0WVe+favLA3TpVM+evi511Oqlm73qvzOX3uzPcX87vHviP2d9KaJSqzxTKBy//pLG9de5l59QXvy+yw6e0dG3An781WD7P+rh5nD7n9uJOF+bf2bazT+5eK2+bj//lFtfsdyhnx90eQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG5lEAAAD//4oibec=") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) 2.260575254s ago: executing program 1 (id=1183): seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x1, &(0x7f0000000140)={0x0, 0x0}) utime(0x0, 0x0) r0 = socket$inet(0x2, 0x802, 0x1) write(r0, &(0x7f0000000080)="08008edf", 0x4) r1 = openat$tcp_congestion(0xffffffffffffff9c, 0x0, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) symlink(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='./config/usb_gadget/g1/functions/hid.usb0\x00') r2 = syz_open_procfs(0x0, 0x0) syz_open_pts(r2, 0x8000) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000600)={0x0, {{0xa, 0xffff, 0x0, @mcast1={0xff, 0x7}, 0x80020000}}, {{0xa, 0x4e22, 0x0, @empty}}}, 0x108) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000e80)='/sys/power/pm_freeze_timeout', 0x101a82, 0x100) copy_file_range(r4, &(0x7f0000000040)=0x8000000000000007, r4, 0x0, 0xb, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2b, &(0x7f0000000200)={0x80000000, {{0xa, 0x0, 0x20000000, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) ioctl$sock_TIOCOUTQ(r4, 0x5411, &(0x7f0000000340)) r5 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x1, 0x1ff) write(r5, &(0x7f0000001000)='8', 0x1) ioctl$XFS_IOC_FSGROWFSLOG(r1, 0x4008586f, &(0x7f00000000c0)={0x0, 0x2}) 2.123063817s ago: executing program 3 (id=1184): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x8000, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x60) syz_emit_ethernet(0x9e, &(0x7f00000000c0)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaaaa86dd6000000000683afffe8000000000000000000000000000aaff020000000000000000000000000001860090780000040000000000000000000309bd3e6d4706598080a8030037ffffff0100000024732472eefa45ad96000000008e254c1e4a8a8b3f0ab0c430d3be27df3e34116db7f91149590d42ca0a5c15b37aaf030200010000000500000000260004003da5633d"], 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000280)='./binderfs2/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$XFS_IOC_GET_RESBLKS(r1, 0x80105873, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x1, 0x0, 0x0}) r4 = dup3(r3, r3, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) capget(&(0x7f0000000100)={0x20080522}, 0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f0000000580)) r6 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGIDLE(r5, 0x8010743f, 0x0) connect$pppoe(r6, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCGPROP(r7, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSFLAGS1(r7, 0x4004743a, &(0x7f0000000300)) ioctl$PPPIOCGCHAN(r6, 0x80047437, &(0x7f0000001f00)) sendmmsg(r6, &(0x7f0000001d00)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000007c0)="0281", 0x2}], 0x1}}], 0x1, 0x24005805) 2.114971768s ago: executing program 0 (id=1185): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e21, @remote}}, 0x0, 0x0, 0x23, 0x0, "e83ae75240c2d6d8ec87bb53fab0910000000000000007a5922406b64cddaeb9d339ba3c35dc0a08df8e61740b7cf2d4e499d58654a4cf0fa0ce1f830c3079cffcfd00"}, 0xd8) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='bbr', 0x3) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) syz_emit_ethernet(0x41, &(0x7f0000000380)={@multicast, @random="a5bfbed391c3", @void, {@llc={0x4, {@llc={0xfe, 0x4c53ccabd4bc63b4, "fe", "048608b6086233649fb527609e0f018a01e9a75805e3f7ea25ec6f26d71c04fac5553143d3dc7ab77a204b8bb9eaffaf"}}}}}, &(0x7f0000000400)={0x1, 0x4, [0xa47, 0xbee, 0x57c, 0x703]}) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000140)=0x4, 0x4) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000)=0xc, 0x4) recvmsg(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000}, 0x700) 2.097507118s ago: executing program 1 (id=1186): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) syz_mount_image$vfat(&(0x7f0000000300), &(0x7f0000000280)='./file0\x00', 0x0, &(0x7f0000000d80)=ANY=[@ANYBLOB='utf8=0,shortname=lower,rodir,utf8=0,uni_xlate=1,utf8=0,iocharset=koi8-ru,shortname=lower,iocharset=utf8,check=relaxed,shortname=mixed,shortname=win95,showexec,shortname=winnt,shortname=win95,rodir,nonumtail=0,errors=continue,nnonuage=936,nonumtail=0,shortname=winnt,shortname=win95,obj_user=errors=remount-ro,\x00'], 0x1, 0x36b, &(0x7f0000000a00)="$eJzs3U1vG1UXAODTvM1H85I6C4QECHFVNrCxkvAHGqFWQkQChRoVFkhTMgEr0zjyWEGuEHTHlt9RsWSHhPgDWcCeHbtsWHZRdVDsuPloCIvUHgrPI0X3xPce+4zHM7qb0dm//d3drc2yuZn1Yup6iqmImHoYsTiIhi4djlODeCaOux9vNW7/9tqHH3/y3ura2o31lG6u3np7JaV09fWfvvzq+2s/9/7/0Q9Xf5yNvcVP9/9Y+X3vpb2X9x/f+qJdpnaZtju9lKU7nU4vu1PkaaNdbjVT+qDIszJP7e0y756Y3yw6Ozv9lG1vLMzvdPOyTNl2P23l/dTrpF63n7LPs/Z2ajabaWE++DutB+vr2eownjtn3fVJFcQYdLur2cE1PPvUTOtBLQUBALW66P5/5pnu/6fD/n+Sju//+bc62P/PHF6/J9n/AwAAAAAAAAAAAADA8+BhVTWqqmqMxmr0kPDh/zWXx5g9df5P/dVdH+N17MG9uYji293Wbms4DudXN6MdReSxFI14dHBbGBnGN99du7GUBhZj4e43g/xrv0S0/ncyfzkasXh2/vIwPz3Jj4NxOuaP569EI148O3/lzPyZePONY/nNaMSvn0UnitgY3N6O8r9eTumd99dO5c8O1gEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw39BMI6/GsO/9biviSuwe9u9vHi1YPNkff5j/pL/+UjTi0dn9+ZfO7M9/OV65XO+xAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBI2b+3lRVF3p1UMOr5P3hlZhT8ddal4fL7p6auxARrLop86lm94eOqqsZV6txkT+VFgumI885gdfgrufhnvRAR56yZjYj6v41/YlDXHQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADqc9T0u+5KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqFPZv7eVFUXeHWNQ9zECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8T/4MAAD//yeQEY0=") modify_ldt$write2(0x11, &(0x7f0000000100)={0x1d30, 0x0, 0x2000, 0x1}, 0x10) syz_clone(0xa0001000, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0) 2.02536473s ago: executing program 2 (id=1187): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@newtfilter={0x30, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xa, 0x1}, {0x1}, {0xf, 0x4}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x0) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002340)={0x3, 0x5, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000000000000000000000000000085"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FD_FRAMES(r5, 0x65, 0x5, 0x0, 0x0) sendmsg$can_raw(r5, &(0x7f0000000000)={&(0x7f00000000c0), 0x10, &(0x7f00000003c0)={&(0x7f0000000200)=@can={{0x0, 0x1, 0x1}, 0x1, 0x3, 0x0, 0x0, "0000000000000005"}, 0x10}, 0x2, 0x0, 0x0, 0x24000884}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) getrlimit(0xa, 0x0) read(r6, &(0x7f00000000c0), 0x3) ioctl$KVM_CREATE_VM(r0, 0xae03, 0x62) 1.9952101s ago: executing program 4 (id=1188): mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000a00)='./config\x00', &(0x7f0000000b00)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/dlm/mycluster\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./config/dlm/mycluster/comms/1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/dlm/mycluster/comms/1/local\x00', 0x1, 0x0) write(r0, &(0x7f0000001000)='1', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./config/dlm/mycluster/comms/1/addr\x00', 0x1, 0x0) write(r1, &(0x7f0000001200)="020000007f00000100"/128, 0x80) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000200), 0x1, 0x0) write(r2, &(0x7f0000001300)="0600000000000000020000000400"/105, 0x69) 1.916302653s ago: executing program 3 (id=1189): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_io_uring_setup(0xefe, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x83, 0x3af}, &(0x7f0000000100)=0x0, &(0x7f0000000440)=0x0, &(0x7f0000000180)) syz_io_uring_modify_offsets$generic(r2, r3, 0x2c, 0x10000) io_uring_enter(r1, 0x2883, 0xf1bd, 0x0, 0x0, 0x0) io_uring_enter(r1, 0x7fffffe, 0x5, 0x5, 0x0, 0x0) io_uring_enter(r1, 0x788, 0x6a29, 0x1, 0x0, 0xfffffffffffffd04) 1.293280848s ago: executing program 2 (id=1190): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f00000002c0)='./file1\x00', 0x400, &(0x7f0000000300)=ANY=[], 0x1, 0x127a, &(0x7f0000000680)="$eJzs3U1rXFUcB+D/JJPXmhe1VlsQD7pRhLHJwpULg7QgBpRoCioIt2aiQyYzITMERsTGlSvBjyHq0p0gfoFs3AjuBEEkG5ddiFcmM7WZzKSNjZ1geZ7NPZxzfvfcl9wLN9wzd/+lLzY31hul9awZI4VCFLfGongzRYqRGI2O3Xju2k+/PPnm2++8trS8fGUlpatLby28mFKafer7dz/+5ukfmueufTv73UTszb+3/8fir3sX9i7u//V1VBqp0ki1ejNl6Xq93syuV8tprdLYKKX0RrWcNcqpUmuUt3va16v1ra1WymprM9Nb2+VGI2W1Vtoot1KzkJrbrZR9kFVqqVQqpZnp4DRWv7qZ53lEno/FeOR5nk/FdJyLh2ImZmMu5uPheCQejfPxWFyIx+OJuHjQ66y3GwAAAAAAAAAAAAAAAAAAAB4sd5n/XzD/HwAAAAAAAAAAAAAAAAAAAO6/o/P/ixG+/w8AAAAAAAAAAAAAAAAAAABDdpfv/x+Z///8ofn/o2e96QAAAAAAAAAAAAAAAAAAAPDgmOwsVlKajNj8bGd1Z7Wz7NQvrUclqlGOyzEXf8bB7P+OTvnqq8tXLqcD8/HC5o1u/sbO6mhvfmFsLuYLA/MLnXzqzU/E9OH8YszF+cHjLw7MT8azz7Tzn3bypZiLH9+PelRjLaLQ3fuD/CcLKb3y+vJUb/5Su9+x/PoBAAAA/yel9I/+5/fdbqeB7Z2m7vN56vYs3OH/A0eez4txqXhWe80tjdZHG1m1Wt6+x8L48esZP92a+wqFiMjicM3s9G8r7cH/syHutTA61EHH7tznFOc0ivf3YLZP4TAO1O9fHqqZjOH+SYx0L4ms2r5/niwVu3ne1/TyieMnuE4HNU3crvm5L3X8PaMwhPsSw3H7pJ/1lgAAAAAAAAAAAPBvDHxncCoi+t4H/LCv5tbr4b3x/jUfP/rnQ9hDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPibHTgWAAAAABDmb51GxwYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8FUAAAD//8DezoA=") r0 = openat(0xffffffffffffffff, &(0x7f0000000480)='./file1\x00', 0x177a42, 0x15) close(0xffffffffffffffff) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @any, 0xb}, 0xe) shutdown(r1, 0x1) set_mempolicy(0x4005, &(0x7f0000000080)=0x8, 0x8) r4 = syz_open_dev$sg(&(0x7f0000001800), 0xcc60, 0xa002) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="060000080000000000000000"]) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r6 = mq_open(&(0x7f0000000240)='/dev/cpu/#/msr\x00', 0x40, 0x17, &(0x7f0000000280)={0xfffffffffffffffe, 0x0, 0xffffffffffffff65, 0x3}) mq_notify(r6, &(0x7f0000000440)={0x0, 0xc, 0x4, @thr={&(0x7f0000000340)="b9c76c2924ac9490fe0888948a1483d8", &(0x7f0000000380)="8aad4f3cab2284323f35c037cf0432ea18c6ee6d262aa737bab73d0f9dad5e6c61693217b8ee270cb130c6696d9af5c0a9aa450027ecc19c9d2e4fa02a447139970a27c1dfae536365da6bf810d9bf30a90bdea6e8c41a5eb96f4a0cb7e83bd442b7f0c3f7b09ecc4fbf2a5c14bb1321e7f71aee96bb3aecc13393fb18f4e6766ddace205ce8f21b61cb3a635f49e736721d1072bcfa5fe754f924e2fcf96cdb742a038ad8a800192dcafc1af2212725"}}) getgroups(0x2, &(0x7f0000000000)=[0xffffffffffffffff, 0xee00]) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000540)={0x0, @local, @initdev}, &(0x7f0000000180)=0xc) fcntl$dupfd(0xffffffffffffffff, 0x406, r5) socket$packet(0x11, 0x3, 0x300) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0xb, 0x80000, 0x4274) sendmsg$nl_route_sched(r8, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r6, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x14) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES64=0x0, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) 1.223992089s ago: executing program 4 (id=1191): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/uhci_hcd/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) close(r0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./my_configfs\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/functions/obex.usb1\x00', 0x1ff) rmdir(&(0x7f0000000440)='./my_configfs/usb_gadget/g1/functions/obex.usb1\x00') r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') pread64(r4, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1, 0xf9, &(0x7f0000006680)) munlock(&(0x7f00000ef000/0x1000)=nil, 0x1000) write$nci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x102) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mremap(&(0x7f0000a94000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000259000/0x4000)=nil) 1.132872812s ago: executing program 3 (id=1192): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f00000002c0)='./file1\x00', 0x400, &(0x7f0000000300)=ANY=[], 0x1, 0x127a, &(0x7f0000000680)="$eJzs3U1rXFUcB+D/JJPXmhe1VlsQD7pRhLHJwpULg7QgBpRoCioIt2aiQyYzITMERsTGlSvBjyHq0p0gfoFs3AjuBEEkG5ddiFcmM7WZzKSNjZ1geZ7NPZxzfvfcl9wLN9wzd/+lLzY31hul9awZI4VCFLfGongzRYqRGI2O3Xju2k+/PPnm2++8trS8fGUlpatLby28mFKafer7dz/+5ukfmueufTv73UTszb+3/8fir3sX9i7u//V1VBqp0ki1ejNl6Xq93syuV8tprdLYKKX0RrWcNcqpUmuUt3va16v1ra1WymprM9Nb2+VGI2W1Vtoot1KzkJrbrZR9kFVqqVQqpZnp4DRWv7qZ53lEno/FeOR5nk/FdJyLh2ImZmMu5uPheCQejfPxWFyIx+OJuHjQ66y3GwAAAAAAAAAAAAAAAAAAAB4sd5n/XzD/HwAAAAAAAAAAAAAAAAAAAO6/o/P/ixG+/w8AAAAAAAAAAAAAAAAAAABDdpfv/x+Z///8ofn/o2e96QAAAAAAAAAAAAAAAAAAAPDgmOwsVlKajNj8bGd1Z7Wz7NQvrUclqlGOyzEXf8bB7P+OTvnqq8tXLqcD8/HC5o1u/sbO6mhvfmFsLuYLA/MLnXzqzU/E9OH8YszF+cHjLw7MT8azz7Tzn3bypZiLH9+PelRjLaLQ3fuD/CcLKb3y+vJUb/5Su9+x/PoBAAAA/yel9I/+5/fdbqeB7Z2m7vN56vYs3OH/A0eez4txqXhWe80tjdZHG1m1Wt6+x8L48esZP92a+wqFiMjicM3s9G8r7cH/syHutTA61EHH7tznFOc0ivf3YLZP4TAO1O9fHqqZjOH+SYx0L4ms2r5/niwVu3ne1/TyieMnuE4HNU3crvm5L3X8PaMwhPsSw3H7pJ/1lgAAAAAAAAAAAPBvDHxncCoi+t4H/LCv5tbr4b3x/jUfP/rnQ9hDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPibHTgWAAAAABDmb51GxwYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8FUAAAD//8DezoA=") r0 = openat(0xffffffffffffffff, &(0x7f0000000480)='./file1\x00', 0x177a42, 0x15) close(0xffffffffffffffff) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @any, 0xb}, 0xe) shutdown(r1, 0x1) set_mempolicy(0x4005, &(0x7f0000000080)=0x8, 0x8) r4 = syz_open_dev$sg(&(0x7f0000001800), 0xcc60, 0xa002) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="060000080000000000000000"]) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r5 = mq_open(&(0x7f0000000240)='/dev/cpu/#/msr\x00', 0x40, 0x17, &(0x7f0000000280)={0xfffffffffffffffe, 0x0, 0xffffffffffffff65, 0x3}) mq_notify(r5, &(0x7f0000000440)={0x0, 0xc, 0x4, @thr={&(0x7f0000000340)="b9c76c2924ac9490fe0888948a1483d8", &(0x7f0000000380)="8aad4f3cab2284323f35c037cf0432ea18c6ee6d262aa737bab73d0f9dad5e6c61693217b8ee270cb130c6696d9af5c0a9aa450027ecc19c9d2e4fa02a447139970a27c1dfae536365da6bf810d9bf30a90bdea6e8c41a5eb96f4a0cb7e83bd442b7f0c3f7b09ecc4fbf2a5c14bb1321e7f71aee96bb3aecc13393fb18f4e6766ddace205ce8f21b61cb3a635f49e736721d1072bcfa5fe754f924e2fcf96cdb742a038ad8a800192dcafc1af2212725"}}) getgroups(0x2, &(0x7f0000000000)=[0xffffffffffffffff, 0xee00]) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000540)={0x0, @local, @initdev}, &(0x7f0000000180)=0xc) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0xb, 0x80000, 0x4274) sendmsg$nl_route_sched(r8, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r5, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x14) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES64=0x0, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) 1.084634813s ago: executing program 0 (id=1193): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x8100, 0x0, 0x4010}, 0x2800804c) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'lo\x00', 0x0}) socket(0x23, 0x1, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv6_newaddr={0x40, 0x14, 0x9535393fea6295b5, 0x70bd27, 0x25dfdbff, {0xa, 0x17, 0x0, 0xff, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IFA_CACHEINFO={0x14, 0x6, {0x0, 0x94a, 0x8001, 0x6}}]}, 0x40}, 0x1, 0x0, 0x0, 0x2004c040}, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r3, 0x0, 0x8001, 0xd) 911.894887ms ago: executing program 1 (id=1194): fsopen(&(0x7f0000000300)='debugfs\x00', 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) syz_open_dev$vim2m(&(0x7f0000000140), 0x2, 0x2) socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) r1 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000002c0), 0x200000, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @private=0xa0100ff}, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x36}}, {0x2, 0x4e24, @rand_addr=0x64010100}, 0x1e3, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x7, 0xb, 0x20}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r1], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r2, &(0x7f0000000000), 0xd) 865.288628ms ago: executing program 1 (id=1195): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4008004}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r3, {0x10}, {}, {0xe, 0x1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x200000, 0xe, 0x7, 0x7, 0x9, 0x40, 0xffffffff, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040098}, 0x4000) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000002980)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {0x10}, {0x0, 0xfff1}, {0x2, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x0, 0x9, 0x0, 0xba64, 0x8, 0xd0f, 0x6, 0x9, 0xc16, 0x56, 0x1, 0x400000, 0x80000001, 0x8, 0x4, 0x1, 0x3ff, 0x4, 0x1, 0x2, 0x6, 0x0, 0x5, 0x9, 0x2, 0x8, 0x2, 0x525, 0x826e, 0x1, 0x2, 0x2108, 0x468b, 0x3, 0x7f, 0x9, 0xe36, 0x1, 0x1, 0xf, 0x0, 0x7, 0x6311, 0xb, 0x6, 0x3cd, 0x2e, 0x7, 0x4, 0x8, 0x4, 0xfffffffe, 0x4, 0x0, 0x81, 0x4, 0xf1, 0x7, 0x1000, 0x1000, 0x2, 0x8, 0x7, 0x4, 0x2, 0x8000, 0x0, 0x8, 0x39, 0x6, 0x5, 0x100, 0x9, 0xb427, 0xfffffffe, 0x3, 0x7, 0x2, 0x80000001, 0xf, 0x3, 0x0, 0xdfa9, 0x2, 0x4, 0x8, 0xfffffffe, 0x8fa, 0x4, 0x6, 0x6, 0x6, 0xffffffff, 0x7, 0x2, 0x165, 0xed, 0x400, 0x7c8, 0x5, 0x6, 0x9, 0x6, 0xd, 0xd, 0x0, 0x3, 0x1000, 0x5, 0x0, 0xc, 0x5, 0x7337, 0x2, 0xff, 0x1, 0x38000000, 0xe, 0x4, 0x1, 0x48, 0x0, 0x5, 0x1, 0x2, 0xd, 0x6795, 0xb, 0x9, 0x7, 0x495, 0x200, 0x8, 0x7, 0x1ff, 0x0, 0x8, 0x9, 0x1, 0x4, 0x3, 0x7, 0x0, 0x4, 0x80000000, 0x0, 0x5, 0x6a8, 0xc1, 0x0, 0x81, 0xc30, 0xffff01ad, 0x8, 0x401, 0x5, 0x3, 0x7f, 0x9, 0x3, 0x7, 0x0, 0x9, 0x3, 0x79c0000, 0x3, 0x5, 0x100, 0x4, 0x8, 0xb535, 0x80, 0x32200, 0x9, 0x89c, 0xb3, 0x10, 0x7, 0x1, 0x3, 0xf, 0xc4e0, 0x89, 0x7, 0x9, 0xfffffffd, 0x9, 0xfffffff8, 0x4, 0x9, 0x7, 0x8, 0xe, 0xfffffffb, 0x739, 0x1ff, 0x4, 0x1, 0x5, 0x6, 0x5, 0x1629c76a, 0x40, 0x9, 0x8, 0x100, 0x1000, 0x8, 0x44, 0xe, 0x5, 0x289, 0x0, 0x3, 0x200, 0x4a5, 0x2, 0x2, 0x3, 0x1000, 0x2, 0x10, 0xfffffffa, 0x4, 0x1, 0x9, 0x2, 0x5, 0x7fffffff, 0xfffffffe, 0x1000, 0x407, 0x80, 0x1ff, 0x60e, 0x5, 0x1, 0xffff, 0x1, 0x0, 0xfffffff7, 0x358, 0x274, 0x7, 0x8, 0x4, 0x40, 0x4, 0x8, 0x8, 0x3, 0x7, 0x8000, 0x6a4b, 0x7, 0x5]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0xb3538085985bb3d6}, 0x0) 299.501322ms ago: executing program 4 (id=1196): seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x1, &(0x7f0000000140)={0x0, 0x0}) utime(0x0, 0x0) r0 = socket$inet(0x2, 0x802, 0x1) write(r0, &(0x7f0000000080)="08008edf", 0x4) r1 = openat$tcp_congestion(0xffffffffffffff9c, 0x0, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) symlink(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='./config/usb_gadget/g1/functions/hid.usb0\x00') r2 = syz_open_procfs(0x0, 0x0) syz_open_pts(r2, 0x8000) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000600)={0x0, {{0xa, 0xffff, 0x0, @mcast1={0xff, 0x7}, 0x80020000}}, {{0xa, 0x4e22, 0x0, @empty}}}, 0x108) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000e80)='/sys/power/pm_freeze_timeout', 0x101a82, 0x100) copy_file_range(r4, &(0x7f0000000040)=0x8000000000000007, r4, 0x0, 0xb, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2b, &(0x7f0000000200)={0x80000000, {{0xa, 0x0, 0x20000000, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) ioctl$sock_TIOCOUTQ(r4, 0x5411, &(0x7f0000000340)) r5 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x1, 0x1ff) write(r5, &(0x7f0000001000)='8', 0x1) ioctl$XFS_IOC_FSGROWFSLOG(r1, 0x4008586f, &(0x7f00000000c0)={0x0, 0x2}) 230.749224ms ago: executing program 3 (id=1197): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$tipc(0x1e, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a80)=@newtfilter={0xb4, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {}, {0x8, 0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x80, 0x2, [@TCA_MATCHALL_ACT={0x7c, 0x2, [@m_tunnel_key={0x78, 0x1, 0x0, 0x0, {{0xf}, {0x48, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @empty}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @remote}}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x3, 0x8, 0x4, 0x7fff, 0x7}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}}]}, 0xb4}, 0x1, 0x0, 0x0, 0x8080}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, 0x0, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000000)="27030200000214000e00002fb96dffff1144ee163cddcb000000800000827600000000000000", 0x26}, {&(0x7f00000004c0)="f058050000007f8f", 0x300}], 0x2}, 0x5) 139.921827ms ago: executing program 0 (id=1198): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x8e40, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x4}}]}, 0x30}}, 0x20040084) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x1, 0x4], 0x3, [0xb, 0x3, 0x1, 0x2002, 0x1, 0x4, 0x2, 0xd09, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x2, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x3ff, 0x2, 0xc, 0x42, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r8, {0x4}, {0xffff}, {0x2, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x9, 0x0, 0xf, 0x10, 0x2, 0x6, 0x2, 0x8, 0x2, 0x0, 0x1, 0x8, 0x1, 0xd, 0x4], 0x3, [0xc, 0x101, 0x7fff, 0x2002, 0x1, 0x4, 0x8, 0xd03, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x7, 0x2a, 0x401, 0x2, 0xc, 0x40, 0xfff9, 0x3, 0x4]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r9, 0x0, 0x0, 0x48040, &(0x7f00000001c0)={0x11, 0x7, r8, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) 139.404957ms ago: executing program 1 (id=1199): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x8000, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x60) syz_emit_ethernet(0x9e, &(0x7f00000000c0)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaaaa86dd6000000000683afffe8000000000000000000000000000aaff020000000000000000000000000001860090780000040000000000000000000309bd3e6d4706598080a8030037ffffff0100000024732472eefa45ad96000000008e254c1e4a8a8b3f0ab0c430d3be27df3e34116db7f91149590d42ca0a5c15b37aaf030200010000000500000000260004003da5633d"], 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000280)='./binderfs2/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$XFS_IOC_GET_RESBLKS(r1, 0x80105873, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x1, 0x0, 0x0}) r4 = dup3(r3, r3, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) capget(&(0x7f0000000100)={0x20080522}, 0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f0000000580)) r6 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGIDLE(r5, 0x8010743f, 0x0) connect$pppoe(r6, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCGPROP(r7, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSFLAGS1(r7, 0x4004743a, &(0x7f0000000300)) ioctl$PPPIOCGCHAN(r6, 0x80047437, &(0x7f0000001f00)) sendmmsg(r6, &(0x7f0000001d00)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000007c0)="0281", 0x2}], 0x1}}], 0x1, 0x24005805) 86.420708ms ago: executing program 4 (id=1200): r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0x6, 0x1, 0x7fff, 0x1, 0x4, 0x5, 0xcc26, 0xffb, 0x5, 0xb69, 0xc1, 0x81, 0x1, 0x3, 0x80000001, 0xa1, 0xffc, 0x9, 0x701, 0x3, 0x40001, 0xfffffffa, 0x8000004, 0x6, 0x9, 0x12000004, 0x7, 0x5, 0x5, 0x762, 0x3, 0xd, 0xe, 0x2b12, 0xb6, 0x6, 0x1c00, 0xb, 0x8, 0xbed4, 0x2000008, 0x8000100, 0x3, 0x0, 0x8, 0x8, 0x5, 0x79b, 0x2, 0x1, 0x5, 0x4, 0x7, 0x7, 0x10, 0x57df5d62, 0xdb, 0x1fa0860a, 0x7, 0x2a, 0x81, 0x2, 0x180001, 0x4007, 0x80002, 0x2, 0x2af, 0xf7, 0x5, 0x2, 0x6, 0x6, 0x4, 0x7, 0x4009, 0x0, 0x4, 0x0, 0x401, 0x752, 0x3, 0x3, 0x0, 0x10001, 0x2, 0x0, 0x6, 0x6, 0x3, 0x80000000, 0xfe000000, 0x5a3, 0x2, 0x84, 0x100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x4005, 0x2, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x6, 0x2, 0x5, 0x8, 0x7, 0x4, 0x2, 0x40, 0x8, 0x4, 0x4, 0x401, 0x66cd, 0x8, 0x8000, 0x2008d9f, 0x1fc, 0x3, 0x4]}}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.stat\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000200)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x4, 0x4, 0x3a0, 0xffffffff, 0xf0, 0x0, 0x0, 0xfeffffff, 0xffffffff, 0x318, 0x318, 0x318, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x2f2, 0xa8, 0xf0}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00', 0x1, 0x35, {0x3}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00', 0x1, 0x3d, {0x6}}}}, {{@ipv6={@private0, @loopback, [0xff, 0x0, 0xff000000, 0xff000000], [0x0, 0xff, 0xff000000, 0xffffff00], 'team0\x00', 'batadv_slave_0\x00', {0xff}, {}, 0xff, 0xe7, 0x4, 0x44}, 0x0, 0xa8, 0xf0}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00', 0x0, 0x2, {0x7}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x400) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) read$FUSE(r0, &(0x7f0000004800)={0x2020}, 0x2020) 6.456489ms ago: executing program 1 (id=1201): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@newtfilter={0x30, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xa, 0x1}, {0x1}, {0xf, 0x4}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x0) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FD_FRAMES(r5, 0x65, 0x5, 0x0, 0x0) sendmsg$can_raw(r5, &(0x7f0000000000)={&(0x7f00000000c0), 0x10, &(0x7f00000003c0)={&(0x7f0000000200)=@can={{0x0, 0x1, 0x1}, 0x1, 0x3, 0x0, 0x0, "0000000000000005"}, 0x10}, 0x2, 0x0, 0x0, 0x24000884}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) getrlimit(0xa, 0x0) read(r6, &(0x7f00000000c0), 0x3) ioctl$KVM_CREATE_VM(r0, 0xae03, 0x62) 0s ago: executing program 0 (id=1202): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x1, 0x0) write(r0, &(0x7f0000000000)='44100,4', 0x7) symlinkat(&(0x7f0000000500)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, &(0x7f00000005c0)='usbip-vudc.0', 0xc) kernel console output (not intermixed with test programs): Enabling of bearer rejected, failed to enable media [ 129.054713][ T4938] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 129.300628][ T4977] lo speed is unknown, defaulting to 1000 [ 129.306732][ T4977] lo speed is unknown, defaulting to 1000 [ 129.313910][ T4977] lo speed is unknown, defaulting to 1000 [ 129.322371][ T4977] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 129.332547][ T4977] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 129.352556][ T4977] lo speed is unknown, defaulting to 1000 [ 129.359292][ T4977] lo speed is unknown, defaulting to 1000 [ 129.365504][ T4977] lo speed is unknown, defaulting to 1000 [ 129.371736][ T4977] lo speed is unknown, defaulting to 1000 [ 129.377953][ T4977] lo speed is unknown, defaulting to 1000 [ 129.925067][ T4981] binder_alloc: 4978: binder_alloc_buf, no vma [ 130.953517][ T4990] program syz.3.153 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 131.874733][ T26] audit: type=1326 audit(1786178300.327:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4991 comm="syz.1.172" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efdc80700d9 code=0x7ffc0000 [ 131.899593][ T26] audit: type=1326 audit(1786178300.327:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4991 comm="syz.1.172" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efdc80700d9 code=0x7ffc0000 [ 131.923940][ T26] audit: type=1326 audit(1786178300.347:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4991 comm="syz.1.172" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efdc80700d9 code=0x7ffc0000 [ 131.967167][ T26] audit: type=1326 audit(1786178300.347:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4991 comm="syz.1.172" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efdc80700d9 code=0x7ffc0000 [ 132.850268][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.077735][ T5003] tipc: Enabling of bearer rejected, failed to enable media [ 133.106381][ T26] audit: type=1326 audit(1786178300.347:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4991 comm="syz.1.172" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efdc80700d9 code=0x7ffc0000 [ 134.193026][ T26] audit: type=1326 audit(1786178300.357:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4991 comm="syz.1.172" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7efdc80700d9 code=0x7ffc0000 [ 135.472525][ T26] audit: type=1326 audit(1786178300.357:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4991 comm="syz.1.172" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efdc80700d9 code=0x7ffc0000 [ 135.497841][ T26] audit: type=1326 audit(1786178300.357:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4991 comm="syz.1.172" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efdc80700d9 code=0x7ffc0000 [ 135.523021][ T26] audit: type=1326 audit(1786178300.367:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4991 comm="syz.1.172" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efdc80700d9 code=0x7ffc0000 [ 135.547461][ T26] audit: type=1326 audit(1786178300.367:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4991 comm="syz.1.172" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efdc80700d9 code=0x7ffc0000 [ 136.801420][ T5031] can: request_module (can-proto-3) failed. [ 137.732228][ T13] nvmet: connect request for invalid subsystem nqn.2014-! [ 137.744371][ T5049] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-" [ 137.766092][ T2288] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 137.864354][ T5041] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 138.746706][ T5063] device syzkaller0 entered promiscuous mode [ 138.818944][ T2288] usb 1-1: Using ep0 maxpacket: 8 [ 139.016752][ T2288] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 139.348420][ T2288] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 139.358086][ T2288] usb 1-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 139.390545][ T5072] sctp: [Deprecated]: syz.4.188 (pid 5072) Use of int in max_burst socket option deprecated. [ 139.390545][ T5072] Use struct sctp_assoc_value instead [ 139.420741][ T5073] tipc: Enabling of bearer rejected, failed to enable media [ 139.540620][ T2288] usb 1-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 139.582797][ T2288] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 139.618519][ T2288] usb 1-1: Product: syz [ 139.634908][ T2288] usb 1-1: Manufacturer: syz [ 139.861165][ T2288] usb 1-1: SerialNumber: syz [ 141.071840][ T2288] snd-usb-audio: probe of 1-1:1.0 failed with error -22 [ 141.454486][ T2288] snd-usb-audio: probe of 1-1:1.1 failed with error -22 [ 141.471446][ T2288] usb 1-1: USB disconnect, device number 3 [ 141.501222][ T4175] udevd[4175]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 141.636058][ T5104] loop3: detected capacity change from 0 to 8192 [ 141.774868][ T5109] device syzkaller0 entered promiscuous mode [ 142.739988][ T5118] program syz.3.197 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 142.758972][ T5118] netlink: 28 bytes leftover after parsing attributes in process `syz.3.197'. [ 144.560914][ T5122] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 144.594767][ T5122] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 144.703304][ T5134] rt1711h 0-004e: check vid/pid fail [ 144.709259][ T5134] rt1711h: probe of 0-004e failed with error -5 [ 144.718093][ T5134] i2c i2c-0: new_device: Instantiated device rt1711h at 0x4e [ 145.571318][ T4231] Bluetooth: hci2: command 0x0405 tx timeout [ 145.577614][ T5122] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 145.609285][ T5122] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 145.797047][ T5122] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 146.659464][ T5122] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 146.699739][ T5122] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 147.386108][ T4231] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 147.590153][ T7] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 147.746224][ T4231] usb 4-1: config 8 has an invalid interface number: 223 but max is 0 [ 147.754435][ T4231] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 147.845784][ T2288] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 147.885441][ T4231] usb 4-1: config 8 has no interface number 0 [ 147.893758][ T4231] usb 4-1: config 8 interface 223 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 148.796194][ T4231] usb 4-1: New USB device found, idVendor=a6eb, idProduct=7458, bcdDevice=2d.4d [ 148.816146][ T2288] usb 1-1: Using ep0 maxpacket: 16 [ 148.836368][ T7] usb 5-1: unable to get BOS descriptor or descriptor too short [ 148.846191][ T4231] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 148.882073][ T4231] usb 4-1: Product: syz [ 148.916773][ T7] usb 5-1: not running at top speed; connect to a high speed hub [ 148.946009][ T4231] usb 4-1: Manufacturer: syz [ 148.983385][ T4231] usb 4-1: SerialNumber: syz [ 149.116453][ T2288] usb 1-1: unable to get BOS descriptor or descriptor too short [ 149.156806][ T7] usb 5-1: config 243 has an invalid interface number: 55 but max is 0 [ 149.671825][ T2288] usb 1-1: config 3 has an invalid interface number: 165 but max is 1 [ 149.741003][ T7] usb 5-1: config 243 has no interface number 0 [ 149.925158][ T2288] usb 1-1: config 3 has no interface number 0 [ 149.931730][ T7] usb 5-1: config 243 interface 55 has no altsetting 0 [ 149.939120][ T2288] usb 1-1: config 3 interface 1 has no altsetting 0 [ 150.048206][ T2288] usb 1-1: config 3 interface 165 has no altsetting 0 [ 150.056422][ T7] usb 5-1: string descriptor 0 read error: -71 [ 150.062675][ T7] usb 5-1: New USB device found, idVendor=0458, idProduct=7004, bcdDevice=a9.bc [ 150.099678][ T5237] loop4: detected capacity change from 0 to 2048 [ 150.112243][ T5238] tipc: Enabled bearer , priority 0 [ 150.119578][ T5232] loop2: detected capacity change from 0 to 1024 [ 150.123344][ T7] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.135798][ T5238] device syzkaller0 entered promiscuous mode [ 150.150127][ T13] usb 4-1: USB disconnect, device number 2 [ 150.163269][ T5233] tipc: Resetting bearer [ 150.186684][ T7] usb 5-1: can't set config #243, error -71 [ 150.199341][ T5237] UDF-fs: warning (device loop4): udf_fill_super: No fileset found [ 150.201103][ T7] usb 5-1: USB disconnect, device number 2 [ 150.247456][ T5233] tipc: Disabling bearer [ 150.277135][ T2288] usb 1-1: New USB device found, idVendor=19d2, idProduct=0012, bcdDevice= 0.a9 [ 150.286806][ T2288] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.295253][ T2288] usb 1-1: Product: syz [ 150.457419][ T2288] usb 1-1: Manufacturer: syz [ 150.462075][ T2288] usb 1-1: SerialNumber: syz [ 150.519686][ T2288] usb 1-1: can't set config #3, error -71 [ 150.639066][ T5246] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 150.654783][ T5246] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 150.671752][ T5246] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 150.716950][ T2288] usb 1-1: USB disconnect, device number 4 [ 150.773190][ T5246] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 150.939741][ T5246] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 151.385501][ T5254] loop3: detected capacity change from 0 to 8 [ 151.413522][ T5232] hfsplus: failed to load extents file [ 151.442716][ T5246] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 151.456183][ T2288] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 151.471428][ T5246] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 151.475940][ T5256] mmap: syz.1.224 (5256) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 151.572736][ T5259] loop3: detected capacity change from 0 to 2048 [ 151.642577][ T5259] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 151.669631][ T5259] UDF-fs: error (device loop3): udf_read_inode: (ino 1376) failed !bh [ 151.680606][ T5259] UDF-fs: error (device loop3): udf_fill_super: Error in udf_iget, block=64, partition=0 [ 151.712506][ T5264] loop4: detected capacity change from 0 to 8 [ 151.794565][ T5264] SQUASHFS error: zlib decompression failed, data probably corrupt [ 151.818384][ T5264] SQUASHFS error: Failed to read block 0x9b: -5 [ 151.835378][ T5264] SQUASHFS error: Unable to read metadata cache entry [99] [ 151.853583][ T5266] device syzkaller0 entered promiscuous mode [ 151.860150][ T2288] usb 1-1: config 3 has an invalid interface number: 138 but max is 0 [ 151.863108][ T5264] SQUASHFS error: Unable to read inode 0x127 [ 151.896613][ T5269] device syzkaller0 entered promiscuous mode [ 151.931464][ T2288] usb 1-1: config 3 has no interface number 0 [ 151.944887][ T2288] usb 1-1: config 3 interface 138 has no altsetting 0 [ 152.206870][ T2288] usb 1-1: New USB device found, idVendor=13d3, idProduct=3346, bcdDevice=fc.f7 [ 152.271443][ T2288] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 152.407868][ T2288] usb 1-1: Product: syz [ 152.485157][ T2288] usb 1-1: Manufacturer: syz [ 152.586438][ T2288] usb 1-1: SerialNumber: syz [ 152.660856][ T5273] loop2: detected capacity change from 0 to 8 [ 152.693969][ T5275] loop4: detected capacity change from 0 to 128 [ 152.753698][ T5275] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 152.843105][ T26] kauditd_printk_skb: 39 callbacks suppressed [ 152.843118][ T26] audit: type=1800 audit(1786178321.297:54): pid=5275 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.232" name="file2" dev="loop4" ino=95 res=0 errno=0 [ 152.902530][ T2288] usb 1-1: ath9k_htc: Device endpoint numbers are not the expected ones [ 152.935854][ T2288] usb 1-1: USB disconnect, device number 5 [ 153.054027][ T5273] SQUASHFS error: Unable to read inode 0x11f [ 153.705603][ T5292] loop0: detected capacity change from 0 to 164 [ 153.872864][ T5299] loop3: detected capacity change from 0 to 256 [ 153.893234][ T5299] exfat: Deprecated parameter 'namecase' [ 153.912871][ T5299] exfat: Deprecated parameter 'namecase' [ 153.970297][ T5299] exFAT-fs (loop3): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 154.015685][ T5306] loop4: detected capacity change from 0 to 2048 [ 154.096723][ T5306] UDF-fs: error (device loop4): udf_process_sequence: Primary Volume Descriptor not found! [ 154.259676][ T5314] hfsplus: invalid extent btree flag [ 154.275458][ T5314] hfsplus: failed to load extents file [ 154.312791][ T5319] MTD: Attempt to mount non-MTD device "/dev/loop4" [ 154.362207][ T5319] cramfs: unsupported filesystem features [ 154.434882][ T5318] EXT4-fs (loop0): mounted filesystem without journal. Opts: journal_ioprio=0x0000000000000003,nogrpid,quota,,errors=continue. Quota mode: writeback. [ 154.464841][ T5318] ext4 filesystem being mounted at /49/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 154.545303][ T5330] device syzkaller0 entered promiscuous mode [ 154.749297][ T5335] device syzkaller0 entered promiscuous mode [ 155.105620][ T5353] ntfs: (device loop4): check_mft_mirror(): $MFT and $MFTMirr (record 1) do not match. Run ntfsfix or chkdsk. [ 155.161678][ T5353] ntfs: (device loop4): load_system_files(): $MFTMirr does not match $MFT. Mounting read-only. Run ntfsfix and/or chkdsk. [ 155.176075][ T5359] netlink: 'syz.0.262': attribute type 1 has an invalid length. [ 155.198243][ T5359] netlink: 'syz.0.262': attribute type 3 has an invalid length. [ 155.213828][ T5359] netlink: 224 bytes leftover after parsing attributes in process `syz.0.262'. [ 155.224469][ T5353] ntfs: (device loop4): ntfs_read_locked_inode(): First extent of $DATA attribute has non zero lowest_vcn. [ 155.263990][ T5359] NCSI netlink: No device for ifindex 2986344450 [ 155.276136][ T5353] ntfs: (device loop4): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0xa as bad. Run chkdsk. [ 155.312473][ T5349] EXT4-fs (loop3): Test dummy encryption mode enabled [ 155.346233][ T5353] ntfs: (device loop4): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 155.360202][ T5349] EXT4-fs (loop3): mounted filesystem without journal. Opts: test_dummy_encryption,grpquota,,errors=continue. Quota mode: writeback. [ 155.398116][ T5353] ntfs: volume version 3.1. [ 155.475331][ T5353] ntfs: (device loop4): ntfs_check_logfile(): Did not find any restart pages in $LogFile and it was not empty. [ 155.529182][ T5353] ntfs: (device loop4): load_system_files(): Failed to load $LogFile. Will not be able to remount read-write. Mount in Windows. [ 155.551253][ T5353] ntfs: (device loop4): ntfs_lookup_inode_by_name(): Index entry out of bounds in directory inode 0x5. [ 155.601541][ T5353] ntfs: (device loop4): check_windows_hibernation_status(): Failed to find inode number for hiberfil.sys. [ 155.679935][ T5376] set_capacity_and_notify: 9 callbacks suppressed [ 155.679949][ T5376] loop3: detected capacity change from 0 to 2048 [ 155.715107][ T5374] loop0: detected capacity change from 0 to 4096 [ 155.798790][ T5376] EXT4-fs (loop3): mounted filesystem without journal. Opts: min_batch_time=0x000000000000000d,mb_optimize_scan=0x0000000000000001,noblock_validity,,errors=continue. Quota mode: none. [ 155.815380][ T5384] loop2: detected capacity change from 0 to 512 [ 156.042830][ T5389] loop4: detected capacity change from 0 to 1024 [ 156.058120][ T5387] device syzkaller0 entered promiscuous mode [ 156.129373][ T5389] hfsplus: invalid length 32517 has been corrected to 255 [ 156.174891][ T5389] hfsplus: invalid length 32517 has been corrected to 255 [ 156.186894][ T5389] hfsplus: invalid length 32517 has been corrected to 255 [ 156.195335][ T5389] hfsplus: invalid length 32517 has been corrected to 255 [ 156.262683][ T5213] hfsplus: b-tree write err: -5, ino 4 [ 156.295037][ T5213] hfsplus: b-tree write err: -5, ino 2 [ 156.304774][ T5384] EXT4-fs (loop2): Ignoring removed oldalloc option [ 156.395743][ T5400] device syzkaller0 entered promiscuous mode [ 156.658467][ T5423] loop4: detected capacity change from 0 to 512 [ 156.702988][ T5423] EXT4-fs (loop4): Ignoring removed orlov option [ 156.715672][ T5384] EXT4-fs (loop2): mounted filesystem without journal. Opts: nolazytime,dioread_lock,oldalloc,block_validity,,errors=continue. Quota mode: writeback. [ 156.723996][ T5423] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 156.736061][ T2288] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 156.790244][ T5428] device syzkaller0 entered promiscuous mode [ 156.814483][ T5423] EXT4-fs error (device loop4): ext4_ext_check_inode:501: inode #16: comm syz.4.286: pblk 0 bad header/extent: invalid magic - magic 0, entries 0, max 28(0), depth 0(0) [ 156.862282][ T5423] EXT4-fs error (device loop4): ext4_orphan_get:1411: comm syz.4.286: couldn't read orphan inode 16 (err -117) [ 156.880202][ T5423] EXT4-fs (loop4): 1 orphan inode deleted [ 156.887846][ T5423] EXT4-fs (loop4): mounted filesystem without journal. Opts: norecovery,nombcache,debug_want_extra_isize=0x000000000000002a,stripe=0x0000000000000004,orlov,lazytime,,errors=continue. Quota mode: none. [ 157.017233][ T2288] usb 4-1: Using ep0 maxpacket: 16 [ 157.113758][ T5443] XFS (nullb0): Invalid superblock magic number [ 157.169332][ T2288] usb 4-1: config 8 has an invalid interface number: 145 but max is 1 [ 157.178262][ T2288] usb 4-1: config 8 has an invalid interface number: 142 but max is 1 [ 157.186844][ T2288] usb 4-1: config 8 has an invalid interface number: 142 but max is 1 [ 157.195491][ T2288] usb 4-1: config 8 has no interface number 0 [ 157.201782][ T2288] usb 4-1: config 8 has no interface number 1 [ 157.208249][ T2288] usb 4-1: config 8 interface 145 altsetting 4 has an invalid endpoint with address 0x0, skipping [ 157.219031][ T2288] usb 4-1: too many endpoints for config 8 interface 142 altsetting 176: 50, using maximum allowed: 30 [ 157.230386][ T2288] usb 4-1: config 8 interface 142 altsetting 176 has 0 endpoint descriptors, different from the interface descriptor's value: 50 [ 157.247766][ T2288] usb 4-1: config 8 interface 145 has no altsetting 0 [ 157.254660][ T2288] usb 4-1: config 8 interface 142 has no altsetting 0 [ 157.261590][ T2288] usb 4-1: config 8 interface 142 has no altsetting 1 [ 157.383394][ T5462] device syzkaller0 entered promiscuous mode [ 157.624370][ T5478] device syzkaller0 entered promiscuous mode [ 157.636378][ T2288] usb 4-1: New USB device found, idVendor=066f, idProduct=8000, bcdDevice= 0.01 [ 157.654158][ T2288] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.704061][ T2288] usb 4-1: Product: syz [ 157.734550][ T5485] device syzkaller0 entered promiscuous mode [ 157.736000][ T2288] usb 4-1: Manufacturer: syz [ 157.745749][ T2288] usb 4-1: SerialNumber: syz [ 157.871541][ T5489] device syzkaller0 entered promiscuous mode [ 158.034126][ T5499] loop0: detected capacity change from 0 to 512 [ 158.107548][ T2288] usb-storage 4-1:8.145: USB Mass Storage device detected [ 158.177979][ T2288] usb-storage 4-1:8.145: Quirks match for vid 066f pid 8000: 10 [ 158.286684][ T2288] usb-storage 4-1:8.142: USB Mass Storage device detected [ 158.329507][ T2288] usb-storage 4-1:8.142: Quirks match for vid 066f pid 8000: 10 [ 158.408656][ T2288] usb 4-1: USB disconnect, device number 3 [ 158.517969][ T5512] loop0: detected capacity change from 0 to 1756 [ 158.584234][ T5512] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 158.599041][ T5512] UDF-fs: Scanning with blocksize 512 failed [ 158.642450][ T5512] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 158.660447][ T5512] UDF-fs: Scanning with blocksize 1024 failed [ 158.696062][ T5512] UDF-fs: INFO Mounting volume 'CDROM', timestamp 2022/11/22 15:59 (1000) [ 158.715914][ T5519] device syzkaller0 entered promiscuous mode [ 158.838653][ T5515] device syzkaller0 entered promiscuous mode [ 158.850126][ T5526] loop0: detected capacity change from 0 to 512 [ 158.889290][ T5526] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 158.922012][ T5526] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (35405!=33349) [ 158.938944][ T5506] loop4: detected capacity change from 0 to 40427 [ 158.963707][ T5526] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a00ec018, mo2=0002] [ 158.973566][ T5526] System zones: 1-12 [ 158.980114][ T5526] EXT4-fs (loop0): orphan cleanup on readonly fs [ 158.991715][ T5526] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:510: comm syz.0.323: Block bitmap for bg 0 marked uninitialized [ 159.024367][ T5526] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:510: comm syz.0.323: Block bitmap for bg 0 marked uninitialized [ 159.048651][ T5506] F2FS-fs (loop4): Found nat_bits in checkpoint [ 159.087286][ T5526] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:510: comm syz.0.323: Block bitmap for bg 0 marked uninitialized [ 159.162038][ T5526] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2809: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 159.221468][ T5526] EXT4-fs (loop0): 1 truncate cleaned up [ 159.241771][ T5526] EXT4-fs (loop0): mounted filesystem without journal. Opts: jqfmt=vfsv1,jqfmt=vfsv0,debug_want_extra_isize=0x0000000000000068,debug,data=journal,quota,nolazytime,,errors=continue. Quota mode: writeback. [ 159.272203][ T5506] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 159.352328][ T4192] attempt to access beyond end of device [ 159.352328][ T4192] loop4: rw=2049, want=45104, limit=40427 [ 159.597990][ T5537] loop3: detected capacity change from 0 to 32768 [ 159.680514][ T5537] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop3 scanned by syz.3.325 (5537) [ 159.796494][ T5537] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 159.811430][ T5537] BTRFS info (device loop3): enabling auto defrag [ 159.822397][ T5537] BTRFS info (device loop3): force clearing of disk cache [ 159.844096][ T5537] BTRFS info (device loop3): max_inline at 485 [ 159.850589][ T5537] BTRFS info (device loop3): disabling free space tree [ 159.858036][ T5537] BTRFS info (device loop3): has skinny extents [ 160.138131][ T5566] device syzkaller0 entered promiscuous mode [ 160.309429][ T5537] BTRFS info (device loop3): enabling ssd optimizations [ 160.392741][ T5537] BTRFS info (device loop3): clearing free space tree [ 160.400470][ T5537] BTRFS info (device loop3): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 160.429939][ T5537] BTRFS info (device loop3): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 160.619637][ T5605] device vlan2 entered promiscuous mode [ 160.632740][ T5605] device wlan1 entered promiscuous mode [ 161.024785][ T5626] netlink: 'syz.4.350': attribute type 15 has an invalid length. [ 161.047180][ T5626] netlink: 'syz.4.350': attribute type 7 has an invalid length. [ 161.065123][ T5626] netlink: 52 bytes leftover after parsing attributes in process `syz.4.350'. [ 161.131245][ T5607] set_capacity_and_notify: 2 callbacks suppressed [ 161.131259][ T5607] loop0: detected capacity change from 0 to 32768 [ 161.203933][ T5607] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 scanned by syz.0.347 (5607) [ 161.247606][ T5607] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 161.262540][ T5607] BTRFS info (device loop0): force clearing of disk cache [ 161.270013][ T5607] BTRFS info (device loop0): force zlib compression, level 3 [ 161.286902][ T5607] BTRFS info (device loop0): disabling free space tree [ 161.293987][ T5607] BTRFS info (device loop0): max_inline at 0 [ 161.310748][ T5607] BTRFS info (device loop0): enabling free space tree [ 161.332896][ T5607] BTRFS info (device loop0): using free space tree [ 161.342438][ T5607] BTRFS info (device loop0): has skinny extents [ 161.702977][ T5671] loop4: detected capacity change from 0 to 128 [ 161.808569][ T5607] BTRFS info (device loop0): enabling ssd optimizations [ 161.979475][ T5671] EXT4-fs (loop4): quotafile must be on filesystem root [ 162.576371][ T5621] loop2: detected capacity change from 0 to 32768 [ 162.868927][ T5621] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.345 (5621) [ 163.221143][ T5737] loop3: detected capacity change from 0 to 128 [ 163.225567][ T5733] loop4: detected capacity change from 0 to 1024 [ 163.360615][ T5737] FAT-fs (loop3): Directory bread(block 162) failed [ 163.380521][ T5733] EXT4-fs (loop4): Ignoring removed bh option [ 163.386038][ T5737] FAT-fs (loop3): Directory bread(block 163) failed [ 163.406858][ T5737] FAT-fs (loop3): Directory bread(block 164) failed [ 163.416287][ T5737] FAT-fs (loop3): Directory bread(block 165) failed [ 163.422920][ T5737] FAT-fs (loop3): Directory bread(block 166) failed [ 163.481158][ T5733] EXT4-fs (loop4): mounted filesystem without journal. Opts: nojournal_checksum,nombcache,barrier,norecovery,debug_want_extra_isize=0x0000000000000080,lazytime,nodelalloc,usrquota,noauto_da_alloc,bh,init_itable,,errors=continue. Quota mode: writeback. [ 163.499316][ T5737] FAT-fs (loop3): Directory bread(block 167) failed [ 163.522452][ T5737] FAT-fs (loop3): Directory bread(block 168) failed [ 163.529750][ T5737] FAT-fs (loop3): Directory bread(block 169) failed [ 163.536844][ T5737] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 163.565051][ T5737] FAT-fs (loop3): Directory bread(block 162) failed [ 163.586118][ T5737] FAT-fs (loop3): Directory bread(block 163) failed [ 163.676089][ T5621] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 163.685352][ T5621] BTRFS info (device loop2): use zlib compression, level 3 [ 163.704044][ T5621] BTRFS info (device loop2): using free space tree [ 163.743379][ T5621] BTRFS info (device loop2): has skinny extents [ 163.796142][ T1110] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 163.976364][ T2288] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 164.070334][ T1110] usb 1-1: Using ep0 maxpacket: 16 [ 164.119341][ T5778] tipc: Enabled bearer , priority 0 [ 164.129871][ T5778] tipc: Resetting bearer [ 164.138519][ T5776] tipc: Disabling bearer [ 164.216191][ T1110] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 164.227849][ T2288] usb 5-1: Using ep0 maxpacket: 8 [ 164.248720][ T1110] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 164.268213][ T1110] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 164.289264][ T1110] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 164.301061][ T1110] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 164.313101][ T5792] sp0: Synchronizing with TNC [ 164.320270][ T1110] usb 1-1: config 0 descriptor?? [ 164.376390][ T2288] usb 5-1: config 0 interface 0 altsetting 183 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 164.389740][ T2288] usb 5-1: config 0 interface 0 has no altsetting 0 [ 164.396603][ T2288] usb 5-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 164.399343][ T5621] BTRFS error (device loop2): open_ctree failed: -12 [ 164.425446][ T2288] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 164.438275][ T2288] usb 5-1: config 0 descriptor?? [ 164.792864][ T1110] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 164.810339][ T1110] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 164.820358][ T1110] microsoft 0003:045E:07DA.0001: ignoring exceeding usage max [ 164.847143][ T1110] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 164.854399][ T1110] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 164.862029][ T1110] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 164.869525][ T1110] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 164.877050][ T1110] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 164.884265][ T1110] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 164.892433][ T1110] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 164.900280][ T1110] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 164.911175][ T2288] uclogic 0003:28BD:0042.0002: unknown main item tag 0x0 [ 164.919403][ T1110] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 164.927043][ T2288] uclogic 0003:28BD:0042.0002: unknown main item tag 0x0 [ 164.934174][ T1110] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 164.941710][ T2288] uclogic 0003:28BD:0042.0002: unknown main item tag 0x0 [ 164.949073][ T1110] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 164.956521][ T2288] uclogic 0003:28BD:0042.0002: unknown main item tag 0x0 [ 164.963636][ T1110] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 164.971521][ T2288] uclogic 0003:28BD:0042.0002: unknown main item tag 0x0 [ 164.978863][ T1110] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 164.979071][ T5628] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 164.986828][ T2288] uclogic 0003:28BD:0042.0002: unknown main item tag 0x0 [ 165.020329][ T2288] uclogic 0003:28BD:0042.0002: No inputs registered, leaving [ 165.031577][ T1110] input: HID 045e:07da as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:045E:07DA.0001/input/input7 [ 165.052943][ T2288] uclogic 0003:28BD:0042.0002: hidraw0: USB HID v0.00 Device [HID 28bd:0042] on usb-dummy_hcd.4-1/input0 [ 165.133323][ T1110] microsoft 0003:045E:07DA.0001: input,hidraw1: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 165.156290][ T5629] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 165.186151][ T1110] usb 1-1: USB disconnect, device number 6 [ 165.224418][ T2288] usb 5-1: USB disconnect, device number 3 [ 165.241303][ T5628] usb 4-1: Using ep0 maxpacket: 16 [ 165.264033][ T5825] fido_id[5825]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 165.376451][ T5628] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 165.387423][ T5628] usb 4-1: config 0 interface 0 has no altsetting 0 [ 165.406421][ T5629] usb 3-1: Using ep0 maxpacket: 32 [ 165.526357][ T5629] usb 3-1: config index 0 descriptor too short (expected 19, got 18) [ 165.546127][ T5628] usb 4-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 165.555472][ T5628] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.566180][ T5628] usb 4-1: Product: syz [ 165.570402][ T5628] usb 4-1: Manufacturer: syz [ 165.574999][ T5628] usb 4-1: SerialNumber: syz [ 165.584575][ T5628] usb 4-1: config 0 descriptor?? [ 166.451697][ T5629] usb 3-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 166.472367][ T5628] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input8 [ 166.484465][ C1] imon 4-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 166.593674][ T5629] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 166.606475][ T5629] usb 3-1: Product: syz [ 166.610667][ T5629] usb 3-1: Manufacturer: syz [ 166.619877][ T5629] usb 3-1: SerialNumber: syz [ 166.642132][ T5629] usb 3-1: config 0 descriptor?? [ 166.648514][ T5628] imon:send_packet: packet tx failed (-71) [ 166.666044][ T5628] imon 4-1:0.0: panel buttons/knobs setup failed [ 166.714258][ T5629] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 166.733010][ T5629] dvb-usb: bulk message failed: -22 (2/0) [ 166.776050][ T4293] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 166.786172][ T5628] rc_core: IR keymap rc-imon-pad not found [ 166.791996][ T5628] Registered IR keymap rc-empty [ 166.808433][ T5629] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 166.818674][ T5628] imon 4-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 166.830219][ T5628] imon 4-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 166.846495][ T5629] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 166.859805][ T5628] imon:send_packet: packet tx failed (-71) [ 166.869591][ T5629] usb 3-1: media controller created [ 166.886062][ T5628] imon 4-1:0.0: remote input dev register failed [ 166.893770][ T5628] imon 4-1:0.0: imon_init_intf0: rc device setup failed [ 166.902258][ T5629] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 166.968617][ T5629] usb 3-1: selecting invalid altsetting 7 [ 166.978871][ T5629] cxusb: set interface failed [ 166.986286][ T5629] dvb-usb: bulk message failed: -22 (1/0) [ 167.003806][ T5855] loop3: detected capacity change from 0 to 512 [ 167.029103][ T5628] imon 4-1:0.0: unable to initialize intf0, err 0 [ 167.044263][ T5628] imon:imon_probe: failed to initialize context! [ 167.057578][ T5628] imon 4-1:0.0: unable to register, err -19 [ 167.065557][ T5629] DVB: Unable to find symbol lgdt330x_attach() [ 167.073075][ T5629] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 167.085770][ T5628] usb 4-1: USB disconnect, device number 4 [ 167.095305][ T5810] dvb-usb: bulk message failed: -22 (3/0) [ 167.166288][ T4293] usb 5-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 167.183748][ T4293] usb 5-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 167.188310][ T5855] EXT4-fs (loop3): mounted filesystem without journal. Opts: nombcache,auto_da_alloc=0x0000000000000006,,errors=continue. Quota mode: writeback. [ 167.193233][ T4293] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.216023][ T5629] rc_core: IR keymap rc-dvico-portable not found [ 167.222385][ T5629] Registered IR keymap rc-empty [ 167.247161][ T5629] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 167.261435][ T5629] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input10 [ 167.278757][ T4293] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 167.294790][ T5629] dvb-usb: schedule remote query interval to 100 msecs. [ 167.302018][ T5629] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 167.309802][ T5855] ext4 filesystem being mounted at /71/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 167.370771][ T5629] usb 3-1: USB disconnect, device number 2 [ 167.446524][ T5867] netlink: 28 bytes leftover after parsing attributes in process `syz.1.404'. [ 167.487561][ T5867] netlink: 28 bytes leftover after parsing attributes in process `syz.1.404'. [ 167.522740][ T5629] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 167.534205][ T5870] netlink: 28 bytes leftover after parsing attributes in process `syz.1.404'. [ 167.547744][ T5870] netlink: 28 bytes leftover after parsing attributes in process `syz.1.404'. [ 167.612480][ T5855] EXT4-fs error (device loop3): ext4_xattr_block_get:543: inode #12: comm syz.3.401: corrupted xattr block 6 [ 167.634978][ T5855] overlayfs: failed to get origin (-117) [ 167.647181][ T5855] EXT4-fs error (device loop3): ext4_xattr_block_find:1857: inode #12: comm syz.3.401: corrupted xattr block 6 [ 167.680154][ T5855] overlayfs: failed to verify origin (/, ino=2, err=-117) [ 167.699029][ T5855] overlayfs: failed to verify upper root origin [ 167.929850][ T5884] tipc: Enabled bearer , priority 0 [ 167.943410][ T5884] tipc: Resetting bearer [ 167.945834][ T5885] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 [ 167.958935][ T5883] tipc: Disabling bearer [ 167.980037][ T5885] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 168.884499][ T4293] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 168.892935][ T4293] stv0680 5-1:4.0: STV(e): camera ping failed!! [ 168.956324][ T4293] stv0680 5-1:4.0: last error: 0, command = 0x0 [ 169.480863][ T4244] usb 5-1: USB disconnect, device number 4 [ 169.702103][ T5904] ODEBUG: Out of memory. ODEBUG disabled [ 170.582364][ T5915] tipc: Enabling of bearer rejected, failed to enable media [ 170.910691][ T5932] ip_tables: iptables: counters copy to user failed while replacing table [ 171.695692][ T5942] loop2: detected capacity change from 0 to 512 [ 171.760394][ T5944] loop3: detected capacity change from 0 to 256 [ 172.664703][ T5942] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 173.118985][ T5951] loop4: detected capacity change from 0 to 512 [ 173.262463][ T5951] EXT4-fs error (device loop4): ext4_xattr_inode_iget:401: comm syz.4.429: inode #1: comm syz.4.429: iget: illegal inode # [ 173.301493][ T5959] tipc: Enabling of bearer rejected, failed to enable media [ 173.341537][ T5942] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpid,barrier=0x000000000000000d,delalloc,stripe=0x0000000000000b75,data_err=ignore,jqfmt=vfsv1,grpjquota=,i_version,,errors=continue. Quota mode: writeback. [ 173.358597][ T5951] EXT4-fs error (device loop4): ext4_xattr_inode_iget:406: comm syz.4.429: error while reading EA inode 1 err=-117 [ 173.364672][ T5942] ext4 filesystem being mounted at /42/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 173.773169][ T5951] EXT4-fs (loop4): 1 orphan inode deleted [ 174.249517][ T5951] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 174.513554][ T5981] tmpfs: Unknown parameter 'grpquota_iÚrØA' [ 174.836328][ T5629] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 175.976057][ T5629] usb 5-1: unable to read config index 0 descriptor/all [ 175.989928][ T5629] usb 5-1: can't read configurations, error -71 [ 176.065499][ T6003] fuse: Unknown parameter '0xffffffffffffffff' [ 176.263497][ T6007] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[4189] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[6007] [ 176.289016][ T6007] netlink: 260 bytes leftover after parsing attributes in process `syz.1.441'. [ 176.298365][ T6007] netlink: 104 bytes leftover after parsing attributes in process `syz.1.441'. [ 176.307500][ T6007] netlink: 8 bytes leftover after parsing attributes in process `syz.1.441'. [ 176.883713][ T4203] Bluetooth: Wrong link type (-22) [ 177.167147][ T6009] configfs-gadget gadget: uvc: uvc_function_bind() [ 177.402532][ T6019] loop4: detected capacity change from 0 to 4096 [ 177.469957][ T6019] __ntfs_error: 7 callbacks suppressed [ 177.469974][ T6019] ntfs: (device loop4): check_mft_mirror(): $MFT and $MFTMirr (record 1) do not match. Run ntfsfix or chkdsk. [ 177.512113][ T6019] ntfs: (device loop4): load_system_files(): $MFTMirr does not match $MFT. Mounting read-only. Run ntfsfix and/or chkdsk. [ 177.522228][ T6030] loop0: detected capacity change from 0 to 512 [ 177.531596][ T6019] ntfs: (device loop4): ntfs_read_locked_inode(): First extent of $DATA attribute has non zero lowest_vcn. [ 177.556049][ T6019] ntfs: (device loop4): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0xa as bad. Run chkdsk. [ 177.561882][ T6031] tipc: Enabling of bearer rejected, failed to enable media [ 177.586077][ T6019] ntfs: (device loop4): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 177.608568][ T6019] ntfs: volume version 3.1. [ 177.620702][ T6019] ntfs: (device loop4): ntfs_check_logfile(): Did not find any restart pages in $LogFile and it was not empty. [ 177.642241][ T6030] EXT4-fs (loop0): Ignoring removed oldalloc option [ 177.645679][ T6019] ntfs: (device loop4): load_system_files(): Failed to load $LogFile. Will not be able to remount read-write. Mount in Windows. [ 177.724678][ T6019] ntfs: (device loop4): ntfs_lookup_inode_by_name(): Index entry out of bounds in directory inode 0x5. [ 177.735900][ T6019] ntfs: (device loop4): check_windows_hibernation_status(): Failed to find inode number for hiberfil.sys. [ 177.754073][ T6030] EXT4-fs (loop0): mounted filesystem without journal. Opts: nolazytime,dioread_lock,oldalloc,block_validity,,errors=continue. Quota mode: writeback. [ 177.759562][ T6019] ntfs: (device loop4): load_system_files(): Failed to determine if Windows is hibernated. Will not be able to remount read-write. Run chkdsk. [ 177.888810][ T6042] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 177.897222][ T6042] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 177.905719][ T6042] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 180.807800][ T6091] loop0: detected capacity change from 0 to 256 [ 180.825678][ T6094] tipc: Enabling of bearer rejected, failed to enable media [ 180.859279][ T6091] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 181.100930][ T5628] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 181.346251][ T5628] usb 3-1: Using ep0 maxpacket: 32 [ 181.446337][ T5629] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 181.936072][ T5628] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 182.066235][ T5629] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 182.066278][ T5629] usb 4-1: New USB device found, idVendor=04b3, idProduct=3100, bcdDevice= 0.00 [ 182.103864][ T5628] usb 3-1: New USB device found, idVendor=16ca, idProduct=1502, bcdDevice=4b.99 [ 182.118957][ T5629] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.120530][ T5629] usb 4-1: config 0 descriptor?? [ 182.143734][ T5628] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.143760][ T5628] usb 3-1: Product: syz [ 182.143776][ T5628] usb 3-1: Manufacturer: syz [ 182.168867][ T5628] usb 3-1: SerialNumber: syz [ 182.574908][ T6126] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 182.587395][ T6126] VFS: Can't find a romfs filesystem on dev nullb0. [ 182.587395][ T6126] [ 183.109759][ T5629] lenovo 0003:04B3:3100.0003: hidraw0: USB HID v0.9a Device [HID 04b3:3100] on usb-dummy_hcd.3-1/input0 [ 183.124958][ T5628] usb 3-1: USB disconnect, device number 3 [ 183.172560][ T6133] loop0: detected capacity change from 0 to 1024 [ 183.327326][ T5628] usb 4-1: USB disconnect, device number 5 [ 183.359078][ T26] kauditd_printk_skb: 8 callbacks suppressed [ 183.359091][ T26] audit: type=1800 audit(1786178351.817:57): pid=6133 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.479" name="file1" dev="loop0" ino=20 res=0 errno=0 [ 183.360973][ T6133] hfsplus: extend alloc file! (16384,256,150995124) [ 183.410587][ T6133] hfsplus: failed to extend attributes file [ 183.423731][ T6140] hfsplus: extend alloc file! (16384,256,150995124) [ 183.432973][ T6140] hfsplus: failed to extend attributes file [ 183.477047][ T6137] tipc: Enabling of bearer rejected, failed to enable media [ 186.103733][ T6163] loop3: detected capacity change from 0 to 1024 [ 186.126154][ T5613] Bluetooth: hci4: command 0x0406 tx timeout [ 186.132238][ T5613] Bluetooth: hci1: command 0x0406 tx timeout [ 186.158479][ T5613] Bluetooth: hci2: command 0x0406 tx timeout [ 186.172672][ T5613] Bluetooth: hci3: command 0x0406 tx timeout [ 186.267202][ T2288] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 186.676115][ T2288] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 187.286046][ T2288] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.298697][ T2288] usb 5-1: config 0 descriptor?? [ 187.347440][ T2288] cp210x 5-1:0.0: cp210x converter detected [ 187.575317][ T6170] md: loop0 has zero or unknown size, marking faulty! [ 187.610411][ T26] audit: type=1326 audit(1786178356.067:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6167 comm="syz.3.490" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc770f0d9 code=0x7ffc0000 [ 189.088039][ T26] audit: type=1326 audit(1786178356.097:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6167 comm="syz.3.490" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc770f0d9 code=0x7ffc0000 [ 189.111955][ C0] vkms_vblank_simulate: vblank timer overrun [ 189.118820][ T26] audit: type=1326 audit(1786178356.097:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6167 comm="syz.3.490" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc770f0d9 code=0x7ffc0000 [ 189.142680][ C0] vkms_vblank_simulate: vblank timer overrun [ 189.150953][ T26] audit: type=1326 audit(1786178356.097:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6167 comm="syz.3.490" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7effc770f0d9 code=0x7ffc0000 [ 189.177636][ T26] audit: type=1326 audit(1786178356.097:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6167 comm="syz.3.490" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc770f0d9 code=0x7ffc0000 [ 189.202566][ T26] audit: type=1326 audit(1786178356.097:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6167 comm="syz.3.490" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc770f0d9 code=0x7ffc0000 [ 189.226465][ C0] vkms_vblank_simulate: vblank timer overrun [ 189.233324][ T2288] cp210x 5-1:0.0: failed to get vendor val 0x370b size 1: -71 [ 189.252819][ T2288] cp210x 5-1:0.0: querying part number failed [ 189.272138][ T2288] usb 5-1: cp210x converter now attached to ttyUSB0 [ 189.286107][ T26] audit: type=1326 audit(1786178356.097:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6167 comm="syz.3.490" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc770f0d9 code=0x7ffc0000 [ 189.310026][ C0] vkms_vblank_simulate: vblank timer overrun [ 190.284504][ T2288] usb 5-1: USB disconnect, device number 7 [ 190.305387][ T2288] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 190.324183][ T2288] cp210x 5-1:0.0: device disconnected [ 191.005586][ T26] audit: type=1326 audit(1786178356.107:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6167 comm="syz.3.490" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7effc770f0d9 code=0x7ffc0000 [ 191.090911][ T26] audit: type=1326 audit(1786178356.107:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6167 comm="syz.3.490" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc770f0d9 code=0x7ffc0000 [ 191.114816][ C0] vkms_vblank_simulate: vblank timer overrun [ 191.137293][ T26] audit: type=1326 audit(1786178356.107:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6167 comm="syz.3.490" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc770f0d9 code=0x7ffc0000 [ 191.161212][ C0] vkms_vblank_simulate: vblank timer overrun [ 191.354198][ T26] audit: type=1326 audit(1786178356.107:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6167 comm="syz.3.490" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effc770f0d9 code=0x7ffc0000 [ 191.378135][ C0] vkms_vblank_simulate: vblank timer overrun [ 191.487949][ T6196] netlink: 8 bytes leftover after parsing attributes in process `syz.3.496'. [ 191.496944][ T6196] netlink: 'syz.3.496': attribute type 10 has an invalid length. [ 191.504665][ T6196] netlink: 12 bytes leftover after parsing attributes in process `syz.3.496'. [ 191.516629][ T6196] device geneve2 entered promiscuous mode [ 191.588193][ T2288] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 191.870579][ T6200] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 192.823671][ T4195] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 192.876118][ T2288] usb 1-1: Using ep0 maxpacket: 16 [ 193.615982][ T2288] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 193.627916][ T2288] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 193.637731][ T2288] usb 1-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 193.650889][ T2288] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.663466][ T2288] usb 1-1: config 0 descriptor?? [ 193.740537][ T6227] capability: warning: `syz.1.517' uses 32-bit capabilities (legacy support in use) [ 193.869457][ T4195] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 193.911782][ T4195] usb 5-1: config 0 interface 0 has no altsetting 0 [ 193.921090][ T4195] usb 5-1: New USB device found, idVendor=18b1, idProduct=0037, bcdDevice= 0.00 [ 193.930690][ T4195] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.943256][ T4195] usb 5-1: config 0 descriptor?? [ 193.966569][ T6195] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 194.328565][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.865224][ T2288] corsair 0003:1B1C:1B02.0004: hidraw0: USB HID v0.00 Device [HID 1b1c:1b02] on usb-dummy_hcd.0-1/input0 [ 195.336250][ T4195] usbhid 5-1:0.0: can't add hid device: -71 [ 195.343229][ T4195] usbhid: probe of 5-1:0.0 failed with error -71 [ 195.501273][ T4195] usb 5-1: USB disconnect, device number 8 [ 195.645281][ T4293] usb 1-1: USB disconnect, device number 7 [ 195.670446][ T6247] fido_id[6247]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 195.779690][ T6258] loop4: detected capacity change from 0 to 128 [ 195.832013][ T6258] FAT-fs (loop4): error, invalid access to FAT (entry 0x00000f0b) [ 195.938777][ T6258] FAT-fs (loop4): Filesystem has been set read-only [ 195.976721][ T6258] FAT-fs (loop4): error, invalid access to FAT (entry 0x00000f0b) [ 195.990452][ T6258] FAT-fs (loop4): error, invalid access to FAT (entry 0x00000f0b) [ 196.042265][ T6266] loop2: detected capacity change from 0 to 512 [ 196.089879][ T6270] loop4: detected capacity change from 0 to 512 [ 196.287267][ T6270] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 196.307757][ T6270] EXT4-fs (loop4): 1 truncate cleaned up [ 196.316078][ T6270] EXT4-fs (loop4): mounted filesystem without journal. Opts: barrier=0x0000000000000101,errors=remount-ro,noblock_validity,. Quota mode: none. [ 196.547690][ T6279] loop0: detected capacity change from 0 to 128 [ 196.989010][ T6283] EXT4-fs error (device loop4): ext4_generic_delete_entry:2729: inode #2: block 13: comm syz.4.520: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 196.996859][ T6279] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 197.030156][ T6279] ext4 filesystem being mounted at /101/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 197.099213][ T6283] EXT4-fs (loop4): Remounting filesystem read-only [ 197.115096][ T6283] EXT4-fs error (device loop4) in ext4_delete_entry:2800: Corrupt filesystem [ 197.129878][ T6290] loop3: detected capacity change from 0 to 256 [ 197.133104][ T6266] EXT4-fs (loop2): 1 orphan inode deleted [ 197.141914][ T6266] EXT4-fs (loop2): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: writeback. [ 197.156713][ T6266] ext4 filesystem being mounted at /53/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 197.182211][ T6283] EXT4-fs (loop4): Remounting filesystem read-only [ 197.196003][ T6283] EXT4-fs warning (device loop4): ext4_rename_delete:3792: inode #2: comm syz.4.520: Deleting old file: nlink 4, error=-117 [ 197.329445][ T6266] EXT4-fs (loop2): re-mounted. Opts: (null). Quota mode: writeback. [ 198.035690][ T6312] loop3: detected capacity change from 0 to 256 [ 198.118999][ T6312] exfat: Deprecated parameter 'utf8' [ 198.161989][ T6312] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0x265d2142, utbl_chksum : 0xe619d30d) [ 198.393159][ T6311] loop4: detected capacity change from 0 to 2048 [ 198.452656][ T6311] UDF-fs: error (device loop4): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 198.515520][ T6311] UDF-fs: error (device loop4): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 198.597142][ T6311] UDF-fs: warning (device loop4): udf_load_vrs: No anchor found [ 198.635706][ T6311] UDF-fs: Scanning with blocksize 512 failed [ 198.638795][ T6323] loop3: detected capacity change from 0 to 512 [ 198.666563][ T6311] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 198.735811][ T6323] EXT4-fs (loop3): mounted filesystem without journal. Opts: barrier=0x00000000000000b2,usrquota,minixdf,nombcache,,errors=continue. Quota mode: writeback. [ 198.814365][ T6318] loop0: detected capacity change from 0 to 32768 [ 198.836931][ T6323] ext4 filesystem being mounted at /106/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 198.867534][ T26] kauditd_printk_skb: 57 callbacks suppressed [ 198.867548][ T26] audit: type=1800 audit(1786178367.327:126): pid=6331 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.533" name="idVendor" dev="configfs" ino=38616 res=0 errno=0 [ 198.906851][ T6318] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz.0.535 (6318) [ 199.000469][ T6318] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm [ 199.023853][ T6318] BTRFS info (device loop0): setting nodatasum [ 199.051837][ T6318] BTRFS info (device loop0): force zlib compression, level 3 [ 199.065102][ T6318] BTRFS info (device loop0): setting incompat feature flag for COMPRESS_LZO (0x8) [ 199.075083][ T6318] BTRFS info (device loop0): use lzo compression, level 0 [ 199.082316][ T6318] BTRFS info (device loop0): turning on flush-on-commit [ 199.090793][ T6318] BTRFS info (device loop0): enabling auto defrag [ 199.097931][ T6318] BTRFS info (device loop0): max_inline at 4096 [ 199.104258][ T6318] BTRFS info (device loop0): using free space tree [ 199.111466][ T6318] BTRFS info (device loop0): has skinny extents [ 199.147454][ T6342] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 199.256283][ T5628] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 199.272699][ T6346] kvm [6344]: vcpu2, guest rIP: 0xfff0 disabled perfctr wrmsr: 0xc0010000 data 0x7 [ 199.304687][ T6318] BTRFS info (device loop0): enabling ssd optimizations [ 199.320176][ T6367] netlink: 20 bytes leftover after parsing attributes in process `syz.1.546'. [ 199.392504][ T26] audit: type=1800 audit(1786178367.847:127): pid=6318 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.535" name="file1" dev="loop0" ino=260 res=0 errno=0 [ 199.556318][ T5628] usb 5-1: Using ep0 maxpacket: 32 [ 199.710626][ T5628] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 199.726187][ T5628] usb 5-1: config 0 has no interface number 0 [ 199.916875][ T5628] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 199.944229][ T6371] loop3: detected capacity change from 0 to 32768 [ 199.945986][ T5628] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.975507][ T5628] usb 5-1: Product: syz [ 199.988790][ T5628] usb 5-1: Manufacturer: syz [ 200.000374][ T5628] usb 5-1: SerialNumber: syz [ 200.033078][ T5628] usb 5-1: config 0 descriptor?? [ 200.103160][ T6371] XFS (loop3): Mounting V5 Filesystem [ 200.111132][ T5628] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 200.328057][ T5628] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 200.338360][ T6371] XFS (loop3): Ending clean mount [ 200.356461][ T5628] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 201.053174][ T4185] XFS (loop3): Unmounting Filesystem [ 201.308078][ T6426] device syzkaller0 entered promiscuous mode [ 201.333719][ T5628] usb 5-1: USB disconnect, device number 9 [ 201.356044][ C1] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -108 [ 201.379357][ T5628] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 201.398294][ T5628] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 201.426491][ T5628] quatech2 5-1:0.51: device disconnected [ 201.566440][ T6438] loop3: detected capacity change from 0 to 512 [ 201.627223][ T6438] EXT4-fs (loop3): mounted filesystem without journal. Opts: journal_ioprio=0x0000000000000003,nogrpid,quota,,errors=continue. Quota mode: writeback. [ 201.662408][ T6438] ext4 filesystem being mounted at /110/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 201.832244][ T6452] af_packet: tpacket_rcv: packet too big, clamped from 40 to 4294967272. macoff=96 [ 202.031101][ T6460] loop4: detected capacity change from 0 to 164 [ 202.112067][ T6446] loop0: detected capacity change from 0 to 32768 [ 202.120407][ T6464] device syzkaller0 entered promiscuous mode [ 203.120508][ T6490] loop2: detected capacity change from 0 to 164 [ 203.283945][ T6499] netlink: 16 bytes leftover after parsing attributes in process `syz.3.588'. [ 203.438561][ T6505] tipc: Enabled bearer , priority 0 [ 203.446600][ T6507] loop0: detected capacity change from 0 to 8 [ 203.468462][ T6505] tipc: Resetting bearer [ 203.487304][ T6507] MTD: Attempt to mount non-MTD device "/dev/loop0" [ 203.495444][ T6504] tipc: Disabling bearer [ 203.505488][ T6507] cramfs: unsupported filesystem features [ 203.697684][ T6516] capability: warning: `syz.0.594' uses deprecated v2 capabilities in a way that may be insecure [ 203.716022][ T23] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 203.986114][ T23] usb 4-1: Using ep0 maxpacket: 8 [ 204.050860][ T6516] loop0: detected capacity change from 0 to 32768 [ 204.136452][ T23] usb 4-1: config 6 has an invalid interface number: 2 but max is 0 [ 204.145120][ T23] usb 4-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 204.165774][ T23] usb 4-1: config 6 has no interface number 0 [ 204.174532][ T23] usb 4-1: config 6 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 204.190708][ T6534] loop4: detected capacity change from 0 to 128 [ 204.313045][ T6534] FAT-fs (loop4): Directory bread(block 524322) failed [ 204.336290][ T6534] FAT-fs (loop4): Directory bread(block 524323) failed [ 204.343754][ T6534] FAT-fs (loop4): Directory bread(block 524324) failed [ 204.386522][ T23] usb 4-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 204.395735][ T23] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.507173][ T23] usb 4-1: Product: syz [ 204.511375][ T23] usb 4-1: Manufacturer: syz [ 204.546005][ T6534] FAT-fs (loop4): Directory bread(block 524325) failed [ 204.554552][ T6534] FAT-fs (loop4): Directory bread(block 524326) failed [ 204.626365][ T23] usb 4-1: SerialNumber: syz [ 204.690710][ T6534] FAT-fs (loop4): Directory bread(block 524327) failed [ 204.722413][ T23] hso 4-1:6.2: Failed to find INT IN ep [ 204.729077][ T6534] FAT-fs (loop4): Directory bread(block 524328) failed [ 204.772916][ T6534] FAT-fs (loop4): Directory bread(block 524329) failed [ 204.814216][ T6534] FAT-fs (loop4): Directory bread(block 524322) failed [ 204.823580][ T6534] FAT-fs (loop4): Directory bread(block 524323) failed [ 204.952919][ T6549] tipc: Enabling of bearer rejected, failed to enable media [ 204.970370][ T6373] usb 4-1: USB disconnect, device number 6 [ 205.298216][ T4195] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 205.486046][ T4234] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 205.706302][ T4195] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 205.726117][ T4234] usb 5-1: Using ep0 maxpacket: 32 [ 205.732203][ T4195] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 205.743208][ T4195] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.844877][ T4195] usb 1-1: config 0 descriptor?? [ 205.850403][ T4234] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 206.042432][ T4234] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 206.166544][ T4234] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 206.206436][ T4195] ath6kl: Failed to submit usb control message: -71 [ 206.235079][ T4195] ath6kl: unable to send the bmi data to the device: -71 [ 206.385282][ T4195] ath6kl: Unable to send get target info: -71 [ 206.393201][ T4234] usb 5-1: SerialNumber: syz [ 206.406687][ T4195] ath6kl: Failed to init ath6kl core: -71 [ 206.423443][ T4195] ath6kl_usb: probe of 1-1:0.0 failed with error -71 [ 206.439753][ T6577] loop3: detected capacity change from 0 to 128 [ 206.476769][ T4195] usb 1-1: USB disconnect, device number 8 [ 206.519798][ T6577] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 206.534575][ T6580] tipc: Enabling of bearer rejected, failed to enable media [ 206.572745][ T26] audit: type=1800 audit(1786178375.027:128): pid=6577 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.611" name="file2" dev="loop3" ino=95 res=0 errno=0 [ 207.470581][ T6604] tipc: Enabling of bearer rejected, failed to enable media [ 207.492442][ T4234] cdc_ether 5-1:1.0 usb1: register 'cdc_ether' at usb-dummy_hcd.4-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 207.686483][ T5627] usb 5-1: USB disconnect, device number 10 [ 207.693898][ T5627] cdc_ether 5-1:1.0 usb1: unregister 'cdc_ether' usb-dummy_hcd.4-1, CDC Ethernet Device [ 207.946006][ T6373] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 208.226425][ T6373] usb 1-1: Using ep0 maxpacket: 16 [ 208.586539][ T6373] usb 1-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 208.679145][ T6373] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 208.904334][ T6373] usb 1-1: Product: syz [ 209.036255][ T6373] usb 1-1: Manufacturer: syz [ 209.040901][ T6373] usb 1-1: SerialNumber: syz [ 209.096714][ T6373] usb 1-1: config 0 descriptor?? [ 209.153620][ T6373] ssu100 1-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 210.256123][ T6373] ssu100: probe of 1-1:0.0 failed with error -71 [ 210.269108][ T6373] usb 1-1: USB disconnect, device number 9 [ 210.286471][ T6675] loop2: detected capacity change from 0 to 128 [ 210.342828][ T6675] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 210.362627][ T26] audit: type=1800 audit(1786178378.817:129): pid=6675 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.629" name="file2" dev="loop2" ino=95 res=0 errno=0 [ 210.474075][ T6649] loop4: detected capacity change from 0 to 32768 [ 210.534410][ T6649] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop4 scanned by syz.4.626 (6649) [ 210.626378][ T6649] BTRFS info (device loop4): using sha256 (sha256-avx2) checksum algorithm [ 210.635096][ T6649] BTRFS info (device loop4): enabling auto defrag [ 210.681727][ T6649] BTRFS info (device loop4): force clearing of disk cache [ 210.698518][ T6649] BTRFS info (device loop4): max_inline at 485 [ 210.709081][ T6649] BTRFS info (device loop4): disabling free space tree [ 210.716452][ T6649] BTRFS info (device loop4): has skinny extents [ 210.826053][ T4232] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 210.915978][ T6373] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 211.230998][ T6649] BTRFS info (device loop4): enabling ssd optimizations [ 211.238256][ T6373] usb 1-1: Using ep0 maxpacket: 16 [ 211.247403][ T6649] BTRFS info (device loop4): clearing free space tree [ 211.268531][ T6649] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 211.302558][ T6649] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 211.376363][ T6373] usb 1-1: config 0 has an invalid interface number: 34 but max is 0 [ 211.384834][ T6373] usb 1-1: config 0 has no interface number 0 [ 211.396233][ T6373] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 211.406788][ T6373] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 211.599094][ T6373] usb 1-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 211.621837][ T6373] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 211.640395][ T6373] usb 1-1: Product: syz [ 211.644591][ T6373] usb 1-1: Manufacturer: syz [ 211.665395][ T6373] usb 1-1: SerialNumber: syz [ 211.695294][ T6373] usb 1-1: config 0 descriptor?? [ 211.699751][ T4232] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 211.726306][ T4232] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 211.736671][ T6691] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 211.743706][ T6691] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 211.746084][ T4232] usb 4-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 211.775717][ T4232] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.796150][ T4232] usb 4-1: config 0 descriptor?? [ 212.001315][ T6730] netlink: 4 bytes leftover after parsing attributes in process `syz.1.641'. [ 212.019322][ T6691] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 212.027598][ T6691] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 212.206319][ T6746] db_root: cannot be changed: target drivers registered [ 212.455312][ T6373] asix 1-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 212.936175][ T4232] hid-led: probe of 0003:27B8:01ED.0005 failed with error -71 [ 212.967205][ T4232] usb 4-1: USB disconnect, device number 7 [ 213.055699][ T6763] loop2: detected capacity change from 0 to 512 [ 213.089912][ T6763] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 213.104144][ T6763] EXT4-fs error (device loop2): ext4_orphan_get:1432: comm syz.2.650: bad orphan inode 131083 [ 213.115874][ T6763] EXT4-fs (loop2): mounted filesystem without journal. Opts: stripe=0x000000000000003d,init_itable,mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: none. [ 213.180850][ T6373] asix 1-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 213.191514][ T6373] asix: probe of 1-1:0.34 failed with error -71 [ 213.201873][ T6373] usb 1-1: USB disconnect, device number 10 [ 213.268637][ T6720] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 213.320484][ T6774] netlink: 8 bytes leftover after parsing attributes in process `syz.1.652'. [ 213.656139][ T6720] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 213.674028][ T6797] loop3: detected capacity change from 0 to 512 [ 213.675194][ T6720] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 213.749271][ T6797] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpjquota=,errors=continue,noblock_validity,,errors=continue. Quota mode: none. [ 213.786649][ T6797] EXT4-fs warning (device loop3): dx_probe:869: inode #2: comm syz.3.662: Unimplemented hash flags: 0x0001 [ 213.798841][ T6720] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 213.808079][ T6720] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 213.816204][ T6797] EXT4-fs warning (device loop3): dx_probe:966: inode #2: comm syz.3.662: Corrupt directory, running e2fsck is recommended [ 213.829864][ T6720] usb 5-1: Manufacturer: syz [ 213.836134][ T6720] usb 5-1: config 0 descriptor?? [ 213.844667][ T6797] EXT4-fs error (device loop3): ext4_readdir:263: inode #2: block 3: comm syz.3.662: path /123/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=4294967295, rec_len=7, size=1024 fake=0 [ 213.996074][ T6720] rc_core: IR keymap rc-hauppauge not found [ 214.002065][ T6720] Registered IR keymap rc-empty [ 214.016032][ T4232] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 214.030365][ T6720] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 214.043929][ T6720] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input13 [ 214.150001][ T6826] netlink: 16 bytes leftover after parsing attributes in process `syz.3.670'. [ 214.240952][ T6373] usb 5-1: USB disconnect, device number 11 [ 214.276456][ T4232] usb 1-1: Using ep0 maxpacket: 8 [ 214.396249][ T4232] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 214.404863][ T4232] usb 1-1: config 179 has no interface number 0 [ 214.411538][ T4232] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 214.423051][ T4232] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 214.434649][ T4232] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 214.446262][ T4232] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 214.458015][ T4232] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 214.471602][ T4232] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 214.481725][ T4232] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 214.516367][ T6805] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 214.790628][ T4232] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input14 [ 215.133836][ T6373] usb 1-1: USB disconnect, device number 11 [ 215.135985][ C0] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 215.148291][ C0] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 215.157030][ T6373] xpad 1-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 216.252559][ T6859] loop4: detected capacity change from 0 to 8192 [ 216.392832][ T6862] device syzkaller0 entered promiscuous mode [ 216.548147][ T6867] program syz.4.681 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 216.636005][ T4232] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 216.645060][ T6867] netlink: 28 bytes leftover after parsing attributes in process `syz.4.681'. [ 217.889886][ T4232] usb 4-1: New USB device found, idVendor=2040, idProduct=6500, bcdDevice= 1.00 [ 217.904262][ T4232] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 217.929747][ T4232] usb 4-1: Product: syz [ 217.938825][ T4232] usb 4-1: Manufacturer: syz [ 217.943441][ T4232] usb 4-1: SerialNumber: syz [ 218.173000][ T4232] em28xx 4-1:1.0: New device syz syz @ 480 Mbps (2040:6500, interface 0, class 0) [ 218.182317][ T4232] em28xx 4-1:1.0: DVB interface 0 found: bulk [ 218.526050][ T6373] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 219.036215][ T6373] usb 3-1: Using ep0 maxpacket: 16 [ 219.816357][ T4232] em28xx 4-1:1.0: unknown em28xx chip ID (0) [ 220.076348][ T4232] em28xx 4-1:1.0: reading from i2c device at 0xa0 failed (error=-5) [ 220.093315][ T4232] em28xx 4-1:1.0: board has no eeprom [ 220.124877][ T6373] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 220.154187][ T6373] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 220.174036][ T6373] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 220.232783][ T6373] usb 3-1: config 0 descriptor?? [ 220.518292][ T4232] em28xx 4-1:1.0: Identified as Hauppauge WinTV HVR 900 (card=10) [ 220.959891][ T4232] em28xx 4-1:1.0: dvb set to bulk mode. [ 220.974129][ T6720] em28xx 4-1:1.0: Binding DVB extension [ 220.995537][ T4232] usb 4-1: USB disconnect, device number 8 [ 221.012627][ T4232] em28xx 4-1:1.0: Disconnecting em28xx [ 221.020152][ T6720] zl10353_read_register: readreg error (reg=127, ret==-19) [ 221.039110][ T6373] mcp2221 0003:04D8:00DD.0006: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 221.061630][ T6720] em28xx 4-1:1.0: dvb frontend not attached. Can't attach xc3028 [ 221.102301][ T6720] em28xx 4-1:1.0: Registering input extension [ 221.153343][ T4232] em28xx 4-1:1.0: Closing input extension [ 221.205894][ T6928] device syzkaller0 entered promiscuous mode [ 221.225308][ T4232] em28xx 4-1:1.0: Freeing device [ 221.391700][ T6925] kvm [6922]: vcpu0, guest rIP: 0x18e disabled perfctr wrmsr: 0xc1 data 0x4cbfd1 [ 221.401140][ T6925] kvm [6922]: vcpu0, guest rIP: 0x1b8 disabled perfctr wrmsr: 0xc1 data 0x0 [ 221.439701][ T6925] kvm [6922]: vcpu0, guest rIP: 0x18e disabled perfctr wrmsr: 0xc2 data 0x4cd0 [ 221.455721][ T6925] kvm [6922]: vcpu0, guest rIP: 0x1b8 disabled perfctr wrmsr: 0xc2 data 0x0 [ 221.512651][ T6925] kvm [6922]: vcpu0, guest rIP: 0x18e disabled perfctr wrmsr: 0xc2 data 0xd500 [ 221.553863][ T6925] kvm [6922]: vcpu0, guest rIP: 0x1b8 disabled perfctr wrmsr: 0xc2 data 0x0 [ 221.593330][ T6925] kvm [6922]: vcpu0, guest rIP: 0x18e disabled perfctr wrmsr: 0xc2 data 0xdd00 [ 221.621896][ T6925] kvm [6922]: vcpu0, guest rIP: 0x1b8 disabled perfctr wrmsr: 0xc2 data 0x0 [ 221.662166][ T6925] kvm [6922]: vcpu0, guest rIP: 0x18e disabled perfctr wrmsr: 0xc1 data 0xbd00 [ 221.682675][ T6925] kvm [6922]: vcpu0, guest rIP: 0x1b8 disabled perfctr wrmsr: 0xc1 data 0x0 [ 221.695797][ T4232] usb 3-1: USB disconnect, device number 4 [ 221.951900][ T6952] Bluetooth: hci0: invalid len left 7, exp >= 50 [ 222.245999][ T4232] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 222.296081][ T6720] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 222.616255][ T4232] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 222.625680][ T4232] usb 5-1: config 0 has no interface number 0 [ 222.793147][ T6969] RDS: rds_bind could not find a transport for ::ffff:100.1.1.2, load rds_tcp or rds_rdma? [ 222.805875][ T6969] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 223.164874][ T4232] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 223.185583][ T6720] usb 4-1: config 0 interface 0 altsetting 32 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 223.207111][ T6720] usb 4-1: config 0 interface 0 altsetting 32 endpoint 0x81 has invalid maxpacket 1015, setting to 64 [ 223.241680][ T6720] usb 4-1: config 0 interface 0 altsetting 32 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 223.266587][ T6720] usb 4-1: config 0 interface 0 has no altsetting 0 [ 223.273223][ T6720] usb 4-1: New USB device found, idVendor=056e, idProduct=00fb, bcdDevice= 0.00 [ 223.290673][ T6720] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 223.313152][ T6720] usb 4-1: config 0 descriptor?? [ 223.346500][ T6956] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 223.356278][ T4232] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 223.375728][ T4232] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 223.402465][ T4232] usb 5-1: Product: syz [ 223.406894][ T4232] usb 5-1: SerialNumber: syz [ 223.434429][ T4232] usb 5-1: config 0 descriptor?? [ 223.488838][ T4232] usbhid 5-1:0.8: couldn't find an input interrupt endpoint [ 223.506283][ T6990] loop0: detected capacity change from 0 to 64 [ 223.700323][ T4232] usb 5-1: USB disconnect, device number 12 [ 223.847811][ T6720] elecom 0003:056E:00FB.0007: unknown main item tag 0x2 [ 223.865019][ T6720] elecom 0003:056E:00FB.0007: item fetching failed at offset 6/40 [ 223.873572][ T6720] elecom: probe of 0003:056E:00FB.0007 failed with error -22 [ 224.597086][ T6373] usb 4-1: USB disconnect, device number 9 [ 227.718139][ T7053] loop2: detected capacity change from 0 to 64 [ 227.940215][ T7057] loop3: detected capacity change from 0 to 8192 [ 232.163362][ T7130] loop3: detected capacity change from 0 to 256 [ 235.480442][ T7150] overlayfs: missing 'lowerdir' [ 236.003795][ T7156] program syz.4.757 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 236.130229][ T7161] loop3: detected capacity change from 0 to 64 [ 237.071181][ T7170] overlayfs: failed to clone upperpath [ 237.834925][ T7184] loop3: detected capacity change from 0 to 8192 [ 238.863806][ T7187] loop0: detected capacity change from 0 to 8192 [ 240.273745][ T7218] autofs4:pid:7218:autofs_fill_super: called with bogus options [ 240.293232][ T7218] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 240.305577][ T7218] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 240.313855][ T7218] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 240.322215][ T7218] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 240.330385][ T7218] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 240.338558][ T7218] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 240.347087][ T7218] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 240.370711][ T7218] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 240.379677][ T7218] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 241.150969][ T7234] configfs-gadget gadget: uvc: uvc_function_unbind() [ 241.415648][ T7225] can: request_module (can-proto-3) failed. [ 241.583925][ T7251] loop2: detected capacity change from 0 to 64 [ 241.847862][ T7261] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 241.929302][ T7264] vivid-000: ================= START STATUS ================= [ 241.937108][ T7264] vivid-000: Radio HW Seek Mode: Bounded [ 241.942873][ T7264] vivid-000: Radio Programmable HW Seek: false [ 241.949177][ T7264] vivid-000: RDS Rx I/O Mode: Block I/O [ 241.954842][ T7264] vivid-000: Generate RBDS Instead of RDS: false [ 241.961354][ T7264] vivid-000: RDS Reception: true [ 241.966413][ T7264] vivid-000: RDS Program Type: 0 inactive [ 241.972256][ T7264] vivid-000: RDS PS Name: inactive [ 241.977607][ T7264] vivid-000: RDS Radio Text: inactive [ 241.983269][ T7264] vivid-000: RDS Traffic Announcement: false inactive [ 241.990238][ T7264] vivid-000: RDS Traffic Program: false inactive [ 241.996735][ T7264] vivid-000: RDS Music: false inactive [ 242.002373][ T7264] vivid-000: ================== END STATUS ================== [ 243.317900][ T7261] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 243.344741][ T7266] Bluetooth: hci0: unsupported parameter 255 [ 243.346347][ T7261] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 243.351969][ T7266] Bluetooth: hci0: unsupported parameter 255 [ 243.370985][ T7261] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 243.378692][ T7261] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 243.394659][ T7261] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 243.432246][ T7261] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 243.486141][ T7272] loop0: detected capacity change from 0 to 8192 [ 244.006202][ T7279] program syz.3.799 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 244.653539][ T7291] program syz.0.786 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 245.874733][ T7311] loop0: detected capacity change from 0 to 256 [ 246.392045][ T7326] vivid-003: ================= START STATUS ================= [ 246.399783][ T7326] vivid-003: Radio HW Seek Mode: Bounded [ 246.405543][ T7326] vivid-003: Radio Programmable HW Seek: false [ 246.411897][ T7326] vivid-003: RDS Rx I/O Mode: Block I/O [ 246.417589][ T7326] vivid-003: Generate RBDS Instead of RDS: false [ 246.424025][ T7326] vivid-003: RDS Reception: true [ 246.429585][ T7326] vivid-003: RDS Program Type: 0 inactive [ 246.435459][ T7326] vivid-003: RDS PS Name: inactive [ 246.441216][ T7326] vivid-003: RDS Radio Text: inactive [ 246.446879][ T7326] vivid-003: RDS Traffic Announcement: false inactive [ 246.453797][ T7326] vivid-003: RDS Traffic Program: false inactive [ 246.460309][ T7326] vivid-003: RDS Music: false inactive [ 246.465951][ T7326] vivid-003: ================== END STATUS ================== [ 247.366352][ T5628] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 247.411833][ T7348] md: loop0 has zero or unknown size, marking faulty! [ 247.433449][ T26] audit: type=1326 audit(1786178415.887:130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7341 comm="syz.2.807" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd7338b0d9 code=0x7ffc0000 [ 247.528619][ T7344] loop3: detected capacity change from 0 to 8192 [ 247.676083][ T5628] usb 1-1: Using ep0 maxpacket: 32 [ 248.621292][ T26] audit: type=1326 audit(1786178415.927:131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7341 comm="syz.2.807" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd7338b0d9 code=0x7ffc0000 [ 248.646698][ T5628] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 248.694449][ T5628] usb 1-1: config 0 has no interface number 0 [ 249.006016][ T5628] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 249.814180][ T7347] loop4: detected capacity change from 0 to 8192 [ 249.823555][ T5628] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 249.839685][ T26] audit: type=1326 audit(1786178415.927:132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7341 comm="syz.2.807" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd7338b0d9 code=0x7ffc0000 [ 249.949229][ T5628] usb 1-1: Product: syz [ 250.009036][ T5628] usb 1-1: Manufacturer: syz [ 250.096485][ T5628] usb 1-1: SerialNumber: syz [ 250.267825][ T5628] usb 1-1: config 0 descriptor?? [ 250.315331][ T26] audit: type=1326 audit(1786178415.927:133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7341 comm="syz.2.807" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fdd7338b0d9 code=0x7ffc0000 [ 250.352134][ T26] audit: type=1326 audit(1786178415.927:134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7341 comm="syz.2.807" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd7338b0d9 code=0x7ffc0000 [ 250.376946][ T26] audit: type=1326 audit(1786178415.927:135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7341 comm="syz.2.807" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd7338b0d9 code=0x7ffc0000 [ 250.391106][ T5628] usb 1-1: can't set config #0, error -71 [ 250.432271][ T26] audit: type=1326 audit(1786178415.927:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7341 comm="syz.2.807" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd7338b0d9 code=0x7ffc0000 [ 250.454963][ T5628] usb 1-1: USB disconnect, device number 12 [ 250.456673][ T26] audit: type=1326 audit(1786178415.927:137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7341 comm="syz.2.807" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fdd7338b0d9 code=0x7ffc0000 [ 250.506180][ T26] audit: type=1326 audit(1786178415.927:138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7341 comm="syz.2.807" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd7338b0d9 code=0x7ffc0000 [ 250.542941][ T26] audit: type=1326 audit(1786178415.927:139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7341 comm="syz.2.807" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd7338b0d9 code=0x7ffc0000 [ 250.690001][ T7364] loop0: detected capacity change from 0 to 4096 [ 250.739265][ T7376] loop4: detected capacity change from 0 to 256 [ 250.825365][ T7381] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 251.064669][ T7383] vivid-004: ================= START STATUS ================= [ 251.072486][ T7383] vivid-004: Radio HW Seek Mode: Bounded [ 251.078283][ T7383] vivid-004: Radio Programmable HW Seek: false [ 251.084576][ T7383] vivid-004: RDS Rx I/O Mode: Block I/O [ 251.090458][ T7383] vivid-004: Generate RBDS Instead of RDS: false [ 251.096922][ T7383] vivid-004: RDS Reception: true [ 251.101979][ T7383] vivid-004: RDS Program Type: 0 inactive [ 251.107870][ T7383] vivid-004: RDS PS Name: inactive [ 251.113208][ T7383] vivid-004: RDS Radio Text: inactive [ 251.118841][ T7383] vivid-004: RDS Traffic Announcement: false inactive [ 251.125729][ T7383] vivid-004: RDS Traffic Program: false inactive [ 251.132558][ T7383] vivid-004: RDS Music: false inactive [ 251.138225][ T7383] vivid-004: ================== END STATUS ================== [ 251.721867][ T7398] device syzkaller0 entered promiscuous mode [ 251.830063][ T7378] loop3: detected capacity change from 0 to 32768 [ 251.845843][ T7378] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz.3.813 (7378) [ 251.869570][ T7378] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm [ 251.879644][ T7378] BTRFS info (device loop3): setting nodatacow, compression disabled [ 251.888130][ T7378] BTRFS info (device loop3): turning on flush-on-commit [ 251.895183][ T7378] BTRFS info (device loop3): setting incompat feature flag for COMPRESS_LZO (0x8) [ 251.904499][ T7378] BTRFS info (device loop3): use lzo compression, level 0 [ 251.943779][ T7378] BTRFS info (device loop3): setting nodatasum [ 251.950809][ T7378] BTRFS info (device loop3): use no compression [ 251.957869][ T7378] BTRFS info (device loop3): trying to use backup root at mount time [ 251.966942][ T7378] BTRFS info (device loop3): max_inline at 0 [ 251.972937][ T7378] BTRFS info (device loop3): using free space tree [ 251.980178][ T7378] BTRFS info (device loop3): has skinny extents [ 254.075542][ T7442] device syzkaller0 entered promiscuous mode [ 254.161612][ T7444] loop2: detected capacity change from 0 to 1024 [ 254.196666][ T7378] BTRFS error (device loop3): open_ctree failed: -12 [ 254.231278][ T26] kauditd_printk_skb: 57 callbacks suppressed [ 254.231293][ T26] audit: type=1800 audit(1786178422.687:197): pid=7444 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.830" name="file1" dev="loop2" ino=20 res=0 errno=0 [ 254.295347][ T7446] loop0: detected capacity change from 0 to 512 [ 254.312132][ T7444] hfsplus: extend alloc file! (16384,256,150995124) [ 254.399650][ T7446] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 254.570504][ T7446] EXT4-fs (loop0): 1 truncate cleaned up [ 254.641171][ T7446] EXT4-fs (loop0): mounted filesystem without journal. Opts: barrier=0x0000000000000101,errors=remount-ro,noblock_validity,. Quota mode: none. [ 254.885265][ T7446] EXT4-fs error (device loop0): ext4_generic_delete_entry:2729: inode #2: block 13: comm syz.0.831: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 255.038243][ T7446] EXT4-fs (loop0): Remounting filesystem read-only [ 255.109096][ T7444] hfsplus: failed to extend attributes file [ 255.117068][ T7444] hfsplus: extend alloc file! (16384,256,150995124) [ 255.123747][ T7444] hfsplus: failed to extend attributes file [ 255.138636][ T7446] EXT4-fs error (device loop0) in ext4_delete_entry:2800: Corrupt filesystem [ 255.177025][ T7446] EXT4-fs (loop0): Remounting filesystem read-only [ 255.249263][ T7446] EXT4-fs warning (device loop0): ext4_rename_delete:3792: inode #2: comm syz.0.831: Deleting old file: nlink 4, error=-117 [ 255.256517][ T7455] device syzkaller0 entered promiscuous mode [ 255.365886][ T7457] tipc: Enabling of bearer rejected, failed to enable media [ 256.848258][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.085493][ T7484] device syzkaller0 entered promiscuous mode [ 257.842949][ T7494] device syzkaller0 entered promiscuous mode [ 257.945141][ T7498] loop0: detected capacity change from 0 to 64 [ 259.454849][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805f803400: rx timeout, send abort [ 260.190719][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805f803400: abort rx timeout. Force session deactivation [ 260.395269][ T7542] lo speed is unknown, defaulting to 1000 [ 260.401642][ T7542] lo speed is unknown, defaulting to 1000 [ 260.413648][ T7542] lo speed is unknown, defaulting to 1000 [ 260.459209][ T7542] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 260.633575][ T7542] lo speed is unknown, defaulting to 1000 [ 260.642408][ T7542] lo speed is unknown, defaulting to 1000 [ 260.655437][ T7542] lo speed is unknown, defaulting to 1000 [ 260.665246][ T7542] lo speed is unknown, defaulting to 1000 [ 260.668855][ T7547] syz.3.864 uses obsolete (PF_INET,SOCK_PACKET) [ 260.678148][ T7542] lo speed is unknown, defaulting to 1000 [ 262.282746][ T26] audit: type=1800 audit(1786178430.737:198): pid=7581 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.874" name="streaming_maxpacket" dev="configfs" ino=43111 res=0 errno=0 [ 263.185141][ T7590] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 263.192180][ T7590] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 263.247058][ T7590] vhci_hcd vhci_hcd.0: Device attached [ 264.386120][ T5707] vhci_hcd: vhci_device speed not set [ 264.722980][ T7586] loop2: detected capacity change from 0 to 8192 [ 264.776102][ T5694] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 264.796199][ T5707] usb 33-1: new full-speed USB device number 2 using vhci_hcd [ 264.814469][ T7613] loop3: detected capacity change from 0 to 256 [ 264.958752][ T7613] FAT-fs (loop3): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 265.023906][ T7613] FAT-fs (loop3): Filesystem has been set read-only [ 265.035518][ T5694] usb 1-1: Using ep0 maxpacket: 16 [ 265.051139][ T7613] FAT-fs (loop3): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 265.093248][ T7613] FAT-fs (loop3): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 265.107344][ T26] audit: type=1800 audit(1786178433.567:199): pid=7613 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.886" name="file1" dev="loop3" ino=1048620 res=0 errno=0 [ 265.186426][ T5694] usb 1-1: config 0 has no interfaces? [ 265.382587][ T5213] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 265.391105][ T5694] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 4.00 [ 265.427449][ T7592] vhci_hcd: connection reset by peer [ 265.435214][ T5213] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 265.448535][ T5694] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 265.525854][ T154] vhci_hcd: stop threads [ 265.551816][ T5694] usb 1-1: Product: syz [ 265.559706][ T154] vhci_hcd: release socket [ 265.606881][ T5694] usb 1-1: Manufacturer: syz [ 265.626444][ T154] vhci_hcd: disconnect device [ 265.631837][ T5694] usb 1-1: SerialNumber: syz [ 265.669537][ T5694] usb 1-1: config 0 descriptor?? [ 265.726176][ T5694] usb 1-1: can't set config #0, error -71 [ 265.742267][ T5694] usb 1-1: USB disconnect, device number 13 [ 265.795182][ T7651] netlink: 20 bytes leftover after parsing attributes in process `syz.0.896'. [ 266.051115][ T7657] loop4: detected capacity change from 0 to 128 [ 266.643650][ T7657] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 266.666187][ T5704] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 266.711612][ T7657] ext4 filesystem being mounted at /164/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 267.088265][ T5704] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 267.225947][ T5704] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 267.359708][ T5704] usb 4-1: config 220 has no interface number 2 [ 267.374084][ T7659] netlink: 28 bytes leftover after parsing attributes in process `syz.1.899'. [ 268.006023][ T5704] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 268.019223][ T5704] usb 4-1: config 220 interface 0 has no altsetting 0 [ 268.026065][ T5704] usb 4-1: config 220 interface 76 has no altsetting 0 [ 268.032913][ T5704] usb 4-1: config 220 interface 1 has no altsetting 0 [ 268.176743][ T7696] process 'syz.4.900' launched './file2' with NULL argv: empty string added [ 268.206243][ T5704] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 268.215493][ T5704] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 268.281846][ T5704] usb 4-1: Product: syz [ 268.301393][ T5704] usb 4-1: Manufacturer: syz [ 268.323044][ T5704] usb 4-1: SerialNumber: syz [ 268.716691][ T5704] usb 4-1: Found UVC 7.01 device syz (8086:0b07) [ 268.723205][ T5704] usb 4-1: No valid video chain found. [ 268.736425][ T5704] usb 4-1: selecting invalid altsetting 0 [ 268.766152][ T2288] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 268.836919][ T5704] usb 4-1: selecting invalid altsetting 0 [ 268.842696][ T5704] usbtest: probe of 4-1:220.1 failed with error -22 [ 268.868205][ T5704] usb 4-1: USB disconnect, device number 10 [ 269.026057][ T2288] usb 1-1: Using ep0 maxpacket: 16 [ 269.055340][ T4175] udevd[4175]: setting mode of /dev/ttyGS1 to 020660 failed: No such file or directory [ 269.156787][ T2288] usb 1-1: config index 0 descriptor too short (expected 20, got 18) [ 269.174382][ T4175] udevd[4175]: setting owner of /dev/ttyGS1 to uid=0, gid=18 failed: No such file or directory [ 269.215016][ T2288] usb 1-1: config 169 has an invalid interface number: 39 but max is 0 [ 269.325058][ T2288] usb 1-1: config 169 has no interface number 0 [ 269.438358][ T2288] usb 1-1: config 169 interface 39 has no altsetting 0 [ 269.740102][ T2288] usb 1-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=8c.00 [ 269.814744][ T2288] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.965985][ T2288] usb 1-1: Product: syz [ 269.970281][ T2288] usb 1-1: Manufacturer: syz [ 269.974868][ T2288] usb 1-1: SerialNumber: syz [ 269.981215][ T5707] vhci_hcd: vhci_device speed not set [ 270.333451][ T7714] udc-core: couldn't find an available UDC or it's busy [ 270.685855][ T7714] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 270.758408][ T7714] udc-core: couldn't find an available UDC or it's busy [ 270.782162][ T7754] device syzkaller0 entered promiscuous mode [ 270.795819][ T7714] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 270.837624][ T2288] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 270.844032][ T2288] command write [95] error -22 [ 270.943082][ T2288] usb 1-1: USB disconnect, device number 14 [ 271.022151][ T7771] loop4: detected capacity change from 0 to 256 [ 271.069654][ T7770] loop3: detected capacity change from 0 to 8192 [ 271.142155][ T7771] FAT-fs (loop4): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 271.176051][ T7771] FAT-fs (loop4): Filesystem has been set read-only [ 271.182726][ T7771] FAT-fs (loop4): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 271.317792][ T7782] program syz.3.923 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 271.336974][ T7782] netlink: 28 bytes leftover after parsing attributes in process `syz.3.923'. [ 271.363731][ T7771] FAT-fs (loop4): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 271.407875][ T26] audit: type=1800 audit(1786178439.867:200): pid=7771 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.924" name="file1" dev="loop4" ino=1048623 res=0 errno=0 [ 271.791989][ T7789] netlink: 8 bytes leftover after parsing attributes in process `syz.2.928'. [ 272.174467][ T5222] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 272.200391][ T5222] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 272.243068][ T7803] loop2: detected capacity change from 0 to 8192 [ 274.873618][ T7879] program syz.2.930 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 275.434540][ T7894] device syzkaller0 entered promiscuous mode [ 276.406872][ T7917] kvm_set_msr_common: 8 callbacks suppressed [ 276.406890][ T7917] kvm [7905]: vcpu0, guest rIP: 0x9114 disabled perfctr wrmsr: 0xc2 data 0x9d00 [ 276.443625][ T7903] loop0: detected capacity change from 0 to 8192 [ 276.450317][ T7917] kvm [7905]: vcpu0, guest rIP: 0x9114 disabled perfctr wrmsr: 0xc1 data 0x9d00 [ 276.482760][ T7917] APIC base relocation is unsupported by KVM [ 276.499380][ T7916] loop3: detected capacity change from 0 to 8192 [ 276.702127][ T7924] program syz.0.958 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 276.718789][ T7924] netlink: 28 bytes leftover after parsing attributes in process `syz.0.958'. [ 277.066919][ T7927] program syz.3.962 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 277.096113][ T7927] netlink: 28 bytes leftover after parsing attributes in process `syz.3.962'. [ 277.522605][ T7945] netlink: 4 bytes leftover after parsing attributes in process `syz.0.963'. [ 278.358697][ T7952] device syzkaller0 entered promiscuous mode [ 278.472605][ T7961] loop4: detected capacity change from 0 to 256 [ 278.475692][ T7962] Bluetooth: hci0: unsupported parameter 255 [ 278.485151][ T7962] Bluetooth: hci0: unsupported parameter 255 [ 278.505332][ T7961] exFAT-fs (loop4): bogus allocation bitmap size(need : 2, cur : 256) [ 278.651580][ T7968] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 278.677434][ T23] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 278.685762][ T7968] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 278.810784][ T7973] loop4: detected capacity change from 0 to 8192 [ 279.028451][ T7984] program syz.4.977 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 279.045037][ T7984] netlink: 28 bytes leftover after parsing attributes in process `syz.4.977'. [ 279.123953][ T23] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 279.240199][ T23] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 279.584350][ T23] usb 1-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 279.624102][ T23] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 279.692936][ T23] usb 1-1: Product: syz [ 279.758137][ T23] usb 1-1: Manufacturer: syz [ 279.840835][ T23] usb 1-1: SerialNumber: syz [ 280.110427][ T7995] loop3: detected capacity change from 0 to 128 [ 280.231715][ T7996] attempt to access beyond end of device [ 280.231715][ T7996] loop3: rw=2049, want=873, limit=128 [ 280.260952][ T23] usblp 1-1:1.0: usblp0: USB Bidirectional printer dev 15 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 280.295501][ T7999] Bluetooth: hci0: unsupported parameter 255 [ 280.303673][ T7999] Bluetooth: hci0: unsupported parameter 255 [ 280.513367][ T5707] usb 1-1: USB disconnect, device number 15 [ 280.549167][ T5707] usblp0: removed [ 280.585680][ T8016] device syzkaller0 entered promiscuous mode [ 280.796418][ T8023] loop3: detected capacity change from 0 to 128 [ 280.848644][ T8023] affs: Invalid blocksize (512, 1024, 2048, 4096 allowed) [ 280.898523][ T8023] affs: Error parsing options [ 280.998422][ T8028] device syzkaller0 entered promiscuous mode [ 281.064573][ T5694] libceph: connect (1)[c::]:6789 error -101 [ 281.073376][ T5694] libceph: mon0 (1)[c::]:6789 connect error [ 281.629341][ T5694] libceph: connect (1)[c::]:6789 error -101 [ 281.867213][ T8023] ceph: No mds server is up or the cluster is laggy [ 281.986871][ T5694] libceph: mon0 (1)[c::]:6789 connect error [ 283.442131][ T8067] device syzkaller0 entered promiscuous mode [ 283.473548][ T8069] Bluetooth: hci0: unsupported parameter 255 [ 283.484701][ T8069] Bluetooth: hci0: unsupported parameter 255 [ 285.466068][ T8076] loop3: detected capacity change from 0 to 32768 [ 285.531461][ T5628] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 285.562906][ T8076] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz.3.1007 (8076) [ 285.611626][ T8076] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm [ 285.635640][ T8076] BTRFS info (device loop3): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 285.645696][ T8076] BTRFS info (device loop3): use zstd compression, level 3 [ 285.654074][ T8076] BTRFS warning (device loop3): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 285.672997][ T8076] BTRFS info (device loop3): trying to use backup root at mount time [ 285.682212][ T8076] BTRFS info (device loop3): enabling auto defrag [ 285.693920][ T8076] BTRFS info (device loop3): disabling free space tree [ 285.712871][ T8076] BTRFS error (device loop3): cannot disable free space tree [ 285.764031][ T8076] BTRFS error (device loop3): open_ctree failed: -22 [ 285.966231][ T5628] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 285.992250][ T5628] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 286.026375][ T8117] device syzkaller0 entered promiscuous mode [ 286.217370][ T4306] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 286.225926][ T5628] usb 5-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 286.264908][ T5628] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 286.371406][ T5628] usb 5-1: Product: syz [ 286.422180][ T5628] usb 5-1: Manufacturer: syz [ 286.492523][ T5628] usb 5-1: SerialNumber: syz [ 286.646694][ T4306] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 286.787149][ T4306] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 286.856151][ T4306] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 286.865372][ T4306] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 286.945666][ T5628] usblp 5-1:1.0: usblp0: USB Bidirectional printer dev 13 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 287.046149][ T4306] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 287.055695][ T4306] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 287.071504][ T4306] usb 1-1: Product: syz [ 287.078990][ T4306] usb 1-1: Manufacturer: syz [ 287.133565][ T8130] device syzkaller0 entered promiscuous mode [ 287.146963][ T4306] cdc_wdm 1-1:1.0: skipping garbage [ 287.152282][ T4306] cdc_wdm 1-1:1.0: skipping garbage [ 287.156864][ T5707] usb 5-1: USB disconnect, device number 13 [ 287.278704][ T5707] usblp0: removed [ 287.893894][ T4306] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 287.899977][ T4306] cdc_wdm 1-1:1.0: Unknown control protocol [ 287.916873][ T4306] usb 1-1: USB disconnect, device number 16 [ 287.978842][ T8137] loop3: detected capacity change from 0 to 256 [ 288.195260][ T8137] exFAT-fs (loop3): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 288.316190][ T4306] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 288.746107][ T4306] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 288.813752][ T4306] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 288.879885][ T4306] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 288.889332][ T5628] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 288.956327][ T4306] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 289.024913][ T4306] usb 1-1: string descriptor 0 read error: -71 [ 289.041761][ T4306] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 289.056427][ T4306] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 289.101636][ T4306] usb 1-1: can't set config #1, error -71 [ 289.122783][ T4306] usb 1-1: USB disconnect, device number 17 [ 289.159398][ T5628] usb 4-1: Using ep0 maxpacket: 32 [ 289.301762][ T5628] usb 4-1: config index 0 descriptor too short (expected 16914, got 18) [ 289.335954][ T5628] usb 4-1: config 232 has too many interfaces: 95, using maximum allowed: 32 [ 289.344767][ T5628] usb 4-1: config 232 has an invalid descriptor of length 0, skipping remainder of the config [ 289.404211][ T5628] usb 4-1: config 232 has 0 interfaces, different from the descriptor's value: 95 [ 289.438381][ T5628] usb 4-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7 [ 289.456019][ T5628] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 289.705508][ T8180] device ip6gre1 entered promiscuous mode [ 289.886437][ T5628] usb 4-1: string descriptor 0 read error: -71 [ 289.896118][ T5707] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 289.909096][ T5628] usb 4-1: USB disconnect, device number 11 [ 290.096052][ T4306] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 290.266159][ T5707] usb 1-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 290.866197][ T4306] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 290.886881][ T4306] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 290.916261][ T5707] usb 1-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 290.926919][ T5707] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.935519][ T5707] usb 1-1: Product: syz [ 290.943940][ T5707] usb 1-1: Manufacturer: syz [ 290.948636][ T5707] usb 1-1: SerialNumber: syz [ 290.994367][ T5707] usb 1-1: config 0 descriptor?? [ 291.014983][ T8219] block device autoloading is deprecated and will be removed. [ 291.026909][ T8175] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 291.073196][ T5707] streamzap 1-1:0.0: streamzap_probe: Unexpected desc.bNumEndpoints (0) [ 291.241383][ T8225] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1050'. [ 291.251514][ T4306] usb 3-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 291.266954][ T4306] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 291.275856][ T4306] usb 3-1: Product: syz [ 291.286532][ T4306] usb 3-1: Manufacturer: syz [ 291.291261][ T4306] usb 3-1: SerialNumber: syz [ 291.463910][ T5628] usb 1-1: USB disconnect, device number 18 [ 291.508465][ T8233] device bond0 entered promiscuous mode [ 291.551088][ T8233] device bond_slave_0 entered promiscuous mode [ 291.598754][ T8233] device bond_slave_1 entered promiscuous mode [ 291.636105][ T8233] device batadv0 entered promiscuous mode [ 291.703253][ T8234] netlink: 'syz.1.1053': attribute type 10 has an invalid length. [ 291.730775][ T8234] device syz_tun entered promiscuous mode [ 291.794262][ T8234] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 291.845245][ T8238] device syzkaller0 entered promiscuous mode [ 292.187487][ T4306] usblp 3-1:1.0: usblp0: USB Bidirectional printer dev 5 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 292.427181][ T8251] device syzkaller0 entered promiscuous mode [ 293.226605][ T5707] usb 3-1: USB disconnect, device number 5 [ 293.234555][ T5707] usblp0: removed [ 293.301257][ T8268] loop0: detected capacity change from 0 to 2048 [ 293.400929][ T8268] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 293.442884][ T8267] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1063'. [ 293.467207][ T8270] loop3: detected capacity change from 0 to 8192 [ 293.671543][ T4235] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 293.707714][ T8276] program syz.3.1065 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 294.166107][ T4235] usb 5-1: config 0 interface 0 altsetting 255 bulk endpoint 0x4 has invalid maxpacket 61 [ 294.236242][ T4235] usb 5-1: config 0 interface 0 has no altsetting 0 [ 294.310247][ T8284] device bond0 entered promiscuous mode [ 294.322687][ T8284] device bond_slave_0 entered promiscuous mode [ 294.398598][ T8284] device bond_slave_1 entered promiscuous mode [ 294.446378][ T4235] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 294.474102][ T4235] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 294.518806][ T4235] usb 5-1: Product: syz [ 294.533330][ T4235] usb 5-1: Manufacturer: syz [ 294.583826][ T4235] usb 5-1: SerialNumber: syz [ 294.608196][ T4235] usb 5-1: config 0 descriptor?? [ 294.640843][ T8284] device batadv0 entered promiscuous mode [ 294.647516][ T8272] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 294.693531][ T4235] usb 5-1: selecting invalid altsetting 0 [ 294.700414][ T8284] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 294.710126][ T8284] Cannot create hsr debugfs directory [ 294.716487][ T8286] netlink: 'syz.3.1067': attribute type 10 has an invalid length. [ 294.749509][ T8286] device syz_tun entered promiscuous mode [ 294.768632][ T8286] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 294.937251][ T8272] usb 5-1: selecting invalid altsetting 0 [ 294.944754][ T8272] usb 5-1: 0:0: usb_set_interface failed (-22) [ 294.951277][ T8272] usb 5-1: selecting invalid altsetting 0 [ 294.957110][ T8272] usb 5-1: 0:0: usb_set_interface failed (-22) [ 294.968184][ T8272] usb 5-1: selecting invalid altsetting 0 [ 294.974004][ T8272] usb 5-1: 0:0: usb_set_interface failed (-22) [ 294.981799][ T8272] usb 5-1: selecting invalid altsetting 0 [ 294.988108][ T8272] usb 5-1: 0:0: usb_set_interface failed (-22) [ 294.996203][ T8271] usb 5-1: selecting invalid altsetting 0 [ 295.001940][ T8271] usb 5-1: 0:0: usb_set_interface failed (-22) [ 295.014944][ T8271] usb 5-1: selecting invalid altsetting 0 [ 295.020822][ T8271] usb 5-1: 0:0: usb_set_interface failed (-22) [ 295.032473][ T8271] usb 5-1: selecting invalid altsetting 0 [ 295.040409][ T8271] usb 5-1: 0:0: usb_set_interface failed (-22) [ 295.065655][ T4235] usb 5-1: USB disconnect, device number 14 [ 295.646460][ T8313] md: md2 stopped. [ 295.917033][ T8333] device bond0 entered promiscuous mode [ 295.930873][ T8333] device bond_slave_0 entered promiscuous mode [ 295.950399][ T8333] device bond_slave_1 entered promiscuous mode [ 295.972345][ T8333] device batadv0 entered promiscuous mode [ 295.992448][ T8333] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 296.014194][ T8333] Cannot create hsr debugfs directory [ 296.031431][ T8335] netlink: 'syz.0.1085': attribute type 10 has an invalid length. [ 296.053751][ T8335] device syz_tun entered promiscuous mode [ 296.102928][ T8335] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 296.186161][ T4235] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 296.280983][ T8341] loop0: detected capacity change from 0 to 512 [ 296.405875][ T8341] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpjquota=,errors=continue,noblock_validity,,errors=continue. Quota mode: none. [ 296.456686][ T8341] EXT4-fs warning (device loop0): dx_probe:869: inode #2: comm syz.0.1086: Unimplemented hash flags: 0x0001 [ 296.539462][ T8341] EXT4-fs warning (device loop0): dx_probe:966: inode #2: comm syz.0.1086: Corrupt directory, running e2fsck is recommended [ 296.616629][ T4235] usb 4-1: config 0 interface 0 altsetting 255 bulk endpoint 0x4 has invalid maxpacket 61 [ 296.626722][ T4235] usb 4-1: config 0 interface 0 has no altsetting 0 [ 296.651966][ T8341] EXT4-fs error (device loop0): ext4_readdir:263: inode #2: block 3: comm syz.0.1086: path /206/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=4294967295, rec_len=7, size=1024 fake=0 [ 296.806238][ T4235] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 296.821763][ T4235] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 296.830537][ T4235] usb 4-1: Product: syz [ 296.834790][ T4235] usb 4-1: Manufacturer: syz [ 296.839676][ T4235] usb 4-1: SerialNumber: syz [ 296.857115][ T4235] usb 4-1: config 0 descriptor?? [ 296.876273][ T8329] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 296.929123][ T4235] usb 4-1: selecting invalid altsetting 0 [ 297.195419][ T8329] usb 4-1: selecting invalid altsetting 0 [ 297.201497][ T8329] usb 4-1: 0:0: usb_set_interface failed (-22) [ 297.221736][ T8329] usb 4-1: selecting invalid altsetting 0 [ 297.233444][ T8329] usb 4-1: 0:0: usb_set_interface failed (-22) [ 297.257321][ T8368] usb 4-1: selecting invalid altsetting 0 [ 297.272144][ T8368] usb 4-1: 0:0: usb_set_interface failed (-22) [ 297.283346][ T8368] usb 4-1: selecting invalid altsetting 0 [ 297.295949][ T8368] usb 4-1: 0:0: usb_set_interface failed (-22) [ 297.313633][ T8328] usb 4-1: selecting invalid altsetting 0 [ 297.326327][ T8328] usb 4-1: 0:0: usb_set_interface failed (-22) [ 297.336106][ T8328] usb 4-1: selecting invalid altsetting 0 [ 297.341851][ T8328] usb 4-1: 0:0: usb_set_interface failed (-22) [ 297.366582][ T8328] usb 4-1: selecting invalid altsetting 0 [ 297.372455][ T8328] usb 4-1: 0:0: usb_set_interface failed (-22) [ 297.388510][ T4235] usb 4-1: USB disconnect, device number 12 [ 297.459370][ T8365] loop0: detected capacity change from 0 to 32768 [ 297.476521][ T8365] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz.0.1092 (8365) [ 297.512673][ T8365] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm [ 297.538165][ T8365] BTRFS info (device loop0): setting nodatacow, compression disabled [ 297.551569][ T8365] BTRFS info (device loop0): turning on flush-on-commit [ 297.561756][ T8365] BTRFS info (device loop0): setting incompat feature flag for COMPRESS_LZO (0x8) [ 297.571351][ T8365] BTRFS info (device loop0): use lzo compression, level 0 [ 297.581385][ T8365] BTRFS info (device loop0): setting nodatasum [ 297.593577][ T8365] BTRFS info (device loop0): use no compression [ 297.609439][ T8365] BTRFS info (device loop0): trying to use backup root at mount time [ 297.627786][ T8365] BTRFS info (device loop0): max_inline at 0 [ 297.640371][ T8365] BTRFS info (device loop0): using free space tree [ 297.653281][ T8365] BTRFS info (device loop0): has skinny extents [ 297.751346][ T5211] BTRFS warning (device loop0): checksum verify failed on 5332992 wanted 0x0a5e5d25 found 0xcee3a718 level 0 [ 297.765531][ T8365] BTRFS warning (device loop0): couldn't read tree root [ 297.773208][ T5211] BTRFS warning (device loop0): checksum verify failed on 5324800 wanted 0x9f73850b found 0xe06dfc66 level 0 [ 297.785289][ T8365] BTRFS warning (device loop0): couldn't read tree root [ 297.793258][ T8365] BTRFS error (device loop0): parent transid verify failed on 5255168 wanted 5 found 7 [ 297.803584][ T8365] BTRFS warning (device loop0): couldn't read tree root [ 297.844243][ T8365] BTRFS info (device loop0): enabling ssd optimizations [ 297.855578][ T8365] BTRFS info (device loop0): clearing free space tree [ 297.866246][ T8365] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 297.880557][ T8365] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 297.903604][ T8365] BTRFS info (device loop0): creating free space tree [ 297.963858][ T8371] loop2: detected capacity change from 0 to 8192 [ 297.967434][ T8365] BTRFS info (device loop0): setting compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 297.992671][ T8365] BTRFS info (device loop0): setting compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 298.116117][ T8393] loop3: detected capacity change from 0 to 8192 [ 298.212246][ T8400] device syzkaller0 entered promiscuous mode [ 298.375082][ T8403] program syz.3.1099 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 298.394882][ T8403] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1099'. [ 298.803222][ T5879] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 10 /dev/loop0 scanned by udevd (5879) [ 300.157365][ T8432] program syz.2.1097 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 300.604195][ T8434] fuse: Bad value for 'fd' [ 300.661862][ T8444] device syzkaller0 entered promiscuous mode [ 301.296004][ T6373] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 301.956321][ T6373] usb 1-1: config 0 interface 0 altsetting 255 bulk endpoint 0x4 has invalid maxpacket 61 [ 302.856259][ T6373] usb 1-1: config 0 interface 0 has no altsetting 0 [ 303.046214][ T6373] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 303.056974][ T6373] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 303.075672][ T6373] usb 1-1: Product: syz [ 303.085802][ T6373] usb 1-1: Manufacturer: syz [ 303.099402][ T6373] usb 1-1: SerialNumber: syz [ 303.167881][ T6373] usb 1-1: config 0 descriptor?? [ 303.276945][ T8440] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 303.464218][ T6373] usb 1-1: selecting invalid altsetting 0 [ 303.896443][ T8495] loop3: detected capacity change from 0 to 8192 [ 303.927721][ T6373] usb 1-1: USB disconnect, device number 19 [ 304.203641][ T8512] program syz.3.1124 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 305.569675][ T8525] loop3: detected capacity change from 0 to 2048 [ 305.974937][ T8525] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found [ 306.066205][ T8525] UDF-fs: Scanning with blocksize 512 failed [ 306.163650][ T8525] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 306.171596][ T8535] device syzkaller0 entered promiscuous mode [ 307.242019][ T8552] tipc: Started in network mode [ 307.256244][ T8552] tipc: Node identity de6bb01ab6a3, cluster identity 4711 [ 307.266479][ T8552] tipc: Enabled bearer , priority 0 [ 307.284988][ T8552] device syzkaller0 entered promiscuous mode [ 307.310481][ T8552] tipc: Resetting bearer [ 307.319836][ T8550] tipc: Resetting bearer [ 307.333334][ T8550] tipc: Disabling bearer [ 307.498377][ T4764] attempt to access beyond end of device [ 307.498377][ T4764] loop3: rw=1, want=2050, limit=2048 [ 307.508880][ T8568] hub 8-0:1.0: USB hub found [ 307.546241][ T4764] Buffer I/O error on dev loop3, logical block 1024, lost async page write [ 307.555181][ T4764] attempt to access beyond end of device [ 307.555181][ T4764] loop3: rw=1, want=2050, limit=2048 [ 307.558871][ T8568] hub 8-0:1.0: 1 port detected [ 307.579586][ T4764] Buffer I/O error on dev loop3, logical block 1024, lost async page write [ 307.590724][ T4764] attempt to access beyond end of device [ 307.590724][ T4764] loop3: rw=1, want=2050, limit=2048 [ 307.609609][ T4764] Buffer I/O error on dev loop3, logical block 1024, lost async page write [ 307.635207][ T4764] attempt to access beyond end of device [ 307.635207][ T4764] loop3: rw=1, want=2050, limit=2048 [ 307.692046][ T4764] Buffer I/O error on dev loop3, logical block 1024, lost async page write [ 307.737225][ T4764] attempt to access beyond end of device [ 307.737225][ T4764] loop3: rw=1, want=2052, limit=2048 [ 307.751087][ T4764] Buffer I/O error on dev loop3, logical block 1025, lost async page write [ 308.593666][ T4764] attempt to access beyond end of device [ 308.593666][ T4764] loop3: rw=1, want=2052, limit=2048 [ 308.608738][ T4764] Buffer I/O error on dev loop3, logical block 1025, lost async page write [ 308.618193][ T4764] attempt to access beyond end of device [ 308.618193][ T4764] loop3: rw=1, want=2052, limit=2048 [ 308.629907][ T4764] Buffer I/O error on dev loop3, logical block 1025, lost async page write [ 308.639558][ T4764] attempt to access beyond end of device [ 308.639558][ T4764] loop3: rw=1, want=2052, limit=2048 [ 308.652193][ T4764] Buffer I/O error on dev loop3, logical block 1025, lost async page write [ 308.671316][ T4764] attempt to access beyond end of device [ 308.671316][ T4764] loop3: rw=1, want=2054, limit=2048 [ 308.727759][ T4764] Buffer I/O error on dev loop3, logical block 1026, lost async page write [ 308.848374][ T8582] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 308.861931][ T8582] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 308.887595][ T8582] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 308.922564][ T8582] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 308.942900][ T8582] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 308.958610][ T8582] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 308.969786][ T8582] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 309.015617][ T8590] device syzkaller0 entered promiscuous mode [ 311.254409][ T8620] loop0: detected capacity change from 0 to 2048 [ 311.360448][ T8620] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 311.378766][ T8620] UDF-fs: Scanning with blocksize 512 failed [ 311.433389][ T8620] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 311.571796][ T8634] loop3: detected capacity change from 0 to 8192 [ 311.609714][ T8622] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 311.988235][ T8648] program syz.3.1157 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 312.336918][ T8648] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1157'. [ 312.478531][ T4764] attempt to access beyond end of device [ 312.478531][ T4764] loop0: rw=1, want=2050, limit=2048 [ 312.508433][ T8655] device syzkaller0 entered promiscuous mode [ 312.524670][ T4764] Buffer I/O error on dev loop0, logical block 1024, lost async page write [ 312.557976][ T4764] attempt to access beyond end of device [ 312.557976][ T4764] loop0: rw=1, want=2050, limit=2048 [ 312.584919][ T4764] Buffer I/O error on dev loop0, logical block 1024, lost async page write [ 312.614309][ T4764] attempt to access beyond end of device [ 312.614309][ T4764] loop0: rw=1, want=2050, limit=2048 [ 312.677876][ T4764] Buffer I/O error on dev loop0, logical block 1024, lost async page write [ 312.737494][ T4764] attempt to access beyond end of device [ 312.737494][ T4764] loop0: rw=1, want=2050, limit=2048 [ 312.775870][ T4764] Buffer I/O error on dev loop0, logical block 1024, lost async page write [ 312.822482][ T4764] attempt to access beyond end of device [ 312.822482][ T4764] loop0: rw=1, want=2052, limit=2048 [ 312.879351][ T4764] Buffer I/O error on dev loop0, logical block 1025, lost async page write [ 312.891822][ T4764] attempt to access beyond end of device [ 312.891822][ T4764] loop0: rw=1, want=2052, limit=2048 [ 312.905465][ T4764] Buffer I/O error on dev loop0, logical block 1025, lost async page write [ 312.914216][ T4764] attempt to access beyond end of device [ 312.914216][ T4764] loop0: rw=1, want=2052, limit=2048 [ 312.950427][ T4764] Buffer I/O error on dev loop0, logical block 1025, lost async page write [ 312.970723][ T4764] attempt to access beyond end of device [ 312.970723][ T4764] loop0: rw=1, want=2052, limit=2048 [ 313.009258][ T4764] Buffer I/O error on dev loop0, logical block 1025, lost async page write [ 313.037565][ T4764] attempt to access beyond end of device [ 313.037565][ T4764] loop0: rw=1, want=2054, limit=2048 [ 313.051578][ T4764] Buffer I/O error on dev loop0, logical block 1026, lost async page write [ 314.113766][ T8694] loop3: detected capacity change from 0 to 8192 [ 315.041457][ T8712] program syz.3.1174 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 315.056070][ T8712] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1174'. [ 315.297170][ T8718] device syzkaller0 entered promiscuous mode [ 315.569833][ T8732] loop0: detected capacity change from 0 to 128 [ 315.624928][ T8732] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 315.641527][ T8732] ext4 filesystem being mounted at /222/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 315.653137][ T8722] device syzkaller0 entered promiscuous mode [ 316.327322][ T8745] dlm: Using TCP for communications [ 316.899513][ T8769] loop3: detected capacity change from 0 to 8192 [ 317.089247][ T8782] program syz.3.1192 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 317.105298][ T8782] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1192'. [ 317.178060][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.221965][ T8765] loop2: detected capacity change from 0 to 8192 [ 317.683395][ T8795] device syzkaller0 entered promiscuous mode [ 317.863709][ T8801] binder: 8798:8801 ioctl c0306201 0 returned -14 [ 317.876790][ T8804] configfs-gadget gadget: uvc: uvc_function_bind() [ 317.883815][ T8804] ================================================================== [ 317.892536][ T8804] BUG: KASAN: double-free or invalid-free in kfree+0xef/0x2a0 [ 317.900035][ T8804] [ 317.902370][ T8804] CPU: 1 PID: 8804 Comm: syz.0.1202 Not tainted syzkaller #0 [ 317.909756][ T8804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 317.919848][ T8804] Call Trace: [ 317.923146][ T8804] [ 317.926090][ T8804] dump_stack_lvl+0x188/0x250 [ 317.930798][ T8804] ? show_regs_print_info+0x20/0x20 [ 317.936017][ T8804] ? _printk+0xda/0x130 [ 317.940204][ T8804] ? load_image+0x410/0x410 [ 317.944730][ T8804] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 317.950213][ T8804] ? kfree+0xef/0x2a0 [ 317.954203][ T8804] print_address_description+0x60/0x2d0 [ 317.959760][ T8804] ? kfree+0xef/0x2a0 [ 317.963756][ T8804] ? kfree+0xef/0x2a0 [ 317.967750][ T8804] kasan_report_invalid_free+0x3a/0x70 [ 317.973247][ T8804] ____kasan_slab_free+0xf3/0x110 [ 317.978290][ T8804] slab_free_freelist_hook+0xec/0x170 [ 317.983680][ T8804] ? kobject_set_name_vargs+0xc6/0x110 [ 317.989161][ T8804] kfree+0xef/0x2a0 [ 317.992999][ T8804] kobject_set_name_vargs+0xc6/0x110 [ 317.998309][ T8804] dev_set_name+0xdf/0x130 [ 318.002767][ T8804] ? get_device+0x30/0x30 [ 318.007142][ T8804] __video_register_device+0x354e/0x4450 [ 318.012827][ T8804] ? v4l2_prio_check+0x150/0x150 [ 318.017787][ T8804] ? __init_waitqueue_head+0xa4/0x140 [ 318.023189][ T8804] ? strlcpy+0x83/0xc0 [ 318.027302][ T8804] ? strlcpy+0x83/0xc0 [ 318.031411][ T8804] uvc_register_video+0x22f/0x2d0 [ 318.036461][ T8804] uvc_function_bind+0xcde/0x12d0 [ 318.041545][ T8804] usb_add_function+0x2d9/0x980 [ 318.046430][ T8804] configfs_composite_bind+0xa02/0xf60 [ 318.051918][ T8804] ? os_desc_qw_sign_store+0x130/0x130 [ 318.057400][ T8804] udc_bind_to_driver+0x203/0x5f0 [ 318.062486][ T8804] usb_gadget_probe_driver+0x1fb/0x380 [ 318.067970][ T8804] gadget_dev_desc_UDC_store+0x1ba/0x2e0 [ 318.073642][ T8804] configfs_write_iter+0x30b/0x400 [ 318.078774][ T8804] ? gadget_dev_desc_UDC_show+0x80/0x80 [ 318.084448][ T8804] vfs_write+0x748/0xd70 [ 318.088719][ T8804] ? file_end_write+0x250/0x250 [ 318.093613][ T8804] ? mutex_lock_nested+0x17/0x20 [ 318.098576][ T8804] ? __fdget_pos+0x2bf/0x370 [ 318.103182][ T8804] ? ksys_write+0x70/0x260 [ 318.107627][ T8804] ksys_write+0x153/0x260 [ 318.111981][ T8804] ? __ia32_sys_read+0x80/0x80 [ 318.116766][ T8804] ? lockdep_hardirqs_on+0x94/0x140 [ 318.121984][ T8804] do_syscall_64+0x4c/0xa0 [ 318.126411][ T8804] ? clear_bhb_loop+0x30/0x80 [ 318.131227][ T8804] ? clear_bhb_loop+0x30/0x80 [ 318.135934][ T8804] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 318.141863][ T8804] RIP: 0033:0x7f11808af0d9 [ 318.146298][ T8804] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 318.165920][ T8804] RSP: 002b:00007f117eb07028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 318.174364][ T8804] RAX: ffffffffffffffda RBX: 00007f1180b36fa0 RCX: 00007f11808af0d9 [ 318.182438][ T8804] RDX: 000000000000000c RSI: 00002000000005c0 RDI: 0000000000000004 [ 318.190424][ T8804] RBP: 00007f1180946024 R08: 0000000000000000 R09: 0000000000000000 [ 318.198417][ T8804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 318.206405][ T8804] R13: 00007f1180b37038 R14: 00007f1180b36fa0 R15: 00007ffebf53a278 [ 318.214414][ T8804] [ 318.217454][ T8804] [ 318.219778][ T8804] Allocated by task 6009: [ 318.224106][ T8804] __kasan_kmalloc+0xaf/0xe0 [ 318.228713][ T8804] kvasprintf+0xe3/0x1a0 [ 318.232967][ T8804] kobject_set_name_vargs+0x5d/0x110 [ 318.238278][ T8804] dev_set_name+0xdf/0x130 [ 318.242711][ T8804] __video_register_device+0x354e/0x4450 [ 318.248359][ T8804] uvc_register_video+0x22f/0x2d0 [ 318.253394][ T8804] uvc_function_bind+0xcde/0x12d0 [ 318.258433][ T8804] usb_add_function+0x2d9/0x980 [ 318.263463][ T8804] configfs_composite_bind+0xa02/0xf60 [ 318.268943][ T8804] udc_bind_to_driver+0x203/0x5f0 [ 318.273985][ T8804] usb_gadget_probe_driver+0x1fb/0x380 [ 318.279455][ T8804] gadget_dev_desc_UDC_store+0x1ba/0x2e0 [ 318.285098][ T8804] configfs_write_iter+0x30b/0x400 [ 318.290220][ T8804] vfs_write+0x748/0xd70 [ 318.294474][ T8804] ksys_write+0x153/0x260 [ 318.298809][ T8804] do_syscall_64+0x4c/0xa0 [ 318.303233][ T8804] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 318.309134][ T8804] [ 318.311476][ T8804] The buggy address belongs to the object at ffff888146c81118 [ 318.311476][ T8804] which belongs to the cache kmalloc-8 of size 8 [ 318.325187][ T8804] The buggy address is located 0 bytes inside of [ 318.325187][ T8804] 8-byte region [ffff888146c81118, ffff888146c81120) [ 318.338132][ T8804] The buggy address belongs to the page: [ 318.343778][ T8804] page:ffffea00051b2040 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888146c81118 pfn:0x146c81 [ 318.355326][ T8804] flags: 0x57ff00000000200(slab|node=1|zone=2|lastcpupid=0x7ff) [ 318.363000][ T8804] raw: 057ff00000000200 ffffea000521b648 ffffea0005076488 ffff888016c41280 [ 318.371736][ T8804] raw: ffff888146c81118 0000000000660036 00000001ffffffff 0000000000000000 [ 318.380328][ T8804] page dumped because: kasan: bad access detected [ 318.386880][ T8804] page_owner tracks the page as allocated [ 318.392605][ T8804] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 5970737195, free_ts 0 [ 318.407583][ T8804] get_page_from_freelist+0x24f6/0x2670 [ 318.413159][ T8804] __alloc_pages+0x1ee/0x480 [ 318.417780][ T8804] alloc_page_interleave+0x24/0x1e0 [ 318.423036][ T8804] new_slab+0xc0/0x4b0 [ 318.427118][ T8804] ___slab_alloc+0x807/0xdd0 [ 318.431727][ T8804] __kmalloc_track_caller+0x11b/0x330 [ 318.437118][ T8804] kstrdup_const+0x51/0x90 [ 318.441550][ T8804] __kernfs_new_node+0xa8/0x6b0 [ 318.446414][ T8804] kernfs_new_node+0x148/0x250 [ 318.451202][ T8804] kernfs_create_dir_ns+0x40/0x120 [ 318.456334][ T8804] sysfs_create_dir_ns+0x12c/0x290 [ 318.461459][ T8804] kobject_add_internal+0x5ba/0xcd0 [ 318.466673][ T8804] kobject_init_and_add+0x128/0x190 [ 318.471904][ T8804] bus_add_driver+0x1de/0x5d0 [ 318.476601][ T8804] driver_register+0x32d/0x430 [ 318.481513][ T8804] acpi_ac_init+0xfb/0x160 [ 318.485950][ T8804] page_owner free stack trace missing [ 318.491326][ T8804] [ 318.493661][ T8804] Memory state around the buggy address: [ 318.499295][ T8804] ffff888146c81000: 03 fc fc fc fc 07 fc fc fc fc 07 fc fc fc fc 07 [ 318.507374][ T8804] ffff888146c81080: fc fc fc fc 07 fc fc fc fc 07 fc fc fc fc fb fc [ 318.515457][ T8804] >ffff888146c81100: fc fc fc fb fc fc fc fc fb fc fc fc fc 07 fc fc [ 318.519997][ T8816] program syz.2.1190 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 318.523531][ T8804] ^ [ 318.523596][ T8804] ffff888146c81180: fc fc 07 fc fc fc fc 07 fc fc fc fc 00 fc fc fc [ 318.523610][ T8804] ffff888146c81200: fc 00 fc fc fc fc 00 fc fc fc fc 06 fc fc fc fc [ 318.536959][ T8816] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1190'. [ 318.537631][ T8804] ================================================================== [ 318.537642][ T8804] Disabling lock debugging due to kernel taint [ 318.569596][ T8806] device syzkaller0 entered promiscuous mode [ 318.594155][ T8804] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 318.601390][ T8804] CPU: 0 PID: 8804 Comm: syz.0.1202 Tainted: G B syzkaller #0 [ 318.610247][ T8804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 318.620309][ T8804] Call Trace: [ 318.623699][ T8804] [ 318.626622][ T8804] dump_stack_lvl+0x188/0x250 [ 318.631296][ T8804] ? show_regs_print_info+0x20/0x20 [ 318.636493][ T8804] ? load_image+0x410/0x410 [ 318.641013][ T8804] panic+0x2f8/0x850 [ 318.644928][ T8804] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 318.651091][ T8804] ? bpf_jit_dump+0xd0/0xd0 [ 318.655593][ T8804] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 318.661738][ T8804] ? _raw_spin_unlock+0x40/0x40 [ 318.666585][ T8804] ? kfree+0xef/0x2a0 [ 318.670557][ T8804] ? kfree+0xef/0x2a0 [ 318.674547][ T8804] check_panic_on_warn+0x80/0xa0 [ 318.679483][ T8804] ? kfree+0xef/0x2a0 [ 318.683448][ T8804] end_report+0x6d/0xf0 [ 318.687607][ T8804] kasan_report_invalid_free+0x59/0x70 [ 318.693072][ T8804] ____kasan_slab_free+0xf3/0x110 [ 318.698097][ T8804] slab_free_freelist_hook+0xec/0x170 [ 318.703469][ T8804] ? kobject_set_name_vargs+0xc6/0x110 [ 318.708939][ T8804] kfree+0xef/0x2a0 [ 318.712744][ T8804] kobject_set_name_vargs+0xc6/0x110 [ 318.718024][ T8804] dev_set_name+0xdf/0x130 [ 318.722455][ T8804] ? get_device+0x30/0x30 [ 318.726779][ T8804] __video_register_device+0x354e/0x4450 [ 318.732582][ T8804] ? v4l2_prio_check+0x150/0x150 [ 318.737507][ T8804] ? __init_waitqueue_head+0xa4/0x140 [ 318.742961][ T8804] ? strlcpy+0x83/0xc0 [ 318.747074][ T8804] ? strlcpy+0x83/0xc0 [ 318.751136][ T8804] uvc_register_video+0x22f/0x2d0 [ 318.756152][ T8804] uvc_function_bind+0xcde/0x12d0 [ 318.761163][ T8804] usb_add_function+0x2d9/0x980 [ 318.766022][ T8804] configfs_composite_bind+0xa02/0xf60 [ 318.771463][ T8804] ? os_desc_qw_sign_store+0x130/0x130 [ 318.776905][ T8804] udc_bind_to_driver+0x203/0x5f0 [ 318.781910][ T8804] usb_gadget_probe_driver+0x1fb/0x380 [ 318.787354][ T8804] gadget_dev_desc_UDC_store+0x1ba/0x2e0 [ 318.792992][ T8804] configfs_write_iter+0x30b/0x400 [ 318.798084][ T8804] ? gadget_dev_desc_UDC_show+0x80/0x80 [ 318.803608][ T8804] vfs_write+0x748/0xd70 [ 318.807829][ T8804] ? file_end_write+0x250/0x250 [ 318.812662][ T8804] ? mutex_lock_nested+0x17/0x20 [ 318.817717][ T8804] ? __fdget_pos+0x2bf/0x370 [ 318.822312][ T8804] ? ksys_write+0x70/0x260 [ 318.826768][ T8804] ksys_write+0x153/0x260 [ 318.831105][ T8804] ? __ia32_sys_read+0x80/0x80 [ 318.835853][ T8804] ? lockdep_hardirqs_on+0x94/0x140 [ 318.841050][ T8804] do_syscall_64+0x4c/0xa0 [ 318.845451][ T8804] ? clear_bhb_loop+0x30/0x80 [ 318.850108][ T8804] ? clear_bhb_loop+0x30/0x80 [ 318.854774][ T8804] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 318.860663][ T8804] RIP: 0033:0x7f11808af0d9 [ 318.865064][ T8804] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 318.884678][ T8804] RSP: 002b:00007f117eb07028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 318.893083][ T8804] RAX: ffffffffffffffda RBX: 00007f1180b36fa0 RCX: 00007f11808af0d9 [ 318.901052][ T8804] RDX: 000000000000000c RSI: 00002000000005c0 RDI: 0000000000000004 [ 318.909023][ T8804] RBP: 00007f1180946024 R08: 0000000000000000 R09: 0000000000000000 [ 318.916982][ T8804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 318.924938][ T8804] R13: 00007f1180b37038 R14: 00007f1180b36fa0 R15: 00007ffebf53a278 [ 318.932898][ T8804] [ 318.936057][ T8804] Kernel Offset: disabled [ 318.940959][ T8804] Rebooting in 86400 seconds..