last executing test programs: 3m31.369483672s ago: executing program 3 (id=231): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000340), 0x103080) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r0, 0x40045402, &(0x7f0000000140)=0x1) ppoll(&(0x7f0000000840)=[{r0, 0x80a0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000083c0)={{0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000380)={0x0, 0x9dc8, 0x0, 0x0, 0xf}) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) 3m29.89845568s ago: executing program 3 (id=239): syz_mount_image$ext4(&(0x7f0000000400)='ext4\x00', &(0x7f0000000440)='./file1\x00', 0x4000, &(0x7f0000000480), 0x1, 0x3d0, &(0x7f00000004c0)="$eJzs3M1uG0UcAPD/br5I+mEjcUCFgyUQBAFxHQhQhEThyscFeAArSUuF21SNkWjJoSBOnDggbhz6Ahx4gKpCSEi8Ai+AKlUozQFuQWvvOm4cp7Fix2r6+0mjndkdZ/bv3axm1rsTwGOrEhHnI2IiIhYjopSvT/MUN9spq3d/c2N5a3NjOYnt7U/+SSLJ1xV/K8mXJ/LCfBqRfhfxzM3edtev3/ii3misXsvL1eblq9X16zdevXS5fnH14uqV2pvnarWlxbdqrw8t1p+ef+ncxPvnz/z8V+nO0vT0bLa/J/Nt3XEMSyUqne9kt6VhNzZm0+PeAQAADiTN+/6Trf5/KSZaubZSVDfGunMAAADAUGy/my8BAACAYywx9gcAAIBjrngO4P7mxnKRxvg4wpG7915ElHfebd7qxD8ZT+R1pkb4fmslIq6+kJSyFCN6DxkAoNudrP9zdq/+XxpPd9WbiWj1h2aH3H5lV7m3/5PeHXKTD8j6f+9ExFZP/y8tqpQn8tKpVldxKrlwqbF6NiJOR8R8TM1k5do+bXzw7y8f99uWxf97cup0kbL2s+VOjfTu5MyDn1mpN+uHibnbvW8izkzuFX/S6f8mETF3iDYmvr71dr9tD49/tLZvRby45/Hfmbkn2X9+omrrfKgWZ0Wv/7799aN+7Y87/uz4z+0ffznpnq9pffA2bn/+57P9tnWPfwY5/6eTT1v5Ylz2Vb3ZvFaLmE4+7F2/uPPZolzUz+Kff27v///i+pfkc1qdzK8Bg/r+h99eOUj8WcraL8aCRyGLf2Wg4z945o3bf3zWr/2Hx58d//YcYPP5moNc/w66g4f57gAAAOBRkbbuayTpQiefpgsL7fsdT8Vc2lhbb758Ye3LKyvt+x/lmEqLO12lrvuhtfbP6J3y4q7yaxHxZET8WJptlReW1xor4w4eAAAAHhMn+oz/M38f2VMIAAAAwMiVx70DAAAAwMgZ/wMAAMCxdph5/WRkZI5rZtxXJgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEfb/wEAAP//Wt22ag==") madvise(&(0x7f00003c1000/0x1000)=nil, 0xdfc3efff, 0x4) syz_emit_ethernet(0x0, 0x0, 0x0) setxattr(&(0x7f00000009c0)='./file0\x00', &(0x7f0000000080)=@known='trusted.overlay.impure\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) 3m29.649593496s ago: executing program 3 (id=242): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(0xffffffffffffffff, 0x40081271, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4c0c8) r5 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x600, 0x0) r6 = epoll_create(0x2) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000009b80)={0x40000012}) read$FUSE(r5, 0x0, 0x0) epoll_pwait(r6, &(0x7f0000000040)=[{}], 0x1, 0x2, 0x0, 0x0) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f00000001c0)={0x4800, 0x0, 0x4, 0x0, 0xb9a9, 0x9ce}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031}, [@IFLA_XDP={0x14, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x2}]}, @IFLA_GROUP={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) 3m27.672340525s ago: executing program 3 (id=250): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_mount_image$ext4(&(0x7f0000000b80)='ext4\x00', &(0x7f0000000bc0)='./file0\x00', 0x204001, &(0x7f0000000240), 0x1, 0xb9f, &(0x7f0000000c00)="$eJzs3E9vVFUbAPDn3k5LS/vS8ubNqxATmxjUaBwKJZiwAtdGTXThktpOSdPhj21NbMOi4F5dGOOCxPARTNzLxpWJC1wofgJiJIboBliMufOnjEyn1DLtgfL7JWfuOXNm7vM8c2HuucncBvDUGi8e8ogDEXE6ixhtPp9HxEC9Nxix2njd3dsXp4uWRa327h9ZZBFx5/bF6da+suZ2uDkYjIjrb2Tx30864y4ur8xPVauVheb48NLZC4cXl1demzs7daZypnLu2OTrxyaPT072sNabFz746rmf3nrx8tVPJ97+ct8PWZyMkeZcex29Mh7ja59Ju1JETPU6WCJ9zXra68xKCRMCAGBDedsa7v8xGn1xf/E2Gt//nDQ5AAAAoCdqfRE1AAAAYJfLXP8DAADALtf6HcCd2xenWy3tLxJ21q1TETHWqL91f3NjphSr9e1g9EfE3j+zaL+tNWu87ZGNF5G+/bFStNim+5A3snopIp5d7/hn9frH6ndxd9afR8RED+KPPzB+kuo/2YP4qesH4Ol07VTjRNZ5/svX1j+xzvmvtM65aytSn/9a67+7Heu/+/X3dVn/vbPJGAfvvXK921z7+u/9z36dKeIX20cq6l+4dSniYGm9+rO1+rMu9Z/eZIzh6ZtXus0V9Rf1ttpO11+7GnGovprrrL8l2+jvEx2enatWJhqP6+x/+fjG8duPf9GK+K1rgZ1QHP+9sbXjf2GTMcae+f1At7mH15//NpC9V+8NNJ/5eGppaeFIxED2ZufzRzfOpfWa1j6K+l9+YeP//+vVX3wnrDY/h+Jfz6XmthhffiDm8KGj32y9/u1V1D+zxeP/+SZjfP3dlQ+7zaWuHwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAnQx4RI5Hl5bV+npfLEcMR8b/Ym1fPLy69Onv+o3MzxVzEWPTns3PVykREjDbGWTE+Uu/fHx99YDwZEfsj4ovRofq4PH2+OpO6eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANYMR8RIZHk5IvKI+Gs0z8vl1FkBAAAAPTeWOgEAAABg27n+BwAAgN2v4/q/9I/R4E7mAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwK60//lrN7KIWD0xVG+FgeZcf9LMgO2Wp04ASKYvdQJAMqW2fq1WqyVMBdhhrvGB7CHzg11n9vQ8FwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeXy8duHYji4jVE0P1VhhozvUnzQzYbnnqBIBk+jaazHYuD2DnlVInACTjGh9oLPXv1Ro65we7vnPPdqYFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwGNmpN6yvBwReb2f5+VyxH8iYiz6s9m5amUiIvZFxC+j/XuK8ZHUSQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANBzi8sr81PVamVBR0enh52heCzS2HIn9TcTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAApLC6vzE9Vq5WFxdSZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKktLq/MT1WrlYVt7KSuEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAdP4OAAD//1rfDrQ=") r0 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) write$binfmt_register(r0, &(0x7f00000001c0)={0x3a, 'syz3', 0x3a, 'M', 0x3a, 0x1, 0x3a, 'usrjquota=', 0x3a, '\x00\x03!\f\xee\x998r~\b\x13\x89\xae\xf1\x06hz\xcc\xd6\xbb\xb8\x19\x90\x9e\xdb\xa2F\xfa_F(\x05\b\x13\x82\x12\xad\x0f^\xff\a\xb5', 0x3a, './file2', 0x3a, [0x46]}, 0x5c) mount(0x0, &(0x7f0000000240)='.\x00', 0x0, 0x2390024, 0x0) mknod$loop(&(0x7f0000000080)='./file1\x00', 0x6000, 0x0) 3m27.452743531s ago: executing program 3 (id=251): openat$rfkill(0xffffffffffffff9c, &(0x7f0000000400), 0x101800, 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000180), 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendmmsg$inet_sctp(r1, &(0x7f0000001380)=[{&(0x7f0000000000)=@in={0x2, 0x4e22, @loopback}, 0x10, &(0x7f0000000080)=[{&(0x7f00000001c0)="14", 0x1}], 0x1, &(0x7f0000000100)=[@sndinfo={0x1c, 0x84, 0x2, {0x2, 0x8, 0xe8, 0x9}}, @sndrcv={0x2c, 0x84, 0x1, {0x2db, 0x2, 0x0, 0x9ce, 0x81, 0x4, 0x0, 0x1}}], 0x48, 0x8001}], 0x1, 0x40) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000540)={{}, {0x18}, 0x0, 0x6}) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r2 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xcf0b, 0x0, 0x3, 0x11}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x4, 0x8, 0x0, 0x0, 0x4, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r2, 0x101, 0x11, 0x5, 0x0, 0x0) r6 = socket(0x10, 0x2, 0x0) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200), r6) sendmsg$IPVS_CMD_GET_CONFIG(r6, &(0x7f0000000680)={&(0x7f0000000140), 0xc, &(0x7f0000000640)={&(0x7f00000006c0)=ANY=[@ANYBLOB="d601042be04a5efe81b3986099e4b46f2421b3996205fd40391940e79b7f32a8204ae753be46be62d9df25f087c2910ef66638959e3afc7d6fcd521bc81aed02c1244f15f858eff5512e84c87f8f4188722e23260d14591cf2c6a355a38c382edf4ef6c71ea75db9053cac8ba4a96380af2589d103980ed4abbea83b874439d5", @ANYRES16=r7, @ANYBLOB="00082abd700001dcdf250d0000000c00028006000b000a0000000800040005000000480003800800030000000000050008000600000008000300020000000800010001000000060007004e23000014000600fc0000000000000000000000000000010500080007000000500001800800080001000000080009006f000000060001000a000000060002001d000000060001000200000014000300fe80000000000000000000000000001408000b0073697000060001000a0000002400028006000e004e210000080003000200000006000b000a00000006000f00040000005c00018014000300ff010000000000000000000000000001080009002b000000060004004e230000060001000a0000000800050000000000080008000c00000008000800000000000c000700000000002e00000008000800010000003000028006000b000a0000000800040007000000080005000600000014000100fc000000000000000000000000000001"], 0x170}, 0x1, 0x0, 0x0, 0x8000}, 0x20000010) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r8 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r8, 0x403c6f2b, &(0x7f0000001e40)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0x40008, 0x5}) preadv(r8, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x1, 0x1, 0xa) ioctl$DVB_DEMUX_DMX_REMOVE_PID(r8, 0x40026f34, &(0x7f0000000100)) 3m26.980465933s ago: executing program 3 (id=253): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING(r1, 0x4068aea3, &(0x7f0000000180)={0xc0, 0x0, 0x1000}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x1, 0x1000, 0x1000, &(0x7f0000001000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000300)={0x1, 0x0, [{0x11, 0x0, 0x1000}]}) 3m25.770077174s ago: executing program 32 (id=253): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING(r1, 0x4068aea3, &(0x7f0000000180)={0xc0, 0x0, 0x1000}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x1, 0x1000, 0x1000, &(0x7f0000001000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000300)={0x1, 0x0, [{0x11, 0x0, 0x1000}]}) 31.161299142s ago: executing program 0 (id=889): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=@newqdisc={0x3c, 0x24, 0xf0b, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x3}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=ANY=[@ANYRES16=r4], 0xcc}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) r5 = socket$kcm(0x23, 0x5, 0x0) listen(r5, 0x800) r6 = socket$kcm(0x10, 0x2, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$nl_route(r7, 0x0, 0x0) sendmsg$inet(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000200)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef595105ea1698fa51f60a64c9f408000000e786a6d0bdbdc3d44bd70011b6c0504bb9189d9193e9bd00"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x20008000) r8 = socket$phonet_pipe(0x23, 0x5, 0x2) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$binderfs(0xffffff9c, &(0x7f0000000140)='./binderfs2/binder1\x00', 0x800, 0x0) connect$phonet_pipe(r8, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, 0x0, 0x40080) sendto$phonet(r8, &(0x7f00000008c0)="0155", 0x2, 0x80, 0x0, 0x0) accept4(r5, 0x0, 0x0, 0x80000) 25.792483828s ago: executing program 2 (id=903): socket$inet6(0xa, 0x80002, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r0, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xd, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000025300)=""/102392, 0x18ff8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x14e203, 0x0) ioctl$SNDCTL_SEQ_PANIC(0xffffffffffffffff, 0x5111) write$binfmt_aout(r1, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000dc0)={0x0, 0x2, 0x0, 0x0, 0xfe, "0062baad630400000000000000000700"}) r3 = syz_open_pts(r1, 0x80) r4 = dup3(r3, r1, 0x80000) read(r4, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) 25.736055029s ago: executing program 0 (id=905): socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0), 0x42, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r2 = openat$sndseq(0xffffffffffffff9c, 0x0, 0xa8860) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r2, 0x40505330, &(0x7f0000000040)={{}, {0x18}, 0x0, 0x7}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x40}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) r3 = socket(0x10, 0x3, 0x0) r4 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x9640, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@mpls_getroute={0x24, 0x1a, 0x1, 0x0, 0x0, {}, [@RTA_DST={0x8, 0x1, {0x8100}}]}, 0x24}}, 0x0) ppoll(&(0x7f0000000040)=[{r4, 0xb00}], 0x1, 0x0, 0x0, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000140)) r6 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000c40), 0xffffffffffffffff) dup2(r3, r0) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYRES16=r6], 0x4c}, 0x2, 0x34005}, 0x0) 21.441975488s ago: executing program 0 (id=907): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) quotactl_fd$Q_QUOTAON(0xffffffffffffffff, 0xffffffff80000201, 0x0, &(0x7f0000000540)='./tracing\x00') prlimit64(0x0, 0xe, &(0x7f0000000380)={0x7, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x44}}, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000a80)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) r3 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x20004, r2}) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TCSETS(r5, 0x5402, &(0x7f0000000000)={0x401, 0x0, 0x10000, 0xb998, 0x0, "194f2f83c2e798c3584770116cddc8819592b1"}) openat(0xffffffffffffff9c, 0x0, 0x2c41, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x60, 0x0, 0x3, {{0x6, 0x40000c, 0xffffffffffffffff, 0x714, 0x2, 0x2, 0xacb8}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = syz_open_dev$dri(&(0x7f0000000280), 0x1ff, 0x140) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r6, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r4}) 17.074959648s ago: executing program 0 (id=910): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$COMEDI_INSN(0xffffffffffffffff, 0x8028640c, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x2000800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x24, 0x7, 0x6, 0x401, 0x0, 0x0, {0xa, 0x0, 0x9}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x3}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x24}}, 0x4c880) sched_setaffinity(0x0, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000400)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x1a0001) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f0000000300)={{0x0, 0x2, 0x3}}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000340)={0x750, 0x0, 0x0, 'queue1\x00', 0x5}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3, 0x3}}) 16.070706894s ago: executing program 0 (id=913): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) r1 = socket(0xa, 0x3, 0xff) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r2, 0x0, 0xc8c0) connect$inet6(r1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r3 = getpgrp(0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r7 = syz_open_dev$sndctrl(&(0x7f0000000080), 0xd, 0x400000) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r7, 0xc1105511, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0) write(r8, &(0x7f0000000400)="0130305c30", 0x5) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0xe, 0xa, &(0x7f0000000680)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x21}, @generic={0x2c}, @initr0, @exit]}, &(0x7f0000000100)='GPL\x00', 0x4, 0xee, &(0x7f0000000340)=""/238, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x59}, 0x80) 12.535084783s ago: executing program 2 (id=920): socket$packet(0x11, 0x3, 0x300) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a80)={0x12, 0x5, &(0x7f0000000b40)=ANY=[@ANYBLOB="18000000040000000000"], &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x24, '\x00', 0x0, 0x9}, 0x94) r4 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=@deltclass={0x24, 0x29, 0x8, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x7, 0xffff}, {0xffe0, 0xfff3}, {0x3, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x20008000}, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'veth0_vlan\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x4c, 0x10, 0xffffffffffffffff, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0xc6da5938055fa6f8, 0x48a21}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x203}, @IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x88a8}]}}}, @IFLA_LINK={0x8, 0x5, r5}]}, 0x4c}, 0x1, 0x200000000000000, 0x0, 0x240400d5}, 0x2000c000) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000880)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@float={0x1, 0x0, 0x0, 0x10, 0xc}, @const={0x0, 0x0, 0x0, 0xb}, @volatile={0x0, 0x0, 0x0, 0x9, 0x2}]}}, 0x0, 0x3e}, 0x28) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000001c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x6, '\x00', 0x0, r6, 0x1, 0x5}, 0x50) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) 10.709334319s ago: executing program 4 (id=921): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xd, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4040080) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0x0, @remote}, 0x10, 0x0}, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r5, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, 0x0, 0x0) sendto$inet6(r5, &(0x7f0000000100)="b8", 0xffe0, 0x2000c851, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x2}) ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000240)=@mmap={0x1, 0x2, 0x4, 0x100000, 0x408000, {0x0, 0xea60}, {0x0, 0x2, 0x4, 0xc0, 0x0, 0xf0, "18a6fc23"}, 0x1, 0x1, {}, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000040)=0x1) 10.156051114s ago: executing program 1 (id=922): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x88000, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee6, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_route(0x10, 0x3, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$RTC_SET_TIME(r3, 0x4024700a, &(0x7f0000000300)={0x1, 0x20, 0x1, 0x1b, 0x3, 0xff, 0x4, 0x14b, 0x1}) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00'}) listen(r5, 0x4) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000040)={{0x1, 0x1, 0x18, r4, {0x8}}, './file0\x00'}) ioctl$COMEDI_INSN(0xffffffffffffffff, 0x8028640c, &(0x7f0000000080)={0xa000006, 0x0, 0x0, 0x9, 0x4000003}) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4) 8.524464725s ago: executing program 2 (id=923): getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6(0xa, 0x6, 0x7) connect$inet6(r1, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x4) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f0000000780), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYRES64=0x0], 0x0, 0x34}, 0xffffffffffffffa5) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r3, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x8}, 0x94) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000280), 0x200, 0x102) ioctl$DRM_IOCTL_MODE_CURSOR(r5, 0xc01c64a3, &(0x7f0000000100)={0x1, 0x0, 0x3, 0xfffffffc, 0x326, 0x89e, 0x1}) connect$bt_l2cap(r4, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) sendmmsg$sock(r4, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x2a18005, 0x0) getpid() ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000180)={0x1, @pix={0x200, 0x807c2, 0x41414770, 0x32314152, 0x425, 0x10004, 0x3, 0x2, 0xfeedcafe, 0x3, 0x2, 0x1}}) 8.427125357s ago: executing program 4 (id=924): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0) r0 = socket(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r2, &(0x7f0000000780)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000140)='\b', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000700)=[{0x0}], 0x1}}], 0x2, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = epoll_create1(0x0) r5 = fcntl$dupfd(r3, 0x0, r4) fanotify_mark(r5, 0x21, 0x101a, r5, 0x0) fanotify_mark(r5, 0x22, 0x4000103b, r5, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000880)=@delchain={0x7c, 0x65, 0x20, 0x70bd28, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x7, 0x18}, {0xb, 0x17c9cedaef6c3850}, {0x7, 0xf}}, [@filter_kind_options=@f_route={{0xa}, {0x2c, 0x2, [@TCA_ROUTE4_IIF={0x8, 0x4, r6}, @TCA_ROUTE4_POLICE={0x10, 0x5, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xffff}]}, @TCA_ROUTE4_TO={0x8, 0x2, 0x7d}, @TCA_ROUTE4_CLASSID={0x8, 0x1, {0xfff2, 0xfff2}}]}}, @TCA_CHAIN={0x8, 0xb, 0x4}, @TCA_CHAIN={0x8, 0xb, 0xc508}, @TCA_CHAIN={0x8, 0xb, 0x40}, @TCA_RATE={0x6, 0x5, {0x8}}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4040000}, 0x40000) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, &(0x7f00000000c0)={'pcl816\x00', [0x100, 0x40, 0x2, 0x1000, 0xa, 0x5, 0x79, 0x3, 0x80008, 0x0, 0xffffffff, 0x1, 0x808, 0x1, 0x5, 0x9, 0x8, 0xa, 0x3, 0x7fffffff, 0x89, 0xca9f, 0xfffffffe, 0x20001e58, 0xffffffff, 0xf39e, 0x3, 0x8, 0x7fff, 0x0, 0xfff7fff8]}) memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2) ftruncate(0xffffffffffffffff, 0x1) 8.276357491s ago: executing program 1 (id=925): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) gettid() timer_create(0x0, 0x0, &(0x7f0000bbdffc)) bind$alg(0xffffffffffffffff, &(0x7f00000003c0)={0x26, 'hash\x00', 0x0, 0x0, 'tgr192\x00'}, 0x58) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$hfs(&(0x7f0000000180), &(0x7f00000000c0)='./file1\x00', 0x1000812, &(0x7f0000001800)=ANY=[@ANYBLOB="71756965742c636f6465706167653d63703836302c696f636861727365743d63703836312c00808fead042bd35dc78f7f06333a5e7165b8271e41aee85e59cbb6c2df3d4e4c16b06c73f2e3b34ac8d4813c9c3d9cee1ddb95d1bbcf504e065b3749a1cbd841e685a558598cf0db10b55885946e678d0a71877037a090000000700848879ef1604cadc1faca3aa22a576750d559c4e124d4cb7293e7393b77286fa8c6dc449eda0a03d342382e84d6d3c29ab95cc923fbe25e134d1c421320a3bffaa17fcd6b5178e322cc47133b3811e3d3bc34998dc7ed029834ad591d9d56c41063d8de2d50a2398e73ff2913a9fe8e954a4e4ca99ceb5737e57193c5f47fd63b16c8b34f256dbac0e5ebd009078df2cb1ca0151ad091adbfee5126d8a59fa5438734bc3e8cc7b7edc10716a0a9b711952cdf96586e06fbace21dc04bdb4a1a2072ce5f72cf02e5256ff74be5e07a5f8d6ec2fa867b2a353bf6ea1b533377803804a49a499d51f1cb71e1cea551598939afe8ff8e8472352e2d5193bc866c000"/396, @ANYRESOCT, @ANYRES8=0x0, @ANYBLOB="eb4df9aa36400f1596263ee4e2ba950c3777a4ec31bc2dc78cd48b646ae82f0508a43d2064587fb0b58769e71fc7b7c8e93fa8ec644b9889e92afb0c6a178d5f85790c4047947250a43c67c7b897debc120c19d2b9c218c8a1205fae81bb140f9e9a69c60fd20d07ac3643e470a4bbe559f8b777749dd02b1336813ff11343d09bebc37a1ed9bb9ced4e3264a2ead14b4350c271", @ANYRESHEX=0x0, @ANYBLOB="0affd5ece651e2a4648f9b279d8dc44bc4bd6acc0aa01a3ab56e469d3c338a26ff996b57afbe65c4eb94f6fd4cfbda2af6c85c6e135955ca0640546a2aac7bb02432e45e6d333181ee921f9f26a8ef000000000800000000000000000000000000000000000000000000000000004de9f91aeab66cc8b2197d3c00068324c7b7bd"], 0x1, 0x305, &(0x7f0000000340)="$eJzs3U1rE1scx/HfmaRNepvbmz5cLtxltaAb0boRNxHJWxDEhWjbCMVQUSuoG1NxJaJ7974FX4QbxTegKxfiC2g3jpwzD8kkk5k0JB2D3w+Ik8n85/zPPP5PoBwB+GNdbX55d/Gb/WekkkrSy8uSJ6kqlSX9q/+qj/b2d/fbrZ2sHZVchI58GQWRZmCb7b2W+/8gudrGuYhQ3X4qq9a7DtPh+/6Vr33rvnsFJYPCuLs/hSdVwrvTfV898cyyHYwZ15lwHrPGHOpQj7VUdB4AgGLZ9/9BUPjb93wtrN89T9oIX/u/5ft/XIdFJzB1fua3Pe9/N8ryjT2//7ivuuM9N4Sz33vRKHGUluf6Ps8rKCQTBaZJH1V2h3wuF2/hzm67dW77XnvH03M1Qj0Ba3ELIXuF5mS7njI2zTBC301qRRmk5c3ZPmwOyX91zBYzDAzfEifEfDCfzE1T11vtxPVf2Tc2W5dwve9MBfmfH97eoouyWyl8bDQaDc/tKLLsGvk/eaZyellNH5EoOrDLSv5AUM/L00Wt9EUFvbuQGlCJo1ZTozajT0PaWktE2d7EV/PwLKfNvDbXzbp+6L2aPfW/Z/Pb0PA7M/GLjtkIbjR3xIP+zKc3V3b7rA+8OTq6UUuuiY9iZVjqR9nPNIwgOoevtKVLWnr45OndUrvdemAXbqcs3K/Fa+ZeSKnbFLygTndNRb4zsHH0DEyEL4Qrp5TY2Ynu0D4/cje2d9mJHPneKyG6YSfWhLziL62sa6P5se9CmtiCX5nwDn/6Y0T9fcIPJRSle9KLzgQFsXWXCcZ/rpIP631Xr9lq4VpleJ0eFWRpJZur3sM9+rbGjkdA1UT8ilv6K1lG54wNFsM6JmUc19FoY65TZ6TTo7dYD/OcDf6znA1MU591i9//AQAAAAAAAAAAAAAAAAAAZs3x/65g4dhRRfcRAAAAAAAAAAAAAAAAAAAAAIBZF8//q2j+X402/2//VCzh/L9V5cz/uzWYw8D8v2/2ZDoS8/8C0/UrAAD///8sd7M=") r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101041, 0xf0) syz_mount_image$vfat(&(0x7f0000000b00), &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x81d011, 0x0, 0x1, 0x0, &(0x7f0000000140)) syz_mount_image$exfat(0x0, &(0x7f0000000100)='./bus\x00', 0x80d800, 0x0, 0x0, 0x0, &(0x7f0000000240)) mkdir(0x0, 0x1b8) syz_mount_image$vfat(&(0x7f00000007c0), &(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x824851, 0x0, 0x1, 0x0, &(0x7f0000000d40)) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) creat(&(0x7f00000009c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x44) syz_mount_image$vfat(&(0x7f0000000800), &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x181d011, 0x0, 0x40, 0x0, &(0x7f0000000140)) mkdir(0x0, 0x0) pwrite64(r1, &(0x7f0000000140)='2', 0xfdef, 0xe7c) 5.52836898s ago: executing program 1 (id=926): fcntl$setsig(0xffffffffffffffff, 0xa, 0x31) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) bpf$PROG_LOAD(0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd002000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ptrace$ARCH_SHSTK_ENABLE(0x1e, r0, 0x2, 0x5001) r3 = socket$inet_tcp(0x2, 0x1, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040f0a00fa1b04"], 0x7) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setxattr$security_ima(0x0, &(0x7f0000000080), 0x0, 0x0, 0x1) openat$ptmx(0xffffffffffffff9c, 0x0, 0x101802, 0x0) r4 = socket$inet6(0xa, 0x1, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb0300050000000000"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r4, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) 5.525759691s ago: executing program 4 (id=927): socket$igmp(0x2, 0x3, 0x2) socket$inet_icmp(0x2, 0x2, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet_sctp(0x2, 0x1, 0x84) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, 0x0, 0x0) sendmsg$rds(r3, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[@mask_fadd={0x58, 0x118, 0x8, {{0xfffffffc, 0x1}, 0x0, 0x0, 0x5c, 0x8, 0x0, 0x200010000000}}], 0x58}, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000200)='dummy_hcd.0', 0xb) 4.629405373s ago: executing program 0 (id=928): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prlimit64(0x0, 0x7, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000380), 0x2040) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r2, 0xc0605345, &(0x7f00000003c0)={0x2, 0x0, {0xffffffffffffffff, 0x1, 0xed, 0x2, 0x2}}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x20a02, 0x0) ioctl$TIOCSSOFTCAR(r3, 0x5453, 0x0) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r4, 0x0, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000480)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @tcp={{0x8, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x5, 0x0, @dev={0xac, 0x14, 0x14, 0x41}, @rand_addr=0x64010100, {[@timestamp_addr={0x44, 0xc, 0x5, 0x3, 0x0, [{@initdev={0xac, 0x1e, 0x0, 0x0}}]}]}}, {{0x4e24, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x10, 0x3, 0x0, 0x2}}}}}}, 0x0) r5 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) readv(r5, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/54, 0x36}], 0x1) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r7, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000001c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r6, @ANYBLOB, @ANYRES32=r8, @ANYBLOB="0a0006000802110000010000280050800500020002000000090001007ee5d52ffd000000080003000bac0f000800deaf37ccbcd6"], 0x50}}, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x2) r9 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_UNLINK(r9, 0x40044160, 0x3) 4.618361703s ago: executing program 2 (id=929): r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file1\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) truncate(0x0, 0x8fff5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x7, 0x80000001}, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000700)='./file1\x00', 0x10002, &(0x7f0000000080), 0x8, 0x4e4, &(0x7f0000000c40)="$eJzs3MFvFFUcAODfbHdpC6IVEQVRCmhsTGyhoHDwgomJB02MeJBj01aCFDC0ByFESmK4k3g0MR6NN0286tF48g/AgwcTQ0IMF8DTmNmdabfb3e0uXYplvy/Z7nuzb+a9N/Pe7Nt5nQmgb41mf5KIJyLiZkQ8VYuuTDBae7t358r0/TtXpmMxTU/+k1TT3c3iuWK9bXlkrBRR+jJp2GDN/KXLZ6fm5mYv5vGJhXOfTcxfuvz6mXNTp2dPz56fPH786JHDx96cfKP7SjXJL6vX3T1fXNi7+91TN96fLhfLh/L3+nq0VO4u69E26V5Ze1Obyva6cLJ6P13d0MLQsaG8WVey/n9l7sCpR10gYMOkaZoOtv54MW10LfszXLc2sHklejH0qeKLPvv9W7w2YNjxv3H7RO0HUFbve/mr9kk5SnmaSsPv214ajYiPF//9JntFu+sQfz6kAgAAfeeXE8VIsHH8V4pddemezOdQRiLi6YjYERHPRMTOiHg2opr2uYh4vjGDJCJtk//Ohvhy/j/mswilW+uuZBvZ+O+tfG5r5fivGP3FyEAe2x5RDJhnD+X7ZCwqg5+cmZs93GL7W9bIv378l72y/IuxYF6OW+WGC3QzUwtTD1bb1W5fi9hTbqx/Us4OXDGNk0TE7ojY08V2R+rCZ177bu9SpJK/f117W7v+VWmTKb2O5uPWkn4b8Wrt+C9G/fFPlnNM2s9PTgzF3OyhiawVHGqax2+/X/+gVf5r1v+nvxpXeefYzyfXXe9Cdvy31rX/KOZvl2cyR5KIZGm+dj4iHeguj+t/tF7hQdv/luSjarjoX59PLSxcPByxJXlv9fLJ5XWLeJE+q//Yweb9f0e+TrYnXoiIrBG/GBEvRcS+vOz7I+JARBxsU/9f33750wev/8OV1X+m6flvxfFfnq/vMFCsnC0ZOLv/5v0WJ4/Ojv/RamgsX9L8/JesOEXUFydrC61Kur69BwAAAJtDKar/+18aXwqXSuPjtWtAO2Nrae7C/MK+iDg/U7tHYCQqpeJKV+16cCUprn+O1MUnG+JH8uvGXw0MV+Pj0xfmZh515aHPbav2+WRV/8/83eV1XmAT6sE8GrBJrdX/d93YoIIAG873P/Svuv6/2CLJov+UgceT73/oX836/9X4vu29C84ZsPml+jL0Nf0f+lc5PlwKV297bnq3LfA48v0Pfanb+/o7CRSPa7h8Nh1snmYomjwxYKjHxcgDw415DUbvq9xJIBtZ9XCDlYjoLPFw51tO0zStLSmGgK2f8FDqrsyDsfqjgRhu0w6Thuc4dBKotHnWw1Lg9K6eN/7imSi9bjY/LO+fSt2xKK91dNYf2LBTEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwEP1XwAAAP//Ec/DZA==") sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = open(&(0x7f0000000040)='./file1\x00', 0x80242, 0x0) write$FUSE_CREATE_OPEN(r5, &(0x7f0000000280)={0xa0, 0x0, 0x0, {{0x1, 0x1, 0x2, 0xa, 0x3, 0x80, {0x2, 0x17d, 0xfffffffffffffffd, 0x0, 0x345, 0x7cf4, 0x9, 0x7ffffffd, 0x0, 0x1000, 0x20000000, 0x0, 0x0, 0x3ff, 0x3101}}, {0x0, 0x3}}}, 0xa0) sendfile(r5, r5, &(0x7f0000000080)=0x2, 0x7f03) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040), 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) syz_mount_image$squashfs(&(0x7f00000000c0), &(0x7f0000000080)='./file2\x00', 0x4, &(0x7f0000000300)=ANY=[@ANYRES8=0x0, @ANYRESDEC, @ANYRES8, @ANYRES8=0x0, @ANYBLOB="230b0325fa00466d3e9b4c40daec64c75a2b81b657cf506b822867ebaba82698e0921a6e0a76fada42f271b3da0b16e3fb9be5eacd5ec2a00279f9be0b6fcd62c2167283b9228ed1723960fe4c3a7f1de32c641a4b9f8104c416bc1f6ccd0c7442d37671bdaf", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES8=r0], 0x2, 0x1c2, &(0x7f0000000100)="$eJzslb9u1EAQxn9jb84xBUJ0ICQaBJciiWP+tFChPAAPwOlyhIiLgDgSJKIwVd4DIeU1KBCvQAGiCQVCooAWIaP1zvrs5CRACUmK/SRnvvlmd2fGmxs/LJ4WCfArYsgdasSc5YMIBrgsTrubOPu15+yC+l+Ms3Oqv1L7UW2xtf1oMB6PNqaSqg9dJWa/8mfiWMo8f70t/tcchyVVBf83hUwJlRxbg5a8SzhwBSVwjO/56Mj5Iz8ZRTdEdKKdpif9nttETEdJDnvgxL39MuJbPcvef38xtOQ+UFX2dwkr7pH2GjuJ3ro1qdUumvqRmKpZY4efda4BP1+vP1kstrbn19YHq6PVkeT59VvZjSy7mS8+WBuPMvdXWiki/Yewdg6wMzVtxWeATzpgz3AQvnyNS7qvfI++mXDRfH5vpUR40+zV2Y494x5XmQWelTJRfeHULS0jxJjaWTKtPK632TqwMHw8XtlBEF2Z7WKI/LY9ZhonbxzTaXcHLtjSrqi/rHZX7Z5a/83y3yJjZxCf1euX0OP5YHNzY8lKjtWar9lp+bmS1gXZrD963eYuJVNuJSAgICAgICDgVON3AAAA//+tn08c") execve(&(0x7f0000000040)='./file2\x00', 0x0, 0x0) write$rfkill(r5, 0x0, 0x0) readv(0xffffffffffffffff, &(0x7f0000000240)=[{0x0}, {0x0}], 0x2) mmap(&(0x7f00001f8000/0x4000)=nil, 0x4000, 0x0, 0x12012, r1, 0x0) 3.604531949s ago: executing program 4 (id=930): mount$binderfs(0x0, &(0x7f0000000280)='./binderfs\x00', 0x0, 0x2000063, &(0x7f0000000400)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getrusage(0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') preadv(r3, &(0x7f0000000040)=[{&(0x7f00000024c0)=""/4127, 0x101f}], 0x1, 0x4800, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x84, 0x0, &(0x7f00000006c0)=[@free_buffer, @release, @enter_looper, @acquire_done={0x40106309, 0x2}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000600)={@fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x9, 0x2, 0x20}, @ptr={0x70742a85, 0x1, &(0x7f0000000580)=""/62, 0x3e, 0x2, 0x27}}, &(0x7f0000000680)={0x0, 0x18, 0x38}}, 0x440}, @dead_binder_done], 0x0, 0x0, 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002bbd7000000000001a00000018000180140002"], 0x2c}, 0x1, 0x0, 0x0, 0x2404c804}, 0x2200c414) r6 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400ee", @ANYRES32, @ANYBLOB="01000000010000001c0012000c00010062"], 0x3c}}, 0x0) syz_mount_image$ext4(&(0x7f0000000300)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x1818e58, &(0x7f00000003c0), 0x2a, 0x64a, &(0x7f0000000c80)="$eJzs3c9rXFsdAPDvvdPkJWl86RMRX1AMuHgFaZrUYtWNbV3YRcGCXYi4aGiSGjq1JUnB1oIJuFBQEHFbpBv/AffSvTsR1J1roYpUFLR0HvfOnWQymV9pMjNJ7ucDkzn33DNzznfunNxz586ZG0BpzWV/0ogPI97eSSJmmtZNR33lXFHu9b+e3c1uSdRq3/5nEkmR1yifFPdni4WJiPjj9YhPVvbXu/Hk6f2laq3uxxEXNx88urjx5OmFtQdL91burfxg8dJXLl9Z+Ori5cWmhr67s8X9jZvf+uwvfvL9L6/+qXohiatxe+xHy9ESx1GZi7l4W4TYnH8mIq5kiTavy0lzCkIotUrxfhyLiE/HTFTypbqZWPv5SBsHDFStElHrLulVADipdG8oq8Y4oHFs399x8O0Bj0qG59W1+gHQbvzZeCjyzPpHDhP5sdHU66TpyKj+2ca5I6g/q+PNs4nnb57NPo89n0P8d2frnDmCejrZ2o6Iz7Tb/knetnN5pFn86Z5j/TQiFiJivGjfNw7RhqQpPYjPYbo5SPzN2yGL/2pxn+Vff8f6Wz/WGnb8AJTTy2vFjnwrW9rd/2Vjj8b4J4rxT/OYcfrwp2Ryo97/7R//Nepv7O8n8nFP2jIOy8Yst9o/5Vhrxt9+duNXneqvj/9mnzduWf2NseAwvNqOmG2J/6dZsMX4J4s/aTP+zYrcudpfHd/88z9udFo36vhrLyI+anv8szsqzVJdzk9eXF2rrizU/+48Zrypjt//4Xu/7VR/+/jfG1C0+2Xbf6pD/E3bP219XPaaPGr/lNutGb+79eJBp/qne27/9O/jSf14s/Ga/nB7c3N9MWI8uVkUKfKXNjfXL3WPNyvTOCebPUcW//kvtO//e97/LVFNNv5l9uHRd+6/7rTuXd7/TSeT39b6bEMnWfzLvbf/vv6f5f2yzzr+893Hn+u0rlv8k4cJDAAAAAAAAEoozc/BJun8TjpN5+fr82U/FVNp9eHG5hdXHz6eiIjz+fchx9JIk/wrIzP15WR1rbqyWHwftrF8qWX5SxHxQUT8ujKZL8/ffVhdHnXwAAAAAAAAAAAAAAAAAAAAcEycLeb/N34T/d+V+vx/oCR6X2Bu3/UfgFNikBeYBI63vP9328W/P7y2AMNl/w/lpf9Deen/UF76P5SX/g/lpf9Deen/UF76PwAAAACcSh98/uVfk4jY+tpkfsuMF+tM+oXTbexApSsDawcwfHo0lNfOqX+DfSidvsb//yt+HHDwzQFGIGmXmQ8Oat07/8u2j9y1ffi2AQAAAAAAAAAAAAB1H33Yef7/weYGAyeNaX9QXoeY/++nA+CE89P/UF6O8YEes/hjotOKXvP/AQAAAAAAAAAAAIAjM53fknS+mAs8HWk6Px/xiYg4F2PJ6lp1ZSEi3o+Iv1TG3suWF0fdaAAAAAAAAAAAAAAAAAAAADhlNp48vb9Ura6sNyf+vy/ndCcaV0HtXbjWR5muia/HAR8VyfBflsmIGPlGGVjiTFNOErGVbflj0bD1jTgezcgTI/7HBAAAAAAAAAAAAAAAAAAAJdQ097i92d8MuUUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMHy71//vkVieqj+gr8J7E6OOEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4mT4OAAD//wdySCI=") 3.493590922s ago: executing program 1 (id=931): r0 = userfaultfd(0x1) ioctl$UFFDIO_COPY(r0, 0xc028aa05, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r2, 0xc004743e, 0x110c230000) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x80047441, 0x17) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r3 = fcntl$getown(r2, 0x9) fcntl$lock(r1, 0x25, &(0x7f0000000040)={0x1, 0x0, 0x2, 0x400, r3}) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SFACILITIES(r4, 0x89e3, &(0x7f0000000000)={0x4065, 0x0, 0x6, 0x9, 0x7ff, 0x8100}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.idle_time\x00', 0x275a, 0x0) write$binfmt_misc(r6, &(0x7f0000000040), 0xe09) ioctl$VHOST_SET_OWNER(r6, 0xaf01, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x7, 0x6, 0x5, 0x0, 0x0, {0xa, 0x0, 0x9}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x3}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x24}}, 0x4c880) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x208800, 0x0) 2.171383866s ago: executing program 1 (id=932): fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) syz_open_dev$sndpcmp(&(0x7f0000000300), 0x0, 0x28002) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f00000002c0)=0x80000000000003) sched_setscheduler(0x0, 0x1, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) openat$tcp_mem(0xffffffffffffff9c, 0x0, 0x8, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x8, &(0x7f0000000540)=ANY=[@ANYBLOB="180000008000000000000000060000008500000061000000181100", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000000000000850000008600000095000000000000003afa4803f50e547b3433a8e0ea31bdfa0853bfacfd283df3c1800be99441dfdf635b88d33f95654967680f8c5e48728c5fb0a3fee7b1d7cdbc5b5c2c078189452ceae852f5d69b5063cd5f16a983d238a8c14fe52c1d610613dfc41fdfd33b623b3812d4283e21245605031530d8e559e385a5bb5f829f266a3d0397c6cc5d9a57216d3d3e83769471080b56ded910c746a9588f6f9331ccd5560da90b36a879122ad70529"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_ethernet(0x7e, &(0x7f00000004c0)={@local, @local, @val, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f81fcb", 0x40, 0x3a, 0x0, @private0, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "4aa1d3", 0x0, 0x0, 0x0, @private1, @ipv4={'\x00', '\xff\xff', @remote}, [@srh, @dstopts={0x11}]}}}}}}}, 0x0) capget(&(0x7f0000002680)={0x20080522}, &(0x7f00000026c0)={0x3ff, 0x0, 0x4, 0x100, 0x5, 0x2}) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) 1.098254023s ago: executing program 4 (id=933): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r3 = dup(0xffffffffffffffff) write$binfmt_elf32(r3, 0x0, 0x58) finit_module(r3, 0x0, 0x3) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket(0xa, 0x5, 0x0) getsockopt$bt_hci(r4, 0x84, 0x1, &(0x7f00000020c0)=""/4052, &(0x7f0000000000)=0xfd4) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f0000000540)={0x2, @pix={0x3, 0x401, 0x3132564e, 0x1, 0x3, 0x3, 0xc, 0x7, 0x0, 0x0, 0x0, 0x3}}) openat$null(0xffffffffffffff9c, &(0x7f0000002840), 0x101101, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000002880)='./file0\x00', &(0x7f00000028c0), 0x0) ptrace(0x10, 0x0) r6 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r6}, 0x4) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r7, 0x8010661b, &(0x7f0000000000)) 1.035691125s ago: executing program 2 (id=934): pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x40000, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r1, 0x5201) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_netfilter(0x10, 0x3, 0xc) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) syz_open_dev$video(0x0, 0x6, 0xd0241) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r6 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00'}) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x89f6, &(0x7f0000000080)={'bridge0\x00', &(0x7f00000000c0)=@ethtool_regs={0x4, 0x0, 0x30, "2a161d2d71db37f20a8f1597f02515fcead4e1f5cad54790db5c4e09db1ac8225b997fc21693c0942f0686928c388bc6"}}) r7 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x20040, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r7, 0x5201) close_range(r0, 0xffffffffffffffff, 0x0) 840.998119ms ago: executing program 1 (id=935): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) gettid() timer_create(0x0, 0x0, &(0x7f0000bbdffc)) bind$alg(0xffffffffffffffff, &(0x7f00000003c0)={0x26, 'hash\x00', 0x0, 0x0, 'tgr192\x00'}, 0x58) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$hfs(&(0x7f0000000180), &(0x7f00000000c0)='./file1\x00', 0x1000812, &(0x7f0000001800)=ANY=[@ANYBLOB="71756965742c636f6465706167653d63703836302c696f636861727365743d63703836312c00808fead042bd35dc78f7f06333a5e7165b8271e41aee85e59cbb6c2df3d4e4c16b06c73f2e3b34ac8d4813c9c3d9cee1ddb95d1bbcf504e065b3749a1cbd841e685a558598cf0db10b55885946e678d0a71877037a090000000700848879ef1604cadc1faca3aa22a576750d559c4e124d4cb7293e7393b77286fa8c6dc449eda0a03d342382e84d6d3c29ab95cc923fbe25e134d1c421320a3bffaa17fcd6b5178e322cc47133b3811e3d3bc34998dc7ed029834ad591d9d56c41063d8de2d50a2398e73ff2913a9fe8e954a4e4ca99ceb5737e57193c5f47fd63b16c8b34f256dbac0e5ebd009078df2cb1ca0151ad091adbfee5126d8a59fa5438734bc3e8cc7b7edc10716a0a9b711952cdf96586e06fbace21dc04bdb4a1a2072ce5f72cf02e5256ff74be5e07a5f8d6ec2fa867b2a353bf6ea1b533377803804a49a499d51f1cb71e1cea551598939afe8ff8e8472352e2d5193bc866c000"/396, @ANYRESOCT, @ANYRES8=0x0, @ANYBLOB="eb4df9aa36400f1596263ee4e2ba950c3777a4ec31bc2dc78cd48b646ae82f0508a43d2064587fb0b58769e71fc7b7c8e93fa8ec644b9889e92afb0c6a178d5f85790c4047947250a43c67c7b897debc120c19d2b9c218c8a1205fae81bb140f9e9a69c60fd20d07ac3643e470a4bbe559f8b777749dd02b1336813ff11343d09bebc37a1ed9bb9ced4e3264a2ead14b4350c271", @ANYRESHEX=0x0, @ANYBLOB="0affd5ece651e2a4648f9b279d8dc44bc4bd6acc0aa01a3ab56e469d3c338a26ff996b57afbe65c4eb94f6fd4cfbda2af6c85c6e135955ca0640546a2aac7bb02432e45e6d333181ee921f9f26a8ef000000000800000000000000000000000000000000000000000000000000004de9f91aeab66cc8b2197d3c00068324c7b7bd"], 0x1, 0x305, &(0x7f0000000340)="$eJzs3U1rE1scx/HfmaRNepvbmz5cLtxltaAb0boRNxHJWxDEhWjbCMVQUSuoG1NxJaJ7974FX4QbxTegKxfiC2g3jpwzD8kkk5k0JB2D3w+Ik8n85/zPPP5PoBwB+GNdbX55d/Gb/WekkkrSy8uSJ6kqlSX9q/+qj/b2d/fbrZ2sHZVchI58GQWRZmCb7b2W+/8gudrGuYhQ3X4qq9a7DtPh+/6Vr33rvnsFJYPCuLs/hSdVwrvTfV898cyyHYwZ15lwHrPGHOpQj7VUdB4AgGLZ9/9BUPjb93wtrN89T9oIX/u/5ft/XIdFJzB1fua3Pe9/N8ryjT2//7ivuuM9N4Sz33vRKHGUluf6Ps8rKCQTBaZJH1V2h3wuF2/hzm67dW77XnvH03M1Qj0Ba3ELIXuF5mS7njI2zTBC301qRRmk5c3ZPmwOyX91zBYzDAzfEifEfDCfzE1T11vtxPVf2Tc2W5dwve9MBfmfH97eoouyWyl8bDQaDc/tKLLsGvk/eaZyellNH5EoOrDLSv5AUM/L00Wt9EUFvbuQGlCJo1ZTozajT0PaWktE2d7EV/PwLKfNvDbXzbp+6L2aPfW/Z/Pb0PA7M/GLjtkIbjR3xIP+zKc3V3b7rA+8OTq6UUuuiY9iZVjqR9nPNIwgOoevtKVLWnr45OndUrvdemAXbqcs3K/Fa+ZeSKnbFLygTndNRb4zsHH0DEyEL4Qrp5TY2Ynu0D4/cje2d9mJHPneKyG6YSfWhLziL62sa6P5se9CmtiCX5nwDn/6Y0T9fcIPJRSle9KLzgQFsXWXCcZ/rpIP631Xr9lq4VpleJ0eFWRpJZur3sM9+rbGjkdA1UT8ilv6K1lG54wNFsM6JmUc19FoY65TZ6TTo7dYD/OcDf6znA1MU591i9//AQAAAAAAAAAAAAAAAAAAZs3x/65g4dhRRfcRAAAAAAAAAAAAAAAAAAAAAIBZF8//q2j+X402/2//VCzh/L9V5cz/uzWYw8D8v2/2ZDoS8/8C0/UrAAD///8sd7M=") r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101041, 0xf0) syz_mount_image$vfat(&(0x7f0000000b00), &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x81d011, 0x0, 0x1, 0x0, &(0x7f0000000140)) syz_mount_image$exfat(0x0, &(0x7f0000000100)='./bus\x00', 0x80d800, 0x0, 0x0, 0x0, &(0x7f0000000240)) mkdir(0x0, 0x1b8) syz_mount_image$vfat(&(0x7f00000007c0), &(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x824851, 0x0, 0x1, 0x0, &(0x7f0000000d40)) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) creat(&(0x7f00000009c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x44) syz_mount_image$vfat(&(0x7f0000000800), &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x181d011, 0x0, 0x40, 0x0, &(0x7f0000000140)) mkdir(0x0, 0x0) pwrite64(r1, &(0x7f0000000140)='2', 0xfdef, 0xe7c) 260.72µs ago: executing program 2 (id=936): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket(0x10, 0x80002, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newlink={0x20, 0x10, 0x437, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40489}}, 0x20}, 0x1, 0x0, 0x0, 0x4c001}, 0x0) r4 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) ioctl$USBDEVFS_SUBMITURB(r4, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0xa20, 0x0, 0x48000000, 0x0, 0x0, 0x0}) r5 = socket(0x1e, 0x4, 0x0) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8000000000000000) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x4, 0x0, 0xfffffffe}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) umount2(&(0x7f0000000380)='./file1/file0\x00', 0x0) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) socket(0x1e, 0x4, 0x0) 0s ago: executing program 4 (id=937): syz_emit_vhci(&(0x7f00000003c0)=ANY=[@ANYBLOB="040e04f34120", @ANYRESDEC], 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1df) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) mkdir(&(0x7f0000000000)='myproc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='myproc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='myproc/iomem\x00', 0x0, 0x0) read(r0, &(0x7f0000000500), 0xfa0) syz_clone3(&(0x7f0000000380)={0x2140280, 0x0, 0x0, 0x0, {0x20080021}, 0x0, 0x0, 0x0, &(0x7f0000000340)}, 0x58) openat(0xffffffffffffff9c, &(0x7f00000001c0)='myproc\x00', 0x280, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/midi.usb0/id\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='Mid', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/midi.usb0/in_ports\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='2\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/midi.usb0/out_ports\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='2', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000100)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1/midi.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f00000003c0)='dummy_udc.0\n', 0xc) syz_open_procfs(0x0, &(0x7f0000000480)='fd/3\x00') mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) userfaultfd(0x80001) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000180)={0x200005, 0x200027, 0x801, 0x0, 0x7}) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x8) kernel console output (not intermixed with test programs): committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 109.353431][ T5865] usb 2-1: USB disconnect, device number 4 [ 109.364828][ T5834] usb 3-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 109.378382][ T5834] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.473066][ T5834] usb 3-1: Product: syz [ 109.479261][ T5834] usb 3-1: Manufacturer: syz [ 109.484697][ T5834] usb 3-1: SerialNumber: syz [ 109.493087][ T5834] usb 3-1: config 0 descriptor?? [ 109.616359][ T5088] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 109.629757][ T5088] CPU: 0 PID: 5088 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 109.637376][ T5088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 109.647450][ T5088] Workqueue: hci3 hci_rx_work [ 109.652212][ T5088] Call Trace: [ 109.655510][ T5088] [ 109.658446][ T5088] dump_stack_lvl+0x18c/0x250 [ 109.663144][ T5088] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 109.669327][ T5088] ? show_regs_print_info+0x20/0x20 [ 109.674556][ T5088] ? load_image+0x420/0x420 [ 109.679073][ T5088] ? sysfs_create_dir_ns+0x243/0x2a0 [ 109.684365][ T5088] sysfs_create_dir_ns+0x26e/0x2a0 [ 109.689521][ T5088] ? __lock_acquire+0x7d80/0x7d80 [ 109.694571][ T5088] ? sysfs_warn_dup+0xa0/0xa0 [ 109.699282][ T5088] ? do_raw_spin_unlock+0x121/0x230 [ 109.704517][ T5088] kobject_add_internal+0x617/0xc90 [ 109.709783][ T5088] kobject_add+0x164/0x240 [ 109.714255][ T5088] ? kobject_init+0x1d0/0x1d0 [ 109.718982][ T5088] ? get_device_parent+0x366/0x390 [ 109.724143][ T5088] device_add+0x3fa/0xc40 [ 109.728533][ T5088] hci_conn_add_sysfs+0xd5/0x1e0 [ 109.733520][ T5088] le_conn_complete_evt+0xe9f/0x1480 [ 109.738869][ T5088] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 109.745163][ T5088] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 109.750845][ T5088] ? mutex_unlock+0x10/0x10 [ 109.751422][ T5865] usb 3-1: USB disconnect, device number 2 [ 109.755366][ T5088] ? skb_pull_data+0xf0/0x1f0 [ 109.755426][ T5088] hci_le_conn_complete_evt+0x187/0x440 [ 109.755456][ T5088] ? hci_remote_host_features_evt+0x150/0x150 [ 109.755480][ T5088] hci_event_packet+0x7b4/0x1280 [ 109.755506][ T5088] ? __lock_acquire+0x7d80/0x7d80 [ 109.755527][ T5088] ? lock_chain_count+0x20/0x20 [ 109.755547][ T5088] ? bis_list+0x290/0x290 [ 109.755572][ T5088] ? lockdep_hardirqs_on+0x98/0x150 [ 109.802129][ T5088] ? hci_send_to_monitor+0xd7/0x4f0 [ 109.807369][ T5088] hci_rx_work+0x43a/0xd60 [ 109.811839][ T5088] ? process_scheduled_works+0x975/0x1600 [ 109.817620][ T5088] process_scheduled_works+0xa60/0x1600 [ 109.823247][ T5088] ? worker_attach_to_pool+0x370/0x370 [ 109.828768][ T5088] ? assign_work+0x3cc/0x5d0 [ 109.833404][ T5088] worker_thread+0xa5e/0xfe0 [ 109.838036][ T5088] ? _raw_spin_unlock+0x40/0x40 [ 109.842916][ T5088] ? __kthread_parkme+0x71/0x1c0 [ 109.847884][ T5088] kthread+0x2fa/0x390 [ 109.851968][ T5088] ? pr_cont_work+0x550/0x550 [ 109.856658][ T5088] ? kthread_blkcg+0xd0/0xd0 [ 109.861248][ T5088] ret_from_fork+0x48/0x80 [ 109.865685][ T5088] ? kthread_blkcg+0xd0/0xd0 [ 109.870297][ T5088] ret_from_fork_asm+0x11/0x20 [ 109.875110][ T5088] [ 109.881749][ T5088] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 109.896878][ T5088] Bluetooth: hci3: failed to register connection device [ 110.272253][ T2200] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 110.286604][ T5815] cdc_ncm 4-1:1.0: failed to get mac address [ 110.304124][ T5815] cdc_ncm 4-1:1.0: bind() failure [ 110.319206][ T5815] cdc_ncm: probe of 4-1:1.1 failed with error -71 [ 110.342551][ T5815] cdc_mbim: probe of 4-1:1.1 failed with error -71 [ 110.354949][ T5815] usbtest: probe of 4-1:1.1 failed with error -71 [ 110.370609][ T5815] usb 4-1: USB disconnect, device number 4 [ 110.464576][ T2200] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 110.475858][ T2200] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 110.488414][ T2200] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 110.504395][ T2200] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 110.521968][ T2200] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.541613][ T2200] usb 1-1: config 0 descriptor?? [ 110.693362][ T6247] loop1: detected capacity change from 0 to 64 [ 110.790728][ T6247] bio_check_eod: 20 callbacks suppressed [ 110.790774][ T6247] syz.1.128: attempt to access beyond end of device [ 110.790774][ T6247] loop1: rw=2049, sector=159, nr_sectors = 1 limit=64 [ 110.810098][ T6247] buffer_io_error: 20 callbacks suppressed [ 110.810112][ T6247] Buffer I/O error on dev loop1, logical block 159, lost async page write [ 110.825173][ T6247] syz.1.128: attempt to access beyond end of device [ 110.825173][ T6247] loop1: rw=2049, sector=160, nr_sectors = 1 limit=64 [ 110.839866][ T6247] Buffer I/O error on dev loop1, logical block 160, lost async page write [ 110.848884][ T6247] syz.1.128: attempt to access beyond end of device [ 110.848884][ T6247] loop1: rw=2049, sector=161, nr_sectors = 1 limit=64 [ 110.862557][ T6247] Buffer I/O error on dev loop1, logical block 161, lost async page write [ 110.871481][ T6247] syz.1.128: attempt to access beyond end of device [ 110.871481][ T6247] loop1: rw=2049, sector=162, nr_sectors = 1 limit=64 [ 110.885135][ T6247] Buffer I/O error on dev loop1, logical block 162, lost async page write [ 110.894043][ T6247] syz.1.128: attempt to access beyond end of device [ 110.894043][ T6247] loop1: rw=2049, sector=163, nr_sectors = 1 limit=64 [ 110.907571][ T6247] Buffer I/O error on dev loop1, logical block 163, lost async page write [ 110.916403][ T6247] syz.1.128: attempt to access beyond end of device [ 110.916403][ T6247] loop1: rw=2049, sector=167, nr_sectors = 1 limit=64 [ 110.930076][ T6247] Buffer I/O error on dev loop1, logical block 167, lost async page write [ 110.940150][ T6247] syz.1.128: attempt to access beyond end of device [ 110.940150][ T6247] loop1: rw=2049, sector=169, nr_sectors = 1 limit=64 [ 110.953869][ T6247] Buffer I/O error on dev loop1, logical block 169, lost async page write [ 110.962797][ T6247] syz.1.128: attempt to access beyond end of device [ 110.962797][ T6247] loop1: rw=2049, sector=171, nr_sectors = 1 limit=64 [ 110.976395][ T6247] Buffer I/O error on dev loop1, logical block 171, lost async page write [ 110.987855][ T6247] syz.1.128: attempt to access beyond end of device [ 110.987855][ T6247] loop1: rw=2049, sector=172, nr_sectors = 1 limit=64 [ 111.001342][ T6247] Buffer I/O error on dev loop1, logical block 172, lost async page write [ 111.010238][ T6247] syz.1.128: attempt to access beyond end of device [ 111.010238][ T6247] loop1: rw=2049, sector=173, nr_sectors = 1 limit=64 [ 111.023933][ T6247] Buffer I/O error on dev loop1, logical block 173, lost async page write [ 111.519716][ T2200] plantronics 0003:047F:FFFF.0002: No inputs registered, leaving [ 111.583547][ T2200] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 111.780528][ T6257] netlink: 8 bytes leftover after parsing attributes in process `syz.2.131'. [ 111.796905][ T6257] netlink: 28 bytes leftover after parsing attributes in process `syz.2.131'. [ 111.855935][ T6257] geneve2: entered promiscuous mode [ 111.863222][ T6257] geneve2: entered allmulticast mode [ 112.217102][ T6275] loop3: detected capacity change from 0 to 256 [ 112.434822][ T6281] loop1: detected capacity change from 0 to 64 [ 112.811123][ C0] plantronics 0003:047F:FFFF.0002: usb_submit_urb(ctrl) failed: -1 [ 113.272839][ T6285] loop1: detected capacity change from 0 to 256 [ 113.280174][ T6285] exfat: Deprecated parameter 'namecase' [ 113.339031][ T6287] loop3: detected capacity change from 0 to 128 [ 113.376259][ T6287] capability: warning: `syz.3.141' uses 32-bit capabilities (legacy support in use) [ 113.404923][ T6285] exFAT-fs (loop1): failed to load upcase table (idx : 0x0001fe89, chksum : 0xf168f48e, utbl_chksum : 0xe619d30d) [ 114.014281][ T9] usb 1-1: USB disconnect, device number 2 [ 114.324918][ T6296] loop3: detected capacity change from 0 to 256 [ 114.399215][ T6296] exfat: Deprecated parameter 'utf8' [ 114.559407][ T6296] exfat: Deprecated parameter 'namecase' [ 114.608038][ T6296] exfat: Deprecated parameter 'namecase' [ 115.169930][ T6296] exFAT-fs (loop3): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 115.928489][ T6349] loop1: detected capacity change from 0 to 4096 [ 115.985687][ T6367] loop2: detected capacity change from 0 to 64 [ 116.178103][ T6367] bio_check_eod: 20 callbacks suppressed [ 116.178165][ T6367] syz.2.149: attempt to access beyond end of device [ 116.178165][ T6367] loop2: rw=2049, sector=159, nr_sectors = 1 limit=64 [ 116.197357][ T6367] buffer_io_error: 20 callbacks suppressed [ 116.197402][ T6367] Buffer I/O error on dev loop2, logical block 159, lost async page write [ 116.212516][ T6367] syz.2.149: attempt to access beyond end of device [ 116.212516][ T6367] loop2: rw=2049, sector=160, nr_sectors = 1 limit=64 [ 116.226225][ T6367] Buffer I/O error on dev loop2, logical block 160, lost async page write [ 116.235204][ T6367] syz.2.149: attempt to access beyond end of device [ 116.235204][ T6367] loop2: rw=2049, sector=161, nr_sectors = 1 limit=64 [ 116.248674][ T6367] Buffer I/O error on dev loop2, logical block 161, lost async page write [ 116.257547][ T6367] syz.2.149: attempt to access beyond end of device [ 116.257547][ T6367] loop2: rw=2049, sector=162, nr_sectors = 1 limit=64 [ 116.271670][ T6367] Buffer I/O error on dev loop2, logical block 162, lost async page write [ 116.280726][ T6367] syz.2.149: attempt to access beyond end of device [ 116.280726][ T6367] loop2: rw=2049, sector=163, nr_sectors = 1 limit=64 [ 116.295752][ T6367] Buffer I/O error on dev loop2, logical block 163, lost async page write [ 116.305227][ T6367] syz.2.149: attempt to access beyond end of device [ 116.305227][ T6367] loop2: rw=2049, sector=167, nr_sectors = 1 limit=64 [ 116.318738][ T6367] Buffer I/O error on dev loop2, logical block 167, lost async page write [ 116.328354][ T6367] syz.2.149: attempt to access beyond end of device [ 116.328354][ T6367] loop2: rw=2049, sector=169, nr_sectors = 1 limit=64 [ 116.342142][ T6367] Buffer I/O error on dev loop2, logical block 169, lost async page write [ 116.351387][ T6367] syz.2.149: attempt to access beyond end of device [ 116.351387][ T6367] loop2: rw=2049, sector=171, nr_sectors = 1 limit=64 [ 116.364911][ T6367] Buffer I/O error on dev loop2, logical block 171, lost async page write [ 116.375046][ T6367] syz.2.149: attempt to access beyond end of device [ 116.375046][ T6367] loop2: rw=2049, sector=172, nr_sectors = 1 limit=64 [ 116.388554][ T6367] Buffer I/O error on dev loop2, logical block 172, lost async page write [ 116.397511][ T6367] syz.2.149: attempt to access beyond end of device [ 116.397511][ T6367] loop2: rw=2049, sector=173, nr_sectors = 1 limit=64 [ 116.411012][ T6367] Buffer I/O error on dev loop2, logical block 173, lost async page write [ 116.542334][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 116.838368][ T6371] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 116.868818][ T6370] netlink: 8 bytes leftover after parsing attributes in process `syz.3.150'. [ 116.949934][ T6370] netlink: 8 bytes leftover after parsing attributes in process `syz.3.150'. [ 116.966791][ T6349] NILFS (loop1): nilfs_sufile_do_free: segment 9 is already clean [ 117.378324][ T6387] syz.3.157 uses obsolete (PF_INET,SOCK_PACKET) [ 118.110616][ T6413] loop1: detected capacity change from 0 to 2048 [ 118.180301][ T6413] UDF-fs: error (device loop1): udf_process_sequence: Primary Volume Descriptor not found! [ 118.215009][ T6339] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0xa [ 118.240002][ T6413] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 118.622387][ T6436] loop1: detected capacity change from 0 to 2048 [ 119.118101][ T6447] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 119.194415][ T6436] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 119.549148][ T6436] ext4 filesystem being mounted at /44/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 119.724961][ T6436] fs-verity: sha512 using implementation "sha512-avx2" [ 120.161209][ T5774] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 120.216458][ T6456] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 120.882015][ T6459] loop1: detected capacity change from 0 to 4096 [ 120.938043][ T6438] loop2: detected capacity change from 0 to 40427 [ 120.971342][ T6438] F2FS-fs (loop2): Insane cp_payload (553648128 >= 504) [ 120.989345][ T6459] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 121.007457][ T6438] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 121.058839][ T6438] F2FS-fs (loop2): invalid crc value [ 121.074065][ T6438] F2FS-fs (loop2): Ignore s_resuid=0, s_resgid=65535 w/o reserve_root [ 121.143252][ T6438] F2FS-fs (loop2): Found nat_bits in checkpoint [ 121.319143][ T6438] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 121.352250][ T6438] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 121.473681][ T5776] bio_check_eod: 5 callbacks suppressed [ 121.473696][ T5776] syz-executor: attempt to access beyond end of device [ 121.473696][ T5776] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 121.502793][ T5774] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 121.515014][ T5776] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 122.170700][ T6484] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 123.322993][ T5835] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 123.391411][ T5835] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 124.040332][ T6517] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 125.066501][ T6509] loop3: detected capacity change from 0 to 32768 [ 125.097553][ T6509] BTRFS: device fsid db05bf05-c4f4-4d41-ba1f-eb57295b561b devid 1 transid 8 /dev/loop3 scanned by syz.3.195 (6509) [ 125.148878][ T6509] BTRFS info (device loop3): first mount of filesystem db05bf05-c4f4-4d41-ba1f-eb57295b561b [ 125.195351][ T6509] BTRFS info (device loop3): using xxhash64 (xxhash64-generic) checksum algorithm [ 125.202199][ T789] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 125.204789][ T5835] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 125.221152][ T6509] BTRFS info (device loop3): using free space tree [ 125.246865][ T6528] loop5: detected capacity change from 0 to 7 [ 125.293956][ T6528] Dev loop5: unable to read RDB block 7 [ 125.302819][ T6528] loop5: AHDI p1 p3 p4 [ 125.316128][ T6528] loop5: partition table partially beyond EOD, truncated [ 125.336134][ T6528] loop5: p1 size 100663296 extends beyond EOD, truncated [ 125.357240][ T6528] loop5: p3 size 4261412863 extends beyond EOD, truncated [ 125.401131][ T6533] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-16) [ 125.412126][ T789] usb 3-1: Using ep0 maxpacket: 8 [ 125.439328][ T789] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 125.445797][ T5835] usb 2-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 125.465277][ T789] usb 3-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 125.477315][ T5835] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.477437][ T6509] BTRFS info (device loop3): enabling ssd optimizations [ 125.502140][ T5835] usb 2-1: Product: syz [ 125.508006][ T789] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 125.522164][ T5835] usb 2-1: Manufacturer: syz [ 125.526843][ T5835] usb 2-1: SerialNumber: syz [ 125.537177][ T6509] BTRFS info (device loop3): auto enabling async discard [ 125.547532][ T789] usb 3-1: config 0 descriptor?? [ 125.570031][ T5835] usb 2-1: config 0 descriptor?? [ 125.592197][ T789] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 125.857848][ T5835] usb 2-1: USB disconnect, device number 5 [ 125.929896][ T5777] BTRFS info (device loop3): last unmount of filesystem db05bf05-c4f4-4d41-ba1f-eb57295b561b [ 126.884630][ T789] gspca_vc032x: reg_w err -71 [ 127.112044][ T789] vc032x: probe of 3-1:0.0 failed with error -71 [ 127.124777][ T789] usb 3-1: USB disconnect, device number 3 [ 127.615647][ T6561] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 127.668374][ T6568] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 129.829005][ T6585] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 130.222052][ T2200] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 130.482166][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 130.537967][ T2200] usb 4-1: config 0 interface 0 altsetting 255 has an invalid endpoint with address 0xFF, skipping [ 130.581695][ T2200] usb 4-1: config 0 interface 0 has no altsetting 0 [ 130.603795][ T2200] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 130.623145][ T2200] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 130.741056][ T9] usb 1-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 131.493672][ T2200] usb 4-1: Product: syz [ 131.497906][ T2200] usb 4-1: Manufacturer: syz [ 131.503174][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.511197][ T9] usb 1-1: Product: syz [ 131.515466][ T2200] usb 4-1: SerialNumber: syz [ 131.524645][ T9] usb 1-1: Manufacturer: syz [ 131.530342][ T2200] usb 4-1: config 0 descriptor?? [ 131.535799][ T9] usb 1-1: SerialNumber: syz [ 131.543086][ T9] usb 1-1: config 0 descriptor?? [ 131.667108][ T2200] snd-usb-audio: probe of 4-1:0.0 failed with error -22 [ 131.783642][ T5769] udevd[5769]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card1/controlC1/../uevent} for writing: No such file or directory [ 131.811086][ T2200] usb 4-1: USB disconnect, device number 5 [ 131.878334][ T789] usb 1-1: USB disconnect, device number 3 [ 132.421184][ T6657] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 132.590380][ T6663] loop1: detected capacity change from 0 to 512 [ 132.640596][ T6665] loop3: detected capacity change from 0 to 2048 [ 132.667033][ T6663] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 132.730018][ T6665] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 132.793465][ T6665] ext4 filesystem being mounted at /57/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 132.938085][ T6665] syz.3.227 (6665) used greatest stack depth: 20304 bytes left [ 132.951329][ T5777] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 132.973647][ T5774] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 133.128698][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.135435][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.388846][ T6681] loop2: detected capacity change from 0 to 32768 [ 134.422099][ T6681] BTRFS: device fsid db05bf05-c4f4-4d41-ba1f-eb57295b561b devid 1 transid 8 /dev/loop2 scanned by syz.2.234 (6681) [ 134.471141][ T6681] BTRFS info (device loop2): first mount of filesystem db05bf05-c4f4-4d41-ba1f-eb57295b561b [ 134.482325][ T6681] BTRFS info (device loop2): using xxhash64 (xxhash64-generic) checksum algorithm [ 134.514199][ T6700] loop3: detected capacity change from 0 to 512 [ 134.519231][ T6681] BTRFS info (device loop2): using free space tree [ 134.560621][ T6700] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 134.818558][ T6681] BTRFS info (device loop2): enabling ssd optimizations [ 134.916746][ T6681] BTRFS info (device loop2): auto enabling async discard [ 135.285047][ T5777] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 135.998528][ T6729] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 136.098167][ T5776] BTRFS info (device loop2): last unmount of filesystem db05bf05-c4f4-4d41-ba1f-eb57295b561b [ 136.402027][ T789] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 136.414983][ T28] audit: type=1326 audit(1785869451.952:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6738 comm="syz.2.248" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3b9839e019 code=0x0 [ 136.625220][ T789] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 136.637184][ T789] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 136.648361][ T789] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 136.661579][ T789] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 136.670868][ T5865] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 136.678644][ T789] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 136.680611][ T6743] loop3: detected capacity change from 0 to 4096 [ 136.692193][ T789] usb 2-1: config 0 descriptor?? [ 136.725871][ T6743] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 136.765957][ T6743] Quota error (device loop3): find_block_dqentry: Quota for id 0 referenced but not present [ 136.781077][ T6743] Quota error (device loop3): qtree_read_dquot: Can't read quota structure for id 0 [ 136.791798][ T6743] EXT4-fs error (device loop3): ext4_acquire_dquot:6953: comm syz.3.250: Failed to acquire dquot type 1 [ 136.811027][ T6743] EXT4-fs warning (device loop3): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-5, ino=4). Please run e2fsck to fix. [ 136.862063][ T5865] usb 1-1: Using ep0 maxpacket: 8 [ 136.869885][ T5865] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 136.878545][ T5865] usb 1-1: config 179 has no interface number 0 [ 136.885355][ T5865] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 136.896838][ T5865] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 136.917041][ T5865] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 136.928689][ T5865] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 136.941853][ T5865] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 136.959268][ T5865] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 136.968539][ T5865] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 136.980407][ T6737] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 137.125813][ T789] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving [ 137.141203][ T789] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 137.505694][ T1095] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.578671][ T9] usb 2-1: USB disconnect, device number 6 [ 138.261189][ T789] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input5 [ 138.307562][ T9] usb 1-1: USB disconnect, device number 4 [ 138.307633][ C1] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 138.322068][ C1] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 138.362410][ T9] xpad 1-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 138.518544][ T1095] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.640112][ T1095] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.809287][ T1095] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.165880][ T5088] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 139.183020][ T5088] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 139.191467][ T1095] tipc: Left network mode [ 139.197215][ T5088] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 139.211011][ T5088] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 139.226599][ T5088] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 139.245615][ T5088] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 139.371251][ T6758] loop1: detected capacity change from 0 to 32768 [ 139.410604][ T6758] BTRFS: device fsid db05bf05-c4f4-4d41-ba1f-eb57295b561b devid 1 transid 8 /dev/loop1 scanned by syz.1.257 (6758) [ 139.490995][ T6758] BTRFS info (device loop1): first mount of filesystem db05bf05-c4f4-4d41-ba1f-eb57295b561b [ 139.518286][ T6758] BTRFS info (device loop1): using xxhash64 (xxhash64-generic) checksum algorithm [ 139.542369][ T6758] BTRFS info (device loop1): using free space tree [ 139.731506][ T6758] BTRFS info (device loop1): enabling ssd optimizations [ 139.754046][ T6758] BTRFS info (device loop1): auto enabling async discard [ 140.039864][ T5774] BTRFS info (device loop1): last unmount of filesystem db05bf05-c4f4-4d41-ba1f-eb57295b561b [ 140.149068][ T6762] chnl_net:caif_netlink_parms(): no params data found [ 140.528599][ T6762] bridge0: port 1(bridge_slave_0) entered blocking state [ 140.541745][ T6762] bridge0: port 1(bridge_slave_0) entered disabled state [ 140.551725][ T6762] bridge_slave_0: entered allmulticast mode [ 140.568887][ T6762] bridge_slave_0: entered promiscuous mode [ 140.658758][ T6762] bridge0: port 2(bridge_slave_1) entered blocking state [ 140.671573][ T6762] bridge0: port 2(bridge_slave_1) entered disabled state [ 140.679502][ T6762] bridge_slave_1: entered allmulticast mode [ 140.692870][ T6762] bridge_slave_1: entered promiscuous mode [ 140.801813][ T6762] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 140.846559][ T6762] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 140.908547][ T6762] team0: Port device team_slave_0 added [ 140.927148][ T1095] hsr_slave_0: left promiscuous mode [ 140.934381][ T1095] hsr_slave_1: left promiscuous mode [ 140.946211][ T1095] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 140.954646][ T1095] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 140.964652][ T1095] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 140.972609][ T1095] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 140.980523][ T1095] bridge_slave_1: left allmulticast mode [ 140.986772][ T1095] bridge_slave_1: left promiscuous mode [ 140.994815][ T1095] bridge0: port 2(bridge_slave_1) entered disabled state [ 141.009310][ T1095] bridge_slave_0: left allmulticast mode [ 141.017597][ T1095] bridge_slave_0: left promiscuous mode [ 141.023613][ T1095] bridge0: port 1(bridge_slave_0) entered disabled state [ 141.052836][ T1095] veth1_macvtap: left promiscuous mode [ 141.058877][ T1095] veth0_macvtap: left promiscuous mode [ 141.065125][ T1095] veth1_vlan: left promiscuous mode [ 141.071743][ T1095] veth0_vlan: left promiscuous mode [ 141.346319][ T5088] Bluetooth: hci2: command tx timeout [ 141.670645][ T1095] team0 (unregistering): Port device team_slave_1 removed [ 141.711113][ T1095] team0 (unregistering): Port device team_slave_0 removed [ 141.759363][ T1095] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 141.805779][ T1095] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 142.138356][ T1095] bond0 (unregistering): Released all slaves [ 142.248211][ T6762] team0: Port device team_slave_1 added [ 142.329559][ T6762] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 142.342509][ T6762] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 142.369071][ T6762] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 142.388778][ T6762] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 142.396016][ T6762] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 142.423483][ T6762] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 142.480509][ T6762] hsr_slave_0: entered promiscuous mode [ 142.494947][ T6762] hsr_slave_1: entered promiscuous mode [ 142.501126][ T6762] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 142.509173][ T6762] Cannot create hsr debugfs directory [ 142.830952][ T6762] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 142.847640][ T6762] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 142.862446][ T6762] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 142.879740][ T6762] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 143.003294][ T6762] 8021q: adding VLAN 0 to HW filter on device bond0 [ 143.029292][ T6762] 8021q: adding VLAN 0 to HW filter on device team0 [ 143.051612][ T1095] bridge0: port 1(bridge_slave_0) entered blocking state [ 143.058820][ T1095] bridge0: port 1(bridge_slave_0) entered forwarding state [ 143.099543][ T6341] bridge0: port 2(bridge_slave_1) entered blocking state [ 143.106759][ T6341] bridge0: port 2(bridge_slave_1) entered forwarding state [ 143.410856][ T6762] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 143.423166][ T5088] Bluetooth: hci2: command tx timeout [ 143.861709][ T6762] veth0_vlan: entered promiscuous mode [ 143.913078][ T6762] veth1_vlan: entered promiscuous mode [ 143.960385][ T6762] veth0_macvtap: entered promiscuous mode [ 143.978320][ T6762] veth1_macvtap: entered promiscuous mode [ 144.011005][ T6762] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 144.025932][ T6762] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 144.036402][ T6762] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 144.048598][ T6762] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 144.065542][ T6762] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 144.079950][ T6762] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 144.093653][ T6762] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 144.111070][ T6762] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 144.122852][ T6762] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 144.136276][ T6762] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 144.148043][ T6762] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 144.164034][ T6762] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 144.177410][ T6762] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 144.191370][ T6762] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 144.210451][ T6762] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 144.228150][ T6762] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 144.238568][ T6762] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 144.250812][ T6762] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 144.390834][ T6341] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 144.409642][ T6341] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 144.482188][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 144.490077][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 145.141743][ T6881] warning: `syz.0.259' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 145.502263][ T5088] Bluetooth: hci2: command tx timeout [ 147.582530][ T5088] Bluetooth: hci2: command tx timeout [ 147.826810][ T6956] loop4: detected capacity change from 0 to 32768 [ 147.884457][ T6956] BTRFS: device fsid db05bf05-c4f4-4d41-ba1f-eb57295b561b devid 1 transid 8 /dev/loop4 scanned by syz.4.271 (6956) [ 147.931783][ T6956] BTRFS info (device loop4): first mount of filesystem db05bf05-c4f4-4d41-ba1f-eb57295b561b [ 147.959650][ T6956] BTRFS info (device loop4): using xxhash64 (xxhash64-generic) checksum algorithm [ 147.994541][ T6956] BTRFS info (device loop4): using free space tree [ 148.232142][ T6956] BTRFS info (device loop4): enabling ssd optimizations [ 148.239170][ T6956] BTRFS info (device loop4): auto enabling async discard [ 148.824202][ T6762] BTRFS info (device loop4): last unmount of filesystem db05bf05-c4f4-4d41-ba1f-eb57295b561b [ 150.572029][ T23] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 150.762551][ T23] usb 5-1: Using ep0 maxpacket: 8 [ 150.779960][ T23] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 150.790420][ T7078] event trace: Could not enable event p [ 150.805015][ T23] usb 5-1: config 179 has no interface number 0 [ 150.811370][ T23] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 150.848345][ T23] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 150.863395][ T23] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 150.876579][ T23] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 150.888931][ T23] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 150.902982][ T23] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 150.914743][ T23] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 150.927960][ T7063] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 151.327652][ T7091] loop1: detected capacity change from 0 to 64 [ 151.697228][ T7091] syz.1.295: attempt to access beyond end of device [ 151.697228][ T7091] loop1: rw=2049, sector=159, nr_sectors = 1 limit=64 [ 151.712440][ T7091] buffer_io_error: 5 callbacks suppressed [ 151.712587][ T7091] Buffer I/O error on dev loop1, logical block 159, lost async page write [ 151.728095][ T7091] syz.1.295: attempt to access beyond end of device [ 151.728095][ T7091] loop1: rw=2049, sector=160, nr_sectors = 1 limit=64 [ 151.742109][ T7091] Buffer I/O error on dev loop1, logical block 160, lost async page write [ 151.751366][ T7091] syz.1.295: attempt to access beyond end of device [ 151.751366][ T7091] loop1: rw=2049, sector=161, nr_sectors = 1 limit=64 [ 151.765185][ T7091] Buffer I/O error on dev loop1, logical block 161, lost async page write [ 151.775385][ T7091] syz.1.295: attempt to access beyond end of device [ 151.775385][ T7091] loop1: rw=2049, sector=162, nr_sectors = 1 limit=64 [ 151.789109][ T7091] Buffer I/O error on dev loop1, logical block 162, lost async page write [ 151.799036][ T7091] syz.1.295: attempt to access beyond end of device [ 151.799036][ T7091] loop1: rw=2049, sector=163, nr_sectors = 1 limit=64 [ 151.813013][ T7091] Buffer I/O error on dev loop1, logical block 163, lost async page write [ 151.822279][ T7091] syz.1.295: attempt to access beyond end of device [ 151.822279][ T7091] loop1: rw=2049, sector=167, nr_sectors = 1 limit=64 [ 151.836102][ T7091] Buffer I/O error on dev loop1, logical block 167, lost async page write [ 151.845440][ T7091] syz.1.295: attempt to access beyond end of device [ 151.845440][ T7091] loop1: rw=2049, sector=169, nr_sectors = 1 limit=64 [ 151.859201][ T7091] Buffer I/O error on dev loop1, logical block 169, lost async page write [ 151.868445][ T7091] syz.1.295: attempt to access beyond end of device [ 151.868445][ T7091] loop1: rw=2049, sector=171, nr_sectors = 1 limit=64 [ 151.882509][ T7091] Buffer I/O error on dev loop1, logical block 171, lost async page write [ 151.892285][ T7091] syz.1.295: attempt to access beyond end of device [ 151.892285][ T7091] loop1: rw=2049, sector=172, nr_sectors = 1 limit=64 [ 151.907078][ T7091] Buffer I/O error on dev loop1, logical block 172, lost async page write [ 151.916508][ T7091] syz.1.295: attempt to access beyond end of device [ 151.916508][ T7091] loop1: rw=2049, sector=173, nr_sectors = 1 limit=64 [ 151.930373][ T7091] Buffer I/O error on dev loop1, logical block 173, lost async page write [ 152.339521][ T789] input: Generic X-Box pad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:179.65/input/input6 [ 152.651057][ T2200] usb 5-1: USB disconnect, device number 2 [ 152.651139][ C1] xpad 5-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 152.665861][ C1] dummy_hcd dummy_hcd.4: timer fired with no URBs pending? [ 152.672828][ T2200] xpad 5-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 153.172022][ T9] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 153.432129][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 153.441389][ T9] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 153.465730][ T9] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 153.484136][ T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 153.498277][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 153.508495][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 153.518663][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 153.532177][ T9] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 153.542356][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 153.557506][ T9] usb 1-1: config 0 descriptor?? [ 153.828009][ T9] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 5 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 153.859400][ T9] usb 1-1: USB disconnect, device number 5 [ 153.878887][ T9] usblp0: removed [ 154.365947][ T9] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 154.622081][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 154.630657][ T9] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 154.642108][ T9] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 154.653527][ T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 154.677328][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 154.689325][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 154.702427][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 154.719762][ T9] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 154.728939][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 154.740201][ T9] usb 1-1: config 0 descriptor?? [ 154.976259][ T9] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 6 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 155.368378][ T173] usb 1-1: USB disconnect, device number 6 [ 155.383933][ T7128] bond_slave_0: entered promiscuous mode [ 155.390086][ T7128] bond_slave_1: entered promiscuous mode [ 155.400114][ T173] usblp0: removed [ 155.407151][ T7128] macvlan2: entered promiscuous mode [ 155.416738][ T7128] bond0: entered promiscuous mode [ 155.427762][ T7128] macvlan2: entered allmulticast mode [ 155.433614][ T7128] bond0: entered allmulticast mode [ 155.438787][ T7128] bond_slave_0: entered allmulticast mode [ 155.453619][ T7128] bond_slave_1: entered allmulticast mode [ 155.460988][ T7128] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 155.472404][ T7128] bond0: left allmulticast mode [ 155.480486][ T7128] bond_slave_0: left allmulticast mode [ 155.491508][ T7128] bond_slave_1: left allmulticast mode [ 155.497366][ T7128] bond0: left promiscuous mode [ 155.506387][ T7128] bond_slave_0: left promiscuous mode [ 155.511950][ T7128] bond_slave_1: left promiscuous mode [ 156.846528][ T7155] loop4: detected capacity change from 0 to 40427 [ 156.868514][ T7155] F2FS-fs (loop4): Invalid SB checksum offset: 0 [ 156.904976][ T7155] F2FS-fs (loop4): Can't find valid F2FS filesystem in 2th superblock [ 156.954581][ T7155] F2FS-fs (loop4): invalid crc value [ 157.253140][ T7155] F2FS-fs (loop4): Try to recover 2th superblock, ret: 0 [ 157.275319][ T7155] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 157.562719][ T6762] bio_check_eod: 5 callbacks suppressed [ 157.562737][ T6762] syz-executor: attempt to access beyond end of device [ 157.562737][ T6762] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 157.614724][ T6762] F2FS-fs (loop4): Stopped filesystem due to reason: 3 [ 158.064696][ T7164] netlink: 'syz.0.315': attribute type 4 has an invalid length. [ 158.142914][ T7164] netlink: 'syz.0.315': attribute type 4 has an invalid length. [ 158.339191][ T7179] block device autoloading is deprecated and will be removed. [ 158.718977][ T7190] syz.1.322 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 158.730544][ T7190] CPU: 0 PID: 7190 Comm: syz.1.322 Not tainted syzkaller #0 [ 158.737868][ T7190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 158.747943][ T7190] Call Trace: [ 158.751220][ T7190] [ 158.754151][ T7190] dump_stack_lvl+0x18c/0x250 [ 158.759156][ T7190] ? show_regs_print_info+0x20/0x20 [ 158.764492][ T7190] ? load_image+0x420/0x420 [ 158.769034][ T7190] ? ___ratelimit+0x478/0x610 [ 158.773735][ T7190] ? radix_tree_cpu_dead+0x160/0x160 [ 158.779057][ T7190] dump_header+0xd8/0x820 [ 158.783412][ T7190] oom_kill_process+0x390/0x580 [ 158.788297][ T7190] out_of_memory+0xe0e/0x1200 [ 158.792981][ T7190] ? mem_cgroup_out_of_memory+0xc1/0x390 [ 158.798623][ T7190] ? mutex_lock_nested+0x20/0x20 [ 158.803572][ T7190] ? unregister_oom_notifier+0x20/0x20 [ 158.809074][ T7190] mem_cgroup_out_of_memory+0x2c2/0x390 [ 158.814624][ T7190] ? try_charge_memcg+0xc91/0x17c0 [ 158.819751][ T7190] ? drain_local_stock+0x630/0x630 [ 158.824879][ T7190] ? do_raw_spin_unlock+0x121/0x230 [ 158.830082][ T7190] try_charge_memcg+0xca1/0x17c0 [ 158.835037][ T7190] ? folio_flags+0x120/0x120 [ 158.839627][ T7190] ? percpu_ref_tryget+0x15/0x180 [ 158.844674][ T7190] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 158.850419][ T7190] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 158.856400][ T7190] ? percpu_ref_tryget+0x15/0x180 [ 158.861438][ T7190] ? percpu_ref_tryget+0x15/0x180 [ 158.866495][ T7190] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 158.872225][ T7190] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 158.877951][ T7190] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 158.883771][ T7190] obj_cgroup_charge+0x36e/0x630 [ 158.888721][ T7190] ? get_obj_cgroup_from_current+0xd4/0x280 [ 158.894631][ T7190] ? obj_cgroup_charge+0xed/0x630 [ 158.899662][ T7190] ? mod_objcg_mlstate+0x320/0x320 [ 158.904827][ T7190] ? get_obj_cgroup_from_current+0xd4/0x280 [ 158.910740][ T7190] ? get_obj_cgroup_from_current+0xd4/0x280 [ 158.916644][ T7190] slab_pre_alloc_hook+0x2e2/0x300 [ 158.921767][ T7190] kmem_cache_alloc+0x5a/0x2c0 [ 158.926541][ T7190] ? vm_area_dup+0x27/0x270 [ 158.931045][ T7190] vm_area_dup+0x27/0x270 [ 158.935403][ T7190] __split_vma+0x1a8/0xc20 [ 158.939848][ T7190] ? mmap_write_unlock+0x160/0x160 [ 158.945586][ T7190] ? schedule+0xc7/0x170 [ 158.949855][ T7190] do_vmi_align_munmap+0x310/0x16a0 [ 158.955116][ T7190] ? futex_wait_setup+0x270/0x270 [ 158.960147][ T7190] ? do_vmi_munmap+0x2d0/0x2d0 [ 158.964942][ T7190] ? mtree_range_walk+0x68c/0x7b0 [ 158.970000][ T7190] ? mas_find_setup+0x47f/0x590 [ 158.974875][ T7190] __se_sys_brk+0x79b/0xd00 [ 158.979398][ T7190] ? __x64_sys_brk+0x40/0x40 [ 158.983997][ T7190] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 158.989996][ T7190] ? lockdep_hardirqs_on+0x98/0x150 [ 158.995210][ T7190] do_syscall_64+0x55/0xb0 [ 158.999661][ T7190] ? clear_bhb_loop+0x40/0x90 [ 159.004338][ T7190] ? clear_bhb_loop+0x40/0x90 [ 159.009030][ T7190] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 159.014954][ T7190] RIP: 0033:0x7ff8bc99e019 [ 159.019398][ T7190] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 159.039029][ T7190] RSP: 002b:00007ff8bd84b028 EFLAGS: 00000246 ORIG_RAX: 000000000000000c [ 159.047464][ T7190] RAX: ffffffffffffffda RBX: 00007ff8bcc25fa0 RCX: 00007ff8bc99e019 [ 159.055471][ T7190] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000001000 [ 159.063448][ T7190] RBP: 00007ff8bca3500c R08: 0000000000000000 R09: 0000000000000000 [ 159.071423][ T7190] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 159.079395][ T7190] R13: 00007ff8bcc26038 R14: 00007ff8bcc25fa0 R15: 00007ffdbb628018 [ 159.087380][ T7190] [ 159.094734][ T7190] memory: usage 0kB, limit 0kB, failcnt 19 [ 159.100683][ T7190] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 159.108761][ T7190] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 159.115952][ T7190] Memory cgroup stats for /syz1/test: [ 159.116556][ T7190] cache 0 [ 159.125098][ T7190] rss 0 [ 159.127968][ T7190] rss_huge 0 [ 159.131254][ T7190] shmem 0 [ 159.134373][ T7190] mapped_file 0 [ 159.138002][ T7190] dirty 0 [ 159.141045][ T7190] writeback 0 [ 159.147726][ T7190] workingset_refault_anon 0 [ 159.153315][ T7190] workingset_refault_file 0 [ 159.158619][ T7190] swap 0 [ 159.161575][ T7190] pgpgin 0 [ 159.164816][ T7190] pgpgout 0 [ 159.168017][ T7190] pgfault 0 [ 159.175488][ T7190] pgmajfault 0 [ 159.179006][ T7190] inactive_anon 0 [ 159.184202][ T7190] active_anon 0 [ 159.187822][ T7190] inactive_file 0 [ 159.193079][ T7190] active_file 0 [ 159.196773][ T7190] unevictable 0 [ 159.200414][ T7190] hierarchical_memory_limit 0 [ 159.208009][ T7190] hierarchical_memsw_limit 9223372036854771712 [ 159.214754][ T7190] total_cache 0 [ 159.218467][ T7190] total_rss 0 [ 159.222383][ T7190] total_rss_huge 0 [ 159.226606][ T7190] total_shmem 0 [ 159.230530][ T7190] total_mapped_file 0 [ 159.235424][ T7190] total_dirty 0 [ 159.239061][ T7190] total_writeback 0 [ 159.243843][ T7190] total_workingset_refault_anon 0 [ 159.249014][ T7190] total_workingset_refault_file 0 [ 159.254770][ T7190] total_swap 0 [ 159.258227][ T7190] total_pgpgin 0 [ 159.261835][ T7190] total_pgpgout 0 [ 159.266115][ T7190] total_pgfault 0 [ 159.269792][ T7190] total_pgmajfault 0 [ 159.275258][ T7190] total_inactive_anon 0 [ 159.279706][ T7190] total_active_anon 0 [ 159.284270][ T7190] total_inactive_file 0 [ 159.289853][ T7190] total_active_file 0 [ 159.296556][ T7190] total_unevictable 0 [ 159.300741][ T7190] anon_cost 0 [ 159.306662][ T7190] file_cost 0 [ 159.310020][ T7190] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz1/test,task_memcg=/syz1/test,task=syz.1.322,pid=7188,uid=0 [ 159.354483][ T7190] Memory cgroup out of memory: Killed process 7188 (syz.1.322) total-vm:104292kB, anon-rss:1384kB, file-rss:22528kB, shmem-rss:0kB, UID:0 pgtables:132kB oom_score_adj:1000 [ 160.142945][ T7217] block device autoloading is deprecated and will be removed. [ 160.337979][ T7209] loop1: detected capacity change from 0 to 40427 [ 160.349332][ T7209] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 160.357855][ T7209] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 160.385398][ T7209] F2FS-fs (loop1): invalid crc value [ 160.431613][ T7209] F2FS-fs (loop1): Found nat_bits in checkpoint [ 160.513618][ T7209] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 160.520727][ T7209] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 160.661758][ T5774] syz-executor: attempt to access beyond end of device [ 160.661758][ T5774] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 160.690208][ T5774] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 162.980725][ T7267] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 163.441527][ T7263] loop1: detected capacity change from 0 to 32768 [ 163.462562][ T7263] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.345 (7263) [ 163.511808][ T7263] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 163.542761][ T7263] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 163.562727][ T7263] BTRFS info (device loop1): setting nodatasum [ 163.574708][ T7263] BTRFS info (device loop1): force zlib compression, level 3 [ 163.592072][ T7263] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_LZO (0x8) [ 163.619374][ T7263] BTRFS info (device loop1): use lzo compression, level 0 [ 163.651981][ T7263] BTRFS info (device loop1): turning on flush-on-commit [ 163.680801][ T7263] BTRFS info (device loop1): enabling auto defrag [ 163.709125][ T7263] BTRFS info (device loop1): max_inline at 4096 [ 163.736055][ T7263] BTRFS info (device loop1): using free space tree [ 163.913598][ T7263] BTRFS info (device loop1): enabling ssd optimizations [ 164.336516][ T5774] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 164.635833][ T7301] kvm: pic: level sensitive irq not supported [ 164.779116][ T7307] loop1: detected capacity change from 0 to 64 [ 164.928385][ T7307] syz.1.352: attempt to access beyond end of device [ 164.928385][ T7307] loop1: rw=2049, sector=159, nr_sectors = 1 limit=64 [ 164.941791][ T7307] buffer_io_error: 5 callbacks suppressed [ 164.941843][ T7307] Buffer I/O error on dev loop1, logical block 159, lost async page write [ 164.956538][ T7307] syz.1.352: attempt to access beyond end of device [ 164.956538][ T7307] loop1: rw=2049, sector=160, nr_sectors = 1 limit=64 [ 164.970264][ T7307] Buffer I/O error on dev loop1, logical block 160, lost async page write [ 164.979263][ T7307] syz.1.352: attempt to access beyond end of device [ 164.979263][ T7307] loop1: rw=2049, sector=161, nr_sectors = 1 limit=64 [ 164.992870][ T7307] Buffer I/O error on dev loop1, logical block 161, lost async page write [ 165.002441][ T7307] syz.1.352: attempt to access beyond end of device [ 165.002441][ T7307] loop1: rw=2049, sector=162, nr_sectors = 1 limit=64 [ 165.016810][ T7307] Buffer I/O error on dev loop1, logical block 162, lost async page write [ 165.025977][ T7307] syz.1.352: attempt to access beyond end of device [ 165.025977][ T7307] loop1: rw=2049, sector=163, nr_sectors = 1 limit=64 [ 165.039570][ T7307] Buffer I/O error on dev loop1, logical block 163, lost async page write [ 165.048732][ T7307] syz.1.352: attempt to access beyond end of device [ 165.048732][ T7307] loop1: rw=2049, sector=167, nr_sectors = 1 limit=64 [ 165.062356][ T7307] Buffer I/O error on dev loop1, logical block 167, lost async page write [ 165.071189][ T7307] syz.1.352: attempt to access beyond end of device [ 165.071189][ T7307] loop1: rw=2049, sector=169, nr_sectors = 1 limit=64 [ 165.084710][ T7307] Buffer I/O error on dev loop1, logical block 169, lost async page write [ 165.093859][ T7307] syz.1.352: attempt to access beyond end of device [ 165.093859][ T7307] loop1: rw=2049, sector=171, nr_sectors = 1 limit=64 [ 165.108428][ T7307] Buffer I/O error on dev loop1, logical block 171, lost async page write [ 165.117838][ T7307] syz.1.352: attempt to access beyond end of device [ 165.117838][ T7307] loop1: rw=2049, sector=172, nr_sectors = 1 limit=64 [ 165.131362][ T7307] Buffer I/O error on dev loop1, logical block 172, lost async page write [ 165.140395][ T7307] syz.1.352: attempt to access beyond end of device [ 165.140395][ T7307] loop1: rw=2049, sector=173, nr_sectors = 1 limit=64 [ 165.154220][ T7307] Buffer I/O error on dev loop1, logical block 173, lost async page write [ 166.610376][ T7331] loop1: detected capacity change from 0 to 40427 [ 166.629061][ T7331] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 166.637566][ T7331] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 166.693977][ T7331] F2FS-fs (loop1): Found nat_bits in checkpoint [ 166.751259][ T7331] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 166.758443][ T7331] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 166.836470][ T7345] loop2: detected capacity change from 0 to 64 [ 167.806582][ T7334] loop4: detected capacity change from 0 to 32768 [ 167.862819][ T7334] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz.4.359 (7334) [ 167.920545][ T7334] BTRFS info (device loop4): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 167.961745][ T7334] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm [ 168.022106][ T7334] BTRFS info (device loop4): setting nodatasum [ 168.048829][ T7334] BTRFS info (device loop4): force zlib compression, level 3 [ 168.082322][ T7334] BTRFS info (device loop4): setting incompat feature flag for COMPRESS_LZO (0x8) [ 168.122147][ T7334] BTRFS info (device loop4): use lzo compression, level 0 [ 168.132855][ T7334] BTRFS info (device loop4): turning on flush-on-commit [ 168.170859][ T7334] BTRFS info (device loop4): enabling auto defrag [ 168.187277][ T5774] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 168.205581][ T7334] BTRFS info (device loop4): max_inline at 4096 [ 168.244209][ T7334] BTRFS info (device loop4): using free space tree [ 168.457744][ T7334] BTRFS info (device loop4): enabling ssd optimizations [ 169.025439][ T6762] BTRFS info (device loop4): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 169.216126][ T7403] bridge1: entered promiscuous mode [ 169.490085][ T7411] loop2: detected capacity change from 0 to 512 [ 169.517747][ T7411] EXT4-fs: Ignoring removed mblk_io_submit option [ 169.655785][ T7415] loop1: detected capacity change from 0 to 64 [ 169.693475][ T7411] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 169.767687][ T7411] ext4 filesystem being mounted at /88/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 169.918033][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 169.934706][ T7424] loop1: detected capacity change from 0 to 1024 [ 170.154073][ T28] audit: type=1800 audit(1785869485.682:3): pid=7424 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.372" name="file1" dev="loop1" ino=20 res=0 errno=0 [ 171.546271][ T7461] netlink: 'syz.0.382': attribute type 1 has an invalid length. [ 171.621329][ T7461] 8021q: adding VLAN 0 to HW filter on device bond1 [ 171.663696][ T7465] loop2: detected capacity change from 0 to 64 [ 171.840443][ T7465] bio_check_eod: 1559 callbacks suppressed [ 171.840455][ T7465] syz.2.381: attempt to access beyond end of device [ 171.840455][ T7465] loop2: rw=2049, sector=159, nr_sectors = 1 limit=64 [ 171.985982][ T7468] loop1: detected capacity change from 0 to 8192 [ 172.038766][ T7468] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 172.060031][ T7465] buffer_io_error: 35 callbacks suppressed [ 172.060079][ T7465] Buffer I/O error on dev loop2, logical block 159, lost async page write [ 172.076439][ T7465] syz.2.381: attempt to access beyond end of device [ 172.076439][ T7465] loop2: rw=2049, sector=160, nr_sectors = 1 limit=64 [ 172.093448][ T7465] Buffer I/O error on dev loop2, logical block 160, lost async page write [ 172.118499][ T7465] syz.2.381: attempt to access beyond end of device [ 172.118499][ T7465] loop2: rw=2049, sector=161, nr_sectors = 1 limit=64 [ 172.140609][ T7465] Buffer I/O error on dev loop2, logical block 161, lost async page write [ 172.163340][ T7465] syz.2.381: attempt to access beyond end of device [ 172.163340][ T7465] loop2: rw=2049, sector=162, nr_sectors = 1 limit=64 [ 172.181033][ T7465] Buffer I/O error on dev loop2, logical block 162, lost async page write [ 172.201757][ T7465] syz.2.381: attempt to access beyond end of device [ 172.201757][ T7465] loop2: rw=2049, sector=163, nr_sectors = 1 limit=64 [ 172.219763][ T7465] Buffer I/O error on dev loop2, logical block 163, lost async page write [ 172.251522][ T7465] syz.2.381: attempt to access beyond end of device [ 172.251522][ T7465] loop2: rw=2049, sector=167, nr_sectors = 1 limit=64 [ 172.271812][ T7465] Buffer I/O error on dev loop2, logical block 167, lost async page write [ 172.289527][ T7465] syz.2.381: attempt to access beyond end of device [ 172.289527][ T7465] loop2: rw=2049, sector=169, nr_sectors = 1 limit=64 [ 172.305731][ T7465] Buffer I/O error on dev loop2, logical block 169, lost async page write [ 172.322939][ T7465] syz.2.381: attempt to access beyond end of device [ 172.322939][ T7465] loop2: rw=2049, sector=171, nr_sectors = 1 limit=64 [ 172.362499][ T7465] Buffer I/O error on dev loop2, logical block 171, lost async page write [ 172.489828][ T7465] syz.2.381: attempt to access beyond end of device [ 172.489828][ T7465] loop2: rw=2049, sector=172, nr_sectors = 1 limit=64 [ 172.503528][ T7465] Buffer I/O error on dev loop2, logical block 172, lost async page write [ 172.521061][ T7465] syz.2.381: attempt to access beyond end of device [ 172.521061][ T7465] loop2: rw=2049, sector=173, nr_sectors = 1 limit=64 [ 172.549769][ T7465] Buffer I/O error on dev loop2, logical block 173, lost async page write [ 172.839080][ T7491] loop4: detected capacity change from 0 to 16 [ 172.908331][ T7491] erofs: (device loop4): erofs_read_superblock: dirblkbits 8 isn't supported [ 173.858399][ T7521] loop1: detected capacity change from 0 to 64 [ 175.433329][ T7533] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 175.599094][ T7548] loop2: detected capacity change from 0 to 128 [ 175.658100][ T7548] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 175.711678][ T7548] ext4 filesystem being mounted at /98/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 175.918954][ T5776] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 175.919579][ T7554] loop1: detected capacity change from 0 to 1024 [ 176.024563][ T7554] EXT4-fs (loop1): couldn't mount as ext2 due to feature incompatibilities [ 176.324971][ T5865] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 176.456816][ T7572] loop1: detected capacity change from 0 to 512 [ 176.502275][ T7572] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 176.552108][ T5865] usb 3-1: Using ep0 maxpacket: 32 [ 176.560930][ T7572] EXT4-fs warning (device loop1): ext4_expand_extra_isize_ea:2855: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 176.588107][ T5865] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 176.602127][ T5865] usb 3-1: config 0 has no interface number 0 [ 176.608308][ T5865] usb 3-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 176.628219][ T7572] EXT4-fs (loop1): 1 truncate cleaned up [ 176.635333][ T7572] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 176.652103][ T5865] usb 3-1: config 0 interface 89 has no altsetting 0 [ 176.675071][ T5865] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 176.692141][ T5865] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.700204][ T5865] usb 3-1: Product: syz [ 176.704788][ T5865] usb 3-1: Manufacturer: syz [ 176.709436][ T5865] usb 3-1: SerialNumber: syz [ 176.716567][ T5865] usb 3-1: config 0 descriptor?? [ 176.753384][ T5865] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 176.786135][ T5865] em28xx 3-1:0.89: Video interface 89 found: [ 176.802144][ T173] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 176.869140][ T7572] EXT4-fs (loop1): pa ffff888077cdb828: logic 131072, phys. 40, len 215 [ 176.878778][ T7572] EXT4-fs error (device loop1): ext4_mb_release_inode_pa:5393: group 0, free 159, pa_free 214 [ 176.971856][ T5774] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 177.002532][ T173] usb 1-1: Using ep0 maxpacket: 8 [ 177.019765][ T173] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 177.043040][ T173] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.065786][ T173] usb 1-1: Product: syz [ 177.070108][ T173] usb 1-1: Manufacturer: syz [ 177.078131][ T173] usb 1-1: SerialNumber: syz [ 177.103338][ T173] usb 1-1: config 0 descriptor?? [ 177.337385][ T173] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 177.368782][ T5865] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 177.833325][ T7609] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 177.978046][ T173] dvb_usb_rtl28xxu: probe of 1-1:0.0 failed with error -71 [ 177.995874][ T173] usb 1-1: USB disconnect, device number 7 [ 178.596459][ T5865] em28xx 3-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 178.606705][ T5865] em28xx 3-1:0.89: board has no eeprom [ 178.682662][ T5865] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 178.712209][ T5865] em28xx 3-1:0.89: analog set to bulk mode. [ 178.735079][ T5834] em28xx 3-1:0.89: Registering V4L2 extension [ 178.760435][ T5865] usb 3-1: USB disconnect, device number 4 [ 178.761405][ T5865] em28xx 3-1:0.89: Disconnecting em28xx [ 178.888543][ T5834] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 178.888644][ T5834] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 178.888659][ T5834] em28xx 3-1:0.89: No AC97 audio processor [ 178.922005][ T5834] usb 3-1: Decoder not found [ 178.922027][ T5834] em28xx 3-1:0.89: failed to create media graph [ 178.924295][ T5834] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 178.958927][ T5834] em28xx 3-1:0.89: Registering snapshot button... [ 178.969876][ T5834] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input7 [ 178.991490][ T5834] em28xx 3-1:0.89: Remote control support is not available for this card. [ 178.991753][ T5865] em28xx 3-1:0.89: Closing input extension [ 178.992755][ T5865] em28xx 3-1:0.89: Deregistering snapshot button [ 179.019541][ T7641] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 179.189745][ T5865] em28xx 3-1:0.89: Freeing device [ 182.412347][ T7718] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 183.204195][ T7726] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 183.468303][ T7732] binder: 7731:7732 unknown command 0 [ 183.476629][ T7732] binder: 7731:7732 ioctl c0306201 200000000080 returned -22 [ 184.712374][ T2200] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 185.042334][ T2200] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 185.163889][ T2200] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 185.229819][ T7770] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 185.242335][ T2200] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 185.278105][ T2200] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 185.301975][ T2200] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 185.339347][ T2200] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 185.386444][ T2200] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 185.422234][ T2200] usb 1-1: Product: syz [ 185.429036][ T2200] usb 1-1: Manufacturer: syz [ 185.447560][ T2200] cdc_wdm 1-1:1.0: skipping garbage [ 185.462354][ T2200] cdc_wdm 1-1:1.0: skipping garbage [ 185.487042][ T2200] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 185.497578][ T2200] cdc_wdm 1-1:1.0: Unknown control protocol [ 185.715168][ T7787] loop4: detected capacity change from 0 to 164 [ 185.851060][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 185.858007][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 185.864789][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 185.871434][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 185.878111][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 185.884756][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 185.891469][ T2200] usb 1-1: USB disconnect, device number 8 [ 185.897398][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 185.897423][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 185.897439][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 186.252584][ T5865] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 186.447937][ T7811] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 186.472028][ T5865] usb 3-1: Using ep0 maxpacket: 32 [ 186.512647][ T5865] usb 3-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 186.521853][ T5865] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.540344][ T5865] usb 3-1: Product: syz [ 186.562069][ T5865] usb 3-1: Manufacturer: syz [ 186.566735][ T5865] usb 3-1: SerialNumber: syz [ 186.600602][ T5865] usb 3-1: config 0 descriptor?? [ 186.626192][ T5865] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 186.859718][ T7821] kvm: pic: non byte write [ 186.872269][ T7821] kvm: pic: non byte write [ 187.719625][ T7837] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 188.646190][ T5865] gspca_ov534_9: reg_w failed -71 [ 188.705138][ T7852] loop1: detected capacity change from 0 to 64 [ 188.869745][ T7852] bio_check_eod: 20 callbacks suppressed [ 188.869759][ T7852] syz.1.463: attempt to access beyond end of device [ 188.869759][ T7852] loop1: rw=2049, sector=159, nr_sectors = 1 limit=64 [ 188.892475][ T7852] buffer_io_error: 20 callbacks suppressed [ 188.892489][ T7852] Buffer I/O error on dev loop1, logical block 159, lost async page write [ 188.917838][ T7852] syz.1.463: attempt to access beyond end of device [ 188.917838][ T7852] loop1: rw=2049, sector=160, nr_sectors = 1 limit=64 [ 188.959910][ T7852] Buffer I/O error on dev loop1, logical block 160, lost async page write [ 188.998183][ T7852] syz.1.463: attempt to access beyond end of device [ 188.998183][ T7852] loop1: rw=2049, sector=161, nr_sectors = 1 limit=64 [ 189.016034][ T7852] Buffer I/O error on dev loop1, logical block 161, lost async page write [ 189.027572][ T5865] gspca_ov534_9: Unknown sensor 0000 [ 189.027626][ T5865] ov534_9: probe of 3-1:0.0 failed with error -22 [ 189.048654][ T7852] syz.1.463: attempt to access beyond end of device [ 189.048654][ T7852] loop1: rw=2049, sector=162, nr_sectors = 1 limit=64 [ 189.076798][ T5865] usb 3-1: USB disconnect, device number 5 [ 189.096942][ T7852] Buffer I/O error on dev loop1, logical block 162, lost async page write [ 189.115824][ T7852] syz.1.463: attempt to access beyond end of device [ 189.115824][ T7852] loop1: rw=2049, sector=163, nr_sectors = 1 limit=64 [ 189.133348][ T7852] Buffer I/O error on dev loop1, logical block 163, lost async page write [ 189.158842][ T7852] syz.1.463: attempt to access beyond end of device [ 189.158842][ T7852] loop1: rw=2049, sector=167, nr_sectors = 1 limit=64 [ 189.173104][ T7852] Buffer I/O error on dev loop1, logical block 167, lost async page write [ 189.192344][ T7852] syz.1.463: attempt to access beyond end of device [ 189.192344][ T7852] loop1: rw=2049, sector=169, nr_sectors = 1 limit=64 [ 189.208922][ T7852] Buffer I/O error on dev loop1, logical block 169, lost async page write [ 189.225551][ T7852] syz.1.463: attempt to access beyond end of device [ 189.225551][ T7852] loop1: rw=2049, sector=171, nr_sectors = 1 limit=64 [ 189.241215][ T7852] Buffer I/O error on dev loop1, logical block 171, lost async page write [ 189.260919][ T7852] syz.1.463: attempt to access beyond end of device [ 189.260919][ T7852] loop1: rw=2049, sector=172, nr_sectors = 1 limit=64 [ 189.277891][ T7852] Buffer I/O error on dev loop1, logical block 172, lost async page write [ 189.296222][ T7852] syz.1.463: attempt to access beyond end of device [ 189.296222][ T7852] loop1: rw=2049, sector=173, nr_sectors = 1 limit=64 [ 189.312873][ T7852] Buffer I/O error on dev loop1, logical block 173, lost async page write [ 189.966352][ T7855] loop4: detected capacity change from 0 to 32768 [ 190.028487][ T7855] [ 190.028487][ T7855] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 190.028487][ T7855] [ 190.129044][ T28] audit: type=1800 audit(1785869505.662:4): pid=7855 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.464" name="file1" dev="loop4" ino=4 res=0 errno=0 [ 190.189664][ T7855] [ 190.189664][ T7855] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 190.189664][ T7855] [ 190.189914][ T7855] [ 190.189914][ T7855] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 190.189914][ T7855] [ 190.230078][ T114] [ 190.230078][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 190.230078][ T114] [ 190.330256][ T6762] [ 190.330256][ T6762] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 190.330256][ T6762] [ 190.330396][ T6762] [ 190.330396][ T6762] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 190.330396][ T6762] [ 190.381079][ T7891] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 190.580982][ T7897] netlink: 'syz.2.473': attribute type 4 has an invalid length. [ 190.685552][ T7901] netlink: 'syz.2.473': attribute type 4 has an invalid length. [ 190.823841][ T7902] loop1: detected capacity change from 0 to 64 [ 191.505162][ T5782] Bluetooth: hci1: command 0x0406 tx timeout [ 191.513103][ T5788] Bluetooth: hci3: command 0x0406 tx timeout [ 191.519181][ T5786] Bluetooth: hci0: command 0x0406 tx timeout [ 191.571172][ T7916] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 191.772931][ T7921] Bluetooth: MGMT ver 1.22 [ 192.479439][ T7938] input: syz1 as /devices/virtual/input/input8 [ 192.884404][ T7951] loop1: detected capacity change from 0 to 64 [ 193.119026][ T7955] binder: 7954:7955 ioctl c0306201 200000000080 returned -14 [ 193.152710][ T7955] binder: 7954:7955 ioctl c0306201 2000000003c0 returned -14 [ 193.166522][ T7957] loop4: detected capacity change from 0 to 128 [ 193.219394][ T7957] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 193.260308][ T7957] ext4 filesystem being mounted at /48/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 193.302041][ T9] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 193.518531][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 193.526934][ T6762] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 193.532428][ T9] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 193.553998][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.567224][ T9] usb 1-1: config 0 descriptor?? [ 193.597272][ T9] pwc: Askey VC010 type 2 USB webcam detected. [ 193.719560][ T7972] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 193.799689][ T9] pwc: send_video_command error -71 [ 193.815634][ T9] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 193.837586][ T9] Philips webcam: probe of 1-1:0.0 failed with error -71 [ 193.872380][ T9] usb 1-1: USB disconnect, device number 9 [ 194.432174][ T9] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 194.547162][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.553614][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.665036][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 194.697764][ T9] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 194.724894][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.733980][ T7980] netlink: 8 bytes leftover after parsing attributes in process `syz.4.491'. [ 194.743744][ T9] usb 1-1: config 0 descriptor?? [ 194.766337][ T9] pwc: Askey VC010 type 2 USB webcam detected. [ 194.954147][ T7987] loop1: detected capacity change from 0 to 64 [ 195.182043][ T9] pwc: recv_control_msg error -32 req 02 val 2b00 [ 195.190127][ T7987] bio_check_eod: 35 callbacks suppressed [ 195.190138][ T7987] syz.1.494: attempt to access beyond end of device [ 195.190138][ T7987] loop1: rw=2049, sector=159, nr_sectors = 1 limit=64 [ 195.195837][ T9] pwc: recv_control_msg error -32 req 02 val 2700 [ 195.196622][ T9] pwc: recv_control_msg error -32 req 02 val 2c00 [ 195.229345][ T7987] buffer_io_error: 35 callbacks suppressed [ 195.229357][ T7987] Buffer I/O error on dev loop1, logical block 159, lost async page write [ 195.262179][ T7987] syz.1.494: attempt to access beyond end of device [ 195.262179][ T7987] loop1: rw=2049, sector=160, nr_sectors = 1 limit=64 [ 195.281444][ T7987] Buffer I/O error on dev loop1, logical block 160, lost async page write [ 195.281839][ T9] pwc: recv_control_msg error -32 req 04 val 1000 [ 195.299819][ T7987] syz.1.494: attempt to access beyond end of device [ 195.299819][ T7987] loop1: rw=2049, sector=161, nr_sectors = 1 limit=64 [ 195.301649][ T9] pwc: recv_control_msg error -32 req 04 val 1300 [ 195.343545][ T7987] Buffer I/O error on dev loop1, logical block 161, lost async page write [ 195.368155][ T7987] syz.1.494: attempt to access beyond end of device [ 195.368155][ T7987] loop1: rw=2049, sector=162, nr_sectors = 1 limit=64 [ 195.388682][ T7987] Buffer I/O error on dev loop1, logical block 162, lost async page write [ 195.536911][ T7987] syz.1.494: attempt to access beyond end of device [ 195.536911][ T7987] loop1: rw=2049, sector=163, nr_sectors = 1 limit=64 [ 195.553648][ T9] pwc: recv_control_msg error -71 req 02 val 2000 [ 195.562612][ T9] pwc: recv_control_msg error -71 req 02 val 2100 [ 195.565204][ T7987] Buffer I/O error on dev loop1, logical block 163, lost async page write [ 195.570076][ T9] pwc: recv_control_msg error -71 req 04 val 1500 [ 195.585821][ T7987] syz.1.494: attempt to access beyond end of device [ 195.585821][ T7987] loop1: rw=2049, sector=167, nr_sectors = 1 limit=64 [ 195.586234][ T9] pwc: recv_control_msg error -71 req 02 val 2500 [ 195.670094][ T9] pwc: recv_control_msg error -71 req 02 val 2400 [ 195.677845][ T9] pwc: recv_control_msg error -71 req 02 val 2600 [ 195.686038][ T9] pwc: recv_control_msg error -71 req 02 val 2900 [ 196.380236][ T9] pwc: recv_control_msg error -71 req 02 val 2800 [ 196.387431][ T9] pwc: recv_control_msg error -71 req 04 val 1100 [ 196.394179][ T7987] Buffer I/O error on dev loop1, logical block 167, lost async page write [ 196.402906][ T9] pwc: recv_control_msg error -71 req 04 val 1200 [ 196.409381][ T7994] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 196.431604][ T7987] syz.1.494: attempt to access beyond end of device [ 196.431604][ T7987] loop1: rw=2049, sector=169, nr_sectors = 1 limit=64 [ 196.448615][ T9] pwc: Registered as video103. [ 196.552436][ T7987] Buffer I/O error on dev loop1, logical block 169, lost async page write [ 196.596341][ T9] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input9 [ 196.610805][ T7987] syz.1.494: attempt to access beyond end of device [ 196.610805][ T7987] loop1: rw=2049, sector=171, nr_sectors = 1 limit=64 [ 196.698612][ T7987] Buffer I/O error on dev loop1, logical block 171, lost async page write [ 196.707590][ T9] usb 1-1: USB disconnect, device number 10 [ 196.747833][ T7987] syz.1.494: attempt to access beyond end of device [ 196.747833][ T7987] loop1: rw=2049, sector=172, nr_sectors = 1 limit=64 [ 196.767633][ T7987] Buffer I/O error on dev loop1, logical block 172, lost async page write [ 196.785689][ T8003] process 'syz.4.499' launched './file0' with NULL argv: empty string added [ 196.800497][ T7987] syz.1.494: attempt to access beyond end of device [ 196.800497][ T7987] loop1: rw=2049, sector=173, nr_sectors = 1 limit=64 [ 196.814752][ T5767] udevd[5767]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 196.841135][ T7987] Buffer I/O error on dev loop1, logical block 173, lost async page write [ 197.225392][ T8010] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 197.251577][ T8012] loop1: detected capacity change from 0 to 512 [ 197.284108][ T8012] EXT4-fs: Ignoring removed oldalloc option [ 197.290088][ T8012] EXT4-fs: inline encryption not supported [ 197.334341][ T8012] EXT4-fs: Mount option(s) incompatible with ext2 [ 197.530649][ T8012] loop1: detected capacity change from 0 to 2048 [ 197.780410][ T8020] netlink: 12 bytes leftover after parsing attributes in process `syz.4.505'. [ 198.941075][ T8028] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 200.023893][ T8035] loop4: detected capacity change from 0 to 64 [ 200.284294][ T8032] bio_check_eod: 5 callbacks suppressed [ 200.284305][ T8032] syz.4.510: attempt to access beyond end of device [ 200.284305][ T8032] loop4: rw=2049, sector=159, nr_sectors = 1 limit=64 [ 200.335354][ T8032] buffer_io_error: 5 callbacks suppressed [ 200.335369][ T8032] Buffer I/O error on dev loop4, logical block 159, lost async page write [ 200.351381][ T8032] syz.4.510: attempt to access beyond end of device [ 200.351381][ T8032] loop4: rw=2049, sector=160, nr_sectors = 1 limit=64 [ 200.380064][ T8032] Buffer I/O error on dev loop4, logical block 160, lost async page write [ 200.392361][ T8032] syz.4.510: attempt to access beyond end of device [ 200.392361][ T8032] loop4: rw=2049, sector=161, nr_sectors = 1 limit=64 [ 200.407163][ T8032] Buffer I/O error on dev loop4, logical block 161, lost async page write [ 200.426795][ T8032] syz.4.510: attempt to access beyond end of device [ 200.426795][ T8032] loop4: rw=2049, sector=162, nr_sectors = 1 limit=64 [ 200.444747][ T8032] Buffer I/O error on dev loop4, logical block 162, lost async page write [ 200.489854][ T8032] syz.4.510: attempt to access beyond end of device [ 200.489854][ T8032] loop4: rw=2049, sector=163, nr_sectors = 1 limit=64 [ 200.511548][ T8032] Buffer I/O error on dev loop4, logical block 163, lost async page write [ 200.522076][ T8032] syz.4.510: attempt to access beyond end of device [ 200.522076][ T8032] loop4: rw=2049, sector=167, nr_sectors = 1 limit=64 [ 200.536165][ T8032] Buffer I/O error on dev loop4, logical block 167, lost async page write [ 200.544942][ T8032] syz.4.510: attempt to access beyond end of device [ 200.544942][ T8032] loop4: rw=2049, sector=169, nr_sectors = 1 limit=64 [ 200.558518][ T8032] Buffer I/O error on dev loop4, logical block 169, lost async page write [ 200.568700][ T8032] syz.4.510: attempt to access beyond end of device [ 200.568700][ T8032] loop4: rw=2049, sector=171, nr_sectors = 1 limit=64 [ 200.604270][ T8032] Buffer I/O error on dev loop4, logical block 171, lost async page write [ 200.632050][ T8032] syz.4.510: attempt to access beyond end of device [ 200.632050][ T8032] loop4: rw=2049, sector=172, nr_sectors = 1 limit=64 [ 200.672260][ T8032] Buffer I/O error on dev loop4, logical block 172, lost async page write [ 200.685218][ T8032] syz.4.510: attempt to access beyond end of device [ 200.685218][ T8032] loop4: rw=2049, sector=173, nr_sectors = 1 limit=64 [ 200.703835][ T8052] loop1: detected capacity change from 0 to 2048 [ 200.720357][ T8032] Buffer I/O error on dev loop4, logical block 173, lost async page write [ 200.731743][ T8052] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 200.989027][ T8058] Bluetooth: hci0: invalid length 0, exp 2 for type 7 [ 201.091694][ T8061] loop4: detected capacity change from 0 to 16 [ 201.174423][ T8062] syz_tun: entered allmulticast mode [ 201.187308][ T8061] erofs: (device loop4): mounted with root inode @ nid 36. [ 201.202670][ T8062] netlink: 4 bytes leftover after parsing attributes in process `syz.1.519'. [ 201.218286][ T8060] syz_tun: left allmulticast mode [ 201.349791][ T8067] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 201.868958][ T8078] overlayfs: failed to clone upperpath [ 202.836238][ T8104] netdevsim netdevsim10 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.979708][ T8115] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 203.116863][ T8120] loop4: detected capacity change from 0 to 1024 [ 203.186144][ T8120] hfsplus: request for non-existent node 33554434 in B*Tree [ 203.206593][ T8120] hfsplus: request for non-existent node 33554434 in B*Tree [ 203.245143][ T8120] hfsplus: request for non-existent node 33554434 in B*Tree [ 203.271050][ T8120] hfsplus: request for non-existent node 33554434 in B*Tree [ 203.294407][ T8120] hfsplus: request for non-existent node 33554434 in B*Tree [ 203.311437][ T8120] hfsplus: request for non-existent node 33554434 in B*Tree [ 203.332746][ T8120] hfsplus: request for non-existent node 33554434 in B*Tree [ 203.340628][ T8120] hfsplus: request for non-existent node 33554434 in B*Tree [ 203.362258][ T8120] hfsplus: request for non-existent node 33554434 in B*Tree [ 203.378033][ T8120] hfsplus: request for non-existent node 33554434 in B*Tree [ 203.401461][ T8120] hfsplus: request for non-existent node 33554434 in B*Tree [ 203.423340][ T8120] hfsplus: request for non-existent node 33554434 in B*Tree [ 203.455701][ T8120] hfsplus: request for non-existent node 33554434 in B*Tree [ 203.474102][ T8120] hfsplus: request for non-existent node 33554434 in B*Tree [ 203.490388][ T28] audit: type=1800 audit(1785869519.022:5): pid=8120 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.541" name="file1" dev="loop4" ino=19 res=0 errno=0 [ 203.843839][ T8149] loop4: detected capacity change from 0 to 512 [ 203.908573][ T7765] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 204.422108][ T5834] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 204.615376][ T5834] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 204.645879][ T5834] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 204.674442][ T5834] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.698712][ T5834] usb 3-1: config 0 descriptor?? [ 204.715643][ T5834] pwc: Askey VC010 type 2 USB webcam detected. [ 205.178674][ T8158] netlink: 4 bytes leftover after parsing attributes in process `syz.2.550'. [ 205.411241][ T5834] pwc: recv_control_msg error -71 req 02 val 2b00 [ 205.425629][ T5834] pwc: recv_control_msg error -71 req 02 val 2700 [ 205.462042][ T5834] pwc: recv_control_msg error -71 req 02 val 2c00 [ 205.469062][ T5834] pwc: recv_control_msg error -71 req 04 val 1000 [ 205.483637][ T5834] pwc: recv_control_msg error -71 req 04 val 1300 [ 205.494402][ T173] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 205.510016][ T5834] pwc: recv_control_msg error -71 req 04 val 1400 [ 205.517948][ T5834] pwc: recv_control_msg error -71 req 02 val 2000 [ 205.532724][ T5834] pwc: recv_control_msg error -71 req 02 val 2100 [ 205.702580][ T173] usb 1-1: Using ep0 maxpacket: 8 [ 205.715743][ T173] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 205.727362][ T5834] pwc: recv_control_msg error -71 req 04 val 1500 [ 205.734587][ T5834] pwc: recv_control_msg error -71 req 02 val 2500 [ 205.741449][ T5834] pwc: recv_control_msg error -71 req 02 val 2400 [ 205.748467][ T5834] pwc: recv_control_msg error -71 req 02 val 2600 [ 205.755508][ T5834] pwc: recv_control_msg error -71 req 02 val 2900 [ 205.762420][ T5834] pwc: recv_control_msg error -71 req 02 val 2800 [ 205.769840][ T5834] pwc: recv_control_msg error -71 req 04 val 1100 [ 205.771612][ T173] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 205.776737][ T5834] pwc: recv_control_msg error -71 req 04 val 1200 [ 205.812269][ T5834] pwc: Registered as video103. [ 205.818171][ T173] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.842594][ T5834] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input10 [ 205.844926][ T173] usb 1-1: config 0 descriptor?? [ 205.925265][ T5834] usb 3-1: USB disconnect, device number 6 [ 206.013048][ T8195] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 206.092363][ T173] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 206.280281][ T8202] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 206.408001][ T173] usb 1-1: USB disconnect, device number 11 [ 206.414265][ C0] iowarrior 1-1:0.0: iowarrior_callback - usb_submit_urb failed with result -19 [ 206.502656][ T8206] binder: 8205:8206 unknown command 0 [ 206.508134][ T8206] binder: 8205:8206 ioctl c0306201 2000000001c0 returned -22 [ 206.642577][ T8208] loop4: detected capacity change from 0 to 128 [ 206.680519][ T8208] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 206.724746][ T8208] ext4 filesystem being mounted at /75/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 206.787046][ T28] audit: type=1804 audit(1785869522.322:6): pid=8208 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.566" name="/newroot/75/file1/bus" dev="loop4" ino=12 res=1 errno=0 [ 207.549805][ T6762] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 207.827551][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 208.044706][ T8247] binder_alloc: 8246: binder_alloc_buf size 24560 failed, no address space [ 208.056148][ T8247] binder_alloc: allocated: 8 (num: 1 largest: 8), free: 12280 (num: 1 largest: 12280) [ 208.142550][ T8249] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 208.795789][ T5834] hid-generic 0006:000F:0100.0005: item fetching failed at offset 0/2 [ 209.513930][ T5834] hid-generic: probe of 0006:000F:0100.0005 failed with error -22 [ 209.894343][ T8264] loop4: detected capacity change from 0 to 64 [ 210.017964][ T8262] bio_check_eod: 5 callbacks suppressed [ 210.017976][ T8262] syz.4.585: attempt to access beyond end of device [ 210.017976][ T8262] loop4: rw=2049, sector=159, nr_sectors = 1 limit=64 [ 210.086098][ T8262] buffer_io_error: 5 callbacks suppressed [ 210.086114][ T8262] Buffer I/O error on dev loop4, logical block 159, lost async page write [ 210.107109][ T8262] syz.4.585: attempt to access beyond end of device [ 210.107109][ T8262] loop4: rw=2049, sector=160, nr_sectors = 1 limit=64 [ 210.122533][ T8262] Buffer I/O error on dev loop4, logical block 160, lost async page write [ 210.133608][ T8262] syz.4.585: attempt to access beyond end of device [ 210.133608][ T8262] loop4: rw=2049, sector=161, nr_sectors = 1 limit=64 [ 210.148663][ T8262] Buffer I/O error on dev loop4, logical block 161, lost async page write [ 210.157691][ T8262] syz.4.585: attempt to access beyond end of device [ 210.157691][ T8262] loop4: rw=2049, sector=162, nr_sectors = 1 limit=64 [ 210.171119][ T8262] Buffer I/O error on dev loop4, logical block 162, lost async page write [ 210.182613][ T8262] syz.4.585: attempt to access beyond end of device [ 210.182613][ T8262] loop4: rw=2049, sector=163, nr_sectors = 1 limit=64 [ 210.199224][ T8262] Buffer I/O error on dev loop4, logical block 163, lost async page write [ 210.209371][ T8262] syz.4.585: attempt to access beyond end of device [ 210.209371][ T8262] loop4: rw=2049, sector=167, nr_sectors = 1 limit=64 [ 210.225266][ T8262] Buffer I/O error on dev loop4, logical block 167, lost async page write [ 210.242696][ T8262] syz.4.585: attempt to access beyond end of device [ 210.242696][ T8262] loop4: rw=2049, sector=169, nr_sectors = 1 limit=64 [ 210.260434][ T8262] Buffer I/O error on dev loop4, logical block 169, lost async page write [ 210.278673][ T8262] syz.4.585: attempt to access beyond end of device [ 210.278673][ T8262] loop4: rw=2049, sector=171, nr_sectors = 1 limit=64 [ 210.294366][ T8262] Buffer I/O error on dev loop4, logical block 171, lost async page write [ 210.333617][ T8262] syz.4.585: attempt to access beyond end of device [ 210.333617][ T8262] loop4: rw=2049, sector=172, nr_sectors = 1 limit=64 [ 210.349200][ T8262] Buffer I/O error on dev loop4, logical block 172, lost async page write [ 210.363599][ T8262] syz.4.585: attempt to access beyond end of device [ 210.363599][ T8262] loop4: rw=2049, sector=173, nr_sectors = 1 limit=64 [ 210.378484][ T8262] Buffer I/O error on dev loop4, logical block 173, lost async page write [ 210.601754][ T8274] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 210.713506][ T8276] 0: reclassify loop, rule prio 0, protocol 03 [ 210.720606][ T8278] syzkaller0: entered promiscuous mode [ 210.730833][ T8278] syzkaller0: entered allmulticast mode [ 212.447496][ T8297] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 213.104545][ T8306] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 213.761601][ T8311] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 213.769570][ T8311] IPv6: NLM_F_CREATE should be set when creating new route [ 214.164544][ T173] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 214.361025][ T173] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 214.375764][ T173] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 214.385637][ T173] usb 1-1: Product: syz [ 214.390031][ T173] usb 1-1: Manufacturer: syz [ 214.401372][ T173] usb 1-1: SerialNumber: syz [ 214.440632][ T8335] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 214.451347][ T8335] batadv_slave_1: entered promiscuous mode [ 214.630714][ T173] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -32 [ 214.662071][ T173] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -32 [ 215.309789][ T8357] loop2: detected capacity change from 0 to 512 [ 215.336449][ T8357] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 215.374798][ T8357] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 215.394433][ T8357] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 215.413412][ T8357] EXT4-fs error (device loop2): ext4_orphan_get:1430: comm syz.2.609: bad orphan inode 3855 [ 215.430496][ T8357] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 215.749147][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 215.907160][ T8376] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 215.919886][ T8376] batadv_slave_1: entered promiscuous mode [ 216.102806][ T173] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000400. ret = -71 [ 216.136523][ T173] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 216.156455][ T173] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 216.179016][ T173] lan78xx: probe of 1-1:1.0 failed with error -71 [ 216.231770][ T173] usb 1-1: USB disconnect, device number 12 [ 216.474255][ T8381] bridge0: port 2(bridge_slave_1) entered disabled state [ 216.484786][ T8381] bridge0: port 1(bridge_slave_0) entered disabled state [ 216.880481][ T8381] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 216.933109][ T8381] batadv_slave_1: left promiscuous mode [ 217.369658][ T8411] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 217.394827][ T8381] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.404289][ T8381] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.418656][ T8381] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.429120][ T8381] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.444096][ T8381] geneve2: left promiscuous mode [ 217.449112][ T8381] geneve2: left allmulticast mode [ 217.474227][ T8381] bridge1: left promiscuous mode [ 217.487661][ T8388] netlink: 4 bytes leftover after parsing attributes in process `syz.1.622'. [ 217.958853][ T8427] syzkaller0: entered promiscuous mode [ 217.968575][ T8427] syzkaller0: entered allmulticast mode [ 218.150645][ T8429] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 218.895764][ T8436] syzkaller0: entered promiscuous mode [ 218.901588][ T8436] syzkaller0: entered allmulticast mode [ 221.998356][ T8461] loop4: detected capacity change from 0 to 64 [ 222.763045][ T8464] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 222.870753][ T8461] bio_check_eod: 5 callbacks suppressed [ 222.870765][ T8461] syz.4.642: attempt to access beyond end of device [ 222.870765][ T8461] loop4: rw=2049, sector=159, nr_sectors = 1 limit=64 [ 222.890451][ T8461] buffer_io_error: 5 callbacks suppressed [ 222.890463][ T8461] Buffer I/O error on dev loop4, logical block 159, lost async page write [ 222.904874][ T8461] syz.4.642: attempt to access beyond end of device [ 222.904874][ T8461] loop4: rw=2049, sector=160, nr_sectors = 1 limit=64 [ 222.918210][ T8461] Buffer I/O error on dev loop4, logical block 160, lost async page write [ 222.926764][ T8461] syz.4.642: attempt to access beyond end of device [ 222.926764][ T8461] loop4: rw=2049, sector=161, nr_sectors = 1 limit=64 [ 222.940025][ T8461] Buffer I/O error on dev loop4, logical block 161, lost async page write [ 222.948688][ T8461] syz.4.642: attempt to access beyond end of device [ 222.948688][ T8461] loop4: rw=2049, sector=162, nr_sectors = 1 limit=64 [ 222.962056][ T8461] Buffer I/O error on dev loop4, logical block 162, lost async page write [ 222.970635][ T8461] syz.4.642: attempt to access beyond end of device [ 222.970635][ T8461] loop4: rw=2049, sector=163, nr_sectors = 1 limit=64 [ 222.983959][ T8461] Buffer I/O error on dev loop4, logical block 163, lost async page write [ 222.992516][ T8461] syz.4.642: attempt to access beyond end of device [ 222.992516][ T8461] loop4: rw=2049, sector=167, nr_sectors = 1 limit=64 [ 223.005743][ T8461] Buffer I/O error on dev loop4, logical block 167, lost async page write [ 223.014322][ T8461] syz.4.642: attempt to access beyond end of device [ 223.014322][ T8461] loop4: rw=2049, sector=169, nr_sectors = 1 limit=64 [ 223.027565][ T8461] Buffer I/O error on dev loop4, logical block 169, lost async page write [ 223.036157][ T8461] syz.4.642: attempt to access beyond end of device [ 223.036157][ T8461] loop4: rw=2049, sector=171, nr_sectors = 1 limit=64 [ 223.049381][ T8461] Buffer I/O error on dev loop4, logical block 171, lost async page write [ 223.058232][ T8461] syz.4.642: attempt to access beyond end of device [ 223.058232][ T8461] loop4: rw=2049, sector=172, nr_sectors = 1 limit=64 [ 223.071476][ T8461] Buffer I/O error on dev loop4, logical block 172, lost async page write [ 223.080041][ T8461] syz.4.642: attempt to access beyond end of device [ 223.080041][ T8461] loop4: rw=2049, sector=173, nr_sectors = 1 limit=64 [ 223.093261][ T8461] Buffer I/O error on dev loop4, logical block 173, lost async page write [ 223.751696][ T8478] syzkaller0: entered promiscuous mode [ 223.760770][ T8478] syzkaller0: entered allmulticast mode [ 223.788684][ T8478] syzkaller0: tun_net_xmit 14 [ 223.964432][ T8483] binder_alloc: 8482: binder_alloc_buf, no vma [ 225.552049][ T5865] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 225.742274][ T5865] usb 5-1: Using ep0 maxpacket: 8 [ 225.749836][ T5865] usb 5-1: config index 0 descriptor too short (expected 74, got 45) [ 225.767530][ T5865] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 225.800155][ T5865] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 225.811369][ T5865] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 225.823190][ T5865] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 225.833500][ T5865] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 225.847242][ T5865] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 225.856887][ T5865] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.092069][ T5865] usb 5-1: GET_CAPABILITIES returned 0 [ 226.097746][ T5865] usbtmc 5-1:16.0: can't read capabilities [ 226.336455][ T8523] netlink: 'syz.2.661': attribute type 1 has an invalid length. [ 226.376419][ T8523] 8021q: adding VLAN 0 to HW filter on device bond1 [ 226.393801][ T9] usb 5-1: USB disconnect, device number 3 [ 226.425852][ T8526] bond1: (slave syz_tun): making interface the new active one [ 226.449778][ T8526] bond1: (slave syz_tun): Enslaving as an active interface with an up link [ 226.501263][ T8526] syz.2.661 (8526) used greatest stack depth: 20104 bytes left [ 226.610584][ T8530] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 226.794808][ T8537] syzkaller0: entered promiscuous mode [ 226.803464][ T8537] syzkaller0: entered allmulticast mode [ 226.822927][ T8538] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 227.058192][ T8540] loop2: detected capacity change from 0 to 64 [ 227.299482][ T8547] syzkaller0: entered promiscuous mode [ 227.305361][ T8547] syzkaller0: entered allmulticast mode [ 227.540197][ T9] smpboot: CPU 1 is now offline [ 227.733404][ T8550] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 227.803633][ T0] Disabled fast string operations [ 228.607335][ T8561] mac80211_hwsim hwsim9 wlan1: entered allmulticast mode [ 230.973048][ T8567] syzkaller0: entered promiscuous mode [ 230.978603][ T8567] syzkaller0: entered allmulticast mode [ 232.752087][ T8583] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 233.031734][ T8593] overlayfs: failed to clone upperpath [ 233.122882][ T8596] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 234.289328][ T8615] loop4: detected capacity change from 0 to 164 [ 238.003860][ T8628] sched: RT throttling activated [ 238.640991][ T8632] tipc: Started in network mode [ 238.658181][ T8632] tipc: Node identity 0a51465c731e, cluster identity 4711 [ 238.686412][ T8632] tipc: Enabled bearer , priority 0 [ 238.714199][ T8636] syzkaller0: entered promiscuous mode [ 238.742984][ T8636] syzkaller0: entered allmulticast mode [ 238.873152][ T8632] tipc: Resetting bearer [ 238.929499][ T8631] tipc: Resetting bearer [ 239.021444][ T8631] tipc: Disabling bearer [ 239.811335][ T8644] xt_TCPMSS: Only works on TCP SYN packets [ 240.001996][ T9] tipc: Node number set to 2035238492 [ 240.236408][ T8652] syzkaller0: entered promiscuous mode [ 240.262128][ T8652] syzkaller0: entered allmulticast mode [ 246.180601][ T8697] syzkaller0: entered promiscuous mode [ 246.199706][ T8697] syzkaller0: entered allmulticast mode [ 246.633176][ T8721] binder: 8720:8721 ioctl c0306201 200000002580 returned -14 [ 247.189690][ T8733] syzkaller0: entered promiscuous mode [ 247.203126][ T8733] syzkaller0: entered allmulticast mode [ 249.985065][ T8778] vivid-000: ================= START STATUS ================= [ 250.018065][ T8778] vivid-000: Radio HW Seek Mode: Bounded [ 250.043225][ T8778] vivid-000: Radio Programmable HW Seek: false [ 250.067608][ T8778] vivid-000: RDS Rx I/O Mode: Block I/O [ 250.082355][ T8778] vivid-000: Generate RBDS Instead of RDS: [ 250.085130][ T5088] Bluetooth: hci0: unexpected subevent 0x0e length: 32 > 15 [ 250.099717][ T8778] false [ 250.105941][ T8778] vivid-000: RDS Reception: true [ 250.118533][ T8778] vivid-000: RDS Program Type: 0 inactive [ 250.134655][ T8778] vivid-000: RDS PS Name: inactive [ 250.148350][ T8778] vivid-000: RDS Radio Text: inactive [ 250.161124][ T8778] vivid-000: RDS Traffic Announcement: false inactive [ 250.175615][ T8778] vivid-000: RDS Traffic Program: false inactive [ 250.191599][ T8778] vivid-000: RDS Music: false inactive [ 250.204774][ T8778] vivid-000: ================== END STATUS ================== [ 250.291084][ T8785] loop2: detected capacity change from 0 to 64 [ 250.331630][ T8785] bio_check_eod: 20 callbacks suppressed [ 250.331642][ T8785] syz.2.740: attempt to access beyond end of device [ 250.331642][ T8785] loop2: rw=2049, sector=159, nr_sectors = 1 limit=64 [ 250.351476][ T8785] buffer_io_error: 20 callbacks suppressed [ 250.351486][ T8785] Buffer I/O error on dev loop2, logical block 159, lost async page write [ 250.365904][ T8785] syz.2.740: attempt to access beyond end of device [ 250.365904][ T8785] loop2: rw=2049, sector=160, nr_sectors = 1 limit=64 [ 250.379247][ T8785] Buffer I/O error on dev loop2, logical block 160, lost async page write [ 250.387862][ T8785] syz.2.740: attempt to access beyond end of device [ 250.387862][ T8785] loop2: rw=2049, sector=161, nr_sectors = 1 limit=64 [ 250.401193][ T8785] Buffer I/O error on dev loop2, logical block 161, lost async page write [ 250.409764][ T8785] syz.2.740: attempt to access beyond end of device [ 250.409764][ T8785] loop2: rw=2049, sector=162, nr_sectors = 1 limit=64 [ 250.423038][ T8785] Buffer I/O error on dev loop2, logical block 162, lost async page write [ 250.431587][ T8785] syz.2.740: attempt to access beyond end of device [ 250.431587][ T8785] loop2: rw=2049, sector=163, nr_sectors = 1 limit=64 [ 250.444892][ T8785] Buffer I/O error on dev loop2, logical block 163, lost async page write [ 250.453475][ T8785] syz.2.740: attempt to access beyond end of device [ 250.453475][ T8785] loop2: rw=2049, sector=167, nr_sectors = 1 limit=64 [ 250.466749][ T8785] Buffer I/O error on dev loop2, logical block 167, lost async page write [ 250.475343][ T8785] syz.2.740: attempt to access beyond end of device [ 250.475343][ T8785] loop2: rw=2049, sector=169, nr_sectors = 1 limit=64 [ 250.488794][ T8785] Buffer I/O error on dev loop2, logical block 169, lost async page write [ 250.497409][ T8785] syz.2.740: attempt to access beyond end of device [ 250.497409][ T8785] loop2: rw=2049, sector=171, nr_sectors = 1 limit=64 [ 250.510696][ T8785] Buffer I/O error on dev loop2, logical block 171, lost async page write [ 250.519284][ T8785] syz.2.740: attempt to access beyond end of device [ 250.519284][ T8785] loop2: rw=2049, sector=172, nr_sectors = 1 limit=64 [ 250.532531][ T8785] Buffer I/O error on dev loop2, logical block 172, lost async page write [ 250.541080][ T8785] syz.2.740: attempt to access beyond end of device [ 250.541080][ T8785] loop2: rw=2049, sector=173, nr_sectors = 1 limit=64 [ 250.554360][ T8785] Buffer I/O error on dev loop2, logical block 173, lost async page write [ 250.738867][ T8787] syzkaller0: entered promiscuous mode [ 250.754267][ T8787] syzkaller0: entered allmulticast mode [ 250.797753][ T8793] Bluetooth: hci0: invalid length 0, exp 2 for type 11 [ 250.998373][ T8796] netlink: 'syz.2.744': attribute type 13 has an invalid length. [ 251.035816][ T8796] netlink: 8 bytes leftover after parsing attributes in process `syz.2.744'. [ 251.060030][ T8796] bond0: option fail_over_mac: unable to set because the bond device has slaves [ 251.128775][ T8802] bridge0: entered promiscuous mode [ 251.152384][ T8802] vlan2: entered promiscuous mode [ 254.057591][ T8814] Bluetooth: hci0: invalid length 0, exp 2 for type 10 [ 254.092916][ T8815] binder: 8813:8815 ioctl c0306201 0 returned -14 [ 254.260616][ T8817] netlink: 8 bytes leftover after parsing attributes in process `syz.1.753'. [ 254.290246][ T8817] bond0: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 255.984700][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.991075][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.521784][ T8851] netlink: 'syz.0.765': attribute type 1 has an invalid length. [ 256.703741][ T8851] 8021q: adding VLAN 0 to HW filter on device bond2 [ 256.724369][ T8856] bond2: (slave gretap1): making interface the new active one [ 257.031857][ T8856] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 257.078156][ T8856] syz.0.765 (8856) used greatest stack depth: 20056 bytes left [ 259.107092][ T8899] loop6: detected capacity change from 0 to 8 [ 259.162113][ T8899] loop6: detected capacity change from 8 to 7 [ 259.202553][ T8899] Dev loop6: unable to read RDB block 7 [ 259.244679][ T8899] loop6: unable to read partition table [ 259.256221][ T8899] loop6: partition table beyond EOD, truncated [ 259.279716][ T8899] loop_reread_partitions: partition scan of loop6 ([{BѷMܾ`*Z5]z(Ť4+hGpXgm [ 259.279716][ T8899] .BL_se) failed (rc=-5) [ 259.366780][ T5142] Dev loop6: unable to read RDB block 7 [ 259.375747][ T5142] loop6: unable to read partition table [ 259.381653][ T5142] loop6: partition table beyond EOD, truncated [ 262.286396][ T8908] capability: warning: `syz.1.775' uses deprecated v2 capabilities in a way that may be insecure [ 262.560333][ T8913] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 263.612886][ T8928] netlink: 12 bytes leftover after parsing attributes in process `syz.1.786'. [ 264.532303][ T8939] syzkaller0: entered promiscuous mode [ 264.556438][ T8939] syzkaller0: entered allmulticast mode [ 264.592980][ T8939] 0: reclassify loop, rule prio 0, protocol 700 [ 265.772621][ T8947] comedi comedi2: board detection failed [ 267.249329][ T8955] netlink: 4 bytes leftover after parsing attributes in process `syz.4.798'. [ 267.712161][ T8955] hsr_slave_1 (unregistering): left promiscuous mode [ 267.830578][ T8960] tipc: Started in network mode [ 267.880109][ T8960] tipc: Node identity d2795bd588ef, cluster identity 4711 [ 267.919820][ T8960] tipc: Enabled bearer , priority 0 [ 267.962322][ T8961] syzkaller0: entered promiscuous mode [ 267.970747][ T8961] syzkaller0: entered allmulticast mode [ 268.011352][ T8959] tipc: Resetting bearer [ 268.069589][ T8957] tipc: Resetting bearer [ 268.135529][ T8957] tipc: Disabling bearer [ 268.147699][ T8974] loop4: detected capacity change from 0 to 64 [ 268.179932][ T8974] bio_check_eod: 5 callbacks suppressed [ 268.179943][ T8974] syz.4.800: attempt to access beyond end of device [ 268.179943][ T8974] loop4: rw=2049, sector=159, nr_sectors = 1 limit=64 [ 268.198879][ T8974] buffer_io_error: 5 callbacks suppressed [ 268.198889][ T8974] Buffer I/O error on dev loop4, logical block 159, lost async page write [ 268.213222][ T8974] syz.4.800: attempt to access beyond end of device [ 268.213222][ T8974] loop4: rw=2049, sector=160, nr_sectors = 1 limit=64 [ 268.226548][ T8974] Buffer I/O error on dev loop4, logical block 160, lost async page write [ 268.235117][ T8974] syz.4.800: attempt to access beyond end of device [ 268.235117][ T8974] loop4: rw=2049, sector=161, nr_sectors = 1 limit=64 [ 268.248365][ T8974] Buffer I/O error on dev loop4, logical block 161, lost async page write [ 268.257024][ T8974] syz.4.800: attempt to access beyond end of device [ 268.257024][ T8974] loop4: rw=2049, sector=162, nr_sectors = 1 limit=64 [ 268.270291][ T8974] Buffer I/O error on dev loop4, logical block 162, lost async page write [ 268.278866][ T8974] syz.4.800: attempt to access beyond end of device [ 268.278866][ T8974] loop4: rw=2049, sector=163, nr_sectors = 1 limit=64 [ 268.292121][ T8974] Buffer I/O error on dev loop4, logical block 163, lost async page write [ 268.300671][ T8974] syz.4.800: attempt to access beyond end of device [ 268.300671][ T8974] loop4: rw=2049, sector=167, nr_sectors = 1 limit=64 [ 268.313906][ T8974] Buffer I/O error on dev loop4, logical block 167, lost async page write [ 268.322538][ T8974] syz.4.800: attempt to access beyond end of device [ 268.322538][ T8974] loop4: rw=2049, sector=169, nr_sectors = 1 limit=64 [ 268.335797][ T8974] Buffer I/O error on dev loop4, logical block 169, lost async page write [ 268.344354][ T8974] syz.4.800: attempt to access beyond end of device [ 268.344354][ T8974] loop4: rw=2049, sector=171, nr_sectors = 1 limit=64 [ 268.357686][ T8974] Buffer I/O error on dev loop4, logical block 171, lost async page write [ 268.366353][ T8974] syz.4.800: attempt to access beyond end of device [ 268.366353][ T8974] loop4: rw=2049, sector=172, nr_sectors = 1 limit=64 [ 268.379632][ T8974] Buffer I/O error on dev loop4, logical block 172, lost async page write [ 268.388376][ T8974] syz.4.800: attempt to access beyond end of device [ 268.388376][ T8974] loop4: rw=2049, sector=173, nr_sectors = 1 limit=64 [ 268.401625][ T8974] Buffer I/O error on dev loop4, logical block 173, lost async page write [ 268.459109][ T8977] tipc: Enabling of bearer rejected, failed to enable media [ 268.479093][ T8969] netlink: 8 bytes leftover after parsing attributes in process `syz.2.796'. [ 268.619592][ T8978] syzkaller1: entered promiscuous mode [ 268.629461][ T8978] syzkaller1: entered allmulticast mode [ 270.310589][ T9009] tc action pedit unable to extract header offset for header type (0x4) [ 270.319452][ T9009] tc action pedit unable to extract header offset for header type (0x4) [ 270.327863][ T9009] tc action pedit unable to extract header offset for header type (0x4) [ 270.336272][ T9009] tc action pedit unable to extract header offset for header type (0x4) [ 270.344619][ T9009] tc action pedit unable to extract header offset for header type (0x4) [ 270.352959][ T9009] tc action pedit unable to extract header offset for header type (0x4) [ 270.361409][ T9009] tc action pedit unable to extract header offset for header type (0x4) [ 270.369797][ T9009] tc action pedit unable to extract header offset for header type (0x4) [ 270.378146][ T9009] tc action pedit unable to extract header offset for header type (0x4) [ 270.386521][ T9009] tc action pedit unable to extract header offset for header type (0x4) [ 270.394889][ T9009] 0: reclassify loop, rule prio 0, protocol 800 [ 271.733538][ T9014] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 271.898769][ T9018] syz_tun: entered promiscuous mode [ 271.918697][ T9018] vlan2: entered promiscuous mode [ 273.739975][ T9030] loop4: detected capacity change from 0 to 256 [ 273.804913][ T9034] loop2: detected capacity change from 0 to 64 [ 273.846656][ T9030] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 273.875189][ T9034] bio_check_eod: 5 callbacks suppressed [ 273.875200][ T9034] syz.2.817: attempt to access beyond end of device [ 273.875200][ T9034] loop2: rw=2049, sector=159, nr_sectors = 1 limit=64 [ 273.894140][ T9034] buffer_io_error: 5 callbacks suppressed [ 273.894149][ T9034] Buffer I/O error on dev loop2, logical block 159, lost async page write [ 273.908432][ T9034] syz.2.817: attempt to access beyond end of device [ 273.908432][ T9034] loop2: rw=2049, sector=160, nr_sectors = 1 limit=64 [ 273.922022][ T9034] Buffer I/O error on dev loop2, logical block 160, lost async page write [ 273.930548][ T9034] syz.2.817: attempt to access beyond end of device [ 273.930548][ T9034] loop2: rw=2049, sector=161, nr_sectors = 1 limit=64 [ 273.943826][ T9034] Buffer I/O error on dev loop2, logical block 161, lost async page write [ 273.952405][ T9034] syz.2.817: attempt to access beyond end of device [ 273.952405][ T9034] loop2: rw=2049, sector=162, nr_sectors = 1 limit=64 [ 273.965716][ T9034] Buffer I/O error on dev loop2, logical block 162, lost async page write [ 273.974276][ T9034] syz.2.817: attempt to access beyond end of device [ 273.974276][ T9034] loop2: rw=2049, sector=163, nr_sectors = 1 limit=64 [ 273.987636][ T9034] Buffer I/O error on dev loop2, logical block 163, lost async page write [ 273.996197][ T9034] syz.2.817: attempt to access beyond end of device [ 273.996197][ T9034] loop2: rw=2049, sector=167, nr_sectors = 1 limit=64 [ 274.009428][ T9034] Buffer I/O error on dev loop2, logical block 167, lost async page write [ 274.018046][ T9034] syz.2.817: attempt to access beyond end of device [ 274.018046][ T9034] loop2: rw=2049, sector=169, nr_sectors = 1 limit=64 [ 274.031309][ T9034] Buffer I/O error on dev loop2, logical block 169, lost async page write [ 274.039920][ T9034] syz.2.817: attempt to access beyond end of device [ 274.039920][ T9034] loop2: rw=2049, sector=171, nr_sectors = 1 limit=64 [ 274.053152][ T9034] Buffer I/O error on dev loop2, logical block 171, lost async page write [ 274.061710][ T9034] syz.2.817: attempt to access beyond end of device [ 274.061710][ T9034] loop2: rw=2049, sector=172, nr_sectors = 1 limit=64 [ 274.075065][ T9034] Buffer I/O error on dev loop2, logical block 172, lost async page write [ 274.083614][ T9034] syz.2.817: attempt to access beyond end of device [ 274.083614][ T9034] loop2: rw=2049, sector=173, nr_sectors = 1 limit=64 [ 274.096883][ T9034] Buffer I/O error on dev loop2, logical block 173, lost async page write [ 274.203873][ T28] audit: type=1800 audit(1785869589.742:7): pid=9030 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.807" name="file1" dev="loop4" ino=1048599 res=0 errno=0 [ 275.663170][ T9042] 8021q: adding VLAN 0 to HW filter on device bond0 [ 275.671163][ T9042] 8021q: adding VLAN 0 to HW filter on device team0 [ 275.801380][ T9042] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 281.424086][ T9076] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 281.633409][ T9084] syzkaller0: entered promiscuous mode [ 281.649673][ T9084] syzkaller0: entered allmulticast mode [ 281.670047][ T9084] tipc: Enabled bearer , priority 0 [ 281.698102][ T9084] tipc: Resetting bearer [ 281.731551][ T9083] tipc: Resetting bearer [ 281.792484][ T9083] tipc: Disabling bearer [ 284.347349][ T9104] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 289.589925][ T9129] overlayfs: failed to clone upperpath [ 290.073398][ T9138] syzkaller0: entered promiscuous mode [ 290.081990][ T9138] syzkaller0: entered allmulticast mode [ 290.352531][ T9138] tipc: Enabled bearer , priority 0 [ 290.401448][ T9138] tipc: Resetting bearer [ 290.423783][ T9137] tipc: Resetting bearer [ 290.468165][ T9137] tipc: Disabling bearer [ 291.277605][ T9171] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 292.094857][ T9173] overlayfs: failed to clone lowerpath [ 293.642785][ T9190] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 294.383480][ T9198] bridge2: entered promiscuous mode [ 294.408489][ T9198] bridge2: entered allmulticast mode [ 294.470259][ T9198] team0: Port device bridge2 added [ 294.564721][ T9204] bridge0: port 3(team0) entered blocking state [ 294.633804][ T9204] bridge0: port 3(team0) entered disabled state [ 294.668293][ T9204] team0: entered allmulticast mode [ 294.700691][ T9204] team_slave_0: entered allmulticast mode [ 294.733422][ T9204] team_slave_1: entered allmulticast mode [ 294.791013][ T9204] team0: entered promiscuous mode [ 294.818279][ T9204] team_slave_0: entered promiscuous mode [ 294.839807][ T9204] team_slave_1: entered promiscuous mode [ 294.916296][ T9205] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 296.512856][ T9220] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 296.519692][ T9220] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 296.806533][ T9220] vhci_hcd vhci_hcd.0: Device attached [ 296.832801][ T9222] vhci_hcd: connection closed [ 296.837277][ T12] vhci_hcd: stop threads [ 296.853988][ T12] vhci_hcd: release socket [ 296.859012][ T12] vhci_hcd: disconnect device [ 297.892121][ T9231] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 297.920228][ T9231] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 299.630733][ T9238] loop2: detected capacity change from 0 to 64 [ 300.897905][ T9237] bio_check_eod: 5 callbacks suppressed [ 300.897918][ T9237] syz.2.873: attempt to access beyond end of device [ 300.897918][ T9237] loop2: rw=2049, sector=159, nr_sectors = 1 limit=64 [ 300.917088][ T9237] buffer_io_error: 5 callbacks suppressed [ 300.917098][ T9237] Buffer I/O error on dev loop2, logical block 159, lost async page write [ 300.931407][ T9237] syz.2.873: attempt to access beyond end of device [ 300.931407][ T9237] loop2: rw=2049, sector=160, nr_sectors = 1 limit=64 [ 300.944830][ T9237] Buffer I/O error on dev loop2, logical block 160, lost async page write [ 300.953405][ T9237] syz.2.873: attempt to access beyond end of device [ 300.953405][ T9237] loop2: rw=2049, sector=161, nr_sectors = 1 limit=64 [ 300.966645][ T9237] Buffer I/O error on dev loop2, logical block 161, lost async page write [ 300.975214][ T9237] syz.2.873: attempt to access beyond end of device [ 300.975214][ T9237] loop2: rw=2049, sector=162, nr_sectors = 1 limit=64 [ 300.988513][ T9237] Buffer I/O error on dev loop2, logical block 162, lost async page write [ 300.997074][ T9237] syz.2.873: attempt to access beyond end of device [ 300.997074][ T9237] loop2: rw=2049, sector=163, nr_sectors = 1 limit=64 [ 301.010317][ T9237] Buffer I/O error on dev loop2, logical block 163, lost async page write [ 301.018989][ T9237] syz.2.873: attempt to access beyond end of device [ 301.018989][ T9237] loop2: rw=2049, sector=167, nr_sectors = 1 limit=64 [ 301.032224][ T9237] Buffer I/O error on dev loop2, logical block 167, lost async page write [ 301.040749][ T9237] syz.2.873: attempt to access beyond end of device [ 301.040749][ T9237] loop2: rw=2049, sector=169, nr_sectors = 1 limit=64 [ 301.054009][ T9237] Buffer I/O error on dev loop2, logical block 169, lost async page write [ 301.062591][ T9237] syz.2.873: attempt to access beyond end of device [ 301.062591][ T9237] loop2: rw=2049, sector=171, nr_sectors = 1 limit=64 [ 301.075863][ T9237] Buffer I/O error on dev loop2, logical block 171, lost async page write [ 301.084466][ T9237] syz.2.873: attempt to access beyond end of device [ 301.084466][ T9237] loop2: rw=2049, sector=172, nr_sectors = 1 limit=64 [ 301.097708][ T9237] Buffer I/O error on dev loop2, logical block 172, lost async page write [ 301.106310][ T9237] syz.2.873: attempt to access beyond end of device [ 301.106310][ T9237] loop2: rw=2049, sector=173, nr_sectors = 1 limit=64 [ 301.119576][ T9237] Buffer I/O error on dev loop2, logical block 173, lost async page write [ 304.745936][ T9249] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 305.047318][ T9257] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 309.714270][ T9281] macsec0: entered promiscuous mode [ 314.062863][ T9301] fuse: Bad value for 'fd' [ 314.325892][ T9304] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 314.806391][ T9313] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 316.871460][ T5787] Bluetooth: hci2: command tx timeout [ 317.225978][ T9329] netlink: 'syz.0.889': attribute type 2 has an invalid length. [ 317.429168][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.435753][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 324.300462][ T9346] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 328.258988][ T9358] netlink: 'syz.4.911': attribute type 1 has an invalid length. [ 328.267220][ T9358] netlink: 'syz.4.911': attribute type 2 has an invalid length. [ 330.225219][ T5088] Bluetooth: hci2: command 0x0406 tx timeout [ 334.695546][ T9393] vlan2: entered allmulticast mode [ 334.700720][ T9393] veth0_vlan: entered allmulticast mode [ 335.013129][ T9392] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 338.649138][ T9407] bio_check_eod: 5 callbacks suppressed [ 338.649150][ T9407] syz.2.923: attempt to access beyond end of device [ 338.649150][ T9407] nbd2: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 340.142532][ T5787] Bluetooth: hci2: command 0x0406 tx timeout [ 340.275024][ T9428] dummy_hcd dummy_hcd.0: remove, state 4 [ 340.281434][ T9428] usb usb1: USB disconnect, device number 1 [ 340.504168][ T9428] dummy_hcd dummy_hcd.0: stopped [ 340.509181][ T9428] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 340.614596][ T9432] loop2: detected capacity change from 0 to 512 [ 340.854889][ T9432] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.929: invalid indirect mapped block 256 (level 2) [ 340.907788][ T9432] EXT4-fs (loop2): 2 truncates cleaned up [ 340.927005][ T9432] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 342.143415][ T9432] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 342.288605][ T9439] netlink: 28 bytes leftover after parsing attributes in process `syz.4.930'. [ 344.107008][ T9452] bridge0: port 4(hsr_slave_1) entered blocking state [ 344.113943][ T9452] bridge0: port 4(hsr_slave_1) entered disabled state [ 344.120827][ T9452] hsr_slave_1: entered allmulticast mode [ 344.127712][ T9452] hsr_slave_1: left allmulticast mode [ 344.349399][ T5088] Bluetooth: hci2: unexpected event for opcode 0x2041 [ 344.385829][ T9456] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 344.397573][ T9456] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 344.405969][ T9456] CPU: 0 PID: 9456 Comm: syz.4.937 Tainted: G S syzkaller #0 [ 344.414714][ T9456] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 344.424758][ T9456] RIP: 0010:dummy_set_selfpowered+0xbb/0x150 [ 344.430731][ T9456] Code: 94 c0 4d 8d b4 c6 80 06 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 df 8d 25 fb 4d 8b 3e 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 c6 8d 25 fb 41 be 78 12 00 00 4d [ 344.450328][ T9456] RSP: 0018:ffffc900104cf7e0 EFLAGS: 00010246 [ 344.456388][ T9456] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000002 [ 344.464358][ T9456] RDX: ffff8880276a9e00 RSI: 0000000000000003 RDI: 0000000000000005 [ 344.472321][ T9456] RBP: 0000000000000003 R08: ffff888019e458df R09: 1ffff110033c8b1b [ 344.480295][ T9456] R10: dffffc0000000000 R11: ffffed10033c8b1c R12: dffffc0000000000 [ 344.488254][ T9456] R13: ffff88803058e530 R14: ffff888141f5d280 R15: 0000000000000000 [ 344.496209][ T9456] FS: 00007fd6cf6026c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 344.505122][ T9456] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 344.511687][ T9456] CR2: 000000110c412d9a CR3: 000000003012b000 CR4: 00000000003506f0 [ 344.519646][ T9456] Call Trace: [ 344.522921][ T9456] [ 344.525852][ T9456] ? dummy_wakeup+0x270/0x270 [ 344.530521][ T9456] usb_gadget_set_selfpowered+0x6e/0x230 [ 344.536143][ T9456] composite_dev_prepare+0x2fa/0x320 [ 344.541416][ T9456] configfs_composite_bind+0xa1/0x13f0 [ 344.546889][ T9456] ? kernfs_put+0x309/0x360 [ 344.551385][ T9456] ? webusb_landingPage_store+0x1c0/0x1c0 [ 344.557090][ T9456] gadget_bind_driver+0x2b3/0x770 [ 344.562115][ T9456] ? gadget_match_driver+0x130/0x130 [ 344.567407][ T9456] really_probe+0x247/0xae0 [ 344.571901][ T9456] ? pm_runtime_barrier+0x14b/0x1c0 [ 344.577100][ T9456] __driver_probe_device+0x1f5/0x390 [ 344.582399][ T9456] driver_probe_device+0x4f/0x420 [ 344.587450][ T9456] __driver_attach+0x444/0x6d0 [ 344.592211][ T9456] bus_for_each_dev+0x235/0x2b0 [ 344.597061][ T9456] ? driver_attach+0x50/0x50 [ 344.601637][ T9456] ? bus_remove_file+0x140/0x140 [ 344.606567][ T9456] ? do_raw_spin_unlock+0x121/0x230 [ 344.611752][ T9456] bus_add_driver+0x340/0x630 [ 344.616415][ T9456] driver_register+0x23a/0x310 [ 344.621162][ T9456] usb_gadget_register_driver_owner+0xf9/0x270 [ 344.627308][ T9456] gadget_dev_desc_UDC_store+0x1c7/0x2e0 [ 344.632931][ T9456] configfs_write_iter+0x312/0x400 [ 344.638026][ T9456] ? gadget_dev_desc_UDC_show+0x80/0x80 [ 344.643555][ T9456] vfs_write+0x474/0x9a0 [ 344.647789][ T9456] ? file_end_write+0x250/0x250 [ 344.652625][ T9456] ? __fget_files+0x3fc/0x460 [ 344.657288][ T9456] ? __fdget_pos+0x2a3/0x330 [ 344.661857][ T9456] ? ksys_write+0x74/0x260 [ 344.666278][ T9456] ksys_write+0x151/0x260 [ 344.670590][ T9456] ? __ia32_sys_read+0x90/0x90 [ 344.675356][ T9456] ? lockdep_hardirqs_on+0x98/0x150 [ 344.680569][ T9456] do_syscall_64+0x55/0xb0 [ 344.684984][ T9456] ? clear_bhb_loop+0x40/0x90 [ 344.689642][ T9456] ? clear_bhb_loop+0x40/0x90 [ 344.694306][ T9456] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 344.700182][ T9456] RIP: 0033:0x7fd6ce79e019 [ 344.704600][ T9456] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 344.724191][ T9456] RSP: 002b:00007fd6cf602028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 344.732589][ T9456] RAX: ffffffffffffffda RBX: 00007fd6cea25fa0 RCX: 00007fd6ce79e019 [ 344.740540][ T9456] RDX: 000000000000000c RSI: 00002000000003c0 RDI: 0000000000000007 [ 344.748502][ T9456] RBP: 00007fd6ce83500c R08: 0000000000000000 R09: 0000000000000000 [ 344.756459][ T9456] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 344.764434][ T9456] R13: 00007fd6cea26038 R14: 00007fd6cea25fa0 R15: 00007ffc5071e618 [ 344.772396][ T9456] [ 344.775398][ T9456] Modules linked in: [ 345.995758][ T9461] netlink: 60 bytes leftover after parsing attributes in process `syz.0.928'. [ 346.272375][ T9456] ---[ end trace 0000000000000000 ]--- [ 346.277889][ T9456] RIP: 0010:dummy_set_selfpowered+0xbb/0x150 [ 346.302270][ T9456] Code: 94 c0 4d 8d b4 c6 80 06 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 df 8d 25 fb 4d 8b 3e 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 c6 8d 25 fb 41 be 78 12 00 00 4d [ 346.328944][ T9456] RSP: 0018:ffffc900104cf7e0 EFLAGS: 00010246 [ 346.335160][ T9456] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000002 [ 346.343518][ T9456] RDX: ffff8880276a9e00 RSI: 0000000000000003 RDI: 0000000000000005 [ 346.351532][ T9456] RBP: 0000000000000003 R08: ffff888019e458df R09: 1ffff110033c8b1b [ 346.360390][ T9456] R10: dffffc0000000000 R11: ffffed10033c8b1c R12: dffffc0000000000 [ 346.368477][ T9456] R13: ffff88803058e530 R14: ffff888141f5d280 R15: 0000000000000000 [ 346.376557][ T9456] FS: 00007fd6cf6026c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 346.385568][ T9456] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 346.392273][ T9456] CR2: 00007fd6ce7eb700 CR3: 000000003012b000 CR4: 00000000003506f0 [ 346.400295][ T9456] Kernel panic - not syncing: Fatal exception [ 346.406602][ T9456] Kernel Offset: disabled [ 346.410916][ T9456] Rebooting in 86400 seconds..