last executing test programs: 3m9.136917533s ago: executing program 2 (id=34): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000080)={@multicast2, @local, @local}, 0xc) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000000ac1414aa00000000000000001400020002000000e000000200000000000004000d0001007564703a73"], 0x54}}, 0x0) 3m8.802276301s ago: executing program 2 (id=36): setns(0xc9, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f000000b500), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_KEY(r3, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000200)={0x24, r0, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_KEY_IDX={0x5}]}, 0x24}}, 0x880) 3m8.548189437s ago: executing program 2 (id=37): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xa, 0x5, 0x2, 0x7, 0x0, 0x1, 0x10000}, 0x50) close(r0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x5, 0x5, 0x9fd, 0x1, 0x41}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r1}, &(0x7f0000000300), &(0x7f0000000340)}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xd, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffff7}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000580)={r2, r0}, 0xc) 3m8.237993865s ago: executing program 2 (id=40): syz_mount_image$exfat(&(0x7f0000000600), &(0x7f0000000640)='./file0\x00', 0x0, &(0x7f0000000680)={[{@utf8}, {@utf8}, {@keep_last_dots}, {@fmask={'fmask', 0x3d, 0x2}}, {@utf8}, {@gid}, {@iocharset={'iocharset', 0x3d, 'cp1251'}}, {@namecase}, {@time_offset={'time_offset', 0x3d, 0x5}}, {@utf8}, {@utf8}, {@dmask={'dmask', 0x3d, 0x9}}]}, 0xff, 0x1535, &(0x7f0000000740)="$eJzs3AucjdX6OPDnWWu9Y0jaTXIZ1lrPy04uiyTJJUkuSZIkSW4JSZIjCYkht6QhCcllSC5DSC4Tk8b9fr8kJEmTJCG5Jev/mZi/OnX+55xfnfz+Z57v57M/s55Z+1nvs+aZvfe739l802VojUY1qzYgIvhD8OKXBACIBYCBAHANAAQAUDaubFzGfHaJCX/sIOzP9VDyla6AXUnc/6yN+5+1cf+zNu5/1sb9z9q4/1kb9z9r4/4zlpVtnp7/Wr5l3Rtf/8/K+PX/v0h6ybFfrC15fVeAmH81hfv//z/8A7nc//9awb9yJ+5/1sb9z6pir3QB7H8BfvxnBdn+4Qz3P2vj/jOWlf3yWnAsXPnr0X/1DSL/yb+B+F4Xf8pXfp//cP+MMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxthf4Iy/TAFA5vhK18UYY4wxxhhjjLE/j892pStgjDHGGGOMMcbYfx6CAAkKAoiBbBAL2SEHCICYzPlrIQ6ug9xwPeSBvJAP8kM8FICCoMGABYIQCkFhiMINUARuhKJQDIpDCXBQEkrBTVAaboYycAuUhVuhHNwG5aECVIRKcDtUhjugCtwJVeEuqAbVoQbUhLuhFtwDteFeqAP3QV24H+rBA1AfHoQG8BA0hIehETwCjeFRaAJNoRk0hxb/o/wXoAe8CD2hFyRAb+gDL0Ff6Af9YQAMhJdhELwCg+FVSIQhMBReg2HwOgyHN2AEjIRR8CaMhrdgDIyFcTAekmACTIS3YRK8A5NhCkyFaZAM02EGvAszYRbMhvdgDrwPc2EezIcFkAIfwEJYBKnwISyGjyANlsBSWAbLYQWshFWwGtbAWlgH62EDbIRNsBm2wFbYBtthB+yEj2EXfAK7YQ/shU9hH3z2b+af/rv8rggIKFCgQoUxGIOxGIs5MAfmxJyYC3NhBCMYh3GYG3NjHsyD+TAfxmM8FsSCaNAgIWEhLIRRjGIRLIJFsSgWx+Lo0GEpLIWl8WYsg2WwLJbFclgOy2MFrICVsBJWxspYBatgVayK1bAa1sAaeDfejb2xNtbGOlgH62LdzMtT2AAbYENsiI2wETbGxtgEm2AzbIYtsAW2xJbYClthG2yDbbEttsN22B7bYwfsgB2xI3bCTtgZO2MX7IJdsRt2S38hG+CL+CL2wmqiN/bBPtgXE7P1xwE4AF/GQfgKvoKvYiIOwaH4Gr6Gr+NwPIUjLozEUTgKK4u3cAyORRLjMQmTcCJOxEk4CSfjFJyC0zAZp+MMnIEzcRbOwvdwDr6P7+M8nIcLMAVTcCEuwlRMxcV4GtNwCS7FZbgcV+ByXIWrcRWuxXW4FjfgBtyEm3ALbsFtuA134A78GBUAfoJ7cA8m4j7ch/txPx7AA3gQD2I6puMhPISH8TAewSN4FI/iMTyOJ/A4nsSTeApP4xk8g+fwHJ7H5+K/avhxsTWJIDIooUSMiBGxIlbkEDlETpFT5BK5RERERJyIE7lFbpFH5BH5RD4RL+JFQVFQGGEEiTDjmUJERVQUEUVEUVFUFBfFhRNOlBKlRGlRWpQRZURZcasoJ24T5UUF0dpVEpVEZdHGVRF3iqqiqqgmqosaoqaoKWqJWqK2qC3qiDqirqgr6okHRH3RG/vjQyKjM43EEGwshmIT0VTIS89QLcVwbCVaizbiCTESR2A70dK1F0+LDmIMdhR/E2PxWdFZjMcu4nnRVXQT3cULoodo5XqKXmIy9hZ9xDTsK/qJ/mKAmInVxXs4J3sN8apIFEPEUPGaWICvi+HiKjFCjBSjxJtitHhLjBFjxTgxXiSJCWKieFtMEu+IyWKKmCqmiWQxXcwQ74qZYpaYLd4Tc8T7Yq6YJ+aLBSJFfCAWikUiVXwoFouPRJpYIpaKZWK5WCFWilVitVgj1op1Yr3YIDaKTWKz2CK2im1iu9ghdoqPxS7xidgt9oi94lOxT3wm9ovPxQHxhTgovhTp4itxSHwtDotvxBHxrTgqvhPHxHFxQnwvToofxClxWpwRZ8U58aM4L34SF4QXIFEKKaWSgYyR2WSszC5zyKtkThlkPv/LOHmdzC2vl3lkXplP5pfxsoAsKLU00kqSoSwkC8uovEEWkTfKorKYLC5LSCdLylLyJlla3izLyFtkWXmrLCdvk+VlBVlRVpK3y8ryDgmRi8eoJqvLGrKmvFsmwD2ytrxX1pH3ybryfllPPiDrywdlA/mQbCgflo3kI7KxfFQ2kU1lM9lctpCPyZbycdlKtpZt5BOyrXxStpNPyfbyadlB+ku/Is/KzvI52UU+L7vKbrK7/ElekF72lL0k9AbZR74k+8p+sr8cIAfKl+Ug+YocLF+ViXKIHCpfk8Pk63K4fEOOkCPlKPmmHC3fkmPkWDlOjpdJcoKcKN+Wk+Q7crKcIqfKaTJZTpf9L600W8p/mv/27+QP/vnom+RmuUVuldvkdrlD7pQfy11yl9wtd8u9cq/cJ/fJ/XK/PCAPyIPyoEyX6fKQPCQPy8PyiDwij8qj8pg8Ls/K7+VJ+YM8JU/L0/KsPCfPyfOXfgagUAkllVKBilHZVKzKrnKoq1ROdbXKpa5REXWtilPXqdzqepVH5VX5VH4Vrwqogkoro6wiFapCqrCKqhvw0i+MKq5KKKdKqlLqpn8nXxVRN6qiqtiv8jPrS/gH9bVQLVRL1VK1Uq1UG9VGtVVtVTvVTrVX7VUH1UF1VB1VJ9VJdVadVRfVRXVVXVV31V31UD1UT9VTJagE1Ue9pPqqfqq/GqAGqpdFxh4Gq8EqUSWqoWqoGqaGqeFquBqhRqhRapQarUarMWqMGqfGqSSVpCaqiWqSmqQmq8lqqpqqklWymqFmqJlqppqtZqs5ao6aq+aq+Wq+SlEpaqFaqFJVqlqsFqs0tUQtUcvUMrVCrVCr1Cq1Rq1R69Q6tUFtUGlqs9qstqqtarvarnaqnWqX2qV2q91qr9qr9ql9ar/arw6oA+qgOqjSVbo6pA6pw+qwOqKOqKPqqDqmjqkT6oQ6qU6qU+qUOqPOqHPqnDqvzqsL6kLGaV8gAhGoQAUxQUwQG8QGOYIcQc4gZ5AryBVEgkgQF8QFuYPrgzxB3iBfkD+IDwoEBQMdmMAG4lLTo8ENQZHgxqBoUCwoHpQIXFAyKBXcFJQObg7KBLcEZYNbg3LBbUH5oEJQMagU3B5UDu4IqgR3BlWDu4JqQfWgRlAzuDuoFdwT1A7uDeoE9wV1g/uDesEDQf3gwaBB8FDQMHg4aBQ8EjQOHg2aBE2DZkHzoMWfur73p/I+7nrqXjpB99Z99Eu6r+6n++sBeqB+WQ/Sr+jB+lWdqIfoofo1PUy/rofrN/QIPVKP0m/q0fotPUaP1eP0eJ2kJ+iJ+m09Sb+jJ+speqqeppP1dD1Dv6tn6ll6tn5Pz9Hv67l6np6vF+gU/YFeqBfpVP2hXqw/0ml6iV6ql+nleoVeqVfp1XqNXqvX6fV6g96oN+nNeoveqrfp7XqH3qk/1rv0J3q33qP36k/1Pv2Z3q8/1wf0F/qg/lKn66/0If21Pqy/0Uf0t/qo/k4f08d1Gf29Pql/0Kf0aX1Gn9Xn9I/6vP5JX9A+4+Q+4+XdKKNMjIkxsSbW5DA5TE6T0+QyuUzEREyciTO5TW6Tx+Qx+Uw+E2/iTUFT0GQgQ6aQKWSiJmqKmCKmqClqipvixhlnSplSprQpbcqYMqasKWvKmXKmvClvKpqK5nZzu7nD3GHuNHeau8xdprqpbmqamqaWqWVqm9qmjqlj6pq6pp6pZ+qb+qaBaWAamoamkWlkGpvGpolpYpqZZqaFaWFampamlWll2pg2pq1pa9qZdqa9aW86mA6mo+loOplOprPpbLqYLqar6Wq6m+6mh+lhepqeJsEkmD6mj+lr+pr+pr8ZaAaaQWaQGWwGm0STaIaaoWaYGWaGm+FmhBlpRmWcqJq3zBgz1owz402SSTITzUQzyUwyk81kM9VMNckm2cwwM8xMM9PMNrPNHDPHzDVzzXwz36SYFLPQLDSpJtUsNotNmkkzS81Ss9wsNyvNSrParDZrzVqzHtabjWaj2Ww2m61mq9lutpudZqfZZXaZ3Wa32Wv2mn1mn9lv9psD5oA5aA6adJNuDplD5rA5bI6YI+aoOWqOmWPmhDlhTpqT5pQ5Zc6YM+acyXvp9dKbWJvd5rBX2Zz2apvLXmP/Ps5n89t4W8AWtNrmsXl/FRtrbVFbzBa3JayzJW0pe9Nv4vK2gq1oK9nbbWV7h63ym7iWvcfWtvfaOvY+W9Pe/au4rr3f1rOP2PqIALapbWib20b2EdvYPmqb2Ka2mW1u29onbTv7lG1vn7Yd7DO/iRfaRXa1XWPX2nV2t91jz9iz9rD9xp6zP9qetpcdaF+2g+wrdrB91SbaIb+JR9k37Wj7lh1jx9pxdvxv4ql2mk220+0M+66daWf9Jk6xH9g5NtXOtfPsfLvg5zijplT7oV1sP7JpNoCldpldblfYlXbV/611md1gN9pNdpf9xG612+x2u8PuzDwRtnvsXvup3Wc/s4fs1/aA/cIetEdsuv3q5zhjf0fst/ao/c4es8ftCfu9PWl/UJnZGXv/3v5kL1hvgZCAJCkKKIayUSxlpxx0FeWkqykXXUMRupbi6DrKTddTHspL+Sg/xVMBKkiaDFkiCqkQFaYo3UCZ5RWnEuSoJJWim6g03Uxl6BYqS7dSObqNylMFqkiV6HaqTHdQFbqTqtJdVI2qUw2qSXdTLbqHatO9VIfuo7p0P9WjB6g+PUgN6CFqSA9TI3qEGtOj1ISaUjNqTi3oMWpJj1Mrak1t6AlqS09SO3qK2tPT1IGeoY70N+pEz1Jneo660PPUlbpRd3qBetCL1JN6UQL1pj70EvWlftSfBtBAepkG0Ss0mF6lRBpCQ+k1Gkav03B6g0bQSBpFb9JoeovG0FgaR+MpiSbQRHqbJtE7NJmm0FSaRsk0nWbQuzSTZtFseo/m0Ps0l+bRfFpAKfQBLaRFlEof0mL6iNJoCS2lZbScVtBKWkWraQ2tpXW0njbQRtpEm2kLbaVttJ120E76mHbRJ7Sb9tBe+pT20We0nz6nA/QFHaQvKZ2+okP0NR2mb+gIfet70Xd0jI7TCfqeTtIPdIpO0xk6S+foRzpPP9EF8gQhhiKUoQqDMCbMFsaG2cMc4VVhzvDqMFd4TRgJrw3jwuvC3OH1YZ4wb5gvzB/GhwXCgqEOTWhDCsOwUFg4jIY3hEXCG8OiYbGweFgidGHJsFR4U1g6vDksE94Slg1vDcuFt4XlwwrhI/dVCm8PK4d3hFXCO8Oq4V1htbB6WCOsGd4d1grvCWuH94Z1wvvCMuH9Yb3wgbB++GDYIHwobBg+HDYKHwkbh4+GTcKmYbOwedgifCxsGT4etgpbh23Cq8K24ZNhu/CpsH34dNghfObn+fsXZc4/8Zv5hLB32Cd8KXwp9P5eOT+6IJoS/SC6MLoomhr9MLo4+lE0LbokujS6LLo8uiK6Mroqujq6Jro2ui66ProhujG6Kep9zWzg0AknnXKBi3HZXKzL7nK4q1xOd7XL5a5xEXeti3PXudzuepfH5XX5XH4X7wq4gk4746wjF7pCrrCLuhtcEXejK+qKueKuhHOupCvlmrsWroVr6R53rVxr18Y94Z5wT7on3VPuKfe06+CecR3d31wn96zr7J5zz7nnXVfXzXV3L7gebkKui4/JBNfH9XF9XV/X3/V3A91AN8gNcoPdYJfoEt1QN9QNc8PccDfcjXAj3Cg3yo12o90YN8aNc+NckktyE91EN8lNcpPdZDfVTXXJLtnNcDPcTDfTVZ518Shz3Vw33813KS7FLXQZ54ypbrFb7NJcmlvqlrrlbrlb6Va61W61W+vWuvVuvdvoNrrNbrPb6ra67W672+l2ul1ul9vtr7m4qNvn9rv97oA74A66L126+8odcl+7w+4bd8R9646679wxd9ydcN+7k+4Hd8qddmfcWXfO/ejOu5/cBeddUmRCZGLk7cikyDuRyZEpkamRaZHkyPTIjMi7kZmRWZHZkfcicyLvR+ZG5kXmRxZEUiIfRBZGFkVSIx9GFkc+iqRFlkSWRpZFlkdWRLwvsDX0hXxhH/U3+CL+Rl/UF/PFfQnvfElfyt/kS1+sO837W305f5sv7yv4iv5R38Q39c18c9/CP+Zb+sd9K9/at/FP+Lb+Sd/OP+Xb+6d9B/+M7+j/5jv5Z31n/5zv4p/3XX03392/4Hv4F31P38sn+N6+j3/J9/X9fH8/wA/0L/tB/hU/2L/qE/0QP9S/5of51/1w/4Yf4Uf6UTFv+tGZb5FhvE/yE/xE/7af5N/xk/0UP9VP88l+up/h3/Uz/Sw/27/n5/j3/Vw/z8/3C3yK/8Av9It8qv/QL/Yf+TS/JPOisV/pV/nVfo1f69f59X6D3+g3+c1+i9/qt/ntfoff6T/2u/wnfrff4/f6T/0+/5nf7z/3B/wX/qD/0qf7r/wh/7U/7L/xR/y3/qj/zh/zx/0J/70/6X/wp/xpf8af9ef8j/68/8lf4H+zxhhjjDH2L5lweSh+PXPxcn7v38kRv7hzHwC4elv+9F/OZ5xRrs9zcdxPxMdmfH26V5eHMm/VqiUkJFy6b5qEoPA8gMy/BGX4+aMHl+Il0AaehPbQGkr/bv39RLdz9E/Wj94KkOMXORkFZcaX1/8cABN+s99+4rEnRi0sF56J+3+sPw+gaOHLOdnhcrwE2vx8faU1lPkH9edt+U/qz/5FEkCrX+TkhMvx5fpLwePwDLT/1T0ZY4wxxhhjjLGL+omKnTLff2Z+4vP33p/Hq8s52eBy/M/enzPGGGOMMcYYY+zKe7Zb96cea9++dad/f1Dlf5T1Lw8aw39qZR787sB7gMzvKAD4gwsCZAzkX7mLLX/JsRIvPXT+fmr5WR/A/45W/hmDK/zExBhjjDHGGPvTXT7p//X31ZUqiDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYy4L+iv9O7ErvkTHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGLvS/k8AAAD///P/+v8=") socket$key(0xf, 0x3, 0x2) pipe(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./proc\x00', &(0x7f00000004c0)='proc\x00', 0x0, 0x0) 3m7.292463358s ago: executing program 2 (id=42): r0 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x8) r2 = openat$cgroup(r1, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000000)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000200)=0x5, 0x12) 3m6.513297847s ago: executing program 2 (id=46): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x16, 0x5, 0xb05, 0x8502, 0x0, 0x0, "05010902a10185030901150026ff00750895088102c0"}}, 0x12e) syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='./bus\x00', 0x1400c, &(0x7f00000002c0)={[{@debug}, {@data_journal}, {@nojournal_checksum}]}, 0x3, 0x4ac, &(0x7f0000000480)="$eJzs3M9vG8UeAPDvOnHy8tr3ktdXfrX8CBREhSBp2gI9cAAEEocikOAARysJVWlaUBMkWkUi5VBOqELijjjyL3CCC0KckLgCZ1RRoRxoi4RktF6vYzu2kzT+AfXnIzmZ2Z3dne/OjjO7EzuAoTWd/kgi9kbEjxExmWUbC0xnv26sr87fXF+dT6Jcfu23pFLu+vrqfF40325PfSaSONjiuMsXLp4pLS0tnq/mZ1fOvju7fOHiE6fPlk4tnlo8d/TEiePH5p5+6uiTu4huIiL2vZKlC9VlL735ycsnP26IvymOLpnutPKRcrnLhxus/9SlRwdYD3ZmpNpexUr/n4yRutabjBc/rGU+GFAFgZ4pl8vlPe1Xr5WB21gSjXldHoZF/oc+v/+t/h6vHwQ829MRyGBdey67AUrjvlF9ZWtGa08Mik33t900HRFvrP3xWfqK7PyPtS6Z9KgGAMCw+Sod/zyejnZW59Mx0MY8SCHurCv33+rc0FRE/C8i9kXE/+Nc7I+IOyIqZe+KiLt3ePy6SZLKMPP6+ljTPEzh6i0Htw3p+O+Z6txW4/gvH/3F1EgldyHLRDF56/TS4pHqOTkcxfE0P9fhGF+/8MOVduvqx3/pKz1+Phas1uPq6HjjNgulldKtR9zo2qWIA6Ot4k9qMwHpyPOeiDjQageFrY9x+rEv7m23buv4O+jCRFP584hHs/Zfi6b4c0nn+cnZf8XS4pHZ/KrY7LvvL7/a7vi7ir8L0vb/d8vrvxb/VFI/X7vceX9rLZZd/umjtnOr08V8w+1f/2ulldJY8nolnd8svV9aWTk/FzGWnMwqXb/86Ma2eT4vn8Z/+FDr/r8vNs7EwYhIL+L7IuL+iHig2nYPRsRDEXGowzn59vmH325eNpHH/zdo/4Udtf9GYiwalxRalEkTI2e++bLhoFMbyWr8Nzu//x2vpA5Xl2zn/W9zLVondnv+AAAA4J+gEBF7IynM1NKFwsxM9j/8+7Op79R75xayzwhMRbGQP+marHseOle9rc/ylyIi+9eCfP2xKFSeG386MlHJz8y/s7Qw0MiBPW36f+qXkUHXDug5H9iC4aX/w/Dq2P+L/asH0H+b+n/HPj/e07oA/dXi7//EIOoB9F+r8b/v+4Hh0NT/TfvBEPH8H4aX/g/Daxuf4QduP8sTsfWH5GuJYkQ0r8r3tI3NbyUxGbGTGu4+kX8z4m73E8Wty/xZLpf7EdfvPWidKHRnPz/Xvoly06qx9pfWr1ci+nZJ7DSR9K479C8xuPckAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAbvorAAD//x891tw=") write$UHID_INPUT2(r0, 0x0, 0x0) write$UHID_INPUT2(r0, 0x0, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000440)={0xc, {0x6, "030000000000"}}, 0xc) 3m5.836331244s ago: executing program 32 (id=46): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x16, 0x5, 0xb05, 0x8502, 0x0, 0x0, "05010902a10185030901150026ff00750895088102c0"}}, 0x12e) syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='./bus\x00', 0x1400c, &(0x7f00000002c0)={[{@debug}, {@data_journal}, {@nojournal_checksum}]}, 0x3, 0x4ac, &(0x7f0000000480)="$eJzs3M9vG8UeAPDvOnHy8tr3ktdXfrX8CBREhSBp2gI9cAAEEocikOAARysJVWlaUBMkWkUi5VBOqELijjjyL3CCC0KckLgCZ1RRoRxoi4RktF6vYzu2kzT+AfXnIzmZ2Z3dne/OjjO7EzuAoTWd/kgi9kbEjxExmWUbC0xnv26sr87fXF+dT6Jcfu23pFLu+vrqfF40325PfSaSONjiuMsXLp4pLS0tnq/mZ1fOvju7fOHiE6fPlk4tnlo8d/TEiePH5p5+6uiTu4huIiL2vZKlC9VlL735ycsnP26IvymOLpnutPKRcrnLhxus/9SlRwdYD3ZmpNpexUr/n4yRutabjBc/rGU+GFAFgZ4pl8vlPe1Xr5WB21gSjXldHoZF/oc+v/+t/h6vHwQ829MRyGBdey67AUrjvlF9ZWtGa08Mik33t900HRFvrP3xWfqK7PyPtS6Z9KgGAMCw+Sod/zyejnZW59Mx0MY8SCHurCv33+rc0FRE/C8i9kXE/+Nc7I+IOyIqZe+KiLt3ePy6SZLKMPP6+ljTPEzh6i0Htw3p+O+Z6txW4/gvH/3F1EgldyHLRDF56/TS4pHqOTkcxfE0P9fhGF+/8MOVduvqx3/pKz1+Phas1uPq6HjjNgulldKtR9zo2qWIA6Ot4k9qMwHpyPOeiDjQageFrY9x+rEv7m23buv4O+jCRFP584hHs/Zfi6b4c0nn+cnZf8XS4pHZ/KrY7LvvL7/a7vi7ir8L0vb/d8vrvxb/VFI/X7vceX9rLZZd/umjtnOr08V8w+1f/2ulldJY8nolnd8svV9aWTk/FzGWnMwqXb/86Ma2eT4vn8Z/+FDr/r8vNs7EwYhIL+L7IuL+iHig2nYPRsRDEXGowzn59vmH325eNpHH/zdo/4Udtf9GYiwalxRalEkTI2e++bLhoFMbyWr8Nzu//x2vpA5Xl2zn/W9zLVondnv+AAAA4J+gEBF7IynM1NKFwsxM9j/8+7Op79R75xayzwhMRbGQP+marHseOle9rc/ylyIi+9eCfP2xKFSeG386MlHJz8y/s7Qw0MiBPW36f+qXkUHXDug5H9iC4aX/w/Dq2P+L/asH0H+b+n/HPj/e07oA/dXi7//EIOoB9F+r8b/v+4Hh0NT/TfvBEPH8H4aX/g/Daxuf4QduP8sTsfWH5GuJYkQ0r8r3tI3NbyUxGbGTGu4+kX8z4m73E8Wty/xZLpf7EdfvPWidKHRnPz/Xvoly06qx9pfWr1ci+nZJ7DSR9K479C8xuPckAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAbvorAAD//x891tw=") write$UHID_INPUT2(r0, 0x0, 0x0) write$UHID_INPUT2(r0, 0x0, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000440)={0xc, {0x6, "030000000000"}}, 0xc) 2m31.311619198s ago: executing program 0 (id=271): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x2, 0x0, @ioapic={0x8000000, 0x9, 0x2fa4, 0xfffffffe, 0x0, [{0x2, 0x1, 0x87, '\x00', 0x8}, {0x8, 0x8, 0x40, '\x00', 0xb}, {0x5, 0x81, 0xd3, '\x00', 0x67}, {0x0, 0x5, 0xf5, '\x00', 0xf}, {0x7, 0x5, 0x6, '\x00', 0xf9}, {0x7, 0x4, 0x54, '\x00', 0xff}, {0x71, 0x4, 0xf9, '\x00', 0x7b}, {0x3, 0x4, 0xc}, {0x7f, 0x5, 0xb, '\x00', 0xb}, {0xbc, 0x4, 0xa, '\x00', 0x6}, {0x0, 0x28, 0x80, '\x00', 0xdc}, {0xff, 0x1, 0xfe, '\x00', 0x1}, {0xfe, 0x7, 0x26}, {0xcf, 0x3, 0x1, '\x00', 0x2}, {0xf, 0xee, 0xc, '\x00', 0x3}, {0x19, 0x2, 0x6, '\x00', 0xb}, {0x9, 0x6, 0xc9, '\x00', 0x8}, {0x5, 0xc, 0xf, '\x00', 0xc}, {0x7, 0xe1, 0x7, '\x00', 0x41}, {0xa, 0x80, 0xe, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x11, 0x2, 0x83, '\x00', 0x10}, {0x9, 0x23, 0xf3, '\x00', 0x4}, {0x0, 0x6, 0x4}]}}) 2m30.789735801s ago: executing program 0 (id=277): r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000040)="effd00001000ff00fd4344c007110000f3050a00dbfd010000000001ffdf00", 0xfe00) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x54}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) 2m30.571534127s ago: executing program 0 (id=280): syz_mount_image$udf(&(0x7f0000000080), &(0x7f00000000c0)='./file1\x00', 0x18410, &(0x7f0000000180)=ANY=[@ANYRES8=0x0, @ANYRES64=0x0], 0x3, 0x4b9, &(0x7f0000001040)="$eJzs20tslNUbx/HfM+90mA79/x0uFjAEmmhiBYFesEBqYrjYaMJFC9VIvKTSKVZ6IZ2ilICwVHcuWLp068KVcWtIXBoXBmNYmCAbN7MSd5jzznuboXRmbDtD6fdD4LyX5x3OOc+8c86ZvCMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAdefVwT6+1uhYAAKCZTp4e7ul/aPxPt6YyAACgKc6w/gcAAFhLTJ5+l2nPhZKd8PfLsscnpi9dHjk2tPBl7SZTSp4f7/5me/v69780cOBgWC5+/XLbplOnzxzuOjozdXG2UCwWxrpGpifOzYwV6n6FpV5fbZffAV1TFy6NjY8Xu/r29lecvpy/t259Z35w4L2jmTB25NjQ0OlETLrtP//vD3nUDD8jTy/I9PH339pJSSktvS9qvHdWWrvfiF1+I0aODfkNmZwYnZ5zJy0VRKUq+yQT9lETcrEkKcnVyzLLs2Zrk6cfZDqyr2SnJHlhP+z2vxiuqz6tkHZLV0ndWgU5e4ytk6cPZLq1L683gn7185+Rrra6clhx6eD+n7GSvel/Hrj7yX1sHn+r6/Xp8ZlErKWCO2q1jw/N9Jh/NmXl6ZR/x5dsWDuTp9a1rlZolnZ5mpIp89Un/rxC/rz0qcEDO3YeSs4wttR4HRe7N7i56hmT24Kpg6Xcn+VvF+qTNU9/ynT/t6y/3x2OAdKNB4td+EdTqoeVZp4mZfrnWsmsal3qJdb3kdU+9q9s/duzR2cuzs9OnP9obsHzuezhD4tzs6PnFj5dXrt6ySO11rHVUo0tyXJWXvF9/mkpui5YA/yvvBfX5pur8Xuhu6oMJd8/9WzXvYptYB7l6mTm6a5M4+9vLY8zyjXcN2uBy/+QTMXSzxZmOsh/8AxYIv8vx/2Xtcoy4uf2/+XvtcK5xLazmx91fCXy7+rk8v+OTEf+3hp8p1HOv1cV6+I6ZXr35vYgLpVxceEDcPnyK45PTBZ6XOwDmTb+FMbKj80FsZvi2F4XW5Tpi1uVseuD2M1xbJ+LvS3TnV8Xjn06ju13sfMuX3e6wtici90RxHbGsXvPzUyO1epWl/8+md6+/pqFbX5k/hP3/42qMvJQzhffXq785xPHbgR5PRvkP10j/1/KNP/X9rDdft+Hb6sN/r9x/t1c+bublbHhgnJjHNtbb7NazeV/g0z3XrkdtTloW7AbZyiZ/2fSlWXUry3K/4bEsXxQr0yDfbEWFeevXBidnCzMssEGG2xEG63+ZEIzuPF/2I3qA56F85hg/O8o78UzpvufxeP/YFUZadH4vzFxbDCYtbSlpezc1MW2LVK2OH9lz8TU6PnC+cJ0//6Bnr5D+3v6D7ZlwsldvFV33z0JXP53y3Ttx1+idUzl/G/h+X+uqoy0KP+bkm2qmNfU3RVrkst/h0wDd29H683F5v/h+r/72coyuv9alP/NiWP5oF4dDfYFAAAAAAAAAAAAAAAAAKwmOfP0nEyXh1+08DdE9Tz/N1ZVRpb/+a/yD5NrPP/VmTg21qTfNTTU0QAAAAAAAAAAAE2SkqevZXpeJbvuDnRIJ5Ilnmj/BgAA//9+z0gL") setrlimit(0x1, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) truncate(&(0x7f0000000340)='./file1\x00', 0x20fffbfff8) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x10bc42, 0x1c) write$binfmt_register(r0, &(0x7f0000000080)={0x3a, 'syz1', 0x3a, 'E', 0x3a, 0x2, 0x3a, 'udf\x00', 0x3a, '/$', 0x3a, './file2'}, 0x2d) truncate(&(0x7f0000000340)='./file1\x00', 0x20fffbfffc) 2m29.312604407s ago: executing program 0 (id=288): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) recvmmsg(r0, &(0x7f00000099c0)=[{{0x0, 0x0, 0x0}, 0x4251}, {{0x0, 0x2d, &(0x7f0000007040)=[{&(0x7f0000006040)=""/4086, 0x1000}], 0x1}, 0x8000}], 0x3fffffffffffdfc, 0x10002, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0xd, 0x20000000ec071, 0xffffffffffffffff, 0x0) 2m27.779019544s ago: executing program 0 (id=294): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x800, &(0x7f0000000000), 0x26, 0x756, &(0x7f00000002c0)="$eJzs3M1rXOUaAPDnnGaafuTeyYUL9+pChBZaKD1Jmk27aty4KxQKbmtITkLISSZkJrUTC7auhdpsFARR1y7dCqX+Ae6koOBeEK1xIW5GzuSjNGam0ybpSPr7wcl53vP1vE/m8GYO5D0BvLReL38kEUMRcTUiqpvb04g42o6ORdzeOG790a2pckmi1br2S1KeFuut6va1ks31yWifEv+PiAeViHPv/z1vvbk6P1kU+fJme6SxsDRSb66en1uYnM1n88Wx8UujF8fHL46OP7WG//VY6+m3Lh2/9+2ba2vffdW4+9rA+SQm2nXHZm09XuaZbPxOKjGxY/viQSTro6TfHQAAoCfl9/wjETHQ/pZajSPtCAAAADhMWoMtAAAA4NBLot89AAAAAA7W1v8BbM3tPah5sJ38/EZEDO+Wf6A9hzjiWFQi4sR68sTMhGTjNNiT23ci4v7Ezvvvi/IOu73Ha4/uaD85R/roHq/Ofrhfjj8Tu40/6fb4E7uMPwNb707Yo87j3+P8RzqMf1d7zPH1p69UOua/E/HqwG75k+38SYf8b/eY/+7aB/c67Wt9HnFm178/yRO5urwfYmJmruj6+oEHf5592K3+E53yJ93rX+qx/nfXf5vvNJaU+c+e6v7575a/vCc+3OxHGhH3Ntdle21HjlML33/Trf7piNbzfP6f9Vj/j18O3uzxUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGhLI2IokjTbjtM0yyJORsR/40Ra1OqNczO1lcXpcl/EcFTSmbkiH42I6kY7Kdtj7fhx+8KO9nhE/OeH4xtJ54o8m6oV0/0uHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgG0nI2IokjSLiDQifq+maZZFDPRw7uAL6B8AAACwT4b73QEAAADgwHn+BwAAgMPveZ//k33uBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCoXb1ypVxa649uTZXt6RvNlfnajfPTeX0+W1iZyqZqy0vZbK02W+TZVG3hadcrarWlsUuxcnOkkdcbI/Xm6vWF2spi4/rcwuRsfj2vvJCqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeFZD7SVJs4hI23GaZlnEvyJiOCrJzFyRj0bEvyPiYbUyWLbH+t1pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9l29uTo/WRT5skAgeGHBexHxD+hGl6DfIxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP1Qb67OTxZFvlzvd08AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADor/SnJCLK5Uz19NDOvUeTP6rtdUS888m1j25ONhrLY+X2X7e3Nz7e3H6hH/0HAACAl8LlZzl46zl96zkeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgV/Xm6vxkUeTLewsuR3O1lXQ4pt81AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz+evAAAA//8KQsc4") chdir(&(0x7f0000000240)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x18c) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x40806685, &(0x7f0000000c40)={0x1, 0x2, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x10) ioctl$FS_IOC_ENABLE_VERITY(r1, 0x40806685, &(0x7f0000000a80)={0x1, 0x2, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0}) 2m27.17718599s ago: executing program 0 (id=298): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./nfsd\x00', &(0x7f00000002c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)='tcp 2', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f000000fa40)='nfsd 1', 0x6) 2m17.624770793s ago: executing program 3 (id=359): r0 = syz_open_procfs(0x0, &(0x7f0000000300)='task\x00') fchdir(r0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, r1, 0x0, 0x4, 0xfffffffffffffffe) syz_open_procfs(r1, 0x0) 2m17.253910322s ago: executing program 3 (id=363): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}, 0x2000000b}, 0x1c) 2m17.058845977s ago: executing program 3 (id=364): r0 = socket$inet6(0xa, 0x3, 0x88) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4620, 0xf69, @mcast2, 0xd}, 0x1c) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000001600)={0x1, 0x6}, 0x4) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x28, 0x0, 0xd, 0xfffff034}, {0x6, 0x0, 0x2, 0xffffffff}]}, 0x10) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x44004) 2m16.873325402s ago: executing program 3 (id=366): syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x10, &(0x7f0000000000), 0xfd, 0x244, &(0x7f0000000680)="$eJzs3T9oJFUcB/DvzO565m6RUxtB/AMiooFwdoJNbBQCEoKIoEJExEZJhJhgl1jZWGitksomiJ3RUtIEG0WwipoiNoIGC4OFFiu7k0hMVqNu3Dkynw9MZibz3vzesPN9u83sBmisq0mmk7SSTCbpJCmON7i7Wq4e7q5PbM8nvd4TPxWDdtV+5ajflSRrSR5KslUWeamdrGw+s/fLzmP3vbncuff9zacnxnqRh/b3dh8/eG/2jY9mHlz54qsfZotMp/un6zp/xZD/tYvklv+j2HWiaNc9Av6Judc+/Lqf+1uT3DPIfydlqhfvraUbtjp54N2/6vv2j1/ePs6xAuev1+v03wPXekDjlEm6KcqpJNV2WU5NVZ/hv2ldLl9eXHp18sXF5YUX6p6pgPPSTXYf/eTSx1dO5P/7VpV/4OLq5//JuY1v+9sHrbpHA4zFHdWqn//J51bvj/xD48g/NJf8Q3PJPzSX/ENzyT80l/zDBdb5+8PyD80l/9Bc8g/NdTz/AECz9C7V/QQyUJe65x8AAAAAAAAAAAAAAAAAAOC09Ynt+aNlXDU/eyfZfyRJe1j91uD3iJMbB38v/1z0m/2hqLqN5Nm7RjzBiD6o+enrm76rt/7nd9Zbf3UhWXs9ybV2+/T9Vxzef//dzWcc7zw/YoF/qTix//BT461/0m8b9daf2Uk+7c8/14bNP2VuG6yHzz/ds79i+Uyv/DriCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABib3wMAAP//+kBtTA==") openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x22042, 0x3db) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x14, 0xd, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e7376b7a5ff537ed73ac58818d78c660e677df8dc905b90242b7c528a076d2f6a00400", "036c5bc6780820d1cbf7966d61fdcf335263bd9b0abdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) 2m16.380924684s ago: executing program 3 (id=368): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r1 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x8, &(0x7f0000000200)=ANY=[@ANYBLOB="bcea"]) r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f00000001c0)={0x51, 0xffff, 0x560c, {0x803, 0x5d5}, {0xfffa, 0x2}, @period={0x59, 0x2, 0x4, 0x6d, 0x9ee, {0x2, 0xb, 0xfffb, 0xa}, 0xfffffffffffffe2f, 0x0}}) close_range(r0, 0xffffffffffffffff, 0x0) 2m15.842786077s ago: executing program 3 (id=373): setns(0xc9, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x42) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'bond0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="350d0000000000003000128008000100687372002400028008000200", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r1], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) 2m15.367353298s ago: executing program 33 (id=373): setns(0xc9, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x42) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'bond0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="350d0000000000003000128008000100687372002400028008000200", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r1], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) 2m11.745709187s ago: executing program 34 (id=298): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./nfsd\x00', &(0x7f00000002c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)='tcp 2', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f000000fa40)='nfsd 1', 0x6) 28.013048665s ago: executing program 5 (id=1093): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000b7403340861a22753635f10203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000040)={0x1c, &(0x7f0000000380)={0x0, 0xe, 0x2, '#\t'}, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 25.670085362s ago: executing program 5 (id=1107): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x10040) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f00000002c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) syz_emit_ethernet(0x76, &(0x7f00000003c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x68, 0x67, 0x0, 0x7, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x15, 0x20, 0x1, 0x0, 0x0, {[@md5sig={0x13, 0x12, "64a80fffa2c70e94f10b4d712c94ae6e"}, @mptcp=@add_addr={0x1e, 0x12, 0x0, 0x12, 0x3, @rand_addr=0x64010102, 0x9, "540089e05cf48439"}, @mss={0x2, 0x4, 0x3}, @generic={0x8, 0xb, "a72e7e48a061f94264"}, @sack={0x5, 0xa, [0x0, 0x8]}]}}}}}}}, 0x0) 25.543868575s ago: executing program 5 (id=1109): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup2(r0, r1) sendto$inet6(r1, &(0x7f0000000540)='e', 0x1, 0x7ddfdbdfafa51cdd, &(0x7f0000000580)={0xa, 0x4e23, 0x2, @loopback, 0xe35a}, 0x1c) connect$inet6(r1, &(0x7f00000005c0)={0xa, 0x4e24, 0x9, @remote, 0xa}, 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r2, 0x84, 0x23, &(0x7f0000000600)={0x1, 0x8}, 0x8) 24.574289339s ago: executing program 5 (id=1120): syz_mount_image$ext4(&(0x7f0000000280)='ext4\x00', &(0x7f0000000340)='./sys\x00', 0x210000, &(0x7f0000000540)={[{@dax_never}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x5}}, {@lazytime}, {@init_itable}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$fuse(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', 0x8820, &(0x7f0000000240)=ANY=[], 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2) 23.784913218s ago: executing program 5 (id=1128): r0 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@private1, 0x800, 0x0, 0x3, 0x9, 0x0, 0x7fff}, 0x20) fstat(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r1) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f0000008940)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @remote, 0x7, 0x1000001}, 0x80, 0x0, 0x0, &(0x7f0000001580)=ANY=[@ANYBLOB="080100000000000029000000", @ANYRES64=r0], 0x108}}], 0x2, 0xc040) 23.241411551s ago: executing program 5 (id=1134): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_ADD_NAN_FUNCTION(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[], 0x3aa0}, 0x1, 0x0, 0x0, 0x40}, 0x24004015) readv(r1, &(0x7f0000000580)=[{&(0x7f0000000280)=""/198, 0xc6}, {&(0x7f0000000480)=""/166, 0xa6}], 0x2) 22.790479772s ago: executing program 35 (id=1134): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_ADD_NAN_FUNCTION(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[], 0x3aa0}, 0x1, 0x0, 0x0, 0x40}, 0x24004015) readv(r1, &(0x7f0000000580)=[{&(0x7f0000000280)=""/198, 0xc6}, {&(0x7f0000000480)=""/166, 0xa6}], 0x2) 3.498098024s ago: executing program 4 (id=1243): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) connect$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) r1 = fcntl$dupfd(r0, 0x406, r0) setsockopt$inet6_buf(r0, 0x29, 0x39, 0x0, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000000)={0x5c}, 0x8) 2.688515914s ago: executing program 1 (id=1249): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)="ebe3a0e9796cfd1647e299f4e376fdba", 0x10}], 0x1}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/72, 0x48}], 0x1}, 0x0) 2.299418743s ago: executing program 4 (id=1250): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$kcm(0x11, 0x2, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001540)=ANY=[@ANYBLOB="bf16000000000000b7070000000100004870000000000000500000000000000095000000000000002ba728041598fbd30cb599e83d24a3aa81d36bb3019c13bd23212fb56fa54f2641d8b02c3815e79c1414eb07eae6f0711e6bd917487960717142fa9ea4318123f602000000000080de89e661168c1886d0d4d94f204e34ff65c26e278ef5b915395b19284a1a4bc72fbc1626e3a2a2ad358061d0ae0209e62f51ee988e6ea604ce974a22a550d6f97080980400003e05df3ceb9f1feae5737ecaa80a666963c474c2a100c788b277beee1cbf9b0a4d3881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3431abe802f5ab3e89cf6c662ed4048d3b3e22278d00ce00000000d3a02762c2951257b85802189d74005d2a1bcf9436e192e23fd275985bf31b714f000bcab6fcd610f25f5888000000003f11afc9bd08c6ebfbb89432fb465bc52f49129b9b6150e320c9901de2ebb9000000018e3095c4c5c7a156cec33a667dccaff950ca1e5efdd4c968dacf81baa3a509b1041d06f6b0097c430481824a3f4fddd3c643f630ba175d876defd3541772f26e27c44cfdb2d85d6d29983e830a9cdd79837b3468e8c67a571d0a017c100344c52a570dd39877dfb2ff1ae66e1ce917474b2e650ae630afd086004c4a56c6cce6e51723257c872c5255f20100000000000000f041b665ab21372c8d8b7bac5b5c784d20a4a24d8dbd75062e1daef9dead619cc6e7baa72707157791c3d2a286ffb8d35452bb5d36c2a8682bf7ecbd53f950ef4709ec01e230d2f53594ef4839c6130c4c13a0cca84b9935f771fd49e480cd9d48aeb12b1d6acabd38a817bcd222614d1f62734d679039a97d2b74f9e8e997ccd314000f7477137f4e8e7025123e783df8b8a17e3aa9fe1f662aef87a065b03cfb65b4dfe4f1b56e1f23128d743753a1de172d683d5892ce9414a1d98ea93e3d35dbb6c23b90cf36e83b8a434a97d09343d7f83079ccb02e69d384146056d125cfa788237874dd42dae334bda042819a2aa24dba1c25be2794448b4f63483026b5e34d44705b76ef29241adab0dd7d68bf975e02069f6f2425e1bc97a3d588085f16bef63a06578d4f5de7bfb6aaa75f16996d536256c02284cb1d3a6fb8cae87691fae365a70c3fc69e1565bba8dd8a8ca049f798abe646f738bebd69413afc9d8a5edd7aaa000000000000001e6c2f2a287c5278a218dbfaffffff00a14db5cfa6819eb1d39c48cfdc80d215c9e16e0c4736c819363154cca4e2f89800d18c89d7f46f679df6c9e2952ae1ebfd0ca88368ee6ce139e8b5822c22cf2e9dde943d34c432e1001171792c65986146666a5490928441f47e0fe5eac41824ca1fd0eb71aa243c88d5480efd8329d9a733d8f9ffffff5f912ac4e34bf6ea8a86da707b03bddb491ba0cc98f6be92c50008a2b50025419d1476c73132ca7ca26ce8a7e3ffb700f09e157f9b844051f1a642aca9ff98c9036471ccff0522903e7bcf62e18f7696bbc280b95e8e0d6fd5644b0ebde3a95b06548862de809d3dae3cccf109f7c78e8479a345e800000000000000000000009455bf417627ce723a5d9103706aba69279500bb82f6b5a3ddc0bd9856712945b70c75ce5b722578820820d010d7a3cffc99fc647d0b82ef26ab708c0b19ed144be51c3b398f0e6bb7a30006000000cba12953d58cff0f0378740fe6662f377b97d8e7cdb047acd083d3cd3856476a60a49ad127ba6570bafc2bbcf9ee721fd9cb467ff071e5604fbf0491245c0000007d932d7a64de4c4aa433fc0840aff7c47da3a4c6966d0000000000000000f6bfbae29e8a6e2a889f6ef6869d82d6bd73eb76b65c7a35a54a4a6b8ad4600e3a972a0bb5971a5f16590b0a03dafa3fd1118765cc8ab9fccf3b51c41a339f200f2fa33006910a679a9ae0187b4d750c4bd244cb0cbfd23b265f4d4da448a7a0d19c5e430a31609dfa2dde267551467eb6475293dd7012cc449009981f22820e57a0eff234ccfe21d7a2302e000669753d3c3432cc14ee1abe724adb6b5431befedd3e22971118f0e21aed1823cb7dde8212a8531bd9691dd4cc6a370e9eb56b3d790b98f2bd0db1e5de6a146597b2cbb7103040d2a39d7965d34df524b760ab92efcce7dd1574052c735935bf6a752c015c7f5ffee9ff66e5dd2866b15b6e0d17618cb1f5c1ee4b051f47db7aa110f499f840a5c965443d725556351ee25fe09f69494b053678dcadcf02e063dff2fa4bef1ac3bbbebe6c74d71ec3b23e29895eff1d1017024fe3e8cc759b05785adc346b7ffd05963f92c1d0d7d90ba878ad89e490f3e29ac51d30632869a534418f916bf6fe8167827a8e6c8f8b391c822805cb0adf1b8bd6947ff208753eb0d208ce14f7b206b2e02c21e963abc5ceb735c1b3c46b0a843de52a903375dfb663a8d8ee9c2b2705c1a81d9d3b9656b219c8cd99c9cafcd0d0540884d97aecb19983fc6af29ab44a82aff9cba921192c665b877af6539bdb1b567f481ba07982e7ad758f4e1eac69e7e88a63960975f490e161e371ec8534791e3b61c685d900a9c0839208356b53750e76fcc3c2d1bddcbd83897921414d0c02e8188f3df79ea2a5c5444004830e6cb227ca1bdafb977c00000000003a417193b8c5d793687335a930867094fd6a78218218e04b705ec62f1608cb569b81914e68f175b392af6bc4fd2121d7fd276af2c97a441b56e7a0687d98b8e76d8d0d231e4fe00be1de76bd19cc12e2bd938eb681ed6bc951c1b4f7c51af59eea4d40c6000000000200778a677b72786311153271a3313da02645e11761699e4d04ac86dd14ff7b9a10d3fa74696fe3953a5b7706bf5d1faba4b18808d9cb0e9db696dec4e0820ee4028d7225a2c9c427cf64cbde6fba056b2006b7a37c1181d530fb865e235cd302f3b4071ee5237ada986b9e5e3144bf479f277f10656ad3744037ccc9c63685a6f1109d2ea73773d3635f61497f1fa1ea4a16f601800bf3e59141fbf05a96113320c445f9ba8596970d5254727e804fbd99ccefb7c09269dd2c5c25e56e169ac15980f3f85f7ca36dd5950ef5b64fd46f123311829534a82940994199b3cf7a8fabea9930952f5da9b909c1946e55289f668c423fcbb31ae91864c882313151741a67538c9689dc8ecc9903c7041e5c0704e2fa55a756487517a7445cbd9e3f5175e41c0000000000000000000a000000bf98efd587fffe326f474b0b089c017b16c0062cbce96f5adebec52a79f9363909842f79c50a1520be46d87003137e4c5031f00123e812a5e37cd52c9eb7336281cb8c6ce9934b157d7875a70eaf103cb3938e2361c51cd1eab8a26b232acf6bf0ab829c26dab637538b2eb1420d812d2b80c777710ba0f18e4661681aa218d9ba54023ab4305d77eb15611ae2545835e9d30e9f6d4fb43a291c69545a1eea0f8720431132d8549f99bf6c5cb060da70cbb59d0a000000000034d083fc37d2449f72de0cbea4bc1dc89c136cdbc504f849d5502d77a95c7bfff4cd9c03058d0d4d07ea64824f1acf2b39389f675f39d01719cdbab3f1ce10609c8d7b3e37cb99b41da5e485a441b6a103549f55ab09dc98767763d1f2fafd45bb7d2b40050d1f8292f4d9ec6d0000000000003932062290f4996fdd55b06023437e9e2072daf7f5d82f6f1b5b89a41134f4dc2e65bb11272fdf8c8141f41d6160b3d8b6ecd16d14267f61b4881adee7f07f3d6af5ae79e16fe2c3f55ac7a6392d2e1d9b4286b6c3e1f5a76b85ed6e1f0000c67e6c5fcdc8c39381be4799b8cb2d08b8262c807dd755e22b801162381aa9d1af2bbc9cfd497585337eac408b8475b47a392a10cae349160f128e5f873a58064eb400c36a90624f6aed398a215e9ce64522ab249f67c38a656d32ecff5cdb2b039c4abf349d2c0f88a42e9189bbfa7f5cf35b6e7ef8f9d33163b7ea875583e3aec4714c9c4ca3ecb04f2720237615a28bf310b58ffa2a103216fdcc8c2d8f5d55e5e7ebf147105272aaae56e86d856b3cf79a3f7306436762dd1a08ce873e07cebc7892ec6f9f696da38feed3dc0001500e34adae1ba89a32bad2af9030f840f1ba46cdadd5cbacc59352c290f55d971b65953533668c25f21d8d62d849e9058eaa97c63491568887548f668cdbca2abf01a361a0b64d8b523e669da350e3ec7445dfbf366b0b3bc5e76824a1e43eaaeca70db90f2fa39596443447671933079a24fe3681ad9ac361f71ac279a688f10a1cc4df1112105edebc5e3bbc394c8305ab129ca2dfb9b7c5e9d097bd01b495cccefddce569117f7f5d6a6270ff0f0f4c371029ca8489571b55841bf3dd003bc81460eee57ceb3c33f4e9300b0144fe040cf5fcfcbb616c2070237881afdb314cecd1623f3e55ab8b7627fa1be349145a8d6313cbc790eefe2020138e82fb9d351be4ddcbcc9bc048dd3db5828d16baec6e07a007f0030f34ea3cfd524d6fa1d45da5641d6c94e1d3ae7fba1c85035d2a60ef1696e0d96aa1c60019f73ae0aa6113cd66ef26b5777337c26e1461405d86fdf091edd526f25cada439bb3609ed5c35ab60a539ade786bd6004d0ea3edbd6c4da0d8e8be8c771c8c8a0b07d9859e04adb18964dcce9bce546074c26dffbc2df372a016e8c845d4257000000000000000000000000000000000000f29657697d9c2b132b2dc2f5ea5122836582a7e85fe2bc166f17aefd9d861de0191f5277d4a3b5afb6f23d9eea2459f7844606e1202768d83c24cc791bde44a448022bbfa571fe029a7b2d5152639ee283894ab6168992ff0acc01b39a078f285ce615351f262019586eb9447bb3eaffd7b53d8f37ca6c5f1027dd5b7592996c8a7789ba108979cc9ad07ed86682843e2eaa855dd01443ee6ffde1811f10039d5d14458177096e15cc4d8f2582a1bea5ccb9f10f615c87c441dc50a244bc138a1cae9868c3079bafe69769000000000000000000e99b63029d219cd3545a8426b56554a9f265d3557eefb3602894507c256cb8ee9ebadfecb6afeb84ba757bfa8d00a5af0dd6aa1e8144ef8ef04410d52204c335408941b8eccc5c734cc6a05247142ed647f89bcb5c043acfb382b9cc918bc3cdc368983157851cdf678800aa7eb2a6cbc12c7ae23bc88b8f10223ab2a093429f3f6965bc5af0114cf6f246e891e20ecaad7059866506c3000000000c3230e901e885b7a4a36bdfdb5ce7a2e5807a0f4c1d461d1243fccf51b875b49490cd7d044e7a1e1a4c013fae1f070a8a37ab90da2efc6c875b3aab34b75a252072691fc97bef0fed8ee597ab83bb53f89c36bc2ee3ad54904542f66dc94132df75fc9944882d6f2e13b7057e0000000000000000000000000000000000001b726c0ccd24000000000000cfd2f4d005578b9ed06e1c41ef3b411066739de953d39b968caaca1507928d68c8f052"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe89}, 0x48) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000000)=r1, 0x4) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030033000b63d25a80648c2594f91224fc60100c214002000003050582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) 2.193436506s ago: executing program 6 (id=1251): r0 = socket$inet6(0xa, 0x2, 0x0) close(r0) r1 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x800, 0x0, 0x3, 0x1, 0x8}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x2005, 0x4) sendmsg$inet6(r1, &(0x7f0000000140)={&(0x7f0000000100)={0xa, 0x4e60, 0x80000, @dev={0xfe, 0x80, '\x00', 0x3d}, 0xfffffffb}, 0x1c, 0x0, 0x0, &(0x7f00000003c0)=[@dstopts_2292={{0x18, 0x29, 0x4, {0x33}}}, @dstopts_2292={{0x18, 0x29, 0x4, {0x3c}}}], 0x30}, 0x3400c8d4) 2.151444827s ago: executing program 1 (id=1253): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x10, 0x4, 0x8, 0x8}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000300000000000000000000f195"], 0x0}, 0x94) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r1, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000003000000b704000000000400850000003300000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xe, 0x0, &(0x7f00000003c0)="7993ff01190000e5ffa53b00008f", 0x0, 0x400, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe, 0x4}, 0x50) 2.01843953s ago: executing program 4 (id=1254): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [], {0x14, 0x10}}, 0x28}}, 0x0) r0 = socket(0xa, 0x3, 0xff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000012c0)=ANY=[], 0xf0}}, 0x0) 1.979041221s ago: executing program 7 (id=1255): r0 = userfaultfd(0x1) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r1, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000000000/0x800000)=nil, 0x800000}) 1.907855123s ago: executing program 6 (id=1256): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x1002}) sendto$inet6(0xffffffffffffffff, &(0x7f0000000100)="c10e000018001f", 0x7, 0x4000000, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_MSG_GETTABLE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000010a"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000058c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002160, 0x0) 1.796675716s ago: executing program 7 (id=1257): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) syz_emit_ethernet(0x7e, &(0x7f00000000c0)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x17, 0xf, 0x0, 0x0, 0x0, {[@mptcp=@capable={0x1e, 0x14, 0x0, 0x8, 0x0, 0x0, [0x400]}, @mptcp=@syn={0x1e, 0xc}, @sack={0x5, 0x16, [0x0, 0x0, 0x0, 0x0, 0x0]}, @md5sig={0x13, 0x12, "a4bcbcee95c6179191d2675112a6689b"}]}}}}}}}, 0x0) 1.783736766s ago: executing program 1 (id=1258): recvmsg$unix(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)=[{0x0, 0xffffffc8}], 0x1, &(0x7f0000000680)}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000500), 0x49f, 0x0, 0x0) 1.779744516s ago: executing program 4 (id=1259): pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000140)={0x0, 0xdffffffe, 0x80, 0x0, 0x0, "8100e1c8e80b598c36ff000800"}) r2 = syz_open_pts(r1, 0x40601) ioctl$TIOCCONS(r2, 0x541d) close_range(r0, 0xffffffffffffffff, 0x0) 1.6279171s ago: executing program 6 (id=1260): syz_mount_image$fuse(0x0, &(0x7f0000000180)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) r0 = fanotify_init(0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) setresuid(r1, r1, 0x0) fanotify_mark(r0, 0x451, 0x8, 0xffffffffffffffff, 0x0) 1.563773801s ago: executing program 1 (id=1261): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000140)={0x1, 0x1000}, 0x4) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000180)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f00000001c0)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x801, 0xf84, 0x3}, 0x1c) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000300)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x5, 0xb68, 0x560b0000, &(0x7f0000000440)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 1.560177262s ago: executing program 4 (id=1262): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000080)=0x654a, 0x4) bind$inet(r0, &(0x7f0000000200)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) syz_usb_connect(0x2, 0x4e, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0}) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) 1.448172024s ago: executing program 6 (id=1263): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) bind$tipc(r0, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x2000002, 0xfffffffe}}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r2, 0x1, 0x70bd2a, 0x25dfdbff, {{}, {}, {0x14, 0x19, {0x0, 0x1}}}}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x4080) 1.194218991s ago: executing program 6 (id=1264): r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='source\x00', &(0x7f0000000200)='127.0.0.1:6789:/\x00', 0x0) r1 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000040)='source\x00', &(0x7f0000000080)='0.0.0.0:0:/\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 913.398237ms ago: executing program 1 (id=1265): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000040)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x33, &(0x7f0000000640)={0x1, &(0x7f00000000c0)=[{0x6, 0x81, 0xca}]}, 0x10) listen(r1, 0x2b9b) close_range(r0, 0xffffffffffffffff, 0x0) 810.73565ms ago: executing program 7 (id=1266): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000006780)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000067c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_REGISTER_BEACONS(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000006840)={&(0x7f0000006880)={0x30, r2, 0x1, 0x50bd26, 0x25dfdbf8, {{}, {@val={0x8, 0x1, 0x4f}, @val={0x8, 0x3, r1}, @val={0xc, 0x99, {0x200005, 0x5d}}}}}, 0x30}, 0x1, 0x0, 0x0, 0x20044041}, 0x24008000) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000006940), 0xffffffffffffffff) sendmsg$NL80211_CMD_REGISTER_BEACONS(r0, &(0x7f0000006980)={0x0, 0x0, &(0x7f00000069c0)={&(0x7f0000006a00)={0x1c, r3, 0x1, 0x70bd08, 0x25dfdbfb, {{}, {@void, @val={0x8, 0x3, r1}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8c4}, 0x2000c010) 775.598051ms ago: executing program 1 (id=1267): pipe(&(0x7f0000000200)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='J=\t\xeb\xf8\xa7\x04\x9f\xe1hO\x8e\xd7\xb5\x93}\x8d\xed\x01L`\x93\xcd^2P\x00$x\"\xda\xf1Az\xfe_\xc5\xb3\x9b`;\x1c\xfc\xaf9\x98\x91\xe7', 0x1) splice(r0, 0x0, r1, 0x0, 0x2, 0x5) r2 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0xaf}, &(0x7f0000000100)=0x0, &(0x7f00000003c0)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r2, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 653.514384ms ago: executing program 7 (id=1268): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x0, 0x0, 0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./proc\x00', &(0x7f0000000500)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./proc/net/netfilter/nfnetlink_log\x00', 0x0, 0x0) read(r1, &(0x7f0000000700), 0x1000) 557.076756ms ago: executing program 7 (id=1269): getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, 0x0, &(0x7f00000002c0)=0x4b) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20004}, 0x4040000) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000340)={0x0, 0x7ff, 0x1, 'queue1\x00', 0x7f}) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000180)={0x217, @time={0x65757100, 0x5}, 0x0, {}, 0x67, 0x2}) 487.087588ms ago: executing program 7 (id=1270): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000b510f210950b2a7773820102030109022400010000000009042200028953950009050a02ff0300fa000905820250"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f0000000600)=ANY=[@ANYBLOB="001606"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000380)={0x2c, &(0x7f0000000180)={0x40, 0xf, 0x2, "e805"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000740)={0x34, &(0x7f0000000440)={0x40, 0x6, 0x1, "05"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 78.445948ms ago: executing program 4 (id=1271): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x8a, &(0x7f0000000800)=0x0) io_submit(r2, 0x1, &(0x7f0000000240)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x5, 0xfffd, r0, 0x0}]) write(r0, 0x0, 0x0) recvmmsg$unix(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x1, 0x180, 0x0) connect$unix(r1, &(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e) 0s ago: executing program 6 (id=1272): r0 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x8) r2 = openat$cgroup(r1, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000100)='cgroup.events\x00', 0x275a, 0x0) read$FUSE(r3, &(0x7f0000000580)={0x2020}, 0x2020) kernel console output (not intermixed with test programs): 6][ T7201] EXT4-fs error (device loop3) in __ext4_new_inode:1360: Out of memory [ 150.843847][ T7201] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5952: Out of memory [ 150.856985][ T7201] EXT4-fs error (device loop3): ext4_evict_inode:254: inode #13: comm syz.3.366: mark_inode_dirty error [ 150.883873][ T7201] EXT4-fs warning (device loop3): ext4_evict_inode:257: couldn't mark inode dirty (err -12) [ 150.948407][ T5777] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5952: Out of memory [ 150.967692][ T5777] EXT4-fs error (device loop3): ext4_dirty_inode:6166: inode #2: comm syz-executor: mark_inode_dirty error [ 151.020499][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 151.360967][ T5777] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 151.475608][ T33] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.673679][ T33] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.784982][ T33] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.884570][ T33] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.015715][ T7218] netlink: 68 bytes leftover after parsing attributes in process `syz.1.376'. [ 152.951926][ T5865] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 152.970418][ T5780] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 152.986308][ T5780] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 152.998984][ T5780] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 153.021374][ T5780] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 153.036603][ T5780] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 153.048770][ T5780] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 153.199990][ T5865] usb 5-1: Using ep0 maxpacket: 16 [ 153.223046][ T5865] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 153.283636][ T5865] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 153.300183][ T5865] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.308581][ T5865] usb 5-1: Product: syz [ 153.316884][ T5865] usb 5-1: Manufacturer: syz [ 153.323096][ T5865] usb 5-1: SerialNumber: syz [ 153.352391][ T5865] usb 5-1: config 0 descriptor?? [ 153.369532][ T5865] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 153.389832][ T7232] rxe_eth0 speed is unknown, defaulting to 1000 [ 153.408260][ T5865] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 154.001497][ T5865] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 154.315740][ T5865] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 154.347050][ T5865] em28xx 5-1:0.0: board has no eeprom [ 154.450746][ T5865] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 154.458698][ T5865] em28xx 5-1:0.0: dvb set to bulk mode. [ 154.496681][ T5104] em28xx 5-1:0.0: Binding DVB extension [ 154.554334][ T5865] usb 5-1: USB disconnect, device number 7 [ 154.578207][ T5865] em28xx 5-1:0.0: Disconnecting em28xx [ 154.722233][ T5104] em28xx 5-1:0.0: Registering input extension [ 154.767441][ T5865] em28xx 5-1:0.0: Closing input extension [ 155.007401][ T5865] em28xx 5-1:0.0: Freeing device [ 155.028841][ T27] audit: type=1326 audit(1792036986.759:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7269 comm="syz.4.384" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd911f9e559 code=0x0 [ 155.152191][ T7232] chnl_net:caif_netlink_parms(): no params data found [ 155.180036][ T5104] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 155.180332][ T5782] Bluetooth: hci1: command tx timeout [ 155.238574][ T33] hsr_slave_0: left promiscuous mode [ 155.247429][ T33] hsr_slave_1: left promiscuous mode [ 155.265069][ T33] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 155.274782][ T33] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 155.288288][ T33] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 155.299413][ T33] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 155.311962][ T33] bridge_slave_1: left allmulticast mode [ 155.318084][ T33] bridge_slave_1: left promiscuous mode [ 155.333019][ T33] bridge0: port 2(bridge_slave_1) entered disabled state [ 155.345455][ T33] bridge_slave_0: left allmulticast mode [ 155.352137][ T33] bridge_slave_0: left promiscuous mode [ 155.358414][ T33] bridge0: port 1(bridge_slave_0) entered disabled state [ 155.398198][ T33] veth1_macvtap: left promiscuous mode [ 155.407229][ T33] veth0_macvtap: left promiscuous mode [ 155.414069][ T33] veth1_vlan: left promiscuous mode [ 155.419831][ T5104] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 155.420277][ T33] veth0_vlan: left promiscuous mode [ 155.441408][ T5104] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 155.458569][ T5104] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 155.480278][ T5104] usb 2-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 155.489514][ T5104] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 156.014616][ T5104] cxacru 2-1:1.0: send of cm 0x91 failed (-71) [ 156.040016][ T5104] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 156.080070][ T5104] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 156.104223][ T5104] cxacru: probe of 2-1:1.0 failed with error -71 [ 156.170306][ T5104] usb 2-1: USB disconnect, device number 5 [ 156.594289][ T5780] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 156.625691][ T5780] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 156.659301][ T5780] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 156.686742][ T5780] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 156.698521][ T5780] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 156.720371][ T5780] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 156.938563][ T7279] loop4: detected capacity change from 0 to 32768 [ 156.974099][ T7279] XFS (loop4): Invalid superblock magic number [ 157.260108][ T5782] Bluetooth: hci1: command tx timeout [ 158.026385][ T33] team0 (unregistering): Port device team_slave_1 removed [ 158.105323][ T33] team0 (unregistering): Port device team_slave_0 removed [ 158.196582][ T33] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 158.307288][ T33] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 158.872448][ T5782] Bluetooth: hci4: command tx timeout [ 158.994848][ T33] bond0 (unregistering): Released all slaves [ 159.288364][ T7280] rxe_eth0 speed is unknown, defaulting to 1000 [ 159.352779][ T5782] Bluetooth: hci1: command tx timeout [ 159.373494][ T7232] bridge0: port 1(bridge_slave_0) entered blocking state [ 159.382827][ T7232] bridge0: port 1(bridge_slave_0) entered disabled state [ 159.390972][ T7232] bridge_slave_0: entered allmulticast mode [ 159.398975][ T7232] bridge_slave_0: entered promiscuous mode [ 159.410136][ T7232] bridge0: port 2(bridge_slave_1) entered blocking state [ 159.420477][ T7232] bridge0: port 2(bridge_slave_1) entered disabled state [ 159.429210][ T7232] bridge_slave_1: entered allmulticast mode [ 159.438592][ T7232] bridge_slave_1: entered promiscuous mode [ 159.508001][ T7232] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 159.564245][ T7232] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 159.691659][ T7232] team0: Port device team_slave_0 added [ 159.725418][ T7232] team0: Port device team_slave_1 added [ 159.797346][ T7232] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 159.828992][ T7232] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 159.864653][ T7232] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 159.889442][ T7232] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 159.911312][ T7232] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 159.949522][ T7232] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 160.135167][ T7232] hsr_slave_0: entered promiscuous mode [ 160.144014][ T7232] hsr_slave_1: entered promiscuous mode [ 160.159255][ T7232] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 160.168287][ T7232] Cannot create hsr debugfs directory [ 160.645430][ T7280] chnl_net:caif_netlink_parms(): no params data found [ 160.795445][ T7280] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.820174][ T7280] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.828277][ T7280] bridge_slave_0: entered allmulticast mode [ 160.872518][ T7280] bridge_slave_0: entered promiscuous mode [ 160.909478][ T7280] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.930111][ T7280] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.937546][ T7280] bridge_slave_1: entered allmulticast mode [ 160.950714][ T5782] Bluetooth: hci4: command tx timeout [ 160.970655][ T7280] bridge_slave_1: entered promiscuous mode [ 161.089068][ T7280] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 161.106587][ T7280] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 161.118353][ T7232] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 161.163677][ T7232] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 161.208852][ T7232] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 161.237338][ T7280] team0: Port device team_slave_0 added [ 161.262512][ T7232] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 161.293125][ T7280] team0: Port device team_slave_1 added [ 161.386027][ T7280] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 161.394558][ T7280] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 161.429425][ T7280] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 161.440494][ T5782] Bluetooth: hci1: command tx timeout [ 161.463900][ T7280] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 161.475717][ T7280] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 161.514706][ T7280] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 161.656697][ T7280] hsr_slave_0: entered promiscuous mode [ 161.672351][ T7280] hsr_slave_1: entered promiscuous mode [ 161.686730][ T7280] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 161.696356][ T7280] Cannot create hsr debugfs directory [ 161.893481][ T7232] 8021q: adding VLAN 0 to HW filter on device bond0 [ 161.947303][ T7232] 8021q: adding VLAN 0 to HW filter on device team0 [ 162.000048][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.008056][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 162.035879][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.043888][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 162.225833][ T7280] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 162.245346][ T7280] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 162.273728][ T7280] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 162.297381][ T7280] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 162.536816][ T7280] 8021q: adding VLAN 0 to HW filter on device bond0 [ 162.643773][ T7280] 8021q: adding VLAN 0 to HW filter on device team0 [ 162.709220][ T2965] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.717675][ T2965] bridge0: port 1(bridge_slave_0) entered forwarding state [ 162.776044][ T33] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.784359][ T33] bridge0: port 2(bridge_slave_1) entered forwarding state [ 162.913230][ T7232] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 163.031798][ T5782] Bluetooth: hci4: command tx timeout [ 163.514654][ T7280] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 163.759152][ T7232] veth0_vlan: entered promiscuous mode [ 163.784561][ T7232] veth1_vlan: entered promiscuous mode [ 163.932619][ T7232] veth0_macvtap: entered promiscuous mode [ 163.953922][ T7232] veth1_macvtap: entered promiscuous mode [ 163.993200][ T7232] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 164.005417][ T7232] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.024043][ T7232] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 164.050061][ T7232] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.095797][ T7232] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 164.110000][ T7232] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.138498][ T7232] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 164.203009][ T7232] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 164.225089][ T7232] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.239477][ T7232] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 164.268239][ T7232] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.286186][ T7232] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 164.308767][ T7232] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.333215][ T7232] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 164.387807][ T7232] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.403640][ T7232] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.419965][ T7232] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.428762][ T7232] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.616764][ T7280] veth0_vlan: entered promiscuous mode [ 164.669784][ T7280] veth1_vlan: entered promiscuous mode [ 164.718458][ T2965] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 164.751330][ T2965] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 164.827683][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 164.847227][ T7280] veth0_macvtap: entered promiscuous mode [ 164.850395][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 164.879103][ T7280] veth1_macvtap: entered promiscuous mode [ 164.912856][ T7280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 164.925388][ T7280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.938647][ T7280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 164.952657][ T7280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.965640][ T7280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 164.978379][ T7280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.991057][ T7280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 165.005082][ T7280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 165.019574][ T7280] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 165.057048][ T7280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 165.092208][ T7280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 165.110747][ T5782] Bluetooth: hci4: command tx timeout [ 165.117048][ T7280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 165.146778][ T7280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 165.168696][ T7280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 165.194916][ T7280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 165.213401][ T7280] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 165.236238][ T7280] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 165.265481][ T7280] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 165.324934][ T7280] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.350684][ T7280] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.367867][ T7280] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.379152][ T7280] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.815496][ T196] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 165.857423][ T196] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 165.948929][ T3470] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 165.970202][ T3470] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 166.063808][ T7409] loop5: detected capacity change from 0 to 128 [ 166.111846][ T7406] rtc_cmos 00:00: Alarms can be up to one day in the future [ 166.140932][ T7409] UDF-fs: error (device loop5): udf_read_tagged: read failed, block=256, location=256 [ 166.185519][ T8] rtc_cmos 00:00: Alarms can be up to one day in the future [ 166.218655][ T8] rtc_cmos 00:00: Alarms can be up to one day in the future [ 166.249463][ T8] rtc_cmos 00:00: Alarms can be up to one day in the future [ 166.273865][ T8] rtc_cmos 00:00: Alarms can be up to one day in the future [ 166.304117][ T8] rtc rtc0: __rtc_set_alarm: err=-22 [ 166.628254][ T7421] netlink: 'syz.1.394': attribute type 3 has an invalid length. [ 166.650426][ T7417] UDF-fs: error (device loop5): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 166.729325][ T7417] UDF-fs: error (device loop5): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 167.224788][ T7433] loop4: detected capacity change from 0 to 128 [ 167.264024][ T7433] FAT-fs (loop4): Unrecognized mount option "ÿÿÿÿÿÿÿÿ" or missing value [ 168.363947][ T7464] loop1: detected capacity change from 0 to 128 [ 168.441033][ T7464] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 168.497411][ T7464] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 168.894693][ T7474] loop1: detected capacity change from 0 to 16 [ 168.925965][ T7474] erofs: (device loop1): mounted with root inode @ nid 36. [ 169.802376][ T7492] xt_hashlimit: size too large, truncated to 1048576 [ 169.943529][ T7496] io-wq is not configured for unbound workers [ 170.243633][ T7494] rxe_eth0 speed is unknown, defaulting to 1000 [ 171.477578][ T7511] rxe_eth0 speed is unknown, defaulting to 1000 [ 172.963244][ T7536] netlink: 8 bytes leftover after parsing attributes in process `syz.6.431'. [ 173.665574][ T7542] FAULT_INJECTION: forcing a failure. [ 173.665574][ T7542] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 173.730358][ T7542] CPU: 0 PID: 7542 Comm: syz.6.434 Not tainted syzkaller #0 [ 173.741165][ T7542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 173.753201][ T7542] Call Trace: [ 173.757930][ T7542] [ 173.763817][ T7542] dump_stack_lvl+0x18c/0x250 [ 173.769435][ T7542] ? show_regs_print_info+0x20/0x20 [ 173.776499][ T7542] ? load_image+0x420/0x420 [ 173.782485][ T7542] ? __might_fault+0xaa/0x120 [ 173.789397][ T7542] ? __lock_acquire+0x7eb0/0x7eb0 [ 173.796321][ T7542] ? __virt_addr_valid+0x10c/0x380 [ 173.802707][ T7542] should_fail_ex+0x394/0x4c0 [ 173.809392][ T7542] _copy_from_user+0x2f/0xe0 [ 173.815028][ T7542] strndup_user+0xb7/0x150 [ 173.821136][ T7542] __se_sys_add_key+0x1c4/0x410 [ 173.829237][ T7542] ? __x64_sys_add_key+0xc0/0xc0 [ 173.835495][ T7542] ? lockdep_hardirqs_on+0x98/0x150 [ 173.843574][ T7542] ? __x64_sys_add_key+0x20/0xc0 [ 173.850208][ T7542] do_syscall_64+0x55/0xb0 [ 173.857897][ T7542] ? clear_bhb_loop+0x40/0x90 [ 173.863212][ T7542] ? clear_bhb_loop+0x40/0x90 [ 173.870419][ T7542] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 173.880377][ T7542] RIP: 0033:0x7f493fb9e559 [ 173.885820][ T7542] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 173.912563][ T7542] RSP: 002b:00007f4940b35028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 173.923777][ T7542] RAX: ffffffffffffffda RBX: 00007f493fe25fa0 RCX: 00007f493fb9e559 [ 173.934706][ T7542] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 00002000000001c0 [ 173.945468][ T7542] RBP: 00007f493fc358b0 R08: ffffffffffffffff R09: 0000000000000000 [ 173.955394][ T7542] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 173.965637][ T7542] R13: 00007f493fe26038 R14: 00007f493fe25fa0 R15: 00007ffe44a663d8 [ 173.975527][ T7542] [ 174.418324][ T27] audit: type=1800 audit(1792037006.149:7): pid=7545 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.435" name="features" dev="configfs" ino=13169 res=0 errno=0 [ 175.644008][ T7570] vivid-000: disconnect [ 175.720144][ T789] vivid-000: reconnect [ 177.112573][ T7581] loop4: detected capacity change from 0 to 32768 [ 177.201874][ T7581] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 177.682169][ T7596] loop1: detected capacity change from 0 to 40427 [ 177.743929][ T7596] F2FS-fs (loop1): Invalid SB checksum offset: 0 [ 177.758896][ T7596] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 177.788367][ T7596] F2FS-fs (loop1): invalid crc value [ 177.811450][ T6038] ocfs2: Unmounting device (7,4) on (node local) [ 178.311407][ T7596] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 178.349817][ T7596] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 178.469410][ T7596] syz.1.452: attempt to access beyond end of device [ 178.469410][ T7596] loop1: rw=10241, sector=53248, nr_sectors = 8 limit=40427 [ 178.726856][ T5775] syz-executor: attempt to access beyond end of device [ 178.726856][ T5775] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 178.753202][ T5775] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 178.910398][ T5842] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 179.152663][ T5842] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 179.190464][ T5842] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 179.219829][ T5842] usb 6-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 179.250594][ T5842] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.678407][ T5104] usb 6-1: USB disconnect, device number 2 [ 179.893923][ T7664] loop8: detected capacity change from 0 to 8 [ 179.923566][ T7664] Dev loop8: unable to read RDB block 8 [ 179.937180][ T7664] loop8: unable to read partition table [ 179.964569][ T7664] loop8: partition table beyond EOD, truncated [ 180.010774][ T7664] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 180.332638][ T7675] loop1: detected capacity change from 0 to 1024 [ 180.366741][ T7675] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 180.484081][ T7675] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 180.672056][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 180.928117][ T28] libceph: connect (1)[c::]:6789 error -101 [ 180.938454][ T789] libceph: connect (1)[c::]:6789 error -101 [ 180.965138][ T28] libceph: mon0 (1)[c::]:6789 connect error [ 180.974478][ T789] libceph: mon0 (1)[c::]:6789 connect error [ 181.273461][ T28] libceph: connect (1)[c::]:6789 error -101 [ 181.289972][ T28] libceph: mon0 (1)[c::]:6789 connect error [ 181.291428][ T789] libceph: connect (1)[c::]:6789 error -101 [ 181.363646][ T789] libceph: mon0 (1)[c::]:6789 connect error [ 181.477425][ T7686] ceph: No mds server is up or the cluster is laggy [ 181.480024][ T7689] ceph: No mds server is up or the cluster is laggy [ 181.890694][ T28] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 182.094077][ T28] usb 7-1: New USB device found, idVendor=17ef, idProduct=6161, bcdDevice= 0.00 [ 182.136794][ T28] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.186194][ T28] usb 7-1: Product: syz [ 182.209912][ T28] usb 7-1: Manufacturer: syz [ 182.237397][ T28] usb 7-1: SerialNumber: syz [ 182.350373][ T8] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 182.372457][ T7725] rxe_eth0 speed is unknown, defaulting to 1000 [ 182.551555][ T28] cdc_acm 7-1:1.0: ttyACM0: USB ACM device [ 182.580601][ T8] usb 6-1: Using ep0 maxpacket: 16 [ 182.611247][ T8] usb 6-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 182.649858][ T8] usb 6-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 182.658701][ T28] usb 7-1: USB disconnect, device number 2 [ 182.710067][ T8] usb 6-1: config 0 interface 0 has no altsetting 0 [ 182.759998][ T8] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 182.830089][ T8] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.911925][ T8] usb 6-1: config 0 descriptor?? [ 183.150109][ T28] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 183.366809][ T28] usb 7-1: New USB device found, idVendor=17ef, idProduct=6161, bcdDevice= 0.00 [ 183.416104][ T28] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 183.419496][ T8] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 183.478206][ T28] usb 7-1: Product: syz [ 183.481713][ T8] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 183.501496][ T28] usb 7-1: Manufacturer: syz [ 183.529934][ T28] usb 7-1: SerialNumber: syz [ 183.534965][ T8] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 183.592210][ T8] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 183.640690][ T8] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 183.685393][ T8] mcp2221 0003:04D8:00DD.0002: USB HID v0.01 Device [HID 04d8:00dd] on usb-dummy_hcd.5-1/input0 [ 183.966689][ T8] usb 6-1: USB disconnect, device number 3 [ 184.197661][ T28] cdc_acm 7-1:1.0: ttyACM0: USB ACM device [ 184.425002][ T8] usb 7-1: USB disconnect, device number 3 [ 185.975547][ T7769] loop4: detected capacity change from 0 to 512 [ 186.054677][ T7773] mmap: syz.1.494 (7773) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 186.148620][ T7769] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 186.261092][ T7769] ext4 filesystem being mounted at /102/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 186.540885][ T6038] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 186.554698][ T7783] EXT4-fs warning (device sda1): verify_group_input:151: Cannot add at group 5 (only 8 groups) [ 186.615074][ T7781] loop1: detected capacity change from 0 to 4096 [ 186.641705][ T7781] EXT4-fs: Ignoring removed nobh option [ 187.154982][ T7781] EXT4-fs: Ignoring removed bh option [ 187.175944][ T7781] EXT4-fs (loop1): Test dummy encryption mode enabled [ 187.227228][ T7781] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 187.247862][ T7797] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 187.538152][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 187.589011][ T7806] loop6: detected capacity change from 0 to 1024 [ 187.721735][ T7806] EXT4-fs (loop6): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 187.869667][ T7812] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 187.966718][ T7806] EXT4-fs error (device loop6): ext4_read_block_bitmap_nowait:478: comm syz.6.503: Invalid block bitmap block 0 in block_group 0 [ 187.999541][ T7806] EXT4-fs (loop6): Remounting filesystem read-only [ 188.011156][ T7806] Quota error (device loop6): write_blk: dquota write failed [ 188.021440][ T7806] Quota error (device loop6): qtree_write_dquot: Error -117 occurred while creating quota [ 188.035154][ T7806] EXT4-fs (loop6): 1 orphan inode deleted [ 188.071993][ T7806] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 188.244143][ T7280] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 189.685267][ T7861] loop5: detected capacity change from 0 to 1024 [ 189.741251][ T7861] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 189.963108][ T7861] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 190.162401][ T7232] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 191.633522][ T7880] loop5: detected capacity change from 0 to 32768 [ 191.738103][ T7880] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 192.178494][ T7232] ocfs2: Unmounting device (7,5) on (node local) [ 192.376471][ T7919] gadgetfs: bound to dummy_udc driver [ 193.498246][ T7953] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 194.239000][ T7945] loop6: detected capacity change from 0 to 40427 [ 194.295614][ T7945] F2FS-fs (loop6): Invalid SB checksum offset: 0 [ 194.309872][ T7945] F2FS-fs (loop6): Can't find valid F2FS filesystem in 2th superblock [ 194.338653][ T7945] F2FS-fs (loop6): invalid crc value [ 194.547754][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.554346][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.649950][ T7945] F2FS-fs (loop6): Try to recover 2th superblock, ret: 0 [ 194.667545][ T7945] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 194.833010][ T7945] syz.6.541: attempt to access beyond end of device [ 194.833010][ T7945] loop6: rw=10241, sector=53248, nr_sectors = 8 limit=40427 [ 195.096909][ T7280] syz-executor: attempt to access beyond end of device [ 195.096909][ T7280] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 195.131787][ T8012] loop4: detected capacity change from 0 to 512 [ 195.153336][ T8012] EXT4-fs: Ignoring removed bh option [ 195.161972][ T7280] F2FS-fs (loop6): Stopped filesystem due to reason: 3 [ 195.281531][ T8012] EXT4-fs warning (device loop4): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 195.381745][ T8012] EXT4-fs warning (device loop4): dx_probe:881: Enable large directory feature to access it [ 195.422056][ T8018] netlink: 12 bytes leftover after parsing attributes in process `syz.1.561'. [ 195.439993][ T8012] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.559: Corrupt directory, running e2fsck is recommended [ 195.463610][ T8018] xfrm1: entered promiscuous mode [ 195.468752][ T8018] xfrm1: entered allmulticast mode [ 195.491580][ T8018] netlink: 12 bytes leftover after parsing attributes in process `syz.1.561'. [ 195.519139][ T8012] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -117 [ 195.538231][ T8012] EXT4-fs error (device loop4): ext4_iget_extra_inode:4752: inode #15: comm syz.4.559: corrupted in-inode xattr: e_name out of bounds [ 195.589025][ T8012] EXT4-fs error (device loop4): ext4_orphan_get:1413: comm syz.4.559: couldn't read orphan inode 15 (err -117) [ 195.615341][ T8012] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 195.780160][ T8012] EXT4-fs warning (device loop4): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 195.820577][ T8012] EXT4-fs warning (device loop4): dx_probe:881: Enable large directory feature to access it [ 195.851191][ T8012] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.559: Corrupt directory, running e2fsck is recommended [ 195.907091][ T8029] EXT4-fs warning (device loop4): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 195.966779][ T8029] EXT4-fs warning (device loop4): dx_probe:881: Enable large directory feature to access it [ 196.024126][ T8029] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.559: Corrupt directory, running e2fsck is recommended [ 196.064980][ T8033] EXT4-fs warning (device loop4): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 196.137512][ T8033] EXT4-fs warning (device loop4): dx_probe:881: Enable large directory feature to access it [ 196.151548][ T8033] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.559: Corrupt directory, running e2fsck is recommended [ 196.172998][ T8012] EXT4-fs warning (device loop4): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 196.323863][ T6038] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 196.832508][ T8056] loop5: detected capacity change from 0 to 4096 [ 196.852507][ T8056] EXT4-fs: Ignoring removed bh option [ 196.894680][ T8056] EXT4-fs (loop5): Test dummy encryption mode enabled [ 196.972817][ T8056] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 197.112414][ T27] audit: type=1800 audit(1792037028.849:8): pid=8056 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.572" name="file1" dev="loop5" ino=15 res=0 errno=0 [ 197.366885][ T7232] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 197.623864][ T8078] netlink: 48 bytes leftover after parsing attributes in process `syz.1.580'. [ 197.685330][ T8078] ip6gre1: entered allmulticast mode [ 198.150832][ T5836] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 198.177784][ T8097] loop1: detected capacity change from 0 to 1024 [ 198.231046][ T8097] EXT4-fs (loop1): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 198.275018][ T8097] ext4 filesystem being mounted at /177/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 198.377929][ T5836] usb 5-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 198.396199][ T5836] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 198.425661][ T5836] usb 5-1: config 0 descriptor?? [ 198.455464][ T8097] EXT4-fs error (device loop1): ext4_map_blocks:720: inode #15: comm syz.1.589: lblock 0 mapped to illegal pblock 0 (length 1) [ 198.486711][ T8097] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 198.500258][ T8097] EXT4-fs (loop1): This should not happen!! Data will be lost [ 198.500258][ T8097] [ 198.608666][ T3482] EXT4-fs error (device loop1): ext4_map_blocks:720: inode #15: block 4: comm kworker/u4:10: lblock 4 mapped to illegal pblock 4 (length 2) [ 198.631537][ T3482] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 4 with max blocks 2 with error 117 [ 198.647187][ T3482] EXT4-fs (loop1): This should not happen!! Data will be lost [ 198.647187][ T3482] [ 198.667889][ T3482] EXT4-fs error (device loop1): ext4_map_blocks:720: inode #15: block 8: comm kworker/u4:10: lblock 8 mapped to illegal pblock 8 (length 8) [ 198.685475][ T3482] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 198.698203][ T3482] EXT4-fs (loop1): This should not happen!! Data will be lost [ 198.698203][ T3482] [ 198.725620][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 199.156281][ T8107] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 199.172771][ T8107] overlayfs: failed to set xattr on upper [ 199.178848][ T8107] overlayfs: ...falling back to redirect_dir=nofollow. [ 199.187857][ T8107] overlayfs: ...falling back to index=off. [ 199.209997][ T8107] overlayfs: ...falling back to xino=off. [ 199.252067][ T8111] bridge0: port 2(bridge_slave_1) entered disabled state [ 199.333754][ T8114] netlink: 8 bytes leftover after parsing attributes in process `syz.5.596'. [ 199.566704][ T8086] loop4: detected capacity change from 0 to 1024 [ 199.616774][ T8086] hfsplus: invalid attributes max_key_len 0 [ 199.634861][ T8086] hfsplus: failed to load attributes file [ 199.667527][ T5836] usb 5-1: Cannot set autoneg [ 199.684457][ T5836] MOSCHIP usb-ethernet driver: probe of 5-1:0.0 failed with error -71 [ 199.735591][ T5836] usb 5-1: USB disconnect, device number 8 [ 199.982906][ T8133] netlink: 'syz.1.606': attribute type 30 has an invalid length. [ 199.999642][ T8133] netdevsim netdevsim1 netdevsim0: set [0, 1] type 1 family 0 port 8472 - 0 [ 200.009401][ T8133] netdevsim netdevsim1 netdevsim1: set [0, 1] type 1 family 0 port 8472 - 0 [ 200.018358][ T8133] netdevsim netdevsim1 netdevsim2: set [0, 1] type 1 family 0 port 8472 - 0 [ 200.027398][ T8133] netdevsim netdevsim1 netdevsim3: set [0, 1] type 1 family 0 port 8472 - 0 [ 200.045235][ T8133] netdevsim netdevsim1 netdevsim0: unset [0, 1] type 1 family 0 port 8472 - 0 [ 200.054532][ T8133] netdevsim netdevsim1 netdevsim1: unset [0, 1] type 1 family 0 port 8472 - 0 [ 200.063861][ T8133] netdevsim netdevsim1 netdevsim2: unset [0, 1] type 1 family 0 port 8472 - 0 [ 200.073092][ T8133] netdevsim netdevsim1 netdevsim3: unset [0, 1] type 1 family 0 port 8472 - 0 [ 200.095468][ T8134] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 200.103281][ T8134] overlayfs: failed to set xattr on upper [ 200.109181][ T8134] overlayfs: ...falling back to redirect_dir=nofollow. [ 200.116864][ T8134] overlayfs: ...falling back to index=off. [ 200.139269][ T8134] overlayfs: ...falling back to xino=off. [ 200.722714][ T8130] loop5: detected capacity change from 0 to 40427 [ 200.761633][ T8130] F2FS-fs (loop5): Invalid SB checksum offset: 0 [ 200.768344][ T8130] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 200.804461][ T8130] F2FS-fs (loop5): invalid crc value [ 201.101835][ T8130] F2FS-fs (loop5): Try to recover 2th superblock, ret: 0 [ 201.108991][ T8130] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 201.245045][ T8130] syz.5.604: attempt to access beyond end of device [ 201.245045][ T8130] loop5: rw=10241, sector=53248, nr_sectors = 8 limit=40427 [ 201.418310][ T7232] syz-executor: attempt to access beyond end of device [ 201.418310][ T7232] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 201.454038][ T7232] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 202.400299][ T8] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 202.592035][ T8] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 202.609818][ T8] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 202.629792][ T8] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 202.643345][ T8] usb 2-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 202.656024][ T8] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.850354][ T8198] loop6: detected capacity change from 0 to 32768 [ 202.855434][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805cf07000: rx timeout, send abort [ 202.869261][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88805cf07000: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 202.889909][ T8198] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop6 scanned by syz.6.632 (8198) [ 202.932796][ T8198] BTRFS info (device loop6): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 202.964662][ T8198] BTRFS info (device loop6): using sha256 (sha256-avx2) checksum algorithm [ 202.982479][ T8198] BTRFS info (device loop6): enabling auto defrag [ 202.989083][ T8198] BTRFS info (device loop6): use no compression [ 203.018620][ T8198] BTRFS info (device loop6): force clearing of disk cache [ 203.042086][ T8198] BTRFS info (device loop6): max_inline at 4096 [ 203.060632][ T8198] BTRFS info (device loop6): disabling free space tree [ 203.143260][ T8198] BTRFS info (device loop6): enabling ssd optimizations [ 203.169845][ T8198] BTRFS info (device loop6): auto enabling async discard [ 203.182542][ T8] cxacru 2-1:1.0: send of cm 0x91 failed (-71) [ 203.189372][ T8] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 203.206307][ T8] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 203.218792][ T8198] BTRFS info (device loop6): rebuilding free space tree [ 203.232214][ T8] cxacru: probe of 2-1:1.0 failed with error -71 [ 203.261571][ T8] usb 2-1: USB disconnect, device number 6 [ 203.367193][ T8198] BTRFS info (device loop6): disabling free space tree [ 203.385351][ T8198] BTRFS info (device loop6): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 203.405838][ T8198] BTRFS info (device loop6): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 203.597940][ T8221] netlink: 'syz.5.635': attribute type 9 has an invalid length. [ 203.630051][ T8221] netlink: 20 bytes leftover after parsing attributes in process `syz.5.635'. [ 204.043988][ T8207] loop4: detected capacity change from 0 to 32768 [ 204.072160][ T7280] BTRFS info (device loop6): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 204.092206][ T8207] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop4 scanned by syz.4.634 (8207) [ 204.217907][ T8207] BTRFS info (device loop4): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 204.262045][ T8207] BTRFS info (device loop4): using blake2b (blake2b-256-generic) checksum algorithm [ 204.292957][ T8207] BTRFS info (device loop4): using free space tree [ 204.675787][ T8207] BTRFS info (device loop4): enabling ssd optimizations [ 204.997572][ T8259] loop1: detected capacity change from 0 to 512 [ 205.164297][ T8259] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 205.249245][ T8259] EXT4-fs (loop1): orphan cleanup on readonly fs [ 205.293844][ T8259] EXT4-fs error (device loop1): ext4_ext_check_inode:532: inode #4: comm syz.1.644: pblk 0 bad header/extent: too large eh_depth - magic f30a, entries 1, max 4(4), depth 2048(2048) [ 205.374821][ T8264] loop5: detected capacity change from 0 to 2048 [ 205.441767][ T8259] EXT4-fs error (device loop1): ext4_quota_enable:7147: comm syz.1.644: Bad quota inode: 4, type: 1 [ 205.494913][ T8259] EXT4-fs warning (device loop1): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 205.536225][ T8264] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 205.547443][ T8259] EXT4-fs (loop1): Cannot turn on quotas: error -117 [ 205.556699][ T8264] ext4 filesystem being mounted at /62/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 205.571048][ T8259] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 205.610817][ T6038] BTRFS info (device loop4): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 205.669637][ T8264] EXT4-fs (loop5): shut down requested (1) [ 205.788343][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 205.797261][ T7232] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 205.946188][ T8272] netlink: 8 bytes leftover after parsing attributes in process `syz.1.648'. [ 206.086001][ T8274] netlink: 203516 bytes leftover after parsing attributes in process `syz.5.649'. [ 206.141925][ T3482] wlan1: Trigger new scan to find an IBSS to join [ 206.595881][ T8294] loop6: detected capacity change from 0 to 1024 [ 206.669119][ T8296] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 207.528154][ T8307] overlayfs: refusing to follow metacopy origin for (/file1) [ 208.245661][ T8309] loop5: detected capacity change from 0 to 32768 [ 208.265013][ T8309] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop5 scanned by syz.5.663 (8309) [ 208.328850][ T8309] BTRFS info (device loop5): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 208.356892][ T8309] BTRFS info (device loop5): using sha256 (sha256-avx2) checksum algorithm [ 208.384329][ T8309] BTRFS info (device loop5): enabling auto defrag [ 208.404589][ T8309] BTRFS info (device loop5): use no compression [ 208.424912][ T8309] BTRFS info (device loop5): force clearing of disk cache [ 208.446350][ T8309] BTRFS info (device loop5): max_inline at 4096 [ 208.466435][ T8309] BTRFS info (device loop5): disabling free space tree [ 208.643440][ T8310] loop4: detected capacity change from 0 to 40427 [ 208.661181][ T8309] BTRFS info (device loop5): enabling ssd optimizations [ 208.670641][ T8310] F2FS-fs (loop4): Invalid SB checksum offset: 0 [ 208.677100][ T8310] F2FS-fs (loop4): Can't find valid F2FS filesystem in 2th superblock [ 208.694832][ T8309] BTRFS info (device loop5): auto enabling async discard [ 208.734472][ T8309] BTRFS info (device loop5): rebuilding free space tree [ 208.744193][ T8310] F2FS-fs (loop4): invalid crc value [ 208.835721][ T8309] BTRFS info (device loop5): disabling free space tree [ 208.849842][ T8309] BTRFS info (device loop5): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 208.899498][ T8309] BTRFS info (device loop5): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 209.147398][ T8310] F2FS-fs (loop4): Try to recover 2th superblock, ret: 0 [ 209.168368][ T8310] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 209.178099][ T8345] FAULT_INJECTION: forcing a failure. [ 209.178099][ T8345] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 209.224398][ T8345] CPU: 1 PID: 8345 Comm: syz.1.669 Not tainted syzkaller #0 [ 209.231805][ T8345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 209.241922][ T8345] Call Trace: [ 209.245267][ T8345] [ 209.248244][ T8345] dump_stack_lvl+0x18c/0x250 [ 209.253009][ T8345] ? show_regs_print_info+0x20/0x20 [ 209.258379][ T8345] ? load_image+0x420/0x420 [ 209.262992][ T8345] ? __lock_acquire+0x7eb0/0x7eb0 [ 209.268096][ T8345] should_fail_ex+0x394/0x4c0 [ 209.272851][ T8345] prepare_alloc_pages+0x1e1/0x5b0 [ 209.273577][ T7232] BTRFS info (device loop5): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 209.278012][ T8345] __alloc_pages+0x134/0x460 [ 209.292856][ T8345] ? zone_statistics+0x170/0x170 [ 209.297888][ T8345] pte_alloc_one+0x84/0x540 [ 209.302561][ T8345] ? pfn_modify_allowed+0x560/0x560 [ 209.307851][ T8345] ? hugepage_vma_check+0x471/0x560 [ 209.313179][ T8345] handle_mm_fault+0x2f72/0x4a50 [ 209.318190][ T8345] ? handle_mm_fault+0xe6/0x4a50 [ 209.323210][ T8345] ? numa_migrate_prep+0x350/0x350 [ 209.328403][ T8345] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 209.333758][ T8345] do_user_addr_fault+0x736/0x12d0 [ 209.338950][ T8345] exc_page_fault+0x64/0x100 [ 209.344280][ T8345] ? clear_bhb_loop+0x40/0x90 [ 209.349027][ T8345] asm_exc_page_fault+0x26/0x30 [ 209.353922][ T8345] RIP: 0033:0x7fd72b052d23 [ 209.358389][ T8345] Code: 10 4c 89 44 24 08 4c 89 0c 24 4c 8b 54 24 28 45 31 c9 48 8b 7c 24 20 48 8b 74 24 18 48 8b 54 24 10 48 8b 4c 24 08 48 8b 2c 24 <48> 8b 59 38 48 81 4b 18 80 00 00 00 e8 1c ff ff ff 48 83 ec 08 b9 [ 209.378047][ T8345] RSP: 002b:00007fd72c078fd0 EFLAGS: 00010246 [ 209.384186][ T8345] RAX: 00007fd72b052ce0 RBX: 00007fd72b425fa0 RCX: 0000000000000000 [ 209.392206][ T8345] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 209.400217][ T8345] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 209.408241][ T8345] R10: ffffffffffffffff R11: 0000000000000000 R12: 0000000000000000 [ 209.416282][ T8345] R13: 00007fd72b426038 R14: 00007fd72b425fa0 R15: 00007ffe5ae0d7b8 [ 209.424323][ T8345] [ 209.518290][ T8345] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 209.601726][ T8310] syz.4.662: attempt to access beyond end of device [ 209.601726][ T8310] loop4: rw=10241, sector=53248, nr_sectors = 8 limit=40427 [ 209.615692][ T7619] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 12 /dev/loop5 scanned by udevd (7619) [ 209.910862][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 209.986523][ T8322] loop6: detected capacity change from 0 to 40427 [ 209.995512][ T6038] syz-executor: attempt to access beyond end of device [ 209.995512][ T6038] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 210.025079][ T6038] F2FS-fs (loop4): Stopped filesystem due to reason: 3 [ 210.046022][ T8322] F2FS-fs (loop6): invalid crc value [ 210.113899][ T8322] F2FS-fs (loop6): Found nat_bits in checkpoint [ 210.140104][ T196] wlan1: Trigger new scan to find an IBSS to join [ 210.387885][ T8322] F2FS-fs (loop6): Start checkpoint disabled! [ 210.450381][ T8322] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e6 [ 211.002814][ T12] kworker/u4:1: attempt to access beyond end of device [ 211.002814][ T12] loop6: rw=2049, sector=40960, nr_sectors = 8 limit=40427 [ 211.054977][ T12] F2FS-fs (loop6): Stopped filesystem due to reason: 3 [ 211.402235][ T8382] loop5: detected capacity change from 0 to 2048 [ 211.810839][ T8395] 8021q: adding VLAN 0 to HW filter on device bond1 [ 211.818770][ T8395] bridge0: port 3(bond1) entered blocking state [ 211.830639][ T8395] bridge0: port 3(bond1) entered disabled state [ 211.841202][ T8395] bond1: entered allmulticast mode [ 211.849491][ T8395] bond1: entered promiscuous mode [ 211.858962][ T8395] bridge0: port 3(bond1) entered blocking state [ 211.865582][ T8395] bridge0: port 3(bond1) entered forwarding state [ 211.878328][ T196] bridge0: port 3(bond1) entered disabled state [ 211.966119][ T8399] loop1: detected capacity change from 0 to 256 [ 211.979887][ T5785] Bluetooth: hci0: command 0x0406 tx timeout [ 211.987020][ T5785] Bluetooth: hci2: command 0x0406 tx timeout [ 212.000143][ T8399] FAT-fs (loop1): Unrecognized mount option "shortð" or missing value [ 212.150960][ T3470] wlan1: Creating new IBSS network, BSSID 2e:c6:ac:c2:4f:3b [ 212.669185][ T8416] bridge1: entered promiscuous mode [ 212.695927][ T8416] bridge1: entered allmulticast mode [ 213.510371][ T8440] netlink: 31 bytes leftover after parsing attributes in process `syz.4.706'. [ 213.529649][ T8440] netlink: 8 bytes leftover after parsing attributes in process `syz.4.706'. [ 213.980782][ T8459] loop6: detected capacity change from 0 to 2048 [ 213.998290][ T8459] UDF-fs: error (device loop6): udf_process_sequence: Primary Volume Descriptor not found! [ 214.034424][ T8459] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 214.327142][ T8465] "syz.5.716" (8465) uses obsolete ecb(arc4) skcipher [ 214.712207][ T8476] jffs2: notice: (8476) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 215.630292][ T8486] netlink: 'syz.1.725': attribute type 11 has an invalid length. [ 216.487520][ T8503] netlink: 8 bytes leftover after parsing attributes in process `syz.6.730'. [ 217.037391][ T8516] loop1: detected capacity change from 0 to 16 [ 217.067323][ T8516] erofs: (device loop1): mounted with root inode @ nid 36. [ 217.115644][ T8516] erofs: (device loop1): z_erofs_readahead: readahead error at folio 22 @ nid 36 [ 217.148372][ T8516] erofs: (device loop1): z_erofs_readahead: readahead error at folio 21 @ nid 36 [ 217.178037][ T8516] erofs: (device loop1): z_erofs_readahead: readahead error at folio 20 @ nid 36 [ 217.233202][ T8516] erofs: (device loop1): z_erofs_readahead: readahead error at folio 18 @ nid 36 [ 217.261160][ T8521] erofs: (device loop1): erofs_find_target_block: corrupted dir block 8200 @ nid 36 [ 217.272844][ T8516] erofs: (device loop1): z_erofs_readahead: readahead error at folio 16 @ nid 36 [ 217.310984][ T8524] erofs: (device loop1): erofs_find_target_block: corrupted dir block 8200 @ nid 36 [ 217.321672][ T8516] erofs: (device loop1): z_erofs_readahead: readahead error at folio 12 @ nid 36 [ 217.390140][ T8516] erofs: (device loop1): z_erofs_readahead: readahead error at folio 9 @ nid 36 [ 217.419239][ T8516] erofs: (device loop1): z_erofs_readahead: readahead error at folio 8 @ nid 36 [ 217.463086][ T8516] syz.1.737: attempt to access beyond end of device [ 217.463086][ T8516] loop1: rw=524288, sector=67108872, nr_sectors = 16 limit=16 [ 217.516033][ T8516] syz.1.737: attempt to access beyond end of device [ 217.516033][ T8516] loop1: rw=524288, sector=720, nr_sectors = 16 limit=16 [ 217.566247][ T8528] bridge1: entered promiscuous mode [ 217.572621][ T8516] syz.1.737: attempt to access beyond end of device [ 217.572621][ T8516] loop1: rw=524288, sector=525144, nr_sectors = 16 limit=16 [ 217.577749][ T8528] bridge1: entered allmulticast mode [ 217.625550][ T8516] syz.1.737: attempt to access beyond end of device [ 217.625550][ T8516] loop1: rw=524288, sector=16, nr_sectors = 8 limit=16 [ 217.947471][ T8532] (null): rxe_set_mtu: Set mtu to 1024 [ 218.303208][ T8541] loop4: detected capacity change from 0 to 2048 [ 218.321799][ T8541] EXT4-fs: Ignoring removed nomblk_io_submit option [ 218.404315][ T8541] EXT4-fs error (device loop4): __ext4_iget:5091: inode #2: block 127754: comm syz.4.748: invalid block [ 218.504794][ T8541] EXT4-fs (loop4): get root inode failed [ 218.521749][ T8541] EXT4-fs (loop4): mount failed [ 218.615252][ T8532] infiniband syz0: set active [ 218.650010][ T8532] infiniband syz0: added team_slave_0 [ 218.694697][ T8541] Need at least one configuration in g1. [ 218.720495][ T8541] udc usbip-vudc.0: failed to start g1: -22 [ 218.749985][ T8541] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 218.771777][ T8541] UDC core: g1: couldn't find an available UDC or it's busy [ 218.854435][ T8532] RDS/IB: syz0: added [ 218.858614][ T8532] smc: adding ib device syz0 with port count 1 [ 218.887588][ T8532] smc: ib device syz0 port 1 has pnetid [ 219.455787][ T8559] loop1: detected capacity change from 0 to 4096 [ 219.598735][ T8559] ntfs3: loop1: Failed to load $Extend (-22). [ 219.617670][ T8559] ntfs3: loop1: Failed to initialize $Extend. [ 219.702062][ T27] audit: type=1800 audit(1792037051.439:9): pid=8559 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.754" name="file2" dev="loop1" ino=31 res=0 errno=0 [ 220.033149][ T8565] netlink: 'syz.4.758': attribute type 5 has an invalid length. [ 220.055451][ T8565] netlink: 'syz.4.758': attribute type 8 has an invalid length. [ 220.076344][ T8567] loop1: detected capacity change from 0 to 256 [ 221.495273][ T8592] netlink: 'syz.1.768': attribute type 25 has an invalid length. [ 221.525019][ T8592] netlink: 4 bytes leftover after parsing attributes in process `syz.1.768'. [ 221.537236][ T8592] netlink: 'syz.1.768': attribute type 25 has an invalid length. [ 221.548220][ T8592] netlink: 4 bytes leftover after parsing attributes in process `syz.1.768'. [ 221.564242][ T5865] IPVS: starting estimator thread 0... [ 221.660600][ T8596] IPVS: using max 17 ests per chain, 40800 per kthread [ 221.684866][ T8599] netlink: 48 bytes leftover after parsing attributes in process `syz.6.771'. [ 221.701183][ T8599] bridge_slave_0: left allmulticast mode [ 221.715764][ T8599] bridge_slave_0: left promiscuous mode [ 221.721231][ T8602] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 221.732408][ T8599] bridge0: port 1(bridge_slave_0) entered disabled state [ 221.846604][ T8604] netlink: 8 bytes leftover after parsing attributes in process `syz.1.774'. [ 221.880394][ T8604] bond2: option ad_actor_sys_prio: invalid value (0) [ 221.887261][ T8604] bond2: option ad_actor_sys_prio: allowed values 1 - 65535 [ 221.907837][ T8604] bond2 (unregistering): Released all slaves [ 222.444504][ T8626] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 222.474105][ T8628] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 222.505129][ T8626] bond1: (slave lo): Enslaving as an active interface with an up link [ 222.535251][ T8626] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 222.849890][ T8641] loop4: detected capacity change from 0 to 512 [ 222.857483][ T8641] EXT4-fs: inline encryption not supported [ 222.897840][ T8641] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 222.972144][ T8641] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2 [ 223.009283][ T8641] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.789: invalid indirect mapped block 2683928664 (level 1) [ 223.034137][ T8641] EXT4-fs (loop4): 1 truncate cleaned up [ 223.043968][ T8641] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 223.756833][ T8668] loop6: detected capacity change from 0 to 512 [ 223.778207][ T8668] EXT4-fs (loop6): Test dummy encryption mode enabled [ 223.784727][ T6038] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 223.800866][ T8668] EXT4-fs error (device loop6): ext4_orphan_get:1408: inode #15: comm syz.6.798: inode has both inline data and extents flags [ 223.820211][ T8668] EXT4-fs error (device loop6): ext4_orphan_get:1413: comm syz.6.798: couldn't read orphan inode 15 (err -117) [ 223.857851][ T8668] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 224.090066][ T8668] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 224.256896][ T7280] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 224.257243][ T8683] loop5: detected capacity change from 0 to 7 [ 224.309278][ T8683] Dev loop5: unable to read RDB block 7 [ 224.319037][ T8683] loop5: AHDI p1 p2 p3 [ 224.339438][ T8683] loop5: partition table partially beyond EOD, truncated [ 224.355087][ T8683] loop5: p1 start 5472580 is beyond EOD, truncated [ 224.368745][ T8683] loop5: p2 start 167772160 is beyond EOD, truncated [ 224.736548][ T8701] loop4: detected capacity change from 0 to 256 [ 224.946335][ T8707] FAULT_INJECTION: forcing a failure. [ 224.946335][ T8707] name failslab, interval 1, probability 0, space 0, times 0 [ 224.967643][ T8707] CPU: 0 PID: 8707 Comm: syz.5.813 Not tainted syzkaller #0 [ 224.975035][ T8707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 224.985157][ T8707] Call Trace: [ 224.988492][ T8707] [ 224.991496][ T8707] dump_stack_lvl+0x18c/0x250 [ 224.996235][ T8707] ? show_regs_print_info+0x20/0x20 [ 225.001499][ T8707] ? load_image+0x420/0x420 [ 225.006077][ T8707] ? __might_sleep+0xe0/0xe0 [ 225.010765][ T8707] ? __lock_acquire+0x7eb0/0x7eb0 [ 225.015873][ T8707] should_fail_ex+0x394/0x4c0 [ 225.020632][ T8707] should_failslab+0x9/0x20 [ 225.025216][ T8707] slab_pre_alloc_hook+0x59/0x300 [ 225.030310][ T8707] ? do_raw_spin_unlock+0x121/0x230 [ 225.035594][ T8707] kmem_cache_alloc+0x5a/0x2c0 [ 225.040432][ T8707] ? alloc_empty_file+0x9e/0x1d0 [ 225.045445][ T8707] alloc_empty_file+0x9e/0x1d0 [ 225.050282][ T8707] dentry_open+0x4b/0x100 [ 225.054791][ T8707] do_mq_open+0x657/0x760 [ 225.059198][ T8707] ? mq_clear_sbinfo+0x90/0x90 [ 225.064045][ T8707] __x64_sys_mq_open+0x186/0x1e0 [ 225.069083][ T8707] ? proc_ipc_sem_dointvec+0x180/0x180 [ 225.074657][ T8707] ? lockdep_hardirqs_on+0x98/0x150 [ 225.079941][ T8707] do_syscall_64+0x55/0xb0 [ 225.084400][ T8707] ? clear_bhb_loop+0x40/0x90 [ 225.089272][ T8707] ? clear_bhb_loop+0x40/0x90 [ 225.094007][ T8707] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 225.099964][ T8707] RIP: 0033:0x7f6bedd9e559 [ 225.104432][ T8707] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 225.124097][ T8707] RSP: 002b:00007f6beec7e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 225.132582][ T8707] RAX: ffffffffffffffda RBX: 00007f6bee025fa0 RCX: 00007f6bedd9e559 [ 225.140602][ T8707] RDX: 00000000000000e8 RSI: 0000000000000040 RDI: 00002000000000c0 [ 225.148635][ T8707] RBP: 00007f6bede358b0 R08: 0000000000000000 R09: 0000000000000000 [ 225.156658][ T8707] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 225.164671][ T8707] R13: 00007f6bee026038 R14: 00007f6bee025fa0 R15: 00007ffc28ae0578 [ 225.172698][ T8707] [ 225.270964][ T5842] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 225.468510][ T5842] usb 7-1: Using ep0 maxpacket: 8 [ 225.477530][ T5842] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 225.490150][ T8716] netlink: 'syz.5.817': attribute type 8 has an invalid length. [ 225.499963][ T5842] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 225.506282][ T8716] netlink: 4 bytes leftover after parsing attributes in process `syz.5.817'. [ 225.522388][ T5842] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 225.544678][ T5842] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 225.563469][ T8716] netlink: 8 bytes leftover after parsing attributes in process `syz.5.817'. [ 225.564340][ T5842] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 225.596701][ T8721] ip_tables: iptables: counters copy to user failed while replacing table [ 225.632108][ T5842] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 225.650091][ T5842] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.916615][ T5842] usb 7-1: usb_control_msg returned -32 [ 225.932090][ T5842] usbtmc 7-1:16.0: can't read capabilities [ 226.366014][ T8745] FAULT_INJECTION: forcing a failure. [ 226.366014][ T8745] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 226.372878][ T5841] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 226.396862][ T8745] CPU: 0 PID: 8745 Comm: syz.5.829 Not tainted syzkaller #0 [ 226.404253][ T8745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 226.414347][ T8745] Call Trace: [ 226.417676][ T8745] [ 226.420671][ T8745] dump_stack_lvl+0x18c/0x250 [ 226.425417][ T8745] ? show_regs_print_info+0x20/0x20 [ 226.430656][ T8745] ? load_image+0x420/0x420 [ 226.435238][ T8745] ? __might_fault+0xaa/0x120 [ 226.439987][ T8745] ? __lock_acquire+0x7eb0/0x7eb0 [ 226.445107][ T8745] should_fail_ex+0x394/0x4c0 [ 226.449885][ T8745] _copy_from_user+0x2f/0xe0 [ 226.454539][ T8745] __se_sys_copy_file_range+0x12f/0x470 [ 226.460180][ T8745] ? __x64_sys_copy_file_range+0xf0/0xf0 [ 226.465876][ T8745] ? __x64_sys_copy_file_range+0x21/0xf0 [ 226.471543][ T8745] do_syscall_64+0x55/0xb0 [ 226.476036][ T8745] ? clear_bhb_loop+0x40/0x90 [ 226.480784][ T8745] ? clear_bhb_loop+0x40/0x90 [ 226.485562][ T8745] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 226.491588][ T8745] RIP: 0033:0x7f6bedd9e559 [ 226.496050][ T8745] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 226.515711][ T8745] RSP: 002b:00007f6beec7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000146 [ 226.524178][ T8745] RAX: ffffffffffffffda RBX: 00007f6bee025fa0 RCX: 00007f6bedd9e559 [ 226.532208][ T8745] RDX: 0000000000000003 RSI: 0000200000000180 RDI: 0000000000000003 [ 226.540258][ T8745] RBP: 00007f6bede358b0 R08: 0000000000000100 R09: 0000000000000000 [ 226.548425][ T8745] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 226.556468][ T8745] R13: 00007f6bee026038 R14: 00007f6bee025fa0 R15: 00007ffc28ae0578 [ 226.564540][ T8745] [ 226.603403][ T5841] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 226.626960][ T5841] usb 2-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice= 1.00 [ 226.649813][ T5841] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 226.657921][ T5841] usb 2-1: Product: syz [ 226.669831][ T5841] usb 2-1: Manufacturer: syz [ 226.703179][ T5841] usb 2-1: selecting invalid altsetting 1 [ 226.722847][ T5841] dvb_ttusb_budget: ttusb_init_controller: error [ 226.729291][ T5841] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 226.818378][ T5841] DVB: Unable to find symbol cx22700_attach() [ 226.872574][ T5841] DVB: Unable to find symbol tda10046_attach() [ 226.878842][ T5841] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 226.956188][ T5842] usb 7-1: USB disconnect, device number 4 [ 227.054906][ T8736] dvb_ttusb_budget: failed urb submission (0: err = -2)! [ 227.085611][ T8] usb 2-1: USB disconnect, device number 7 [ 227.343863][ T5782] Bluetooth: hci3: command 0x0406 tx timeout [ 227.725367][ T8776] FAULT_INJECTION: forcing a failure. [ 227.725367][ T8776] name failslab, interval 1, probability 0, space 0, times 0 [ 227.749784][ T8776] CPU: 0 PID: 8776 Comm: syz.5.840 Not tainted syzkaller #0 [ 227.757301][ T8776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 227.767425][ T8776] Call Trace: [ 227.770769][ T8776] [ 227.773758][ T8776] dump_stack_lvl+0x18c/0x250 [ 227.778508][ T8776] ? show_regs_print_info+0x20/0x20 [ 227.783769][ T8776] ? load_image+0x420/0x420 [ 227.788373][ T8776] ? __might_sleep+0xe0/0xe0 [ 227.793038][ T8776] ? __lock_acquire+0x7eb0/0x7eb0 [ 227.798124][ T8776] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 227.804277][ T8776] should_fail_ex+0x394/0x4c0 [ 227.809027][ T8776] should_failslab+0x9/0x20 [ 227.813596][ T8776] slab_pre_alloc_hook+0x59/0x300 [ 227.818691][ T8776] ? alloc_super+0x5a/0x910 [ 227.823254][ T8776] __kmem_cache_alloc_node+0x53/0x250 [ 227.828698][ T8776] ? __lock_acquire+0x7eb0/0x7eb0 [ 227.833879][ T8776] ? alloc_super+0x5a/0x910 [ 227.839208][ T8776] kmalloc_trace+0x2a/0xe0 [ 227.843700][ T8776] alloc_super+0x5a/0x910 [ 227.848091][ T8776] ? kill_litter_super+0xb0/0xb0 [ 227.853092][ T8776] ? kill_litter_super+0xb0/0xb0 [ 227.858102][ T8776] sget_fc+0x325/0x8d0 [ 227.862322][ T8776] ? kill_litter_super+0xb0/0xb0 [ 227.867321][ T8776] ? mqueue_get_tree+0xf0/0xf0 [ 227.872151][ T8776] get_tree_nodev+0x2a/0x140 [ 227.876898][ T8776] vfs_get_tree+0x8c/0x280 [ 227.881464][ T8776] fc_mount+0x1c/0xb0 [ 227.885621][ T8776] mq_init_ns+0x3a1/0x510 [ 227.890019][ T8776] copy_ipcs+0x309/0x500 [ 227.894328][ T8776] create_new_namespaces+0x212/0x700 [ 227.899690][ T8776] unshare_nsproxy_namespaces+0x11a/0x160 [ 227.905497][ T8776] ksys_unshare+0x4fa/0x8f0 [ 227.910088][ T8776] ? sighand_ctor+0x50/0x50 [ 227.915190][ T8776] ? lock_chain_count+0x20/0x20 [ 227.920796][ T8776] ? syscall_enter_from_user_mode+0x25/0x80 [ 227.926762][ T8776] __x64_sys_unshare+0x38/0x40 [ 227.931591][ T8776] do_syscall_64+0x55/0xb0 [ 227.936065][ T8776] ? clear_bhb_loop+0x40/0x90 [ 227.940795][ T8776] ? clear_bhb_loop+0x40/0x90 [ 227.945533][ T8776] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 227.951493][ T8776] RIP: 0033:0x7f6bedd9e559 [ 227.955976][ T8776] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 227.975638][ T8776] RSP: 002b:00007f6beec7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 227.984124][ T8776] RAX: ffffffffffffffda RBX: 00007f6bee025fa0 RCX: 00007f6bedd9e559 [ 227.992157][ T8776] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006a040000 [ 228.000181][ T8776] RBP: 00007f6bede358b0 R08: 0000000000000000 R09: 0000000000000000 [ 228.008651][ T8776] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 228.016703][ T8776] R13: 00007f6bee026038 R14: 00007f6bee025fa0 R15: 00007ffc28ae0578 [ 228.024761][ T8776] [ 228.174191][ T5842] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 228.235589][ T5842] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 228.527350][ T8792] loop1: detected capacity change from 0 to 512 [ 228.596804][ T8792] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 228.659371][ T8792] ext4 filesystem being mounted at /250/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 228.772633][ T8792] xt_hashlimit: size too large, truncated to 1048576 [ 228.877402][ T8784] loop4: detected capacity change from 0 to 40427 [ 228.895919][ T8784] F2FS-fs (loop4): invalid crc value [ 228.914966][ T8784] F2FS-fs (loop4): Found nat_bits in checkpoint [ 229.104617][ T8784] F2FS-fs (loop4): Start checkpoint disabled! [ 229.158850][ T8784] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 229.382023][ T8803] netlink: 'syz.5.848': attribute type 1 has an invalid length. [ 229.410294][ T8803] netlink: 'syz.5.848': attribute type 2 has an invalid length. [ 229.429978][ T8803] netlink: 244 bytes leftover after parsing attributes in process `syz.5.848'. [ 229.900538][ T2965] kworker/u4:7: attempt to access beyond end of device [ 229.900538][ T2965] loop4: rw=2049, sector=40960, nr_sectors = 8 limit=40427 [ 229.919998][ T2965] F2FS-fs (loop4): Stopped filesystem due to reason: 3 [ 230.002061][ T8817] FAULT_INJECTION: forcing a failure. [ 230.002061][ T8817] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 230.025433][ T8817] CPU: 0 PID: 8817 Comm: syz.6.855 Not tainted syzkaller #0 [ 230.032820][ T8817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 230.042946][ T8817] Call Trace: [ 230.046284][ T8817] [ 230.049263][ T8817] dump_stack_lvl+0x18c/0x250 [ 230.054020][ T8817] ? show_regs_print_info+0x20/0x20 [ 230.059413][ T8817] ? load_image+0x420/0x420 [ 230.063985][ T8817] ? __might_fault+0xaa/0x120 [ 230.068732][ T8817] ? __lock_acquire+0x7eb0/0x7eb0 [ 230.073822][ T8817] ? __virt_addr_valid+0x10c/0x380 [ 230.079130][ T8817] should_fail_ex+0x394/0x4c0 [ 230.083917][ T8817] _copy_from_user+0x2f/0xe0 [ 230.088576][ T8817] memdup_user+0x64/0xc0 [ 230.092885][ T8817] __se_sys_kexec_load+0x109/0x160 [ 230.098075][ T8817] do_syscall_64+0x55/0xb0 [ 230.102592][ T8817] ? clear_bhb_loop+0x40/0x90 [ 230.107335][ T8817] ? clear_bhb_loop+0x40/0x90 [ 230.112069][ T8817] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 230.118035][ T8817] RIP: 0033:0x7f493fb9e559 [ 230.122502][ T8817] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 230.142171][ T8817] RSP: 002b:00007f4940b35028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f6 [ 230.150642][ T8817] RAX: ffffffffffffffda RBX: 00007f493fe25fa0 RCX: 00007f493fb9e559 [ 230.158667][ T8817] RDX: 0000200000000600 RSI: 0000000000000004 RDI: 0000000000000003 [ 230.166677][ T8817] RBP: 00007f493fc358b0 R08: 0000000000000000 R09: 0000000000000000 [ 230.174784][ T8817] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 230.182794][ T8817] R13: 00007f493fe26038 R14: 00007f493fe25fa0 R15: 00007ffe44a663d8 [ 230.190846][ T8817] [ 230.349832][ T5842] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 230.552249][ T5842] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 230.572618][ T5842] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 230.603691][ T5842] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 230.629827][ T5842] usb 6-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 230.649261][ T5842] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.675150][ T8815] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 230.683859][ T8815] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 230.722521][ T5842] pl2303 6-1:1.0: pl2303 converter detected [ 230.745158][ T5842] usb 6-1: pl2303 converter now attached to ttyUSB0 [ 231.110064][ T8815] pl2303 6-1:1.0: pl2303_vendor_write - failed to write [0007]: -110 [ 231.127422][ T8815] pl2303 ttyUSB0: pl2303_get_line_request - failed: -32 [ 231.144371][ T8815] pl2303 ttyUSB0: pl2303_set_line_request - failed: -32 [ 231.163189][ T8815] pl2303 6-1:1.0: pl2303_vendor_read - failed to read [000a]: -32 [ 231.181284][ T8815] pl2303 ttyUSB0: pl2303_set_control_lines - failed: -32 [ 231.491698][ T8815] pl2303 ttyUSB0: pl2303_set_control_lines - failed: -32 [ 231.522636][ T8815] pl2303 ttyUSB0: error sending break = -32 [ 231.717477][ T5865] usb 6-1: USB disconnect, device number 4 [ 231.752470][ T5865] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 231.780939][ T5865] pl2303 6-1:1.0: device disconnected [ 232.131889][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 232.377533][ T8848] Bluetooth: MGMT ver 1.22 [ 232.518486][ T8854] loop4: detected capacity change from 0 to 512 [ 232.538000][ T8854] EXT4-fs (loop4): Test dummy encryption mode enabled [ 232.576993][ T8854] EXT4-fs error (device loop4): ext4_orphan_get:1408: inode #15: comm syz.4.871: inode has both inline data and extents flags [ 232.629200][ T8858] loop1: detected capacity change from 0 to 512 [ 232.630949][ T8854] EXT4-fs error (device loop4): ext4_orphan_get:1413: comm syz.4.871: couldn't read orphan inode 15 (err -117) [ 232.645078][ T8858] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 232.746617][ T8854] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 232.992445][ T8865] netlink: 'syz.5.875': attribute type 1 has an invalid length. [ 233.040876][ T8865] 8021q: adding VLAN 0 to HW filter on device bond1 [ 233.277506][ T6038] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 233.392202][ T8872] loop4: detected capacity change from 0 to 512 [ 233.435021][ T8872] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 233.462089][ T8872] ext4 filesystem being mounted at /193/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 233.760103][ T6038] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 233.800429][ T8878] Illegal XDP return value 4294967274 on prog (id 88) dev N/A, expect packet loss! [ 234.004851][ T8884] netlink: 8 bytes leftover after parsing attributes in process `syz.1.882'. [ 234.114498][ T8890] input: syz0 as /devices/virtual/input/input9 [ 234.763898][ T27] audit: type=1326 audit(1792037066.499:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8907 comm="syz.1.892" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd72b19e559 code=0x0 [ 235.141352][ T8922] FAULT_INJECTION: forcing a failure. [ 235.141352][ T8922] name failslab, interval 1, probability 0, space 0, times 0 [ 235.160004][ T8922] CPU: 1 PID: 8922 Comm: syz.4.898 Not tainted syzkaller #0 [ 235.167380][ T8922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 235.177494][ T8922] Call Trace: [ 235.180823][ T8922] [ 235.183805][ T8922] dump_stack_lvl+0x18c/0x250 [ 235.188588][ T8922] ? show_regs_print_info+0x20/0x20 [ 235.193854][ T8922] ? load_image+0x420/0x420 [ 235.198435][ T8922] ? __might_sleep+0xe0/0xe0 [ 235.203092][ T8922] ? __lock_acquire+0x7eb0/0x7eb0 [ 235.208201][ T8922] should_fail_ex+0x394/0x4c0 [ 235.212974][ T8922] should_failslab+0x9/0x20 [ 235.217547][ T8922] slab_pre_alloc_hook+0x59/0x300 [ 235.222728][ T8922] ? kvmalloc_node+0x70/0x180 [ 235.227465][ T8922] ? kvmalloc_node+0x70/0x180 [ 235.232205][ T8922] __kmem_cache_alloc_node+0x53/0x250 [ 235.237657][ T8922] ? kvmalloc_node+0x70/0x180 [ 235.242398][ T8922] __kmalloc_node+0xa6/0x240 [ 235.247042][ T8922] kvmalloc_node+0x70/0x180 [ 235.251588][ T8922] bpf_test_run_xdp_live+0x1e9/0x1b30 [ 235.257028][ T8922] ? verify_lock_unused+0x140/0x140 [ 235.262287][ T8922] ? kasan_set_track+0x4e/0x70 [ 235.267089][ T8922] ? __kasan_kmalloc+0x8f/0xa0 [ 235.272062][ T8922] ? __kmalloc+0xb7/0x240 [ 235.276436][ T8922] ? bpf_test_init+0x9f/0x140 [ 235.281157][ T8922] ? bpf_prog_test_run+0x31f/0x390 [ 235.286323][ T8922] ? __sys_bpf+0x49d/0x890 [ 235.290773][ T8922] ? __x64_sys_bpf+0x7c/0x90 [ 235.295398][ T8922] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 235.301515][ T8922] ? xdp_convert_md_to_buff+0x330/0x330 [ 235.307106][ T8922] ? __lock_acquire+0x7eb0/0x7eb0 [ 235.312179][ T8922] ? __virt_addr_valid+0x10c/0x380 [ 235.317339][ T8922] ? trace_raw_output_bpf_test_finish+0xd0/0xd0 [ 235.323622][ T8922] ? _copy_from_user+0xa5/0xe0 [ 235.328423][ T8922] ? bpf_test_init+0x119/0x140 [ 235.333238][ T8922] ? xdp_convert_md_to_buff+0x5b/0x330 [ 235.338737][ T8922] bpf_prog_test_run_xdp+0x7d8/0x1140 [ 235.344158][ T8922] ? __lock_acquire+0x7eb0/0x7eb0 [ 235.349242][ T8922] ? dev_put+0x80/0x80 [ 235.353361][ T8922] ? dev_put+0x80/0x80 [ 235.357470][ T8922] bpf_prog_test_run+0x31f/0x390 [ 235.362468][ T8922] __sys_bpf+0x49d/0x890 [ 235.366748][ T8922] ? bpf_link_show_fdinfo+0x560/0x560 [ 235.372192][ T8922] ? lock_chain_count+0x20/0x20 [ 235.377091][ T8922] __x64_sys_bpf+0x7c/0x90 [ 235.382281][ T8922] do_syscall_64+0x55/0xb0 [ 235.386750][ T8922] ? clear_bhb_loop+0x40/0x90 [ 235.391477][ T8922] ? clear_bhb_loop+0x40/0x90 [ 235.396200][ T8922] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 235.402144][ T8922] RIP: 0033:0x7fd911f9e559 [ 235.406604][ T8922] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 235.426257][ T8922] RSP: 002b:00007fd912efd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 235.434714][ T8922] RAX: ffffffffffffffda RBX: 00007fd912225fa0 RCX: 00007fd911f9e559 [ 235.442730][ T8922] RDX: 0000000000000050 RSI: 0000200000000c00 RDI: 000000000000000a [ 235.450777][ T8922] RBP: 00007fd9120358b0 R08: 0000000000000000 R09: 0000000000000000 [ 235.458783][ T8922] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 235.466784][ T8922] R13: 00007fd912226038 R14: 00007fd912225fa0 R15: 00007ffcde68fa98 [ 235.474812][ T8922] [ 235.959905][ T5841] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 236.151919][ T5841] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 236.167855][ T5841] usb 7-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 236.177867][ T5841] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 236.224690][ T5841] as10x_usb: device has been detected [ 236.244499][ T5841] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 236.314226][ T5841] usb 7-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 236.397413][ T5841] as10x_usb: error during firmware upload part1 [ 236.415153][ T5841] Registered device Abilis Systems DVB-Titan [ 236.839694][ C0] sched: RT throttling activated [ 237.031728][ T8936] loop1: detected capacity change from 0 to 131072 [ 237.045627][ T8936] F2FS-fs (loop1): invalid crc value [ 237.071000][ T8936] F2FS-fs (loop1): Found nat_bits in checkpoint [ 237.129864][ T8936] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 237.151949][ T28] usb 7-1: USB disconnect, device number 5 [ 237.163435][ T8948] FAULT_INJECTION: forcing a failure. [ 237.163435][ T8948] name failslab, interval 1, probability 0, space 0, times 0 [ 237.176375][ T8948] CPU: 0 PID: 8948 Comm: syz.4.907 Not tainted syzkaller #0 [ 237.183739][ T8948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 237.193873][ T8948] Call Trace: [ 237.197192][ T8948] [ 237.200167][ T8948] dump_stack_lvl+0x18c/0x250 [ 237.204894][ T8948] ? show_regs_print_info+0x20/0x20 [ 237.210139][ T8948] ? load_image+0x420/0x420 [ 237.214730][ T8948] ? __might_sleep+0xe0/0xe0 [ 237.219380][ T8948] ? __lock_acquire+0x7eb0/0x7eb0 [ 237.224455][ T8948] ? trace_raw_output_percpu_destroy_chunk+0xc0/0xc0 [ 237.231181][ T8948] should_fail_ex+0x394/0x4c0 [ 237.235910][ T8948] should_failslab+0x9/0x20 [ 237.240461][ T8948] slab_pre_alloc_hook+0x59/0x300 [ 237.245551][ T8948] ? pcpu_alloc+0x11e7/0x1880 [ 237.250286][ T8948] ? percpu_ref_init+0xc3/0x340 [ 237.255184][ T8948] __kmem_cache_alloc_node+0x53/0x250 [ 237.260674][ T8948] ? percpu_ref_init+0xc3/0x340 [ 237.265600][ T8948] ? io_allocate_scq_urings+0x620/0x620 [ 237.271205][ T8948] kmalloc_trace+0x2a/0xe0 [ 237.275676][ T8948] percpu_ref_init+0xc3/0x340 [ 237.280395][ T8948] io_ring_ctx_alloc+0x205/0xc10 [ 237.285374][ T8948] io_uring_create+0x2df/0x1330 [ 237.290262][ T8948] ? __might_fault+0xc6/0x120 [ 237.295077][ T8948] ? __might_fault+0xaa/0x120 [ 237.299799][ T8948] __se_sys_io_uring_setup+0x29f/0x2b0 [ 237.305312][ T8948] ? __x64_sys_io_uring_setup+0x60/0x60 [ 237.310921][ T8948] ? lockdep_hardirqs_on+0x98/0x150 [ 237.316179][ T8948] do_syscall_64+0x55/0xb0 [ 237.320638][ T8948] ? clear_bhb_loop+0x40/0x90 [ 237.325361][ T8948] ? clear_bhb_loop+0x40/0x90 [ 237.330077][ T8948] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 237.336019][ T8948] RIP: 0033:0x7fd911f9e559 [ 237.340474][ T8948] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 237.360120][ T8948] RSP: 002b:00007fd912efcfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 237.368596][ T8948] RAX: ffffffffffffffda RBX: 0000200000000200 RCX: 00007fd911f9e559 [ 237.376790][ T8948] RDX: 00002000000002c0 RSI: 0000200000000200 RDI: 000000000000424a [ 237.384820][ T8948] RBP: 00007fd9120358b0 R08: 0000000000000000 R09: 0000000000000000 [ 237.392834][ T8948] R10: 0000200000000300 R11: 0000000000000206 R12: 00002000000002c0 [ 237.401282][ T8948] R13: 0000200000000300 R14: 0000200000000280 R15: 00007ffcde68fa98 [ 237.409300][ T8948] [ 237.502195][ T28] Unregistered device Abilis Systems DVB-Titan [ 237.508028][ T28] as10x_usb: device has been disconnected [ 238.694966][ T8969] netlink: 8 bytes leftover after parsing attributes in process `syz.1.916'. [ 238.830059][ T28] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 239.015577][ T28] usb 5-1: Using ep0 maxpacket: 32 [ 239.034368][ T28] usb 5-1: unable to get BOS descriptor or descriptor too short [ 239.051399][ T28] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 239.069973][ T28] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 239.092551][ T28] usb 5-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 239.107328][ T28] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.126344][ T28] usb 5-1: Product: syz [ 239.136592][ T28] usb 5-1: Manufacturer: syz [ 239.148732][ T28] usb 5-1: SerialNumber: syz [ 239.540254][ T5865] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 239.592781][ T28] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 239.688584][ T28] snd-usb-audio: probe of 5-1:1.0 failed with error -22 [ 239.742535][ T5865] usb 6-1: config 0 interface 0 has no altsetting 0 [ 239.764705][ T5865] usb 6-1: New USB device found, idVendor=1a34, idProduct=f705, bcdDevice= 0.00 [ 239.766605][ T7619] udevd[7619]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 239.795183][ T5865] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 239.844719][ T5865] usb 6-1: config 0 descriptor?? [ 239.956849][ T28] usb 5-1: USB disconnect, device number 9 [ 240.173204][ T8991] loop1: detected capacity change from 0 to 40427 [ 240.222383][ T8991] F2FS-fs (loop1): invalid crc value [ 240.263733][ T8991] F2FS-fs (loop1): Found nat_bits in checkpoint [ 240.461072][ T8991] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 240.560900][ T5865] usbhid 6-1:0.0: can't add hid device: -71 [ 240.567063][ T5865] usbhid: probe of 6-1:0.0 failed with error -71 [ 240.611055][ T5865] usb 6-1: USB disconnect, device number 5 [ 240.744127][ T9007] FAULT_INJECTION: forcing a failure. [ 240.744127][ T9007] name failslab, interval 1, probability 0, space 0, times 0 [ 240.819803][ T9007] CPU: 1 PID: 9007 Comm: syz.4.926 Not tainted syzkaller #0 [ 240.827203][ T9007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 240.837409][ T9007] Call Trace: [ 240.840860][ T9007] [ 240.843837][ T9007] dump_stack_lvl+0x18c/0x250 [ 240.848576][ T9007] ? show_regs_print_info+0x20/0x20 [ 240.853841][ T9007] ? load_image+0x420/0x420 [ 240.858419][ T9007] ? __might_sleep+0xe0/0xe0 [ 240.863075][ T9007] ? __lock_acquire+0x7eb0/0x7eb0 [ 240.868170][ T9007] should_fail_ex+0x394/0x4c0 [ 240.872922][ T9007] should_failslab+0x9/0x20 [ 240.877499][ T9007] slab_pre_alloc_hook+0x59/0x300 [ 240.882588][ T9007] kmem_cache_alloc+0x5a/0x2c0 [ 240.887426][ T9007] ? do_timer_create+0x19d/0x1300 [ 240.892525][ T9007] do_timer_create+0x19d/0x1300 [ 240.897450][ T9007] ? __might_fault+0xaa/0x120 [ 240.902190][ T9007] ? __lock_acquire+0x7eb0/0x7eb0 [ 240.907287][ T9007] ? __ia32_sys_clock_nanosleep_time32+0xb0/0xb0 [ 240.913701][ T9007] ? __might_fault+0xaa/0x120 [ 240.918435][ T9007] ? __might_fault+0xc6/0x120 [ 240.923152][ T9007] ? __might_fault+0xaa/0x120 [ 240.927869][ T9007] __x64_sys_timer_create+0x16a/0x1c0 [ 240.933287][ T9007] ? posix_timer_event+0x100/0x100 [ 240.938438][ T9007] ? lockdep_hardirqs_on+0x98/0x150 [ 240.943671][ T9007] do_syscall_64+0x55/0xb0 [ 240.948128][ T9007] ? clear_bhb_loop+0x40/0x90 [ 240.952847][ T9007] ? clear_bhb_loop+0x40/0x90 [ 240.957565][ T9007] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 240.963587][ T9007] RIP: 0033:0x7fd911f9e559 [ 240.968034][ T9007] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 240.987769][ T9007] RSP: 002b:00007fd912efd028 EFLAGS: 00000246 ORIG_RAX: 00000000000000de [ 240.996233][ T9007] RAX: ffffffffffffffda RBX: 00007fd912225fa0 RCX: 00007fd911f9e559 [ 241.004251][ T9007] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000000 [ 241.012265][ T9007] RBP: 00007fd9120358b0 R08: 0000000000000000 R09: 0000000000000000 [ 241.020272][ T9007] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 241.028275][ T9007] R13: 00007fd912226038 R14: 00007fd912225fa0 R15: 00007ffcde68fa98 [ 241.036315][ T9007] [ 241.182051][ T5775] syz-executor: attempt to access beyond end of device [ 241.182051][ T5775] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 241.218331][ T5775] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 241.592332][ T9024] netlink: 'syz.5.934': attribute type 1 has an invalid length. [ 241.594233][ T9022] loop6: detected capacity change from 0 to 512 [ 241.644031][ T9024] 8021q: adding VLAN 0 to HW filter on device bond2 [ 241.713899][ T9024] bond2: (slave gretap1): making interface the new active one [ 241.726190][ T9024] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 241.764111][ T9022] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 241.851101][ T9022] ext4 filesystem being mounted at /128/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 242.068177][ T7280] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 242.582913][ T9034] loop1: detected capacity change from 0 to 32768 [ 242.629402][ T9034] XFS (loop1): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 242.781957][ T9034] XFS (loop1): Ending clean mount [ 242.832950][ T9034] XFS (loop1): Quotacheck needed: Please wait. [ 242.924571][ T9034] XFS (loop1): Quotacheck: Done. [ 242.995807][ T9054] 9pnet: p9_errstr2errno: server reported unknown error 0xffffffffffffffff [ 243.024083][ T5775] XFS (loop1): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 245.337733][ T9101] loop5: detected capacity change from 0 to 512 [ 245.368974][ T9103] netlink: 8 bytes leftover after parsing attributes in process `syz.6.967'. [ 245.437395][ T9101] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 245.463755][ T9101] ext4 filesystem being mounted at /138/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 245.668884][ T9111] loop4: detected capacity change from 0 to 256 [ 245.689492][ T9110] FAULT_INJECTION: forcing a failure. [ 245.689492][ T9110] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 245.723747][ T9110] CPU: 0 PID: 9110 Comm: syz.6.960 Not tainted syzkaller #0 [ 245.731135][ T9110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 245.741267][ T9110] Call Trace: [ 245.744695][ T9110] [ 245.747735][ T9110] dump_stack_lvl+0x18c/0x250 [ 245.752559][ T9110] ? show_regs_print_info+0x20/0x20 [ 245.757808][ T9110] ? load_image+0x420/0x420 [ 245.762368][ T9110] ? __might_fault+0xaa/0x120 [ 245.767107][ T9110] ? __lock_acquire+0x7eb0/0x7eb0 [ 245.772172][ T9110] ? __virt_addr_valid+0x10c/0x380 [ 245.777331][ T9110] should_fail_ex+0x394/0x4c0 [ 245.782068][ T9110] _copy_to_user+0x2f/0xa0 [ 245.786529][ T9110] bpf_verifier_vlog+0x4e6/0x840 [ 245.791528][ T9110] __btf_verifier_log+0xe3/0x140 [ 245.796515][ T9110] ? sort_r+0x17f5/0x1810 [ 245.800894][ T9110] ? btf_check_sec_info+0x350/0x350 [ 245.806179][ T9110] btf_datasec_check_meta+0x70b/0xb50 [ 245.811634][ T9110] btf_check_all_metas+0x371/0xaf0 [ 245.816800][ T9110] btf_parse_type_sec+0xfc/0x1960 [ 245.821865][ T9110] ? btf_check_sec_info+0x350/0x350 [ 245.827113][ T9110] ? __virt_addr_valid+0x10c/0x380 [ 245.832280][ T9110] ? btf_verifier_log+0x1a0/0x1a0 [ 245.837370][ T9110] ? btf_parse_hdr+0x545/0x700 [ 245.842183][ T9110] ? btf_parse_str_sec+0x20d/0x2a0 [ 245.847342][ T9110] btf_new_fd+0x440/0x9e0 [ 245.851732][ T9110] ? bpf_btf_show_fdinfo+0x80/0x80 [ 245.857178][ T9110] ? capable+0x88/0xe0 [ 245.861306][ T9110] __sys_bpf+0x670/0x890 [ 245.865612][ T9110] ? bpf_link_show_fdinfo+0x560/0x560 [ 245.871076][ T9110] ? lock_chain_count+0x20/0x20 [ 245.875975][ T9110] __x64_sys_bpf+0x7c/0x90 [ 245.880442][ T9110] do_syscall_64+0x55/0xb0 [ 245.884913][ T9110] ? clear_bhb_loop+0x40/0x90 [ 245.889635][ T9110] ? clear_bhb_loop+0x40/0x90 [ 245.894366][ T9110] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 245.900318][ T9110] RIP: 0033:0x7f493fb9e559 [ 245.904793][ T9110] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 245.924455][ T9110] RSP: 002b:00007f4940b35028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 245.932912][ T9110] RAX: ffffffffffffffda RBX: 00007f493fe25fa0 RCX: 00007f493fb9e559 [ 245.940939][ T9110] RDX: 0000000000000028 RSI: 0000200000001b40 RDI: 0000000000000012 [ 245.948980][ T9110] RBP: 00007f493fc358b0 R08: 0000000000000000 R09: 0000000000000000 [ 245.957017][ T9110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 245.965048][ T9110] R13: 00007f493fe26038 R14: 00007f493fe25fa0 R15: 00007ffe44a663d8 [ 245.973172][ T9110] [ 245.991959][ T9111] exFAT-fs (loop4): invalid fs_name [ 245.997250][ T9111] exFAT-fs (loop4): failed to read boot sector [ 246.014960][ T9111] exFAT-fs (loop4): failed to recognize exfat type [ 246.039353][ T9111] netlink: 8 bytes leftover after parsing attributes in process `syz.4.961'. [ 246.066645][ T7232] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 246.266828][ T5780] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 247.060359][ T9133] loop0: detected capacity change from 0 to 1 [ 247.066929][ T9131] netlink: 12 bytes leftover after parsing attributes in process `syz.4.970'. [ 247.125555][ T9133] ldm_validate_privheads(): Disk read failed. [ 247.138450][ T9133] loop0: [ 247.153573][ T9133] loop0: partition table partially beyond EOD, truncated [ 247.236095][ T5144] ldm_validate_privheads(): Disk read failed. [ 247.256275][ T5144] loop0: [ 247.259362][ T5144] loop0: partition table partially beyond EOD, truncated [ 247.559883][ T5841] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 247.752458][ T5841] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 247.763116][ T5841] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 247.776088][ T5841] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 247.800933][ T5841] usb 6-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 247.811771][ T5841] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 248.210004][ T28] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 248.246156][ T5841] cxacru 6-1:1.0: send of cm 0x91 failed (-71) [ 248.259333][ T5841] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 248.267833][ T5841] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 248.281793][ T5841] cxacru: probe of 6-1:1.0 failed with error -71 [ 248.312862][ T5841] usb 6-1: USB disconnect, device number 6 [ 248.354665][ T9154] loop4: detected capacity change from 0 to 128 [ 248.415298][ T28] usb 7-1: New USB device found, idVendor=17ef, idProduct=6161, bcdDevice= 0.00 [ 248.440563][ T28] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.448654][ T28] usb 7-1: Product: syz [ 248.470604][ T28] usb 7-1: Manufacturer: syz [ 248.475303][ T28] usb 7-1: SerialNumber: syz [ 248.563889][ T9156] loop4: detected capacity change from 0 to 512 [ 248.621888][ T9156] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 248.636020][ T9156] ext4 filesystem being mounted at /213/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 248.732619][ T28] cdc_acm 7-1:1.0: ttyACM0: USB ACM device [ 248.752905][ T6038] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 248.771030][ T28] usb 7-1: USB disconnect, device number 6 [ 248.923958][ T9162] loop5: detected capacity change from 0 to 512 [ 248.967817][ T9162] EXT4-fs (loop5): Test dummy encryption mode enabled [ 248.995349][ T9162] EXT4-fs error (device loop5): ext4_orphan_get:1408: inode #15: comm syz.5.983: inode has both inline data and extents flags [ 249.013603][ T9162] EXT4-fs error (device loop5): ext4_orphan_get:1413: comm syz.5.983: couldn't read orphan inode 15 (err -117) [ 249.051806][ T9162] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 249.287825][ T7232] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 249.369812][ T28] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 249.586325][ T28] usb 7-1: New USB device found, idVendor=17ef, idProduct=6161, bcdDevice= 0.00 [ 249.599746][ T28] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 249.617995][ T28] usb 7-1: Product: syz [ 249.629758][ T28] usb 7-1: Manufacturer: syz [ 249.639794][ T28] usb 7-1: SerialNumber: syz [ 249.828655][ T9184] netlink: 4 bytes leftover after parsing attributes in process `syz.1.993'. [ 249.916329][ T9184] team0: Port device team_slave_1 removed [ 250.082143][ T28] cdc_acm 7-1:1.0: ttyACM0: USB ACM device [ 250.187777][ T9193] netlink: 'syz.1.997': attribute type 1 has an invalid length. [ 250.408763][ T9199] vhci_hcd vhci_hcd.0: Expecting SOCK_STREAM - found 3 [ 250.563608][ T5836] usb 7-1: USB disconnect, device number 7 [ 250.599868][ T28] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 250.836869][ T28] usb 2-1: unable to get BOS descriptor or descriptor too short [ 250.847933][ T28] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 250.860975][ T28] usb 2-1: can't read configurations, error -71 [ 251.706766][ T9217] loop4: detected capacity change from 0 to 32768 [ 251.756631][ T9217] XFS (loop4): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 252.129495][ T9244] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 252.155928][ T9217] XFS (loop4): Ending clean mount [ 252.560289][ T6038] XFS (loop4): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 253.164376][ T9263] loop5: detected capacity change from 0 to 4096 [ 253.226852][ T9263] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 253.418604][ T9271] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 253.583369][ T7232] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 253.941996][ T9284] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1035'. [ 253.979927][ T9284] netlink: 'syz.1.1035': attribute type 7 has an invalid length. [ 253.987762][ T9284] netlink: 'syz.1.1035': attribute type 8 has an invalid length. [ 254.012668][ T9284] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1035'. [ 254.777011][ T9288] loop5: detected capacity change from 0 to 32768 [ 254.837099][ T9288] XFS (loop5): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 254.875307][ T9286] loop6: detected capacity change from 0 to 32768 [ 254.892327][ T9286] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop6 scanned by syz.6.1036 (9286) [ 254.920231][ T9286] BTRFS info (device loop6): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 254.943803][ T9286] BTRFS info (device loop6): using sha256 (sha256-avx2) checksum algorithm [ 254.989448][ T9286] BTRFS info (device loop6): force clearing of disk cache [ 255.003503][ T9288] XFS (loop5): Ending clean mount [ 255.031515][ T9286] BTRFS info (device loop6): enabling auto defrag [ 255.048424][ T9286] BTRFS info (device loop6): max_inline at 0 [ 255.068031][ T9286] BTRFS info (device loop6): enabling disk space caching [ 255.103024][ T9286] BTRFS info (device loop6): disk space caching is enabled [ 255.264999][ T9286] BTRFS info (device loop6): enabling ssd optimizations [ 255.282661][ T7232] XFS (loop5): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 255.298684][ T9286] BTRFS info (device loop6): rebuilding free space tree [ 255.366338][ T9286] BTRFS info (device loop6): disabling free space tree [ 255.397301][ T9286] BTRFS info (device loop6): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 255.450152][ T9286] BTRFS info (device loop6): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 255.848941][ T9338] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 255.959475][ T196] BTRFS info (device loop6): qgroup scan completed (inconsistency flag cleared) [ 255.999614][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.006456][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.045608][ T7280] BTRFS info (device loop6): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 256.290599][ T9344] netlink: 'syz.5.1049': attribute type 10 has an invalid length. [ 256.334338][ T9344] bridge0: port 2(bridge_slave_1) entered disabled state [ 256.378036][ T9344] bridge_slave_1: left allmulticast mode [ 256.396400][ T9344] bridge_slave_1: left promiscuous mode [ 256.416615][ T9344] bridge0: port 2(bridge_slave_1) entered disabled state [ 256.775238][ T9357] capability: warning: `syz.6.1054' uses deprecated v2 capabilities in a way that may be insecure [ 256.982363][ T9365] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1058'. [ 257.010452][ T9365] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1058'. [ 257.050992][ T9369] FAULT_INJECTION: forcing a failure. [ 257.050992][ T9369] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 257.080228][ T9369] CPU: 1 PID: 9369 Comm: syz.4.1059 Not tainted syzkaller #0 [ 257.087708][ T9369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 257.097826][ T9369] Call Trace: [ 257.099153][ T9371] loop1: detected capacity change from 0 to 512 [ 257.101135][ T9369] [ 257.101146][ T9369] dump_stack_lvl+0x18c/0x250 [ 257.101179][ T9369] ? show_regs_print_info+0x20/0x20 [ 257.101202][ T9369] ? load_image+0x420/0x420 [ 257.122267][ T9371] EXT4-fs: Ignoring removed nobh option [ 257.124853][ T9369] ? __lock_acquire+0x7eb0/0x7eb0 [ 257.124892][ T9369] ? __virt_addr_valid+0x10c/0x380 [ 257.124925][ T9369] should_fail_ex+0x394/0x4c0 [ 257.124963][ T9369] _copy_to_user+0x2f/0xa0 [ 257.124999][ T9369] bpf_vlog_reverse_ubuf+0x2ad/0x3a0 [ 257.125041][ T9369] bpf_vlog_finalize+0x174/0x3e0 [ 257.125081][ T9369] btf_new_fd+0x4ca/0x9e0 [ 257.125121][ T9369] ? bpf_btf_show_fdinfo+0x80/0x80 [ 257.125154][ T9369] ? capable+0x88/0xe0 [ 257.125189][ T9369] __sys_bpf+0x670/0x890 [ 257.125217][ T9369] ? bpf_link_show_fdinfo+0x560/0x560 [ 257.125259][ T9369] ? lock_chain_count+0x20/0x20 [ 257.125295][ T9369] __x64_sys_bpf+0x7c/0x90 [ 257.125327][ T9369] do_syscall_64+0x55/0xb0 [ 257.125348][ T9369] ? clear_bhb_loop+0x40/0x90 [ 257.125371][ T9369] ? clear_bhb_loop+0x40/0x90 [ 257.125396][ T9369] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 257.212985][ T9369] RIP: 0033:0x7fd911f9e559 [ 257.217444][ T9369] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 257.237096][ T9369] RSP: 002b:00007fd912efd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 257.245555][ T9369] RAX: ffffffffffffffda RBX: 00007fd912225fa0 RCX: 00007fd911f9e559 [ 257.253563][ T9369] RDX: 0000000000000028 RSI: 0000200000001b40 RDI: 0000000000000012 [ 257.261586][ T9369] RBP: 00007fd9120358b0 R08: 0000000000000000 R09: 0000000000000000 [ 257.269596][ T9369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 257.277607][ T9369] R13: 00007fd912226038 R14: 00007fd912225fa0 R15: 00007ffcde68fa98 [ 257.285639][ T9369] [ 257.387948][ T9371] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 257.598263][ T5775] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 257.987425][ T9396] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1070'. [ 258.043114][ T9398] syzkaller1: entered promiscuous mode [ 258.057261][ T9398] syzkaller1: entered allmulticast mode [ 258.527300][ T9418] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 259.640864][ T9458] x86/PAT: syz.6.1095:9458 freeing invalid memtype [mem 0xfe004000-0xfe008fff] [ 259.662697][ T5836] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 259.688800][ T9457] x86/PAT: syz.6.1095:9457 freeing invalid memtype [mem 0xfe009000-0xfe00efff] [ 259.720426][ T9457] x86/PAT: syz.6.1095:9457 freeing invalid memtype [mem 0xfe000000-0xfe003fff] [ 259.865673][ T5836] usb 6-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 259.875816][ T5836] usb 6-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 259.884412][ T5836] usb 6-1: Product: syz [ 259.888949][ T5836] usb 6-1: Manufacturer: syz [ 259.895616][ T5836] usb 6-1: SerialNumber: syz [ 259.916364][ T5836] usb 6-1: config 0 descriptor?? [ 259.936405][ T5836] ch341 6-1:0.0: ch341-uart converter detected [ 260.760480][ T28] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 260.955284][ T28] usb 5-1: config 0 has an invalid interface number: 64 but max is 0 [ 260.969844][ T28] usb 5-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 260.984487][ T5836] ch341-uart ttyUSB0: failed to read break control: -71 [ 260.993454][ T28] usb 5-1: config 0 has no interface number 0 [ 261.012469][ T5836] ch341-uart: probe of ttyUSB0 failed with error -71 [ 261.015095][ T28] usb 5-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 261.031626][ T28] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.043187][ T5836] usb 6-1: USB disconnect, device number 7 [ 261.054306][ T5836] ch341 6-1:0.0: device disconnected [ 261.056021][ T28] usb 5-1: Product: syz [ 261.070015][ T28] usb 5-1: Manufacturer: syz [ 261.074694][ T28] usb 5-1: SerialNumber: syz [ 261.115375][ T28] usb 5-1: config 0 descriptor?? [ 261.534217][ T9493] netlink: 104 bytes leftover after parsing attributes in process `syz.6.1105'. [ 261.573282][ T28] usb 5-1: Found UVC 0.00 device syz (046d:0823) [ 261.582554][ T28] usb 5-1: No valid video chain found. [ 261.673635][ T9495] loop6: detected capacity change from 0 to 8 [ 261.842569][ T28] usb 5-1: USB disconnect, device number 10 [ 262.878623][ T9527] loop5: detected capacity change from 0 to 1024 [ 262.917950][ T9527] EXT4-fs (loop5): stripe (5) is not aligned with cluster size (16), stripe is disabled [ 263.007559][ T9527] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 263.310653][ T9527] EXT4-fs error (device loop5): ext4_find_dest_de:2117: inode #12: block 7: comm syz.5.1120: bad entry in directory: rec_len is too small for name_len - offset=16, inode=14, rec_len=40, size=56 fake=0 [ 263.367421][ T9527] EXT4-fs (loop5): Remounting filesystem read-only [ 263.408228][ T9542] overlayfs: failed to get metacopy (-5) [ 263.731433][ T9552] loop6: detected capacity change from 0 to 256 [ 263.771330][ T9552] exfat: Bad value for 'uid' [ 263.837373][ T7619] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 263.918019][ T7232] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 264.164588][ T196] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.348161][ T196] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.463674][ T196] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.618208][ T196] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.366689][ T27] audit: type=1804 audit(1792037103.088:11): pid=9576 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1141" name="/newroot/255/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=146 res=1 errno=0 [ 265.470960][ T5782] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 265.482562][ T5782] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 265.507533][ T5782] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 265.521235][ T5782] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 265.530371][ T5782] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 265.537793][ T5782] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 265.881757][ T9581] rxe_eth0 speed is unknown, defaulting to 1000 [ 266.523755][ T9607] FAULT_INJECTION: forcing a failure. [ 266.523755][ T9607] name failslab, interval 1, probability 0, space 0, times 0 [ 266.569917][ T9607] CPU: 0 PID: 9607 Comm: syz.4.1150 Not tainted syzkaller #0 [ 266.577387][ T9607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 266.587509][ T9607] Call Trace: [ 266.590847][ T9607] [ 266.593875][ T9607] dump_stack_lvl+0x18c/0x250 [ 266.598614][ T9607] ? show_regs_print_info+0x20/0x20 [ 266.603878][ T9607] ? load_image+0x420/0x420 [ 266.608470][ T9607] ? __might_sleep+0xe0/0xe0 [ 266.613172][ T9607] ? __lock_acquire+0x7eb0/0x7eb0 [ 266.618282][ T9607] should_fail_ex+0x394/0x4c0 [ 266.623143][ T9607] should_failslab+0x9/0x20 [ 266.627728][ T9607] slab_pre_alloc_hook+0x59/0x300 [ 266.632828][ T9607] ? d_instantiate+0x6f/0x90 [ 266.637499][ T9607] kmem_cache_alloc+0x5a/0x2c0 [ 266.642340][ T9607] ? alloc_empty_file+0x9e/0x1d0 [ 266.647353][ T9607] alloc_empty_file+0x9e/0x1d0 [ 266.652186][ T9607] alloc_file+0x5b/0x600 [ 266.656498][ T9607] alloc_file_pseudo+0x184/0x210 [ 266.661497][ T9607] ? fput+0x1a0/0x1a0 [ 266.665541][ T9607] ? _raw_spin_unlock+0x28/0x40 [ 266.670520][ T9607] anon_inode_getfd+0xca/0x1c0 [ 266.675348][ T9607] __se_sys_fanotify_init+0x62a/0x750 [ 266.680816][ T9607] do_syscall_64+0x55/0xb0 [ 266.685299][ T9607] ? clear_bhb_loop+0x40/0x90 [ 266.690033][ T9607] ? clear_bhb_loop+0x40/0x90 [ 266.694779][ T9607] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 266.700769][ T9607] RIP: 0033:0x7fd911f9e559 [ 266.705258][ T9607] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 266.724947][ T9607] RSP: 002b:00007fd912efd028 EFLAGS: 00000246 ORIG_RAX: 000000000000012c [ 266.733446][ T9607] RAX: ffffffffffffffda RBX: 00007fd912225fa0 RCX: 00007fd911f9e559 [ 266.741485][ T9607] RDX: 0000000000000000 RSI: 0000000000080000 RDI: 0000000000000010 [ 266.749523][ T9607] RBP: 00007fd9120358b0 R08: 0000000000000000 R09: 0000000000000000 [ 266.757559][ T9607] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 266.765628][ T9607] R13: 00007fd912226038 R14: 00007fd912225fa0 R15: 00007ffcde68fa98 [ 266.773724][ T9607] [ 267.633297][ T196] bond2: (slave gretap1): Releasing active interface [ 267.660194][ T5780] Bluetooth: hci1: command tx timeout [ 268.576196][ T9630] loop4: detected capacity change from 0 to 40427 [ 268.593303][ T9646] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 268.620476][ T9630] F2FS-fs (loop4): Fix alignment : done, start(4096) end(16896) block(12288) [ 268.638024][ T9646] overlayfs: failed to set xattr on upper [ 268.665068][ T9630] F2FS-fs (loop4): invalid crc value [ 268.691908][ T9646] overlayfs: ...falling back to redirect_dir=nofollow. [ 268.699214][ T9646] overlayfs: ...falling back to index=off. [ 268.710968][ T9630] F2FS-fs (loop4): invalid crc value [ 268.716588][ T9630] F2FS-fs (loop4): Failed to get valid F2FS checkpoint [ 268.747069][ T9646] overlayfs: ...falling back to uuid=null. [ 268.759886][ T9646] overlayfs: ...falling back to xino=off. [ 269.194203][ T9581] chnl_net:caif_netlink_parms(): no params data found [ 269.590700][ T196] hsr_slave_0: left promiscuous mode [ 269.641344][ T196] hsr_slave_1: left promiscuous mode [ 269.670251][ T196] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 269.708460][ T196] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 269.740294][ T5780] Bluetooth: hci1: command tx timeout [ 269.746829][ T196] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 269.779219][ T196] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 269.805202][ T196] bridge_slave_0: left allmulticast mode [ 269.836448][ T196] bridge_slave_0: left promiscuous mode [ 269.859298][ T196] bridge0: port 1(bridge_slave_0) entered disabled state [ 270.064540][ T196] veth1_macvtap: left promiscuous mode [ 270.098622][ T196] veth0_macvtap: left promiscuous mode [ 270.108854][ T196] veth1_vlan: left promiscuous mode [ 270.130475][ T196] veth0_vlan: left promiscuous mode [ 270.624267][ T9674] loop6: detected capacity change from 0 to 1024 [ 271.008267][ T196] bond2 (unregistering): Released all slaves [ 271.130241][ T7280] hfsplus: node 4:3 still has 1 user(s)! [ 271.409145][ T196] bond1 (unregistering): Released all slaves [ 271.539914][ T5841] usb 7-1: new low-speed USB device number 8 using dummy_hcd [ 271.728945][ T5841] usb 7-1: config 1 interface 0 altsetting 15 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 271.740281][ T5841] usb 7-1: config 1 interface 0 has no altsetting 0 [ 271.751678][ T5841] usb 7-1: string descriptor 0 read error: -22 [ 271.758717][ T5841] usb 7-1: New USB device found, idVendor=04b4, idProduct=ed81, bcdDevice= 0.40 [ 271.768852][ T5841] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.791154][ T9681] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 271.831978][ T5780] Bluetooth: hci1: command tx timeout [ 272.385018][ T196] team0 (unregistering): Port device team_slave_1 removed [ 272.459460][ T5841] cypress 0003:04B4:ED81.0004: global environment stack underflow [ 272.475335][ T196] team0 (unregistering): Port device team_slave_0 removed [ 272.487386][ T5841] cypress 0003:04B4:ED81.0004: item 0 2 1 11 parsing failed [ 272.498457][ T5841] cypress 0003:04B4:ED81.0004: parse failed [ 272.505034][ T5841] cypress: probe of 0003:04B4:ED81.0004 failed with error -22 [ 272.575922][ T196] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 272.650617][ T196] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 272.705649][ T5841] usb 7-1: USB disconnect, device number 8 [ 273.193792][ T196] bond0 (unregistering): Released all slaves [ 273.536369][ T9581] bridge0: port 1(bridge_slave_0) entered blocking state [ 273.575867][ T9581] bridge0: port 1(bridge_slave_0) entered disabled state [ 273.601538][ T9581] bridge_slave_0: entered allmulticast mode [ 273.623742][ T9581] bridge_slave_0: entered promiscuous mode [ 273.657978][ T9581] bridge0: port 2(bridge_slave_1) entered blocking state [ 273.679905][ T9581] bridge0: port 2(bridge_slave_1) entered disabled state [ 273.687266][ T9581] bridge_slave_1: entered allmulticast mode [ 273.731506][ T9581] bridge_slave_1: entered promiscuous mode [ 273.782975][ T9703] 9p: Unknown uid 00000000004294967295 [ 273.847314][ T9581] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 273.866049][ T9581] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 273.913825][ T5780] Bluetooth: hci1: command tx timeout [ 274.000873][ T9581] team0: Port device team_slave_0 added [ 274.032196][ T9581] team0: Port device team_slave_1 added [ 274.063551][ T27] audit: type=1326 audit(1792037111.788:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9710 comm="syz.4.1178" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd911f9e559 code=0x0 [ 274.136339][ T9581] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 274.143836][ T9581] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 274.180922][ T9581] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 274.203850][ T9581] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 274.217529][ T9581] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 274.254015][ T9581] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 274.329372][ T9581] hsr_slave_0: entered promiscuous mode [ 274.336486][ T9581] hsr_slave_1: entered promiscuous mode [ 274.343377][ T9581] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 274.351272][ T9581] Cannot create hsr debugfs directory [ 274.855202][ T9581] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 274.870135][ T9581] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 274.897001][ T9581] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 274.931419][ T9581] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 275.017303][ T9731] loop6: detected capacity change from 0 to 256 [ 275.081432][ T9731] exFAT-fs (loop6): failed to load upcase table (idx : 0x0001fe89, chksum : 0xeb34f926, utbl_chksum : 0xe619d30d) [ 275.304173][ T9581] 8021q: adding VLAN 0 to HW filter on device bond0 [ 275.374504][ T9581] 8021q: adding VLAN 0 to HW filter on device team0 [ 275.412491][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 275.419803][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 275.510646][ T214] bridge0: port 2(bridge_slave_1) entered blocking state [ 275.517935][ T214] bridge0: port 2(bridge_slave_1) entered forwarding state [ 275.744498][ T9745] bridge_slave_0: left allmulticast mode [ 275.750473][ T9745] bridge_slave_0: left promiscuous mode [ 275.759113][ T9745] bridge0: port 1(bridge_slave_0) entered disabled state [ 275.776692][ T9745] bridge_slave_1: left allmulticast mode [ 275.782830][ T9745] bridge_slave_1: left promiscuous mode [ 275.803089][ T9745] bridge0: port 2(bridge_slave_1) entered disabled state [ 275.859059][ T9745] bond0: (slave bond_slave_0): Releasing backup interface [ 275.958010][ T9745] bond0: (slave bond_slave_1): Releasing backup interface [ 276.083390][ T9745] team0: Port device team_slave_0 removed [ 276.130846][ T9745] team0: Port device team_slave_1 removed [ 276.161367][ T9745] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 276.177901][ T9745] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 276.228731][ T9745] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 276.260231][ T9745] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 276.357739][ T9745] bond1: (slave geneve2): Releasing active interface [ 277.075830][ T9581] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 277.179054][ T9763] loop1: detected capacity change from 0 to 32768 [ 277.205689][ T9763] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.1190 (9763) [ 277.219980][ T9789] loop6: detected capacity change from 0 to 512 [ 277.264485][ T9763] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 277.323250][ T9789] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 277.333952][ T9763] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 277.363098][ T9763] BTRFS info (device loop1): turning off barriers [ 277.382138][ T9763] BTRFS info (device loop1): setting nodatasum [ 277.388509][ T9763] BTRFS info (device loop1): metadata ratio 772 [ 277.405283][ T9763] BTRFS info (device loop1): setting nodatacow, compression disabled [ 277.442985][ T9789] EXT4-fs error (device loop6): ext4_free_branches:1030: inode #16: comm syz.6.1197: invalid indirect mapped block 32768 (level 2) [ 277.460500][ T9763] BTRFS info (device loop1): setting datacow [ 277.466581][ T9763] BTRFS info (device loop1): enabling disk space caching [ 277.485593][ T9789] EXT4-fs (loop6): 1 orphan inode deleted [ 277.492043][ T9789] EXT4-fs (loop6): 1 truncate cleaned up [ 277.499199][ T9789] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 277.515082][ T9763] BTRFS info (device loop1): force clearing of disk cache [ 277.523108][ T9763] BTRFS info (device loop1): disk space caching is enabled [ 277.802657][ T9763] BTRFS info (device loop1): enabling ssd optimizations [ 277.850251][ T9794] EXT4-fs error (device loop6): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 191 vs 220 free clusters [ 277.874002][ T9763] BTRFS info (device loop1): rebuilding free space tree [ 277.918381][ T9763] BTRFS info (device loop1): disabling free space tree [ 277.976270][ T9763] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 277.988331][ T7280] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 278.017479][ T9763] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 278.177189][ T9826] loop6: detected capacity change from 0 to 256 [ 278.626308][ T9581] veth0_vlan: entered promiscuous mode [ 278.721488][ T9581] veth1_vlan: entered promiscuous mode [ 278.851889][ T9581] veth0_macvtap: entered promiscuous mode [ 278.877855][ T9581] veth1_macvtap: entered promiscuous mode [ 278.958387][ T9581] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 278.992203][ T9581] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 279.009726][ T9581] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 279.029745][ T9581] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 279.054657][ T9581] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 279.069065][ T9581] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 279.082482][ T9581] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 279.120726][ T9581] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 279.149427][ T9581] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 279.176298][ T9581] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 279.194726][ T9581] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 279.206133][ T9581] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 279.217951][ T9581] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 279.237284][ T9581] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 279.271225][ T9581] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 279.292080][ T9581] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 279.301180][ T9581] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 279.319892][ T9581] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 279.411597][ T5775] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 279.588834][ T196] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 279.634530][ T196] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 279.736784][ T214] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 279.781943][ T214] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 280.641676][ T9878] kvm: apic: phys broadcast and lowest prio [ 281.271509][ T9908] syzkaller1: entered promiscuous mode [ 281.278438][ T9908] syzkaller1: entered allmulticast mode [ 282.451193][ T9950] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 282.490197][ T9950] syzkaller1: Refused to change device type [ 283.312137][ T9965] loop4: detected capacity change from 0 to 512 [ 283.408169][ T9965] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 283.460396][ T9965] ext4 filesystem being mounted at /284/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 283.485571][ T9971] loop7: detected capacity change from 0 to 512 [ 283.494944][ T9971] EXT4-fs: Ignoring removed bh option [ 283.524420][ T9971] EXT4-fs (loop7): Test dummy encryption mode enabled [ 283.548939][ T9971] EXT4-fs (loop7): can't mount with journal_checksum, fs mounted w/o journal [ 283.660998][ T5782] Bluetooth: hci4: command 0x0406 tx timeout [ 283.877594][ T6038] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 283.998363][ T9952] loop1: detected capacity change from 0 to 32768 [ 284.101898][ T9952] XFS (loop1): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 284.316472][ T9952] XFS (loop1): Torn write (CRC failure) detected at log block 0x30. Truncating head block from 0x51. [ 284.409432][ T9952] XFS (loop1): Starting recovery (logdev: internal) [ 284.476760][ T9952] XFS (loop1): Ending recovery (logdev: internal) [ 284.489461][ T9952] XFS (loop1): AG 0: Corrupt btree 5 pointer at level 1 index 0. [ 284.499030][ T9952] XFS (loop1): Failed to initialize disk quotas. [ 284.626448][ T5775] XFS (loop1): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 285.891206][T10043] af_packet: tpacket_rcv: packet too big, clamped from 2916 to 4294967286. macoff=82 [ 286.301874][ T8] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 286.336883][ T5841] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 286.584822][ T789] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 286.610739][ T5865] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 287.061708][T10050] ceph: No mds server is up or the cluster is laggy [ 287.062273][T10053] ceph: No mds server is up or the cluster is laggy [ 287.123003][ T28] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 287.138857][ T789] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 287.143047][ T5865] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 287.340653][ T29] INFO: task syz.0.298:6972 blocked for more than 143 seconds. [ 287.348938][ T29] Not tainted syzkaller #0 [ 287.350439][ T5865] usb 8-1: Using ep0 maxpacket: 16 [ 287.356270][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 287.376138][ T29] task:syz.0.298 state:D stack:27912 pid:6972 ppid:5776 flags:0x00004004 [ 287.389619][ T5865] usb 8-1: config 0 has an invalid interface number: 34 but max is 0 [ 287.397454][ T29] Call Trace: [ 287.407574][ T29] [ 287.409924][ T5865] usb 8-1: config 0 has no interface number 0 [ 287.412830][ T29] __schedule+0x15ae/0x4660 [ 287.420263][ T5865] usb 8-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 287.423862][ T29] ? asan.module_dtor+0x20/0x20 [ 287.437809][ T29] ? __mutex_lock+0x66e/0xc80 [ 287.450723][ T5865] usb 8-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 287.466608][ T29] ? __mutex_trylock_common+0x8a/0x270 [ 287.476369][ T5865] usb 8-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 287.482844][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 287.501667][ T5865] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 287.509863][ T29] schedule+0xbd/0x170 [ 287.509936][ T29] schedule_preempt_disabled+0x13/0x20 [ 287.509963][ T29] __mutex_lock+0x673/0xc80 [ 287.509993][ T29] ? __mutex_lock+0x4d2/0xc80 [ 287.510023][ T29] ? write_ports+0xb7/0xfa0 [ 287.510052][ T29] ? mutex_lock_nested+0x20/0x20 [ 287.510098][ T29] write_ports+0xb7/0xfa0 [ 287.510129][ T29] ? write_versions+0xe00/0xe00 [ 287.524473][ T5865] usb 8-1: Product: syz [ 287.552076][ T29] ? __might_fault+0xaa/0x120 [ 287.568259][ T5865] usb 8-1: Manufacturer: syz [ 287.573313][ T5865] usb 8-1: SerialNumber: syz [ 287.579595][ T29] ? __lock_acquire+0x7eb0/0x7eb0 [ 287.595289][ T29] ? __virt_addr_valid+0x10c/0x380 [ 287.601532][ T5865] usb 8-1: config 0 descriptor?? [ 287.611308][ T29] ? __virt_addr_valid+0x10c/0x380 [ 287.616652][ T29] ? __might_fault+0xaa/0x120 [ 287.622010][ T29] ? __might_fault+0xc6/0x120 [ 287.626842][ T29] ? __might_fault+0xaa/0x120 [ 287.628883][T10070] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 287.631783][ T29] ? simple_transaction_get+0x11d/0x140 [ 287.645788][T10070] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 287.654171][ T29] nfsctl_transaction_write+0x10c/0x150 [ 287.663010][ T29] ? nfsctl_transaction_read+0x1b0/0x1b0 [ 287.668946][ T29] vfs_write+0x299/0x9a0 [ 287.673812][ T29] ? file_end_write+0x250/0x250 [ 287.678750][ T29] ? __fget_files+0x28/0x460 [ 287.684598][ T29] ? __fget_files+0x3fc/0x460 [ 287.689404][ T29] ? __fdget_pos+0x2a3/0x330 [ 287.694751][ T29] ? ksys_write+0x74/0x260 [ 287.699267][ T29] ksys_write+0x151/0x260 [ 287.704503][ T29] ? __ia32_sys_read+0x90/0x90 [ 287.709469][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 287.716942][ T29] do_syscall_64+0x55/0xb0 [ 287.722623][ T29] ? clear_bhb_loop+0x40/0x90 [ 287.727507][ T29] ? clear_bhb_loop+0x40/0x90 [ 287.733791][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 287.740679][ T29] RIP: 0033:0x7f414519e559 [ 287.746911][ T29] RSP: 002b:00007f4146028028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 287.756062][ T29] RAX: ffffffffffffffda RBX: 00007f4145426090 RCX: 00007f414519e559 [ 287.764654][ T29] RDX: 0000000000000006 RSI: 000020000000fa40 RDI: 0000000000000004 [ 287.773411][ T29] RBP: 00007f41452358b0 R08: 0000000000000000 R09: 0000000000000000 [ 287.784833][ T29] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 287.793473][ T29] R13: 00007f4145426128 R14: 00007f4145426090 R15: 00007fffd38834a8 [ 287.804966][ T29] [ 287.831621][ T29] [ 287.831621][ T29] Showing all locks held in the system: [ 287.839477][ T29] 1 lock held by khungtaskd/29: [ 287.865368][ T29] #0: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 [ 287.867438][T10070] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 287.885080][T10070] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 287.895842][ T29] 2 locks held by getty/5535: [ 287.907283][ T29] #0: ffff8880335080a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 287.917471][ T29] #1: ffffc9000327e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 [ 287.930617][ T29] 5 locks held by kworker/1:5/5865: [ 287.936584][ T29] #0: ffff88814264b138 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 287.958818][ T29] #1: ffffc9000498fd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 287.978677][ T29] #2: ffff8881433251d8 (&dev->mutex){....}-{3:3}, at: hub_event+0x188/0x4a80 [ 287.989597][ T29] #3: ffff8880325a41d8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x89/0x420 [ 287.999527][ T29] #4: ffff888026b9f1a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x89/0x420 [ 288.009489][ T29] 3 locks held by syz.0.298/6969: [ 288.015011][ T29] #0: ffff888026d49248 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 [ 288.026000][ T29] #1: ffff888033170418 (sb_writers#30){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 [ 288.035598][ T29] #2: ffffffff8e1e1708 (nfsd_mutex){+.+.}-{3:3}, at: write_ports+0xb7/0xfa0 [ 288.048774][ T29] 3 locks held by syz.0.298/6972: [ 288.056280][ T29] #0: ffff888030449748 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 [ 288.073062][ T29] #1: ffff888033170418 (sb_writers#30){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 [ 288.083761][ T29] #2: ffffffff8e1e1708 (nfsd_mutex){+.+.}-{3:3}, at: write_ports+0xb7/0xfa0 [ 288.093480][ T29] [ 288.095972][ T29] ============================================= [ 288.095972][ T29] [ 288.118175][ T29] NMI backtrace for cpu 0 [ 288.122598][ T29] CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 [ 288.129884][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 288.140086][ T29] Call Trace: [ 288.143422][ T29] [ 288.146407][ T29] dump_stack_lvl+0x18c/0x250 [ 288.151255][ T29] ? __wake_up_klogd+0xd9/0x100 [ 288.156239][ T29] ? show_regs_print_info+0x20/0x20 [ 288.161521][ T29] ? load_image+0x420/0x420 [ 288.166098][ T29] nmi_cpu_backtrace+0x3a6/0x3e0 [ 288.171109][ T29] ? nmi_trigger_cpumask_backtrace+0x2f0/0x2f0 [ 288.177850][ T29] ? load_image+0x420/0x420 [ 288.182411][ T29] ? wq_watchdog_touch+0xef/0x170 [ 288.187780][ T29] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 288.193958][ T29] nmi_trigger_cpumask_backtrace+0x17a/0x2f0 [ 288.200160][ T29] watchdog+0xf59/0xfa0 [ 288.204414][ T29] ? watchdog+0x1e1/0xfa0 [ 288.208798][ T29] kthread+0x2fa/0x390 [ 288.212917][ T29] ? hungtask_pm_notify+0x50/0x50 [ 288.217982][ T29] ? kthread_blkcg+0xd0/0xd0 [ 288.222617][ T29] ret_from_fork+0x48/0x80 [ 288.227086][ T29] ? kthread_blkcg+0xd0/0xd0 [ 288.231717][ T29] ret_from_fork_asm+0x11/0x20 [ 288.236552][ T29] [ 288.241053][ T29] Sending NMI from CPU 0 to CPUs 1: [ 288.246339][ C1] NMI backtrace for cpu 1 [ 288.246350][ C1] CPU: 1 PID: 3454 Comm: kworker/u4:8 Not tainted syzkaller #0 [ 288.246367][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 288.246378][ C1] Workqueue: events_unbound nsim_dev_trap_report_work [ 288.246406][ C1] RIP: 0010:kasan_check_range+0x89/0x290 [ 288.246431][ C1] Code: 00 fc ff df 4d 8d 34 19 4d 89 f4 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 3d 01 00 00 4c 89 cb 48 f7 d3 4c 01 fb 41 80 3b 00 <0f> 85 8d 01 00 00 49 ff c3 48 ff c3 75 ee e9 1d 01 00 00 44 89 dd [ 288.246448][ C1] RSP: 0018:ffffc9000cdc7560 EFLAGS: 00000246 [ 288.246461][ C1] RAX: ffffc9000cdc7b01 RBX: fffffffffffffffe RCX: ffffffff813bc9f8 [ 288.246474][ C1] RDX: 0000000000000001 RSI: 0000000000000010 RDI: ffffc9000cdc76d8 [ 288.246486][ C1] RBP: 0000000000000000 R08: ffffc9000cdc76e7 R09: 1ffff920019b8edc [ 288.246498][ C1] R10: dffffc0000000000 R11: fffff520019b8edb R12: 0000000000000002 [ 288.246509][ C1] R13: ffffc9000cdc7688 R14: fffff520019b8edd R15: 1ffff920019b8edb [ 288.246522][ C1] FS: 0000000000000000(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000 [ 288.246536][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 288.246547][ C1] CR2: 00007ffcba0dac00 CR3: 000000006568d000 CR4: 00000000003506e0 [ 288.246562][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 288.246572][ C1] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 288.246582][ C1] Call Trace: [ 288.246587][ C1] [ 288.246597][ C1] __asan_memset+0x22/0x40 [ 288.246622][ C1] ? nsim_dev_trap_report_work+0x253/0xa90 [ 288.246643][ C1] unwind_next_frame+0x1628/0x2990 [ 288.246667][ C1] ? __alloc_skb+0x138/0x2c0 [ 288.246689][ C1] ? __alloc_skb+0x138/0x2c0 [ 288.246710][ C1] ? stack_trace_save+0x100/0x100 [ 288.246731][ C1] arch_stack_walk+0x144/0x190 [ 288.246752][ C1] ? nsim_dev_trap_report_work+0x253/0xa90 [ 288.246776][ C1] stack_trace_save+0xaa/0x100 [ 288.246804][ C1] ? stack_trace_snprint+0xf0/0xf0 [ 288.246824][ C1] ? stack_trace_save+0xaa/0x100 [ 288.246848][ C1] ? kasan_set_track+0x5f/0x70 [ 288.246866][ C1] ? kasan_set_track+0x4e/0x70 [ 288.246886][ C1] kasan_set_track+0x4e/0x70 [ 288.246905][ C1] ? kasan_set_track+0x4e/0x70 [ 288.246923][ C1] ? __kasan_kmalloc+0x8f/0xa0 [ 288.246942][ C1] ? __kmalloc_node_track_caller+0xb4/0x230 [ 288.246967][ C1] ? kmalloc_reserve+0x116/0x240 [ 288.246988][ C1] ? __alloc_skb+0x138/0x2c0 [ 288.247033][ C1] ? __kmem_cache_alloc_node+0x194/0x250 [ 288.247059][ C1] ? __alloc_skb+0x138/0x2c0 [ 288.247081][ C1] __kasan_kmalloc+0x8f/0xa0 [ 288.247101][ C1] ? __alloc_skb+0x138/0x2c0 [ 288.247122][ C1] __kmalloc_node_track_caller+0xb4/0x230 [ 288.247147][ C1] ? rcu_is_watching+0x15/0xb0 [ 288.247172][ C1] ? __alloc_skb+0x138/0x2c0 [ 288.247192][ C1] kmalloc_reserve+0x116/0x240 [ 288.247217][ C1] __alloc_skb+0x138/0x2c0 [ 288.247241][ C1] nsim_dev_trap_report_work+0x253/0xa90 [ 288.247269][ C1] ? process_scheduled_works+0x975/0x1600 [ 288.247294][ C1] process_scheduled_works+0xa60/0x1600 [ 288.247334][ C1] ? worker_attach_to_pool+0x370/0x370 [ 288.247359][ C1] ? assign_work+0x3cc/0x5d0 [ 288.247384][ C1] worker_thread+0xa5e/0xfe0 [ 288.247420][ C1] kthread+0x2fa/0x390 [ 288.247436][ C1] ? pr_cont_work+0x550/0x550 [ 288.247457][ C1] ? kthread_blkcg+0xd0/0xd0 [ 288.247474][ C1] ret_from_fork+0x48/0x80 [ 288.247494][ C1] ? kthread_blkcg+0xd0/0xd0 [ 288.247511][ C1] ret_from_fork_asm+0x11/0x20 [ 288.247542][ C1] [ 288.548264][ T5865] asix 8-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 288.582970][ T29] Kernel panic - not syncing: hung_task: blocked tasks [ 288.583011][ T29] CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 [ 288.583057][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 288.583109][ T29] Call Trace: [ 288.583133][ T29] [ 288.583157][ T29] dump_stack_lvl+0x18c/0x250 [ 288.583251][ T29] ? show_regs_print_info+0x20/0x20 [ 288.583330][ T29] ? load_image+0x420/0x420 [ 288.583491][ T29] panic+0x2ca/0x720 [ 288.583587][ T29] ? bpf_jit_dump+0xd0/0xd0 [ 288.583683][ T29] ? __irq_work_queue_local+0x13a/0x3b0 [ 288.583768][ T29] ? preempt_schedule_thunk+0x1a/0x30 [ 288.583885][ T29] ? nmi_trigger_cpumask_backtrace+0x2a4/0x2f0 [ 288.583981][ T29] watchdog+0xf98/0xfa0 [ 288.584078][ T29] ? watchdog+0x1e1/0xfa0 [ 288.584192][ T29] kthread+0x2fa/0x390 [ 288.584253][ T29] ? hungtask_pm_notify+0x50/0x50 [ 288.584349][ T29] ? kthread_blkcg+0xd0/0xd0 [ 288.584435][ T29] ret_from_fork+0x48/0x80 [ 288.584522][ T29] ? kthread_blkcg+0xd0/0xd0 [ 288.584594][ T29] ret_from_fork_asm+0x11/0x20 [ 288.584723][ T29] [ 288.587613][ T29] Kernel Offset: disabled