last executing test programs: 823.780509ms ago: executing program 1 (id=2): mknodat(0xffffffffffffff9c, &(0x7f00000007c0)='./file0\x00', 0x21c0, 0x103) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000001c0), 0x1, 0x481, &(0x7f00000002c0)="$eJzs3M2PU1UbAPDntjPDy9c7o+IHiIKikWicYQZUlmA0caGJiS5wOXYGghTGMKMRQrS6wKUhcW9cmvAXuNKNUVcmbnVvSIhhA7q65rb3Dm2nrczQWsf+fknpOT23Pefh3NOec8+0AYys/dk/ScSOiPglIiYb2dYD9jfubt24VPnjxqVKEmn6xu9J/bibNy5VikOL520vMrXWx5stX7h4Zr5aXTyf52dWzr47s3zh4rOnz86fWjy1eG7u6NEjh2dfeH7uub7EmbXp5p4Pl/bufuWtK69VTlx5+4erSRF/Sxzv96W+ppduVi4ST/arln+JnU3pZGyIDWFdshMy667x+vifjHLc7rzJePmToTYOGKg0TdMt3YtrKfAflsSwWwAMR/45n0TUKtkauHk9PwquH28sgLK4b+W3RslYlPJjxtvWt/2UrbZO1P78IrtF2/UUAIBB+OZ4476Y+92ef5RaruIfy/eGpiLinoi4NyLui4hdEXF/RDwQEQ9GxENNz+m079OufZNk7fyndG1Dgd2h6xN5Ys38r5j9xVQ5z+2sxz+enDxdXTwUEf+PiIMxviXLz/ao49uXfv6sW9n+pvlfdsvqL+aCeTuujbVdoFuYX5nfaLztrn8csWessbfXGn+yuhOQ9ePuiNizb2N1nH76q73dyv4+/h76sM+UfhnxVGNvsxZt8Uc+909670/O/C+qi4dmirNirR9/uvx6U7Yy2ZS5q/j7IOv/bdG5/3NTSfN+7fL667j866dd1zR3eP5PND8nO/8nkjfr6aLgg/mVlfOzERPJq/njx/LHW+urHzd3+/gs/oMHOsVfqr/HFf8TD0dEdhI/EhGPRsS+vO2PRcTjEXGgR/zfv/jEOxuPf7Cy+BfW1f9dE8Xe9pqi8pnvvq6XFJ011SP+JDr0/5F66mD+SKf3v8nWUyR6tvT83ZzNAAAAsPmUImJHJKXp1XSpND3d+Hv5XbGtVF1aXnnm5NJ75xYa3xGYivFScaVrcvV6aNRm82X91XJEVj6X54vrpYfz68afl7fW89OVperCsIOHEbe9y/jP/FYeduuAgfN9LRhdGx3/aZp+1OemAP8wn/8wuox/GF0dxv/WtnyP3wgANrNOn/8W9jAazP9hdBn/MLqMfxhdxj+MpPyb8GN38gX/gSWy95/h1b7+RJoOqfaJ4ce+mojS0GqPYce+vkSS/5ZGOvC6il+W6ccL1l/ILgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDp/RUAAP//S+LZpQ==") 563.912408ms ago: executing program 3 (id=4): syz_mount_image$erofs(&(0x7f0000001d00), &(0x7f0000001d40)='./file0\x00', 0x0, &(0x7f0000001ec0)=ANY=[], 0x3, 0x17e, &(0x7f0000001fc0)="$eJzsmLFKw0AYx/+X1BbFwUnERcGCVTBNUhUXhw7uglZxs9hYqmkrbQZbcHDyFVwcfAJfwEHER/ABqpNL3ZwjSa7tWaw6qCD+f8N3/+/u6/XuC/wDASHk3/L48NJqeVfPOoBRJJGQ8096r0ZT6sfvKoXE2drE9f3J/EXuPNu/nwDg+1///xiAm6wOT+a+//bXSTluQuvqHDTMSb0NAUPqXWjYktqBwI7UB4quBvWGsV9yHWOv6hYCYQbBCoIdhEz/+dqnAgXlfEJZrzeah3nXdWo/KD7rXzurYVU5n/q8Or0xlf5Z0GBJnYHAhtQrSHR6E7VEuf9krLe//sv3p6Cg+Gui50/+pcCs4k8xxT/SXvkoXW80F0rlfNEpOhXbziybi6a5ZKdDI4riB/43HPrTiLL/0IDauIjjOO95NSuK3dyO4nuOGw/9T0NqJsqFnFMJ3wdjYjoYUrrMCSGEEEIIIYQQQggh5NuZggi/gg7kNly218Pq1wAAAP//j8p1+w==") getrlimit(0x4, 0x0) openat(0xffffffffffffff9c, &(0x7f0000002140)='./file2\x00', 0x80000, 0x2) 466.449258ms ago: executing program 3 (id=6): syz_usb_control_io(0xffffffffffffffff, &(0x7f00000002c0)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x20, 0x29, 0xf, {0xf, 0x29, 0xe, 0x4, 0xb, 0x6, "04000004", "02012000"}}, 0x0}, 0x0) r0 = syz_usb_connect$uac3(0x3, 0x97, &(0x7f0000000040)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x10, 0x103d, 0x100, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x85, 0x3, 0x1, 0xd8, 0x10, 0xc, {0x8, 0xb, 0x1, 0x2, 0x1, 0x1, 0x30, 0x2}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0xe, 0x0, 0x3, {0xa, 0x25, 0x25, 0x7fffffff, 0xc, 0x180}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@as_header={0x17, 0x24, 0x1, 0x6, 0x8000, 0x7, 0x2, 0x6, 0x4a, 0x9, 0x10}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7f, 0x4, 0x0, {0xa, 0x25, 0x25, 0x400, 0x8f, 0x2}}}}}}}}]}}, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0003020000000203"]}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000772904202404019957c201020301090224"], 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000580)={0x2c, &(0x7f0000000240)={0x40, 0xe, 0x2, {0x2, 0x8}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_connect$uac1(0x4, 0x0, 0x0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0xc07}}]}) syz_usb_control_io$uac3(r0, &(0x7f0000000100)={0x14, &(0x7f0000000300)={0x0, 0xe, 0x6, {0x6, 0xa, "c39aed3c"}}, 0x0}, 0x0) syz_usb_control_io$uac3(r0, &(0x7f0000000140)={0x14, &(0x7f0000000240)=ANY=[], 0x0}, 0x0) 466.303768ms ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)='27', 0x2) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000080)) 466.184898ms ago: executing program 0 (id=1): prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000340), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000003c0)=0x2) syz_open_dev$loop(0x0, 0x6b, 0x901) setitimer(0x1, 0x0, &(0x7f0000000400)) r3 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000000440)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) sendmmsg$inet6(r3, &(0x7f00000004c0), 0x40000000000017d, 0x888) setsockopt$inet6_IPV6_DSTOPTS(r3, 0x29, 0x3b, 0x0, 0x0) sched_getattr(r0, 0x0, 0x0, 0x0) timer_create(0x3, 0x0, &(0x7f0000000500)=0x0) timer_gettime(r4, 0x0) 455.68031ms ago: executing program 1 (id=7): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x841e, &(0x7f0000000080)={[{@nojournal_checksum}, {@jqfmt_vfsold}, {@lazytime}, {@usrquota}, {@usrquota}]}, 0x3, 0x42f, &(0x7f00000000c0)="$eJzs289rHFUcAPDvzCat/WViqT+aVo1WMfgjadJae/CiKHhQEPRQjzFJS+y2kSaCLUGjSD1Kwbt4FPwLPOlF1JPgVe9SKJJLq6eV2Z1Jdje7aZJustX9fGCS92be8t53Z97ue/N2AuhZw9mfJGJ/RPweEQO1bGOB4dq/W8uLU38vL04lUam89VdSLXdzeXGqKFq8bl+R6YtIP0viSIt65y9fOT9ZLs9cyvNjCxfeH5u/fOW52QuT52bOzVycOH365InxF05NPN+ROLO4bg59NHf08GvvXHtj6sy1d3/+Ninib4qjQ4bXO/hkpdLh6rrrQF066etiQ9iUUq2bRn+1/w9EKVZP3kC8+mlXGwdsq0qlUnmg/eGlCvA/lkS3WwB0R/FFn81/i22Hhh53hRsv1SZAWdy38q12pC/SvEx/0/y2k4Yj4szSP19lW2zPfQgAgAbfZ+OfZ1uN/9Kovy90b76GMhgR90XEwYg4FRGHIuL+iGrZByPioU3W37xIsnb8k17fUmAblI3/XszXthrHf8XoLwZLee5ANf7+5OxseeZ4/p6MRP/uLD++Th0/vPLbF+2O1Y//si2rvxgL5u243re78TXTkwuTdxJzvRufRAz1tYo/WVkJSCLicEQMbbGO2ae/Odru2O3jX0cH1pkqX0c8VTv/S9EUfyFZf31y7J4ozxwfK66KtX759eqb7eq/o/g7IDv/e1te/yvxDyb167Xzm6/j6h+ft53TbPX635W83bDvw8mFhUvjEbuS12uNrt8/0VRuYrV8Fv/Isdb9/2CsvhNHIiK7iB+OiEci4tG87Y9FxOMRcWyd+H96+Yn3th7/9srin97U+V9N7IrmPa0TpfM/ftdQ6eBm4s/O/8lqaiTfs5HPv420a2tXMwAAAPz3pBGxP5J0dCWdpqOjtd/wH4q9aXlufuGZs3MfXJyuPSMwGP1pcadroO5+6Hg+rS/yE035E/l94y9Le6r50am58nS3g4cet69N/8/8Wep264Bt53kt6F36P/Qu/R96l/4PvatF/9/TjXYAO6/V9//HXWgHsPOa+r9lP+gh5v/Qu/R/6F36P/Sk+T1x+4fkJSTWJCK9K5ohsU2Jbn8yAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMa/AQAA//9QOObV") syz_mount_image$vfat(&(0x7f0000000600), &(0x7f0000000640)='./file0\x00', 0x400, &(0x7f0000000680)=ANY=[@ANYBLOB="6572726f72733d72656d6f756e742d726f2c757466383d302c757365667265652c646973636172642c757466383d312c756e695f786c6174653d302c73686f72746e616d653d77696e39352c756e695f786c6174653d302c756e695f786c6174653d302c0008442895b66131b4e4d54b2ba6ae54dabaa5206d4a2a060b5ccc774b3ec4c81a1a9852327ff871d16d0d9344e764c68194b9d9d0be76c595bac1fc5a0a8256a7b77e071e9bdd6100f9aeb8576d329be6e4bb168f1434000000", @ANYRESHEX=0x0], 0xfd, 0x296, &(0x7f0000000780)="$eJzs3M1qE1EUwPFj0o80tU0WIiiIB92oi6GNL2CQFsSAUhtRF8LUTjRkTMrMWImI7c6tz1FcuhPUF+jGnQt30k0XCm66UCOdjzatQ6u2yYTm/4Myp3Pvydz5CmcGctfvvHpcq7hGxfQklVFJiSzLhkh+MwodC5cpPx6SdstycfT7pzO37t67XiyVpmZUp4uzlwuqOn723dPnr8998EZvvxl/Oyyr+fvr3wpfVk+unlr/NRt9esNTU+caDc+csy2dr7o1Q/WmbZmupdW6azk72it2Y2GhqWZ9fiy74Fiuq2a9qTWrqV5DPaep5kOzWlfDMHQsK/0m/c8Z5ZWZGbPYkcEgCSNxKx2naKZjG8sr3RgUAADoLUnV/4+qrlZdre9X/6eE+r9zqP+PkuNrEvsUuFn/Z8P7d8uln10cGQAAAAAAAAAAAAAAAAAAAAAAOIiNVivXarVy0TL6GxaRjIhE/yc9TnTGQc7/cPeHi0PW9sO9jIj9crG8WA6WQXuxIlWxxZKJQZEf/vUQCuLpa6WpCfXl5b29FOYvLZbT/vXh50fy8fmTQb7uzB+UbPv2C5KTE/I5Lr8Qmz8kF8635RuSk48PpCG2zPvX9Xb+i0nVqzdKu/JH/H4AAAAAABwFhm754/ndbzc0mjZkV3uwcvv9gOT2eT+w6/l6QE4PJLffAAAAAAD0E7f5rGbatuUQ7AiuiMiefZI+dCM9cqA6GKQ2z0HXt/41ujV64yAcarD2JNi1v+mc4JcSAAAAgI7YLvqTHgkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP1rj2nAMmEXf03U/3/mHmvbXLr7ewgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD0jt8BAAD//ysQG/U=") socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000a80)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000b00)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000c40)=@abs, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f0000000d40), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000d80)=0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000d00)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) r2 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r2, &(0x7f0000000d40)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000001180)={{{@in6=@private2, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0x0, 0xa}, {0xffffffffffffbff9, 0x0, 0x0, 0x2, 0x23, 0x3, 0x401}, {0x5, 0xb}, 0x3, 0x0, 0x1, 0x0, 0x0, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x640100fd}, 0xfffffffd, 0x32}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x2}, 0x0, 0x0, 0x0, 0xf9, 0x3, 0x0, 0xffffffff}}, 0xe8) sendmmsg(r2, &(0x7f0000001280), 0x21, 0x810) 417.299934ms ago: executing program 4 (id=5): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000002c0), 0x0, 0x0) read$msr(r3, &(0x7f0000001240)=""/102392, 0x18ff8) syz_emit_ethernet(0x8e, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xf, 0x4, 0x4, 0x4, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xe, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="b702000001000000b703000000000000b7040000000000008500000032000000b7000000010000009500"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000440)={@map=r6, r7, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000480)={r6, &(0x7f00000004c0)='\x00\x00', &(0x7f0000000500)=@tcp=r4}, 0x20) sendto(r5, &(0x7f0000000540)="01020304", 0x4, 0x0, 0x0, 0x0) 329.407124ms ago: executing program 2 (id=8): mknod$loop(&(0x7f0000000000)='./file0\x00', 0x6000, 0x0) r0 = creat(&(0x7f0000000040)='./file0\x00', 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r1, 0x25, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x9, 0x2000002, 0x20010, r1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000300), 0x651, 0x0) recvmmsg(r3, &(0x7f0000000340), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x6) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r5 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = dup2(r0, r0) ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000080)={'\x00', 0x3e, 0xa, 0x8, 0x0, 0x10}) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r7 = openat$kvm(0xffffffffffffff9c, 0x0, 0x20000, 0x0) ioctl$KVM_CHECK_EXTENSION(r7, 0xae03, 0xc9) ioctl$BLKTRACESTOP(r6, 0x1275, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) ioctl$BLKPG(r0, 0x1269, 0x0) 0s ago: executing program 1 (id=9): r0 = syz_usb_connect(0x0, 0xb3, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc0201011124020101020000000000000000020010092403020101000100"], 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000240)={0x14, 0x0, &(0x7f0000000140)={0x0, 0x3, 0x47, @string={0x47, 0x3, "1fec67e673d5366db37b9a904951db99004b2998c3d8f94d64031d9508cce7c9b296004a6eab493e854b6b419e0d6b0fc08cadd816ccc5182333125d344838773216f842af"}}}, &(0x7f0000000540)={0x44, &(0x7f0000000280)={0x0, 0x5, 0x5, "cde2224c76"}, 0x0, &(0x7f00000003c0)={0x0, 0x8, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.190' (ED25519) to the list of known hosts. [ 22.189724][ T28] audit: type=1400 audit(1793826294.924:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.190713][ T279] cgroup: Unknown subsys name 'net' [ 22.212694][ T28] audit: type=1400 audit(1793826294.924:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.239629][ T28] audit: type=1400 audit(1793826294.964:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.239811][ T279] cgroup: Unknown subsys name 'devices' [ 22.354129][ T279] cgroup: Unknown subsys name 'hugetlb' [ 22.359738][ T279] cgroup: Unknown subsys name 'rlimit' [ 22.491733][ T28] audit: type=1400 audit(1793826295.224:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.514982][ T28] audit: type=1400 audit(1793826295.224:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.523586][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.539873][ T28] audit: type=1400 audit(1793826295.224:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.571452][ T28] audit: type=1400 audit(1793826295.294:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.596944][ T28] audit: type=1400 audit(1793826295.294:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.628413][ T28] audit: type=1400 audit(1793826295.364:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.653995][ T28] audit: type=1400 audit(1793826295.364:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.654218][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.493606][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.500659][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.508179][ T288] device bridge_slave_0 entered promiscuous mode [ 23.515222][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.522254][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.529747][ T288] device bridge_slave_1 entered promiscuous mode [ 23.572389][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.579611][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.587101][ T287] device bridge_slave_0 entered promiscuous mode [ 23.595928][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.602985][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.610377][ T287] device bridge_slave_1 entered promiscuous mode [ 23.665257][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.672308][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.679937][ T290] device bridge_slave_0 entered promiscuous mode [ 23.707591][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.714670][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.722121][ T290] device bridge_slave_1 entered promiscuous mode [ 23.755180][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.762238][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.769727][ T291] device bridge_slave_0 entered promiscuous mode [ 23.779557][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.786645][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.794100][ T291] device bridge_slave_1 entered promiscuous mode [ 23.839248][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.846391][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.853809][ T289] device bridge_slave_0 entered promiscuous mode [ 23.876310][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.883500][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.890919][ T289] device bridge_slave_1 entered promiscuous mode [ 23.917471][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.924540][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.931824][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.938859][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.974057][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.981107][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.988383][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.995408][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.056177][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.063246][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.070504][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.077538][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.106769][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.113860][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.121126][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.128175][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.157534][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.164617][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.171890][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.179030][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.187259][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.195785][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.204055][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.211877][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.221288][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.230137][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.237500][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.244773][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.252982][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.260890][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.269008][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.276259][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.283494][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.291083][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.298886][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.306404][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.315444][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.328402][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.358649][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.367516][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.375891][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.382948][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.402942][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.411141][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.419300][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.426330][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.433706][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.441660][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.450007][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.458224][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.465246][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.472703][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.480826][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.487875][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.506242][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.514236][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.521710][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.532273][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.539921][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.554243][ T287] device veth0_vlan entered promiscuous mode [ 24.563612][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.571711][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.579989][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.588242][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.596823][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.605259][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.613725][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.622009][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.636686][ T288] device veth0_vlan entered promiscuous mode [ 24.647963][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.656564][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.664869][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.671882][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.679432][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.687945][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.696162][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.703196][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.710599][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.718652][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.728705][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.736340][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.747676][ T290] device veth0_vlan entered promiscuous mode [ 24.756972][ T288] device veth1_macvtap entered promiscuous mode [ 24.766266][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.774686][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.782878][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.790984][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.799332][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.807643][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.815875][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.823733][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.831180][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.840257][ T287] device veth1_macvtap entered promiscuous mode [ 24.849060][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.856782][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.865290][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.875466][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.883871][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.893411][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.901492][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.918375][ T290] device veth1_macvtap entered promiscuous mode [ 24.925348][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.933208][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.941421][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.950605][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.958883][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.967229][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.975169][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.983865][ T289] device veth0_vlan entered promiscuous mode [ 24.990713][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.998259][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.017905][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.026390][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.026449][ T288] request_module fs-gadgetfs succeeded, but still no fs? [ 25.034518][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.050720][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.059169][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.067500][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.075849][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.084116][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.092349][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.100768][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.115952][ T289] device veth1_macvtap entered promiscuous mode [ 25.132579][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.138634][ T311] loop1: detected capacity change from 0 to 512 [ 25.140828][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.155592][ T311] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 25.156027][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.185193][ T311] EXT4-fs error (device loop1): mb_free_blocks:1839: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 25.190668][ T291] device veth0_vlan entered promiscuous mode [ 25.207629][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.208557][ T311] EXT4-fs error (device loop1): ext4_do_update_inode:5281: inode #11: comm syz.1.2: corrupted inode contents [ 25.217068][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.228258][ T311] EXT4-fs error (device loop1): ext4_dirty_inode:6158: inode #11: comm syz.1.2: mark_inode_dirty error [ 25.236165][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.254755][ T311] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.2: invalid indirect mapped block 1 (level 1) [ 25.255049][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.268624][ T311] EXT4-fs error (device loop1): ext4_do_update_inode:5281: inode #11: comm syz.1.2: corrupted inode contents [ 25.276343][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.287811][ T311] EXT4-fs error (device loop1) in ext4_orphan_del:303: Corrupt filesystem [ 25.295554][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.304257][ T311] EXT4-fs error (device loop1): ext4_do_update_inode:5281: inode #11: comm syz.1.2: corrupted inode contents [ 25.311705][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.330395][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.330485][ T311] EXT4-fs error (device loop1): ext4_truncate:4327: inode #11: comm syz.1.2: mark_inode_dirty error [ 25.352026][ T311] EXT4-fs error (device loop1) in ext4_process_orphan:345: Corrupt filesystem [ 25.362479][ T311] EXT4-fs (loop1): 1 truncate cleaned up [ 25.368200][ T291] device veth1_macvtap entered promiscuous mode [ 25.372761][ T311] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 25.383982][ T311] EXT4-fs (loop1): unmounting filesystem. [ 25.391319][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.399675][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.403110][ T317] loop3: detected capacity change from 0 to 16 [ 25.414654][ T317] erofs: (device loop3): mounted with root inode @ nid 36. [ 25.418300][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.461509][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.477233][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.488119][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.497367][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.499505][ T329] loop1: detected capacity change from 0 to 512 [ 25.513939][ T329] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 25.540608][ T329] EXT4-fs (loop1): 1 truncate cleaned up [ 25.546420][ T329] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 25.600254][ T334] syz.0.1 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 25.871028][ T37] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 25.929041][ T288] EXT4-fs (loop1): unmounting filesystem. [ 26.142535][ T37] usb 4-1: Using ep0 maxpacket: 16 [ 26.151292][ T37] usb 4-1: unable to get BOS descriptor or descriptor too short [ 26.160146][ T37] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 26.173064][ T37] usb 4-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 26.182282][ T37] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.190690][ T37] usb 4-1: Product: syz [ 26.195251][ T37] usb 4-1: Manufacturer: syz [ 26.199966][ T37] usb 4-1: SerialNumber: syz [ 26.252486][ T24] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.316045][ T332] ================================================================== [ 26.324138][ T332] BUG: KASAN: slab-out-of-bounds in sk_skb_adjust_room+0x34e/0x610 [ 26.324588][ T343] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.332048][ T332] Read of size 8 at addr ffff888120c7cf48 by task syz.4.5/332 [ 26.332070][ T332] [ 26.332077][ T332] CPU: 1 PID: 332 Comm: syz.4.5 Not tainted syzkaller #0 [ 26.332095][ T332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 26.332114][ T332] Call Trace: [ 26.378048][ T332] [ 26.380977][ T332] __dump_stack+0x21/0x24 [ 26.385295][ T332] dump_stack_lvl+0x110/0x170 [ 26.389951][ T332] ? __cfi_dump_stack_lvl+0x8/0x8 [ 26.394952][ T332] ? pskb_expand_head+0x436/0x12b0 [ 26.400049][ T332] ? sk_skb_adjust_room+0x34e/0x610 [ 26.405230][ T332] print_address_description+0x71/0x200 [ 26.410784][ T332] print_report+0x4a/0x60 [ 26.415099][ T332] kasan_report+0x122/0x150 [ 26.419586][ T332] ? sk_skb_adjust_room+0x34e/0x610 [ 26.424768][ T332] __asan_report_load8_noabort+0x14/0x20 [ 26.430384][ T332] sk_skb_adjust_room+0x34e/0x610 [ 26.435394][ T332] bpf_prog_e15ab8bd9cea3c06+0x19/0x20 [ 26.440831][ T332] sk_psock_verdict_recv+0x1c8/0x7b0 [ 26.446101][ T332] ? skb_recv_datagram+0x140/0x180 [ 26.451198][ T332] unix_stream_read_skb+0x13d/0x300 [ 26.456407][ T332] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 26.462284][ T332] ? __cfi_sk_psock_verdict_recv+0x10/0x10 [ 26.468072][ T332] ? __cfi_unix_stream_read_skb+0x10/0x10 [ 26.473772][ T332] ? __kasan_check_write+0x14/0x20 [ 26.478870][ T332] ? _raw_spin_lock+0x94/0xf0 [ 26.483530][ T332] ? _raw_spin_unlock_irqrestore+0x5a/0x80 [ 26.489318][ T332] sk_psock_verdict_data_ready+0xaf/0x1d0 [ 26.495026][ T332] unix_stream_sendmsg+0x631/0xa80 [ 26.500128][ T332] ? __cfi_unix_stream_sendmsg+0x10/0x10 [ 26.505742][ T332] ? security_socket_sendmsg+0x93/0xb0 [ 26.511189][ T332] __sys_sendto+0x4ac/0x660 [ 26.515679][ T332] ? __cfi___sys_sendto+0x10/0x10 [ 26.520692][ T332] ? __this_cpu_preempt_check+0x13/0x20 [ 26.526220][ T332] ? xfd_validate_state+0x70/0x150 [ 26.531326][ T332] ? __kasan_check_write+0x14/0x20 [ 26.536435][ T332] __x64_sys_sendto+0xe5/0x100 [ 26.541193][ T332] x64_sys_call+0x83/0x9a0 [ 26.545613][ T332] do_syscall_64+0x4c/0xa0 [ 26.550040][ T332] ? clear_bhb_loop+0x30/0x80 [ 26.554701][ T332] ? clear_bhb_loop+0x30/0x80 [ 26.559361][ T332] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.565237][ T332] RIP: 0033:0x7f06ca59fb19 [ 26.569638][ T332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.589239][ T332] RSP: 002b:00007f06cb41c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 26.597649][ T332] RAX: ffffffffffffffda RBX: 00007f06ca825fa0 RCX: 00007f06ca59fb19 [ 26.605619][ T332] RDX: 0000000000000004 RSI: 0000200000000540 RDI: 0000000000000005 [ 26.613578][ T332] RBP: 00007f06ca637b70 R08: 0000000000000000 R09: 0000000000000000 [ 26.621542][ T332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.629497][ T332] R13: 00007f06ca826038 R14: 00007f06ca825fa0 R15: 00007fffaa618a18 [ 26.637457][ T332] [ 26.640459][ T332] [ 26.642761][ T332] The buggy address belongs to the object at ffff888120c7cf00 [ 26.642761][ T332] which belongs to the cache UNIX-STREAM of size 1152 [ 26.656885][ T332] The buggy address is located 72 bytes inside of [ 26.656885][ T332] 1152-byte region [ffff888120c7cf00, ffff888120c7d380) [ 26.670142][ T332] [ 26.672448][ T332] The buggy address belongs to the physical page: [ 26.678834][ T332] page:ffffea0004831f00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x120c7c [ 26.689068][ T332] head:ffffea0004831f00 order:2 compound_mapcount:0 compound_pincount:0 [ 26.697372][ T332] flags: 0x4000000000010200(slab|head|zone=1) [ 26.703433][ T332] raw: 4000000000010200 0000000000000000 dead000000000122 ffff88810020ac00 [ 26.711994][ T332] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 26.720587][ T332] page dumped because: kasan: bad access detected [ 26.726991][ T332] page_owner tracks the page as allocated [ 26.732680][ T332] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 276, tgid 276 (sshd-session), ts 21369348632, free_ts 0 [ 26.752977][ T332] post_alloc_hook+0x1f5/0x210 [ 26.757732][ T332] prep_new_page+0x1c/0x110 [ 26.762217][ T332] get_page_from_freelist+0x2ca9/0x2d20 [ 26.767746][ T332] __alloc_pages+0x1fa/0x610 [ 26.772328][ T332] alloc_slab_page+0x6e/0xf0 [ 26.776894][ T332] new_slab+0x98/0x3e0 [ 26.780948][ T332] ___slab_alloc+0x70f/0xb70 [ 26.785522][ T332] __slab_alloc+0x5e/0xa0 [ 26.789835][ T332] kmem_cache_alloc+0x1a8/0x320 [ 26.794674][ T332] sk_prot_alloc+0x5f/0x320 [ 26.799187][ T332] sk_alloc+0x3b/0x460 [ 26.803239][ T332] unix_create1+0xb8/0x710 [ 26.807653][ T332] unix_create+0x149/0x200 [ 26.812047][ T332] __sock_create+0x39e/0x7c0 [ 26.816619][ T332] __sys_socketpair+0x218/0x5b0 [ 26.821453][ T332] __x64_sys_socketpair+0x9b/0xb0 [ 26.826458][ T332] page_owner free stack trace missing [ 26.831798][ T332] [ 26.834098][ T332] Memory state around the buggy address: [ 26.839701][ T332] ffff888120c7ce00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.847742][ T332] ffff888120c7ce80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.855824][ T332] >ffff888120c7cf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.863875][ T332] ^ [ 26.870269][ T332] ffff888120c7cf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.878314][ T332] ffff888120c7d000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.886349][ T332] ================================================================== [ 26.894985][ T332] Disabling lock debugging due to kernel taint [ 26.911839][ T37] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 26.920570][ T37] snd-usb-audio: probe of 4-1:1.0 failed with error -22 [ 27.025344][ T24] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.035852][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 27.044979][ T24] usb 2-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 27.054300][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.067631][ T24] usb 2-1: Found UVC 1.00 device (046d:0825) [ 27.111251][ T323] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.120560][ T323] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 27.267387][ T24] usb 2-1: No streaming interface found for terminal 2. [ 27.329568][ T37] usb 4-1: 2:1 : bogus bTerminalLink 6 [ 27.477721][ T315] usb 2-1: USB disconnect, device number 2 [ 27.536864][ T37] usb 4-1: USB disconnect, device number 2