last executing test programs: 8m12.506226726s ago: executing program 3 (id=491): syz_mount_image$iso9660(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000440)=ANY=[], 0xf6, 0xa1d, &(0x7f0000000d00)="$eJzs3ctvXGdfB/DvmdiJ41YhbUMJUdtMUqV12+CMHZoo6oIm9jhx8QXZjtQIUFM1CYpiUdSC1FYsUgmxoqJCCAnYoC5ZVSoLukHZwZIVCyTof4AqFhAWaF7NmXEytucSu46dN+/nMzo5t99zm3PmPJnxzHnCz7NGo1FO21y/+ve7WVmePJemf/jm26+a05d3sz/78nbxj8lIkmoy9P/luTI8Nb20OD8gozvJ9ST3kiLJgbTmPRxct3Y9xZ/n2Yfr91L8bY52STayxcYxUINfaHt9/gEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwBNparpWmygyN7tw9f1qb+UQ4H32r2X3fTnqd/H9oGKLpGhOGRlZG+r76JGHu19s/nMyL7XWXmqN/D2SL5558fA7LwxV1tL3qdCu+PTzL+58uLp685OHm4a7Bg6129VcPrBr1Xt0+7eX7HJ9YXZ5cXb+4uV6dXZ5sXrh3LnamSszy9WZ2dSXry2v1OerU0v1iyuLS9WxqTeqExcunK3Wx68tXl24PD0+V1/beP7XJmu1c9X3xn+rfnFpeXHhzHvjy1NXZufmZhculzHN3c2Y880T8TdnV6or9Yvz1eqt26s3zw6qZDNoouueYn3Q5KCcJmuTkxMTk5MT596+8Pb5Wm1o04baBtkUsfcnLXvnH3b02g0/UaXd/2cus1nI1byfatfHVKazlMXM99jfttb/nzpT71tuZ/+/1ssffbj7WMr+/5XW2iu9+v8edRn8aDRaOW83/drj03yeL3InH2Y1q7mZT35yjpse/7f1NMPdtlZ/ems3Py6nnoXMZjmLmc18LpZbqu0t1VzIuZxLLR/kSmaynGpmMpu51LOca1nOSurlGTWVpdRzMStZzFKqGctU3kg1E7mQCzmbauoZz7Us5moWcjnTuVjmciu3y+f9bJ86PgiaeJSgyT5Bk7VkB/v/xpP4P0Eetx2/hsN2Ndr9//6eAY21pbGpXasVAAAAsJN+9V9y6Mjz//wfyXBeLj+Xn5mdq9f2uloAAADADiq/rvdSczbcXHo5hff/AAAA8LQpyt/YFUlGc7y11Pol1L74EAAAAACeEuXf/19pzkabS8dTPLgTyvW9rhsAAACwMwbfY39gRHF67fa/1Rut+Y12RPs+v6Mzs3P18anFuXcm8lp5l4HylwabctuXFMPlzw/ezIlW1InR1nx0fY4jzaiJ8Xcm8mZOthsy9mpz9upYl8jJVuTrrcjX+0SebUYCwNPuZJ/+uF///z+Nlmb//2ZOtyJOHxvan2ToWJeetaZnBYAnxeAxdgZGFL/+8P3/cDvbdf3/87n1v62vFIzno3yc1dzI6fLXBuU3Dtbl+jtftz8zePA1hFqKAZ8GrMX+6/lKTg/4PGC0Y6CX0wM+EWjF5neTs4//QADALjrZox/eSv9/uuP9fza//38wtNBNPykEgCfCgxHsH+PCXrcRAFhPLw0AAAAAAAAAAAAAAAAAAAAAAAAAAAA7b0fv9j+yzeT/2R7X7/EOQ7Bp4WD7Odh+Pn+RZPfqXOxwWZUdyKeRZLeO1+4t5HCy7We162m8P8net2vgwlD7JXHnw9W9uiIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwm4pkX7ftleRAklqSM7tfq8fn7l5XYPf9RudKcT/381kO7V11AAAAAAAAAAAAAAAAAAAAAAAAAAAAAACeTu37/1fSmj/T2pShSnIqyfUkv73XddxJ9/e6Ajvk4DbTddz/v3nM0ygy1DrsKYanppcW55uHvxz7ofLDN99+1Zw6kh941HLKwMqGwSXaJWyM/btn15aeK1ONTt/89M4ffvwH1elLqWR/Lq3MzE3PX15692GSF4vvkmpa05q1+v7xqX/6ukvLv2u2tLuN5c6UT8705nJ/pVvq/uX2c3v15mSzpJX6+yt/9Pu3P+vY9XxOJK+OJWPrS/q95tSjpBMZ7lda8WPxp8Wh/FWul8e/+WwUjaJ5iH6pbP/BW7dXb45/9PHqjR51OpzjSW4kI/3r9GXH7uPl9aSr8qyrDDdLrZVBzX+ODGhjXx05TvRow3PlKTPabsP+nm3oVO3dhlLH817ptr9Vo7M9avRCXutypBsHkt41eq3/ke6u+LH49+JK/i1/0jH+R6V5/E+l96tzfRZlZMeZ0jOy0oosWz7ZueODjZH/9dePVPuuw9SwVX+27sVb6bj+t4/VDl2PGkXf61FHiVt7XWwoccNZ0ed1UfZIRzakaF99eqVp1/NIK6pHPX85byVDx/pdFTf11m8NuKI8SP9u993bff3/TTGW/85d4/8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABPviLZ1217JTmV5PDaejVpbCHbA712VEaLrVZxR9198M9TobLVBMX93M9nOfR4qgMAAAAAAADAbrs0/cM3337VnIqD7U3tv+9Xk6Ekh4u/PJjppcX5ARkNJ9eT3Gsuj3TZ3+fP/c10efbh+r3m2tGttgQAeFQ/CwAA//9Q62fs") r0 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x8) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=[0x7], 0x0, 0x0, 0x1}}, 0x40) 8m12.233238743s ago: executing program 3 (id=494): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f00000003c0), 0x0, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='htcp', 0x4) shutdown(r0, 0x1) 8m12.011177178s ago: executing program 3 (id=498): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='add 1', 0x5) write(r0, &(0x7f0000000180)='add 2', 0x5) write(r0, &(0x7f00000001c0)='add 3', 0x5) write(r0, &(0x7f0000000200)='add 4', 0x5) write(r0, &(0x7f0000000240)='add 5', 0x5) write(r0, 0x0, 0x0) write(r0, &(0x7f00000002c0)='add 7', 0x5) write(r0, &(0x7f0000000300)='add 8', 0x5) write(r0, &(0x7f0000000340)='add 1-', 0x6) write(r0, &(0x7f0000000380)='add 2-', 0x6) write(r0, &(0x7f00000003c0)='add', 0x3) 8m11.803048833s ago: executing program 3 (id=503): syz_mount_image$vfat(&(0x7f0000001200), &(0x7f0000001240)='./file0\x00', 0x2004000, &(0x7f0000000000)=ANY=[@ANYRES64=0x0, @ANYRES32=0x0], 0xfe, 0x123a, &(0x7f00000024c0)="$eJzs3E9rHGUcB/CfmzSpSfNHrdUK0gd70cuQ5OBFQYKkIF1Q2kZoBWFqNrpk3A2ZJbAijZ7Em2/Bq3jUkyDe9BIPgu/AWy4ePagj3UlrViNRW7s1fD6Xfdjn+Q6/Z2YYeJZ9Zu/5j97eWC+z9bwXjQdeiMZmxPgvKVI04pb34pnnvv7myctXr11cbjZXLqV0YfnK4rMppdlzX7727qdPfdWbfvWz2S8mY3f+9b0fl37YPbN7du/XK2+1y9QuU6fbS3m63u328utFK621y40spVeKVl62UrtTtraG+teL7uZmP+WdtZmpza1WWaa8008brX7qdVNvq5/yN/N2J2VZlmamgjux+slPVVVFVNWJmIiqqqoHYyoacSpmYjbmYj4eiofjkTgdj8aZeCwej7ODUREToy4dAAAAAAAAAAAAAAAAAAAAjpHD9v9PD+////zU/tiD+/8Hzo2wcAAAAAAAAAAAAAAAAAAAADhGLl+9dnG52Vy5lNLJiOKD7dXt1fqz7l9ej3YU0YqFmIufY7D7v1a3J6K5spAG5uP9Ymc/v7O9OjacXxy8TuBP+QsvNVcW63wazk/G1MH8UszF6cPzS3/Inx/kT8bT5w/ks5iL796IbhSxFjezv+dvLKb04svN2/lvd+u5r43wugAAAMDdlKXbDl2/Z9lf9df5o34fuLm+Xjh0fT8eT4yPdu5ElP13NvKiaG2NvHGrovqbnYi4Twr7141GRPS/j4i7dMAPb9Rn6G+nJo4afOLI40yP4NR9PB1xB/GxoRvpvrgT/o+No54cY//dQ4l7Zv+iT466DgAAAAAAAAAAAP6Ze/F3wlHPEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPiNHTgWAAAAABDmb51GxwYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXwUAAP//vGrDtw==") open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x8009, 0x0, 0x0, 0x7, 0x8, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d16c2ee5e5ca9000ff8ee09e7376b7a5ff537ed73ac58818d78c660e677df8dc905b90242b7c528a076d2f6a00400", "036c5bc6780820d1cbf7966d61fdcf335263bd9bbdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00000000000000e500", "f2837a00e6d6020000edff000000000000000100", [0x4, 0x7]}) 8m11.1271078s ago: executing program 3 (id=509): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000001200)=0x8a4, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x6, 0x7, 0x0, 0x8001}]}, 0x10) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 8m10.342761099s ago: executing program 3 (id=520): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='add 1', 0x5) write(r0, &(0x7f0000000180)='add 2', 0x5) write(r0, &(0x7f00000001c0)='add 3', 0x5) write(r0, &(0x7f0000000200)='add 4', 0x5) write(r0, &(0x7f0000000240)='add 5', 0x5) write(r0, &(0x7f0000000280), 0x0) write(r0, &(0x7f00000002c0)='add 7', 0x5) write(r0, &(0x7f0000000300)='add 8', 0x5) write(r0, &(0x7f0000000340)='add 1-', 0x6) write(r0, &(0x7f0000000380)='add 2-', 0x6) write(r0, &(0x7f00000003c0)='add', 0x3) 8m9.453518221s ago: executing program 32 (id=520): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='add 1', 0x5) write(r0, &(0x7f0000000180)='add 2', 0x5) write(r0, &(0x7f00000001c0)='add 3', 0x5) write(r0, &(0x7f0000000200)='add 4', 0x5) write(r0, &(0x7f0000000240)='add 5', 0x5) write(r0, &(0x7f0000000280), 0x0) write(r0, &(0x7f00000002c0)='add 7', 0x5) write(r0, &(0x7f0000000300)='add 8', 0x5) write(r0, &(0x7f0000000340)='add 1-', 0x6) write(r0, &(0x7f0000000380)='add 2-', 0x6) write(r0, &(0x7f00000003c0)='add', 0x3) 6m2.461443205s ago: executing program 0 (id=1371): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r0, r0, 0x200000000000000) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2e, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x0, 0x0, 0x4, 0x0, 0x3}, 0xa) syz_emit_ethernet(0x36, &(0x7f00000001c0)={@local, @multicast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x10, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @empty, @multicast1}, {{0x1, 0x4e23, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x0, 0xff}}}}}}, 0x0) 6m2.142641713s ago: executing program 0 (id=1374): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r2, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0) read$nci(r0, &(0x7f00000002c0)=""/100, 0x64) write$nci(r0, &(0x7f0000000580)=@NCI_OP_RF_DISCOVER_RSP={0x1, 0x1, 0x2, 0x3, 0x1, 0x1}, 0x4) 6m0.616480829s ago: executing program 0 (id=1382): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000240)='./file0\x00', 0x2010480, &(0x7f00000001c0), 0x5, 0x76a, &(0x7f0000000fc0)="$eJzs3d9rW1UcAPDvTdt17aatIOh8KghaGEvtrJuCDxMfRHAw0Ge3kGZlNm1Gk461FNwQwRdBxQdBX/bsj/nmqz9e9b/wQTamdsOJD1K5adJla9KlW5MI+XzgNOfce9Nzvjn3nnuSe0kC6FsT6Z9MxKGI+CiJGKstTyJiqJobjDixud3t9bV8mpLY2Hjzj6S6za31tXw0PCd1oFZ4MiJ+fD/icGZ7veWV1flcsVhYqpWnKgvnp8orq0fOLeTmCnOFxWPTMzNHj79w/NjexfrXL6sHr3/82rPfnPjnvSeufvhTEifiYG1dYxx7ZSImaq/JUPoS3uXVva6sx5JeN4AHkh6aA5tHeRyKsRio5loY6WbLAIBOeTciNgCAPpM4/wNAn6l/DnBrfS1fT739RKK7brwSEfs3469f39xcM1i7Zre/eh109FZy15WRJCLG96D+iYj44ru3v0pTdOg6JEAzly5HxJnxie3jf7LtnoXdeq6NbSbuKRv/oHu+T+c/Lzab/2W25j/RZP4z3OTYfRD3P/4z1/agmpbS+d/LDfe23W6Iv2Z8oFZ6pDrnG0rOnisW0rHt0YiYjKHhtDy9Qx2TN/+92Wpd4/zvz0/e+TKtP328s0Xm2uDw3c+ZzVVyDxNzoxuXI54abBZ/stX/SYv576k263j9pQ8+b7UujT+Nt562x99ZG1cinmna/3fuaEt2vD9xqro7TNV3iia+/fWz0Vb1N/Z/mtL66+8FuiHt/9Gd4x9PGu/XLO++jp+vjP3Qat3942++/+9L3qrm99WWXcxVKkvTEfuSN7YvP3rnufVyffs0/smnmx//O+3/6XvCM23GP3j9968fPP7OSuOf3VX/7z5z9fb8QKv62+v/mWpusraknfGv3QY+zGsHAAAAAAAAAAAAAAAAAAAAAAAAAO3KRMTBSDLZrXwmk81u/ob34zGaKZbKlcNnS8uLs1H9rezxGMrUv+pyrOH7UKdr34dfLx+9p/x8RDwWEZ8Oj1TL2XypONvr4AEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACg5kCL3/9P/Tbc69YBAB2zv9cNAAC6zvkfAPrP7s7/Ix1rBwDQPd7/A0D/cf4HgP7j/A8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAECHnTp5Mk0bf6+v5dPy7IWV5fnShSOzhfJ8dmE5n82Xls5n50qluWIhmy8ttPxHlzYfiqXS+ZlYXL44VSmUK1PlldXTC6Xlxcrpcwu5ucLpwlDXIgMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA9pVXVudzxWJhSUZGRmYr0zhKjPRugAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4n/svAAD//9EyKso=") r0 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setresuid(0x0, r1, 0x0) r2 = open(0x0, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r2, 0xc0185879, 0x0) 5m59.964398085s ago: executing program 0 (id=1388): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x4000004, &(0x7f0000000000)={[{@block_validity}, {@minixdf}, {@noblock_validity}, {@lazytime}, {@noauto_da_alloc}, {@block_validity}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x7}}, {@debug}, {@usrjquota}, {@nolazytime}, {@norecovery}]}, 0xfe, 0x477, &(0x7f0000000780)="$eJzs3M1vFOUfAPDvTLctLz9+rYgvIEgVjcSXlpYXOXjRaMJBExM9YDzVtpDKQg2tiRCi1QMeDYl3439hPOnFqBdNvOrdkBDDBdTLmtmZKUvZLVu67QL7+STTPs/M0z7Pd2ae2Wfm2d0AetZI9iOJ+F9E/B4RQ3n25gIj+a/rVy9M/X31wlQStdpbfyX1cteuXpgqi5Z/tzXP1GpFfrBJvRffjZisVmfOFvmxhdMfjM2fO//C7OnJkzMnZ85MHD166OCegSMThzsSZxbXtV0fz+3eeeydS29MHb/03k9JJfK4Y1kcnTKS792mnu50ZV22rSFd37FL9v5yI93sTKCb+iIiO1z99f4/FH2xeWnbULz2WVcbB6yrWq1WW+GqvFgD7mNJdLsFQHcUtwD1+99y2cDhR9ddeTm/Acrivl4s+ZZKpHlib/+y+9tOGomI44v/fJUtsU7PIQAAGn2XjX+ebzb+S+PhPDGQ/fh/MYcyHBEPRMT2iHgwInZExEMR9bKPRMSjq6x/+QzJreOf9PIdB9eGbPz3UjG3dfP4Ly2LDPcVuW31+PuTE7PVmQPFPtkf/YMnZpOZ8RXq+P7V375ota1x/JctWf3lWLBox+XK4Kab/mZ6cmFyTUE3uPJpxK5Ks/iTKKdxkojYGRG77rCO2WcrLbfdPv4VtP63bat9HfFMfvwXY1n8paTl/OT4i0cmDo9tiurMgbHyrLjVz79efLNV/WuKvwOy47+l6fm/FP9wsili/tz5U/X52vnV13Hxj89b3tO0d/4vZY5tK87/geTt+oqBYsNHkwsLZ8cjBpLXb10/ceO/lfmyfBb//n3N+//2uLEnHouI3RGxJyIez24Ki7Y/ERFPRsS+FeL/8ZWn3l99/BszV5rFP3274x+Nx3/1ib5TP3x7+/iza1yr43+ontpfrGnn+tduA9ey7wAAAOBekdbfA5+ko0mlSKfp6Gj+Hv4dsSWtzs0vPHdi7sMz0/l75YejPy2fdA01PA8dL54Nl/mJZfmDxXPjL/s21/OjU3PV6W4HDz1ua9n/l64Fef/P/NnX7dYB664D82jAPUr/h96l/0NvSvR/6Gn6P/SuZv3/k5alR79Z18YAG8rrP/SuNvr/Yv6r9agAuDd5/Yfepf9DT2r52fh0TR/53/DEv8X3Gd4t7bn/E5HeFc24/xOVtr/MYhWJ2lDe/7M1g03LdPvKBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0Bn/BQAA///T8uXN") mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) syz_mount_image$vfat(&(0x7f0000000040), &(0x7f00000001c0)='./bus\x00', 0x104b8ad, 0x0, 0x3, 0x0, &(0x7f0000000240)) renameat2(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000001c0)='./bus/file0\x00', 0x5) 5m58.449417592s ago: executing program 0 (id=1393): write(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x300000a, 0x12, r0, 0x852ac000) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000000000)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local, {[@timestamp_addr={0x44, 0x4, 0x8, 0x1, 0xc}]}}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0xfffe}}}}}}, 0x0) 5m57.30266274s ago: executing program 0 (id=1402): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) setsockopt(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000000140)=0xfffffdfb) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000000)={0xffffffff, 0xc9a, 0x8007fffd, 0x0, 0xe, "dce4f0020100000000001b347d5c00010200"}) r1 = socket(0xa, 0x3, 0x87) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={@private2={0xfc, 0x2, '\x00', 0x1}, 0x8000018}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f00000001c0)={@local, 0x18}) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x8936, &(0x7f0000000000)) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TIOCOUTQ(r2, 0x5411, &(0x7f0000000080)) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0}, 0x0) 5m57.033860707s ago: executing program 33 (id=1402): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) setsockopt(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000000140)=0xfffffdfb) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000000)={0xffffffff, 0xc9a, 0x8007fffd, 0x0, 0xe, "dce4f0020100000000001b347d5c00010200"}) r1 = socket(0xa, 0x3, 0x87) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={@private2={0xfc, 0x2, '\x00', 0x1}, 0x8000018}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f00000001c0)={@local, 0x18}) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x8936, &(0x7f0000000000)) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TIOCOUTQ(r2, 0x5411, &(0x7f0000000080)) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0}, 0x0) 5m51.315214276s ago: executing program 1 (id=1425): recvmsg$unix(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}, 0x0) r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000200)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000ffff00000000000000bd0000000000000000000000e4ec01000000004000000000fc00000000000000000000000000013da51fd47aa2e2f700000000000000000000000000000000000000000000000000000000000000060000000000000000050000000a004e200e8a34c38f"], 0x310) 5m51.008597324s ago: executing program 1 (id=1426): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x2210000, &(0x7f0000000080), 0xb, 0x57c, &(0x7f0000000c40)="$eJzs3V1rHFUfAPD/bDbp6/M0hVLUCwn0wkrtpkl8qSC0XooWC3pfl2QaSjbdkt2UJhbaXlgQb6QIIhbFD+C9l8UPoJ+ioIUiJeiFN5HZzLbbJJvNy9ZN3d8PJjlnZnbPnDlzzv7Pzi4bQN8ayf4UIl6MiC+TiEMt24qRbxxZ2W/p0fXJbEliefmjP5JI8nXN/ZP8/4E880JE/PxZxInC2nJrC4sz5Uolncvzo/XZK6O1hcWTl2bL0+l0enl8YuL0GxPjb7/1Ztfq+ur5v7758N57p784tvT1jw8O30nibBzMt7XWYwdu5v8bp2IkRvJzMhhnV+041oXCdpOk1wfAtgzk/XwwsjHgUAzkvR7477sREctAn0r0f+hTzTigObfv0jz4ufHw3ZUJ0Nr6F1feG4m9jbnR/qXkqZlRNt8d7kL5WRk//X73TrZEh/chbnShPICmm7ci4lSxuHb8S/Lxb/tONd483tjqMvrt9Qd66V4W/7y2XvxTeBz/xDrxz4F1+u52dO7/hQddKKatLP57Z9349/HQNTyQ5/7XiPkGk4uXKumpiPh/RByPwT1ZfqP7OaeX7i+329Ya/2VLVn4zFsyP40Fxz9OPmSrXyzupc6uHtyJeehL/JrFm/N/biHVXt392Ps5niV8+71jG0fTuy+22da5/q+5HwMs/RLyybvs/uaOVbHx/crRxPYw2r4q1/rx99Nd25W+t/t2Xtf/+jes/nLTer61tvYzv9/6dttu23et/KPm4kR7K110r1+tzYxFDyQdr148/eWwz39w/q//xYxuPf0PrXP/7IuKTTdb/9pHbbXfdDe0/taX233ri/vufftuu/M21/+uN1PF8zWbGv80e4E7OHQAAAAAAAOw2hYg4GEmh9DhdKJRKK5/vOBL7C5VqrX7iYnX+8lQ0vis7HIOF5p3uQy2fhxjLPw/bzI+vyk9ExOGI+GpgXyNfmqxWpnpdeQAAAAAAAAAAAAAAAAAAANglDrT5/n/mt4FeHx3wzPnJb+hfHft/N37pCdiVvP5D/9L/oX/p/9C/ivFdrw8B6BGv/9C/9H/oX/o/9C/9HwAAAAAAAAAAAAAAAAAAAAAAAAAAALrq/Llz2bK89Oj6ZJafurowP1O9enIqrc2UZucnS5PVuSul6Wp1upKWJquznZ6vUq1eGRuP+Wuj9bRWH60tLF6Yrc5frl+4NFueTi+kg/9KrQAAAAAAAAAAAAAAAAAAAOD5UltYnClXKumcRNvEmdgVh7HtRNKplc/kF8OWnjnyRLH3FZR4BokeD0wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0OKfAAAA//+HzDVX") chdir(&(0x7f0000000140)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0) r0 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) getdents(r0, 0x0, 0x0) 5m50.531198475s ago: executing program 1 (id=1428): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x3, 0x8}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x2000) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0x6000000, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0x8, 0x2, [@TCA_FW_ACT={0x4}]}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x4000800) 5m44.240203689s ago: executing program 1 (id=1447): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x4000004, &(0x7f0000000000)={[{@block_validity}, {@minixdf}, {@noblock_validity}, {@lazytime}, {@noauto_da_alloc}, {@block_validity}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x7}}, {@debug}, {@usrjquota}, {@nolazytime}, {@norecovery}]}, 0xfe, 0x477, &(0x7f0000000780)="$eJzs3M1vFOUfAPDvTLctLz9+rYgvIEgVjcSXlpYXOXjRaMJBExM9YDzVtpDKQg2tiRCi1QMeDYl3439hPOnFqBdNvOrdkBDDBdTLmtmZKUvZLVu67QL7+STTPs/M0z7Pd2ae2Wfm2d0AetZI9iOJ+F9E/B4RQ3n25gIj+a/rVy9M/X31wlQStdpbfyX1cteuXpgqi5Z/tzXP1GpFfrBJvRffjZisVmfOFvmxhdMfjM2fO//C7OnJkzMnZ85MHD166OCegSMThzsSZxbXtV0fz+3eeeydS29MHb/03k9JJfK4Y1kcnTKS792mnu50ZV22rSFd37FL9v5yI93sTKCb+iIiO1z99f4/FH2xeWnbULz2WVcbB6yrWq1WW+GqvFgD7mNJdLsFQHcUtwD1+99y2cDhR9ddeTm/Acrivl4s+ZZKpHlib/+y+9tOGomI44v/fJUtsU7PIQAAGn2XjX+ebzb+S+PhPDGQ/fh/MYcyHBEPRMT2iHgwInZExEMR9bKPRMSjq6x/+QzJreOf9PIdB9eGbPz3UjG3dfP4Ly2LDPcVuW31+PuTE7PVmQPFPtkf/YMnZpOZ8RXq+P7V375ota1x/JctWf3lWLBox+XK4Kab/mZ6cmFyTUE3uPJpxK5Ks/iTKKdxkojYGRG77rCO2WcrLbfdPv4VtP63bat9HfFMfvwXY1n8paTl/OT4i0cmDo9tiurMgbHyrLjVz79efLNV/WuKvwOy47+l6fm/FP9wsili/tz5U/X52vnV13Hxj89b3tO0d/4vZY5tK87/geTt+oqBYsNHkwsLZ8cjBpLXb10/ceO/lfmyfBb//n3N+//2uLEnHouI3RGxJyIez24Ki7Y/ERFPRsS+FeL/8ZWn3l99/BszV5rFP3274x+Nx3/1ib5TP3x7+/iza1yr43+ontpfrGnn+tduA9ey7wAAAOBekdbfA5+ko0mlSKfp6Gj+Hv4dsSWtzs0vPHdi7sMz0/l75YejPy2fdA01PA8dL54Nl/mJZfmDxXPjL/s21/OjU3PV6W4HDz1ua9n/l64Fef/P/NnX7dYB664D82jAPUr/h96l/0NvSvR/6Gn6P/SuZv3/k5alR79Z18YAG8rrP/SuNvr/Yv6r9agAuDd5/Yfepf9DT2r52fh0TR/53/DEv8X3Gd4t7bn/E5HeFc24/xOVtr/MYhWJ2lDe/7M1g03LdPvKBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0Bn/BQAA///T8uXN") mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000001c0)='./bus/file0\x00', 0x5) 5m43.571164855s ago: executing program 1 (id=1450): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000023c0)=ANY=[@ANYBLOB="1400000001090101"], 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0xc854) 5m41.689261s ago: executing program 1 (id=1460): creat(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) creat(&(0x7f0000000e00)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) mknod$loop(&(0x7f0000000700)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x800, 0x1) mknod$loop(&(0x7f0000000080)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x800, 0x0) 5m41.174018593s ago: executing program 34 (id=1460): creat(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) creat(&(0x7f0000000e00)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) mknod$loop(&(0x7f0000000700)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x800, 0x1) mknod$loop(&(0x7f0000000080)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x800, 0x0) 2.966318398s ago: executing program 6 (id=3136): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) listen(r0, 0xfffffffc) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 2.848124251s ago: executing program 5 (id=3137): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x185042, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000001ac0)={r0, 0x2000, {0x0, 0x0, 0x0, 0x3, 0x14a1fa, 0x0, 0x0, 0x1c, 0x4, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1cac3f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174f000000000000000010e200", [0x82, 0x3fd]}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys\x00', 0x101080, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0) write(r2, &(0x7f0000000200)='wwnn=0x1111111111111111,wwpn=0x2222222222222222', 0x2f) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/fcloop/ctl/add_target_port\x00', 0x82001, 0x0) write(r3, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444\x00', 0x2f) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000280)='highspeed\x00', 0xa) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0) write(r4, &(0x7f0000000600)='wwnn=0x3333333333333333,wwpn=0x4444444444444444,roles=32,lpwwnn=0x1111111111111111,lpwwpn=0x2222222222222222\x00', 0x6c) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/fcloop/ctl/set_cmd_drop\x00', 0x1, 0x0) write(r5, &(0x7f0000000800)='101:0:1\x00', 0x7) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000940)=ANY=[@ANYRESHEX=r5, @ANYRESDEC=r4, @ANYBLOB="01000000000000000000", @ANYRES16=r4], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x4, 0xc, 0x0, &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write(0xffffffffffffffff, &(0x7f0000000a00)='transport=fc,traddr=nn-0x3333333333333333:pn-0x4444444444444444,host_traddr=nn-0x1111111111111111:pn-0x2222222222222222,nqn=nqn.2014-08.org.nvmexpress.discovery\x00', 0xa1) close(0xffffffffffffffff) r8 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x7, &(0x7f0000000300)=ANY=[@ANYRES32=0x0, @ANYRES16=r4, @ANYRESDEC, @ANYRESOCT=r6, @ANYRES32=r7, @ANYRES32=r2], &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x41100, 0x9, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x9, 0x3}, 0x8, 0x10, &(0x7f00000001c0)={0x5, 0x8, 0x8001, 0x6}, 0x10, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000340)=[{0x2, 0x1, 0x3, 0x9}, {0x0, 0x3, 0x7, 0x3}, {0xfffffffd, 0x3, 0xb, 0x7}, {0x2, 0x4, 0xc, 0x6}, {0x3, 0x3, 0x10, 0x8}, {0x0, 0x2, 0x9, 0x9}, {0x0, 0x4, 0x5}, {0x3, 0x3, 0x1, 0x3}, {0x4, 0x2, 0xb, 0x3}], 0x10, 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c40)={r9, 0x0, 0x0, 0x8d, &(0x7f0000000540), &(0x7f0000000740)=""/141, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x5}, 0x50) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x2012, r8, 0x0) mkdirat(r4, &(0x7f0000000540)='./sys\x00', 0x10) 2.698134394s ago: executing program 5 (id=3140): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r0, 0xc05064a7, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1}) 2.581843527s ago: executing program 5 (id=3141): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x101700) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000080)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000240), 0x400000000a0a01, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x111, 0x6}}, 0x20) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r2, 0xc0844123, &(0x7f00000001c0)) ioctl$SNDRV_PCM_IOCTL_FORWARD(r2, 0x40084149, &(0x7f0000000100)=0x8) 2.364537343s ago: executing program 5 (id=3145): mmap(&(0x7f000091d000/0x12000)=nil, 0x12000, 0xf, 0x30, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x8081, 0x0) write(r1, &(0x7f0000000200)='md0\n\x00', 0x4) close(r0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x8, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) r7 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r7, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x8, 0x4003, 0x400, 0x0, {0xa, 0x1000, 0xb9c, @local}}}, 0x32) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001280), r8) sendmsg$L2TP_CMD_TUNNEL_GET(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="14000000", @ANYRES16=r9, @ANYBLOB="2503000000000000000008"], 0x14}}, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a00000000040000020000000200000000000000010000000000000000000000000000000000000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x400c0930, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000440)="020000000100000002000000ffffff") r10 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r10, &(0x7f0000000600)='3\n\x00', 0x2) syz_emit_vhci(&(0x7f0000000180)=ANY=[@ANYBLOB], 0xd) close(r10) 2.202260017s ago: executing program 5 (id=3146): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./my_configfs\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./my_configfs/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) chdir(&(0x7f0000000b00)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='control/header/h\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='streaming/header/h\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='streaming/uncompressed/u\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='streaming/uncompressed/u/360p\x00', 0x1ff) symlink(&(0x7f0000001200)='control/header/h\x00', 0x0) symlink(&(0x7f0000001400)='streaming/uncompressed/u\x00', &(0x7f0000001500)='streaming/header/h/u\x00') symlink(&(0x7f0000001600)='streaming/header/h\x00', &(0x7f0000001700)='streaming/class/fs/h\x00') symlink(0x0, &(0x7f0000001900)='streaming/class/hs/h\x00') symlink(0x0, &(0x7f0000001b00)='streaming/class/ss/h\x00') fchdir(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='control/header/h\x00', 0x1, 0x118) write(r1, &(0x7f0000001f00)='usbip-vudc.0', 0xc) nanosleep(&(0x7f0000002000)={0x0, 0x5f5e100}, 0x0) r2 = syz_open_dev$video(&(0x7f0000002100), 0x0, 0x2) r3 = syz_open_dev$video(0x0, 0x1, 0x2) r4 = syz_open_dev$video(&(0x7f0000002400), 0x3, 0x2) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x401c565a, &(0x7f0000002600)={0x8000004}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r3, 0x401c565a, &(0x7f0000002700)={0x8000004}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r4, 0x401c565a, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x401c565a, &(0x7f0000002a00)={0x8000004}) close(r2) close(r3) close(0xffffffffffffffff) close(r4) close(0xffffffffffffffff) 1.978870152s ago: executing program 6 (id=3149): syz_open_dev$dri(0x0, 0x1, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r0, 0xc05064a7, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1}) 1.877916294s ago: executing program 5 (id=3151): syz_usb_connect(0x5, 0x4e, &(0x7f0000000000)=ANY=[], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x60) ioctl$TIOCMGET(r0, 0x5415, 0x0) 1.857000875s ago: executing program 6 (id=3152): ftruncate(0xffffffffffffffff, 0x100000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./config\x00', 0x399242, 0x1d) socket$kcm(0x2, 0x1000000000000002, 0x0) write(r0, &(0x7f0000000200)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0) write(r1, 0x0, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='.', 0x1) 1.720244278s ago: executing program 6 (id=3153): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5f1000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) 900.457688ms ago: executing program 6 (id=3162): openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(&(0x7f0000000100)=@filename='configfs\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nullb/nullb1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000e00)='1\n', 0x2) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nullb/nullb1/power\x00', 0x2, 0x0) write(r0, &(0x7f0000000700)='1', 0x1) 813.301511ms ago: executing program 6 (id=3164): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000200)="98e2a815325d16965a04d665912e3ae38e9264095421d18b72301ab25d9849a3631491688bebafa42c86c3d054e89731ed0a1cff124869a964126b8974e822dc00c3b41a0efb7f40adc21b1e6876150c9423083b49bb7f74a5a71ca2b6703f9b1a5d6fe2812f327bf1fec7065c", 0x6d, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@timestamp, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @timestamp, @window={0x3, 0xfffe}, @sack_perm], 0x2000000000000061) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) 697.012593ms ago: executing program 2 (id=3166): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x1, @empty, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r2, 0x40047438, &(0x7f0000000040)) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f00000000c0)) write$ppp(r2, &(0x7f0000000280)="dce0", 0x2) 611.925605ms ago: executing program 2 (id=3167): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./lower\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./upper\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./work\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./mnt\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000200)='./mnt\x00', &(0x7f0000000240)='overlay\x00', 0x0, &(0x7f0000000300)='lowerdir=lower,upperdir=upper,workdir=work,index=on,nfs_export=on\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt/dir\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000140)=""/106, 0x6a) 562.456056ms ago: executing program 4 (id=3168): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) listen(r0, 0xfffffffc) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 477.129008ms ago: executing program 4 (id=3169): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x185042, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000001ac0)={r0, 0x2000, {0x0, 0x0, 0x0, 0x3, 0x14a1fa, 0x0, 0x0, 0x1c, 0x4, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1cac3f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174f000000000000000010e200", [0x82, 0x3fd]}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys\x00', 0x101080, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0) write(r2, &(0x7f0000000200)='wwnn=0x1111111111111111,wwpn=0x2222222222222222', 0x2f) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/fcloop/ctl/add_target_port\x00', 0x82001, 0x0) write(r3, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444\x00', 0x2f) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000280)='highspeed\x00', 0xa) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0) write(r4, &(0x7f0000000600)='wwnn=0x3333333333333333,wwpn=0x4444444444444444,roles=32,lpwwnn=0x1111111111111111,lpwwpn=0x2222222222222222\x00', 0x6c) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/fcloop/ctl/set_cmd_drop\x00', 0x1, 0x0) write(r5, &(0x7f0000000800)='101:0:1\x00', 0x7) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000940)=ANY=[@ANYRESHEX=r5, @ANYRESDEC=r4, @ANYBLOB="01000000000000000000", @ANYRES16=r4], 0x50) close(r5) write(0xffffffffffffffff, &(0x7f0000000a00)='transport=fc,traddr=nn-0x3333333333333333:pn-0x4444444444444444,host_traddr=nn-0x1111111111111111:pn-0x2222222222222222,nqn=nqn.2014-08.org.nvmexpress.discovery\x00', 0xa1) close(0xffffffffffffffff) r7 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x7, &(0x7f0000000300)=ANY=[@ANYRES32=0x0, @ANYRES16=r4, @ANYRESDEC, @ANYRESOCT=r6, @ANYRES32, @ANYRES32=r2], &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x41100, 0x9, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x9, 0x3}, 0x8, 0x10, &(0x7f00000001c0)={0x5, 0x8, 0x8001, 0x6}, 0x10, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000340)=[{0x2, 0x1, 0x3, 0x9}, {0x0, 0x3, 0x7, 0x3}, {0xfffffffd, 0x3, 0xb, 0x7}, {0x2, 0x4, 0xc, 0x6}, {0x3, 0x3, 0x10, 0x8}, {0x0, 0x2, 0x9, 0x9}, {0x0, 0x4, 0x5}, {0x3, 0x3, 0x1, 0x3}, {0x4, 0x2, 0xb, 0x3}], 0x10, 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c40)={r8, 0x0, 0x0, 0x8d, &(0x7f0000000540), &(0x7f0000000740)=""/141, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x5}, 0x50) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x2012, r7, 0x0) mkdirat(r4, &(0x7f0000000540)='./sys\x00', 0x10) 416.64942ms ago: executing program 2 (id=3170): ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000180)={0xcf43, 0x4c8, 0x2, 0x9fff, 0xe, "3d52e3ff00"}) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x40, 0x3, 0x7, 0x16, "b0bf2ebb48c849ac0000000003000018bfff40"}) r0 = syz_open_pts(0xffffffffffffffff, 0x0) r1 = dup3(r0, 0xffffffffffffffff, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000)=0xff) 343.902602ms ago: executing program 2 (id=3171): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./my_configfs\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./my_configfs/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) chdir(&(0x7f0000000b00)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='control/header/h\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='streaming/header/h\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='streaming/uncompressed/u\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='streaming/uncompressed/u/360p\x00', 0x1ff) symlink(&(0x7f0000001200)='control/header/h\x00', 0x0) symlink(&(0x7f0000001400)='streaming/uncompressed/u\x00', &(0x7f0000001500)='streaming/header/h/u\x00') symlink(&(0x7f0000001600)='streaming/header/h\x00', &(0x7f0000001700)='streaming/class/fs/h\x00') symlink(0x0, &(0x7f0000001900)='streaming/class/hs/h\x00') symlink(0x0, &(0x7f0000001b00)='streaming/class/ss/h\x00') fchdir(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='control/header/h\x00', 0x1, 0x118) write(r1, &(0x7f0000001f00)='usbip-vudc.0', 0xc) nanosleep(&(0x7f0000002000)={0x0, 0x5f5e100}, 0x0) r2 = syz_open_dev$video(&(0x7f0000002100), 0x0, 0x2) r3 = syz_open_dev$video(0x0, 0x2, 0x2) r4 = syz_open_dev$video(&(0x7f0000002400), 0x3, 0x2) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x401c565a, &(0x7f0000002600)={0x8000004}) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x401c565a, &(0x7f0000002700)={0x8000004}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r4, 0x401c565a, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x401c565a, &(0x7f0000002a00)={0x8000004}) close(r2) close(0xffffffffffffffff) close(r3) close(r4) close(0xffffffffffffffff) 283.526673ms ago: executing program 4 (id=3172): openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nullb/nullb1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000e00)='1\n', 0x2) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nullb/nullb1/power\x00', 0x2, 0x0) write(r0, &(0x7f0000000700)='1', 0x1) 148.663476ms ago: executing program 4 (id=3173): ftruncate(0xffffffffffffffff, 0x100000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./config\x00', 0x399242, 0x1d) socket$kcm(0x2, 0x1000000000000002, 0x0) write(r0, &(0x7f0000000200)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0) write(r1, 0x0, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='.', 0x1) 127.858287ms ago: executing program 2 (id=3174): write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xb) r0 = socket(0x2a, 0x2, 0x20003a) getsockopt$inet_mreqn(r0, 0x0, 0x24, 0x0, 0x0) syz_emit_vhci(0x0, 0x10) close(0xffffffffffffffff) 110.017517ms ago: executing program 4 (id=3175): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x1, @empty, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r2, 0x40047438, &(0x7f0000000040)) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f00000000c0)) write$ppp(r2, &(0x7f0000000280)="dce0", 0x2) 593.62µs ago: executing program 2 (id=3176): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000380)=@delqdisc={0x434, 0x25, 0x100, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0xa, 0x7}, {0x0, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x3, 0xfffffff8, 0x4, 0x40, 0x2, 0x2, 0x5, 0x7fff, 0x4, 0x1, 0x6, 0x1c8, 0x7, 0x0, 0x5, 0x1, 0x8, 0x9, 0x9, 0x9, 0xf9, 0x200, 0x1, 0x5, 0x6, 0xfff, 0x9, 0x1, 0x80, 0x10000, 0x0, 0x6, 0xff, 0x4, 0x6, 0x9, 0xe6c1, 0x2, 0x65, 0x6, 0x5, 0x71, 0x1f146d7e, 0x80000001, 0x89, 0xe9, 0x80000001, 0x2, 0xff, 0x8, 0xffff8dc2, 0x400, 0x0, 0x2, 0xffff, 0x10001, 0x0, 0x2, 0x8, 0xa000000, 0x0, 0x5, 0x8, 0x3, 0x4, 0x401, 0x5, 0x8, 0x4ad1, 0x1, 0x25b1, 0x5, 0xfff, 0x0, 0xe, 0xffffffff, 0x3, 0x5, 0x3ff, 0xfff, 0x8, 0xf, 0x0, 0x4, 0x626cfd3b, 0x0, 0x60df8662, 0x2, 0x5, 0x4, 0xc6, 0x8, 0x7, 0xfffffffa, 0xc, 0x4, 0xffffffff, 0xa80, 0x0, 0x7, 0x2, 0x0, 0xff, 0x8, 0x7, 0xc, 0xfdc1, 0x77f, 0x4, 0xfffffff0, 0x4, 0x7fff, 0x1000, 0x1, 0x1f1f, 0x3, 0x665195e5, 0x5, 0x7, 0x5, 0x6, 0x7, 0x4, 0x800, 0x101, 0x400, 0x2, 0x6, 0xd, 0x9, 0x7, 0xc5, 0x99, 0x4, 0x2e9, 0x4, 0x3, 0x401, 0xfffffffe, 0x7, 0x80000000, 0x8, 0x0, 0x4, 0x37, 0x4, 0x31, 0x2, 0x2, 0x3, 0x6, 0x1, 0x690c, 0x368d, 0x9, 0x2, 0xe, 0x8, 0x7, 0x5597, 0x3, 0x7, 0x7fff, 0x62, 0xf6, 0x5, 0x0, 0x7fffffff, 0xd, 0x9, 0x2, 0x100, 0x6, 0x101, 0x5, 0x2, 0x3, 0x4, 0xfc8d, 0x8, 0x3ff, 0x3, 0x0, 0x3, 0x5, 0x9, 0x5, 0x8000, 0x1, 0x7, 0x20000, 0x4, 0x2, 0x9f85, 0x65, 0x4, 0x0, 0x7ff, 0x4, 0x6, 0x7, 0xd92, 0x40, 0xfff, 0xe1, 0x8, 0x426, 0x5, 0x9, 0x1, 0x1000, 0x9, 0x36ae765f, 0x401, 0x9, 0x200000, 0x3, 0x4, 0x5, 0x0, 0x89, 0x5, 0x80000000, 0x9c4, 0x1, 0x41632842, 0x6, 0x10, 0x2, 0x8001, 0x5, 0x100, 0x8, 0x9, 0xfe64, 0xd, 0x1c2, 0x2, 0x6, 0x2, 0x80000001, 0xa, 0x6, 0xfffffffc, 0x5, 0x3, 0x7f, 0x400000, 0x5, 0x3, 0x6, 0x8001, 0x10001, 0x5, 0x4, 0x7]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x40000}, 0x8010) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 0s ago: executing program 4 (id=3177): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./my_configfs\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./my_configfs/usb_gadget/g1\x00', 0x1ff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) chdir(&(0x7f0000000b00)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='control/header/h\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='streaming/header/h\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='streaming/uncompressed/u\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='streaming/uncompressed/u/360p\x00', 0x1ff) symlink(&(0x7f0000001200)='control/header/h\x00', 0x0) symlink(&(0x7f0000001400)='streaming/uncompressed/u\x00', &(0x7f0000001500)='streaming/header/h/u\x00') symlink(&(0x7f0000001600)='streaming/header/h\x00', &(0x7f0000001700)='streaming/class/fs/h\x00') symlink(0x0, &(0x7f0000001900)='streaming/class/hs/h\x00') symlink(0x0, &(0x7f0000001b00)='streaming/class/ss/h\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='control/header/h\x00', 0x1, 0x118) write(r0, &(0x7f0000001f00)='usbip-vudc.0', 0xc) nanosleep(&(0x7f0000002000)={0x0, 0x5f5e100}, 0x0) r1 = syz_open_dev$video(&(0x7f0000002100), 0x0, 0x2) r2 = syz_open_dev$video(0x0, 0x1, 0x2) r3 = syz_open_dev$video(0x0, 0x2, 0x2) r4 = syz_open_dev$video(&(0x7f0000002400), 0x3, 0x2) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x401c565a, &(0x7f0000002600)={0x8000004}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x401c565a, &(0x7f0000002700)={0x8000004}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r4, 0x401c565a, 0x0) close(r1) close(r2) close(r3) close(r4) close(0xffffffffffffffff) kernel console output (not intermixed with test programs): 000 [ 493.284867][T12441] do_coredump+0x1791/0x24a0 [ 493.289495][T12441] ? nfs_stat_to_errno+0x170/0x170 [ 493.294649][T12441] ? lock_chain_count+0x20/0x20 [ 493.299533][T12441] ? _raw_spin_unlock_irq+0x23/0x50 [ 493.304753][T12441] ? lockdep_hardirqs_on+0x98/0x150 [ 493.310006][T12441] get_signal+0x10da/0x1390 [ 493.314556][T12441] arch_do_signal_or_restart+0xc2/0x7b0 [ 493.320140][T12441] ? get_sigframe_size+0x20/0x20 [ 493.325113][T12441] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 493.331131][T12441] ? exit_to_user_mode_loop+0x3b/0x110 [ 493.336641][T12441] exit_to_user_mode_loop+0x70/0x110 [ 493.341974][T12441] exit_to_user_mode_prepare+0xee/0x180 [ 493.347548][T12441] irqentry_exit_to_user_mode+0x9/0x30 [ 493.353036][T12441] exc_page_fault+0x8c/0x100 [ 493.357670][T12441] asm_exc_page_fault+0x26/0x30 [ 493.362554][T12441] RIP: 0033:0x7fe424c53bd7 [ 493.366989][T12441] Code: e8 fe f9 ff ff 89 f2 48 8d 3d 5d 4f 1b 00 48 8d 35 c3 0a 1e 00 31 c0 e8 37 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 493.386704][T12441] RSP: 002b:00007fe425cd5120 EFLAGS: 00010202 [ 493.392796][T12441] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007fe424d9e0d9 [ 493.400784][T12441] RDX: 00007fe425cd5140 RSI: 00007fe425cd5270 RDI: 000000000000000b [ 493.408771][T12441] RBP: 00007fe424e35024 R08: 0000000000000000 R09: 0000000000000000 [ 493.416757][T12441] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 493.424747][T12441] R13: 00007fe425026038 R14: 00007fe425025fa0 R15: 00007ffc46797428 [ 493.432782][T12441] [ 493.481655][T12441] memory: usage 307200kB, limit 307200kB, failcnt 38964 [ 493.488762][T12441] memory+swap: usage 380316kB, limit 9007199254740988kB, failcnt 0 [ 493.501342][T12441] kmem: usage 2648kB, limit 9007199254740988kB, failcnt 0 [ 493.523393][T12441] Memory cgroup stats for /syz2: [ 493.523779][T12441] cache 311451648 [ 493.551218][T12441] rss 409600 [ 493.561394][T12441] rss_huge 0 [ 493.572889][T12441] shmem 311443456 [ 493.576584][T12441] mapped_file 133865472 [ 493.580765][T12441] dirty 8192 [ 493.592716][T12441] writeback 0 [ 493.596051][T12441] workingset_refault_anon 0 [ 493.600594][T12441] workingset_refault_file 2114 [ 493.612739][T12441] swap 74870784 [ 493.621671][T12441] pgpgin 645124 [ 493.628827][T12441] pgpgout 568986 [ 493.638931][T12441] pgfault 420237 [ 493.647323][T12441] pgmajfault 6251 [ 493.651076][T12441] inactive_anon 152494080 [ 493.676429][T12441] active_anon 159358976 [ 493.680636][T12441] inactive_file 8192 [ 493.694936][T12441] active_file 0 [ 493.698450][T12441] unevictable 0 [ 493.703532][T12441] hierarchical_memory_limit 314572800 [ 493.709023][T12441] hierarchical_memsw_limit 9223372036854771712 [ 493.719016][T12441] total_cache 311451648 [ 493.735272][T12441] total_rss 409600 [ 493.739046][T12441] total_rss_huge 0 [ 493.743289][T12441] total_shmem 311443456 [ 493.748651][T12441] total_mapped_file 133865472 [ 493.761780][T12441] total_dirty 8192 [ 493.765572][T12441] total_writeback 0 [ 493.791799][T12441] total_workingset_refault_anon 0 [ 493.799168][T12441] total_workingset_refault_file 2114 [ 493.819688][T12441] total_swap 74870784 [ 493.829827][T12441] total_pgpgin 645124 [ 493.838371][T12441] total_pgpgout 568986 [ 493.852268][T12441] total_pgfault 420237 [ 493.856435][T12441] total_pgmajfault 6251 [ 493.860619][T12441] total_inactive_anon 152494080 [ 493.872747][T12441] total_active_anon 159358976 [ 493.877479][T12441] total_inactive_file 8192 [ 493.902632][T12441] total_active_file 0 [ 493.906663][T12441] total_unevictable 0 [ 493.910672][T12441] anon_cost 0 [ 493.935031][T12441] file_cost 0 [ 493.938385][T12441] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz2,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.2045,pid=12207,uid=0 [ 493.960265][T12441] Memory cgroup out of memory: Killed process 12207 (syz.2.2045) total-vm:200548kB, anon-rss:1396kB, file-rss:20608kB, shmem-rss:46592kB, UID:0 pgtables:304kB oom_score_adj:1000 [ 494.238369][T12821] syz.2.2279 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 494.291322][T12821] CPU: 0 PID: 12821 Comm: syz.2.2279 Not tainted syzkaller #0 [ 494.298872][T12821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 494.308965][T12821] Call Trace: [ 494.312278][T12821] [ 494.315244][T12821] dump_stack_lvl+0x18c/0x250 [ 494.319963][T12821] ? show_regs_print_info+0x20/0x20 [ 494.325202][T12821] ? load_image+0x420/0x420 [ 494.329775][T12821] ? ___ratelimit+0x478/0x610 [ 494.334509][T12821] ? radix_tree_cpu_dead+0x160/0x160 [ 494.339852][T12821] dump_header+0xd8/0x820 [ 494.344231][T12821] oom_kill_process+0x390/0x580 [ 494.349141][T12821] out_of_memory+0xe0e/0x1200 [ 494.353880][T12821] ? mem_cgroup_out_of_memory+0xc1/0x390 [ 494.359571][T12821] ? mutex_lock_nested+0x20/0x20 [ 494.364563][T12821] ? unregister_oom_notifier+0x20/0x20 [ 494.370078][T12821] mem_cgroup_out_of_memory+0x2c2/0x390 [ 494.375674][T12821] ? try_charge_memcg+0xc91/0x17c0 [ 494.380831][T12821] ? drain_local_stock+0x630/0x630 [ 494.386005][T12821] ? do_raw_spin_unlock+0x121/0x230 [ 494.391259][T12821] try_charge_memcg+0xca1/0x17c0 [ 494.396267][T12821] ? folio_flags+0x120/0x120 [ 494.400929][T12821] ? percpu_ref_tryget+0x15/0x180 [ 494.406002][T12821] ? get_mem_cgroup_from_mm+0x38/0x290 [ 494.411502][T12821] charge_memcg+0x11b/0x3b0 [ 494.416045][T12821] ? __mem_cgroup_charge+0x80/0x80 [ 494.421201][T12821] ? get_mem_cgroup_from_mm+0x38/0x290 [ 494.426699][T12821] ? get_mem_cgroup_from_mm+0x38/0x290 [ 494.432210][T12821] ? get_mem_cgroup_from_mm+0x1b2/0x290 [ 494.437808][T12821] __mem_cgroup_charge+0x25/0x80 [ 494.442790][T12821] do_wp_page+0x1378/0x34d0 [ 494.447354][T12821] ? folio_put+0xd0/0xd0 [ 494.451638][T12821] ? do_raw_spin_lock+0x11f/0x2b0 [ 494.456711][T12821] ? __rwlock_init+0x150/0x150 [ 494.461535][T12821] handle_mm_fault+0x1306/0x4a50 [ 494.466521][T12821] ? handle_mm_fault+0xe6/0x4a50 [ 494.471525][T12821] ? lock_vma_under_rcu+0x52c/0x660 [ 494.476769][T12821] ? numa_migrate_prep+0x350/0x350 [ 494.481929][T12821] ? lock_vma_under_rcu+0xe5/0x660 [ 494.487110][T12821] ? do_user_addr_fault+0x1cb/0x12d0 [ 494.492458][T12821] do_user_addr_fault+0xad2/0x12d0 [ 494.497622][T12821] ? rcu_is_watching+0x15/0xb0 [ 494.502444][T12821] exc_page_fault+0x64/0x100 [ 494.507089][T12821] asm_exc_page_fault+0x26/0x30 [ 494.511996][T12821] RIP: 0033:0x7fe424c517fc [ 494.516463][T12821] Code: 23 83 c0 01 44 39 d0 75 dc 48 89 f0 25 ff 1f 00 00 49 89 34 c1 41 88 3c 00 31 c0 c3 66 90 41 38 3c 10 74 0b 41 88 3c 10 31 c0 <49> 89 34 d1 c3 b8 01 00 00 00 c3 66 0f 1f 84 00 00 00 00 00 48 83 [ 494.536123][T12821] RSP: 002b:00007ffc46797468 EFLAGS: 00010246 [ 494.542279][T12821] RAX: 0000000000000000 RBX: ffffffff83ed0b1b RCX: 0000000000000000 [ 494.550302][T12821] RDX: 0000000000000b1b RSI: ffffffff83ed0b1b RDI: 0000000000000000 [ 494.558327][T12821] RBP: 0000000000000000 R08: 00007fe425010000 R09: 00007fe425012000 [ 494.566341][T12821] R10: 0000000083ed0b1f R11: 0000000000000000 R12: 00007fe425026038 [ 494.574353][T12821] R13: 0000000000000005 R14: ffffffff83ed054a R15: 00007fe425b55720 [ 494.582368][T12821] ? security_socket_create+0x2a/0xb0 [ 494.587820][T12821] ? security_socket_getsockname+0x3b/0x90 [ 494.593702][T12821] ? security_socket_getsockname+0x3b/0x90 [ 494.599573][T12821] [ 494.881845][ T9889] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 495.112097][T12821] memory: usage 282616kB, limit 307200kB, failcnt 39018 [ 495.119127][T12821] memory+swap: usage 355616kB, limit 9007199254740988kB, failcnt 0 [ 495.184286][T12821] kmem: usage 2256kB, limit 9007199254740988kB, failcnt 0 [ 495.227290][T12821] Memory cgroup stats for /syz2: [ 495.227655][T12821] cache 281899008 [ 495.241535][T12821] rss 290816 [ 495.244790][T12821] rss_huge 0 [ 495.271556][T12821] shmem 281890816 [ 495.275259][T12821] mapped_file 85938176 [ 495.279779][T12821] dirty 8192 [ 495.320375][T12821] writeback 0 [ 495.330508][T12821] workingset_refault_anon 0 [ 495.355652][T12821] workingset_refault_file 2114 [ 495.360494][T12821] swap 74752000 [ 495.398163][T12821] pgpgin 645127 [ 495.431488][T12821] pgpgout 576233 [ 495.438352][T12821] pgfault 420244 [ 495.463219][T12821] pgmajfault 6251 [ 495.466923][T12821] inactive_anon 149004288 [ 495.471312][T12821] active_anon 133177344 [ 495.531690][T12821] inactive_file 8192 [ 495.535661][T12821] active_file 0 [ 495.539147][T12821] unevictable 0 [ 495.589175][T12821] hierarchical_memory_limit 314572800 [ 495.623710][T12821] hierarchical_memsw_limit 9223372036854771712 [ 495.629947][T12821] total_cache 281899008 [ 495.701525][T12821] total_rss 290816 [ 495.705317][T12821] total_rss_huge 0 [ 495.709069][T12821] total_shmem 281890816 [ 495.737172][T12821] total_mapped_file 85938176 [ 495.756318][T12821] total_dirty 8192 [ 495.760098][T12821] total_writeback 0 [ 495.770282][T12821] total_workingset_refault_anon 0 [ 495.801513][T12821] total_workingset_refault_file 2114 [ 495.806873][T12821] total_swap 74752000 [ 495.810900][T12821] total_pgpgin 645127 [ 495.831488][T12821] total_pgpgout 576233 [ 495.835663][T12821] total_pgfault 420244 [ 495.839772][T12821] total_pgmajfault 6251 [ 495.882214][T12821] total_inactive_anon 149004288 [ 495.887148][T12821] total_active_anon 133177344 [ 495.909660][T12821] total_inactive_file 8192 [ 495.922163][T12821] total_active_file 0 [ 495.926200][T12821] total_unevictable 0 [ 495.930226][T12821] anon_cost 0 [ 495.961499][T12821] file_cost 0 [ 495.964861][T12821] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz2,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.2045,pid=12214,uid=0 [ 496.027183][T12821] Memory cgroup out of memory: Killed process 12214 (syz.2.2045) total-vm:200816kB, anon-rss:1404kB, file-rss:20608kB, shmem-rss:42240kB, UID:0 pgtables:304kB oom_score_adj:1000 [ 497.932485][T12860] fuse: Bad value for 'fd' [ 499.505349][T12874] loop5: detected capacity change from 0 to 128 [ 499.769334][T12874] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 499.952545][T12874] ext4 filesystem being mounted at /227/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 500.972858][T12890] tmpfs: Bad value for 'nr_inodes' [ 501.583238][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.589970][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.752390][ T9889] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 503.851303][T12907] loop5: detected capacity change from 0 to 512 [ 503.952736][T12907] ext4: Bad value for 'data' [ 505.418851][T12470] syz.4.2144 (12470) used greatest stack depth: 17288 bytes left [ 506.107648][T12930] loop5: detected capacity change from 0 to 512 [ 506.181603][T12930] EXT4-fs error (device loop5): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 506.196244][T12930] EXT4-fs error (device loop5): ext4_do_update_inode:5256: inode #11: comm syz.5.2311: corrupted inode contents [ 506.212934][T12930] EXT4-fs error (device loop5): ext4_dirty_inode:6144: inode #11: comm syz.5.2311: mark_inode_dirty error [ 506.228603][T12930] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #11: comm syz.5.2311: invalid indirect mapped block 1 (level 1) [ 506.251571][T12930] EXT4-fs error (device loop5): ext4_do_update_inode:5256: inode #11: comm syz.5.2311: corrupted inode contents [ 506.292495][T12930] EXT4-fs error (device loop5) in ext4_orphan_del:303: Corrupt filesystem [ 506.301726][T12930] EXT4-fs error (device loop5): ext4_do_update_inode:5256: inode #11: comm syz.5.2311: corrupted inode contents [ 506.314398][T12930] EXT4-fs error (device loop5): ext4_truncate:4302: inode #11: comm syz.5.2311: mark_inode_dirty error [ 506.325911][T12930] EXT4-fs error (device loop5) in ext4_process_orphan:345: Corrupt filesystem [ 506.335635][T12930] EXT4-fs (loop5): 1 truncate cleaned up [ 506.342780][T12930] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 508.407582][T12472] syz.5.2146 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 508.542230][T12472] CPU: 1 PID: 12472 Comm: syz.5.2146 Not tainted syzkaller #0 [ 508.549779][T12472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 508.559873][T12472] Call Trace: [ 508.563199][T12472] [ 508.566182][T12472] dump_stack_lvl+0x18c/0x250 [ 508.571169][T12472] ? show_regs_print_info+0x20/0x20 [ 508.576462][T12472] ? load_image+0x420/0x420 [ 508.581015][T12472] ? ___ratelimit+0x478/0x610 [ 508.585762][T12472] ? radix_tree_cpu_dead+0x160/0x160 [ 508.591106][T12472] dump_header+0xd8/0x820 [ 508.595485][T12472] oom_kill_process+0x390/0x580 [ 508.600394][T12472] out_of_memory+0xe0e/0x1200 [ 508.605139][T12472] ? mem_cgroup_out_of_memory+0xc1/0x390 [ 508.610817][T12472] ? print_unlock_imbalance_bug+0x160/0x160 [ 508.616762][T12472] ? mutex_lock_nested+0x20/0x20 [ 508.621762][T12472] ? unregister_oom_notifier+0x20/0x20 [ 508.627291][T12472] mem_cgroup_out_of_memory+0x2c2/0x390 [ 508.632886][T12472] ? try_charge_memcg+0xc91/0x17c0 [ 508.638133][T12472] ? drain_local_stock+0x630/0x630 [ 508.643298][T12472] ? do_raw_spin_unlock+0x121/0x230 [ 508.648539][T12472] try_charge_memcg+0xca1/0x17c0 [ 508.653515][T12472] ? folio_prep_large_rmappable+0x9e/0x1b0 [ 508.659361][T12472] ? folio_flags+0x120/0x120 [ 508.664005][T12472] ? shmem_alloc_folio+0x1f4/0x2a0 [ 508.669158][T12472] ? percpu_ref_tryget+0x15/0x180 [ 508.674215][T12472] ? get_mem_cgroup_from_mm+0x38/0x290 [ 508.679716][T12472] charge_memcg+0x11b/0x3b0 [ 508.684260][T12472] ? __mem_cgroup_charge+0x80/0x80 [ 508.689400][T12472] ? get_mem_cgroup_from_mm+0x38/0x290 [ 508.694885][T12472] ? get_mem_cgroup_from_mm+0x38/0x290 [ 508.700379][T12472] ? get_mem_cgroup_from_mm+0x1b2/0x290 [ 508.705961][T12472] __mem_cgroup_charge+0x25/0x80 [ 508.710932][T12472] shmem_add_to_page_cache+0x8d3/0x1b80 [ 508.716512][T12472] ? xas_load+0x12b/0x140 [ 508.720883][T12472] ? shmem_alloc_folio+0x2a0/0x2a0 [ 508.726039][T12472] shmem_get_folio_gfp+0x1037/0x2b40 [ 508.731382][T12472] shmem_fault+0x1b8/0x820 [ 508.735852][T12472] ? zero_pipe_buf_get+0x10/0x10 [ 508.740825][T12472] ? handle_mm_fault+0xe6/0x4a50 [ 508.745790][T12472] ? __lock_acquire+0x7d80/0x7d80 [ 508.750854][T12472] __do_fault+0x13b/0x4d0 [ 508.755213][T12472] ? handle_mm_fault+0x3929/0x4a50 [ 508.760365][T12472] ? handle_mm_fault+0xe6/0x4a50 [ 508.765327][T12472] handle_mm_fault+0x3945/0x4a50 [ 508.770295][T12472] ? handle_mm_fault+0xe6/0x4a50 [ 508.775273][T12472] ? numa_migrate_prep+0x350/0x350 [ 508.780411][T12472] ? follow_page_pte+0x6d0/0x1ae0 [ 508.785474][T12472] ? pmd_lock+0x60/0x60 [ 508.789667][T12472] __get_user_pages+0x604/0x1580 [ 508.794649][T12472] ? file_update_time+0x98/0x1a0 [ 508.799626][T12472] ? populate_vma_page_range+0x380/0x380 [ 508.805291][T12472] ? get_dump_page+0xb6/0x200 [ 508.810008][T12472] ? down_read_killable+0x1d0/0x340 [ 508.815341][T12472] get_dump_page+0x10c/0x200 [ 508.819975][T12472] ? fault_in_readable+0x150/0x150 [ 508.825161][T12472] ? __asan_memset+0x22/0x40 [ 508.829788][T12472] ? iov_iter_bvec+0xd4/0x1b0 [ 508.834498][T12472] dump_user_range+0x127/0x840 [ 508.839296][T12472] ? dump_skip+0x40/0x40 [ 508.843564][T12472] ? dump_emit+0x78/0xe0 [ 508.847843][T12472] ? dump_emit+0xa6/0xe0 [ 508.852105][T12472] ? elf_core_dump+0x2dbb/0x37c0 [ 508.857074][T12472] elf_core_dump+0x320e/0x37c0 [ 508.861884][T12472] ? load_elf_binary+0x2850/0x2850 [ 508.867032][T12472] ? verify_lock_unused+0x140/0x140 [ 508.872263][T12472] ? __lock_acquire+0x7d80/0x7d80 [ 508.877317][T12472] ? mas_next_slot+0x94c/0x980 [ 508.882173][T12472] ? rcu_read_lock_any_held+0xb4/0x140 [ 508.887655][T12472] ? 0xffffffffff600000 [ 508.891848][T12472] do_coredump+0x1791/0x24a0 [ 508.896488][T12472] ? nfs_stat_to_errno+0x170/0x170 [ 508.901641][T12472] ? lock_chain_count+0x20/0x20 [ 508.906526][T12472] ? _raw_spin_unlock_irq+0x23/0x50 [ 508.911748][T12472] ? lockdep_hardirqs_on+0x98/0x150 [ 508.916981][T12472] get_signal+0x10da/0x1390 [ 508.921537][T12472] arch_do_signal_or_restart+0xc2/0x7b0 [ 508.927158][T12472] ? get_sigframe_size+0x20/0x20 [ 508.932133][T12472] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 508.938176][T12472] ? exit_to_user_mode_loop+0x3b/0x110 [ 508.943693][T12472] exit_to_user_mode_loop+0x70/0x110 [ 508.949008][T12472] exit_to_user_mode_prepare+0xee/0x180 [ 508.954590][T12472] irqentry_exit_to_user_mode+0x9/0x30 [ 508.960083][T12472] exc_page_fault+0x8c/0x100 [ 508.964715][T12472] asm_exc_page_fault+0x26/0x30 [ 508.969602][T12472] RIP: 0033:0x7f18b1853bd7 [ 508.974059][T12472] Code: e8 fe f9 ff ff 89 f2 48 8d 3d 5d 4f 1b 00 48 8d 35 c3 0a 1e 00 31 c0 e8 37 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 508.993688][T12472] RSP: 002b:00007f18afbd7120 EFLAGS: 00010202 [ 508.999779][T12472] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007f18b199e0d9 [ 509.007771][T12472] RDX: 00007f18afbd7140 RSI: 00007f18afbd7270 RDI: 000000000000000b [ 509.015786][T12472] RBP: 00007f18b1a35024 R08: 0000000000000000 R09: 0000000000000000 [ 509.023780][T12472] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 509.031780][T12472] R13: 00007f18b1c26038 R14: 00007f18b1c25fa0 R15: 00007fff6d2c5218 [ 509.039792][T12472] [ 509.121570][T12472] memory: usage 307196kB, limit 307200kB, failcnt 13801 [ 509.129557][T12472] memory+swap: usage 357076kB, limit 9007199254740988kB, failcnt 0 [ 509.191505][T12472] kmem: usage 2724kB, limit 9007199254740988kB, failcnt 0 [ 509.230971][T12472] Memory cgroup stats for /syz5: [ 509.231139][T12472] cache 310378496 [ 509.240496][T12472] rss 1105920 [ 509.261707][T12472] rss_huge 0 [ 509.267941][T12472] shmem 310366208 [ 509.291553][T12472] mapped_file 182956032 [ 509.295775][T12472] dirty 4096 [ 509.299001][T12472] writeback 0 [ 509.340477][T12472] workingset_refault_anon 0 [ 509.383922][T12472] workingset_refault_file 1857 [ 509.388771][T12472] swap 51077120 [ 509.405526][T12472] pgpgin 455820 [ 509.409047][T12472] pgpgout 379774 [ 509.445819][T12472] pgfault 186416 [ 509.449440][T12472] pgmajfault 5 [ 509.485934][T12472] inactive_anon 78123008 [ 509.490287][T12472] active_anon 233349120 [ 509.528134][T12472] inactive_file 12288 [ 509.563726][T12472] active_file 0 [ 509.567303][T12472] unevictable 0 [ 509.570804][T12472] hierarchical_memory_limit 314572800 [ 509.631539][T12472] hierarchical_memsw_limit 9223372036854771712 [ 509.637831][T12472] total_cache 310378496 [ 509.683666][T12472] total_rss 1105920 [ 509.687548][T12472] total_rss_huge 0 [ 509.691299][T12472] total_shmem 310366208 [ 509.742161][T12472] total_mapped_file 182956032 [ 509.746953][T12472] total_dirty 4096 [ 509.750719][T12472] total_writeback 0 [ 509.791611][T12472] total_workingset_refault_anon 0 [ 509.796711][T12472] total_workingset_refault_file 1857 [ 509.811600][T12472] total_swap 51077120 [ 509.821723][T12472] total_pgpgin 455820 [ 509.825754][T12472] total_pgpgout 379774 [ 509.829851][T12472] total_pgfault 186416 [ 509.861582][T12472] total_pgmajfault 5 [ 509.865572][T12472] total_inactive_anon 78123008 [ 509.870364][T12472] total_active_anon 233349120 [ 509.902798][T12472] total_inactive_file 12288 [ 509.907446][T12472] total_active_file 0 [ 509.919793][T12472] total_unevictable 0 [ 509.931958][T12472] anon_cost 0 [ 509.935394][T12472] file_cost 0 [ 509.938710][T12472] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz.5.2146,pid=12472,uid=0 [ 510.001547][T12472] Memory cgroup out of memory: Killed process 12472 (syz.5.2146) total-vm:200552kB, anon-rss:1368kB, file-rss:20608kB, shmem-rss:90624kB, UID:0 pgtables:284kB oom_score_adj:1000 [ 510.313131][ T9889] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 510.710835][T12523] syz.6.2165 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 510.888655][T12523] CPU: 0 PID: 12523 Comm: syz.6.2165 Not tainted syzkaller #0 [ 510.896294][T12523] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 510.906403][T12523] Call Trace: [ 510.909725][T12523] [ 510.912701][T12523] dump_stack_lvl+0x18c/0x250 [ 510.917439][T12523] ? show_regs_print_info+0x20/0x20 [ 510.922687][T12523] ? load_image+0x420/0x420 [ 510.927235][T12523] ? ___ratelimit+0x478/0x610 [ 510.931973][T12523] ? radix_tree_cpu_dead+0x160/0x160 [ 510.937314][T12523] dump_header+0xd8/0x820 [ 510.941700][T12523] oom_kill_process+0x390/0x580 [ 510.946607][T12523] out_of_memory+0xe0e/0x1200 [ 510.951326][T12523] ? mem_cgroup_out_of_memory+0xc1/0x390 [ 510.956999][T12523] ? mutex_lock_nested+0x20/0x20 [ 510.961986][T12523] ? unregister_oom_notifier+0x20/0x20 [ 510.967487][T12523] mem_cgroup_out_of_memory+0x2c2/0x390 [ 510.973064][T12523] ? try_charge_memcg+0xc91/0x17c0 [ 510.978209][T12523] ? drain_local_stock+0x630/0x630 [ 510.983371][T12523] ? do_raw_spin_unlock+0x121/0x230 [ 510.988609][T12523] try_charge_memcg+0xca1/0x17c0 [ 510.993598][T12523] ? folio_prep_large_rmappable+0x9e/0x1b0 [ 510.999446][T12523] ? folio_flags+0x120/0x120 [ 511.004077][T12523] ? shmem_alloc_folio+0x1f4/0x2a0 [ 511.009240][T12523] ? percpu_ref_tryget+0x15/0x180 [ 511.014307][T12523] ? get_mem_cgroup_from_mm+0x38/0x290 [ 511.019801][T12523] charge_memcg+0x11b/0x3b0 [ 511.024342][T12523] ? __mem_cgroup_charge+0x80/0x80 [ 511.029488][T12523] ? get_mem_cgroup_from_mm+0x38/0x290 [ 511.034980][T12523] ? get_mem_cgroup_from_mm+0x38/0x290 [ 511.040472][T12523] ? get_mem_cgroup_from_mm+0x1b2/0x290 [ 511.046055][T12523] __mem_cgroup_charge+0x25/0x80 [ 511.051027][T12523] shmem_add_to_page_cache+0x8d3/0x1b80 [ 511.056604][T12523] ? xas_load+0x12b/0x140 [ 511.060971][T12523] ? shmem_alloc_folio+0x2a0/0x2a0 [ 511.066145][T12523] shmem_get_folio_gfp+0x1037/0x2b40 [ 511.071493][T12523] shmem_write_begin+0xf2/0x430 [ 511.076405][T12523] generic_perform_write+0x2fe/0x5c0 [ 511.081753][T12523] ? generic_file_direct_write+0x3e0/0x3e0 [ 511.087598][T12523] ? down_write+0x16e/0x200 [ 511.092151][T12523] ? file_update_time+0x98/0x1a0 [ 511.097144][T12523] shmem_file_write_iter+0xfb/0x120 [ 511.102386][T12523] __kernel_write_iter+0x29f/0x6d0 [ 511.107572][T12523] ? vfs_read+0x990/0x990 [ 511.111930][T12523] ? get_dump_page+0x156/0x200 [ 511.116732][T12523] ? __asan_memset+0x22/0x40 [ 511.121358][T12523] ? iov_iter_bvec+0xd4/0x1b0 [ 511.126065][T12523] dump_user_range+0x418/0x840 [ 511.130870][T12523] ? dump_skip+0x40/0x40 [ 511.135145][T12523] ? dump_emit+0x78/0xe0 [ 511.139428][T12523] ? dump_emit+0xa6/0xe0 [ 511.143695][T12523] ? elf_core_dump+0x2dbb/0x37c0 [ 511.148673][T12523] elf_core_dump+0x320e/0x37c0 [ 511.153481][T12523] ? load_elf_binary+0x2850/0x2850 [ 511.158627][T12523] ? verify_lock_unused+0x140/0x140 [ 511.163853][T12523] ? __lock_acquire+0x7d80/0x7d80 [ 511.168905][T12523] ? mas_next_slot+0x94c/0x980 [ 511.173726][T12523] ? rcu_read_lock_any_held+0xb4/0x140 [ 511.179224][T12523] ? 0xffffffffff600000 [ 511.183418][T12523] do_coredump+0x1791/0x24a0 [ 511.188053][T12523] ? nfs_stat_to_errno+0x170/0x170 [ 511.193207][T12523] ? lock_chain_count+0x20/0x20 [ 511.198122][T12523] ? _raw_spin_unlock_irq+0x23/0x50 [ 511.203356][T12523] ? lockdep_hardirqs_on+0x98/0x150 [ 511.208584][T12523] get_signal+0x10da/0x1390 [ 511.213124][T12523] arch_do_signal_or_restart+0xc2/0x7b0 [ 511.218707][T12523] ? get_sigframe_size+0x20/0x20 [ 511.223675][T12523] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 511.229688][T12523] ? exit_to_user_mode_loop+0x3b/0x110 [ 511.235205][T12523] exit_to_user_mode_loop+0x70/0x110 [ 511.240525][T12523] exit_to_user_mode_prepare+0xee/0x180 [ 511.246103][T12523] irqentry_exit_to_user_mode+0x9/0x30 [ 511.251598][T12523] exc_page_fault+0x8c/0x100 [ 511.256229][T12523] asm_exc_page_fault+0x26/0x30 [ 511.261113][T12523] RIP: 0033:0x7f4b8cc53bd7 [ 511.265557][T12523] Code: e8 fe f9 ff ff 89 f2 48 8d 3d 5d 4f 1b 00 48 8d 35 c3 0a 1e 00 31 c0 e8 37 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 511.285189][T12523] RSP: 002b:00007f4b8afd7120 EFLAGS: 00010202 [ 511.291285][T12523] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007f4b8cd9e0d9 [ 511.299291][T12523] RDX: 00007f4b8afd7140 RSI: 00007f4b8afd7270 RDI: 000000000000000b [ 511.307300][T12523] RBP: 00007f4b8ce35024 R08: 0000000000000000 R09: 0000000000000000 [ 511.315318][T12523] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 511.323315][T12523] R13: 00007f4b8d026038 R14: 00007f4b8d025fa0 R15: 00007ffd5d2fe298 [ 511.331329][T12523] [ 511.534809][T12523] memory: usage 307200kB, limit 307200kB, failcnt 14686 [ 511.613794][T12523] memory+swap: usage 354272kB, limit 9007199254740988kB, failcnt 0 [ 511.643797][T12523] kmem: usage 2712kB, limit 9007199254740988kB, failcnt 0 [ 511.719086][T12523] Memory cgroup stats for /syz6: [ 511.719498][T12523] cache 310525952 [ 511.728291][T12523] rss 1269760 [ 511.731842][T12523] rss_huge 0 [ 511.735126][T12523] shmem 310517760 [ 511.738791][T12523] mapped_file 58634240 [ 511.742985][T12523] dirty 0 [ 511.745973][T12523] writeback 0 [ 511.749318][T12523] workingset_refault_anon 0 [ 511.753938][T12523] workingset_refault_file 2731 [ 511.758748][T12523] swap 48201728 [ 511.762478][T12523] pgpgin 533416 [ 511.765975][T12523] pgpgout 457294 [ 511.769553][T12523] pgfault 167745 [ 511.773242][T12523] pgmajfault 18 [ 511.776747][T12523] inactive_anon 204341248 [ 511.781209][T12523] active_anon 107446272 [ 511.871482][T12523] inactive_file 4096 [ 511.881490][T12523] active_file 4096 [ 511.885275][T12523] unevictable 0 [ 511.888772][T12523] hierarchical_memory_limit 314572800 [ 511.921663][T12523] hierarchical_memsw_limit 9223372036854771712 [ 511.927896][T12523] total_cache 310525952 [ 511.952048][T12523] total_rss 1269760 [ 511.955934][T12523] total_rss_huge 0 [ 511.959692][T12523] total_shmem 310517760 [ 511.981544][T12523] total_mapped_file 58634240 [ 511.986204][T12523] total_dirty 0 [ 511.989701][T12523] total_writeback 0 [ 512.011484][T12523] total_workingset_refault_anon 0 [ 512.016592][T12523] total_workingset_refault_file 2731 [ 512.042112][T12523] total_swap 48201728 [ 512.046165][T12523] total_pgpgin 533416 [ 512.071533][T12523] total_pgpgout 457294 [ 512.075679][T12523] total_pgfault 167745 [ 512.079782][T12523] total_pgmajfault 18 [ 512.111481][T12523] total_inactive_anon 204341248 [ 512.116405][T12523] total_active_anon 107446272 [ 512.121114][T12523] total_inactive_file 4096 [ 512.151676][T12523] total_active_file 4096 [ 512.161640][T12523] total_unevictable 0 [ 512.165677][T12523] anon_cost 0 [ 512.169019][T12523] file_cost 0 [ 512.191581][T12523] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz6,mems_allowed=0-1,oom_memcg=/syz6,task_memcg=/syz6,task=syz.6.2165,pid=12523,uid=0 [ 512.243266][T12523] Memory cgroup out of memory: Killed process 12523 (syz.6.2165) total-vm:200552kB, anon-rss:1404kB, file-rss:20608kB, shmem-rss:57216kB, UID:0 pgtables:284kB oom_score_adj:1000 [ 512.638051][T12981] loop2: detected capacity change from 0 to 512 [ 512.661217][T12981] ext4: Bad value for 'data' [ 512.907406][T12791] syz.6.2266 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 513.054639][T12791] CPU: 0 PID: 12791 Comm: syz.6.2266 Not tainted syzkaller #0 [ 513.062198][T12791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 513.072302][T12791] Call Trace: [ 513.075623][T12791] [ 513.078637][T12791] dump_stack_lvl+0x18c/0x250 [ 513.083413][T12791] ? show_regs_print_info+0x20/0x20 [ 513.088717][T12791] ? load_image+0x420/0x420 [ 513.093270][T12791] ? ___ratelimit+0x478/0x610 [ 513.098009][T12791] ? radix_tree_cpu_dead+0x160/0x160 [ 513.103351][T12791] dump_header+0xd8/0x820 [ 513.107743][T12791] oom_kill_process+0x390/0x580 [ 513.112664][T12791] out_of_memory+0xe0e/0x1200 [ 513.117411][T12791] ? mem_cgroup_out_of_memory+0xc1/0x390 [ 513.123089][T12791] ? print_unlock_imbalance_bug+0x160/0x160 [ 513.129035][T12791] ? mutex_lock_nested+0x20/0x20 [ 513.134032][T12791] ? unregister_oom_notifier+0x20/0x20 [ 513.139550][T12791] mem_cgroup_out_of_memory+0x2c2/0x390 [ 513.145169][T12791] ? try_charge_memcg+0xc91/0x17c0 [ 513.150335][T12791] ? drain_local_stock+0x630/0x630 [ 513.155525][T12791] ? do_raw_spin_unlock+0x121/0x230 [ 513.160785][T12791] try_charge_memcg+0xca1/0x17c0 [ 513.165800][T12791] ? folio_prep_large_rmappable+0x9e/0x1b0 [ 513.171687][T12791] ? folio_flags+0x120/0x120 [ 513.176334][T12791] ? shmem_alloc_folio+0x1f4/0x2a0 [ 513.181515][T12791] ? percpu_ref_tryget+0x15/0x180 [ 513.186585][T12791] ? get_mem_cgroup_from_mm+0x38/0x290 [ 513.192071][T12791] charge_memcg+0x11b/0x3b0 [ 513.196597][T12791] ? __mem_cgroup_charge+0x80/0x80 [ 513.201752][T12791] ? get_mem_cgroup_from_mm+0x38/0x290 [ 513.207231][T12791] ? get_mem_cgroup_from_mm+0x38/0x290 [ 513.212718][T12791] ? get_mem_cgroup_from_mm+0x1b2/0x290 [ 513.218289][T12791] __mem_cgroup_charge+0x25/0x80 [ 513.223279][T12791] shmem_add_to_page_cache+0x8d3/0x1b80 [ 513.228884][T12791] ? xas_load+0x12b/0x140 [ 513.233253][T12791] ? shmem_alloc_folio+0x2a0/0x2a0 [ 513.238405][T12791] shmem_get_folio_gfp+0x1037/0x2b40 [ 513.243749][T12791] shmem_write_begin+0xf2/0x430 [ 513.248634][T12791] generic_perform_write+0x2fe/0x5c0 [ 513.253967][T12791] ? generic_file_direct_write+0x3e0/0x3e0 [ 513.259803][T12791] ? down_write+0x16e/0x200 [ 513.264378][T12791] ? file_update_time+0x98/0x1a0 [ 513.269349][T12791] shmem_file_write_iter+0xfb/0x120 [ 513.274579][T12791] __kernel_write_iter+0x29f/0x6d0 [ 513.279731][T12791] ? vfs_read+0x990/0x990 [ 513.284091][T12791] ? get_dump_page+0x156/0x200 [ 513.288897][T12791] ? __asan_memset+0x22/0x40 [ 513.293519][T12791] ? iov_iter_bvec+0xd4/0x1b0 [ 513.298252][T12791] dump_user_range+0x418/0x840 [ 513.303057][T12791] ? dump_skip+0x40/0x40 [ 513.307321][T12791] ? dump_emit+0x78/0xe0 [ 513.311604][T12791] ? dump_emit+0xa6/0xe0 [ 513.315876][T12791] ? elf_core_dump+0x2dbb/0x37c0 [ 513.320851][T12791] elf_core_dump+0x320e/0x37c0 [ 513.325681][T12791] ? load_elf_binary+0x2850/0x2850 [ 513.330853][T12791] ? verify_lock_unused+0x140/0x140 [ 513.336084][T12791] ? __lock_acquire+0x7d80/0x7d80 [ 513.341134][T12791] ? mas_next_slot+0x94c/0x980 [ 513.345956][T12791] ? rcu_read_lock_any_held+0xb4/0x140 [ 513.351450][T12791] ? 0xffffffffff600000 [ 513.355669][T12791] do_coredump+0x1791/0x24a0 [ 513.360309][T12791] ? nfs_stat_to_errno+0x170/0x170 [ 513.365464][T12791] ? lock_chain_count+0x20/0x20 [ 513.370350][T12791] ? _raw_spin_unlock_irq+0x23/0x50 [ 513.375573][T12791] ? lockdep_hardirqs_on+0x98/0x150 [ 513.380815][T12791] get_signal+0x10da/0x1390 [ 513.385365][T12791] arch_do_signal_or_restart+0xc2/0x7b0 [ 513.390953][T12791] ? get_sigframe_size+0x20/0x20 [ 513.395948][T12791] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 513.401973][T12791] ? exit_to_user_mode_loop+0x3b/0x110 [ 513.407470][T12791] exit_to_user_mode_loop+0x70/0x110 [ 513.412798][T12791] exit_to_user_mode_prepare+0xee/0x180 [ 513.418385][T12791] irqentry_exit_to_user_mode+0x9/0x30 [ 513.423880][T12791] exc_page_fault+0x8c/0x100 [ 513.428519][T12791] asm_exc_page_fault+0x26/0x30 [ 513.433418][T12791] RIP: 0033:0x7f4b8cc53bd7 [ 513.437866][T12791] Code: e8 fe f9 ff ff 89 f2 48 8d 3d 5d 4f 1b 00 48 8d 35 c3 0a 1e 00 31 c0 e8 37 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 513.457496][T12791] RSP: 002b:00007f4b8afb6120 EFLAGS: 00010202 [ 513.463637][T12791] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007f4b8cd9e0d9 [ 513.471643][T12791] RDX: 00007f4b8afb6140 RSI: 00007f4b8afb6270 RDI: 000000000000000b [ 513.479676][T12791] RBP: 00007f4b8ce35024 R08: 0000000000000000 R09: 0000000000000000 [ 513.487937][T12791] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 513.495936][T12791] R13: 00007f4b8d026128 R14: 00007f4b8d026090 R15: 00007ffd5d2fe298 [ 513.503950][T12791] [ 513.791581][T12791] memory: usage 304704kB, limit 307200kB, failcnt 15403 [ 513.798606][T12791] memory+swap: usage 351612kB, limit 9007199254740988kB, failcnt 0 [ 513.911948][T12791] kmem: usage 2400kB, limit 9007199254740988kB, failcnt 0 [ 513.919157][T12791] Memory cgroup stats for /syz6: [ 513.919339][T12791] cache 305451008 [ 514.001519][T12791] rss 1138688 [ 514.031519][T12791] rss_huge 0 [ 514.047847][T12791] shmem 304267264 [ 514.091491][T12791] mapped_file 1060864 [ 514.095541][T12791] dirty 0 [ 514.098513][T12791] writeback 0 [ 514.161965][T12791] workingset_refault_anon 0 [ 514.166555][T12791] workingset_refault_file 3019 [ 514.171364][T12791] swap 48033792 [ 514.251863][T12989] loop2: detected capacity change from 0 to 512 [ 514.280995][T12791] pgpgin 534068 [ 514.297103][T12989] EXT4-fs error (device loop2): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 514.312001][T12989] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2341: corrupted inode contents [ 514.324575][T12989] EXT4-fs error (device loop2): ext4_dirty_inode:6144: inode #11: comm syz.2.2341: mark_inode_dirty error [ 514.331657][T12791] pgpgout 459217 [ 514.342091][T12989] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.2341: invalid indirect mapped block 1 (level 1) [ 514.373337][T12989] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2341: corrupted inode contents [ 514.385850][T12989] EXT4-fs error (device loop2) in ext4_orphan_del:303: Corrupt filesystem [ 514.401677][T12989] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2341: corrupted inode contents [ 514.414153][T12989] EXT4-fs error (device loop2): ext4_truncate:4302: inode #11: comm syz.2.2341: mark_inode_dirty error [ 514.425689][T12989] EXT4-fs error (device loop2) in ext4_process_orphan:345: Corrupt filesystem [ 514.436925][T12989] EXT4-fs (loop2): 1 truncate cleaned up [ 514.444268][T12989] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 514.476575][T12791] pgfault 167775 [ 514.483446][T12791] pgmajfault 19 [ 514.490210][T12791] inactive_anon 99950592 [ 514.499036][T12791] active_anon 205455360 [ 514.526848][T12791] inactive_file 4096 [ 514.620650][T12791] active_file 1179648 [ 514.671924][T12791] unevictable 0 [ 514.675470][T12791] hierarchical_memory_limit 314572800 [ 514.680884][T12791] hierarchical_memsw_limit 9223372036854771712 [ 514.778940][T12791] total_cache 305451008 [ 514.831585][T12791] total_rss 1138688 [ 514.835585][T12791] total_rss_huge 0 [ 514.839347][T12791] total_shmem 304267264 [ 514.901552][T12791] total_mapped_file 1060864 [ 514.906136][T12791] total_dirty 0 [ 514.982061][T12791] total_writeback 0 [ 514.985948][T12791] total_workingset_refault_anon 0 [ 514.991008][T12791] total_workingset_refault_file 3019 [ 515.111532][T12791] total_swap 48033792 [ 515.115610][T12791] total_pgpgin 534068 [ 515.119635][T12791] total_pgpgout 459217 [ 515.191558][T12791] total_pgfault 167775 [ 515.195720][T12791] total_pgmajfault 19 [ 515.199737][T12791] total_inactive_anon 99950592 [ 515.281527][T12791] total_active_anon 205455360 [ 515.286325][T12791] total_inactive_file 4096 [ 515.290785][T12791] total_active_file 1179648 [ 515.421526][T12791] total_unevictable 0 [ 515.425603][T12791] anon_cost 0 [ 515.428925][T12791] file_cost 0 [ 515.491704][T12791] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz6,mems_allowed=0-1,oom_memcg=/syz6,task_memcg=/syz6,task=syz.6.2266,pid=12789,uid=0 [ 515.581538][T12791] Memory cgroup out of memory: Killed process 12789 (syz.6.2266) total-vm:102244kB, anon-rss:1532kB, file-rss:55424kB, shmem-rss:0kB, UID:0 pgtables:200kB oom_score_adj:1000 [ 516.970422][ T5776] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 519.456409][ T5792] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 519.467190][ T5792] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 519.476723][ T5792] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 519.495329][ T5792] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 519.517733][ T5792] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 519.525303][ T5792] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 520.066977][T13021] chnl_net:caif_netlink_parms(): no params data found [ 521.571683][ T5792] Bluetooth: hci4: command tx timeout [ 521.725707][T13021] bridge0: port 1(bridge_slave_0) entered blocking state [ 521.743287][T13021] bridge0: port 1(bridge_slave_0) entered disabled state [ 521.750593][T13021] bridge_slave_0: entered allmulticast mode [ 521.793159][T13021] bridge_slave_0: entered promiscuous mode [ 521.833240][T13021] bridge0: port 2(bridge_slave_1) entered blocking state [ 521.840448][T13021] bridge0: port 2(bridge_slave_1) entered disabled state [ 521.899816][T13021] bridge_slave_1: entered allmulticast mode [ 521.923136][T13021] bridge_slave_1: entered promiscuous mode [ 523.657151][ T5792] Bluetooth: hci4: command tx timeout [ 523.710791][ T3000] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 523.827334][T13021] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 523.857441][T13021] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 523.987236][T13021] team0: Port device team_slave_0 added [ 524.237965][ T3000] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.332176][T13021] team0: Port device team_slave_1 added [ 524.595185][T13021] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 524.611679][T13021] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 524.685062][T13021] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 525.007365][ T3000] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 525.143970][T13021] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 525.171636][T13021] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 525.241537][T13021] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 525.555651][ T3000] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 525.698632][T13021] hsr_slave_0: entered promiscuous mode [ 525.732058][ T5792] Bluetooth: hci4: command tx timeout [ 525.793482][T13021] hsr_slave_1: entered promiscuous mode [ 525.841605][T13021] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 525.849244][T13021] Cannot create hsr debugfs directory [ 527.828695][ T5792] Bluetooth: hci4: command tx timeout [ 529.134467][T13021] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 529.244660][T13021] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 529.423719][T13021] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 529.452700][T13021] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 530.100093][T13021] 8021q: adding VLAN 0 to HW filter on device bond0 [ 530.384796][T13021] 8021q: adding VLAN 0 to HW filter on device team0 [ 530.636321][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 530.643618][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 530.745088][ T2950] bridge0: port 2(bridge_slave_1) entered blocking state [ 530.752288][ T2950] bridge0: port 2(bridge_slave_1) entered forwarding state [ 531.007140][ T3000] hsr_slave_0: left promiscuous mode [ 531.031176][ T3000] hsr_slave_1: left promiscuous mode [ 531.188776][ T3000] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 531.221722][ T3000] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 531.249627][ T3000] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 531.271639][ T3000] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 531.336314][ T3000] bridge_slave_1: left allmulticast mode [ 531.349651][ T3000] bridge_slave_1: left promiscuous mode [ 531.365954][ T3000] bridge0: port 2(bridge_slave_1) entered disabled state [ 531.466951][ T3000] bridge_slave_0: left allmulticast mode [ 531.483717][ T3000] bridge_slave_0: left promiscuous mode [ 531.489504][ T3000] bridge0: port 1(bridge_slave_0) entered disabled state [ 531.722664][ T3000] veth1_macvtap: left promiscuous mode [ 531.728276][ T3000] veth0_macvtap: left promiscuous mode [ 531.772309][ T3000] veth1_vlan: left promiscuous mode [ 531.777722][ T3000] veth0_vlan: left promiscuous mode [ 534.949263][ T3000] team0 (unregistering): Port device team_slave_1 removed [ 535.165999][ T3000] team0 (unregistering): Port device team_slave_0 removed [ 535.431952][ T3000] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 535.612046][ T3000] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 536.311149][ T3000] bond0 (unregistering): Released all slaves [ 537.228830][T13021] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 537.370084][T13021] veth0_vlan: entered promiscuous mode [ 537.426619][T13021] veth1_vlan: entered promiscuous mode [ 537.575127][T13021] veth0_macvtap: entered promiscuous mode [ 537.737685][T13021] veth1_macvtap: entered promiscuous mode [ 537.853859][T13021] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 537.893912][T13021] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 537.908311][T13021] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 537.927928][T13021] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 537.953723][T13021] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 537.975066][T13021] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 538.008235][T13021] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 538.044533][T13021] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 538.081568][T13021] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 538.101485][T13021] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 538.120703][T13021] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 538.145004][T13021] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 538.155585][T13021] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 538.183220][T13021] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 538.225399][T13021] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.236690][T13021] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.253036][T13021] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.272164][T13021] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.542664][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 538.588770][T13303] loop4: detected capacity change from 0 to 512 [ 538.595301][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 538.644437][T13303] ext4: Bad value for 'data' [ 538.688296][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 538.797823][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 539.081918][T13309] loop4: detected capacity change from 0 to 512 [ 539.190997][T13309] EXT4-fs error (device loop4): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 539.205807][T13309] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.2460: corrupted inode contents [ 539.222065][T13309] EXT4-fs error (device loop4): ext4_dirty_inode:6144: inode #11: comm syz.4.2460: mark_inode_dirty error [ 539.260401][T13309] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #11: comm syz.4.2460: invalid indirect mapped block 1 (level 1) [ 539.275602][T13309] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.2460: corrupted inode contents [ 539.291370][T13309] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 539.301646][T13309] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.2460: corrupted inode contents [ 539.317645][T13309] EXT4-fs error (device loop4): ext4_truncate:4302: inode #11: comm syz.4.2460: mark_inode_dirty error [ 539.330577][T13309] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 539.351823][T13309] EXT4-fs (loop4): 1 truncate cleaned up [ 539.366521][T13309] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 539.857726][ T7154] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 540.688256][T12774] syz.5.2258 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 540.698295][T12774] CPU: 1 PID: 12774 Comm: syz.5.2258 Not tainted syzkaller #0 [ 540.705813][T12774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 540.715915][T12774] Call Trace: [ 540.719232][T12774] [ 540.722233][T12774] dump_stack_lvl+0x18c/0x250 [ 540.727008][T12774] ? show_regs_print_info+0x20/0x20 [ 540.732261][T12774] ? load_image+0x420/0x420 [ 540.736817][T12774] ? ___ratelimit+0x478/0x610 [ 540.741553][T12774] ? radix_tree_cpu_dead+0x160/0x160 [ 540.746906][T12774] dump_header+0xd8/0x820 [ 540.751326][T12774] oom_kill_process+0x390/0x580 [ 540.756253][T12774] out_of_memory+0xe0e/0x1200 [ 540.761002][T12774] ? mem_cgroup_out_of_memory+0xc1/0x390 [ 540.766689][T12774] ? print_unlock_imbalance_bug+0x160/0x160 [ 540.772644][T12774] ? mutex_lock_nested+0x20/0x20 [ 540.777660][T12774] ? unregister_oom_notifier+0x20/0x20 [ 540.783193][T12774] mem_cgroup_out_of_memory+0x2c2/0x390 [ 540.788797][T12774] ? try_charge_memcg+0xc91/0x17c0 [ 540.793965][T12774] ? drain_local_stock+0x630/0x630 [ 540.799148][T12774] ? do_raw_spin_unlock+0x121/0x230 [ 540.800313][T13337] loop2: detected capacity change from 0 to 512 [ 540.804396][T12774] try_charge_memcg+0xca1/0x17c0 [ 540.804441][T12774] ? folio_prep_large_rmappable+0x9e/0x1b0 [ 540.804478][T12774] ? folio_flags+0x120/0x120 [ 540.804508][T12774] ? shmem_alloc_folio+0x1f4/0x2a0 [ 540.804548][T12774] ? percpu_ref_tryget+0x15/0x180 [ 540.836383][T12774] ? get_mem_cgroup_from_mm+0x38/0x290 [ 540.841892][T12774] charge_memcg+0x11b/0x3b0 [ 540.846458][T12774] ? __mem_cgroup_charge+0x80/0x80 [ 540.851606][T12774] ? get_mem_cgroup_from_mm+0x38/0x290 [ 540.857102][T12774] ? get_mem_cgroup_from_mm+0x38/0x290 [ 540.862600][T12774] ? get_mem_cgroup_from_mm+0x1b2/0x290 [ 540.868178][T12774] __mem_cgroup_charge+0x25/0x80 [ 540.873146][T12774] shmem_add_to_page_cache+0x8d3/0x1b80 [ 540.878726][T12774] ? xas_load+0x12b/0x140 [ 540.883094][T12774] ? shmem_alloc_folio+0x2a0/0x2a0 [ 540.888249][T12774] shmem_get_folio_gfp+0x1037/0x2b40 [ 540.893590][T12774] shmem_write_begin+0xf2/0x430 [ 540.898474][T12774] generic_perform_write+0x2fe/0x5c0 [ 540.903805][T12774] ? generic_file_direct_write+0x3e0/0x3e0 [ 540.909636][T12774] ? down_write+0x16e/0x200 [ 540.914179][T12774] ? file_update_time+0x98/0x1a0 [ 540.919152][T12774] shmem_file_write_iter+0xfb/0x120 [ 540.924388][T12774] __kernel_write_iter+0x29f/0x6d0 [ 540.929541][T12774] ? vfs_read+0x990/0x990 [ 540.933900][T12774] ? get_dump_page+0x156/0x200 [ 540.938707][T12774] ? __asan_memset+0x22/0x40 [ 540.943327][T12774] ? iov_iter_bvec+0xd4/0x1b0 [ 540.948044][T12774] dump_user_range+0x418/0x840 [ 540.952850][T12774] ? dump_skip+0x40/0x40 [ 540.957117][T12774] ? dump_emit+0x78/0xe0 [ 540.961400][T12774] ? dump_emit+0xa6/0xe0 [ 540.965673][T12774] ? elf_core_dump+0x2dbb/0x37c0 [ 540.970658][T12774] elf_core_dump+0x320e/0x37c0 [ 540.975478][T12774] ? load_elf_binary+0x2850/0x2850 [ 540.980634][T12774] ? verify_lock_unused+0x140/0x140 [ 540.985902][T12774] ? __lock_acquire+0x7d80/0x7d80 [ 540.990969][T12774] ? mas_next_slot+0x94c/0x980 [ 540.995800][T12774] ? rcu_read_lock_any_held+0xb4/0x140 [ 541.001285][T12774] ? 0xffffffffff600000 [ 541.005480][T12774] do_coredump+0x1791/0x24a0 [ 541.010119][T12774] ? nfs_stat_to_errno+0x170/0x170 [ 541.015272][T12774] ? lock_chain_count+0x20/0x20 [ 541.020153][T12774] ? _raw_spin_unlock_irq+0x23/0x50 [ 541.025382][T12774] ? lockdep_hardirqs_on+0x98/0x150 [ 541.030610][T12774] get_signal+0x10da/0x1390 [ 541.035164][T12774] arch_do_signal_or_restart+0xc2/0x7b0 [ 541.040750][T12774] ? get_sigframe_size+0x20/0x20 [ 541.045725][T12774] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 541.051762][T12774] ? exit_to_user_mode_loop+0x3b/0x110 [ 541.057259][T12774] exit_to_user_mode_loop+0x70/0x110 [ 541.062579][T12774] exit_to_user_mode_prepare+0xee/0x180 [ 541.068168][T12774] irqentry_exit_to_user_mode+0x9/0x30 [ 541.073661][T12774] exc_page_fault+0x8c/0x100 [ 541.078285][T12774] asm_exc_page_fault+0x26/0x30 [ 541.083164][T12774] RIP: 0033:0x7f18b1853bd7 [ 541.087609][T12774] Code: e8 fe f9 ff ff 89 f2 48 8d 3d 5d 4f 1b 00 48 8d 35 c3 0a 1e 00 31 c0 e8 37 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 541.107339][T12774] RSP: 002b:00007f18afbd7120 EFLAGS: 00010202 [ 541.113448][T12774] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007f18b199e0d9 [ 541.121448][T12774] RDX: 00007f18afbd7140 RSI: 00007f18afbd7270 RDI: 000000000000000b [ 541.129446][T12774] RBP: 00007f18b1a35024 R08: 0000000000000000 R09: 0000000000000000 [ 541.137443][T12774] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 541.145436][T12774] R13: 00007f18b1c26038 R14: 00007f18b1c25fa0 R15: 00007fff6d2c5218 [ 541.153446][T12774] [ 541.207690][T13337] EXT4-fs error (device loop2): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 541.222330][T13337] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2469: corrupted inode contents [ 541.236532][T13337] EXT4-fs error (device loop2): ext4_dirty_inode:6144: inode #11: comm syz.2.2469: mark_inode_dirty error [ 541.251695][T13337] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.2469: invalid indirect mapped block 1 (level 1) [ 541.269551][T12774] memory: usage 307200kB, limit 307200kB, failcnt 33084 [ 541.276835][T13337] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2469: corrupted inode contents [ 541.291080][T12774] memory+swap: usage 432028kB, limit 9007199254740988kB, failcnt 0 [ 541.299197][T13337] EXT4-fs error (device loop2) in ext4_orphan_del:303: Corrupt filesystem [ 541.313586][T13337] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2469: corrupted inode contents [ 541.326130][T13337] EXT4-fs error (device loop2): ext4_truncate:4302: inode #11: comm syz.2.2469: mark_inode_dirty error [ 541.337908][T12774] kmem: usage 2728kB, limit 9007199254740988kB, failcnt 0 [ 541.345384][T12774] Memory cgroup stats for /syz5: [ 541.345545][T12774] cache 311447552 [ 541.354625][T12774] rss 331776 [ 541.357900][T13337] EXT4-fs error (device loop2) in ext4_process_orphan:345: Corrupt filesystem [ 541.367412][T12774] rss_huge 0 [ 541.370660][T12774] shmem 311447552 [ 541.375117][T12774] mapped_file 207519744 [ 541.379420][T13337] EXT4-fs (loop2): 1 truncate cleaned up [ 541.387599][T12774] dirty 0 [ 541.390649][T12774] writeback 0 [ 541.431317][T13337] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 541.471590][T12774] workingset_refault_anon 0 [ 541.476172][T12774] workingset_refault_file 1857 [ 541.511717][T12774] swap 127823872 [ 541.519600][T12774] pgpgin 535476 [ 541.530239][T12774] pgpgout 459358 [ 541.544584][T12774] pgfault 231586 [ 541.561965][T12774] pgmajfault 5 [ 541.572035][T12774] inactive_anon 198762496 [ 541.588490][T12774] active_anon 113016832 [ 541.603214][T12774] inactive_file 0 [ 541.613316][T12774] active_file 0 [ 541.616836][T12774] unevictable 0 [ 541.661104][T12774] hierarchical_memory_limit 314572800 [ 541.707417][T12774] hierarchical_memsw_limit 9223372036854771712 [ 541.728882][T12774] total_cache 311447552 [ 541.739636][T12774] total_rss 331776 [ 541.752929][T12774] total_rss_huge 0 [ 541.756708][T12774] total_shmem 311447552 [ 541.776359][T12774] total_mapped_file 207519744 [ 541.781286][T12774] total_dirty 0 [ 541.787477][T13021] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 541.829721][T12774] total_writeback 0 [ 541.834547][T12774] total_workingset_refault_anon 0 [ 541.839619][T12774] total_workingset_refault_file 1857 [ 541.862575][T12774] total_swap 127823872 [ 541.866715][T12774] total_pgpgin 535476 [ 541.893984][T12774] total_pgpgout 459358 [ 541.898997][T12774] total_pgfault 231586 [ 541.919084][T12774] total_pgmajfault 5 [ 541.927418][T12774] total_inactive_anon 198762496 [ 541.937366][T12774] total_active_anon 113016832 [ 541.956483][T12774] total_inactive_file 0 [ 541.960734][T12774] total_active_file 0 [ 541.977856][T12774] total_unevictable 0 [ 541.987140][T12774] anon_cost 0 [ 541.990485][T12774] file_cost 0 [ 541.995480][T12774] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz.5.2201,pid=12621,uid=0 [ 542.044091][T12774] Memory cgroup out of memory: Killed process 12621 (syz.5.2201) total-vm:200548kB, anon-rss:1276kB, file-rss:20608kB, shmem-rss:98688kB, UID:0 pgtables:324kB oom_score_adj:1000 [ 542.855453][T13373] loop4: detected capacity change from 0 to 512 [ 543.131180][T13373] EXT4-fs error (device loop4): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 543.146142][T13373] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.2486: corrupted inode contents [ 543.163508][T13373] EXT4-fs error (device loop4): ext4_dirty_inode:6144: inode #11: comm syz.4.2486: mark_inode_dirty error [ 543.177956][T13373] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #11: comm syz.4.2486: invalid indirect mapped block 1 (level 1) [ 543.197845][T13373] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.2486: corrupted inode contents [ 543.211202][T13373] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 543.237483][T13373] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.2486: corrupted inode contents [ 543.253399][T13373] EXT4-fs error (device loop4): ext4_truncate:4302: inode #11: comm syz.4.2486: mark_inode_dirty error [ 543.269465][T13373] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 543.282426][T13373] EXT4-fs (loop4): 1 truncate cleaned up [ 543.295101][T13373] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 543.639966][ T7154] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 545.732752][T13416] loop6: detected capacity change from 0 to 512 [ 546.023145][T13416] EXT4-fs error (device loop6): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 546.037851][T13416] EXT4-fs error (device loop6): ext4_do_update_inode:5256: inode #11: comm syz.6.2498: corrupted inode contents [ 546.053844][T13416] EXT4-fs error (device loop6): ext4_dirty_inode:6144: inode #11: comm syz.6.2498: mark_inode_dirty error [ 546.067309][T13416] EXT4-fs error (device loop6): ext4_free_branches:1030: inode #11: comm syz.6.2498: invalid indirect mapped block 1 (level 1) [ 546.083981][T13416] EXT4-fs error (device loop6): ext4_do_update_inode:5256: inode #11: comm syz.6.2498: corrupted inode contents [ 546.114260][T13416] EXT4-fs error (device loop6) in ext4_orphan_del:303: Corrupt filesystem [ 546.125359][T13416] EXT4-fs error (device loop6): ext4_do_update_inode:5256: inode #11: comm syz.6.2498: corrupted inode contents [ 546.138517][T13416] EXT4-fs error (device loop6): ext4_truncate:4302: inode #11: comm syz.6.2498: mark_inode_dirty error [ 546.150780][T13416] EXT4-fs error (device loop6) in ext4_process_orphan:345: Corrupt filesystem [ 546.161405][T13416] EXT4-fs (loop6): 1 truncate cleaned up [ 546.173909][T13416] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 546.684059][T10110] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 547.387955][T13442] loop6: detected capacity change from 0 to 512 [ 547.467038][T13442] ext4: Bad value for 'data' [ 549.096244][T13483] loop6: detected capacity change from 0 to 512 [ 549.186751][T13483] EXT4-fs error (device loop6): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 549.345118][T13483] EXT4-fs error (device loop6): ext4_do_update_inode:5256: inode #11: comm syz.6.2514: corrupted inode contents [ 549.536761][T13483] EXT4-fs error (device loop6): ext4_dirty_inode:6144: inode #11: comm syz.6.2514: mark_inode_dirty error [ 549.633552][T13483] EXT4-fs error (device loop6): ext4_free_branches:1030: inode #11: comm syz.6.2514: invalid indirect mapped block 1 (level 1) [ 549.686448][T13483] EXT4-fs error (device loop6): ext4_do_update_inode:5256: inode #11: comm syz.6.2514: corrupted inode contents [ 549.826338][T13483] EXT4-fs error (device loop6) in ext4_orphan_del:303: Corrupt filesystem [ 549.861622][T13483] EXT4-fs error (device loop6): ext4_do_update_inode:5256: inode #11: comm syz.6.2514: corrupted inode contents [ 549.925170][T13483] EXT4-fs error (device loop6): ext4_truncate:4302: inode #11: comm syz.6.2514: mark_inode_dirty error [ 549.966859][T13483] EXT4-fs error (device loop6) in ext4_process_orphan:345: Corrupt filesystem [ 550.004154][T13483] EXT4-fs (loop6): 1 truncate cleaned up [ 550.036549][T13483] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 552.137022][T10110] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 552.843786][T13553] loop4: detected capacity change from 0 to 512 [ 552.851300][T13553] ext4: Bad value for 'data' [ 553.740781][T13565] loop4: detected capacity change from 0 to 512 [ 553.897124][T13565] EXT4-fs error (device loop4): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 553.911878][T13565] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.2565: corrupted inode contents [ 553.926420][T13565] EXT4-fs error (device loop4): ext4_dirty_inode:6144: inode #11: comm syz.4.2565: mark_inode_dirty error [ 553.943443][T13565] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #11: comm syz.4.2565: invalid indirect mapped block 1 (level 1) [ 554.012947][T13565] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.2565: corrupted inode contents [ 554.036170][T13565] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 554.052405][T13565] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.2565: corrupted inode contents [ 554.115496][T13565] EXT4-fs error (device loop4): ext4_truncate:4302: inode #11: comm syz.4.2565: mark_inode_dirty error [ 554.199921][T13565] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 554.245629][T13565] EXT4-fs (loop4): 1 truncate cleaned up [ 554.332226][T13565] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 555.523232][ T7154] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 557.275595][T13595] loop6: detected capacity change from 0 to 512 [ 557.292640][T13595] ext4: Bad value for 'data' [ 557.521657][ T5793] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 558.270274][T13607] loop6: detected capacity change from 0 to 512 [ 558.414621][T13607] EXT4-fs error (device loop6): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 558.511671][T13607] EXT4-fs error (device loop6): ext4_do_update_inode:5256: inode #11: comm syz.6.2581: corrupted inode contents [ 558.571842][T13607] EXT4-fs error (device loop6): ext4_dirty_inode:6144: inode #11: comm syz.6.2581: mark_inode_dirty error [ 558.588828][T13607] EXT4-fs error (device loop6): ext4_free_branches:1030: inode #11: comm syz.6.2581: invalid indirect mapped block 1 (level 1) [ 558.661969][T13607] EXT4-fs error (device loop6): ext4_do_update_inode:5256: inode #11: comm syz.6.2581: corrupted inode contents [ 558.684637][T13607] EXT4-fs error (device loop6) in ext4_orphan_del:303: Corrupt filesystem [ 558.732011][T13607] EXT4-fs error (device loop6): ext4_do_update_inode:5256: inode #11: comm syz.6.2581: corrupted inode contents [ 558.794065][T13607] EXT4-fs error (device loop6): ext4_truncate:4302: inode #11: comm syz.6.2581: mark_inode_dirty error [ 558.860518][T13607] EXT4-fs error (device loop6) in ext4_process_orphan:345: Corrupt filesystem [ 558.916097][T13607] EXT4-fs (loop6): 1 truncate cleaned up [ 558.954014][T13607] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 560.135363][T10110] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 563.018479][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.027223][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 571.349136][T13854] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[10110] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[13854] [ 573.270790][T13889] loop5: detected capacity change from 0 to 512 [ 573.352709][T13889] ext4: Bad value for 'data' [ 574.784894][T13917] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2723'. [ 575.913641][T13938] loop5: detected capacity change from 0 to 512 [ 575.927180][T13938] EXT4-fs error (device loop5): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 575.941792][T13938] EXT4-fs error (device loop5): ext4_do_update_inode:5256: inode #11: comm syz.5.2706: corrupted inode contents [ 575.983012][T13938] EXT4-fs error (device loop5): ext4_dirty_inode:6144: inode #11: comm syz.5.2706: mark_inode_dirty error [ 576.001779][T13938] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #11: comm syz.5.2706: invalid indirect mapped block 1 (level 1) [ 576.016716][T13938] EXT4-fs error (device loop5): ext4_do_update_inode:5256: inode #11: comm syz.5.2706: corrupted inode contents [ 576.029625][T13938] EXT4-fs error (device loop5) in ext4_orphan_del:303: Corrupt filesystem [ 576.042467][T13938] EXT4-fs error (device loop5): ext4_do_update_inode:5256: inode #11: comm syz.5.2706: corrupted inode contents [ 576.061514][T13938] EXT4-fs error (device loop5): ext4_truncate:4302: inode #11: comm syz.5.2706: mark_inode_dirty error [ 576.081516][T13938] EXT4-fs error (device loop5) in ext4_process_orphan:345: Corrupt filesystem [ 576.101836][T13938] EXT4-fs (loop5): 1 truncate cleaned up [ 576.108791][T13938] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 578.104371][T13974] loop2: detected capacity change from 0 to 128 [ 578.355012][T13974] netlink: 'syz.2.2748': attribute type 1 has an invalid length. [ 578.652997][T13978] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2748'. [ 578.742783][T13978] 8021q: adding VLAN 0 to HW filter on device bond1 [ 579.143289][T13980] 8021q: adding VLAN 0 to HW filter on device bond1 [ 579.223570][T13980] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 579.291507][T13980] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 579.351091][T13980] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 579.411498][T13980] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 579.473568][T13980] bond1: (slave geneve2): making interface the new active one [ 579.532681][T13980] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 581.632767][ T9889] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 583.458126][ T5792] Bluetooth: hci1: unexpected event for opcode 0x0419 [ 584.603460][ T5792] Bluetooth: hci3: unexpected event for opcode 0x0404 [ 585.700991][T14047] dummy_hcd dummy_hcd.0: remove, state 4 [ 585.707529][T14047] usb usb1: USB disconnect, device number 1 [ 585.732332][T14047] dummy_hcd dummy_hcd.0: stopped [ 585.737343][T14047] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 585.975744][T14053] nvmet: adding nsid 1 to subsystem testsubsys [ 586.503170][T14062] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 586.606331][ T5792] Bluetooth: hci2: unexpected event for opcode 0x2010 [ 587.043462][T14076] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2785'. [ 587.503728][ T5792] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 587.513177][ T5792] Bluetooth: hci1: Injecting HCI hardware error event [ 587.522040][ T5779] Bluetooth: hci1: hardware error 0x00 [ 587.539355][T14083] loop2: detected capacity change from 0 to 512 [ 587.552045][T14083] ext4: Bad value for 'data' [ 587.967651][T14086] loop2: detected capacity change from 0 to 512 [ 588.035293][T14086] EXT4-fs error (device loop2): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 588.052788][T14086] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2787: corrupted inode contents [ 588.102716][T14086] EXT4-fs error (device loop2): ext4_dirty_inode:6144: inode #11: comm syz.2.2787: mark_inode_dirty error [ 588.117149][T14086] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.2787: invalid indirect mapped block 1 (level 1) [ 588.137527][T14086] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2787: corrupted inode contents [ 588.149836][T14086] EXT4-fs error (device loop2) in ext4_orphan_del:303: Corrupt filesystem [ 588.158767][T14086] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2787: corrupted inode contents [ 588.171062][T14086] EXT4-fs error (device loop2): ext4_truncate:4302: inode #11: comm syz.2.2787: mark_inode_dirty error [ 588.196322][T14086] EXT4-fs error (device loop2) in ext4_process_orphan:345: Corrupt filesystem [ 588.236227][T14086] EXT4-fs (loop2): 1 truncate cleaned up [ 588.243697][T14086] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 589.592459][T13021] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 589.763362][ T5792] Bluetooth: hci1: unexpected event for opcode 0x0404 [ 589.813498][ T5779] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 590.337061][ T6194] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 590.482440][T14117] 9pnet_virtio: no channels available for device syz [ 590.501586][ T8] usb 3-1: new low-speed USB device number 7 using dummy_hcd [ 590.573554][ T6194] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32 [ 590.591494][ T6194] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 590.601196][ T6194] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 590.651621][ T6194] usb 6-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice= 1.00 [ 590.660736][ T6194] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 590.687533][ T8] usb 3-1: unable to get BOS descriptor or descriptor too short [ 590.697040][ T8] usb 3-1: config 100 has an invalid interface number: 173 but max is 0 [ 590.713745][ T8] usb 3-1: config 100 has no interface number 0 [ 590.731282][ T8] usb 3-1: config 100 interface 173 altsetting 142 endpoint 0xE is Bulk; changing to Interrupt [ 590.733585][T14109] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 590.766661][ T8] usb 3-1: config 100 interface 173 altsetting 142 has an invalid endpoint with address 0xFF, skipping [ 590.792886][ T8] usb 3-1: config 100 interface 173 has no altsetting 0 [ 590.804338][ T6194] cyberjack 6-1:1.0: Reiner SCT Cyberjack USB card reader converter detected [ 590.816774][ T8] usb 3-1: string descriptor 0 read error: -22 [ 590.825534][ T8] usb 3-1: New USB device found, idVendor=0c2e, idProduct=0700, bcdDevice=d4.f4 [ 590.852890][ T8] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 590.901968][ T6194] usb 6-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 590.906124][T14116] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 590.926828][T14116] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 590.972924][ T8] metro_usb 3-1:100.173: required endpoints missing [ 591.174729][ T8] usb 6-1: USB disconnect, device number 2 [ 591.205577][ T8] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 591.268960][ T8] cyberjack 6-1:1.0: device disconnected [ 591.289472][ T5837] usb 3-1: USB disconnect, device number 7 [ 591.339522][T14127] loop6: detected capacity change from 0 to 512 [ 591.374616][T14127] ext4: Bad value for 'data' [ 591.714004][ T5779] Bluetooth: hci2: unexpected event for opcode 0x0404 [ 591.760210][T13557] syz.5.2560 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 591.893772][T13557] CPU: 0 PID: 13557 Comm: syz.5.2560 Not tainted syzkaller #0 [ 591.901330][T13557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 591.911427][T13557] Call Trace: [ 591.914740][T13557] [ 591.917699][T13557] dump_stack_lvl+0x18c/0x250 [ 591.922418][T13557] ? show_regs_print_info+0x20/0x20 [ 591.927674][T13557] ? load_image+0x420/0x420 [ 591.932212][T13557] ? ___ratelimit+0x478/0x610 [ 591.936941][T13557] ? radix_tree_cpu_dead+0x160/0x160 [ 591.942275][T13557] dump_header+0xd8/0x820 [ 591.946658][T13557] oom_kill_process+0x390/0x580 [ 591.951565][T13557] out_of_memory+0xe0e/0x1200 [ 591.956436][T13557] ? mem_cgroup_out_of_memory+0xc1/0x390 [ 591.962110][T13557] ? print_unlock_imbalance_bug+0x160/0x160 [ 591.968054][T13557] ? mutex_lock_nested+0x20/0x20 [ 591.973043][T13557] ? unregister_oom_notifier+0x20/0x20 [ 591.978560][T13557] mem_cgroup_out_of_memory+0x2c2/0x390 [ 591.984244][T13557] ? try_charge_memcg+0xc91/0x17c0 [ 591.989432][T13557] ? drain_local_stock+0x630/0x630 [ 591.994612][T13557] ? do_raw_spin_unlock+0x121/0x230 [ 591.999875][T13557] try_charge_memcg+0xca1/0x17c0 [ 592.004978][T13557] ? folio_prep_large_rmappable+0x9e/0x1b0 [ 592.010842][T13557] ? folio_flags+0x120/0x120 [ 592.015478][T13557] ? shmem_alloc_folio+0x1f4/0x2a0 [ 592.020737][T13557] ? percpu_ref_tryget+0x15/0x180 [ 592.025903][T13557] ? get_mem_cgroup_from_mm+0x38/0x290 [ 592.031413][T13557] charge_memcg+0x11b/0x3b0 [ 592.035972][T13557] ? __mem_cgroup_charge+0x80/0x80 [ 592.041127][T13557] ? get_mem_cgroup_from_mm+0x38/0x290 [ 592.046631][T13557] ? get_mem_cgroup_from_mm+0x38/0x290 [ 592.052140][T13557] ? get_mem_cgroup_from_mm+0x1b2/0x290 [ 592.057735][T13557] __mem_cgroup_charge+0x25/0x80 [ 592.062723][T13557] shmem_add_to_page_cache+0x8d3/0x1b80 [ 592.068334][T13557] ? xas_load+0x12b/0x140 [ 592.072732][T13557] ? shmem_alloc_folio+0x2a0/0x2a0 [ 592.077909][T13557] shmem_get_folio_gfp+0x1037/0x2b40 [ 592.083540][T13557] shmem_write_begin+0xf2/0x430 [ 592.088460][T13557] generic_perform_write+0x2fe/0x5c0 [ 592.093826][T13557] ? generic_file_direct_write+0x3e0/0x3e0 [ 592.099690][T13557] ? down_write+0x16e/0x200 [ 592.104258][T13557] ? file_update_time+0x98/0x1a0 [ 592.109254][T13557] shmem_file_write_iter+0xfb/0x120 [ 592.114502][T13557] __kernel_write_iter+0x29f/0x6d0 [ 592.119666][T13557] ? vfs_read+0x990/0x990 [ 592.124036][T13557] ? get_dump_page+0x156/0x200 [ 592.128854][T13557] ? __asan_memset+0x22/0x40 [ 592.133515][T13557] ? iov_iter_bvec+0xd4/0x1b0 [ 592.138259][T13557] dump_user_range+0x418/0x840 [ 592.143087][T13557] ? dump_skip+0x40/0x40 [ 592.147377][T13557] ? dump_emit+0x78/0xe0 [ 592.151681][T13557] ? dump_emit+0xa6/0xe0 [ 592.156007][T13557] ? elf_core_dump+0x2dbb/0x37c0 [ 592.161008][T13557] elf_core_dump+0x320e/0x37c0 [ 592.165854][T13557] ? load_elf_binary+0x2850/0x2850 [ 592.171030][T13557] ? verify_lock_unused+0x140/0x140 [ 592.176287][T13557] ? __lock_acquire+0x7d80/0x7d80 [ 592.181373][T13557] ? mas_next_slot+0x94c/0x980 [ 592.186221][T13557] ? rcu_read_lock_any_held+0xb4/0x140 [ 592.191730][T13557] ? 0xffffffffff600000 [ 592.195938][T13557] do_coredump+0x1791/0x24a0 [ 592.200611][T13557] ? nfs_stat_to_errno+0x170/0x170 [ 592.205791][T13557] ? lock_chain_count+0x20/0x20 [ 592.210690][T13557] ? _raw_spin_unlock_irq+0x23/0x50 [ 592.215933][T13557] ? lockdep_hardirqs_on+0x98/0x150 [ 592.221196][T13557] get_signal+0x10da/0x1390 [ 592.225776][T13557] arch_do_signal_or_restart+0xc2/0x7b0 [ 592.231391][T13557] ? get_sigframe_size+0x20/0x20 [ 592.236392][T13557] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 592.242429][T13557] ? exit_to_user_mode_loop+0x3b/0x110 [ 592.247951][T13557] exit_to_user_mode_loop+0x70/0x110 [ 592.253297][T13557] exit_to_user_mode_prepare+0xee/0x180 [ 592.258895][T13557] irqentry_exit_to_user_mode+0x9/0x30 [ 592.264426][T13557] exc_page_fault+0x8c/0x100 [ 592.269097][T13557] asm_exc_page_fault+0x26/0x30 [ 592.274012][T13557] RIP: 0033:0x7f18b1853bd7 [ 592.278471][T13557] Code: e8 fe f9 ff ff 89 f2 48 8d 3d 5d 4f 1b 00 48 8d 35 c3 0a 1e 00 31 c0 e8 37 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 592.298114][T13557] RSP: 002b:00007f18afbd7120 EFLAGS: 00010202 [ 592.304215][T13557] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007f18b199e0d9 [ 592.312232][T13557] RDX: 00007f18afbd7140 RSI: 00007f18afbd7270 RDI: 000000000000000b [ 592.320245][T13557] RBP: 00007f18b1a35024 R08: 0000000000000000 R09: 0000000000000000 [ 592.328268][T13557] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 592.336283][T13557] R13: 00007f18b1c26038 R14: 00007f18b1c25fa0 R15: 00007fff6d2c5218 [ 592.344326][T13557] [ 592.378815][T13557] memory: usage 307200kB, limit 307200kB, failcnt 55936 [ 592.413365][T13557] memory+swap: usage 376804kB, limit 9007199254740988kB, failcnt 0 [ 592.436487][T13557] kmem: usage 2492kB, limit 9007199254740988kB, failcnt 0 [ 592.450661][T13557] Memory cgroup stats for /syz5: [ 592.450834][T13557] cache 311508992 [ 592.460960][T13557] rss 450560 [ 592.471295][T13557] rss_huge 0 [ 592.474607][T13557] shmem 311508992 [ 592.478373][T13557] mapped_file 184295424 [ 592.484900][T13557] dirty 0 [ 592.487885][T13557] writeback 0 [ 592.491302][T13557] workingset_refault_anon 0 [ 592.495966][T13557] workingset_refault_file 1857 [ 592.501012][T13557] swap 71274496 [ 592.504756][T13557] pgpgin 650888 [ 592.508364][T13557] pgpgout 574726 [ 592.528647][T13557] pgfault 296851 [ 592.541492][T13557] pgmajfault 5 [ 592.544918][T13557] inactive_anon 17707008 [ 592.551376][T13557] active_anon 294252544 [ 592.556583][T13557] inactive_file 0 [ 592.560354][T13557] active_file 0 [ 592.564028][T13557] unevictable 0 [ 592.567619][T13557] hierarchical_memory_limit 314572800 [ 592.573352][T13557] hierarchical_memsw_limit 9223372036854771712 [ 592.579853][T13557] total_cache 311508992 [ 592.601258][T13557] total_rss 450560 [ 592.626793][T13557] total_rss_huge 0 [ 592.630598][T13557] total_shmem 311508992 [ 592.647393][T13557] total_mapped_file 184295424 [ 592.680761][T13557] total_dirty 0 [ 592.698554][T13557] total_writeback 0 [ 592.705548][T13557] total_workingset_refault_anon 0 [ 592.710636][T13557] total_workingset_refault_file 1857 [ 592.739873][T13557] total_swap 71274496 [ 592.748473][T13557] total_pgpgin 650888 [ 592.753160][T13557] total_pgpgout 574726 [ 592.757263][T13557] total_pgfault 296851 [ 592.761369][T13557] total_pgmajfault 5 [ 592.771897][T13557] total_inactive_anon 17707008 [ 592.776916][T13557] total_active_anon 294252544 [ 592.785420][T13557] total_inactive_file 0 [ 592.795844][T13557] total_active_file 0 [ 592.799882][T13557] total_unevictable 0 [ 592.809645][T13557] anon_cost 0 [ 592.820491][T13557] file_cost 0 [ 592.829926][T13557] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz.5.2377,pid=13094,uid=0 [ 592.902635][T13557] Memory cgroup out of memory: Killed process 13094 (syz.5.2377) total-vm:200552kB, anon-rss:1404kB, file-rss:20608kB, shmem-rss:110976kB, UID:0 pgtables:348kB oom_score_adj:1000 [ 592.960571][T14127] syz.6.2803 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 592.970924][T14127] CPU: 1 PID: 14127 Comm: syz.6.2803 Not tainted syzkaller #0 [ 592.978448][T14127] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 592.988553][T14127] Call Trace: [ 592.991877][T14127] [ 592.994852][T14127] dump_stack_lvl+0x18c/0x250 [ 592.999631][T14127] ? show_regs_print_info+0x20/0x20 [ 593.004888][T14127] ? load_image+0x420/0x420 [ 593.009440][T14127] ? ___ratelimit+0x478/0x610 [ 593.014203][T14127] ? radix_tree_cpu_dead+0x160/0x160 [ 593.019551][T14127] dump_header+0xd8/0x820 [ 593.023944][T14127] oom_kill_process+0x390/0x580 [ 593.028855][T14127] out_of_memory+0xe0e/0x1200 [ 593.033595][T14127] ? mem_cgroup_out_of_memory+0xc1/0x390 [ 593.039285][T14127] ? mutex_lock_nested+0x20/0x20 [ 593.044281][T14127] ? unregister_oom_notifier+0x20/0x20 [ 593.049803][T14127] mem_cgroup_out_of_memory+0x2c2/0x390 [ 593.055416][T14127] ? try_charge_memcg+0xc91/0x17c0 [ 593.060610][T14127] ? drain_local_stock+0x630/0x630 [ 593.065787][T14127] ? do_raw_spin_unlock+0x121/0x230 [ 593.071049][T14127] try_charge_memcg+0xca1/0x17c0 [ 593.076057][T14127] ? folio_prep_large_rmappable+0x9e/0x1b0 [ 593.081928][T14127] ? folio_flags+0x120/0x120 [ 593.086589][T14127] ? shmem_alloc_folio+0x1f4/0x2a0 [ 593.091773][T14127] ? percpu_ref_tryget+0x15/0x180 [ 593.096855][T14127] ? get_mem_cgroup_from_mm+0x38/0x290 [ 593.102373][T14127] charge_memcg+0x11b/0x3b0 [ 593.106951][T14127] ? __mem_cgroup_charge+0x80/0x80 [ 593.112115][T14127] ? get_mem_cgroup_from_mm+0x38/0x290 [ 593.117631][T14127] ? get_mem_cgroup_from_mm+0x38/0x290 [ 593.123152][T14127] ? get_mem_cgroup_from_mm+0x1b2/0x290 [ 593.128756][T14127] __mem_cgroup_charge+0x25/0x80 [ 593.133759][T14127] shmem_add_to_page_cache+0x8d3/0x1b80 [ 593.139363][T14127] ? xas_load+0x12b/0x140 [ 593.143802][T14127] ? shmem_alloc_folio+0x2a0/0x2a0 [ 593.148998][T14127] shmem_get_folio_gfp+0x1037/0x2b40 [ 593.154370][T14127] shmem_fault+0x1b8/0x820 [ 593.158854][T14127] ? zero_pipe_buf_get+0x10/0x10 [ 593.163855][T14127] ? handle_mm_fault+0xe6/0x4a50 [ 593.168852][T14127] ? __lock_acquire+0x7d80/0x7d80 [ 593.173941][T14127] __do_fault+0x13b/0x4d0 [ 593.178325][T14127] ? handle_mm_fault+0x3929/0x4a50 [ 593.183488][T14127] ? handle_mm_fault+0xe6/0x4a50 [ 593.188487][T14127] handle_mm_fault+0x3945/0x4a50 [ 593.193484][T14127] ? handle_mm_fault+0xe6/0x4a50 [ 593.198493][T14127] ? numa_migrate_prep+0x350/0x350 [ 593.203691][T14127] ? follow_page_pte+0x6dd/0x1ae0 [ 593.208781][T14127] ? pmd_lock+0x60/0x60 [ 593.213007][T14127] __get_user_pages+0x604/0x1580 [ 593.218024][T14127] ? populate_vma_page_range+0x380/0x380 [ 593.223724][T14127] populate_vma_page_range+0x2c1/0x380 [ 593.229245][T14127] ? fixup_user_fault+0x750/0x750 [ 593.234330][T14127] ? down_read+0x1ac/0x2e0 [ 593.238817][T14127] __mm_populate+0x260/0x390 [ 593.243525][T14127] ? faultin_page_range+0x8a0/0x8a0 [ 593.248792][T14127] ? up_write+0x1be/0x410 [ 593.253184][T14127] vm_mmap_pgoff+0x2da/0x3f0 [ 593.257845][T14127] ? account_locked_vm+0x200/0x200 [ 593.263024][T14127] ? ksys_mmap_pgoff+0xf3/0x720 [ 593.267942][T14127] ? __x64_sys_mmap+0x7a/0x130 [ 593.272771][T14127] do_syscall_64+0x55/0xb0 [ 593.277262][T14127] ? clear_bhb_loop+0x40/0x90 [ 593.282005][T14127] ? clear_bhb_loop+0x40/0x90 [ 593.286748][T14127] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 593.292705][T14127] RIP: 0033:0x7f4b8cd9e0d9 [ 593.297178][T14127] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 593.316850][T14127] RSP: 002b:00007f4b8aff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 593.325324][T14127] RAX: ffffffffffffffda RBX: 00007f4b8d025fa0 RCX: 00007f4b8cd9e0d9 [ 593.333354][T14127] RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000 [ 593.341377][T14127] RBP: 00007f4b8ce35024 R08: ffffffffffffffff R09: 0000000000000000 [ 593.349405][T14127] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 593.357425][T14127] R13: 00007f4b8d026038 R14: 00007f4b8d025fa0 R15: 00007ffd5d2fe298 [ 593.365466][T14127] [ 593.373065][T14127] memory: usage 307200kB, limit 307200kB, failcnt 25506 [ 593.380121][T14127] memory+swap: usage 362496kB, limit 9007199254740988kB, failcnt 0 [ 593.388124][T14127] kmem: usage 2796kB, limit 9007199254740988kB, failcnt 0 [ 593.395342][T14127] Memory cgroup stats for /syz6: [ 593.395659][T14127] cache 311066624 [ 593.405263][T14127] rss 643072 [ 593.408512][T14127] rss_huge 0 [ 593.412013][T14127] shmem 311066624 [ 593.415699][T14127] mapped_file 188993536 [ 593.419894][T14127] dirty 0 [ 593.422929][T14127] writeback 0 [ 593.426255][T14127] workingset_refault_anon 12 [ 593.430888][T14127] workingset_refault_file 4717 [ 593.435740][T14127] swap 56623104 [ 593.439227][T14127] pgpgin 701610 [ 593.442769][T14127] pgpgout 625509 [ 593.446353][T14127] pgfault 267941 [ 593.449936][T14127] pgmajfault 25 [ 593.453463][T14127] inactive_anon 209141760 [ 593.457826][T14127] active_anon 102567936 [ 593.462059][T14127] inactive_file 0 [ 593.465745][T14127] active_file 0 [ 593.469244][T14127] unevictable 0 [ 593.472792][T14127] hierarchical_memory_limit 314572800 [ 593.478200][T14127] hierarchical_memsw_limit 9223372036854771712 [ 593.484453][T14127] total_cache 311066624 [ 593.488661][T14127] total_rss 643072 [ 593.492542][T14127] total_rss_huge 0 [ 593.496303][T14127] total_shmem 311066624 [ 593.500504][T14127] total_mapped_file 188993536 [ 593.506250][T14127] total_dirty 0 [ 593.509755][T14127] total_writeback 0 [ 593.513834][T14127] total_workingset_refault_anon 12 [ 593.518981][T14127] total_workingset_refault_file 4717 [ 593.524348][T14127] total_swap 56623104 [ 593.528366][T14127] total_pgpgin 701610 [ 593.532429][T14127] total_pgpgout 625509 [ 593.536538][T14127] total_pgfault 267941 [ 593.540642][T14127] total_pgmajfault 25 [ 593.544736][T14127] total_inactive_anon 209141760 [ 593.549617][T14127] total_active_anon 102567936 [ 593.554365][T14127] total_inactive_file 0 [ 593.558557][T14127] total_active_file 0 [ 593.562635][T14127] total_unevictable 0 [ 593.566683][T14127] anon_cost 0 [ 593.570016][T14127] file_cost 0 [ 593.573377][T14127] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz6,mems_allowed=0-1,oom_memcg=/syz6,task_memcg=/syz6,task=syz.6.2613,pid=13681,uid=0 [ 593.590398][T14127] Memory cgroup out of memory: Killed process 13681 (syz.6.2613) total-vm:202600kB, anon-rss:1412kB, file-rss:20480kB, shmem-rss:115328kB, UID:0 pgtables:348kB oom_score_adj:1000 [ 594.061776][ T5779] Bluetooth: hci2: unexpected event for opcode 0x0404 [ 594.688394][T14160] dvmrp0: entered allmulticast mode [ 595.278569][T14181] loop4: detected capacity change from 0 to 512 [ 595.323044][T14181] ext4: Bad value for 'data' [ 595.399144][ T5793] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 595.653834][T14181] loop4: detected capacity change from 0 to 512 [ 595.718429][T14181] EXT4-fs error (device loop4): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 595.733291][T14181] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.2827: corrupted inode contents [ 595.751724][T14181] EXT4-fs error (device loop4): ext4_dirty_inode:6144: inode #11: comm syz.4.2827: mark_inode_dirty error [ 595.773500][T14181] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #11: comm syz.4.2827: invalid indirect mapped block 1 (level 1) [ 595.792357][T14181] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.2827: corrupted inode contents [ 595.804672][T14181] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 595.824948][T14181] EXT4-fs error (device loop4): ext4_do_update_inode:5256: inode #11: comm syz.4.2827: corrupted inode contents [ 595.838485][T14181] EXT4-fs error (device loop4): ext4_truncate:4302: inode #11: comm syz.4.2827: mark_inode_dirty error [ 595.850156][T14181] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 595.863534][T14181] EXT4-fs (loop4): 1 truncate cleaned up [ 595.870626][T14181] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 596.089314][ T7154] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 596.303880][T14192] page:ffffea0001310000 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88804c400580 pfn:0x4c400 [ 596.357408][T14192] head:ffffea0001310000 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 596.381663][T14192] memcg:ffff88806bf4ba01 [ 596.386066][T14192] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 596.411137][T14192] page_type: 0xffffffff() [ 596.430732][T14192] raw: 00fff00000000840 ffff888017c4fdc0 ffffea000131ab10 ffffea0001db9010 [ 596.451669][T14192] raw: ffff88804c400580 000000000017000b 00000001ffffffff ffff88806bf4ba01 [ 596.484761][T14192] page dumped because: unmovable page [ 596.507216][T14192] page_owner tracks the page as allocated [ 596.529675][T14192] page last allocated via order 2, migratetype Reclaimable, gfp_mask 0x152810(GFP_NOWAIT|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 10381, tgid 10381 (syz.6.1524), ts 343830968973, free_ts 27832595532 [ 596.591568][T14192] post_alloc_hook+0x1c1/0x200 [ 596.596508][T14192] get_page_from_freelist+0x2181/0x22a0 [ 596.621561][T14192] __alloc_pages+0x1f0/0x460 [ 596.631073][T14192] alloc_slab_page+0x5d/0x180 [ 596.645356][T14192] new_slab+0x87/0x2d0 [ 596.656587][T14192] ___slab_alloc+0xc5c/0x12f0 [ 596.670361][T14192] kmem_cache_alloc_lru+0xfc/0x2b0 [ 596.688403][T14192] xas_create+0x111f/0x1760 [ 596.703689][T14192] xas_store+0xa3/0x19e0 [ 596.709623][T14192] shmem_add_to_page_cache+0xa80/0x1b80 [ 596.717261][T14200] warning: `syz.5.2832' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 596.736895][T14192] shmem_get_folio_gfp+0x1037/0x2b40 [ 596.746149][T14192] shmem_fault+0x1b8/0x820 [ 596.761497][T14192] __do_fault+0x13b/0x4d0 [ 596.772205][T14192] handle_mm_fault+0x3945/0x4a50 [ 596.782147][T14192] __get_user_pages+0x604/0x1580 [ 596.791479][T14192] get_dump_page+0x10c/0x200 [ 596.807932][T14192] page last free stack trace: [ 596.821554][T14192] free_unref_page_prepare+0x7d7/0x8f0 [ 596.831519][T14192] free_unref_page+0x32/0x2e0 [ 596.841471][T14192] free_contig_range+0xa1/0x150 [ 596.851533][T14192] destroy_args+0x7d/0x840 [ 596.861475][T14192] debug_vm_pgtable+0x411/0x440 [ 596.881549][T14192] do_one_initcall+0x242/0x790 [ 596.891505][T14192] do_initcall_level+0x13d/0x1f0 [ 596.901558][T14192] do_initcalls+0x69/0xd0 [ 596.911482][T14192] kernel_init_freeable+0x3d9/0x560 [ 596.925382][T14192] kernel_init+0x1d/0x1c0 [ 596.942359][T14192] ret_from_fork+0x48/0x80 [ 596.956538][T14192] ret_from_fork_asm+0x11/0x20 [ 597.348226][T14213] loop2: detected capacity change from 0 to 512 [ 597.362841][T14213] ext4: Bad value for 'data' [ 597.413533][ T5793] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 597.683006][T14213] loop2: detected capacity change from 0 to 512 [ 597.698391][T14213] EXT4-fs error (device loop2): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 597.714007][T14213] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2838: corrupted inode contents [ 597.727282][T14213] EXT4-fs error (device loop2): ext4_dirty_inode:6144: inode #11: comm syz.2.2838: mark_inode_dirty error [ 597.741088][T14213] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.2838: invalid indirect mapped block 1 (level 1) [ 597.755001][T14213] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2838: corrupted inode contents [ 597.770146][T14213] EXT4-fs error (device loop2) in ext4_orphan_del:303: Corrupt filesystem [ 597.779287][T14213] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2838: corrupted inode contents [ 597.799762][T14213] EXT4-fs error (device loop2): ext4_truncate:4302: inode #11: comm syz.2.2838: mark_inode_dirty error [ 597.813966][T14213] EXT4-fs error (device loop2) in ext4_process_orphan:345: Corrupt filesystem [ 597.823638][T14213] EXT4-fs (loop2): 1 truncate cleaned up [ 597.830699][T14213] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 598.083714][T13021] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 598.801546][ T6197] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 599.003140][ T6197] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 599.021120][ T6197] usb 3-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 599.041050][ T6197] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 599.075949][ T6197] keyspan 3-1:1.0: Keyspan 2 port adapter converter detected [ 599.094165][ T6197] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 81 [ 599.103980][T14242] jffs2: notice: (14242) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 599.111683][ T6197] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 1 [ 599.154741][ T6197] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 84 [ 599.173342][ T6197] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 2 [ 599.207035][ T6197] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 599.217363][ T6197] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 88 [ 599.240654][ T6197] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 6 [ 599.262769][ T6197] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 599.522925][ T8] usb 3-1: USB disconnect, device number 8 [ 599.551241][ T8] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 599.575785][ T8] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 599.599756][ T8] keyspan 3-1:1.0: device disconnected [ 602.874849][ T28] audit: type=1800 audit(1788252684.317:54): pid=14319 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2873" name="memory_backed" dev="configfs" ino=33007 res=0 errno=0 [ 602.914007][ T28] audit: type=1800 audit(1788252684.365:55): pid=14319 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2873" name="power" dev="configfs" ino=33008 res=0 errno=0 [ 603.018103][T14319] null_blk: disk nullb1 created [ 603.524217][ T5779] Bluetooth: hci3: command 0x0406 tx timeout [ 603.824916][T14276] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 604.457924][ T5766] IPVS: starting estimator thread 0... [ 604.581583][T14347] IPVS: using max 18 ests per chain, 43200 per kthread [ 604.598344][T14349] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 605.259571][T14363] netlink: 'syz.6.2890': attribute type 1 has an invalid length. [ 605.291758][T14370] loop2: detected capacity change from 0 to 512 [ 605.329633][T14370] ext4: Bad value for 'data' [ 605.498096][T14363] bond1: entered promiscuous mode [ 605.615824][T14363] 8021q: adding VLAN 0 to HW filter on device bond1 [ 605.742445][T14375] loop2: detected capacity change from 0 to 512 [ 605.858984][T14375] EXT4-fs error (device loop2): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 605.873783][T14375] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2892: corrupted inode contents [ 605.886303][T14375] EXT4-fs error (device loop2): ext4_dirty_inode:6144: inode #11: comm syz.2.2892: mark_inode_dirty error [ 605.915053][T14375] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.2892: invalid indirect mapped block 1 (level 1) [ 605.935411][T14375] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2892: corrupted inode contents [ 605.955622][T14375] EXT4-fs error (device loop2) in ext4_orphan_del:303: Corrupt filesystem [ 606.006754][T14375] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2892: corrupted inode contents [ 606.019248][T14375] EXT4-fs error (device loop2): ext4_truncate:4302: inode #11: comm syz.2.2892: mark_inode_dirty error [ 606.031008][T14375] EXT4-fs error (device loop2) in ext4_process_orphan:345: Corrupt filesystem [ 606.040393][T14375] EXT4-fs (loop2): 1 truncate cleaned up [ 606.047891][T14375] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 606.350728][T14371] 8021q: adding VLAN 0 to HW filter on device bond1 [ 606.355858][T13021] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 606.358629][T14371] bond1: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 606.469354][T14371] bond1: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 606.551065][T14371] bond1: (slave ip6gre1): making interface the new active one [ 606.626101][T14371] ip6gre1: entered promiscuous mode [ 606.633308][T14371] bond1: (slave ip6gre1): Enslaving as an active interface with an up link [ 606.738831][T14386] block device autoloading is deprecated and will be removed. [ 606.810701][ T28] audit: type=1800 audit(1788252688.127:56): pid=14391 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2899" name="memory_backed" dev="configfs" ino=33315 res=0 errno=0 [ 607.031056][T14383] md/raid10:md0: not clean -- starting background reconstruction [ 607.059559][T14383] md/raid10:md0: active with 1 out of 2 devices [ 607.071876][T14383] md0: detected capacity change from 0 to 2048 [ 607.099810][T14400] md: resync of RAID array md0 [ 607.113437][T14401] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 607.113437][T14401] The task syz.4.2902 (14401) triggered the difference, watch for misbehavior. [ 607.163924][T14400] md/raid10:md0: resync fails [ 607.184372][T14400] md: md0: resync done. [ 607.269904][T14402] md: recovery of RAID array md0 [ 607.335598][T14402] md: md0: recovery done. [ 608.646155][T14433] netlink: 88 bytes leftover after parsing attributes in process `syz.2.2918'. [ 608.822464][ T28] audit: type=1800 audit(1788252690.109:57): pid=14438 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2920" name="memory_backed" dev="configfs" ino=33925 res=0 errno=0 [ 609.067682][T14445] overlayfs: failed to resolve 'work': -2 [ 609.308441][ T8] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 609.527175][ T8] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 609.552963][ T8] usb 3-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 609.571692][ T8] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 609.605880][ T8] keyspan 3-1:1.0: Keyspan 2 port adapter converter detected [ 609.614188][T14461] jffs2: notice: (14461) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 609.626140][ T8] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 81 [ 609.649307][ T8] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 1 [ 609.677219][ T8] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 84 [ 609.684990][ T8] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 2 [ 609.694099][ T5766] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 609.701731][ T28] audit: type=1800 audit(1788252690.971:58): pid=14464 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2931" name="memory_backed" dev="configfs" ino=33521 res=0 errno=0 [ 609.738859][ T8] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 609.766417][ T8] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 88 [ 609.795002][ T8] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 6 [ 609.809798][ T8] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 609.859751][ T8] usb 3-1: USB disconnect, device number 9 [ 609.880384][ T8] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 609.929007][ T5766] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32 [ 609.955496][ T8] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 609.966133][ T5766] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 609.992398][ T8] keyspan 3-1:1.0: device disconnected [ 610.007870][ T5766] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 610.039945][ T5766] usb 5-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice= 1.00 [ 610.055987][ T5766] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 610.076627][T14458] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 610.108324][ T5766] cyberjack 5-1:1.0: Reiner SCT Cyberjack USB card reader converter detected [ 610.141420][ T5766] usb 5-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 610.313897][ T8] usb 5-1: USB disconnect, device number 2 [ 610.355581][ T8] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 610.379076][ T8] cyberjack 5-1:1.0: device disconnected [ 610.677584][T14478] overlayfs: failed to resolve 'work': -2 [ 610.735483][T14480] loop2: detected capacity change from 0 to 512 [ 610.767303][T14480] ext4: Bad value for 'data' [ 610.828237][ T5793] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 611.083609][ T28] audit: type=1800 audit(1788252692.324:59): pid=14485 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.2940" name="memory_backed" dev="configfs" ino=33564 res=0 errno=0 [ 611.138465][T14483] loop2: detected capacity change from 0 to 512 [ 611.168410][T14483] EXT4-fs error (device loop2): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 611.183046][T14483] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2938: corrupted inode contents [ 611.195833][T14483] EXT4-fs error (device loop2): ext4_dirty_inode:6144: inode #11: comm syz.2.2938: mark_inode_dirty error [ 611.207723][T14483] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.2938: invalid indirect mapped block 1 (level 1) [ 611.251921][T14483] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2938: corrupted inode contents [ 611.266646][T14483] EXT4-fs error (device loop2) in ext4_orphan_del:303: Corrupt filesystem [ 611.275664][T14483] EXT4-fs error (device loop2): ext4_do_update_inode:5256: inode #11: comm syz.2.2938: corrupted inode contents [ 611.306216][T14483] EXT4-fs error (device loop2): ext4_truncate:4302: inode #11: comm syz.2.2938: mark_inode_dirty error [ 611.331894][T14489] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 611.343695][T14483] EXT4-fs error (device loop2) in ext4_process_orphan:345: Corrupt filesystem [ 611.364487][T14483] EXT4-fs (loop2): 1 truncate cleaned up [ 611.373379][T14483] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 611.761654][T13021] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 611.979700][ T6197] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 612.067122][T14504] overlayfs: failed to resolve 'work': -2 [ 612.256176][ T6197] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 612.279613][ T6197] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 612.293661][T14512] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 612.305112][ T6197] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 612.342536][ T6197] keyspan 6-1:1.0: Keyspan 2 port adapter converter detected [ 612.365645][ T6197] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 81 [ 612.395738][ T6197] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 1 [ 612.432351][ T6197] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 84 [ 612.457814][ T6197] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 2 [ 612.476208][ T6197] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 612.503884][ T6197] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 88 [ 612.523962][ T6197] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 6 [ 612.574931][ T6197] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 612.631474][ T6197] usb 6-1: USB disconnect, device number 3 [ 612.684474][ T6197] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 612.743474][ T6197] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 612.777507][ T6197] keyspan 6-1:1.0: device disconnected [ 612.905994][T14518] md: couldn't update array info. -22 [ 612.928766][T14518] md: could not open device unknown-block(1,1). [ 612.952118][T14518] md: md_import_device returned -16 [ 613.363613][T14528] overlayfs: failed to resolve 'upper': -2 [ 613.920725][ T5792] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 613.932978][ T5792] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 613.944671][ T5792] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 613.974304][ T5792] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 613.984564][ T5792] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 613.992033][ T5792] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 614.482027][T14544] loop6: detected capacity change from 0 to 512 [ 614.489932][T14544] ext4: Bad value for 'data' [ 614.688094][ T59] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 614.834324][T14549] overlayfs: failed to resolve 'upper': -2 [ 614.892193][T14550] loop6: detected capacity change from 0 to 512 [ 614.930605][T14550] EXT4-fs error (device loop6): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 614.945209][T14550] EXT4-fs error (device loop6): ext4_do_update_inode:5256: inode #11: comm syz.6.2965: corrupted inode contents [ 614.957676][T14550] EXT4-fs error (device loop6): ext4_dirty_inode:6144: inode #11: comm syz.6.2965: mark_inode_dirty error [ 614.969682][T14550] EXT4-fs error (device loop6): ext4_free_branches:1030: inode #11: comm syz.6.2965: invalid indirect mapped block 1 (level 1) [ 615.005133][T14550] EXT4-fs error (device loop6): ext4_do_update_inode:5256: inode #11: comm syz.6.2965: corrupted inode contents [ 615.018336][T14550] EXT4-fs error (device loop6) in ext4_orphan_del:303: Corrupt filesystem [ 615.027413][T14550] EXT4-fs error (device loop6): ext4_do_update_inode:5256: inode #11: comm syz.6.2965: corrupted inode contents [ 615.041003][T14550] EXT4-fs error (device loop6): ext4_truncate:4302: inode #11: comm syz.6.2965: mark_inode_dirty error [ 615.058205][T14550] EXT4-fs error (device loop6) in ext4_process_orphan:345: Corrupt filesystem [ 615.069688][T14550] EXT4-fs (loop6): 1 truncate cleaned up [ 615.076798][T14550] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 615.177020][ T59] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 615.447229][T10110] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 615.459507][ T59] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 615.611365][ T59] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 615.876567][T14531] chnl_net:caif_netlink_parms(): no params data found [ 616.108367][ T5792] Bluetooth: hci0: command tx timeout [ 616.204121][T14573] md: couldn't update array info. -22 [ 616.212144][T14573] md: could not open device unknown-block(1,1). [ 616.218908][T14573] md: md_import_device returned -16 [ 616.277230][T14531] bridge0: port 1(bridge_slave_0) entered blocking state [ 616.284443][T14531] bridge0: port 1(bridge_slave_0) entered disabled state [ 616.329262][T14531] bridge_slave_0: entered allmulticast mode [ 616.336848][T14531] bridge_slave_0: entered promiscuous mode [ 616.445015][T14575] overlayfs: failed to resolve 'upper': -2 [ 616.462095][T14531] bridge0: port 2(bridge_slave_1) entered blocking state [ 616.494107][T14531] bridge0: port 2(bridge_slave_1) entered disabled state [ 616.508097][T14531] bridge_slave_1: entered allmulticast mode [ 616.526811][T14531] bridge_slave_1: entered promiscuous mode [ 616.703807][T14531] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 616.732952][T14531] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 617.058118][T14531] team0: Port device team_slave_0 added [ 617.184421][T14531] team0: Port device team_slave_1 added [ 617.268276][T14604] overlayfs: failed to resolve 'lower': -2 [ 617.316297][T14531] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 617.334313][T14531] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 617.367176][T14531] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 617.423169][T14531] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 617.440522][T14531] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 617.482165][T14531] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 617.541678][T14610] md: couldn't update array info. -22 [ 617.790623][T14531] hsr_slave_0: entered promiscuous mode [ 617.811796][T14531] hsr_slave_1: entered promiscuous mode [ 617.837286][T14531] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 617.844996][T14531] Cannot create hsr debugfs directory [ 617.954325][T14620] loop6: detected capacity change from 0 to 512 [ 617.979073][T14620] ext4: Bad value for 'data' [ 618.023908][ T5793] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 618.233474][ T5792] Bluetooth: hci0: command tx timeout [ 618.453828][T14628] loop6: detected capacity change from 0 to 512 [ 618.698298][T14628] EXT4-fs error (device loop6): mb_free_blocks:1970: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 618.713693][T14628] EXT4-fs error (device loop6): ext4_do_update_inode:5256: inode #11: comm syz.6.2989: corrupted inode contents [ 618.733820][T14628] EXT4-fs error (device loop6): ext4_dirty_inode:6144: inode #11: comm syz.6.2989: mark_inode_dirty error [ 618.748666][T14628] EXT4-fs error (device loop6): ext4_free_branches:1030: inode #11: comm syz.6.2989: invalid indirect mapped block 1 (level 1) [ 618.771923][T14628] EXT4-fs error (device loop6): ext4_do_update_inode:5256: inode #11: comm syz.6.2989: corrupted inode contents [ 618.812104][T14628] EXT4-fs error (device loop6) in ext4_orphan_del:303: Corrupt filesystem [ 618.842248][T14628] EXT4-fs error (device loop6): ext4_do_update_inode:5256: inode #11: comm syz.6.2989: corrupted inode contents [ 618.861079][T14628] EXT4-fs error (device loop6): ext4_truncate:4302: inode #11: comm syz.6.2989: mark_inode_dirty error [ 618.881556][T14628] EXT4-fs error (device loop6) in ext4_process_orphan:345: Corrupt filesystem [ 618.893315][T14628] EXT4-fs (loop6): 1 truncate cleaned up [ 618.919673][T14628] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 619.194136][T10110] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 619.329716][T14636] overlayfs: failed to resolve 'lower': -2 [ 619.383249][ T59] hsr_slave_0: left promiscuous mode [ 619.419814][ T59] hsr_slave_1: left promiscuous mode [ 619.428645][T14640] md: couldn't update array info. -22 [ 619.459650][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 619.464093][T14640] md: could not open device unknown-block(1,1). [ 619.483949][T14640] md: md_import_device returned -16 [ 619.490789][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 619.500605][T14640] md: could not open device unknown-block(1,2). [ 619.516934][T14640] md: md_import_device returned -16 [ 619.528305][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 619.535770][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 619.580159][ T59] bridge_slave_1: left allmulticast mode [ 619.585875][ T59] bridge_slave_1: left promiscuous mode [ 619.607280][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 619.622810][ T59] bridge_slave_0: left allmulticast mode [ 619.643542][ T59] bridge_slave_0: left promiscuous mode [ 619.654016][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 619.765435][ T59] veth1_macvtap: left promiscuous mode [ 619.774381][ T59] veth0_macvtap: left promiscuous mode [ 619.780547][ T59] veth1_vlan: left promiscuous mode [ 619.786086][ T59] veth0_vlan: left promiscuous mode [ 620.331614][ T5792] Bluetooth: hci0: command tx timeout [ 620.391218][T14658] overlayfs: failed to resolve 'lower': -2 [ 620.453847][T14660] md: couldn't update array info. -22 [ 620.467237][T14660] md: could not open device unknown-block(1,1). [ 620.477452][T14660] md: md_import_device returned -16 [ 620.483502][T14660] md: could not open device unknown-block(1,2). [ 620.527089][T14660] md: md_import_device returned -16 [ 620.885880][ T28] audit: type=1800 audit(1788252701.996:60): pid=14674 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3008" name="memory_backed" dev="configfs" ino=34458 res=0 errno=0 [ 621.212215][ T59] team0 (unregistering): Port device team_slave_1 removed [ 621.329581][ T59] team0 (unregistering): Port device team_slave_0 removed [ 621.404908][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 621.499684][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 621.858567][ T28] audit: type=1800 audit(1788252702.956:61): pid=14698 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3017" name="memory_backed" dev="configfs" ino=34992 res=0 errno=0 [ 621.997088][T14700] netlink: 24 bytes leftover after parsing attributes in process `syz.6.3018'. [ 622.064742][ T59] bond0 (unregistering): Released all slaves [ 622.431550][ T5792] Bluetooth: hci0: command tx timeout [ 622.885365][T14725] md: couldn't update array info. -22 [ 622.919250][T14725] md: could not open device unknown-block(1,1). [ 622.947233][T14725] md: md_import_device returned -16 [ 622.957751][T14725] md: could not open device unknown-block(1,2). [ 622.979206][T14725] md: md_import_device returned -16 [ 623.303701][ T6194] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 623.335371][T14531] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 623.361847][T14531] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 623.386619][T14531] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 623.428122][T14531] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 623.511440][ T6194] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32 [ 623.533948][ T6194] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 623.577399][ T6194] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 623.614397][ T6194] usb 6-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice= 1.00 [ 623.654890][ T6194] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 623.674355][T14531] 8021q: adding VLAN 0 to HW filter on device bond0 [ 623.695168][T14728] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 623.716235][T14743] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 623.739104][ T6194] cyberjack 6-1:1.0: Reiner SCT Cyberjack USB card reader converter detected [ 623.759014][T14531] 8021q: adding VLAN 0 to HW filter on device team0 [ 623.783179][ T2975] bridge0: port 1(bridge_slave_0) entered blocking state [ 623.790391][ T2975] bridge0: port 1(bridge_slave_0) entered forwarding state [ 623.805898][ T6194] usb 6-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 623.861518][ T2975] bridge0: port 2(bridge_slave_1) entered blocking state [ 623.868808][ T2975] bridge0: port 2(bridge_slave_1) entered forwarding state [ 623.951508][ T5766] usb 6-1: USB disconnect, device number 4 [ 624.022649][ T5766] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 624.049330][T14531] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 624.073404][ T5766] cyberjack 6-1:1.0: device disconnected [ 624.606872][T14531] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 624.843461][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.851642][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.113787][T14785] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 625.378114][T14531] veth0_vlan: entered promiscuous mode [ 625.483307][T14531] veth1_vlan: entered promiscuous mode [ 625.600028][T14531] veth0_macvtap: entered promiscuous mode [ 625.658323][T14531] veth1_macvtap: entered promiscuous mode [ 625.760531][T14531] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 625.788290][T14531] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 625.806767][T14531] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 625.836518][T14531] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 625.854411][T14809] md: couldn't update array info. -22 [ 625.864601][T14809] md: could not open device unknown-block(1,1). [ 625.870983][T14809] md: md_import_device returned -16 [ 625.884166][T14531] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 625.914199][T14531] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 625.926348][T14812] md: could not open device unknown-block(1,2). [ 625.932736][T14812] md: md_import_device returned -16 [ 625.957778][T14531] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 626.032147][T14531] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 626.064078][T14531] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 626.078365][ T28] audit: type=1800 audit(1788252707.141:62): pid=14814 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3049" name="memory_backed" dev="configfs" ino=35175 res=0 errno=0 [ 626.111983][T14531] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 626.138042][T14817] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 626.155778][T14531] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 626.165697][T14531] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 626.210049][T14531] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 626.223902][T14531] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 626.271205][T14531] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.317060][T14531] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.325871][T14531] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.376537][T14531] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.392232][ T28] audit: type=1800 audit(1788252707.449:63): pid=14822 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3052" name="power" dev="configfs" ino=35946 res=0 errno=0 [ 626.716694][ T2993] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 626.753385][ T2993] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 626.844897][ T2993] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 626.878625][ T2993] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 627.069650][ T28] audit: type=1800 audit(1788252708.124:64): pid=14848 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3059" name="memory_backed" dev="configfs" ino=36008 res=0 errno=0 [ 627.308450][T14854] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 627.405858][ T28] audit: type=1800 audit(1788252708.452:65): pid=14858 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3061" name="power" dev="configfs" ino=36024 res=0 errno=0 [ 627.905367][T14877] md: couldn't update array info. -22 [ 627.938863][T14877] md: could not open device unknown-block(1,1). [ 627.945233][T14877] md: md_import_device returned -16 [ 627.984925][T14877] md: could not open device unknown-block(1,2). [ 627.991753][T14877] md: md_import_device returned -16 [ 628.128761][T14881] md: couldn't update array info. -22 [ 628.160276][T14881] md: could not open device unknown-block(1,1). [ 628.199725][T14881] md: md_import_device returned -16 [ 628.213060][T14881] md: could not open device unknown-block(1,2). [ 628.238968][T14881] md: md_import_device returned -16 [ 628.245515][T14886] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 628.285351][T14886] 9pnet_virtio: no channels available for device 127.0.0.1 [ 628.298550][ T28] audit: type=1800 audit(1788252709.346:66): pid=14891 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3073" name="power" dev="configfs" ino=35476 res=0 errno=0 [ 628.820181][T14906] md: couldn't update array info. -22 [ 628.829282][T14906] md: could not open device unknown-block(1,1). [ 628.852785][T14906] md: md_import_device returned -16 [ 628.864843][T14906] md: could not open device unknown-block(1,2). [ 628.881174][T14906] md: md_import_device returned -16 [ 629.020704][T14915] md: couldn't update array info. -22 [ 629.053727][T14915] md: could not open device unknown-block(1,1). [ 629.079190][T14915] md: md_import_device returned -16 [ 629.110761][T14915] md: could not open device unknown-block(1,2). [ 629.125453][T14915] md: md_import_device returned -16 [ 629.175287][T14921] md: couldn't update array info. -22 [ 629.193686][T14921] md: could not open device unknown-block(1,1). [ 629.202120][T14921] md: md_import_device returned -16 [ 629.213605][T14922] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 629.232712][T14921] md: could not open device unknown-block(1,2). [ 629.249769][T14922] 9pnet_virtio: no channels available for device 127.0.0.1 [ 629.279693][T14921] md: md_import_device returned -16 [ 629.394323][ T28] audit: type=1800 audit(1788252710.430:67): pid=14926 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3085" name="power" dev="configfs" ino=36138 res=0 errno=0 [ 630.164384][T14960] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 630.208757][T14960] 9pnet_virtio: no channels available for device 127.0.0.1 [ 630.321904][T14964] md: couldn't update array info. -22 [ 630.343242][T14964] md: could not open device unknown-block(1,1). [ 630.352567][ T28] audit: type=1800 audit(1788252711.384:68): pid=14966 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3097" name="power" dev="configfs" ino=36173 res=0 errno=0 [ 630.378518][T14964] md: md_import_device returned -16 [ 630.392074][T14964] md: could not open device unknown-block(1,2). [ 630.407290][T14964] md: md_import_device returned -16 [ 631.013801][T14989] overlayfs: failed to resolve 'work': -2 [ 631.282266][T14999] md: couldn't update array info. -22 [ 631.289153][T14999] md: could not open device unknown-block(1,1). [ 631.295541][T14999] md: md_import_device returned -16 [ 631.302062][T14999] md: could not open device unknown-block(1,2). [ 631.309289][T14999] md: md_import_device returned -16 [ 631.311276][ T8] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 631.491709][ T8] usb 3-1: device descriptor read/64, error -71 [ 631.760298][ T8] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 631.930690][ T8] usb 3-1: device descriptor read/64, error -71 [ 632.052256][ T8] usb usb3-port1: attempt power cycle [ 632.253288][T15021] overlayfs: failed to resolve 'work': -2 [ 632.463260][ T8] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 632.485218][T15029] md: couldn't update array info. -22 [ 632.493258][T15029] md: could not open device unknown-block(1,1). [ 632.507512][T15029] md: md_import_device returned -16 [ 632.513506][T15029] md: could not open device unknown-block(1,2). [ 632.520011][T15029] md: md_import_device returned -16 [ 632.525028][ T8] usb 3-1: device descriptor read/8, error -71 [ 632.794901][ T8] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 632.865948][ T8] usb 3-1: device descriptor read/8, error -71 [ 632.986798][ T8] usb usb3-port1: unable to enumerate USB device [ 633.227075][T15049] md: couldn't update array info. -22 [ 633.237525][T15049] md: could not open device unknown-block(1,1). [ 633.243890][T15049] md: md_import_device returned -16 [ 633.267995][T15049] md: could not open device unknown-block(1,2). [ 633.274373][T15049] md: md_import_device returned -16 [ 633.664220][T15060] md: couldn't update array info. -22 [ 633.671866][T15060] md: could not open device unknown-block(1,1). [ 633.689505][T15060] md: md_import_device returned -16 [ 633.699755][T15060] md: could not open device unknown-block(1,2). [ 633.706105][T15060] md: md_import_device returned -16 [ 633.842638][T15066] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 633.997125][T15072] fuse: Bad value for 'fd' [ 634.334482][T15083] md: couldn't update array info. -22 [ 634.341173][T15083] md: could not open device unknown-block(1,2). [ 634.347827][T15083] md: md_import_device returned -16 [ 634.626418][T15091] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 634.862458][T15098] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 634.991801][T15105] md: couldn't update array info. -22 [ 634.998008][T15105] md: could not open device unknown-block(1,1). [ 635.004418][T15105] md: md_import_device returned -16 [ 635.014403][T15105] md: could not open device unknown-block(1,2). [ 635.022077][T15105] md: md_import_device returned -16 [ 635.135614][ T6184] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 635.295761][ T6184] usb 6-1: device descriptor read/64, error -71 [ 635.563984][T15120] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 635.580961][ T6184] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 635.747926][ T6184] usb 6-1: device descriptor read/64, error -71 [ 635.797330][T15127] md: couldn't update array info. -22 [ 635.803864][T15127] md: could not open device unknown-block(1,1). [ 635.820877][T15127] md: md_import_device returned -16 [ 635.888751][ T6184] usb usb6-port1: attempt power cycle [ 636.244363][T15145] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 636.309661][ T6184] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 636.351611][ T6184] usb 6-1: device descriptor read/8, error -71 [ 636.376818][ T28] audit: type=1800 audit(1788252717.377:69): pid=15149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3172" name="power" dev="configfs" ino=37005 res=0 errno=0 [ 636.633604][ T6184] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 636.680370][T15158] gadgetfs: bound to dummy_udc driver [ 636.687782][T15158] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 636.699537][T15158] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 636.707983][T15158] CPU: 0 PID: 15158 Comm: syz.2.3176 Not tainted syzkaller #0 [ 636.715469][T15158] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 636.725545][T15158] RIP: 0010:dummy_udc_start+0xcd/0x1e0 [ 636.731061][T15158] Code: 41 83 ff 03 74 18 41 83 ff 05 0f 85 8e 00 00 00 e8 48 35 cb fa eb 0c e8 41 35 cb fa eb 05 e8 3a 35 cb fa 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 a4 b2 23 fb 4d 8b 36 4c 89 f7 e8 [ 636.750714][T15158] RSP: 0018:ffffc9000b4878b0 EFLAGS: 00010246 [ 636.750999][ T6184] usb 6-1: device descriptor read/8, error -71 [ 636.756811][T15158] RAX: 0000000000000000 RBX: ffffffff8de5b040 RCX: 0000000000080000 [ 636.756828][T15158] RDX: ffffc900121e0000 RSI: 0000000000028ac0 RDI: 0000000000028ac1 [ 636.756843][T15158] RBP: ffff888143fc0000 R08: ffff888030f2da00 R09: 0000000000000004 [ 636.787005][T15158] R10: 0000000000000005 R11: 0000000000000002 R12: dffffc0000000000 [ 636.795017][T15158] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003 [ 636.803031][T15158] FS: 00007f3adf3cd6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 636.812008][T15158] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 636.818641][T15158] CR2: 0000001b32520ff8 CR3: 000000005cd26000 CR4: 00000000003506f0 [ 636.826657][T15158] Call Trace: [ 636.829969][T15158] [ 636.832948][T15158] ? dummy_pullup+0x120/0x120 [ 636.837679][T15158] gadget_bind_driver+0x390/0x770 [ 636.842758][T15158] ? gadget_match_driver+0x130/0x130 [ 636.848101][T15158] really_probe+0x247/0xae0 [ 636.852653][T15158] ? pm_runtime_barrier+0x14b/0x1c0 [ 636.857915][T15158] __driver_probe_device+0x1f5/0x390 [ 636.863261][T15158] driver_probe_device+0x4f/0x420 [ 636.868348][T15158] __driver_attach+0x444/0x6d0 [ 636.873183][T15158] bus_for_each_dev+0x235/0x2b0 [ 636.878087][T15158] ? driver_attach+0x50/0x50 [ 636.882721][T15158] ? bus_remove_file+0x140/0x140 [ 636.887693][T15158] ? do_raw_spin_unlock+0x121/0x230 [ 636.892827][ T6184] usb usb6-port1: unable to enumerate USB device [ 636.892926][T15158] bus_add_driver+0x340/0x630 [ 636.903995][T15158] driver_register+0x23a/0x310 [ 636.908800][T15158] usb_gadget_register_driver_owner+0xf9/0x270 [ 636.915003][T15158] dev_config+0xe49/0x1260 [ 636.919468][T15158] ? rcu_read_lock_any_held+0xb4/0x140 [ 636.924977][T15158] ? rcu_read_lock_bh_held+0x100/0x100 [ 636.930487][T15158] ? ep0_read+0x1890/0x1890 [ 636.935034][T15158] ? ep0_read+0x1890/0x1890 [ 636.939578][T15158] vfs_write+0x299/0x9a0 [ 636.943872][T15158] ? file_end_write+0x250/0x250 [ 636.948785][T15158] ? __fget_files+0x28/0x460 [ 636.953432][T15158] ? __fget_files+0x3fc/0x460 [ 636.958134][T15158] ? __fdget_pos+0x2a3/0x330 [ 636.962747][T15158] ? ksys_write+0x74/0x260 [ 636.967178][T15158] ksys_write+0x151/0x260 [ 636.971838][T15158] ? __ia32_sys_read+0x90/0x90 [ 636.976647][T15158] ? lockdep_hardirqs_on+0x98/0x150 [ 636.981867][T15158] do_syscall_64+0x55/0xb0 [ 636.986298][T15158] ? clear_bhb_loop+0x40/0x90 [ 636.990992][T15158] ? clear_bhb_loop+0x40/0x90 [ 636.995700][T15158] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 637.001639][T15158] RIP: 0033:0x7f3ade59e0d9 [ 637.006082][T15158] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 637.025701][T15158] RSP: 002b:00007f3adf3cd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 637.034163][T15158] RAX: ffffffffffffffda RBX: 00007f3ade825fa0 RCX: 00007f3ade59e0d9 [ 637.042144][T15158] RDX: 0000000000000048 RSI: 0000200000000200 RDI: 0000000000000003 [ 637.050124][T15158] RBP: 00007f3ade635024 R08: 0000000000000000 R09: 0000000000000000 [ 637.058114][T15158] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 637.066192][T15158] R13: 00007f3ade826038 R14: 00007f3ade825fa0 R15: 00007ffe48b81218 [ 637.074200][T15158] [ 637.077224][T15158] Modules linked in: [ 637.085030][T15158] ---[ end trace 0000000000000000 ]--- [ 637.090533][T15158] RIP: 0010:dummy_udc_start+0xcd/0x1e0 [ 637.096100][T15158] Code: 41 83 ff 03 74 18 41 83 ff 05 0f 85 8e 00 00 00 e8 48 35 cb fa eb 0c e8 41 35 cb fa eb 05 e8 3a 35 cb fa 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 a4 b2 23 fb 4d 8b 36 4c 89 f7 e8 [ 637.116570][T15158] RSP: 0018:ffffc9000b4878b0 EFLAGS: 00010246 [ 637.122793][T15158] RAX: 0000000000000000 RBX: ffffffff8de5b040 RCX: 0000000000080000 [ 637.130860][T15158] RDX: ffffc900121e0000 RSI: 0000000000028ac0 RDI: 0000000000028ac1 [ 637.139357][T15158] RBP: ffff888143fc0000 R08: ffff888030f2da00 R09: 0000000000000004 [ 637.154574][T15158] R10: 0000000000000005 R11: 0000000000000002 R12: dffffc0000000000 [ 637.162648][T15158] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003 [ 637.171869][T15158] FS: 00007f3adf3cd6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 637.182148][T15158] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 637.189056][T15158] CR2: 00007f51559ef2f8 CR3: 000000005cd26000 CR4: 00000000003506f0 [ 637.197737][T15158] Kernel panic - not syncing: Fatal exception [ 637.204406][T15158] Kernel Offset: disabled [ 637.208750][T15158] Rebooting in 86400 seconds..