last executing test programs: 1m9.92361567s ago: executing program 32 (id=149): io_setup(0x3ff, &(0x7f0000000500)) sendmsg$DCCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x20000080}, 0x26041814) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0x22, 0x3, 0x50000}]}) io_setup(0x7, &(0x7f0000000000)=0x0) syz_clone3(&(0x7f0000000080)={0x21800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_destroy(r0) 1m5.965880068s ago: executing program 33 (id=219): r0 = syz_io_uring_setup(0x31c5, &(0x7f0000000140)={0x0, 0xd73c, 0x2, 0xfffffffe}, &(0x7f00000001c0), &(0x7f0000000100), &(0x7f0000000000)) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x0, &(0x7f0000000300)={[{@init_itable}]}, 0x1, 0x79f, &(0x7f0000000340)="$eJzs3c1rHOUfAPDvbJKmSfv7JYKg9RQQNFC6MTVtFTxUPIhgoaBn27DZhppNtmQ3pQkBW0TwIqh4EPTSsy/15tWXq/4XHqSlalqseJDI7Eu7aXabbM3uhubzgck+z8xsnue7z8wzz+wMOwHsWWPpn0zEoYj4MIkYqc1PImKgkuqPOFld787aai6dklhff+P3pLLO7bXVXDS8J3WglnkyIn54L+JwZnO5peWVuelCIb9Yy0+U5y9MlJZXjpyfn57Nz+YXjk9OTR09cezE8Z2L9c+fVw7e+OjVZ78++fe7T1z74MckTsbB2rLGOHbKWIzVPpOB9CPc4JWdLqzHko3Zfb2qB+1Jd82+6l4eh2Ik+iqpFoa6WTMAoFPWAYC9651eVwAA6Jb69wC311Zz9am330h0182XI2J/Nf769c3qkv7aNbv9leugw7eTDVdGkogY3YHyxyLi82/f+jKdotYOyQ78X4CtXL4SEWdHxzb3/8mmexba9dyDFq4PVl7G7pu9144/0EvfpeOfF5qN/zJ3xz/RZPwz2GTffRhb7/+Z67VE3w4Ut0k6/nup4d62Ow3x14z21XL/q4z5BpJz5wv5tG/7f0SMx8Bgmp+srNp85DZ+659brcpvHP/98fHbX6Tlp6/31shc7x/c+J6Z6fL0f4277uaViKf6m8Wf3G3/pMX49/Q2y3jtxfc/a7UsjT+Ntz5tjr+z1q9GPNO0/e+1ZdLy/sT+YyeOT1Q2h4n6RtHEN798Otyq/Mb2T6e0/Pq5QDek7T/84PhHk8b7NUvtl/HT1ZHvWy3bOv7m2/++5M1Kun6j4aXpcnlxMmJf8vrm+Ufvvbeer6+fxj/+dPP9v1ps8+0/PSc8u834+2/89tXDx99ZafwzbbV/+4lrd+Za9t3ba/+pSmq8Nmc7/d8W9bocD701AwAAAAAAAAAAAAAAAAAAAAAAAED7MhFxMJJM9m46k8lmq8/wfjyGM4ViqXz4XHFpYSYqz8oejYFM/acuRxp+D3Wy9nv49fzR+/LPR8RjEfHJ4FAln80VCzO9Dh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAag60eP5/6tfBXtcOAOiY/b2uAADQdY7/ALD3tHf8H+pYPQCA7nH+DwB7z7aP/2c7Ww8AoHvaPf/v61A9AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeGSdPnUqndb/WlvNpfmZi8tLc8WLR2bypbns/FIumysuXsjOFouzhXw2V5xv+Y8uV18KxeKFqVhYujRRzpfKE6XllTPzxaWF8pnz89Oz+TP5ga5FBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADbV1pemZsuFPKLEg9MDO2OauyaRH/simo8Com+2BXVuD/R2EsM9a6DAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANjl/g0AAP//3BEuHw==") renameat2(0xffffffffffffff9c, &(0x7f0000000b00)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000b40)='./proc\x00', 0x4) unshare(0x6020400) ioctl$BTRFS_IOC_SUBVOL_SYNC_WAIT(0xffffffffffffffff, 0x40109441, &(0x7f0000000040)={0x50e, 0x4, 0x3}) syz_io_uring_setup(0x3c5f, &(0x7f0000000240)={0x0, 0x24, 0x27, 0x5, 0xffffffff, 0x0, r0}, &(0x7f00000002c0), &(0x7f00000000c0), &(0x7f0000000000)) 1m5.629779192s ago: executing program 34 (id=8): r0 = io_uring_setup(0x3e35, &(0x7f0000000000)={0x0, 0x350f, 0x10, 0x4, 0x3d8}) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xf, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000025c0)={r2, &(0x7f0000002600), &(0x7f0000002640)=@udp=r1}, 0x20) recvmsg(r1, &(0x7f0000002780)={0x0, 0x0, &(0x7f00000027c0)=[{&(0x7f0000002800)=""/128, 0x80}], 0x1}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1m3.540296142s ago: executing program 35 (id=263): bpf$BPF_LINK_CREATE(0x8, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff, 0xc, 0x0, @val=@tracing={0x0, 0x10000003ff}}, 0x20) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)={0x1c, 0x52, 0x1, 0x70bd2a, 0x0, {0x2}, [@nested={0x8, 0x1, 0x0, 0x1, [@generic="feffffff"]}]}, 0x1c}}, 0x800) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000000)=0x201, 0x4) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40080}, 0x0) 54.959623795s ago: executing program 36 (id=357): syz_mount_image$erofs(&(0x7f0000000140), &(0x7f0000000340)='./file1\x00', 0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="00ea2eb34e7ea51c9446c55a2d1e0be39af9faf44ad59cb6ad1c94490d970e811439edddc71c9b18946b559ce53bee0a1abe562fc3f3898e5826eda1962cf6e3c4c0ade52151923a70b46eacfc1aaaebcf156e549e884bcabc1333f344f31cd30cd93cb2814e0dbc24a7a107e295e86e09283c825fe177c89c6385f68f2c843cffffffff15539bab6142ceed9265ba989d1a283fc4ffc83f3a7a6c746823e656ad78f3b5a336cdbd83dad59e0debb36b4ea5e658e253f01637cc03f704a08019f95b92fffffffff8dd21552d6967ab1b01e5d52a5793eb179deee4572770a5197127b090287bca2a4eaa1705b42c16968d0201d3ba3cc8000000657ea095f152b1b6a1e6ad8d24ad17f649ccc23d4ecbcdb5620cc48f95f563c2230f859d196e6c4f00b8e3a7b01fcb1d79dcc09b7a854ec8c31dd27ff9b4a2864e1dcaf719d20b56769d51228ecc1915fb8c8b598c11b3c296b05f9c5355fc6f19a7b28f5ae9a0d0804ccc5716cfac0246ddffa2f12077a02a959aa1b74373c38b2bcc90743b80666eae25dea73e127263b8fdbc64fe862b994ca8473d0000000000000000"], 0x1, 0x1b0, &(0x7f0000000b40)="$eJzslDGPEkEUx/8zC7tuYoRWKxNJxMJld1EjhQW1hSYajZ1EVoIuYmALoPNTWPsxiA3fQwu96hquu+qKuczsLAzk7uAuB1vc+xVv/rP7dubN28kfBEHcWA7+H//jqLhS30YFjn5+aC1zuJE/LZ08+tN99funf/R3OnvZWF+PARBi+/0LAGZNC4meC7H6dUWPb8EzXTTfvweDp/VHcLzTOgLDB62/GLov8z3vczeOvE/9uC2FL0MgQyhDfb2++Q+GdipVicx4PxxPvrbiOBrsUGzq37zJ8cLon/m/st744FbWywAcgdZ1MLzR+jmcrDdpS4zz3yss17eudn55k3bfrC3EHV37fja9W9qQU0Su3di/kFdp7CLvMi4UtzIfufTnDOqqK/I+RZ5i6U/iF8NDw58Khn/Ukt732nA8edzttTpRJ/oWhvVn/hPffxrWlBGlccXz7BX/c5U/wVi/eI5X2szGqJUkgyCNi3k4cpAMwrMc11b+x1F9kFbN1vbPnqHM7suhauk5QRAEQRAEQRAEQRAEQRDEtVLWo1C4CyUamRDCSYfwtco8DQAA//8J4Fqh") r0 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./file2\x00', 0x80000, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r0, 0x1000) read(r0, &(0x7f0000000d40)=""/189, 0xbd) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) syz_mount_image$ext4(&(0x7f0000000f40)='ext4\x00', &(0x7f0000000f80)='./file2\x00', 0x1881e, &(0x7f0000000080)={[{@i_version}, {@nogrpid}, {@quota}], [{@mask={'mask', 0x3d, '^MAY_WRITE'}}, {@subj_type={'subj_type', 0x3d, '(/--:+%#![]:'}}, {@smackfsroot}]}, 0xfd, 0x502, &(0x7f0000001000)="$eJzs3c9vY0cdAPCvnThxsmmTlh4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEitxgiN/AOc9ceeC4MZlOSDxIwJtkDi4es8vWW/W3lj5YUfx5yM9vZk3tr8zm30z62/WngBG1s2I2I+IiYj4OCJms+u57IgP2kfyuCcHD1YODx6s5KLV+uhfubQ9uRYdz0ncyF6zGBE/+l7ET3PPx23s7m0sV6uV7aw+36xtzTd29+6s15bXKmuVzXJ5aXFp4b2775YvbKxv1Cay0lcf/3H/Wz9PujWTXekcx0VqD71wHCcxHhE/uIxgQzCWjWdi2B3hTPIR8WpEvJne/7Mxlv40AYDrrNWajdZsZx0AuO7yaQ4sly9luYCZyOdLpXYO77WYzlfrjebt+/WdzdV2rmwuCvn769XKQpYrnItCLqkvpuWn9fKJ+t2IeCUifjk5ldZLK/Xq6jD/4QMAI+zGifX/v5Pt9R8AuOaKw+4AADBw1n8AGD3WfwAYPdZ/ABg97fV/atjdAAAGyPt/ABg91n8AGCk//PDD5GgdZt9/vfrJ7s5G/ZM7q5XGRqm2s1JaqW9vldbq9bX0O3tqp71etV7fWnwndj6d+/ZWoznf2N27V6vvbDbvpd/rfa9SSB+1P4CRAQC9vPLGo7/kkhX5/an0iI69HApD7Rlw2fLD7gAwNGNneI4dguB6cC/D6DrHe3zpAbgmumzR+4xitw8ItVqt1uV1Cbhkt74k/w+jqiP/738Bw4g5S/4fuB7k/2F0tVq5fvf8j34fCABcbXL8QI/f/7+anX+X/XLgJ6snH/HwMnsFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAV9vR/r+lbC/wmcjnS6WIlyJiLgq5++vVykJEvBwRf54sTCb1xSH3GQA4r/zfc9n+X7dm3555pun1G8fFiYj42a8/+tWny83m9p8iJnL/njy63nyYXS8PvvcAwOmO1un03PFG/snBg5WjY5D9+cd3I6LYjn94MBGHx/HHYzw9F6MQEdP/yWX1tlxH7uI89j+LiC92G38uZtIcSHvn05Pxk9gvDTR+/pn4+bStfU7+LL5wAX2BUfMomX8+6Hb/5eNmeu5+/xfTGer8svkveamVw3QOfBr/aP4b6zH/3ew3xjt/+H67NPV822cRXx6POIp92DH/HMXP9Yj/dp/x//qV19/s1db6TcSt6B6/M9Z8s7Y139jdu7NeW16rrFU2y+WlxaWF9+6+W55Pc9TzvVeDf75/++Vebcn4p3vEL54y/q/3Of7f/v/jH3/tBfG/+Va3+Pl47QXxkzXxG33GX57+fbFXWxJ/tcf4T/v53+4z/uO/7Z3cNnyyz6cCAJegsbu3sVytVrYVFK5+IfkrewW60bXwnUHFmojuTb94q31Pn2hqtc4Uq9eMcRFZN+AqOL7pI+J/w+4MAAAAAAAAAAAAAADQ1SA+sTTsMQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHB9fR4AAP//9V7PLg==") 52.317607531s ago: executing program 2 (id=396): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0100000004000000080000000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0x1, 0x14, &(0x7f0000001200)=@framed={{}, [@printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xf}}, @generic={0x7a, 0xa, 0x0, 0xfffffff0}, @map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0xbf, 0x3, 0xa}, @generic={0x7, 0x3, 0x0, 0x0, 0xfffffff0}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0x9, 0x3, 0x2, 0x3, 0x0, 0xffffffffffffffff, 0x10003}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001140)={0x11, 0x14, &(0x7f0000001200)=ANY=[], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000012c0)={r1}, 0xc) 52.259457236s ago: executing program 2 (id=400): mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0xc000, 0x103) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000180)='./bus\x00', 0x3820c50, 0x0, 0xf7, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./bus\x00', &(0x7f0000000200), 0x8, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f0000000300)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x42, 0x0) 52.215276431s ago: executing program 2 (id=401): r0 = epoll_create1(0x0) r1 = dup(r0) mount$9p_fd(0x0, &(0x7f00000002c0)='.\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000500)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r1}}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000680)={0x2001}) 52.12265254s ago: executing program 2 (id=404): syz_mount_image$vfat(&(0x7f0000000480), &(0x7f00000004c0)='./file0\x00', 0x4000, &(0x7f0000000500)=ANY=[@ANYBLOB="73686f72746e616d653d77696e6e742c757466383d302c636865636b3d7374726963742c646973636172642c757466383d312c6e66732c73686f72746e616d653d77696e39352c73686f72746e616d653d6c6f7765722c756e695f786c6174653d302c0036b573262ed88dfec7618c03371693a5173bd0bf12d29c0180500a87e3789adea802a90933b243ca225dacfc27597d6e1ce3d9fdc12409748ba4fbde6f1d76e116fd437b79bbcea7fdc682fd0b90334eed137d03ce386950f5e50ff2516eb2b500a9b99e04f2a41864e44cb46101a23835877342485260d4510fa3240a2c9756d388e5861cdeaf4c88bca74fe3ce71eef72c"], 0xfd, 0x2b6, &(0x7f0000000600)="$eJzs3E9rE08YwPGnaZOmKW1y+PEDBfFBL3pZ2vgKgrQgBpTaiHoQpnajIWtSsjESEdubV19H8ehNsL6BXrx5Fy9FELz0IF3pbtYkZaV/NN22+X6g7HRnnszM7iY8u7Czde/N02rZtcqmKYm0SkJkTbZFcruljpHONuGXU9JrTa5O/vh84c79BzcLxeLcgup8YfFaXlWnL354/vLtpY/Nybvvpt+Py2bu4db3/JfN/zfPbe0shp9eb6rRpXq9aZYcW5crbtVSve3YxrW1UnPtRl992amvrLTV1JanMisN23XV1NpatdvarGuz0Vbz2FRqalmWTmVk2IweOqK0vrBgCgMZDOIwEbWz0SiY0cjK0vpxDAoAAJwsg8j/Rw6Q/z+puFpxtbZf/p8Q8v/B8fP/ncikEWdDcvcGoGAyne9vP/J/AAAAAAAAAAAAAAAAAAAAAABOg23Py3qelw234d+4iKRFJPw/7nFiMI5w/kdiHC7+sZ4X99IizutWqVUKtkF9oSwVccSWmaTIT/966AjK8zeKczPqy8mGs9qJ918SHA/jQ7no+NkgXnviV1ulpGR6+89LVv6Ljs/viU+KSKuUkiuXe+ItycqnR1IXR5b967ob/2pW9fqt4p7+J/x2AAAAAACcBZb+luu//w1Wk7QsDZcN2VMf7Ow+H5DsPs8HVDZS0o0fk/Nj8c0bAAAAAIBh4rZfVI3j2I3TWkh2JnLcvR/10KVE5IQcukMXrHRwrCOq0hLu8TxvdbfR33eaEJGYZvrtz1dU+NDqpJyUwxS+PgvGfpDGcfwaAQAAABikbtIf90gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABheB108LGx/lLXHerob7e998hhnCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMTvVwAAAP//G5URgQ==") mkdir(&(0x7f00000008c0)='./bus\x00', 0x0) symlinkat(&(0x7f0000000e80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000fc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') mount$incfs(&(0x7f0000000900)='.\x00', &(0x7f0000000940)='./bus\x00', &(0x7f0000000980), 0xc002, 0x0) chdir(&(0x7f00000009c0)='./bus\x00') lsetxattr$trusted_overlay_redirect(&(0x7f0000001240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0, 0x0, 0x1) 51.982066934s ago: executing program 2 (id=409): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000013c0), 0x20380) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r0, 0x40045402, &(0x7f0000001400)=0x1) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001440)={{0x1, 0x0, 0x3f8}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000001480)={0x7, 0xffff, 0x0, 0x0, 0xe}) ioctl$int_in(r0, 0x5452, &(0x7f0000001500)=0x3) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) 51.720254711s ago: executing program 2 (id=416): prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000180)={0x1, &(0x7f00000001c0)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) pipe(0x0) io_setup(0x3ff, &(0x7f0000000200)=0x0) io_submit(r1, 0x1, &(0x7f0000000240)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}]) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000680)) 51.618964611s ago: executing program 37 (id=416): prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000180)={0x1, &(0x7f00000001c0)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) pipe(0x0) io_setup(0x3ff, &(0x7f0000000200)=0x0) io_submit(r1, 0x1, &(0x7f0000000240)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}]) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000680)) 45.243899331s ago: executing program 4 (id=504): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./tracing/dynamic_events\x00', 0x40000, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x80) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000140)={0x0, 0x9, 0x5, 0x81, 0xffffffff, 0x2}) preadv2(r0, &(0x7f0000002b40)=[{&(0x7f00000005c0)=""/3, 0x3}], 0x1, 0xffff, 0xf1b, 0x0) 45.167258139s ago: executing program 4 (id=506): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) setpriority(0x2, 0x0, 0x7) 45.124020044s ago: executing program 4 (id=507): pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) fcntl$setpipe(r0, 0x407, 0x0) write$FUSE_INIT(r0, &(0x7f0000000180)={0x50, 0xfffffffffffffff5, 0x0, {0x7, 0x28, 0x2, 0xffffffff82048008, 0x0, 0x40, 0x8, 0x0, 0x0, 0x0, 0x104, 0x4}}, 0x50) vmsplice(r0, &(0x7f0000000480)=[{&(0x7f00000004c0)="eb", 0x20000101}], 0x1, 0x0) fcntl$setpipe(r0, 0x407, 0x2000000) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, 0x0) 44.85830739s ago: executing program 4 (id=515): openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x4, &(0x7f0000000380)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3}, [@call={0x85, 0x0, 0x0, 0x41}]}, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_mount_image$msdos(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x2800080, &(0x7f0000000480)=ANY=[@ANYRES64=0x0, @ANYRESOCT, @ANYRESDEC=0x0, @ANYRES8=0x0], 0x1, 0x2ad, &(0x7f00000005c0)="$eJzs3U9LVF0cB/DjqPjgg+Lq4alNh1q1GdR1CyUUpIGinKCC4IrXGuY2I3NnMSMtbN0maNk7iJbtgugN+C7aSSCuXGXY9d8IQaSOkJ/PZn6c7/k7F85d3s1bb17UV/LyStIOpZmBUJoJobQzECZCKRxYDzffvnr3+sGjx3dmK5W5+zHOzy5OTccYx699fvLyw/Uv7X8ffhz/NBI2Jp5ubk1/3fhv48rm98XntTzW8thotmMSl5rNdrKUpXG5ltfLMd7L0iRPY62Rp62efCVrrq52Y9JYHhtdbaV5HpNGN9bTbmw3Y7vVjcmzpNaI5XI5jo0GTqP6fmd3N2ztFi56N/Sf53+5HbvU/wlhe71T7VSL3yKfX6jMTcafho9GbXc61cHDfKrIY28+HEb38+mT+cGr5UaR72W371ZOjB8Jy+d8dgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC6vcjw0cdS63elUB4u8/Ku8qOYXKnOT+x1686FwdahvxwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAU8m7a/Uky9JWf4qhPq51NsXwb/TZ+yPPZ/WRYy2DfzLPwDltTPG3Fxd9MwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAED/9X7EHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgMsq767VkyxLW2dVfPu/mPhYdNFnBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDT+hEAAP//yRtmJg==") syz_clone(0xa0302000, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r0, 0x0, 0x2100, 0x0, &(0x7f0000000480), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) 44.66589054s ago: executing program 4 (id=520): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000700), r1) getsockname$packet(r1, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000780)=0x14) sendmsg$nl_route(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=@newlink={0x38, 0x10, 0x439, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, 0x9901, 0x49a41}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @remote}]}}}]}, 0x38}}, 0x0) sendto$packet(r0, &(0x7f0000000880)="05d936277c6f5422007f83477c", 0xd, 0x40880, &(0x7f00000008c0)={0x11, 0x86dd, r2, 0x1, 0x4, 0x6, @local}, 0x14) 44.248260122s ago: executing program 4 (id=526): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000002e00)="267600410f01b00000000066b88e000f00d066420f3a14ce5736430f0164b107b805000000b9060000000f01c1f30f01330f015b7548b80c000000000000000f23d80f21f835800000000f23f8f30fc733", 0x51}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 44.110472325s ago: executing program 38 (id=526): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000002e00)="267600410f01b00000000066b88e000f00d066420f3a14ce5736430f0164b107b805000000b9060000000f01c1f30f01330f015b7548b80c000000000000000f23d80f21f835800000000f23f8f30fc733", 0x51}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 42.411643796s ago: executing program 5 (id=548): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000240)={0xaa, 0x220}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000280)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f00000002c0)={{&(0x7f000040a000/0x800000)=nil, 0x800000}, 0x1}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 42.37618739s ago: executing program 5 (id=549): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x3, 0x5, &(0x7f0000000800)=ANY=[@ANYBLOB="180200000300000000000000000000008500000087000000850000009e00000095"], &(0x7f0000000840)='GPL\x00', 0x4, 0xc0, &(0x7f0000000880)=""/192}, 0x80) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000009c0)=@bpf_lsm={0x6, 0x3, &(0x7f0000000a80)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000ac0)='syzkaller\x00'}, 0x94) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000b00)={r1}, 0x8) close(r2) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000b40)={r1, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000bc0)={r2, r0, 0x4, r1}, 0x10) 42.338529164s ago: executing program 5 (id=550): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x7002}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000001c0)={'pim6reg1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) pread64(r0, &(0x7f0000000200)=""/87, 0x57, 0xfffd) 42.220851286s ago: executing program 5 (id=553): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000200)='./file0/../file0\x00') mount$bind(&(0x7f00000003c0)='.\x00', &(0x7f0000000440)='./file0\x00', 0x0, 0x2a05004, 0x0) syz_clone(0x0, 0x0, 0xfffffffffffffead, 0x0, 0x0, 0x0) pivot_root(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='./file0/../file0\x00') 42.149855192s ago: executing program 5 (id=555): openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./tracing\x00', 0x1ed) mount(0x0, &(0x7f0000000300)='./tracing\x00', &(0x7f0000000340)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./tracing/uprobe_events\x00', 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xb, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="8500000011000000630a04ff000000004400000000740000950000000000000018100000", @ANYRES32, @ANYBLOB="00000000000400000500c094060000000000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000540)=""/149, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x2d) write(r0, &(0x7f0000000600)='r:my_probe ./file0:0x0\n', 0xffffff01) 42.036556334s ago: executing program 5 (id=558): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000700)={{r1, 0xffffffffffffffff}, &(0x7f0000000500), &(0x7f0000000380)=r1}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r2, &(0x7f0000000140), &(0x7f0000000000)=""/3, 0x2}, 0x20) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000680)={'veth0_to_bond\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r3, {0x4}, {}, {0xfff3}}}, 0x24}}, 0x800) 41.993503268s ago: executing program 39 (id=558): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000700)={{r1, 0xffffffffffffffff}, &(0x7f0000000500), &(0x7f0000000380)=r1}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r2, &(0x7f0000000140), &(0x7f0000000000)=""/3, 0x2}, 0x20) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000680)={'veth0_to_bond\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r3, {0x4}, {}, {0xfff3}}}, 0x24}}, 0x800) 38.255208664s ago: executing program 7 (id=625): syz_mount_image$erofs(&(0x7f0000000380), &(0x7f00000003c0)='./file0\x00', 0x18000c6, &(0x7f0000000400)=ANY=[@ANYRES16=0x0, @ANYRES16], 0x0, 0x17d, &(0x7f0000000440)="$eJzsmLFP+kAUx7/vyg/yMy6uLg4SxcHSFjUuxLA5mogaNwlUghYx0EGYdPH/cHZwdvOPMM7qYFwY3Uxqej3oQQR10MT4PsPj+7h313evyXcoGIb5szw+vNyvFe+EAWASaaTU/89GXCO0+tfb83Jraj1/OfeUv041robPIwBB8PnnJwDcFAz4Kg+Cwd1p9VuE6OstCCwovQOCqfQeBLaVdkHYVfpA042w3jT3a55rlhteJRRWGOwwOGHIDffXPSNUtP5IW2+1O4clz3Ob3yg+ml+3IJDX+tPfV282ljY/GwK20jkQNpVeRao3m2gk2v2nE/H5xg/fnwULFr9NxP4UXBDmNX9KaP6R9evH2Va7s1irl6pu1T1ynNyKtWRZy05WGlEUx/jff+lPE9r5/0bUJimJk5LvN+0o9nMniu85rpD+J5CZjfLQ+5Mju4nWSe0jqTLGmHKGYRiGYRiGYRiGYRiGYZgvMAOSX0EldIo4GcDZkNVvAQAA///an3MA") mkdir(&(0x7f00000005c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000640)='./bus\x00', &(0x7f0000000680), 0x0, &(0x7f00000006c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000700)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000f40)='./file1\x00', 0x0) 38.175419552s ago: executing program 7 (id=628): r0 = socket(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'syz_tun\x00', 0x0}) setsockopt$MRT6_INIT(r0, 0x29, 0xc8, &(0x7f0000000200), 0x4) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000080)={0x0, 0x0, 0x1, r1}, 0xc) syz_emit_ethernet(0x46, &(0x7f0000000100)=ANY=[@ANYBLOB="33330000123400112233445586dd6000000000103b40fe8000000000000000000000000000bbff0e"], 0x0) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000000140)={{0xa, 0x4e23, 0x4, @mcast2, 0x8}, {0xa, 0x4e20, 0x2, @empty, 0x5}, 0x1, {[0x3, 0x466, 0x2, 0x7, 0x9, 0xfffffff7, 0x8, 0x40]}}, 0x5c) 38.133880206s ago: executing program 7 (id=630): r0 = socket$inet(0x2, 0x3, 0x2) r1 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local, @remote}, 0xc) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000080)={@multicast2, @local, @remote}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000200)=ANY=[@ANYBLOB="e0000002ac1414aa"], 0x1c) syz_emit_ethernet(0x36, &(0x7f0000000640)={@broadcast, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x0, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10002, 0x20}}}}}, 0x0) 38.118664458s ago: executing program 7 (id=632): syz_mount_image$vfat(&(0x7f0000000c00), &(0x7f0000000480)='./file2\x00', 0x8410, &(0x7f0000000800)=ANY=[@ANYBLOB="7379735f696d6d757461626c652c666d61736b3d30313737373737373737373737373737373737373737332c73686f72746e616d653d6c6f7765722c636865636b3d7374726963742c2c756e695f786c6174653d302c726f6469722c726f6469722c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6c6f7765722c6e6f6e756d7461696c3d302c756e695f786c6174653d312c756e695f786c6174653d312c6572726f72733d636f6e74696e75652c74696d655f6f66667365743d3078303030303030303030303030303465302c757466383d302c0077b5b28056fc4549d277ed7fab6b0be29df17f888ccab55cccc917ad315c8ea56f5a89c104f92d058b92f5881e69e06002f5914c03fefbeb09121733eaf5ded73df976fbd4cfcb8b70b0bf44da1b46bc0800000000000000f9e4ebbf71c77fc9a810ce726b8c6d6295a5f2e2b069b95ba8ecce52ded99b82923228c37d5e1ec11cdbcabb8a89cbf2cf2771d69e3cf0e6760094145e542e426bceaab9b2cd261046247bce0565db3ac5888b74efd48bc9f455e60f49496ca8137aba85fe39756814fda1f0624b33a2025792a2d47aff43355f9d23a606e1a477ccfff09befb1d0cf1599d272628028b9786e1fbfb3d637c2561421488c9d0000000094bf13ac582f6b67de0cad9336316e70794271b2259fe5d73a74ad7da615c31505c7c0c168052d38e5b64c4bb7d0599e5dcf0000000000000000000000000000002790cf17418aa278cfc0c9d1c81c63e58b877706a808e9a51cc0d73e298db2939adc0efdab4745ab0e09ef8beaaf04e5374c2e7e4672e47fe5a25502919954242f8d779d84091f20646210edf871d3f20ad66fcf4b816323b8abb307381d4ada887dcc71e35f364baa1b93fd5ee36c02aa4628511442992ced893ab946472440b53fc08cc41403e167b1f2605e04d5f0c16ed49969b59d650d88642b10c7893fe9b664421a40f4822ffcc284dfe9aea76e4a04293c970f2dae776decf07b085e16511b0bd365b0f86c7fcd8df00a87f4dbbf8e623667e3b65e4c487055a2e5cd64402a4de537bf113fc7370099e4faebe6ea9d4f155f8f5f4c5f9b205ce1bbb16e002a19457e05a210d9e9820bc7f318ebfdfcc22f831505", @ANYBLOB="d23c17f6ec01b3b820b1fdfffa233394c6e77c8285b061be4d1d842e4a63ec47a083470f375b81080001cf3df73c16fd31622d37a921bdbff76ef2fed6da828ab4e0f87928c18c0380050249fb6ab8cdc85b032f67dc95a947e63e3667ac2b1c953f5017b3cf2ce986800b84dcc3b33bfe950832606c010ac9f8a252454548986e9b7a88529e53efe01210aad5b2300137f1a62cd7a4a17b307956"], 0xff, 0x2a0, &(0x7f00000001c0)="$eJzs3T9rA2UYAPDnkjSNOqSIiyJ4oINTaV1dGqWC2EmJoA4abAuShEILASsYO/UTOPo9/AguLn4DwVVwa4fKyeXumtSmf2hjCvb3m57ee8/zPrkX0inPffX6sL97kMTJ2e/RaiVR24qtOE9iLWpR+SEaAQD8f5xnWfyVPSSzUVt8NwDAMhT//wtP3QsAsByffPb5R52dne2P07QVr7ZPR90kIoano26x3tmPb2IQe7ER7biIyC4V8Qcf7mxHI82txVvD8aibZw6//LWs3/kzYpK/Ge1Ym5+/mRYu81+sukujs79S/dGOV+bnv/Pv/BiOo9uMt9+c6X892vHb13EQg9iNPHea//1mmr6f/Xj23Rf5Nnl+Uovu6uS+qay+pCMBAAAAAAAAAAAAAAAAAAAAAOAZWE/TpBjfM5nfk1+azM8ZdesXk/X1tDI732dczQdKqkLFfKAsyhE94yx+qubrbKRpmpU3TvMb8VrDiwUAAAAAAAAAAAAAAAAAAAAgd/Ttcb83GOwdLiSopgFUP+t/aJ2tmStvxHG/V7+54Or995qdNpD3euvN0WjEgh7LXcELeT8Lr7w6PdxPowiqg1noXi+/VxQ97vfScql6yP1ectderergfp5dasYjG2uWHWRXz7R12erVrOaCnkbzpblLf2dZdr867/5RnFF5JZmM2Ljf7itlMPcD5kHr+ln8cnPBG78y6o/+0gEAAAAAAAAAAAAAAAAAAOaa/uh3zuLJram1/6wpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFiy6fv/q6AVEVevXAvGZfJt95RBMw6PnvgjAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Az8EwAA//9I2EsX") r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) wait4(r0, 0x0, 0x8, 0x0) ptrace$setregset(0x4205, r0, 0x1, &(0x7f0000000100)={&(0x7f0000000040)="dcef58b7f29c1f7c93d183044aedba283413e674c7719c33a4b17f028f68610a6c55bb2bf8282853f3e16f8394a8676ff55a3507e2ad50248c6130863b0f7433c7fbc9b978a39eae88bffd05d139cedbee444f7c98e1f92b0f64462b4b470bedced2125e0b1f38fbaa348c6d75aa1a4011e9cdae15ecb9309b0101edbf6dd6d111d6132f1821a4e4cbec8438c571a70e7ca7b0451a6cc55c", 0xf8}) ptrace$setregset(0x4205, r0, 0x200, &(0x7f00000001c0)={&(0x7f0000000440)="c94522e546f93f6dedf11f1509685636", 0x60}) 38.070871613s ago: executing program 7 (id=633): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSETMODE(r0, 0x4b45, 0x1000000000004) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000700)='./proc\x00', &(0x7f0000000740)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./proc/sys/net/ipv4/fib_multipath_hash_policy\x00', 0x1c1842, 0x0) read$FUSE(r1, &(0x7f000000ad00)={0x2020}, 0x2020) 38.00109097s ago: executing program 7 (id=638): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0600000004000000040000000001"], 0x50) close(0x3) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x1, 0xd, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002f00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000840)="7a7fa22c2aff88df53ef2a2d280f", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 37.955308114s ago: executing program 40 (id=638): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0600000004000000040000000001"], 0x50) close(0x3) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x1, 0xd, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002f00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000840)="7a7fa22c2aff88df53ef2a2d280f", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 21.273501061s ago: executing program 1 (id=1111): mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$msdos(&(0x7f0000000400), &(0x7f0000000440)='.\x02\x00', 0x4010, &(0x7f0000000480)=ANY=[@ANYRES16=0x0, @ANYRESOCT=0x0, @ANYRESOCT], 0x1, 0x1212, &(0x7f0000007340)="$eJzs201rXFUYB/An00mTJiaNb9V240E3urnYLlx1EzQB6YDSdoRWEG7JRIeMMyF3FjPFRcGdKz+HuHQniF8g38JdEEQ3EcErmZnWJh2MxcwM0t9vcx/u/9ycczIvcIf7HFz/+vOd7SLbzrtRmZuL6u58pMMUKSpxLoYexFtfbv721a07d2+s12obN1PaXL999Z2U0uprP3z8xbev/9hd/ui71e8XYn/tk4Nfrv20f2n/8sGftz9rFqlZpHanm/J0r9Pp5vdajbTVLHaylD5sNfKikZrtorF3LN9udXZ3+ylvb60s7e41iiLl7X7aafRTt5O6e/2Uf5o32ynLsrSyFJxQfZrB9W8Oy7KM30f/x7IsL1xfiuV4LlZiNS7GWjwfL8SL8VK8HJfilXg1Lh8NKie0dgAAAAAAAAAAAAAAAAAAAHhGDfr/oyzn4/ygs/9C6P8HAAAAAAAAAAAAAAAAAACAadP/DwAAAAAAAAAAAAAAAAAAALN3eKybX/8/AAAAAAAAAAAAAAAAAAAAzMKtO3dvrNdqGzdTWoz4+UGv3qsPj8N88/3axttpYO3vq37t9ernHuVXh3k6ni/E0ii/NjZfjDffGOZH2bsf1B7PK1G/EluT3z4AAAA8E7L0yNj7+yxL6Y9yXD6sHvt94MT9fTWuVMfNuDg6lhcnsR+eTtG/v5O3Wo29oj//sLh/xkU1/u3gudGqTh38XkT8l4UtjyYanDl/9ltWTKBYGL1oR2ce1tNdRpw6phqn/J3KP10+5lM5s2K630PMxpPvPQAAAAAAAAAAAP4Pnnz6rzJKzu5xwpNzVqa/TQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+YgeOBQAAAACE+Vun0bEBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALBUAAAA//9V63jq") r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000013c0), 0x8101, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, 0x0) open(0x0, 0x24842, 0x40) 21.09190014s ago: executing program 1 (id=1115): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)="522db49c98d3b63ab78fbcfb8f35d8f92975c2765104d8be09396d3eba", 0x1d) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) read$rfkill(r0, &(0x7f00000001c0), 0x5) 21.050397484s ago: executing program 1 (id=1116): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x0, &(0x7f0000000080), 0x21, 0x4b5, &(0x7f0000000b00)="$eJzs3cFvE9kZAPBvJjEJIZDQcmirtlBKSyuEnRiIECd6aVUhpKqopx4gTUwUxY6j2EEk5RD+h0rl2v4JPVTqoRKn3ntrb73QQyW6i3ZFVlqtvJqxAyHEIbsEW4p/P/E08+YZf+9hzXv2R+IXwMA6FxGbEXEsIu5FxETnetIpcbNdsse9fPFobuvFo7kkWq07HyV5e3YtdvydzInOc45GxK9/EfG75O24jfWNpdlqtbLaqZeatZVSY33j8mJtdqGyUFkul2emZ6auX7lWPrSxnq395fnPF2/95u9/+96zf27+9PdZt8Y7bTvHcZjaQy+8ipMZjohbHyJYHwx1xnOs3x3ha0kj4hsRcT6//ydiKH81AYCjrNWaiNbEzjoAcNSleQ4sSYudXMB4pGmx2M7hnYmxtFpvNC/dr68tz7dzZZNRSO8vVitTnVzhZBSSrD6dn7+ul3fVr0TE6Yj4w8jxvF6cq1fn+/nGBwAG2Ild6/+nI+31HwA44kb73QEAoOes/wAweKz/ADB4rP8AMHis/wAwePZf/0d61g8AoHd8/geAgfKr27ez0trqfP/1/IP1taX6g8vzlcZSsbY2V5yrr64UF+r1hfw7e2rver5qvb4yfTXWHpaalUaz1FjfuFurry037+bf6323UujJqACA/Zw++/TfSURs3jiel9ixl4O1Go62tN8dAPpmqN8dAPrGbl8wuHzGB/bYovcNXX9E6Mnh9wXojYvflv+HQSX/D4NL/h8Gl/w/DK5WK7HnPwAMGDl+wP//AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwFc3npckLXb2Ah+PNC0WI05GxGQUkvuL1cpURJyKiH+NFEay+nS/Ow0AvKf0f0ln/6+LExfGd7ceSz4byY/5n1xzdTq7/vH29Wg+ufPHh7PN5mq5130HAA5ie53Ojzs+yL988Whuu/SyP89/1t5cNIu71SntluEYzo+jUYiIsU+STr0te78ydAjxNx9HxLf2Gn+S50YmOzuf7o6fxT7Z0/jpG/HTvK19zP4tvnkIfYFB8zSbf27udf+lcS4/7n3/j+Yz1Pvbnv+23pr/0lfz31CX+e/cQWNc/ccvu7Y9jvjO8F7xk1fxky7xLxww/n+++/3z3dpaf4q4GHvH3xmr1KytlBrrG5cXa7MLlYXKcrk8Mz0zdf3KtXIpz1GXtjPVb/v/jUun9hv/WJf4o+8Y/48OOP4/f37vtz/YJ/5Pfrj3639mn/jZmvjjA8afHftr1+27s/jzXcb/rtf/0gHjP/vvxvwBHwoA9EBjfWNptlqtrPbhZKQd/Yv+RHfi5CifFN7zefo9MwEf2uubvt89AQAAAAAAAAAAAAAAuunFbyP1e4wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcXV8GAAD//2i91V8=") mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f00000a1000/0x1000)=nil, 0x1000, 0x2, 0x28011, r0, 0x0) ftruncate(r0, 0x1000) 20.431246066s ago: executing program 1 (id=1126): syz_mount_image$ext4(&(0x7f0000000400)='ext4\x00', &(0x7f0000000440)='./mnt\x00', 0x2200054, &(0x7f0000000480)={[{@jqfmt_vfsold}, {@bh}]}, 0x1, 0x236, &(0x7f0000000780)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") creat(&(0x7f00000009c0)='./bus\x00', 0xf2) mount(&(0x7f0000000a40)=@loop={'/dev/loop', 0x0}, &(0x7f0000000a80)='./bus\x00', 0x0, 0x5000, 0x0) r0 = open(&(0x7f0000000ac0)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000cc0)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x14, 0xd, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e7376b7a5ff537ed73ac58818d78c660e677df8dc905b90242b7c528a076d2f6a00400", "036c5bc6780820d1cbf7966d61fdcf335263bd9b0abdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000bc0)='./file1\x00', 0x0) 20.011228188s ago: executing program 1 (id=1133): r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0xb, &(0x7f00000000c0)=0xc555, 0x4) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000080)=0x3, 0x4) syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486dd601b8b97004d88c19e9ace5ffb2e9fc603dd282100000002ff02000000000000000000000000000104004e20004db0"], 0x0) 19.664558493s ago: executing program 1 (id=1142): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000004c0), 0x200, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000500)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000), 0x6) ioctl$sock_bt_hci(r1, 0x800448d7, 0x0) 19.664460593s ago: executing program 41 (id=1142): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000004c0), 0x200, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000500)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000), 0x6) ioctl$sock_bt_hci(r1, 0x800448d7, 0x0) 4.294997568s ago: executing program 6 (id=1356): r0 = socket$inet_tcp(0x2, 0x1, 0x0) fcntl$setstatus(r0, 0x4, 0x42800) setsockopt$inet_tcp_int(r0, 0x6, 0xa, &(0x7f0000000480)=0x4, 0x4) bind$inet(r0, &(0x7f0000000500)={0x2, 0x4e20, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000580)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000005c0)={0x0, 0x14, &(0x7f0000000600)=[{&(0x7f0000000640)=' ', 0x100120}], 0x1}, 0x0) 4.156138072s ago: executing program 6 (id=1361): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x2800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r1, 0x4008ae48, &(0x7f00000006c0)=0xeeef0000) 4.014513816s ago: executing program 6 (id=1369): mount$incfs(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='.\x00', 0x0, 0x1, 0x0) r0 = syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x8000d0, &(0x7f0000000140), 0x1, 0x586, &(0x7f0000000480)="$eJzs3U9sHFcZAPBvdx0ncd2mCY3UlIMDqUj/KLbblZwaDoQDHCjqpUioUjlYycYOXsfGdkVtLu6NE0UCBKiiasQBCSRiiQNwqChIHJAIEgIhLNRKIA78aQHhHigBjGZ31t54Z51Ftndbz+8nbfbNm7G/93bzvd19b9YTQG6dTv4pRAxGxI2IOFbfvPWA0/W775RXp66XV6cKsbHx5N8KteOulVenGoc2fu6OiFiJiHsj4seXIy4eao27sLQ8PVGtVubT7ZHFmbmRhaXlc1dmJiYrk5Wr5fJj42Nj4+fHRv+P3hR23PuJuddP/GbqicmXhv791PmZb/y1EBdq/Y5t/dhLWS3qK0Rc2I9gPVBK+hMRAx0ef7Ly/Mv73CQ69KUTayPJc3dPRNxfy/9jUao9mxEffPHpfxyLD9xs97M31l78UzfbCgDsnY3E4Z13AwdTMZLP/oXicETUy8Xi8HD9M/w9MVCszi4sPnx59pmrl+pzBHfHoeLlK9XKaDpXcHccKiTbj9TKW9uPbtsuR8TxiPhc6Whte/jibPVSV0c6oGEw4rXvfvpi/x3b8v+PpXr+AwdXkv+/+sn3f5iU3yz1ujVANyX5/603Zx4P+Q+5c/v8P9L1NgHd4fUf8kv+Q3615v/O584CB4fXf8gv+Q/5Jf8hv+Q/5Jf8h/xqzn/pD/l0fOiVtUJErLz/aO2W6E/3ZfzZHuAA2bjTt/whr7z3h/zq2yoe7WU7gO7zGR+43dn/bb8NPLf3bQG6o9jrBgA9c/aU9T/IK/P/kF99vW4A0DPe4wPm/yF/zP9Dfg22uf7XnU3X7hqNiLsi4melQ4cb1/oC3rkGI1574cb3no4o/rmQvv9PxoKJ11/9UfNx/YV/1pYI+iPiMy88+ZVnJxYX5x9J6v++Wb/41bT+0V71BuhEI08beQzk18LS8vREtVqZV1DYVoh4WzRDYR8LjXHgWnl1qnHr1tjz/EMRb3yofhJCEvd6eqvv7UvnJo/U1igH1gu3nKtQ2IO1y8+fi1h5LiLuzep/Ib3eeX3lY2C91BL/Xel9cjuVzp8kx5zsMH7prt3Fv68p/lBT/Hd3GH/t4x0euE+Of7u38V/67eayV1/W49+3y6/EnrjN/se/uatfv2t/+H1v498/1Nv4X56NeCUZf0az8q+YpOXmymfz+PPFL9TnSvp3Gf+zZ7fGv+st419xc/wrtRn/TncY56dPVT6ZVV/6ecQbz0Xclxm/Ee9ILdbAerEl/pmm8eeBHeL/5WO/nM6qv/BqxMa1iLORHb851sjizNzIwtLyuSszE5OVycrVcvmx8bGx8fNjoyO1OeqRxkx1qydunvxwVv2Zr9f7P9AmfqP/7R7/jR363Gz5a58afE9G/S9O1eM/cCb7+T+Rxq8//n0t8d+b3if/T/6TnsubHPNWRBxO6x+MiB+8fPyhrHZ99GY9/qU2/S/eEr+1/w932P/43X+fyap+9iOd/gIAYC+1nxrodcsAAIC91o2Vxl73Ecg2sN4fzcvAhZWmdYWVrXWFpP6tdH2htBLxr3SNIal/MF0lS8qZCw3A287J5ff9utdtAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMi7haXl6YlqtTK/0OuWAN32vwAAAP//mSj9Tw==") r1 = openat(r0, &(0x7f0000000a40)='./file1\x00', 0x842, 0xa) r2 = openat(0xffffffffffffff9c, &(0x7f0000000ac0)='./file1\x00', 0x42, 0x40) copy_file_range(r2, 0x0, r2, 0x0, 0x9, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP(r1, 0xd0009412, 0x0) 3.77628383s ago: executing program 0 (id=1381): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000380)=0x7fff) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000003c0)={0x0, 0x2572c, 0x0, 0x0, 0x0, "00769a7d8200010000001495595915303d6000"}) r1 = syz_open_pts(r0, 0x0) read(r0, &(0x7f0000000400)=""/214, 0xd6) ioctl$TCFLSH(r1, 0x540b, 0x0) 3.67459073s ago: executing program 0 (id=1382): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000000c0)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6474, 0x200, 0x2, 0x15e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x400, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x200, 0x3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x2, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0x4, 0x8002, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) 3.606665867s ago: executing program 6 (id=1385): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002100), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000002140)={@my=0x1}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000002180)={0x28, 0x0, 0x0, @my=0x1}, 0x10) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r1, 0x28, 0x0, &(0x7f00000021c0)=0x1ff, 0x8) close(0x3) 2.7817668s ago: executing program 0 (id=1395): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x437, 0x3, 0x3, {0x0, 0x0, 0x0, r2, 0x51b0b}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8801}, 0x4000010) sendmmsg$inet(r0, &(0x7f0000004880)=[{{&(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f00000000c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @remote, @rand_addr=0x64010100}}}], 0x20}}], 0x1, 0x4000080) 2.752857074s ago: executing program 0 (id=1397): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), r1) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000ac0)=0x44) sendmsg$nl_route(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000b80)=@newlink={0x40, 0x10, 0x439, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, 0x9901, 0x49a41}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @remote}, @IFLA_IPTUN_TTL={0x5}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20060094}, 0x0) sendto$packet(r0, &(0x7f0000000bc0)="05d936277c6f5422007f83477ca1b278e3e4018a34e7bfd3de1a00ad6762646c95c716727eb53bcc", 0x28, 0x404c891, &(0x7f0000000c00)={0x11, 0x86dd, r2, 0x1, 0x4, 0x6, @local}, 0x14) 2.716920757s ago: executing program 6 (id=1398): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='io\x00') pread64(r2, &(0x7f0000000380)=""/15, 0xf, 0x4) 2.716416307s ago: executing program 0 (id=1399): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000000000404c05f20dafd60000000109022400010000000009040000010300010009210101000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000400)=ANY=[@ANYBLOB="000657"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c40)={0x84, &(0x7f0000000500)=ANY=[@ANYBLOB="001e1400000009"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000580)={0x2c, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="20014000000020"], 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000600)={0x18, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="20012900000005", @ANYBLOB="b139490983"], 0x0}) 1.159411673s ago: executing program 6 (id=1427): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000700), 0x101000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000880)=0xf) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$TCFLSH(r1, 0x400455c8, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$TIOCSTI(r1, 0x5412, &(0x7f00000008c0)=0x3) 620.414608ms ago: executing program 0 (id=1430): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0x401, 0x4) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000180), 0xffffffffffffff94, 0xb, 0x0, 0x0) ppoll(&(0x7f0000000080)=[{r0, 0x2123}], 0x1, 0x0, 0x0, 0x0) 561.544743ms ago: executing program 8 (id=1432): syz_mount_image$ext4(&(0x7f0000000280)='ext4\x00', &(0x7f00000002c0)='./file1\x00', 0x1000040, &(0x7f0000000300), 0x1, 0x5a3, &(0x7f00000008c0)="$eJzs3T1sG3UbAPDnznHTj7xv+krvK72gDhUgFamqk/QDClO7IipV6oDEApHjRlWcuIodaKJIpHuF6IAAdSkbDIwgBgbEwsjKwseMVNEIpKYDGDk+p2nqFCfEMcS/n3TJ/3939vP8fX7OvtOdHEDfOtr4k0Y8EREXk4jhdcsGIlt4tLneyvJi8f7yYjGJev3Sz0kkEXFvebHYWj/J/h+KiKWI+H9EfJWPOJ6uPeW+VqM6vzA1Xi6XZrP+SG366kh1fuHElenxydJkaebU8y+cOXv6zNjJsfXp3q+v7+W3NtYb3998+8Y3L92++fEnR5aK744ncS6GsmXrx7GTmq9JPs5tmH+6G8F6KOl1AmxLLqvzRin9L4Yjl1V9O/X1O4fBXUkP6KL6YER9zbom0AcSRQ99qvU9oHH825p28/vHnfPNA5BG3JXlxeJb0Yo/0Dw3EftXj00O/pI8dGTSON48vJuJsictXY+I0YGBR9//Sfb+277RnUiQrvryfHNDPbr907X9T7TZ/wy1zp3+Ra3930q2/1tpEz+3yf7vYocxfnv1xw82jX99MJ5sGz9Zi5+0iZ9GxOsdxr/1yudnN1tW/zDiWLSP35I8/vzwyOUr5dJo82/bGF8cO/Li5uOPOLhJ/OY52/2riawf/74sp7TD8X/29adPLT0m/rNPP377t3v9D0TEOx3G/8+9j17ebNmd68ndxreArW7/JPJxu8P4z507+l3WdNYQAAAAAAAAAAB2ULp6LVuSFtbaaVooNO/h/W8cTMuVau345crczETzmrfDkU9bV1oNN/tJoz+WXY/b6p/c0D+VywLmDqz2C8VKeaLHYwcAAAAAAAAAAAAAAAAAAIC/i0Mb7v//Nbd6///Gn6sG9qrNf/Ib2OvUP/Svh+s/6VkewO7z+Q99q67+oX+pf+hf6h/6l/qH/tW2/g/sfh7A7vP5D/1L/QMAAAAAAAAAAAAAAAAAAAAAAAAAQFdcvHChMdXvLy8WG/2Jgfm5qcobJyZK1anC9FyxUKzMXi1MViqT5VKhWJn+s+dLKpWrozEzd22kVqrWRqrzC69NV+ZmWr8pWsp3fUQAAAAAAAAAAAAAAAAAAADwzzO0OiVpISLf7KdpoRDxr4g4nERy+Uq5NBoR/46Ib3P5wUZ/rNdJAwAAAAAAAAAAAAAAAAAAwB5TnV+YGi+XS7PdawxkoTp71A+1ruYzsJWVI2JpZ9NoPOOWH5XPXsDubqY+aeQ6fB/2faOHOyUAAAAAAAAAAAAAAAAAAOhTD2767fQRv3c3IQAAAAAAAAAAAAAAAAAAAOhL6U9JRDSmY8PPDG1cui9Zya3+j4g3b11679p4rTY71ph/d21+7f1s/sle5A90qlWnaUQ06hgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4oDq/MDVeLpdmt9kY7GCdXo8RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYDv+CAAA//9bQM66") r0 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./file1\x00', 0x101042, 0x15) r1 = openat(0xffffffffffffff9c, &(0x7f0000000ec0)='./file1\x00', 0x8042, 0xb) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000f40)=0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) syz_ublk_setup_io_uring(0x71f5, &(0x7f0000000f80)={0x0, 0x3fcd, 0x2000, 0x5, 0x1d8, 0x0, r0}, 0x0, 0x0, 0x0) 550.408885ms ago: executing program 8 (id=1434): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=ANY=[@ANYBLOB="c4000000190001000000000010000000e0000002000000000000000000000000ac1414bb00000000000000000000000000000000000000000a00008006000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000f5ff1810be1a000000000500000000000000000000000000000008000000000000000000000000000000fdffffffffffffff900f00000000000000000000000000000000000000000000000000000000000000100000b86b6e0000010001000000000c0015005d07350002"], 0xc4}, 0x1, 0x0, 0x0, 0x4008011}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x2, 0x10, 0x0, 0x87}, {0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0xfffffffffffffffb}, {0x0, 0xfffffffffffffffd, 0x200000000000000}, 0x0, 0x6e6bc0}}, 0xb8}, 0x1, 0x0, 0x0, 0x24004811}, 0x2c000010) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000c40)=ANY=[@ANYBLOB="d40000001b001d0328bd7000fcdbdf25ffffffff000000000000000000000000fe8000000000000000000000000000264e2000014e2404000200000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="08000000000000000100010000000000f4ffffffffffffff04000000000000000200000000000000ba410000000091ad07000000000000000000008000000000ffffff7f0000000003000000000000000400000000000000080000000000000003000000b86b6e"], 0xd4}}, 0x0) 500.63084ms ago: executing program 8 (id=1436): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_tracing={0x1a, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b703000000000000a500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000084000000b70000000000000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x18, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2}, 0x94) bpf$OBJ_PIN_PROG(0x11, &(0x7f0000000780)=@generic={0x0, r3}, 0x18) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000340)={r2, 0x0, 0x0}, 0x10) 440.616606ms ago: executing program 8 (id=1438): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000c00), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000dc0)=[@text64={0x40, &(0x7f0000000000)="c744240077dd0000c74424027fbe0000c7442406000000000f011c24b801000000c401f1c6cc08450f01ca47160f01f8f8baf80cb8e4f61882ef66bafc0c66b8795966efc744240042b40000c744240200280000c7442406000000000f011c2466b8de003e0f005c101b2e0f005ffa460f1ec32e640fc71f", 0x78}], 0x1, 0xe4, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 440.419296ms ago: executing program 9 (id=1439): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) 399.17062ms ago: executing program 8 (id=1443): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r0) syz_mount_image$fuse(0x0, &(0x7f0000000600)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000200)=0x1, 0x12) 382.507741ms ago: executing program 8 (id=1445): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x32cc0000) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000200)={0xaa, 0x2cc}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000010000/0x1000)=nil, 0x1000}, 0x1}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00000a0000/0x14000)=nil, &(0x7f0000ac8000/0x3000)=nil, 0x14000, 0x1}) 339.890856ms ago: executing program 9 (id=1446): r0 = syz_clone(0x1100400, 0x0, 0xffffffffffffff2b, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='task\x00') fchdir(r1) mount(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000200)='proc\x00', 0x800000, 0x0) r2 = syz_open_procfs(r0, &(0x7f0000000240)='stat\x00') pread64(r2, &(0x7f0000000280)=""/15, 0xf, 0x4) 309.675969ms ago: executing program 3 (id=1448): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./mnt\x00', 0x1ff) mount(&(0x7f0000000180)=@filename='./dev/sda1\x00', &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='ext4\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt\x00', 0x149000, 0x19a) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000340)={0x19, 0xfffffffffffffffd, 0x1000003, 0xfff, 0xfe8, 0x2}) 295.81352ms ago: executing program 9 (id=1449): r0 = socket(0x1, 0x5, 0x0) close(r0) timerfd_create(0x1, 0x800) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000340)={0xe000200c}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000380)={0x80002017}) 247.066885ms ago: executing program 3 (id=1450): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0xc, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r3, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x4a, &(0x7f0000000580)={@empty, @multicast, @val={@void, {0x8100, 0x6, 0x1, 0x1}}, {@ipv6={0x86dd, @udp={0xa, 0x6, "000100", 0x10, 0x11, 0x0, @local, @ipv4={'\x00', '\xff\xff', @local}, {[], {0x4e1d, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x1, 0x1, 0x65, 0x0, @val=0x80}}}}}}}}, 0x0) 229.347127ms ago: executing program 3 (id=1451): pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) fcntl$setpipe(r1, 0x407, 0x0) write$FUSE_INIT(r1, &(0x7f0000000480)={0x50, 0xfffffffffffffff5, 0x0, {0x7, 0x28, 0x2, 0xffffffff82048008, 0x0, 0x40, 0x8, 0x0, 0x0, 0x0, 0x104, 0x8}}, 0x50) vmsplice(r1, &(0x7f0000000500)=[{&(0x7f0000000540)="eb", 0x20000101}], 0x1, 0x0) fcntl$setpipe(r1, 0x407, 0x2000000) read$watch_queue(r0, &(0x7f0000000580)=""/43, 0x50) 188.811121ms ago: executing program 9 (id=1452): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x40042, 0x10) close(r0) r1 = socket$inet6(0xa, 0x80002, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x12, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r2}, &(0x7f0000000200), &(0x7f0000000240)=r0}, 0x20) recvfrom$inet6(r1, 0x0, 0x0, 0x40, 0x0, 0x0) 172.649352ms ago: executing program 9 (id=1453): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f0000000100)) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x400000b6, 0x0, 0x7f}]}) 97.0695ms ago: executing program 3 (id=1454): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0) 43.244606ms ago: executing program 3 (id=1455): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000bc0)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) recvmsg$unix(r0, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000c40), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c80)={0xffffffffffffffff}) close_range(r1, 0xffffffffffffffff, 0x2) dup3(r0, r2, 0x80000) 42.895986ms ago: executing program 3 (id=1456): getrandom(&(0x7f0000000300)=""/286, 0xffffff9a, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x80040, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x140000000) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x32877000) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) ioctl$ASHMEM_SET_NAME(r0, 0x7709, &(0x7f0000000800)='\x00\x00\x00\x06\x00\x00\x03\x00\x00x\x92\x12\xbc\x00\x00\xbb\x0642\x9c\x1a\xd1\xcbx\xb0\xd6\x1e\x10gQ\xca\x0e;\xf7\'\x8c\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xbc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn\x05\x00\x00\x00-<\r\xd1?\xd8\xe2\xb2\xb1n\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \xac\xc4K\x03\xfa\x13Vz\xbf\xe3c\x8d \x0f\xb1\xe9\xf2oci(\xcb\x82\x05\xfe[H\xaf\x01\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafd%\xf1\xdbjE\x01\xd1sD5hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\x851Y9OB\xdeB\xe1\x02-&\"1hS\x92\xe4$-\x02\x00\xe4\x8e\"\x85\xc9x\xef\x81E.r\x89\xe5\x00\x9e\x97\x96\xb8j\x81\xf0\xdca\xfb\xa6\xff\xff\xff\xff\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\xc0\xbb\xfdq~#\xf7\xa8\"$,\xf4\x84|\x89o\x00<\xa6-\xb0\xd3\x80\xbe\xcf\a\x00\xfc\xa6\xb1\x05\x94\x84l\xbfA\xeb\xd8\t\x00\x00\x00CvNhx461\x04N<\xedV\xcet\xaa~\xf3j\x94\xec\x92\x86uY\xf6\xb5\t?,~\xa67\\\xb9\xc9K\xf8\x9d\x96\xc0\xb5\xc7wF\x99\x12\x97T\x90.\x9c\xe3\x9a\xf1\xb9\x9c\x13\xbc\x19\xde/\xaahB\t\x97\a03\xcd\xb3\xc8\xd5l\x14!\xf9Xg@\x90\x14>2\x1d\xeeB\xccT\x0e\xd8\xef\xc8\xe9\xb4\xf3l\xc3\xf2\x998\xc8\xc2|2\xee\xb4W\x99f.\xeb\xe9\x05\xcbkz3+\xdd\xe1*8\x95@0t0\xad\xe3#\xd7\x19\xe7Q\xdfmI\xe5\x1e\xe4\x87\xc9\x8f\xa7\xe0\xd9v\xf6\x01\x9d\x8f`,\x1a8\x81I\x86l\x8f2\r:\xc1\x02\xd6Z%\xa7Ks\x8bUolS\x05\xbe\x97\x1fGe\x94\xa6\xa3\xab\xdb\r\x17\xff[\xb1\x00\xff\x7f\x00\x00\x00\x00\x00\xe8\xb3r\f\xed-V\x89\f\xa9\xb8\x911\x8b\xb6Yp\xfe#S') 0s ago: executing program 9 (id=1457): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000140)=0x13) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000180)=0x2) socket$packet(0x11, 0x2, 0x300) ioctl$TCSETSW2(r0, 0x402c542c, &(0x7f0000000000)={0x7, 0x0, 0xfffffff2, 0x1fd3, 0x4f, "0d41810700916fb7a9000000000000a84900", 0x9, 0x140220}) kernel console output (not intermixed with test programs): v6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 55.667275][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 55.675160][ T879] tipc: Node number set to 10005162 [ 55.688119][ T1410] device veth1_macvtap entered promiscuous mode [ 55.704791][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 55.715898][ T1429] EXT4-fs error (device loop7): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 42 vs 41 free clusters [ 55.723288][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 55.739457][ T1429] EXT4-fs error (device loop7): ext4_do_update_inode:5281: inode #16: comm syz.7.429: corrupted inode contents [ 55.753391][ T1429] EXT4-fs error (device loop7): ext4_dirty_inode:6158: inode #16: comm syz.7.429: mark_inode_dirty error [ 55.757554][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 55.780258][ T1429] EXT4-fs error (device loop7): ext4_do_update_inode:5281: inode #16: comm syz.7.429: corrupted inode contents [ 55.800240][ T1429] EXT4-fs error (device loop7): __ext4_ext_dirty:202: inode #16: comm syz.7.429: mark_inode_dirty error [ 55.829298][ T1429] EXT4-fs error (device loop7): ext4_do_update_inode:5281: inode #16: comm syz.7.429: corrupted inode contents [ 55.849156][ T1429] EXT4-fs error (device loop7): __ext4_ext_dirty:202: inode #16: comm syz.7.429: mark_inode_dirty error [ 55.860880][ T1429] EXT4-fs error (device loop7): ext4_do_update_inode:5281: inode #16: comm syz.7.429: corrupted inode contents [ 55.873161][ T1429] EXT4-fs error (device loop7) in ext4_orphan_del:303: Corrupt filesystem [ 55.882308][ T1429] EXT4-fs error (device loop7): ext4_do_update_inode:5281: inode #16: comm syz.7.429: corrupted inode contents [ 55.900124][ T1429] EXT4-fs error (device loop7): ext4_truncate:4327: inode #16: comm syz.7.429: mark_inode_dirty error [ 55.918250][ T1393] loop1: detected capacity change from 0 to 131072 [ 55.920399][ T1429] EXT4-fs error (device loop7) in ext4_process_orphan:345: Corrupt filesystem [ 55.936801][ T1429] EXT4-fs (loop7): 1 truncate cleaned up [ 55.946756][ T1393] F2FS-fs (loop1): invalid crc value [ 55.952606][ T8] Quota error (device loop7): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 55.964152][ T1429] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 55.974003][ T1429] ext4 filesystem being mounted at /37/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 55.979988][ T8] EXT4-fs error (device loop7): ext4_release_dquot:6864: comm kworker/u4:0: Failed to release dquot type 1 [ 56.004599][ T1393] F2FS-fs (loop1): Found nat_bits in checkpoint [ 56.041557][ T882] EXT4-fs (loop7): unmounting filesystem. [ 56.082483][ T1393] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 56.227580][ T1457] ip_tables: iptables: counters copy to user failed while replacing table [ 56.279894][ T308] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 56.316286][ T1460] loop7: detected capacity change from 0 to 4096 [ 56.334239][ T1460] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 56.350032][ T1460] EXT4-fs (loop7): Test dummy encryption mode enabled [ 56.372739][ T1441] syz.4.433 (1441) used greatest stack depth: 18984 bytes left [ 56.391202][ T1460] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 56.437070][ T1460] fscrypt: AES-256-XTS using blk-crypto-fallback [ 56.449250][ T28] audit: type=1326 audit(1794329359.293:331): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1465 comm="syz.4.440" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fa2fa8f19 code=0x7ffc0000 [ 56.478031][ T28] audit: type=1326 audit(1794329359.303:332): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1465 comm="syz.4.440" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fa2fa8f19 code=0x7ffc0000 [ 56.504519][ T28] audit: type=1326 audit(1794329359.303:333): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1465 comm="syz.4.440" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fa2fa8f19 code=0x7ffc0000 [ 56.521591][ T308] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 56.535616][ T28] audit: type=1326 audit(1794329359.303:334): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1465 comm="syz.4.440" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7f8fa2fa8f19 code=0x7ffc0000 [ 56.563752][ T28] audit: type=1326 audit(1794329359.303:335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1465 comm="syz.4.440" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fa2fa8f19 code=0x7ffc0000 [ 56.576220][ T308] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 56.588912][ T28] audit: type=1326 audit(1794329359.303:336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1465 comm="syz.4.440" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fa2fa8f19 code=0x7ffc0000 [ 56.623601][ T28] audit: type=1326 audit(1794329359.303:337): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1465 comm="syz.4.440" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fa2fa8f19 code=0x7ffc0000 [ 56.657330][ T28] audit: type=1326 audit(1794329359.303:338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1465 comm="syz.4.440" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fa2fa8f19 code=0x7ffc0000 [ 56.659224][ T308] usb 7-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= 1.00 [ 56.710045][ T308] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.725706][ T308] usb 7-1: Product: syz [ 56.734457][ T308] usb 7-1: Manufacturer: syz [ 56.744514][ T308] usb 7-1: SerialNumber: syz [ 56.759971][ T1446] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 56.776353][ T1446] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 56.777557][ T882] EXT4-fs (loop7): unmounting filesystem. [ 56.794121][ T308] usbserial_generic 7-1:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 56.812443][ T308] usbserial_generic 7-1:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 56.835548][ T308] usbserial_generic 7-1:1.0: generic converter detected [ 56.851954][ T308] usb 7-1: generic converter now attached to ttyUSB0 [ 56.910823][ T1471] capability: warning: `syz.7.443' uses deprecated v2 capabilities in a way that may be insecure [ 56.950079][ T1469] loop4: detected capacity change from 0 to 40427 [ 56.984402][ T1469] F2FS-fs (loop4): invalid crc value [ 57.032405][ T1469] F2FS-fs (loop4): Found nat_bits in checkpoint [ 57.073457][ T308] usb 7-1: USB disconnect, device number 4 [ 57.085972][ T308] generic ttyUSB0: generic converter now disconnected from ttyUSB0 [ 57.120672][ T308] usbserial_generic 7-1:1.0: device disconnected [ 57.156091][ T1469] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 57.191844][ T1469] syz.4.441: attempt to access beyond end of device [ 57.191844][ T1469] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 58.312010][ T1487] loop1: detected capacity change from 0 to 256 [ 58.319065][ T1473] loop9: detected capacity change from 0 to 40427 [ 58.336188][ T1487] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x205ad3ec, utbl_chksum : 0xe619d30d) [ 58.344936][ T1473] F2FS-fs (loop9): invalid crc value [ 59.328756][ T1473] F2FS-fs (loop9): Found nat_bits in checkpoint [ 59.357470][ T1410] syz-executor: attempt to access beyond end of device [ 59.357470][ T1410] loop4: rw=2049, sector=45104, nr_sectors = 8 limit=40427 [ 59.401168][ T1473] F2FS-fs (loop9): Mounted with checkpoint version = 48b305e4 [ 59.442903][ T1497] input: syz0 as /devices/virtual/input/input5 [ 59.491366][ T1265] syz-executor: attempt to access beyond end of device [ 59.491366][ T1265] loop9: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 60.023280][ T1523] loop1: detected capacity change from 0 to 40427 [ 60.033766][ T1523] F2FS-fs (loop1): Corrupted extension count (64 + 1 > 64) [ 60.041594][ T1523] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 60.062358][ T1552] netlink: 4 bytes leftover after parsing attributes in process `syz.4.472'. [ 60.088372][ T1523] F2FS-fs (loop1): Image doesn't support compression [ 60.102284][ T1556] netlink: 27 bytes leftover after parsing attributes in process `syz.9.473'. [ 60.110389][ T1523] F2FS-fs (loop1): Image doesn't support compression [ 60.133849][ T28] kauditd_printk_skb: 16 callbacks suppressed [ 60.133866][ T28] audit: type=1400 audit(1794329362.983:355): avc: denied { ioctl } for pid=1557 comm="syz.7.474" path="socket:[23405]" dev="sockfs" ino=23405 ioctlcmd=0x52c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 60.165893][ T1523] F2FS-fs (loop1): invalid crc value [ 60.181414][ T1523] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 60.223172][ T28] audit: type=1400 audit(1794329619.112:356): avc: denied { bind } for pid=1562 comm="syz.9.476" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 60.271125][ T28] audit: type=1400 audit(1794329619.112:357): avc: denied { listen } for pid=1562 comm="syz.9.476" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 60.300260][ T1523] F2FS-fs (loop1): Start checkpoint disabled! [ 60.321588][ T1523] F2FS-fs (loop1): f2fs_disable_checkpoint() finish, err:0 [ 60.338980][ T1523] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 60.346341][ T1523] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 60.388613][ T1492] loop6: detected capacity change from 0 to 131072 [ 60.398208][ T1492] F2FS-fs (loop6): Invalid segment/section count (458783, 24 x 150994945) [ 60.409338][ T1492] F2FS-fs (loop6): Can't find valid F2FS filesystem in 1th superblock [ 60.419205][ T1492] F2FS-fs (loop6): invalid crc value [ 60.451587][ T1492] F2FS-fs (loop6): Found nat_bits in checkpoint [ 60.468753][ T1590] loop7: detected capacity change from 0 to 128 [ 60.525577][ T1492] F2FS-fs (loop6): Try to recover 1th superblock, ret: 0 [ 60.536004][ T1492] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e4 [ 60.618109][ T1492] F2FS-fs (loop6): f2fs_check_nid_range: out-of-range nid=60900, run fsck to fix. [ 60.669119][ T1603] input: syz0 as /devices/virtual/input/input6 [ 60.679795][ T1601] ip_tables: iptables: counters copy to user failed while replacing table [ 60.742249][ T1607] xt_hashlimit: size too large, truncated to 1048576 [ 60.782822][ T28] audit: type=1400 audit(1794329619.692:358): avc: denied { create } for pid=1608 comm="syz.7.495" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 60.788767][ T1609] loop7: detected capacity change from 0 to 128 [ 60.832233][ T1609] FAT-fs (loop7): Invalid FSINFO signature: 0x00000004, 0x80417272 (sector = 1) [ 60.838432][ T1612] loop1: detected capacity change from 0 to 1024 [ 60.860382][ T1612] EXT4-fs: Ignoring removed mblk_io_submit option [ 60.888942][ T1125] FAT-fs (loop7): Invalid FSINFO signature: 0x00000004, 0x80417272 (sector = 1) [ 60.923201][ T1612] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 60.965777][ T28] audit: type=1400 audit(1794329619.872:359): avc: denied { setattr } for pid=1610 comm="syz.1.496" name="file0" dev="loop1" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 61.045637][ T287] EXT4-fs (loop1): unmounting filesystem. [ 61.103054][ T1622] netlink: 4 bytes leftover after parsing attributes in process `syz.1.499'. [ 61.141651][ T1624] loop4: detected capacity change from 0 to 256 [ 61.168762][ T1624] exFAT-fs (loop4): failed to load upcase table (idx : 0x00011a39, chksum : 0xd54015fb, utbl_chksum : 0xe619d30d) [ 61.248721][ T1626] loop7: detected capacity change from 0 to 4096 [ 61.261117][ T1626] EXT4-fs (loop7): Test dummy encryption mode enabled [ 61.285205][ T1626] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 61.345239][ T882] EXT4-fs (loop7): unmounting filesystem. [ 61.349043][ T1635] loop1: detected capacity change from 0 to 256 [ 61.394308][ T1635] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x1a9973fb, utbl_chksum : 0xe619d30d) [ 61.535782][ T1643] loop7: detected capacity change from 0 to 128 [ 61.552104][ T1656] netlink: 8 bytes leftover after parsing attributes in process `syz.1.512'. [ 61.565772][ T1654] ip_tables: iptables: counters copy to user failed while replacing table [ 61.596102][ T1658] futex_wake_op: syz.9.513 tries to shift op by 144; fix this program [ 61.624820][ T1658] futex_wake_op: syz.9.513 tries to shift op by 144; fix this program [ 61.645126][ T28] audit: type=1400 audit(1794329620.552:360): avc: denied { mount } for pid=1660 comm="syz.7.514" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 61.711295][ T1663] loop4: detected capacity change from 0 to 512 [ 61.817095][ T1671] netlink: 4 bytes leftover after parsing attributes in process `syz.7.518'. [ 61.863578][ T1673] FAULT_INJECTION: forcing a failure. [ 61.863578][ T1673] name failslab, interval 1, probability 0, space 0, times 0 [ 61.919023][ T1673] CPU: 1 PID: 1673 Comm: syz.9.519 Not tainted syzkaller #0 [ 61.926392][ T1673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 61.936504][ T1673] Call Trace: [ 61.939818][ T1673] [ 61.942784][ T1673] __dump_stack+0x21/0x24 [ 61.947167][ T1673] dump_stack_lvl+0x110/0x170 [ 61.951881][ T1673] ? __cfi_dump_stack_lvl+0x8/0x8 [ 61.956955][ T1673] dump_stack+0x15/0x24 [ 61.961151][ T1673] should_fail_ex+0x3bf/0x510 [ 61.965956][ T1673] __should_failslab+0xac/0xf0 [ 61.970808][ T1673] should_failslab+0x9/0x20 [ 61.975442][ T1673] __kmem_cache_alloc_node+0x3d/0x2d0 [ 61.980861][ T1673] ? realloc_user_queue+0xbb/0x2a0 [ 61.986050][ T1673] ? realloc_user_queue+0xbb/0x2a0 [ 61.991221][ T1673] __kmalloc+0xa4/0x1e0 [ 61.995424][ T1673] realloc_user_queue+0xbb/0x2a0 [ 62.000410][ T1673] ? memset+0x35/0x40 [ 62.004445][ T1673] snd_timer_user_open+0x103/0x190 [ 62.009608][ T1673] ? __cfi_snd_timer_user_open+0x10/0x10 [ 62.015312][ T1673] snd_open+0x33e/0x3b0 [ 62.019522][ T1673] chrdev_open+0x593/0x600 [ 62.023991][ T1673] ? __cfi_chrdev_open+0x10/0x10 [ 62.028982][ T1673] ? fsnotify_perm+0x3e9/0x5b0 [ 62.033795][ T1673] do_dentry_open+0x885/0x11f0 [ 62.038694][ T1673] ? __cfi_chrdev_open+0x10/0x10 [ 62.043675][ T1673] vfs_open+0x73/0x80 [ 62.047715][ T1673] path_openat+0x2699/0x2f30 [ 62.052372][ T1673] ? slab_post_alloc_hook+0x4f/0x2d0 [ 62.057711][ T1673] ? kmem_cache_alloc+0x166/0x320 [ 62.062805][ T1673] ? getname_flags+0xba/0x510 [ 62.067521][ T1673] ? do_sys_openat2+0xeb/0x820 [ 62.072339][ T1673] ? do_filp_open+0x420/0x420 [ 62.077070][ T1673] do_filp_open+0x1ee/0x420 [ 62.081618][ T1673] ? __cfi_do_filp_open+0x10/0x10 [ 62.086693][ T1673] ? alloc_fd+0x4c1/0x570 [ 62.091160][ T1673] do_sys_openat2+0x15e/0x820 [ 62.095908][ T1673] ? __se_sys_futex+0x136/0x310 [ 62.100802][ T1673] ? do_sys_open+0xe0/0xe0 [ 62.105270][ T1673] ? __this_cpu_preempt_check+0x13/0x20 [ 62.110904][ T1673] ? xfd_validate_state+0x70/0x150 [ 62.116071][ T1673] __x64_sys_openat+0x136/0x160 [ 62.120978][ T1673] x64_sys_call+0x783/0x9a0 [ 62.125523][ T1673] do_syscall_64+0x4c/0xa0 [ 62.130015][ T1673] ? clear_bhb_loop+0x30/0x80 [ 62.134738][ T1673] ? clear_bhb_loop+0x30/0x80 [ 62.139473][ T1673] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 62.145517][ T1673] RIP: 0033:0x7fe15d9a8f19 [ 62.149975][ T1673] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 62.169617][ T1673] RSP: 002b:00007fe15e935028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 62.178076][ T1673] RAX: ffffffffffffffda RBX: 00007fe15dc25fa0 RCX: 00007fe15d9a8f19 [ 62.186091][ T1673] RDX: 0000000000022000 RSI: 0000200000000b00 RDI: ffffffffffffff9c [ 62.194108][ T1673] RBP: 00007fe15da37f6d R08: 0000000000000000 R09: 0000000000000000 [ 62.202112][ T1673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 62.210123][ T1673] R13: 00007fe15dc26038 R14: 00007fe15dc25fa0 R15: 00007ffd9a42c898 [ 62.218155][ T1673] [ 62.245010][ T1678] exFAT-fs (loop7): failed to load upcase table (idx : 0x00010000, chksum : 0x205ad3fc, utbl_chksum : 0xe619d30d) [ 62.335035][ T879] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 62.360178][ T879] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 62.480971][ T28] audit: type=1400 audit(1794329621.392:361): avc: denied { write } for pid=1686 comm="syz.7.527" name="hidraw0" dev="devtmpfs" ino=1298 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 62.590723][ T1699] exFAT-fs (loop1): failed to load upcase table (idx : 0x0001207b, chksum : 0x1e861e4d, utbl_chksum : 0xe619d30d) [ 62.654793][ T1702] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 62.725757][ T1702] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 62.773173][ T10] device bridge_slave_1 left promiscuous mode [ 62.785518][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.800751][ T857] EXT4-fs (loop6): unmounting filesystem. [ 62.812336][ T10] device bridge_slave_0 left promiscuous mode [ 62.822077][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.835926][ T10] device veth1_macvtap left promiscuous mode [ 62.844850][ T1712] FAULT_INJECTION: forcing a failure. [ 62.844850][ T1712] name fail_futex, interval 1, probability 0, space 0, times 1 [ 62.858299][ T1712] CPU: 0 PID: 1712 Comm: syz.6.534 Not tainted syzkaller #0 [ 62.860300][ T10] device veth0_vlan left promiscuous mode [ 62.865627][ T1712] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 62.865644][ T1712] Call Trace: [ 62.865650][ T1712] [ 62.865658][ T1712] __dump_stack+0x21/0x24 [ 62.892076][ T1712] dump_stack_lvl+0x110/0x170 [ 62.896811][ T1712] ? __cfi_dump_stack_lvl+0x8/0x8 [ 62.901871][ T1712] ? kasan_save_stack+0x4c/0x60 [ 62.906763][ T1712] ? kasan_save_stack+0x3a/0x60 [ 62.911667][ T1712] ? __kasan_record_aux_stack+0xb6/0xc0 [ 62.917267][ T1712] ? call_rcu+0xcf/0xf50 [ 62.921561][ T1712] dump_stack+0x15/0x24 [ 62.925763][ T1712] should_fail_ex+0x3bf/0x510 [ 62.930485][ T1712] should_fail+0xb/0x10 [ 62.934714][ T1712] get_futex_key+0x143/0xb10 [ 62.939357][ T1712] ? __cfi_get_futex_key+0x10/0x10 [ 62.944529][ T1712] futex_wake+0x150/0x8e0 [ 62.948905][ T1712] ? __cfi_futex_wake+0x10/0x10 [ 62.953845][ T1712] ? call_rcu+0xb84/0xf50 [ 62.958219][ T1712] ? kmem_cache_free+0x12d/0x300 [ 62.963216][ T1712] ? __cfi_call_rcu+0x10/0x10 [ 62.967947][ T1712] do_futex+0x2bf/0x430 [ 62.972146][ T1712] ? percpu_counter_add_batch+0x13c/0x160 [ 62.977934][ T1712] ? __cfi_do_futex+0x10/0x10 [ 62.982656][ T1712] ? __fput+0x66d/0x8f0 [ 62.986880][ T1712] __se_sys_futex+0x136/0x310 [ 62.991597][ T1712] ? __x64_sys_futex+0x100/0x100 [ 62.996581][ T1712] ? xfd_validate_state+0x70/0x150 [ 63.001754][ T1712] ? __kasan_check_write+0x14/0x20 [ 63.006905][ T1712] __x64_sys_futex+0xe5/0x100 [ 63.011674][ T1712] x64_sys_call+0x7ec/0x9a0 [ 63.016314][ T1712] do_syscall_64+0x4c/0xa0 [ 63.020783][ T1712] ? clear_bhb_loop+0x30/0x80 [ 63.025507][ T1712] ? clear_bhb_loop+0x30/0x80 [ 63.030229][ T1712] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 63.036163][ T1712] RIP: 0033:0x7f2eb21a8f19 [ 63.040651][ T1712] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 63.060319][ T1712] RSP: 002b:00007f2eb315a0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 63.068778][ T1712] RAX: ffffffffffffffda RBX: 00007f2eb2425fa8 RCX: 00007f2eb21a8f19 [ 63.076796][ T1712] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f2eb2425fac [ 63.084803][ T1712] RBP: 00007f2eb2425fa0 R08: 003011bf7b3df93c R09: 0000000000000000 [ 63.092817][ T1712] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 63.100824][ T1712] R13: 00007f2eb2426038 R14: 00007fffeb99b340 R15: 00007fffeb99b428 [ 63.108932][ T1712] [ 63.141763][ T1685] F2FS-fs (loop9): Invalid log_blocksize (268), supports only 12 [ 63.210548][ T1685] F2FS-fs (loop9): Can't find valid F2FS filesystem in 1th superblock [ 63.224249][ T1685] F2FS-fs (loop9): invalid crc value [ 63.233796][ T1705] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 63.254069][ T1705] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 63.295355][ T1705] F2FS-fs (loop1): Found nat_bits in checkpoint [ 63.321145][ T1685] F2FS-fs (loop9): Found nat_bits in checkpoint [ 63.344289][ T1703] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.358013][ T1703] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.366148][ T1705] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 63.372537][ T1724] SELinux: failed to load policy [ 63.373579][ T28] audit: type=1400 audit(1794329622.272:362): avc: denied { load_policy } for pid=1723 comm="syz.7.537" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 63.382746][ T1703] device bridge_slave_0 entered promiscuous mode [ 63.398859][ T1705] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 63.440264][ T1703] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.451452][ T1703] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.472154][ T1703] device bridge_slave_1 entered promiscuous mode [ 63.478888][ T1685] F2FS-fs (loop9): Try to recover 1th superblock, ret: 0 [ 63.487034][ T1685] F2FS-fs (loop9): Mounted with checkpoint version = 48b305e5 [ 63.644531][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 63.652781][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 63.671217][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 63.680238][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 63.688627][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.695731][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.704367][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 63.713392][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 63.722073][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.729166][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.757996][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 63.770560][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 63.784956][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 63.805975][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 63.824516][ T1703] device veth0_vlan entered promiscuous mode [ 63.834337][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 63.846048][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 63.859286][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 63.878276][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 63.893549][ T1703] device veth1_macvtap entered promiscuous mode [ 63.915620][ T337] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 63.934714][ T337] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 64.004178][ T1705] syz.1.533: attempt to access beyond end of device [ 64.004178][ T1705] loop1: rw=2049, sector=77824, nr_sectors = 3232 limit=40427 [ 64.023791][ T1737] netlink: 8 bytes leftover after parsing attributes in process `syz.6.542'. [ 64.185187][ T287] syz-executor: attempt to access beyond end of device [ 64.185187][ T287] loop1: rw=2051, sector=77824, nr_sectors = 3232 limit=40427 [ 64.216080][ T287] F2FS-fs (loop1): Issue discard(9728, 9728, 404) failed, ret: -5 [ 64.296203][ T28] audit: type=1400 audit(1794329623.202:363): avc: denied { bind } for pid=1759 comm="syz.6.552" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 64.343989][ T28] audit: type=1400 audit(1794329623.242:364): avc: denied { map } for pid=1759 comm="syz.6.552" path="socket:[24693]" dev="sockfs" ino=24693 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 64.396739][ T1766] netlink: 16 bytes leftover after parsing attributes in process `syz.1.547'. [ 64.461241][ T1749] F2FS-fs (loop7): invalid crc value [ 64.475790][ T1749] F2FS-fs (loop7): Found nat_bits in checkpoint [ 64.541560][ T1749] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 64.645533][ T1779] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 64.654371][ T1779] ext4 filesystem being mounted at /47/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 64.729708][ T857] EXT4-fs (loop6): unmounting filesystem. [ 64.788321][ T1784] syz.7.546: attempt to access beyond end of device [ 64.788321][ T1784] loop7: rw=2049, sector=40424, nr_sectors = 8 limit=40427 [ 64.843286][ T1787] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.871301][ T1787] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.889265][ T10] Bluetooth: hci0: Frame reassembly failed (-84) [ 64.899454][ T1787] device bridge_slave_0 entered promiscuous mode [ 64.912174][ T1787] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.919272][ T1787] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.927175][ T1787] device bridge_slave_1 entered promiscuous mode [ 65.010577][ T1803] SELinux: failed to load policy [ 65.030900][ T1787] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.037997][ T1787] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.045339][ T1787] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.052420][ T1787] bridge0: port 1(bridge_slave_0) entered forwarding state [ 65.119333][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 65.134598][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.144664][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.160504][ T43] device bridge_slave_1 left promiscuous mode [ 65.167845][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.177927][ T1819] set_capacity_and_notify: 7 callbacks suppressed [ 65.177954][ T1819] loop6: detected capacity change from 0 to 512 [ 65.191133][ T43] device bridge_slave_0 left promiscuous mode [ 65.196443][ T1819] EXT4-fs: Ignoring removed i_version option [ 65.205687][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.216069][ T1819] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 65.226144][ T43] device veth1_macvtap left promiscuous mode [ 65.232724][ T43] device veth0_vlan left promiscuous mode [ 65.242479][ T1819] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 65.251887][ T1819] ext4 filesystem being mounted at /53/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 65.336578][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 65.346384][ T309] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.353572][ T309] bridge0: port 1(bridge_slave_0) entered forwarding state [ 65.367865][ T857] EXT4-fs (loop6): unmounting filesystem. [ 65.378239][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 65.390441][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 65.398804][ T309] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.405897][ T309] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.427356][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 65.435660][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 65.461140][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 65.476231][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 65.480578][ T308] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 65.490957][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 65.504573][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 65.518305][ T1787] device veth0_vlan entered promiscuous mode [ 65.530736][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 65.542421][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 65.555213][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 65.563755][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 65.585122][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 65.593734][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 65.604881][ T1787] device veth1_macvtap entered promiscuous mode [ 65.616510][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 65.624690][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 65.634699][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 65.660548][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 65.669164][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 65.672318][ T308] usb 10-1: unable to get BOS descriptor or descriptor too short [ 65.685184][ T28] kauditd_printk_skb: 2 callbacks suppressed [ 65.685201][ T28] audit: type=1400 audit(1794329624.582:367): avc: denied { read } for pid=1835 comm="syz.7.581" name="/" dev="configfs" ino=10699 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 65.714306][ T28] audit: type=1400 audit(1794329624.582:368): avc: denied { open } for pid=1835 comm="syz.7.581" path="/" dev="configfs" ino=10699 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 65.733217][ T1839] ip_tables: iptables: counters copy to user failed while replacing table [ 65.741279][ T308] usb 10-1: config 7 has an invalid interface number: 222 but max is 0 [ 65.753562][ T308] usb 10-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 65.764093][ T308] usb 10-1: config 7 has no interface number 0 [ 65.770545][ T308] usb 10-1: config 7 interface 222 altsetting 64 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 65.784288][ T308] usb 10-1: config 7 interface 222 has no altsetting 0 [ 65.798441][ T308] usb 10-1: New USB device found, idVendor=0421, idProduct=042f, bcdDevice=b2.2c [ 65.814256][ T308] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 65.830165][ T308] usb 10-1: Product: syz [ 65.836728][ T308] usb 10-1: Manufacturer: syz [ 65.846839][ T308] usb 10-1: SerialNumber: syz [ 65.882664][ T1851] loop6: detected capacity change from 0 to 256 [ 65.898885][ T1851] exFAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 65.910944][ T1851] exFAT-fs (loop6): Medium has reported failures. Some data may be lost. [ 65.922134][ T1851] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 65.941504][ T28] audit: type=1400 audit(1794329624.852:369): avc: denied { read } for pid=1850 comm="syz.6.587" name="file1" dev="loop6" ino=1048834 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 66.060691][ T308] usb 10-1: bad CDC descriptors [ 66.066754][ T308] usb 10-1: USB disconnect, device number 2 [ 66.116013][ T1859] FAULT_INJECTION: forcing a failure. [ 66.116013][ T1859] name failslab, interval 1, probability 0, space 0, times 0 [ 66.129251][ T1859] CPU: 0 PID: 1859 Comm: syz.7.589 Not tainted syzkaller #0 [ 66.136606][ T1859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 66.146674][ T1859] Call Trace: [ 66.149966][ T1859] [ 66.153041][ T1859] __dump_stack+0x21/0x24 [ 66.157380][ T1859] dump_stack_lvl+0x110/0x170 [ 66.162063][ T1859] ? __cfi_dump_stack_lvl+0x8/0x8 [ 66.167099][ T1859] ? debug_smp_processor_id+0x17/0x20 [ 66.172512][ T1859] ? kasan_quarantine_put+0x34/0x190 [ 66.177810][ T1859] dump_stack+0x15/0x24 [ 66.181979][ T1859] should_fail_ex+0x3bf/0x510 [ 66.186685][ T1859] __should_failslab+0xac/0xf0 [ 66.191552][ T1859] should_failslab+0x9/0x20 [ 66.196067][ T1859] __kmem_cache_alloc_node+0x3d/0x2d0 [ 66.201459][ T1859] ? x509_key_preparse+0x222/0x6d0 [ 66.206610][ T1859] ? x509_key_preparse+0x222/0x6d0 [ 66.211854][ T1859] __kmalloc+0xa4/0x1e0 [ 66.216033][ T1859] x509_key_preparse+0x222/0x6d0 [ 66.221011][ T1859] asymmetric_key_preparse+0xaf/0x100 [ 66.226404][ T1859] key_create_or_update+0x43e/0x9f0 [ 66.231656][ T1859] ? __cfi_key_create_or_update+0x10/0x10 [ 66.237576][ T1859] ? __cfi_lookup_user_key+0x10/0x10 [ 66.242888][ T1859] ? __kasan_check_write+0x14/0x20 [ 66.248041][ T1859] __se_sys_add_key+0x34b/0x410 [ 66.252916][ T1859] ? __x64_sys_add_key+0xd0/0xd0 [ 66.257902][ T1859] ? ksys_write+0x1fa/0x260 [ 66.262474][ T1859] ? __kasan_check_write+0x14/0x20 [ 66.267605][ T1859] ? fpregs_restore_userregs+0x128/0x260 [ 66.273305][ T1859] __x64_sys_add_key+0xbf/0xd0 [ 66.278125][ T1859] x64_sys_call+0x6aa/0x9a0 [ 66.282640][ T1859] do_syscall_64+0x4c/0xa0 [ 66.287102][ T1859] ? clear_bhb_loop+0x30/0x80 [ 66.291796][ T1859] ? clear_bhb_loop+0x30/0x80 [ 66.296510][ T1859] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 66.302431][ T1859] RIP: 0033:0x7f11d31a8f19 [ 66.306857][ T1859] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 66.326485][ T1859] RSP: 002b:00007f11d3fb6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 66.334969][ T1859] RAX: ffffffffffffffda RBX: 00007f11d3425fa0 RCX: 00007f11d31a8f19 [ 66.342980][ T1859] RDX: 0000200000000600 RSI: 0000000000000000 RDI: 0000200000000380 [ 66.350997][ T1859] RBP: 00007f11d3237f6d R08: 000000003c326747 R09: 0000000000000000 [ 66.359025][ T1859] R10: 00000000000001d8 R11: 0000000000000246 R12: 0000000000000000 [ 66.367035][ T1859] R13: 00007f11d3426038 R14: 00007f11d3425fa0 R15: 00007ffc76c16f58 [ 66.375044][ T1859] [ 66.740492][ T1872] netlink: 'syz.6.594': attribute type 4 has an invalid length. [ 66.759698][ T1872] netlink: 'syz.6.594': attribute type 4 has an invalid length. [ 66.959943][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 66.978897][ T1879] loop9: detected capacity change from 0 to 40427 [ 66.995123][ T1879] F2FS-fs (loop9): Invalid log_blocksize (268), supports only 12 [ 67.004476][ T1879] F2FS-fs (loop9): Can't find valid F2FS filesystem in 1th superblock [ 67.020855][ T1879] F2FS-fs (loop9): invalid crc value [ 67.062180][ T1879] F2FS-fs (loop9): Found nat_bits in checkpoint [ 67.138826][ T1879] F2FS-fs (loop9): Try to recover 1th superblock, ret: 0 [ 67.146042][ T1879] F2FS-fs (loop9): Mounted with checkpoint version = 48b305e5 [ 67.516288][ T1904] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 67.745424][ T1909] loop1: detected capacity change from 0 to 1024 [ 67.772004][ T1909] EXT4-fs: Ignoring removed nomblk_io_submit option [ 67.794537][ T1909] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 67.823033][ T1917] sock: sock_set_timeout: `syz.0.610' (pid 1917) tries to set negative timeout [ 67.861420][ T1909] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 67.874169][ T1909] ext4 filesystem being mounted at /99/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 67.923258][ T287] EXT4-fs (loop1): unmounting filesystem. [ 68.024708][ T1933] af_packet: tpacket_rcv: packet too big, clamped from 1 to 4294967272. macoff=96 [ 68.076010][ T1936] loop6: detected capacity change from 0 to 512 [ 68.107476][ T1936] EXT4-fs: Ignoring removed nobh option [ 68.128038][ T1936] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 68.139078][ T1936] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a016c028, mo2=0002] [ 68.148910][ T1936] System zones: 1-12 [ 68.153752][ T1936] EXT4-fs error (device loop6): ext4_orphan_get:1431: comm syz.6.616: bad orphan inode 16 [ 68.164238][ T1936] EXT4-fs (loop6): Remounting filesystem read-only [ 68.170968][ T1936] ext4_test_bit(bit=15, block=4) = 0 [ 68.173485][ T1943] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.176558][ T1936] EXT4-fs (loop6): 1 orphan inode deleted [ 68.189229][ T1936] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 68.211866][ T28] audit: type=1400 audit(1794329627.122:370): avc: denied { mounton } for pid=1945 comm="syz.9.620" path="/34/file0" dev="tmpfs" ino=207 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 68.246769][ T857] EXT4-fs (loop6): unmounting filesystem. [ 68.301845][ T1958] loop7: detected capacity change from 0 to 16 [ 68.310430][ T1958] erofs: (device loop7): mounted with root inode @ nid 36. [ 68.322628][ T28] audit: type=1400 audit(1794329627.232:371): avc: denied { unlink } for pid=1957 comm="syz.7.625" name="file1" dev="overlay" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 68.353383][ T28] audit: type=1400 audit(1794329627.242:372): avc: denied { link } for pid=1957 comm="syz.7.625" name="#1b" dev="tmpfs" ino=508 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 68.375917][ T28] audit: type=1400 audit(1794329627.242:373): avc: denied { rename } for pid=1957 comm="syz.7.625" name="#1c" dev="tmpfs" ino=508 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 68.440149][ T1972] loop7: detected capacity change from 0 to 256 [ 68.458420][ T1973] Core dump to core aborted: cannot preserve file permissions [ 68.472596][ T882] FAT-fs (loop7): error, corrupted directory (invalid entries) [ 68.480813][ T882] FAT-fs (loop7): error, corrupted directory (invalid entries) [ 68.619502][ T1987] user requested TSC rate below hardware speed [ 68.645785][ T1992] xt_hashlimit: size too large, truncated to 1048576 [ 68.783135][ T1994] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.790558][ T1994] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.799660][ T1994] device bridge_slave_0 entered promiscuous mode [ 68.806282][ T28] audit: type=1400 audit(1794329627.712:374): avc: denied { nlmsg_read } for pid=2004 comm="syz.1.647" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 68.828923][ T1994] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.836659][ T1994] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.844752][ T1994] device bridge_slave_1 entered promiscuous mode [ 68.916147][ T1994] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.923279][ T1994] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.930628][ T1994] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.937685][ T1994] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.971325][ T337] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.979219][ T337] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.987894][ T337] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 68.995733][ T337] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 69.017950][ T337] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 69.026409][ T337] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.029957][ T1100] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 69.033516][ T337] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.049438][ T337] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 69.057850][ T337] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.064953][ T337] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.094200][ T337] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 69.103222][ T337] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 69.115291][ T2016] netlink: 4 bytes leftover after parsing attributes in process `syz.9.652'. [ 69.138940][ T2018] syz.1.653[2018] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 69.139086][ T2018] syz.1.653[2018] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 69.146529][ T2020] loop6: detected capacity change from 0 to 512 [ 69.173926][ T337] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 69.188200][ T337] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 69.198639][ T337] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 69.210597][ T337] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 69.223728][ T1994] device veth0_vlan entered promiscuous mode [ 69.246753][ T2025] xt_hashlimit: size too large, truncated to 1048576 [ 69.250034][ T1100] usb 1-1: Using ep0 maxpacket: 16 [ 69.263101][ T337] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 69.276102][ T1100] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 69.292806][ T1994] device veth1_macvtap entered promiscuous mode [ 69.294282][ T1100] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 69.315020][ T1100] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 69.325265][ T1100] usb 1-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 69.338196][ T337] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 69.351455][ T1100] usb 1-1: config 0 interface 0 has no altsetting 0 [ 69.358298][ T337] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 69.367082][ T1100] usb 1-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 69.376279][ T1100] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 69.391589][ T1100] usb 1-1: config 0 descriptor?? [ 69.644143][ T2054] ip_tables: iptables: counters copy to user failed while replacing table [ 69.688375][ T2062] loop3: detected capacity change from 0 to 512 [ 69.695471][ T2062] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 69.707481][ T2062] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2802: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 69.721456][ T2062] EXT4-fs (loop3): 1 truncate cleaned up [ 69.727316][ T2062] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 69.780264][ T1994] EXT4-fs (loop3): unmounting filesystem. [ 69.802992][ T1100] logitech-djreceiver 0003:046D:C53A.0004: hiddev96,hidraw0: USB HID vff.fc Device [HID 046d:c53a] on usb-dummy_hcd.0-1/input0 [ 69.817068][ T2073] loop9: detected capacity change from 0 to 512 [ 69.835381][ T2073] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: writeback. [ 69.836256][ T2079] netlink: 8 bytes leftover after parsing attributes in process `syz.3.678'. [ 69.851910][ T2073] ext4 filesystem being mounted at /44/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 69.878220][ T2081] EXT4-fs: Ignoring removed bh option [ 69.886420][ T1265] EXT4-fs (loop9): unmounting filesystem. [ 69.894783][ T2081] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a802c128, mo2=0002] [ 69.903236][ T2081] System zones: 1-12 [ 69.907910][ T2081] EXT4-fs (loop3): 1 truncate cleaned up [ 69.913868][ T2081] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 69.929987][ T28] audit: type=1400 audit(1794329628.832:375): avc: denied { remove_name } for pid=2080 comm="syz.3.679" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop3" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 69.990780][ T1994] EXT4-fs (loop3): unmounting filesystem. [ 69.991905][ T28] audit: type=1400 audit(1794329628.842:376): avc: denied { rename } for pid=2080 comm="syz.3.679" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop3" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 70.031141][ T1100] usb 1-1: USB disconnect, device number 2 [ 70.058671][ T43] Bluetooth: hci0: Frame reassembly failed (-84) [ 70.127385][ T2091] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d) [ 70.264147][ T2101] capability: warning: `syz.3.687' uses 32-bit capabilities (legacy support in use) [ 70.285476][ T2103] mmap: syz.3.688 (2103): VmData 29134848 exceed data ulimit 2. Update limits or use boot option ignore_rlimit_data. [ 70.344080][ T2110] set_capacity_and_notify: 2 callbacks suppressed [ 70.344100][ T2110] loop3: detected capacity change from 0 to 4096 [ 70.370070][ T2110] EXT4-fs (loop3): Test dummy encryption mode enabled [ 70.387118][ T2110] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 70.431169][ T1994] EXT4-fs (loop3): unmounting filesystem. [ 70.477376][ T2119] input: syz1 as /devices/virtual/input/input7 [ 70.625799][ T2133] loop1: detected capacity change from 0 to 512 [ 70.632748][ T2133] EXT4-fs: Ignoring removed bh option [ 70.655368][ T2133] EXT4-fs (loop1): warning: mounting unchecked fs, running e2fsck is recommended [ 70.665840][ T2133] EXT4-fs (loop1): 1 truncate cleaned up [ 70.671798][ T2133] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 70.695966][ T287] EXT4-fs (loop1): unmounting filesystem. [ 70.709524][ T28] kauditd_printk_skb: 3 callbacks suppressed [ 70.709539][ T28] audit: type=1400 audit(1794329629.612:380): avc: denied { wake_alarm } for pid=2140 comm="syz.6.704" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 70.785096][ T2151] loop1: detected capacity change from 0 to 1024 [ 70.804008][ T2151] EXT4-fs: Ignoring removed oldalloc option [ 70.817592][ T2155] loop6: detected capacity change from 0 to 128 [ 70.830860][ T2151] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 70.839126][ T2155] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 70.852004][ T2151] ext4 filesystem being mounted at /129/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 70.861578][ T2155] ext4 filesystem being mounted at /78/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 70.909084][ T2151] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.708: bg 0: block 112: padding at end of block bitmap is not set [ 70.924803][ T857] EXT4-fs (loop6): unmounting filesystem. [ 70.957070][ T309] EXT4-fs error (device loop1): ext4_map_blocks:747: inode #15: comm kworker/u4:3: lblock 0 mapped to illegal pblock 0 (length 1) [ 70.978241][ T309] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 70.991127][ T309] EXT4-fs (loop1): This should not happen!! Data will be lost [ 70.991127][ T309] [ 71.002701][ T287] EXT4-fs (loop1): unmounting filesystem. [ 71.104751][ T28] audit: type=1400 audit(1794329630.012:381): avc: denied { write } for pid=2170 comm="syz.1.714" name="functions" dev="configfs" ino=18168 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 71.131513][ T28] audit: type=1400 audit(1794329630.012:382): avc: denied { add_name } for pid=2170 comm="syz.1.714" name="midi2.0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 71.195700][ T2183] loop6: detected capacity change from 0 to 512 [ 71.214726][ T28] audit: type=1326 audit(1794329630.122:383): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2188 comm="syz.1.719" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f951a8f19 code=0x7ffc0000 [ 71.240522][ T28] audit: type=1326 audit(1794329630.122:384): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2188 comm="syz.1.719" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f951a8f19 code=0x7ffc0000 [ 71.268138][ T2189] loop1: detected capacity change from 0 to 512 [ 71.304908][ T2189] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 [ 71.321053][ T28] audit: type=1326 audit(1794329630.122:385): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2188 comm="syz.1.719" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f951a8f19 code=0x7ffc0000 [ 71.399855][ T28] audit: type=1326 audit(1794329630.122:386): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2188 comm="syz.1.719" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f951a8f19 code=0x7ffc0000 [ 71.454425][ T28] audit: type=1326 audit(1794329630.152:387): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2188 comm="syz.1.719" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f3f951a8f19 code=0x7ffc0000 [ 71.498290][ T28] audit: type=1326 audit(1794329630.152:388): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2188 comm="syz.1.719" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f951a8f19 code=0x7ffc0000 [ 71.531693][ T2198] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=3835797286 (7671594572 ns) > initial count (4918772610 ns). Using initial count to start timer. [ 71.558880][ T28] audit: type=1326 audit(1794329630.152:389): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2188 comm="syz.1.719" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f951a8f19 code=0x7ffc0000 [ 71.645531][ T2209] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.653455][ T2209] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.699238][ T2215] loop0: detected capacity change from 0 to 128 [ 71.723011][ T2217] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 71.822266][ T2230] loop6: detected capacity change from 0 to 16 [ 71.840613][ T2230] erofs: (device loop6): mounted with root inode @ nid 36. [ 71.899041][ T2234] netlink: 27 bytes leftover after parsing attributes in process `syz.6.737'. [ 71.923342][ T2236] netlink: 104 bytes leftover after parsing attributes in process `syz.6.738'. [ 72.079870][ T45] Bluetooth: hci0: command 0x1003 tx timeout [ 72.085978][ T1130] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 72.142748][ T2251] netlink: 8 bytes leftover after parsing attributes in process `syz.1.744'. [ 72.196036][ T2259] IPv4: Oversized IP packet from 127.202.26.0 [ 72.224211][ T2266] netlink: 4 bytes leftover after parsing attributes in process `syz.1.752'. [ 72.292916][ T2274] loop9: detected capacity change from 0 to 128 [ 72.310733][ T2274] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 72.320127][ T2274] ext4 filesystem being mounted at /49/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 72.369736][ T1265] EXT4-fs (loop9): unmounting filesystem. [ 72.666035][ T2304] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.673332][ T2304] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.823346][ T2327] A link change request failed with some changes committed already. Interface sit0 may have been left with an inconsistent configuration, please check. [ 72.844672][ T2331] SELinux: failed to load policy [ 72.973510][ T2337] netlink: 8 bytes leftover after parsing attributes in process `syz.6.777'. [ 73.001476][ T2337] IPv6: sit2: Disabled Multicast RS [ 73.058187][ T2344] loop1: detected capacity change from 0 to 4096 [ 73.099253][ T2344] EXT4-fs (loop1): Test dummy encryption mode enabled [ 73.144762][ T2344] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 73.200314][ T287] EXT4-fs (loop1): unmounting filesystem. [ 73.540786][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 73.602889][ T2385] device veth0_vlan left promiscuous mode [ 73.623269][ T2385] device veth0_vlan entered promiscuous mode [ 73.641791][ T2385] device veth1_macvtap left promiscuous mode [ 73.668593][ T2385] device veth1_macvtap entered promiscuous mode [ 73.725475][ T2345] F2FS-fs (loop3): Invalid segment/section count (458783, 24 x 150994945) [ 73.749933][ T2345] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 73.770792][ T2345] F2FS-fs (loop3): invalid crc value [ 73.797613][ T2345] F2FS-fs (loop3): Found nat_bits in checkpoint [ 73.858089][ T2345] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 73.865523][ T2345] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 73.890567][ T2401] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 73.905724][ T2401] ext4 filesystem being mounted at /29/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 73.940203][ T2401] EXT4-fs (loop0): unmounting filesystem. [ 74.005797][ T2410] netlink: 20 bytes leftover after parsing attributes in process `syz.0.805'. [ 74.091335][ T2345] F2FS-fs (loop3): f2fs_check_nid_range: out-of-range nid=60900, run fsck to fix. [ 74.124497][ T2345] F2FS-fs (loop3): f2fs_check_nid_range: out-of-range nid=60900, run fsck to fix. [ 75.387841][ T2427] set_capacity_and_notify: 2 callbacks suppressed [ 75.387862][ T2427] loop1: detected capacity change from 0 to 256 [ 75.532422][ T2433] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 75.545476][ T2433] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.552786][ T2433] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.684812][ T2449] loop9: detected capacity change from 0 to 16 [ 75.699976][ T2449] erofs: (device loop9): mounted with root inode @ nid 36. [ 75.716758][ T28] kauditd_printk_skb: 47 callbacks suppressed [ 75.716775][ T28] audit: type=1400 audit(1794329635.620:437): avc: denied { write } for pid=2447 comm="syz.9.822" name="file0" dev="overlay" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 75.745073][ T28] audit: type=1400 audit(1794329635.620:438): avc: denied { rename } for pid=2447 comm="syz.9.822" name="file1" dev="overlay" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 75.767757][ T28] audit: type=1400 audit(1794329635.620:439): avc: denied { add_name remove_name } for pid=2447 comm="syz.9.822" name="file0" dev="overlay" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 75.794472][ T2451] netlink: 8 bytes leftover after parsing attributes in process `syz.1.825'. [ 75.813510][ T28] audit: type=1400 audit(1794329635.620:440): avc: denied { create } for pid=2447 comm="syz.9.822" name="#21" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 75.857886][ T2466] loop0: detected capacity change from 0 to 128 [ 75.867801][ T2466] EXT4-fs: Ignoring removed mblk_io_submit option [ 75.874625][ T28] audit: type=1400 audit(1794329635.630:441): avc: denied { associate } for pid=2447 comm="syz.9.822" name="#21" scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 75.902021][ T28] audit: type=1400 audit(1794329635.630:442): avc: denied { setattr } for pid=2447 comm="syz.9.822" name="#21" dev="tmpfs" ino=411 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 75.926232][ T28] audit: type=1400 audit(1794329635.630:443): avc: denied { rename } for pid=2447 comm="syz.9.822" name="#21" dev="tmpfs" ino=411 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 75.926260][ T2466] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 75.948576][ T28] audit: type=1400 audit(1794329635.630:444): avc: denied { reparent } for pid=2447 comm="syz.9.822" name="#21" dev="tmpfs" ino=411 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 75.998451][ T28] audit: type=1400 audit(1794329635.630:445): avc: denied { write open } for pid=2447 comm="syz.9.822" path=2F202864656C6574656429 dev="tmpfs" ino=412 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 76.022609][ T28] audit: type=1400 audit(1794329635.630:446): avc: denied { setattr } for pid=2447 comm="syz.9.822" name="#412" dev="tmpfs" ino=412 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 76.045094][ T2466] ext4 filesystem being mounted at /34/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 76.089115][ T2466] Invalid argument reading file caps for ./file0 [ 76.115671][ T1787] EXT4-fs (loop0): unmounting filesystem. [ 76.190460][ T2483] loop9: detected capacity change from 0 to 2048 [ 76.202613][ T2483] ext4: Unknown parameter 'uid>00000000000000000000' [ 76.625557][ T2515] loop1: detected capacity change from 0 to 40427 [ 76.642829][ T2515] F2FS-fs (loop1): fault_injection options not supported [ 76.656966][ T2515] F2FS-fs (loop1): fault_type options not supported [ 76.671516][ T2515] F2FS-fs (loop1): invalid crc value [ 76.687322][ T2515] F2FS-fs (loop1): Found nat_bits in checkpoint [ 76.702388][ T2548] loop0: detected capacity change from 0 to 512 [ 76.738142][ T2515] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 76.802746][ T2557] loop6: detected capacity change from 0 to 1024 [ 76.826686][ T2557] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a002c118, mo2=0002] [ 76.836137][ T2557] System zones: 0-1, 3-12 [ 76.841243][ T2557] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 76.866251][ T857] EXT4-fs (loop6): unmounting filesystem. [ 76.881120][ T2561] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 76.957349][ T2577] loop1: detected capacity change from 0 to 512 [ 76.972673][ T2577] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 76.982170][ T2577] ext4 filesystem being mounted at /171/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 77.003497][ T287] EXT4-fs (loop1): unmounting filesystem. [ 77.047195][ T2588] tap0: tun_chr_ioctl cmd 1074025692 [ 77.253578][ T2600] loop1: detected capacity change from 0 to 256 [ 77.272537][ T2600] FAT-fs (loop1): Unrecognized mount option "utf8=xE6f8=" or missing value [ 77.467440][ T2615] loop9: detected capacity change from 0 to 512 [ 77.484886][ T2615] FAT-fs (loop9): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 77.567374][ T2626] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 77.623806][ T2628] netlink: 'syz.1.895': attribute type 4 has an invalid length. [ 77.665263][ T2628] netlink: 'syz.1.895': attribute type 4 has an invalid length. [ 77.884405][ T2667] FAULT_INJECTION: forcing a failure. [ 77.884405][ T2667] name failslab, interval 1, probability 0, space 0, times 0 [ 77.897186][ T2667] CPU: 0 PID: 2667 Comm: syz.6.913 Not tainted syzkaller #0 [ 77.904526][ T2667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 77.914607][ T2667] Call Trace: [ 77.917904][ T2667] [ 77.920848][ T2667] __dump_stack+0x21/0x24 [ 77.925199][ T2667] dump_stack_lvl+0x110/0x170 [ 77.929895][ T2667] ? __cfi_dump_stack_lvl+0x8/0x8 [ 77.934935][ T2667] dump_stack+0x15/0x24 [ 77.939104][ T2667] should_fail_ex+0x3bf/0x510 [ 77.943805][ T2667] ? security_inode_alloc+0x33/0x120 [ 77.949134][ T2667] __should_failslab+0xac/0xf0 [ 77.953927][ T2667] should_failslab+0x9/0x20 [ 77.958458][ T2667] kmem_cache_alloc+0x3b/0x320 [ 77.963270][ T2667] security_inode_alloc+0x33/0x120 [ 77.968417][ T2667] inode_init_always+0x6ee/0x950 [ 77.973379][ T2667] new_inode_pseudo+0xa2/0x1f0 [ 77.978166][ T2667] new_inode+0x28/0x1e0 [ 77.982351][ T2667] proc_pid_make_inode+0x24/0x1c0 [ 77.987407][ T2667] proc_fdinfo_instantiate+0x4f/0x1f0 [ 77.992821][ T2667] proc_fill_cache+0x1f3/0x3f0 [ 77.997607][ T2667] ? __cfi_proc_fdinfo_instantiate+0x10/0x10 [ 78.003607][ T2667] ? __cfi_proc_fill_cache+0x10/0x10 [ 78.008958][ T2667] ? __cfi_snprintf+0x10/0x10 [ 78.013669][ T2667] ? filldir64+0x428/0x640 [ 78.018145][ T2667] ? _raw_spin_unlock+0x4c/0x70 [ 78.023038][ T2667] ? task_lookup_next_fd_rcu+0x21b/0x2a0 [ 78.028691][ T2667] proc_readfd_common+0x432/0x600 [ 78.033732][ T2667] ? __cfi_proc_fdinfo_instantiate+0x10/0x10 [ 78.039738][ T2667] ? proc_open_fdinfo+0x20/0x20 [ 78.044603][ T2667] ? phys_pte_init+0x108/0x3b2 [ 78.049389][ T2667] ? __cfi_down_read_killable+0x10/0x10 [ 78.054975][ T2667] proc_readfdinfo+0x24/0x30 [ 78.059599][ T2667] iterate_dir+0x26d/0x610 [ 78.064056][ T2667] ? __cfi_proc_readfdinfo+0x10/0x10 [ 78.069357][ T2667] __se_sys_getdents64+0xf2/0x250 [ 78.074417][ T2667] ? __x64_sys_getdents64+0x90/0x90 [ 78.079661][ T2667] ? xfd_validate_state+0x70/0x150 [ 78.084796][ T2667] ? __cfi_filldir64+0x10/0x10 [ 78.089592][ T2667] ? fpregs_restore_userregs+0x128/0x260 [ 78.095273][ T2667] __x64_sys_getdents64+0x7b/0x90 [ 78.100331][ T2667] x64_sys_call+0x15c/0x9a0 [ 78.104861][ T2667] do_syscall_64+0x4c/0xa0 [ 78.109315][ T2667] ? clear_bhb_loop+0x30/0x80 [ 78.114018][ T2667] ? clear_bhb_loop+0x30/0x80 [ 78.118753][ T2667] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 78.124927][ T2667] RIP: 0033:0x7f2eb21a8f19 [ 78.129374][ T2667] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 78.149013][ T2667] RSP: 002b:00007f2eb315a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 78.157460][ T2667] RAX: ffffffffffffffda RBX: 00007f2eb2425fa0 RCX: 00007f2eb21a8f19 [ 78.165488][ T2667] RDX: 0000000000000ff9 RSI: 0000200000000400 RDI: 0000000000000004 [ 78.173485][ T2667] RBP: 00007f2eb2237f6d R08: 0000000000000000 R09: 0000000000000000 [ 78.181474][ T2667] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 78.189486][ T2667] R13: 00007f2eb2426038 R14: 00007f2eb2425fa0 R15: 00007fffeb99b428 [ 78.197502][ T2667] [ 78.327132][ T2681] overlayfs: failed to verify origin (48/mydev, ino=273, err=-116) [ 78.335270][ T2681] overlayfs: failed to verify upper root origin [ 78.418813][ T2696] ip_tables: iptables: counters copy to user failed while replacing table [ 78.588876][ T2706] netlink: 84 bytes leftover after parsing attributes in process `syz.1.929'. [ 78.608752][ T2701] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 78.772495][ T2701] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 78.788487][ T2701] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 994 with error 28 [ 78.801880][ T2701] EXT4-fs (loop0): This should not happen!! Data will be lost [ 78.801880][ T2701] [ 78.812009][ T2701] EXT4-fs (loop0): Total free blocks count 0 [ 78.818043][ T2701] EXT4-fs (loop0): Free/Dirty block details [ 78.824255][ T2701] EXT4-fs (loop0): free_blocks=4096 [ 78.829620][ T2701] EXT4-fs (loop0): dirty_blocks=1008 [ 78.835188][ T2701] EXT4-fs (loop0): Block reservation details [ 78.843268][ T2701] EXT4-fs (loop0): i_reserved_data_blocks=63 [ 78.912976][ T2737] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 78.933860][ T1787] EXT4-fs (loop0): unmounting filesystem. [ 78.970698][ T2737] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: writeback. [ 79.038830][ T2749] Zero length message leads to an empty skb [ 79.168144][ T1265] EXT4-fs (loop9): unmounting filesystem. [ 79.730441][ T2733] F2FS-fs (loop3): Test dummy encryption mode enabled [ 79.749750][ T2733] F2FS-fs (loop3): invalid crc value [ 79.790408][ T2796] netlink: 4 bytes leftover after parsing attributes in process `syz.0.966'. [ 79.799644][ T2733] F2FS-fs (loop3): Found nat_bits in checkpoint [ 79.816234][ T2790] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 79.841120][ T2790] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 79.859690][ T2790] F2FS-fs (loop1): invalid crc value [ 79.882066][ T2733] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 79.895092][ T2790] F2FS-fs (loop1): Found nat_bits in checkpoint [ 79.980743][ T2790] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 79.988632][ T2790] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 80.021875][ T2822] input: syz0 as /devices/virtual/input/input8 [ 80.185637][ T2830] ip_tables: iptables: counters copy to user failed while replacing table [ 80.528076][ T2855] set_capacity_and_notify: 5 callbacks suppressed [ 80.528097][ T2855] loop9: detected capacity change from 0 to 256 [ 80.560412][ T2855] exfat: Deprecated parameter 'utf8' [ 80.578657][ T2855] exFAT-fs (loop9): failed to load upcase table (idx : 0x0001fe89, chksum : 0xc374f927, utbl_chksum : 0xe619d30d) [ 80.875592][ T28] kauditd_printk_skb: 675 callbacks suppressed [ 80.875609][ T28] audit: type=1400 audit(1794329640.780:1122): avc: denied { create } for pid=2868 comm="syz.9.993" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 80.902758][ T28] audit: type=1400 audit(1794329640.780:1123): avc: denied { write } for pid=2868 comm="syz.9.993" name="file0" dev="tmpfs" ino=617 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 80.932847][ T28] audit: type=1400 audit(1794329640.780:1124): avc: denied { open } for pid=2868 comm="syz.9.993" path="/110/file0" dev="tmpfs" ino=617 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 80.961019][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 80.980070][ T28] audit: type=1400 audit(1794329640.780:1125): avc: denied { ioctl } for pid=2868 comm="syz.9.993" path="/110/file0" dev="tmpfs" ino=617 ioctlcmd=0x1285 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 81.011027][ T28] audit: type=1400 audit(1794329640.830:1126): avc: denied { unlink } for pid=1265 comm="syz-executor" name="file0" dev="tmpfs" ino=617 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 81.141108][ T2889] netlink: 108 bytes leftover after parsing attributes in process `syz.0.999'. [ 81.266186][ T28] audit: type=1400 audit(1794329641.170:1127): avc: denied { remount } for pid=2899 comm="syz.0.1004" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 81.456039][ T2917] loop6: detected capacity change from 0 to 512 [ 81.465019][ T2917] EXT4-fs (loop6): mounting ext3 file system using the ext4 subsystem [ 81.473543][ T2917] EXT4-fs (loop6): invalid journal inode [ 81.479299][ T2917] EXT4-fs (loop6): can't get journal size [ 81.487035][ T2917] EXT4-fs (loop6): 1 truncate cleaned up [ 81.493211][ T2917] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 81.502826][ T28] audit: type=1400 audit(1794329641.410:1128): avc: denied { mounton } for pid=2916 comm="syz.6.1011" path="/149/file1/file0" dev="loop6" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 81.508100][ T2917] incfs_lookup_dentry err:-13 [ 81.527631][ T28] audit: type=1400 audit(1794329641.410:1129): avc: denied { ioctl } for pid=2916 comm="syz.6.1011" path="/149/file1/file0/.pending_reads" dev="incremental-fs" ino=2 ioctlcmd=0x671e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 81.559635][ T28] audit: type=1400 audit(1794329641.460:1130): avc: denied { rmdir } for pid=857 comm="syz-executor" name="lost+found" dev="loop6" ino=11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 81.584156][ T28] audit: type=1400 audit(1794329641.490:1131): avc: denied { unlink } for pid=857 comm="syz-executor" name="file1" dev="loop6" ino=14 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 81.608080][ T857] EXT4-fs (loop6): unmounting filesystem. [ 81.618102][ T2921] loop1: detected capacity change from 0 to 1024 [ 81.631489][ T2921] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 81.646663][ T2923] x86/PAT: syz.6.1012:2923 freeing invalid memtype [mem 0xfe004000-0xfe004fff] [ 81.662005][ T2921] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 81.697524][ T287] EXT4-fs (loop1): unmounting filesystem. [ 81.735802][ T2935] FAULT_INJECTION: forcing a failure. [ 81.735802][ T2935] name failslab, interval 1, probability 0, space 0, times 0 [ 81.748632][ T2935] CPU: 0 PID: 2935 Comm: syz.6.1018 Not tainted syzkaller #0 [ 81.756090][ T2935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 81.766230][ T2935] Call Trace: [ 81.769543][ T2935] [ 81.772501][ T2935] __dump_stack+0x21/0x24 [ 81.776924][ T2935] dump_stack_lvl+0x110/0x170 [ 81.781644][ T2935] ? __cfi_dump_stack_lvl+0x8/0x8 [ 81.786767][ T2935] ? do_futex+0x2e2/0x430 [ 81.791151][ T2935] dump_stack+0x15/0x24 [ 81.795349][ T2935] should_fail_ex+0x3bf/0x510 [ 81.800078][ T2935] ? ioctx_alloc+0x10d/0x720 [ 81.804716][ T2935] __should_failslab+0xac/0xf0 [ 81.809529][ T2935] should_failslab+0x9/0x20 [ 81.814075][ T2935] kmem_cache_alloc+0x3b/0x320 [ 81.818886][ T2935] ? __bitmap_weight+0xb9/0x110 [ 81.823876][ T2935] ? __x64_sys_futex+0x100/0x100 [ 81.828881][ T2935] ioctx_alloc+0x10d/0x720 [ 81.833348][ T2935] __se_sys_io_setup+0x6f/0x230 [ 81.838241][ T2935] __x64_sys_io_setup+0x5b/0x70 [ 81.843136][ T2935] x64_sys_call+0x840/0x9a0 [ 81.847684][ T2935] do_syscall_64+0x4c/0xa0 [ 81.852134][ T2935] ? clear_bhb_loop+0x30/0x80 [ 81.856857][ T2935] ? clear_bhb_loop+0x30/0x80 [ 81.861592][ T2935] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 81.867526][ T2935] RIP: 0033:0x7f2eb21a8f19 [ 81.871979][ T2935] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 81.891629][ T2935] RSP: 002b:00007f2eb315a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ce [ 81.900088][ T2935] RAX: ffffffffffffffda RBX: 00007f2eb2425fa0 RCX: 00007f2eb21a8f19 [ 81.908132][ T2935] RDX: 0000000000000000 RSI: 0000200000000ac0 RDI: 0000000000000de1 [ 81.916149][ T2935] RBP: 00007f2eb2237f6d R08: 0000000000000000 R09: 0000000000000000 [ 81.924162][ T2935] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 81.932218][ T2935] R13: 00007f2eb2426038 R14: 00007f2eb2425fa0 R15: 00007fffeb99b428 [ 81.940252][ T2935] [ 81.969235][ T2948] sock: sock_timestamping_bind_phc: sock not bind to device [ 82.222178][ T2986] loop0: detected capacity change from 0 to 1024 [ 82.253942][ T2986] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 82.316512][ T2986] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 82.539044][ T3026] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1059'. [ 82.609185][ T3030] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 82.702705][ T1787] EXT4-fs (loop0): unmounting filesystem. [ 82.722100][ T3035] kvm: pic: non byte write [ 82.740060][ T3035] kvm: MWAIT instruction emulated as NOP! [ 82.747703][ T3044] Bluetooth: ISO socket layer initialized [ 82.879910][ T3054] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=262 sclass=netlink_route_socket pid=3054 comm=syz.6.1071 [ 83.011701][ T3062] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1074'. [ 84.327173][ T3071] loop6: detected capacity change from 0 to 2048 [ 84.391782][ T3071] loop6: p1 < > p3 p4 < p5 > [ 84.406323][ T3071] loop6: p3 size 467968 extends beyond EOD, truncated [ 84.426742][ T3071] loop6: p5 size 467968 extends beyond EOD, truncated [ 84.587968][ T3093] loop3: detected capacity change from 0 to 512 [ 84.673791][ T3102] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 84.727748][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 84.752377][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 84.775855][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 84.800251][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 84.818755][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 84.837337][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 84.855892][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 84.874585][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 84.890278][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 84.953497][ T3119] netlink: 'syz.6.1100': attribute type 9 has an invalid length. [ 85.300562][ T3080] loop0: detected capacity change from 0 to 131072 [ 85.313162][ T3080] F2FS-fs (loop0): Invalid segment/section count (458783, 24 x 150994945) [ 85.326300][ T3080] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 85.342186][ T3080] F2FS-fs (loop0): invalid crc value [ 85.371461][ T3080] F2FS-fs (loop0): Found nat_bits in checkpoint [ 85.381377][ T3148] loop1: detected capacity change from 0 to 8192 [ 85.468570][ T3080] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 85.479081][ T3080] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 85.516841][ T3162] loop1: detected capacity change from 0 to 512 [ 85.556528][ T3162] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 85.568801][ T3162] ext4 filesystem being mounted at /230/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 85.733123][ T3169] loop6: detected capacity change from 0 to 2048 [ 85.774695][ T3169] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 85.832353][ T857] EXT4-fs (loop6): unmounting filesystem. [ 85.901428][ T28] kauditd_printk_skb: 13 callbacks suppressed [ 85.901444][ T28] audit: type=1400 audit(1794329645.810:1145): avc: denied { sqpoll } for pid=3175 comm="syz.9.1121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 85.962535][ T3181] loop9: detected capacity change from 0 to 128 [ 85.967460][ T28] audit: type=1400 audit(1794329645.840:1146): avc: denied { map } for pid=3161 comm="syz.1.1116" path="/230/bus/memory.events.local" dev="loop1" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 86.000431][ T3181] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a002c018, mo2=0002] [ 86.018650][ T3181] System zones: 1-3, 19-19, 35-36 [ 86.024574][ T3181] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 86.037846][ T3184] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 86.044936][ T3181] ext4 filesystem being mounted at /132/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 86.110443][ T1265] EXT4-fs (loop9): unmounting filesystem. [ 86.118809][ T287] EXT4-fs (loop1): unmounting filesystem. [ 86.135459][ T3188] loop9: detected capacity change from 0 to 1024 [ 86.159609][ T3188] EXT4-fs: Invalid commit interval 2146488486, must be smaller than 21474836 [ 86.186686][ T3194] loop1: detected capacity change from 0 to 128 [ 86.222225][ T3194] EXT4-fs: Ignoring removed bh option [ 86.242383][ T3194] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 86.260213][ T3194] ext4 filesystem being mounted at /231/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 86.280957][ T28] audit: type=1400 audit(1794329646.190:1147): avc: denied { mounton } for pid=3193 comm="syz.1.1126" path="/231/mnt/bus" dev="loop1" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 86.349889][ T3194] loop1: detected capacity change from 128 to 64 [ 86.386237][ T3200] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5954: Out of memory [ 86.417596][ T3203] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1130'. [ 86.427003][ T3200] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5954: Out of memory [ 86.449327][ T3200] EXT4-fs error (device loop1): ext4_evict_inode:281: inode #13: comm syz.1.1126: mark_inode_dirty error [ 86.468389][ T3203] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 86.501934][ T3200] EXT4-fs warning (device loop1): ext4_evict_inode:284: couldn't mark inode dirty (err -12) [ 86.584609][ T3215] loop6: detected capacity change from 0 to 1024 [ 86.621298][ T3215] EXT4-fs: Ignoring removed nobh option [ 86.632846][ T3215] EXT4-fs: Ignoring removed oldalloc option [ 86.639164][ T3215] EXT4-fs: Ignoring removed orlov option [ 86.672044][ T3215] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 86.703529][ T3215] EXT4-fs error (device loop6): __ext4_new_inode:1291: comm syz.6.1135: failed to insert inode 12: doubly allocated? [ 86.716342][ T3215] EXT4-fs error (device loop6) in ext4_free_inode:362: Corrupt filesystem [ 86.734900][ T857] EXT4-fs (loop6): unmounting filesystem. [ 86.779975][ T60] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 86.805455][ T287] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5954: Out of memory [ 86.814954][ T287] EXT4-fs error (device loop1): ext4_dirty_inode:6158: inode #2: comm syz-executor: mark_inode_dirty error [ 86.828252][ T287] EXT4-fs (loop1): unmounting filesystem. [ 86.922734][ T3237] 9pnet: p9_errstr2errno: server reported unknown error n [ 86.922734][ T3237] 秷iFM0x0000000000000003 [ 86.952161][ T3239] loop6: detected capacity change from 0 to 256 [ 86.966527][ T3239] exfat: Deprecated parameter 'utf8' [ 86.975484][ T3239] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0x488b7802, utbl_chksum : 0xe619d30d) [ 86.995273][ T28] audit: type=1400 audit(1794329646.900:1148): avc: denied { setattr } for pid=3238 comm="syz.6.1147" name="file0" dev="loop6" ino=1048868 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 87.018387][ T60] usb 1-1: Using ep0 maxpacket: 32 [ 87.025340][ T60] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 87.041172][ T60] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 87.069885][ T60] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 87.078988][ T60] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.088380][ T2205] device bridge_slave_1 left promiscuous mode [ 87.090227][ T60] usb 1-1: config 0 descriptor?? [ 87.099720][ T2205] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.107470][ T2205] device bridge_slave_0 left promiscuous mode [ 87.108894][ T60] hub 1-1:0.0: USB hub found [ 87.113978][ T2205] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.126813][ T2205] device veth1_macvtap left promiscuous mode [ 87.133413][ T2205] device veth0_vlan left promiscuous mode [ 87.233786][ T3240] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.241090][ T3240] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.248775][ T3240] device bridge_slave_0 entered promiscuous mode [ 87.256710][ T3240] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.263993][ T3240] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.272570][ T3240] device bridge_slave_1 entered promiscuous mode [ 87.309696][ T60] hub 1-1:0.0: config failed, can't read hub descriptor (err -22) [ 87.376803][ T3240] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.383946][ T3240] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.391318][ T3240] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.398382][ T3240] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.428948][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 87.437621][ T2204] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.445646][ T2204] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.463635][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 87.472800][ T2204] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.479910][ T2204] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.487954][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 87.497759][ T2204] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.504871][ T2204] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.522423][ T60] hid-generic 0003:046D:C31C.0005: item fetching failed at offset 0/1 [ 87.540086][ T60] hid-generic: probe of 0003:046D:C31C.0005 failed with error -22 [ 87.550326][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 87.561113][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 87.569329][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 87.581209][ T3240] device veth0_vlan entered promiscuous mode [ 87.587882][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 87.596049][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 87.604662][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 87.613074][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 87.628463][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 87.637216][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 87.647014][ T3240] device veth1_macvtap entered promiscuous mode [ 87.667369][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 87.678183][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 87.689212][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 87.712385][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 87.719038][ T3282] loop9: detected capacity change from 0 to 256 [ 87.734258][ T2204] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 87.743677][ T3282] exFAT-fs (loop9): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 87.762810][ T3282] exFAT-fs (loop9): Medium has reported failures. Some data may be lost. [ 87.768585][ T3284] FAULT_INJECTION: forcing a failure. [ 87.768585][ T3284] name fail_futex, interval 1, probability 0, space 0, times 0 [ 87.781848][ T3282] exFAT-fs (loop9): failed to load upcase table (idx : 0x0000ff98, chksum : 0x84a6b859, utbl_chksum : 0xe619d30d) [ 87.792523][ T3284] CPU: 1 PID: 3284 Comm: syz.3.1165 Not tainted syzkaller #0 [ 87.803674][ T3284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 87.813771][ T3284] Call Trace: [ 87.817080][ T3284] [ 87.820039][ T3284] __dump_stack+0x21/0x24 [ 87.824402][ T3284] dump_stack_lvl+0x110/0x170 [ 87.829119][ T3284] ? __cfi_dump_stack_lvl+0x8/0x8 [ 87.834213][ T3284] ? __switch_to+0x56f/0x1070 [ 87.838946][ T3284] dump_stack+0x15/0x24 [ 87.843140][ T3284] should_fail_ex+0x3bf/0x510 [ 87.847873][ T3284] should_fail+0xb/0x10 [ 87.852072][ T3284] get_futex_key+0x143/0xb10 [ 87.856718][ T3284] ? _raw_spin_unlock+0x4c/0x70 [ 87.861616][ T3284] ? __cfi_get_futex_key+0x10/0x10 [ 87.866767][ T3284] ? __schedule+0xcbb/0x1700 [ 87.871373][ T3284] ? futex_setup_timer+0xb0/0xc0 [ 87.876330][ T3284] futex_wait_requeue_pi+0x2af/0x9b0 [ 87.881636][ T3284] ? __cfi_futex_wait_requeue_pi+0x10/0x10 [ 87.887461][ T3284] ? futex_unqueue+0x132/0x160 [ 87.892285][ T3284] ? __cfi_futex_wait+0x10/0x10 [ 87.897224][ T3284] ? __cfi_futex_wake+0x10/0x10 [ 87.902095][ T3284] ? vfs_write+0xa51/0xd00 [ 87.906604][ T3284] do_futex+0x188/0x430 [ 87.910802][ T3284] ? __cfi_do_futex+0x10/0x10 [ 87.915506][ T3284] ? __kasan_check_write+0x14/0x20 [ 87.920688][ T3284] ? mutex_unlock+0x8f/0x230 [ 87.925347][ T3284] __se_sys_futex+0x136/0x310 [ 87.930068][ T3284] ? __x64_sys_futex+0x100/0x100 [ 87.935032][ T3284] ? xfd_validate_state+0x70/0x150 [ 87.940174][ T3284] ? __kasan_check_write+0x14/0x20 [ 87.945321][ T3284] __x64_sys_futex+0xe5/0x100 [ 87.950023][ T3284] x64_sys_call+0x7ec/0x9a0 [ 87.954573][ T3284] do_syscall_64+0x4c/0xa0 [ 87.959007][ T3284] ? clear_bhb_loop+0x30/0x80 [ 87.963705][ T3284] ? clear_bhb_loop+0x30/0x80 [ 87.968418][ T3284] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 87.974352][ T3284] RIP: 0033:0x7fab515a8f19 [ 87.978782][ T3284] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.998407][ T3284] RSP: 002b:00007fab524cd028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 88.006849][ T3284] RAX: ffffffffffffffda RBX: 00007fab51825fa0 RCX: 00007fab515a8f19 [ 88.014839][ T3284] RDX: 0000000000000001 RSI: 000000000000000b RDI: 0000000000000000 [ 88.022827][ T3284] RBP: 00007fab51637f6d R08: 0000200000000700 R09: 0000000000000001 [ 88.030816][ T3284] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 88.038934][ T3284] R13: 00007fab51826038 R14: 00007fab51825fa0 R15: 00007ffe9c7c03a8 [ 88.046955][ T3284] [ 88.053104][ T40] usb 1-1: USB disconnect, device number 3 [ 88.221207][ T28] audit: type=1400 audit(1794329648.130:1149): avc: denied { create } for pid=3296 comm="syz.3.1169" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 88.250882][ T28] audit: type=1400 audit(1794329648.130:1150): avc: denied { module_request } for pid=3296 comm="syz.3.1169" kmod="net-pf-21" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 88.507920][ T3318] loop0: detected capacity change from 0 to 512 [ 88.529094][ T3322] loop9: detected capacity change from 0 to 256 [ 88.547663][ T3322] FAT-fs (loop9): Directory bread(block 1285) failed [ 88.558601][ T3318] EXT4-fs (loop0): Test dummy encryption mode enabled [ 88.580375][ T3322] FAT-fs (loop9): Directory bread(block 1286) failed [ 88.598751][ T3318] EXT4-fs error (device loop0): ext4_orphan_get:1405: inode #15: comm syz.0.1177: inode has both inline data and extents flags [ 88.612163][ T3322] FAT-fs (loop9): Directory bread(block 1287) failed [ 88.618972][ T3322] FAT-fs (loop9): Directory bread(block 1288) failed [ 88.638348][ T3322] FAT-fs (loop9): FAT read failed (blocknr 1281) [ 88.650621][ T3318] EXT4-fs error (device loop0): ext4_orphan_get:1410: comm syz.0.1177: couldn't read orphan inode 15 (err -117) [ 88.693203][ T3318] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 88.763844][ T1787] EXT4-fs (loop0): unmounting filesystem. [ 89.068063][ T3367] xt_hashlimit: size too large, truncated to 1048576 [ 89.212053][ T3365] F2FS-fs (loop9): invalid crc value [ 89.237984][ T3365] F2FS-fs (loop9): Found nat_bits in checkpoint [ 89.335130][ T3365] F2FS-fs (loop9): Start checkpoint disabled! [ 89.360358][ T3365] F2FS-fs (loop9): f2fs_disable_checkpoint() finish, err:0 [ 89.379879][ T3365] F2FS-fs (loop9): Mounted with checkpoint version = 48b305e6 [ 89.465908][ T2204] kworker/u4:6: attempt to access beyond end of device [ 89.465908][ T2204] loop9: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 89.589404][ T3385] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 89.612183][ T3385] EXT4-fs error (device loop6): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 89.637279][ T3385] EXT4-fs (loop6): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 89.649759][ T3385] EXT4-fs (loop6): This should not happen!! Data will be lost [ 89.649759][ T3385] [ 89.659955][ T3385] EXT4-fs (loop6): Total free blocks count 0 [ 89.666051][ T3385] EXT4-fs (loop6): Free/Dirty block details [ 89.672427][ T3385] EXT4-fs (loop6): free_blocks=4096 [ 89.677693][ T3385] EXT4-fs (loop6): dirty_blocks=64 [ 89.683344][ T3385] EXT4-fs (loop6): Block reservation details [ 89.689519][ T3385] EXT4-fs (loop6): i_reserved_data_blocks=4 [ 89.725822][ T2204] EXT4-fs (loop6): Delayed block allocation failed for inode 15 at logical offset 31 with max blocks 33 with error 28 [ 89.865690][ T3398] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 89.886017][ T3398] ext4 filesystem being mounted at /208/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 94.381684][ T857] EXT4-fs (loop6): unmounting filesystem. [ 94.406488][ T3404] set_capacity_and_notify: 3 callbacks suppressed [ 94.406509][ T3404] loop9: detected capacity change from 0 to 512 [ 94.437129][ T3410] device veth0 entered promiscuous mode [ 94.459224][ T3404] EXT4-fs error (device loop9): ext4_validate_block_bitmap:429: comm syz.9.1211: bg 0: block 5: invalid block bitmap [ 94.485936][ T3404] EXT4-fs error (device loop9) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 94.505464][ T3404] EXT4-fs error (device loop9): ext4_free_branches:1030: inode #11: comm syz.9.1211: invalid indirect mapped block 3 (level 2) [ 94.529002][ T3404] EXT4-fs (loop9): 1 orphan inode deleted [ 94.549087][ T3404] EXT4-fs (loop9): 1 truncate cleaned up [ 94.572537][ T3404] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: writeback. [ 94.626911][ T3404] fscrypt (loop9, inode 11): Direct key flag not allowed with different contents and filenames modes [ 94.655257][ T1265] EXT4-fs (loop9): unmounting filesystem. [ 94.764113][ T3447] ------------[ cut here ]------------ [ 94.769677][ T3447] WARNING: CPU: 1 PID: 3447 at mm/page_alloc.c:5902 __alloc_pages+0x2cc/0x610 [ 94.778742][ T3447] Modules linked in: [ 94.782808][ T3447] CPU: 1 PID: 3447 Comm: syz.8.1227 Not tainted syzkaller #0 [ 94.790342][ T3447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 94.800699][ T3447] RIP: 0010:__alloc_pages+0x2cc/0x610 [ 94.806709][ T3447] Code: 0c 25 28 00 00 00 48 3b 8c 24 e0 00 00 00 0f 85 a3 00 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 c6 05 1c 89 dd 05 01 <0f> 0b eb 8f a9 00 00 08 00 48 8b 54 24 10 75 17 44 89 f6 81 e6 7f [ 94.826490][ T3447] RSP: 0018:ffffc9000178f5a0 EFLAGS: 00010246 [ 94.832630][ T3447] RAX: ffffc9000178f600 RBX: 0000000000000016 RCX: 0000000000000000 [ 94.840674][ T3447] RDX: 0000000000000018 RSI: 0000000000000000 RDI: ffffc9000178f628 [ 94.848696][ T3447] RBP: ffffc9000178f6d0 R08: ffffc9000178f627 R09: ffffc9000178f610 [ 94.856763][ T3447] R10: dffffc0000000000 R11: fffff520002f1ec5 R12: dffffc0000000000 [ 94.864801][ T3447] R13: 0000000000000000 R14: 0000000000040dc0 R15: 1ffff920002f1eb8 [ 94.872868][ T3447] FS: 00007fa7fbd056c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 94.881868][ T3447] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.888485][ T3447] CR2: 0000200000001000 CR3: 00000001501de000 CR4: 00000000003506a0 [ 94.896554][ T3447] DR0: 0000000000000000 DR1: 0000000000008000 DR2: 0000000000000000 [ 94.904805][ T3447] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 94.912988][ T3447] Call Trace: [ 94.916299][ T3447] [ 94.919262][ T3447] ? __cfi___alloc_pages+0x10/0x10 [ 94.924494][ T3447] __kmalloc_large_node+0xa1/0x1c0 [ 94.929650][ T3447] ? hashtab_init+0xca/0x160 [ 94.934335][ T3447] __kmalloc+0xe3/0x1e0 [ 94.938525][ T3447] hashtab_init+0xca/0x160 [ 94.943021][ T3447] symtab_init+0x40/0x60 [ 94.947303][ T3447] class_read+0x1fa/0xa80 [ 94.951719][ T3447] ? __kasan_kmalloc+0x95/0xb0 [ 94.956544][ T3447] ? __cfi_class_read+0x10/0x10 [ 94.961562][ T3447] ? hashtab_init+0xf0/0x160 [ 94.966322][ T3447] ? __cfi_class_read+0x10/0x10 [ 94.971260][ T3447] policydb_read+0xb21/0x25c0 [ 94.974464][ T3463] bridge0: port 3(syz_tun) entered blocking state [ 94.976025][ T3447] ? __cfi_policydb_read+0x10/0x10 [ 94.987724][ T3447] ? __kasan_kmalloc+0x95/0xb0 [ 94.992596][ T3447] ? security_load_policy+0x120/0xeb0 [ 94.998006][ T3447] ? kmalloc_trace+0x40/0xb0 [ 95.001135][ T3463] bridge0: port 3(syz_tun) entered disabled state [ 95.002685][ T3447] security_load_policy+0x15b/0xeb0 [ 95.014375][ T3447] ? irqentry_exit+0x37/0x40 [ 95.019028][ T3447] ? exc_page_fault+0x5e/0xb0 [ 95.024054][ T3447] ? asm_exc_page_fault+0x27/0x30 [ 95.029213][ T3447] ? __cfi_security_load_policy+0x10/0x10 [ 95.035019][ T3447] ? copy_user_enhanced_fast_string+0xa/0x40 [ 95.041089][ T3463] device syz_tun entered promiscuous mode [ 95.041105][ T3447] sel_write_load+0x386/0x600 [ 95.051598][ T3447] ? __cfi_sel_write_load+0x10/0x10 [ 95.056848][ T3447] ? security_file_permission+0x94/0xb0 [ 95.062520][ T3447] ? __cfi_sel_write_load+0x10/0x10 [ 95.063506][ T3463] bridge0: port 3(syz_tun) entered blocking state [ 95.067748][ T3447] vfs_write+0x3fb/0xd00 [ 95.067780][ T3447] ? __cfi_vfs_write+0x10/0x10 [ 95.074242][ T3463] bridge0: port 3(syz_tun) entered forwarding state [ 95.078497][ T3447] ? __kasan_check_write+0x14/0x20 [ 95.095048][ T3447] ? mutex_lock+0x93/0x1b0 [ 95.099527][ T3447] ? __cfi_mutex_lock+0x10/0x10 [ 95.104482][ T3447] ? __fdget_pos+0x2cd/0x380 [ 95.109115][ T3447] ? ksys_write+0x70/0x260 [ 95.113617][ T3447] ksys_write+0x14a/0x260 [ 95.117985][ T3447] ? __cfi_ksys_write+0x10/0x10 [ 95.123095][ T3447] ? fpregs_restore_userregs+0x128/0x260 [ 95.128773][ T3447] __x64_sys_write+0x7b/0x90 [ 95.133477][ T3447] x64_sys_call+0x27b/0x9a0 [ 95.138025][ T3447] do_syscall_64+0x4c/0xa0 [ 95.142691][ T3447] ? clear_bhb_loop+0x30/0x80 [ 95.147432][ T3447] ? clear_bhb_loop+0x30/0x80 [ 95.152197][ T3447] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 95.158138][ T3447] RIP: 0033:0x7fa7fada8f19 [ 95.162627][ T3447] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.182304][ T3447] RSP: 002b:00007fa7fbd05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.190816][ T3447] RAX: ffffffffffffffda RBX: 00007fa7fb025fa0 RCX: 00007fa7fada8f19 [ 95.198826][ T3447] RDX: 0000000000002000 RSI: 0000200000000000 RDI: 0000000000000003 [ 95.206888][ T3447] RBP: 00007fa7fae37f6d R08: 0000000000000000 R09: 0000000000000000 [ 95.214929][ T3447] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.222980][ T3447] R13: 00007fa7fb026038 R14: 00007fa7fb025fa0 R15: 00007ffd8f4d3c38 [ 95.231034][ T3447] [ 95.234090][ T3447] ---[ end trace 0000000000000000 ]--- [ 95.239740][ T3447] SELinux: failed to load policy [ 95.305442][ T3472] loop8: detected capacity change from 0 to 2048 [ 95.324972][ T3472] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 95.335307][ T3472] ext4 filesystem being mounted at /10/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 95.357566][ T3472] EXT4-fs error (device loop8): ext4_validate_block_bitmap:438: comm syz.8.1234: bg 0: block 152: padding at end of block bitmap is not set [ 95.372563][ T3472] fs-verity (loop8, inode 13): Error -28 writing Merkle tree block 1 [ 95.380948][ T3472] fs-verity (loop8, inode 13): Error -28 building Merkle tree [ 95.423909][ T3240] EXT4-fs (loop8): unmounting filesystem. [ 95.478839][ T309] Bluetooth: hci0: Frame reassembly failed (-84) [ 95.549068][ T3501] ip_tables: iptables: counters copy to user failed while replacing table [ 95.605690][ T3504] loop0: detected capacity change from 0 to 512 [ 95.622719][ T3504] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 95.660570][ T3504] EXT4-fs (loop0): 1 truncate cleaned up [ 95.666872][ T3504] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 95.701802][ T28] audit: type=1400 audit(1794329655.610:1151): avc: denied { read write } for pid=3513 comm="syz.3.1251" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 95.730182][ T28] audit: type=1400 audit(1794329655.630:1152): avc: denied { open } for pid=3513 comm="syz.3.1251" path="/dev/raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 95.754023][ T28] audit: type=1400 audit(1794329655.630:1153): avc: denied { ioctl } for pid=3513 comm="syz.3.1251" path="/dev/raw-gadget" dev="devtmpfs" ino=258 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 95.821661][ T1787] EXT4-fs (loop0): unmounting filesystem. [ 95.845841][ T3517] loop0: detected capacity change from 0 to 1024 [ 95.869596][ T3517] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 95.919793][ T1787] EXT4-fs (loop0): unmounting filesystem. [ 95.937286][ T3526] loop0: detected capacity change from 0 to 512 [ 95.945143][ T3526] EXT4-fs: Ignoring removed nobh option [ 95.951036][ T3526] EXT4-fs: quotafile must be on filesystem root [ 95.958680][ T28] audit: type=1400 audit(1794329655.860:1154): avc: denied { write } for pid=3525 comm="syz.0.1255" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 95.999867][ T2319] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 96.201681][ T2319] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 96.211598][ T2319] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 96.224437][ T2319] usb 4-1: config 0 interface 0 has no altsetting 0 [ 96.231110][ T2319] usb 4-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 96.240291][ T2319] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.249441][ T2319] usb 4-1: config 0 descriptor?? [ 96.279905][ T2323] usb 7-1: new full-speed USB device number 5 using dummy_hcd [ 96.462452][ T2323] usb 7-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 96.471642][ T2323] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.479668][ T2323] usb 7-1: Product: syz [ 96.483946][ T2323] usb 7-1: Manufacturer: syz [ 96.488600][ T2323] usb 7-1: SerialNumber: syz [ 96.658931][ T2319] lenovo 0003:17EF:6047.0006: ignoring exceeding usage max [ 96.674140][ T2319] lenovo 0003:17EF:6047.0006: No inputs registered, leaving [ 96.682178][ T2319] lenovo 0003:17EF:6047.0006: hidraw0: USB HID v0.10 Joystick [HID 17ef:6047] on usb-dummy_hcd.3-1/input0 [ 96.710901][ T2323] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 5 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 96.723039][ T2323] usb 7-1: USB disconnect, device number 5 [ 96.730172][ T2323] usblp0: removed [ 96.871599][ T2319] usb 4-1: USB disconnect, device number 4 [ 96.974311][ T28] audit: type=1400 audit(1794329656.880:1155): avc: denied { create } for pid=3541 comm="syz.0.1261" name="uvc.0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 97.320657][ T28] audit: type=1326 audit(1794329657.230:1156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3564 comm="syz.0.1271" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f876fda8f19 code=0x7ffc0000 [ 97.345651][ T28] audit: type=1326 audit(1794329657.230:1157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3564 comm="syz.0.1271" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f876fda8f19 code=0x7ffc0000 [ 97.371034][ T28] audit: type=1326 audit(1794329657.230:1158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3564 comm="syz.0.1271" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f876fda8f19 code=0x7ffc0000 [ 97.397944][ T28] audit: type=1326 audit(1794329657.230:1159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3564 comm="syz.0.1271" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=22 compat=0 ip=0x7f876fda8f19 code=0x7ffc0000 [ 97.423111][ T28] audit: type=1326 audit(1794329657.230:1160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3564 comm="syz.0.1271" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f876fda8f19 code=0x7ffc0000 [ 97.521475][ T701] Bluetooth: hci0: command 0x1003 tx timeout [ 97.527575][ T1130] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 97.658585][ T3572] loop6: detected capacity change from 0 to 40427 [ 97.666538][ T3572] F2FS-fs (loop6): invalid crc value [ 97.673406][ T3572] F2FS-fs (loop6): Found nat_bits in checkpoint [ 97.729442][ T3572] F2FS-fs (loop6): Start checkpoint disabled! [ 97.736410][ T3572] F2FS-fs (loop6): f2fs_disable_checkpoint() finish, err:0 [ 97.744134][ T3572] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e6 [ 97.839955][ T3586] syz.6.1274: attempt to access beyond end of device [ 97.839955][ T3586] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 98.083353][ T3572] syz.6.1274 (3572) used greatest stack depth: 18272 bytes left [ 98.119874][ T2204] kworker/u4:6: attempt to access beyond end of device [ 98.119874][ T2204] loop6: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 98.277493][ T3608] loop6: detected capacity change from 0 to 512 [ 98.290931][ T3607] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1288'. [ 98.364880][ T3614] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1292'. [ 98.379369][ T3612] loop3: detected capacity change from 0 to 4096 [ 98.404089][ T3612] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 98.546642][ T3625] FAULT_INJECTION: forcing a failure. [ 98.546642][ T3625] name failslab, interval 1, probability 0, space 0, times 0 [ 98.562775][ T1994] EXT4-fs (loop3): unmounting filesystem. [ 98.582635][ T3627] loop6: detected capacity change from 0 to 512 [ 98.592014][ T3625] CPU: 1 PID: 3625 Comm: syz.8.1297 Tainted: G W syzkaller #0 [ 98.600926][ T3625] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 98.611011][ T3625] Call Trace: [ 98.614319][ T3625] [ 98.617283][ T3625] __dump_stack+0x21/0x24 [ 98.621646][ T3625] dump_stack_lvl+0x110/0x170 [ 98.626354][ T3625] ? __cfi_dump_stack_lvl+0x8/0x8 [ 98.631406][ T3625] ? __kasan_slab_free+0x11/0x20 [ 98.636386][ T3625] ? genl_family_rcv_msg_doit+0x2b1/0x370 [ 98.642158][ T3625] dump_stack+0x15/0x24 [ 98.646356][ T3625] should_fail_ex+0x3bf/0x510 [ 98.651091][ T3625] __should_failslab+0xac/0xf0 [ 98.655999][ T3625] should_failslab+0x9/0x20 [ 98.660547][ T3625] kmem_cache_alloc_node+0x42/0x330 [ 98.665800][ T3625] ? __alloc_skb+0xe8/0x4a0 [ 98.670355][ T3625] __alloc_skb+0xe8/0x4a0 [ 98.674732][ T3625] netlink_ack+0x373/0x1160 [ 98.679287][ T3625] ? __cfi_genl_rcv_msg+0x10/0x10 [ 98.684349][ T3625] ? __cfi_netlink_ack+0x10/0x10 [ 98.689336][ T3625] netlink_rcv_skb+0x27e/0x450 [ 98.694151][ T3625] ? __cfi_genl_rcv_msg+0x10/0x10 [ 98.699211][ T3625] ? __cfi_netlink_rcv_skb+0x10/0x10 [ 98.704536][ T3625] ? __netlink_lookup+0x387/0x3b0 [ 98.709608][ T3625] genl_rcv+0x28/0x40 [ 98.713623][ T3625] netlink_unicast+0x8c1/0xa60 [ 98.718426][ T3625] netlink_sendmsg+0x8b9/0xbd0 [ 98.723240][ T3625] ? cgroup_rstat_updated+0xf0/0x360 [ 98.728565][ T3625] ? __cfi_netlink_sendmsg+0x10/0x10 [ 98.733898][ T3625] ? security_socket_sendmsg+0x93/0xb0 [ 98.739407][ T3625] __sys_sendto+0x4ac/0x660 [ 98.743970][ T3625] ? __cfi___sys_sendto+0x10/0x10 [ 98.749053][ T3625] ? do_user_addr_fault+0x9a5/0x1030 [ 98.754391][ T3625] __x64_sys_sendto+0xe5/0x100 [ 98.759203][ T3625] x64_sys_call+0x83/0x9a0 [ 98.763664][ T3625] do_syscall_64+0x4c/0xa0 [ 98.768116][ T3625] ? clear_bhb_loop+0x30/0x80 [ 98.772840][ T3625] ? clear_bhb_loop+0x30/0x80 [ 98.777571][ T3625] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 98.783512][ T3625] RIP: 0033:0x7fa7fad6974e [ 98.787965][ T3625] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 98.807610][ T3625] RSP: 002b:00007fa7fbd03e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 98.816078][ T3625] RAX: ffffffffffffffda RBX: 00007fa7fbd056c0 RCX: 00007fa7fad6974e [ 98.824105][ T3625] RDX: 0000000000000020 RSI: 00007fa7fbd04000 RDI: 0000000000000003 [ 98.832214][ T3625] RBP: 0000000000000000 R08: 00007fa7fbd03f04 R09: 000000000000000c [ 98.840231][ T3625] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 98.848241][ T3625] R13: 00007fa7fbd03f58 R14: 00007fa7fbd04000 R15: 0000000000000000 [ 98.856262][ T3625] [ 98.931871][ T3638] loop8: detected capacity change from 0 to 512 [ 98.953326][ T3638] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 98.969976][ T3638] System zones: 1-12 [ 98.980273][ T3638] EXT4-fs error (device loop8): ext4_xattr_inode_iget:401: inode #12: comm syz.8.1302: missing EA_INODE flag [ 99.025618][ T3647] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1306'. [ 99.031613][ T3638] EXT4-fs error (device loop8): ext4_xattr_inode_iget:406: comm syz.8.1302: error while reading EA inode 12 err=-117 [ 99.129396][ T3653] netlink: 64 bytes leftover after parsing attributes in process `syz.9.1309'. [ 99.138922][ T3638] EXT4-fs (loop8): 1 orphan inode deleted [ 99.146515][ T3655] FAULT_INJECTION: forcing a failure. [ 99.146515][ T3655] name fail_futex, interval 1, probability 0, space 0, times 0 [ 99.162523][ T3638] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 99.190107][ T3655] CPU: 0 PID: 3655 Comm: syz.3.1310 Tainted: G W syzkaller #0 [ 99.199182][ T3655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 99.209283][ T3655] Call Trace: [ 99.212680][ T3655] [ 99.215983][ T3655] __dump_stack+0x21/0x24 [ 99.220350][ T3655] dump_stack_lvl+0x110/0x170 [ 99.225066][ T3655] ? __cfi_dump_stack_lvl+0x8/0x8 [ 99.230145][ T3655] ? __schedule+0xcbb/0x1700 [ 99.234774][ T3655] dump_stack+0x15/0x24 [ 99.238966][ T3655] should_fail_ex+0x3bf/0x510 [ 99.243684][ T3655] should_fail+0xb/0x10 [ 99.247885][ T3655] get_futex_key+0x143/0xb10 [ 99.252514][ T3655] ? __cfi_avc_has_perm_noaudit+0x10/0x10 [ 99.258273][ T3655] ? __cfi_get_futex_key+0x10/0x10 [ 99.263445][ T3655] futex_wake+0x150/0x8e0 [ 99.267815][ T3655] ? __cfi_futex_wait+0x10/0x10 [ 99.272785][ T3655] ? __cfi_avc_has_perm+0x10/0x10 [ 99.277871][ T3655] ? __cfi_futex_wake+0x10/0x10 [ 99.282758][ T3655] ? selinux_socket_setsockopt+0x282/0x360 [ 99.288654][ T3655] ? __cfi_selinux_socket_setsockopt+0x10/0x10 [ 99.294856][ T3655] do_futex+0x2bf/0x430 [ 99.299139][ T3655] ? ip_setsockopt+0xa3/0x100 [ 99.303856][ T3655] ? __cfi_do_futex+0x10/0x10 [ 99.308573][ T3655] __se_sys_futex+0x136/0x310 [ 99.313383][ T3655] ? __x64_sys_futex+0x100/0x100 [ 99.318359][ T3655] ? xfd_validate_state+0x70/0x150 [ 99.323522][ T3655] __x64_sys_futex+0xe5/0x100 [ 99.328325][ T3655] x64_sys_call+0x7ec/0x9a0 [ 99.332874][ T3655] do_syscall_64+0x4c/0xa0 [ 99.337324][ T3655] ? clear_bhb_loop+0x30/0x80 [ 99.342061][ T3655] ? clear_bhb_loop+0x30/0x80 [ 99.346813][ T3655] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 99.352763][ T3655] RIP: 0033:0x7fab515a8f19 [ 99.353612][ T3604] F2FS-fs (loop0): Invalid segment/section count (458783, 24 x 150994945) [ 99.357215][ T3655] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.374818][ T3604] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 99.385351][ T3655] RSP: 002b:00007fab524cd0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 99.385379][ T3655] RAX: ffffffffffffffda RBX: 00007fab51825fa8 RCX: 00007fab515a8f19 [ 99.385395][ T3655] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fab51825fac [ 99.385410][ T3655] RBP: 00007fab51825fa0 R08: 0006444ff5ad4b70 R09: 0000000000000000 [ 99.425948][ T3655] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 99.433549][ T3604] F2FS-fs (loop0): invalid crc value [ 99.434047][ T3655] R13: 00007fab51826038 R14: 00007ffe9c7c02c0 R15: 00007ffe9c7c03a8 [ 99.447326][ T3655] [ 99.451937][ T3638] EXT4-fs (loop8): unmounting filesystem. [ 99.476679][ T3604] F2FS-fs (loop0): Found nat_bits in checkpoint [ 99.509857][ T3669] set_capacity_and_notify: 1 callbacks suppressed [ 99.509946][ T3669] loop8: detected capacity change from 0 to 512 [ 99.587854][ T3604] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 99.595074][ T3604] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 99.605535][ T3669] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e002e018, mo2=0082] [ 99.613733][ T3669] System zones: 0-2, 18-18, 34-34 [ 99.620661][ T3669] EXT4-fs (loop8): 1 orphan inode deleted [ 99.626504][ T3669] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 99.635693][ T3669] ext4 filesystem being mounted at /16/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 99.646341][ T10] EXT4-fs error (device loop8): ext4_release_dquot:6864: comm kworker/u4:1: Failed to release dquot type 1 [ 99.658732][ T3669] EXT4-fs error (device loop8): ext4_xattr_block_get:543: inode #12: comm syz.8.1314: corrupted xattr block 6 [ 99.670901][ T3669] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop8 ino=12 [ 99.680111][ T3669] EXT4-fs error (device loop8): ext4_xattr_block_get:543: inode #12: comm syz.8.1314: corrupted xattr block 6 [ 99.692257][ T3669] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop8 ino=12 [ 99.701369][ T3669] EXT4-fs error (device loop8): ext4_get_inode_usage:835: inode #12: comm syz.8.1314: corrupted xattr block 6 [ 99.725714][ T3240] EXT4-fs (loop8): unmounting filesystem. [ 99.731735][ T10] EXT4-fs error (device loop8): ext4_release_dquot:6864: comm kworker/u4:1: Failed to release dquot type 1 [ 99.749869][ T2319] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 99.849323][ T3682] loop6: detected capacity change from 0 to 512 [ 99.880611][ T3682] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 99.919446][ T3682] EXT4-fs (loop6): 1 truncate cleaned up [ 99.928558][ T3682] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 99.936053][ T2319] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 99.979933][ T2319] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 99.989161][ T2319] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.033288][ T2319] usb 4-1: config 0 descriptor?? [ 100.167067][ T857] EXT4-fs (loop6): unmounting filesystem. [ 100.245450][ T2319] usbhid 4-1:0.0: can't add hid device: -71 [ 100.251491][ T2319] usbhid: probe of 4-1:0.0 failed with error -71 [ 100.271098][ T2319] usb 4-1: USB disconnect, device number 5 [ 100.399179][ T3680] loop8: detected capacity change from 0 to 131072 [ 100.408613][ T3680] F2FS-fs (loop8): Invalid segment/section count (458783, 24 x 150994945) [ 100.417367][ T3680] F2FS-fs (loop8): Can't find valid F2FS filesystem in 1th superblock [ 100.426208][ T3680] F2FS-fs (loop8): invalid crc value [ 100.468495][ T3680] F2FS-fs (loop8): Found nat_bits in checkpoint [ 100.562489][ T3680] F2FS-fs (loop8): Try to recover 1th superblock, ret: 0 [ 100.569592][ T3680] F2FS-fs (loop8): Mounted with checkpoint version = 48b305e4 [ 100.829861][ T2319] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 101.011060][ T2319] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 101.027647][ T2319] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 101.060854][ T2319] usb 4-1: config 0 interface 0 has no altsetting 0 [ 101.067526][ T2319] usb 4-1: New USB device found, idVendor=1b1c, idProduct=1b1c, bcdDevice= 0.00 [ 101.096860][ T2319] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.122142][ T2319] usb 4-1: config 0 descriptor?? [ 101.176125][ T28] kauditd_printk_skb: 582 callbacks suppressed [ 101.176141][ T28] audit: type=1400 audit(1794329661.080:1741): avc: denied { mount } for pid=3740 comm="syz.8.1335" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 101.181086][ T3741] overlayfs: upper fs does not support tmpfile. [ 101.190127][ T28] audit: type=1400 audit(1794329661.080:1742): avc: denied { remount } for pid=3740 comm="syz.8.1335" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 101.230884][ T28] audit: type=1400 audit(1794329661.080:1743): avc: denied { mounton } for pid=3740 comm="syz.8.1335" path="/19/file0/file0" dev="bpf" ino=32748 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=dir permissive=1 [ 101.262874][ T28] audit: type=1400 audit(1794329661.160:1744): avc: denied { unmount } for pid=3240 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 101.284037][ T3743] loop8: detected capacity change from 0 to 128 [ 101.394658][ T3727] loop9: detected capacity change from 0 to 131072 [ 101.404511][ T3727] F2FS-fs (loop9): Test dummy encryption mode enabled [ 101.412187][ T3727] F2FS-fs (loop9): invalid crc value [ 101.418980][ T3727] F2FS-fs (loop9): Found nat_bits in checkpoint [ 101.462018][ T3727] F2FS-fs (loop9): Mounted with checkpoint version = 48b305e5 [ 101.531457][ T2319] input: HID 1b1c:1b1c as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:1B1C:1B1C.0007/input/input11 [ 101.625955][ T2319] hid-generic 0003:1B1C:1B1C.0007: input,hidraw0: USB HID v0.00 Keyboard [HID 1b1c:1b1c] on usb-dummy_hcd.3-1/input0 [ 101.832273][ T3761] ip_tables: iptables: counters copy to user failed while replacing table [ 101.956640][ T2319] usb 4-1: USB disconnect, device number 6 [ 102.031355][ T3777] loop9: detected capacity change from 0 to 512 [ 102.073354][ T3777] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: writeback. [ 102.082584][ T3777] ext4 filesystem being mounted at /183/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 102.121007][ T1265] EXT4-fs (loop9): unmounting filesystem. [ 102.177033][ T3775] loop0: detected capacity change from 0 to 40427 [ 102.197763][ T3785] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 102.208145][ T3775] F2FS-fs (loop0): invalid crc value [ 102.231040][ T3775] F2FS-fs (loop0): Found nat_bits in checkpoint [ 102.245879][ T3792] ip_tables: iptables: counters copy to user failed while replacing table [ 102.272204][ T3792] ip_tables: iptables: counters copy to user failed while replacing table [ 102.297076][ T3798] netlink: 20 bytes leftover after parsing attributes in process `syz.9.1357'. [ 102.317684][ T3798] netlink: 20 bytes leftover after parsing attributes in process `syz.9.1357'. [ 102.337133][ T3775] F2FS-fs (loop0): Start checkpoint disabled! [ 102.351792][ T3775] F2FS-fs (loop0): f2fs_disable_checkpoint() finish, err:0 [ 102.374405][ T3775] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 102.455633][ T10] kworker/u4:1: attempt to access beyond end of device [ 102.455633][ T10] loop0: rw=2049, sector=40960, nr_sectors = 24 limit=40427 [ 102.510468][ T28] audit: type=1400 audit(1794329662.420:1745): avc: denied { associate } for pid=3816 comm="syz.8.1366" name="3" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 102.548759][ T3824] loop6: detected capacity change from 0 to 512 [ 102.578870][ T3828] ip_tables: iptables: counters copy to user failed while replacing table [ 102.622595][ T3824] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 102.635951][ T3824] ext4 filesystem being mounted at /252/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 102.652405][ T3824] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.1369: corrupted xattr block 33 [ 102.694466][ T3824] SELinux: inode_doinit_use_xattr: getxattr returned 74 for dev=loop6 ino=15 [ 102.738038][ T3824] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.1369: corrupted xattr block 33 [ 102.738799][ T3849] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.1369: corrupted xattr block 33 [ 102.762020][ T3849] SELinux: inode_doinit_use_xattr: getxattr returned 74 for dev=loop6 ino=15 [ 102.771060][ T3849] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.1369: corrupted xattr block 33 [ 102.801908][ T3824] SELinux: inode_doinit_use_xattr: getxattr returned 74 for dev=loop6 ino=15 [ 102.823548][ T3849] SELinux: inode_doinit_use_xattr: getxattr returned 74 for dev=loop6 ino=15 [ 102.847136][ T3824] EXT4-fs error (device loop6): ext4_xattr_block_get:543: inode #15: comm syz.6.1369: corrupted xattr block 33 [ 102.889590][ T3824] SELinux: inode_doinit_use_xattr: getxattr returned 74 for dev=loop6 ino=15 [ 102.945315][ T857] EXT4-fs (loop6): unmounting filesystem. [ 103.020439][ T28] audit: type=1400 audit(1794329662.930:1746): avc: denied { setopt } for pid=3868 comm="syz.6.1385" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 103.098339][ T28] audit: type=1326 audit(1794329663.000:1747): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3877 comm="syz.9.1388" exe="/root/ci2-android-6-1/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe15d9a8f19 code=0x0 [ 103.144771][ T3881] loop8: detected capacity change from 0 to 128 [ 103.167173][ T3881] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 103.176162][ T3881] ext4 filesystem being mounted at /32/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 103.199054][ T3240] EXT4-fs (loop8): unmounting filesystem. [ 103.228676][ T3885] loop8: detected capacity change from 0 to 2048 [ 103.251361][ T3885] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 103.275682][ T3240] EXT4-fs (loop8): unmounting filesystem. [ 103.774802][ T3901] device ip6gre1 entered promiscuous mode [ 103.982947][ T3920] EXT4-fs: Ignoring removed bh option [ 104.010661][ T3920] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 104.060516][ T1265] EXT4-fs (loop9): unmounting filesystem. [ 104.099940][ T2319] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 104.148178][ T3929] FAT-fs (loop9): Directory bread(block 199916) failed [ 104.159911][ T3929] FAT-fs (loop9): Directory bread(block 199917) failed [ 104.167109][ T3929] FAT-fs (loop9): Directory bread(block 199918) failed [ 104.190044][ T3929] FAT-fs (loop9): Directory bread(block 199919) failed [ 104.197006][ T3929] FAT-fs (loop9): Directory bread(block 199920) failed [ 104.210165][ T3929] FAT-fs (loop9): Directory bread(block 199921) failed [ 104.217137][ T3929] FAT-fs (loop9): Directory bread(block 199922) failed [ 104.240101][ T3929] FAT-fs (loop9): Directory bread(block 199923) failed [ 104.290942][ T2319] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.309881][ T2319] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 104.322625][ T3935] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1409'. [ 104.331687][ T2319] usb 1-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 104.343800][ T2319] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.353060][ T2319] usb 1-1: config 0 descriptor?? [ 104.423551][ T40] hid-generic 0000:0000:0000.0008: unknown main item tag 0x0 [ 104.438543][ T28] audit: type=1400 audit(1794329664.340:1748): avc: denied { append } for pid=3942 comm="syz.3.1412" name="ptp0" dev="devtmpfs" ino=264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 104.462516][ T40] hid-generic 0000:0000:0000.0008: hidraw0: HID v0.00 Device [syz1] on syz0 [ 104.705919][ T3960] set_capacity_and_notify: 2 callbacks suppressed [ 104.705938][ T3960] loop8: detected capacity change from 0 to 512 [ 104.762230][ T3960] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 104.773591][ T2319] playstation 0003:054C:0DF2.0009: unknown main item tag 0x0 [ 104.781563][ T2319] playstation 0003:054C:0DF2.0009: unknown main item tag 0x0 [ 104.789014][ T2319] playstation 0003:054C:0DF2.0009: unknown main item tag 0x0 [ 104.797699][ T3960] ext4 filesystem being mounted at /42/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 104.819917][ T2319] playstation 0003:054C:0DF2.0009: unknown main item tag 0x0 [ 104.827370][ T2319] playstation 0003:054C:0DF2.0009: unknown main item tag 0x0 [ 104.835928][ T2319] playstation 0003:054C:0DF2.0009: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.0-1/input0 [ 104.881581][ T3240] EXT4-fs (loop8): unmounting filesystem. [ 104.969900][ T28] audit: type=1400 audit(1794329664.870:1749): avc: denied { module_load } for pid=3969 comm="syz.3.1422" path="/137/bus" dev="tmpfs" ino=726 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=system permissive=1 [ 105.024319][ T3968] loop8: detected capacity change from 0 to 8192 [ 105.067822][ T3970] Invalid ELF header magic: != ELF [ 105.393654][ T2319] playstation 0003:054C:0DF2.0009: Failed to retrieve feature with reportID 5: -32 [ 105.411112][ T2319] playstation 0003:054C:0DF2.0009: Failed to retrieve DualSense calibration info: -32 [ 105.436861][ T2319] playstation 0003:054C:0DF2.0009: Failed to get calibration data from DualSense [ 105.446606][ T2319] playstation 0003:054C:0DF2.0009: Failed to create dualsense. [ 105.455175][ T2319] playstation: probe of 0003:054C:0DF2.0009 failed with error -32 [ 105.465027][ T2205] Bluetooth: hci0: Frame reassembly failed (-84) [ 105.472630][ T2319] usb 1-1: USB disconnect, device number 4 [ 105.478562][ T3982] Bluetooth: hci0: Frame reassembly failed (-84) [ 105.515649][ T3983] fido_id[3983]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 105.890894][ T3987] tipc: Started in network mode [ 105.895829][ T3987] tipc: Node identity 1000001, cluster identity 4711 [ 105.902796][ T3987] tipc: Node number set to 16777217 [ 105.909757][ T3987] tipc: New replicast peer: 127.0.0.1 [ 105.915762][ T3987] tipc: Enabled bearer , priority 10 [ 105.949164][ T3994] loop8: detected capacity change from 0 to 1024 [ 105.966482][ T3994] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 105.975175][ T3994] ext4 filesystem being mounted at /46/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 105.997911][ T3240] EXT4-fs (loop8): unmounting filesystem. [ 106.023614][ T4003] netlink: 20 bytes leftover after parsing attributes in process `syz.8.1434'. [ 106.251724][ T4035] EXT4-fs warning (device sda1): verify_group_input:151: Cannot add at group 25 (only 8 groups) [ 106.463967][ T28] audit: type=1400 audit(1794329666.370:1750): avc: denied { ioctl } for pid=4048 comm="syz.3.1454" path="socket:[34406]" dev="sockfs" ino=34406 ioctlcmd=0x7452 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 106.563339][ T28] audit: type=1400 audit(1794329666.470:1751): avc: denied { map } for pid=4053 comm="syz.3.1456" path="/dev/ashmem" dev="devtmpfs" ino=269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 106.629436][ T4050] ================================================================== [ 106.637559][ T4050] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x62/0xb0 [ 106.645252][ T4050] Write of size 8 at addr ffff88812af51990 by task syz.3.1454/4050 [ 106.653177][ T4050] [ 106.655529][ T4050] CPU: 1 PID: 4050 Comm: syz.3.1454 Tainted: G W syzkaller #0 [ 106.664411][ T4050] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 106.674506][ T4050] Call Trace: [ 106.677823][ T4050] [ 106.680801][ T4050] __dump_stack+0x21/0x24 [ 106.685174][ T4050] dump_stack_lvl+0x110/0x170 [ 106.689892][ T4050] ? __cfi_dump_stack_lvl+0x8/0x8 [ 106.694956][ T4050] ? rcu_segcblist_enqueue+0x62/0xb0 [ 106.700287][ T4050] print_address_description+0x71/0x200 [ 106.705867][ T4050] print_report+0x4a/0x60 [ 106.710221][ T4050] kasan_report+0x122/0x150 [ 106.714830][ T4050] ? rcu_segcblist_enqueue+0x62/0xb0 [ 106.720138][ T4050] __asan_report_store8_noabort+0x17/0x20 [ 106.725870][ T4050] rcu_segcblist_enqueue+0x62/0xb0 [ 106.731005][ T4050] call_rcu+0x554/0xf50 [ 106.735185][ T4050] ? __cfi_call_rcu+0x10/0x10 [ 106.739879][ T4050] ? mutex_unlock+0x8f/0x230 [ 106.744489][ T4050] ? __cfi_mutex_unlock+0x10/0x10 [ 106.749527][ T4050] ? __kasan_check_write+0x14/0x20 [ 106.754653][ T4050] ? l2tp_session_delete+0x48/0x4d0 [ 106.759876][ T4050] pppol2tp_release+0x1e3/0x2b0 [ 106.764754][ T4050] sock_close+0xc9/0x220 [ 106.769024][ T4050] ? __cfi_sock_close+0x10/0x10 [ 106.773905][ T4050] __fput+0x1fd/0x8f0 [ 106.777928][ T4050] ____fput+0x15/0x20 [ 106.781939][ T4050] task_work_run+0x1e1/0x250 [ 106.786554][ T4050] ? __cfi_task_work_run+0x10/0x10 [ 106.791713][ T4050] ? free_nsproxy+0x21f/0x270 [ 106.796420][ T4050] do_exit+0xb0d/0x29f0 [ 106.800609][ T4050] ? __cfi_do_exit+0x10/0x10 [ 106.805312][ T4050] ? xfd_validate_state+0x70/0x150 [ 106.810449][ T4050] ? __kasan_check_write+0x14/0x20 [ 106.815662][ T4050] __x64_sys_exit+0x40/0x40 [ 106.820192][ T4050] x64_sys_call+0x67/0x9a0 [ 106.824630][ T4050] do_syscall_64+0x4c/0xa0 [ 106.829059][ T4050] ? clear_bhb_loop+0x30/0x80 [ 106.833752][ T4050] ? clear_bhb_loop+0x30/0x80 [ 106.838453][ T4050] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 106.844385][ T4050] RIP: 0033:0x7fab515a8f19 [ 106.848817][ T4050] Code: Unable to access opcode bytes at 0x7fab515a8eef. [ 106.855849][ T4050] RSP: 002b:00007fab524ccef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 106.864282][ T4050] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007fab515a8f19 [ 106.872467][ T4050] RDX: 00007fab524cd9c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 106.880472][ T4050] RBP: 00007fab51637f6d R08: 0000000000000000 R09: 0000000000000058 [ 106.888468][ T4050] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 106.896457][ T4050] R13: 00007fab51826038 R14: 00007fab51825fa0 R15: 00007ffe9c7c03a8 [ 106.904495][ T4050] [ 106.907547][ T4050] [ 106.909888][ T4050] Allocated by task 4049: [ 106.914229][ T4050] kasan_set_track+0x4b/0x70 [ 106.918844][ T4050] kasan_save_alloc_info+0x1f/0x30 [ 106.924143][ T4050] __kasan_kmalloc+0x95/0xb0 [ 106.928758][ T4050] __kmalloc+0xb4/0x1e0 [ 106.932941][ T4050] l2tp_session_create+0x38/0xbd0 [ 106.937998][ T4050] pppol2tp_connect+0xbf5/0x1640 [ 106.942962][ T4050] __sys_connect+0x3da/0x460 [ 106.947586][ T4050] __x64_sys_connect+0x7a/0x90 [ 106.952373][ T4050] x64_sys_call+0x88d/0x9a0 [ 106.956893][ T4050] do_syscall_64+0x4c/0xa0 [ 106.961330][ T4050] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 106.967260][ T4050] [ 106.969611][ T4050] Freed by task 10: [ 106.973431][ T4050] kasan_set_track+0x4b/0x70 [ 106.978056][ T4050] kasan_save_free_info+0x2b/0x40 [ 106.983104][ T4050] ____kasan_slab_free+0x132/0x180 [ 106.988254][ T4050] __kasan_slab_free+0x11/0x20 [ 106.993066][ T4050] slab_free_freelist_hook+0xc2/0x190 [ 106.998464][ T4050] __kmem_cache_free+0xb7/0x1b0 [ 107.003342][ T4050] kfree+0x6f/0xf0 [ 107.007084][ T4050] l2tp_session_put+0xaf/0x1a0 [ 107.011898][ T4050] l2tp_session_delete+0x3df/0x4d0 [ 107.017030][ T4050] l2tp_tunnel_del_work+0x199/0x410 [ 107.022266][ T4050] process_one_work+0x717/0xc30 [ 107.027143][ T4050] worker_thread+0xa4d/0x11d0 [ 107.031840][ T4050] kthread+0x281/0x320 [ 107.035933][ T4050] ret_from_fork+0x1f/0x30 [ 107.040400][ T4050] [ 107.042744][ T4050] Last potentially related work creation: [ 107.048471][ T4050] kasan_save_stack+0x3a/0x60 [ 107.053209][ T4050] __kasan_record_aux_stack+0xb6/0xc0 [ 107.058628][ T4050] kasan_record_aux_stack_noalloc+0xb/0x10 [ 107.064455][ T4050] call_rcu+0xcf/0xf50 [ 107.068599][ T4050] pppol2tp_release+0x1e3/0x2b0 [ 107.073491][ T4050] sock_close+0xc9/0x220 [ 107.077760][ T4050] __fput+0x1fd/0x8f0 [ 107.081765][ T4050] ____fput+0x15/0x20 [ 107.085769][ T4050] task_work_run+0x1e1/0x250 [ 107.090399][ T4050] do_exit+0xb0d/0x29f0 [ 107.094580][ T4050] __cfi___ia32_sys_exit+0x0/0x10 [ 107.099640][ T4050] x64_sys_call+0x67/0x9a0 [ 107.104082][ T4050] do_syscall_64+0x4c/0xa0 [ 107.108516][ T4050] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 107.114430][ T4050] [ 107.116766][ T4050] The buggy address belongs to the object at ffff88812af51800 [ 107.116766][ T4050] which belongs to the cache kmalloc-512 of size 512 [ 107.131007][ T4050] The buggy address is located 400 bytes inside of [ 107.131007][ T4050] 512-byte region [ffff88812af51800, ffff88812af51a00) [ 107.144299][ T4050] [ 107.146665][ T4050] The buggy address belongs to the physical page: [ 107.153088][ T4050] page:ffffea0004abd400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12af50 [ 107.163340][ T4050] head:ffffea0004abd400 order:2 compound_mapcount:0 compound_pincount:0 [ 107.171680][ T4050] flags: 0x4000000000010200(slab|head|zone=1) [ 107.177781][ T4050] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042f00 [ 107.186407][ T4050] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 107.195027][ T4050] page dumped because: kasan: bad access detected [ 107.201459][ T4050] page_owner tracks the page as allocated [ 107.207186][ T4050] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 2323, tgid 2323 (kworker/0:10), ts 89121031633, free_ts 86849721471 [ 107.229347][ T4050] post_alloc_hook+0x1f5/0x210 [ 107.234139][ T4050] prep_new_page+0x1c/0x110 [ 107.238753][ T4050] get_page_from_freelist+0x2ca9/0x2d20 [ 107.244356][ T4050] __alloc_pages+0x1fa/0x610 [ 107.249067][ T4050] alloc_slab_page+0x6e/0xf0 [ 107.253674][ T4050] new_slab+0x98/0x3e0 [ 107.257763][ T4050] ___slab_alloc+0x70f/0xb70 [ 107.262375][ T4050] __slab_alloc+0x5e/0xa0 [ 107.266719][ T4050] __kmem_cache_alloc_node+0x204/0x2d0 [ 107.272208][ T4050] __kmalloc_node_track_caller+0xa1/0x1e0 [ 107.277970][ T4050] __alloc_skb+0x226/0x4a0 [ 107.282487][ T4050] __ipv6_ifa_notify+0x200/0xe80 [ 107.287448][ T4050] addrconf_dad_completed+0x192/0xe80 [ 107.292927][ T4050] addrconf_dad_work+0xc1b/0x14a0 [ 107.297969][ T4050] process_one_work+0x717/0xc30 [ 107.302834][ T4050] worker_thread+0xa4d/0x11d0 [ 107.307526][ T4050] page last free stack trace: [ 107.312207][ T4050] free_unref_page_prepare+0x81b/0x820 [ 107.317686][ T4050] free_unref_page+0x93/0x530 [ 107.322386][ T4050] __free_pages+0x67/0x100 [ 107.326819][ T4050] __vunmap+0xa3c/0xc00 [ 107.330986][ T4050] vfree+0x61/0x90 [ 107.334723][ T4050] kcov_close+0x2b/0x50 [ 107.338891][ T4050] __fput+0x1fd/0x8f0 [ 107.342935][ T4050] ____fput+0x15/0x20 [ 107.346940][ T4050] task_work_run+0x1e1/0x250 [ 107.351544][ T4050] do_exit+0xb0d/0x29f0 [ 107.355725][ T4050] do_group_exit+0x21b/0x2e0 [ 107.360365][ T4050] __x64_sys_exit_group+0x3f/0x40 [ 107.365414][ T4050] x64_sys_call+0x7b4/0x9a0 [ 107.369933][ T4050] do_syscall_64+0x4c/0xa0 [ 107.374371][ T4050] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 107.380316][ T4050] [ 107.382653][ T4050] Memory state around the buggy address: [ 107.388296][ T4050] ffff88812af51880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.396403][ T4050] ffff88812af51900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.404482][ T4050] >ffff88812af51980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 107.412646][ T4050] ^ [ 107.417255][ T4050] ffff88812af51a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 107.425330][ T4050] ffff88812af51a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 107.433400][ T4050] ================================================================== [ 107.441498][ T4050] Disabling lock debugging due to kernel taint [ 107.464470][ T28] audit: type=1400 audit(1794329667.370:1752): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 107.520003][ T701] Bluetooth: hci0: command 0x1003 tx timeout [ 107.526164][ T1130] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 115.919889][ C0] tipc: RX(1000001): key[1] is activated