last executing test programs: 5.103764717s ago: executing program 3 (id=606): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000200)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e24, 0x6, @mcast2, 0x7f}, 0x1c) 5.001905462s ago: executing program 3 (id=608): openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) syz_io_uring_setup(0x71fd, 0x0, &(0x7f0000000380), &(0x7f00000003c0)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$inet(0xffffffffffffffff, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) mount(&(0x7f0000000240), &(0x7f0000000200)='./file0\x00', &(0x7f0000000140)='ufs\x00', 0x0, 0x0) listen(0xffffffffffffffff, 0x80000001) r3 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f00000000c0), 0x0, 0xffffffffffffffff) r4 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f0000000280)='asymmetric\x00', &(0x7f0000000240)=@keyring={'key_or_keyring:', r3}) keyctl$KEYCTL_MOVE(0x1e, r3, 0xffffffffffffffff, r4, 0x0) 4.058433499s ago: executing program 3 (id=619): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0xb5c, &(0x7f0000000640)={0x0, 0x1780, 0x0, 0x1, 0x164}, &(0x7f0000000dc0)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000003c0)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/212, 0xd4}], 0x1}) io_uring_enter(r3, 0x847ba, 0x0, 0xe, 0x0, 0x0) 3.738411995s ago: executing program 1 (id=623): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="d40500002000ffffd435550000000264bc202900000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) 3.738207195s ago: executing program 1 (id=624): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x483) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x0, 0x2, 0x4, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x5422) 3.719518636s ago: executing program 1 (id=625): r0 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r0, &(0x7f0000000a80)=[{{0x0, 0x0, 0x0}, 0xb}, {{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f0000000e40)=""/243, 0xf3}, {&(0x7f0000000f40)=""/232, 0xe8}, {&(0x7f0000001380)=""/4084, 0xff4}, {&(0x7f0000000600)=""/242, 0xf2}], 0x4}, 0x5}, {{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x1}], 0x4, 0x2120, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="180000002500010324bd5502ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4004088}, 0x0) 3.458173949s ago: executing program 0 (id=630): bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x15, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18080000000000e0000018110000000000000000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b70600001fffff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0x1, 'C'}, {0x18, 0x110, 0xd, "10"}], 0x30}, 0xfc40) 3.43297396s ago: executing program 0 (id=631): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000ff4ae0086d04dd08f4ff080203010902120001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000480)={0x2c, &(0x7f00000001c0)={0x20, 0xa, 0x5, "ca5e688d8f"}, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x20, 0x3, 0x1, 0x8}}) 3.318416376s ago: executing program 4 (id=633): r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x7, &(0x7f0000000040)=[{0xe, 0x5, 0xb436}], 0x1, 0xbff, 0x57, 0x0, 0x2c, 0x5c}) 3.247613269s ago: executing program 4 (id=634): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'ip6gretap0\x00'}) close_range(r0, 0xffffffffffffffff, 0x0) 3.211203111s ago: executing program 3 (id=635): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000040de28421100000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000001c0)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="000085000000854eb1"], 0x0, 0x0, 0x0, 0x0}, 0x0) dup(0xffffffffffffffff) socket$inet_mptcp(0x2, 0x1, 0x106) 3.162456884s ago: executing program 4 (id=636): r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket(0x10, 0x3, 0x0) r2 = dup(r1) r3 = fanotify_init(0x20, 0x101000) fanotify_mark(r3, 0x1, 0x8, r2, 0x0) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000200)="a101", 0x2}], 0x1) 3.148280904s ago: executing program 4 (id=638): sched_setscheduler(0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000100)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f00000000c0)='./file1\x00') symlinkat(&(0x7f0000000400)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00') r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r0, r0) setpgid(0x0, r0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x441, 0x104) 3.115939926s ago: executing program 4 (id=639): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2000000036000701fcffffff00008100017c00000c0001"], 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 2.674381728s ago: executing program 1 (id=640): ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f911, 0x8000, '\x00', @string=0x0}}) r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000b80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0d, &(0x7f0000000040)) 2.643040929s ago: executing program 3 (id=641): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x4, 0x6, &(0x7f0000006680)) set_tid_address(0x0) 2.617879201s ago: executing program 3 (id=642): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03", 0x3}], 0x1}, 0x0) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="5001"], 0x14) 2.250256019s ago: executing program 4 (id=644): socket$inet6_udp(0xa, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1, 0x8}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {}, {0x10, 0x10}}, [@filter_kind_options=@f_flow={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048084}, 0x0) 2.239140449s ago: executing program 32 (id=644): socket$inet6_udp(0xa, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1, 0x8}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {}, {0x10, 0x10}}, [@filter_kind_options=@f_flow={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048084}, 0x0) 2.177047972s ago: executing program 1 (id=646): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001000)=ANY=[@ANYBLOB="100100000a0a050000000000000000000a000009fc001280580001800d00010073796e70726f78790000000044000280060001400005000008000340000000020500020001000000080003400000000a060d014000400000060001401000000008000340000000020800034000000018100001800b00010074756e6e656c00e106"], 0x110}, 0x1, 0x0, 0x0, 0x2404c004}, 0x4000) 2.078456417s ago: executing program 1 (id=648): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x3, 0x1}, 0x4) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x14, 0x1c, 0x301, 0x70bd2f, 0x25dfdbff, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x4008}, 0x0) 1.541630764s ago: executing program 0 (id=652): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="0281"], 0x10}}, 0x0) 1.486458097s ago: executing program 0 (id=653): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, 0x0, &(0x7f0000000180)) 1.486258666s ago: executing program 0 (id=654): ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0xe82b) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x402, 0x0) ioctl$KDSKBMETA(r2, 0x4b63, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x8000000) semget$private(0x0, 0x4000, 0x0) 1.480814517s ago: executing program 2 (id=655): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0xd0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x0, 0x20}, 0xc) bind$inet6(r1, 0x0, 0x0) sendto$inet6(r1, &(0x7f00000003c0)='\x00', 0x1, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x20, @loopback, 0x1}, 0x1c) sendmmsg$sock(r1, &(0x7f0000003b80)=[{{0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}}], 0x1, 0x0) ioctl$PPPIOCSPASS(0xffffffffffffffff, 0x40087447, &(0x7f0000000580)={0x0, &(0x7f0000000540)}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = fsopen(&(0x7f0000000000)='cifs\x00', 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f0000000100)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r5, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000240)='uid', &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) ptrace(0x10, r2) ptrace$setregset(0x4205, r2, 0x1, &(0x7f0000000100)={0x0}) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="180000"], 0x4203) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x4048055) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_WRITE={0x17, 0x1, 0x2007, @fd, 0xffffffffffffff7f, 0x0, 0x0, 0x4, 0x1}) 612.20878ms ago: executing program 2 (id=656): ioctl$FE_GET_PROPERTY(0xffffffffffffffff, 0x80106f53, &(0x7f00000016c0)={0x37, 0x0}) r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOGETCMAP(r0, 0x4604, &(0x7f00000001c0)={0x2, 0x1, &(0x7f00000000c0)=[0x0], &(0x7f0000001280), 0x0, 0x0}) 540.858904ms ago: executing program 2 (id=657): getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_open_dev$cec(0x0, 0x0, 0x880) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, 0x0, 0x10) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/tty/ldiscs\x00', 0x0, 0x0) read$FUSE(r1, 0x0, 0x0) pread64(r1, &(0x7f0000001440)=""/126, 0x7e, 0x41) 540.734684ms ago: executing program 2 (id=658): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$ARCH_MAP_VDSO_32(0x1e, r0, 0x7fffffff, 0x2002) 486.523926ms ago: executing program 2 (id=659): syz_usb_connect(0x0, 0x1a2, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000b6a57e4086805b0bc5e10102030109029001020000000009040000020e0100000a2401002200020102092100000001220000090500000000000000a7008d566539461c701919d99a91c3af134dfaf61ea66b8f08810855d90c55c91f11c4a6d847caf7b449c6c760e60f6b890d99ed23074bf2538ca7bba727dfe7c00b90d0bc7f2da56768ed5ce8df38c07183564831596fd52da49a92adafa6277df5a120c898fc51ca04089f110dfbe1b258e9b9a83bf95fb0a4a24ca6acae78e1c291f671fcdca77c7128d319f7a4b51bbc2ed4bab8aac95498fb6033f760602c1a8b1eac2150072501000000000905000000000000000725010000000007250100000000090400000eb03748000a2401000000020102052405"], 0x0) 444.618278ms ago: executing program 0 (id=660): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x6, 0x8, 0x8000, 0x0, 0xb3, 0x4, 0xfffffe0000000001, 0x7, 0x2}, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_SET_OP_GET_BYINDEX(0xffffffffffffffff, 0x1, 0x53, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="40010000", @ANYRES16=r3, @ANYBLOB="01000000000004000000010000002400030000000000000000000000000000000000000000000000000000000000000000001400020077673100000000000000000000000000f4000880"], 0x140}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x4c, r3, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20d0}, 0x44000) 0s ago: executing program 2 (id=661): r0 = socket$inet6(0xa, 0x2, 0x0) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000040), &(0x7f0000000080)={0x0, 0xfb, 0x15, 0xe1260139dbd62050, 0x6, "b519fcbeeec9fdcfe809e5f92e124907"}, 0x15, 0x1) kernel console output (not intermixed with test programs): orted userspace flags (000000b1) [ 28.206070][ T4412] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6'. [ 28.213303][ T4442] tipc: Started in network mode [ 28.214270][ T4442] tipc: Node identity 40000000000000000000000000000001, cluster identity 4711 [ 28.216832][ T4442] tipc: Enabling of bearer rejected, failed to enable media [ 28.237035][ T4328] Bluetooth: hci0: command 0x041b tx timeout [ 28.237067][ T4319] Bluetooth: hci1: command 0x041b tx timeout [ 28.237938][ T4328] Bluetooth: hci3: command 0x041b tx timeout [ 28.383100][ T4319] Bluetooth: hci4: command 0x041b tx timeout [ 29.341743][ C0] vcan0: j1939_tp_rxtimer: 0x00000000239b0c05: rx timeout, send abort [ 29.343682][ C0] vcan0: j1939_xtp_rx_abort_one: 0x00000000239b0c05: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 29.407459][ T4330] XFS (loop2): Unmounting Filesystem [ 29.422552][ T4450] loop4: detected capacity change from 0 to 32768 [ 29.424060][ T4450] ======================================================= [ 29.424060][ T4450] WARNING: The mand mount option has been deprecated and [ 29.424060][ T4450] and is ignored by this kernel. Remove the mand [ 29.424060][ T4450] option from the mount to silence this warning. [ 29.424060][ T4450] ======================================================= [ 29.491471][ T4452] loop3: detected capacity change from 0 to 32768 [ 29.502638][ T4452] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop3 scanned by syz.3.14 (4452) [ 29.509775][ T4452] BTRFS info (device loop3): first mount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 29.511488][ T4452] BTRFS info (device loop3): using crc32c (crc32c-generic) checksum algorithm [ 29.512967][ T4452] BTRFS info (device loop3): enabling disk space caching [ 29.514218][ T4452] BTRFS info (device loop3): force clearing of disk cache [ 29.515483][ T4452] BTRFS info (device loop3): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 29.517075][ T4452] BTRFS info (device loop3): use zstd compression, level 3 [ 29.518238][ T4452] BTRFS info (device loop3): disk space caching is enabled [ 29.530479][ T4450] XFS (loop4): DAX unsupported by block device. Turning off DAX. [ 29.537653][ T4450] XFS (loop4): Mounting V5 Filesystem [ 29.590268][ T4450] XFS (loop4): Ending clean mount [ 29.602381][ T4450] XFS (loop4): Quotacheck needed: Please wait. [ 29.628198][ T4450] XFS (loop4): Quotacheck: Done. [ 29.633707][ T4475] loop1: detected capacity change from 0 to 8192 [ 29.672358][ T4452] BTRFS info (device loop3): enabling ssd optimizations [ 29.675190][ T4452] BTRFS info (device loop3): rebuilding free space tree [ 29.685170][ T4452] BTRFS info (device loop3): disabling free space tree [ 29.687334][ T4452] BTRFS info (device loop3): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 29.688840][ T4452] BTRFS info (device loop3): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 29.701207][ T4485] FAULT_INJECTION: forcing a failure. [ 29.701207][ T4485] name failslab, interval 1, probability 0, space 0, times 0 [ 29.705109][ T4475] loop1: AHDI p2 p3 [ 29.713373][ T4485] CPU: 0 PID: 4485 Comm: syz.0.17 Not tainted syzkaller #0 [ 29.714629][ T4485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 29.716385][ T4485] Call trace: [ 29.716947][ T4485] dump_backtrace+0x1c0/0x1ec [ 29.717762][ T4485] show_stack+0x2c/0x3c [ 29.718351][ T4485] __dump_stack+0x30/0x40 [ 29.719040][ T4485] dump_stack_lvl+0xf4/0x15c [ 29.719769][ T4485] dump_stack+0x1c/0x5c [ 29.720493][ T4485] should_fail_ex+0x3c0/0x518 [ 29.721279][ T4485] __should_failslab+0xc0/0x120 [ 29.722084][ T4485] should_failslab+0x10/0x28 [ 29.722773][ T4485] kmem_cache_alloc+0x88/0x308 [ 29.723612][ T4485] skb_clone+0x190/0x304 [ 29.724297][ T4485] __netlink_deliver_tap+0x36c/0x6dc [ 29.725101][ T4485] netlink_deliver_tap+0x1ac/0x1b0 [ 29.725926][ T4485] netlink_unicast+0x5ec/0x814 [ 29.726699][ T4485] netlink_sendmsg+0x6f4/0x9c0 [ 29.727319][ T4485] ____sys_sendmsg+0x5c8/0x938 [ 29.728083][ T4485] __sys_sendmmsg+0x344/0x834 [ 29.728818][ T4485] __arm64_sys_sendmmsg+0xa0/0xbc [ 29.729761][ T4485] invoke_syscall+0x98/0x2b4 [ 29.730494][ T4485] el0_svc_common+0x138/0x258 [ 29.731294][ T4485] do_el0_svc+0x58/0x130 [ 29.732028][ T4485] el0_svc+0x58/0x128 [ 29.732663][ T4485] el0t_64_sync_handler+0x84/0xf0 [ 29.733532][ T4485] el0t_64_sync+0x18c/0x190 [ 29.740382][ T4450] tmpfs: Unknown parameter 'fsmagic' [ 29.766292][ T4485] Zero length message leads to an empty skb [ 29.793507][ T4317] XFS (loop4): Unmounting Filesystem [ 29.840018][ T4319] Bluetooth: hci2: command 0x040f tx timeout [ 29.988496][ T4497] loop2: detected capacity change from 0 to 164 [ 30.091001][ T4501] FAULT_INJECTION: forcing a failure. [ 30.091001][ T4501] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 30.093473][ T4501] CPU: 1 PID: 4501 Comm: syz.1.33 Not tainted syzkaller #0 [ 30.094521][ T4501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 30.096056][ T4501] Call trace: [ 30.096545][ T4501] dump_backtrace+0x1c0/0x1ec [ 30.097267][ T4501] show_stack+0x2c/0x3c [ 30.097900][ T4501] __dump_stack+0x30/0x40 [ 30.098648][ T4501] dump_stack_lvl+0xf4/0x15c [ 30.099448][ T4501] dump_stack+0x1c/0x5c [ 30.100191][ T4501] should_fail_ex+0x3c0/0x518 [ 30.100994][ T4501] should_fail+0x14/0x24 [ 30.101742][ T4501] should_fail_usercopy+0x20/0x30 [ 30.102659][ T4501] iovec_from_user+0xcc/0x5dc [ 30.103448][ T4501] __import_iovec+0x84/0x470 [ 30.104242][ T4501] import_iovec+0x88/0xa4 [ 30.104915][ T4501] copy_msghdr_from_user+0x344/0x4d0 [ 30.105636][ T4501] __sys_sendmsg+0x22c/0x374 [ 30.106269][ T4501] __arm64_sys_sendmsg+0x80/0x94 [ 30.106948][ T4501] invoke_syscall+0x98/0x2b4 [ 30.107578][ T4501] el0_svc_common+0x138/0x258 [ 30.108222][ T4501] do_el0_svc+0x58/0x130 [ 30.108853][ T4501] el0_svc+0x58/0x128 [ 30.109440][ T4501] el0t_64_sync_handler+0x84/0xf0 [ 30.110124][ T4501] el0t_64_sync+0x18c/0x190 [ 30.134406][ T4507] loop2: detected capacity change from 0 to 8192 [ 30.143139][ T4507] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 30.143154][ T4507] REISERFS (device loop2): found reiserfs format "3.5" with non-standard journal [ 30.143459][ T4507] REISERFS (device loop2): using ordered data mode [ 30.162407][ T4507] reiserfs: using flush barriers [ 30.169067][ T4507] REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 30.169175][ T4507] REISERFS (device loop2): checking transaction log (loop2) [ 30.170056][ T4507] REISERFS (device loop2): Using r5 hash to sort names [ 30.170093][ T4507] REISERFS (device loop2): using 3.5.x disk format [ 30.170227][ T4507] REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage. [ 30.279269][ T4331] BTRFS info (device loop3): last unmount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 30.316195][ T47] Bluetooth: hci1: command 0x040f tx timeout [ 30.317090][ T4319] Bluetooth: hci0: command 0x040f tx timeout [ 30.325626][ T47] Bluetooth: hci3: command 0x040f tx timeout [ 30.395778][ T4328] Bluetooth: hci4: command 0x040f tx timeout [ 31.313913][ T4518] REISERFS warning (device loop2): reiserfs-13077 reiserfs_fh_to_dentry: nfsd/reiserfs, fhtype=268435458, len=2 - odd [ 31.417932][ T4528] netlink: 96 bytes leftover after parsing attributes in process `syz.4.26'. [ 31.528604][ T4522] loop0: detected capacity change from 0 to 32768 [ 31.544082][ T4533] loop3: detected capacity change from 0 to 128 [ 31.654784][ T4538] syz.3.25: attempt to access beyond end of device [ 31.654784][ T4538] loop3: rw=524288, sector=353, nr_sectors = 256 limit=128 [ 31.666178][ T4538] syz.3.25: attempt to access beyond end of device [ 31.666178][ T4538] loop3: rw=524288, sector=609, nr_sectors = 128 limit=128 [ 31.668811][ T4538] syz.3.25: attempt to access beyond end of device [ 31.668811][ T4538] loop3: rw=0, sector=353, nr_sectors = 8 limit=128 [ 31.680321][ T4538] syz.3.25: attempt to access beyond end of device [ 31.680321][ T4538] loop3: rw=0, sector=353, nr_sectors = 8 limit=128 [ 31.682564][ T4538] syz.3.25: attempt to access beyond end of device [ 31.682564][ T4538] loop3: rw=0, sector=353, nr_sectors = 8 limit=128 [ 31.684910][ T4538] syz.3.25: attempt to access beyond end of device [ 31.684910][ T4538] loop3: rw=0, sector=353, nr_sectors = 8 limit=128 [ 31.792926][ T4550] FAULT_INJECTION: forcing a failure. [ 31.792926][ T4550] name failslab, interval 1, probability 0, space 0, times 0 [ 31.806422][ T4550] CPU: 1 PID: 4550 Comm: syz.0.32 Not tainted syzkaller #0 [ 31.807632][ T4550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 31.809261][ T4550] Call trace: [ 31.809842][ T4550] dump_backtrace+0x1c0/0x1ec [ 31.810653][ T4550] show_stack+0x2c/0x3c [ 31.811425][ T4550] __dump_stack+0x30/0x40 [ 31.812209][ T4550] dump_stack_lvl+0xf4/0x15c [ 31.812986][ T4550] dump_stack+0x1c/0x5c [ 31.813680][ T4550] should_fail_ex+0x3c0/0x518 [ 31.814502][ T4550] __should_failslab+0xc0/0x120 [ 31.815302][ T4550] should_failslab+0x10/0x28 [ 31.816147][ T4550] kmem_cache_alloc+0x88/0x308 [ 31.816925][ T4550] vm_area_alloc+0x2c/0xe0 [ 31.817636][ T4550] mmap_region+0xb88/0x1900 [ 31.818390][ T4550] do_mmap+0x9cc/0x1138 [ 31.819147][ T4550] vm_mmap_pgoff+0x190/0x294 [ 31.819848][ T4550] ksys_mmap_pgoff+0x3b8/0x5a0 [ 31.820651][ T4550] __arm64_sys_mmap+0xf8/0x110 [ 31.821462][ T4550] invoke_syscall+0x98/0x2b4 [ 31.822224][ T4550] el0_svc_common+0x138/0x258 [ 31.822950][ T4550] do_el0_svc+0x58/0x130 [ 31.823623][ T4550] el0_svc+0x58/0x128 [ 31.824292][ T4550] el0t_64_sync_handler+0x84/0xf0 [ 31.825164][ T4550] el0t_64_sync+0x18c/0x190 [ 31.915997][ T47] Bluetooth: hci2: command 0x0419 tx timeout [ 32.030992][ T4559] (syz.3.37,4559,1):ocfs2_parse_options:1446 ERROR: Unrecognized mount option "bcs_X 000000000000001" or missing value [ 32.035690][ T4559] (syz.3.37,4559,1):ocfs2_fill_super:1176 ERROR: status = -22 [ 32.395922][ T4328] Bluetooth: hci3: command 0x0419 tx timeout [ 32.396989][ T4328] Bluetooth: hci1: command 0x0419 tx timeout [ 32.497276][ T47] Bluetooth: hci4: command 0x0419 tx timeout [ 32.552239][ T4580] netlink: 96 bytes leftover after parsing attributes in process `syz.1.50'. [ 33.561205][ T4586] set_capacity_and_notify: 3 callbacks suppressed [ 33.561215][ T4586] loop3: detected capacity change from 0 to 8192 [ 33.580056][ T4586] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 33.582251][ T4586] REISERFS (device loop3): found reiserfs format "3.5" with non-standard journal [ 33.583701][ T4586] REISERFS (device loop3): using ordered data mode [ 33.584673][ T4586] reiserfs: using flush barriers [ 33.610562][ T4586] REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 33.613228][ T4586] REISERFS (device loop3): checking transaction log (loop3) [ 33.666165][ T4586] REISERFS (device loop3): Using r5 hash to sort names [ 33.667312][ T4586] REISERFS (device loop3): using 3.5.x disk format [ 33.668505][ T4586] REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage. [ 33.729611][ T4556] loop2: detected capacity change from 0 to 131072 [ 33.863934][ T4594] REISERFS warning (device loop3): reiserfs-13077 reiserfs_fh_to_dentry: nfsd/reiserfs, fhtype=268435458, len=2 - odd [ 33.941196][ T4589] loop0: detected capacity change from 0 to 32768 [ 33.974734][ T4589] XFS (loop0): Mounting V5 Filesystem [ 34.004455][ T4589] XFS (loop0): Ending clean mount [ 34.012950][ T4400] XFS (loop0): Metadata CRC error detected at xfs_inobt_read_verify+0x50/0x108, xfs_finobt block 0x10 [ 34.014702][ T4400] XFS (loop0): Unmount and run xfs_repair [ 34.016441][ T4400] XFS (loop0): First 128 bytes of corrupted metadata buffer: [ 34.017826][ T4400] 00000000: 46 49 42 33 00 00 00 01 ff ff ff ff ff ff ff ff FIB3............ [ 34.019377][ T4400] 00000010: 00 00 00 00 00 00 00 10 00 00 00 01 00 00 00 10 ................ [ 34.022078][ T4400] 00000020: d7 dc 42 4e 79 90 42 cb 9f 91 9c b7 20 0a 10 1d ..BNy.B..... ... [ 34.024695][ T4400] 00000030: 00 00 00 00 0f 8d d2 a2 00 00 18 00 00 00 40 37 ..............@7 [ 34.030423][ T4400] 00000040: ff ff ff ff ff ff fe 00 00 00 00 00 00 00 00 00 ................ [ 34.033166][ T4400] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 34.043028][ T4400] 00000060: 00 00 00 00 00 f0 00 00 00 00 00 00 00 00 00 00 ................ [ 34.054150][ T4400] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 34.073686][ T4589] XFS (loop0): metadata I/O error in "xfs_btree_read_buf_block+0x184/0x290" at daddr 0x10 len 4 error 74 [ 34.076616][ T4589] XFS (loop0): Failed to initialize disk quotas. [ 34.114699][ T4607] FAULT_INJECTION: forcing a failure. [ 34.114699][ T4607] name failslab, interval 1, probability 0, space 0, times 0 [ 34.116967][ T4607] CPU: 0 PID: 4607 Comm: syz.2.46 Not tainted syzkaller #0 [ 34.118123][ T4607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 34.119584][ T4607] Call trace: [ 34.120111][ T4607] dump_backtrace+0x1c0/0x1ec [ 34.120895][ T4607] show_stack+0x2c/0x3c [ 34.121584][ T4607] __dump_stack+0x30/0x40 [ 34.122253][ T4607] dump_stack_lvl+0xf4/0x15c [ 34.122967][ T4607] dump_stack+0x1c/0x5c [ 34.123569][ T4607] should_fail_ex+0x3c0/0x518 [ 34.124357][ T4607] __should_failslab+0xc0/0x120 [ 34.125330][ T4607] should_failslab+0x10/0x28 [ 34.126181][ T4607] __kmem_cache_alloc_node+0x7c/0x314 [ 34.127008][ T4607] kmalloc_trace+0x48/0x94 [ 34.127752][ T4607] rtnl_newlink+0xf4/0x1a50 [ 34.128542][ T4607] rtnetlink_rcv_msg+0x698/0xcdc [ 34.129358][ T4607] netlink_rcv_skb+0x218/0x3e8 [ 34.130224][ T4607] rtnetlink_rcv+0x28/0x38 [ 34.131023][ T4607] netlink_unicast+0x60c/0x814 [ 34.131807][ T4607] netlink_sendmsg+0x6f4/0x9c0 [ 34.132612][ T4607] ____sys_sendmsg+0x5c8/0x938 [ 34.133386][ T4607] __sys_sendmsg+0x288/0x374 [ 34.134157][ T4607] __arm64_sys_sendmsg+0x80/0x94 [ 34.135012][ T4607] invoke_syscall+0x98/0x2b4 [ 34.135874][ T4607] el0_svc_common+0x138/0x258 [ 34.136721][ T4607] do_el0_svc+0x58/0x130 [ 34.137437][ T4607] el0_svc+0x58/0x128 [ 34.138122][ T4607] el0t_64_sync_handler+0x84/0xf0 [ 34.139010][ T4607] el0t_64_sync+0x18c/0x190 [ 34.148908][ T4322] XFS (loop0): Unmounting Filesystem [ 34.186355][ T4611] loop2: detected capacity change from 0 to 4096 [ 34.215344][ T4611] ntfs3: loop2: ntfs_set_state r=3 failed, -22. [ 34.218007][ T4611] FAULT_INJECTION: forcing a failure. [ 34.218007][ T4611] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 34.224386][ T4611] CPU: 1 PID: 4611 Comm: syz.2.49 Not tainted syzkaller #0 [ 34.225412][ T4611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 34.227257][ T4611] Call trace: [ 34.227893][ T4611] dump_backtrace+0x1c0/0x1ec [ 34.228674][ T4611] show_stack+0x2c/0x3c [ 34.229369][ T4611] __dump_stack+0x30/0x40 [ 34.230098][ T4611] dump_stack_lvl+0xf4/0x15c [ 34.230725][ T4611] dump_stack+0x1c/0x5c [ 34.231307][ T4611] should_fail_ex+0x3c0/0x518 [ 34.232068][ T4611] should_fail+0x14/0x24 [ 34.232787][ T4611] should_fail_usercopy+0x20/0x30 [ 34.233589][ T4611] strncpy_from_user+0x48/0x578 [ 34.234265][ T4611] getname_flags+0xec/0x45c [ 34.234908][ T4611] __arm64_sys_mkdirat+0x80/0xa8 [ 34.235623][ T4611] invoke_syscall+0x98/0x2b4 [ 34.236276][ T4611] el0_svc_common+0x138/0x258 [ 34.236942][ T4611] do_el0_svc+0x58/0x130 [ 34.237588][ T4611] el0_svc+0x58/0x128 [ 34.238308][ T4611] el0t_64_sync_handler+0x84/0xf0 [ 34.239094][ T4611] el0t_64_sync+0x18c/0x190 [ 34.263924][ T4615] FAULT_INJECTION: forcing a failure. [ 34.263924][ T4615] name failslab, interval 1, probability 0, space 0, times 0 [ 34.265888][ T4615] CPU: 1 PID: 4615 Comm: syz.1.52 Not tainted syzkaller #0 [ 34.266974][ T4615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 34.268665][ T4615] Call trace: [ 34.269162][ T4615] dump_backtrace+0x1c0/0x1ec [ 34.270744][ T4615] show_stack+0x2c/0x3c [ 34.271401][ T4615] __dump_stack+0x30/0x40 [ 34.272247][ T4615] dump_stack_lvl+0xf4/0x15c [ 34.272998][ T4615] dump_stack+0x1c/0x5c [ 34.273630][ T4615] should_fail_ex+0x3c0/0x518 [ 34.274492][ T4615] __should_failslab+0xc0/0x120 [ 34.275249][ T4615] should_failslab+0x10/0x28 [ 34.275952][ T4615] __kmem_cache_alloc_node+0x7c/0x314 [ 34.276914][ T4615] __kmalloc_node+0xdc/0x17c [ 34.277543][ T4615] memcg_alloc_slab_cgroups+0x90/0x160 [ 34.278474][ T4615] slab_post_alloc_hook+0xc0/0x430 [ 34.279356][ T4615] kmem_cache_alloc+0x22c/0x308 [ 34.280133][ T4615] dst_alloc+0xf8/0x170 [ 34.280675][ T4615] ip6_pol_route+0x80c/0x1048 [ 34.281330][ T4615] ip6_pol_route_output+0x60/0x94 [ 34.282343][ T4615] fib6_rule_lookup+0x190/0x4b4 [ 34.283132][ T4615] ip6_route_output_flags_noref+0x250/0x314 [ 34.284297][ T4615] ip6_route_output_flags+0xe4/0x360 [ 34.285253][ T4615] ip6_dst_lookup_tail+0x170/0x1300 [ 34.286316][ T4615] ip6_dst_lookup_flow+0x54/0xe0 [ 34.287125][ T4615] rawv6_sendmsg+0xa3c/0x1314 [ 34.287914][ T4615] inet_sendmsg+0x154/0x284 [ 34.288616][ T4615] ____sys_sendmsg+0x5c8/0x938 [ 34.289358][ T4615] __sys_sendmsg+0x288/0x374 [ 34.290091][ T4615] __arm64_sys_sendmsg+0x80/0x94 [ 34.290853][ T4615] invoke_syscall+0x98/0x2b4 [ 34.291548][ T4615] el0_svc_common+0x138/0x258 [ 34.292334][ T4615] do_el0_svc+0x58/0x130 [ 34.293058][ T4615] el0_svc+0x58/0x128 [ 34.293703][ T4615] el0t_64_sync_handler+0x84/0xf0 [ 34.294574][ T4615] el0t_64_sync+0x18c/0x190 [ 34.330401][ T4583] ntfs3: loop2: ntfs3_write_inode r=3 failed, -22. [ 34.332328][ T4330] ntfs3: loop2: ntfs_set_state r=3 failed, -22. [ 34.333442][ T4330] ntfs3: loop2: Mark volume as dirty due to NTFS errors [ 34.334558][ T4330] ntfs3: loop2: ntfs_set_state r=3 failed, -22. [ 34.338287][ T1574] ntfs3: loop2: ntfs3_write_inode r=3 failed, -22. [ 34.340136][ T4330] ntfs3: loop2: ntfs_evict_inode r=3 failed, -22. [ 34.374095][ T4618] loop1: detected capacity change from 0 to 4096 [ 34.382370][ T4620] Bluetooth: MGMT ver 1.22 [ 34.425649][ T4618] ntfs3: loop1: ntfs_set_state r=3 failed, -22. [ 34.503900][ T1574] ntfs3: loop1: ntfs3_write_inode r=3 failed, -22. [ 34.507300][ T4318] ntfs3: loop1: ntfs_set_state r=3 failed, -22. [ 34.509584][ T4318] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 34.511091][ T4318] ntfs3: loop1: ntfs_set_state r=3 failed, -22. [ 34.515854][ T55] ntfs3: loop1: ntfs3_write_inode r=3 failed, -22. [ 34.521782][ T4318] ntfs3: loop1: ntfs_evict_inode r=3 failed, -22. [ 34.547766][ T4630] loop0: detected capacity change from 0 to 1024 [ 34.549228][ T4630] EXT4-fs: Ignoring removed bh option [ 34.550084][ T4630] EXT4-fs: Ignoring removed oldalloc option [ 34.551116][ T4630] EXT4-fs: Ignoring removed nomblk_io_submit option [ 34.556378][ T4630] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 34.561258][ T4634] loop3: detected capacity change from 0 to 164 [ 34.564588][ T4630] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e841c01c, mo2=0003] [ 34.566110][ T4630] System zones: 0-1, 3-36 [ 34.581075][ T4630] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 34.624779][ T4638] FAULT_INJECTION: forcing a failure. [ 34.624779][ T4638] name failslab, interval 1, probability 0, space 0, times 0 [ 34.636400][ T4638] CPU: 0 PID: 4638 Comm: syz.2.58 Not tainted syzkaller #0 [ 34.637646][ T4638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 34.639161][ T4638] Call trace: [ 34.639677][ T4638] dump_backtrace+0x1c0/0x1ec [ 34.640515][ T4638] show_stack+0x2c/0x3c [ 34.641244][ T4638] __dump_stack+0x30/0x40 [ 34.642054][ T4638] dump_stack_lvl+0xf4/0x15c [ 34.642723][ T4638] dump_stack+0x1c/0x5c [ 34.643363][ T4638] should_fail_ex+0x3c0/0x518 [ 34.644134][ T4638] __should_failslab+0xc0/0x120 [ 34.644938][ T4638] should_failslab+0x10/0x28 [ 34.645659][ T4638] kmem_cache_alloc+0x88/0x308 [ 34.646343][ T4638] skb_clone+0x190/0x304 [ 34.647119][ T4638] __netlink_deliver_tap+0x36c/0x6dc [ 34.648017][ T4638] netlink_deliver_tap+0x1ac/0x1b0 [ 34.649083][ T4638] netlink_unicast+0x5ec/0x814 [ 34.649898][ T4638] netlink_sendmsg+0x6f4/0x9c0 [ 34.650713][ T4638] ____sys_sendmsg+0x5c8/0x938 [ 34.651523][ T4638] __sys_sendmsg+0x288/0x374 [ 34.652311][ T4638] __arm64_sys_sendmsg+0x80/0x94 [ 34.653147][ T4638] invoke_syscall+0x98/0x2b4 [ 34.653956][ T4638] el0_svc_common+0x138/0x258 [ 34.654756][ T4638] do_el0_svc+0x58/0x130 [ 34.655445][ T4638] el0_svc+0x58/0x128 [ 34.656110][ T4638] el0t_64_sync_handler+0x84/0xf0 [ 34.656903][ T4638] el0t_64_sync+0x18c/0x190 [ 34.664364][ T4322] EXT4-fs (loop0): unmounting filesystem. [ 34.685214][ T4641] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input4 [ 34.769396][ T4641] loop3: detected capacity change from 0 to 4096 [ 34.778959][ T4641] ntfs3: loop3: ntfs_set_state r=3 failed, -22. [ 34.898884][ T4648] loop2: detected capacity change from 0 to 4096 [ 35.179426][ T4648] ntfs3: loop2: Different NTFS' sector size (2048) and media sector size (512) [ 35.280154][ T4653] netlink: 28 bytes leftover after parsing attributes in process `syz.0.63'. [ 35.326048][ T4655] FAULT_INJECTION: forcing a failure. [ 35.326048][ T4655] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 35.330769][ T4655] CPU: 0 PID: 4655 Comm: syz.4.64 Not tainted syzkaller #0 [ 35.331894][ T4655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 35.333490][ T4655] Call trace: [ 35.334021][ T4655] dump_backtrace+0x1c0/0x1ec [ 35.334945][ T4655] show_stack+0x2c/0x3c [ 35.335784][ T4655] __dump_stack+0x30/0x40 [ 35.336557][ T4655] dump_stack_lvl+0xf4/0x15c [ 35.337354][ T4655] dump_stack+0x1c/0x5c [ 35.338092][ T4655] should_fail_ex+0x3c0/0x518 [ 35.338839][ T4655] should_fail+0x14/0x24 [ 35.339589][ T4655] should_fail_usercopy+0x20/0x30 [ 35.340504][ T4655] simple_read_from_buffer+0xcc/0x240 [ 35.341405][ T4655] proc_fail_nth_read+0x19c/0x23c [ 35.342155][ T4655] vfs_read+0x290/0x7f0 [ 35.342868][ T4655] ksys_read+0x12c/0x224 [ 35.343618][ T4655] __arm64_sys_read+0x7c/0x90 [ 35.344432][ T4655] invoke_syscall+0x98/0x2b4 [ 35.345164][ T4655] el0_svc_common+0x138/0x258 [ 35.345906][ T4655] do_el0_svc+0x58/0x130 [ 35.346640][ T4655] el0_svc+0x58/0x128 [ 35.347323][ T4655] el0t_64_sync_handler+0x84/0xf0 [ 35.348095][ T4655] el0t_64_sync+0x18c/0x190 [ 35.486708][ T4648] fuse: Unknown parameter 'XC|󋆈pƃ\qd_change" failed at function = gfs2_quota_cleanup, file = fs/gfs2/quota.c, line = 1485 [ 55.848449][ T4331] CPU: 1 PID: 4331 Comm: syz-executor Not tainted syzkaller #0 [ 55.849693][ T4331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 55.851335][ T4331] Call trace: [ 55.851896][ T4331] dump_backtrace+0x1c0/0x1ec [ 55.852723][ T4331] show_stack+0x2c/0x3c [ 55.853373][ T4331] __dump_stack+0x30/0x40 [ 55.854104][ T4331] dump_stack_lvl+0xf4/0x15c [ 55.854889][ T4331] dump_stack+0x1c/0x5c [ 55.855549][ T4331] gfs2_assert_warn_i+0x16c/0x26c [ 55.856332][ T4331] gfs2_quota_cleanup+0x464/0x668 [ 55.857128][ T4331] gfs2_put_super+0x1f0/0x760 [ 55.857865][ T4331] generic_shutdown_super+0x130/0x324 [ 55.858870][ T4331] kill_block_super+0x70/0xdc [ 55.859692][ T4331] gfs2_kill_sb+0xc0/0xd4 [ 55.860547][ T4331] deactivate_locked_super+0xac/0x120 [ 55.861479][ T4331] deactivate_super+0xe4/0x104 [ 55.862232][ T4331] cleanup_mnt+0x390/0x418 [ 55.863000][ T4331] __cleanup_mnt+0x20/0x30 [ 55.863723][ T4331] task_work_run+0x1ec/0x278 [ 55.864446][ T4331] do_notify_resume+0x1fa0/0x2aa4 [ 55.865244][ T4331] el0_svc+0x98/0x128 [ 55.865996][ T4331] el0t_64_sync_handler+0x84/0xf0 [ 55.866812][ T4331] el0t_64_sync+0x18c/0x190 [ 55.876139][ T5378] REISERFS (device loop1): journal params: device loop1, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 55.884187][ T5378] REISERFS (device loop1): checking transaction log (loop1) [ 55.894129][ T5378] REISERFS (device loop1): Using r5 hash to sort names [ 55.895274][ T5378] REISERFS (device loop1): using 3.5.x disk format [ 55.903977][ T5378] REISERFS (device loop1): Created .reiserfs_priv - reserved for xattr storage. [ 55.942807][ T5378] REISERFS warning (device loop1): reiserfs-13077 reiserfs_fh_to_dentry: nfsd/reiserfs, fhtype=268435458, len=2 - odd [ 56.061598][ T5392] FAULT_INJECTION: forcing a failure. [ 56.061598][ T5392] name failslab, interval 1, probability 0, space 0, times 0 [ 56.063710][ T5392] CPU: 0 PID: 5392 Comm: syz.4.272 Not tainted syzkaller #0 [ 56.064855][ T5392] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 56.066694][ T5392] Call trace: [ 56.067246][ T5392] dump_backtrace+0x1c0/0x1ec [ 56.068080][ T5392] show_stack+0x2c/0x3c [ 56.068695][ T5392] __dump_stack+0x30/0x40 [ 56.069385][ T5392] dump_stack_lvl+0xf4/0x15c [ 56.070053][ T5392] dump_stack+0x1c/0x5c [ 56.070772][ T5392] should_fail_ex+0x3c0/0x518 [ 56.071571][ T5392] __should_failslab+0xc0/0x120 [ 56.072380][ T5392] should_failslab+0x10/0x28 [ 56.073214][ T5392] kmem_cache_alloc+0x88/0x308 [ 56.074079][ T5392] skb_clone+0x190/0x304 [ 56.074798][ T5392] __netlink_deliver_tap+0x36c/0x6dc [ 56.075661][ T5392] netlink_deliver_tap+0x1ac/0x1b0 [ 56.076540][ T5392] netlink_unicast+0x5ec/0x814 [ 56.077264][ T5392] netlink_sendmsg+0x6f4/0x9c0 [ 56.078116][ T5392] ____sys_sendmsg+0x5c8/0x938 [ 56.078944][ T5392] __sys_sendmsg+0x288/0x374 [ 56.079751][ T5392] __arm64_sys_sendmsg+0x80/0x94 [ 56.080610][ T5392] invoke_syscall+0x98/0x2b4 [ 56.081364][ T5392] el0_svc_common+0x138/0x258 [ 56.082138][ T5392] do_el0_svc+0x58/0x130 [ 56.082881][ T5392] el0_svc+0x58/0x128 [ 56.083561][ T5392] el0t_64_sync_handler+0x84/0xf0 [ 56.084533][ T5392] el0t_64_sync+0x18c/0x190 [ 56.116444][ T5394] loop4: detected capacity change from 0 to 512 [ 56.183489][ T5394] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 56.241137][ T5408] netlink: 132 bytes leftover after parsing attributes in process `syz.2.276'. [ 56.247551][ T4317] EXT4-fs (loop4): unmounting filesystem. [ 56.284025][ T5414] FAULT_INJECTION: forcing a failure. [ 56.284025][ T5414] name failslab, interval 1, probability 0, space 0, times 0 [ 56.287770][ T5414] CPU: 1 PID: 5414 Comm: syz.2.280 Not tainted syzkaller #0 [ 56.288966][ T5414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 56.290699][ T5414] Call trace: [ 56.291240][ T5414] dump_backtrace+0x1c0/0x1ec [ 56.292088][ T5414] show_stack+0x2c/0x3c [ 56.292807][ T5414] __dump_stack+0x30/0x40 [ 56.293635][ T5414] dump_stack_lvl+0xf4/0x15c [ 56.294452][ T5414] dump_stack+0x1c/0x5c [ 56.295159][ T5414] should_fail_ex+0x3c0/0x518 [ 56.295981][ T5414] __should_failslab+0xc0/0x120 [ 56.296858][ T5414] should_failslab+0x10/0x28 [ 56.297631][ T5414] kmem_cache_alloc+0x88/0x308 [ 56.298449][ T5414] skb_clone+0x190/0x304 [ 56.299151][ T5414] __netlink_deliver_tap+0x36c/0x6dc [ 56.300060][ T5414] netlink_deliver_tap+0x1ac/0x1b0 [ 56.300973][ T5414] netlink_unicast+0x5ec/0x814 [ 56.301850][ T5414] netlink_sendmsg+0x6f4/0x9c0 [ 56.302625][ T5414] ____sys_sendmsg+0x5c8/0x938 [ 56.303466][ T5414] __sys_sendmsg+0x288/0x374 [ 56.304302][ T5414] __arm64_sys_sendmsg+0x80/0x94 [ 56.305178][ T5414] invoke_syscall+0x98/0x2b4 [ 56.305926][ T5414] el0_svc_common+0x138/0x258 [ 56.306634][ T5414] do_el0_svc+0x58/0x130 [ 56.307410][ T5414] el0_svc+0x58/0x128 [ 56.308106][ T5414] el0t_64_sync_handler+0x84/0xf0 [ 56.309036][ T5414] el0t_64_sync+0x18c/0x190 [ 56.329013][ T5414] netlink: 40 bytes leftover after parsing attributes in process `syz.2.280'. [ 56.354540][ T5397] loop3: detected capacity change from 0 to 32768 [ 56.393973][ T5397] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 56.398827][ T5397] BTRFS info (device loop3): using sha256 (sha256-ce) checksum algorithm [ 56.400233][ T5397] BTRFS info (device loop3): force clearing of disk cache [ 56.401359][ T5397] BTRFS info (device loop3): enabling auto defrag [ 56.402592][ T5397] BTRFS info (device loop3): max_inline at 727 [ 56.403515][ T5397] BTRFS info (device loop3): enabling disk space caching [ 56.404694][ T5397] BTRFS info (device loop3): disk space caching is enabled [ 56.437442][ T5424] loop0: detected capacity change from 0 to 128 [ 56.463149][ T5422] loop2: detected capacity change from 0 to 8192 [ 56.471055][ T5422] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 56.473155][ T5422] REISERFS (device loop2): found reiserfs format "3.5" with non-standard journal [ 56.475791][ T5422] REISERFS (device loop2): using ordered data mode [ 56.479235][ T5422] reiserfs: using flush barriers [ 56.481728][ T5422] REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 56.484509][ T5422] REISERFS (device loop2): checking transaction log (loop2) [ 56.489629][ T5422] REISERFS (device loop2): Using r5 hash to sort names [ 56.491077][ T5422] REISERFS (device loop2): using 3.5.x disk format [ 56.493787][ T5422] REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage. [ 56.501431][ T5422] REISERFS warning (device loop2): reiserfs-13077 reiserfs_fh_to_dentry: nfsd/reiserfs, fhtype=268435458, len=2 - odd [ 56.528631][ T5397] BTRFS info (device loop3): enabling ssd optimizations [ 56.531864][ T5397] BTRFS info (device loop3): rebuilding free space tree [ 56.539049][ T5397] BTRFS info (device loop3): disabling free space tree [ 56.540142][ T5397] BTRFS info (device loop3): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 56.541739][ T5397] BTRFS info (device loop3): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 56.569373][ T5440] overlayfs: unrecognized mount option "verity=off" or missing value [ 56.574587][ T5440] fuse: Bad value for 'fd' [ 56.660496][ T5447] loop0: detected capacity change from 0 to 128 [ 56.673276][ T4331] BTRFS info (device loop3): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 56.679473][ T5447] FAULT_INJECTION: forcing a failure. [ 56.679473][ T5447] name failslab, interval 1, probability 0, space 0, times 0 [ 56.684189][ T5447] CPU: 0 PID: 5447 Comm: syz.0.285 Not tainted syzkaller #0 [ 56.685477][ T5447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 56.687257][ T5447] Call trace: [ 56.687777][ T5447] dump_backtrace+0x1c0/0x1ec [ 56.688568][ T5447] show_stack+0x2c/0x3c [ 56.689327][ T5447] __dump_stack+0x30/0x40 [ 56.690116][ T5447] dump_stack_lvl+0xf4/0x15c [ 56.690941][ T5447] dump_stack+0x1c/0x5c [ 56.691640][ T5447] should_fail_ex+0x3c0/0x518 [ 56.692447][ T5447] __should_failslab+0xc0/0x120 [ 56.693249][ T5447] should_failslab+0x10/0x28 [ 56.694083][ T5447] __kmem_cache_alloc_node+0x7c/0x314 [ 56.695000][ T5447] __kmalloc+0xd8/0x178 [ 56.695722][ T5447] __d_alloc+0xb4/0x684 [ 56.696399][ T5447] d_alloc_parallel+0x7c/0x113c [ 56.697199][ T5447] path_openat+0x708/0x26bc [ 56.697925][ T5447] do_filp_open+0x194/0x384 [ 56.698759][ T5447] do_sys_openat2+0x134/0x3f4 [ 56.699581][ T5447] __arm64_sys_openat+0x118/0x14c [ 56.700506][ T5447] invoke_syscall+0x98/0x2b4 [ 56.701240][ T5447] el0_svc_common+0x138/0x258 [ 56.701948][ T5447] do_el0_svc+0x58/0x130 [ 56.702693][ T5447] el0_svc+0x58/0x128 [ 56.703403][ T5447] el0t_64_sync_handler+0x84/0xf0 [ 56.704173][ T5447] el0t_64_sync+0x18c/0x190 [ 57.726721][ T5462] netlink: 132 bytes leftover after parsing attributes in process `syz.1.290'. [ 57.829955][ T5468] loop1: detected capacity change from 0 to 8192 [ 57.832543][ T5468] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 57.835423][ T5468] REISERFS (device loop1): found reiserfs format "3.5" with non-standard journal [ 57.837503][ T5468] REISERFS (device loop1): using ordered data mode [ 57.839033][ T5468] reiserfs: using flush barriers [ 57.840494][ T5468] REISERFS (device loop1): journal params: device loop1, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 57.843556][ T5470] loop4: detected capacity change from 0 to 7 [ 57.843686][ T5468] REISERFS (device loop1): checking transaction log (loop1) [ 57.850724][ T5468] REISERFS (device loop1): Using r5 hash to sort names [ 57.851958][ T5468] REISERFS (device loop1): using 3.5.x disk format [ 57.853272][ T5468] REISERFS (device loop1): Created .reiserfs_priv - reserved for xattr storage. [ 57.856967][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 57.858726][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 57.860389][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 57.861958][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 57.862822][ T5468] REISERFS warning (device loop1): reiserfs-13077 reiserfs_fh_to_dentry: nfsd/reiserfs, fhtype=268435458, len=2 - odd [ 57.863757][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 57.865768][ T5473] netlink: 52 bytes leftover after parsing attributes in process `syz.2.295'. [ 57.866604][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 57.872440][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 57.874004][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 57.879500][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 57.879854][ T5473] n: the hash_elasticity option has been deprecated and is always 16 [ 57.881042][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 57.884029][ T5473] n: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 57.892194][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 57.893809][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 57.897662][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 57.899225][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 57.900453][ T5470] ldm_validate_partition_table(): Disk read failed. [ 57.901791][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 57.903302][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 57.904830][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 57.906456][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 57.911546][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 57.913365][ T5470] Dev loop4: unable to read RDB block 0 [ 57.914822][ T5470] loop4: unable to read partition table [ 57.916807][ T5470] loop4: partition table beyond EOD, truncated [ 57.917956][ T5470] loop_reread_partitions: partition scan of loop4 (Cj̖P=ý?}X %֐ȵ4FLQk݊5) failed (rc=-5) [ 58.126866][ T5478] loop1: detected capacity change from 0 to 32768 [ 58.129233][ T5478] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by syz.1.296 (5478) [ 58.133153][ T5478] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 58.135044][ T5478] BTRFS info (device loop1): using sha256 (sha256-ce) checksum algorithm [ 58.137211][ T5478] BTRFS info (device loop1): force clearing of disk cache [ 58.138511][ T5478] BTRFS info (device loop1): enabling auto defrag [ 58.139613][ T5478] BTRFS info (device loop1): max_inline at 727 [ 58.140570][ T5478] BTRFS info (device loop1): enabling disk space caching [ 58.141878][ T5478] BTRFS info (device loop1): disk space caching is enabled [ 58.165148][ T5478] BTRFS info (device loop1): enabling ssd optimizations [ 58.166942][ T5478] BTRFS info (device loop1): rebuilding free space tree [ 58.172709][ T5478] BTRFS info (device loop1): disabling free space tree [ 58.174178][ T5478] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 58.176358][ T5478] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 58.181544][ T27] audit: type=1326 audit(58.211:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5481 comm="syz.3.298" exe="/root/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffbb777128 code=0x0 [ 58.248472][ T4318] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 58.378328][ T5505] loop3: detected capacity change from 0 to 32768 [ 58.392116][ T5505] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 58.393985][ T5505] BTRFS info (device loop3): using crc32c (crc32c-generic) checksum algorithm [ 58.396014][ T5505] BTRFS info (device loop3): turning on sync discard [ 58.399017][ T5505] BTRFS info (device loop3): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 58.401160][ T5505] BTRFS info (device loop3): use zstd compression, level 3 [ 58.404053][ T5505] BTRFS info (device loop3): turning on async discard [ 58.406523][ T5505] BTRFS warning (device loop3): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 58.408340][ T5505] BTRFS info (device loop3): trying to use backup root at mount time [ 58.411041][ T5505] BTRFS info (device loop3): enabling auto defrag [ 58.413190][ T5505] BTRFS info (device loop3): using free space tree [ 58.529639][ T4583] BTRFS warning (device loop3): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 58.538814][ T5505] BTRFS error (device loop3): failed to load root extent [ 58.540039][ T5505] BTRFS warning (device loop3): try to load backup roots slot 1 [ 58.541553][ T39] BTRFS warning (device loop3): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 58.543838][ T5505] BTRFS warning (device loop3): couldn't read tree root [ 58.544987][ T5505] BTRFS warning (device loop3): try to load backup roots slot 2 [ 58.554076][ T5505] BTRFS error (device loop3): parent transid verify failed on logical 5255168 mirror 1 wanted 5 found 7 [ 58.562413][ T5505] BTRFS warning (device loop3): couldn't read tree root [ 58.563504][ T5505] BTRFS warning (device loop3): try to load backup roots slot 3 [ 58.572457][ T5507] BTRFS warning: duplicate device /dev/loop1 devid 1 generation 8 scanned by syz.1.300 (5507) [ 59.473684][ T5505] BTRFS info (device loop3): enabling ssd optimizations [ 59.475264][ T5505] BTRFS info (device loop3): rebuilding free space tree [ 59.482916][ T5505] BTRFS info (device loop3): checking UUID tree [ 59.490026][ T5536] __nla_validate_parse: 1 callbacks suppressed [ 59.490037][ T5536] netlink: 132 bytes leftover after parsing attributes in process `syz.4.303'. [ 59.533207][ T39] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.558427][ T5538] FAULT_INJECTION: forcing a failure. [ 59.558427][ T5538] name failslab, interval 1, probability 0, space 0, times 0 [ 59.572911][ T5538] CPU: 1 PID: 5538 Comm: syz.3.299 Not tainted syzkaller #0 [ 59.574133][ T5538] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 59.575716][ T5538] Call trace: [ 59.576348][ T5538] dump_backtrace+0x1c0/0x1ec [ 59.577135][ T5538] show_stack+0x2c/0x3c [ 59.577817][ T5538] __dump_stack+0x30/0x40 [ 59.578611][ T5538] dump_stack_lvl+0xf4/0x15c [ 59.579402][ T5538] dump_stack+0x1c/0x5c [ 59.580035][ T5538] should_fail_ex+0x3c0/0x518 [ 59.580844][ T5538] __should_failslab+0xc0/0x120 [ 59.581562][ T5538] should_failslab+0x10/0x28 [ 59.582366][ T5538] __kmem_cache_alloc_node+0x7c/0x314 [ 59.583520][ T5538] __kmalloc+0xd8/0x178 [ 59.584279][ T5538] tomoyo_realpath_from_path+0xc4/0x4d4 [ 59.585302][ T5538] tomoyo_path_number_perm+0x1c8/0x550 [ 59.586233][ T5538] tomoyo_file_ioctl+0x2c/0x3c [ 59.587003][ T5538] security_file_ioctl+0x80/0xbc [ 59.587848][ T5538] __arm64_sys_ioctl+0xa8/0x1c8 [ 59.588593][ T5538] invoke_syscall+0x98/0x2b4 [ 59.589373][ T5538] el0_svc_common+0x138/0x258 [ 59.590156][ T5538] do_el0_svc+0x58/0x130 [ 59.590904][ T5538] el0_svc+0x58/0x128 [ 59.591598][ T5538] el0t_64_sync_handler+0x84/0xf0 [ 59.592501][ T5538] el0t_64_sync+0x18c/0x190 [ 59.705374][ T5538] ERROR: Out of memory at tomoyo_realpath_from_path. [ 59.788153][ T5541] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 59.790374][ T5541] REISERFS (device loop1): found reiserfs format "3.5" with non-standard journal [ 59.791864][ T5541] REISERFS (device loop1): using ordered data mode [ 59.792897][ T5541] reiserfs: using flush barriers [ 59.813615][ T5541] REISERFS (device loop1): journal params: device loop1, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 59.826838][ T5541] REISERFS (device loop1): checking transaction log (loop1) [ 59.836293][ T5541] REISERFS (device loop1): Using r5 hash to sort names [ 59.837576][ T5541] REISERFS (device loop1): using 3.5.x disk format [ 59.838863][ T5541] REISERFS (device loop1): Created .reiserfs_priv - reserved for xattr storage. [ 59.847415][ T5541] REISERFS warning (device loop1): reiserfs-13077 reiserfs_fh_to_dentry: nfsd/reiserfs, fhtype=268435458, len=2 - odd [ 59.875721][ T4331] BTRFS info (device loop3): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 60.044743][ T5549] FAULT_INJECTION: forcing a failure. [ 60.044743][ T5549] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 60.047185][ T5549] CPU: 0 PID: 5549 Comm: syz.1.309 Not tainted syzkaller #0 [ 60.048300][ T5549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 60.050016][ T5549] Call trace: [ 60.050555][ T5549] dump_backtrace+0x1c0/0x1ec [ 60.051314][ T5549] show_stack+0x2c/0x3c [ 60.052004][ T5549] __dump_stack+0x30/0x40 [ 60.052739][ T5549] dump_stack_lvl+0xf4/0x15c [ 60.053468][ T5549] dump_stack+0x1c/0x5c [ 60.054222][ T5549] should_fail_ex+0x3c0/0x518 [ 60.055033][ T5549] should_fail+0x14/0x24 [ 60.055727][ T5549] should_fail_usercopy+0x20/0x30 [ 60.056569][ T5549] simple_read_from_buffer+0xcc/0x240 [ 60.057452][ T5549] proc_fail_nth_read+0x19c/0x23c [ 60.058308][ T5549] vfs_read+0x290/0x7f0 [ 60.058942][ T5549] ksys_read+0x12c/0x224 [ 60.059618][ T5549] __arm64_sys_read+0x7c/0x90 [ 60.060352][ T5549] invoke_syscall+0x98/0x2b4 [ 60.061113][ T5549] el0_svc_common+0x138/0x258 [ 60.061896][ T5549] do_el0_svc+0x58/0x130 [ 60.062637][ T5549] el0_svc+0x58/0x128 [ 60.063349][ T5549] el0t_64_sync_handler+0x84/0xf0 [ 60.064227][ T5549] el0t_64_sync+0x18c/0x190 [ 60.098519][ T5542] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz.4.305 (5542) [ 60.102414][ T5542] BTRFS info (device loop4): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 60.104120][ T5542] BTRFS info (device loop4): using crc32c (crc32c-generic) checksum algorithm [ 60.105503][ T5542] BTRFS info (device loop4): turning on sync discard [ 60.106839][ T5542] BTRFS info (device loop4): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 60.108275][ T5542] BTRFS info (device loop4): use zstd compression, level 3 [ 60.109585][ T5542] BTRFS info (device loop4): turning on async discard [ 60.110750][ T5542] BTRFS warning (device loop4): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 60.112489][ T5542] BTRFS info (device loop4): trying to use backup root at mount time [ 60.113736][ T5542] BTRFS info (device loop4): enabling auto defrag [ 60.118169][ T5542] BTRFS info (device loop4): using free space tree [ 60.124505][ T5449] BTRFS warning (device loop4): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 60.127884][ T5542] BTRFS error (device loop4): failed to load root extent [ 60.129081][ T5542] BTRFS warning (device loop4): try to load backup roots slot 1 [ 60.130595][ T39] BTRFS warning (device loop4): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 60.133092][ T5542] BTRFS warning (device loop4): couldn't read tree root [ 60.134255][ T5542] BTRFS warning (device loop4): try to load backup roots slot 2 [ 60.143227][ T5542] BTRFS error (device loop4): parent transid verify failed on logical 5255168 mirror 1 wanted 5 found 7 [ 60.145014][ T5542] BTRFS warning (device loop4): couldn't read tree root [ 60.146143][ T5542] BTRFS warning (device loop4): try to load backup roots slot 3 [ 60.150260][ T5542] BTRFS info (device loop4): enabling ssd optimizations [ 60.151522][ T5542] BTRFS info (device loop4): rebuilding free space tree [ 60.155362][ T5542] BTRFS info (device loop4): checking UUID tree [ 60.197873][ T5542] tipc: Enabled bearer , priority 0 [ 60.273734][ T4317] BTRFS info (device loop4): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 60.420103][ T27] audit: type=1326 audit(60.451:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5576 comm="syz.4.311" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff87177128 code=0x7ffc0000 [ 60.424551][ T27] audit: type=1326 audit(60.451:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5576 comm="syz.4.311" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff87177128 code=0x7ffc0000 [ 60.445668][ T27] audit: type=1326 audit(60.451:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5576 comm="syz.4.311" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff87177128 code=0x7ffc0000 [ 60.449155][ T27] audit: type=1326 audit(60.451:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5576 comm="syz.4.311" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=102 compat=0 ip=0xffff87177128 code=0x7ffc0000 [ 60.452412][ T27] audit: type=1326 audit(60.451:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5576 comm="syz.4.311" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff87177128 code=0x7ffc0000 [ 60.462492][ T4309] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 9 /dev/loop4 scanned by udevd (4309) [ 60.477383][ T27] audit: type=1326 audit(60.451:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5576 comm="syz.4.311" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=436 compat=0 ip=0xffff87177128 code=0x7ffc0000 [ 60.486553][ T27] audit: type=1326 audit(60.451:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5576 comm="syz.4.311" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=94 compat=0 ip=0xffff87177128 code=0x7ffc0000 [ 60.491534][ T5579] syz.3.312 uses obsolete (PF_INET,SOCK_PACKET) [ 60.525839][ T5571] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by syz.1.310 (5571) [ 60.544441][ T5571] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 60.546621][ T5571] BTRFS info (device loop1): using sha256 (sha256-ce) checksum algorithm [ 60.547985][ T5571] BTRFS info (device loop1): force clearing of disk cache [ 60.549076][ T5571] BTRFS info (device loop1): enabling auto defrag [ 60.550246][ T5571] BTRFS info (device loop1): max_inline at 727 [ 60.559614][ T5571] BTRFS info (device loop1): enabling disk space caching [ 60.560845][ T5571] BTRFS info (device loop1): disk space caching is enabled [ 60.560862][ T5537] F2FS-fs (loop2): invalid crc value [ 60.577964][ T5537] F2FS-fs (loop2): Found nat_bits in checkpoint [ 60.595400][ T5537] F2FS-fs (loop2): Cannot turn on quotas: -2 on 2 [ 60.608650][ T5537] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4 [ 60.695716][ T5571] BTRFS info (device loop1): enabling ssd optimizations [ 60.700624][ T5571] BTRFS info (device loop1): rebuilding free space tree [ 60.704062][ T5571] BTRFS info (device loop1): disabling free space tree [ 60.705445][ T5571] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 60.730642][ T5571] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 60.967047][ T4318] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 61.080784][ T4328] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 61.082378][ T4328] CPU: 1 PID: 4328 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 61.083489][ T4328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 61.085090][ T4328] Workqueue: hci4 hci_rx_work [ 61.085841][ T4328] Call trace: [ 61.086342][ T4328] dump_backtrace+0x1c0/0x1ec [ 61.087190][ T4328] show_stack+0x2c/0x3c [ 61.087933][ T4328] __dump_stack+0x30/0x40 [ 61.088715][ T4328] dump_stack_lvl+0xf4/0x15c [ 61.089495][ T4328] dump_stack+0x1c/0x5c [ 61.090221][ T4328] sysfs_create_dir_ns+0x244/0x264 [ 61.091053][ T4328] kobject_add_internal+0x598/0xb08 [ 61.091899][ T4328] kobject_add+0x140/0x20c [ 61.092647][ T4328] device_add+0x3f0/0xf90 [ 61.093464][ T4328] hci_conn_add_sysfs+0xbc/0x1c8 [ 61.094266][ T4328] le_conn_complete_evt+0xcc8/0x1244 [ 61.095145][ T4328] hci_le_conn_complete_evt+0x114/0x3f4 [ 61.096040][ T4328] hci_le_meta_evt+0x2c0/0x4a0 [ 61.096827][ T4328] hci_event_packet+0x6b8/0xf18 [ 61.097745][ T4328] hci_rx_work+0x328/0xa84 [ 61.098506][ T4328] process_one_work+0x7f8/0x13a4 [ 61.099386][ T4328] worker_thread+0x8c4/0xfec [ 61.100107][ T4328] kthread+0x250/0x2d8 [ 61.100741][ T4328] ret_from_fork+0x10/0x20 [ 61.101997][ T4328] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 61.105062][ T4328] Bluetooth: hci4: failed to register connection device [ 61.115294][ T5631] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 61.142880][ T5631] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.428966][ T5642] mkiss: ax0: crc mode is auto. [ 62.004572][ T4373] tipc: Node number set to 1073741825 [ 63.002980][ T5692] netlink: 'syz.2.346': attribute type 1 has an invalid length. [ 63.038679][ T5694] netlink: 44 bytes leftover after parsing attributes in process `syz.4.347'. [ 63.162262][ T5706] netlink: 28 bytes leftover after parsing attributes in process `syz.4.353'. [ 63.164157][ T5702] netlink: 'syz.2.351': attribute type 10 has an invalid length. [ 63.226170][ T4373] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 63.427512][ T5714] process 'syz.2.355' launched '/dev/fd/-1' with NULL argv: empty string added [ 63.641093][ T5718] ALSA: mixer_oss: invalid OSS volume 'PHl6qӆONEOUT' [ 63.718581][ T4373] usb 1-1: Using ep0 maxpacket: 8 [ 63.723797][ T4373] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 63.728273][ T4373] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b1, bcdDevice= 0.40 [ 63.729794][ T4373] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 63.731077][ T4373] usb 1-1: Product: syz [ 63.731709][ T4373] usb 1-1: Manufacturer: syz [ 63.732475][ T4373] usb 1-1: SerialNumber: syz [ 64.365656][ T4373] snd-usb-audio: probe of 1-1:1.0 failed with error -71 [ 64.377993][ T4373] usb 1-1: USB disconnect, device number 2 [ 64.393354][ T5755] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 64.394771][ T5755] IPv6: NLM_F_CREATE should be set when creating new route [ 64.396021][ T5755] IPv6: NLM_F_CREATE should be set when creating new route [ 64.422551][ T5758] netlink: 4 bytes leftover after parsing attributes in process `syz.2.374'. [ 64.488649][ T2062] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.491002][ T2062] ieee802154 phy1 wpan1: encryption failed: -22 [ 68.323245][ T5873] netlink: 256 bytes leftover after parsing attributes in process `syz.0.410'. [ 68.440870][ T5881] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 68.443015][ T5881] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 68.515438][ T5888] overlayfs: overlapping lowerdir path [ 68.977224][ T5920] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 68.979146][ T5920] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 69.101372][ T5934] random: crng reseeded on system resumption [ 69.609351][ T1513] cfg80211: failed to load regulatory.db [ 69.885924][ T5958] kernel profiling enabled (shift: 9) [ 70.242542][ T5965] netlink: 5364 bytes leftover after parsing attributes in process `syz.1.451'. [ 70.249139][ T5964] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 70.262423][ T5964] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 70.329206][ T5969] netlink: 20 bytes leftover after parsing attributes in process `syz.1.452'. [ 70.330750][ T5969] netlink: 28 bytes leftover after parsing attributes in process `syz.1.452'. [ 70.333970][ T5969] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 71.329621][ T5995] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 71.332417][ T5995] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 71.391921][ T6003] netlink: 32 bytes leftover after parsing attributes in process `syz.2.464'. [ 71.578777][ T6009] syz.2.466 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 71.585653][ T6009] ubi31: attaching mtd0 [ 71.590702][ T6009] ubi31: scanning is finished [ 71.591502][ T6009] ubi31: empty MTD device detected [ 71.808394][ T6009] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 71.809755][ T6009] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 71.810933][ T6009] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 71.812032][ T6009] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 71.813169][ T6009] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 71.814397][ T6009] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 71.815736][ T6009] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 1664839887 [ 71.817434][ T6009] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 71.821276][ T6011] ubi31: background thread "ubi_bgt31d" started, PID 6011 [ 71.823619][ T5892] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 71.995022][ T6021] overlayfs: missing 'lowerdir' [ 72.453201][ T6047] netlink: 8 bytes leftover after parsing attributes in process `syz.1.480'. [ 72.559665][ T6057] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 72.564524][ T6057] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 72.698879][ T6072] netlink: 8 bytes leftover after parsing attributes in process `syz.2.492'. [ 72.814226][ T1513] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 72.818353][ T1513] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz0] on syz0 [ 72.844066][ T6084] fido_id[6084]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 73.435157][ T6112] netlink: 44 bytes leftover after parsing attributes in process `syz.1.507'. [ 75.277677][ T5627] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 75.309212][ T6160] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 75.312248][ T6160] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 75.466248][ T5627] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 75.468230][ T5627] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 75.469676][ T5627] usb 1-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 75.471021][ T5627] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.482944][ T5627] usb 1-1: config 0 descriptor?? [ 75.847819][ T6173] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 75.858922][ T6173] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 75.861685][ T6174] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 75.863967][ T6174] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 76.060644][ T6180] capability: warning: `syz.2.536' uses deprecated v2 capabilities in a way that may be insecure [ 76.474223][ T5627] Bluetooth: Can't get version to change to load ram patch err [ 76.475680][ T5627] Bluetooth: Loading sysconfig file failed [ 76.476499][ T5627] ath3k: probe of 1-1:0.0 failed with error -71 [ 76.479330][ T5627] usb 1-1: USB disconnect, device number 3 [ 77.427452][ T6225] device vlan2 entered promiscuous mode [ 77.428476][ T6225] device bridge0 entered promiscuous mode [ 78.140901][ T4328] Bluetooth: hci3: unknown advertising packet type: 0xd3 [ 78.297436][ T6282] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 78.300838][ T6282] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 79.899797][ T6313] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 79.995011][ T6316] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 80.415697][ T5627] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 80.478763][ T6305] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 80.496997][ T6325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 80.499712][ T6325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 80.599985][ T5627] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 80.601445][ T5627] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 80.603724][ T5627] usb 1-1: config 0 descriptor?? [ 80.607146][ T5627] cp210x 1-1:0.0: cp210x converter detected [ 81.212402][ T5627] cp210x 1-1:0.0: failed to get vendor val 0x370c size 73: -71 [ 81.213715][ T5627] cp210x 1-1:0.0: GPIO initialisation failed: -71 [ 81.666804][ T5627] usb 1-1: cp210x converter now attached to ttyUSB0 [ 81.671172][ T5627] usb 1-1: USB disconnect, device number 4 [ 81.675729][ T5627] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 81.677355][ T5627] cp210x 1-1:0.0: device disconnected [ 81.723335][ T6360] serio: Serial port ptm0 [ 81.782882][ T6368] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 81.785122][ T6368] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 81.879501][ T6371] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 81.881126][ T6371] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 81.883527][ T6371] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 82.641495][ T6366] delete_channel: no stack [ 82.993980][ T6419] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 82.995779][ T6419] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 83.035861][ T5627] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 83.491114][ T6430] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 83.492626][ T6430] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 83.495796][ T5627] usb 1-1: Using ep0 maxpacket: 8 [ 83.499016][ T5627] usb 1-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 83.500351][ T5627] usb 1-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 83.501738][ T5627] usb 1-1: Product: syz [ 83.502454][ T5627] usb 1-1: Manufacturer: syz [ 83.503255][ T5627] usb 1-1: SerialNumber: syz [ 83.505150][ T5627] usb 1-1: config 0 descriptor?? [ 83.509744][ T5627] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 84.002196][ T47] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 84.005078][ T47] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 84.012240][ T47] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 84.016143][ T47] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 84.019128][ T47] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 84.020399][ T47] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 84.079241][ T9] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.115690][ T5627] gspca_zc3xx: reg_w_i err -71 [ 84.116677][ T5627] gspca_zc3xx: probe of 1-1:0.0 failed with error -71 [ 84.122280][ T5627] usb 1-1: USB disconnect, device number 5 [ 84.168348][ T9] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.247924][ T9] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.279993][ T6442] chnl_net:caif_netlink_parms(): no params data found [ 84.337491][ T9] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.351406][ T6442] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.352871][ T6442] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.354507][ T6442] device bridge_slave_0 entered promiscuous mode [ 84.356826][ T6442] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.358060][ T6442] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.359553][ T6442] device bridge_slave_1 entered promiscuous mode [ 84.367655][ T6442] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.370371][ T6442] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.381506][ T6442] team0: Port device team_slave_0 added [ 84.384879][ T6442] team0: Port device team_slave_1 added [ 84.394390][ T6442] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.395877][ T6442] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.400039][ T6442] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.404210][ T6442] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.405443][ T6442] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.409843][ T6442] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.447067][ T6442] device hsr_slave_0 entered promiscuous mode [ 84.486901][ T6442] device hsr_slave_1 entered promiscuous mode [ 84.525631][ T6442] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 84.526932][ T6442] Cannot create hsr debugfs directory [ 84.666028][ T9] tipc: Disabling bearer [ 84.668523][ T9] tipc: Left network mode [ 85.671246][ T6485] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 85.672796][ T6485] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 86.085700][ T47] Bluetooth: hci0: command 0x0409 tx timeout [ 86.236270][ T5260] INFO: trying to register non-static key. [ 86.237251][ T5260] The code is fine but needs lockdep annotation, or maybe [ 86.238261][ T5260] you didn't initialize this object before use? [ 86.239055][ T5260] turning off the locking correctness validator. [ 86.239961][ T5260] CPU: 1 PID: 5260 Comm: gfs2_quotad Not tainted syzkaller #0 [ 86.241107][ T5260] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 86.242749][ T5260] Call trace: [ 86.243235][ T5260] dump_backtrace+0x1c0/0x1ec [ 86.243960][ T5260] show_stack+0x2c/0x3c [ 86.244529][ T5260] __dump_stack+0x30/0x40 [ 86.245138][ T5260] dump_stack_lvl+0xf4/0x15c [ 86.245829][ T5260] dump_stack+0x1c/0x5c [ 86.246467][ T5260] assign_lock_key+0x230/0x264 [ 86.247186][ T5260] register_lock_class+0x1ac/0x694 [ 86.247972][ T5260] __lock_acquire+0x164/0x6800 [ 86.248666][ T5260] lock_acquire+0x20c/0x63c [ 86.249447][ T5260] _raw_spin_lock_irqsave+0x6c/0xb0 [ 86.250263][ T5260] finish_wait+0xc8/0x1ac [ 86.250959][ T5260] gfs2_quotad+0x390/0x500 [ 86.251577][ T5260] kthread+0x250/0x2d8 [ 86.252110][ T5260] ret_from_fork+0x10/0x20 [ 86.252675][ T5260] list_del corruption. prev->next should be ffff8000209a7d98, but was 0000000000000000. (prev=ffff0000f53e4bd8) [ 86.254287][ T5260] ------------[ cut here ]------------ [ 86.255031][ T5260] kernel BUG at lib/list_debug.c:61! [ 86.256017][ T5260] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP [ 86.257203][ T5260] Modules linked in: [ 86.257847][ T5260] CPU: 1 PID: 5260 Comm: gfs2_quotad Not tainted syzkaller #0 [ 86.259075][ T5260] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026 [ 86.260654][ T5260] pstate: 624000c5 (nZCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 86.261929][ T5260] pc : __list_del_entry_valid+0x13c/0x158 [ 86.262832][ T5260] lr : __list_del_entry_valid+0x13c/0x158 [ 86.263778][ T5260] sp : ffff8000209a7c70 [ 86.264439][ T5260] x29: ffff8000209a7c70 x28: 0000000000000000 x27: 0000000000000bb8 [ 86.265611][ T5260] x26: 0000000000001770 x25: dfff800000000000 x24: dfff800000000000 [ 86.266720][ T5260] x23: ffff0000f53e47c0 x22: dfff800000000000 x21: ffff0000f53e4bd8 [ 86.268061][ T5260] x20: ffff0000f53e4bd8 x19: ffff8000209a7d98 x18: ffff800011b9bf60 [ 86.269278][ T5260] x17: 20747562202c3839 x16: ffff8000082eef80 x15: 0000000000000000 [ 86.270489][ T5260] x14: 0000000000000001 x13: 1fffe00033eaa5a3 x12: 0000000000ff0100 [ 86.271722][ T5260] x11: ff00800008311668 x10: 0000000000000000 x9 : e3a2ed67d73f7b00 [ 86.272917][ T5260] x8 : e3a2ed67d73f7b00 x7 : 0000000000000001 x6 : 0000000000000001 [ 86.274133][ T5260] x5 : ffff8000209a7738 x4 : ffff800015304cc0 x3 : ffff800008538848 [ 86.275312][ T5260] x2 : 0000000000000001 x1 : 0000000100000001 x0 : 000000000000006d [ 86.276443][ T5260] Call trace: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 86.276946][ T5260] __list_del_entry_valid+0x13c/0x158 [ 86.277827][ T5260] finish_wait+0xd4/0x1ac [ 86.278515][ T5260] gfs2_quotad+0x390/0x500 [ 86.279163][ T5260] kthread+0x250/0x2d8 [ 86.279775][ T5260] ret_from_fork+0x10/0x20 [ 86.280474][ T5260] Code: 91300000 aa1303e1 aa1503e3 95c1ea98 (d4210000) [ 86.281597][ T5260] ---[ end trace 0000000000000000 ]--- [ 86.599784][ T5260] Kernel panic - not syncing: Oops - BUG: Fatal exception [ 86.600957][ T5260] SMP: stopping secondary CPUs [ 86.601711][ T5260] Kernel Offset: disabled [ 86.602274][ T5260] CPU features: 0x080000,000f0097,a65bfea7 [ 86.603113][ T5260] Memory Limit: none [ 86.918583][ T5260] Rebooting in 86400 seconds..