last executing test programs: 12.09316491s ago: executing program 1 (id=86): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl(r0, 0x400452c8, &(0x7f0000000000)="000000000000000000000000000000000000000001") mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/rfcomm0\x00', 0x802, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x5401, 0x0) 12.09289957s ago: executing program 1 (id=88): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x4, &(0x7f0000000040)=0x2, 0x4) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x9, &(0x7f00000000c0)=0x1, 0x4) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) 12.025869302s ago: executing program 1 (id=89): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newlink={0x38, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x40489}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @rand_addr=0x64010101}]}}}]}, 0x38}}, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0x439, 0x0, 0x40000000, {0x0, 0x0, 0xe403, r2}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @rand_addr=0x64010100}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x200080d0) 11.921313104s ago: executing program 1 (id=90): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x2000044, &(0x7f0000000600)={[{@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x4, 0x521, &(0x7f0000000640)="$eJzs3d9rK1kdAPDvTJtue2/XZlXkuuDu4q7cu+hN2q2rVWR3BdGnBXV9v9Y2LaVpU5p0vS2LdvEPEERU8A/wRfDBR0H2TxDhgr6LiiJ6rz7qHZlkqv2RtLFNm2v6+cBpzsmZOd9zhmaSmTnMBHBtvRARb0TEWES8HBEzxftpkWK/k/LlHj18ZylPSWTZW39NIineO2grL49HxM1itcmI+OqXIr6RnIzb3N1bX6zXa9tFudra2Ko2d/furm0srtZWa5vz83M/j4hXF2azwoXGWY6I177wxx989ydffO2Xn/jm7+79+c638m597kOdfkfE0oUC9NBpu9TeFgfybbR9GcGGJB9PaWzYvQAAoB/5b/z3R8RH27//Z2Ks/WsOAAAAGCXZ69PxzyQiAwAAAEZWGhHTkaSVYi7AdKRppdKZw/vBuJHWG83Wx1caO5vLeV1EOUrpylq9NlvMFS5HKcnLc8Uc24PyK8fK8xHxTER8f2aqXa4sNerLwz75AQAAANfEzeePHv//YyZt5wEAAIARU+5ZAAAAAEaFQ34AAAAYfY7/AQAAYKR9+c0385QdPMd7+e3dnfXG23eXa831ysbOUmWpsb1VWW00Vtv37Ns4q716o7H1ydjcuV9t1ZqtanN3795GY2ezdW/tyCOwAQAAgCv0zPPv/TaJiP3PTrVTFPcBBDjiD8PuADBIY8PuADA048PuADA0pTOXsIeAUZecUX9y8k7nXGH86nL6AwAADN7tD5+8/j9R1J19bgD4f2auDwBcP0ev7k0NrR/A1SuddwbgrUH3BBiW93VenupV3/PmHX1c/++cY8iyc3UMAAAYmOl2StJKcQwwHWlaqUQ8HY+zcpSSlbV6bbao+81M6am8PNdeMzlzzjAAAAAAAAAAAAAAAAAAAAAAAAAA0JFlSWQAAADASItI/5S07+YfcXvmpemjZweOPfXrx2/98P5iq7U9FzGR/G0mf2siIlo/Kt5/JfNIAAAAABiuqfxP5zi9eJ0bdpcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGDWPHr6zdJCuMu5fPh8R5W7xx2Oy/ToZpYi48fckxg+tl0TE2ADi778bEbe6xU/icZZl5aIX3eJPXXL8cnvTdI+fRsTNAcSH6+y9fP/zRrfPXxovtF+7f/7Gi3RRvfd/6X/2f2M99j9PHyv38uyDn1V7xn834tnx7vufg/hJJ/6REHnhxT7H+PWv7e11rTjUZLf4h2NVWxtb1ebu3t21jcXV2mptc35+7lMLn154dWG2urJWrxV/u4b53kd+8fi08d/oEb98dPwntv9LfY0+i389uP/wA51CqVv8Oy92//691SN+Wnz3fazI5/W3D/L7nfxhz/3018+dNv7lHuOfPGP8d/oaf3zm5a985/dda05sDQDgKjR399YX6/Xa9imZyT6W+Z8yERdt5/WB9udJyMTZy0w+IV29jEz27c7/48XaueDqJzLZRVYfjwF0Y+LE53QszttgErGft9XnPyQAADBi/vuj/7QrSAAAAAAAAAAAAAAAAAAAAMBlOudtySYjou+Fj8fcH85QAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABO9e8AAAD//zDU0hs=") r0 = open(&(0x7f0000000180)='./bus\x00', 0x48a7e, 0x0) mount(&(0x7f0000000440)=@loop={'/dev/loop', 0x0}, &(0x7f0000000200)='./bus\x00', 0x0, 0x1000, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0xa27b734c1a0bc97) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x3, 0x0, 0x0, 0x4, 0x0, "ef35af413bb901527fe4d0ce5d29c3ee5e5c3676345a41499db7aac63a01000000000000004faa2ae2c084a0ea0000000000007700000c00002000", "036c47c678082004cb59d654cb9b1b165263bdbcef549ba197fce47ddfdd753abd950100172a00ffffff00f7ffffff000000f3e7f20000000200000000000600", "b7326736181c208220fffff2ff00000000000000000e00", [0x4]}) write$P9_RREADLINK(r0, &(0x7f0000000480)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) 10.80276619s ago: executing program 1 (id=104): openat$kvm(0xffffffffffffff9c, 0x0, 0x40040, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/events/sched/sched_switch/trigger\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='enable_event:sched:sched_process_fork', 0x25) 10.648946274s ago: executing program 1 (id=110): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x5543, 0x64, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x8, 0x0, "", [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x1, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c04a1010901a1007508950109308102c0c000"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000540)={0x0, 0x10, 0xa, "4c4854b8a454ff6188c1"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0xa, 0x62080) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, 0x0) 10.581732545s ago: executing program 32 (id=110): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x5543, 0x64, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x8, 0x0, "", [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x1, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c04a1010901a1007508950109308102c0c000"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000540)={0x0, 0x10, 0xa, "4c4854b8a454ff6188c1"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0xa, 0x62080) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, 0x0) 3.844356191s ago: executing program 0 (id=239): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x6, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f00000008c0)=ANY=[@ANYBLOB="180200000400000000000000000000008500000041000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x4, 0x8, 0xf}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000140), 0xa283, r0}, 0x38) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x14, &(0x7f0000000540)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @printk={@lld}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r1, r0}, 0xc) 3.551116158s ago: executing program 0 (id=246): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x315901c, 0x0) chroot(&(0x7f0000001140)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000100)='./file0/file0\x00', &(0x7f00000000c0)='./file0/../file0\x00') 3.512558769s ago: executing program 0 (id=249): r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000040)='.\x00', 0x428) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r1, &(0x7f00000005c0)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x4, 0x0, 0x0, 0x1, 0x3, 0x3e, 0x2ef4, 0x3d6, 0x40, 0x0, 0x0, 0xb87d, 0x38, 0x1, 0xfffe, 0x12, 0xc}, [{0x3, 0x1, 0x8, 0xd, 0x1, 0xe5, 0x10000000001, 0x450c}]}, 0x78) close(r1) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) 3.4703212s ago: executing program 0 (id=250): setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex_waitv(&(0x7f0000001080)=[{0x3, &(0x7f0000000180)=0x3, 0x82}], 0x1, 0x0, 0x0, 0x1) prctl$PR_MCE_KILL(0x4e, 0x1, 0x2) 3.111386048s ago: executing program 5 (id=263): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000010000000c00000009"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000006"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 3.088028429s ago: executing program 5 (id=264): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./bus\x00', 0x800, &(0x7f0000000000), 0x0, 0x756, &(0x7f00000002c0)="$eJzs3M1rXOUaAPDnnGaafuTeyYUL9+pChBZaKD1Jmk27aty4KxQKbmtITkLISSZkJrUTC7auhdpsFARR1y7dCqX+Ae6koOBeEK1xIW5GzuSjNGam0ybpSPr7wcl53vP1vE/m8GYO5D0BvLReL38kEUMRcTUiqpvb04g42o6ORdzeOG790a2pckmi1br2S1KeFuut6va1ks31yWifEv+PiAeViHPv/z1vvbk6P1kU+fJme6SxsDRSb66en1uYnM1n88Wx8UujF8fHL46OP7WG//VY6+m3Lh2/9+2ba2vffdW4+9rA+SQm2nXHZm09XuaZbPxOKjGxY/viQSTro6TfHQAAoCfl9/wjETHQ/pZajSPtCAAAADhMWoMtAAAA4NBLot89AAAAAA7W1v8BbM3tPah5sJ38/EZEDO+Wf6A9hzjiWFQi4sR68sTMhGTjNNiT23ci4v7Ezvvvi/IOu73Ha4/uaD85R/roHq/Ofrhfjj8Tu40/6fb4E7uMPwNb707Yo87j3+P8RzqMf1d7zPH1p69UOua/E/HqwG75k+38SYf8b/eY/+7aB/c67Wt9HnFm178/yRO5urwfYmJmruj6+oEHf5592K3+E53yJ93rX+qx/nfXf5vvNJaU+c+e6v7575a/vCc+3OxHGhH3Ntdle21HjlML33/Trf7piNbzfP6f9Vj/j18O3uzxUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGhLI2IokjTbjtM0yyJORsR/40Ra1OqNczO1lcXpcl/EcFTSmbkiH42I6kY7Kdtj7fhx+8KO9nhE/OeH4xtJ54o8m6oV0/0uHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgG0nI2IokjSLiDQifq+maZZFDPRw7uAL6B8AAACwT4b73QEAAADgwHn+BwAAgMPveZ//k33uBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCoXb1ypVxa649uTZXt6RvNlfnajfPTeX0+W1iZyqZqy0vZbK02W+TZVG3hadcrarWlsUuxcnOkkdcbI/Xm6vWF2spi4/rcwuRsfj2vvJCqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeFZD7SVJs4hI23GaZlnEvyJiOCrJzFyRj0bEvyPiYbUyWLbH+t1pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9l29uTo/WRT5skAgeGHBexHxD+hGl6DfIxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP1Qb67OTxZFvlzvd08AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADor/SnJCLK5Uz19NDOvUeTP6rtdUS888m1j25ONhrLY+X2X7e3Nz7e3H6hH/0HAACAl8LlZzl46zl96zkeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgV/Xm6vxkUeTLewsuR3O1lXQ4pt81AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz+evAAAA//8KQsc4") unshare(0x2020600) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) unshare(0x2020600) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) 2.881103074s ago: executing program 5 (id=265): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18020000faffffff00000000030000008500000036000000670000000700000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000540)={r0, r2, 0x25, 0x0, @val=@tcx}, 0x1c) syz_emit_ethernet(0xe, &(0x7f0000000300)={@random="ffffffffffff", @random="aabbccddeeff", @void, {@generic={0x88ca}}}, 0x0) 2.793086716s ago: executing program 5 (id=267): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x6a, 0x4) bind$inet(r0, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000040)=0xd, 0x4) connect$inet(r0, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) sendmmsg(r0, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000c00)="2213d3ae303f049be5e1d447b7df79f0fdccfb4fdb52f969931e", 0x1a}], 0x1}}, {{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000740)="92dba7cc4e4fe50a93d5de1baaf50bbbf2eabd1d9a34aa9072af6fee1096e10f7d3457909b2d05533e04734c882101a130479f1f2fb09b39bb384f5d03b064388215c1f38cd1e8e12bdb765610e6cc54c60abc2b594784cd1396f265db0c564b01632a5f91d13ca786bc41ebeb64461f36154e392b7b547aef90734844c0eb73e91db70d5158d7ab57c27453b5130b2f7caa21eab57fe93fb63082b47498c60df4b211e48bd1904131fa5f42b3d3761ab6b995fb8890373aad2b8c06f5005771e07d98f76ab21fab6295ccc658883a0f2a3fef32b93c16d4dcaceeb4fb4d6f39ba860e3c157018ad6efb0b3628c8", 0xee}, {&(0x7f0000000940)="6cb9b5ed91ee06b8c1f742714fe71e004f3574425077e31b329aaaa4a64f8fa6270166d3bc30904b759c88abab7238eaa063fa30bb668dce79bcf9fb8acf55e27667a4ff5ad320fe390e13505bae1de7881f4104e5decd17d3f114552b2a6d3f4517296b8aa17bb5e26a0fe8046927833805834292581179f616d92dbefb90d76f9f7fea0391b305c1cb1ee06648ef3830ed26ddc63439afef93447e99e2d747cf37513deac72718a3d3d8087578a3dae42244248a398db533031d31127500000000000000b7c3e4e86de74c2b1d7de58d6722e6fa2263d79f9ba6bb4a742a5676164e6c1c256983eec5b823b19938fcbb9679528aca40a6a6c07e179a640d6c53c0e9274e8e9012d82828486dd2cce355a6200b9991fdeb00f238d610278434ce85974fb9f7bca547e6acae11ed30487f233b3dfc67c76e8325feb3cce574d683303aadb08aa8de9bb1e7b8313cd1132f165127c81ca3852f2fc918ab0b9121e815e316f9cd2d38e5e449d1d394c91e8bd17de9", 0x174}, {&(0x7f00000006c0)="92933ae6adb1fbe9f93f904b11157cbe3d27e7dbdc7f9cccef5f06a85d3511526419362ad07778698bcebc880c5e77b2b3", 0x31}], 0x3}}], 0x2, 0xc8c0) 2.725001887s ago: executing program 5 (id=268): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x7c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0, 0x0}) syz_ublk_setup_queues(r7, r5, &(0x7f0000000340)={0x0, 0x0, 0x2, 0xfffffffd, 0xc8, 0x0, r0}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x668a, 0x800, 0x10fffff, 0x4, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x40000, 0x0, 0x47, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f74, 0x200, 0x1, 0x400000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1316, 0x8, 0xfffffffb, 0x5, 0x0, r0}}], 0x1, &(0x7f0000001000)={0x2e, 0x4c, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x0, r4, '\x00', {0x2, 0x3, 0x0, 0x0}}, 0x0) 2.6176085s ago: executing program 0 (id=271): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x404, &(0x7f0000000580)={[{@max_batch_time={'max_batch_time', 0x3d, 0x8}}, {@max_batch_time={'max_batch_time', 0x3d, 0x2}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}, {@errors_remount}, {@nombcache}]}, 0x1, 0x440, &(0x7f0000000d40)="$eJzs28tvG8UfAPDv2k776+uXUJVHH0CgICIeSZOW0gMXEEgcQEKCQzmGJK1C0wY1QaJVBAGhckSVuCOOSPwFnOCCgBMSV7ijShXKpS0no7V3E9ux3TycuKk/H2nbmd1xZr7eHXtmxxtAzxpM/0ki9kfEnxHRX83WFxis/nd7aWHiztLCRBLl8jv/JJVyt5YWJvKi+ev25ZlSROGLJI42qXfuytUL4zMzU5ez/Mj8xQ9H5q5cfWH64vj5qfNTl8bOnDl1cvSl02MvdiTONK5bRz6ZPXb4jfeuvzVx9vr7v36f5PE3xNEhg+0OPl0ud7i67jpQk05KXWwI61KsdtPoq/T//ijGysnrj9c/72rjgC1VLpfLD7U+vFgG7mNJbOLF+UcIsAPlX/Tp/DfftmfkcW+4+Up1ApTGfTvbqkdKUcjK9DXMbztpMCLOLv77TbrF1tyHAACo82M6/nm+2fivELX3hf6fraEMRMQDEXEwIk5HxKGIeDCiUvbhiHikWSVJ6/obF0lWj38KNzYc3Bqk47+Xs7Wt+vFfPvqLgWKWO1CJvy85Nz0zdSJ7T4aib3eaH21Tx0+v/fFVq2O14790S+vPx4JZO26Udte/ZnJ8fnwzMde6+VnEkVKz+JPllYD09B2OiCMbrGP62e+OtTp29/jb6MA6U/nbiGeq538xGuLPJe3XJ0f+FzNTJ0byq2K1336/9vZyplh/bFPxd0B6/vc2vf6X4x9Iatdr59Zfx7W/vmw5p9no9b8rebdu38fj8/OXRyN2JW9WG127f6yh3NhK+TT+oePN+//BWHknjkZEehE/GhGPRcTjWdufiIgnSxHH28T/y6tPfbCx+He3+audkcY/ua7zv5LYFY17mieKF37+oa7SgbXGH9n5P1VJDWV71vL5t5Z2bexqBgAAgJ2nEBH7IykML6cLheHh6m/4D8XeYszOzT93bvajS5PVZwQGoq+Q3+nqr7kfOppN6/P8WEP+ZHbf+Ovinkp+eGJ25s799RN42HH2tej/qb+L3W4dsOU8rwW9S/+H3qX/Q+/S/6F3Nen/e7rRDmD7Nfv+/7QL7QC2X0P/t+wHPcT8H3qX/g+9S/+HnjS3J+7+kLyExKpEFO6JZkhsUaLbn0wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACd8V8AAAD//4sp5BA=") unlink(&(0x7f0000000180)='./file1\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x101042, 0x15) pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xe7c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 2.568738091s ago: executing program 2 (id=273): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000b80)={0xaa, 0xc1}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 2.353136886s ago: executing program 3 (id=276): openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = epoll_create1(0x0) setuid(0xee01) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x90000005}) 2.353024096s ago: executing program 3 (id=277): r0 = syz_clone(0x200000, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ptrace(0x4206, r0) ptrace(0x4208, r0) ptrace$poke(0x4, r0, 0x0, 0x0) 2.337254696s ago: executing program 2 (id=278): syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000f00)='./file1\x00', 0x0, &(0x7f0000000180), 0x1, 0x27e, &(0x7f0000000500)="$eJzs3T1oO2UcB/DfXZJ/34JWBRHFFxARLZS6CSLoolAQKSKCChURJ2mFanFrnFwcdFbp5FLEzeooLsVF6Fq1Q0UQsThYHHSIXC6RmCZaL82l/+TzgfTuubsnv0vJ97mH0lwCmFqLEfFYRFQiYikiahGRdB9wT/5YbDd35w7WI5rNZ35NWsfl7Vyn30JENCLi4YhqZ9/2/gsnvx89ef+7b9bu+3j/+bkSXlqld8PpyfFTZx89/c5nqw9tp+1t9fay+3Vcottv7LOxmkTcPIJiV0VSHfcZcBFrb336bRaSWyLi3lb+a5G2I/ve1rWvavHgh4P6vv/L4R1lnitw+ZrNWnYNbDSBqZO25sBJuhwR+XqaLi/nc/jvKvPpa5tbbyy9ulnZeKV71Chj+g6MSj3i+IkvZj5f6Mn/T5U8/8DkyvL/7Nre99n62bm/lAET6c58keV/6aWdB0L+YerIP0yG+QJ95B8mQr1gJ/mH613B7BbI/60/Hj5arBhwpVww/z+XeU5AOcz/YYLVOiuNvrvlH6bXhfPvX31h4nTy79IP06f7+g8ATJfmzLg/gQyMy7jHHwAAAAAAAAAAAAAAAAAA4LzduYP1ziMiKaXm1x9EnD4eEdXe+tH6YoO0tZxt/Zz/LckO+1uSd2u7Vqj+i3cPc/bD+2T0n76u9rRnuxs3/DDy+v/qm7tG87xv/7M58A6WOxsRjezglWr1/Psvab//irvpP/bXXh6ywP/Um+pHniuj6uDf4p97ZdQfbPUo4sts/FnpN/6kcVtr2X/8qXffYrmg1/8Y8gkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAozV8BAAD///BWbAI=") openat(0xffffffffffffff9c, &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x181341, 0x84) symlinkat(&(0x7f0000000700)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x28541, 0x140) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x380407b, 0x0, 0x1, 0x0, &(0x7f0000000140)) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) 2.318454916s ago: executing program 0 (id=279): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0xf, {[@main=@item_012={0x0, 0x0, 0xb}, @local=@item_4={0x3, 0x2, 0x1, "45501821"}, @global=@item_012={0x1, 0x1, 0x8, "f5"}, @global=@item_012={0x1, 0x1, 0x7, "86"}, @main=@item_4={0x3, 0x0, 0xb, "4070f43f"}]}}, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r1, 0x8010661b, 0x0) 2.268624038s ago: executing program 4 (id=280): socket$packet(0x11, 0xa, 0x300) r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'syz_tun\x00', 0x0}) bind$packet(r0, &(0x7f0000000080)={0x11, 0x802, r2, 0x1, 0x0, 0x6, @local}, 0x14) syz_emit_ethernet(0x32, &(0x7f0000000340)=ANY=[@ANYBLOB="bbbbbbbbbbbb0000000000000802"], 0x0) 2.268450928s ago: executing program 4 (id=281): sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0xb0, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1000001}, @CTA_NAT_SRC={0x1c, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @loopback}, @CTA_NAT_PROTO={0x4}]}]}, 0xb0}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$KVM_SET_DEBUGREGS(r2, 0x4080aea2, &(0x7f00000002c0)={[0xfec00000, 0xf000, 0x8080000, 0x60000], 0x6cbf, 0x20, 0x7e31}) 2.19676331s ago: executing program 2 (id=282): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2b, 0x0, {{@in6=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0xfffffffffffffffe, 0x6, 0x3c, 0xffffffffffffffff, 0x200000000000, 0x4000000000000000}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0xffff, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x0, 0x32}, 0x2, @in6=@rand_addr=' \x01\x00', 0x3501, 0x4, 0xef9a5e7037ee9545, 0x0, 0x0, 0x0, 0x10000001}]}]}, 0xfc}}, 0x0) r2 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) 2.181583459s ago: executing program 4 (id=283): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000080)=0x2, 0x4) bind$inet6(r1, &(0x7f0000000540)={0xa, 0x4e22, 0x7, @empty, 0x200}, 0x1c) listen(r0, 0x0) 2.117146601s ago: executing program 4 (id=284): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0x3c}}, 0x10) sendmmsg$inet(r1, &(0x7f0000000c00)=[{{&(0x7f0000000080)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}], 0x1, 0x2000c044) sendto$inet(r1, &(0x7f0000000c80)="e8", 0x6200, 0x0, 0x0, 0x0) 2.117027531s ago: executing program 2 (id=285): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregs(0x1a, r0, 0xc, 0x0) 2.116896832s ago: executing program 4 (id=286): syz_mount_image$exfat(&(0x7f00000005c0), &(0x7f0000000240)='./bus\x00', 0x3010050, &(0x7f0000000600)=ANY=[], 0x1, 0x14fe, &(0x7f0000000700)="$eJzs3Au0ztXWMPA511p/NklPkvuaa/55kssiSXJJSCRJkiS5JSRJkoTEJrckJCH3JPeQ3GIn9/st9yQ5kiQJCUnWN3Q6n/e8nfftnO+c7/V9Z8/fGGvsNff/mfNZa889nv9ljL2/7Ti4av1qlesyM/xT8M9fUgEgBQD6AcA1ABABQKlspbIBDoNMGlP/uTcR/1oPTbvSKxBXkvQ/fZP+p2/S//RN+p++Sf/TN+l/+ib9T9+k/0KkZ1un575WRvod/3PP/0Ge//8/R87//0YOFxvz5fpi13f6B1Kk/+mb9D99k/6nb9L/9E36n75J///NRQCV/pvD0v/0TfovRHp2pZ8/y7iy40r//gkhhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGESB/OhcsMAPxlfqXXJYQQQgghhBBCiH+dkPFKr0AIIYQQQgghhBD/9yEo0GAgggyQEVIgE2SGqyALXA1Z4RpIwLWQDa6D7HA95ICckAtyQx7IC/nAAoEDhhjyQwFIwg1QEG6EQlAYikBR8FAMisNNUAJuhpJwC5SCW6E03AZloCyUg/JwO1SAO6AiVILKcCdUgbugKlSDu6E63AM14F6oCfdBLbgfasMDUAcehLrwENSDh6E+PAIN4FFoCI2gMTSBpv9H+S9CV3gJukF3SIUe0BNehl7QG/pAX+gHr0B/eBUGwGswEAbBYHgdhsAbMBTehGEwHEbAWzASRsFoGANjYRyMh7dhArwDE+FdmASTYQpMhWkwHWbAezATZsFseB/mwAcwF+bBfFgAC+FDWASLIQ0+giXwMSyFZbAcVsBKWAWrYQ2shXWwHjbARtgEm2ELbIVPYBtshx2wE3bBbtgDn8Je+Az2weewH774B/PP/qf8TggIqFChQYMZMAOmYApmxsyYBbNgVsyKCUxgNsyG2TE75sAcmAtzYR7Mg/kwHxISMjLmx/yYxCQWxIJYCAthESyCHj0Wx+JYAm/GklgSS2EpLI2lsQyWxbJYHstjBayAFbEiVsbKWAWrYFWsinfj3XgP1sAaWBNrYi2shbWxNtbBOlgX62I9rIf1sT42wAbYEBtiY2yMTbEpNsNm2BybY0tsia2wFbbG1tgG22BbbIvtsB22x/bYATtgR+yInbAzdsYX8UV8CV/C7lhF9cCe2BN7YS/sg32xL76C/fFVfBVfw4E4CAfj6/g6voFD8QwOw+E4AkdgBTUKR+MYZDUOx+N4nIATcCJOxEk4GSfjVJyG03EGzsCZOAtn4fs4Bz/AD3AezsMFuBAX4iJcjGmYhkvwLC7FZbgcV+BKXIUrcQ2uxTW4HjfgetyEm3ALbsFP8BPcjttxJ+7E3bgbP8VP8TP8DAfiftyPB/AAHsSDeAgP4WE8jEfwCB7Fo3gMj+FxPI4n8CSewpN4Gk/jGTyL5/AcnsfzeAGfz/N1vd2F1w0EdYlRRmVQGVSKSlGZVWaVRWVRWVVWlVAJlU1lU9lVdpVD5VC5VC6VR+VR+VQ+RYoUq1jlV/lVUiVVQVVQFVKFVBFVRHnlVXFVXJVQJVRJVVKVUreq0uo2VUaVVS18eVVeVVAtfUVVSVVWlVUVdZeqqqqpaqq6qq5qqBqqpqqpaqlaqrZ6QNVRPbAPPqQudaa+GoQN1GBsqBqpxqqJegMfU83UUGyuWqiW6gk1HIdha9XMt1FPq7ZqNLZTz6ox+JzqoMZhR/WC6qQ6qy7qRdVVNffdMvz2EaimYi/VW/VRfdVMvEtd6lhV9ZoaqAapwep1tQDfUEPVm2qYGq5GqLfUSDVKjVZj1Fg1To1Xb6sJ6h01Ub2rJqnJaoqaqqap6WqGek/NVLPUbPW+mqM+UHPVPDVfLVAL1YdqkVqs0tRHaon6WC1Vy9RytUKtVKvUarVGrVXr1Hq1QW1Um9RmtUVtVZ+obWq72qF2ql1qt9qjPlV71Wdqn/pc7VdfqAPqT+qg+lIdUl+pw+prdUR9o46qb9Ux9Z06rr5XJ9RJdUr9oE6rH9UZdVadUz+p8+pndUH9oi6qoECjVlproyOdQWfUKTqTzqyv0ln01TqrvkYn9LU6m75OZ9fX6xw6p86lc+s8Oq/Op60m7TTrWOfXBXRS36AL6ht1IV1YF9FFtdfFdHF9ky6hb9Yl9S26lL5Vl9a36TK6rC6ny+vbdQV9h66oK+nK+k5dRd+lq+pq+m5dXd+ja+h7dU19n66l79e19QO6jn5Q19UP6Xr6YV1fP6Ib6Ed1Q91IN9ZNdFP9mG6mH9fNdQvdUj+hW+kndWv9lG6jn9Zt9TO6nX5Wt9fP6Q76ed1Rv6A76c66i/5FX9RBd9PddaruoXvql3Uv3Vv30X11P/2K7q9f1QP0a3qgHqQH69f1EP2GHqrf1MP0cD1Cv6VH6lF6tB6jx+pxerx+W0/Q7+iJ+l09SU/WU/RUPU1P131+qzT778h/52/kD/j13bforfoTvU1v1zv0Tr1L79Z79B69V+/V+/Q+vV/v1wf0AX1QH9SH9CF9WB/WR/QRfVQf1cf0MX1cH9cn9En9k/5Bn9Y/6jP6rD6rf9Ln9Xl94befARg0ymhjTGQymIwmxWQymc1VJou52mQ115iEudZkM9eZ7OZ6k8PkNLlMbpPH5DX5jDVknGETm/ymgEmaG0xBc6MpZAqbIqao8aaYKW5u+qfz/2h9TU1T08w0M81Nc9PStDStTCvT2rQ2bUwb09a0Ne1MO9PetDcdTAfT0XQ0nUwn08V0MV1NV9PNdDOpJtX0NC+bXqa36WP6mn7mFdPf9DcDzAAz0Aw0g81gM8QMMUPNUDPMDDMjzAgz0ow0o81oM9aMNePNeDPBTDATzUQzyUwyU8wUM81MMzPMDDPTzDSzzWwzx8wxc81cM9/MNwvNQrPILDJpJs0sMUvMUrPMLDMrzAqzyqwya8was86sMxvMBrPJbDJLzVaz1Wwz28wOs8PsMrvMHrPH7DV7zT6zz+w3+80Bc8AcNAfNIXPIHDaHzRFzxBw1R80xc8wcN8fNCXPCnDKnzGlz2pwxZ8w5c86cN+fNBXPBXDQXL132RSpSkYlMlCHKEKVEKVHmKHOUJcoSZY2yRokoEWWLskXZo+ujHFHOKFeUO8oT5Y1SwUYUuYijOMofFYiS0Q1RwejGqFBUOCoSFY18VCwqHt0UlYhujkpGt0Sloluj0tFtUZmobFQuKh/dHlWI7ogqRpWiytGdUZXorqhqVC26O6oe3RPViO6Nakb3RbWi+6Pa0QNRnejBqG70UFQvejiqHz0SNYgejRpGjaLGUZOo6b+0fghncj7uu9nuNtX2sD3ty7aX7W372L62n33F9rev2gH2NTvQDrKD7et2iH3DDrVv2mF2uB1h37Ij7Sg72o6xY+04O96+bSfYd+xE+66dZCfbKXaqnWan2xn2PTvTzrKz7ft2jv3AzrXz7Hy7wC60H9pFdrFNsx/ZJfZju9Qus8vtCrvSrrKr7Rq71q6z6+0Gu9FuspvtFrvVfmK32e12h91pd9nddo/91O61n9l99nO7335hD9g/2YP2S3vIfmUP26/tEfuNPWq/tcfsd/a4/d6esCftKfuDPW1/tGfsWXvO/mTP25/tBfuLvWjDpYv7S6d3MmQoA2WgFEqhzJSZslAWykpZKUEJykbZKDtlpxyUg3JRLspDeSgf5aNLmJjyU35KUpIKUkEqRIWoCBUhT56KU3EqQSWoJJWkUlSKSlNpKkNlqByVo9vpdrqD7qBKVInupDvpLrqLqlE1qk7VqQbVoJpUk2pRLapNtakO1aG6VJfqUT2qT/WpATWghtSQGlNjakpNqRk1o+bUnFpSS2pFrag1taY21IbaUltqR+2oPbWnDtSBOlJH6kSdqAt1oa7UlbpRN0qlVOpJPakX9aI+1If6UT/qT/1pAA2ggTSQBtNgGkJDaCgNpWE0nEbQWzSSRtFoGkNjaRyNp/E0gSbQRJpIk2gSTaEpNI2m0QyaQTNpJs2m2TSH5tBcmkvzaT4tpIW0iBZRGqXRElpCS2kpLafltJJW0mpaTWtpLa2n9bSRNtJm2kxbaStto220g3bQLtpFe2gP7aW9tI/20X7aTwfoAB2kg3SIDtFhOkxH6AgdpaN0jI7RcTpOJ+gEnaJTdJpO0xk6Q+foHJ2nn+kC/UIXKVCKU5DZXeWyuKtdVneNS3GZ3KU4AoBLcS6X2+VxeV0+Z10Ol/OvYnLOFXKFXRFX1HlXzBV3N/0uLuPKunKuvLvdVXB3uIq/i6u7e1wNd6+r6e5z1dzdfxXXcve72u4RV8c96uq6Rq6ea+Lqu0dcA/eoa+gaucauiWvlnnSt3VOujXvatXXP/C5e5Ba7tW6dW+82uL3uM3fO/eSOum/defez6+a6u37uFdffveoGuNfcQDfod/EI95Yb6Ua50W6MG+vG/S6e4qa6aW66m+HeczPdrN/FC92Hbo5Lc3PdPDffLfg1vrSmNPeRW+I+dkvdMrfcrXAr3Sq32q3532td4Ta5zW6L2+M+ddvcdrfD7XS73O5f40v72Oc+d/vdF+6I+8YddF+6Q+6YO+y+/jW+tL9j7jt33H3vTriT7pT7wZ12P7oz7uyv+7+09x/cL+6iCw4YWbFmwxFn4Iycwpk4M1/FWfhqzsrXcIKv5Wx8HWfn6zkH5+RcnJvzcF7Ox5aJHTPHnJ8LcJJv4IJ8IxfiwlyEi7LnYlycb+ISfDOX5Fu4FN/Kpfk2LsNluRyX59u5At/BFbkSV+Y7uUoIXJWr8d1cne/hGnwv1+T7uBbfz7X5Aa7DD3Jdfojr8cNcnx/hBvwoN+RG3JibcFN+jJvx49ycW3BLfoJb8ZPcmp/iNvw0t+VnuB0/y+35Oe7Az3NHfoE7cWfuwi9yV36Ju3F3TuUe3JNf5l7cm/twX+7Hr3B/fpUH8Gs8kAfxYH6dh/AbPJTf5GE8nEfwWzySR/FoHsNjeRyP57d5Ar/DE/ldnsSTeQpP5Wk8nWfwezyTZ/Fsfp/n8Ac8l+fxfF7AC/lDXsSLOY0/4iX8MS/lZbycV/BKXsWreQ2v5XW8njfwRt7Em3kLb+VPeBtv5x28k3fxbt7Dn/Je/oz38ee8n7/gA/wnPshf8iH+ig/z13yEv+Gj/C0f4+/4OH/PJ/gkn+If+DT/yGf4LJ/jn/g8/8wX+Be+yIEhxljFOjZxFGeIM8YpcaY4c3xVnCW+Os4aXxMn4mvjbPF1cfb4+jhHnDPOFeeO88R543yxjSl2McdxnD8uECfjG+KC8Y1xobhwXCQuGvu4WFw8vikuEd8cl4xviUvFt8al49viMnHZ+JH7yse3xxXiO+KKcaW4cnxnXCW+K64aV4vvjqvH98Q14nvjmvF9ccn4/rh2/EBcJ34wrhs/FNeLH47rx4/EDeJH44Zxo7hx3CRuGj8WN4sfj5vHLeKW8RNxq/jJuHX8VNwmfjpuGz/zh8dT4x5xz/jl+OU4hHv1/OSC5MLkh8lFycXJtORHySXJj5NLk8uSy5MrkiuTq5Krk2uSa5PrkuuTG5Ibk5uSm5NbkiFUywgevfLaGx/5DD6jT/GZfGZ/lc/ir/ZZ/TU+4a/12fx1Pru/3ufwOX0un9vn8Xl9Pm89eefZxz6/L+CT/gZf0N/oC/nCvogv6r0v5ov7Jr6pb+qb+cd9c9/Ct/RP+Cf8k/5J/5R/yj/t2/pnfDv/rG/vn/Md/PP+ef+C7+Q7+y7+Rd/Vv+S7+e4+1af6nr6n7+V7+T6+j+/n+/n+vr8f4Af4gX6gH+wH+yF+iB/qh/phfpgf4Uf4kX6kH+1H+7F+rB/vx/sJfoKf6Cf6SX6Sn+Kn+Gl+mp/hZ/iZfqaf7Wf7OYXm+Ll+rp/v5/uFfqFf5Bf5NJ/ml/glfqlf6pf75X6lX+lX+9V+rV/r1/v1fqPf6Df7zX6r3+q3+W1+h9/hd/ldfo/f4/f6vX6f3+f3+/3+gD/gD/qD/pD/yh/2X/sj/ht/1H/rj/nv/HH/vT/hT/pT/gd/2v/oz/iz/pz/yZ/3P/sL/hd/0Qc/PvF2YkLincTExLuJSYnJiSmJqYlpiemJGYn3EjMTsxKzE+8n5iQ+SMxNzEvMTyxILEx8mFiUWJxIS3yUWJL4OLE0sSyxPLEisTKxKhFC3m1xyB8KhGS4IRQMN4ZCoXAoEooGH4qF4uGmUCLcHEqGW0KpcGsoHW4LZULZUC48GhqGRqFxaBKahsdCs/B4aB5ahJbhidAqPBlah6dCm/B0aBueCe3Cs6F9eC50CM+HjuGF0Cl0Dl3Ci6FreCl0C91DaugReoaXQ6/QO/QJfUO/8EroH14NA8JrYWAYFAaH18OQ8EYYGt4Mw8LwMCK8FUaGUWF0GBPGhnFhfHg7TAjvhInh3TApTA5TwtQwLUwPM8J7YWaYFWaH98Oc8EGYG+aF+WFBWBg+DIvC4pAWPgpLwsdhaVgWlocVYWVYFVaHNWFtWBfWhw1hY9gUNoctYWv4JGwL28OOsDPsCrvDnvBp2Bs+C/vC52F/+CIcCH8KB8OX4VD4KhwOX4cj4ZtwNHwbjoXvwvHwfTgRToZT4YdwOvwYzoSz4Vz4KZwPP4cL4ZdwUf5mTQghhBDi76L/4HiPv/G9DACgfpv3BICrt+c+/J9rbszx53lvladVAgCe7t7xob+MKlVSU1N/e+1SDVGBeQCQ+Ov6f4mXQUt4EtpACyjxN9fXW3U+z39QP3krQOb/kJMCl+PL9W/+L+o/9sSIRaXjc9n+m/rzAAoVuJyTCS7Hl+uX/C/q52z2B+vP9OV4gOb/IScLXI4v1y8Oj8Mz0OavXimEEEIIIYQQQvxZb1Wu/R/dP1+6P89jLudkhMvxH92fCyGEEEIIIYQQ4sp7rnOXpx5r06ZF+79vgr89F/jHsmQiE5n8fza50p9MQgghhBBCiH+1yxf9V3olQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCFE+vU/8e/ErvQehRBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCiCvtfwUAAP//luw5aQ==") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000a80)=0x1, 0x4) r1 = socket$inet6(0xa, 0x3, 0x88) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000980)={{{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in=@initdev={0xac, 0x1e, 0x3, 0x0}, 0x4e1f, 0x0, 0x0, 0x3, 0xa}, {0xec, 0x8000000000000000, 0x1, 0x6811221b, 0x1d26, 0x8000000000010003, 0x200000200000003, 0x100000000}, {0x7ae, 0xfffffffffffffffd, 0x6, 0x7}, 0x6, 0x0, 0x1, 0x0, 0x6, 0x1}, {{@in=@empty, 0x0, 0x6c}, 0xa, @in6=@remote, 0x0, 0x1, 0x2, 0x0, 0x9, 0x7}}, 0xe8) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e24, 0x7f, @loopback, 0x1ff}, 0x1c) 2.082553262s ago: executing program 2 (id=287): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x16, 0x3, &(0x7f0000000680)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x4, 0x4, 0x4, 0x10, 0x0, 0x0}, 0x50) close(0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xa, 0x8, &(0x7f0000000300)=ANY=[@ANYBLOB="18120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7030000f2717ca8bfa400000000000007040000f8ffffffb705000000000000850000001900000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x10, 0x38, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 1.906801106s ago: executing program 4 (id=288): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000080000002d01000000000000850000000100000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$packet(0x11, 0x2, 0x300) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000800)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) syz_emit_ethernet(0x3e, &(0x7f00000001c0)={@broadcast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x66, 0x0, 0x0, 0x1, 0x0, @remote, @local}, @parameter_prob={0xc, 0x0, 0x0, 0x0, 0x4, 0x0, {0x5, 0x4, 0x0, 0x4, 0x6, 0x64, 0xa0a, 0x6, 0x0, 0x9, @broadcast, @loopback}}}}}}, 0x0) 1.332850179s ago: executing program 3 (id=289): r0 = syz_ublk_setup_io_uring(0x757b, &(0x7f00000016c0)={0x0, 0xed61, 0x40, 0x0, 0xe6}, &(0x7f0000001740)=0x0, &(0x7f0000001780)=0x0, &(0x7f00000017c0)=0x0) syz_io_uring_setup(0x42ac, &(0x7f00000006c0)={0x0, 0xc1a5, 0x1000, 0x0, 0x33e}, &(0x7f0000000740), 0x0, &(0x7f00000007c0)) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000840)={0x2e, 0x12, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000800)=@any_dev={0x1, 0xed7, 0x0, 0x0, 0x1000, 0x80000001, 0xffffffffffffffff, 0x0, 0x10}}}, &(0x7f00000008c0)) io_uring_register$IORING_REGISTER_RESTRICTIONS(r0, 0xb, &(0x7f0000001800), 0x0) io_uring_register$IORING_REGISTER_ENABLE_RINGS(r0, 0xc, 0x0, 0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000001bc0)={0x2e, 0x40, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x2, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000001b80)=@any_dev={0x2, 0x954, 0x0, 0x0, 0x1000, 0x10001, 0x0, 0x0, 0x160}}}, 0xfffffffffffffffe) 131.987127ms ago: executing program 3 (id=290): unshare(0x400) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x20000011}, 0x10) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080), 0x80000, 0x0) ioctl$RTC_ALM_READ(r0, 0x40187014, &(0x7f0000000000)) 125.991098ms ago: executing program 5 (id=291): prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000300)="04000000000000000000000038010000380100000000000000000000000000000000000000000000000000000000000063") ioctl(r0, 0xc138fd0a, &(0x7f0000000300)) 21.74841ms ago: executing program 3 (id=292): rt_sigprocmask(0x0, &(0x7f0000001480)={[0xffffffffffffffff]}, 0x0, 0x8) r0 = getpgrp(0x0) r1 = gettid() rt_tgsigqueueinfo(r0, r1, 0x1d, &(0x7f00000021c0)={0x9, 0xe, 0x2}) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000002180)={[0xfffffffffffffff7]}, 0x8, 0x80000) read$FUSE(r2, &(0x7f0000000140)={0x2020}, 0x2020) 5.3311ms ago: executing program 3 (id=293): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$fuse(0x0, 0x0, 0x3008409, 0x0, 0x4, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0600000004000000080000000f"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r1}, 0xc) 0s ago: executing program 2 (id=294): setuid(0xee00) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000000040)=0x8001) r2 = getpgid(0x0) fcntl$setownex(r1, 0xf, &(0x7f0000000140)={0x1, r2}) sendmmsg$unix(r0, &(0x7f0000011500)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000000)="11", 0x1}], 0x1, 0x0, 0x0, 0x4004040}}], 0x1, 0x40015) 0s ago: executing program 3 (id=295): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x4, 0x4, 0x4, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xe, 0x6, &(0x7f0000000300)=ANY=[@ANYBLOB="b702000001000000b703000000000000b7040000000000008500000032000000b70000000100000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)={@map=r2, r3, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000600)={r2, &(0x7f0000000640), &(0x7f0000000680)=@tcp=r0}, 0x20) sendto(r1, &(0x7f0000000800)="01", 0x1, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 9.247451][ T115] udevd (115) used greatest stack depth: 21248 bytes left [ 14.323783][ T28] kauditd_printk_skb: 27 callbacks suppressed [ 14.323799][ T28] audit: type=1400 audit(1791202809.548:59): avc: denied { transition } for pid=224 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.329872][ T28] audit: type=1400 audit(1791202809.548:60): avc: denied { noatsecure } for pid=224 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.333901][ T28] audit: type=1400 audit(1791202809.548:61): avc: denied { write } for pid=224 comm="sh" path="pipe:[13067]" dev="pipefs" ino=13067 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.340323][ T28] audit: type=1400 audit(1791202809.548:62): avc: denied { rlimitinh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.348612][ T28] audit: type=1400 audit(1791202809.548:63): avc: denied { siginh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.111' (ED25519) to the list of known hosts. [ 21.653982][ T28] audit: type=1400 audit(1791202816.878:64): avc: denied { mounton } for pid=278 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.655654][ T278] cgroup: Unknown subsys name 'net' [ 21.678503][ T28] audit: type=1400 audit(1791202816.878:65): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.707736][ T28] audit: type=1400 audit(1791202816.908:66): avc: denied { unmount } for pid=278 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.708389][ T278] cgroup: Unknown subsys name 'devices' [ 21.823678][ T278] cgroup: Unknown subsys name 'hugetlb' [ 21.829770][ T278] cgroup: Unknown subsys name 'rlimit' [ 21.961267][ T28] audit: type=1400 audit(1791202817.188:67): avc: denied { setattr } for pid=278 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.988790][ T28] audit: type=1400 audit(1791202817.188:68): avc: denied { mounton } for pid=278 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.998190][ T280] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.015200][ T28] audit: type=1400 audit(1791202817.188:69): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.053009][ T28] audit: type=1400 audit(1791202817.248:70): avc: denied { relabelto } for pid=280 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 22.085058][ T28] audit: type=1400 audit(1791202817.248:71): avc: denied { write } for pid=280 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.123426][ T28] audit: type=1400 audit(1791202817.348:72): avc: denied { read } for pid=278 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.153316][ T28] audit: type=1400 audit(1791202817.348:73): avc: denied { open } for pid=278 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.153351][ T278] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.982656][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.993190][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.004454][ T286] device bridge_slave_0 entered promiscuous mode [ 23.015043][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.024584][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.035067][ T286] device bridge_slave_1 entered promiscuous mode [ 23.074823][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.083709][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.093577][ T287] device bridge_slave_0 entered promiscuous mode [ 23.113561][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.121457][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.133305][ T287] device bridge_slave_1 entered promiscuous mode [ 23.170177][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.179100][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.190048][ T289] device bridge_slave_0 entered promiscuous mode [ 23.211023][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.220556][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.229047][ T289] device bridge_slave_1 entered promiscuous mode [ 23.261320][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.278161][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.288144][ T288] device bridge_slave_0 entered promiscuous mode [ 23.297135][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.305531][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.315251][ T288] device bridge_slave_1 entered promiscuous mode [ 23.415618][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.426432][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.434681][ T290] device bridge_slave_0 entered promiscuous mode [ 23.445885][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.453697][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.461811][ T290] device bridge_slave_1 entered promiscuous mode [ 23.548984][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.556640][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.564275][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.574656][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.622561][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.630276][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.638880][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.646131][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.673510][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.682274][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.692187][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.701986][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.710650][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.744575][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.753449][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.762419][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.785435][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.794013][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.801832][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.822300][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.847267][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.859836][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.867516][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.877954][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.889615][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.900589][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.910087][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.919434][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.945829][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.954709][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.964446][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.972643][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.982042][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.990247][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.999363][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.009657][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.017715][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.026066][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.038136][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.047915][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.055562][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.063797][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.079598][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.088317][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.116739][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.125871][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.134830][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.143479][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.152423][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.162301][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.171236][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.179731][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.188843][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.197746][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.208389][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.217861][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.240143][ T286] device veth0_vlan entered promiscuous mode [ 24.249340][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.258886][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.269014][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.277912][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.286422][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.295206][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.304191][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.313870][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.323048][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.330105][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.337608][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.346245][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.355550][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.365030][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.375795][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.384797][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.393348][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.402507][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.410643][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.418825][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.426528][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.454693][ T288] device veth0_vlan entered promiscuous mode [ 24.462134][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.471493][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.480110][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.489025][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.499125][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.508924][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.537804][ T288] device veth1_macvtap entered promiscuous mode [ 24.549033][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.559485][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.570157][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.589246][ T289] device veth0_vlan entered promiscuous mode [ 24.600574][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.610410][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.619627][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.630285][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.640012][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.649296][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.658823][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.668932][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.678754][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.688870][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.701490][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.717756][ T290] device veth0_vlan entered promiscuous mode [ 24.727983][ T287] device veth0_vlan entered promiscuous mode [ 24.742157][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.756077][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.766336][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.775965][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.788105][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.800197][ T286] device veth1_macvtap entered promiscuous mode [ 24.821228][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.832565][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.843898][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.854452][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.864850][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.874353][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.885625][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.896012][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.908602][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.919241][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.930572][ T289] device veth1_macvtap entered promiscuous mode [ 24.944871][ T288] request_module fs-gadgetfs succeeded, but still no fs? [ 24.958924][ T290] device veth1_macvtap entered promiscuous mode [ 24.968192][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.980593][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.995632][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.015424][ T287] device veth1_macvtap entered promiscuous mode [ 25.035960][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.045953][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.058159][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.071025][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.081514][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.110343][ T315] Zero length message leads to an empty skb [ 25.118429][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.127952][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.139076][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.152775][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.164026][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.182742][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.192722][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.203389][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.218188][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.233654][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.321611][ T333] ip_tables: iptables: counters copy to user failed while replacing table [ 25.455635][ T346] loop3: detected capacity change from 0 to 256 [ 25.471424][ T346] exfat: Deprecated parameter 'utf8' [ 25.477754][ T346] exfat: Deprecated parameter 'utf8' [ 25.487585][ T346] exfat: Bad value for 'gid' [ 25.751000][ T309] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 25.961924][ T309] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.966457][ T356] loop1: detected capacity change from 0 to 40427 [ 25.991168][ T309] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 25.991366][ T356] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 26.007731][ T309] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 26.018472][ T356] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 26.029647][ T309] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 26.055359][ T309] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.056844][ T356] F2FS-fs (loop1): invalid crc value [ 26.068067][ T309] usb 3-1: config 0 descriptor?? [ 26.079747][ T356] F2FS-fs (loop1): Found nat_bits in checkpoint [ 26.113882][ T356] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 26.121877][ T356] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 26.310926][ T24] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.360922][ T6] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 26.483202][ T309] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 26.502561][ T24] usb 1-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 1.00 [ 26.504977][ T309] plantronics 0003:047F:FFFF.0001: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 26.512970][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.541232][ T24] usb 1-1: config 0 descriptor?? [ 26.551899][ T6] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.576512][ T6] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 26.588446][ T6] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 26.621108][ T6] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 26.642095][ T6] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.653010][ T6] usb 4-1: Product: syz [ 26.657429][ T6] usb 4-1: Manufacturer: syz [ 26.663729][ T6] usb 4-1: SerialNumber: syz [ 26.680408][ T6] cdc_ncm 4-1:1.0: skipping garbage [ 26.689263][ T6] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 26.730904][ T6] cdc_ncm 4-1:1.0: bind() failure [ 26.875931][ T28] kauditd_printk_skb: 55 callbacks suppressed [ 26.875946][ T28] audit: type=1400 audit(1791202822.098:129): avc: denied { mount } for pid=377 comm="syz.1.24" name="/" dev="configfs" ino=12796 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 26.920079][ T28] audit: type=1400 audit(1791202822.138:130): avc: denied { setopt } for pid=366 comm="syz.3.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 26.920773][ T309] usb 4-1: USB disconnect, device number 2 [ 26.948130][ T28] audit: type=1400 audit(1791202822.138:131): avc: denied { search } for pid=377 comm="syz.1.24" name="/" dev="configfs" ino=12796 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 26.954194][ T380] FAULT_INJECTION: forcing a failure. [ 26.954194][ T380] name failslab, interval 1, probability 0, space 0, times 1 [ 26.973276][ T28] audit: type=1400 audit(1791202822.138:132): avc: denied { read } for pid=377 comm="syz.1.24" name="/" dev="configfs" ino=12796 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 27.011401][ T28] audit: type=1400 audit(1791202822.138:133): avc: denied { open } for pid=377 comm="syz.1.24" path="/" dev="configfs" ino=12796 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 27.013928][ T24] wacom 0003:056A:0331.0002: hidraw1: USB HID v1.10 Device [HID 056a:0331] on usb-dummy_hcd.0-1/input0 [ 27.035118][ T380] CPU: 0 PID: 380 Comm: syz.1.25 Not tainted syzkaller #0 [ 27.054839][ T380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 27.067034][ T380] Call Trace: [ 27.070707][ T380] [ 27.074291][ T380] __dump_stack+0x21/0x24 [ 27.080081][ T380] dump_stack_lvl+0x110/0x170 [ 27.085187][ T380] ? __cfi_dump_stack_lvl+0x8/0x8 [ 27.090797][ T380] dump_stack+0x15/0x24 [ 27.095346][ T380] should_fail_ex+0x3bf/0x510 [ 27.100929][ T380] ? key_alloc+0x2d3/0xf00 [ 27.105396][ T380] __should_failslab+0xac/0xf0 [ 27.110913][ T380] should_failslab+0x9/0x20 [ 27.115726][ T380] kmem_cache_alloc+0x3b/0x320 [ 27.121299][ T380] ? key_user_lookup+0x1c8/0x460 [ 27.127712][ T380] key_alloc+0x2d3/0xf00 [ 27.133075][ T380] keyring_alloc+0x47/0xb0 [ 27.137657][ T380] lookup_user_key+0x4ed/0x1150 [ 27.143886][ T380] ? __cfi_lookup_user_key+0x10/0x10 [ 27.149311][ T380] ? __cfi_lookup_user_key_possessed+0x10/0x10 [ 27.152218][ T375] loop4: detected capacity change from 0 to 131072 [ 27.155948][ T380] ? __kasan_check_write+0x14/0x20 [ 27.155978][ T380] __se_sys_add_key+0x311/0x410 [ 27.155999][ T380] ? __x64_sys_add_key+0xd0/0xd0 [ 27.180263][ T380] ? xfd_validate_state+0x70/0x150 [ 27.185795][ T380] ? __kasan_check_write+0x14/0x20 [ 27.188493][ T375] F2FS-fs (loop4): Invalid segment/section count (458783, 24 x 150994945) [ 27.191385][ T380] ? fpregs_restore_userregs+0x128/0x260 [ 27.191418][ T380] __x64_sys_add_key+0xbf/0xd0 [ 27.191441][ T380] x64_sys_call+0x6aa/0x9a0 [ 27.217217][ T375] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 27.218389][ T380] do_syscall_64+0x4c/0xa0 [ 27.229594][ T375] F2FS-fs (loop4): invalid crc value [ 27.232270][ T380] ? clear_bhb_loop+0x30/0x80 [ 27.232304][ T380] ? clear_bhb_loop+0x30/0x80 [ 27.232324][ T380] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.232344][ T380] RIP: 0033:0x7f34f4f9e199 [ 27.232362][ T380] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.278354][ T380] RSP: 002b:00007f34f5f1f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 27.287072][ T380] RAX: ffffffffffffffda RBX: 00007f34f5225fa0 RCX: 00007f34f4f9e199 [ 27.295335][ T380] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 00002000000002c0 [ 27.301892][ T375] F2FS-fs (loop4): Found nat_bits in checkpoint [ 27.303999][ T380] RBP: 00007f34f50350b8 R08: fffffffffffffffe R09: 0000000000000000 [ 27.304017][ T380] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.304029][ T380] R13: 00007f34f5226038 R14: 00007f34f5225fa0 R15: 00007ffe2ddec448 [ 27.335544][ T380] [ 27.341483][ T375] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 27.349419][ T375] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 27.377509][ T28] audit: type=1400 audit(1791202822.598:134): avc: denied { bind } for pid=387 comm="syz.1.26" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 27.398996][ T28] audit: type=1400 audit(1791202822.598:135): avc: denied { name_bind } for pid=387 comm="syz.1.26" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 27.420723][ T28] audit: type=1400 audit(1791202822.598:136): avc: denied { node_bind } for pid=387 comm="syz.1.26" saddr=::ffff:0.0.0.0 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 27.445166][ T28] audit: type=1400 audit(1791202822.618:137): avc: denied { connect } for pid=387 comm="syz.1.26" laddr=::ffff:0.0.0.0 lport=20001 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 27.469661][ T28] audit: type=1400 audit(1791202822.668:138): avc: denied { write } for pid=387 comm="syz.1.26" path="socket:[16772]" dev="sockfs" ino=16772 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 27.592692][ T309] usb 1-1: USB disconnect, device number 2 [ 27.660914][ T396] loop3: detected capacity change from 0 to 512 [ 27.701493][ T396] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -2 [ 27.711226][ T396] EXT4-fs error (device loop3): ext4_iget_extra_inode:4765: inode #15: comm syz.3.31: corrupted in-inode xattr [ 27.725044][ T396] EXT4-fs error (device loop3): ext4_orphan_get:1410: comm syz.3.31: couldn't read orphan inode 15 (err -117) [ 27.737685][ T396] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 27.801886][ T288] EXT4-fs (loop3): unmounting filesystem. [ 27.830983][ C0] plantronics 0003:047F:FFFF.0001: usb_submit_urb(ctrl) failed: -1 [ 27.933403][ T405] loop4: detected capacity change from 0 to 40427 [ 27.945811][ T405] F2FS-fs (loop4): fault_injection options not supported [ 27.953569][ T405] F2FS-fs (loop4): fault_type options not supported [ 27.963186][ T405] F2FS-fs (loop4): invalid crc value [ 27.975515][ T405] F2FS-fs (loop4): Found nat_bits in checkpoint [ 27.999628][ T405] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 28.090907][ T24] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 28.281913][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 28.289322][ T24] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 28.310864][ T24] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 28.329932][ T24] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 28.354349][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.392257][ T24] hub 4-1:1.0: bad descriptor, ignoring hub [ 28.399029][ T24] hub: probe of 4-1:1.0 failed with error -5 [ 28.662518][ T6] usb 3-1: USB disconnect, device number 2 [ 28.668295][ T440] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 28.734623][ T447] loop2: detected capacity change from 0 to 1024 [ 28.757308][ T447] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #3: block 2: comm syz.2.49: lblock 2 mapped to illegal pblock 2 (length 1) [ 28.779451][ T447] EXT4-fs (loop2): Remounting filesystem read-only [ 28.788900][ T447] EXT4-fs error (device loop2): __ext4_get_inode_loc:4522: comm syz.2.49: Invalid inode table block 1 in block_group 0 [ 28.807053][ T447] EXT4-fs (loop2): Remounting filesystem read-only [ 28.816855][ T447] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5954: Corrupt filesystem [ 28.827845][ T447] EXT4-fs (loop2): Remounting filesystem read-only [ 28.836120][ T447] EXT4-fs error (device loop2): __ext4_ext_dirty:202: inode #3: comm syz.2.49: mark_inode_dirty error [ 28.853417][ T447] EXT4-fs (loop2): Remounting filesystem read-only [ 28.861162][ T447] EXT4-fs error (device loop2): ext4_acquire_dquot:6828: comm syz.2.49: Failed to acquire dquot type 0 [ 28.874236][ T447] EXT4-fs (loop2): Remounting filesystem read-only [ 28.890966][ T447] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5954: Corrupt filesystem [ 28.909154][ T309] usb 4-1: reset high-speed USB device number 3 using dummy_hcd [ 28.957291][ T447] EXT4-fs (loop2): Remounting filesystem read-only [ 28.975131][ T447] EXT4-fs error (device loop2): ext4_evict_inode:281: inode #11: comm syz.2.49: mark_inode_dirty error [ 28.999801][ T447] EXT4-fs (loop2): Remounting filesystem read-only [ 29.013904][ T447] EXT4-fs warning (device loop2): ext4_evict_inode:284: couldn't mark inode dirty (err -117) [ 29.029158][ T447] EXT4-fs (loop2): 1 orphan inode deleted [ 29.032441][ T492] loop4: detected capacity change from 0 to 256 [ 29.037574][ T447] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 29.055046][ T487] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:40: lblock 1 mapped to illegal pblock 1 (length 1) [ 29.080956][ T487] EXT4-fs (loop2): Remounting filesystem read-only [ 29.089087][ T492] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 29.090540][ T487] EXT4-fs error (device loop2): ext4_release_dquot:6864: comm kworker/u4:40: Failed to release dquot type 0 [ 29.128494][ T487] EXT4-fs (loop2): Remounting filesystem read-only [ 29.161536][ T492] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 29.181880][ T290] EXT4-fs (loop2): unmounting filesystem. [ 29.189940][ T290] EXT4-fs error (device loop2): __ext4_get_inode_loc:4522: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 29.209782][ T290] EXT4-fs (loop2): Remounting filesystem read-only [ 29.224415][ T290] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5954: Corrupt filesystem [ 29.241317][ T290] EXT4-fs (loop2): Remounting filesystem read-only [ 29.260620][ T290] EXT4-fs error (device loop2): ext4_quota_off:7134: inode #3: comm syz-executor: mark_inode_dirty error [ 29.279951][ T290] EXT4-fs (loop2): Remounting filesystem read-only [ 29.957781][ T515] netlink: 28 bytes leftover after parsing attributes in process `syz.4.59'. [ 30.013227][ T301] usb 4-1: USB disconnect, device number 3 [ 30.112826][ T531] netlink: 8 bytes leftover after parsing attributes in process `syz.0.70'. [ 30.124744][ T531] netlink: 8 bytes leftover after parsing attributes in process `syz.0.70'. [ 30.443318][ T564] loop4: detected capacity change from 0 to 256 [ 30.483962][ T564] exfat: Deprecated parameter 'utf8' [ 30.490530][ T564] exfat: Deprecated parameter 'utf8' [ 30.520839][ T291] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 30.544035][ T564] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 30.633104][ T574] loop4: detected capacity change from 0 to 1024 [ 30.656030][ T574] ======================================================= [ 30.656030][ T574] WARNING: The mand mount option has been deprecated and [ 30.656030][ T574] and is ignored by this kernel. Remove the mand [ 30.656030][ T574] option from the mount to silence this warning. [ 30.656030][ T574] ======================================================= [ 30.700641][ T574] EXT4-fs: Ignoring removed bh option [ 30.722415][ T291] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.739856][ T291] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.757919][ T574] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 30.776989][ T517] loop3: detected capacity change from 0 to 131072 [ 30.782945][ T291] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 30.802051][ T517] F2FS-fs (loop3): invalid crc value [ 30.805430][ T583] loop1: detected capacity change from 0 to 512 [ 30.817287][ T574] ext4 filesystem being mounted at /18/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 30.845425][ T291] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 30.856409][ T291] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.866023][ T291] usb 1-1: config 0 descriptor?? [ 30.884753][ T583] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 30.884968][ T517] F2FS-fs (loop3): Found nat_bits in checkpoint [ 30.911852][ T574] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.87: bg 0: block 112: padding at end of block bitmap is not set [ 30.933252][ T574] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #15: block 3: comm syz.4.87: lblock 3 mapped to illegal pblock 3 (length 1) [ 30.957131][ T517] F2FS-fs (loop3): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. [ 30.961128][ T574] EXT4-fs error (device loop4): ext4_ext_remove_space:2945: inode #15: comm syz.4.87: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 2, max 4(4), depth 0(0) [ 30.969992][ T583] EXT4-fs (loop1): 1 orphan inode deleted [ 30.997072][ T468] EXT4-fs error (device loop1): ext4_release_dquot:6864: comm kworker/u4:21: Failed to release dquot type 1 [ 30.997397][ T614] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: block 3: comm syz.4.87: lblock 3 mapped to illegal pblock 3 (length 1) [ 31.021005][ T583] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 31.036247][ T583] ext4 filesystem being mounted at /28/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.048396][ T517] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 31.063976][ T289] EXT4-fs (loop4): unmounting filesystem. [ 31.140902][ T583] loop1: detected capacity change from 512 to 0 [ 31.156493][ C0] I/O error, dev loop1, sector 296 op 0x0:(READ) flags 0x3000 phys_seg 1 prio class 2 [ 31.167346][ C1] I/O error, dev loop1, sector 96 op 0x0:(READ) flags 0x3000 phys_seg 1 prio class 2 [ 31.178827][ T622] EXT4-fs error (device loop1): ext4_write_dquot:6808: comm syz.1.90: Failed to commit dquot type 1 [ 31.191896][ T468] loop: Write error at byte offset 9223372036854775807, length 4096. [ 31.200444][ C1] I/O error, dev loop1, sector 0 op 0x1:(WRITE) flags 0x3800 phys_seg 1 prio class 2 [ 31.211212][ C1] I/O error, dev loop1, sector 0 op 0x1:(WRITE) flags 0x3800 phys_seg 1 prio class 2 [ 31.221761][ C1] Buffer I/O error on dev loop1, logical block 0, lost sync page write [ 31.232501][ T622] EXT4-fs (loop1): I/O error while writing superblock [ 31.240429][ C1] I/O error, dev loop1, sector 272 op 0x0:(READ) flags 0x3000 phys_seg 1 prio class 2 [ 31.251380][ C1] I/O error, dev loop1, sector 280 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 31.261525][ T622] EXT4-fs error (device loop1): ext4_get_inode_loc:4660: inode #16: block 34: comm syz.1.90: unable to read itable block [ 31.277512][ T488] loop: Write error at byte offset 9223372036854775807, length 4096. [ 31.291891][ T291] plantronics 0003:047F:FFFF.0003: unbalanced collection at end of report description [ 31.310899][ C0] I/O error, dev loop1, sector 0 op 0x1:(WRITE) flags 0x3800 phys_seg 1 prio class 2 [ 31.320707][ C0] I/O error, dev loop1, sector 0 op 0x1:(WRITE) flags 0x3800 phys_seg 1 prio class 2 [ 31.330467][ C0] Buffer I/O error on dev loop1, logical block 0, lost sync page write [ 31.340492][ T622] EXT4-fs (loop1): I/O error while writing superblock [ 31.341155][ T291] plantronics 0003:047F:FFFF.0003: parse failed [ 31.354245][ T622] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5954: IO failure [ 31.364370][ T291] plantronics: probe of 0003:047F:FFFF.0003 failed with error -22 [ 31.375273][ T476] loop: Write error at byte offset 9223372036854775807, length 4096. [ 31.397124][ C1] I/O error, dev loop1, sector 0 op 0x1:(WRITE) flags 0x3800 phys_seg 1 prio class 2 [ 31.407785][ C1] I/O error, dev loop1, sector 0 op 0x1:(WRITE) flags 0x3800 phys_seg 1 prio class 2 [ 31.418211][ C1] Buffer I/O error on dev loop1, logical block 0, lost sync page write [ 31.429013][ T622] EXT4-fs (loop1): I/O error while writing superblock [ 31.436812][ T622] EXT4-fs error (device loop1): ext4_dirty_inode:6158: inode #16: comm syz.1.90: mark_inode_dirty error [ 31.460236][ T476] loop: Write error at byte offset 9223372036854775807, length 4096. [ 31.487546][ C0] Buffer I/O error on dev loop1, logical block 0, lost sync page write [ 31.494279][ T301] usb 1-1: USB disconnect, device number 3 [ 31.505779][ T622] EXT4-fs (loop1): I/O error while writing superblock [ 31.519737][ T622] EXT4-fs error (device loop1): ext4_wait_block_bitmap:573: comm syz.1.90: Cannot read block bitmap - block_group = 0, block_bitmap = 2 [ 31.542043][ T476] loop: Write error at byte offset 9223372036854775807, length 4096. [ 31.555779][ C0] Buffer I/O error on dev loop1, logical block 0, lost sync page write [ 31.568511][ T622] EXT4-fs (loop1): I/O error while writing superblock [ 31.586346][ T622] EXT4-fs error (device loop1): ext4_write_dquot:6808: comm syz.1.90: Failed to commit dquot type 1 [ 31.604971][ T476] loop: Write error at byte offset 9223372036854775807, length 4096. [ 31.645554][ C1] Buffer I/O error on dev loop1, logical block 0, lost sync page write [ 31.655202][ T622] EXT4-fs (loop1): I/O error while writing superblock [ 31.671101][ T622] EXT4-fs error (device loop1): ext4_get_inode_loc:4660: inode #16: block 34: comm syz.1.90: unable to read itable block [ 31.696097][ T635] Illegal XDP return value 4294967274 on prog (id 12) dev syz_tun, expect packet loss! [ 31.710533][ T476] loop: Write error at byte offset 9223372036854775807, length 4096. [ 31.737269][ C1] Buffer I/O error on dev loop1, logical block 0, lost sync page write [ 31.746328][ T622] EXT4-fs (loop1): I/O error while writing superblock [ 31.762504][ T622] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5954: IO failure [ 31.780588][ T476] loop: Write error at byte offset 9223372036854775807, length 4096. [ 31.792005][ C1] Buffer I/O error on dev loop1, logical block 0, lost sync page write [ 31.801449][ T622] EXT4-fs (loop1): I/O error while writing superblock [ 31.810671][ T622] EXT4-fs error (device loop1): ext4_dirty_inode:6158: inode #16: comm syz.1.90: mark_inode_dirty error [ 31.828488][ T476] loop: Write error at byte offset 9223372036854775807, length 4096. [ 31.840676][ C1] Buffer I/O error on dev loop1, logical block 0, lost sync page write [ 31.852994][ T622] EXT4-fs (loop1): I/O error while writing superblock [ 31.866796][ T622] EXT4-fs error (device loop1): ext4_get_inode_loc:4660: inode #16: block 34: comm syz.1.90: unable to read itable block [ 31.884278][ T476] loop: Write error at byte offset 9223372036854775807, length 4096. [ 31.895170][ C1] Buffer I/O error on dev loop1, logical block 0, lost sync page write [ 31.941741][ T28] kauditd_printk_skb: 66 callbacks suppressed [ 31.941752][ T28] audit: type=1400 audit(1791202827.168:199): avc: denied { load_policy } for pid=649 comm="syz.4.103" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 31.944653][ T650] SELinux: failed to load policy [ 31.993312][ T653] loop3: detected capacity change from 0 to 512 [ 32.000082][ T28] audit: type=1400 audit(1791202827.218:200): avc: denied { getopt } for pid=652 comm="syz.4.106" lport=60 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 32.023798][ T28] audit: type=1400 audit(1791202827.238:201): avc: denied { bind } for pid=657 comm="syz.4.108" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 32.077422][ T653] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -2 [ 32.083781][ T28] audit: type=1400 audit(1791202827.238:202): avc: denied { listen } for pid=657 comm="syz.4.108" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 32.160325][ T653] EXT4-fs error (device loop3): ext4_iget_extra_inode:4765: inode #15: comm syz.3.105: corrupted in-inode xattr [ 32.191018][ T653] EXT4-fs error (device loop3): ext4_orphan_get:1410: comm syz.3.105: couldn't read orphan inode 15 (err -117) [ 32.204111][ T653] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 32.253422][ T28] audit: type=1400 audit(1791202827.478:203): avc: denied { mounton } for pid=669 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 32.346797][ T288] EXT4-fs (loop3): unmounting filesystem. [ 32.382276][ T669] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.389447][ T669] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.397751][ T669] device bridge_slave_0 entered promiscuous mode [ 32.423444][ T669] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.430721][ T669] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.438901][ T669] device bridge_slave_1 entered promiscuous mode [ 32.539818][ T669] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.547830][ T669] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.556005][ T669] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.563199][ T669] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.584736][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.594219][ T469] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.602882][ T469] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.613250][ T690] ip_tables: iptables: counters copy to user failed while replacing table [ 32.628459][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.642045][ T469] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.652226][ T469] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.663607][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.674828][ T469] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.684535][ T469] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.711379][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.732406][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.752115][ T488] device bridge_slave_1 left promiscuous mode [ 32.759393][ T488] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.767761][ T488] device bridge_slave_0 left promiscuous mode [ 32.775085][ T488] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.785256][ T488] device veth1_macvtap left promiscuous mode [ 32.791424][ T488] device veth0_vlan left promiscuous mode [ 32.895506][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.910543][ T669] device veth0_vlan entered promiscuous mode [ 32.917821][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.926867][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.939291][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.952588][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.964120][ T669] device veth1_macvtap entered promiscuous mode [ 32.978845][ T469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 32.991717][ T476] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.122608][ T709] tipc: Started in network mode [ 33.127833][ T709] tipc: Node identity 4, cluster identity 4711 [ 33.142901][ T709] tipc: Node number set to 4 [ 33.152298][ T709] tipc: Enabled bearer , priority 0 [ 33.199909][ T28] audit: type=1400 audit(1791202828.418:204): avc: denied { create } for pid=711 comm="syz.2.126" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 33.234919][ T28] audit: type=1400 audit(1791202828.418:205): avc: denied { write } for pid=711 comm="syz.2.126" path="socket:[18852]" dev="sockfs" ino=18852 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 33.265032][ T716] loop2: detected capacity change from 0 to 512 [ 33.289637][ T720] loop4: detected capacity change from 0 to 128 [ 33.322707][ T723] loop0: detected capacity change from 0 to 512 [ 33.328793][ T725] loop3: detected capacity change from 0 to 2048 [ 33.347257][ T716] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 33.379335][ T725] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 33.402372][ T723] EXT4-fs error (device loop0): ext4_validate_block_bitmap:429: comm syz.0.131: bg 0: block 5: invalid block bitmap [ 33.417129][ T716] ext4 filesystem being mounted at /24/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 33.446456][ T28] audit: type=1400 audit(1791202828.668:206): avc: denied { read } for pid=724 comm="syz.3.129" name="file0" dev="loop3" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 33.461394][ T723] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 33.470819][ T725] fscrypt (loop3, inode 12): Error -61 getting encryption context [ 33.480626][ T723] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #11: comm syz.0.131: invalid indirect mapped block 3 (level 2) [ 33.504064][ T723] EXT4-fs (loop0): 1 orphan inode deleted [ 33.510299][ T723] EXT4-fs (loop0): 1 truncate cleaned up [ 33.517437][ T723] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 33.520909][ T28] audit: type=1400 audit(1791202828.738:207): avc: denied { setattr } for pid=715 comm="syz.2.128" name="file0" dev="loop2" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 33.551760][ T288] EXT4-fs (loop3): unmounting filesystem. [ 33.574730][ T606] kworker/u4:63: attempt to access beyond end of device [ 33.574730][ T606] loop4: rw=1, sector=145, nr_sectors = 6 limit=128 [ 33.682202][ T28] audit: type=1400 audit(1791202828.908:208): avc: denied { write } for pid=741 comm="syz.4.144" name="unix" dev="proc" ino=4026532513 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 33.682759][ T723] EXT4-fs (loop0): unmounting filesystem. [ 33.743425][ T744] loop4: detected capacity change from 0 to 512 [ 33.759791][ T290] EXT4-fs (loop2): unmounting filesystem. [ 33.810697][ T744] FAT-fs (loop4): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 33.830872][ T744] FAT-fs (loop4): Filesystem has been set read-only [ 34.166116][ T783] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 34.226946][ T357] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 34.242616][ T357] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 498 with error 28 [ 34.257017][ T357] EXT4-fs (loop4): This should not happen!! Data will be lost [ 34.257017][ T357] [ 34.267607][ T357] EXT4-fs (loop4): Total free blocks count 0 [ 34.274420][ T357] EXT4-fs (loop4): Free/Dirty block details [ 34.280742][ T357] EXT4-fs (loop4): free_blocks=4096 [ 34.287164][ T357] EXT4-fs (loop4): dirty_blocks=512 [ 34.292724][ T357] EXT4-fs (loop4): Block reservation details [ 34.299411][ T357] EXT4-fs (loop4): i_reserved_data_blocks=32 [ 34.313303][ T289] EXT4-fs (loop4): unmounting filesystem. [ 34.374609][ T798] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 34.385996][ T798] ext4 filesystem being mounted at /42/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 34.403778][ T289] EXT4-fs (loop4): unmounting filesystem. [ 34.440263][ T804] netlink: 'syz.4.159': attribute type 4 has an invalid length. [ 34.460673][ T804] netlink: 'syz.4.159': attribute type 4 has an invalid length. [ 34.520852][ T309] usb 1-1: new low-speed USB device number 4 using dummy_hcd [ 34.702026][ T309] usb 1-1: config 0 has no interfaces? [ 34.718084][ T309] usb 1-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 34.750854][ T309] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.773730][ T309] usb 1-1: config 0 descriptor?? [ 34.987695][ T24] usb 1-1: USB disconnect, device number 4 [ 35.440910][ T6] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 35.522779][ T887] FAULT_INJECTION: forcing a failure. [ 35.522779][ T887] name failslab, interval 1, probability 0, space 0, times 0 [ 35.540667][ T887] CPU: 1 PID: 887 Comm: syz.3.184 Not tainted syzkaller #0 [ 35.550348][ T887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 35.562076][ T887] Call Trace: [ 35.565918][ T887] [ 35.568946][ T887] __dump_stack+0x21/0x24 [ 35.573285][ T887] dump_stack_lvl+0x110/0x170 [ 35.578308][ T887] ? __cfi_dump_stack_lvl+0x8/0x8 [ 35.583530][ T887] ? __bitmap_weight+0xb9/0x110 [ 35.588414][ T887] ? __alloc_percpu+0x24/0x30 [ 35.593097][ T887] dump_stack+0x15/0x24 [ 35.597277][ T887] should_fail_ex+0x3bf/0x510 [ 35.601965][ T887] ? alloc_vfsmnt+0x27/0x4a0 [ 35.606844][ T887] __should_failslab+0xac/0xf0 [ 35.611805][ T887] should_failslab+0x9/0x20 [ 35.616330][ T887] kmem_cache_alloc+0x3b/0x320 [ 35.621327][ T887] ? __cfi__raw_spin_lock+0x10/0x10 [ 35.626734][ T887] alloc_vfsmnt+0x27/0x4a0 [ 35.631247][ T887] clone_mnt+0x6d/0xd00 [ 35.635423][ T887] ? is_subdir+0x60/0x150 [ 35.640267][ T887] copy_tree+0x3dd/0x790 [ 35.642058][ T6] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 35.644663][ T887] copy_mnt_ns+0x180/0x930 [ 35.655157][ T6] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 35.659589][ T887] ? create_new_namespaces+0x34/0x660 [ 35.674230][ T887] ? create_new_namespaces+0x34/0x660 [ 35.680094][ T887] create_new_namespaces+0xd0/0x660 [ 35.685431][ T887] unshare_nsproxy_namespaces+0x120/0x170 [ 35.686719][ T6] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 35.691455][ T887] ksys_unshare+0x4d5/0x850 [ 35.691498][ T887] ? __cfi_ksys_unshare+0x10/0x10 [ 35.691523][ T887] ? fpregs_restore_userregs+0x128/0x260 [ 35.691547][ T887] __x64_sys_unshare+0x38/0x40 [ 35.714137][ T6] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 35.716310][ T887] x64_sys_call+0x767/0x9a0 [ 35.722009][ T6] usb 5-1: SerialNumber: syz [ 35.729970][ T887] do_syscall_64+0x4c/0xa0 [ 35.730008][ T887] ? clear_bhb_loop+0x30/0x80 [ 35.748210][ T887] ? clear_bhb_loop+0x30/0x80 [ 35.753012][ T887] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 35.758951][ T887] RIP: 0033:0x7f896179e199 [ 35.763436][ T887] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.783534][ T887] RSP: 002b:00007f8962635028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 35.792016][ T887] RAX: ffffffffffffffda RBX: 00007f8961a25fa0 RCX: 00007f896179e199 [ 35.800106][ T887] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002c020400 [ 35.808456][ T887] RBP: 00007f89618350b8 R08: 0000000000000000 R09: 0000000000000000 [ 35.816723][ T887] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 35.824974][ T887] R13: 00007f8961a26038 R14: 00007f8961a25fa0 R15: 00007fffbc6701d8 [ 35.833315][ T887] [ 35.945153][ T6] usb 5-1: 0:2 : does not exist [ 35.958851][ T6] usb 5-1: USB disconnect, device number 2 [ 36.066527][ T921] netlink: 'syz.3.194': attribute type 3 has an invalid length. [ 36.074521][ T921] netlink: 8 bytes leftover after parsing attributes in process `syz.3.194'. [ 36.202565][ T923] FAULT_INJECTION: forcing a failure. [ 36.202565][ T923] name fail_futex, interval 1, probability 0, space 0, times 1 [ 36.216977][ T923] CPU: 1 PID: 923 Comm: syz.0.195 Not tainted syzkaller #0 [ 36.224776][ T923] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 36.235353][ T923] Call Trace: [ 36.238746][ T923] [ 36.241702][ T923] __dump_stack+0x21/0x24 [ 36.246158][ T923] dump_stack_lvl+0x110/0x170 [ 36.251552][ T923] ? __cfi_dump_stack_lvl+0x8/0x8 [ 36.256783][ T923] dump_stack+0x15/0x24 [ 36.261360][ T923] should_fail_ex+0x3bf/0x510 [ 36.266053][ T923] should_fail+0xb/0x10 [ 36.270306][ T923] get_futex_key+0x170/0xb10 [ 36.275891][ T923] ? __cfi_get_futex_key+0x10/0x10 [ 36.281633][ T923] ? memset+0x35/0x40 [ 36.285927][ T923] ? refill_pi_state_cache+0x12e/0x170 [ 36.291531][ T923] futex_requeue+0x2a1/0x13a0 [ 36.296226][ T923] ? __kasan_check_read+0x11/0x20 [ 36.301379][ T923] ? schedule+0xd4/0x170 [ 36.305834][ T923] ? futex_wait+0x5f1/0x900 [ 36.310391][ T923] ? __cfi_futex_requeue+0x10/0x10 [ 36.315528][ T923] ? __cfi_futex_wake+0x10/0x10 [ 36.320591][ T923] ? vfs_write+0xa51/0xd00 [ 36.325029][ T923] do_futex+0x25e/0x430 [ 36.329351][ T923] ? __cfi_do_futex+0x10/0x10 [ 36.334073][ T923] ? __kasan_check_write+0x14/0x20 [ 36.339337][ T923] ? mutex_unlock+0x8f/0x230 [ 36.343948][ T923] __se_sys_futex+0x136/0x310 [ 36.348653][ T923] ? __x64_sys_futex+0x100/0x100 [ 36.353710][ T923] ? xfd_validate_state+0x70/0x150 [ 36.358952][ T923] ? __kasan_check_write+0x14/0x20 [ 36.364278][ T923] __x64_sys_futex+0xe5/0x100 [ 36.368987][ T923] x64_sys_call+0x7ec/0x9a0 [ 36.373510][ T923] do_syscall_64+0x4c/0xa0 [ 36.377977][ T923] ? clear_bhb_loop+0x30/0x80 [ 36.382697][ T923] ? clear_bhb_loop+0x30/0x80 [ 36.387407][ T923] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 36.393332][ T923] RIP: 0033:0x7f7baf99e199 [ 36.397775][ T923] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.417677][ T923] RSP: 002b:00007f7bb0908028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 36.426516][ T923] RAX: ffffffffffffffda RBX: 00007f7bafc25fa0 RCX: 00007f7baf99e199 [ 36.433096][ T925] set_capacity_and_notify: 3 callbacks suppressed [ 36.433121][ T925] loop3: detected capacity change from 0 to 40427 [ 36.434653][ T923] RDX: 0000000000000001 RSI: 000000000000000c RDI: 000020000000cffc [ 36.455665][ T923] RBP: 00007f7bafa350b8 R08: 0000000000000000 R09: 0000000000000000 [ 36.463806][ T923] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 36.472069][ T923] R13: 00007f7bafc26038 R14: 00007f7bafc25fa0 R15: 00007fffdfdc1728 [ 36.480074][ T923] [ 36.484058][ T925] F2FS-fs (loop3): Wrong segment_count / block_count (31 > 0) [ 36.500849][ T925] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 36.524305][ T925] F2FS-fs (loop3): invalid crc value [ 36.550910][ T925] F2FS-fs (loop3): Found nat_bits in checkpoint [ 36.616976][ T925] F2FS-fs (loop3): Try to recover 2th superblock, ret: 0 [ 36.631999][ T925] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 36.726713][ T288] syz-executor: attempt to access beyond end of device [ 36.726713][ T288] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 36.780636][ T918] loop2: detected capacity change from 0 to 131072 [ 36.830753][ T918] F2FS-fs (loop2): Test dummy encryption mode enabled [ 36.847709][ T918] F2FS-fs (loop2): invalid crc value [ 36.884847][ T918] F2FS-fs (loop2): Found nat_bits in checkpoint [ 36.979947][ T918] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 36.980161][ T28] kauditd_printk_skb: 26 callbacks suppressed [ 36.980194][ T28] audit: type=1400 audit(1791202832.198:235): avc: denied { ioctl } for pid=951 comm="syz.3.202" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=19880 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 37.020753][ T28] audit: type=1400 audit(1791202832.248:236): avc: denied { mounton } for pid=951 comm="syz.3.202" path="/29/bus" dev="tmpfs" ino=176 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 37.063084][ T918] fscrypt: AES-256-XTS using blk-crypto-fallback [ 37.089355][ T28] audit: type=1400 audit(1791202832.308:237): avc: denied { ioctl } for pid=917 comm="syz.2.193" path="/35/bus/file1" dev="loop2" ino=10 ioctlcmd=0xf514 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 37.354629][ T961] loop2: detected capacity change from 0 to 1024 [ 37.370089][ T961] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 37.370835][ T291] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 37.402557][ T961] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 37.417662][ T290] EXT4-fs (loop2): unmounting filesystem. [ 37.436230][ T966] loop2: detected capacity change from 0 to 2048 [ 37.460634][ T966] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 37.476372][ T966] ext4 filesystem being mounted at /37/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 37.517669][ T28] audit: type=1400 audit(1791202832.738:238): avc: denied { create } for pid=972 comm="syz.4.211" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 37.548290][ T28] audit: type=1400 audit(1791202832.738:239): avc: denied { ioctl } for pid=972 comm="syz.4.211" path="socket:[19919]" dev="sockfs" ino=19919 ioctlcmd=0x8915 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 37.581659][ T28] audit: type=1400 audit(1791202832.798:240): avc: denied { write } for pid=981 comm="syz.4.215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 37.587717][ T291] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 37.613663][ T28] audit: type=1400 audit(1791202832.798:241): avc: denied { nlmsg_write } for pid=981 comm="syz.4.215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 37.641695][ T291] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 37.660860][ T291] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.669032][ T291] usb 6-1: Product: syz [ 37.680820][ T291] usb 6-1: Manufacturer: syz [ 37.685472][ T291] usb 6-1: SerialNumber: syz [ 37.746844][ T996] loop4: detected capacity change from 0 to 512 [ 37.761333][ T976] EXT4-fs error (device loop2): ext4_validate_block_bitmap:438: comm syz.2.209: bg 0: block 345: padding at end of block bitmap is not set [ 37.782865][ T976] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 37.789763][ T28] audit: type=1400 audit(1791202833.008:242): avc: denied { mounton } for pid=995 comm="syz.4.220" path="/64/file0/dev" dev="loop4" ino=1048662 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=dir permissive=1 [ 37.795782][ T976] EXT4-fs (loop2): This should not happen!! Data will be lost [ 37.795782][ T976] [ 37.839257][ T976] syz.2.209 (976) used greatest stack depth: 20704 bytes left [ 37.848918][ T289] FAT-fs (loop4): error, invalid access to FAT (entry 0x00000103) [ 37.864752][ T601] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 1 with max blocks 127 with error 28 [ 37.882685][ T28] audit: type=1400 audit(1791202833.048:243): avc: denied { read } for pid=995 comm="syz.4.220" name="control" dev="devtmpfs" ino=266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 37.907461][ T601] EXT4-fs (loop2): This should not happen!! Data will be lost [ 37.907461][ T601] [ 37.924347][ T601] EXT4-fs (loop2): Total free blocks count 0 [ 37.930745][ T601] EXT4-fs (loop2): Free/Dirty block details [ 37.937181][ T601] EXT4-fs (loop2): free_blocks=0 [ 37.942736][ T28] audit: type=1400 audit(1791202833.048:244): avc: denied { open } for pid=995 comm="syz.4.220" path="/64/file0/dev/mapper/control" dev="devtmpfs" ino=266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 37.968523][ T601] EXT4-fs (loop2): dirty_blocks=4080 [ 37.974548][ T601] EXT4-fs (loop2): Block reservation details [ 38.481171][ T6] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 38.661983][ T6] usb 5-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 38.673864][ T6] usb 5-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 38.684685][ T6] usb 5-1: config 1 interface 0 has no altsetting 0 [ 38.693385][ T6] usb 5-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 38.702725][ T6] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.711235][ T6] usb 5-1: Product: syz [ 38.715513][ T6] usb 5-1: Manufacturer: syz [ 38.720299][ T291] cdc_ncm 6-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 38.727144][ T6] usb 5-1: SerialNumber: syz [ 38.732234][ T291] cdc_ncm 6-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 38.740302][ T291] cdc_ncm 6-1:1.0: setting rx_max = 2048 [ 38.746818][ T1030] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 38.755542][ T1030] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 38.924685][ T291] cdc_ncm 6-1:1.0: setting tx_max = 184 [ 38.953187][ T291] cdc_ncm 6-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.5-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 38.992426][ T291] usb 6-1: USB disconnect, device number 2 [ 39.010717][ T291] cdc_ncm 6-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.5-1, CDC NCM (NO ZLP) [ 39.067880][ T1050] loop3: detected capacity change from 0 to 8192 [ 39.127669][ T1050] netlink: 24 bytes leftover after parsing attributes in process `syz.3.243'. [ 39.213989][ T1069] process 'syz.0.249' launched './file1' with NULL argv: empty string added [ 39.226092][ T1071] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 39.236204][ T1071] tipc: Enabled bearer , priority 10 [ 39.545647][ T1092] loop2: detected capacity change from 0 to 40427 [ 39.563981][ T1092] F2FS-fs (loop2): invalid crc value [ 39.595675][ T1092] F2FS-fs (loop2): Found nat_bits in checkpoint [ 39.658817][ T1092] F2FS-fs (loop2): Start checkpoint disabled! [ 39.667763][ T1124] loop5: detected capacity change from 0 to 2048 [ 39.674834][ T1092] F2FS-fs (loop2): f2fs_disable_checkpoint() finish, err:0 [ 39.700978][ T1092] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 39.727942][ T1117] loop3: detected capacity change from 0 to 40427 [ 39.736545][ T1124] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 39.747640][ T1124] ext4 filesystem being mounted at /22/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 39.750539][ T1117] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 39.763454][ T1092] syz.2.254: attempt to access beyond end of device [ 39.763454][ T1092] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 39.794397][ T669] EXT4-fs (loop5): unmounting filesystem. [ 39.800932][ T1092] syz.2.254: attempt to access beyond end of device [ 39.800932][ T1092] loop2: rw=2049, sector=45104, nr_sectors = 8 limit=40427 [ 39.805466][ T1117] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 39.814903][ T6] rtl8150 5-1:1.0: couldn't reset the device [ 39.829829][ T6] rtl8150: probe of 5-1:1.0 failed with error -5 [ 39.844948][ T6] usb 5-1: USB disconnect, device number 3 [ 39.852009][ T1092] syz.2.254: attempt to access beyond end of device [ 39.852009][ T1092] loop2: rw=2049, sector=45112, nr_sectors = 8 limit=40427 [ 39.870752][ T1117] F2FS-fs (loop3): Found nat_bits in checkpoint [ 39.895177][ T601] kworker/u4:58: attempt to access beyond end of device [ 39.895177][ T601] loop2: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 39.951117][ T1117] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 39.958295][ T1117] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 40.116726][ T1172] loop0: detected capacity change from 0 to 512 [ 40.146192][ T1172] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 40.178217][ T1172] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2802: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 40.273764][ T1172] EXT4-fs (loop0): 1 truncate cleaned up [ 40.316106][ T1172] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 40.408893][ T286] EXT4-fs (loop0): unmounting filesystem. [ 40.440767][ T1197] EXT4-fs (loop2): mounting ext2 file system using the ext4 subsystem [ 40.475517][ T1197] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 40.491024][ T1197] ext2 filesystem being mounted at /52/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 40.524533][ T290] EXT4-fs (loop2): unmounting filesystem. [ 40.624409][ T1237] exFAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 40.636244][ T1237] exFAT-fs (loop4): Medium has reported failures. Some data may be lost. [ 40.653927][ T1237] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 40.720883][ T291] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 41.083110][ T291] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 41.188277][ T291] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 41.204124][ T291] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 41.230344][ T291] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 41.250333][ T291] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.278488][ T291] usb 1-1: config 0 descriptor?? [ 42.570781][ C1] sched: RT throttling activated [ 42.594002][ T28] kauditd_printk_skb: 37 callbacks suppressed [ 42.594018][ T28] audit: type=1400 audit(1791202838.811:282): avc: denied { read } for pid=1247 comm="syz.3.290" name="rtc0" dev="devtmpfs" ino=263 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 42.630099][ T28] audit: type=1400 audit(1791202838.841:283): avc: denied { ioctl } for pid=1247 comm="syz.3.290" path="/dev/rtc0" dev="devtmpfs" ino=263 ioctlcmd=0x7014 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 42.727995][ T28] audit: type=1400 audit(1791202838.921:284): avc: denied { write } for pid=1249 comm="syz.5.291" name="control" dev="devtmpfs" ino=266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 42.758174][ T1259] ================================================================== [ 42.766507][ T1259] BUG: KASAN: use-after-free in sk_skb_adjust_room+0x34e/0x610 [ 42.774259][ T1259] Read of size 8 at addr ffff888121164548 by task syz.3.295/1259 [ 42.781973][ T1259] [ 42.784296][ T1259] CPU: 0 PID: 1259 Comm: syz.3.295 Not tainted syzkaller #0 [ 42.791780][ T1259] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 42.801921][ T1259] Call Trace: [ 42.805203][ T1259] [ 42.808315][ T1259] __dump_stack+0x21/0x24 [ 42.812788][ T1259] dump_stack_lvl+0x110/0x170 [ 42.817479][ T1259] ? __cfi_dump_stack_lvl+0x8/0x8 [ 42.822506][ T1259] ? pskb_expand_head+0x436/0x12b0 [ 42.827802][ T1259] ? sk_skb_adjust_room+0x34e/0x610 [ 42.833276][ T1259] print_address_description+0x71/0x200 [ 42.838928][ T1259] print_report+0x4a/0x60 [ 42.843255][ T1259] kasan_report+0x122/0x150 [ 42.847759][ T1259] ? sk_skb_adjust_room+0x34e/0x610 [ 42.853056][ T1259] __asan_report_load8_noabort+0x14/0x20 [ 42.858698][ T1259] sk_skb_adjust_room+0x34e/0x610 [ 42.863822][ T1259] bpf_prog_e15ab8bd9cea3c06+0x19/0x20 [ 42.869307][ T1259] sk_psock_verdict_recv+0x1c8/0x7b0 [ 42.875653][ T1259] ? skb_recv_datagram+0x140/0x180 [ 42.880966][ T1259] unix_stream_read_skb+0x12e/0x2f0 [ 42.886181][ T1259] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 42.892378][ T1259] ? __cfi_sk_psock_verdict_recv+0x10/0x10 [ 42.898230][ T1259] ? __cfi_unix_stream_read_skb+0x10/0x10 [ 42.903965][ T1259] ? __kasan_check_write+0x14/0x20 [ 42.909099][ T1259] ? _raw_spin_lock+0x94/0xf0 [ 42.911065][ T1250] device-mapper: ioctl: Invalid ioctl structure: name c, dev fc00 [ 42.913784][ T1259] ? _raw_spin_unlock_irqrestore+0x5a/0x80 [ 42.927938][ T1259] sk_psock_verdict_data_ready+0xaf/0x1d0 [ 42.934069][ T1259] unix_stream_sendmsg+0x631/0xa80 [ 42.939232][ T1259] ? __cfi_unix_stream_sendmsg+0x10/0x10 [ 42.945778][ T1259] ? security_socket_sendmsg+0x93/0xb0 [ 42.954167][ T1259] __sys_sendto+0x4ac/0x660 [ 42.960550][ T1259] ? __cfi___sys_sendto+0x10/0x10 [ 42.964083][ T1264] set_capacity_and_notify: 2 callbacks suppressed [ 42.964099][ T1264] loop2: detected capacity change from 0 to 256 [ 42.966465][ T1259] ? __this_cpu_preempt_check+0x13/0x20 [ 42.973935][ T28] audit: type=1400 audit(1791202839.181:285): avc: denied { getopt } for pid=1263 comm="syz.2.296" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 42.980252][ T1259] ? xfd_validate_state+0x70/0x150 [ 42.989658][ T1264] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d) [ 43.009653][ T1259] ? __kasan_check_write+0x14/0x20 [ 43.009691][ T1259] __x64_sys_sendto+0xe5/0x100 [ 43.009718][ T1259] x64_sys_call+0x83/0x9a0 [ 43.009739][ T1259] do_syscall_64+0x4c/0xa0 [ 43.047008][ T1259] ? clear_bhb_loop+0x30/0x80 [ 43.051754][ T1259] ? clear_bhb_loop+0x30/0x80 [ 43.056645][ T1259] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 43.062721][ T1259] RIP: 0033:0x7f896179e199 [ 43.067571][ T1259] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 43.088053][ T1259] RSP: 002b:00007f8962635028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 43.097185][ T1259] RAX: ffffffffffffffda RBX: 00007f8961a25fa0 RCX: 00007f896179e199 [ 43.105958][ T1259] RDX: 0000000000000001 RSI: 0000200000000800 RDI: 0000000000000004 [ 43.114502][ T1259] RBP: 00007f89618350b8 R08: 0000000000000000 R09: 0000000000000000 [ 43.123133][ T1259] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 43.132535][ T1259] R13: 00007f8961a26038 R14: 00007f8961a25fa0 R15: 00007fffbc6701d8 [ 43.141400][ T1259] [ 43.144541][ T1259] [ 43.147039][ T1259] Allocated by task 809: [ 43.151279][ T1259] kasan_set_track+0x4b/0x70 [ 43.156363][ T1259] kasan_save_alloc_info+0x1f/0x30 [ 43.161597][ T1259] __kasan_slab_alloc+0x72/0x80 [ 43.166483][ T1259] slab_post_alloc_hook+0x4f/0x2d0 [ 43.172228][ T1259] kmem_cache_alloc+0x166/0x320 [ 43.177541][ T1259] sk_prot_alloc+0x5f/0x320 [ 43.182429][ T1259] sk_alloc+0x3b/0x460 [ 43.186959][ T1259] unix_create1+0xb8/0x710 [ 43.191564][ T1259] unix_create+0x149/0x200 [ 43.196157][ T1259] __sock_create+0x39e/0x7c0 [ 43.200757][ T1259] __sys_socketpair+0x218/0x5b0 [ 43.205730][ T1259] __x64_sys_socketpair+0x9b/0xb0 [ 43.211201][ T1259] x64_sys_call+0x6e/0x9a0 [ 43.216416][ T1259] do_syscall_64+0x4c/0xa0 [ 43.222008][ T1259] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 43.228099][ T1259] [ 43.231063][ T1259] Freed by task 810: [ 43.235979][ T1259] kasan_set_track+0x4b/0x70 [ 43.241905][ T1259] kasan_save_free_info+0x2b/0x40 [ 43.247325][ T1259] ____kasan_slab_free+0x132/0x180 [ 43.252883][ T1259] __kasan_slab_free+0x11/0x20 [ 43.258044][ T1259] slab_free_freelist_hook+0xc2/0x190 [ 43.263435][ T1259] kmem_cache_free+0x12d/0x300 [ 43.268311][ T1259] __sk_destruct+0x4b4/0x5e0 [ 43.273411][ T1259] __sk_free+0x30a/0x400 [ 43.279168][ T1259] sk_free+0x54/0x90 [ 43.283150][ T1259] unix_release_sock+0xb6d/0xe60 [ 43.288716][ T1259] unix_release+0x9d/0xd0 [ 43.294141][ T1259] sock_close+0xc9/0x220 [ 43.299350][ T1259] __fput+0x1fd/0x8f0 [ 43.303991][ T1259] ____fput+0x15/0x20 [ 43.308080][ T1259] task_work_run+0x1e1/0x250 [ 43.312970][ T1259] exit_to_user_mode_loop+0x9b/0xb0 [ 43.319065][ T1259] exit_to_user_mode_prepare+0x87/0xd0 [ 43.324971][ T1259] syscall_exit_to_user_mode+0x1a/0x30 [ 43.330560][ T1259] do_syscall_64+0x58/0xa0 [ 43.335008][ T1259] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 43.341092][ T1259] [ 43.343526][ T1259] The buggy address belongs to the object at ffff888121164500 [ 43.343526][ T1259] which belongs to the cache UNIX-STREAM of size 1152 [ 43.359040][ T1259] The buggy address is located 72 bytes inside of [ 43.359040][ T1259] 1152-byte region [ffff888121164500, ffff888121164980) [ 43.374085][ T1259] [ 43.376507][ T1259] The buggy address belongs to the physical page: [ 43.384229][ T1259] page:ffffea0004845900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x121164 [ 43.394571][ T1259] head:ffffea0004845900 order:2 compound_mapcount:0 compound_pincount:0 [ 43.402904][ T1259] flags: 0x4000000000010200(slab|head|zone=1) [ 43.408977][ T1259] raw: 4000000000010200 0000000000000000 dead000000000122 ffff88810020cf00 [ 43.417746][ T1259] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 43.426334][ T1259] page dumped because: kasan: bad access detected [ 43.432746][ T1259] page_owner tracks the page as allocated [ 43.438468][ T1259] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 277, tgid 277 (sshd-session), ts 20700596976, free_ts 0 [ 43.458872][ T1259] post_alloc_hook+0x1f5/0x210 [ 43.463645][ T1259] prep_new_page+0x1c/0x110 [ 43.468154][ T1259] get_page_from_freelist+0x2ca9/0x2d20 [ 43.473869][ T1259] __alloc_pages+0x1fa/0x610 [ 43.478457][ T1259] alloc_slab_page+0x6e/0xf0 [ 43.483126][ T1259] new_slab+0x98/0x3e0 [ 43.487181][ T1259] ___slab_alloc+0x70f/0xb70 [ 43.491861][ T1259] __slab_alloc+0x5e/0xa0 [ 43.496183][ T1259] kmem_cache_alloc+0x1a8/0x320 [ 43.501129][ T1259] sk_prot_alloc+0x5f/0x320 [ 43.505723][ T1259] sk_alloc+0x3b/0x460 [ 43.509782][ T1259] unix_create1+0xb8/0x710 [ 43.514310][ T1259] unix_stream_connect+0x1cd/0xda0 [ 43.519520][ T1259] __sys_connect+0x3da/0x460 [ 43.524106][ T1259] __x64_sys_connect+0x7a/0x90 [ 43.528955][ T1259] x64_sys_call+0x88d/0x9a0 [ 43.533486][ T1259] page_owner free stack trace missing [ 43.538851][ T1259] [ 43.541714][ T1259] Memory state around the buggy address: [ 43.548059][ T1259] ffff888121164400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 43.556803][ T1259] ffff888121164480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.565256][ T1259] >ffff888121164500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.574109][ T1259] ^ [ 43.580645][ T1259] ffff888121164580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.588720][ T1259] ffff888121164600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.596861][ T1259] ================================================================== [ 43.605893][ T1259] Disabling lock debugging due to kernel taint [ 43.609500][ T28] audit: type=1400 audit(1791202839.831:286): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 43.635995][ T291] usbhid 1-1:0.0: can't add hid device: -71 [ 43.642508][ T291] usbhid: probe of 1-1:0.0 failed with error -71 [ 43.654466][ T291] usb 1-1: USB disconnect, device number 5 [ 43.680660][ T28] audit: type=1400 audit(1791202839.831:287): avc: denied { search } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 43.702829][ T28] audit: type=1400 audit(1791202839.831:288): avc: denied { write } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 43.724797][ T28] audit: type=1400 audit(1791202839.831:289): avc: denied { add_name } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 43.745566][ T28] audit: type=1400 audit(1791202839.831:290): avc: denied { create } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 43.767019][ T28] audit: type=1400 audit(1791202839.831:291): avc: denied { append open } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1