last executing test programs: 22.012458085s ago: executing program 3 (id=498): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000400)={r1, 0x3, 0x6}, 0x10) 21.87263286s ago: executing program 3 (id=499): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) open(&(0x7f0000000140)='./file1\x00', 0x60142, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[], 0x64}}, 0x10000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x40, 0x2c, 0xf3f, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff3}, {0x7, 0xfff3}, {0xb, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x10, 0x2, [@TCA_BASIC_EMATCHES={0xc, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8}]}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000001100000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000ae3030000000000000000050000000900010073797a30000000000800024000000001140000001100010000c35491a3dc720000000000"], 0x50}, 0x1, 0x0, 0x0, 0x4c841}, 0x802) socket(0x10, 0x803, 0x0) read$FUSE(r1, &(0x7f0000000200)={0x2020, 0x0, 0x0}, 0x2020) r5 = open(&(0x7f00000000c0)='./file1\x00', 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000002300)={0x50, 0x0, r4, {0x7, 0x9, 0x0, 0x1030002, 0x0, 0x0, 0x2}}, 0x50) read$FUSE(r1, &(0x7f00000065c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r1, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r6}, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000004400), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000004440)={'wlan0\x00'}) write(r7, &(0x7f0000000000)="300000001c00010401000000000000002d000000010000008000000105000100280000000a0002000000000000000000300000001c00010401000000000000002d000000010000008000000105000100280000000a0002000000000000000000300000001d00010401000000000000002d000000010000008000000105000100280000000a0002000000000000000000", 0x90) dup3(0xffffffffffffffff, r1, 0x0) close(0x3) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x103042, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) io_submit(r8, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r5, 0x0, 0x0, 0x0, 0x0, 0x2}]) r9 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r0, &(0x7f0000000040)={0x80000010}) 20.792790171s ago: executing program 3 (id=507): setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000a40)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2f, &(0x7f0000000b80)={0x0, {{0xa, 0x4e24, 0x6589e3, @mcast1, 0x8}}, {{0xa, 0x4621, 0x4, @dev={0xfe, 0x80, '\x00', 0x24}, 0x5}}}, 0x108) preadv(0xffffffffffffffff, &(0x7f0000000e00)=[{&(0x7f0000000e40)=""/128, 0x80}], 0x1, 0x5b, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000880), 0x7, 0x0) ioctl$MON_IOCX_MFETCH(r0, 0xc0109207, &(0x7f00000008c0)={0x0, 0x0, 0xfffffffd}) ioctl$MON_IOCH_MFLUSH(r0, 0x9208, 0x8) syz_open_dev$usbfs(&(0x7f0000000900), 0x75, 0x109301) openat(0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0x101042, 0x15) socket$nl_route(0x10, 0x3, 0x0) 20.626411698s ago: executing program 3 (id=509): r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x3c1, 0x3, 0x470, 0x0, 0x268, 0x33a, 0x268, 0x268, 0x3a0, 0x460, 0x460, 0x3a0, 0x460, 0xc, 0x0, {[{{@uncond, 0x0, 0x220, 0x268, 0xd8000000, {0x9402}, [@common=@inet=@hashlimit2={{0x150}, {'pimreg\x00', {0x2000000000, 0x8, 0x0, 0x1, 0x10000000, 0x5, 0xd}}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@rand_addr=0x64010102, 'dvmrp1\x00', {0xfffffffffffff000}}}}, {{@uncond, 0x0, 0xd0, 0x138, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00', 0x2}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4d0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000a00)=@security={'security\x00', 0xe, 0x4, 0x3c8, 0xffffffff, 0x208, 0xd0, 0xd0, 0xffffffff, 0xffffffff, 0x2f8, 0x2f8, 0x2f8, 0xffffffff, 0x4, &(0x7f0000000000), {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0xc, 0x6d, 0x45}}}, {{@ipv6={@mcast1, @remote, [0x0, 0xff000000, 0xffffff00, 0xffffff00], [0xff, 0xffffff00, 0xff000000, 0xff000000], 'team_slave_1\x00', 'vcan0\x00', {0xff}, {}, 0x8, 0xa0, 0x0, 0x4c}, 0x0, 0x100, 0x138, 0x0, {}, [@common=@ah={{0x30}, {[0x4d2, 0x4d3], 0x40, 0xb1, 0x2}}, @common=@eui64={{0x28}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x4, 0x6, 0x1}, {0x4, 0x0, 0x1}, {0x2, 0x1, 0x2}, 0x4, 0x1}}}, {{@ipv6={@empty, @remote, [0xff, 0xff, 0xffff7f, 0xffffff00], [0xffffff00, 0xff000000, 0xffffffff, 0xffffffff], 'macsec0\x00', 'pim6reg1\x00', {}, {0xff}, 0xd9, 0x7, 0x4, 0x8}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@loopback, 'veth1_virt_wifi\x00', {0x7}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x428) rseq(&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) unshare(0x40400) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f00000003c0)=0x80000004, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./trace\x00', &(0x7f0000000480)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./trace/set_event\x00', 0x2, 0x0) writev(r1, &(0x7f0000000e40)=[{&(0x7f0000000e80)='\v', 0x1}, {&(0x7f0000000ec0)="269f", 0x2}], 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x3, 0x38) setsockopt$inet6_int(r2, 0x29, 0x7, &(0x7f0000000300)=0xefbe, 0x4) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) wait4(r3, 0x0, 0x20000000, 0x0) ptrace$peeksig(0x1a, r3, 0x0, &(0x7f0000000300)) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) r4 = openat(r1, &(0x7f0000000200)='./proc/irq/default_smp_affinity\x00', 0x50b541, 0x88) write(r4, &(0x7f0000000240)='2', 0x1) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/asound/seq/clients\x00', 0x0, 0x0) madvise(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x13) lseek(r5, 0x9, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='fd/3\x00') pipe2$9p(&(0x7f0000000080), 0x800) 20.337180758s ago: executing program 3 (id=512): r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x180, 0x0) ioctl$PTP_EXTTS_REQUEST(r0, 0x40103d02, 0x0) 19.74076211s ago: executing program 3 (id=517): syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x8052, &(0x7f0000000600)={[{@noauto_da_alloc}, {@init_itable_val={'init_itable', 0x3d, 0x4004}}, {@barrier_val={'barrier', 0x3d, 0x5}}]}, 0x43, 0x4f7, &(0x7f0000000b00)="$eJzs3U9sFNUfAPDvbP/z50d//PihIGoRjY3EFgoKBxOD0cSDJkZM1GPTFoIUatqSCEGzJAaPhsS78ejVg1f1QownE694NDEkxHABTIxrZndmu7vdLXTZdsF+Psl235vZmffevnmzb97bnQawYY2kf5JK+FpEbIuIQuMLRipPt29enLpz8+JUFEul438k5c1upfFMtpvYnEVGCxGFT5OlFTUWzl84PTk7OzOfxccXz3w4vnD+wvOnBrMlR48ePnTwyIsTL6y+UE3SS8t1a/cnc3t2vf7+lTenevPleWq15eiUkRhplpWyZzqdWJdtrQknvV3MCKuSHv9pdfWV2/+26ImVKq+4jjkD1lqpVCoNtF5dLDW6tGwJ8NBKots5ALoj/6BPr3/zR7OOQP/adD+67saxygVQWu7b2SPiyfLCfBykr+H6tpNGIuK94p9fpo9Yo3EIAIBa3x/Le4IN/b/hyszIX+euvpw+/yebQxmOiP9GxPaI+F9E7IiI/0fEzoh4JCIebdh/T0SUVki/cbS5mn51EqpwvUNFbSrt/72UzW0t9f/qMjDck8W2RuQd5pkD2XsyGn0DJ07NzhxcIY0fXv3l81bravt/6SNNP+8LZvm43tswQDc9uTjZdoEb3LgUsbu3sfxJb0RSrZskInZFxO5V7He4Jnzqua/3VCN99a+7e/nLSk3n0Towz1T6KuLZSv0Xo67+l1JM6uYnz0yenDk5c3aiOj85PhizMwfG06PgQNM0fvr58lut0r9r+b/9rXGT1458dzxrWfcvrf9NkRRrj/3N1VKXDScRSXW+dmH1aVz+9bOW1zTtHv/9yTvlcH5d+tHk4uL8wYj+5I3lyyeWts3j6XMUK+Uf3de8/W/PtknficciIj2IH4+IJ6JyhZjmfW9EPBUR+1Yo/4+vPP1B++VfW2n5pxvOf5War6v/ynx9f8zMLx0I9YEkmxusLBmqXdVzeu+1Oy1OHvdW/4fLodFsyfLzX5rDpO4UsTyDlUD+aZcu+bsj7yAAAAA8+AoRsaVmLGlLFApjY5UxoB2xqTA7t7C4/8TcubPT6bqI4egr5CNdlfHgviQf/xyuiU80xA9l48Zf9AyV42NTc7PTXS05sLnc5pPCWMS7PTXtP/V7Z4aYgQeZ32vBxrVS+0878TuvrGNmgHV175//Vz9e04wA666m/bf6hX+xje99AQ8B1//A0tfz736jH+cMePiVtGXY0FbV/ve7CSD8m/TG29Vwoas5Adab/j9sSK1+zt+ZQGmg+arBWP7iGFx5hz3RXjaGmqTVlUDas+pK6kPtbJXfTaHla6Kwuh0ORGfq9MR9vhvF+YWTOzt+8Jey78q3t3m0vGPFN+vSTpsFas8SI63+jQUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAD758AAAD//y283iw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x101042, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) readahead(r0, 0x2, 0x40) pwrite64(r0, &(0x7f0000000000)='E', 0x1, 0x4fed3) 19.457186169s ago: executing program 32 (id=517): syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x8052, &(0x7f0000000600)={[{@noauto_da_alloc}, {@init_itable_val={'init_itable', 0x3d, 0x4004}}, {@barrier_val={'barrier', 0x3d, 0x5}}]}, 0x43, 0x4f7, &(0x7f0000000b00)="$eJzs3U9sFNUfAPDvbP/z50d//PihIGoRjY3EFgoKBxOD0cSDJkZM1GPTFoIUatqSCEGzJAaPhsS78ejVg1f1QownE694NDEkxHABTIxrZndmu7vdLXTZdsF+Psl235vZmffevnmzb97bnQawYY2kf5JK+FpEbIuIQuMLRipPt29enLpz8+JUFEul438k5c1upfFMtpvYnEVGCxGFT5OlFTUWzl84PTk7OzOfxccXz3w4vnD+wvOnBrMlR48ePnTwyIsTL6y+UE3SS8t1a/cnc3t2vf7+lTenevPleWq15eiUkRhplpWyZzqdWJdtrQknvV3MCKuSHv9pdfWV2/+26ImVKq+4jjkD1lqpVCoNtF5dLDW6tGwJ8NBKots5ALoj/6BPr3/zR7OOQP/adD+67saxygVQWu7b2SPiyfLCfBykr+H6tpNGIuK94p9fpo9Yo3EIAIBa3x/Le4IN/b/hyszIX+euvpw+/yebQxmOiP9GxPaI+F9E7IiI/0fEzoh4JCIebdh/T0SUVki/cbS5mn51EqpwvUNFbSrt/72UzW0t9f/qMjDck8W2RuQd5pkD2XsyGn0DJ07NzhxcIY0fXv3l81bravt/6SNNP+8LZvm43tswQDc9uTjZdoEb3LgUsbu3sfxJb0RSrZskInZFxO5V7He4Jnzqua/3VCN99a+7e/nLSk3n0Towz1T6KuLZSv0Xo67+l1JM6uYnz0yenDk5c3aiOj85PhizMwfG06PgQNM0fvr58lut0r9r+b/9rXGT1458dzxrWfcvrf9NkRRrj/3N1VKXDScRSXW+dmH1aVz+9bOW1zTtHv/9yTvlcH5d+tHk4uL8wYj+5I3lyyeWts3j6XMUK+Uf3de8/W/PtknficciIj2IH4+IJ6JyhZjmfW9EPBUR+1Yo/4+vPP1B++VfW2n5pxvOf5War6v/ynx9f8zMLx0I9YEkmxusLBmqXdVzeu+1Oy1OHvdW/4fLodFsyfLzX5rDpO4UsTyDlUD+aZcu+bsj7yAAAAA8+AoRsaVmLGlLFApjY5UxoB2xqTA7t7C4/8TcubPT6bqI4egr5CNdlfHgviQf/xyuiU80xA9l48Zf9AyV42NTc7PTXS05sLnc5pPCWMS7PTXtP/V7Z4aYgQeZ32vBxrVS+0878TuvrGNmgHV175//Vz9e04wA666m/bf6hX+xje99AQ8B1//A0tfz736jH+cMePiVtGXY0FbV/ve7CSD8m/TG29Vwoas5Adab/j9sSK1+zt+ZQGmg+arBWP7iGFx5hz3RXjaGmqTVlUDas+pK6kPtbJXfTaHla6Kwuh0ORGfq9MR9vhvF+YWTOzt+8Jey78q3t3m0vGPFN+vSTpsFas8SI63+jQUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAD758AAAD//y283iw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x101042, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) readahead(r0, 0x2, 0x40) pwrite64(r0, &(0x7f0000000000)='E', 0x1, 0x4fed3) 10.35682118s ago: executing program 4 (id=540): setreuid(0xffffffffffffffff, 0xee01) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, 0x0, 0x0) socket(0x28, 0x5, 0x0) r0 = socket(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = gettid() timer_create(0x0, &(0x7f00000008c0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000000900)) timer_settime(0x0, 0x1, &(0x7f0000000940)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f0000000980)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0xf3a, 0x0) write$cgroup_pid(r3, &(0x7f00000009c0), 0xffffff98) close_range(r0, r3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000040), 0xa600, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x0) r8 = fcntl$dupfd(r7, 0x0, r6) ioctl$KVM_CAP_SPLIT_IRQCHIP(r8, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x400000000530}) ioctl$KVM_SET_GSI_ROUTING(r5, 0x4008ae6a, &(0x7f0000000140)={0x1, 0x0, [{0x4, 0x4, 0x0, 0x0, @irqchip={0xdb35, 0x1005}}]}) r9 = syz_open_dev$sndpcmc(0x0, 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r9, 0xc2604111, &(0x7f0000000480)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0x1, 0x1, 0xfffffffc, 0xffffffff, 0xffffffff], [0xffffffff, 0x2, 0xfffffffd, 0xa, 0xffffffff, 0x0, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0x83, 0xffffffff, 0xffffffff, 0xffffffff, 0x3, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0xa, 0x186a0, 0x0, 0x0, 0x1}, {0x103, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x101000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0xffd, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r9, 0xc0884113, 0x0) 9.856810832s ago: executing program 4 (id=543): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000200)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000240)=0x6) socket$vsock_stream(0x28, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) listen(0xffffffffffffffff, 0x5) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f000001a600)={0x0, &(0x7f000001a640)}) close(0xffffffffffffffff) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000340)=@filter={'filter\x00', 0x42, 0x4, 0x388, 0xffffffff, 0xf8, 0x1f0, 0xf8, 0xffffffff, 0xffffffff, 0x2f0, 0x2f0, 0x2f0, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @loopback, 0xff000000, 0xff000000, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11}, 0x0, 0xd0, 0xf8, 0x0, {0x100000000000000}, [@common=@inet=@udp={{0x30}, {[0x4e24, 0x4e21], [0x4e24, 0x4e27]}}, @common=@unspec=@connmark={{0x30}, {0x5}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x98, 0xf8, 0x0, {}, [@common=@unspec=@state={{0x28}, {0x7}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0x2, 0x3, 0x6, 0x1, 0x4], 0x2, 0x3}, {0x3, [0x6, 0x2, 0x1, 0x2, 0x0, 0x5], 0x6, 0x2}}}}, {{@uncond, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x0, 0x2, 0x1, 0x6, 0x5, 0x2], 0x1, 0x4}}}, @common=@inet=@socket2={{0x28}, 0x1}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff}, {0xffffffffffffffff, 0x1, 0x5}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3e8) 9.027539277s ago: executing program 4 (id=544): r0 = socket(0x10, 0x3, 0x0) sendto$inet6(r0, &(0x7f0000000100)="7800000018002507b9409b14ffff00000204be04020506050e020409430009003f000c00100000000d0085a168d0bf46d32345653600648d0a00120002080a0000005ade4a460c89b6ec0cff3959547f509058ba86c902000000004a32000400160005000a0000000000e000e218d1ddf66ed538f2523250", 0x78, 0x0, 0x0, 0x0) 8.912403319s ago: executing program 2 (id=545): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1b7) mount(&(0x7f0000000200)=@filename='./dev/sda1\x00', &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='ext4\x00', 0x8410, 0x0) r0 = open$dir(&(0x7f00000002c0)='./mnt\x00', 0x0, 0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) ioctl$XFS_IOC_GOINGDOWN(r0, 0x8004587d, &(0x7f0000000300)) umount2(0x0, 0x0) 8.652905336s ago: executing program 0 (id=546): unshare(0x22020400) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000180), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000bc0)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, 0x0) 8.268763076s ago: executing program 2 (id=548): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x200000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='0fc5:1227:bnc', 0xd) 8.03291589s ago: executing program 0 (id=549): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt(r0, 0x3a, 0x1, 0x0, &(0x7f0000000000)) 6.734064044s ago: executing program 2 (id=550): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) socket(0x11, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xa002, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r0 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000007c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r1, r0, &(0x7f0000000800)=0x64, 0x12) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000840)='/proc/cpuinfo\x00', 0x0, 0x0) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000880)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) sendfile(r3, r2, 0x0, 0x23b) write$rfkill(0xffffffffffffffff, 0x0, 0x0) r4 = socket(0x1e, 0x1, 0x0) connect$tipc(r4, &(0x7f0000000000)=@id, 0x10) r5 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(0xffffffffffffffff, &(0x7f00000000c0), 0x10) sendmsg$can_bcm(r5, &(0x7f0000000140)={&(0x7f00000002c0), 0x10, &(0x7f0000000400)={&(0x7f00000008c0)=ANY=[@ANYBLOB="0400000015060000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="020000a001000000000000ae3e47ef9f07fc6fd5cf0007030000e570e1817499ac76d51e11906c7782a0"], 0x48}}, 0x40010) recvmmsg(r4, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000580)=""/133, 0x85}], 0x1, &(0x7f0000000640)=""/146, 0x92}, 0x4}], 0x1, 0x0, 0x0) r6 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000500)={0x0, 0x30b5, 0x0, 0x2, 0x377}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x6, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff}}}, &(0x7f0000000480)=0x0) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) r12 = dup(r11) syz_ublk_setup_queues(r12, r10, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0xfffffffd, 0x32c}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x20, 0x1006, 0x15a, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ac7, 0x8000, 0x10000003, 0x546}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x8, 0x3, 0xfffffffc}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0x3, 0x826, 0x0, 0x0}}, 0x0) 6.57911172s ago: executing program 0 (id=551): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x20, 0x3, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000540)={r0, 0x0, 0x22, 0x0, &(0x7f00000005c0)="f6f4e9a1d78ad62ceef1884386dd78bb3fb7dbfc8180ca8395ccfda2e499b3dcf581", 0x0, 0xa1b, 0x0, 0x2f, 0x0, &(0x7f0000000600)="010a", 0x0}, 0x50) 6.085003251s ago: executing program 0 (id=553): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000200)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000240)=0x6) socket$vsock_stream(0x28, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) listen(0xffffffffffffffff, 0x5) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f000001a600)={0x0, &(0x7f000001a640)}) close(0xffffffffffffffff) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000340)=@filter={'filter\x00', 0x42, 0x4, 0x388, 0xffffffff, 0xf8, 0x1f0, 0xf8, 0xffffffff, 0xffffffff, 0x2f0, 0x2f0, 0x2f0, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @loopback, 0xff000000, 0xff000000, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11}, 0x0, 0xd0, 0xf8, 0x0, {0x100000000000000}, [@common=@inet=@udp={{0x30}, {[0x4e24, 0x4e21], [0x4e24, 0x4e27]}}, @common=@unspec=@connmark={{0x30}, {0x5}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x98, 0xf8, 0x0, {}, [@common=@unspec=@state={{0x28}, {0x7}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0x2, 0x3, 0x6, 0x1, 0x4], 0x2, 0x3}, {0x3, [0x6, 0x2, 0x1, 0x2, 0x0, 0x5], 0x6, 0x2}}}}, {{@uncond, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x0, 0x2, 0x1, 0x6, 0x5, 0x2], 0x1, 0x4}}}, @common=@inet=@socket2={{0x28}, 0x1}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff}, {0xffffffffffffffff, 0x1, 0x5}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3e8) 4.948634649s ago: executing program 0 (id=555): r0 = syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x19f, &(0x7f0000000200)={[{@journal_dev={'journal_dev', 0x3d, 0x4}}]}, 0x1, 0x561, &(0x7f0000000280)="$eJzs3c9vHFcdAPDvbLxufji1SzlAJUqBoqSCrOOathaHEiQEp0qIcg/G3lhW1t7IXrexFQnnL0BCCBCc4MIFiT8ACUXiwhEhRYIzSEUgBE45IAEZNLOztuPMbjbJZtc/Ph9pMm/e/Pi+N5sZz5t5mgngxHolIq5ExP00TV+LiMkiv1IMsd0esuXu7dxayIYk0vTdfySRFHmdbSXF+Fyx2umI+MbXIr6dPBx3fXPr+nyjUV8rpqdbKzem1ze3Li2vzC/Vl+qrs7Mzb869NffG3OWB1PN8RLz9lb/84Ls//+rbv/78+3+++reLWbVjopi/vx6PIdtFY70WaFe9mu+LjmyFtScIdliN5TUsnClbIk3T9H46uS/n9lBKBgDAQdkF7Eci4tMR8VpMxqnel7MAAADAEZR+aSL+m7Sf0JQY75IPAAAAHCGVvA9sUqkVfQEmolKp1dp9eD8aZyuN5nrrc9eaG6uLd388ERFTUa1cW27ULxd9haeimmTTM3l6b/r1A9OzEfFCRHx/8kw+XVtoNhZHffMDAAAATohzB9r//5pst/8BAACAY2bq4azKKMoBAAAAPDsl7X8AAADgmNH+BwAAgGPt6++8kw1p5/vXi+9tblxvvndpsb5+vbaysVBbaK7dqFWiuZS/s29l/7qnSrbXaDZvfCFWN25Ot+rrren1za2rK82N1dbV5Qc+gQ0AAAAM0QufvPPHJCK2v3gmHzLjoy4UMBRju6mkGJcc/X96vj3+YEiFAoai7B7+QR88N4SCAEM39kRrpf2cNoBDrjrqAgAjlzxiftfOO78rxp8abHkAAIDBu/Dx7s//e38DYNsnAuCIcxDDyXXgQV46OaqCAEOXP//vt8OviwU4Vqp99QAEjrOnfv7/SGn6WAUCAAAGbiIfkkqtuL03EZVKrRZxPv8sQDW5ttyoX46I5yPiD5PV57LpmXzN5JFtBgAAAAAAAAAAAAAAAAAAAAAAAACgLU2TSHu50nMuAAAAcAREVP6a/Kb9Lv8Lk69OHLw/MJ78O/8k8HhEvP+Td394c77VWpvJ8v+5m9/6UZH/+ijuYAAAAAAHddrpnXY8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzSvZ1bC/d2bqX/2bm1MMy4f/9yREztxs+H9pyxOJ2PT0c1Is5+mMTYvvWSiDg1gPjbtyPiY2Xxk6xYuyHL4p959vFjqtgLZfHPDSA+nGR3svPPlbLjrxKv5OPy428s4oHpJ9X9/Be7579TXY7/833GeOnuL6e7xr8d8dJY+fmnEz/Zi396L3rk+6gf3/rm1la3eelPIy5EefyOLDXdWrkxvb65dWl5ZX6pvlRfnZ2deXPurbk35i5PX1tu1It/S2N87xO/ut+r/me7xJ96uP4PlOnVvmof8b+7N3de7PL3Kot/8TMl8X/7s2KJh+NXim19tkhn8y900tvt9H4v/+L3L/eq/+Je/auP+P0fqP/F3tXe+wEHcaAAAAOzvrl1fb7RqK/1mfgwfYyFB5sorie2H3P1rJVeNuvFYg88fcHGR7E3DkkiORzFeMLEdwa6wTRN0y7/o+5ERD/bSeIw7JY8McKTEgAA8EzsXfSPuiQAAAAAAAAAAAAAAAAAAABwcg3wnWHjpa/ZK3mzwPZuKvFmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg0Ph/AAAA//9kGdln") fspick(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec778000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) syz_mount_image$hfsplus(&(0x7f0000000980), &(0x7f00000009c0)='./file1\x00', 0x4810, &(0x7f0000000a00)=ANY=[], 0x11, 0x693, &(0x7f0000000a40)="$eJzs3c1vHGcdB/DvrNcvm0qO26ZpQJUwjVQQEYkdK4VwSUAIBalCVThwthqnseKkwXFR2gNxAYkrB/6AcggXOIEQEhJSpHKGW8XN4lQJiUtPaQ8MmtlZe+3u2ptXO/TziWaf55ln5pnf/OZlXyJrAnxuXTiR9t10cuHEa7eq9sadhZWNOwvXevUkk0laSbtbpLieFB8k59Od8oVqZjNcMWw7v14+e/HDjzc+6rba2RqveukMD7A9yl6sN1Nmk4w15UPYNt4bDzbe5Fa12MxMlbDjvcTBfhtPUm7z46NbPYOUY32Nodc78PQouu+bfbrX/0xyKMlU7w1tvdvZevIR7um+7kXrjy8OAAAAODAO37ud3Mr0fscBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAT5Pm+f9FM7V69dkUvef/T/Q9Y39in8MdbvfIpnqVu60nEQwAAAAAAAAAPF5fupffXSzL6V67LOr/83+5bhypX5/J27mZpazmZG5lMWtZy2rmk8z0DTRxa3FtbXW+t+anZVkOWfP0wDVPjxhw51HsNQAAAAAAAAD83zjXlD/LhUzvcywAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALBNkYx1i3o60qvPpNVOMpVkolpuPflHr/40u7vfAQAAAMATcPhe7uVWpnvtsqi/8x+tv/dP5e1cz1qWs5aVLOVS/VtA91t/a+POwsrGnYVr1fTZcb/9n636H6f3DKMeMd3fHgZv+Vi9RCeXs1zPOZk38lZWcimtes3KsV48g+N6r4qpONdVlqMl6FJTVnv+q6Y8GGbqjIxvZmSuia3KxrO7Z6L/6DzAlubT2vzl58h95Pzcrlsp/ts7Jod6c5Jnvr93zsfva2ceys5MnO47+47unonkK3/6/Y+urFy/eqVYP3FwTqP7MPmvratmZyYW+jLx4siZuHzz6czETq28sFm/kO/lhzmR2bye1SznJ1nMWpYym+/WtcXmfK5eZ3bP1Pltrdf3imKiOS5jO2L68uFuuVtML9frTmc5P8hbuZSlvFr/O535fCNnciZn+47wCyNc9a0BV/2fhwd//KtNpZPkl015MFR5fbYvr/333Jm6r39OK+Vkd73nHtm9cVP7i02lOhI/b8qDYTMTU9l8l+hF93wvA+MDM/Gb+rZyc+X61dUrizd2jFusD97eK9m++wfnRlKdL89VB6tubT87qr7nB/bN131HNvtaO/t+29ns2+tKnWg+w312pNN134sD+xbqvmN9fVuftz4ty7L7eQuAA+/Q1w5NdP7d+Xvn/c4vOlc6r019Z/Kbky9NZPxv499qz4290nqp+EPez0+z9zd0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgTzffeffq4srK0uqOSlmWt4d0PZZK2sm2OX/9S98ySeqHAY0+YLX0+VZSz2mnqdxfYLcfbHfee9Ak/LM5Jk8k4Y+kMjX0/NlZ+aQsy4MR8yiVsnFQ4tmPyr7eloAn4NTatRunbr7z7teXry2+ufTm0vWzZ86cnTt75tWFU5eXV5bmuq/7HSXwOPR9AgcAAAAAAAAAAACeEqP9cU7xcH/bAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAQLpxI+26KzM+dnKvaG3cWVqqpV99a8pMkrSTFbFJ8kJxPd8pM33DFsO2sJxc//Hjjo26r3Uz18q3d1hvNejNlNslYUw4wNWhmeXvYeEU9zo3h442o2NzDKmHHe4mD/fa/AAAA///tbhq7") r1 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./file1\x00', 0x140, 0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000009, 0x22852, r1, 0xffffc000) 4.794324695s ago: executing program 2 (id=556): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000d80)={0x1, &(0x7f0000000dc0)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) r0 = memfd_create(&(0x7f00000014c0)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x1c\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\x83\x11\v}k+\xeb\xc3\xc0O\xae\xd2\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh#\xcf)\x0f\xc8\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb901nEy\x82\x83\x80\xd3O\x00|hP\x00\x00\x00\x00\x00\x00\x00\x05\x86\xfe\xd9\xa5\xc6\nSy\xa3N\xba-]\'q\xc6\xfb\x02\x9a\xa9Z\xa8\x80Bx\xbd74\xcf\"\xa5\xea$\x95\xfd\x06T\xef\x89\xe4j\x06\xdc\x15\xe7\xc3\xb5H\xf7\xdc\xee\x182\xab\xe2?\"\xbewm\x9d\xd8x\xd92\xeeS/\xd2\xcd[\x9dcO1\xcb\x12lZ$\xa7\x9d\xf8b\xf6}\xc5``\xfe0\x8a\'v-\x99`?\x97\x8c\xdd\xd6\xfa\xa2\x06>\xf3\xe2uI\xe65C\xdb\x84\xe6eU\xe8RK\xd6=s\xcd\x9d\x1f#3\xc5\x16\xd0\xbbD\xc5\xde\xc8/\v\xa5W\xbep\x87\x15\x10\xcdm\xa7\x93\x01\x1c,9V8\xdc\xfd\xb7\xc0\xfc\x04\x00p\xad\x12\xb2\xbf\xfbFZ\x1a\f\x99\x05\xe4\x1eP\xed\x87\x89\xbeo\xfbv\xb6\x8a\xee\xf6Oc8\xaf\x11[\xc3\x98w-\xf0\xb2z\xc7\xaf;\x92\xad4\x1b\x92L\x97<\xbdh\x80\xf2\xc0\xd0n)K\xf2#Ncp\xe4\xb4\xfb\x94\x18\xc2-TWA\x13\xfe\xea\xad\v\xc4\xa5\x02\xf9\xed]\xf4\\\x01\xab\xdc\xb6\xcdP\x93\xf2\xc3\x96\xf2\xc0\xd6-x\xd5\xd6\xc7\x9d\xa5\x1f\xd2t\xd7\x8f}b\x9749\xd4a7\x18\xe0\x91KV7[\xb8\x8dL\xc8\xc8\x8f>sbE\xf5\xa7\xdb|\xb0m\x16c\x84\r\"\xf2\x92s\xeb\xaf\x1c\x00\xf4\x8dL\xa5\x10\x89FB\xfb8\xf9\x9d\xcbm\x1c\x91\xd0fd$5\xdc\xad\xec\xef\x90\xd9\xefX\xd2m\x9e\xec\x94w\xb3\xf9\xd9\x0eu-z\x81\xbb\xa6\xc0\x00\xa1\xd9\xcbI\xda\xa3\b\x9e@\xb8\xc8k\xdeQ/\xb8X\x9c\xff4Np~\xc4\xc1_\x1c#zX\a\xd41\x1c\x7fH\x91\xd9k\x05\x1f\n\b\b\x88\xd6\xcf4i\xa0B\xe7\x9c\x9c\xe6\xcax\xca\xa1E#6\xe9\xf31W\xd0\x1bY3/\x00I#\xfa\xb0\f\xd5!\x9fR[\n\xdb`\xdb\x82M\'k\x16(\xfa\xc2\xec\x96e\\Q\xe9\x19\xe1u\x86\xcb\xc3\xb0\xb8\x19\xb9l\x1fk!R\xb1P\x8b\xda\xffE\x89\x97\n\x17m\xd10\x1a\xe7Qz\xd8\bi\x8dRw+\xa1^N\xaf\x1b\x1dg\x8f$\xbe\x93\x8d\x8b\xfd\r\xee<\x84\x95\x82)TH\xcac9\x98\x13WW@;\xb4\xd5\x0f\xa1\xb3xX(\x80\xe8\x89\xed e.\xe04\xba\x9c=\xc6\x04\f\xbf\x06\xce5\xf99GD8@\xd2\r\xd0\xdf@\xe3\xbe\"qq#]\x86W\tA\xa7\x91\x85\xae\x9c\x8dO\xa6\xa3\xf9i\x83\xc5\xa8C\x164\xef\xa4\\\a\xaa%\x94!3k]\xd5\xbe\'U\xf17', 0x0) r1 = dup(r0) r2 = memfd_create(&(0x7f0000001100)='-B\xd5NI\xc5j\x9appp\xf0\xd0\xe5/w\xd4N\xa6\xa8-\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x01\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh#\xcf)\x0f\xc8\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb90a\xa9\xb2\x04\x1d\xa1\xce\x8b\x19\xea\xef', 0x0) copy_file_range(r2, 0x0, r1, 0x0, 0x7, 0x0) 4.406294345s ago: executing program 2 (id=557): syz_mount_image$ext4(&(0x7f0000000000)='ext2\x00', &(0x7f0000000080)='./file1\x00', 0x0, &(0x7f00000000c0), 0x1, 0x27e, &(0x7f00000003c0)="$eJzs3T1oO2UcB/DfXZJ/34JWBRHFFxARLZS6CSLoolAQKSKCChURJ2mFanFrnFwcdFbp5FLEzeooLsVF6Fq1Q0UQsThYHHSIXC6RmCZaL82l/+TzgfTuubsnv0vJ97mH0lwCmFqLEfFYRFQiYikiahGRdB9wT/5YbDd35w7WI5rNZ35NWsfl7Vyn30JENCLi4YhqZ9/2/gsnvx89ef+7b9bu+3j/+bkSXlqld8PpyfFTZx89/c5nqw9tp+1t9fay+3Vcottv7LOxmkTcPIJiV0VSHfcZcBFrb336bRaSWyLi3lb+a5G2I/ve1rWvavHgh4P6vv/L4R1lnitw+ZrNWnYNbDSBqZO25sBJuhwR+XqaLi/nc/jvKvPpa5tbbyy9ulnZeKV71Chj+g6MSj3i+IkvZj5f6Mn/T5U8/8DkyvL/7Nre99n62bm/lAET6c58keV/6aWdB0L+YerIP0yG+QJ95B8mQr1gJ/mH613B7BbI/60/Hj5arBhwpVww/z+XeU5AOcz/YYLVOiuNvrvlH6bXhfPvX31h4nTy79IP06f7+g8ATJfmzLg/gQyMy7jHHwAAAAAAAAAAAAAAAAAA4LzduYP1ziMiKaXm1x9EnD4eEdXe+tH6YoO0tZxt/Zz/LckO+1uSd2u7Vqj+i3cPc/bD+2T0n76u9rRnuxs3/DDy+v/qm7tG87xv/7M58A6WOxsRjezglWr1/Psvab//irvpP/bXXh6ywP/Um+pHniuj6uDf4p97ZdQfbPUo4sts/FnpN/6kcVtr2X/8qXffYrmg1/8Y8gkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAozV8BAAD///BWbAI=") symlinkat(&(0x7f0000000740)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000880)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xffffff6a) symlink(&(0x7f0000000b00)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000c00)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 3.617450506s ago: executing program 4 (id=558): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000300)={0x1, &(0x7f0000000380)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r0, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x82040, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000180), 0x801, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) syz_usb_connect(0x3, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201020079db8540da0b77010b7d000000010902120004000000000904", @ANYRES32, @ANYRES16=r1], 0x0) 3.48480304s ago: executing program 1 (id=559): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000003c0), 0x163183) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r0, 0x40045402, &(0x7f0000000400)=0x5) ppoll(&(0x7f0000000440)=[{r0, 0x44}, {r0, 0x20}], 0x2, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000480)={{0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f00000004c0)={0x2, 0xffffff3a, 0x0, 0x0, 0xf}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYRES8=r0], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r2, 0x5, 0xe, 0x0, &(0x7f0000000380)="43227504001100b32415f73227b2", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) syz_mount_image$fuse(0x0, &(0x7f0000000200)='./proc\x00', 0x4, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r3, 0x0, 0x0) unshare(0x24040400) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x85, 0x7, 0x7ffc0001}]}) fdatasync(r4) syz_emit_ethernet(0x44, &(0x7f0000001200)={@local, @remote, @void, {@ipv6={0x86dd, @esp={0x8, 0x6, "b5b945", 0xe, 0x32, 0xff, @private2, @dev={0xfe, 0x80, '\x00', 0x13}, {[], {0x4d4, 0x2}}}}}}, 0x0) 3.48469468s ago: executing program 2 (id=560): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da070000000000010902240001000000000904000009030000000921000000012222000905810308"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) 3.044412346s ago: executing program 1 (id=561): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8801}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=@newsa={0x138, 0x1c, 0x1, 0xfdfffffe, 0x100, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x1, 0x717, 0x4e20, 0x5, 0xa, 0x0, 0x20, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@empty, {0x0, 0x1000000000000192, 0x1000000000000192, 0xffff, 0x3, 0x5, 0xfffffffffffffffc}, {0xffffffffffffffff, 0x0, 0x11, 0xfffffffffffffffe}, {0xfffffffe, 0x9}, 0x8070bd2d, 0x3505, 0x2, 0x1, 0x1, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x81}, 0x0) 2.696485192s ago: executing program 1 (id=562): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/kvm/halt_successful_poll\x00', 0x0, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) read(r0, &(0x7f0000000140)=""/100, 0x64) syz_mount_image$erofs(&(0x7f00000002c0), &(0x7f0000000300)='./file1\x00', 0x3008003, &(0x7f0000000340)=ANY=[], 0x2, 0x211, &(0x7f0000000380)="$eJzsmbGL1EAUxr9Jstn1OA5tLGwsPPBEL5tkVa45QcFSEE5Ry8WLx2nuVvYi3C4ILjY2WggWgq2NpYWFlYX/gLZaqCBYuOWChTAyk0kyZpM1q2uj7wc3903emzdvHplXZEEQxH/Lp4+jD/fPrFw4BmAei6ir51/MzMfQ/N8/vnX00erZJ8/fPX29vXD7ZT4eA8B56Xbf8iYbwKvTJiIwK37CORYy+6KWgtK4CANHlL4EBieW37kkngRguKJ8rmu6s0eJMHCudsL1a5th4IrBE4Mvhpaen0hqOGBYB9CQ2XHONPtOr3+jHYZBNy9qPNlnzDStMErLKfIbvRHlWUVSPc6F/+V7dwdirmoDF0ZaPw8GPKVbYFhTegV1OI6TlUQ7/wEri29WOX8VMUDlGp2Sez2oGvmZFPuWZ1D9SiK5I9OsEmX864n9W6I2izgP5/NvnbjQqc/+YdID9VWff2cvYPpVIpefX61fr2pMvoxQ9jHT27kwPPcHxbQLCpWKrH+Kzn5Y608WrLR/NKOtm82dXn95c6u9EWwE277fOuked90TflM2onic0P8asj/NafFrJb42s7HbjqKutwtEXS+d+/GYHQBrLzpfxZK9kP3PwNIhGUJ2LHnsevEeTP0Z8r9QS2ax553SMxEEQRAEQRAEQRAEQRAEQRRzEAzxL2GcqQ+iRfjn5RfKHwEAAP//wutaPw==") r1 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='.\x00', 0x0, 0x0) r2 = getuid() quotactl$Q_QUOTAOFF(0xffffffff80000301, &(0x7f0000000000)=@md={'/dev/md', @named={'_syz', 0x0, '2'}}, r2, 0x0) fadvise64(r1, 0xe0ffff, 0x19, 0x3) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0x2, 0x12, 0xffffffffffffffff, 0x0) socket$key(0xf, 0x3, 0x2) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000015c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x408a0}}, {{&(0x7f0000001640)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x40042}}], 0x2, 0x40) 2.164263747s ago: executing program 1 (id=563): r0 = socket$inet6(0xa, 0x2, 0x3a) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) syz_mount_image$ext4(&(0x7f0000000680)='ext4\x00', &(0x7f0000000240)='./file0\x00', 0x800700, &(0x7f0000000cc0)={[{@grpjquota}, {@inlinecrypt}, {@data_writeback}, {@noinit_itable}, {@init_itable_val={'init_itable', 0x3d, 0x1}}, {@minixdf}, {@data_journal}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x5c}}, {@errors_continue}, {@dioread_lock}, {@resuid={'resuid', 0x3d, r1}}, {@barrier_val={'barrier', 0x3d, 0x8000000000000000}}], [{@fscontext={'fscontext', 0x3d, 'unconfined_u'}}, {@subj_user={'subj_user', 0x3d, ']{*${.['}}, {@subj_role={'subj_role', 0x3d, ',(V'}}, {@euid_eq={'euid', 0x3d, r1}}, {@subj_user={'subj_user', 0x3d, '\x00'}}]}, 0x3, 0x465, &(0x7f0000000f00)="$eJzs3M9vFFUcAPDvzLYgP1sRf4CoVWJs/NHSgsrBi0YTDxhN9IDH2hZCWKihNRFCpBqDFxND1LPxaOJf4M2LUU8mXvVuSIhyAT3VzOwM7C67pYXtLnQ/n2SX92Ze+963b97Mm3m7BNC3RrK3JGJrRPwREUO1bGOBkdo/Vy+fnf738tnpJJaW3v47yctduXx2uixa/tyWIjOaRqSfJkUljeZPnzk+Va3Oniry4wsn3h+fP33muWMnpo7OHp09OXnw4IH9Ey++MPn8Mq3fuOI4s7iu7P5obs+u19+98Mb04Qvv/fJ91t6txf76ODplJAv8n6Vc3eYvs7cnO11Zj22rSycDPWwIq1KJiKy7BvPxPxSVuN55Q/HaJz1tHLCmsmvTMlfRxSVgHUtihcViZQWBu0V5oc/uf8tXl6Yed4RLL9dugLK4rxav2p6BSIsyg033t500EhGHF//7JnvFGj2HAACo9/n014fi2VbzvzQeqCu3vVhDGY6IeyNiR0TcFxE7I+L+iLzsgxHxUNuaNrTc2rw0dOP8J714y8GtQDb/e6lY22qc/5Wzv8pwpchty+MfTI4cq87uK/4mozG4MctPLFPHj6/+/kW7ffXzv+yV1V/OBYt2XBxoekA3M7UwlU9KO+DSxxG7B1rFn1xbCchu/XdFxO7V/ertZeLY09/taVfo5vEvowPrTEvfRjxV6//FaIq/lCy/Pjl+T1Rn942XR8WNfv3t/Fvt6r+t+Dsg6//Njcd/c5HhpH69dn71dZz/87O29zS3evxvSN7J+6U8q3w4tbBwaiJiQ3Iozzdsn7z+s2W+LJ/FP7q39fjfUUtsyt4ejojsIH4kIh6NiMeKtj8eEU9ExN5l4v/5lfb77oT+n2l5/rt2/Df1/+oTleM//dCu/pX1/4E8NVpsyc9/N7HSBt7O3w4AAADuFmn+GfgkHbuWTtOxsdpn+HfG5rQ6N7/wzJG5D07O1D4rPxyDafmka6jueehEslj8xlp+snhWXO7fXzw3/qqyKc+PTc9VZ3ocO/S7LW3Gf+avSq9bB6y5Vutoky3Xaxu+yAasA83jP23Mnnuzm40Busr3taF/3WT8p91qB9B9rv/Qv1qN/3NNeWsBsD65/kP/Mv6hfxn/0L+Mf+hLt/O9/n5OZKfMO6AZ1aGiH7tfe6S9jl1iLRKt/58mAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAu9X/AQAA//9l+OT1") 1.83831289s ago: executing program 1 (id=564): signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x800000000003ff]}, 0x8, 0x800) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x37) r0 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9, 0x80}, 0x50) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000001c0)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r2, &(0x7f0000002380)=""/102392, 0x18ff8) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0xa, &(0x7f000001b3c0)=0xce, 0x4) connect$inet(r0, &(0x7f000001b400)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f000001b440)=0x7e6, 0x4) sendmsg$inet(r0, &(0x7f000001b480)={0x0, 0x0, &(0x7f000001b4c0)=[{&(0x7f000001b500)=' ', 0x1}], 0x1}, 0x0) setgroups(0x0, 0x0) getgroups(0x1, &(0x7f00000000c0)=[0xee00]) setregid(r3, r3) r4 = fsopen(&(0x7f0000000100)='configfs\x00', 0x1) setgroups(0x1, &(0x7f0000000240)=[0x0]) unshare(0xc040480) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1c0000000400000008000000000000000100"/48, @ANYRES32=r5, @ANYBLOB="0100000002"], 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r6}, &(0x7f00000003c0), &(0x7f0000000400), 0x100000000000000}, 0x20) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) fsmount(r4, 0x0, 0x0) 962.514011ms ago: executing program 1 (id=565): r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000280), 0x84, 0x0) ioctl$PTP_PEROUT_REQUEST(r0, 0x40383d03, 0x0) 911.391266ms ago: executing program 4 (id=566): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) rseq(0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) bind$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e21, 0x5, @ipv4={'\x00', '\xff\xff', @empty}, 0x7}, 0x1c) connect$inet6(r4, &(0x7f0000000280)={0xa, 0x4e21, 0x10659, @empty, 0xff}, 0x1c) r5 = fcntl$dupfd(r4, 0x406, r4) write$cgroup_pid(r5, &(0x7f00000002c0), 0xb375) recvmsg(r5, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x103) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000) socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000180)={'veth0_to_team\x00', &(0x7f0000000200)=@ethtool_cmd={0x2c, 0x4, 0x4, 0x0, 0x2, 0x1, 0x0, 0x0, 0xff, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x10, 0x3]}}) 772.8141ms ago: executing program 0 (id=567): r0 = syz_mount_image$vfat(&(0x7f0000001900), &(0x7f0000001ac0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000001bc0)=ANY=[@ANYBLOB="00631dda01aef2b0bad477a11d13ec0c19456795dd9b2620df1c0f624854ea3dd5a00bd6df44035f5c3ae796fec6d633a0ffad0569794acfef7da01767fd4175f2cd82df769aa2ee7bfe3640554507d24c60c9f9e222a72e1e3e71145c480657d2864e5e276f028d64701ae31cde0ceaf408fdb05c0f4142da00e9000001001d0149e6d308cbe315789f4baffe39bbced9b1d4db174c6121d2e290e9fc561a62225f002ee310e1fa7321000000000000d6231001a4b2d467825f3abb0c167e129cf1fa0e7854103f4bf2d3a0194983bc86cbd3d75ccef3c8ac4516dac10222664bbc980b4e99027c53ae2c6cc05d3be246e5837cbf286225d43e8c1d2e3fda86b86906b79fdedae7f3bbe362e8ad7f2b370442013de1788be93a3d553c2e1f5b559393d964df51bf393f52ecbe6f832b222231fbb9fee9e0343c2d3d567f7cff6d0b25303bcbcc99c879d3bc622b336c622a91291a63f9644964e5a679ea1b5005b9d987d6094ed4e1af157499d5fb2850161224a441240ea52dda516bc06ff3ade3c08c653108720c3e34727b0ae3db5da52511edb4325a2dd02b05f06a9e39764a8fbe0eb4eee5b51895703128cade291bc5c1acfae9ec5d34e71f75d8b5046aafd108b487be169a7bd49de322163858ae595e084074253c72d65f402752618d636a30c7800d77cbe196c326ca4d210f12f442868cba3ea9a0cbca8f59b1054675e2b1e898305a7245aae76525aaf2460152e5647f", @ANYRES64], 0x1, 0x2aa, &(0x7f0000001e00)="$eJzs3c9OE10Yx/EfpS/wgjBVFAVjPNGNbiZQr6AhkBibaJAa/yQmg0y16dCSToOpMcLOrWsvgbh0Z2K8ATZegQt3bFyyMI7pdIACQ4IEmYLfz+Y8nTNPc06eM81p0pmuP3y3UC76dtGpK9VllJYGtCFllFK3WrqiNhXGPWq3opvD+W9X7j96fCeXz0/NGDOdm72VNcYMXf388vWHa1/qAw8+Dn3q1Vrm6fqP7Pe1kbXR9V+zL0q+KfmmUq0bx8xVq3VnznPNfMkv28bc81zHd02p4ru1Hf1Fr7q42DBOZX6wf7Hm+r5xKg1TdhumXjX1WsM4z51Sxdi2bQb7haa+/btSxzkOJKVWyzmTksb29BRWExkQAABIVMz+f+Uw+/909Jr9/0lSWJ2ZcXJJjwJHyNp7qLn/fxL7dY/9PwAAAAAAAAAAAAAAAAAAAAAAJ8FGEFhBEFjNdvP+gB5JQXT8f0n9kgYknZE0KGkous0gI+mspHOShiWdl3RB0oiki5IuSRpte6+Ep4oY7fVvtv9F9e+m/v+E/eq/6/oPHyJB/U+fA9af6/+UantwT5+08HapsFRota3+XFEleXI1Lks/w1pGWvH07fzUuAlldHlhOcpfXip078yfkNVcMHH5E618szO/N1x3W/lZWc0FFpefjc3v043rbfm2LH19pqo8zYdrcjv/zYQxk3fzu/LHwvN26zne8vx1ttkSWz/b3q+/lX+A9RGMx9YnrbF0snOH5DdelR3Pc2sEBJ0XjHTGMA4dvO+MYRwmSPqTCcdhu+hJjwQAAAAAAAAAAAAAAAAA8CeO5jeDm/8UFn9OwlMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGCP3wEAAP//t8JUVA==") prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x7, 0x100}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000003a80), &(0x7f0000003ac0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x100800, 0x0, 0x1, 0x0, &(0x7f0000003bc0)) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(r0, &(0x7f0000000180)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xa8) 232.47µs ago: executing program 4 (id=568): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) sendmsg$NL80211_CMD_DEL_KEY(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000000c0)={0x20, r2, 0x1, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_KEY_SEQ={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x8806}, 0x844) 0s ago: executing program 5 (id=518): r0 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000940)={0x9, 0x4, 0x4, 0x2, 0x80, 0x1, 0x0, '\x00', 0x0, r0, 0x1, 0x1}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xd, 0x4, 0x4, 0xa8, 0x0, r1, 0x0, '\x00', 0x0, r0, 0x0, 0x5}, 0x50) kernel console output (not intermixed with test programs): Failed to release dquot type 1 [ 73.527600][ T4399] syz.2.3: attempt to access beyond end of device [ 73.527600][ T4399] loop2: rw=524288, sector=1768, nr_sectors = 4 limit=256 [ 73.586541][ T4403] loop1: detected capacity change from 0 to 2048 [ 73.599283][ T4399] syz.2.3: attempt to access beyond end of device [ 73.599283][ T4399] loop2: rw=0, sector=1768, nr_sectors = 4 limit=256 [ 73.630357][ T4403] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 73.655089][ T27] audit: type=1800 audit(1793356840.812:2): pid=4399 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3" name="file1" dev="loop2" ino=1048630 res=0 errno=0 [ 73.727830][ T4399] syz.2.3: attempt to access beyond end of device [ 73.727830][ T4399] loop2: rw=2049, sector=1768, nr_sectors = 4 limit=256 [ 73.860850][ T4403] UDF-fs: error (device loop1): udf_fiiter_advance_blk: extent after position 232 not allocated in directory (ino 1376) [ 73.874763][ T4403] UDF-fs: error (device loop1): udf_verify_fi: directory (ino 1376) has entry past directory size at pos 232 [ 73.886853][ T4339] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 73.980468][ T4408] Bluetooth: ISO socket layer initialized [ 74.547569][ T4412] loop2: detected capacity change from 0 to 1024 [ 74.662647][ T4339] usb 5-1: config 1 has an invalid interface number: 86 but max is 0 [ 74.674499][ T4339] usb 5-1: config 1 has no interface number 0 [ 74.680653][ T4339] usb 5-1: New USB device found, idVendor=19d2, idProduct=cfa8, bcdDevice=12.10 [ 74.853280][ T4417] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12'. [ 75.234672][ T4259] rxe_eth0 speed is unknown, defaulting to 1000 [ 75.563847][ T4427] loop0: detected capacity change from 0 to 128 [ 75.681053][ T4259] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 75.918894][ T4259] usb 2-1: unable to get BOS descriptor or descriptor too short [ 75.931310][ T4259] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 75.959352][ T4259] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 75.992273][ T4259] usb 2-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 76.018050][ T4259] usb 2-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 76.059853][ T4259] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 76.088691][ T4259] usb 2-1: config 1 interface 1 has no altsetting 0 [ 76.113914][ T4259] usb 2-1: string descriptor 0 read error: -22 [ 76.133927][ T4259] usb 2-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 76.160873][ T4259] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 76.192485][ T4372] usb 4-1: failed to send control message: -110 [ 76.198922][ T4372] ch341-uart: probe of ttyUSB0 failed with error -110 [ 76.214841][ T4339] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 76.256076][ T4339] rndis_wlan 5-1:1.86: skipping garbage [ 76.261894][ T4339] usb 5-1: bad CDC descriptors [ 76.269373][ T4339] rndis_host 5-1:1.86: skipping garbage [ 76.294242][ T129] cfg80211: failed to load regulatory.db [ 76.303638][ T4339] usb 5-1: bad CDC descriptors [ 76.319906][ T4438] loop0: detected capacity change from 0 to 512 [ 76.414477][ T4372] usb 4-1: USB disconnect, device number 2 [ 76.457260][ T4372] ch341 4-1:0.0: device disconnected [ 76.535780][ T4317] usb 5-1: USB disconnect, device number 2 [ 76.687204][ T4444] ip_tables: iptables: counters copy to user failed while replacing table [ 76.706979][ T4449] ip_tables: iptables: counters copy to user failed while replacing table [ 76.742508][ T4448] loop4: detected capacity change from 0 to 1024 [ 76.923969][ T4438] EXT4-fs (loop0): Test dummy encryption mode enabled [ 77.119260][ T4438] EXT4-fs error (device loop0): ext4_validate_block_bitmap:429: comm syz.0.15: bg 0: block 7: invalid block bitmap [ 77.184804][ T4438] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 77.226316][ T4259] usb 2-1: USB disconnect, device number 2 [ 77.278128][ T4438] EXT4-fs error (device loop0): ext4_xattr_delete_inode:2921: inode #11: comm syz.0.15: corrupted xattr block 95 [ 77.359963][ T4289] udevd[4289]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 77.399199][ T4438] EXT4-fs warning (device loop0): ext4_evict_inode:301: xattr delete (err -117) [ 77.431145][ T4438] EXT4-fs (loop0): 1 orphan inode deleted [ 77.436915][ T4438] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 77.520325][ T4438] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2805: Unable to expand inode 12. Delete some EAs or run e2fsck. [ 78.893450][ T4270] EXT4-fs (loop0): unmounting filesystem. [ 79.013404][ T7] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 79.070854][ T4339] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 80.121900][ T7] usb 5-1: config 0 has an invalid interface number: 237 but max is 0 [ 80.134818][ T7] usb 5-1: config 0 has no interface number 0 [ 80.154981][ T7] usb 5-1: config 0 interface 237 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 80.166243][ T7] usb 5-1: config 0 interface 237 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 80.179142][ T7] usb 5-1: config 0 interface 237 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 80.191387][ T4339] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 80.211108][ T4339] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 80.246576][ T7] usb 5-1: New USB device found, idVendor=045e, idProduct=84bd, bcdDevice=89.be [ 80.259778][ T4339] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 80.288467][ T7] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=3 [ 80.328094][ T4339] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 80.337606][ T7] usb 5-1: Product: syz [ 80.406042][ T7] usb 5-1: Manufacturer: syz [ 80.411018][ T4339] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 80.419891][ T7] usb 5-1: SerialNumber: syz [ 80.460423][ T7] usb 5-1: config 0 descriptor?? [ 80.480591][ T4339] usb 2-1: config 0 descriptor?? [ 80.507391][ T7] xpad 5-1:0.237: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 80.624412][ T7] xpad: probe of 5-1:0.237 failed with error -5 [ 80.757086][ T7] usb 5-1: USB disconnect, device number 3 [ 80.931983][ T4339] plantronics 0003:047F:FFFF.0001: ignoring exceeding usage max [ 80.983703][ T4339] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 81.018592][ T4339] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 81.528117][ T4507] mmap: syz.3.24 (4507) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 81.567230][ T4510] loop0: detected capacity change from 0 to 1024 [ 81.598012][ T4510] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 82.389764][ T4317] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 82.398127][ C0] plantronics 0003:047F:FFFF.0001: usb_submit_urb(ctrl) failed: -1 [ 82.538295][ T4518] loop2: detected capacity change from 0 to 512 [ 82.552805][ T4510] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 82.611157][ T4510] ext4 filesystem being mounted at /9/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 82.676168][ T4518] EXT4-fs: Ignoring removed nobh option [ 82.684986][ T4317] usb 5-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 82.721270][ T4317] usb 5-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 82.740866][ T4317] usb 5-1: Product: syz [ 82.755717][ T4317] usb 5-1: Manufacturer: syz [ 82.773932][ T4518] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 82.817012][ T4518] ext4 filesystem being mounted at /6/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 82.834073][ T4317] usb 5-1: Found UVC 1.00 device syz (225a:e1d4) [ 82.845774][ T4510] EXT4-fs error (device loop0): ext4_map_blocks:747: inode #15: comm syz.0.29: lblock 0 mapped to illegal pblock 0 (length 1) [ 82.921409][ T4525] loop1: detected capacity change from 0 to 1024 [ 82.942070][ T4510] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 82.966509][ T4510] EXT4-fs (loop0): This should not happen!! Data will be lost [ 82.966509][ T4510] [ 82.984210][ T4526] EXT4-fs error (device loop0): ext4_validate_block_bitmap:438: comm syz.0.29: bg 0: block 112: padding at end of block bitmap is not set [ 83.020701][ T4526] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 28 [ 83.027779][ T4317] usb 5-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 83.056695][ T4526] EXT4-fs (loop0): This should not happen!! Data will be lost [ 83.056695][ T4526] [ 83.076147][ T4526] EXT4-fs (loop0): Total free blocks count 0 [ 83.083128][ T4526] EXT4-fs (loop0): Free/Dirty block details [ 83.089192][ T4317] uvcvideo 5-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 83.109087][ T4317] uvcvideo 5-1:1.1: Failed to initialize the device (-5). [ 83.158782][ T4317] usb 5-1: USB disconnect, device number 4 [ 83.169167][ T4526] EXT4-fs (loop0): free_blocks=0 [ 83.196764][ T4526] EXT4-fs (loop0): dirty_blocks=64 [ 83.203130][ T4282] EXT4-fs (loop2): unmounting filesystem. [ 83.228905][ T4526] EXT4-fs (loop0): Block reservation details [ 83.330688][ T129] usb 2-1: USB disconnect, device number 3 [ 83.558655][ T4532] rxe_eth0 speed is unknown, defaulting to 1000 [ 84.637649][ T4539] loop4: detected capacity change from 0 to 16 [ 85.303684][ T4539] erofs: (device loop4): mounted with root inode @ nid 36. [ 85.349417][ T4539] erofs: (device loop4): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 85.372263][ T4539] syz.4.36: attempt to access beyond end of device [ 85.372263][ T4539] loop4: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 85.473653][ T4539] erofs: (device loop4): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 85.511003][ T4539] syz.4.36: attempt to access beyond end of device [ 85.511003][ T4539] loop4: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 85.614520][ T27] audit: type=1800 audit(1793356852.772:3): pid=4539 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.36" name="file2" dev="loop4" ino=89 res=0 errno=0 [ 85.721018][ T4339] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 85.796649][ T4556] loop4: detected capacity change from 0 to 512 [ 85.824194][ T4556] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 85.912542][ T4556] EXT4-fs (loop4): 1 truncate cleaned up [ 85.918237][ T4556] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 85.930848][ T4339] usb 2-1: Using ep0 maxpacket: 32 [ 85.938406][ T4339] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 85.959624][ T4339] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 85.969714][ T4339] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 85.979401][ T4339] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.989199][ T4339] usb 2-1: config 0 descriptor?? [ 86.351374][ T4562] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 86.774225][ T4339] savu 0003:1E7D:2D5A.0002: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.1-1/input0 [ 86.831154][ T4339] usb 2-1: USB disconnect, device number 4 [ 86.871726][ T4274] EXT4-fs (loop4): unmounting filesystem. [ 87.092428][ T4568] loop4: detected capacity change from 0 to 512 [ 87.112419][ T4570] loop0: detected capacity change from 0 to 1024 [ 87.139386][ T4568] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 87.177630][ T4570] hfsplus: unknown catalog record type 1280 [ 87.195806][ T4565] fido_id[4565]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 87.226679][ T4570] hfsplus: failed to load root directory [ 87.272628][ T4568] EXT4-fs (loop4): 1 truncate cleaned up [ 87.278335][ T4568] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 87.287981][ T4573] FAULT_INJECTION: forcing a failure. [ 87.287981][ T4573] name failslab, interval 1, probability 0, space 0, times 1 [ 87.301040][ T4573] CPU: 1 PID: 4573 Comm: syz.2.45 Not tainted syzkaller #0 [ 87.308248][ T4573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 87.318315][ T4573] Call Trace: [ 87.321596][ T4573] [ 87.324558][ T4573] dump_stack_lvl+0x188/0x24e [ 87.329253][ T4573] ? show_regs_print_info+0x12/0x12 [ 87.334440][ T4573] ? load_image+0x410/0x410 [ 87.338935][ T4573] ? __might_sleep+0xd0/0xd0 [ 87.343511][ T4573] ? __lock_acquire+0x7ea0/0x7ea0 [ 87.348526][ T4573] should_fail_ex+0x390/0x4c0 [ 87.353200][ T4573] should_failslab+0x5/0x20 [ 87.357684][ T4573] slab_pre_alloc_hook+0x59/0x300 [ 87.362700][ T4573] ? __se_sys_memfd_create+0xee/0x340 [ 87.368058][ T4573] __kmem_cache_alloc_node+0x4f/0x270 [ 87.373415][ T4573] ? __se_sys_memfd_create+0xee/0x340 [ 87.378773][ T4573] __kmalloc+0xa3/0x240 [ 87.382915][ T4573] __se_sys_memfd_create+0xee/0x340 [ 87.388101][ T4573] do_syscall_64+0x4c/0xa0 [ 87.392500][ T4573] ? clear_bhb_loop+0x60/0xb0 [ 87.397158][ T4573] ? clear_bhb_loop+0x60/0xb0 [ 87.401823][ T4573] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 87.407740][ T4573] RIP: 0033:0x7fad26f9f559 [ 87.412156][ T4573] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.431783][ T4573] RSP: 002b:00007fad27dc7e08 EFLAGS: 00000202 ORIG_RAX: 000000000000013f [ 87.440213][ T4573] RAX: ffffffffffffffda RBX: 00000000000004fa RCX: 00007fad26f9f559 [ 87.448196][ T4573] RDX: 00007fad27dc7ee0 RSI: 0000000000000000 RDI: 00007fad27036d00 [ 87.456165][ T4573] RBP: 0000200000000440 R08: 00000000ffffffff R09: 0000000000000000 [ 87.464153][ T4573] R10: 0000000000000001 R11: 0000000000000202 R12: 0000200000000380 [ 87.472137][ T4573] R13: 00007fad27dc7ee0 R14: 00007fad27dc7ea0 R15: 0000200000000400 [ 87.480123][ T4573] [ 89.798156][ T4271] Bluetooth: hci4: command 0x0405 tx timeout [ 89.846157][ T4274] EXT4-fs (loop4): unmounting filesystem. [ 90.220805][ T26] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 91.356412][ T4259] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 91.502356][ T26] usb 4-1: Using ep0 maxpacket: 32 [ 91.522425][ T26] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 91.559712][ T26] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 10 [ 91.574223][ T4259] usb 5-1: Using ep0 maxpacket: 16 [ 91.581846][ T4259] usb 5-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 91.610936][ T4259] usb 5-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 91.621084][ T26] usb 4-1: config 0 interface 0 has no altsetting 0 [ 91.629607][ T26] usb 4-1: New USB device found, idVendor=05ac, idProduct=021c, bcdDevice= 0.00 [ 91.643186][ T4259] usb 5-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 91.670976][ T26] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.701016][ T4259] usb 5-1: config 0 interface 0 has no altsetting 0 [ 91.707668][ T4259] usb 5-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 91.732327][ T26] usb 4-1: config 0 descriptor?? [ 91.755046][ T4259] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.791705][ T4259] usb 5-1: config 0 descriptor?? [ 91.944993][ T26] usbhid 4-1:0.0: can't add hid device: -71 [ 91.951110][ T26] usbhid: probe of 4-1:0.0 failed with error -71 [ 91.972081][ T26] usb 4-1: USB disconnect, device number 3 [ 92.018450][ T4607] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 92.120868][ T4317] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 92.206534][ T4259] hid (null): unknown global tag 0xc [ 92.220996][ T4259] hid (null): unknown global tag 0xc [ 92.238082][ T4259] hid (null): unknown global tag 0xe [ 92.243549][ T4259] hid (null): unknown global tag 0xd [ 92.270857][ T4259] hid (null): invalid report_count 42501 [ 92.300085][ T4259] hid (null): unknown global tag 0xfe [ 92.311363][ T4259] hid (null): bogus close delimiter [ 92.313354][ T4317] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 56, changing to 9 [ 92.316596][ T4259] hid (null): invalid report_size 44609 [ 92.371520][ T4317] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 8703, setting to 1024 [ 92.444252][ T4317] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 92.478207][ T26] usb 5-1: USB disconnect, device number 5 [ 92.501374][ T4317] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.553358][ T4317] usb 2-1: config 0 descriptor?? [ 92.890369][ T4620] loop2: detected capacity change from 0 to 1024 [ 93.005651][ T4622] rxe_eth0 speed is unknown, defaulting to 1000 [ 93.158101][ T77] hfsplus: b-tree write err: -5, ino 3 [ 94.358900][ T4317] ath6kl: Failed to submit usb control message: -110 [ 94.368087][ T4317] ath6kl: unable to send the bmi data to the device: -110 [ 94.381394][ T4317] ath6kl: Unable to send get target info: -110 [ 94.402353][ T4317] ath6kl: Failed to init ath6kl core: -110 [ 94.911149][ T4317] ath6kl_usb: probe of 2-1:0.0 failed with error -110 [ 94.963486][ T4317] usb 2-1: USB disconnect, device number 5 [ 95.132769][ T27] audit: type=1326 audit(1793356862.292:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4645 comm="syz.0.69" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f6846d9f559 code=0x0 [ 95.135864][ T4648] loop1: detected capacity change from 0 to 512 [ 96.452198][ T4648] EXT4-fs error (device loop1): ext4_orphan_get:1409: inode #15: comm syz.1.68: iget: bad i_size value: 38620345925642 [ 96.518976][ T4648] EXT4-fs error (device loop1): ext4_orphan_get:1414: comm syz.1.68: couldn't read orphan inode 15 (err -117) [ 96.578322][ T4648] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 96.850364][ T4278] EXT4-fs (loop1): unmounting filesystem. [ 96.866976][ T4660] input: syz1 as /devices/virtual/input/input6 [ 97.345583][ T27] audit: type=1326 audit(1793356864.502:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4671 comm="syz.3.74" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda67b9f559 code=0x7ffc0000 [ 97.459035][ T27] audit: type=1326 audit(1793356864.502:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4671 comm="syz.3.74" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda67b9f559 code=0x7ffc0000 [ 97.998700][ T27] audit: type=1326 audit(1793356864.502:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4671 comm="syz.3.74" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda67b9f559 code=0x7ffc0000 [ 98.060360][ T4680] netlink: 'syz.2.66': attribute type 12 has an invalid length. [ 98.121566][ T27] audit: type=1326 audit(1793356864.502:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4671 comm="syz.3.74" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7fda67b9f559 code=0x7ffc0000 [ 98.215458][ T27] audit: type=1326 audit(1793356864.502:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4671 comm="syz.3.74" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda67b9f559 code=0x7ffc0000 [ 98.354943][ T4317] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 98.373147][ T27] audit: type=1326 audit(1793356864.502:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4671 comm="syz.3.74" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda67b9f559 code=0x7ffc0000 [ 98.444977][ T27] audit: type=1326 audit(1793356864.502:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4671 comm="syz.3.74" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda67b9f559 code=0x7ffc0000 [ 98.499795][ T4690] loop4: detected capacity change from 0 to 256 [ 98.520862][ T27] audit: type=1326 audit(1793356864.502:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4671 comm="syz.3.74" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=189 compat=0 ip=0x7fda67b9f559 code=0x7ffc0000 [ 98.547405][ T27] audit: type=1326 audit(1793356864.502:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4671 comm="syz.3.74" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda67b9f559 code=0x7ffc0000 [ 98.552583][ T4317] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 98.589773][ T4690] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 98.693101][ T4317] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 98.721638][ T4317] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 98.753507][ T4695] loop2: detected capacity change from 0 to 1024 [ 98.857424][ T4317] usb 4-1: New USB device found, idVendor=047f, idProduct=0017, bcdDevice= 0.00 [ 98.959063][ T4317] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.099733][ T4317] usb 4-1: config 0 descriptor?? [ 99.509807][ T4704] FAULT_INJECTION: forcing a failure. [ 99.509807][ T4704] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 99.591689][ T4704] CPU: 1 PID: 4704 Comm: syz.1.82 Not tainted syzkaller #0 [ 99.593181][ T4695] syz.2.81: attempt to access beyond end of device [ 99.593181][ T4695] loop2: rw=0, sector=5778, nr_sectors = 2 limit=1024 [ 99.598915][ T4704] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 99.598929][ T4704] Call Trace: [ 99.598936][ T4704] [ 99.598945][ T4704] dump_stack_lvl+0x188/0x24e [ 99.598970][ T4704] ? show_regs_print_info+0x12/0x12 [ 99.598988][ T4704] ? load_image+0x410/0x410 [ 99.599012][ T4704] ? __lock_acquire+0x7ea0/0x7ea0 [ 99.599042][ T4704] should_fail_ex+0x390/0x4c0 [ 99.599073][ T4704] _copy_to_user+0x2c/0x130 [ 99.599095][ T4704] do_timer_create+0xca9/0x12f0 [ 99.599116][ T4704] ? do_timer_create+0x63d/0x12f0 [ 99.599142][ T4704] ? __ia32_sys_clock_nanosleep_time32+0xa0/0xa0 [ 99.599161][ T4704] ? __might_fault+0xc2/0x120 [ 99.599178][ T4704] ? __might_fault+0xa6/0x120 [ 99.599202][ T4704] __x64_sys_timer_create+0x166/0x1c0 [ 99.599230][ T4704] ? posix_timer_event+0xf0/0xf0 [ 99.599264][ T4704] ? lockdep_hardirqs_on+0x94/0x140 [ 99.599287][ T4704] do_syscall_64+0x4c/0xa0 [ 99.599303][ T4704] ? clear_bhb_loop+0x60/0xb0 [ 99.599320][ T4704] ? clear_bhb_loop+0x60/0xb0 [ 99.599339][ T4704] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 99.599364][ T4704] RIP: 0033:0x7f3b0ff9f559 [ 99.599381][ T4704] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.599395][ T4704] RSP: 002b:00007f3b10dbd028 EFLAGS: 00000246 ORIG_RAX: 00000000000000de [ 99.599417][ T4704] RAX: ffffffffffffffda RBX: 00007f3b10225fa0 RCX: 00007f3b0ff9f559 [ 99.599430][ T4704] RDX: 0000200000000040 RSI: 0000200000000000 RDI: 0000000000000000 [ 99.599442][ T4704] RBP: 00007f3b10036b20 R08: 0000000000000000 R09: 0000000000000000 [ 99.599454][ T4704] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 99.599465][ T4704] R13: 00007f3b10226038 R14: 00007f3b10225fa0 R15: 00007ffe198ce768 [ 99.599492][ T4704] [ 99.797484][ T4317] plantronics 0003:047F:0017.0004: unknown main item tag 0x3 [ 99.808919][ T4317] plantronics 0003:047F:0017.0004: unknown main item tag 0x3 [ 99.857435][ T4317] plantronics 0003:047F:0017.0004: unknown main item tag 0x1 [ 99.910848][ T4317] plantronics 0003:047F:0017.0004: unknown main item tag 0x0 [ 99.918273][ T4317] plantronics 0003:047F:0017.0004: unknown main item tag 0x0 [ 99.923512][ T4712] Bluetooth: MGMT ver 1.22 [ 99.961678][ T4317] plantronics 0003:047F:0017.0004: unknown main item tag 0x0 [ 99.985280][ T4709] syz.2.81: attempt to access beyond end of device [ 99.985280][ T4709] loop2: rw=0, sector=5778, nr_sectors = 2 limit=1024 [ 99.992552][ T4317] plantronics 0003:047F:0017.0004: No inputs registered, leaving [ 100.057302][ T4317] plantronics 0003:047F:0017.0004: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:0017] on usb-dummy_hcd.3-1/input0 [ 100.130254][ T4317] usb 4-1: USB disconnect, device number 4 [ 100.364926][ T4717] fido_id[4717]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 100.892436][ T4726] Cannot find add_set index 1 as target [ 101.112328][ T4726] loop0: detected capacity change from 0 to 1024 [ 101.131401][ T4726] hfsplus: unable to parse mount options [ 101.625018][ T4260] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 102.081564][ T4341] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 102.272645][ T4341] usb 3-1: too many endpoints for config 253 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 102.364906][ T4341] usb 3-1: config 253 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 102.589840][ T4341] usb 3-1: config 253 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 102.665648][ T4341] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 102.710817][ T4341] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 102.749314][ T4341] usb 3-1: SerialNumber: syz [ 103.542183][ T4341] rndis_wlan 3-1:253.0: RNDIS init failed, -71 [ 103.549040][ T4341] rndis_wlan: probe of 3-1:253.0 failed with error -71 [ 103.568111][ T4341] rndis_host 3-1:253.0: RNDIS init failed, -71 [ 103.580623][ T4341] rndis_host: probe of 3-1:253.0 failed with error -71 [ 103.616972][ T4341] usb 3-1: USB disconnect, device number 2 [ 103.727537][ T4759] FAULT_INJECTION: forcing a failure. [ 103.727537][ T4759] name failslab, interval 1, probability 0, space 0, times 0 [ 103.791408][ T4759] CPU: 0 PID: 4759 Comm: syz.1.98 Not tainted syzkaller #0 [ 103.798644][ T4759] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 103.808688][ T4759] Call Trace: [ 103.811956][ T4759] [ 103.814875][ T4759] dump_stack_lvl+0x188/0x24e [ 103.819544][ T4759] ? show_regs_print_info+0x12/0x12 [ 103.824761][ T4759] ? load_image+0x410/0x410 [ 103.829271][ T4759] ? __might_sleep+0xd0/0xd0 [ 103.833864][ T4759] ? __lock_acquire+0x7ea0/0x7ea0 [ 103.838900][ T4759] should_fail_ex+0x390/0x4c0 [ 103.843591][ T4759] should_failslab+0x5/0x20 [ 103.848099][ T4759] slab_pre_alloc_hook+0x59/0x300 [ 103.853123][ T4759] kmem_cache_alloc+0x56/0x2f0 [ 103.857885][ T4759] ? __alloc_file+0x25/0x230 [ 103.862481][ T4759] __alloc_file+0x25/0x230 [ 103.866892][ T4759] alloc_empty_file+0x90/0x180 [ 103.871652][ T4759] alloc_file+0x5b/0x5f0 [ 103.875894][ T4759] alloc_file_pseudo+0x180/0x200 [ 103.880827][ T4759] ? alloc_empty_file_noaccount+0x80/0x80 [ 103.886543][ T4759] ? _raw_spin_unlock+0x24/0x40 [ 103.891397][ T4759] anon_inode_getfd+0xc6/0x1b0 [ 103.896159][ T4759] __se_sys_fsopen+0x22d/0x2c0 [ 103.900925][ T4759] do_syscall_64+0x4c/0xa0 [ 103.905333][ T4759] ? clear_bhb_loop+0x60/0xb0 [ 103.910000][ T4759] ? clear_bhb_loop+0x60/0xb0 [ 103.914665][ T4759] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 103.920563][ T4759] RIP: 0033:0x7f3b0ff9f559 [ 103.924974][ T4759] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.944574][ T4759] RSP: 002b:00007f3b10d9c028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 103.952982][ T4759] RAX: ffffffffffffffda RBX: 00007f3b10226090 RCX: 00007f3b0ff9f559 [ 103.960944][ T4759] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000380 [ 103.968905][ T4759] RBP: 00007f3b10036b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.976865][ T4759] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.984825][ T4759] R13: 00007f3b10226128 R14: 00007f3b10226090 R15: 00007ffe198ce768 [ 103.992804][ T4759] [ 104.029573][ T27] kauditd_printk_skb: 3 callbacks suppressed [ 104.029586][ T27] audit: type=1326 audit(1700006404.130:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4754 comm="syz.3.101" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda67b9f559 code=0x7ffc0000 [ 104.120825][ T27] audit: type=1326 audit(1700006404.190:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4754 comm="syz.3.101" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda67b9f559 code=0x7ffc0000 [ 104.170785][ T27] audit: type=1326 audit(1700006404.190:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4754 comm="syz.3.101" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda67b9f559 code=0x7ffc0000 [ 104.271293][ T27] audit: type=1326 audit(1700006404.200:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4754 comm="syz.3.101" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fda67b408d9 code=0x7ffc0000 [ 104.356047][ T27] audit: type=1326 audit(1700006404.200:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4754 comm="syz.3.101" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fda67b9f559 code=0x7ffc0000 [ 104.396117][ T4765] loop0: detected capacity change from 0 to 16 [ 104.448513][ T4765] erofs: (device loop0): mounted with root inode @ nid 36. [ 104.480781][ T27] audit: type=1326 audit(1700006404.200:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4754 comm="syz.3.101" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda67b9f559 code=0x7ffc0000 [ 104.588087][ T27] audit: type=1326 audit(1700006404.250:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4754 comm="syz.3.101" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fda67b9f2c2 code=0x7ffc0000 [ 104.638443][ T27] audit: type=1326 audit(1700006404.730:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4754 comm="syz.3.101" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fda67b9f2c2 code=0x7ffc0000 [ 104.750945][ T27] audit: type=1326 audit(1700006404.740:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4754 comm="syz.3.101" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda67b9f559 code=0x7ffc0000 [ 104.847743][ T27] audit: type=1326 audit(1700006404.740:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4754 comm="syz.3.101" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fda67b9f2c2 code=0x7ffc0000 [ 105.071270][ T26] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 105.250846][ T26] usb 4-1: device descriptor read/64, error -71 [ 105.279462][ T4781] device syzkaller0 entered promiscuous mode [ 106.630900][ T26] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 106.735450][ T4766] ALSA: mixer_oss: invalid OSS volume '' [ 107.018876][ T4796] loop3: detected capacity change from 0 to 512 [ 107.043684][ T4798] loop2: detected capacity change from 0 to 1024 [ 107.075642][ T4796] EXT4-fs: Ignoring removed nobh option [ 107.097893][ T4796] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 107.404838][ T4271] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 107.414713][ T4271] CPU: 0 PID: 4271 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 107.422279][ T4271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 107.432346][ T4271] Workqueue: hci3 hci_rx_work [ 107.437044][ T4271] Call Trace: [ 107.440324][ T4271] [ 107.443260][ T4271] dump_stack_lvl+0x188/0x24e [ 107.447949][ T4271] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 107.453610][ T4271] ? show_regs_print_info+0x12/0x12 [ 107.458828][ T4271] ? load_image+0x410/0x410 [ 107.463364][ T4271] ? sysfs_create_dir_ns+0x23f/0x290 [ 107.468676][ T4271] sysfs_create_dir_ns+0x26a/0x290 [ 107.473820][ T4271] ? __lock_acquire+0x7ea0/0x7ea0 [ 107.478861][ T4271] ? sysfs_warn_dup+0xa0/0xa0 [ 107.483562][ T4271] ? do_raw_spin_unlock+0x11d/0x230 [ 107.488777][ T4271] kobject_add_internal+0x617/0xca0 [ 107.494009][ T4271] kobject_add+0x160/0x230 [ 107.498441][ T4271] ? lockdep_hardirqs_on+0x94/0x140 [ 107.503656][ T4271] ? kobject_init+0x1c0/0x1c0 [ 107.508356][ T4271] ? __raw_spin_lock_init+0x41/0x100 [ 107.513649][ T4271] ? klist_children_get+0x50/0x50 [ 107.518686][ T4271] ? get_device_parent+0x121/0x3e0 [ 107.523817][ T4271] device_add+0x470/0x1050 [ 107.528255][ T4271] hci_conn_add_sysfs+0xd1/0x1e0 [ 107.533213][ T4271] le_conn_complete_evt+0xf93/0x15c0 [ 107.538525][ T4271] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 107.544789][ T4271] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 107.550431][ T4271] ? lockdep_hardirqs_on+0x94/0x140 [ 107.555639][ T4271] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 107.561284][ T4271] hci_le_enh_conn_complete_evt+0x185/0x460 [ 107.567199][ T4271] ? hci_remote_host_features_evt+0x230/0x230 [ 107.573277][ T4271] hci_event_packet+0x7b3/0x1290 [ 107.578234][ T4271] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 107.583879][ T4271] ? bis_list+0x280/0x280 [ 107.588224][ T4271] ? kcov_remote_start+0x1b3/0x810 [ 107.593349][ T4271] ? hci_send_to_monitor+0x9c/0x4a0 [ 107.598577][ T4271] hci_rx_work+0x3eb/0xd40 [ 107.603017][ T4271] ? process_one_work+0x7b4/0x1160 [ 107.608138][ T4271] process_one_work+0x8ab/0x1160 [ 107.613101][ T4271] ? worker_detach_from_pool+0x240/0x240 [ 107.618750][ T4271] ? _raw_spin_lock_irq+0xb7/0xf0 [ 107.623797][ T4271] ? _raw_spin_lock_irqsave+0x100/0x100 [ 107.629360][ T4271] ? wq_worker_running+0x97/0x190 [ 107.634391][ T4271] worker_thread+0xaf5/0x12a0 [ 107.639111][ T4271] kthread+0x29d/0x330 [ 107.643182][ T4271] ? worker_clr_flags+0x1a0/0x1a0 [ 107.648202][ T4271] ? kthread_blkcg+0xd0/0xd0 [ 107.652790][ T4271] ret_from_fork+0x1f/0x30 [ 107.657214][ T4271] [ 107.676291][ T4271] kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 107.690840][ T4271] Bluetooth: hci3: failed to register connection device [ 107.875619][ T4796] EXT4-fs (loop3): 1 truncate cleaned up [ 107.908012][ T4796] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 107.973786][ T4806] loop1: detected capacity change from 0 to 128 [ 108.016154][ T4806] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 108.025412][ T4806] ext4 filesystem being mounted at /20/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 108.041788][ T4796] syz.3.114 (pid 4796) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 108.311685][ T4279] EXT4-fs (loop3): unmounting filesystem. [ 108.359263][ T4815] loop0: detected capacity change from 0 to 128 [ 108.413305][ T4815] FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 108.563945][ T48] FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 108.604768][ T4823] loop2: detected capacity change from 0 to 128 [ 108.681745][ T4829] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 108.843671][ T4823] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 109.141131][ T4823] ext4 filesystem being mounted at /28/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 109.639181][ T27] kauditd_printk_skb: 42 callbacks suppressed [ 109.639194][ T27] audit: type=1800 audit(1700006409.740:69): pid=4823 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.121" name="file1" dev="loop2" ino=12 res=0 errno=0 [ 109.649317][ T4278] EXT4-fs (loop1): unmounting filesystem. [ 109.781651][ T4282] EXT4-fs (loop2): unmounting filesystem. [ 109.850347][ T4841] loop4: detected capacity change from 0 to 8 [ 109.952171][ T4841] SQUASHFS error: zstd decompression error: 10 [ 109.979896][ T4841] SQUASHFS error: zstd decompression failed, data probably corrupt [ 110.024149][ T4841] SQUASHFS error: Failed to read block 0x4ea: -5 [ 110.051222][ T4841] SQUASHFS error: Unable to read metadata cache entry [4e8] [ 110.076477][ T4841] SQUASHFS error: Unable to read inode 0x11f [ 110.294010][ T4854] loop4: detected capacity change from 0 to 512 [ 110.321580][ T4854] EXT4-fs (loop4): Test dummy encryption mode enabled [ 110.384010][ T4854] EXT4-fs error (device loop4): ext4_validate_block_bitmap:429: comm syz.4.134: bg 0: block 7: invalid block bitmap [ 110.426367][ T4854] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 110.465688][ T4854] EXT4-fs error (device loop4): ext4_xattr_delete_inode:2921: inode #11: comm syz.4.134: corrupted xattr block 95 [ 110.987597][ T4864] Cannot find add_set index 1 as target [ 111.619063][ T4854] EXT4-fs warning (device loop4): ext4_evict_inode:301: xattr delete (err -117) [ 111.633128][ T4867] loop3: detected capacity change from 0 to 1024 [ 111.644191][ T4854] EXT4-fs (loop4): 1 orphan inode deleted [ 111.650026][ T4854] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 111.723603][ T4854] EXT4-fs error (device loop4) in ext4_setattr:5695: error 28 [ 111.831427][ T4274] EXT4-fs (loop4): unmounting filesystem. [ 111.850368][ T4872] loop2: detected capacity change from 0 to 512 [ 111.916355][ T4872] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 111.978985][ T4872] ext4 filesystem being mounted at /33/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 112.078918][ T4876] loop0: detected capacity change from 0 to 512 [ 112.131228][ T4876] EXT4-fs (loop0): feature flags set on rev 0 fs, running e2fsck is recommended [ 112.153315][ T4282] EXT4-fs (loop2): unmounting filesystem. [ 112.175241][ T4876] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem [ 112.243545][ T4876] EXT4-fs (loop0): orphan cleanup on readonly fs [ 112.276920][ T4876] EXT4-fs error (device loop0): ext4_orphan_get:1435: comm syz.0.145: bad orphan inode 15 [ 112.315328][ T4876] ext4_test_bit(bit=14, block=18) = 1 [ 112.321121][ T4876] is_bad_inode(inode)=0 [ 112.325294][ T4876] NEXT_ORPHAN(inode)=1023 [ 112.362223][ T4876] max_ino=32 [ 112.365513][ T4876] i_nlink=0 [ 112.372086][ T4876] EXT4-fs error (device loop0): ext4_validate_block_bitmap:438: comm syz.0.145: bg 0: block 440: padding at end of block bitmap is not set [ 112.387195][ T26] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 112.398246][ T4876] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 112.408326][ T4876] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 112.479861][ T4270] EXT4-fs (loop0): unmounting filesystem. [ 112.570995][ T26] usb 5-1: Using ep0 maxpacket: 32 [ 112.577903][ T26] usb 5-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 112.635864][ T26] usb 5-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 112.705395][ T26] usb 5-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 112.725978][ T4906] TCP: TCP_TX_DELAY enabled [ 112.739771][ T26] usb 5-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 112.773905][ T26] usb 5-1: Product: syz [ 112.804048][ T26] usb 5-1: Manufacturer: syz [ 112.885968][ T26] hub 5-1:4.0: USB hub found [ 112.933227][ T4880] device-mapper: table: 248:0: crypt: Error allocating crypto tfm (-EINTR) [ 112.965031][ T4880] device-mapper: ioctl: error adding target to table [ 113.068685][ T26] hub 5-1:4.0: config failed, hub doesn't have any ports! (err -19) [ 113.178696][ T4911] loop0: detected capacity change from 0 to 512 [ 113.271707][ T4911] EXT4-fs: Ignoring removed nobh option [ 114.418941][ T26] usb 5-1: USB disconnect, device number 6 [ 114.582103][ T4887] syz.2.146 (4887): drop_caches: 2 [ 114.582588][ T4911] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 114.659973][ T4911] EXT4-fs (loop0): 1 truncate cleaned up [ 114.665712][ T4911] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 114.843396][ T4270] EXT4-fs (loop0): unmounting filesystem. [ 116.213086][ T27] audit: type=1326 audit(1700006416.320:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4943 comm="syz.2.160" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 116.365256][ T27] audit: type=1326 audit(1700006416.320:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4943 comm="syz.2.160" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 117.650476][ T4955] loop1: detected capacity change from 0 to 1024 [ 117.740275][ T27] audit: type=1326 audit(1700006416.320:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4943 comm="syz.2.160" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 117.940127][ T27] audit: type=1326 audit(1700006416.320:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4943 comm="syz.2.160" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 118.140941][ T27] audit: type=1326 audit(1700006416.320:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4943 comm="syz.2.160" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 118.365262][ T27] audit: type=1326 audit(1700006416.320:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4943 comm="syz.2.160" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 118.366007][ T4947] syz.4.163 (4947): drop_caches: 2 [ 119.029583][ T4955] hfsplus: inconsistency in B*Tree (1,0,1,0,2) [ 119.037356][ T4955] hfsplus: xattr searching failed [ 119.043415][ T4955] syz.1.164: attempt to access beyond end of device [ 119.043415][ T4955] loop1: rw=0, sector=5778, nr_sectors = 2 limit=1024 [ 119.092490][ T4955] Buffer I/O error on dev loop1, logical block 2889, async page read [ 119.101045][ T4955] syz.1.164: attempt to access beyond end of device [ 119.101045][ T4955] loop1: rw=0, sector=5778, nr_sectors = 2 limit=1024 [ 119.115957][ T4955] Buffer I/O error on dev loop1, logical block 2889, async page read [ 119.216173][ T27] audit: type=1326 audit(1700006416.320:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4943 comm="syz.2.160" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 119.433840][ T27] audit: type=1326 audit(1700006416.320:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4943 comm="syz.2.160" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 119.610958][ T4993] loop4: detected capacity change from 0 to 512 [ 119.630993][ T27] audit: type=1326 audit(1700006416.320:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4943 comm="syz.2.160" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=188 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 119.709841][ T4995] loop1: detected capacity change from 0 to 1024 [ 119.720508][ T4993] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 119.732804][ T4993] ext4 filesystem being mounted at /28/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 119.757027][ T27] audit: type=1326 audit(1700006416.320:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4943 comm="syz.2.160" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 120.007752][ T4274] EXT4-fs (loop4): unmounting filesystem. [ 122.087270][ T5027] loop3: detected capacity change from 0 to 512 [ 122.362982][ T5001] syz.0.178 (5001): drop_caches: 2 [ 122.843940][ T5037] loop1: detected capacity change from 0 to 1024 [ 123.294737][ T5048] loop1: detected capacity change from 0 to 128 [ 123.296849][ T5045] loop3: detected capacity change from 0 to 1024 [ 123.328577][ T5048] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 123.416896][ T5048] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 123.433426][ T5045] syz.3.193: attempt to access beyond end of device [ 123.433426][ T5045] loop3: rw=0, sector=5778, nr_sectors = 2 limit=1024 [ 123.544749][ T5050] loop4: detected capacity change from 0 to 2048 [ 123.625831][ T5050] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 123.710877][ T11] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 123.957065][ T5058] input: syz0 as /devices/virtual/input/input8 [ 124.040919][ T4317] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 124.212307][ T5056] loop0: detected capacity change from 0 to 256 [ 124.280818][ T4317] usb 3-1: Using ep0 maxpacket: 16 [ 124.294233][ T4317] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 124.539815][ T5056] exfat: Deprecated parameter 'namecase' [ 124.545661][ T5056] exfat: Deprecated parameter 'namecase' [ 124.564170][ T4317] usb 3-1: config 0 interface 0 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 124.648436][ T4317] usb 3-1: config 0 interface 0 has no altsetting 0 [ 124.655405][ T4317] usb 3-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 124.671477][ T4317] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 124.714732][ T4317] usb 3-1: config 0 descriptor?? [ 124.721073][ T5056] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xfcc0b04e, utbl_chksum : 0xe619d30d) [ 124.763956][ T4317] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 124.851344][ T4263] udevd[4263]: setting mode of /dev/input/event4 to 020660 failed: No such file or directory [ 124.881832][ T4263] udevd[4263]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 125.064028][ T5068] loop4: detected capacity change from 0 to 8 [ 125.118780][ T5069] loop3: detected capacity change from 0 to 128 [ 125.177384][ T5068] process 'syz.4.202' launched './file0' with NULL argv: empty string added [ 125.352897][ T5075] loop0: detected capacity change from 0 to 2048 [ 125.470973][ T5076] syz.3.203: attempt to access beyond end of device [ 125.470973][ T5076] loop3: rw=2049, sector=145, nr_sectors = 103 limit=128 [ 125.935690][ T5075] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 126.627128][ T5097] loop0: detected capacity change from 0 to 512 [ 127.821048][ T5097] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 127.924629][ T129] usb 3-1: USB disconnect, device number 3 [ 127.952764][ T5097] EXT4-fs (loop0): 1 truncate cleaned up [ 128.070771][ T5097] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 128.087705][ T5097] EXT4-fs error (device loop0): ext4_append:79: inode #2: comm syz.0.213: Logical block already allocated [ 128.185817][ T5110] loop4: detected capacity change from 0 to 128 [ 128.197751][ T5110] EXT4-fs: Ignoring removed i_version option [ 128.736655][ T5110] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 128.745747][ T5110] ext4 filesystem being mounted at /38/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 128.766885][ T5097] EXT4-fs (loop0): Remounting filesystem read-only [ 128.963152][ T4270] EXT4-fs (loop0): unmounting filesystem. [ 129.030054][ T4274] EXT4-fs (loop4): unmounting filesystem. [ 129.386707][ T5133] binder: 5131:5133 ioctl c018620c 200000000680 returned -1 [ 129.410100][ T5136] loop1: detected capacity change from 0 to 1024 [ 129.614127][ T5143] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 129.830958][ T4317] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 131.118208][ T4317] usb 1-1: Using ep0 maxpacket: 16 [ 131.148306][ T4317] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 131.158589][ T4317] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 131.169880][ T4317] usb 1-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 131.183131][ T4317] usb 1-1: config 0 interface 0 has no altsetting 0 [ 131.189761][ T4317] usb 1-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 131.238885][ T4317] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 131.268341][ T4317] usb 1-1: config 0 descriptor?? [ 131.289850][ T4317] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 131.434179][ T5159] loop2: detected capacity change from 0 to 1024 [ 131.444474][ T5157] rxe_eth0 speed is unknown, defaulting to 1000 [ 131.515418][ T5162] loop1: detected capacity change from 0 to 128 [ 131.587684][ T5162] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 131.602292][ T5162] ext4 filesystem being mounted at /44/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 131.658048][ T4278] EXT4-fs (loop1): unmounting filesystem. [ 131.926904][ T5170] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 131.960833][ T5172] xt_hashlimit: max too large, truncated to 1048576 [ 132.970004][ T1278] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.976383][ T1278] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.092692][ T129] usb 1-1: USB disconnect, device number 2 [ 134.284171][ T5178] syz.1.244 (5178): drop_caches: 2 [ 134.353150][ T5206] netlink: 64 bytes leftover after parsing attributes in process `syz.4.251'. [ 135.108910][ T5217] Cannot find add_set index 1 as target [ 135.856208][ T5220] loop1: detected capacity change from 0 to 512 [ 136.170947][ T4317] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 136.380961][ T4317] usb 5-1: Using ep0 maxpacket: 16 [ 136.392629][ T4317] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 136.441129][ T4317] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 136.490775][ T4317] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 136.570828][ T4317] usb 5-1: config 0 interface 0 has no altsetting 0 [ 136.597997][ T4317] usb 5-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 136.630488][ T4317] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 136.851103][ T4317] usb 5-1: config 0 descriptor?? [ 137.003982][ T4317] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 137.351037][ T5234] syz.0.265 (5234): drop_caches: 2 [ 137.446417][ T5256] loop0: detected capacity change from 0 to 512 [ 137.533530][ T5256] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 137.733225][ T5258] loop2: detected capacity change from 0 to 512 [ 137.766453][ T5256] EXT4-fs (loop0): 1 truncate cleaned up [ 137.776294][ T5256] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 137.817205][ T5258] EXT4-fs (loop2): 1 truncate cleaned up [ 138.310763][ T5265] Cannot find add_set index 1 as target [ 139.070807][ T5258] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 139.164290][ T27] kauditd_printk_skb: 9 callbacks suppressed [ 139.164304][ T27] audit: type=1800 audit(1700006439.270:89): pid=5258 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.252" name="file1" dev="loop2" ino=13 res=0 errno=0 [ 139.187059][ T4342] usb 5-1: USB disconnect, device number 7 [ 139.323505][ T4270] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz-executor: invalid indirect mapped block 4294901760 (level 0) [ 139.454602][ T4282] EXT4-fs (loop2): unmounting filesystem. [ 139.474049][ T4270] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz-executor: invalid indirect mapped block 4294967295 (level 1) [ 139.621031][ T4270] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz-executor: invalid indirect mapped block 65535 (level 2) [ 139.842695][ T4270] EXT4-fs (loop0): unmounting filesystem. [ 140.054829][ T5276] loop2: detected capacity change from 0 to 128 [ 141.589437][ T5276] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 141.661159][ T5276] ext4 filesystem being mounted at /58/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 142.384565][ T5286] syz.3.275 (5286): drop_caches: 2 [ 142.395132][ T4282] EXT4-fs (loop2): unmounting filesystem. [ 142.454920][ T5286] syz.3.275 (5286): drop_caches: 2 [ 143.798397][ T5304] syz.3.278 (5304): drop_caches: 2 [ 143.827139][ T5304] syz.3.278 (5304): drop_caches: 2 [ 145.129886][ T5329] loop4: detected capacity change from 0 to 2048 [ 145.218450][ T5329] UDF-fs: error (device loop4): udf_fiiter_advance_blk: extent after position 232 not allocated in directory (ino 1376) [ 145.284371][ T5336] netlink: 16 bytes leftover after parsing attributes in process `syz.2.277'. [ 145.311691][ T5329] UDF-fs: error (device loop4): udf_verify_fi: directory (ino 1376) has entry past directory size at pos 232 [ 145.670970][ T5346] loop4: detected capacity change from 0 to 1024 [ 145.726494][ T5345] loop0: detected capacity change from 0 to 1024 [ 145.779714][ T5345] EXT4-fs: Ignoring removed oldalloc option [ 145.795916][ T5345] EXT4-fs: Ignoring removed oldalloc option [ 145.843698][ T5345] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 145.958918][ T5345] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 145.973851][ T5355] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 146.090556][ T27] audit: type=1800 audit(1700006446.190:90): pid=5345 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.291" name="bus" dev="loop0" ino=18 res=0 errno=0 [ 146.864127][ T4270] EXT4-fs (loop0): unmounting filesystem. [ 147.176336][ T5370] loop2: detected capacity change from 0 to 1024 [ 147.241952][ T5368] loop0: detected capacity change from 0 to 8192 [ 147.265588][ T5372] netlink: 16 bytes leftover after parsing attributes in process `syz.3.299'. [ 147.349954][ T5368] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 147.386931][ T5368] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 147.410322][ T5368] loop0: unable to read partition table [ 147.444734][ T5368] loop_reread_partitions: partition scan of loop0 () failed (rc=-5) [ 148.184341][ T5381] Cannot find add_set index 1 as target [ 149.302328][ T4271] Bluetooth: hci1: command 0x2021 tx timeout [ 149.348199][ T5383] loop0: detected capacity change from 0 to 4096 [ 149.413584][ T5391] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 149.429024][ T5383] EXT4-fs: Ignoring removed orlov option [ 149.485161][ T5383] EXT4-fs (loop0): Test dummy encryption mode enabled [ 149.594616][ T5383] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 150.739523][ T5403] syz.3.310 (5403): drop_caches: 2 [ 150.786990][ T5403] syz.3.310 (5403): drop_caches: 2 [ 151.118891][ T5383] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 151.299610][ T5419] loop4: detected capacity change from 0 to 256 [ 151.369552][ T5419] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 151.398585][ T4270] EXT4-fs (loop0): unmounting filesystem. [ 152.181715][ T27] audit: type=1800 audit(1700006399.450:91): pid=5419 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.311" name="file1" dev="loop4" ino=1048640 res=0 errno=0 [ 152.306884][ T5424] loop0: detected capacity change from 0 to 1024 [ 152.431652][ T5426] binder: 5425:5426 ioctl c0306201 200000000100 returned -14 [ 152.521469][ T5427] binder: 5425:5427 ioctl c0306201 200000000340 returned -14 [ 152.776180][ T5435] loop2: detected capacity change from 0 to 128 [ 153.291316][ T5438] Cannot find add_set index 1 as target [ 153.941698][ T5435] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 153.998716][ T5435] UDF-fs: error (device loop2): udf_process_sequence: Primary Volume Descriptor not found! [ 154.065915][ T5435] UDF-fs: error (device loop2): udf_process_sequence: Primary Volume Descriptor not found! [ 154.105512][ T5435] UDF-fs: Scanning with blocksize 512 failed [ 154.167789][ T5435] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 154.208866][ T5435] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=512, location=512 [ 154.249387][ T5435] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 154.260860][ T5435] UDF-fs: Scanning with blocksize 1024 failed [ 154.293339][ T5435] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 154.337948][ T5435] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=512, location=512 [ 154.376717][ T5435] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 154.413641][ T5435] UDF-fs: Scanning with blocksize 2048 failed [ 154.419108][ T5448] netlink: 28 bytes leftover after parsing attributes in process `syz.0.321'. [ 154.436130][ T5435] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 154.576786][ T5435] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=512, location=512 [ 154.642067][ T5435] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 154.671747][ T5435] UDF-fs: Scanning with blocksize 4096 failed [ 154.677868][ T5435] UDF-fs: warning (device loop2): udf_fill_super: No partition found (1) [ 154.837816][ T5454] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 155.837628][ T5462] input: syz1 as /devices/virtual/input/input10 [ 156.213128][ T5470] loop1: detected capacity change from 0 to 512 [ 156.241001][ T4317] smpboot: CPU 1 is now offline [ 156.303389][ T5470] EXT4-fs: inline encryption not supported [ 156.331683][ T5469] ip_tables: iptables: counters copy to user failed while replacing table [ 156.344063][ T5468] x86: Booting SMP configuration: [ 156.349235][ T5468] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 156.392796][ T5473] ip_tables: iptables: counters copy to user failed while replacing table [ 156.498229][ T5470] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 156.591687][ T5470] EXT4-fs (loop1): 1 truncate cleaned up [ 156.661567][ T5475] loop3: detected capacity change from 0 to 256 [ 156.704382][ T5470] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 156.851237][ T5479] loop0: detected capacity change from 0 to 512 [ 156.865785][ T5475] FAT-fs (loop3): Directory bread(block 64) failed [ 156.897447][ T5479] EXT4-fs: Ignoring removed nobh option [ 156.903232][ T5475] FAT-fs (loop3): Directory bread(block 65) failed [ 156.955213][ T5475] FAT-fs (loop3): Directory bread(block 66) failed [ 156.994024][ T5481] loop2: detected capacity change from 0 to 512 [ 157.010616][ T5475] FAT-fs (loop3): Directory bread(block 67) failed [ 157.036054][ T4278] EXT4-fs (loop1): unmounting filesystem. [ 157.043564][ T5479] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 157.119717][ T5475] FAT-fs (loop3): Directory bread(block 68) failed [ 157.126997][ T5479] ext4 filesystem being mounted at /83/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 157.195562][ T5475] FAT-fs (loop3): Directory bread(block 69) failed [ 157.225474][ T5481] EXT4-fs (loop2): 1 orphan inode deleted [ 157.246870][ T4699] Quota error (device loop2): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 157.248185][ T5479] EXT4-fs error (device loop0): ext4_find_dest_de:2117: inode #2: block 3: comm syz.0.331: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 157.257016][ T4699] EXT4-fs error (device loop2): ext4_release_dquot:6877: comm kworker/u4:13: Failed to release dquot type 1 [ 157.288199][ T5475] FAT-fs (loop3): Directory bread(block 70) failed [ 157.316668][ T5481] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 157.336949][ T5475] FAT-fs (loop3): Directory bread(block 71) failed [ 157.440258][ T5475] FAT-fs (loop3): Directory bread(block 72) failed [ 157.453902][ T5481] ext4 filesystem being mounted at /70/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 157.490474][ T5491] loop4: detected capacity change from 0 to 512 [ 157.497003][ T5475] FAT-fs (loop3): Directory bread(block 73) failed [ 157.558367][ T5481] capability: warning: `syz.2.330' uses deprecated v2 capabilities in a way that may be insecure [ 157.611122][ T5491] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 157.700577][ T5475] syz.3.329: attempt to access beyond end of device [ 157.700577][ T5475] loop3: rw=524288, sector=1768, nr_sectors = 4 limit=256 [ 157.742012][ T5491] EXT4-fs (loop4): 1 truncate cleaned up [ 157.778956][ T4270] EXT4-fs (loop0): unmounting filesystem. [ 157.785496][ T5491] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 157.840992][ T5475] syz.3.329: attempt to access beyond end of device [ 157.840992][ T5475] loop3: rw=0, sector=1768, nr_sectors = 4 limit=256 [ 157.865178][ T4282] EXT4-fs (loop2): unmounting filesystem. [ 158.024931][ T27] audit: type=1800 audit(1700006401.140:92): pid=5475 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.329" name="file1" dev="loop3" ino=1048643 res=0 errno=0 [ 158.063663][ T27] audit: type=1800 audit(1700006401.170:93): pid=5494 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.329" name="file1" dev="loop3" ino=1048643 res=0 errno=0 [ 158.268219][ T5505] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 158.648662][ T4317] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 158.670002][ T4274] EXT4-fs (loop4): unmounting filesystem. [ 158.856671][ T4317] usb 3-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 158.899665][ T4317] usb 3-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 158.983783][ T4317] usb 3-1: Product: syz [ 159.032002][ T4317] usb 3-1: Manufacturer: syz [ 159.166683][ T4317] usb 3-1: SerialNumber: syz [ 159.237325][ T4317] usb 3-1: config 0 descriptor?? [ 159.301746][ T4317] ch341 3-1:0.0: ch341-uart converter detected [ 160.872514][ T4317] usb 3-1: failed to send control message: -71 [ 160.878929][ T4317] ch341-uart: probe of ttyUSB0 failed with error -71 [ 160.984248][ T4317] usb 3-1: USB disconnect, device number 4 [ 161.061147][ T4317] ch341 3-1:0.0: device disconnected [ 161.361013][ T4372] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 161.392119][ T5529] input: syz0 as /devices/virtual/input/input11 [ 161.572586][ T4372] usb 4-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 161.595192][ T4372] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 161.618245][ T5532] netlink: 44 bytes leftover after parsing attributes in process `syz.2.346'. [ 161.668007][ T4372] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 161.679493][ T5532] netlink: 51 bytes leftover after parsing attributes in process `syz.2.346'. [ 161.731127][ T4372] usb 4-1: config 1 has no interface number 0 [ 161.740516][ T5532] netlink: 51 bytes leftover after parsing attributes in process `syz.2.346'. [ 161.786747][ T4372] usb 4-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 161.872922][ T5536] netlink: 'syz.0.348': attribute type 2 has an invalid length. [ 161.890802][ T4372] usb 4-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 162.023496][ T4372] usb 4-1: string descriptor 0 read error: -71 [ 162.033330][ T5527] ALSA: mixer_oss: invalid OSS volume '' [ 162.086051][ T4372] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 162.155954][ T4372] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.192232][ T5542] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 162.580060][ T4372] usb 4-1: can't set config #1, error -71 [ 162.635585][ T4372] usb 4-1: USB disconnect, device number 7 [ 162.880984][ T1173] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 163.070807][ T1173] usb 3-1: Using ep0 maxpacket: 16 [ 163.079185][ T1173] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 163.136709][ T1173] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 163.899303][ T5555] ip_tables: iptables: counters copy to user failed while replacing table [ 163.932128][ T1173] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 163.950433][ T5561] loop4: detected capacity change from 0 to 512 [ 163.999813][ T1173] usb 3-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 164.014776][ T5561] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 164.064518][ T5563] ip_tables: iptables: counters copy to user failed while replacing table [ 164.100917][ T1173] usb 3-1: config 0 interface 0 has no altsetting 0 [ 164.140261][ T5561] EXT4-fs (loop4): 1 truncate cleaned up [ 164.146191][ T1173] usb 3-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 164.155718][ T5561] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 164.186000][ T1173] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 164.211635][ T5561] EXT4-fs error (device loop4): __ext4_expand_extra_isize:5972: inode #12: comm syz.4.344: bad extra_isize 62 (inode size 256) [ 164.271743][ T1173] usb 3-1: config 0 descriptor?? [ 164.318893][ T5566] EXT4-fs error (device loop4): __ext4_expand_extra_isize:5972: inode #12: comm syz.4.344: bad extra_isize 62 (inode size 256) [ 164.348232][ T5568] netlink: 16 bytes leftover after parsing attributes in process `syz.1.357'. [ 164.384503][ T5566] EXT4-fs error (device loop4): __ext4_expand_extra_isize:5972: inode #12: comm syz.4.344: bad extra_isize 62 (inode size 256) [ 164.424661][ T5568] netlink: 16 bytes leftover after parsing attributes in process `syz.1.357'. [ 164.493200][ T5566] EXT4-fs error (device loop4): __ext4_expand_extra_isize:5972: inode #12: comm syz.4.344: bad extra_isize 62 (inode size 256) [ 164.689616][ T1173] usbhid 3-1:0.0: can't add hid device: -71 [ 164.697785][ T1173] usbhid: probe of 3-1:0.0 failed with error -71 [ 164.749324][ T1173] usb 3-1: USB disconnect, device number 5 [ 164.774114][ T5573] loop1: detected capacity change from 0 to 2048 [ 164.809681][ T4274] EXT4-fs (loop4): unmounting filesystem. [ 164.882811][ T5573] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 165.102963][ T5579] loop0: detected capacity change from 0 to 256 [ 165.183923][ T5579] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 165.323205][ T5581] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 165.980427][ T5586] loop2: detected capacity change from 0 to 16 [ 166.010095][ T27] audit: type=1804 audit(1700006398.970:94): pid=5590 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.364" name="/newroot/71/file1" dev="fuse" ino=1 res=1 errno=0 [ 166.060330][ T5586] erofs: (device loop2): mounted with root inode @ nid 36. [ 166.086043][ T27] audit: type=1800 audit(1700006399.050:95): pid=5579 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.363" name="file1" dev="loop0" ino=1048644 res=0 errno=0 [ 166.181944][ T5586] erofs: (device loop2): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 166.246733][ T5586] syz.2.366: attempt to access beyond end of device [ 166.246733][ T5586] loop2: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 166.289552][ T5594] loop4: detected capacity change from 0 to 512 [ 166.345725][ T27] audit: type=1800 audit(1700006399.310:96): pid=5586 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.366" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 166.357270][ T5594] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 166.499949][ T5594] EXT4-fs (loop4): 1 truncate cleaned up [ 166.530551][ T5594] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 166.664026][ T4274] EXT4-fs (loop4): unmounting filesystem. [ 167.157639][ T5616] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 167.301329][ T5615] ip_tables: iptables: counters copy to user failed while replacing table [ 167.660803][ T27] audit: type=1804 audit(1700006400.620:97): pid=5624 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.378" name="/newroot/75/file1" dev="fuse" ino=1 res=1 errno=0 [ 167.856851][ T5631] loop3: detected capacity change from 0 to 2048 [ 167.937865][ T5631] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 168.115673][ T27] audit: type=1800 audit(1700006401.080:98): pid=5631 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.362" name="file2" dev="loop3" ino=1347 res=0 errno=0 [ 168.276222][ T5637] loop0: detected capacity change from 0 to 512 [ 168.363038][ T5637] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 168.554710][ T1173] smpboot: CPU 1 is now offline [ 168.573396][ T5637] EXT4-fs (loop0): 1 truncate cleaned up [ 168.581729][ T5641] x86: Booting SMP configuration: [ 168.586824][ T5641] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 168.641205][ T5637] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 169.090237][ T4270] EXT4-fs (loop0): unmounting filesystem. [ 169.380699][ T5659] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 169.391515][ T5659] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 169.401413][ T5659] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 169.411927][ T5659] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 169.421936][ T5659] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 169.433853][ T5659] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 169.443750][ T5659] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 169.454254][ T5659] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 169.648652][ T5658] loop0: detected capacity change from 0 to 2048 [ 169.971103][ T5658] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 170.303057][ T5671] loop3: detected capacity change from 0 to 128 [ 170.695840][ T5679] loop0: detected capacity change from 0 to 2048 [ 170.742885][ T27] audit: type=1804 audit(1700006403.710:99): pid=5682 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.396" name="/newroot/78/file1" dev="fuse" ino=1 res=1 errno=0 [ 171.984280][ T5679] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 172.040678][ T27] audit: type=1804 audit(1700006405.000:100): pid=5679 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.397" name=2F6E6577726F6F742F3130312F66696C65302F02 dev="loop0" ino=18 res=1 errno=0 [ 172.071799][ T27] audit: type=1800 audit(1700006405.010:101): pid=5679 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.397" name=02 dev="loop0" ino=18 res=0 errno=0 [ 172.251471][ T4270] EXT4-fs (loop0): unmounting filesystem. [ 172.275772][ T5690] loop4: detected capacity change from 0 to 2048 [ 172.338392][ T5693] loop3: detected capacity change from 0 to 1024 [ 172.457989][ T5693] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 172.469058][ T5690] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 172.514927][ T5697] ip_tables: iptables: counters copy to user failed while replacing table [ 172.549223][ T27] audit: type=1800 audit(1700006405.510:102): pid=5690 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.400" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 172.569852][ T27] audit: type=1800 audit(1700006405.520:103): pid=5690 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.400" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 172.597440][ T5704] loop0: detected capacity change from 0 to 1024 [ 172.753381][ T27] audit: type=1800 audit(1700006405.720:104): pid=5690 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.400" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 172.781364][ T5704] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 172.802590][ T4279] EXT4-fs (loop3): unmounting filesystem. [ 172.932957][ T5710] loop2: detected capacity change from 0 to 256 [ 172.960517][ T5704] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 173.022016][ T5710] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 173.298899][ T4274] EXT4-fs (loop4): unmounting filesystem. [ 173.786272][ T27] audit: type=1800 audit(1700006399.040:105): pid=5710 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.407" name="file1" dev="loop2" ino=1048647 res=0 errno=0 [ 173.828242][ T5725] loop4: detected capacity change from 0 to 8 [ 173.886964][ T4270] EXT4-fs (loop0): unmounting filesystem. [ 173.950959][ T5725] unable to read inode lookup table [ 174.120695][ T5731] bridge0: port 1(bridge_slave_0) entered disabled state [ 174.205733][ T5731] Zero length message leads to an empty skb [ 174.389771][ T5741] loop3: detected capacity change from 0 to 1024 [ 174.416716][ T5744] netlink: 12 bytes leftover after parsing attributes in process `syz.0.418'. [ 174.618420][ T5741] EXT4-fs: Ignoring removed oldalloc option [ 174.700974][ T5741] EXT4-fs: Ignoring removed oldalloc option [ 174.751377][ T5741] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 174.788621][ T5748] loop4: detected capacity change from 0 to 512 [ 174.808941][ T5738] loop2: detected capacity change from 0 to 8192 [ 174.851501][ T5748] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 174.876482][ T5741] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 174.892089][ T5752] loop0: detected capacity change from 0 to 128 [ 174.902791][ T5751] loop1: detected capacity change from 0 to 512 [ 174.932920][ T5738] syz.2.416: attempt to access beyond end of device [ 174.932920][ T5738] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 174.953704][ T27] audit: type=1800 audit(1700006400.210:106): pid=5741 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.417" name="bus" dev="loop3" ino=18 res=0 errno=0 [ 174.987206][ T5751] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 174.998732][ T5748] EXT4-fs (loop4): 1 truncate cleaned up [ 175.118409][ T5757] syz.0.423: attempt to access beyond end of device [ 175.118409][ T5757] loop0: rw=2049, sector=145, nr_sectors = 40 limit=128 [ 175.132611][ T5748] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 175.150615][ T5738] Buffer I/O error on dev loop2, logical block 57847, async page read [ 175.183070][ T5751] EXT4-fs (loop1): 1 truncate cleaned up [ 175.240450][ T5751] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 175.254381][ T4279] EXT4-fs (loop3): unmounting filesystem. [ 175.300479][ T27] audit: type=1800 audit(1700006400.550:107): pid=5738 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.416" name="file2" dev="loop2" ino=1048649 res=0 errno=0 [ 175.332409][ T5759] EXT4-fs error (device loop4): __ext4_expand_extra_isize:5972: inode #12: comm syz.4.421: bad extra_isize 62 (inode size 256) [ 175.405845][ T77] kworker/u4:4: attempt to access beyond end of device [ 175.405845][ T77] loop0: rw=1, sector=150, nr_sectors = 1 limit=128 [ 175.439947][ T5759] EXT4-fs (loop4): Remounting filesystem read-only [ 175.446844][ T77] Buffer I/O error on dev loop0, logical block 150, lost async page write [ 175.527604][ T5759] EXT4-fs error (device loop4): __ext4_expand_extra_isize:5972: inode #12: comm syz.4.421: bad extra_isize 62 (inode size 256) [ 175.574036][ T27] audit: type=1326 audit(1700006400.830:108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5762 comm="syz.3.424" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fda67b9f559 code=0x0 [ 175.674111][ T5759] EXT4-fs (loop4): Remounting filesystem read-only [ 175.716909][ T4278] EXT4-fs (loop1): unmounting filesystem. [ 175.858332][ T4274] EXT4-fs (loop4): unmounting filesystem. [ 175.915589][ T5773] loop3: detected capacity change from 0 to 512 [ 175.967649][ T5774] loop1: detected capacity change from 0 to 1024 [ 176.035735][ T5773] EXT4-fs error (device loop3): mb_free_blocks:1839: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 176.109967][ T5781] loop4: detected capacity change from 0 to 2048 [ 176.123196][ T5774] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 176.144064][ T5773] EXT4-fs error (device loop3): ext4_do_update_inode:5279: inode #11: comm syz.3.429: corrupted inode contents [ 176.174554][ T5774] ext4 filesystem being mounted at /87/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 176.203228][ T5781] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 176.232711][ T5773] EXT4-fs error (device loop3): ext4_dirty_inode:6166: inode #11: comm syz.3.429: mark_inode_dirty error [ 176.246394][ T5774] EXT4-fs error (device loop1): ext4_free_blocks:6220: comm syz.1.428: Freeing blocks not in datazone - block = 0, count = 16 [ 176.302276][ T5773] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.429: invalid indirect mapped block 1 (level 1) [ 176.317743][ T5774] EXT4-fs (loop1): Remounting filesystem read-only [ 176.357171][ T5773] EXT4-fs error (device loop3): ext4_do_update_inode:5279: inode #11: comm syz.3.429: corrupted inode contents [ 176.432565][ T5773] EXT4-fs error (device loop3) in ext4_orphan_del:303: Corrupt filesystem [ 176.444797][ T4278] EXT4-fs (loop1): unmounting filesystem. [ 176.464293][ T4317] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 176.491212][ T5773] EXT4-fs error (device loop3): ext4_do_update_inode:5279: inode #11: comm syz.3.429: corrupted inode contents [ 176.538406][ T5773] EXT4-fs error (device loop3): ext4_truncate:4325: inode #11: comm syz.3.429: mark_inode_dirty error [ 177.780629][ T5773] EXT4-fs error (device loop3) in ext4_process_orphan:345: Corrupt filesystem [ 177.818384][ T5800] loop2: detected capacity change from 0 to 128 [ 177.848488][ T5773] EXT4-fs (loop3): 1 truncate cleaned up [ 177.862478][ T4317] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 178.613394][ T4289] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 178.620923][ T5773] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 178.652085][ T4317] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 178.686401][ T5773] EXT4-fs (loop3): unmounting filesystem. [ 178.714459][ T4317] usb 1-1: New USB device found, idVendor=0552, idProduct=5510, bcdDevice= 0.00 [ 178.738246][ T5805] loop1: detected capacity change from 0 to 1024 [ 178.760789][ T4317] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 178.799557][ T4317] usb 1-1: Product: syz [ 178.804044][ T4317] usb 1-1: Manufacturer: syz [ 178.861351][ T5805] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 178.895794][ T5805] ext4 filesystem being mounted at /89/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 178.968707][ T5805] EXT4-fs error (device loop1): ext4_map_blocks:747: inode #15: block 3: comm syz.1.440: lblock 3 mapped to illegal pblock 3 (length 3) [ 179.053773][ T5805] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 179.099246][ T5814] loop4: detected capacity change from 0 to 2048 [ 179.123611][ T5805] EXT4-fs (loop1): This should not happen!! Data will be lost [ 179.123611][ T5805] [ 179.172827][ T5813] EXT4-fs error (device loop1): ext4_map_blocks:637: inode #15: block 3: comm syz.1.440: lblock 3 mapped to illegal pblock 3 (length 1) [ 179.209450][ T5814] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 179.228681][ T5817] EXT4-fs (loop3): 1 truncate cleaned up [ 179.240202][ T5818] EXT4-fs error (device loop1): ext4_free_blocks:6220: comm syz.1.440: Freeing blocks not in datazone - block = 3, count = 1 [ 179.263457][ T5817] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 179.279557][ T5814] ext4 filesystem being mounted at /80/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 179.302285][ T5818] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.440: bg 0: block 112: padding at end of block bitmap is not set [ 179.321525][ T5817] EXT4-fs error (device loop3): ext4_map_blocks:637: inode #2: block 4: comm syz.3.445: lblock 0 mapped to illegal pblock 4 (length 1) [ 179.376814][ T5818] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 16 with max blocks 52 with error 28 [ 179.402735][ T5817] EXT4-fs (loop3): Remounting filesystem read-only [ 179.429031][ T5814] fs-verity: sha512 using implementation "sha512-avx2" [ 179.438828][ T5818] EXT4-fs (loop1): This should not happen!! Data will be lost [ 179.438828][ T5818] [ 179.476459][ T5814] fs-verity (loop4, inode 13): Error -28 writing Merkle tree block 1 [ 179.484909][ T5818] EXT4-fs (loop1): Total free blocks count 0 [ 179.501486][ T4279] EXT4-fs (loop3): unmounting filesystem. [ 179.509608][ T5818] EXT4-fs (loop1): Free/Dirty block details [ 179.529604][ T5814] fs-verity (loop4, inode 13): Error -28 building Merkle tree [ 179.548363][ T5818] EXT4-fs (loop1): free_blocks=0 [ 179.580968][ T5818] EXT4-fs (loop1): dirty_blocks=64 [ 179.586107][ T5818] EXT4-fs (loop1): Block reservation details [ 179.634780][ T4274] EXT4-fs (loop4): unmounting filesystem. [ 179.723913][ T5824] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x9f0f4494, utbl_chksum : 0xe619d30d) [ 179.736672][ T4544] EXT4-fs error (device loop1): ext4_map_blocks:747: inode #15: block 8: comm kworker/u4:8: lblock 8 mapped to illegal pblock 8 (length 8) [ 179.770664][ T4339] usb 1-1: USB disconnect, device number 3 [ 179.906579][ T5830] ip_tables: iptables: counters copy to user failed while replacing table [ 179.915439][ T4317] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 180.102976][ T4317] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 180.125437][ T4317] usb 4-1: config 0 has no interfaces? [ 180.883544][ T4317] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 180.920799][ T4317] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 180.941978][ T4317] usb 4-1: Product: syz [ 180.946162][ T4317] usb 4-1: Manufacturer: syz [ 180.970832][ T4317] usb 4-1: SerialNumber: syz [ 180.997377][ T4317] usb 4-1: config 0 descriptor?? [ 181.020869][ T4372] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 181.220812][ T4372] usb 3-1: Using ep0 maxpacket: 8 [ 181.228564][ T4372] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 181.259333][ T4372] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 181.279566][ T4372] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 181.292724][ T4372] usb 3-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 181.312200][ T4372] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.320219][ T4372] usb 3-1: Product: syz [ 181.342152][ T4372] usb 3-1: Manufacturer: syz [ 181.357113][ T4372] usb 3-1: SerialNumber: syz [ 181.362488][ T27] audit: type=1804 audit(1700006406.620:109): pid=5845 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.453" name="/newroot/110/file1" dev="fuse" ino=1 res=1 errno=0 [ 181.510981][ T1173] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 181.539176][ T5850] set_capacity_and_notify: 2 callbacks suppressed [ 181.539236][ T5850] loop1: detected capacity change from 0 to 512 [ 181.555169][ T5850] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 181.569550][ T5850] EXT4-fs (loop1): 1 truncate cleaned up [ 181.577341][ T5850] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 181.659871][ T4278] EXT4-fs (loop1): unmounting filesystem. [ 181.702483][ T1173] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 181.714023][ T1173] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 181.728949][ T1173] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 181.753854][ T1173] usb 5-1: config 1 has no interface number 0 [ 181.767905][ T1173] usb 5-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 181.797809][ T1173] usb 5-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 181.826053][ T1173] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 181.847557][ T1173] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.873068][ T1173] usb 5-1: Product: syz [ 181.879262][ T1173] usb 5-1: Manufacturer: syz [ 181.887281][ T1173] usb 5-1: SerialNumber: syz [ 182.671249][ T4372] usb 3-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 182.681794][ T4372] usb 3-1: clock source 0 is not valid, cannot use [ 182.689247][ T1173] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 182.706155][ T1173] cdc_ncm 5-1:1.1: bind() failure [ 182.753605][ T4339] usb 4-1: USB disconnect, device number 8 [ 182.804747][ T5861] binder: 5860:5861 ioctl c0306201 0 returned -14 [ 182.870006][ T1173] usb 5-1: USB disconnect, device number 8 [ 182.884992][ T5840] ALSA: mixer_oss: invalid OSS volume '' [ 182.917497][ T4372] usb 3-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 183.054894][ T4372] usb 3-1: USB disconnect, device number 6 [ 183.275384][ T5873] loop0: detected capacity change from 0 to 512 [ 183.306680][ T5873] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 183.323838][ T4287] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:200' [ 183.334311][ T4287] CPU: 1 PID: 4287 Comm: kworker/u5:8 Not tainted syzkaller #0 [ 183.341889][ T4287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 183.351956][ T4287] Workqueue: hci4 hci_rx_work [ 183.356678][ T4287] Call Trace: [ 183.359969][ T4287] [ 183.362916][ T4287] dump_stack_lvl+0x188/0x24e [ 183.367613][ T4287] ? show_regs_print_info+0x12/0x12 [ 183.372762][ T1173] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 183.372822][ T4287] ? load_image+0x410/0x410 [ 183.384891][ T4287] sysfs_create_dir_ns+0x26a/0x290 [ 183.390047][ T4287] ? __lock_acquire+0x7ea0/0x7ea0 [ 183.395088][ T4287] ? sysfs_warn_dup+0xa0/0xa0 [ 183.399767][ T4287] ? do_raw_spin_unlock+0x11d/0x230 [ 183.404962][ T4287] kobject_add_internal+0x617/0xca0 [ 183.410160][ T4287] kobject_add+0x160/0x230 [ 183.414599][ T4287] ? kobject_init+0x1c0/0x1c0 [ 183.419274][ T4287] ? __raw_spin_lock_init+0x41/0x100 [ 183.424550][ T4287] ? klist_children_get+0x50/0x50 [ 183.429565][ T4287] ? get_device_parent+0x121/0x3e0 [ 183.434681][ T4287] device_add+0x470/0x1050 [ 183.439100][ T4287] hci_conn_add_sysfs+0xd1/0x1e0 [ 183.444046][ T4287] hci_sync_conn_complete_evt+0x707/0xab0 [ 183.449768][ T4287] ? hci_remote_ext_features_evt+0xb50/0xb50 [ 183.455761][ T4287] hci_event_packet+0x806/0x1290 [ 183.460701][ T4287] ? lock_chain_count+0x20/0x20 [ 183.465558][ T4287] ? bis_list+0x280/0x280 [ 183.469879][ T4287] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 183.475777][ T4287] ? kcov_remote_start+0x50f/0x810 [ 183.480885][ T4287] ? lockdep_hardirqs_on+0x94/0x140 [ 183.486089][ T4287] ? hci_send_to_monitor+0x9c/0x4a0 [ 183.491287][ T4287] hci_rx_work+0x3eb/0xd40 [ 183.495700][ T4287] ? _raw_spin_unlock+0x40/0x40 [ 183.500554][ T4287] ? process_one_work+0x7b4/0x1160 [ 183.505665][ T4287] process_one_work+0x8ab/0x1160 [ 183.510606][ T4287] ? worker_detach_from_pool+0x240/0x240 [ 183.516234][ T4287] ? _raw_spin_lock_irq+0xb7/0xf0 [ 183.521255][ T4287] ? _raw_spin_lock_irqsave+0x100/0x100 [ 183.526798][ T4287] ? wq_worker_running+0x97/0x190 [ 183.531820][ T4287] worker_thread+0xaf5/0x12a0 [ 183.536504][ T4287] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 183.542403][ T4287] kthread+0x29d/0x330 [ 183.546461][ T4287] ? worker_clr_flags+0x1a0/0x1a0 [ 183.551478][ T4287] ? kthread_blkcg+0xd0/0xd0 [ 183.556058][ T4287] ret_from_fork+0x1f/0x30 [ 183.560480][ T4287] [ 183.564037][ T4287] kobject_add_internal failed for hci4:200 with -EEXIST, don't try to register things with the same name in the same directory. [ 183.577422][ T4287] Bluetooth: hci4: failed to register connection device [ 183.602266][ T5873] EXT4-fs (loop0): 1 truncate cleaned up [ 183.608029][ T5873] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 183.761823][ T4270] EXT4-fs (loop0): unmounting filesystem. [ 183.792747][ T1173] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 183.823803][ T1173] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 183.870329][ T1173] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 0 [ 183.918388][ T1173] usb 5-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 184.737765][ T1173] usb 5-1: New USB device found, idVendor=0552, idProduct=5510, bcdDevice= 0.00 [ 184.785315][ T1173] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 184.832536][ T1173] usb 5-1: Product: syz [ 185.536959][ T5889] Cannot find add_set index 1 as target [ 185.587100][ T4287] Bluetooth: hci3: command 0x0406 tx timeout [ 185.593818][ T4271] Bluetooth: hci2: command 0x0406 tx timeout [ 185.614100][ T1173] usb 5-1: Manufacturer: syz [ 185.650918][ T4286] Bluetooth: hci4: command 0x0409 tx timeout [ 185.891925][ T4286] Bluetooth: hci1: command 0x0406 tx timeout [ 185.897970][ T4286] Bluetooth: hci0: command 0x0406 tx timeout [ 186.264594][ T5896] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 186.275143][ T5896] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 186.285018][ T5896] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 186.295516][ T5896] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 186.305496][ T5896] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 186.315984][ T5896] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 186.325831][ T5896] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 186.337198][ T5896] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 186.514736][ T4339] usb 5-1: USB disconnect, device number 9 [ 186.868961][ T5899] loop4: detected capacity change from 0 to 512 [ 186.985478][ T5899] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 187.026549][ T5899] ext4 filesystem being mounted at /83/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 187.216407][ T5899] Quota error (device loop4): do_check_range: Getting dqdh_next_free 4294967294 out of range 0-8 [ 187.292275][ T5899] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 187.359165][ T5899] EXT4-fs error (device loop4): ext4_acquire_dquot:6841: comm syz.4.474: Failed to acquire dquot type 0 [ 187.535919][ T4274] EXT4-fs (loop4): unmounting filesystem. [ 187.668048][ T27] audit: type=1804 audit(1700006412.920:110): pid=5914 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.470" name="/newroot/99/file1" dev="fuse" ino=1 res=1 errno=0 [ 187.708678][ T5917] Bluetooth: MGMT ver 1.22 [ 187.730823][ T4287] Bluetooth: hci4: command 0x0406 tx timeout [ 187.750912][ T4339] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 187.942621][ T4339] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 187.953196][ T4339] usb 1-1: config 0 has no interfaces? [ 187.960482][ T4339] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 187.970705][ T4339] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 187.978945][ T4339] usb 1-1: Product: syz [ 187.983460][ T4339] usb 1-1: Manufacturer: syz [ 187.988239][ T4339] usb 1-1: SerialNumber: syz [ 187.995461][ T4339] usb 1-1: config 0 descriptor?? [ 188.180962][ T5925] loop2: detected capacity change from 0 to 1024 [ 188.210669][ T5929] loop4: detected capacity change from 0 to 256 [ 188.220802][ T5925] hfsplus: failed to load catalog file [ 188.256991][ T5929] FAT-fs (loop4): Invalid FSINFO signature: 0x00fffff8, 0x00000000 (sector = 1) [ 189.144180][ T48] FAT-fs (loop4): Invalid FSINFO signature: 0x00fffff8, 0x00000000 (sector = 1) [ 189.160679][ T5935] loop2: detected capacity change from 0 to 16 [ 189.193217][ T5935] erofs: (device loop2): mounted with root inode @ nid 36. [ 189.241914][ T5935] syz.2.486: attempt to access beyond end of device [ 189.241914][ T5935] loop2: rw=524288, sector=16, nr_sectors = 32 limit=16 [ 189.312746][ T5935] syz.2.486: attempt to access beyond end of device [ 189.312746][ T5935] loop2: rw=524288, sector=8, nr_sectors = 32 limit=16 [ 189.810806][ T4287] Bluetooth: hci4: command 0x0411 tx timeout [ 189.831356][ T27] audit: type=1326 audit(1700006415.090:111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5953 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 189.861376][ T27] audit: type=1326 audit(1700006415.090:112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5953 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 189.948142][ T27] audit: type=1326 audit(1700006415.090:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5953 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 189.986428][ T27] audit: type=1326 audit(1700006415.090:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5953 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=22 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 190.021475][ T27] audit: type=1326 audit(1700006415.090:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5953 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 190.050762][ T27] audit: type=1326 audit(1700006415.090:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5953 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 190.063734][ T5963] loop3: detected capacity change from 0 to 128 [ 190.079965][ T27] audit: type=1326 audit(1700006415.090:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5953 comm="syz.2.496" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad26f9f559 code=0x7ffc0000 [ 190.101693][ T5963] EXT4-fs: Ignoring removed i_version option [ 190.155879][ T5963] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 190.170125][ T5963] ext4 filesystem being mounted at /88/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 190.255968][ T4279] EXT4-fs (loop3): unmounting filesystem. [ 190.322318][ T5968] device syz_tun entered promiscuous mode [ 190.329392][ T5967] device syz_tun left promiscuous mode [ 190.457163][ T4339] usb 1-1: USB disconnect, device number 4 [ 190.571095][ T4317] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 190.645409][ T5983] loop0: detected capacity change from 0 to 512 [ 190.662355][ T5983] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 190.670450][ T5983] System zones: 1-12 [ 190.689728][ T5983] EXT4-fs error (device loop0): ext4_xattr_inode_iget:401: inode #12: comm syz.0.504: missing EA_INODE flag [ 190.724272][ T5983] EXT4-fs error (device loop0): ext4_xattr_inode_iget:406: comm syz.0.504: error while reading EA inode 12 err=-117 [ 190.743636][ T5983] EXT4-fs (loop0): 1 orphan inode deleted [ 190.759651][ T5983] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 190.771236][ T4317] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 190.783232][ T4317] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 190.816045][ T4317] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 190.825437][ T4317] usb 3-1: config 1 has no interface number 0 [ 190.831792][ T4317] usb 3-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 190.844601][ T4317] usb 3-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 190.894887][ T4317] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 190.922538][ T4317] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 190.945437][ T4317] usb 3-1: Product: syz [ 191.062783][ T4317] usb 3-1: Manufacturer: syz [ 191.072874][ T4317] usb 3-1: SerialNumber: syz [ 191.087788][ T4317] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 191.103535][ T4317] cdc_ncm 3-1:1.1: bind() failure [ 191.333463][ T5953] ALSA: mixer_oss: invalid OSS volume '' [ 191.351659][ T4317] usb 3-1: USB disconnect, device number 7 [ 191.589278][ T4270] EXT4-fs (loop0): unmounting filesystem. [ 191.670351][ T5997] loop0: detected capacity change from 0 to 128 [ 191.679732][ T5998] xt_hashlimit: max too large, truncated to 1048576 [ 191.687471][ T5997] EXT4-fs: Ignoring removed i_version option [ 191.693827][ T5998] xt_hashlimit: overflow, try lower: 137438953472/8 [ 191.702693][ T5998] x_tables: duplicate underflow at hook 2 [ 191.716489][ T5997] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 191.732767][ T5997] ext4 filesystem being mounted at /120/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 191.936051][ T4270] EXT4-fs (loop0): unmounting filesystem. [ 192.075103][ T6007] loop4: detected capacity change from 0 to 512 [ 192.103819][ T6006] loop2: detected capacity change from 0 to 2048 [ 192.128129][ T6006] EXT4-fs: Ignoring removed i_version option [ 192.154331][ T6007] EXT4-fs (loop4): 1 truncate cleaned up [ 192.199578][ T6007] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 192.282146][ T6006] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 192.290626][ T6006] ext4 filesystem being mounted at /97/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 192.305641][ T6004] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.514: bg 0: block 465: padding at end of block bitmap is not set [ 192.338514][ T6014] loop0: detected capacity change from 0 to 128 [ 192.587114][ T4282] EXT4-fs (loop2): unmounting filesystem. [ 192.633640][ T6016] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 192.650212][ T48] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 192.821241][ T4274] EXT4-fs (loop4): unmounting filesystem. [ 192.856452][ T48] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 192.909266][ T4287] Bluetooth: hci2: Malformed Event: 0x13 [ 192.947160][ T6022] netlink: 'syz.2.520': attribute type 9 has an invalid length. [ 192.958987][ T6022] netlink: 'syz.2.520': attribute type 7 has an invalid length. [ 192.983607][ T6022] netlink: 'syz.2.520': attribute type 8 has an invalid length. [ 193.038830][ T48] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.059715][ T6024] syz.4.521 (6024): drop_caches: 2 [ 193.094481][ T6024] syz.4.521 (6024): drop_caches: 2 [ 193.158166][ T48] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.915720][ T1278] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.030913][ T1278] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.321537][ T6034] netlink: 128 bytes leftover after parsing attributes in process `syz.0.523'. [ 194.448869][ T4286] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 194.460766][ T4286] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 194.468522][ T4286] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 194.481118][ T4286] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 194.491213][ T4286] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 194.498466][ T4286] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 194.705988][ T6036] rxe_eth0 speed is unknown, defaulting to 1000 [ 195.221573][ T6062] loop0: detected capacity change from 0 to 512 [ 195.461603][ T6062] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 195.990547][ T6036] chnl_net:caif_netlink_parms(): no params data found [ 196.252544][ T6036] bridge0: port 1(bridge_slave_0) entered blocking state [ 196.281440][ T6036] bridge0: port 1(bridge_slave_0) entered disabled state [ 196.309694][ T6036] device bridge_slave_0 entered promiscuous mode [ 196.530977][ T4287] Bluetooth: hci4: command 0x0409 tx timeout [ 197.169971][ T6096] loop1: detected capacity change from 0 to 512 [ 197.189407][ T4270] EXT4-fs (loop0): unmounting filesystem. [ 197.355932][ T6096] EXT4-fs error (device loop1): ext4_orphan_get:1409: inode #15: comm syz.1.531: iget: bad i_size value: 38620345925642 [ 197.455005][ T6096] EXT4-fs error (device loop1): ext4_orphan_get:1414: comm syz.1.531: couldn't read orphan inode 15 (err -117) [ 197.510188][ T6036] bridge0: port 2(bridge_slave_1) entered blocking state [ 197.528019][ T6036] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.541395][ T6096] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 197.551580][ T6036] device bridge_slave_1 entered promiscuous mode [ 197.728870][ T6104] EXT4-fs error (device loop1): ext4_validate_block_bitmap:429: comm syz.1.531: bg 0: block 5: invalid block bitmap [ 197.857157][ T6104] EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 184 with error 28 [ 197.876599][ T6036] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 197.916607][ T6036] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 197.979725][ T6104] EXT4-fs (loop1): This should not happen!! Data will be lost [ 197.979725][ T6104] [ 198.034973][ T6104] EXT4-fs (loop1): Total free blocks count 0 [ 198.079100][ T6104] EXT4-fs (loop1): Free/Dirty block details [ 198.106218][ T6036] team0: Port device team_slave_0 added [ 198.125820][ T6104] EXT4-fs (loop1): free_blocks=0 [ 198.151517][ T6036] team0: Port device team_slave_1 added [ 198.156544][ T6104] EXT4-fs (loop1): dirty_blocks=188 [ 198.204622][ T6104] EXT4-fs (loop1): Block reservation details [ 198.261471][ T6036] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 198.276568][ T6104] EXT4-fs (loop1): i_reserved_data_blocks=188 [ 198.281639][ T6036] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 198.378282][ T6036] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 198.451059][ T48] device hsr_slave_0 left promiscuous mode [ 198.489252][ T48] device hsr_slave_1 left promiscuous mode [ 198.538011][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 198.570373][ T48] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 198.588258][ T4278] EXT4-fs (loop1): unmounting filesystem. [ 198.611130][ T4287] Bluetooth: hci4: command 0x041b tx timeout [ 198.662657][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 198.800332][ T48] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 198.841547][ T48] device bridge_slave_1 left promiscuous mode [ 198.849566][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 198.911436][ T6118] loop2: detected capacity change from 0 to 16 [ 198.918992][ T48] device bridge_slave_0 left promiscuous mode [ 198.950263][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 199.002516][ T6118] erofs: (device loop2): mounted with root inode @ nid 36. [ 199.046445][ T6118] erofs: (device loop2): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 199.111262][ T6118] syz.2.524: attempt to access beyond end of device [ 199.111262][ T6118] loop2: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 199.137273][ T48] device veth1_macvtap left promiscuous mode [ 199.162213][ T48] device veth0_macvtap left promiscuous mode [ 199.185033][ T48] device veth1_vlan left promiscuous mode [ 199.201426][ T48] device veth0_vlan left promiscuous mode [ 199.375064][ T6118] erofs: (device loop2): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 199.456117][ T6118] syz.2.524: attempt to access beyond end of device [ 199.456117][ T6118] loop2: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 199.601152][ T6118] syz.2.524: attempt to access beyond end of device [ 199.601152][ T6118] loop2: rw=0, sector=34359738360, nr_sectors = 8 limit=16 [ 199.727338][ T27] kauditd_printk_skb: 109 callbacks suppressed [ 199.727353][ T27] audit: type=1800 audit(1700006424.980:227): pid=6118 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.524" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 199.913501][ T6118] syz.2.524 (6118) used greatest stack depth: 19088 bytes left [ 199.992963][ T6131] binder: 6130:6131 ioctl 4018620d 0 returned -22 [ 200.162222][ T6135] binder: 6130:6135 ioctl c018620b 0 returned -14 [ 200.410888][ T4317] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 200.612823][ T4317] usb 3-1: config 0 has too many interfaces: 223, using maximum allowed: 32 [ 200.639944][ T4317] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 200.691222][ T4287] Bluetooth: hci4: command 0x040f tx timeout [ 200.709438][ T4317] usb 3-1: config 0 has 2 interfaces, different from the descriptor's value: 223 [ 200.747209][ T4317] usb 3-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 200.783301][ T4317] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 200.851581][ T4317] usb 3-1: config 0 descriptor?? [ 200.900245][ T4317] usb 3-1: Found UVC 9.00 device (046d:0825) [ 201.377048][ T48] team0 (unregistering): Port device team_slave_1 removed [ 201.456558][ T4317] usb 3-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 201.476602][ T48] team0 (unregistering): Port device team_slave_0 removed [ 201.507108][ T4317] uvcvideo 3-1:0.1: Failed to query (129) UVC probe control : 0 (exp. 48). [ 201.566224][ T48] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 201.601198][ T4317] uvcvideo 3-1:0.1: Failed to initialize the device (-5). [ 201.654376][ T48] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 201.765187][ T4317] usb 3-1: USB disconnect, device number 8 [ 202.469758][ T6159] ip_tables: iptables: counters copy to user failed while replacing table [ 202.517569][ T6163] ip_tables: iptables: counters copy to user failed while replacing table [ 203.173378][ T6162] Cannot find add_set index 1 as target [ 203.227382][ T4287] Bluetooth: hci4: command 0x0419 tx timeout [ 203.252644][ T48] bond0 (unregistering): Released all slaves [ 203.357182][ T6036] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 203.368797][ T6036] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 203.419446][ T6036] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 203.583703][ T6166] EXT4-fs (sda1): shut down requested (0) [ 203.598074][ T6036] device hsr_slave_0 entered promiscuous mode [ 203.634461][ T6036] device hsr_slave_1 entered promiscuous mode [ 204.077712][ T6176] loop1: detected capacity change from 0 to 1024 [ 204.173080][ T6176] hfsplus: failed to load root directory [ 204.285776][ T6036] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 205.536647][ T6036] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 205.569122][ T6036] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 205.593608][ T6036] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 205.865757][ T6036] 8021q: adding VLAN 0 to HW filter on device bond0 [ 205.888543][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 205.905719][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 205.917566][ T6036] 8021q: adding VLAN 0 to HW filter on device team0 [ 205.939513][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 205.957051][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 205.973988][ T77] bridge0: port 1(bridge_slave_0) entered blocking state [ 205.981103][ T77] bridge0: port 1(bridge_slave_0) entered forwarding state [ 206.004356][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 206.016965][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 206.030375][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 206.045850][ T77] bridge0: port 2(bridge_slave_1) entered blocking state [ 206.052947][ T77] bridge0: port 2(bridge_slave_1) entered forwarding state [ 206.067938][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 206.080386][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 206.136387][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 206.155471][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 206.170312][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 206.188683][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 206.220445][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 206.253618][ T4544] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 206.269208][ T4544] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 206.282870][ T4544] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 206.293972][ T4544] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 206.311740][ T6036] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 206.347718][ T4544] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 206.360514][ T4544] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 206.377683][ T6036] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 206.428984][ T4544] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 206.443911][ T4544] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 206.468056][ T4563] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 206.490353][ T4563] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 206.527072][ T6036] device veth0_vlan entered promiscuous mode [ 206.550656][ T4563] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 206.580482][ T4563] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 206.613591][ T6036] device veth1_vlan entered promiscuous mode [ 207.262720][ T6229] Cannot find add_set index 1 as target [ 207.366051][ T4563] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 207.462576][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 207.482210][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 207.501185][ T6036] device veth0_macvtap entered promiscuous mode [ 207.519484][ T6036] device veth1_macvtap entered promiscuous mode [ 207.546311][ T6234] loop1: detected capacity change from 0 to 512 [ 207.559196][ T6036] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 207.586417][ T6036] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 207.598889][ T6036] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 207.614755][ T6036] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 207.627255][ T6036] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 207.643125][ T6036] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 207.670765][ T6036] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 207.687840][ T6234] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 207.710249][ T6036] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 207.752861][ T6036] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 207.811156][ T6234] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 207.820266][ T6234] EXT4-fs (loop1): orphan cleanup on readonly fs [ 207.827861][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 207.836900][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 207.850278][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 207.859843][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 207.873263][ T6036] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 207.887535][ T6234] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:477: comm syz.1.554: Invalid block bitmap block 0 in block_group 0 [ 207.911395][ T6036] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 207.931187][ T6036] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 207.941827][ T6036] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 207.957106][ T6036] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 207.958858][ T6240] loop2: detected capacity change from 0 to 128 [ 207.974215][ T6036] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 207.994194][ T6036] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 208.014845][ T6036] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 208.014986][ T6234] Quota error (device loop1): write_blk: dquota write failed [ 208.032539][ T6036] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 208.046030][ T4544] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 208.056889][ T4544] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 208.088931][ T6036] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 208.106766][ T6036] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 208.130925][ T6240] EXT4-fs (loop2): mounting ext2 file system using the ext4 subsystem [ 208.153788][ T6036] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 208.162793][ T6234] Quota error (device loop1): qtree_write_dquot: Error -28 occurred while creating quota [ 208.207478][ T6036] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 208.230942][ T6234] EXT4-fs error (device loop1): ext4_acquire_dquot:6841: comm syz.1.554: Failed to acquire dquot type 1 [ 208.262609][ T6240] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 208.311367][ T6240] ext2 filesystem being mounted at /107/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 208.340803][ T6234] EXT4-fs (loop1): 1 orphan inode deleted [ 208.358203][ T4544] Quota error (device loop1): do_check_range: Getting block 0 out of range 1-5 [ 208.369401][ T4544] EXT4-fs error (device loop1): ext4_release_dquot:6877: comm kworker/u4:8: Failed to release dquot type 1 [ 208.410124][ T6244] netlink: 'syz.4.544': attribute type 5 has an invalid length. [ 208.437623][ T6234] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 208.479253][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 208.497811][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 208.516609][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 208.545037][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 208.563548][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 208.576901][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 208.754841][ T4278] EXT4-fs (loop1): unmounting filesystem. [ 208.775198][ T4282] EXT4-fs (loop2): unmounting filesystem. [ 209.067277][ T27] audit: type=1326 audit(1700006434.320:228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6250 comm="syz.1.559" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b0ff9f559 code=0x7ffc0000 [ 209.101014][ T4339] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 209.101026][ T27] audit: type=1326 audit(1700006434.320:229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6250 comm="syz.1.559" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b0ff9f559 code=0x7ffc0000 [ 209.101057][ T27] audit: type=1326 audit(1700006434.320:230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6250 comm="syz.1.559" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b0ff9f559 code=0x7ffc0000 [ 209.161013][ T27] audit: type=1326 audit(1700006434.320:231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6250 comm="syz.1.559" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b0ff9f559 code=0x7ffc0000 [ 209.189784][ T27] audit: type=1326 audit(1700006434.320:232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6250 comm="syz.1.559" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=75 compat=0 ip=0x7f3b0ff9f559 code=0x7ffc0000 [ 209.230375][ T27] audit: type=1326 audit(1700006434.320:233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6250 comm="syz.1.559" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b0ff9f559 code=0x7ffc0000 [ 209.261124][ T4372] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 209.261938][ T27] audit: type=1326 audit(1700006434.320:234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6250 comm="syz.1.559" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b0ff9f559 code=0x7ffc0000 [ 209.292325][ T4339] usb 5-1: config 0 has an invalid interface number: 255 but max is 3 [ 209.300614][ T4339] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 4 [ 209.360788][ T4339] usb 5-1: config 0 has no interface number 0 [ 209.367547][ T4339] usb 5-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 209.417285][ T6256] netlink: 292 bytes leftover after parsing attributes in process `syz.1.561'. [ 209.457911][ T4339] usb 5-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 209.500809][ T4372] usb 3-1: Using ep0 maxpacket: 16 [ 209.507305][ T4372] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 209.550800][ T4339] usb 5-1: config 0 interface 255 has no altsetting 0 [ 209.557650][ T4339] usb 5-1: New USB device found, idVendor=0bda, idProduct=0177, bcdDevice=7d.0b [ 209.577085][ T4372] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 209.645357][ T4372] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 209.665303][ T4339] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.676061][ T6258] loop1: detected capacity change from 0 to 16 [ 209.710860][ T4372] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.725565][ T4339] usb 5-1: config 0 descriptor?? [ 209.730972][ T6258] erofs: (device loop1): mounted with root inode @ nid 36. [ 209.782645][ T4339] ums-realtek 5-1:0.255: USB Mass Storage device detected [ 209.801650][ T4372] usb 3-1: config 0 descriptor?? [ 209.822155][ T6258] syz.1.562: attempt to access beyond end of device [ 209.822155][ T6258] loop1: rw=524288, sector=16, nr_sectors = 32 limit=16 [ 209.890860][ T6258] syz.1.562: attempt to access beyond end of device [ 209.890860][ T6258] loop1: rw=524288, sector=8, nr_sectors = 32 limit=16 [ 210.015769][ T4317] usb 5-1: USB disconnect, device number 10 [ 210.025715][ T6264] loop0: detected capacity change from 0 to 512 [ 210.105821][ T6264] EXT4-fs (loop0): orphan cleanup on readonly fs [ 210.150914][ T6264] EXT4-fs warning (device loop0): ext4_enable_quotas:7093: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 210.207028][ T6264] EXT4-fs (loop0): Cannot turn on quotas: error -22 [ 210.239425][ T6268] loop1: detected capacity change from 0 to 512 [ 210.256448][ T6264] EXT4-fs error (device loop0): ext4_ext_check_inode:520: inode #13: comm syz.0.555: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 2048(2048) [ 210.289974][ T6268] EXT4-fs: inline encryption not supported [ 210.308777][ T6268] EXT4-fs: Invalid uid value -1 [ 210.341438][ T6264] EXT4-fs error (device loop0): ext4_orphan_get:1414: comm syz.0.555: couldn't read orphan inode 13 (err -117) [ 210.406639][ T6264] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 210.532112][ T6264] EXT4-fs error (device loop0): ext4_lookup:1860: comm syz.0.555: inode #15: comm syz.0.555: iget: illegal inode # [ 211.452378][ T4270] EXT4-fs (loop0): unmounting filesystem. [ 212.470447][ T4372] usbhid 3-1:0.0: can't add hid device: -71 [ 212.489698][ T4699] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 212.490545][ T4372] usbhid: probe of 3-1:0.0 failed with error -71 [ 212.521487][ T6289] loop0: detected capacity change from 0 to 128 [ 212.591075][ T6289] FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 212.623931][ T4372] usb 3-1: USB disconnect, device number 9 SYZFAIL: posix_spawnp failed (errno 5: Input/output error) [ 213.119120][ T4699] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 213.347162][ T4699] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 213.648056][ T4699] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.057344][ T4699] device hsr_slave_0 left promiscuous mode [ 215.064345][ T4699] device hsr_slave_1 left promiscuous mode [ 215.072171][ T4699] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 215.079577][ T4699] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 215.087347][ T4699] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 215.094783][ T4699] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 215.104020][ T4699] device bridge_slave_1 left promiscuous mode [ 215.110190][ T4699] bridge0: port 2(bridge_slave_1) entered disabled state [ 215.119720][ T4699] device bridge_slave_0 left promiscuous mode [ 215.126809][ T4699] bridge0: port 1(bridge_slave_0) entered disabled state [ 215.145944][ T4699] device veth1_macvtap left promiscuous mode [ 215.152074][ T4699] device veth0_macvtap left promiscuous mode [ 215.159133][ T4699] device veth1_vlan left promiscuous mode [ 215.165635][ T4699] device veth0_vlan left promiscuous mode [ 215.592587][ T4699] team0 (unregistering): Port device team_slave_1 removed [ 215.626342][ T4699] team0 (unregistering): Port device team_slave_0 removed [ 215.659912][ T4699] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 215.695362][ T4699] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 215.918208][ T4699] bond0 (unregistering): Released all slaves [ 216.386036][ T4699] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.434285][ T4699] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.477509][ T4699] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.553773][ T4699] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.674462][ T4699] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.736159][ T4699] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.807870][ T4699] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.855592][ T4699] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.017986][ T4699] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.085472][ T4699] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.166454][ T4699] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.237785][ T4699] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.368579][ T4699] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.452211][ T4699] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.519614][ T4699] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.595439][ T4699] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 219.744027][ T4699] device hsr_slave_0 left promiscuous mode [ 219.750686][ T4699] device hsr_slave_1 left promiscuous mode [ 219.758207][ T4699] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 219.765955][ T4699] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 219.773694][ T4699] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 219.781174][ T4699] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 219.788647][ T4699] device bridge_slave_1 left promiscuous mode [ 219.794967][ T4699] bridge0: port 2(bridge_slave_1) entered disabled state [ 219.803157][ T4699] device bridge_slave_0 left promiscuous mode [ 219.809324][ T4699] bridge0: port 1(bridge_slave_0) entered disabled state [ 219.820046][ T4699] device hsr_slave_0 left promiscuous mode [ 219.826344][ T4699] device hsr_slave_1 left promiscuous mode [ 219.834216][ T4699] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 219.841697][ T4699] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 219.849686][ T4699] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 219.857407][ T4699] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 219.865007][ T4699] device bridge_slave_1 left promiscuous mode [ 219.871238][ T4699] bridge0: port 2(bridge_slave_1) entered disabled state [ 219.881115][ T4699] device bridge_slave_0 left promiscuous mode [ 219.887262][ T4699] bridge0: port 1(bridge_slave_0) entered disabled state [ 219.898003][ T4699] device hsr_slave_0 left promiscuous mode [ 219.908516][ T4699] device hsr_slave_1 left promiscuous mode [ 219.915400][ T4699] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 219.923034][ T4699] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 219.930546][ T4699] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 219.938072][ T4699] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 219.947006][ T4699] device bridge_slave_1 left promiscuous mode [ 219.953292][ T4699] bridge0: port 2(bridge_slave_1) entered disabled state [ 219.966572][ T4699] device bridge_slave_0 left promiscuous mode [ 219.975055][ T4699] bridge0: port 1(bridge_slave_0) entered disabled state [ 219.988598][ T4699] device hsr_slave_0 left promiscuous mode [ 219.994975][ T4699] device hsr_slave_1 left promiscuous mode [ 220.001615][ T4699] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 220.009030][ T4699] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 220.016835][ T4699] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 220.024512][ T4699] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 220.032433][ T4699] device bridge_slave_1 left promiscuous mode [ 220.038775][ T4699] bridge0: port 2(bridge_slave_1) entered disabled state [ 220.047293][ T4699] device bridge_slave_0 left promiscuous mode [ 220.053997][ T4699] bridge0: port 1(bridge_slave_0) entered disabled state [ 220.107759][ T4699] device veth1_macvtap left promiscuous mode [ 220.114383][ T4699] device veth0_macvtap left promiscuous mode [ 220.120427][ T4699] device veth1_vlan left promiscuous mode [ 220.126391][ T4699] device veth0_vlan left promiscuous mode [ 220.133141][ T4699] device veth1_macvtap left promiscuous mode [ 220.139142][ T4699] device veth0_macvtap left promiscuous mode [ 220.146737][ T4699] device veth1_vlan left promiscuous mode [ 220.152694][ T4699] device veth0_vlan left promiscuous mode [ 220.160329][ T4699] device veth1_macvtap left promiscuous mode [ 220.167039][ T4699] device veth0_macvtap left promiscuous mode [ 220.178560][ T4699] device veth1_vlan left promiscuous mode [ 220.186802][ T4699] device veth0_vlan left promiscuous mode [ 220.210134][ T4699] device veth1_macvtap left promiscuous mode [ 220.216325][ T4699] device veth0_macvtap left promiscuous mode [ 220.222504][ T4699] device veth1_vlan left promiscuous mode [ 220.228286][ T4699] device veth0_vlan left promiscuous mode [ 220.849065][ T4699] team0 (unregistering): Port device team_slave_1 removed [ 220.884401][ T4699] team0 (unregistering): Port device team_slave_0 removed [ 220.925556][ T4699] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 220.960386][ T4699] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 221.232122][ T4699] bond0 (unregistering): Released all slaves [ 221.648819][ T4699] team0 (unregistering): Port device team_slave_1 removed [ 221.685307][ T4699] team0 (unregistering): Port device team_slave_0 removed [ 221.720659][ T4699] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 221.758690][ T4699] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 221.994994][ T4699] bond0 (unregistering): Released all slaves [ 222.360611][ T4699] team0 (unregistering): Port device team_slave_1 removed [ 222.402787][ T4699] team0 (unregistering): Port device team_slave_0 removed [ 222.441678][ T4699] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 222.476285][ T4699] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 222.754990][ T4699] bond0 (unregistering): Released all slaves