last executing test programs: 16.886269007s ago: executing program 4 (id=1515): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f0000000180)=0xffffffffffffffff) fcntl$setsig(r2, 0xa, 0x12) ppoll(&(0x7f0000000100)=[{r3}], 0x1, 0x0, &(0x7f0000000080)={[0x8001a0efffffff]}, 0x8) dup2(r2, r3) fcntl$setown(r3, 0x8, r1) tkill(r1, 0x13) 16.627619345s ago: executing program 4 (id=1517): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x6, @random="9529f7f600", 'wg1\x00'}}, 0x1e) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@ipv4_newrule={0x1c, 0x20, 0xf4db158ec847dc81, 0x0, 0x2003, {0x2, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x3, 0x8}}, 0x1c}, 0x1, 0x0, 0x0, 0x20000895}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x439, 0xffffffff, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801, 0x1313}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x40008c0) keyctl$read(0xb, 0x0, &(0x7f00000001c0)=""/47, 0x2f) recvmsg(0xffffffffffffffff, &(0x7f00000035c0)={&(0x7f0000000380)=@un=@abs, 0x80, &(0x7f0000002500)=[{&(0x7f0000000500)=""/163, 0xa3}, {&(0x7f00000005c0)=""/207, 0xcf}, {&(0x7f0000001140)=""/4096, 0x1000}, {&(0x7f0000002140)=""/119, 0x77}, {&(0x7f00000021c0)=""/232, 0xe8}, {&(0x7f00000022c0)=""/175, 0xaf}, {&(0x7f0000002380)=""/156, 0x9c}, {&(0x7f0000002440)=""/48, 0x30}, {&(0x7f0000002480)=""/128, 0x80}], 0x9, &(0x7f00000025c0)=""/4096, 0x1000}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000240)={'vlan0\x00', &(0x7f00000009c0)=@ethtool_flash={0x26, 0x8000020, './file0\x00'}}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x79, 0x10, 0x6f}, [@ldst={0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xeacf, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x22e, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100), 0x2, 0x52c, &(0x7f0000000c00)="$eJzs3UFsI1cZAOB/Jsnau02bLfQAqNClFBa0WjvxtquqF8qpQqgSokcO25A4UbT2erV2ShP2kD1yR6ISJzhx5oDEAakn7kgc4MalHJAKrEBNJSQGzdhOnU2cWIkTt/H3SU+eeW9m/vc0mves52ReAFPrWkTsRMSliHg7IhZ6+UkvxevdlB/30eOHK7uPH64kkWVv/TMpyvO8GDgn91TvmuWI+MEbET9Kngj6p4j21vbd5Uaj/qCXVe0071fbW9s3N5rL6/X1+r1a7fbS7cVXb71SG1tbX2j+5sPLEfH73335gz/ufOsnebXme2WD7RinbtPn9uLkZiPie2cRbAJmeu25dJKTT3QS45RGxOci4sXi+V+ImeJu7rf/Nn37HGsHAJyFLFuIbGFwHwC46NJiDixJK725gPlI00qlO4f3XFxJG61258Zaa/Peaneu7GrMpWsbjfpib67waswlaxuz9aViu7/fqNeS/fu3IuLZiPhZ6XKxX1lpNVYn+cUHAKbYU0+M//8pdcd/AOCCK3+yWZpkPQCA81OedAUAgHNn/AeA6WP8B4DpY/wHgOlj/AeA6WP8B4Cp8v0338xTttt7//XqO1ubd1vv3Fytt+9WmpsrlZXWg/uV9VZrvXhnT/O46zVarftLL8fmu9VOvd2ptre27zRbm/c6d4r3et+pz51LqwCAozz7wvt/SSJi57XLRYqB9/0fO1Y/f9a1A85SOukKABMzM+kKABNzcLUvYFqYj4fp9b8sy2Jg7d6IeLS3NfAy0KF/IvTeSGFS64bCp8/1L55i/h/4TDP/D9PrZPP/vsvDRWD+H6ZXliXW/AeAKWOOH6bc/PGHDP7+v5gN7Iz2+z8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABcSPNFStJKby3w+UjTSiXi6Yi4GnPJ2kajvhgRz0TEn0tzpXx/KSKsGwQAn2Xp35OIyNP1hZcOrAR2qfRxqfiMiB//4q2fv7vc6TxYiriU/Gsvv/NeL782ifoDAMfpj9P9cbzvo8cPV/rpPOvz4Xe6i4vmcXd7qVsyG7PFZ7mYa7jy76S335V/X5kZQ/ydRxHxhcPanxRzI1d7K58+GT+P/fS5xk/3xU+Lsoj+UqyfH0NdYNq8n/c/rx/2/KVxrfg8/PkvFz3U6fX7v90D/V+61//NDOn/ro0a4+U/fPdAZrbQLXsU8aXZiN3+xQf6n378ZEj8l0aM/9fnv/LisLLslxHX47D2J/tiVTvN+9X21vbNjebyen29fq9Wu710e/HVW6/UqsUcdXVtI/k4yw6L8Y/XbjwzLH7e/itD4pePaf/XR2z/r/779g+/ekT8b37t8Pv/3BHx8zHxGyPGX77y2/Kwsjz+6pD2H3f/b4wY/4O/ba8eyExGPBkAGLv21vbd5Uaj/uD0G+Ujj0lPfuW8niMfnETsjKU5o7S09OufvnH8WaWzrs9pN2JY0cynpYYXZqN0grPK431OR9yYdM8EnLVPHvpJ1wQAAAAAAAAAAAAAABjmPP6daNJtBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4OL6fwAAAP//cbjWGw==") bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x8, [@volatile={0x6, 0x0, 0x0, 0x9, 0x4}, @var={0x10, 0x0, 0x0, 0xe, 0x1}, @enum64={0x4, 0x1, 0x0, 0x13, 0x0, 0x4, [{0x5, 0x8, 0xbf}]}]}, {0x0, [0x61, 0x2e, 0x30, 0x30, 0x30, 0x61]}}, &(0x7f0000000300)=""/18, 0x54, 0x12, 0x1}, 0x28) 16.070234231s ago: executing program 4 (id=1520): r0 = socket$inet_udp(0x2, 0x2, 0x0) readv(r0, &(0x7f0000000440)=[{&(0x7f00000000c0)=""/40, 0x28}, {&(0x7f0000000280)=""/217, 0xd9}, {&(0x7f0000000380)=""/152, 0x98}], 0x3) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x6f, &(0x7f0000000200)={@local, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x21, 0x61, 0x2, 0x0, 0x3, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x4d, 0x0, @gue={{0x2, 0x0, 0x1, 0x88, 0x100, @val=0x169c84ce1e5d9ba2}, "c4d26f9988fa7be20a3dd20dc366683a099e9cebeda34a8bb65cc16b71941f8c427555e50e057975f314bbe30ad21f574e9e50ece5a3f3e870092a0018"}}}}}}, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) mq_open(&(0x7f0000000140)='.\x00', 0x40, 0x2, 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x0, 0x0) readv(r0, &(0x7f0000000080)=[{0x0}, {&(0x7f0000002c40)=""/4096, 0x1000}], 0x2) r2 = socket$key(0xf, 0x3, 0x2) ioctl$sock_ifreq(r2, 0x89a3, &(0x7f0000000100)={'veth0_virt_wifi\x00', @ifru_ivalue=0x388}) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0401273, &(0x7f0000000000)={'\x00', 0x40, 0xa, 0x0, 0x800, 0x8, 0x0}) ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f0000000040)=r3) madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) 14.579027046s ago: executing program 3 (id=1529): syz_emit_ethernet(0x45, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x37, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @broadcast=0xac14140a, @multicast1}, "040086dd0000ff"}}}}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) setsockopt$inet_int(r0, 0x0, 0x15, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000040)={'vxcan0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@can_newroute={0x24, 0x18, 0x1, 0x0, 0x25dfdbfe, {0x1d, 0x1, 0x6}, [@CGW_SRC_IF={0x8, 0x9, r5}, @CGW_DST_IF={0x8, 0xa, r5}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="563f000019"], 0xfe33) 14.398295212s ago: executing program 3 (id=1532): openat$nullb(0xffffffffffffff9c, &(0x7f0000000380), 0x4000000004882, 0x0) io_setup(0x1, &(0x7f00000004c0)) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) set_mempolicy(0x2002, &(0x7f0000000000)=0x9, 0x9) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42032, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x103840) writev(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f0000000440)="580000001400192340834b80040d8c560a0677bc45ff810500004277000058000b480400945f64009400050028925a01000000020000008000f07ffeffe809000000fff5dd000000100001000c081000418e0000070031d0", 0x58}], 0x1) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000280)=0x8000005, 0x4) recvmmsg(r0, &(0x7f0000003440)=[{{&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000002980)=[{&(0x7f0000000680)=""/198, 0xc6}], 0x1, &(0x7f0000000180)=""/140, 0x8c}, 0xfffffff6}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000780)=""/133, 0x85}], 0x1, &(0x7f0000000840)=""/181, 0xb5}, 0x5}, {{&(0x7f00000004c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x80, &(0x7f0000000900)=[{&(0x7f0000000a00)=""/191, 0xbf}, {&(0x7f0000000540)=""/17, 0xb}, {&(0x7f0000000ac0)=""/129, 0x81}], 0x3, &(0x7f0000000940)=""/33, 0x21}, 0x1}, {{&(0x7f0000000b80)=@l2tp6={0xa, 0x0, 0x0, @private2}, 0x80, &(0x7f0000003680)=[{&(0x7f0000000c00)=""/2, 0x2}, {&(0x7f0000000c40)=""/125, 0x7d}, {0x0}, {&(0x7f0000000e80)=""/77, 0x4d}, {&(0x7f0000000f00)=""/248, 0xf8}, {&(0x7f0000004fc0)=""/4113, 0x1009}, {0x0}], 0x7, &(0x7f0000002140)=""/205, 0xcd}, 0x3}, {{&(0x7f0000002240)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x80, &(0x7f0000000d40)=[{&(0x7f00000022c0)=""/113, 0x71}, {&(0x7f0000002340)=""/224, 0xe0}, {&(0x7f0000002440)=""/84, 0x54}, {&(0x7f0000002000)=""/183, 0xb7}], 0x4, &(0x7f0000000d80)=""/188, 0xbc}, 0x5}, {{0x0, 0x0, &(0x7f0000002d40), 0x58}, 0x95}, {{&(0x7f0000002e00)=@vsock, 0x80, &(0x7f0000002f00)}, 0x5}, {{0x0, 0x0, &(0x7f00000030c0)=[{&(0x7f0000003080)=""/53, 0x35}], 0x1, &(0x7f0000003100)=""/239, 0xef}, 0x5}], 0x8, 0x10022, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) syz_clone(0xa8140180, 0x0, 0x0, 0x0, 0x0, 0x0) 14.222334807s ago: executing program 1 (id=1535): keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) accept4(r1, 0x0, 0x0, 0x800) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x81, 0x0, 'queue0\x00'}) write$sndseq(r0, &(0x7f0000000380)=[{0x84, 0x77, 0x0, 0x0, @time={0xe, 0x428}, {0xfd}, {0x7, 0x9}, @raw32={[0x2, 0x6, 0x8000000]}}, {0x4, 0x0, 0x5, 0x83, @tick, {0xfd}, {0x3}, @note={0x81}}, {0x6, 0x3, 0x9, 0x3, @tick=0x1, {0x9, 0x5}, {0xce, 0x2}, @connect={{0x10, 0x3}, {0x6, 0xb}}}, {0x3, 0x8, 0xe8, 0x2, @tick=0x80, {0x80, 0x10}, {0x2}, @quote={{0x6, 0x3}, 0xc}}], 0x70) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01) write$sndseq(r2, &(0x7f0000000080)=[{0x1e, 0x0, 0x8, 0xfd, @tick=0x3ff, {0x0, 0xdc}, {}, @result}], 0x1c) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) 13.190889868s ago: executing program 3 (id=1537): r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0xfffffffffffffdf1) sendto$inet(r0, 0x0, 0x0, 0x20000090, 0x0, 0x0) shutdown(r0, 0x1) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000080)=0x4000004, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e23, 0x8001, @empty, 0xffffff5d}, 0x1c) listen(0xffffffffffffffff, 0x50) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r1, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000004c0)={'bond0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, 0x0, &(0x7f00000001c0)='GPL\x00'}, 0x94) close(0x3) 13.069866641s ago: executing program 3 (id=1539): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@remote, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0xfffffffffffffffe, 0x1, 0x4, 0x100000000, 0x5, 0x0, 0xe}, {0x0, 0xffffffff, 0x400000003, 0xfffffffffffffffc}, 0xfffffffc, 0x1, 0x1, 0x0, 0x6}, {{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x4, 0x3c}, 0x0, @in=@multicast2, 0x0, 0x0, 0x0, 0xb7, 0x7, 0xfffffffe}}, 0xe8) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x1c) 12.863043548s ago: executing program 4 (id=1540): sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004000}, 0x4005000) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000100)="480000001400195a8563e43c", 0xc}], 0x1) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c}}, 0x40040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="2c385a7af3", 0x5) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x100000000000000}, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x16, &(0x7f0000000280)=ANY=[@ANYBLOB="7912b8000000000061138c0000000000bf2000000000000015000000080063033d030100000000009500003a000000006916000000000000bf6700000000000066060500fcff03006706000002000000760300000ee60060bf050000000000003c6500bf000000006507f9ff01000000070700004cdfffff1e75040000000000bf54000000000000070400000400f9ffad43010000000000d5000000000000000500000000000000950000000000000032410000000000000054bb12dc8c27df8ecfc7bdd2d17f2f1754558f22dd399703d6c4f6f3be0b369289aa6812b8e007e733a9a4f16d0a3e1282ee45a010fb94fe9de56c9d8a814261bdb94a05000000c6c60bf7a13ba1fcf1111ce4fc0d742a81762bab8395fa64810b5b40d893ea8fe0ffffff7f1b546cad3f1d5af65706fd4f68795cce6cf16ab689b555202da2e0ec2871a51445dc8da39e5b0ab71ca9b901627b562ed84b026002d4519af619e3cca4d69e0dee080006774a8f3e691700ec88158f02001b0000c81c8b297dff0445a13d0045fb3cda32a673a6bb55d8c80800dce431e56723888fb126a1403d2b63f16fb2ad9bc117aba7cbebe174aba210d739a018f9bbec63222d20cedbc4d03723f1c932b3a6aa57f1ad2e99e0e67a993716d20000009f0f53acbb40b401e3738270b3156268784f2af9e4bcf8b07a10d6735154be1602f9dd1d7d4301e00000000000460bcc5989ec85e3cbcb6bcfaf0000000000000000bc00f674629709e7e78f4ddc211bc3ebf0bd9d42ca019dd5d0861cd64722cf74686ebfbe2562671cd47840f81d2a8f8f9be3bcd19dc6840aa7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7eab049b1bd47287cd31cc43ea0ffb567b40407d000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900000000000000000000000000000000000000000000000014000000e3de3d7b4cd07ec3ee777de774fc7987cca41989140003"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) 11.035011944s ago: executing program 0 (id=1541): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) sendmsg$inet(r4, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0xffff, @multicast1}, 0x10, &(0x7f00000014c0)=[{&(0x7f0000000000)="be39", 0xffeb}, {0x0}], 0x2, &(0x7f0000000c80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @private}}}], 0x20}, 0x0) recvmmsg(r4, &(0x7f000000cf00), 0x400000000000062, 0x2, 0x0) 9.998909085s ago: executing program 0 (id=1542): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100000a27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = fsopen(&(0x7f00000004c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) symlinkat(&(0x7f0000000000)='.\x00', r4, &(0x7f0000000140)='./file0\x00') 9.998763825s ago: executing program 3 (id=1543): openat$sysfs(0xffffffffffffff9c, 0x0, 0x202, 0xc4) socket$packet(0x11, 0x3, 0x300) unshare(0x6020400) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x8, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB], &(0x7f0000001200)='syzkaller\x00'}, 0x94) fsmount(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r2, r1, 0x25, 0x0, @void}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f00000002c0)={r5, 0x11, 0x6, @random="08d32bfb45c9"}, 0x10) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x3, 0xfff1}, {0x4, 0xa}, {0x0, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x4048080}, 0x0) 9.734064443s ago: executing program 1 (id=1544): bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='scalable', 0x8) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000c00), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r1, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x44, r2, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_RATE_PARENT_NODE_NAME={0xf, 0xa9, @name2}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000454}, 0x2000c800) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 9.661292505s ago: executing program 4 (id=1546): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) chdir(0x0) r3 = socket$inet6(0xa, 0x2, 0x3a) setsockopt$inet6_int(r3, 0x29, 0x4e, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c) 8.941961087s ago: executing program 2 (id=1547): r0 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@func={0x6, 0x1800}]}}, 0x0, 0x26}, 0x28) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4c, &(0x7f0000000000)=0xc000000, 0x4) r3 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r3, 0xc4c85512, &(0x7f00000000c0)={{0x7, 0x2, 0x0, 0x200000}, 0x0, [0x9, 0x0, 0x3, 0xfffffffffffffffe, 0xfffffffff7fffffe, 0x0, 0x5, 0x0, 0x10000, 0x0, 0x4, 0x0, 0x0, 0x661, 0x7, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7, 0x4, 0x0, 0x6, 0x0, 0x703a, 0x6, 0xae4f, 0x8000000, 0x0, 0x1, 0x0, 0x8, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x3, 0x3, 0x0, 0x0, 0x0, 0x7fffffffffffffff, 0xfffffffffffffffc, 0x1, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfff, 0x3, 0xd5e4, 0x0, 0x7, 0x1fc, 0xfffffffffffffffe, 0x1, 0x6, 0x1, 0x0, 0xfffffffffffffffb, 0x4, 0x10377, 0xffffffffffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0x4000, 0x1, 0x3, 0xfffffffffffffffd, 0x0, 0x0, 0x5, 0x6, 0x3, 0x0, 0x800, 0x0, 0x0, 0x0, 0x5, 0x8, 0xc, 0x0, 0x0, 0x9, 0x4000000000000, 0x0, 0x80000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x4, 0xd30, 0x1000, 0x6, 0x0, 0x0, 0x0, 0x4, 0x4, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x71, 0x0, 0x7fffffff]}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0xa, 0x7, 0x2, 0x4002804c4, 0x9, 0x5, 0x5, 0x0, 0x4, 0xfff, 0x2000000000000000, 0x5, 0x8d], 0xeeee8000, 0x11500}) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x42282, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 8.85630777s ago: executing program 0 (id=1549): timer_create(0x2, 0x0, &(0x7f0000000100)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000380)={{}, {0x0, 0x9}}, 0x0) timer_settime(r0, 0x1, &(0x7f0000000140)={{}, {0x77359400}}, &(0x7f0000000040)) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x17ef, 0x6062, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x9}}]}}, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000180)={@loopback={0x200000000000000}, 0x800, 0x0, 0x3, 0x1}, 0x20) setsockopt$inet6_int(r2, 0x29, 0x1000000000021, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x380000, @loopback}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f00000001c0)={@loopback, 0x800, 0x1}, 0x20) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) 8.809181922s ago: executing program 1 (id=1550): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_opts(r3, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x18) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x6e23, 0x2, @mcast1, 0x9}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000001840), 0x3b, 0x0) 7.797177862s ago: executing program 1 (id=1551): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$can_bcm(0x1d, 0x2, 0x2) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r3, &(0x7f0000000000), 0x10) io_submit(r4, 0x1, &(0x7f0000000100)=[&(0x7f00000000c0)={0x400000, 0x0, 0x0, 0x1, 0x0, r3, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f00000000000029ffffff000000", 0x20000238}]) 7.607467618s ago: executing program 2 (id=1552): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x104}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x202) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000780)={0xfffffffe, 0x0, 0x0, 'queue0\x00', 0x48}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, &(0x7f00000003c0)={0x0, 0x0, {0xffffffffffffffff}}) 6.316530258s ago: executing program 1 (id=1553): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$tipc(0x1e, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000080)=0x6, 0x4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42}, 0x10) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) sendmsg$tipc(r0, &(0x7f0000000c80)={&(0x7f0000000980)=@id, 0x10, 0x0}, 0x0) connect$tipc(r0, &(0x7f00000000c0)=@name, 0x10) 5.957274538s ago: executing program 2 (id=1554): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000002000010000000000fcdbdf250a8000000000000332000300140001002001000000000000000000000000000105001600870000006b52a569aa58bc536c4a95d8156be0e7fedde8c3e8530a1dcc51"], 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x40800) r1 = socket$netlink(0x10, 0x3, 0xc) ioctl$sock_netdev_private(r1, 0x8924, &(0x7f0000000080)="963a") r2 = socket$kcm(0x23, 0x2, 0x0) sendmsg$sock(r2, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000240)=0x9, 0x4) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff00000065"], 0x78) ioctl$sock_TIOCINQ(r2, 0x541b, &(0x7f0000000080)) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x439, 0x70bd26, 0x1, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) 5.773264304s ago: executing program 0 (id=1555): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) read$FUSE(0xffffffffffffffff, 0x0, 0x0) mount$9p_tcp(&(0x7f0000000180), 0xfffffffffffffffd, 0x0, 0x1000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$kcm(0x23, 0x5, 0x0) sendmsg$kcm(r3, &(0x7f0000001100)={0x0, 0x0, 0x0}, 0x80) 5.659585888s ago: executing program 2 (id=1556): read$FUSE(0xffffffffffffffff, &(0x7f0000000200)={0x2020}, 0x2020) sched_setscheduler(0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x34, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x60}]}, &(0x7f0000000080)='syzkaller\x00', 0x4, 0x98, &(0x7f00000000c0)=""/152}, 0x80) 5.553187191s ago: executing program 4 (id=1557): sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x300, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) fsmount(0xffffffffffffffff, 0x1, 0x8) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f00000001c0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0xfffc, 0x0, @loopback={0x0, 0x1c9ae7fffe9a6f34}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f00000000c0)={0xfd, 0x0, 0xfe, 0x22, 0x0, 0x7, 0x6, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3}, 0xe) shutdown(r1, 0x1) recvmmsg(r1, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}}], 0x414, 0x0, 0x0) 5.380254356s ago: executing program 3 (id=1558): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x4, 0x10, 0x6, 0x8, 0xfbee}, 0x1, 0x0, 0x3, 0x5, 0xe, 0x4, 0xd, 0x18, 0x5, 0x2, {0x6, 0x8, 0xfffffffc, 0x0, 0xffffffff, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 4.965175629s ago: executing program 1 (id=1559): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x18) connect$inet6(r0, &(0x7f0000000240)={0xa, 0xffff, 0x4462, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xd38f}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000001840), 0x3b, 0x0) 3.655987319s ago: executing program 2 (id=1560): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100000a27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = fsopen(&(0x7f00000004c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) symlinkat(&(0x7f0000000000)='.\x00', r4, &(0x7f0000000140)='./file0\x00') 3.654660869s ago: executing program 0 (id=1570): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x800000}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) memfd_create(0x0, 0x2) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x24, 0x39, 0x107, 0x1, 0x25dfdbfb, {0x4, 0x7c}, [@nested={0x4, 0x8c}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x88\a'}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24000005}, 0xd014) 763.05µs ago: executing program 2 (id=1561): syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000280)=r1}, 0x20) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r1, r3}, 0x14) syz_emit_ethernet(0x12, &(0x7f0000000240)=ANY=[], 0x0) 0s ago: executing program 0 (id=1562): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x42000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20084084) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r2, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={0x2c, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x2c}}, 0x0) kernel console output (not intermixed with test programs): overlayfs: missing 'lowerdir' [ 71.239024][ T4478] netlink: 277 bytes leftover after parsing attributes in process `syz.3.62'. [ 71.290325][ T1419] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.297309][ T1419] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.323692][ T4177] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by udevd (4177) [ 71.529131][ T4489] loop3: detected capacity change from 0 to 128 [ 73.050710][ T26] audit: type=1804 audit(1781869076.009:4): pid=4500 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.66" name="/newroot/12/file0/bus" dev="loop3" ino=1048595 res=1 errno=0 [ 73.127632][ T26] audit: type=1804 audit(1781869076.049:5): pid=4489 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.66" name="/newroot/12/file0/bus" dev="loop3" ino=1048595 res=1 errno=0 [ 73.963393][ T26] audit: type=1804 audit(1781869076.059:6): pid=4489 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.66" name="/newroot/12/file0/bus" dev="loop3" ino=1048595 res=1 errno=0 [ 74.154910][ T4515] device macvlan2 entered promiscuous mode [ 76.990279][ T2855] cfg80211: failed to load regulatory.db [ 77.054117][ T4556] loop0: detected capacity change from 0 to 128 [ 77.326755][ T26] audit: type=1800 audit(1781869080.269:7): pid=4556 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.82" name="file1" dev="loop0" ino=1048597 res=0 errno=0 [ 77.687763][ T4564] loop3: detected capacity change from 0 to 512 [ 78.050777][ T4564] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.85: invalid indirect mapped block 256 (level 2) [ 78.203797][ T4564] EXT4-fs (loop3): 2 truncates cleaned up [ 78.242299][ T4564] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,auto_da_alloc,lazytime,journal_dev=0x0000000000000006,,errors=continue. Quota mode: writeback. [ 79.608562][ T1213] attempt to access beyond end of device [ 79.608562][ T1213] loop0: rw=1, want=321, limit=128 [ 79.890452][ T1213] attempt to access beyond end of device [ 79.890452][ T1213] loop0: rw=1, want=401, limit=128 [ 80.296962][ T2855] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 80.344925][ T4598] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 80.408416][ T4596] netlink: 16 bytes leftover after parsing attributes in process `syz.3.96'. [ 81.246788][ T2855] usb 5-1: Using ep0 maxpacket: 16 [ 81.401948][ T2855] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 81.414514][ T4612] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 81.467116][ T4612] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 81.589716][ T2855] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 81.616224][ T2855] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.644229][ T2855] usb 5-1: Product: syz [ 81.653795][ T2855] usb 5-1: Manufacturer: syz [ 81.662646][ T2855] usb 5-1: SerialNumber: syz [ 81.724101][ T2855] usb 5-1: config 0 descriptor?? [ 81.805559][ T2855] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 81.836107][ T2855] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 82.846278][ T4627] loop0: detected capacity change from 0 to 512 [ 82.866706][ T2855] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 82.909740][ T4627] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 82.988394][ T4627] EXT4-fs (loop0): 1 truncate cleaned up [ 82.994086][ T4627] EXT4-fs (loop0): mounted filesystem without journal. Opts: nobarrier,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,user_xattr,errors=remount-ro,user_xattr,. Quota mode: none. [ 83.094663][ T26] audit: type=1800 audit(1781869086.049:8): pid=4627 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.105" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 83.138532][ T4640] netlink: 24 bytes leftover after parsing attributes in process `syz.3.108'. [ 83.182503][ T4638] loop2: detected capacity change from 0 to 2048 [ 83.248310][ T4638] loop2: p1 < > p3 p4 < > [ 83.269417][ T4638] loop2: p3 start 4284289 is beyond EOD, truncated [ 83.412092][ T3559] loop2: p1 < > p3 p4 < > [ 83.417099][ T2855] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 83.431034][ T3559] loop2: p3 start 4284289 is beyond EOD, truncated [ 83.443623][ T2855] em28xx 5-1:0.0: board has no eeprom [ 83.786933][ T2855] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 83.835344][ T4181] udevd[4181]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 83.853919][ T2855] em28xx 5-1:0.0: dvb set to bulk mode. [ 83.873669][ T4179] udevd[4179]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 84.192396][ T4271] em28xx 5-1:0.0: Binding DVB extension [ 84.394541][ T2855] usb 5-1: USB disconnect, device number 2 [ 84.607266][ T2855] em28xx 5-1:0.0: Disconnecting em28xx [ 84.654731][ T4271] em28xx 5-1:0.0: Registering input extension [ 84.673621][ T2855] em28xx 5-1:0.0: Closing input extension [ 84.833320][ T4664] process 'syz.0.116' launched '/dev/fd/4' with NULL argv: empty string added [ 84.875575][ T2855] em28xx 5-1:0.0: Freeing device [ 85.634363][ T4659] device syzkaller0 entered promiscuous mode [ 86.590526][ T4683] netlink: 12 bytes leftover after parsing attributes in process `syz.4.122'. [ 86.599216][ T4686] sctp: [Deprecated]: syz.0.120 (pid 4686) Use of int in maxseg socket option. [ 86.599216][ T4686] Use struct sctp_assoc_value instead [ 86.658258][ T4683] netlink: 'syz.4.122': attribute type 10 has an invalid length. [ 86.674002][ T4683] netlink: 40 bytes leftover after parsing attributes in process `syz.4.122'. [ 86.736421][ T4683] device dummy0 entered promiscuous mode [ 90.488479][ T4734] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.496974][ T4734] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.152750][ T4739] netlink: 8 bytes leftover after parsing attributes in process `syz.4.139'. [ 91.353632][ T4749] 9pnet: p9_errstr2errno: server reported unknown error aaaaaaaaa [ 91.431407][ T4755] netlink: 'syz.4.144': attribute type 1 has an invalid length. [ 91.451052][ T4755] netlink: 'syz.4.144': attribute type 4 has an invalid length. [ 91.474664][ T4755] netlink: 9462 bytes leftover after parsing attributes in process `syz.4.144'. [ 91.718245][ T7] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 92.589022][ T4783] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 92.602880][ T4782] device syzkaller0 entered promiscuous mode [ 92.622001][ T4783] CIFS mount error: No usable UNC path provided in device string! [ 92.622001][ T4783] [ 92.643134][ T4783] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 92.655419][ T7] usb 2-1: config 0 has no interfaces? [ 93.031643][ T7] usb 2-1: New USB device found, idVendor=0403, idProduct=f850, bcdDevice=a4.46 [ 93.061136][ T7] usb 2-1: New USB device strings: Mfr=133, Product=2, SerialNumber=0 [ 93.076664][ T7] usb 2-1: Product: syz [ 93.082184][ T7] usb 2-1: Manufacturer: syz [ 93.116914][ T7] usb 2-1: config 0 descriptor?? [ 94.152526][ T7] usb 2-1: USB disconnect, device number 2 [ 94.223216][ T4797] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 94.576322][ T4808] netlink: 24 bytes leftover after parsing attributes in process `syz.0.161'. [ 94.641336][ T4815] netlink: 12 bytes leftover after parsing attributes in process `syz.2.164'. [ 94.683671][ T4815] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 94.739827][ T4815] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 95.020040][ T4815] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 98.070247][ T4853] futex_wake_op: à³OñJ÷N\ìg´é tries to shift op by 144; fix this program [ 98.086706][ T4855] loop1: detected capacity change from 0 to 256 [ 98.207395][ T4860] autofs4:pid:4860:autofs_fill_super: called with bogus options [ 99.769513][ T4855] exFAT-fs (loop1): hint_cluster is invalid (17) [ 99.852095][ T4855] exFAT-fs (loop1): error, invalid dentry access beyond EOF (clu : 5, eidx : 129) [ 99.880760][ T4855] exFAT-fs (loop1): Filesystem has been set read-only [ 102.879003][ T4910] netlink: 4 bytes leftover after parsing attributes in process `syz.2.193'. [ 104.462293][ T7] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 105.056852][ T7] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 105.083090][ T7] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 10 [ 105.114684][ T7] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 105.135277][ T4947] loop3: detected capacity change from 0 to 4096 [ 105.138354][ T4952] netlink: 48 bytes leftover after parsing attributes in process `syz.0.207'. [ 105.151090][ T7] usb 5-1: New USB device found, idVendor=046d, idProduct=ca03, bcdDevice= 0.00 [ 105.169208][ T7] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.264907][ T7] usb 5-1: config 0 descriptor?? [ 105.786914][ T7] usbhid 5-1:0.0: can't add hid device: -71 [ 105.796292][ T7] usbhid: probe of 5-1:0.0 failed with error -71 [ 106.015279][ T7] usb 5-1: USB disconnect, device number 3 [ 106.080085][ T4956] loop1: detected capacity change from 0 to 4096 [ 106.117995][ T4959] netlink: 4 bytes leftover after parsing attributes in process `syz.2.210'. [ 106.136971][ T4959] netlink: 4 bytes leftover after parsing attributes in process `syz.2.210'. [ 106.254914][ T4956] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 106.291654][ T4962] Zero length message leads to an empty skb [ 106.354301][ T4964] netlink: 4 bytes leftover after parsing attributes in process `syz.0.208'. [ 106.633963][ T4965] loop2: detected capacity change from 0 to 128 [ 106.686822][ T4956] EXT4-fs (loop1): mounted filesystem without journal. Opts: init_itable=0x0000000000000101,stripe=0x0000000000000061,journal_ioprio=0x0000000000000006,minixdf,nodiscard,nomblk_io_submit,acl,nojournal_checksum,resuid=0x0000000000000000,,errors=continue. Quota mode: writeback. [ 106.948909][ T4962] attempt to access beyond end of device [ 106.948909][ T4962] loop2: rw=2049, want=250, limit=128 [ 107.039428][ T26] audit: type=1800 audit(1781869109.999:9): pid=4956 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.209" name="file1" dev="loop1" ino=15 res=0 errno=0 [ 107.168879][ T4968] loop4: detected capacity change from 0 to 2048 [ 107.389834][ T4968] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 107.773864][ T4970] loop0: detected capacity change from 0 to 32768 [ 107.910860][ T4981] netlink: 16 bytes leftover after parsing attributes in process `syz.1.214'. [ 110.045527][ T4993] netlink: 140 bytes leftover after parsing attributes in process `syz.3.219'. [ 110.085739][ T4993] netlink: 28 bytes leftover after parsing attributes in process `syz.3.219'. [ 110.185874][ T4996] netlink: 51 bytes leftover after parsing attributes in process `syz.2.220'. [ 110.403890][ T5000] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 110.411024][ T5009] IPVS: sync thread started: state = MASTER, mcast_ifn = dummy0, syncid = 65, id = 0 [ 110.590622][ T5007] netlink: 40 bytes leftover after parsing attributes in process `syz.3.223'. [ 112.130181][ T5022] netlink: 798 bytes leftover after parsing attributes in process `syz.2.226'. [ 112.751931][ T5032] tipc: Started in network mode [ 112.777144][ T5032] tipc: Node identity 4, cluster identity 4711 [ 112.784147][ T5032] tipc: Node number set to 4 [ 113.516820][ T5036] netlink: 12 bytes leftover after parsing attributes in process `syz.2.229'. [ 113.559473][ T5039] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 113.569042][ T5039] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 113.753090][ T5039] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 114.953983][ T5039] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 115.551584][ T5039] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 115.573365][ T5041] netlink: 28 bytes leftover after parsing attributes in process `syz.2.229'. [ 115.623712][ T5054] xt_CT: No such helper "syz1" [ 115.624603][ T5041] 8021q: adding VLAN 0 to HW filter on device bond1 [ 115.664533][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 116.617004][ T5071] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 116.668948][ T5074] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 116.766607][ T13] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 116.775314][ T5077] loop2: detected capacity change from 0 to 2048 [ 116.858373][ T5081] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 116.878455][ T5081] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 116.885967][ T5081] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 116.965913][ T5081] device bridge_slave_0 left promiscuous mode [ 117.177589][ T13] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 117.397402][ T13] usb 4-1: New USB device found, idVendor=0582, idProduct=00eb, bcdDevice= 0.40 [ 117.442412][ T13] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.542563][ T13] usb 4-1: Product: syz [ 117.626314][ T5081] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.645107][ T13] usb 4-1: Manufacturer: syz [ 117.753608][ T13] usb 4-1: SerialNumber: syz [ 117.845230][ T5081] device bridge_slave_1 left promiscuous mode [ 118.355527][ T5081] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.445607][ T5081] bond0: (slave bond_slave_0): Releasing backup interface [ 118.528539][ T5081] bond0: (slave bond_slave_1): Releasing backup interface [ 118.622748][ T5081] team0: Port device team_slave_0 removed [ 118.678049][ T5081] team0: Port device team_slave_1 removed [ 118.696406][ T5081] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 118.706592][ T5081] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 118.728747][ T5081] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 118.737803][ T5081] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 118.795216][ T5082] team0: Mode changed to "roundrobin" [ 118.803401][ T5088] netlink: 4 bytes leftover after parsing attributes in process `syz.1.244'. [ 118.826825][ T13] usb 4-1: Can't get UAC3 power state for id 10 [ 118.893784][ T5094] loop0: detected capacity change from 0 to 32768 [ 118.900665][ T13] usb 4-1: BAAD HEADSET c_chmask mismatch [ 118.972996][ T5094] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 118.989815][ T5094] BTRFS info (device loop0): using free space tree [ 119.007812][ T5094] BTRFS info (device loop0): has skinny extents [ 119.137613][ T13] snd-usb-audio: probe of 4-1:1.0 failed with error -22 [ 119.405295][ T13] usb 4-1: USB disconnect, device number 2 [ 119.893308][ T5094] BTRFS info (device loop0): enabling ssd optimizations [ 120.072546][ T4180] udevd[4180]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 120.509077][ T5139] netlink: 4 bytes leftover after parsing attributes in process `syz.3.255'. [ 121.495262][ T5146] loop1: detected capacity change from 0 to 2048 [ 121.545687][ T5139] bond0: (slave bond_slave_0): Releasing backup interface [ 122.126720][ T4199] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 123.806837][ T4199] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 123.903199][ T5167] xt_hashlimit: size too large, truncated to 1048576 [ 123.976883][ T5167] xt_hashlimit: invalid rate [ 124.006959][ T4199] usb 5-1: New USB device found, idVendor=0582, idProduct=00eb, bcdDevice= 0.40 [ 124.042386][ T4199] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.121348][ T4199] usb 5-1: Product: syz [ 124.157971][ T4199] usb 5-1: Manufacturer: syz [ 124.203046][ T4199] usb 5-1: SerialNumber: syz [ 125.682025][ T4199] usb 5-1: Can't get UAC3 power state for id 10 [ 125.786794][ T4199] usb 5-1: BAAD HEADSET c_chmask mismatch [ 125.932559][ T4199] snd-usb-audio: probe of 5-1:1.0 failed with error -22 [ 125.993825][ T4199] usb 5-1: USB disconnect, device number 4 [ 126.077827][ T5127] udevd[5127]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 127.382915][ T5204] loop1: detected capacity change from 0 to 512 [ 127.460354][ T5204] EXT4-fs (loop1): external journal device major/minor numbers have changed [ 127.519785][ T5208] capability: warning: `syz.4.276' uses deprecated v2 capabilities in a way that may be insecure [ 127.840206][ T5204] block device autoloading is deprecated and will be removed. [ 128.127726][ T5204] EXT4-fs (loop1): external journal has bad superblock [ 128.703001][ T5222] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 128.788309][ T5222] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 128.817586][ T4266] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 128.893226][ T5222] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 129.053203][ T5222] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 129.096038][ T5222] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 129.106009][ T5222] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 129.116453][ T5222] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 129.126697][ T5222] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 129.137359][ T5222] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 129.149777][ T5222] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 129.177176][ T5222] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 129.177940][ T4266] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 129.197096][ T5222] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 129.225676][ T5222] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 129.245813][ T5222] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 129.267535][ T5222] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 129.387023][ T4266] usb 3-1: New USB device found, idVendor=0582, idProduct=00eb, bcdDevice= 0.40 [ 129.402534][ T4266] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.439180][ T4266] usb 3-1: Product: syz [ 129.446843][ T4266] usb 3-1: Manufacturer: syz [ 129.486649][ T4266] usb 3-1: SerialNumber: syz [ 129.546367][ T5237] device syzkaller0 entered promiscuous mode [ 129.605164][ T5237] tipc: Started in network mode [ 129.623898][ T5231] loop3: detected capacity change from 0 to 32768 [ 129.633562][ T5237] tipc: Node identity e28ef1a919fd, cluster identity 4711 [ 129.644915][ T5237] tipc: Enabled bearer , priority 0 [ 129.658755][ T5236] tipc: Resetting bearer [ 129.682941][ T5236] tipc: Disabling bearer [ 130.818828][ T5252] device syzkaller0 entered promiscuous mode [ 130.836822][ T4266] usb 3-1: Can't get UAC3 power state for id 10 [ 130.853271][ T5252] tipc: Enabled bearer , priority 0 [ 130.894574][ T5251] tipc: Resetting bearer [ 130.909631][ T4266] usb 3-1: BAAD HEADSET c_chmask mismatch [ 130.952817][ T5251] tipc: Disabling bearer [ 130.964642][ T4266] snd-usb-audio: probe of 3-1:1.0 failed with error -22 [ 131.133118][ T4266] usb 3-1: USB disconnect, device number 2 [ 131.156065][ T4179] udevd[4179]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 132.787172][ T1419] ieee802154 phy0 wpan0: encryption failed: -22 [ 135.530216][ T5311] netlink: 4 bytes leftover after parsing attributes in process `syz.4.308'. [ 135.539686][ T5311] (unnamed net_device) (uninitialized): Invalid ad_actor_system MAC address. [ 135.549994][ T5311] (unnamed net_device) (uninitialized): option ad_actor_system: invalid value (68719607821) [ 137.297533][ T5331] loop1: detected capacity change from 0 to 1024 [ 137.930352][ T5331] EXT4-fs (loop1): Ignoring removed mblk_io_submit option [ 137.930401][ T5331] EXT4-fs (loop1): bad geometry: bigalloc file system with non-zero first_data_block [ 137.930401][ T5331] [ 139.411327][ T5346] loop0: detected capacity change from 0 to 256 [ 139.690255][ T5346] FAT-fs (loop0): Unrecognized mount option "01777777777777777777777" or missing value [ 140.368100][ T5346] 9pnet: Insufficient options for proto=fd [ 140.449586][ T5346] loop0: detected capacity change from 0 to 256 [ 140.610695][ T5367] bridge0: port 2(bridge_slave_1) entered blocking state [ 140.617871][ T5367] bridge0: port 2(bridge_slave_1) entered forwarding state [ 140.625442][ T5367] bridge0: port 1(bridge_slave_0) entered blocking state [ 140.632635][ T5367] bridge0: port 1(bridge_slave_0) entered forwarding state [ 140.670257][ T5367] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 140.712715][ T5367] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 140.739228][ T5370] binder: 5369:5370 ioctl c0306201 0 returned -14 [ 140.752924][ T5367] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 140.789518][ T5361] ±ÿþ€: renamed from team_slave_1 [ 140.827682][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 142.179616][ T4266] Bluetooth: hci4: command 0x0405 tx timeout [ 142.360197][ T5387] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 142.403495][ T5387] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 142.443436][ T5387] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 142.472998][ T5387] device bridge_slave_0 left promiscuous mode [ 142.528987][ T5387] bridge0: port 1(bridge_slave_0) entered disabled state [ 142.556621][ T1107] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 143.503406][ T5387] device bridge_slave_1 left promiscuous mode [ 143.550471][ T5387] bridge0: port 2(bridge_slave_1) entered disabled state [ 143.778088][ T5387] bond0: (slave bond_slave_0): Releasing backup interface [ 143.884509][ T5387] bond0: (slave bond_slave_1): Releasing backup interface [ 144.113023][ T5387] team0: Port device team_slave_0 removed [ 144.140556][ T5387] team0: Port device team_slave_1 removed [ 144.148849][ T5387] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 144.157162][ T5387] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 144.166425][ T5387] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 144.168205][ T5409] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[4193] was attempted by ""[5409] [ 144.175171][ T5387] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 145.286729][ T1107] usb 3-1: unable to get BOS descriptor or descriptor too short [ 145.536891][ T1107] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 145.854091][ T1107] usb 3-1: can't read configurations, error -71 [ 146.782150][ T5391] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.791429][ T5391] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.802041][ T5391] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.810975][ T5391] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.887011][ T5393] team0: Mode changed to "roundrobin" [ 146.913324][ T5397] netlink: 4 bytes leftover after parsing attributes in process `syz.4.332'. [ 146.986469][ T5422] netlink: 798 bytes leftover after parsing attributes in process `syz.3.339'. [ 148.075812][ T5447] loop2: detected capacity change from 0 to 256 [ 148.143099][ T5450] syz.1.347 uses obsolete (PF_INET,SOCK_PACKET) [ 148.185146][ T5447] exFAT-fs (loop2): failed to load upcase table (idx : 0x00011bf5, chksum : 0xcea91b8a, utbl_chksum : 0xe619d30d) [ 148.192718][ T5450] netlink: 8 bytes leftover after parsing attributes in process `syz.1.347'. [ 148.216920][ T5447] exFAT-fs (loop2): bogus allocation bitmap size(need : 2, cur : 17179869186) [ 148.253868][ T5450] bond0: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 148.269468][ T5452] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 148.363253][ T5452] overlayfs: failed to look up (tracing) for ino (-66) [ 148.550529][ T5457] loop2: detected capacity change from 0 to 2048 [ 148.618035][ T5130] Alternate GPT is invalid, using primary GPT. [ 148.662147][ T5130] loop2: p2 p3 p7 [ 148.754812][ T5457] Alternate GPT is invalid, using primary GPT. [ 148.787135][ T5457] loop2: p2 p3 p7 [ 150.051377][ T5484] loop3: detected capacity change from 0 to 512 [ 150.172350][ T5484] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 150.204271][ T5484] ext4 filesystem being mounted at /80/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 150.765443][ T5501] device macsec1 entered promiscuous mode [ 150.771298][ T5501] device bridge0 entered promiscuous mode [ 155.628400][ T3559] Alternate GPT is invalid, using primary GPT. [ 155.676975][ T3559] loop2: p2 p3 p7 [ 156.839700][ T5522] netlink: 72 bytes leftover after parsing attributes in process `syz.3.371'. [ 157.443807][ T5578] netlink: 'syz.4.373': attribute type 4 has an invalid length. [ 157.683216][ T5130] udevd[5130]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 157.697294][ T4177] udevd[4177]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 157.724095][ T4651] udevd[4651]: inotify_add_watch(7, /dev/loop2p7, 10) failed: No such file or directory [ 158.103946][ T5589] loop0: detected capacity change from 0 to 8 [ 158.394145][ T5589] SQUASHFS error: lzo decompression failed, data probably corrupt [ 158.468798][ T5589] SQUASHFS error: Failed to read block 0x91: -5 [ 158.656733][ T5589] SQUASHFS error: Unable to read metadata cache entry [8f] [ 158.664693][ T5589] SQUASHFS error: Unable to read inode 0x11f [ 159.840800][ T5595] o2cb: This node has not been configured. [ 159.846954][ T5595] o2cb: Cluster check failed. Fix errors before retrying. [ 159.854164][ T5595] (syz.4.378,5595,1):user_dlm_register:675 ERROR: status = -22 [ 159.861765][ T5595] (syz.4.378,5595,1):dlmfs_mkdir:430 ERROR: Error -22 could not register domain "file0" [ 161.044232][ T5625] loop0: detected capacity change from 0 to 512 [ 161.112106][ T5625] EXT4-fs error (device loop0): ext4_orphan_get:1406: inode #15: comm syz.0.388: iget: bad i_size value: 38620345925642 [ 161.156026][ T5625] EXT4-fs error (device loop0): ext4_orphan_get:1411: comm syz.0.388: couldn't read orphan inode 15 (err -117) [ 161.182208][ T5625] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 161.382937][ T5625] EXT4-fs error (device loop0): ext4_validate_block_bitmap:429: comm syz.0.388: bg 0: block 5: invalid block bitmap [ 161.405770][ T5625] EXT4-fs (loop0): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 416 with error 28 [ 161.425976][ T5625] EXT4-fs (loop0): This should not happen!! Data will be lost [ 161.425976][ T5625] [ 161.441106][ T5625] EXT4-fs (loop0): Total free blocks count 0 [ 161.456665][ T5625] EXT4-fs (loop0): Free/Dirty block details [ 161.466113][ T5625] EXT4-fs (loop0): free_blocks=0 [ 161.478887][ T5625] EXT4-fs (loop0): dirty_blocks=420 [ 161.492933][ T5625] EXT4-fs (loop0): Block reservation details [ 161.503565][ T5625] EXT4-fs (loop0): i_reserved_data_blocks=420 [ 162.751582][ T5646] loop3: detected capacity change from 0 to 16 [ 162.810196][ T5651] netlink: 4 bytes leftover after parsing attributes in process `syz.1.397'. [ 162.918846][ T5652] binder: BINDER_SET_CONTEXT_MGR already set [ 162.937171][ T5652] binder: 5648:5652 ioctl 4018620d 200000004a80 returned -16 [ 163.125609][ T5646] erofs: (device loop3): mounted with root inode @ nid 36. [ 163.480065][ T5656] netlink: 12 bytes leftover after parsing attributes in process `syz.4.400'. [ 163.498258][ T5646] attempt to access beyond end of device [ 163.498258][ T5646] loop3: rw=0, want=24, limit=16 [ 163.551706][ T5646] attempt to access beyond end of device [ 163.551706][ T5646] loop3: rw=0, want=24, limit=16 [ 163.567904][ T5646] attempt to access beyond end of device [ 163.567904][ T5646] loop3: rw=0, want=24, limit=16 [ 163.585811][ T5663] netlink: 20 bytes leftover after parsing attributes in process `syz.0.399'. [ 163.608843][ T5656] 8021q: adding VLAN 0 to HW filter on device bond1 [ 163.638769][ T5665] bond1 (unregistering): Released all slaves [ 163.866875][ T5675] tipc: Started in network mode [ 163.877411][ T5675] tipc: Node identity 2007ff, cluster identity 4711 [ 163.904500][ T5675] tipc: Node number set to 2099199 [ 164.050220][ T5676] loop3: detected capacity change from 0 to 8192 [ 165.154726][ T5690] tipc: Failed to remove unknown binding: 66,0,0/0:2948650574/2948650575 [ 165.340811][ T5694] tipc: Failed to remove unknown binding: 66,0,0/0:642816490/642816492 [ 165.498697][ T5690] tipc: Failed to remove unknown binding: 66,0,0/0:2948650574/2948650575 [ 167.124670][ T5711] netlink: 20 bytes leftover after parsing attributes in process `syz.2.415'. [ 167.796970][ T26] audit: type=1326 audit(1781869170.749:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5714 comm="syz.1.417" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 167.885501][ T5715] loop1: detected capacity change from 0 to 1024 [ 167.894270][ T5718] netlink: 28 bytes leftover after parsing attributes in process `syz.3.419'. [ 167.899316][ T26] audit: type=1326 audit(1781869170.799:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5714 comm="syz.1.417" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 167.904688][ T5718] netlink: 28 bytes leftover after parsing attributes in process `syz.3.419'. [ 167.952562][ T26] audit: type=1326 audit(1781869170.809:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5714 comm="syz.1.417" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 167.983200][ T26] audit: type=1326 audit(1781869170.809:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5714 comm="syz.1.417" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 168.006994][ T5718] netlink: 56 bytes leftover after parsing attributes in process `syz.3.419'. [ 168.064322][ T5715] hfsplus: invalid btree flag [ 168.064396][ T26] audit: type=1326 audit(1781869170.809:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5714 comm="syz.1.417" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 168.064426][ T26] audit: type=1326 audit(1781869170.809:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5714 comm="syz.1.417" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 168.099612][ T5715] hfsplus: failed to load extents file [ 168.271831][ T26] audit: type=1326 audit(1781869170.809:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5714 comm="syz.1.417" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 168.411669][ T5740] device syzkaller0 entered promiscuous mode [ 168.420190][ T26] audit: type=1326 audit(1781869170.809:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5714 comm="syz.1.417" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 168.454912][ T26] audit: type=1326 audit(1781869170.809:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5714 comm="syz.1.417" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 169.094452][ T26] audit: type=1326 audit(1781869170.809:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5714 comm="syz.1.417" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 169.287054][ T5749] netlink: 'syz.3.426': attribute type 2 has an invalid length. [ 169.670610][ T5755] loop4: detected capacity change from 0 to 32768 [ 169.796123][ T5755] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 169.804856][ T5755] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 169.847294][ T5756] loop0: detected capacity change from 0 to 4096 [ 169.884347][ T5755] gfs2: fsid=syz:syz.0: journal 0 mapped with 1 extents in 0ms [ 169.950115][ T4195] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 169.969626][ T4195] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 170.924878][ T4266] Bluetooth: hci2: command 0x0406 tx timeout [ 170.932196][ T4266] Bluetooth: hci3: command 0x0406 tx timeout [ 170.938996][ T4266] Bluetooth: hci0: command 0x0406 tx timeout [ 170.945187][ T4266] Bluetooth: hci1: command 0x0406 tx timeout [ 170.952620][ T4266] Bluetooth: hci4: command 0x0406 tx timeout [ 171.087763][ T5756] EXT4-fs (loop0): inline encryption not supported [ 171.584334][ T4195] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 1614ms [ 171.671268][ T4195] gfs2: fsid=syz:syz.0: jid=0: Done [ 171.684397][ T5756] EXT4-fs (loop0): Test dummy encryption mode enabled [ 171.710367][ T5755] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 171.748182][ T5756] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c018, mo2=0003] [ 171.805899][ T5756] System zones: 0-5 [ 171.982500][ T5756] EXT4-fs (loop0): mounted filesystem without journal. Opts: debug,delalloc,inlinecrypt,test_dummy_encryption,errors=continue,errors=continue,delalloc,barrier,,errors=continue. Quota mode: writeback. [ 173.192693][ T5803] netlink: 56 bytes leftover after parsing attributes in process `syz.1.442'. [ 173.574792][ T5805] device syzkaller0 entered promiscuous mode [ 174.162451][ T5811] netlink: 8 bytes leftover after parsing attributes in process `syz.4.436'. [ 176.396709][ T5847] 9pnet: p9_errstr2errno: server reported unknown error 0x000000000000 [ 179.643420][ T5888] netlink: 76 bytes leftover after parsing attributes in process `syz.1.465'. [ 179.731331][ T5892] ±ÿþ€: renamed from team_slave_1 [ 180.338627][ T5902] netlink: 20 bytes leftover after parsing attributes in process `syz.3.467'. [ 181.839232][ T5929] loop3: detected capacity change from 0 to 256 [ 182.033836][ T5940] netlink: 8 bytes leftover after parsing attributes in process `syz.1.479'. [ 184.231144][ T5966] device bridge0 entered promiscuous mode [ 184.237564][ T5966] device macsec2 entered promiscuous mode [ 187.875508][ T5992] tipc: Started in network mode [ 187.891801][ T5992] tipc: Node identity 6608efd54bd5, cluster identity 4711 [ 187.900005][ T5992] tipc: Enabled bearer , priority 0 [ 187.915354][ T5992] tipc: Enabled bearer , priority 10 [ 187.926043][ T5992] tipc: Enabled bearer , priority 27 [ 187.934006][ T5992] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 187.953065][ T5988] tipc: Disabling bearer [ 187.963763][ T5996] netlink: 4 bytes leftover after parsing attributes in process `syz.0.496'. [ 188.116622][ T6001] netlink: 'syz.2.497': attribute type 1 has an invalid length. [ 188.743806][ T6001] 8021q: adding VLAN 0 to HW filter on device bond2 [ 188.815657][ T6004] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 188.861261][ T6004] bond2: (slave batadv1): making interface the new active one [ 188.871541][ T6004] bond2: (slave batadv1): Enslaving as an active interface with an up link [ 189.048357][ T7] tipc: Node number set to 769519573 [ 189.068289][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 190.424551][ T6013] device bridge0 entered promiscuous mode [ 190.430593][ T6013] device macsec1 entered promiscuous mode [ 190.514588][ T6014] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.724871][ T6020] loop2: detected capacity change from 0 to 512 [ 190.752896][ T26] kauditd_printk_skb: 56 callbacks suppressed [ 190.752910][ T26] audit: type=1326 audit(1781869193.709:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6015 comm="syz.0.500" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f89a513de59 code=0x0 [ 190.865174][ T6020] EXT4-fs (loop2): orphan cleanup on readonly fs [ 190.906936][ T6020] Quota error (device loop2): do_check_range: Getting dqdh_prev_free 1536 out of range 0-5 [ 190.926227][ T6028] netlink: 8 bytes leftover after parsing attributes in process `syz.4.504'. [ 190.990281][ T6020] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 190.999438][ T6031] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 191.016665][ T6020] EXT4-fs error (device loop2): ext4_acquire_dquot:6236: comm syz.2.502: Failed to acquire dquot type 1 [ 191.017549][ T6020] Quota error (device loop2): do_check_range: Getting dqdh_prev_free 1536 out of range 0-5 [ 191.070417][ T6020] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 191.086653][ T6020] EXT4-fs error (device loop2): ext4_acquire_dquot:6236: comm syz.2.502: Failed to acquire dquot type 1 [ 191.120843][ T6020] EXT4-fs error (device loop2): ext4_validate_block_bitmap:438: comm syz.2.502: bg 0: block 248: padding at end of block bitmap is not set [ 191.171655][ T6020] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 191.204144][ T6020] Quota error (device loop2): do_check_range: Getting dqdh_prev_free 1536 out of range 0-5 [ 191.207980][ T6038] netlink: 4 bytes leftover after parsing attributes in process `syz.3.508'. [ 191.224215][ T6020] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 191.246346][ T6020] EXT4-fs error (device loop2): ext4_acquire_dquot:6236: comm syz.2.502: Failed to acquire dquot type 1 [ 191.249213][ T6038] netlink: 32 bytes leftover after parsing attributes in process `syz.3.508'. [ 191.291117][ T6020] EXT4-fs (loop2): 1 orphan inode deleted [ 191.316975][ T6020] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 191.331195][ T6040] netlink: 'syz.3.509': attribute type 1 has an invalid length. [ 191.353969][ T6040] device bond1 entered promiscuous mode [ 191.406834][ T6040] 8021q: adding VLAN 0 to HW filter on device bond1 [ 191.415937][ T6020] raw_sendmsg: syz.2.502 forgot to set AF_INET. Fix it! [ 191.487833][ T6040] bond1: (slave bridge1): making interface the new active one [ 191.501263][ T6040] device bridge1 entered promiscuous mode [ 191.526418][ T6040] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 191.558033][ T5567] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 191.720706][ T6046] device syzkaller0 entered promiscuous mode [ 193.018349][ T4233] usb 3-1: new low-speed USB device number 5 using dummy_hcd [ 193.174022][ T6048] bridge0: port 2(bridge_slave_1) entered disabled state [ 193.181317][ T6048] bridge0: port 1(bridge_slave_0) entered disabled state [ 193.244280][ T6048] tipc: Resetting bearer [ 193.416706][ T4233] usb 3-1: unable to get BOS descriptor or descriptor too short [ 193.478091][ T6048] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 193.499058][ T4233] usb 3-1: config 242 has an invalid interface number: 40 but max is 0 [ 193.507703][ T4233] usb 3-1: config 242 has no interface number 0 [ 193.513973][ T4233] usb 3-1: config 242 interface 40 altsetting 4 endpoint 0xD is Bulk; changing to Interrupt [ 193.524306][ T4233] usb 3-1: config 242 interface 40 altsetting 4 endpoint 0x6 has invalid maxpacket 512, setting to 8 [ 193.535870][ T4233] usb 3-1: config 242 interface 40 has no altsetting 0 [ 193.558562][ T6048] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 193.776757][ T4233] usb 3-1: string descriptor 0 read error: -22 [ 193.782983][ T4233] usb 3-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=44.11 [ 193.795043][ T4233] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.816927][ T6052] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 193.839116][ T4233] hdpvr 3-1:242.40: Could not find bulk-in endpoint [ 193.845786][ T4233] hdpvr: probe of 3-1:242.40 failed with error -12 [ 193.892703][ T6048] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.902081][ T6048] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.911420][ T6048] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.920632][ T6048] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.095857][ T6048] netdevsim netdevsim2 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 194.105321][ T6048] netdevsim netdevsim2 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 194.114395][ T6048] netdevsim netdevsim2 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 194.123406][ T6048] netdevsim netdevsim2 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 194.169634][ T1419] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.265786][ T4271] usb 3-1: USB disconnect, device number 5 [ 196.746597][ T6072] device bridge0 entered promiscuous mode [ 196.752488][ T6072] device macsec1 entered promiscuous mode [ 199.229311][ T6100] binder: 6096:6100 ioctl 4018620d 0 returned -22 [ 199.742558][ T6111] x_tables: ip_tables: osf match: only valid for protocol 6 [ 203.409993][ T6147] netlink: 'syz.0.538': attribute type 2 has an invalid length. [ 203.487474][ T6113] loop4: detected capacity change from 0 to 1024 [ 203.739469][ T6113] hfsplus: extend alloc file! (16384,256,150995124) [ 203.765309][ T6113] hfsplus: failed to extend attributes file [ 204.066601][ T4199] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 204.326787][ T4199] usb 4-1: Using ep0 maxpacket: 32 [ 205.917721][ T4199] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 205.956169][ T6182] bridge0: port 1(hsr0) entered blocking state [ 205.962672][ T6182] bridge0: port 1(hsr0) entered disabled state [ 205.974142][ T6182] device hsr0 entered promiscuous mode [ 206.086430][ T4199] usb 4-1: config 0 has no interface number 0 [ 206.377542][ T4199] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 206.444255][ T4199] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.639513][ T4199] usb 4-1: Product: syz [ 206.643727][ T4199] usb 4-1: Manufacturer: syz [ 206.649624][ T4199] usb 4-1: SerialNumber: syz [ 206.657227][ T4199] usb 4-1: config 0 descriptor?? [ 206.708498][ T4199] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 206.726596][ T4199] usb 4-1: selecting invalid altsetting 1 [ 206.732574][ T4199] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 206.768376][ T4199] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 206.802875][ T4199] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 207.005497][ T4199] usb 4-1: media controller created [ 208.420287][ T4199] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 208.617881][ T4199] usb 4-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 208.666255][ T4199] zl10353_read_register: readreg error (reg=127, ret==-71) [ 208.766060][ T4199] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 209.308277][ T6225] netlink: 12 bytes leftover after parsing attributes in process `syz.4.562'. [ 209.940098][ T4199] usb 4-1: USB disconnect, device number 3 [ 210.009157][ T6225] 8021q: adding VLAN 0 to HW filter on device bond1 [ 210.100035][ T6230] device macvlan2 entered promiscuous mode [ 210.237464][ T6230] device bond1 entered promiscuous mode [ 210.243564][ T6230] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 210.300025][ T6230] device bond1 left promiscuous mode [ 212.319506][ T6260] device syzkaller0 entered promiscuous mode [ 213.236595][ T7] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 213.487362][ T7] usb 1-1: Using ep0 maxpacket: 8 [ 213.736653][ T7] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 213.756580][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 214.060727][ T7] pvrusb2: Hardware description: Terratec Grabster AV400 [ 214.142891][ T7] pvrusb2: ********** [ 214.198504][ T7] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 214.348418][ T7] pvrusb2: Important functionality might not be entirely working. [ 214.478759][ T7] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 214.564931][ T7] pvrusb2: ********** [ 214.609201][ T2419] pvrusb2: Invalid write control endpoint [ 214.760440][ T2419] pvrusb2: Invalid write control endpoint [ 214.777371][ T2419] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 214.817651][ T2419] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 214.833534][ T2419] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 214.851431][ T2419] pvrusb2: Device being rendered inoperable [ 214.861442][ T2419] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 214.869784][ T2419] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 214.891638][ T2419] pvrusb2: Attached sub-driver cx25840 [ 214.901989][ T2419] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 214.916871][ T2419] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 215.758927][ T6306] DRBG: could not allocate CTR cipher TFM handle: ctr(aes) [ 216.191203][ T6281] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.200813][ T6281] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.209866][ T6281] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.297417][ T6287] netlink: 14 bytes leftover after parsing attributes in process `syz.1.578'. [ 216.333994][ T6287] bond0 (unregistering): Released all slaves [ 216.345405][ T6292] netlink: 'syz.0.572': attribute type 21 has an invalid length. [ 216.354079][ T6292] netlink: 156 bytes leftover after parsing attributes in process `syz.0.572'. [ 216.406075][ T4195] usb 1-1: USB disconnect, device number 2 [ 219.032927][ T6358] capability: warning: `syz.2.597' uses 32-bit capabilities (legacy support in use) [ 219.099834][ T6353] loop0: detected capacity change from 0 to 2048 [ 219.302326][ T6353] EXT4-fs (loop0): mounted filesystem without journal. Opts: discard,max_dir_size_kb=0x0000000000000004,norecovery,,errors=continue. Quota mode: none. [ 219.342347][ T6369] netlink: 'syz.3.600': attribute type 11 has an invalid length. [ 219.744045][ T6353] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 219.923652][ T6353] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 219.946405][ T6353] EXT4-fs (loop0): This should not happen!! Data will be lost [ 219.946405][ T6353] [ 219.960829][ T6374] loop3: detected capacity change from 0 to 512 [ 219.980256][ T6353] EXT4-fs (loop0): Total free blocks count 0 [ 219.986276][ T6353] EXT4-fs (loop0): Free/Dirty block details [ 219.996611][ T6353] EXT4-fs (loop0): free_blocks=2415919104 [ 220.016827][ T6353] EXT4-fs (loop0): dirty_blocks=16 [ 220.039860][ T6353] EXT4-fs (loop0): Block reservation details [ 220.077023][ T6353] EXT4-fs (loop0): i_reserved_data_blocks=1 [ 220.106103][ T6374] EXT4-fs (loop3): Quota format mount options ignored when QUOTA feature is enabled [ 220.153613][ T6374] EXT4-fs (loop3): orphan cleanup on readonly fs [ 220.164257][ T6353] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 10 with max blocks 22 with error 28 [ 220.177450][ T6380] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 220.193006][ T6374] EXT4-fs warning (device loop3): ext4_enable_quotas:6488: Failed to enable quota tracking (type=0, err=-22, ino=3). Please run e2fsck to fix. [ 220.208228][ T6374] EXT4-fs (loop3): Cannot turn on quotas: error -22 [ 220.214851][ T6374] EXT4-fs error (device loop3): ext4_orphan_get:1432: comm syz.3.600: bad orphan inode 768 [ 220.228404][ T6353] EXT4-fs (loop0): This should not happen!! Data will be lost [ 220.228404][ T6353] [ 220.243736][ T6380] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 220.254241][ T6374] EXT4-fs (loop3): mounted filesystem without journal. Opts: jqfmt=vfsold,noauto_da_alloc,delalloc,,errors=continue. Quota mode: writeback. [ 220.288798][ T6380] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 220.291450][ T6385] device syzkaller0 entered promiscuous mode [ 220.404017][ T6369] EXT4-fs (loop3): warning: mounting fs with errors, running e2fsck is recommended [ 220.484024][ T6390] netlink: 8 bytes leftover after parsing attributes in process `syz.0.605'. [ 220.493345][ T6390] netlink: 4 bytes leftover after parsing attributes in process `syz.0.605'. [ 220.522437][ T6369] EXT4-fs warning (device loop3): ext4_enable_quotas:6488: Failed to enable quota tracking (type=0, err=-22, ino=3). Please run e2fsck to fix. [ 220.725560][ T6405] netlink: 'syz.2.608': attribute type 10 has an invalid length. [ 220.756296][ T6403] tipc: Started in network mode [ 220.768754][ T6403] tipc: Node identity 8a214501fc81, cluster identity 4711 [ 220.776201][ T6403] tipc: Enabled bearer , priority 0 [ 220.817027][ T6403] device syzkaller0 entered promiscuous mode [ 220.842590][ T4234] syzkaller0: tun_net_xmit 70 [ 220.886411][ T6403] tipc: Resetting bearer [ 220.906353][ T6403] syzkaller0: tun_net_xmit 90 [ 220.947987][ T6402] tipc: Resetting bearer [ 220.973517][ T6402] tipc: Disabling bearer [ 221.102760][ T6428] loop0: detected capacity change from 0 to 512 [ 221.122233][ T6428] EXT4-fs (loop0): bad s_min_extra_isize: 40992 [ 221.875204][ T6434] loop4: detected capacity change from 0 to 2048 [ 222.359292][ T6442] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 228.414041][ T26] audit: type=1800 audit(1781869231.369:77): pid=6434 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.619" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop4" ino=2097152 res=0 errno=0 [ 228.491696][ T26] audit: type=1800 audit(1781869231.449:78): pid=6443 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.619" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 229.700000][ T6480] loop0: detected capacity change from 0 to 256 [ 233.548951][ T6512] syz.1.640[6512] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 233.549107][ T6512] syz.1.640[6512] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 235.476157][ T6546] IPVS: Error joining to the multicast group [ 237.274769][ T6556] loop2: detected capacity change from 0 to 164 [ 237.507126][ T6557] ./file0: Can't open blockdev [ 237.691223][ T6579] device syzkaller0 entered promiscuous mode [ 238.590193][ T4195] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 239.097036][ T6597] netlink: 156 bytes leftover after parsing attributes in process `syz.3.665'. [ 240.795860][ T4195] usb 1-1: Using ep0 maxpacket: 16 [ 241.037792][ T4195] usb 1-1: device descriptor read/all, error -71 [ 241.194298][ T6608] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 241.203997][ T6608] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 241.212791][ T6608] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 241.576698][ T4195] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 241.897162][ T4195] usb 1-1: Using ep0 maxpacket: 16 [ 242.146866][ T4195] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 242.244741][ T4195] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 242.255020][ T4195] usb 1-1: config 0 interface 0 has no altsetting 0 [ 242.262066][ T4195] usb 1-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 242.272006][ T4195] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 242.469152][ T4195] usb 1-1: config 0 descriptor?? [ 242.808290][ T6631] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 243.317154][ T6629] loop2: detected capacity change from 0 to 2048 [ 243.387469][ T6637] tipc: Enabled bearer , priority 0 [ 243.425462][ T6637] tipc: Resetting bearer [ 243.589592][ T4195] hid-generic 0003:1E71:2009.0001: unknown main item tag 0x0 [ 243.598819][ T4195] hid-generic 0003:1E71:2009.0001: unknown main item tag 0x0 [ 243.624114][ T4195] hid-generic 0003:1E71:2009.0001: unknown main item tag 0x0 [ 243.648748][ T4195] hid-generic 0003:1E71:2009.0001: unknown main item tag 0x0 [ 243.699017][ T4195] hid-generic 0003:1E71:2009.0001: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.0-1/input0 [ 243.821531][ T6629] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 244.784234][ T4195] usb 1-1: USB disconnect, device number 4 [ 245.035624][ T6653] loop4: detected capacity change from 0 to 512 [ 245.318770][ T6656] fido_id[6656]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 248.242085][ T6653] EXT4-fs: error -4 creating inode table initialization thread [ 248.287233][ T6653] EXT4-fs (loop4): mount failed [ 248.695133][ T6686] netlink: 4 bytes leftover after parsing attributes in process `syz.1.694'. [ 248.799783][ T6686] device team0 entered promiscuous mode [ 248.838324][ T6686] 8021q: adding VLAN 0 to HW filter on device team0 [ 251.582939][ T6722] trusted_key: encrypted_key: master key parameter 'šÙ|™{E' is invalid [ 252.271935][ T6719] loop0: detected capacity change from 0 to 2048 [ 252.369789][ T6726] netlink: 8 bytes leftover after parsing attributes in process `syz.3.708'. [ 252.386258][ T6726] netlink: 48 bytes leftover after parsing attributes in process `syz.3.708'. [ 252.426197][ T6726] device geneve2 entered promiscuous mode [ 252.513849][ T6719] EXT4-fs (loop0): mounted filesystem without journal. Opts: bsddf,user_xattr,debug_want_extra_isize=0x0000000000000006,,errors=continue. Quota mode: none. [ 252.651497][ T6719] mmap: syz.0.704 (6719) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 252.676360][ T6728] 8021q: adding VLAN 0 to HW filter on device bond2 [ 252.732648][ T6724] device syzkaller0 entered promiscuous mode [ 252.765002][ T6736] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 252.795350][ T6736] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 252.804567][ T6736] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 252.822895][ T6736] bond2: (slave geneve2): Enslaving as a backup interface with an up link [ 252.847990][ T4363] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 252.897313][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 253.023956][ T6754] loop3: detected capacity change from 0 to 8 [ 253.066812][ T4240] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 253.094776][ T6754] SQUASHFS error: lzo decompression failed, data probably corrupt [ 253.123705][ T6754] SQUASHFS error: Failed to read block 0x62b: -5 [ 253.131474][ T6754] SQUASHFS error: Unable to read metadata cache entry [629] [ 253.145523][ T6754] SQUASHFS error: Unable to read inode 0x11f [ 253.202898][ T6756] loop0: detected capacity change from 0 to 4096 [ 253.267313][ T6756] EXT4-fs (loop0): Test dummy encryption mode enabled [ 253.288999][ T6756] EXT4-fs (loop0): Ignoring removed nobh option [ 253.315877][ T6756] EXT4-fs (loop0): mounted filesystem without journal. Opts: test_dummy_encryption=v1,nobh,,errors=continue. Quota mode: writeback. [ 253.732095][ T6770] device batadv_slave_0 entered promiscuous mode [ 253.749483][ T6767] device batadv_slave_0 left promiscuous mode [ 254.717511][ T6774] IPVS: set_ctl: invalid protocol: 2 0.0.0.0:20002 [ 254.784395][ T6784] loop4: detected capacity change from 0 to 256 [ 255.323414][ T6784] exfat: Deprecated parameter 'utf8' [ 255.364341][ T6784] exfat: Bad value for 'errors' [ 255.609141][ T1419] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.766738][ T4234] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 256.016768][ T4234] usb 3-1: Using ep0 maxpacket: 16 [ 256.367474][ T4234] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 256.421137][ T4234] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 256.431856][ T4234] usb 3-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 256.445472][ T4234] usb 3-1: config 0 interface 0 has no altsetting 0 [ 256.452640][ T4234] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 256.500910][ T4234] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 256.533372][ T4234] usb 3-1: config 0 descriptor?? [ 256.852329][ T26] audit: type=1326 audit(1781869259.809:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6813 comm="syz.1.735" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f0f94bdbe59 code=0x0 [ 256.867010][ T7] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 257.039753][ T4234] hid (null): report_id 0 is invalid [ 257.047250][ T4234] hid (null): report_id 0 is invalid [ 257.847903][ T4234] usb 3-1: USB disconnect, device number 6 [ 258.146798][ T7] usb 4-1: config 0 has no interfaces? [ 258.152504][ T7] usb 4-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 258.181672][ T7] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 258.233235][ T7] usb 4-1: config 0 descriptor?? [ 258.304474][ T6837] loop4: detected capacity change from 0 to 32768 [ 259.123694][ T6854] netlink: 'syz.2.746': attribute type 10 has an invalid length. [ 259.148626][ T6854] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 259.204471][ T7] usb 4-1: USB disconnect, device number 4 [ 259.275377][ T6863] netlink: 'syz.0.749': attribute type 1 has an invalid length. [ 259.918406][ T6863] device bond1 entered promiscuous mode [ 259.928402][ T6863] 8021q: adding VLAN 0 to HW filter on device bond1 [ 260.068257][ T6868] 8021q: adding VLAN 0 to HW filter on device bond2 [ 260.116413][ T6868] bond1: (slave bond2): making interface the new active one [ 260.161875][ T6868] device bond2 entered promiscuous mode [ 260.201774][ T6868] bond1: (slave bond2): Enslaving as an active interface with an up link [ 260.264441][ T6869] bond1: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 260.485736][ T6869] bond1: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 260.501347][ T4363] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 260.928389][ T6884] device syzkaller0 entered promiscuous mode [ 261.056385][ T6897] device syzkaller0 entered promiscuous mode [ 262.219760][ T6915] netlink: 'syz.1.764': attribute type 1 has an invalid length. [ 262.248057][ T26] audit: type=1326 audit(1781869265.209:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6908 comm="syz.4.761" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f52cb38de59 code=0x0 [ 266.090799][ T6915] 8021q: adding VLAN 0 to HW filter on device bond0 [ 267.383141][ T6927] bond0: (slave ip6gretap1): making interface the new active one [ 267.539172][ T6927] bond0: (slave ip6gretap1): Enslaving as an active interface with an up link [ 268.322237][ T5565] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 269.401347][ T6966] netlink: 4 bytes leftover after parsing attributes in process `syz.4.777'. [ 270.388746][ T6980] loop4: detected capacity change from 0 to 256 [ 274.483147][ T7003] loop3: detected capacity change from 0 to 4096 [ 274.521450][ T7003] EXT4-fs (loop3): inline encryption not supported [ 274.557261][ T4234] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 274.627344][ T7003] EXT4-fs (loop3): Test dummy encryption mode enabled [ 274.787482][ T7003] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c018, mo2=0003] [ 274.917057][ T4234] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 274.929354][ T7003] System zones: 0-5 [ 274.974913][ T4234] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 275.067695][ T7003] EXT4-fs (loop3): mounted filesystem without journal. Opts: debug,delalloc,inlinecrypt,test_dummy_encryption,errors=continue,errors=continue,delalloc,barrier,,errors=continue. Quota mode: writeback. [ 275.176617][ T4234] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 275.195920][ T4234] usb 3-1: config 1 has no interface number 1 [ 275.215279][ T4234] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 275.296648][ T4234] usb 3-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 275.536737][ T4234] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 275.898464][ T4234] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 276.069963][ T4234] usb 3-1: Product: syz [ 276.303976][ T4234] usb 3-1: Manufacturer: syz [ 276.311066][ T4234] usb 3-1: SerialNumber: syz [ 276.563717][ T7041] loop0: detected capacity change from 0 to 256 [ 280.687913][ T7050] device syzkaller0 entered promiscuous mode [ 280.697089][ T4234] usb 3-1: MIDIStreaming interface descriptor not found [ 281.428914][ T4234] usb 3-1: USB disconnect, device number 7 [ 282.188013][ T7055] netlink: 132 bytes leftover after parsing attributes in process `syz.1.805'. [ 282.228216][ T7055] netlink: 132 bytes leftover after parsing attributes in process `syz.1.805'. [ 282.274016][ T7055] netlink: 39 bytes leftover after parsing attributes in process `syz.1.805'. [ 282.436905][ T7060] udevd[7060]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 288.469113][ T7113] device syzkaller0 entered promiscuous mode [ 288.585106][ T7123] loop3: detected capacity change from 0 to 256 [ 289.612713][ T7136] netlink: 24 bytes leftover after parsing attributes in process `syz.1.824'. [ 289.686656][ T26] audit: type=1800 audit(1781869292.619:81): pid=7142 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.825" name="SYSV00000000" dev="hugetlbfs" ino=1 res=0 errno=0 [ 290.549807][ T7123] netlink: 132 bytes leftover after parsing attributes in process `syz.3.832'. [ 290.576505][ T7123] netlink: 132 bytes leftover after parsing attributes in process `syz.3.832'. [ 290.585697][ T7123] netlink: 39 bytes leftover after parsing attributes in process `syz.3.832'. [ 290.758947][ T7157] tipc: Enabling of bearer rejected, failed to enable media [ 290.771537][ T7157] tipc: Enabled bearer , priority 10 [ 293.010290][ T7157] tipc: Enabled bearer , priority 27 [ 293.128736][ T7157] tipc: Enabled bearer , priority 12 [ 293.156789][ T7174] device syzkaller0 entered promiscuous mode [ 293.734506][ T4234] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 294.481041][ T7197] netlink: 8 bytes leftover after parsing attributes in process `syz.1.839'. [ 295.471976][ T4234] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 295.491557][ T4234] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 295.975867][ T4234] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 295.989812][ T4234] usb 4-1: config 1 has no interface number 1 [ 295.996028][ T4234] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 296.009571][ T4234] usb 4-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 296.076593][ T4234] usb 4-1: string descriptor 0 read error: -71 [ 296.085024][ T4234] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 296.172301][ T4234] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 296.196687][ T4234] usb 4-1: can't set config #1, error -71 [ 296.203979][ T4234] usb 4-1: USB disconnect, device number 5 [ 296.313525][ T7217] bridge0: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 300.256126][ T7266] netlink: 8 bytes leftover after parsing attributes in process `syz.0.861'. [ 300.988543][ T7267] bridge0: port 3(hsr0) entered blocking state [ 300.994763][ T7267] bridge0: port 3(hsr0) entered disabled state [ 301.002126][ T7267] device hsr0 entered promiscuous mode [ 301.302687][ T7276] netlink: 'syz.3.862': attribute type 1 has an invalid length. [ 301.354475][ T7276] 8021q: adding VLAN 0 to HW filter on device bond2 [ 301.398093][ T7278] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 301.514577][ T7278] bond2: (slave batadv1): making interface the new active one [ 301.545701][ T7278] bond2: (slave batadv1): Enslaving as an active interface with an up link [ 301.563728][ T4240] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 301.644320][ T7276] bond2 (unregistering): (slave batadv1): Releasing active interface [ 301.702863][ T7276] bond2 (unregistering): Released all slaves [ 301.927747][ T7292] device syzkaller0 entered promiscuous mode [ 301.968153][ T7296] binder: 7295:7296 ioctl 4018620d 0 returned -22 [ 303.309189][ T7310] SET target dimension over the limit! [ 306.104177][ T7356] netlink: 8 bytes leftover after parsing attributes in process `syz.0.887'. [ 306.455132][ T7367] loop4: detected capacity change from 0 to 2048 [ 306.776240][ T7367] UDF-fs: error (device loop4): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 306.788977][ T7367] UDF-fs: error (device loop4): udf_read_tagged: tag checksum failed, block 160: 0xd2 != 0xd4 [ 306.806769][ T7367] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 307.329710][ C0] hrtimer: interrupt took 461147 ns [ 307.383580][ T7388] overlayfs: bad mount option "redirect_dir=off:/" [ 307.542912][ T7393] 9pnet_virtio: no channels available for device ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 307.544691][ T7393] @0Ù: renamed from bond_slave_1 [ 308.365927][ T7398] device syzkaller0 entered promiscuous mode [ 308.426080][ T7400] device syzkaller0 entered promiscuous mode [ 308.464794][ T7397] netlink: 14 bytes leftover after parsing attributes in process `syz.0.902'. [ 308.501613][ T7397] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 308.518743][ T7397] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 308.536070][ T7397] bond0 (unregistering): Released all slaves [ 310.556290][ T7436] DRBG: could not allocate CTR cipher TFM handle: ctr(aes) [ 310.614400][ T7443] loop0: detected capacity change from 0 to 512 [ 310.677304][ T7443] EXT4-fs (loop0): Test dummy encryption mode enabled [ 310.802264][ T7443] EXT4-fs error (device loop0): ext4_orphan_get:1406: inode #15: comm syz.0.917: inode has both inline data and extents flags [ 310.893891][ T7443] EXT4-fs error (device loop0): ext4_orphan_get:1411: comm syz.0.917: couldn't read orphan inode 15 (err -117) [ 310.926789][ T7443] EXT4-fs (loop0): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue. Quota mode: writeback. [ 311.442174][ T7443] fscrypt (loop0): Missing crypto API support for AES-256-XTS (API name: "xts(aes)") [ 316.904482][ T7528] loop2: detected capacity change from 0 to 256 [ 317.044887][ T1419] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.925235][ T7532] netlink: 'syz.3.937': attribute type 4 has an invalid length. [ 318.242878][ T7540] vivid-000: disconnect [ 318.294812][ T7541] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 318.752984][ T7537] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 318.818957][ T7533] vivid-000: reconnect [ 318.930825][ T7543] netlink: 14 bytes leftover after parsing attributes in process `syz.2.940'. [ 318.971915][ T7543] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 318.997447][ T7543] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 319.018480][ T7543] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 319.052082][ T7543] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 319.089718][ T7543] bond0 (unregistering): Released all slaves [ 319.959438][ T7565] netlink: 8 bytes leftover after parsing attributes in process `syz.4.945'. [ 320.165502][ T7565] netlink: 4 bytes leftover after parsing attributes in process `syz.4.945'. [ 320.443843][ T7580] netlink: 'syz.2.949': attribute type 11 has an invalid length. [ 320.526884][ T7584] loop4: detected capacity change from 0 to 256 [ 321.024133][ T7580] loop2: detected capacity change from 0 to 512 [ 323.104128][ T7580] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 324.164025][ T7580] EXT4-fs: failed to create workqueue [ 324.226915][ T7580] EXT4-fs (loop2): mount failed [ 326.522361][ T7632] netlink: 'syz.2.967': attribute type 39 has an invalid length. [ 327.279662][ T7634] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 327.288325][ T7634] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 327.295743][ T7634] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 327.311249][ T7634] IPv6: ADDRCONF(NETDEV_CHANGE): syzkaller0: link becomes ready [ 327.602009][ T7640] IPVS: Error joining to the multicast group [ 328.435895][ T7651] netlink: 12 bytes leftover after parsing attributes in process `syz.3.972'. [ 328.474211][ T7648] loop0: detected capacity change from 0 to 2048 [ 328.528325][ T7651] bridge2: port 1(veth3) entered blocking state [ 328.699842][ T7651] bridge2: port 1(veth3) entered disabled state [ 330.580288][ T7652] ./file0: Can't open blockdev [ 330.690276][ T7651] device veth3 entered promiscuous mode [ 330.710697][ T7660] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 330.818037][ T7659] bridge2: port 2(veth5) entered blocking state [ 330.830473][ T7659] bridge2: port 2(veth5) entered disabled state [ 331.658743][ T7659] device veth5 entered promiscuous mode [ 334.731233][ T7700] device syzkaller0 entered promiscuous mode [ 336.314766][ T7712] device ip6gre1 entered promiscuous mode [ 336.939322][ T4266] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 336.948586][ T7715] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 336.982591][ T4266] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 336.995139][ T7717] loop3: detected capacity change from 0 to 256 [ 337.092225][ T4236] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 337.116909][ T7717] exFAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 337.168609][ T7717] exFAT-fs (loop3): Medium has reported failures. Some data may be lost. [ 337.557064][ T4266] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 337.576354][ T7717] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 337.677310][ T4266] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 337.836580][ T7721] loop4: detected capacity change from 0 to 2048 [ 337.893153][ T7721] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 338.059779][ T7737] loop3: detected capacity change from 0 to 512 [ 338.119646][ T7733] loop2: detected capacity change from 0 to 512 [ 338.216634][ T7737] EXT4-fs (loop3): Ignoring removed nobh option [ 338.223421][ T7737] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 338.467474][ T7733] EXT4-fs: Invalid sb specification: sb=0x000000000000000eJdebug,jqfmt=vfsold,nobh,barrier,usrjquota="block_validity,errors=remount-ro,, [ 338.838938][ T7733] EXT4-fs (loop2): Unrecognized mount option "sb=0x000000000000000eJdebug" or missing value [ 338.986402][ T7737] EXT4-fs (loop3): 1 truncate cleaned up [ 339.002469][ T7737] EXT4-fs (loop3): mounted filesystem without journal. Opts: errors=remount-ro,nobh,debug_want_extra_isize=0x0000000000000068,mb_optimize_scan=0x0000000000000001,max_batch_time=0x0000000000000007,dioread_lock,. Quota mode: none. [ 339.443914][ T7733] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 340.293763][ T7766] trusted_key: encrypted_key: master key parameter 'šÙ|™{E' is invalid [ 340.876591][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 341.706552][ T1107] usb 1-1: new low-speed USB device number 5 using dummy_hcd [ 342.096720][ T1107] usb 1-1: config index 0 descriptor too short (expected 1307, got 27) [ 342.105016][ T1107] usb 1-1: config 0 has an invalid interface number: 0 but max is -1 [ 342.121923][ T7788] netlink: 'syz.3.1010': attribute type 2 has an invalid length. [ 342.138327][ T1107] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 342.156635][ T1107] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 342.216903][ T1107] usb 1-1: string descriptor 0 read error: -22 [ 342.224584][ T1107] usb 1-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=c3.de [ 342.244121][ T1107] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 342.262277][ T1107] usb 1-1: config 0 descriptor?? [ 342.308822][ T1107] hub 1-1:0.0: bad descriptor, ignoring hub [ 342.324533][ T1107] hub: probe of 1-1:0.0 failed with error -5 [ 342.656902][ T7770] loop0: detected capacity change from 0 to 32768 [ 342.752236][ T7770] (syz.0.1005,7770,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 342.771334][ T7770] (syz.0.1005,7770,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 342.793677][ T7770] (syz.0.1005,7770,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0x656d756e, computed 0x6ffed392. Applying ECC. [ 342.807923][ T7770] (syz.0.1005,7770,0):ocfs2_block_check_validate:416 ERROR: Fixed CRC32 failed: stored: 0x656d756e, computed 0xb3a26753 [ 342.820648][ T7770] (syz.0.1005,7770,0):ocfs2_validate_dir_block:452 ERROR: Checksum failed for dinode 288 [ 342.830544][ T7770] (syz.0.1005,7770,0):ocfs2_read_virt_blocks:1021 ERROR: status = -5 [ 342.839394][ T7770] (syz.0.1005,7770,0):ocfs2_read_dir_block:511 ERROR: status = -5 [ 342.847269][ T7770] (syz.0.1005,7770,0):ocfs2_find_entry_el:728 ERROR: reading directory 18, offset 0 [ 342.857583][ T7770] (syz.0.1005,7770,0):ocfs2_init_global_system_inodes:462 ERROR: status = -22 [ 342.866536][ T7770] (syz.0.1005,7770,0):ocfs2_init_global_system_inodes:464 ERROR: Unable to load system inode 1, possibly corrupt fs? [ 342.866568][ T7770] (syz.0.1005,7770,0):ocfs2_init_global_system_inodes:473 ERROR: status = -22 [ 342.888115][ T7770] (syz.0.1005,7770,0):ocfs2_initialize_super:2281 ERROR: status = -22 [ 342.896320][ T7770] (syz.0.1005,7770,0):ocfs2_fill_super:1177 ERROR: status = -22 [ 343.487412][ T6061] usb 1-1: USB disconnect, device number 5 [ 343.956340][ T7821] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1017'. [ 344.009739][ T7821] device team0 entered promiscuous mode [ 344.015875][ T7821] 8021q: adding VLAN 0 to HW filter on device team0 [ 346.819520][ T7835] 8021q: adding VLAN 0 to HW filter on device bond0 [ 346.944885][ T7855] netlink: 'syz.4.1026': attribute type 2 has an invalid length. [ 347.012083][ T7835] bond0: (slave geneve2): Enslaving as a backup interface with an up link [ 347.096888][ T5567] bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 347.109394][ T4240] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 347.296019][ T4315] bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 349.046564][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 349.429093][ T7897] netlink: 'syz.4.1039': attribute type 1 has an invalid length. [ 350.019333][ T7897] 8021q: adding VLAN 0 to HW filter on device bond3 [ 356.545443][ T7979] netlink: 'syz.1.1059': attribute type 1 has an invalid length. [ 356.589401][ T26] audit: type=1326 audit(1781869359.549:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7981 comm="syz.3.1061" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f29aa365e59 code=0x7ffc0000 [ 356.651085][ T7977] binder_alloc: 7976: binder_alloc_buf, no vma [ 356.819793][ T26] audit: type=1326 audit(1781869359.779:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7981 comm="syz.3.1061" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f29aa365e59 code=0x7ffc0000 [ 356.844964][ T26] audit: type=1326 audit(1781869359.779:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7981 comm="syz.3.1061" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f29aa365e59 code=0x7ffc0000 [ 356.877097][ T26] audit: type=1326 audit(1781869359.779:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7981 comm="syz.3.1061" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f29aa365e59 code=0x7ffc0000 [ 356.901580][ T26] audit: type=1326 audit(1781869359.829:86): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7981 comm="syz.3.1061" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=441 compat=0 ip=0x7f29aa365e59 code=0x7ffc0000 [ 356.984206][ T7979] 8021q: adding VLAN 0 to HW filter on device bond1 [ 357.036217][ T7986] loop3: detected capacity change from 0 to 512 [ 357.142333][ T7986] EXT4-fs (loop3): Ignoring removed bh option [ 357.157473][ T7986] EXT4-fs (loop3): Test dummy encryption mode enabled [ 357.165159][ T7986] EXT4-fs (loop3): Using encoding defined by superblock: utf8-12.1.0 with flags 0x0 [ 357.174659][ T7986] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 357.183817][ T7986] EXT4-fs (loop3): The Hurd can't support 64-bit file systems [ 357.222924][ T26] audit: type=1326 audit(1781869359.829:87): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7981 comm="syz.3.1061" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f29aa365e59 code=0x7ffc0000 [ 357.830139][ T7984] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 357.839521][ T7984] bond1: (slave batadv1): making interface the new active one [ 357.849298][ T7984] bond1: (slave batadv1): Enslaving as an active interface with an up link [ 357.859350][ T26] audit: type=1326 audit(1781869359.829:88): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7981 comm="syz.3.1061" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7f29aa365e59 code=0x7ffc0000 [ 357.877775][ T7994] syz.0.1064[7994] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 357.934027][ T7994] syz.0.1064[7994] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 357.946333][ T7985] bond1 (unregistering): (slave batadv1): Releasing active interface [ 358.041978][ T26] audit: type=1326 audit(1781869359.829:89): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7981 comm="syz.3.1061" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f29aa365e59 code=0x7ffc0000 [ 358.095989][ T26] audit: type=1326 audit(1781869359.829:90): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7981 comm="syz.3.1061" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7f29aa365e59 code=0x7ffc0000 [ 358.616143][ T26] audit: type=1326 audit(1781869359.869:91): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7981 comm="syz.3.1061" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f29aa365e59 code=0x7ffc0000 [ 358.840581][ T7985] bond1 (unregistering): Released all slaves [ 359.440131][ T8011] device syzkaller0 entered promiscuous mode [ 361.131606][ T8031] xt_ipcomp: unknown flags 1D [ 361.261167][ T8033] qnx6: unable to read the first superblock [ 363.939385][ T8066] netlink: 196 bytes leftover after parsing attributes in process `syz.4.1082'. [ 363.954550][ T8066] netlink: 196 bytes leftover after parsing attributes in process `syz.4.1082'. [ 363.963948][ T8066] netlink: 19 bytes leftover after parsing attributes in process `syz.4.1082'. [ 365.046762][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 368.289897][ T8097] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1089'. [ 370.938778][ T8117] loop2: detected capacity change from 0 to 2048 [ 370.954691][ T8118] device bridge1 entered promiscuous mode [ 371.115685][ T8117] EXT4-fs (loop2): mounted filesystem without journal. Opts: discard,max_dir_size_kb=0x0000000000000004,norecovery,,errors=continue. Quota mode: none. [ 371.841001][ T8117] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 371.954174][ T8117] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 22 with error 28 [ 371.967119][ T8140] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1099'. [ 372.010581][ T8140] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1099'. [ 372.020010][ T8117] EXT4-fs (loop2): This should not happen!! Data will be lost [ 372.020010][ T8117] [ 372.035079][ T8117] EXT4-fs (loop2): Total free blocks count 0 [ 372.043563][ T8117] EXT4-fs (loop2): Free/Dirty block details [ 372.043764][ T26] kauditd_printk_skb: 25 callbacks suppressed [ 372.043857][ T26] audit: type=1800 audit(1781869374.999:117): pid=8126 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1096" name="bus" dev="ramfs" ino=44617 res=0 errno=0 [ 372.050091][ T8117] EXT4-fs (loop2): free_blocks=2415919104 [ 372.091742][ T8142] loop0: detected capacity change from 0 to 2048 [ 372.232828][ T8117] EXT4-fs (loop2): dirty_blocks=32 [ 372.255272][ T8148] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 372.274822][ T8117] EXT4-fs (loop2): Block reservation details [ 372.280980][ T8117] EXT4-fs (loop2): i_reserved_data_blocks=2 [ 372.342603][ T26] audit: type=1800 audit(1781869375.299:118): pid=8142 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1100" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop0" ino=2097152 res=0 errno=0 [ 373.157069][ T8159] netlink: 'syz.4.1106': attribute type 11 has an invalid length. [ 373.222814][ T8159] loop4: detected capacity change from 0 to 512 [ 373.429563][ T8159] EXT4-fs (loop4): Quota format mount options ignored when QUOTA feature is enabled [ 373.465866][ T8159] EXT4-fs (loop4): orphan cleanup on readonly fs [ 373.654641][ T8159] EXT4-fs warning (device loop4): ext4_enable_quotas:6488: Failed to enable quota tracking (type=0, err=-22, ino=3). Please run e2fsck to fix. [ 373.949776][ T8159] EXT4-fs (loop4): Cannot turn on quotas: error -22 [ 374.529956][ T8159] EXT4-fs error (device loop4): ext4_orphan_get:1432: comm syz.4.1106: bad orphan inode 768 [ 374.581687][ T8159] EXT4-fs (loop4): mounted filesystem without journal. Opts: jqfmt=vfsold,noauto_da_alloc,delalloc,,errors=continue. Quota mode: writeback. [ 374.696392][ T8159] EXT4-fs (loop4): warning: mounting fs with errors, running e2fsck is recommended [ 375.986568][ T8159] EXT4-fs warning (device loop4): ext4_multi_mount_protect:403: Unable to create kmmpd thread for loop4. [ 376.044162][ T26] audit: type=1326 audit(1781869378.999:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8171 comm="syz.2.1110" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7faf0bc76e59 code=0x0 [ 376.103577][ T8184] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1114'. [ 376.330276][ T8192] loop3: detected capacity change from 0 to 2048 [ 376.544332][ T8192] EXT4-fs (loop3): mounted filesystem without journal. Opts: discard,max_dir_size_kb=0x0000000000000004,norecovery,,errors=continue. Quota mode: none. [ 377.516909][ T8192] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 377.603993][ T8192] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 377.686882][ T8192] EXT4-fs (loop3): This should not happen!! Data will be lost [ 377.686882][ T8192] [ 377.734840][ T8192] EXT4-fs (loop3): Total free blocks count 0 [ 377.744481][ T8192] EXT4-fs (loop3): Free/Dirty block details [ 377.757572][ T8192] EXT4-fs (loop3): free_blocks=2415919104 [ 377.773663][ T8192] EXT4-fs (loop3): dirty_blocks=16 [ 377.801742][ T8192] EXT4-fs (loop3): Block reservation details [ 377.812023][ T8192] EXT4-fs (loop3): i_reserved_data_blocks=1 [ 377.845107][ T5567] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 10 with max blocks 1 with error 28 [ 377.854666][ T8218] netlink: 'syz.2.1121': attribute type 1 has an invalid length. [ 377.876588][ T5567] EXT4-fs (loop3): This should not happen!! Data will be lost [ 377.876588][ T5567] [ 378.063937][ T8223] loop4: detected capacity change from 0 to 1024 [ 378.086203][ T8218] 8021q: adding VLAN 0 to HW filter on device bond3 [ 378.494565][ T1419] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.719533][ T8218] bond0: (slave bond3): making interface the new active one [ 378.788425][ T8218] bond0: (slave bond3): Enslaving as an active interface with an up link [ 378.971702][ T8234] bond0: (slave gretap1): Enslaving as a backup interface with an up link [ 379.950270][ T8281] device syzkaller0 entered promiscuous mode [ 380.052190][ T4251] hfsplus: bad catalog file entry [ 380.096967][ T4251] hfsplus: b-tree write err: -5, ino 3 [ 382.061947][ T8305] netlink: 'syz.0.1137': attribute type 10 has an invalid length. [ 382.099176][ T8309] netlink: 'syz.4.1136': attribute type 1 has an invalid length. [ 382.227921][ T8309] device bond4 entered promiscuous mode [ 382.249540][ T8309] 8021q: adding VLAN 0 to HW filter on device bond4 [ 383.023408][ T8317] bond4: (slave bridge1): making interface the new active one [ 383.088394][ T8317] device bridge1 entered promiscuous mode [ 383.095381][ T8317] bond4: (slave bridge1): Enslaving as an active interface with an up link [ 383.104424][ T4240] IPv6: ADDRCONF(NETDEV_CHANGE): bond4: link becomes ready [ 383.933791][ T8340] xt_connbytes: Forcing CT accounting to be enabled [ 384.146726][ T8340] xt_CT: No such helper "netbios-ns" [ 386.436308][ T8372] loop0: detected capacity change from 0 to 512 [ 386.448650][ T8374] netlink: 'syz.2.1155': attribute type 1 has an invalid length. [ 386.531562][ T8374] device bond4 entered promiscuous mode [ 386.618048][ T8374] 8021q: adding VLAN 0 to HW filter on device bond4 [ 386.643841][ T8374] bond4: (slave bridge1): making interface the new active one [ 386.652083][ T8374] device bridge1 entered promiscuous mode [ 386.834944][ T8387] x_tables: ip_tables: osf match: only valid for protocol 6 [ 388.157896][ T8374] bond4: (slave bridge1): Enslaving as an active interface with an up link [ 388.365127][ T5569] IPv6: ADDRCONF(NETDEV_CHANGE): bond4: link becomes ready [ 388.619432][ T8395] netlink: 112 bytes leftover after parsing attributes in process `syz.4.1161'. [ 389.104727][ T8400] loop3: detected capacity change from 0 to 4096 [ 389.168810][ T8400] EXT4-fs (loop3): Test dummy encryption mode enabled [ 389.218083][ T8400] EXT4-fs (loop3): Ignoring removed nobh option [ 389.370563][ T8400] EXT4-fs (loop3): mounted filesystem without journal. Opts: test_dummy_encryption=v1,nobh,,errors=continue. Quota mode: writeback. [ 390.472460][ T8413] bridge0: port 1(syz_tun) entered blocking state [ 390.499606][ T8413] bridge0: port 1(syz_tun) entered disabled state [ 390.525428][ T8413] device syz_tun entered promiscuous mode [ 391.227105][ T8433] cgroup: No subsys list or none specified [ 395.899152][ T8452] 8021q: adding VLAN 0 to HW filter on device bond5 [ 395.990792][ T8472] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.001294][ T8472] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.014536][ T8472] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.023519][ T8472] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.034132][ T8472] bond5: (slave geneve3): Enslaving as a backup interface with an up link [ 396.041120][ T8476] sctp: [Deprecated]: syz.3.1182 (pid 8476) Use of struct sctp_assoc_value in delayed_ack socket option. [ 396.041120][ T8476] Use struct sctp_sack_info instead [ 397.046544][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 397.258450][ T8480] loop0: detected capacity change from 0 to 40427 [ 397.279724][ T5565] bond5: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 397.292565][ T4251] IPv6: ADDRCONF(NETDEV_CHANGE): bond5: link becomes ready [ 397.304729][ T8476] sctp: [Deprecated]: syz.3.1182 (pid 8476) Use of struct sctp_assoc_value in delayed_ack socket option. [ 397.304729][ T8476] Use struct sctp_sack_info instead [ 397.415007][ T5565] bond5: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 397.559649][ T8480] F2FS-fs (loop0): invalid crc value [ 397.666260][ T8480] F2FS-fs (loop0): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 397.882724][ T8480] F2FS-fs (loop0): recover fsync data on readonly fs [ 397.901824][ T8480] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 398.296566][ T8483] tipc: Failed to remove unknown binding: 66,0,0/0:111145009/111145010 [ 398.322385][ T8486] overlayfs: missing 'lowerdir' [ 398.347746][ T8488] tipc: Failed to remove unknown binding: 66,0,0/0:111145009/111145010 [ 398.671885][ T8494] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1188'. [ 400.305344][ T8513] device syzkaller0 entered promiscuous mode [ 400.316843][ T6061] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 401.336788][ T6061] usb 5-1: unable to get BOS descriptor or descriptor too short [ 401.456774][ T6061] usb 5-1: config 64 has an invalid interface number: 44 but max is 0 [ 401.467462][ T8524] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1197'. [ 401.485701][ T6061] usb 5-1: config 64 has no interface number 0 [ 401.495240][ T6061] usb 5-1: config 64 interface 44 altsetting 7 endpoint 0x83 has an invalid bInterval 57, changing to 9 [ 401.573547][ T6061] usb 5-1: config 64 interface 44 has no altsetting 0 [ 401.767752][ T6061] usb 5-1: New USB device found, idVendor=07c0, idProduct=158b, bcdDevice=d9.d2 [ 401.832760][ T6061] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 401.975462][ T6061] usb 5-1: Product: syz [ 402.074571][ T6061] usb 5-1: Manufacturer: syz [ 402.236855][ T6061] usb 5-1: SerialNumber: syz [ 402.383061][ T8531] xt_policy: output policy not valid in PREROUTING and INPUT [ 402.514014][ T8506] udc-core: couldn't find an available UDC or it's busy [ 402.620632][ T8506] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 402.759105][ T8535] netlink: 'syz.1.1199': attribute type 1 has an invalid length. [ 402.941748][ T8535] device bond1 entered promiscuous mode [ 403.013213][ T8535] 8021q: adding VLAN 0 to HW filter on device bond1 [ 403.035704][ T6061] iowarrior 5-1:64.44: no interrupt-out endpoint found [ 403.071522][ T6061] usb 5-1: USB disconnect, device number 5 [ 403.160266][ T8545] loop0: detected capacity change from 0 to 1024 [ 403.192021][ T8535] bond1: (slave bridge2): making interface the new active one [ 403.209702][ T8535] device bridge2 entered promiscuous mode [ 403.257179][ T8535] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 403.297882][ T5569] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 404.509165][ T26] audit: type=1326 audit(1781869407.469:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.1.1207" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 404.713157][ T4366] hfsplus: bad catalog file entry [ 404.763244][ T4366] hfsplus: b-tree write err: -5, ino 3 [ 405.116760][ T26] audit: type=1326 audit(1781869407.719:121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.1.1207" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 405.273621][ T26] audit: type=1326 audit(1781869407.749:122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.1.1207" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 405.318492][ T26] audit: type=1326 audit(1781869407.759:123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.1.1207" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 405.342059][ T8595] loop0: detected capacity change from 0 to 8 [ 405.504054][ T26] audit: type=1326 audit(1781869407.859:124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.1.1207" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 405.509103][ T8597] 8021q: adding VLAN 0 to HW filter on device bond2 [ 405.536273][ T26] audit: type=1326 audit(1781869407.869:125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.1.1207" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 406.719870][ T8601] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.770262][ T26] audit: type=1326 audit(1781869407.889:126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.1.1207" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 406.777223][ T8601] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.832444][ T26] audit: type=1326 audit(1781869407.949:127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.1.1207" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 406.846585][ T8601] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.866824][ T26] audit: type=1326 audit(1781869407.959:128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.1.1207" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 406.903536][ T26] audit: type=1326 audit(1781869407.969:129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.1.1207" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 406.926583][ T8601] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.949884][ T8601] bond2: (slave geneve2): Enslaving as a backup interface with an up link [ 406.975005][ T8595] SQUASHFS error: lzo decompression failed, data probably corrupt [ 407.077481][ T8595] SQUASHFS error: Failed to read block 0x62b: -5 [ 407.083862][ T8595] SQUASHFS error: Unable to read metadata cache entry [629] [ 407.096157][ T8616] xt_connbytes: Forcing CT accounting to be enabled [ 407.106629][ T5569] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 407.132556][ T8595] SQUASHFS error: Unable to read inode 0x11f [ 407.148391][ T5561] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 407.322283][ T8616] xt_CT: No such helper "netbios-ns" [ 407.673186][ T5569] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 408.387365][ T8636] netlink: 'syz.0.1215': attribute type 1 has an invalid length. [ 409.309053][ T8636] device bond4 entered promiscuous mode [ 409.314918][ T8636] 8021q: adding VLAN 0 to HW filter on device bond4 [ 409.351972][ T8636] bond4: (slave bridge2): making interface the new active one [ 409.360076][ T8636] device bridge2 entered promiscuous mode [ 409.367876][ T8636] bond4: (slave bridge2): Enslaving as an active interface with an up link [ 409.389382][ T8629] bridge0: port 2(syz_tun) entered blocking state [ 409.390046][ T8649] loop2: detected capacity change from 0 to 1024 [ 409.395868][ T8629] bridge0: port 2(syz_tun) entered disabled state [ 409.429471][ T8629] device syz_tun entered promiscuous mode [ 409.448472][ T5565] IPv6: ADDRCONF(NETDEV_CHANGE): bond4: link becomes ready [ 409.531370][ T8654] loop0: detected capacity change from 0 to 1024 [ 409.571057][ T8654] EXT4-fs (loop0): Test dummy encryption mode enabled [ 409.656436][ T8654] EXT4-fs (loop0): mounted filesystem without journal. Opts: test_dummy_encryption,i_version,noblock_validity,commit=0x0000000000000005,noinit_itable,max_batch_time=0x0000000000000000,abort,auto_da_alloc,lazytime,noauto_da_alloc,block_validity,,errors=continue. Quota mode: writeback. [ 409.966312][ T8670] xt_nat: multiple ranges no longer supported [ 410.784236][ T8672] ipt_REJECT: TCP_RESET invalid for non-tcp [ 411.037381][ T5552] hfsplus: bad catalog file entry [ 411.042619][ T5552] hfsplus: b-tree write err: -5, ino 3 [ 411.256924][ T8683] batman_adv: batadv0: Adding interface: macsec1 [ 411.286859][ T8683] batman_adv: batadv0: The MTU of interface macsec1 is too small (1468) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 411.318959][ T8683] batman_adv: batadv0: Interface activated: macsec1 [ 411.510813][ T8688] xt_connbytes: Forcing CT accounting to be enabled [ 412.177082][ T8684] netlink: 164 bytes leftover after parsing attributes in process `syz.1.1231'. [ 412.490037][ T8688] xt_CT: No such helper "netbios-ns" [ 412.537976][ T8699] netlink: 'syz.3.1244': attribute type 1 has an invalid length. [ 412.758435][ T8699] device bond2 entered promiscuous mode [ 412.766069][ T8699] 8021q: adding VLAN 0 to HW filter on device bond2 [ 413.523965][ T8702] 8021q: adding VLAN 0 to HW filter on device bond3 [ 413.545127][ T8702] bond2: (slave bond3): making interface the new active one [ 413.566115][ T8702] device bond3 entered promiscuous mode [ 413.586837][ T8702] bond2: (slave bond3): Enslaving as an active interface with an up link [ 413.638011][ T5552] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 413.652534][ T8713] bond2: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 413.667121][ T8713] bond2: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 413.727235][ T8726] device syzkaller0 entered promiscuous mode [ 413.924563][ T8734] loop0: detected capacity change from 0 to 1024 [ 414.749523][ T8734] hfsplus: request for non-existent node 33423360 in B*Tree [ 414.774178][ T8729] Set syz1 is full, maxelem 6117 reached [ 414.852792][ T8734] hfsplus: request for non-existent node 33423360 in B*Tree [ 414.874925][ T8748] netlink: 'syz.1.1246': attribute type 39 has an invalid length. [ 414.902256][ T8750] hfsplus: request for non-existent node 33423360 in B*Tree [ 414.920589][ T8750] hfsplus: request for non-existent node 33423360 in B*Tree [ 414.961387][ T8734] hfsplus: request for non-existent node 33423360 in B*Tree [ 414.985203][ T8734] hfsplus: request for non-existent node 33423360 in B*Tree [ 415.025967][ T8750] hfsplus: request for non-existent node 33423360 in B*Tree [ 415.050106][ T8750] hfsplus: request for non-existent node 33423360 in B*Tree [ 415.092746][ T8734] hfsplus: request for non-existent node 33423360 in B*Tree [ 415.110922][ T8734] hfsplus: request for non-existent node 33423360 in B*Tree [ 415.155989][ T8750] hfsplus: request for non-existent node 33423360 in B*Tree [ 415.163723][ T8750] hfsplus: request for non-existent node 33423360 in B*Tree [ 415.194641][ T8734] hfsplus: request for non-existent node 33423360 in B*Tree [ 415.214394][ T8734] hfsplus: request for non-existent node 33423360 in B*Tree [ 415.327925][ T8734] hfsplus: request for non-existent node 33423360 in B*Tree [ 415.352480][ T8734] hfsplus: request for non-existent node 33423360 in B*Tree [ 415.419305][ T8734] hfsplus: request for non-existent node 33423360 in B*Tree [ 415.436615][ T8734] hfsplus: request for non-existent node 33423360 in B*Tree [ 415.448662][ T8734] hfsplus: request for non-existent node 33423360 in B*Tree [ 415.458738][ T8761] netlink: 'syz.1.1250': attribute type 10 has an invalid length. [ 415.466378][ T8734] hfsplus: request for non-existent node 33423360 in B*Tree [ 416.225437][ T8767] xt_connbytes: Forcing CT accounting to be enabled [ 417.051580][ T8767] xt_CT: No such helper "netbios-ns" [ 417.062479][ T8782] loop2: detected capacity change from 0 to 512 [ 418.393795][ T8782] EXT4-fs (loop2): Ignoring removed nomblk_io_submit option [ 418.637128][ T8796] tipc: Enabling of bearer rejected, already enabled [ 418.645557][ T8782] EXT4-fs (loop2): can't mount with data=, fs mounted w/o journal [ 419.627991][ T8803] netlink: 'syz.0.1272': attribute type 1 has an invalid length. [ 420.607615][ T8815] loop2: detected capacity change from 0 to 256 [ 420.765763][ T8815] FAT-fs (loop2): Directory bread(block 64) failed [ 420.786656][ T8815] FAT-fs (loop2): Directory bread(block 65) failed [ 420.793303][ T8815] FAT-fs (loop2): Directory bread(block 66) failed [ 420.824480][ T8815] FAT-fs (loop2): Directory bread(block 67) failed [ 420.842050][ T8815] FAT-fs (loop2): Directory bread(block 68) failed [ 420.859069][ T8815] FAT-fs (loop2): Directory bread(block 69) failed [ 420.906611][ T8815] FAT-fs (loop2): Directory bread(block 70) failed [ 420.957987][ T8815] FAT-fs (loop2): Directory bread(block 71) failed [ 420.976599][ T8815] FAT-fs (loop2): Directory bread(block 72) failed [ 421.005068][ T8815] FAT-fs (loop2): Directory bread(block 73) failed [ 430.350097][ T8916] device syzkaller0 entered promiscuous mode [ 430.415916][ T8918] IPVS: Error connecting to the multicast addr [ 432.069679][ T8925] loop3: detected capacity change from 0 to 40427 [ 432.548863][ T8925] F2FS-fs (loop3): invalid crc value [ 433.192920][ T8925] F2FS-fs (loop3): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 433.308215][ T8925] F2FS-fs (loop3): recover fsync data on readonly fs [ 433.315415][ T8925] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 438.064008][ T8953] device syzkaller0 entered promiscuous mode [ 439.106983][ T8977] device syzkaller0 entered promiscuous mode [ 439.270666][ T8983] netlink: 79 bytes leftover after parsing attributes in process `syz.4.1309'. [ 439.782659][ T8983] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1309'. [ 439.819445][ T8983] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1309'. [ 439.829760][ T8983] netlink: 'syz.4.1309': attribute type 11 has an invalid length. [ 440.037033][ T1419] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.120949][ T8996] device vlan3 entered promiscuous mode [ 441.880462][ T9008] loop4: detected capacity change from 0 to 4096 [ 441.892287][ T26] kauditd_printk_skb: 7 callbacks suppressed [ 441.892301][ T26] audit: type=1326 audit(1781869445.845:137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9013 comm="syz.1.1324" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 442.063182][ T9008] ntfs: (device loop4): parse_options(): Invalid mft_zone_multiplier. Using default value, i.e. 1. [ 442.128192][ T26] audit: type=1326 audit(1781869445.885:138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9013 comm="syz.1.1324" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 442.208844][ T9018] netlink: 52 bytes leftover after parsing attributes in process `syz.3.1325'. [ 442.522600][ T26] audit: type=1326 audit(1781869445.885:139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9013 comm="syz.1.1324" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 442.632530][ T9018] bridge0: port 2(bridge_slave_1) entered disabled state [ 442.639982][ T9018] bridge0: port 1(bridge_slave_0) entered disabled state [ 442.811506][ T9008] ntfs: volume version 3.1. [ 442.821666][ T26] audit: type=1326 audit(1781869445.885:140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9013 comm="syz.1.1324" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=441 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 442.847013][ T26] audit: type=1326 audit(1781869445.885:141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9013 comm="syz.1.1324" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 442.872054][ T26] audit: type=1326 audit(1781869445.885:142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9013 comm="syz.1.1324" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 442.896696][ T26] audit: type=1326 audit(1781869445.885:143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9013 comm="syz.1.1324" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 442.921542][ T26] audit: type=1326 audit(1781869445.885:144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9013 comm="syz.1.1324" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 442.948074][ T26] audit: type=1326 audit(1781869445.885:145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9013 comm="syz.1.1324" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0f94bdbe59 code=0x7ffc0000 [ 443.636084][ T5565] Bluetooth: (null): Too short H5 packet [ 443.660974][ T5565] Bluetooth: (null): Invalid header checksum [ 443.776278][ T5565] Bluetooth: (null): Invalid header checksum [ 443.782577][ T5565] Bluetooth: (null): Invalid header checksum [ 449.459766][ T9098] device syzkaller0 entered promiscuous mode [ 449.656673][ T9109] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 451.178331][ T9130] syz.2.1353 (9130) used greatest stack depth: 19280 bytes left [ 454.135339][ T9157] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 454.226307][ T9163] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1367'. [ 455.068959][ T9171] loop3: detected capacity change from 0 to 131072 [ 455.546496][ T9179] futex_wake_op: syz.0.1372 tries to shift op by 144; fix this program [ 455.638938][ T9171] F2FS-fs (loop3): Found nat_bits in checkpoint [ 455.717022][ T9171] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 457.249379][ T26] kauditd_printk_skb: 25 callbacks suppressed [ 457.249394][ T26] audit: type=1800 audit(1781869461.205:171): pid=9176 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1370" name="bus" dev="ramfs" ino=48029 res=0 errno=0 [ 457.300310][ T9205] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1380'. [ 457.366660][ T1107] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 457.378135][ T9208] loop4: detected capacity change from 0 to 256 [ 457.497003][ T9208] FAT-fs (loop4): Directory bread(block 64) failed [ 457.546486][ T9208] FAT-fs (loop4): Directory bread(block 65) failed [ 457.563405][ T9208] FAT-fs (loop4): Directory bread(block 66) failed [ 457.601637][ T9208] FAT-fs (loop4): Directory bread(block 67) failed [ 457.606711][ T1107] usb 1-1: Using ep0 maxpacket: 32 [ 457.618297][ T9217] device syzkaller0 entered promiscuous mode [ 457.653538][ T9208] FAT-fs (loop4): Directory bread(block 68) failed [ 457.683895][ T9208] FAT-fs (loop4): Directory bread(block 69) failed [ 457.700972][ T9208] FAT-fs (loop4): Directory bread(block 70) failed [ 457.721584][ T9208] FAT-fs (loop4): Directory bread(block 71) failed [ 457.729363][ T9208] FAT-fs (loop4): Directory bread(block 72) failed [ 457.738820][ T9208] FAT-fs (loop4): Directory bread(block 73) failed [ 458.686824][ T1107] usb 1-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 458.695902][ T1107] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 458.726786][ T1107] usb 1-1: Product: syz [ 458.730994][ T1107] usb 1-1: Manufacturer: syz [ 458.735611][ T1107] usb 1-1: SerialNumber: syz [ 458.757901][ T1107] usb 1-1: config 0 descriptor?? [ 459.516144][ T9236] loop2: detected capacity change from 0 to 128 [ 459.546904][ T1107] peak_usb 1-1:0.0 can0: unable to request usb[type=0 value=1] err=-71 [ 459.604438][ T1107] peak_usb 1-1:0.0: unable to read PCAN-USB Pro firmware info (err -71) [ 459.825084][ T1107] peak_usb: probe of 1-1:0.0 failed with error -71 [ 460.396528][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 460.456634][ T1107] usb 1-1: USB disconnect, device number 6 [ 460.517192][ T9249] device syzkaller0 entered promiscuous mode [ 460.841042][ T9252] device syzkaller0 entered promiscuous mode [ 460.904331][ T9258] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1394'. [ 461.246920][ T1107] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 461.676870][ T1107] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 461.706491][ T1107] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 461.716289][ T1107] usb 1-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 461.761167][ T1107] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 461.798622][ T1107] usb 1-1: config 0 descriptor?? [ 462.225665][ T9272] loop2: detected capacity change from 0 to 32768 [ 462.252289][ T9272] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz.2.1398 (9272) [ 462.486009][ T1107] elan 0003:04F3:0755.0003: unknown main item tag 0x0 [ 462.593248][ T1107] elan 0003:04F3:0755.0003: unknown main item tag 0x0 [ 462.745368][ T1107] elan 0003:04F3:0755.0003: unknown main item tag 0x0 [ 462.927100][ T9272] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm [ 462.961629][ T9272] BTRFS info (device loop2): setting nodatacow, compression disabled [ 462.966168][ T1107] elan 0003:04F3:0755.0003: unknown main item tag 0x0 [ 462.976706][ T1107] elan 0003:04F3:0755.0003: unknown main item tag 0x0 [ 463.015807][ T9272] BTRFS info (device loop2): turning on flush-on-commit [ 463.023815][ T1107] elan 0003:04F3:0755.0003: failed to start in urb: -90 [ 463.023869][ T9272] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_LZO (0x8) [ 463.057925][ T9272] BTRFS info (device loop2): use lzo compression, level 0 [ 463.075519][ T9272] BTRFS info (device loop2): setting nodatasum [ 463.105951][ T9272] BTRFS info (device loop2): use no compression [ 463.143010][ T9272] BTRFS info (device loop2): trying to use backup root at mount time [ 463.188149][ T1107] elan 0003:04F3:0755.0003: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.0-1/input0 [ 463.207097][ T1107] usb 1-1: USB disconnect, device number 7 [ 463.223333][ T9272] BTRFS info (device loop2): max_inline at 0 [ 463.260260][ T9272] BTRFS info (device loop2): using free space tree [ 463.281357][ T9272] BTRFS info (device loop2): has skinny extents [ 464.119002][ T9312] device syzkaller0 entered promiscuous mode [ 464.134021][ T9298] fido_id[9298]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 464.292738][ T9] BTRFS warning (device loop2): checksum verify failed on 5332992 wanted 0x0a5e5d25 found 0xcee3a718 level 0 [ 464.488128][ T9272] BTRFS warning (device loop2): couldn't read tree root [ 464.511426][ T144] BTRFS warning (device loop2): checksum verify failed on 5324800 wanted 0x9f73850b found 0xe06dfc66 level 0 [ 468.291899][ T9272] BTRFS warning (device loop2): couldn't read tree root [ 468.307978][ T9272] BTRFS error (device loop2): parent transid verify failed on 5255168 wanted 5 found 7 [ 468.367563][ T9272] BTRFS warning (device loop2): couldn't read tree root [ 468.505384][ T9346] device syzkaller0 entered promiscuous mode [ 468.618518][ T9346] tipc: Enabled bearer , priority 0 [ 468.647844][ T9345] tipc: Resetting bearer [ 469.522491][ T9358] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 469.691225][ T9345] tipc: Disabling bearer [ 469.705897][ T9371] tipc: Node number set to 1990214913 [ 469.740090][ T9272] BTRFS error (device loop2): open_ctree failed: -22 [ 472.969048][ T9390] loop4: detected capacity change from 0 to 2048 [ 474.793980][ T9390] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 478.167361][ T9439] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1437'. [ 483.003620][ T9470] __sock_release: fasync list not empty! [ 483.236842][ T9482] cgroup: No subsys list or none specified [ 484.958734][ T9503] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1455'. [ 485.033708][ T9503] af_packet: tpacket_rcv: packet too big, clamped from 64521 to 3956. macoff=92 [ 485.061312][ T9506] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 486.703230][ T9530] netlink: 'syz.4.1464': attribute type 2 has an invalid length. [ 486.786510][ T9528] futex_wake_op: syz.1.1463 tries to shift op by 32; fix this program [ 486.932789][ T9511] loop3: detected capacity change from 0 to 32768 [ 487.827455][ T9511] XFS (loop3): Mounting V5 Filesystem [ 489.012624][ T9559] loop2: detected capacity change from 0 to 2048 [ 489.101668][ T9559] EXT4-fs (loop2): Ignoring removed nomblk_io_submit option [ 489.852976][ T9511] XFS (loop3): Ending clean mount [ 489.927309][ T9559] EXT4-fs (loop2): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000000000000,grpquota,nomblk_io_submit,stripe=0x000000000004ffff,norecovery,init_itable,max_batch_time=0x000000000000186b,,errors=continue. Quota mode: writeback. [ 490.379505][ T9511] XFS (loop3): Quotacheck needed: Please wait. [ 490.691537][ T9511] XFS (loop3): Quotacheck: Done. [ 490.764281][ T4193] XFS (loop3): Unmounting Filesystem [ 490.890642][ T9593] loop0: detected capacity change from 0 to 2048 [ 493.553210][ T9593] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 493.576814][ T9593] NILFS (loop0): mounting unchecked fs [ 493.589378][ T5130] udevd[5130]: incorrect nilfs2 checksum on /dev/loop0 [ 493.638957][ T9593] NILFS (loop0): recovery complete [ 493.719223][ T9603] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 493.824761][ T26] audit: type=1804 audit(1781869497.765:172): pid=9593 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.1481" name="/newroot/270/file0/bus" dev="loop0" ino=18 res=1 errno=0 [ 493.874085][ T26] audit: type=1800 audit(1781869497.805:173): pid=9593 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1481" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 493.917639][ T9606] device syzkaller1 entered promiscuous mode [ 494.698321][ T9612] binder: BINDER_SET_CONTEXT_MGR already set [ 494.732751][ T9612] binder: 9611:9612 ioctl 4018620d 200000000040 returned -16 [ 497.154738][ T9627] tipc: Enabling of bearer rejected, already enabled [ 497.658299][ T9630] device syzkaller0 entered promiscuous mode [ 499.379129][ T9646] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 499.416248][ T9654] loop4: detected capacity change from 0 to 2048 [ 499.476183][ T9654] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 1024) [ 499.478648][ T9646] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 499.496083][ T9654] NILFS (loop4): mounting unchecked fs [ 499.517762][ T5130] udevd[5130]: incorrect nilfs2 checksum on /dev/loop4 [ 499.519563][ T9654] NILFS (loop4): recovery complete [ 499.552711][ T9656] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 499.568530][ T9646] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 499.651531][ T9646] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 499.666688][ T26] audit: type=1804 audit(1781869503.615:174): pid=9654 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.1499" name="/newroot/305/file0/bus" dev="loop4" ino=18 res=1 errno=0 [ 499.741360][ T26] audit: type=1800 audit(1781869503.645:175): pid=9654 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1499" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 499.796925][ T9646] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.815236][ T9646] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.831947][ T9646] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.845724][ T9646] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 501.376959][ T1419] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.490245][ T9684] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1510'. [ 502.005115][ T9697] loop3: detected capacity change from 0 to 4096 [ 502.006964][ T9702] netlink: 'syz.4.1517': attribute type 39 has an invalid length. [ 502.074448][ T9697] EXT4-fs (loop3): Test dummy encryption mode enabled [ 502.093495][ T9697] EXT4-fs (loop3): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000004000000,noauto_da_alloc,grpid,test_dummy_encryption=v1,nodiscard,data_err=ignore,acl,journal_ioprio=0x0000000000000000,resuid=0x0000000000000000,,errors=continue. Quota mode: writeback. [ 502.646140][ T9724] bond2: option mode: unable to set because the bond device has slaves [ 502.656632][ T9697] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 502.689499][ T9697] EXT4-fs (loop3): re-mounted. Opts: (null). Quota mode: writeback. [ 502.693084][ T9724] device ip6gretap1 entered promiscuous mode [ 502.732417][ T9724] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 502.748196][ T9724] bond2: (slave macvlan2): Enslaving as a backup interface with an up link [ 502.887825][ T9] bond2: (slave macvlan2): link status up again after 0 ms [ 502.915855][ T9] bond2: (slave macvlan2): failed to get link speed/duplex [ 503.094034][ T5569] bond2: (slave macvlan2): failed to get link speed/duplex [ 503.127480][ T9739] loop2: detected capacity change from 0 to 512 [ 503.226849][ T144] bond2: (slave macvlan2): failed to get link speed/duplex [ 503.363988][ T9739] EXT4-fs (loop2): Test dummy encryption mode enabled [ 503.479064][ T9746] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1527'. [ 503.555881][ T9746] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 503.919718][ T9739] EXT4-fs error (device loop2): ext4_orphan_get:1406: inode #15: comm syz.2.1526: inode has both inline data and extents flags [ 503.988945][ T9739] EXT4-fs error (device loop2): ext4_orphan_get:1411: comm syz.2.1526: couldn't read orphan inode 15 (err -117) [ 504.017232][ T9739] EXT4-fs (loop2): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue. Quota mode: writeback. [ 504.032511][ T9746] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 504.077327][ T9755] netlink: 16178 bytes leftover after parsing attributes in process `syz.3.1529'. [ 504.124793][ T144] bond2: (slave macvlan2): failed to get link speed/duplex [ 504.225558][ T9739] fscrypt (loop2): Missing crypto API support for AES-256-XTS (API name: "xts(aes)") [ 504.256855][ T5563] bond2: (slave macvlan2): failed to get link speed/duplex [ 504.420206][ T9776] loop2: detected capacity change from 0 to 2048 [ 504.438818][ T144] bond2: (slave macvlan2): failed to get link speed/duplex [ 504.529868][ T9776] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 504.559046][ T5552] bond2: (slave macvlan2): failed to get link speed/duplex [ 504.696782][ T5552] bond2: (slave macvlan2): failed to get link speed/duplex [ 504.826909][ T154] bond2: (slave macvlan2): failed to get link speed/duplex [ 505.014382][ T5563] bond2: (slave macvlan2): failed to get link speed/duplex [ 505.422855][ T9784] __sock_release: fasync list not empty! [ 508.027599][ T5563] net_ratelimit: 10 callbacks suppressed [ 508.027715][ T5563] bond2: (slave macvlan2): failed to get link speed/duplex [ 508.818752][ T9802] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1543'. [ 508.852970][ T9802] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 509.769881][ T9802] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 509.837967][ T5563] bond2: (slave macvlan2): failed to get link speed/duplex [ 509.966649][ T5569] bond2: (slave macvlan2): failed to get link speed/duplex [ 510.096591][ T9] bond2: (slave macvlan2): failed to get link speed/duplex [ 510.216702][ T5565] bond2: (slave macvlan2): failed to get link speed/duplex [ 510.340431][ T5565] bond2: (slave macvlan2): failed to get link speed/duplex [ 510.488042][ T5563] bond2: (slave macvlan2): failed to get link speed/duplex [ 510.616703][ T4363] bond2: (slave macvlan2): failed to get link speed/duplex [ 510.776763][ T4363] bond2: (slave macvlan2): failed to get link speed/duplex [ 510.919154][ T154] bond2: (slave macvlan2): failed to get link speed/duplex [ 513.189698][ T4363] net_ratelimit: 13 callbacks suppressed [ 513.189793][ T4363] bond2: (slave macvlan2): failed to get link speed/duplex [ 515.051558][ T5569] bond2: (slave macvlan2): failed to get link speed/duplex [ 518.562254][ T9857] ================================================================== [ 518.571033][ T9857] BUG: KASAN: slab-out-of-bounds in ieee80211_monitor_select_queue+0x23a/0x240 [ 518.580163][ T9857] Read of size 2 at addr ffff888074f02dfb by task syz.3.1558/9857 [ 518.588162][ T9857] [ 518.590551][ T9857] CPU: 1 PID: 9857 Comm: syz.3.1558 Not tainted syzkaller #0 [ 518.598177][ T9857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 518.608539][ T9857] Call Trace: [ 518.611976][ T9857] [ 518.615119][ T9857] dump_stack_lvl+0x188/0x250 [ 518.620113][ T9857] ? show_regs_print_info+0x20/0x20 [ 518.625829][ T9857] ? load_image+0x400/0x400 [ 518.630553][ T9857] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 518.636806][ T9857] ? ieee80211_tx+0x460/0x460 [ 518.641691][ T9857] print_address_description+0x60/0x2d0 [ 518.647878][ T9857] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 518.654154][ T9857] kasan_report+0xdf/0x130 [ 518.658670][ T9857] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 518.664936][ T9857] ieee80211_monitor_select_queue+0x23a/0x240 [ 518.671142][ T9857] ? ieee80211_recalc_smps_work+0x20/0x20 [ 518.676866][ T9857] netdev_core_pick_tx+0x118/0x2e0 [ 518.682061][ T9857] __dev_queue_xmit+0x756/0x2f80 [ 518.686999][ T9857] ? __might_fault+0xb7/0x110 [ 518.691774][ T9857] ? dev_queue_xmit+0x20/0x20 [ 518.696525][ T9857] ? virtio_net_hdr_to_skb+0xa6b/0x11f0 [ 518.702193][ T9857] ? packet_cached_dev_get+0x270/0x270 [ 518.707754][ T9857] ? skb_copy_datagram_from_iter+0x5e3/0x6a0 [ 518.713755][ T9857] packet_sendmsg+0x3dba/0x5060 [ 518.718762][ T9857] ? __might_sleep+0xf0/0xf0 [ 518.723422][ T9857] ? aa_sk_perm+0x7dc/0x910 [ 518.727980][ T9857] ? packet_getsockopt+0x9a0/0x9a0 [ 518.733092][ T9857] ? aa_sock_msg_perm+0x94/0x150 [ 518.738172][ T9857] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 518.743531][ T9857] ? security_socket_sendmsg+0x7c/0xa0 [ 518.749129][ T9857] ? packet_getsockopt+0x9a0/0x9a0 [ 518.754233][ T9857] ____sys_sendmsg+0x5b7/0x8f0 [ 518.759095][ T9857] ? __sys_sendmsg_sock+0x30/0x30 [ 518.764120][ T9857] ? import_iovec+0x6f/0xa0 [ 518.768706][ T9857] ___sys_sendmsg+0x236/0x2e0 [ 518.773480][ T9857] ? __sys_sendmsg+0x2a0/0x2a0 [ 518.778729][ T9857] __se_sys_sendmsg+0x1af/0x290 [ 518.783672][ T9857] ? __x64_sys_sendmsg+0x80/0x80 [ 518.788615][ T9857] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 518.794709][ T9857] ? lockdep_hardirqs_on+0x94/0x140 [ 518.800400][ T9857] do_syscall_64+0x4c/0xa0 [ 518.804847][ T9857] ? clear_bhb_loop+0x30/0x80 [ 518.809518][ T9857] ? clear_bhb_loop+0x30/0x80 [ 518.814400][ T9857] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 518.820306][ T9857] RIP: 0033:0x7f29aa365e59 [ 518.824974][ T9857] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 518.844631][ T9857] RSP: 002b:00007f29a85bf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 518.853231][ T9857] RAX: ffffffffffffffda RBX: 00007f29aa5defa0 RCX: 00007f29aa365e59 [ 518.861237][ T9857] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000006 [ 518.869297][ T9857] RBP: 00007f29aa3fbe6f R08: 0000000000000000 R09: 0000000000000000 [ 518.877264][ T9857] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 518.885307][ T9857] R13: 00007f29aa5df038 R14: 00007f29aa5defa0 R15: 00007ffe64f82908 [ 518.893287][ T9857] [ 518.896306][ T9857] [ 518.898618][ T9857] Allocated by task 7136: [ 518.903016][ T9857] __kasan_kmalloc+0xb5/0xf0 [ 518.907600][ T9857] __register_sysctl_table+0xe0/0x1230 [ 518.913216][ T9857] __addrconf_sysctl_register+0x271/0x3e0 [ 518.919094][ T9857] addrconf_sysctl_register+0x15c/0x1b0 [ 518.924631][ T9857] ipv6_add_dev+0xbf3/0x1190 [ 518.929201][ T9857] addrconf_notify+0x66f/0xf00 [ 518.933956][ T9857] raw_notifier_call_chain+0xcb/0x160 [ 518.939408][ T9857] register_netdevice+0x12a6/0x1710 [ 518.944591][ T9857] veth_newlink+0x8d7/0xe30 [ 518.949159][ T9857] rtnl_newlink+0x1359/0x1a50 [ 518.953878][ T9857] rtnetlink_rcv_msg+0x844/0xf30 [ 518.958793][ T9857] netlink_rcv_skb+0x1f5/0x440 [ 518.963705][ T9857] netlink_unicast+0x774/0x920 [ 518.968512][ T9857] netlink_sendmsg+0x8ba/0xbe0 [ 518.973306][ T9857] ____sys_sendmsg+0x5b7/0x8f0 [ 518.978064][ T9857] ___sys_sendmsg+0x236/0x2e0 [ 518.982813][ T9857] __se_sys_sendmsg+0x1af/0x290 [ 518.987732][ T9857] do_syscall_64+0x4c/0xa0 [ 518.992338][ T9857] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 518.998377][ T9857] [ 519.001141][ T9857] The buggy address belongs to the object at ffff888074f02000 [ 519.001141][ T9857] which belongs to the cache kmalloc-2k of size 2048 [ 519.015295][ T9857] The buggy address is located 1531 bytes to the right of [ 519.015295][ T9857] 2048-byte region [ffff888074f02000, ffff888074f02800) [ 519.029540][ T9857] The buggy address belongs to the page: [ 519.035292][ T9857] page:ffffea0001d3c000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x74f00 [ 519.045522][ T9857] head:ffffea0001d3c000 order:3 compound_mapcount:0 compound_pincount:0 [ 519.054119][ T9857] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 519.062347][ T9857] raw: 00fff00000010200 0000000000000000 0000000100000001 ffff888016c42000 [ 519.070967][ T9857] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 519.079544][ T9857] page dumped because: kasan: bad access detected [ 519.085963][ T9857] page_owner tracks the page as allocated [ 519.091701][ T9857] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4188, ts 53923286151, free_ts 53890796508 [ 519.112416][ T9857] get_page_from_freelist+0x1bbd/0x1ca0 [ 519.117983][ T9857] __alloc_pages+0x1ee/0x480 [ 519.122576][ T9857] new_slab+0xc0/0x4b0 [ 519.126654][ T9857] ___slab_alloc+0x80a/0xdd0 [ 519.131414][ T9857] __kmalloc+0x1cd/0x330 [ 519.135638][ T9857] rfkill_alloc+0x9a/0x250 [ 519.140301][ T9857] wiphy_new_nm+0x11eb/0x1840 [ 519.145008][ T9857] ieee80211_alloc_hw_nm+0x32a/0x1e50 [ 519.150680][ T9857] mac80211_hwsim_new_radio+0x10a/0x4080 [ 519.156471][ T9857] hwsim_new_radio_nl+0xa6f/0xc40 [ 519.161964][ T9857] genl_rcv_msg+0xcea/0xf90 [ 519.166561][ T9857] netlink_rcv_skb+0x1f5/0x440 [ 519.171318][ T9857] genl_rcv+0x24/0x40 [ 519.175472][ T9857] netlink_unicast+0x774/0x920 [ 519.180235][ T9857] netlink_sendmsg+0x8ba/0xbe0 [ 519.185004][ T9857] __sys_sendto+0x46d/0x620 [ 519.189607][ T9857] page last free stack trace: [ 519.194260][ T9857] free_unref_page_prepare+0x637/0x6c0 [ 519.199737][ T9857] free_unref_page+0x8f/0x2a0 [ 519.204507][ T9857] __unfreeze_partials+0x1a5/0x200 [ 519.209603][ T9857] put_cpu_partial+0x12d/0x190 [ 519.214350][ T9857] qlist_free_all+0x35/0x90 [ 519.218833][ T9857] kasan_quarantine_reduce+0x150/0x160 [ 519.224314][ T9857] __kasan_slab_alloc+0x2f/0xd0 [ 519.229200][ T9857] slab_post_alloc_hook+0x4c/0x380 [ 519.234317][ T9857] kmem_cache_alloc_trace+0x103/0x2a0 [ 519.239686][ T9857] netdevice_event+0x324/0x900 [ 519.244522][ T9857] raw_notifier_call_chain+0xcb/0x160 [ 519.249895][ T9857] __dev_notify_flags+0x194/0x300 [ 519.254915][ T9857] dev_change_flags+0xe3/0x1a0 [ 519.259669][ T9857] devinet_ioctl+0x8dc/0x1a70 [ 519.264408][ T9857] inet_ioctl+0x2fa/0x460 [ 519.268767][ T9857] sock_do_ioctl+0xfb/0x320 [ 519.273257][ T9857] [ 519.275562][ T9857] Memory state around the buggy address: [ 519.281282][ T9857] ffff888074f02c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 519.289340][ T9857] ffff888074f02d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 519.298006][ T9857] >ffff888074f02d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 519.306416][ T9857] ^ [ 519.314497][ T9857] ffff888074f02e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 519.322825][ T9857] ffff888074f02e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 519.331083][ T9857] ================================================================== [ 519.339283][ T9857] Disabling lock debugging due to kernel taint [ 519.345562][ T9857] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 519.352781][ T9857] CPU: 1 PID: 9857 Comm: syz.3.1558 Tainted: G B syzkaller #0 [ 519.361797][ T9857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 519.372069][ T9857] Call Trace: [ 519.375346][ T9857] [ 519.378285][ T9857] dump_stack_lvl+0x188/0x250 [ 519.382954][ T9857] ? show_regs_print_info+0x20/0x20 [ 519.388161][ T9857] ? load_image+0x400/0x400 [ 519.392655][ T9857] panic+0x2e5/0x810 [ 519.396626][ T9857] ? bpf_jit_dump+0xd0/0xd0 [ 519.401132][ T9857] ? _raw_spin_unlock_irqrestore+0xbc/0x120 [ 519.407030][ T9857] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 519.412943][ T9857] ? _raw_spin_unlock+0x40/0x40 [ 519.418048][ T9857] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 519.424446][ T9857] check_panic_on_warn+0x80/0xa0 [ 519.429469][ T9857] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 519.435696][ T9857] end_report+0x6d/0xf0 [ 519.439846][ T9857] kasan_report+0x102/0x130 [ 519.444332][ T9857] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 519.450710][ T9857] ieee80211_monitor_select_queue+0x23a/0x240 [ 519.456784][ T9857] ? ieee80211_recalc_smps_work+0x20/0x20 [ 519.462493][ T9857] netdev_core_pick_tx+0x118/0x2e0 [ 519.467593][ T9857] __dev_queue_xmit+0x756/0x2f80 [ 519.472554][ T9857] ? __might_fault+0xb7/0x110 [ 519.477271][ T9857] ? dev_queue_xmit+0x20/0x20 [ 519.481931][ T9857] ? virtio_net_hdr_to_skb+0xa6b/0x11f0 [ 519.487909][ T9857] ? packet_cached_dev_get+0x270/0x270 [ 519.493366][ T9857] ? skb_copy_datagram_from_iter+0x5e3/0x6a0 [ 519.499367][ T9857] packet_sendmsg+0x3dba/0x5060 [ 519.504224][ T9857] ? __might_sleep+0xf0/0xf0 [ 519.508976][ T9857] ? aa_sk_perm+0x7dc/0x910 [ 519.513464][ T9857] ? packet_getsockopt+0x9a0/0x9a0 [ 519.518562][ T9857] ? aa_sock_msg_perm+0x94/0x150 [ 519.523541][ T9857] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 519.528821][ T9857] ? security_socket_sendmsg+0x7c/0xa0 [ 519.534265][ T9857] ? packet_getsockopt+0x9a0/0x9a0 [ 519.539359][ T9857] ____sys_sendmsg+0x5b7/0x8f0 [ 519.544116][ T9857] ? __sys_sendmsg_sock+0x30/0x30 [ 519.549130][ T9857] ? import_iovec+0x6f/0xa0 [ 519.553651][ T9857] ___sys_sendmsg+0x236/0x2e0 [ 519.558330][ T9857] ? __sys_sendmsg+0x2a0/0x2a0 [ 519.563191][ T9857] __se_sys_sendmsg+0x1af/0x290 [ 519.568038][ T9857] ? __x64_sys_sendmsg+0x80/0x80 [ 519.572960][ T9857] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 519.578924][ T9857] ? lockdep_hardirqs_on+0x94/0x140 [ 519.584216][ T9857] do_syscall_64+0x4c/0xa0 [ 519.588618][ T9857] ? clear_bhb_loop+0x30/0x80 [ 519.593306][ T9857] ? clear_bhb_loop+0x30/0x80 [ 519.597977][ T9857] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 519.604048][ T9857] RIP: 0033:0x7f29aa365e59 [ 519.608456][ T9857] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 519.628068][ T9857] RSP: 002b:00007f29a85bf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 519.636486][ T9857] RAX: ffffffffffffffda RBX: 00007f29aa5defa0 RCX: 00007f29aa365e59 [ 519.644553][ T9857] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000006 [ 519.652771][ T9857] RBP: 00007f29aa3fbe6f R08: 0000000000000000 R09: 0000000000000000 [ 519.660763][ T9857] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 519.668900][ T9857] R13: 00007f29aa5df038 R14: 00007f29aa5defa0 R15: 00007ffe64f82908 [ 519.677052][ T9857] [ 519.680189][ T9857] Kernel Offset: disabled [ 519.684514][ T9857] Rebooting in 86400 seconds..