last executing test programs: 2.875960665s ago: executing program 1 (id=607): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) epoll_create1(0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2.596540382s ago: executing program 1 (id=608): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000170900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x2000c450) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_HASH_SREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_HASH_DREG={0x8, 0x2, 0x1, 0x0, 0x17}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xe}}}, 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000040) 2.585028902s ago: executing program 1 (id=610): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) sendfile(r0, r0, 0x0, 0x400000000000000) 2.553287652s ago: executing program 1 (id=611): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc00000019000100000000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000005000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000080400000000000000000080000000000000000000000000000000044000500ac1414aa000000000000000000000000000000003c"], 0xfc}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=@migrate={0xcc, 0x21, 0x1, 0x70bd27, 0xfffffffe, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@loopback, 0xdffc, 0x0, 0x0, 0x0, 0xa, 0xe0, 0x80}, 0x2}, [@migrate={0x50, 0x11, [{@in6=@dev={0xfe, 0x80, '\x00', 0x15}, @in6=@dev={0xfe, 0x80, '\x00', 0x28}, @in=@local, @in=@multicast2, 0x3c, 0x0, 0x0, 0x0, 0xa, 0xa}]}, @user_kmaddress={0x2c, 0x13, {@in6=@dev={0xfe, 0x80, '\x00', 0x2b}, @in6=@empty, 0x0, 0x1}}]}, 0xcc}, 0x1, 0x0, 0x0, 0x800}, 0x0) 2.499910314s ago: executing program 1 (id=615): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_GET_MP_STATE(r2, 0x8004ae98, &(0x7f0000000000)) 2.490315954s ago: executing program 1 (id=618): socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000000000010711e0920000000000001090224000100000000090400090103000100092105000001220500090581030002"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000180)='A') preadv(r1, &(0x7f00000033c0)=[{0x0, 0x41}, {&(0x7f00000001c0)=""/141, 0x8d}], 0x2, 0x9, 0x0) 2.428396655s ago: executing program 4 (id=620): capset(0x0, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffd, 0xfffffffd, 0x0, 0x3}) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r0}, &(0x7f0000000000), &(0x7f0000000040)=r1}, 0x20) 2.398465236s ago: executing program 4 (id=621): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0xd8efb076b3815638, 0xffffffffffffffff, 0x4000) 2.352012617s ago: executing program 4 (id=623): ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x3, 0x7fff, 0x16, "b0bf2ebb48c849ac0000000003000018bfff40"}) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000300)={0xffffffffffffffff, &(0x7f00000001c0)='.\x00', 0x10000, &(0x7f0000000240)={@align=0x20000000000000f3, {0x4, 0x9, 0xa8c, 0x5}}, 0x1, &(0x7f0000000280)={@_ha_fsid}, &(0x7f00000002c0)=0x80000001}) setsockopt$ARPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000040)={'filter\x00', 0x4}, 0x68) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="7f454c4604070001040000000000040002000600030000000903000038000104ce0000000e0000000b0020"], 0x58) open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x190) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x44}}, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0xff, 0xaec4, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x81, 0x1], 0x0, 0x41981}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.323983558s ago: executing program 4 (id=625): socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000cc0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000011c0)}]}}], 0x1, 0xc0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x8, 0x7, 0x4000000000000e51, 0xfffffffffffffffe, 0x5479, 0x1035, 0x200000000006, 0x0, 0x5, 0xfffffffffffffffc, 0xffffffff, 0xbf4, 0xfff, 0x808000000000005, 0x800000068], 0x2000, 0x80cd4}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.2329604s ago: executing program 4 (id=630): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) r2 = accept(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) recvmmsg$unix(r2, &(0x7f0000000c40), 0x40002ce, 0x80, 0x0) 1.350181989s ago: executing program 4 (id=648): openat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x40, 0x80) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x10400}}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000008380)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000593c437a5692b43a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000044000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000ab000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea21056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000096b193c0191176f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f3ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff00", 0x2000, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x0, 0x85, {0x0, 0x5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x41, 0x0) writev(r2, &(0x7f0000000240)=[{&(0x7f0000000c80)='49', 0x2}], 0x1) 1.268086652s ago: executing program 0 (id=653): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xe, &(0x7f0000000000)=0xd, 0x4) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) r2 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_SET_BINARY(r2, 0x6, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000042003303"], 0x14}, 0x1, 0x0, 0x0, 0x4015}, 0x24040004) recvmmsg(r6, &(0x7f00000057c0)=[{{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000e00)=""/4096, 0x1000}], 0x1}, 0x81}], 0x2, 0x10102, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_SETINTERFACE(r1, 0x80085504, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, &(0x7f0000000540)={0x3, 0x0, "48489a112228a472f371e2a4d7a36be7520bdc07419e7eedd5ebc6df5b324c0b29d9e49fc77849bf6ea560bf174f36289e413e468c82806c60373b6a1e665250645904489ea583f401c638d161e0f56fe62f19999157465c31166531d6cd015141647c558de322a42e9ef1af65fc69fa9525333c6f35b84f9d29a213d742aa897f4ee8ae735538b4a5b498eb6fcf73ae2b9808d5947bb7d15dbcb32a6755af69a1e731d6254344e6d6ce92e582dd2fc291f329d9a1aa47cbc079c8fbe8391d7f83a39396beaab588b0bde92c39d2b01d4a7d67fe9a1d31d5c32e8ebbcb3d70253b92a3938dce3756db4abec7bebe62a0e029c356b2d0ff89b19aeb5e09a3eb08"}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20008000}, 0x0) 696.426075ms ago: executing program 3 (id=660): sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, 0x0, 0x80) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x3, 0x7fff, 0x16, "b0bf2ebb48c849ac0000000003000018bfff40"}) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000300)={0xffffffffffffffff, &(0x7f00000001c0)='.\x00', 0x10000, &(0x7f0000000240)={@align=0x20000000000000f3, {0x4, 0x9, 0xa8c, 0x5}}, 0x1, &(0x7f0000000280)={@_ha_fsid}, &(0x7f00000002c0)=0x80000001}) setsockopt$ARPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000040)={'filter\x00', 0x4}, 0x68) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="7f454c4604070001040000000000040002000600030000000903000038000104ce0000000e0000000b0020"], 0x58) open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x190) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x44}}, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0xff, 0xaec4, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x81, 0x1], 0x0, 0x41981}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 479.469209ms ago: executing program 3 (id=662): syz_emit_ethernet(0x5e, &(0x7f0000000340)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x28, 0x3a, 0xfc, @dev, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @loopback, @local}}}}}}, 0x0) 387.978421ms ago: executing program 0 (id=665): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)={0x30, 0x41, 0x107, 0xfffffffe, 0xfffffffe, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0xc, 0x2, 0x0, 0x1, [@typed={0x8, 0x129, 0x0, 0x0, @fd=r0}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 380.573471ms ago: executing program 3 (id=666): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000080)={@multicast2, @dev={0xac, 0x14, 0x14, 0x42}, @private=0xa010100}, 0xc) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f00000006c0)={0x7, {{0x2, 0x0, @multicast2}}, {{0x2, 0x4e24, @multicast1}}}, 0x108) 372.446082ms ago: executing program 0 (id=667): sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x3, 0x7fff, 0x16, "b0bf2ebb48c849ac0000000003000018bfff40"}) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, 0x10000, 0x0, 0x1, &(0x7f0000000280)={@_ha_fsid}, &(0x7f00000002c0)=0x80000001}) setsockopt$ARPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000040)={'filter\x00', 0x4}, 0x68) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="7f454c4604070001040000000000040002000600030000000903000038000104ce"], 0x58) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x44}}, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0xff, 0xaec4, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x81, 0x1], 0x0, 0x41981}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 320.112763ms ago: executing program 3 (id=669): mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x20, 0x1) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 304.881443ms ago: executing program 3 (id=672): r0 = eventfd2(0xe4c, 0x0) read(r0, 0x0, 0x0) 255.048624ms ago: executing program 3 (id=674): ioctl$UI_SET_LEDBIT(0xffffffffffffffff, 0x40045569, 0x2000000000000e) bpf$MAP_CREATE(0x0, 0x0, 0x50) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r0}, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000080)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x800, 0x0, 0x2, 0x1}, 0x20) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, 0x0) openat$kvm(0xffffff9c, 0x0, 0x800, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000838500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 245.363104ms ago: executing program 0 (id=675): unshare(0x26020480) r0 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r0, 0x1, 0x4, &(0x7f00000000c0)=0xd, 0x4) 168.056666ms ago: executing program 2 (id=677): r0 = socket$packet(0x11, 0x2, 0x300) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7ff}, [@call={0x85, 0x0, 0x0, 0x2e}, @printk={@lld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x20000000}, {0x85, 0x0, 0x0, 0x72}}]}, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x8000}, [@call={0x85, 0x0, 0x0, 0x75}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) syz_emit_ethernet(0x4e, &(0x7f0000000480)={@broadcast, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x18, 0x3a, 0x0, @remote, @mcast2, {[], @mld={0x83, 0x0, 0x0, 0x0, 0x0, @private0}}}}}}, 0x0) 167.953326ms ago: executing program 0 (id=678): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]}) readv(0xffffffffffffffff, 0x0, 0x0) 167.871616ms ago: executing program 2 (id=679): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20a40, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x3f6, 0x0, 0xa}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 167.727506ms ago: executing program 0 (id=680): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x1, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$vcsa(&(0x7f0000000380), 0x7b95b611, 0x802) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x5}}]}}]}, 0x48}}, 0x20040084) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0xfff5, 0x4}, {}, {0x8, 0xc}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x7e, 0xffffffffffffffff, 0xfffffffc, 0x8}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) 56.888639ms ago: executing program 2 (id=681): setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000240)={0x8, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @private1}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000001780)={0x8, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8}}, {{0xa, 0x4e20, 0x2, @loopback, 0x200}}, {{0xa, 0x4e22, 0x8001, @loopback, 0x14}}]}, 0x210) 49.655929ms ago: executing program 2 (id=682): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002180)={0x1, &(0x7f0000000380)=[{0x6, 0xfd, 0xd, 0x7fffffff}]}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) 107.25µs ago: executing program 2 (id=683): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0xe}, @NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x7c}}, 0x0) 0s ago: executing program 2 (id=684): pipe(&(0x7f00000001c0)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x7}, 0x48) splice(r0, 0x0, r1, 0x0, 0x4ffe2, 0x0) kernel console output (not intermixed with test programs): 19916][ T319] ? _raw_spin_lock+0x94/0xf0 [ 34.024756][ T319] ? _raw_spin_trylock_bh+0x150/0x150 [ 34.031099][ T319] ? ext4_get_projid+0x140/0x140 [ 34.036249][ T319] ? __kasan_check_write+0x14/0x20 [ 34.041595][ T319] iput+0x654/0x7e0 [ 34.045484][ T319] ext4_orphan_cleanup+0x989/0xd40 [ 34.049219][ T337] EXT4-fs (loop1): Ignoring removed nobh option [ 34.083120][ T319] ext4_fill_super+0x867e/0x8d90 [ 34.091664][ T319] ? ext4_mount+0x40/0x40 [ 34.097905][ T319] ? vscnprintf+0x80/0x80 [ 34.099358][ T337] EXT4-fs (loop1): mounted filesystem without journal. Opts: resgid=0x0000000000000000,nobh,noauto_da_alloc,,errors=continue [ 34.102557][ T319] ? set_blocksize+0x1eb/0x3a0 [ 34.117757][ T337] ext4 filesystem being mounted at /4/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 34.120768][ T319] ? sb_set_blocksize+0xaa/0xf0 [ 34.145303][ T319] mount_bdev+0x26a/0x380 [ 34.149673][ T319] ? ext4_mount+0x40/0x40 [ 34.154472][ T319] ext4_mount+0x34/0x40 [ 34.165816][ T319] legacy_get_tree+0xed/0x190 [ 34.170565][ T319] ? ext4_chksum+0x180/0x180 [ 34.175866][ T319] vfs_get_tree+0x89/0x260 [ 34.185499][ T319] do_new_mount+0x25a/0xa30 [ 34.190552][ T319] path_mount+0x581/0xca0 [ 34.197351][ T319] __se_sys_mount+0x320/0x390 [ 34.202750][ T319] ? __x64_sys_mount+0xd0/0xd0 [ 34.395940][ T319] ? debug_smp_processor_id+0x17/0x20 [ 34.411754][ T337] EXT4-fs error (device loop1) in ext4_do_update_inode:5362: error 27 [ 34.420390][ T319] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 34.450871][ T319] __x64_sys_mount+0xbf/0xd0 [ 34.455671][ T337] EXT4-fs error (device loop1): ext4_dirty_inode:6181: inode #2: comm syz.1.10: mark_inode_dirty error [ 34.467250][ T337] EXT4-fs error (device loop1) in ext4_do_update_inode:5362: error 27 [ 34.471009][ T319] do_syscall_64+0x31/0x40 [ 34.478137][ T337] EXT4-fs error (device loop1): __ext4_ext_dirty:182: inode #2: comm syz.1.10: mark_inode_dirty error [ 34.489286][ T319] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 34.498943][ T319] RIP: 0033:0x7f4a2d1c210a [ 34.503496][ T319] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.525326][ T319] RSP: 002b:00007f4a2bc19e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 34.534783][ T319] RAX: ffffffffffffffda RBX: 00007f4a2bc19ee0 RCX: 00007f4a2d1c210a [ 34.572723][ T352] input: syz1 as /devices/virtual/input/input4 [ 34.618867][ T319] RDX: 0000200000000580 RSI: 0000200000000140 RDI: 00007f4a2bc19ea0 [ 34.628591][ T319] RBP: 0000200000000580 R08: 00007f4a2bc19ee0 R09: 0000000000800718 [ 34.639552][ T319] R10: 0000000000800718 R11: 0000000000000246 R12: 0000200000000140 [ 34.648767][ T319] R13: 00007f4a2bc19ea0 R14: 00000000000004a8 R15: 00002000000003c0 [ 34.660488][ T319] ---[ end trace 04a4a74602900005 ]--- [ 34.668059][ T319] EXT4-fs (loop2): 1 orphan inode deleted [ 34.674387][ T319] EXT4-fs (loop2): mounted filesystem without journal. Opts: delalloc,norecovery,debug_want_extra_isize=0x0000000000000060,nobh,resgid=0x0000000000000000,resuid=0x0000000000000000,grpquota,noblock_validity,usrquota,data_err=ignore,,errors=continue [ 34.880996][ T347] EXT4-fs (loop4): mounted filesystem without journal. Opts: nolazytime,nodelalloc,,errors=continue [ 34.918894][ T347] ext4 filesystem being mounted at /1/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 35.060601][ T24] kauditd_printk_skb: 68 callbacks suppressed [ 35.060611][ T24] audit: type=1400 audit(1784806631.430:142): avc: denied { write } for pid=362 comm="syz.3.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 35.148707][ T24] audit: type=1400 audit(1784806631.460:143): avc: denied { read } for pid=362 comm="syz.3.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 35.179420][ T363] EXT4-fs (loop3): Ignoring removed bh option [ 35.191401][ T24] audit: type=1400 audit(1784806631.490:144): avc: denied { create } for pid=346 comm="syz.4.12" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 35.238226][ T363] EXT4-fs (loop3): mounted filesystem without journal. Opts: i_version,nogrpid,bh,,errors=continue [ 35.249674][ T363] ext4 filesystem being mounted at /4/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 35.624425][ T374] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 35.746112][ T24] audit: type=1400 audit(1784806632.080:145): avc: denied { create } for pid=371 comm="syz.1.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 35.766554][ T374] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 35.832578][ T372] netlink: 16 bytes leftover after parsing attributes in process `syz.4.20'. [ 35.842213][ T377] EXT4-fs (loop2): mounted filesystem without journal. Opts: max_dir_size_kb=0x0000000000001000,nodiscard,quota,,errors=continue [ 35.938462][ T377] ext4 filesystem being mounted at /1/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 35.957128][ T374] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2799: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 36.034312][ T24] audit: type=1400 audit(1784806632.400:146): avc: denied { unmount } for pid=280 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 36.056999][ T374] EXT4-fs (loop3): 1 truncate cleaned up [ 36.062721][ T374] EXT4-fs (loop3): mounted filesystem without journal. Opts: max_batch_time=0x0000000000000004,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,user_xattr,errors=remount-ro,data=journal, [ 36.095543][ T24] audit: type=1400 audit(1784806632.460:147): avc: denied { create } for pid=387 comm="syz.4.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 36.173513][ T24] audit: type=1400 audit(1784806632.460:148): avc: denied { write } for pid=387 comm="syz.4.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 36.214280][ T24] audit: type=1400 audit(1784806632.460:149): avc: denied { nlmsg_write } for pid=387 comm="syz.4.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 36.236583][ T24] audit: type=1400 audit(1784806632.560:150): avc: denied { write } for pid=392 comm="syz.3.25" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 36.293440][ T24] audit: type=1400 audit(1784806632.660:151): avc: denied { map_create } for pid=395 comm="syz.0.26" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 36.367846][ T377] EXT4-fs error (device loop2) in ext4_do_update_inode:5362: error 27 [ 36.377765][ T377] EXT4-fs error (device loop2): ext4_dirty_inode:6181: inode #2: comm syz.2.21: mark_inode_dirty error [ 36.390591][ T377] EXT4-fs error (device loop2) in ext4_do_update_inode:5362: error 27 [ 36.401105][ T377] EXT4-fs error (device loop2): __ext4_ext_dirty:182: inode #2: comm syz.2.21: mark_inode_dirty error [ 36.545429][ T304] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 36.803558][ T408] netlink: 'syz.0.31': attribute type 9 has an invalid length. [ 36.815378][ T304] usb 4-1: Using ep0 maxpacket: 16 [ 36.935557][ T304] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.951650][ T304] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.962715][ T304] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 36.976496][ T304] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 36.986095][ T304] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.997279][ T304] usb 4-1: config 0 descriptor?? [ 37.065333][ T287] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 37.305345][ T287] usb 3-1: Using ep0 maxpacket: 16 [ 37.445598][ T287] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 37.457065][ T287] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 37.457264][ T393] udc-core: couldn't find an available UDC or it's busy [ 37.473949][ T393] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 37.567001][ T304] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 37.574947][ T287] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 37.587948][ T304] microsoft 0003:045E:07DA.0001: unknown main item tag 0x4 [ 37.596418][ T287] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 37.604625][ T304] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 37.612188][ T287] usb 3-1: SerialNumber: syz [ 37.640719][ T304] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.0001/input/input5 [ 37.663849][ T304] microsoft 0003:045E:07DA.0001: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 37.677473][ T287] usb 3-1: 0:2 : does not exist [ 37.798701][ T443] device syzkaller0 entered promiscuous mode [ 37.854882][ T417] usb 4-1: USB disconnect, device number 2 [ 37.905410][ T305] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 38.145348][ T305] usb 5-1: Using ep0 maxpacket: 32 [ 38.150592][ T25] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 38.265456][ T305] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 108, changing to 7 [ 38.455383][ T305] usb 5-1: New USB device found, idVendor=047f, idProduct=c010, bcdDevice= 0.40 [ 38.465040][ T305] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.473234][ T305] usb 5-1: Product: syz [ 38.478110][ T305] usb 5-1: Manufacturer: syz [ 38.482801][ T305] usb 5-1: SerialNumber: syz [ 38.555399][ T25] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 38.570500][ T25] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 38.583062][ T454] ====================================================== [ 38.583062][ T454] WARNING: the mand mount option is being deprecated and [ 38.583062][ T454] will be removed in v5.15! [ 38.583062][ T454] ====================================================== [ 38.614149][ T25] usb 2-1: config 220 has no interface number 2 [ 38.621014][ T25] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 38.634575][ T25] usb 2-1: config 220 interface 0 has no altsetting 0 [ 38.642217][ T25] usb 2-1: config 220 interface 76 has no altsetting 0 [ 38.650204][ T25] usb 2-1: config 220 interface 1 has no altsetting 0 [ 38.796516][ T454] exFAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 38.807839][ T454] exFAT-fs (loop0): Medium has reported failures. Some data may be lost. [ 38.825693][ T25] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 38.832671][ T454] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 38.860008][ T25] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.869253][ T25] usb 2-1: Product: syz [ 38.870064][ T454] exFAT-fs (loop0): error, failed to bmap (inode : ffff88812f0d40d0 iblock : 0, err : -5) [ 38.874406][ T25] usb 2-1: Manufacturer: syz [ 38.884343][ T454] exFAT-fs (loop0): Filesystem has been set read-only [ 38.889536][ T25] usb 2-1: SerialNumber: syz [ 38.955703][ T458] EXT4-fs (loop2): mounted filesystem without journal. Opts: delalloc,barrier,barrier,jqfmt=vfsv1,,errors=continue [ 39.177351][ T287] usb 3-1: USB disconnect, device number 2 [ 39.216368][ T476] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 39.225993][ T476] ext4 filesystem being mounted at /14/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 39.245591][ T25] uvcvideo: Found UVC 7.01 device syz (8086:0b07) [ 39.252471][ T25] uvcvideo: No valid video chain found. [ 39.258275][ T305] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 39.265410][ T25] usb 2-1: selecting invalid altsetting 0 [ 39.303845][ T305] usb 5-1: USB disconnect, device number 2 [ 39.313145][ T479] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 39.327064][ T479] ext4 filesystem being mounted at /6/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 39.371467][ T25] usb 2-1: USB disconnect, device number 2 [ 39.423227][ T479] EXT4-fs error (device loop2): ext4_get_first_dir_block:3716: inode #12: block 32: comm syz.2.56: bad entry in directory: rec_len is too small for name_len - offset=0, inode=12, rec_len=12, size=2048 fake=0 [ 39.452166][ T479] EXT4-fs error (device loop2): ext4_get_first_dir_block:3719: inode #12: comm syz.2.56: directory missing '.' [ 39.475281][ T497] EXT4-fs (loop3): mounted filesystem without journal. Opts: delalloc,barrier,barrier,jqfmt=vfsv1,,errors=continue [ 39.488382][ T302] udevd[302]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 39.556575][ T330] udevd[330]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card1/controlC1/../uevent} for writing: No such file or directory [ 39.635978][ T505] FAT-fs (loop2): Directory bread(block 199916) failed [ 39.645831][ T505] FAT-fs (loop2): Directory bread(block 199917) failed [ 39.659161][ T505] FAT-fs (loop2): Directory bread(block 199918) failed [ 39.666396][ T505] FAT-fs (loop2): Directory bread(block 199919) failed [ 39.673564][ T505] FAT-fs (loop2): Directory bread(block 199920) failed [ 39.681580][ T505] FAT-fs (loop2): Directory bread(block 199921) failed [ 39.690916][ T514] EXT4-fs (loop0): Ignoring removed nobh option [ 39.753076][ T505] FAT-fs (loop2): Directory bread(block 199922) failed [ 39.761686][ T514] EXT4-fs (loop0): mounted filesystem without journal. Opts: max_dir_size_kb=0x0000000000001000,nobh,quota,,errors=continue [ 39.782595][ T505] FAT-fs (loop2): Directory bread(block 199923) failed [ 39.822897][ T514] ext4 filesystem being mounted at /19/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 39.910832][ T514] EXT4-fs error (device loop0) in ext4_do_update_inode:5362: error 27 [ 39.919776][ T514] EXT4-fs error (device loop0): ext4_dirty_inode:6181: inode #2: comm syz.0.67: mark_inode_dirty error [ 39.931482][ T514] EXT4-fs error (device loop0) in ext4_do_update_inode:5362: error 27 [ 39.939896][ T514] EXT4-fs error (device loop0): __ext4_ext_dirty:182: inode #2: comm syz.0.67: mark_inode_dirty error [ 39.995421][ T417] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 40.018523][ T533] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 40.039611][ T533] EXT4-fs (loop3): 1 truncate cleaned up [ 40.045323][ T533] EXT4-fs (loop3): mounted filesystem without journal. Opts: noload,noload,lazytime,noload,resgid=0x0000000000000000,auto_da_alloc,,errors=continue [ 40.094159][ T533] EXT4-fs warning (device loop3): ext4_group_extend:1834: can't read last block, resize aborted [ 40.111769][ T547] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 40.136933][ T547] EXT4-fs (loop2): 1 truncate cleaned up [ 40.142969][ T547] EXT4-fs (loop2): mounted filesystem without journal. Opts: init_itable=0x0000000000000004,dioread_nolock,debug_want_extra_isize=0x000000000000006a,jqfmt=vfsold,nojournal_checksum,grpjquota=,,errors=continue [ 40.144000][ T551] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 40.376416][ T24] kauditd_printk_skb: 54 callbacks suppressed [ 40.376453][ T24] audit: type=1400 audit(1784806636.750:206): avc: denied { map } for pid=545 comm="syz.2.79" path="/9/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/memory.stat" dev="loop2" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 40.651396][ T24] audit: type=1400 audit(1784806637.020:207): avc: denied { setopt } for pid=569 comm="syz.2.85" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 40.656130][ T417] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 40.681319][ T417] usb 5-1: config 0 has no interfaces? [ 40.686859][ T417] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 40.696010][ T417] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.778576][ T417] usb 5-1: config 0 descriptor?? [ 40.800191][ T579] Zero length message leads to an empty skb [ 40.976880][ T24] audit: type=1400 audit(1784806637.350:208): avc: denied { mmap_zero } for pid=600 comm="syz.1.97" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 41.028168][ T24] audit: type=1400 audit(1784806637.400:209): avc: denied { read } for pid=521 comm="syz.4.71" name="usbmon7" dev="devtmpfs" ino=175 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 41.036704][ T415] usb 5-1: USB disconnect, device number 3 [ 41.051518][ T24] audit: type=1400 audit(1784806637.400:210): avc: denied { open } for pid=521 comm="syz.4.71" path="/dev/usbmon7" dev="devtmpfs" ino=175 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 41.087930][ T603] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 41.167316][ T609] netlink: 4 bytes leftover after parsing attributes in process `syz.3.100'. [ 41.194421][ T611] netlink: 'syz.3.102': attribute type 4 has an invalid length. [ 41.270724][ T617] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 41.299388][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 41.309782][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 41.319557][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 41.319740][ T617] EXT4-fs error (device loop1): ext4_validate_block_bitmap:429: comm syz.1.104: bg 0: block 4: invalid block bitmap [ 41.328324][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 41.341194][ T617] EXT4-fs error (device loop1) in ext4_mb_clear_bb:5650: Corrupt filesystem [ 41.348607][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 41.357346][ T617] EXT4-fs error (device loop1): ext4_free_branches:1026: inode #11: comm syz.1.104: invalid indirect mapped block 1 (level 1) [ 41.365633][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 41.386775][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 41.386954][ T617] EXT4-fs (loop1): 1 truncate cleaned up [ 41.394965][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 41.400713][ T617] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 41.476462][ T24] audit: type=1400 audit(1784806637.850:211): avc: denied { mounton } for pid=621 comm="syz.0.106" path="/23/file0" dev="tmpfs" ino=139 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 41.541918][ T624] EXT4-fs (loop1): Test dummy encryption mode enabled [ 41.549385][ T624] EXT4-fs (loop1): Journaled quota options ignored when QUOTA feature is enabled [ 41.561142][ T624] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c000c01c, mo2=0002] [ 41.570606][ T624] EXT4-fs (loop1): mounted filesystem without journal. Opts: test_dummy_encryption,i_version,noblock_validity,nobarrier,inlinecrypt,max_batch_time=0x0000000000000000,abort,auto_da_alloc,usrjquota=./file1,max_dir_size_kb=0x0000000000000007,debug,,errors=continue [ 41.903685][ T24] audit: type=1400 audit(1784806638.090:212): avc: denied { connect } for pid=628 comm="syz.4.107" lport=7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 41.932187][ T632] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 41.951602][ T632] EXT4-fs (loop0): 1 truncate cleaned up [ 41.958430][ T632] EXT4-fs (loop0): mounted filesystem without journal. Opts: barrier=0x0000000000000101,i_version,,errors=continue [ 41.979695][ T641] EXT4-fs (loop2): Ignoring removed nobh option [ 41.991070][ T24] audit: type=1400 audit(1784806638.360:213): avc: denied { map } for pid=631 comm="syz.0.108" path="/dev/loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 42.017902][ T632] EXT4-fs error (device loop0) in ext4_setattr:5745: Corrupt filesystem [ 42.027113][ T641] EXT4-fs (loop2): mounted filesystem without journal. Opts: nobh,grpquota,,errors=continue [ 42.040143][ T641] ext4 filesystem being mounted at /20/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 42.156650][ T24] audit: type=1400 audit(1784806638.530:214): avc: denied { read write } for pid=649 comm="syz.0.112" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 42.185406][ T24] audit: type=1400 audit(1784806638.530:215): avc: denied { open } for pid=649 comm="syz.0.112" path="/25/file0/file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 42.415339][ T305] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 42.530703][ T667] EXT4-fs (loop0): mounted filesystem without journal. Opts: nobarrier,noinit_itable,dioread_nolock,init_itable,,errors=continue [ 42.548784][ T667] ext4 filesystem being mounted at /27/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 42.588925][ T667] fs-verity (loop0, inode 18): Unknown hash algorithm number: 0 [ 42.597496][ T674] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 42.671533][ T679] capability: warning: `syz.0.121' uses deprecated v2 capabilities in a way that may be insecure [ 42.735380][ T305] usb 4-1: Using ep0 maxpacket: 16 [ 42.842465][ T688] device syzkaller0 entered promiscuous mode [ 42.886043][ T305] usb 4-1: config 0 interface 0 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 42.918300][ T305] usb 4-1: config 0 interface 0 has no altsetting 0 [ 42.925754][ T305] usb 4-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 42.935093][ T305] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.071289][ T698] erofs: (device loop1): mounted with root inode @ nid 36. [ 43.092682][ T305] usb 4-1: config 0 descriptor?? [ 43.100120][ T697] attempt to access beyond end of device [ 43.100120][ T697] loop1: rw=524288, want=1342177528, limit=16 [ 43.113366][ T697] attempt to access beyond end of device [ 43.113366][ T697] loop1: rw=0, want=1342177280, limit=16 [ 43.125889][ T697] attempt to access beyond end of device [ 43.125889][ T697] loop1: rw=0, want=1342177280, limit=16 [ 43.137881][ T698] attempt to access beyond end of device [ 43.137881][ T698] loop1: rw=0, want=1342177280, limit=16 [ 43.150413][ T698] attempt to access beyond end of device [ 43.150413][ T698] loop1: rw=0, want=1342177280, limit=16 [ 43.163085][ T698] attempt to access beyond end of device [ 43.163085][ T698] loop1: rw=0, want=1342177280, limit=16 [ 43.174949][ T698] attempt to access beyond end of device [ 43.174949][ T698] loop1: rw=0, want=1342177280, limit=16 [ 43.187561][ T697] attempt to access beyond end of device [ 43.187561][ T697] loop1: rw=0, want=1342177280, limit=16 [ 43.199249][ T697] attempt to access beyond end of device [ 43.199249][ T697] loop1: rw=0, want=1342177280, limit=16 [ 43.211097][ T697] attempt to access beyond end of device [ 43.211097][ T697] loop1: rw=0, want=1342177280, limit=16 [ 43.366252][ T709] EXT4-fs error (device loop2): ext4_orphan_get:1401: inode #15: comm syz.2.134: iget: bad i_size value: 38620345925642 [ 43.379623][ T709] EXT4-fs error (device loop2): ext4_orphan_get:1406: comm syz.2.134: couldn't read orphan inode 15 (err -117) [ 43.409441][ T714] EXT4-fs error (device loop1) in ext4_do_update_inode:5362: error 27 [ 43.415521][ T709] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 43.427441][ T714] EXT4-fs error (device loop1) in ext4_orphan_del:3292: error 27 [ 43.436266][ T714] EXT4-fs error (device loop1) in ext4_do_update_inode:5362: error 27 [ 43.444412][ T709] EXT4-fs error (device loop2): ext4_validate_block_bitmap:429: comm syz.2.134: bg 0: block 5: invalid block bitmap [ 43.447744][ T714] EXT4-fs error (device loop1): ext4_evict_inode:333: inode #15: comm syz.1.133: mark_inode_dirty error [ 43.556183][ T714] EXT4-fs (loop1): 1 orphan inode deleted [ 43.562091][ T714] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 43.562483][ T709] EXT4-fs (loop2): Delayed block allocation failed for inode 19 at logical offset 0 with max blocks 5 with error 28 [ 43.584829][ T709] EXT4-fs (loop2): This should not happen!! Data will be lost [ 43.584829][ T709] [ 43.595494][ T709] EXT4-fs (loop2): Total free blocks count 0 [ 43.602628][ T709] EXT4-fs (loop2): Free/Dirty block details [ 43.604772][ T305] hid-generic 0003:05AC:0269.0002: unknown main item tag 0x0 [ 43.624776][ T709] EXT4-fs (loop2): free_blocks=0 [ 43.632073][ T709] EXT4-fs (loop2): dirty_blocks=5 [ 43.636002][ T305] hid-generic 0003:05AC:0269.0002: unknown main item tag 0x6 [ 43.645363][ T709] EXT4-fs (loop2): Block reservation details [ 43.658375][ T714] EXT4-fs error (device loop1): __ext4_get_inode_loc:4451: comm syz.1.133: Invalid inode table block 3033877320 in block_group 0 [ 43.661416][ T709] EXT4-fs (loop2): i_reserved_data_blocks=5 [ 43.683274][ T305] hid-generic 0003:05AC:0269.0002: unknown main item tag 0x0 [ 43.684168][ T714] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5971: Corrupt filesystem [ 43.701717][ T305] hid-generic 0003:05AC:0269.0002: unknown main item tag 0x0 [ 43.711126][ T305] hid-generic 0003:05AC:0269.0002: unknown main item tag 0x0 [ 43.721277][ T305] hid-generic 0003:05AC:0269.0002: unknown main item tag 0x0 [ 43.730738][ T305] hid-generic 0003:05AC:0269.0002: unknown main item tag 0x0 [ 43.741037][ T305] hid-generic 0003:05AC:0269.0002: unknown main item tag 0x0 [ 43.748787][ T305] hid-generic 0003:05AC:0269.0002: unknown main item tag 0x0 [ 43.758778][ T305] hid-generic 0003:05AC:0269.0002: unknown main item tag 0x0 [ 43.766609][ T305] hid-generic 0003:05AC:0269.0002: unknown main item tag 0x0 [ 43.788214][ T305] hid-generic 0003:05AC:0269.0002: hidraw0: USB HID v0.05 Device [HID 05ac:0269] on usb-dummy_hcd.3-1/input0 [ 43.842072][ T305] usb 4-1: USB disconnect, device number 3 [ 43.963423][ T721] EXT4-fs (loop2): Ignoring removed orlov option [ 44.031979][ T724] fido_id[724]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 44.038207][ T721] EXT4-fs (loop2): mounted filesystem without journal. Opts: block_validity,bsddf,sysvgroups,norecovery,debug_want_extra_isize=0x0000000000000080,orlov,nogrpid,noauto_da_alloc,norecovery,,errors=continue [ 44.067268][ T727] exfat: Deprecated parameter 'utf8' [ 44.073952][ T727] exfat: Deprecated parameter 'namecase' [ 44.074400][ T737] netlink: 40 bytes leftover after parsing attributes in process `syz.4.139'. [ 44.079818][ T727] exfat: Deprecated parameter 'utf8' [ 44.094593][ T737] netlink: 40 bytes leftover after parsing attributes in process `syz.4.139'. [ 44.112086][ T727] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xb89b369d, utbl_chksum : 0xe619d30d) [ 44.152283][ T741] exFAT-fs (loop4): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x190b464b, utbl_chksum : 0xe619d30d) [ 44.260631][ T751] input: syz0 as /devices/virtual/input/input6 [ 44.264635][ T741] process 'syz.4.142' launched './file0' with NULL argv: empty string added [ 44.276311][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.282323][ T741] exFAT-fs (loop4): Filesystem has been set read-only [ 44.289136][ T741] exFAT-fs (loop4): error, failed to bmap (inode : ffff88812f0d5990 iblock : 0, err : -5) [ 44.299105][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.305075][ T741] exFAT-fs (loop4): error, failed to bmap (inode : ffff88812f0d5990 iblock : 0, err : -5) [ 44.315054][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.321091][ T741] exFAT-fs (loop4): error, failed to bmap (inode : ffff88812f0d5990 iblock : 1, err : -5) [ 44.331504][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.335559][ T744] EXT4-fs (loop0): Ignoring removed mblk_io_submit option [ 44.343816][ T741] exFAT-fs (loop4): error, failed to bmap (inode : ffff88812f0d5990 iblock : 2, err : -5) [ 44.359004][ T744] EXT4-fs (loop0): external journal device major/minor numbers have changed [ 44.368369][ T744] EXT4-fs (loop0): failed to open journal device unknown-block(4,137) -6 [ 44.371188][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.394051][ T741] exFAT-fs (loop4): error, failed to bmap (inode : ffff88812f0d5990 iblock : 3, err : -5) [ 44.428683][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.435427][ T741] exFAT-fs (loop4): error, failed to bmap (inode : ffff88812f0d5990 iblock : 4, err : -5) [ 44.452020][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.458168][ T741] exFAT-fs (loop4): error, failed to bmap (inode : ffff88812f0d5990 iblock : 5, err : -5) [ 44.468102][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.474169][ T741] exFAT-fs (loop4): error, failed to bmap (inode : ffff88812f0d5990 iblock : 6, err : -5) [ 44.503056][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.504307][ T759] EXT4-fs (loop2): mounted filesystem without journal. Opts: jqfmt=vfsv1,jqfmt=vfsv1,errors=remount-ro,sb=0x0000000000000001, [ 44.510228][ T741] exFAT-fs (loop4): error, failed to bmap (inode : ffff88812f0d5990 iblock : 7, err : -5) [ 44.542631][ T767] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d) [ 44.585062][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.605655][ T741] exFAT-fs (loop4): error, failed to bmap (inode : ffff88812f0d5990 iblock : 0, err : -5) [ 44.616100][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.622384][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.628720][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.634799][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.640910][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.647190][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.653354][ T741] exFAT-fs (loop4): error, broken FAT chain. [ 44.811348][ T778] EXT4-fs (loop3): Ignoring removed nomblk_io_submit option [ 44.820969][ T778] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: comm syz.3.154: inode #1: comm syz.3.154: iget: illegal inode # [ 44.834384][ T778] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.154: error while reading EA inode 1 err=-117 [ 44.853353][ T778] EXT4-fs (loop3): 1 orphan inode deleted [ 44.859949][ T778] EXT4-fs (loop3): mounted filesystem without journal. Opts: jqfmt=vfsv0,stripe=0x0000000000000008,nombcache,noinit_itable,nomblk_io_submit,minixdf,nobarrier,inode_readahead_blks=0x0000000000000000,usrjquota=,block_validity,noblock_validity,noquota,,errors=continue [ 44.966775][ T789] EXT4-fs (loop4): Test dummy encryption mode enabled [ 45.002974][ T794] EXT4-fs (loop3): Test dummy encryption mode enabled [ 45.011035][ T789] EXT4-fs (loop4): mounted filesystem without journal. Opts: test_dummy_encryption=v1,max_dir_size_kb=0x0000000000000002,inlinecrypt,,errors=continue [ 45.029056][ T794] EXT4-fs error (device loop3): ext4_orphan_get:1401: inode #15: comm syz.3.160: inode has both inline data and extents flags [ 45.043073][ T789] ext4 filesystem being mounted at /21/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 45.062719][ T794] EXT4-fs error (device loop3): ext4_orphan_get:1406: comm syz.3.160: couldn't read orphan inode 15 (err -117) [ 45.076219][ T794] EXT4-fs (loop3): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue [ 45.089390][ T794] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 45.115529][ T801] EXT4-fs (loop0): 1 truncate cleaned up [ 45.121357][ T801] EXT4-fs (loop0): mounted filesystem without journal. Opts: min_batch_time=0x0000000000008001,,errors=continue [ 45.360297][ T829] erofs: (device loop2): mounted with root inode @ nid 36. [ 45.438914][ T842] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 45.542695][ T844] exFAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 45.553394][ T844] exFAT-fs (loop2): Medium has reported failures. Some data may be lost. [ 45.563089][ T844] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 45.580947][ T24] kauditd_printk_skb: 24 callbacks suppressed [ 45.580958][ T24] audit: type=1400 audit(1784806641.950:240): avc: denied { append } for pid=843 comm="syz.2.178" path="/30/bus/blkio.bfq.io_merged_recursive" dev="loop2" ino=1048605 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 45.613521][ T54] usb 4-1: new low-speed USB device number 4 using dummy_hcd [ 45.685347][ T305] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 45.737816][ T861] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 45.806198][ T864] erofs: (device loop2): mounted with root inode @ nid 36. [ 45.922952][ T24] audit: type=1400 audit(1784806642.290:241): avc: denied { create } for pid=866 comm="syz.2.186" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 45.943722][ T305] usb 5-1: Using ep0 maxpacket: 16 [ 45.949905][ T24] audit: type=1400 audit(1784806642.290:242): avc: denied { write } for pid=866 comm="syz.2.186" name="file0" dev="tmpfs" ino=202 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 45.975944][ T24] audit: type=1400 audit(1784806642.290:243): avc: denied { open } for pid=866 comm="syz.2.186" path="/34/file0" dev="tmpfs" ino=202 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 46.000901][ T24] audit: type=1400 audit(1784806642.290:244): avc: denied { ioctl } for pid=866 comm="syz.2.186" path="/34/file0" dev="tmpfs" ino=202 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 46.036138][ T54] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 46.047902][ T54] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 46.174828][ T24] audit: type=1400 audit(1784806642.540:245): avc: denied { unlink } for pid=283 comm="syz-executor" name="file0" dev="tmpfs" ino=202 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 46.255399][ T305] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 46.264644][ T305] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 46.301252][ T305] usb 5-1: Product: syz [ 46.307712][ T305] usb 5-1: Manufacturer: syz [ 46.312566][ T305] usb 5-1: SerialNumber: syz [ 46.320323][ T305] usb 5-1: config 0 descriptor?? [ 46.325702][ T54] usb 4-1: string descriptor 0 read error: -22 [ 46.331908][ T54] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 46.343280][ T54] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 46.419750][ T24] audit: type=1400 audit(1784806642.790:246): avc: denied { set_context_mgr } for pid=881 comm="syz.2.190" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 46.420626][ T882] binder: 881:882 ioctl c0306201 200000000080 returned -14 [ 46.466384][ T24] audit: type=1400 audit(1784806642.840:247): avc: denied { map } for pid=881 comm="syz.2.190" path="/dev/binderfs/binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 46.490885][ T882] binder: 881:882 ioctl c0306201 2000000003c0 returned -14 [ 46.491384][ T409] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 46.505887][ T24] audit: type=1400 audit(1784806642.870:248): avc: denied { call } for pid=881 comm="syz.2.190" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 46.524754][ T24] audit: type=1400 audit(1784806642.870:249): avc: denied { transfer } for pid=881 comm="syz.2.190" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 46.548480][ T884] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 46.587421][ T417] usb 4-1: USB disconnect, device number 4 [ 46.596066][ T305] r8152 5-1:0.0: Unknown version 0x7410 [ 46.709204][ T891] EXT4-fs error (device loop1): __ext4_iget:5034: inode #11: block 1: comm syz.1.193: invalid block [ 46.722211][ T891] EXT4-fs error (device loop1): ext4_orphan_get:1406: comm syz.1.193: couldn't read orphan inode 11 (err -117) [ 46.735695][ T891] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 46.797787][ T456] usb 5-1: USB disconnect, device number 4 [ 46.885410][ T409] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 46.896225][ T409] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 46.905172][ T409] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 46.926604][ T903] EXT4-fs (loop1): mounted filesystem without journal. Opts: delalloc,barrier,barrier,jqfmt=vfsv1,,errors=continue [ 46.988402][ T908] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 47.075408][ T409] usb 1-1: New USB device found, idVendor=06f8, idProduct=b000, bcdDevice= 0.40 [ 47.085291][ T409] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.093302][ T409] usb 1-1: Product: syz [ 47.099763][ T918] exFAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 47.116188][ T918] exFAT-fs (loop2): Medium has reported failures. Some data may be lost. [ 47.125206][ T409] usb 1-1: Manufacturer: syz [ 47.130472][ T409] usb 1-1: SerialNumber: syz [ 47.141212][ T918] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 47.252269][ T932] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 47.311091][ T938] sysfs: cannot create duplicate filename '/devices/virtual/bdi/7:0' [ 47.320024][ T938] CPU: 1 PID: 938 Comm: syz.4.210 Tainted: G W syzkaller #0 [ 47.328995][ T938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 47.339757][ T938] Call Trace: [ 47.343142][ T938] __dump_stack+0x21/0x24 [ 47.347486][ T938] dump_stack_lvl+0x1a7/0x208 [ 47.352277][ T938] ? show_regs_print_info+0x18/0x18 [ 47.357552][ T938] ? kmem_cache_alloc_trace+0x179/0x2e0 [ 47.363084][ T938] ? sysfs_create_dir_ns+0x227/0x290 [ 47.368373][ T938] dump_stack+0x15/0x1c [ 47.372508][ T938] sysfs_create_dir_ns+0x266/0x290 [ 47.377598][ T938] ? __kasan_check_write+0x14/0x20 [ 47.382711][ T938] ? sysfs_warn_dup+0xa0/0xa0 [ 47.387467][ T938] kobject_add_internal+0x774/0xde0 [ 47.392657][ T938] kobject_add+0x165/0x230 [ 47.397254][ T938] ? _raw_spin_lock+0x94/0xf0 [ 47.401910][ T938] ? kobject_init+0x1d0/0x1d0 [ 47.406652][ T938] ? __kasan_check_write+0x14/0x20 [ 47.411888][ T938] ? mutex_unlock+0x1c/0x40 [ 47.416518][ T938] ? get_device_parent+0x2a1/0x410 [ 47.421605][ T938] device_add+0x3d8/0xc00 [ 47.425917][ T938] ? kobject_set_name_vargs+0xca/0x110 [ 47.431347][ T938] device_create+0x26c/0x300 [ 47.435919][ T938] ? root_device_unregister+0x80/0x80 [ 47.441296][ T938] ? vsnprintf+0x189d/0x1990 [ 47.445866][ T938] bdi_register_va+0x90/0x5f0 [ 47.450534][ T938] bdi_register+0xdf/0x130 [ 47.454939][ T938] ? vsnprintf+0x189d/0x1990 [ 47.459662][ T938] ? bdi_register_va+0x5f0/0x5f0 [ 47.464585][ T938] ? __kasan_check_read+0x11/0x20 [ 47.469591][ T938] ? blk_alloc_devt+0xda/0x330 [ 47.474346][ T938] __device_add_disk+0x538/0x1010 [ 47.479349][ T938] device_add_disk+0x2a/0x40 [ 47.483933][ T938] loop_add+0x59f/0x770 [ 47.485371][ T417] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 47.488112][ T938] loop_control_ioctl+0x396/0x570 [ 47.500567][ T938] ? loop_remove+0xb0/0xb0 [ 47.504956][ T938] ? __fget_files+0x2e1/0x340 [ 47.509615][ T938] ? security_file_ioctl+0x84/0xa0 [ 47.514704][ T938] ? loop_remove+0xb0/0xb0 [ 47.519184][ T938] __se_sys_ioctl+0x121/0x1a0 [ 47.523837][ T938] __x64_sys_ioctl+0x7b/0x90 [ 47.528492][ T938] do_syscall_64+0x31/0x40 [ 47.532882][ T938] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 47.538763][ T938] RIP: 0033:0x7fad51509e99 [ 47.543253][ T938] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 47.562842][ T938] RSP: 002b:00007fad4ff63028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 47.571379][ T938] RAX: ffffffffffffffda RBX: 00007fad51791fa0 RCX: 00007fad51509e99 [ 47.579965][ T938] RDX: 0000000000100000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 47.588016][ T938] RBP: 00007fad5159feaf R08: 0000000000000000 R09: 0000000000000000 [ 47.596020][ T938] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 47.603986][ T938] R13: 00007fad51792038 R14: 00007fad51791fa0 R15: 00007ffde9d46a38 [ 47.614152][ T938] kobject_add_internal failed for 7:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 47.627756][ T938] ------------[ cut here ]------------ [ 47.633334][ T938] WARNING: CPU: 0 PID: 938 at block/genhd.c:821 __device_add_disk+0xcf9/0x1010 [ 47.642298][ T938] Modules linked in: [ 47.647024][ T938] CPU: 0 PID: 938 Comm: syz.4.210 Tainted: G W syzkaller #0 [ 47.655642][ T938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 47.665777][ T938] RIP: 0010:__device_add_disk+0xcf9/0x1010 [ 47.671580][ T938] Code: ff e8 eb 84 31 ff 0f 0b e9 74 fe ff ff e8 df 84 31 ff 0f 0b e9 64 f4 ff ff e8 d3 84 31 ff 0f 0b e9 a4 f9 ff ff e8 c7 84 31 ff <0f> 0b e9 52 f8 ff ff e8 bb 84 31 ff e9 77 fd ff ff e8 b1 84 31 ff [ 47.691914][ T938] RSP: 0018:ffffc90000ec7cb0 EFLAGS: 00010246 [ 47.698515][ T938] RAX: ffffffff82331e99 RBX: ffff888126aa2000 RCX: 0000000000080000 [ 47.706591][ T938] RDX: ffffc90002d21000 RSI: 000000000007ffff RDI: 0000000000080000 [ 47.714772][ T938] RBP: ffffc90000ec7d38 R08: 0000000000000003 R09: 0000000000000004 [ 47.723001][ T938] R10: dffffc0000000000 R11: fffff520001d8eac R12: ffff888126aa2348 [ 47.731445][ T938] R13: ffff888106d91000 R14: 00000000ffffffef R15: ffff888126aa2068 [ 47.739441][ T938] FS: 00007fad4ff636c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 47.748496][ T409] usb 1-1: 0:2 : does not exist [ 47.757828][ T938] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 47.764542][ T938] CR2: 000000110c2eddf3 CR3: 000000011206e000 CR4: 00000000003506b0 [ 47.772849][ T409] usb 1-1: USB disconnect, device number 2 [ 47.775334][ T938] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 47.787684][ T938] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 47.796089][ T938] Call Trace: [ 47.799516][ T938] device_add_disk+0x2a/0x40 [ 47.804395][ T938] loop_add+0x59f/0x770 [ 47.809090][ T938] loop_control_ioctl+0x396/0x570 [ 47.814258][ T938] ? loop_remove+0xb0/0xb0 [ 47.818747][ T938] ? __fget_files+0x2e1/0x340 [ 47.823511][ T938] ? security_file_ioctl+0x84/0xa0 [ 47.828857][ T938] ? loop_remove+0xb0/0xb0 [ 47.833609][ T938] __se_sys_ioctl+0x121/0x1a0 [ 47.838410][ T938] __x64_sys_ioctl+0x7b/0x90 [ 47.843051][ T938] do_syscall_64+0x31/0x40 [ 47.847561][ T938] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 47.853456][ T938] RIP: 0033:0x7fad51509e99 [ 47.857881][ T938] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 47.877713][ T417] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 47.885288][ T938] RSP: 002b:00007fad4ff63028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 47.888826][ T417] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 47.897305][ T938] RAX: ffffffffffffffda RBX: 00007fad51791fa0 RCX: 00007fad51509e99 [ 47.907185][ T417] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 47.915207][ T938] RDX: 0000000000100000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 47.928158][ T417] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 47.936086][ T938] RBP: 00007fad5159feaf R08: 0000000000000000 R09: 0000000000000000 [ 47.945398][ T417] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.953278][ T938] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 47.961979][ T417] usb 2-1: config 0 descriptor?? [ 47.975468][ T938] R13: 00007fad51792038 R14: 00007fad51791fa0 R15: 00007ffde9d46a38 [ 47.983569][ T938] ---[ end trace 04a4a74602900006 ]--- [ 47.989261][ T938] sysfs: cannot create duplicate filename '/dev/block/7:0' [ 47.996999][ T938] CPU: 0 PID: 938 Comm: syz.4.210 Tainted: G W syzkaller #0 [ 47.997222][ T302] udevd[302]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 48.005602][ T938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 48.005606][ T938] Call Trace: [ 48.005628][ T938] __dump_stack+0x21/0x24 [ 48.005636][ T938] dump_stack_lvl+0x1a7/0x208 [ 48.005647][ T938] ? show_regs_print_info+0x18/0x18 [ 48.005657][ T938] ? sysfs_warn_dup+0x51/0xa0 [ 48.005665][ T938] dump_stack+0x15/0x1c [ 48.005672][ T938] sysfs_warn_dup+0x8e/0xa0 [ 48.005689][ T938] sysfs_do_create_link_sd+0xc9/0x110 [ 48.070409][ T938] sysfs_create_link+0x68/0x80 [ 48.076384][ T938] device_create_sys_dev_entry+0x11b/0x180 [ 48.082445][ T938] ? device_add_attrs+0x430/0x430 [ 48.087709][ T938] ? device_create_file+0x10e/0x1c0 [ 48.093254][ T938] device_add+0x847/0xc00 [ 48.097596][ T938] __device_add_disk+0x6c7/0x1010 [ 48.104387][ T938] device_add_disk+0x2a/0x40 [ 48.109062][ T938] loop_add+0x59f/0x770 [ 48.113238][ T938] loop_control_ioctl+0x396/0x570 [ 48.118270][ T938] ? loop_remove+0xb0/0xb0 [ 48.123125][ T938] ? __fget_files+0x2e1/0x340 [ 48.128352][ T938] ? security_file_ioctl+0x84/0xa0 [ 48.133588][ T938] ? loop_remove+0xb0/0xb0 [ 48.138202][ T938] __se_sys_ioctl+0x121/0x1a0 [ 48.143967][ T938] __x64_sys_ioctl+0x7b/0x90 [ 48.148667][ T938] do_syscall_64+0x31/0x40 [ 48.153277][ T938] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.159181][ T938] RIP: 0033:0x7fad51509e99 [ 48.163996][ T938] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 48.185212][ T938] RSP: 002b:00007fad4ff63028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 48.193740][ T938] RAX: ffffffffffffffda RBX: 00007fad51791fa0 RCX: 00007fad51509e99 [ 48.201752][ T938] RDX: 0000000000100000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 48.210553][ T938] RBP: 00007fad5159feaf R08: 0000000000000000 R09: 0000000000000000 [ 48.218806][ T938] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 48.227422][ T938] R13: 00007fad51792038 R14: 00007fad51791fa0 R15: 00007ffde9d46a38 [ 48.236957][ T938] kobject_add_internal failed for queue (error: -2 parent: loop1048576) [ 48.246708][ T938] ------------[ cut here ]------------ [ 48.252380][ T938] WARNING: CPU: 0 PID: 938 at fs/sysfs/file.c:328 sysfs_create_files+0x227/0x360 [ 48.261555][ T938] Modules linked in: [ 48.265496][ T938] CPU: 0 PID: 938 Comm: syz.4.210 Tainted: G W syzkaller #0 [ 48.274150][ T938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 48.284277][ T938] RIP: 0010:sysfs_create_files+0x227/0x360 [ 48.290248][ T938] Code: 4d 89 ef 49 89 fd 48 89 c7 e8 85 49 d7 ff 4c 89 ef 4d 89 fd e9 2f ff ff ff e8 95 d4 9c ff 31 c0 e9 f4 00 00 00 e8 89 d4 9c ff <0f> 0b 41 c6 44 1d 06 f8 41 c6 44 1d 04 f8 c7 44 24 1c ea ff ff ff [ 48.310293][ T938] RSP: 0018:ffffc90000ec7bc0 EFLAGS: 00010246 [ 48.318364][ T938] RAX: ffffffff81c7cfff RBX: dffffc0000000000 RCX: 0000000000080000 [ 48.326827][ T938] RDX: ffffc90002d21000 RSI: 000000000007ffff RDI: 0000000000080000 [ 48.335083][ T938] RBP: ffffc90000ec7ca0 R08: ffff88810b3ba37b R09: 1ffff1102167746f [ 48.343328][ T938] R10: dffffc0000000000 R11: ffffed1021677470 R12: ffffffff853fb9e0 [ 48.351354][ T938] R13: 1ffff920001d8f80 R14: ffff888126aa2098 R15: ffff888126aa2068 [ 48.359470][ T938] FS: 00007fad4ff636c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 48.368691][ T938] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.375487][ T938] CR2: 000000110c2eddf3 CR3: 000000011206e000 CR4: 00000000003506b0 [ 48.383474][ T938] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 48.391511][ T938] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 48.400230][ T938] Call Trace: [ 48.403515][ T938] ? sysfs_create_file_ns+0x1b0/0x1b0 [ 48.409336][ T938] ? __kasan_check_write+0x14/0x20 [ 48.414632][ T938] ? kobject_get+0xd3/0x120 [ 48.419190][ T938] __device_add_disk+0xb5f/0x1010 [ 48.424993][ T938] device_add_disk+0x2a/0x40 [ 48.429825][ T938] loop_add+0x59f/0x770 [ 48.434021][ T938] loop_control_ioctl+0x396/0x570 [ 48.439101][ T938] ? loop_remove+0xb0/0xb0 [ 48.443820][ T938] ? __fget_files+0x2e1/0x340 [ 48.448697][ T938] ? security_file_ioctl+0x84/0xa0 [ 48.453946][ T938] ? loop_remove+0xb0/0xb0 [ 48.458404][ T938] __se_sys_ioctl+0x121/0x1a0 [ 48.463217][ T938] __x64_sys_ioctl+0x7b/0x90 [ 48.468672][ T938] do_syscall_64+0x31/0x40 [ 48.473091][ T938] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.479162][ T938] RIP: 0033:0x7fad51509e99 [ 48.483611][ T938] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 48.504813][ T938] RSP: 002b:00007fad4ff63028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 48.513297][ T938] RAX: ffffffffffffffda RBX: 00007fad51791fa0 RCX: 00007fad51509e99 [ 48.521646][ T938] RDX: 0000000000100000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 48.530188][ T938] RBP: 00007fad5159feaf R08: 0000000000000000 R09: 0000000000000000 [ 48.538214][ T938] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 48.546337][ T938] R13: 00007fad51792038 R14: 00007fad51791fa0 R15: 00007ffde9d46a38 [ 48.554529][ T938] ---[ end trace 04a4a74602900007 ]--- [ 48.560088][ T938] ------------[ cut here ]------------ [ 48.565683][ T938] kernfs: can not remove 'events', no directory [ 48.571974][ T938] WARNING: CPU: 1 PID: 938 at fs/kernfs/dir.c:1588 kernfs_remove_by_name_ns+0x103/0x160 [ 48.582416][ T938] Modules linked in: [ 48.586431][ T938] CPU: 1 PID: 938 Comm: syz.4.210 Tainted: G W syzkaller #0 [ 48.595447][ T938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 48.605838][ T938] RIP: 0010:kernfs_remove_by_name_ns+0x103/0x160 [ 48.612169][ T938] Code: 06 4c 89 f7 e8 fe ee ff ff 4c 89 f7 e8 86 af ff ff 45 31 f6 eb 29 e8 fc 33 9d ff 48 c7 c7 40 31 2b 85 4c 89 f6 e8 ed 74 b1 02 <0f> 0b 41 be fe ff ff ff eb 13 e8 de 33 9d ff 41 be fe ff ff ff 48 [ 48.632686][ T938] RSP: 0018:ffffc90000ec7b88 EFLAGS: 00010246 [ 48.639954][ T938] RAX: eeefab407bcbc500 RBX: dffffc0000000000 RCX: 0000000000080000 [ 48.648444][ T938] RDX: ffffc90002d21000 RSI: 000000000007ffff RDI: 0000000000080000 [ 48.656518][ T938] RBP: ffffc90000ec7bb0 R08: ffff8881f7127453 R09: 1ffff1103ee24e8a [ 48.664714][ T938] R10: dffffc0000000000 R11: ffffed103ee24e8b R12: 0000000000000000 [ 48.666218][ T417] plantronics 0003:047F:FFFF.0003: ignoring exceeding usage max [ 48.673062][ T938] R13: 0000000000000000 R14: ffffffff853fb9c0 R15: 0000000000000000 [ 48.682699][ T417] plantronics 0003:047F:FFFF.0003: unbalanced delimiter at end of report description [ 48.689862][ T938] FS: 00007fad4ff636c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 48.700446][ T417] plantronics 0003:047F:FFFF.0003: parse failed [ 48.708999][ T938] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.709016][ T938] CR2: 0000001b2e522ff8 CR3: 000000011206e000 CR4: 00000000003506a0 [ 48.716372][ T417] plantronics: probe of 0003:047F:FFFF.0003 failed with error -22 [ 48.722607][ T938] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 48.747019][ T938] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 48.755487][ T938] Call Trace: [ 48.758784][ T938] sysfs_create_files+0x2d8/0x360 [ 48.763798][ T938] ? sysfs_create_file_ns+0x1b0/0x1b0 [ 48.769432][ T938] ? __kasan_check_write+0x14/0x20 [ 48.774578][ T938] ? kobject_get+0xd3/0x120 [ 48.779152][ T938] __device_add_disk+0xb5f/0x1010 [ 48.784296][ T938] device_add_disk+0x2a/0x40 [ 48.788925][ T938] loop_add+0x59f/0x770 [ 48.793318][ T938] loop_control_ioctl+0x396/0x570 [ 48.798599][ T938] ? loop_remove+0xb0/0xb0 [ 48.803343][ T938] ? __fget_files+0x2e1/0x340 [ 48.808168][ T938] ? security_file_ioctl+0x84/0xa0 [ 48.813389][ T938] ? loop_remove+0xb0/0xb0 [ 48.817827][ T938] __se_sys_ioctl+0x121/0x1a0 [ 48.822535][ T938] __x64_sys_ioctl+0x7b/0x90 [ 48.827329][ T938] do_syscall_64+0x31/0x40 [ 48.831863][ T938] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.837880][ T938] RIP: 0033:0x7fad51509e99 [ 48.842315][ T938] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 48.862503][ T938] RSP: 002b:00007fad4ff63028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 48.870972][ T938] RAX: ffffffffffffffda RBX: 00007fad51791fa0 RCX: 00007fad51509e99 [ 48.879252][ T938] RDX: 0000000000100000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 48.887518][ T938] RBP: 00007fad5159feaf R08: 0000000000000000 R09: 0000000000000000 [ 48.895800][ T938] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 48.907287][ T938] R13: 00007fad51792038 R14: 00007fad51791fa0 R15: 00007ffde9d46a38 [ 48.915491][ T938] ---[ end trace 04a4a74602900008 ]--- [ 48.920969][ T938] loop1048576: failed to create sysfs files for events [ 48.934511][ T20] usb 2-1: USB disconnect, device number 3 [ 48.998709][ T940] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 49.009233][ T940] ext4 filesystem being mounted at /43/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 49.079141][ T948] EXT4-fs (loop3): mounted filesystem without journal. Opts: usrquota,nodelalloc,,errors=continue [ 49.099364][ T948] ext4 filesystem being mounted at /38/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 49.198642][ T963] device syzkaller0 entered promiscuous mode [ 49.236188][ T417] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 49.259094][ T963] EXT4-fs error (device loop3): ext4_free_branches:1026: inode #13: comm syz.3.219: invalid indirect mapped block 10 (level 1) [ 49.272807][ T963] EXT4-fs error (device loop3): ext4_free_branches:1026: inode #13: comm syz.3.219: invalid indirect mapped block 8 (level 1) [ 49.286472][ T963] EXT4-fs (loop3): 1 truncate cleaned up [ 49.292369][ T963] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 49.452248][ T973] netlink: 4 bytes leftover after parsing attributes in process `syz.1.222'. [ 49.500787][ T977] APIC base relocation is unsupported by KVM [ 49.505320][ T417] usb 5-1: Using ep0 maxpacket: 16 [ 49.665405][ T417] usb 5-1: config 0 interface 0 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 49.678463][ T417] usb 5-1: config 0 interface 0 has no altsetting 0 [ 49.685181][ T417] usb 5-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 49.694837][ T417] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.703672][ T417] usb 5-1: config 0 descriptor?? [ 49.715878][ T988] EXT4-fs (loop3): Ignoring removed nomblk_io_submit option [ 49.723474][ T988] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 49.752132][ T988] EXT4-fs (loop3): orphan cleanup on readonly fs [ 49.758886][ T988] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 49.767217][ T988] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -2 [ 49.776579][ T988] EXT4-fs (loop3): 1 truncate cleaned up [ 49.785509][ T988] EXT4-fs (loop3): mounted filesystem without journal. Opts: nomblk_io_submit,usrjquota="errors=continue,noload,data_err=ignore,grpjquota="errors=continue,errors=remount-ro,jqfmt=vfsv1, [ 49.866199][ T996] EXT4-fs (loop2): Ignoring removed orlov option [ 50.605025][ T996] EXT4-fs (loop2): mounted filesystem without journal. Opts: nombcache,orlov,journal_ioprio=0x0000000000000006,,errors=continue [ 50.611873][ T1002] netlink: 168 bytes leftover after parsing attributes in process `syz.0.231'. [ 50.635202][ T996] ext4 filesystem being mounted at /45/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 50.805430][ T24] kauditd_printk_skb: 9 callbacks suppressed [ 50.805441][ T24] audit: type=1400 audit(1784806647.170:259): avc: denied { map } for pid=1011 comm="syz.3.235" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=174 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 50.845657][ T417] hid (null): unknown global tag 0xc [ 50.857918][ T417] hid-generic 0003:05AC:0269.0004: unexpected long global item [ 50.933227][ T417] hid-generic: probe of 0003:05AC:0269.0004 failed with error -22 [ 51.106378][ T417] usb 5-1: USB disconnect, device number 5 [ 51.116743][ T1035] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 51.116807][ T1035] ext4 filesystem being mounted at /53/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 51.118573][ T24] audit: type=1400 audit(1784806647.490:260): avc: denied { execute } for pid=1034 comm="syz.3.243" name="file1" dev="loop3" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 51.118707][ T24] audit: type=1400 audit(1784806647.490:261): avc: denied { execute_no_trans } for pid=1034 comm="syz.3.243" path="/53/file1/file1" dev="loop3" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 51.258163][ T24] audit: type=1400 audit(1784806647.630:262): avc: denied { execute } for pid=1046 comm="syz.3.248" path="/55/file1" dev="tmpfs" ino=313 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 51.281034][ T24] audit: type=1400 audit(1784806647.630:263): avc: denied { create } for pid=1046 comm="syz.3.248" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 51.310420][ T1053] FAT-fs (loop2): Directory bread(block 64) failed [ 51.317775][ T1053] FAT-fs (loop2): Directory bread(block 65) failed [ 51.324335][ T1053] FAT-fs (loop2): Directory bread(block 66) failed [ 51.331101][ T1053] FAT-fs (loop2): Directory bread(block 67) failed [ 51.339224][ T1053] FAT-fs (loop2): Directory bread(block 68) failed [ 51.345950][ T1053] FAT-fs (loop2): Directory bread(block 69) failed [ 51.349937][ T1057] exFAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 51.352570][ T1053] FAT-fs (loop2): Directory bread(block 70) failed [ 51.364563][ T1057] exFAT-fs (loop1): Medium has reported failures. Some data may be lost. [ 51.371214][ T1053] FAT-fs (loop2): Directory bread(block 71) failed [ 51.381504][ T1057] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 51.386181][ T1053] FAT-fs (loop2): Directory bread(block 72) failed [ 51.405110][ T1053] FAT-fs (loop2): Directory bread(block 73) failed [ 52.404170][ T24] audit: type=1400 audit(1784806648.320:264): avc: denied { nlmsg_tty_audit } for pid=1052 comm="syz.2.249" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 52.443530][ T24] audit: type=1107 audit(1784806648.320:265): pid=1052 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='' [ 52.562556][ T1076] kvm: apic: phys broadcast and lowest prio [ 52.890323][ T1085] erofs: (device loop3): mounted with root inode @ nid 36. [ 52.965016][ T1087] EXT4-fs (loop2): Ignoring removed nobh option [ 53.003787][ T1087] EXT4-fs (loop2): orphan cleanup on readonly fs [ 53.022297][ T1087] EXT4-fs warning (device loop2): ext4_xattr_inode_get:492: inode #11: comm syz.2.258: ea_inode file size=1535 entry size=6 [ 53.037256][ T1087] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2799: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 53.051183][ T1087] EXT4-fs error (device loop2) in ext4_do_update_inode:5362: error 27 [ 53.060305][ T1087] EXT4-fs error (device loop2): ext4_dirty_inode:6181: inode #15: comm syz.2.258: mark_inode_dirty error [ 53.073252][ T1087] EXT4-fs error (device loop2) in ext4_do_update_inode:5362: error 27 [ 53.081849][ T1087] EXT4-fs error (device loop2): ext4_xattr_delete_inode:2943: inode #15: comm syz.2.258: mark_inode_dirty error [ 53.116692][ T1087] EXT4-fs error (device loop2): ext4_xattr_delete_inode:2946: inode #15: comm syz.2.258: mark inode dirty (error -27) [ 53.172278][ T1100] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 53.181640][ T456] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 53.191896][ T1087] EXT4-fs warning (device loop2): ext4_evict_inode:305: xattr delete (err -27) [ 53.205023][ T1100] ext4 filesystem being mounted at /59/qY3aK supports timestamps until 2038-01-19 (0x7fffffff) [ 53.223847][ T1087] EXT4-fs (loop2): 1 orphan inode deleted [ 53.246485][ T1087] EXT4-fs (loop2): mounted filesystem without journal. Opts: usrjquota=,acl,debug_want_extra_isize=0x000000000000005c,barrier,nobh,min_batch_time=0x000000000000b656,block_validity,,errors=continue [ 53.274062][ T1100] EXT4-fs error (device loop3): ext4_get_first_dir_block:3719: inode #12: comm syz.3.263: directory missing '.' [ 53.398921][ T24] audit: type=1400 audit(1784806649.770:266): avc: denied { write } for pid=1110 comm="syz.3.265" name="wireless" dev="proc" ino=4026532459 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 53.422454][ T1104] ------------[ cut here ]------------ [ 53.428074][ T1104] WARNING: CPU: 0 PID: 1104 at fs/sysfs/group.c:116 internal_create_group+0xf0/0xd00 [ 53.437703][ T1104] Modules linked in: [ 53.442153][ T1104] CPU: 0 PID: 1104 Comm: syz.0.264 Tainted: G W syzkaller #0 [ 53.450974][ T1104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 53.461152][ T1104] RIP: 0010:internal_create_group+0xf0/0xd00 [ 53.467232][ T1104] Code: 00 74 08 48 89 df e8 8f 12 d7 ff 48 8b 03 83 7c 24 2c 00 74 22 48 85 c0 0f 84 f8 0b 00 00 e8 57 9d 9c ff eb 20 e8 50 9d 9c ff <0f> 0b 41 be ea ff ff ff e9 c2 09 00 00 48 85 c0 0f 84 e6 0b 00 00 [ 53.486999][ T1104] RSP: 0018:ffffc90000dc7140 EFLAGS: 00010287 [ 53.493130][ T1104] RAX: ffffffff81c81211 RBX: ffff888126aa2098 RCX: 0000000000080000 [ 53.501228][ T1104] RDX: ffffc9000191c000 RSI: 00000000000038e0 RDI: 00000000000038e1 [ 53.509784][ T1104] RBP: ffffc90000dc7248 R08: ffff88810b3ba32f R09: 1ffff11021677465 [ 53.518496][ T1104] R10: dffffc0000000000 R11: ffffed1021677466 R12: 1ffff920001b8e38 [ 53.527093][ T1104] R13: dffffc0000000000 R14: ffffffff86834880 R15: 1ffff11024d54413 [ 53.535222][ T1104] FS: 00007eff37fa56c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 53.544424][ T1104] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 53.551415][ T1104] CR2: 0000001b2e423ffc CR3: 0000000131770000 CR4: 00000000003526b0 [ 53.559725][ T1104] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 53.569157][ T456] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 53.569199][ T1104] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 53.579636][ T456] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 53.587657][ T1104] Call Trace: [ 53.599922][ T1104] ? rt_mutex_setprio+0xa50/0xa50 [ 53.605646][ T1104] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 53.611548][ T1104] ? sysfs_create_group+0x30/0x30 [ 53.616705][ T1104] ? __kasan_check_write+0x14/0x20 [ 53.621875][ T1104] ? blk_queue_flag_set+0x2a/0x40 [ 53.626958][ T1104] sysfs_create_group+0x1f/0x30 [ 53.631810][ T1104] loop_configure+0xc30/0x1250 [ 53.636646][ T1104] lo_ioctl+0x2de/0x1f40 [ 53.640916][ T1104] ? lo_release+0x1f0/0x1f0 [ 53.645511][ T1104] ? 0xffffffffa0016db0 [ 53.649670][ T1104] ? is_bpf_text_address+0x177/0x190 [ 53.654938][ T1104] ? __kernel_text_address+0xa0/0x100 [ 53.660452][ T1104] ? unwind_get_return_address+0x4d/0x90 [ 53.666221][ T1104] ? stack_trace_save+0xf0/0xf0 [ 53.672011][ T1104] ? arch_stack_walk+0xee/0x140 [ 53.675399][ T456] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 53.677152][ T1104] ? __kasan_check_write+0x14/0x20 [ 53.688083][ T456] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 53.691796][ T1104] ? kobject_get_unless_zero+0x15f/0x1e0 [ 53.691816][ T1104] ? __kobject_del+0x2c0/0x2c0 [ 53.700144][ T456] usb 2-1: SerialNumber: syz [ 53.705473][ T1104] ? mutex_lock+0x92/0xf0 [ 53.705494][ T1104] ? mutex_trylock+0xb0/0xb0 [ 53.723843][ T1104] ? fsnotify+0x51f/0x1a90 [ 53.728308][ T1104] ? bdev_check_media_change+0x340/0x340 [ 53.733935][ T1104] ? __kasan_check_write+0x14/0x20 [ 53.739081][ T1104] ? _raw_spin_lock+0x94/0xf0 [ 53.743758][ T1104] ? _raw_spin_trylock_bh+0x150/0x150 [ 53.749169][ T1104] ? __kasan_check_write+0x14/0x20 [ 53.754272][ T1104] ? disk_unblock_events+0x51/0x60 [ 53.759422][ T1104] ? __blkdev_get+0x10f9/0x13c0 [ 53.764276][ T1104] ? 0xffffffffa0016db0 [ 53.768939][ T1104] ? is_bpf_text_address+0x177/0x190 [ 53.774987][ T1104] ? __kernel_text_address+0xa0/0x100 [ 53.780395][ T1104] ? unwind_get_return_address+0x4d/0x90 [ 53.786136][ T1104] ? stack_trace_save+0xf0/0xf0 [ 53.791058][ T1104] ? arch_stack_walk+0xee/0x140 [ 53.797846][ T1104] ? avc_has_extended_perms+0x1fa/0xc90 [ 53.803395][ T1104] ? memcpy+0x56/0x70 [ 53.807550][ T1104] ? avc_has_extended_perms+0x801/0xc90 [ 53.813367][ T1104] ? kasan_set_track+0x5b/0x70 [ 53.818369][ T1104] ? avc_ss_reset+0x270/0x270 [ 53.823085][ T1104] ? __kasan_slab_free+0x11/0x20 [ 53.828345][ T1104] ? do_sys_openat2+0x68e/0x750 [ 53.833308][ T1104] ? __x64_sys_openat+0x136/0x160 [ 53.838643][ T1104] ? do_syscall_64+0x31/0x40 [ 53.843324][ T1104] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 53.849455][ T1104] ? blkdev_common_ioctl+0xfe1/0x1bb0 [ 53.854890][ T1104] ? ioctl_has_perm+0x1b8/0x4f0 [ 53.859957][ T1104] ? blkdev_bszset+0x1e0/0x1e0 [ 53.864848][ T1104] ? do_vfs_ioctl+0x1403/0x15d0 [ 53.869751][ T1104] ? __ia32_compat_sys_ioctl+0x8c0/0x8c0 [ 53.875409][ T1104] ? has_cap_mac_admin+0x370/0x370 [ 53.880516][ T1104] ? kmem_cache_free+0x100/0x2d0 [ 53.885548][ T1104] ? selinux_file_ioctl+0x3ad/0x4c0 [ 53.890761][ T1104] ? lo_release+0x1f0/0x1f0 [ 53.895288][ T1104] blkdev_ioctl+0x2e0/0x630 [ 53.899784][ T1104] ? blkdev_compat_ptr_ioctl+0xc0/0xc0 [ 53.905506][ T1104] ? __fget_files+0x2e1/0x340 [ 53.910717][ T1104] block_ioctl+0xae/0x100 [ 53.915033][ T1104] ? blkdev_iopoll+0x100/0x100 [ 53.919970][ T1104] __se_sys_ioctl+0x121/0x1a0 [ 53.924664][ T1104] __x64_sys_ioctl+0x7b/0x90 [ 53.929326][ T1104] do_syscall_64+0x31/0x40 [ 53.934040][ T1104] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 53.941017][ T1104] RIP: 0033:0x7eff3954bb2b [ 53.945471][ T1104] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 53.965906][ T1104] RSP: 002b:00007eff37fa4db0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 53.974973][ T1104] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007eff3954bb2b [ 53.983026][ T1104] RDX: 0000000000000003 RSI: 0000000000004c00 RDI: 0000000000000004 [ 53.991021][ T1104] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 53.999139][ T1104] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 54.006048][ T456] usb 2-1: 0:2 : does not exist [ 54.007315][ T1104] R13: 00007eff37fa4ee0 R14: 00007eff37fa4ea0 R15: 00007eff2fb64000 [ 54.020268][ T1104] ---[ end trace 04a4a74602900009 ]--- [ 54.027614][ T456] usb 2-1: USB disconnect, device number 4 [ 54.068444][ T1104] exFAT-fs (loop1048576): hint_cluster is invalid (17) [ 54.075714][ T1104] exFAT-fs (loop1048576): error, invalid dentry access beyond EOF (clu : 5, eidx : 129) [ 54.087581][ T1104] exFAT-fs (loop1048576): Filesystem has been set read-only [ 54.095680][ T1104] exFAT-fs (loop1048576): error, invalid dentry access beyond EOF (clu : 5, eidx : 129) [ 54.130405][ T1116] exfat: Unknown parameter '}CN X' [ 54.235693][ T302] udevd[302]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 54.247366][ T1122] FAT-fs (loop2): Directory bread(block 162) failed [ 54.258484][ T1122] FAT-fs (loop2): Directory bread(block 163) failed [ 54.265106][ T1122] FAT-fs (loop2): Directory bread(block 164) failed [ 54.271879][ T1122] FAT-fs (loop2): Directory bread(block 165) failed [ 54.278950][ T1126] FAT-fs (loop3): Unrecognized mount option "nonumtail=0u.\_q" or missing value [ 54.290208][ T1122] FAT-fs (loop2): Directory bread(block 166) failed [ 54.297016][ T1122] FAT-fs (loop2): Directory bread(block 167) failed [ 54.299398][ T1129] netlink: 'syz.0.272': attribute type 4 has an invalid length. [ 54.303689][ T1122] FAT-fs (loop2): Directory bread(block 168) failed [ 54.318242][ T1122] FAT-fs (loop2): Directory bread(block 169) failed [ 54.324996][ T1122] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 54.343795][ T1129] netlink: 'syz.0.272': attribute type 4 has an invalid length. [ 54.384796][ T1129] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.392069][ T1129] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.421385][ T24] audit: type=1400 audit(1784806650.790:267): avc: denied { read write } for pid=1131 comm="syz.4.273" name="uhid" dev="devtmpfs" ino=261 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 54.469261][ T24] audit: type=1400 audit(1784806650.820:268): avc: denied { open } for pid=1131 comm="syz.4.273" path="/dev/uhid" dev="devtmpfs" ino=261 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 54.539675][ T1136] erofs: (device loop1): mounted with root inode @ nid 36. [ 54.682197][ T1139] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 54.712831][ T1139] EXT4-fs (loop4): warning: maximal mount count reached, running e2fsck is recommended [ 54.723415][ T1139] EXT4-fs error (device loop4): ext4_orphan_get:1401: inode #15: comm syz.4.275: iget: bad i_size value: 360287970189639680 [ 54.736612][ T1139] EXT4-fs (loop4): Remounting filesystem read-only [ 54.738767][ T1157] netlink: 28 bytes leftover after parsing attributes in process `syz.1.283'. [ 54.743160][ T1139] EXT4-fs error (device loop4): ext4_orphan_get:1406: comm syz.4.275: couldn't read orphan inode 15 (err -117) [ 54.764322][ T1139] EXT4-fs (loop4): mounted filesystem without journal. Opts: errors=remount-ro,grpquota, [ 54.909725][ T1172] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 54.923268][ T1172] overlayfs: missing 'lowerdir' [ 54.945378][ T456] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 55.054031][ T1177] netlink: 20 bytes leftover after parsing attributes in process `syz.4.291'. [ 55.477139][ T1194] netlink: 8 bytes leftover after parsing attributes in process `syz.2.298'. [ 55.525485][ T456] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 55.535969][ T456] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.544795][ T456] usb 4-1: Product: syz [ 55.550527][ T456] usb 4-1: Manufacturer: syz [ 55.555418][ T20] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 55.564079][ T456] usb 4-1: SerialNumber: syz [ 55.855317][ T20] usb 5-1: Using ep0 maxpacket: 8 [ 55.989874][ T20] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 55.999678][ T20] usb 5-1: config 0 has no interface number 0 [ 56.006056][ T20] usb 5-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0x80, skipping [ 56.016939][ T20] usb 5-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0xAB, skipping [ 56.027868][ T20] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 56.042182][ T20] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 56.051727][ T20] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 56.061313][ T20] usb 5-1: config 0 descriptor?? [ 56.215325][ T456] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 56.317640][ T20] usb 5-1: USB disconnect, device number 6 [ 56.355512][ T1220] fuse: Bad value for 'fd' [ 56.496217][ T24] kauditd_printk_skb: 6 callbacks suppressed [ 56.496229][ T24] audit: type=1400 audit(1784806652.870:275): avc: denied { create } for pid=1223 comm="syz.2.310" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 56.548094][ T24] audit: type=1400 audit(1784806652.900:276): avc: denied { bind } for pid=1223 comm="syz.2.310" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 56.595375][ T24] audit: type=1400 audit(1784806652.900:277): avc: denied { write } for pid=1223 comm="syz.2.310" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 56.655389][ T456] usb 2-1: unable to get BOS descriptor or descriptor too short [ 56.673783][ T24] audit: type=1400 audit(1784806653.040:278): avc: denied { getopt } for pid=1238 comm="syz.0.315" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 56.723550][ T1241] ------------[ cut here ]------------ [ 56.729241][ T1241] WARNING: CPU: 0 PID: 1241 at fs/sysfs/group.c:116 internal_create_group+0xf0/0xd00 [ 56.739055][ T1241] Modules linked in: [ 56.743090][ T1241] CPU: 0 PID: 1241 Comm: syz.0.316 Tainted: G W syzkaller #0 [ 56.745396][ T456] usb 2-1: config 4 has an invalid interface number: 9 but max is 0 [ 56.751807][ T1241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 56.760065][ T456] usb 2-1: config 4 has no interface number 0 [ 56.769992][ T1241] RIP: 0010:internal_create_group+0xf0/0xd00 [ 56.776375][ T456] usb 2-1: config 4 interface 9 has no altsetting 0 [ 56.782246][ T1241] Code: 00 74 08 48 89 df e8 8f 12 d7 ff 48 8b 03 83 7c 24 2c 00 74 22 48 85 c0 0f 84 f8 0b 00 00 e8 57 9d 9c ff eb 20 e8 50 9d 9c ff <0f> 0b 41 be ea ff ff ff e9 c2 09 00 00 48 85 c0 0f 84 e6 0b 00 00 [ 56.808754][ T1241] RSP: 0018:ffffc90000dc7140 EFLAGS: 00010283 [ 56.815119][ T1241] RAX: ffffffff81c81211 RBX: ffff888126aa2098 RCX: 0000000000080000 [ 56.824077][ T1241] RDX: ffffc9000191c000 RSI: 0000000000025b91 RDI: 0000000000025b92 [ 56.832229][ T1241] RBP: ffffc90000dc7248 R08: ffff88810b3ba32f R09: 1ffff11021677465 [ 56.840346][ T1241] R10: dffffc0000000000 R11: ffffed1021677466 R12: 1ffff920001b8e38 [ 56.848451][ T1241] R13: dffffc0000000000 R14: ffffffff86834880 R15: 1ffff11024d54413 [ 56.856732][ T1241] FS: 00007eff37fa56c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 56.865686][ T1241] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 56.872396][ T1241] CR2: 0000555590a4f908 CR3: 0000000113afa000 CR4: 00000000003506b0 [ 56.880567][ T1241] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 56.889057][ T1241] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 56.897297][ T1241] Call Trace: [ 56.900605][ T1241] ? rt_mutex_setprio+0xa50/0xa50 [ 56.905809][ T1241] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 56.911704][ T1241] ? sysfs_create_group+0x30/0x30 [ 56.917124][ T1241] ? __kasan_check_write+0x14/0x20 [ 56.922401][ T1241] ? blk_queue_flag_set+0x2a/0x40 [ 56.927661][ T1241] sysfs_create_group+0x1f/0x30 [ 56.933086][ T1241] loop_configure+0xc30/0x1250 [ 56.937929][ T1241] lo_ioctl+0x2de/0x1f40 [ 56.942286][ T1241] ? lo_release+0x1f0/0x1f0 [ 56.945403][ T456] usb 2-1: New USB device found, idVendor=2357, idProduct=0602, bcdDevice=91.75 [ 56.946870][ T1241] ? 0xffffffffa0016db0 [ 56.956380][ T456] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.960709][ T1241] ? is_bpf_text_address+0x177/0x190 [ 56.969797][ T456] usb 2-1: Product: syz [ 56.975113][ T1241] ? __kernel_text_address+0xa0/0x100 [ 56.979341][ T456] usb 2-1: Manufacturer: syz [ 56.984602][ T1241] ? unwind_get_return_address+0x4d/0x90 [ 56.989990][ T456] usb 2-1: SerialNumber: syz [ 56.995771][ T1241] ? stack_trace_save+0xf0/0xf0 [ 57.005334][ T1241] ? arch_stack_walk+0xee/0x140 [ 57.010273][ T1241] ? __kasan_check_write+0x14/0x20 [ 57.015951][ T1241] ? kobject_get_unless_zero+0x15f/0x1e0 [ 57.022200][ T1241] ? __kobject_del+0x2c0/0x2c0 [ 57.027302][ T1241] ? mutex_lock+0x92/0xf0 [ 57.031738][ T1241] ? mutex_trylock+0xb0/0xb0 [ 57.036604][ T1241] ? fsnotify+0x51f/0x1a90 [ 57.041092][ T1241] ? bdev_check_media_change+0x340/0x340 [ 57.046919][ T1241] ? __kasan_check_write+0x14/0x20 [ 57.052132][ T1241] ? _raw_spin_lock+0x94/0xf0 [ 57.056878][ T1241] ? _raw_spin_trylock_bh+0x150/0x150 [ 57.062267][ T1241] ? __kasan_check_write+0x14/0x20 [ 57.067431][ T1241] ? disk_unblock_events+0x51/0x60 [ 57.072537][ T1241] ? __blkdev_get+0x10f9/0x13c0 [ 57.077519][ T1241] ? 0xffffffffa0016db0 [ 57.081675][ T1241] ? is_bpf_text_address+0x177/0x190 [ 57.087402][ T1241] ? __kernel_text_address+0xa0/0x100 [ 57.092782][ T1241] ? unwind_get_return_address+0x4d/0x90 [ 57.098554][ T1241] ? stack_trace_save+0xf0/0xf0 [ 57.103429][ T1241] ? arch_stack_walk+0xee/0x140 [ 57.108322][ T1241] ? avc_has_extended_perms+0x1fa/0xc90 [ 57.114184][ T1241] ? memcpy+0x56/0x70 [ 57.118308][ T1241] ? avc_has_extended_perms+0x801/0xc90 [ 57.123948][ T1241] ? kasan_set_track+0x5b/0x70 [ 57.128747][ T1241] ? avc_ss_reset+0x270/0x270 [ 57.133422][ T1241] ? __kasan_slab_free+0x11/0x20 [ 57.138388][ T1241] ? do_sys_openat2+0x68e/0x750 [ 57.143230][ T1241] ? __x64_sys_openat+0x136/0x160 [ 57.148279][ T1241] ? do_syscall_64+0x31/0x40 [ 57.152878][ T1241] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 57.159007][ T1241] ? blkdev_common_ioctl+0xfe1/0x1bb0 [ 57.164373][ T1241] ? ioctl_has_perm+0x1b8/0x4f0 [ 57.169274][ T1241] ? blkdev_bszset+0x1e0/0x1e0 [ 57.174073][ T1241] ? do_vfs_ioctl+0x1403/0x15d0 [ 57.179069][ T1241] ? __ia32_compat_sys_ioctl+0x8c0/0x8c0 [ 57.184710][ T1241] ? has_cap_mac_admin+0x370/0x370 [ 57.189861][ T1241] ? kmem_cache_free+0x100/0x2d0 [ 57.194799][ T1241] ? selinux_file_ioctl+0x3ad/0x4c0 [ 57.200138][ T1241] ? lo_release+0x1f0/0x1f0 [ 57.204646][ T1241] blkdev_ioctl+0x2e0/0x630 [ 57.209175][ T1241] ? blkdev_compat_ptr_ioctl+0xc0/0xc0 [ 57.214642][ T1241] ? __fget_files+0x2e1/0x340 [ 57.219501][ T1241] block_ioctl+0xae/0x100 [ 57.223878][ T1241] ? blkdev_iopoll+0x100/0x100 [ 57.228673][ T1241] __se_sys_ioctl+0x121/0x1a0 [ 57.233344][ T1241] __x64_sys_ioctl+0x7b/0x90 [ 57.238015][ T1241] do_syscall_64+0x31/0x40 [ 57.242451][ T1241] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 57.248389][ T1241] RIP: 0033:0x7eff3954bb2b [ 57.252806][ T1241] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 57.272861][ T1241] RSP: 002b:00007eff37fa4db0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 57.281554][ T1241] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007eff3954bb2b [ 57.289563][ T1241] RDX: 0000000000000003 RSI: 0000000000004c00 RDI: 0000000000000004 [ 57.297621][ T1241] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 57.305870][ T1241] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 57.310054][ T456] usb 2-1: USB disconnect, device number 5 [ 57.313930][ T1241] R13: 00007eff37fa4ee0 R14: 00007eff37fa4ea0 R15: 00007eff2fb85000 [ 57.313942][ T1241] ---[ end trace 04a4a7460290000a ]--- [ 57.354303][ T1241] EXT4-fs (loop1048576): Quota format mount options ignored when QUOTA feature is enabled [ 57.364418][ T1241] EXT4-fs (loop1048576): Test dummy encryption mode enabled [ 57.373143][ T1241] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c198, mo2=0003] [ 57.381602][ T1241] System zones: 0-5 [ 57.391701][ T1241] EXT4-fs (loop1048576): mounted filesystem without journal. Opts: debug,jqfmt=vfsv0,inlinecrypt,debug,test_dummy_encryption=v1,norecovery,delalloc,nogrpid,minixdf,,errors=continue [ 57.676770][ T1261] ------------[ cut here ]------------ [ 57.690115][ T1195] usb 4-1: USB disconnect, device number 5 [ 57.699052][ T1261] WARNING: CPU: 1 PID: 1261 at fs/sysfs/group.c:116 internal_create_group+0xf0/0xd00 [ 57.712731][ T1261] Modules linked in: [ 57.716815][ T1261] CPU: 1 PID: 1261 Comm: syz.0.323 Tainted: G W syzkaller #0 [ 57.725750][ T1261] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 57.736175][ T1261] RIP: 0010:internal_create_group+0xf0/0xd00 [ 57.742180][ T1261] Code: 00 74 08 48 89 df e8 8f 12 d7 ff 48 8b 03 83 7c 24 2c 00 74 22 48 85 c0 0f 84 f8 0b 00 00 e8 57 9d 9c ff eb 20 e8 50 9d 9c ff <0f> 0b 41 be ea ff ff ff e9 c2 09 00 00 48 85 c0 0f 84 e6 0b 00 00 [ 57.773146][ T1261] RSP: 0018:ffffc90000e87140 EFLAGS: 00010283 [ 57.779936][ T1261] RAX: ffffffff81c81211 RBX: ffff888126aa2098 RCX: 0000000000080000 [ 57.788115][ T1261] RDX: ffffc9000191c000 RSI: 0000000000003814 RDI: 0000000000003815 [ 57.796195][ T1261] RBP: ffffc90000e87248 R08: ffff88810b3ba32f R09: 1ffff11021677465 [ 57.804389][ T1261] R10: dffffc0000000000 R11: ffffed1021677466 R12: 1ffff920001d0e38 [ 57.812829][ T1261] R13: dffffc0000000000 R14: ffffffff86834880 R15: 1ffff11024d54413 [ 57.821030][ T1261] FS: 00007eff37fa56c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 57.832939][ T1261] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.840292][ T1261] CR2: 0000555590a344a0 CR3: 000000010b01a000 CR4: 00000000003506b0 [ 57.848393][ T1261] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 57.856778][ T1261] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 57.864883][ T1261] Call Trace: [ 57.868501][ T1261] ? rt_mutex_setprio+0xa50/0xa50 [ 57.873597][ T1261] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 57.879766][ T1261] ? sysfs_create_group+0x30/0x30 [ 57.884948][ T1261] ? __kasan_check_write+0x14/0x20 [ 57.890202][ T1261] ? blk_queue_flag_set+0x2a/0x40 [ 57.895337][ T1261] sysfs_create_group+0x1f/0x30 [ 57.900787][ T1261] loop_configure+0xc30/0x1250 [ 57.905665][ T1261] lo_ioctl+0x2de/0x1f40 [ 57.909948][ T1261] ? lo_release+0x1f0/0x1f0 [ 57.914522][ T1261] ? 0xffffffffa0016db0 [ 57.919482][ T1261] ? is_bpf_text_address+0x177/0x190 [ 57.924863][ T1261] ? __kernel_text_address+0xa0/0x100 [ 57.930728][ T1261] ? unwind_get_return_address+0x4d/0x90 [ 57.936658][ T1261] ? stack_trace_save+0xf0/0xf0 [ 57.941754][ T1261] ? arch_stack_walk+0xee/0x140 [ 57.946705][ T1261] ? __kasan_check_write+0x14/0x20 [ 57.951875][ T1261] ? kobject_get_unless_zero+0x15f/0x1e0 [ 57.957578][ T1261] ? __kobject_del+0x2c0/0x2c0 [ 57.962371][ T1261] ? mutex_lock+0x92/0xf0 [ 57.966901][ T1261] ? mutex_trylock+0xb0/0xb0 [ 57.971623][ T1261] ? fsnotify+0x51f/0x1a90 [ 57.976832][ T1261] ? bdev_check_media_change+0x340/0x340 [ 57.982550][ T1261] ? __kasan_check_write+0x14/0x20 [ 57.987904][ T1261] ? _raw_spin_lock+0x94/0xf0 [ 57.992731][ T1261] ? _raw_spin_trylock_bh+0x150/0x150 [ 57.998395][ T1261] ? __kasan_check_write+0x14/0x20 [ 58.003800][ T1261] ? disk_unblock_events+0x51/0x60 [ 58.009270][ T1261] ? __blkdev_get+0x10f9/0x13c0 [ 58.014468][ T1261] ? 0xffffffffa0016db0 [ 58.018800][ T1261] ? is_bpf_text_address+0x177/0x190 [ 58.024449][ T1261] ? __kernel_text_address+0xa0/0x100 [ 58.029893][ T1261] ? unwind_get_return_address+0x4d/0x90 [ 58.035598][ T1261] ? stack_trace_save+0xf0/0xf0 [ 58.040504][ T1261] ? arch_stack_walk+0xee/0x140 [ 58.045503][ T1261] ? avc_has_extended_perms+0x1fa/0xc90 [ 58.051090][ T1261] ? memcpy+0x56/0x70 [ 58.055102][ T1261] ? avc_has_extended_perms+0x801/0xc90 [ 58.060788][ T1261] ? kasan_set_track+0x5b/0x70 [ 58.065616][ T1261] ? avc_ss_reset+0x270/0x270 [ 58.070428][ T1261] ? __kasan_slab_free+0x11/0x20 [ 58.075536][ T1261] ? do_sys_openat2+0x68e/0x750 [ 58.080423][ T1261] ? __x64_sys_openat+0x136/0x160 [ 58.085506][ T1261] ? do_syscall_64+0x31/0x40 [ 58.090599][ T1261] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 58.096755][ T1261] ? blkdev_common_ioctl+0xfe1/0x1bb0 [ 58.102167][ T1261] ? ioctl_has_perm+0x1b8/0x4f0 [ 58.107105][ T1261] ? blkdev_bszset+0x1e0/0x1e0 [ 58.111946][ T1261] ? do_vfs_ioctl+0x1403/0x15d0 [ 58.117089][ T1261] ? __ia32_compat_sys_ioctl+0x8c0/0x8c0 [ 58.122803][ T1261] ? has_cap_mac_admin+0x370/0x370 [ 58.127978][ T1261] ? kmem_cache_free+0x100/0x2d0 [ 58.132998][ T1261] ? selinux_file_ioctl+0x3ad/0x4c0 [ 58.138268][ T1261] ? lo_release+0x1f0/0x1f0 [ 58.142808][ T1261] blkdev_ioctl+0x2e0/0x630 [ 58.147380][ T1261] ? blkdev_compat_ptr_ioctl+0xc0/0xc0 [ 58.153315][ T1261] ? __fget_files+0x2e1/0x340 [ 58.158084][ T1261] block_ioctl+0xae/0x100 [ 58.162460][ T1261] ? blkdev_iopoll+0x100/0x100 [ 58.167291][ T1261] __se_sys_ioctl+0x121/0x1a0 [ 58.172032][ T1261] __x64_sys_ioctl+0x7b/0x90 [ 58.176739][ T1261] do_syscall_64+0x31/0x40 [ 58.181276][ T1261] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 58.187475][ T1261] RIP: 0033:0x7eff3954bb2b [ 58.192100][ T1261] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 58.212035][ T1261] RSP: 002b:00007eff37fa4db0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 58.222003][ T1261] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007eff3954bb2b [ 58.231565][ T1261] RDX: 0000000000000003 RSI: 0000000000004c00 RDI: 0000000000000004 [ 58.239874][ T1261] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 58.248044][ T1261] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 58.256153][ T1261] R13: 00007eff37fa4ee0 R14: 00007eff37fa4ea0 R15: 00007eff2fb64000 [ 58.264236][ T1261] ---[ end trace 04a4a7460290000b ]--- [ 58.682539][ T1261] exFAT-fs (loop1048576): hint_cluster is invalid (17) [ 58.735722][ T1261] exFAT-fs (loop1048576): error, invalid dentry access beyond EOF (clu : 5, eidx : 129) [ 58.966160][ T1288] futex_wake_op: syz.4.330 tries to shift op by 144; fix this program [ 59.146326][ T1261] exFAT-fs (loop1048576): Filesystem has been set read-only [ 59.169299][ T1290] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.176645][ T1290] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.191905][ T1261] exFAT-fs (loop1048576): error, invalid dentry access beyond EOF (clu : 5, eidx : 129) [ 60.075286][ T1306] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 60.308438][ T1310] netlink: 8 bytes leftover after parsing attributes in process `syz.4.340'. [ 60.334859][ T24] audit: type=1400 audit(1784806656.700:279): avc: denied { bind } for pid=1312 comm="syz.3.338" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 60.492359][ T24] audit: type=1400 audit(1784806656.860:280): avc: denied { bind } for pid=1346 comm="syz.2.355" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 60.554746][ T24] audit: type=1400 audit(1784806656.860:281): avc: denied { name_bind } for pid=1346 comm="syz.2.355" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 60.597311][ T1356] IPv4: Oversized IP packet from 127.202.26.0 [ 60.618246][ T24] audit: type=1400 audit(1784806656.860:282): avc: denied { node_bind } for pid=1346 comm="syz.2.355" saddr=ff02::1 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 60.670517][ T1324] ------------[ cut here ]------------ [ 60.676282][ T1324] WARNING: CPU: 1 PID: 1324 at fs/sysfs/group.c:116 internal_create_group+0xf0/0xd00 [ 60.686275][ T1324] Modules linked in: [ 60.690185][ T1324] CPU: 1 PID: 1324 Comm: syz.0.344 Tainted: G W syzkaller #0 [ 60.699115][ T1324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 60.709573][ T1324] RIP: 0010:internal_create_group+0xf0/0xd00 [ 60.715803][ T1324] Code: 00 74 08 48 89 df e8 8f 12 d7 ff 48 8b 03 83 7c 24 2c 00 74 22 48 85 c0 0f 84 f8 0b 00 00 e8 57 9d 9c ff eb 20 e8 50 9d 9c ff <0f> 0b 41 be ea ff ff ff e9 c2 09 00 00 48 85 c0 0f 84 e6 0b 00 00 [ 60.735826][ T1324] RSP: 0018:ffffc9000ab1f140 EFLAGS: 00010283 [ 60.742095][ T1324] RAX: ffffffff81c81211 RBX: ffff888126aa2098 RCX: 0000000000080000 [ 60.750356][ T1324] RDX: ffffc9000191c000 RSI: 000000000000383d RDI: 000000000000383e [ 60.758519][ T1324] RBP: ffffc9000ab1f248 R08: ffff88810b3ba32f R09: 1ffff11021677465 [ 60.766647][ T1324] R10: dffffc0000000000 R11: ffffed1021677466 R12: 1ffff92001563e38 [ 60.774843][ T1324] R13: dffffc0000000000 R14: ffffffff86834880 R15: 1ffff11024d54413 [ 60.783423][ T1324] FS: 00007eff37fa56c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 60.792711][ T1324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 60.799540][ T1324] CR2: 00007eff2fb83000 CR3: 000000010dcc6000 CR4: 00000000003506a0 [ 60.807865][ T1324] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 60.816188][ T1324] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 60.825151][ T1324] Call Trace: [ 60.829607][ T1324] ? rt_mutex_setprio+0xa50/0xa50 [ 60.835107][ T1324] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 60.841281][ T1324] ? sysfs_create_group+0x30/0x30 [ 60.846381][ T1324] ? __kasan_check_write+0x14/0x20 [ 60.851634][ T1324] ? blk_queue_flag_set+0x2a/0x40 [ 60.856787][ T1324] sysfs_create_group+0x1f/0x30 [ 60.861850][ T1324] loop_configure+0xc30/0x1250 [ 60.866671][ T1324] lo_ioctl+0x2de/0x1f40 [ 60.871085][ T1324] ? lo_release+0x1f0/0x1f0 [ 60.875710][ T1324] ? 0xffffffffa0016db0 [ 60.879869][ T1324] ? is_bpf_text_address+0x177/0x190 [ 60.885132][ T1324] ? __kernel_text_address+0xa0/0x100 [ 60.890622][ T1324] ? unwind_get_return_address+0x4d/0x90 [ 60.896280][ T1324] ? stack_trace_save+0xf0/0xf0 [ 60.901138][ T1324] ? arch_stack_walk+0xee/0x140 [ 60.906019][ T1324] ? __kasan_check_write+0x14/0x20 [ 60.911143][ T1324] ? kobject_get_unless_zero+0x15f/0x1e0 [ 60.916793][ T1324] ? __kobject_del+0x2c0/0x2c0 [ 60.922164][ T1324] ? mutex_lock+0x92/0xf0 [ 60.926514][ T1324] ? mutex_trylock+0xb0/0xb0 [ 60.931373][ T1324] ? fsnotify+0x51f/0x1a90 [ 60.935805][ T1324] ? bdev_check_media_change+0x340/0x340 [ 60.941499][ T1324] ? __kasan_check_write+0x14/0x20 [ 60.946655][ T1324] ? _raw_spin_lock+0x94/0xf0 [ 60.951331][ T1324] ? _raw_spin_trylock_bh+0x150/0x150 [ 60.956720][ T1324] ? __kasan_check_write+0x14/0x20 [ 60.961834][ T1324] ? disk_unblock_events+0x51/0x60 [ 60.966968][ T1324] ? __blkdev_get+0x10f9/0x13c0 [ 60.971842][ T1324] ? 0xffffffffa0016db0 [ 60.976028][ T1324] ? is_bpf_text_address+0x177/0x190 [ 60.981516][ T1324] ? __kernel_text_address+0xa0/0x100 [ 60.986933][ T1324] ? unwind_get_return_address+0x4d/0x90 [ 60.992564][ T1324] ? stack_trace_save+0xf0/0xf0 [ 60.997571][ T1324] ? arch_stack_walk+0xee/0x140 [ 61.002440][ T1324] ? avc_has_extended_perms+0x1fa/0xc90 [ 61.008118][ T1324] ? memcpy+0x56/0x70 [ 61.012123][ T1324] ? avc_has_extended_perms+0x801/0xc90 [ 61.017730][ T1324] ? kasan_set_track+0x5b/0x70 [ 61.022505][ T1324] ? avc_ss_reset+0x270/0x270 [ 61.027228][ T1324] ? __kasan_slab_free+0x11/0x20 [ 61.032190][ T1324] ? do_sys_openat2+0x68e/0x750 [ 61.037141][ T1324] ? __x64_sys_openat+0x136/0x160 [ 61.042179][ T1324] ? do_syscall_64+0x31/0x40 [ 61.046794][ T1324] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 61.053014][ T1324] ? blkdev_common_ioctl+0xfe1/0x1bb0 [ 61.058421][ T1324] ? ioctl_has_perm+0x1b8/0x4f0 [ 61.063277][ T1324] ? blkdev_bszset+0x1e0/0x1e0 [ 61.068143][ T1324] ? do_vfs_ioctl+0x1403/0x15d0 [ 61.073290][ T1324] ? __ia32_compat_sys_ioctl+0x8c0/0x8c0 [ 61.078937][ T1324] ? has_cap_mac_admin+0x370/0x370 [ 61.084137][ T1324] ? kmem_cache_free+0x100/0x2d0 [ 61.089108][ T1324] ? selinux_file_ioctl+0x3ad/0x4c0 [ 61.094313][ T1324] ? lo_release+0x1f0/0x1f0 [ 61.098848][ T1324] blkdev_ioctl+0x2e0/0x630 [ 61.103392][ T1324] ? blkdev_compat_ptr_ioctl+0xc0/0xc0 [ 61.108883][ T1324] ? __fget_files+0x2e1/0x340 [ 61.113579][ T1324] block_ioctl+0xae/0x100 [ 61.117928][ T1324] ? blkdev_iopoll+0x100/0x100 [ 61.123079][ T1324] __se_sys_ioctl+0x121/0x1a0 [ 61.128324][ T1324] __x64_sys_ioctl+0x7b/0x90 [ 61.133028][ T1324] do_syscall_64+0x31/0x40 [ 61.137468][ T1324] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 61.143360][ T1324] RIP: 0033:0x7eff3954bb2b [ 61.148424][ T1324] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 61.168441][ T1324] RSP: 002b:00007eff37fa4db0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 61.177278][ T1324] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007eff3954bb2b [ 61.185322][ T1324] RDX: 0000000000000003 RSI: 0000000000004c00 RDI: 0000000000000004 [ 61.193304][ T1324] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 61.201737][ T1324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 61.210056][ T1324] R13: 00007eff37fa4ee0 R14: 00007eff37fa4ea0 R15: 00007eff2fb64000 [ 61.218144][ T1324] ---[ end trace 04a4a7460290000c ]--- [ 61.731827][ T415] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 61.764148][ T1392] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=118 sclass=netlink_route_socket pid=1392 comm=syz.4.371 [ 61.905460][ T24] audit: type=1400 audit(1784806658.230:283): avc: denied { setopt } for pid=1389 comm="syz.2.370" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 62.156148][ T415] usb 2-1: Using ep0 maxpacket: 8 [ 62.166778][ T24] audit: type=1400 audit(1784806658.540:284): avc: denied { connect } for pid=1415 comm="syz.3.379" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 62.244234][ T24] audit: type=1400 audit(1784806658.610:285): avc: denied { setopt } for pid=1419 comm="syz.0.380" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 62.280181][ T24] audit: type=1400 audit(1784806658.650:286): avc: denied { mount } for pid=1421 comm="syz.0.381" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 62.315432][ T415] usb 2-1: unable to get BOS descriptor or descriptor too short [ 62.395349][ T415] usb 2-1: config 1 interface 0 has no altsetting 0 [ 62.435330][ T415] usb 2-1: language id specifier not provided by device, defaulting to English [ 62.565477][ T415] usb 2-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.40 [ 62.601237][ T415] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 62.642755][ T415] usb 2-1: Product: syz [ 62.647348][ T415] usb 2-1: Manufacturer: ꎷ긖篘ⲯ暏庁罍ꬂﱨ࿝䭌㲰㻄ⳍ㉾ល赈퇍꣑壚ᖺﭗ멺Ъ⟀〆鯫雍䔴㙕쀏窺ௗ铴랤릔搸잯 [ 62.663471][ T415] usb 2-1: SerialNumber: syz [ 62.945334][ T417] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 63.086494][ T24] audit: type=1400 audit(1784806659.460:287): avc: denied { create } for pid=1440 comm="syz.3.388" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 63.135576][ T415] usbhid 2-1:1.0: can't add hid device: -71 [ 63.142054][ T415] usbhid: probe of 2-1:1.0 failed with error -71 [ 63.151694][ T415] usb 2-1: USB disconnect, device number 6 [ 63.357639][ T24] audit: type=1400 audit(1784806659.730:288): avc: denied { write } for pid=1451 comm="syz.4.392" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 63.415358][ T417] usb 3-1: unable to get BOS descriptor or descriptor too short [ 63.505459][ T417] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 255, changing to 7 [ 63.516691][ T24] audit: type=1326 audit(1784806659.880:289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1459 comm="syz.1.395" exe="/root/ci2-android-5-10/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fcbe6478e99 code=0x0 [ 64.315344][ T417] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice= 0.40 [ 64.324630][ T417] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 64.336469][ T417] usb 3-1: Product: syz [ 64.340655][ T417] usb 3-1: Manufacturer: syz [ 64.345364][ T417] usb 3-1: SerialNumber: syz [ 64.471331][ T24] audit: type=1400 audit(1784806660.840:290): avc: denied { create } for pid=1483 comm="syz.3.405" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 64.638271][ T417] snd-usb-audio: probe of 3-1:1.0 failed with error -2 [ 64.687823][ T417] usb 3-1: USB disconnect, device number 3 [ 64.875279][ T54] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 65.449665][ T1529] netlink: 12 bytes leftover after parsing attributes in process `syz.0.420'. [ 65.458808][ T1529] netlink: 12 bytes leftover after parsing attributes in process `syz.0.420'. [ 65.475373][ T54] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 65.486821][ T54] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 65.497587][ T54] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 65.511001][ T54] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 65.520441][ T54] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 65.534803][ T54] usb 4-1: config 0 descriptor?? [ 65.738761][ T1550] hub 8-0:1.0: USB hub found [ 65.743897][ T1550] hub 8-0:1.0: 1 port detected [ 65.881724][ T25] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 66.016256][ T54] plantronics 0003:047F:FFFF.0005: ignoring exceeding usage max [ 66.025176][ T54] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 66.032789][ T54] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 66.040416][ T54] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 66.047874][ T54] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 66.055447][ T54] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 66.062894][ T54] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 66.070460][ T54] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 66.078680][ T54] plantronics 0003:047F:FFFF.0005: No inputs registered, leaving [ 66.088310][ T54] plantronics 0003:047F:FFFF.0005: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 66.155473][ T25] usb 3-1: Using ep0 maxpacket: 8 [ 66.235340][ T417] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 66.275403][ T25] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 66.435423][ T25] usb 3-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 66.444665][ T25] usb 3-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 66.452998][ T25] usb 3-1: Product: syz [ 66.468171][ T25] usb 3-1: Manufacturer: syz [ 66.475410][ T25] usb 3-1: SerialNumber: syz [ 66.512405][ T1568] netlink: 8 bytes leftover after parsing attributes in process `syz.0.433'. [ 66.705345][ T417] usb 5-1: unable to get BOS descriptor or descriptor too short [ 66.759763][ T1584] device veth0 entered promiscuous mode [ 66.765880][ T417] usb 5-1: not running at top speed; connect to a high speed hub [ 66.781590][ T1584] netlink: 4 bytes leftover after parsing attributes in process `syz.1.440'. [ 66.855453][ T417] usb 5-1: config 1 interface 0 altsetting 1 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 66.872661][ T417] usb 5-1: config 1 interface 0 has no altsetting 0 [ 66.945470][ T24] audit: type=1400 audit(1784806663.300:291): avc: denied { ioctl } for pid=1595 comm="syz.0.446" path="socket:[21460]" dev="sockfs" ino=21460 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 67.085372][ T417] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 67.098223][ T417] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 67.108082][ T417] usb 5-1: Product: syz [ 67.112404][ T417] usb 5-1: Manufacturer: syz [ 67.117347][ T417] usb 5-1: SerialNumber: syz [ 67.129208][ T24] audit: type=1400 audit(1784806663.500:292): avc: denied { create } for pid=1607 comm="syz.0.451" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 67.155333][ T1557] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 67.173659][ T1625] netlink: 12 bytes leftover after parsing attributes in process `syz.1.457'. [ 67.235506][ T1627] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 67.247462][ T1627] EXT4-fs (loop1): Ignoring removed bh option [ 67.265804][ T1627] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c1a8, mo2=0003] [ 67.274318][ T1627] System zones: 0-5 [ 67.280763][ T1627] EXT4-fs (loop1): mounted filesystem without journal. Opts: debug,jqfmt=vfsv0,inlinecrypt,errors=remount-ro,bh,norecovery,delalloc,nogrpid,minixdf, [ 67.475457][ T417] cdc_ether: probe of 5-1:1.0 failed with error -71 [ 67.483927][ T417] usb 5-1: USB disconnect, device number 7 [ 67.615804][ T304] usb 4-1: USB disconnect, device number 6 [ 67.805296][ T5] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 68.091585][ T1658] ------------[ cut here ]------------ [ 68.097238][ T1658] WARNING: CPU: 1 PID: 1658 at fs/sysfs/group.c:116 internal_create_group+0xf0/0xd00 [ 68.107262][ T1658] Modules linked in: [ 68.111855][ T1658] CPU: 1 PID: 1658 Comm: syz.0.470 Tainted: G W syzkaller #0 [ 68.121523][ T1658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 68.132944][ T1658] RIP: 0010:internal_create_group+0xf0/0xd00 [ 68.139683][ T1658] Code: 00 74 08 48 89 df e8 8f 12 d7 ff 48 8b 03 83 7c 24 2c 00 74 22 48 85 c0 0f 84 f8 0b 00 00 e8 57 9d 9c ff eb 20 e8 50 9d 9c ff <0f> 0b 41 be ea ff ff ff e9 c2 09 00 00 48 85 c0 0f 84 e6 0b 00 00 [ 68.159966][ T1658] RSP: 0018:ffffc90000ed7140 EFLAGS: 00010283 [ 68.166710][ T1658] RAX: ffffffff81c81211 RBX: ffff888126aa2098 RCX: 0000000000080000 [ 68.175797][ T1658] RDX: ffffc9000191c000 RSI: 000000000000381f RDI: 0000000000003820 [ 68.184204][ T1658] RBP: ffffc90000ed7248 R08: ffff88810b3ba32f R09: 1ffff11021677465 [ 68.197689][ T1658] R10: dffffc0000000000 R11: ffffed1021677466 R12: 1ffff920001dae38 [ 68.207028][ T1658] R13: dffffc0000000000 R14: ffffffff86834880 R15: 1ffff11024d54413 [ 68.216666][ T1658] FS: 00007eff37fa56c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 68.227563][ T1658] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 68.234806][ T1658] CR2: 00007f566de62000 CR3: 0000000113b0e000 CR4: 00000000003506a0 [ 68.245333][ T1658] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 68.253608][ T1658] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 68.262199][ T1658] Call Trace: [ 68.265921][ T1658] ? rt_mutex_setprio+0xa50/0xa50 [ 68.271153][ T1658] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 68.277349][ T1658] ? sysfs_create_group+0x30/0x30 [ 68.282419][ T1658] ? __kasan_check_write+0x14/0x20 [ 68.291304][ T1658] ? blk_queue_flag_set+0x2a/0x40 [ 68.296478][ T1658] sysfs_create_group+0x1f/0x30 [ 68.301759][ T1658] loop_configure+0xc30/0x1250 [ 68.306652][ T1658] lo_ioctl+0x2de/0x1f40 [ 68.310933][ T1658] ? lo_release+0x1f0/0x1f0 [ 68.315898][ T1658] ? 0xffffffffa0016db0 [ 68.320334][ T1658] ? is_bpf_text_address+0x177/0x190 [ 68.325911][ T5] usb 2-1: Using ep0 maxpacket: 32 [ 68.331362][ T1658] ? __kernel_text_address+0xa0/0x100 [ 68.337119][ T1658] ? unwind_get_return_address+0x4d/0x90 [ 68.343051][ T1658] ? stack_trace_save+0xf0/0xf0 [ 68.348352][ T1658] ? arch_stack_walk+0xee/0x140 [ 68.353641][ T1658] ? __kasan_check_write+0x14/0x20 [ 68.359236][ T1658] ? kobject_get_unless_zero+0x15f/0x1e0 [ 68.365122][ T1658] ? __kobject_del+0x2c0/0x2c0 [ 68.370514][ T1658] ? mutex_lock+0x92/0xf0 [ 68.375097][ T1658] ? mutex_trylock+0xb0/0xb0 [ 68.380002][ T1658] ? fsnotify+0x51f/0x1a90 [ 68.384786][ T1658] ? bdev_check_media_change+0x340/0x340 [ 68.390869][ T1658] ? __kasan_check_write+0x14/0x20 [ 68.396670][ T1658] ? _raw_spin_lock+0x94/0xf0 [ 68.403468][ T1658] ? _raw_spin_trylock_bh+0x150/0x150 [ 68.409504][ T1658] ? __kasan_check_write+0x14/0x20 [ 68.414830][ T1658] ? disk_unblock_events+0x51/0x60 [ 68.420326][ T1658] ? __blkdev_get+0x10f9/0x13c0 [ 68.425609][ T1658] ? 0xffffffffa0016db0 [ 68.429892][ T1658] ? is_bpf_text_address+0x177/0x190 [ 68.435492][ T1658] ? __kernel_text_address+0xa0/0x100 [ 68.441073][ T1658] ? unwind_get_return_address+0x4d/0x90 [ 68.447255][ T5] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 68.457546][ T1658] ? stack_trace_save+0xf0/0xf0 [ 68.462532][ T5] usb 2-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 68.465410][ T1658] ? arch_stack_walk+0xee/0x140 [ 68.472484][ T5] usb 2-1: config 0 interface 0 has no altsetting 0 [ 68.477714][ T1658] ? avc_has_extended_perms+0x1fa/0xc90 [ 68.489643][ T1658] ? memcpy+0x56/0x70 [ 68.493759][ T1658] ? avc_has_extended_perms+0x801/0xc90 [ 68.499908][ T1658] ? kasan_set_track+0x5b/0x70 [ 68.505655][ T1658] ? avc_ss_reset+0x270/0x270 [ 68.510727][ T1658] ? __kasan_slab_free+0x11/0x20 [ 68.516841][ T1658] ? do_sys_openat2+0x68e/0x750 [ 68.522308][ T1658] ? __x64_sys_openat+0x136/0x160 [ 68.527613][ T1658] ? do_syscall_64+0x31/0x40 [ 68.532507][ T1658] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 68.538850][ T1658] ? blkdev_common_ioctl+0xfe1/0x1bb0 [ 68.544918][ T1658] ? ioctl_has_perm+0x1b8/0x4f0 [ 68.550134][ T1658] ? blkdev_bszset+0x1e0/0x1e0 [ 68.555356][ T1658] ? do_vfs_ioctl+0x1403/0x15d0 [ 68.560613][ T1658] ? __ia32_compat_sys_ioctl+0x8c0/0x8c0 [ 68.566759][ T1658] ? has_cap_mac_admin+0x370/0x370 [ 68.572024][ T1658] ? kmem_cache_free+0x100/0x2d0 [ 68.577528][ T1658] ? selinux_file_ioctl+0x3ad/0x4c0 [ 68.583004][ T1658] ? lo_release+0x1f0/0x1f0 [ 68.587999][ T1658] blkdev_ioctl+0x2e0/0x630 [ 68.588301][ T54] usb 3-1: USB disconnect, device number 4 [ 68.592608][ T1658] ? blkdev_compat_ptr_ioctl+0xc0/0xc0 [ 68.604446][ T1658] ? __fget_files+0x2e1/0x340 [ 68.613944][ T1658] block_ioctl+0xae/0x100 [ 68.618665][ T1658] ? blkdev_iopoll+0x100/0x100 [ 68.623514][ T1658] __se_sys_ioctl+0x121/0x1a0 [ 68.628412][ T1658] __x64_sys_ioctl+0x7b/0x90 [ 68.633175][ T1658] do_syscall_64+0x31/0x40 [ 68.637961][ T5] usb 2-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 68.638196][ T1658] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 68.647200][ T5] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.653503][ T1658] RIP: 0033:0x7eff3954bb2b [ 68.661291][ T5] usb 2-1: Product: syz [ 68.666249][ T1658] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 68.669927][ T5] usb 2-1: Manufacturer: syz [ 68.690706][ T1658] RSP: 002b:00007eff37fa4db0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 68.695045][ T5] usb 2-1: SerialNumber: syz [ 68.705341][ T1658] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007eff3954bb2b [ 68.713180][ T5] usb 2-1: config 0 descriptor?? [ 68.728545][ T1658] RDX: 0000000000000003 RSI: 0000000000004c00 RDI: 0000000000000004 [ 68.736742][ T1658] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 68.744908][ T1658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 68.753720][ T1658] R13: 00007eff37fa4ee0 R14: 00007eff37fa4ea0 R15: 00007eff2fb64000 [ 68.762024][ T1658] ---[ end trace 04a4a7460290000d ]--- [ 68.949709][ T1667] exFAT-fs (loop2): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x190b464b, utbl_chksum : 0xe619d30d) [ 69.001016][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.015290][ T1667] exFAT-fs (loop2): Filesystem has been set read-only [ 69.032361][ T1667] exFAT-fs (loop2): error, failed to bmap (inode : ffff88811a9cae30 iblock : 0, err : -5) [ 69.052963][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.059051][ T1667] exFAT-fs (loop2): error, failed to bmap (inode : ffff88811a9cae30 iblock : 0, err : -5) [ 69.069338][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.077282][ T1667] exFAT-fs (loop2): error, failed to bmap (inode : ffff88811a9cae30 iblock : 1, err : -5) [ 69.077778][ T24] audit: type=1400 audit(1784806665.450:293): avc: denied { create } for pid=1672 comm="syz.0.475" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 69.107101][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.113689][ T1667] exFAT-fs (loop2): error, failed to bmap (inode : ffff88811a9cae30 iblock : 2, err : -5) [ 69.135362][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.139375][ T24] audit: type=1400 audit(1784806665.500:294): avc: denied { accept } for pid=1672 comm="syz.0.475" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 69.153184][ T1667] exFAT-fs (loop2): error, failed to bmap (inode : ffff88811a9cae30 iblock : 3, err : -5) [ 69.172985][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.183235][ T1667] exFAT-fs (loop2): error, failed to bmap (inode : ffff88811a9cae30 iblock : 4, err : -5) [ 69.193325][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.199700][ T1667] exFAT-fs (loop2): error, failed to bmap (inode : ffff88811a9cae30 iblock : 5, err : -5) [ 69.210761][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.217984][ T1667] exFAT-fs (loop2): error, failed to bmap (inode : ffff88811a9cae30 iblock : 6, err : -5) [ 69.228285][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.235221][ T1667] exFAT-fs (loop2): error, failed to bmap (inode : ffff88811a9cae30 iblock : 7, err : -5) [ 69.245726][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.252446][ T1667] exFAT-fs (loop2): error, failed to bmap (inode : ffff88811a9cae30 iblock : 0, err : -5) [ 69.262670][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.295358][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.301818][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.308592][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.314980][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.336602][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.343191][ T1667] exFAT-fs (loop2): error, broken FAT chain. [ 69.681792][ T24] audit: type=1400 audit(1784806666.050:295): avc: denied { setopt } for pid=1691 comm="syz.3.481" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 70.015314][ T5] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 70.081166][ T304] usb 2-1: USB disconnect, device number 7 [ 70.235487][ T1714] : renamed from team_slave_1 [ 70.521164][ T24] audit: type=1400 audit(1784806666.890:296): avc: denied { watch watch_reads } for pid=1717 comm="syz.2.491" path="/94" dev="tmpfs" ino=522 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 70.595478][ T5] usb 4-1: config 2 has an invalid interface number: 79 but max is 0 [ 70.603781][ T5] usb 4-1: config 2 has no interface number 0 [ 70.610130][ T5] usb 4-1: config 2 interface 79 altsetting 13 bulk endpoint 0x1 has invalid maxpacket 64 [ 70.620385][ T5] usb 4-1: config 2 interface 79 has no altsetting 0 [ 71.005392][ T5] usb 4-1: New USB device found, idVendor=0ab4, idProduct=0011, bcdDevice=ca.fb [ 71.017636][ T5] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.026226][ T5] usb 4-1: Product: syz [ 71.030454][ T5] usb 4-1: Manufacturer: syz [ 71.035283][ T5] usb 4-1: SerialNumber: syz [ 71.080718][ T1699] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 71.505406][ T20] usb 2-1: new low-speed USB device number 8 using dummy_hcd [ 71.640287][ T5] usb 4-1: USB disconnect, device number 7 [ 71.905333][ T20] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 71.927460][ T20] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 71.937143][ T20] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 71.950649][ T20] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 71.959965][ T20] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 72.005776][ T20] hub 2-1:1.0: bad descriptor, ignoring hub [ 72.012592][ T20] hub: probe of 2-1:1.0 failed with error -5 [ 72.021694][ T20] cdc_wdm 2-1:1.0: skipping garbage [ 72.027745][ T20] cdc_wdm 2-1:1.0: skipping garbage [ 72.052213][ T20] cdc_wdm: probe of 2-1:1.0 failed with error -22 [ 72.335330][ T304] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 72.335418][ T20] usb 2-1: USB disconnect, device number 8 [ 72.585290][ T304] usb 1-1: Using ep0 maxpacket: 16 [ 72.705364][ T304] usb 1-1: config index 0 descriptor too short (expected 51443, got 18) [ 72.875439][ T304] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 72.899364][ T304] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 72.908247][ T304] usb 1-1: Product: syz [ 72.912527][ T304] usb 1-1: Manufacturer: syz [ 72.926597][ T304] usb 1-1: SerialNumber: syz [ 72.948482][ T304] usb 1-1: config 0 descriptor?? [ 73.125320][ T20] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 73.839458][ T24] audit: type=1400 audit(1784806670.210:297): avc: denied { name_bind } for pid=1834 comm="syz.1.537" src=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 73.925377][ T24] audit: type=1400 audit(1784806670.300:298): avc: denied { read } for pid=1836 comm="syz.1.538" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 73.974340][ T304] usb 1-1: USB disconnect, device number 3 [ 74.012908][ T24] audit: type=1400 audit(1784806670.380:299): avc: denied { write } for pid=1841 comm="syz.2.540" name="mcfilter6" dev="proc" ino=4026532660 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 74.106447][ T1846] device syzkaller0 entered promiscuous mode [ 74.130041][ T24] audit: type=1326 audit(1784806670.500:300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1848 comm="syz.3.536" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f566de78e99 code=0x7ffc0000 [ 74.170557][ T24] audit: type=1326 audit(1784806670.500:301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1848 comm="syz.3.536" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f566de78e99 code=0x7ffc0000 [ 74.198136][ T24] audit: type=1326 audit(1784806670.500:302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1848 comm="syz.3.536" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f566de78e99 code=0x7ffc0000 [ 74.198173][ T1846] EXT4-fs error (device loop2): ext4_free_branches:1026: inode #13: comm syz.2.542: invalid indirect mapped block 10 (level 1) [ 74.236670][ T20] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 74.247808][ T20] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 74.257887][ T1846] EXT4-fs error (device loop2): ext4_free_branches:1026: inode #13: comm syz.2.542: invalid indirect mapped block 8 (level 1) [ 74.258246][ T20] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 74.284684][ T20] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 74.294538][ T20] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 74.294644][ T1846] EXT4-fs (loop2): 1 truncate cleaned up [ 74.309947][ T24] audit: type=1326 audit(1784806670.500:303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1848 comm="syz.3.536" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f566de78e99 code=0x7ffc0000 [ 74.310584][ T20] usb 5-1: config 0 descriptor?? [ 74.344543][ T1846] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 74.356074][ T24] audit: type=1326 audit(1784806670.500:304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1848 comm="syz.3.536" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7f566de78e99 code=0x7ffc0000 [ 74.381502][ T1855] netlink: 16 bytes leftover after parsing attributes in process `syz.3.544'. [ 74.381854][ T24] audit: type=1326 audit(1784806670.530:305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1848 comm="syz.3.536" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f566de78e99 code=0x7ffc0000 [ 74.423947][ T24] audit: type=1326 audit(1784806670.530:306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1848 comm="syz.3.536" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f566de78e99 code=0x7ffc0000 [ 74.586169][ T1876] Invalid argument reading file caps for ./file0 [ 74.795751][ T1892] syz.1.559 uses obsolete (PF_INET,SOCK_PACKET) [ 74.879203][ T20] plantronics 0003:047F:FFFF.0006: ignoring exceeding usage max [ 74.894527][ T20] plantronics 0003:047F:FFFF.0006: unbalanced delimiter at end of report description [ 74.945508][ T20] plantronics 0003:047F:FFFF.0006: parse failed [ 74.952720][ T20] plantronics: probe of 0003:047F:FFFF.0006 failed with error -22 [ 75.141981][ T304] usb 5-1: USB disconnect, device number 8 [ 76.168725][ T1967] TCP: request_sock_TCP: Possible SYN flooding on port 20002. Dropping request. Check SNMP counters. [ 76.865346][ T304] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 77.171976][ T1991] FAT-fs (loop3): Directory bread(block 64) failed [ 77.178899][ T1991] FAT-fs (loop3): Directory bread(block 65) failed [ 77.185908][ T1991] FAT-fs (loop3): Directory bread(block 66) failed [ 77.192697][ T1991] FAT-fs (loop3): Directory bread(block 67) failed [ 77.199825][ T1991] FAT-fs (loop3): Directory bread(block 68) failed [ 77.207086][ T1991] FAT-fs (loop3): Directory bread(block 69) failed [ 77.226394][ T1991] FAT-fs (loop3): Directory bread(block 70) failed [ 77.235402][ T1991] FAT-fs (loop3): Directory bread(block 71) failed [ 77.242252][ T1991] FAT-fs (loop3): Directory bread(block 72) failed [ 77.255559][ T304] usb 3-1: config 0 has an invalid interface number: 238 but max is 0 [ 77.274361][ T1991] FAT-fs (loop3): Directory bread(block 73) failed [ 77.280091][ T304] usb 3-1: config 0 has no interface number 0 [ 77.670674][ T2001] netlink: 48 bytes leftover after parsing attributes in process `syz.1.602'. [ 77.680051][ T304] usb 3-1: config 0 interface 238 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 31 [ 77.872004][ T304] usb 3-1: config 0 interface 238 altsetting 2 endpoint 0x88 has invalid wMaxPacketSize 0 [ 77.881977][ T304] usb 3-1: config 0 interface 238 has no altsetting 0 [ 78.275420][ T304] usb 3-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=f6.6a [ 78.288290][ T304] usb 3-1: New USB device strings: Mfr=181, Product=147, SerialNumber=160 [ 78.298400][ T304] usb 3-1: Product: syz [ 78.302785][ T304] usb 3-1: Manufacturer: syz [ 78.307895][ T304] usb 3-1: SerialNumber: syz [ 78.313235][ T304] usb 3-1: config 0 descriptor?? [ 78.335397][ T1952] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 78.561819][ T20] usb 3-1: USB disconnect, device number 5 [ 78.605286][ T287] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 78.845261][ T287] usb 2-1: Using ep0 maxpacket: 16 [ 78.965380][ T287] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 78.976481][ T287] usb 2-1: config 0 interface 0 has no altsetting 0 [ 78.983123][ T287] usb 2-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 78.992635][ T287] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.001458][ T287] usb 2-1: config 0 descriptor?? [ 79.316959][ T2102] netlink: 4 bytes leftover after parsing attributes in process `syz.2.643'. [ 79.367923][ T24] kauditd_printk_skb: 9 callbacks suppressed [ 79.367934][ T24] audit: type=1400 audit(1784806675.740:316): avc: denied { ioctl } for pid=2110 comm="syz.2.647" path="socket:[24796]" dev="sockfs" ino=24796 ioctlcmd=0x89f1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 79.486653][ T287] hid-generic 0003:1E71:2009.0007: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.1-1/input0 [ 79.526524][ T24] audit: type=1400 audit(1784806675.900:317): avc: denied { create } for pid=2129 comm="syz.2.655" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 79.547270][ T24] audit: type=1400 audit(1784806675.900:318): avc: denied { setopt } for pid=2129 comm="syz.2.655" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 79.589081][ T2125] erofs: (device loop3): mounted with root inode @ nid 36. [ 79.791212][ T2139] netlink: 8 bytes leftover after parsing attributes in process `syz.3.657'. [ 79.802495][ T2139] syz_tun: refused to change device tx_queue_len [ 80.339531][ T24] audit: type=1400 audit(1784806676.710:319): avc: denied { bind } for pid=2151 comm="syz.2.664" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 80.339952][ T2153] netlink: 32 bytes leftover after parsing attributes in process `syz.2.664'. [ 80.405119][ T24] audit: type=1400 audit(1784806676.710:320): avc: denied { setopt } for pid=2151 comm="syz.2.664" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 80.530484][ T24] audit: type=1400 audit(1784806676.900:321): avc: denied { setopt } for pid=2176 comm="syz.0.675" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 80.772576][ T2200] ================================================================== [ 80.780696][ T2200] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x88e/0x3160 [ 80.788850][ T2200] Read of size 8 at addr ffff88810b80b6d8 by task syz.0.680/2200 [ 80.796558][ T2200] [ 80.798990][ T2200] CPU: 0 PID: 2200 Comm: syz.0.680 Tainted: G W syzkaller #0 [ 80.807655][ T2200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 80.817730][ T2200] Call Trace: [ 80.821025][ T2200] __dump_stack+0x21/0x24 [ 80.825476][ T2200] dump_stack_lvl+0x1a7/0x208 [ 80.830261][ T2200] ? show_regs_print_info+0x18/0x18 [ 80.835461][ T2200] ? thaw_kernel_threads+0x220/0x220 [ 80.840747][ T2200] print_address_description+0x7f/0x2c0 [ 80.846287][ T2200] ? tc_setup_flow_action+0x88e/0x3160 [ 80.851736][ T2200] kasan_report+0x100/0x140 [ 80.856232][ T2200] ? flow_action_cookie_create+0x28/0x90 [ 80.861965][ T2200] ? tc_setup_flow_action+0x88e/0x3160 [ 80.867437][ T2200] __asan_report_load8_noabort+0x14/0x20 [ 80.873068][ T2200] tc_setup_flow_action+0x88e/0x3160 [ 80.878348][ T2200] mall_replace_hw_filter+0x2db/0x8c0 [ 80.883712][ T2200] ? pcpu_block_update_hint_alloc+0x8b7/0xc50 [ 80.889772][ T2200] ? mall_set_parms+0x450/0x450 [ 80.894615][ T2200] ? tcf_exts_destroy+0xb0/0xb0 [ 80.899459][ T2200] ? pcpu_alloc+0xf8d/0x16c0 [ 80.904043][ T2200] ? mall_set_parms+0x1a0/0x450 [ 80.908894][ T2200] mall_change+0x546/0x770 [ 80.913306][ T2200] ? __kasan_check_write+0x14/0x20 [ 80.918408][ T2200] ? mall_get+0xa0/0xa0 [ 80.922561][ T2200] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 80.928448][ T2200] tc_new_tfilter+0x1487/0x1ab0 [ 80.933294][ T2200] ? mall_get+0xa0/0xa0 [ 80.937442][ T2200] ? tcf_gate_entry_destructor+0x20/0x20 [ 80.943407][ T2200] ? 0xffffffffa0016db0 [ 80.947558][ T2200] ? security_capable+0x87/0xb0 [ 80.952676][ T2200] ? ns_capable+0x8c/0xf0 [ 80.957222][ T2200] ? netlink_net_capable+0x125/0x160 [ 80.962500][ T2200] ? tcf_gate_entry_destructor+0x20/0x20 [ 80.968224][ T2200] rtnetlink_rcv_msg+0x811/0xca0 [ 80.973159][ T2200] ? unwind_get_return_address+0x4d/0x90 [ 80.978786][ T2200] ? rtnetlink_bind+0x80/0x80 [ 80.983627][ T2200] ? stack_trace_save+0xa6/0xf0 [ 80.988469][ T2200] ? stack_trace_snprint+0xe0/0xe0 [ 80.993575][ T2200] ? avc_has_perm+0x168/0x3d0 [ 80.998243][ T2200] ? memcpy+0x56/0x70 [ 81.002213][ T2200] ? avc_has_perm+0x27f/0x3d0 [ 81.006882][ T2200] ? __kasan_slab_alloc+0xc9/0xe0 [ 81.011899][ T2200] ? avc_has_perm_noaudit+0x260/0x260 [ 81.017269][ T2200] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 81.023328][ T2200] ? selinux_nlmsg_lookup+0x398/0x430 [ 81.028701][ T2200] netlink_rcv_skb+0x1e9/0x430 [ 81.033453][ T2200] ? rtnetlink_bind+0x80/0x80 [ 81.038124][ T2200] ? netlink_ack+0xb30/0xb30 [ 81.042702][ T2200] ? __netlink_lookup+0x387/0x3b0 [ 81.047719][ T2200] rtnetlink_rcv+0x1c/0x20 [ 81.052143][ T2200] netlink_unicast+0x86c/0xa30 [ 81.056914][ T2200] netlink_sendmsg+0x949/0xb70 [ 81.061684][ T2200] ? netlink_getsockopt+0x530/0x530 [ 81.066896][ T2200] ? security_socket_sendmsg+0x82/0xa0 [ 81.072357][ T2200] ? netlink_getsockopt+0x530/0x530 [ 81.077550][ T2200] ____sys_sendmsg+0x5be/0x8f0 [ 81.082308][ T2200] ? __sys_sendmsg_sock+0x40/0x40 [ 81.087324][ T2200] ? import_iovec+0x7c/0xb0 [ 81.091818][ T2200] ___sys_sendmsg+0x236/0x2e0 [ 81.096483][ T2200] ? __sys_sendmsg+0x280/0x280 [ 81.101240][ T2200] ? alloc_file+0x82/0x580 [ 81.105649][ T2200] ? __fdget+0x1a1/0x230 [ 81.109879][ T2200] __x64_sys_sendmsg+0x201/0x2d0 [ 81.114913][ T2200] ? __kasan_check_write+0x14/0x20 [ 81.120042][ T2200] ? ___sys_sendmsg+0x2e0/0x2e0 [ 81.124914][ T2200] ? __kasan_check_read+0x11/0x20 [ 81.129945][ T2200] ? exit_to_user_mode_prepare+0x9a/0xa0 [ 81.135591][ T2200] do_syscall_64+0x31/0x40 [ 81.140007][ T2200] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 81.145889][ T2200] RIP: 0033:0x7eff3954be99 [ 81.150306][ T2200] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 81.170017][ T2200] RSP: 002b:00007eff37f63028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 81.178606][ T2200] RAX: ffffffffffffffda RBX: 00007eff397d4180 RCX: 00007eff3954be99 [ 81.186576][ T2200] RDX: 0000000020000000 RSI: 0000200000000580 RDI: 000000000000000a [ 81.194545][ T2200] RBP: 00007eff395e1eaf R08: 0000000000000000 R09: 0000000000000000 [ 81.202524][ T2200] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 81.210496][ T2200] R13: 00007eff397d4218 R14: 00007eff397d4180 R15: 00007ffdec587818 [ 81.218467][ T2200] [ 81.220790][ T2200] Allocated by task 2200: [ 81.225128][ T2200] __kasan_kmalloc+0xd4/0x100 [ 81.229800][ T2200] __kmalloc+0x19f/0x330 [ 81.234033][ T2200] tcf_idr_create+0x5f/0x790 [ 81.238701][ T2200] tcf_idr_create_from_flags+0x61/0x70 [ 81.244151][ T2200] tcf_gact_init+0x2e6/0x560 [ 81.248733][ T2200] tcf_action_init_1+0x443/0x6d0 [ 81.253662][ T2200] tcf_action_init+0x227/0x780 [ 81.258420][ T2200] tcf_exts_validate+0x23c/0x540 [ 81.263348][ T2200] mall_set_parms+0x4a/0x450 [ 81.267929][ T2200] mall_change+0x47a/0x770 [ 81.272014][ T2188] sched: RT throttling activated [ 81.277295][ T2200] tc_new_tfilter+0x1487/0x1ab0 [ 81.282127][ T2200] rtnetlink_rcv_msg+0x811/0xca0 [ 81.287062][ T2200] netlink_rcv_skb+0x1e9/0x430 [ 81.291811][ T2200] rtnetlink_rcv+0x1c/0x20 [ 81.296207][ T2200] netlink_unicast+0x86c/0xa30 [ 81.300960][ T2200] netlink_sendmsg+0x949/0xb70 [ 81.305720][ T2200] ____sys_sendmsg+0x5be/0x8f0 [ 81.310492][ T2200] ___sys_sendmsg+0x236/0x2e0 [ 81.315155][ T2200] __x64_sys_sendmsg+0x201/0x2d0 [ 81.320080][ T2200] do_syscall_64+0x31/0x40 [ 81.324477][ T2200] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 81.330343][ T2200] [ 81.332654][ T2200] The buggy address belongs to the object at ffff88810b80b600 [ 81.332654][ T2200] which belongs to the cache kmalloc-256 of size 256 [ 81.346686][ T2200] The buggy address is located 216 bytes inside of [ 81.346686][ T2200] 256-byte region [ffff88810b80b600, ffff88810b80b700) [ 81.359949][ T2200] The buggy address belongs to the page: [ 81.365586][ T2200] page:ffffea00042e0280 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b80a [ 81.375797][ T2200] head:ffffea00042e0280 order:1 compound_mapcount:0 [ 81.382450][ T2200] flags: 0x4000000000010200(slab|head) [ 81.387889][ T2200] raw: 4000000000010200 ffffea00042ec980 0000000200000002 ffff888100043200 [ 81.396456][ T2200] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 81.405105][ T2200] page dumped because: kasan: bad access detected [ 81.411579][ T2200] page_owner tracks the page as allocated [ 81.417301][ T2200] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, ts 5624604961, free_ts 0 [ 81.435255][ T2200] prep_new_page+0x176/0x190 [ 81.439825][ T2200] get_page_from_freelist+0x225f/0x23f0 [ 81.445345][ T2200] __alloc_pages_nodemask+0x29a/0x640 [ 81.450693][ T2200] new_slab+0x84/0x3f0 [ 81.454740][ T2200] ___slab_alloc+0x2f8/0x4c0 [ 81.459303][ T2200] __slab_alloc+0x63/0xa0 [ 81.463609][ T2200] kmem_cache_alloc_trace+0x1a8/0x2e0 [ 81.469060][ T2200] device_add+0xb9/0xc00 [ 81.473520][ T2200] platform_device_add+0x474/0x6d0 [ 81.478623][ T2200] init+0x371/0x1167 [ 81.482528][ T2200] do_one_initcall+0x205/0x5e0 [ 81.487363][ T2200] do_initcall_level+0x174/0x2dc [ 81.492279][ T2200] do_initcalls+0x50/0x92 [ 81.496604][ T2200] do_basic_setup+0x88/0x8f [ 81.501088][ T2200] kernel_init_freeable+0x28c/0x3c3 [ 81.506271][ T2200] kernel_init+0x11/0x1a0 [ 81.510690][ T2200] page_owner free stack trace missing [ 81.516241][ T2200] [ 81.518548][ T2200] Memory state around the buggy address: [ 81.524338][ T2200] ffff88810b80b580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 81.532401][ T2200] ffff88810b80b600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 81.540463][ T2200] >ffff88810b80b680: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 81.548688][ T2200] ^ [ 81.555869][ T2200] ffff88810b80b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 81.563909][ T2200] ffff88810b80b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 81.572123][ T2200] ================================================================== [ 81.580542][ T2200] Disabling lock debugging due to kernel taint [ 81.723627][ T25] usb 2-1: USB disconnect, device number 9