last executing test programs: 1m16.903343025s ago: executing program 3 (id=4): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000000)=@fragment={0x88, 0x0, 0x5, 0x1, 0x0, 0x1, 0x8000064}, 0x8) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24, 0x6, @empty}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, 0x0, 0x0) 1m16.720640738s ago: executing program 3 (id=6): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000000)={0xff, 0x829, 0x3, 0x81, 0xf, "7c6ced0300000088eea0ed80268d56ec22424b"}) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000300)={0x57, 0x0, 0x8, {0x0, 0x1}, {0x74, 0x2}, @rumble={0x1, 0x8}}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0xff0f) 1m16.564602845s ago: executing program 3 (id=7): socket$kcm(0x10, 0x2, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000040)='./file3\x00', 0x1010041, &(0x7f0000000000)={[{@errors_continue}, {@errors_remount}, {@jqfmt_vfsv1}, {@grpjquota}]}, 0x1, 0x546, &(0x7f0000000180)="$eJzs3dFrZFcZAPDv3mR2s7upmaoPtWAttrJbdSdJ47bBh6og+lRQKz4Ja0wmIWSSWZJJuwmLTfFVEES04Is++SL4BwjSF99FKNR3UVGkZvVBoe2VO3Onm0xmkhRncpfk94Oz9557Zu73nQlz5tyZu/cGcGE9GRE3ImIsIp6JiKlie1qU2OuU/HH39+8t5iWJLHvp7SSSYlt3X5eL5bXiaRMR8Y2vRnw3ORp3a2d3baHRqG8W9enWevJOlu3eXF1fWKmv1Dfm5mafm39+/tb8zFD6WY2IF77815/88JdfeeG3n33lT7f/fuN7eVr/zbJXo6cfw9TpeqX9WnSNR8TmKIKVZLzdw45bJecCAMDx8vn+hyPik+35/1SMtWdzAAAAwHmSfWEy3kkiMgAAAODcSiNiMpK0VpzvO1mcsXotIj4aV9NGc6v1meXm9sZS3hZRjUq6vNqoz8RE+9yBalSSvD5bnGPbrT/bU5+LiEcj4sdTV9r12mKzsVT2lx8AAABwQVzrOf7/91Sa1mpF417JyQEAAADDUy07AQAAAGDkHP8DAADA+VfN+tyh66h09JkAAAAAI/C1F1/MS9a9//XSyzvba82Xby7Vt9Zq69uLtcXm5p3aSrO50r5m3/pJ+2s0m3c+Fxvbd6db9a3W9NbO7u315vZG6/bqoVtgAwAAAGfo0U+88cckIvY+f6VdcpeKtkpENnbwweNlZAiMygc6p+cvo8sDOHsHP9+vlJgHcPZM6eHiqpSdAFC6k/4D0MCTd34//FwAAIDRuP6xwb//v71camrAiBW//yenugAIcK6MlZ0AUJrO73/vZR1lZwOcpcpxMwAHBXDupcP5/f+EUwkTAwoAAJRssl2StFYcB0xGmtZqEY+0bwtYSZZXG/WZiPhQRLw1Vbmc12fbz0zM5gEAAAAAAAAAAAAAAAAAAAAAAADglLIsiQwAAAA41yLSv3XvzHV96unJ3u8HLiX/mWovI+KVn73007sLrdbmbL79n+9vb71ebH+2jG8wAAAAgF7d4/TucTwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADNP9/XuL97Msy/bvLZ5l3H98KSKqRfyidFrGY6K9nIhKRFz9VxLjB56XRMTYEOLvvRYRj/WLn+RpRbXI4lD8SxFpRFwZVvz4gPGjE//aEOLDRfZGPv58sd/7L40n28v+77/xovy/Bo9/6fvj39iA8e+RQTutHK4+/uavpwfGfy3i8fH+4083fpLvr0/8p07Zx+98c3d3UFv2i4jr/ca/5HCs6db6nemtnd2bq+sLK/WV+sbc3Oxz88/P35qfmV5ebdSLf/vG+NHHf/Peg9q7R/p/9Zjxt93/Aa//06fs/7tv3t3/SGe15y8Tlfh5lt14qv/f/7F88emj8buffZ8qPgfyev4apq9/q2/8J371hycG5Zb3f2lA/yd6+n+5p/83Ttn/Z77+/T+f8qEAwBnY2tldW2g06ptWDq5E9aFI4+FdyeedpaeRRBL5yluHmhbKT6yz8mrxHltodN9tQ9rz74qDo1EmX9J4BAAAjM6DSX9vS1JOQgAAAAAAAAAAAAAAAAAAAHABnXgZsEFNaUQ82PLtHxxzNbLemHvldBUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Fj/CwAA//8GI9aV") mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x1004401, &(0x7f00000011c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000000040)='./file0\x00') mount$9p_xen(0x0, &(0x7f0000000100)='./file3\x00', &(0x7f0000000740), 0x32048, 0x0) 1m16.337998965s ago: executing program 3 (id=8): r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000140)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000000)={0x1d, r1, 0x3}, 0x18) sendmmsg$inet(r0, &(0x7f0000002e00)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="d1", 0x1}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0) syz_usb_connect$hid(0x6, 0x36, 0x0, 0x0) 1m15.184849865s ago: executing program 3 (id=13): mremap(&(0x7f0000041000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00004c3000/0x2000)=nil) r0 = socket$kcm(0x29, 0x2, 0x0) write$cgroup_pressure(r0, &(0x7f0000000140)={'full'}, 0xfffffdef) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x20040011) setsockopt$sock_attach_bpf(r0, 0x1, 0x7, &(0x7f0000000340), 0x4) 1m14.568450721s ago: executing program 32 (id=13): mremap(&(0x7f0000041000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00004c3000/0x2000)=nil) r0 = socket$kcm(0x29, 0x2, 0x0) write$cgroup_pressure(r0, &(0x7f0000000140)={'full'}, 0xfffffdef) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x20040011) setsockopt$sock_attach_bpf(r0, 0x1, 0x7, &(0x7f0000000340), 0x4) 9.559802425s ago: executing program 1 (id=513): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dbg\x00', 0x0) mount(0x0, &(0x7f0000000100)='./dbg\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x33) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') read$FUSE(r0, 0x0, 0x0) 9.393992085s ago: executing program 1 (id=516): ioctl$BTRFS_IOC_TREE_SEARCH(0xffffffffffffffff, 0xd0009411, &(0x7f00000000c0)={{0x0, 0x3, 0x1000, 0x0, 0x6, 0x0, 0x8000000000000000, 0x3, 0x0, 0x9, 0x4, 0x1, 0x9, 0x81, 0x6}}) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100fdfffffffdffffff1d00000008000300", @ANYRES32=r2, @ANYBLOB="48002f8008000100030000000c0002000203aa8aaaaaaaaa3000038024000380060001000200000006000300a1aa0000060001000000e9ff0700020001000000080001"], 0x64}}, 0x0) 9.090722705s ago: executing program 1 (id=521): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r0, 0x400, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r1, 0x400, 0x0) fcntl$setlease(r0, 0x400, 0x0) 8.887003667s ago: executing program 1 (id=523): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000500)='./bus\x00', 0x1000c40, &(0x7f00000002c0), 0x5, 0x51c, &(0x7f0000000700)="$eJzs3cFvI1cZAPBvZjebNE2bFCoVENClFBa0WjvxtlHVU7mAUFUJUXHikIbEG0Vx4ih2ShNWavI/IFGJA4ITZyQQHCr1xBHBDW69lANSgRWoQeJgNONx1t3YG3c3awv795NGM29mMt97Y8178RfHL4CJdTUijiLiSkS8ERHzxf6kWOKV9pKd99Gd22snd26vJdFqvf6PJD+e7Yuun8k8XlxzJiK++62IHyRn4zYODrdWa7XqXlEuN7d3y42Dwxub26sb1Y3qTqWyvLS8+NLNFysDtWNmgHOe3f7Vh9/cfPV77/7uCx/86ejrP8qqNVcc627HRWo3feo0TuZyRLz6KIKNwKWiPVdGXREeSBoRn4qI5/Lnfz4u5a/mYHo81gDA/4FWaz5a891lAGDcpXkOLElLRS5gLtK0VGrn8J6O2bRWbzSv36rv76y3c2ULMZXe2qxVF4tc4UJMJVl56e1s+265Eh8v34yIpyLix9OP5eXS2uB5BgDgYj1+z/j/7+n2+A8AjLmeH57pfn++Mry6AADDMciHZwGA8WL8B4DJc3f8nx1pPQCA4fH+HwAmj/EfACbN+53x/9KoawIADMV3XnstW1onxfdfr795sL9Vf/PGerWxVdreXyut1fd2Sxv1+katWlqrb593vVq9vrv0Quy/VW5WG81y4+BwZbu+v9Ncyb/Xe6U6NZRWAQD389Sz7/0liYijlx/Ll+iay8FYDeMtHXUFgJGR84fJ5Vu4YXJ5jw+T69fFf/yeN5dn348Iv/MAQVtvP8APARft2mfl/2FSyf/D5JL/h8kl/w+Tq9VK+s35n56eAgCMlU+Y4/cnARhDQ/37PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIyJuXxZ6CqnaakU8URELMRUcmuzVl2MiCcj4s/TU9NZeWmkNQYAHl76t6SY/+va/PNz9x69kvxnOl9HxA9/+vpP3lptNveWsv3/PN3ffKfYXxlF/QGA83TG6c443vHRndtrnWWY9fnwG+3JRbO4J8XSPnI5LmerP87kkw7P/itplwvZ7yuXLiD+0XFEfKZX+5M8N7JQzHx6b/ws9hNDjZ9+LH6aH2uvs3vx6TNXnu4b87y5XmFSvJf1P6/0ev7SuJqvZ3pOfjyT91APr9P/nZzp/zrP+0ze1/Tq/64OGuOF33+777HjiM9d7hU/OY2f9In//IDx3//8F5/rd6z184hr0Tt+d6xyc3u33Dg4vJHd+OpGdadSWV5aXnzp5ouVcp6jLncy1d3aI8TfX77+ZN/2//K3RUd5Nv7MOe3/yn1b3TrtgH/x3ze+/6V+8Y8jvvbl3q//0/eJn42JXy22+/f0bauzv+k7fXcWf719/48/6et//Zy4HR/89XB9wFMBgCFoHBxurdZq1b0L3ZiKC75g10byiOpsYwQbMcRY2a/JD3udZ4qU2Wrn+ek+5w8/e/eZbN/I7+qFbIyuTwKG4+5DP+qaAAAAAAAAAAAAAAAA/TzyfydKR91CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxtn/AgAA//8LKMVX") r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') pivot_root(&(0x7f0000000340)='./file1\x00', &(0x7f0000000300)='./file1\x00') 8.37951116s ago: executing program 1 (id=524): syz_usb_connect(0x5, 0x49, &(0x7f0000000980)={{0x12, 0x1, 0x110, 0x30, 0x66, 0x5b, 0x20, 0x421, 0x275, 0x6c0b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x37, 0x1, 0x5c, 0x4, 0x30, 0x5, "", [{{0x9, 0x4, 0xae, 0x8, 0x0, 0x2, 0x2, 0xff, 0xa, [@cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0xd, 0x8000, 0x6, 0x31}, {0x6, 0x24, 0x1a, 0x80, 0x10}, [@mdlm_detail={0x4, 0x24, 0x13, 0x3}, @mdlm_detail={0x4, 0x24, 0x13, 0x7f}]}]}}]}}]}}, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) 7.745764899s ago: executing program 1 (id=529): r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f00000006c0)='.\x00', 0x40001a2) r1 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x3, 0x0, 0x8000000200007, 0x282b, 0x20103, 0x80001, {0x200004, 0x10005c62, 0x203, 0x1000000000, 0x83, 0x4, 0x10000006, 0x6, 0x0, 0x0, 0x0, 0xee00, 0xee00, 0x8, 0x1}}, {0x0, 0xa}}}, 0xa0) sendfile(r1, r1, &(0x7f0000000100)=0x4, 0x8112) 7.716992788s ago: executing program 0 (id=530): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470004c00028008000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="0800030002000000080007006401010108000700ac1414bb0800020003"], 0x78}}, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x6f, &(0x7f00000001c0)={@multicast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x2, 0x61, 0x20, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x4e20, 0x4e20, 0x4d, 0x0, @gue={{0x2, 0x1, 0x2, 0x7f, 0x100}, "9163ebaed46008c7d42978cf1ee665ea8b4edc2a63f7a4ac61747dd3e643c565b61a5e0d1af69a6a311fd7cb972b36a6c6fa8be429bdcf46332d130b72"}}}}}}, 0x0) 7.330199485s ago: executing program 33 (id=529): r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f00000006c0)='.\x00', 0x40001a2) r1 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x3, 0x0, 0x8000000200007, 0x282b, 0x20103, 0x80001, {0x200004, 0x10005c62, 0x203, 0x1000000000, 0x83, 0x4, 0x10000006, 0x6, 0x0, 0x0, 0x0, 0xee00, 0xee00, 0x8, 0x1}}, {0x0, 0xa}}}, 0xa0) sendfile(r1, r1, &(0x7f0000000100)=0x4, 0x8112) 7.226270205s ago: executing program 0 (id=533): syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x8, 0x40, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0x8, 0x0, 0x4, 0x3}, {0x6, 0x24, 0x1a, 0x1041, 0x4}}, {{0x9, 0x5, 0x81, 0x3, 0x40, 0x6, 0x82, 0x8}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x40, 0x49, 0x7, 0xc}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x6, 0x80, 0x4b}}}}}}}]}}, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0x12, 0x3a, 0x8, 0x2}, 0x48) bpf$BPF_PROG_ATTACH(0x1c, &(0x7f0000000000)={@map=r0, 0xffffffffffffffff, 0x2c}, 0x20) 7.054616185s ago: executing program 2 (id=535): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f00000000c0)={0x77359400}, 0x10) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) 6.620467504s ago: executing program 2 (id=537): sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x40, 0x0, 0x10, 0x70bd2c, 0x25dfdbfb, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @broadcast}, @NLBL_UNLABEL_A_SECCTX={0x24, 0x7, 'system_u:object_r:var_auth_t:s0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4040880}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000008000000000018000380140003801000018004000300080001"], 0x44}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)={0x38, r1, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x38}}, 0x0) 6.167109352s ago: executing program 2 (id=539): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000406a05125000000000000109022400010000e80b0904000001030002000921fd7f000122e30109058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x83, 0x1, "d2"}, 0x0, 0x0}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x22, 0x4, {[@global=@item_012={0x1, 0x1, 0x9, "f5"}, @global=@item_012={0x1, 0x1, 0x7, "84"}]}}, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) 5.807193059s ago: executing program 5 (id=542): getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdd34, 0x10000, 0x3}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r4 = eventfd2(0x8d57, 0x1) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000440)=r4, 0x1) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000340)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000280)=@new_dev={0x3, 0x89b, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x8c}}}, &(0x7f00000003c0)) 5.646664612s ago: executing program 0 (id=543): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x24, 0x24, 0xd0f, 0x70bd25, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0xc}, {0x0, 0xa}, {0x10, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x40055}, 0x4c050) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000001400010401000000000000002d0000000100000005"], 0x20}}, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0xf0ffffffffffff, 0x0, 0x8880}, 0x0) 5.623087858s ago: executing program 5 (id=544): mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f00000002c0)={0x0, 0x5, 0x2, 0x200f, 0x2, 0x100000}, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x13e) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$BLKPG(r0, 0xc0c0128e, &(0x7f0000000280)={0x1, 0x0, 0x0, 0x0}) 5.459930339s ago: executing program 5 (id=545): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000180)=ANY=[], 0x8) connect$inet6(r0, &(0x7f00000004c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='batadv0\x00', 0xfc3d) sendto$inet6(r0, &(0x7f00000000c0)="797d82e4f660df92e576727698ce19ee1a436e79fca85e2f", 0x18, 0x3b00, 0x0, 0x0) 5.400383046s ago: executing program 0 (id=546): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r0, &(0x7f0000010480)="703a732f70202e2f66696c65303a300c24fed0849287cddd1218bf84bfffd25dd05a7c036beac8bce2c54fc7c1618e9d8e21fa8d119612ee2c553a6a", 0x3c) 5.200438337s ago: executing program 5 (id=548): r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x842) ioctl$EVIOCGBITSND(r0, 0x40044591, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f00000003c0)={0x55, 0x8000, 0xfffd, {0x0, 0x1}, {0x51, 0x2}, @cond=[{0x1ff, 0x5388, 0x6f5, 0x800, 0xc7, 0x202}, {0xffff, 0x5, 0x1, 0x46, 0x2, 0x101}]}) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) 5.197098485s ago: executing program 0 (id=549): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000080), 0x8100, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x8, 0x4, 0x8b, 0xfffa}, 0x1d, [0x7ffe, 0xc95a, 0x1, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x9, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x6, 0x4, 0x8, 0x4, 0x3c5b, 0x1, 0x3, 0x9, 0x1, 0x1f461e2c, 0x0, 0xe660, 0x4, 0x7, 0x101, 0x7fff, 0x1, 0x80000000, 0x4, 0x3, 0xe, 0xfffffffb, 0x71, 0xfffffff8, 0x7, 0x0, 0x0, 0x4, 0x80003e, 0x8f, 0x6, 0x10000006, 0x0, 0x5, 0x4, 0x8, 0x0, 0x2, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x1, 0xffff, 0x134, 0x7ffe, 0x9, 0xfffffff3, 0x129432e6, 0xcb, 0x6, 0xd, 0x2bf, 0x6c9, 0x9, 0x6, 0x3, 0x0, 0x7, 0x5, 0x0, 0xe, 0x312, 0x74, 0xea4, 0x0, 0x4, 0x4, 0x8000, 0x3, 0x400, 0x5, 0x6, 0x7, 0xff, 0x5, 0x5, 0x5f31, 0x4, 0x0, 0x2, 0x100002, 0xa, 0x4, 0x9, 0x8, 0x800, 0x6, 0x7, 0x8002, 0x1, 0xfe000000, 0xff7f, 0x2, 0x7f, 0x9, 0x2, 0xffffffff, 0x9, 0x1, 0x7, 0x80000003, 0x9, 0x48c93690, 0x42, 0x7], [0x400, 0x4, 0x0, 0x5, 0xfffffffe, 0xfffff76b, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x83, 0x80000003, 0x200009, 0x100003e7, 0x9, 0x5, 0x3, 0x2, 0xf38, 0x8, 0x4, 0x6d01, 0x5, 0x38, 0x800003, 0x200, 0x80, 0xf, 0xd, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0x53cf697b, 0x4, 0x6, 0xac8, 0x7, 0x2, 0x3, 0x7ff, 0xfffffffc, 0x2, 0x4, 0xffff, 0x0, 0x1a, 0x1c, 0x120000, 0x3, 0x8, 0xaaed, 0x4, 0x65], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0x20000ce7, 0x1ff, 0x2, 0xf58, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7ffe, 0x80000000, 0x200a620, 0x2, 0xc, 0x1, 0x4, 0x14c, 0x60a7, 0xe, 0x6, 0xffffffff, 0x80000000, 0x5, 0x8, 0x5, 0xee1, 0xfffff000, 0xffff, 0x3, 0x7f, 0x104, 0x9606, 0x7, 0x2, 0x4, 0x8006, 0x1, 0x0, 0x4, 0x8, 0x30b1d693, 0xa1f, 0x8, 0x7, 0x1, 0x6c1b, 0x2, 0x4, 0xb0b2748, 0x1, 0x1, 0x200, 0xffbf2445, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 5.070350814s ago: executing program 0 (id=550): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x12, r0, 0x108000) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r2, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) 4.993821269s ago: executing program 5 (id=551): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0x1, 0x2, 0x2, 0x7, 0x4, 0x7fffffff, 0x4e38}]}) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f00000004c0)=@vmx={0x0, 0x0, 0x465, {0x1000, 0xfec00000}, {"d07ee51100"}}) 4.56950331s ago: executing program 5 (id=553): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="20b52c020000065f"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000200)={0x0, 0x2, 0x81, 0x4, 0x3, [], [0x5, 0x7, 0x2, 0x8001], [0x6, 0x4, 0x7fffffff, 0x9], [0x2, 0x0, 0x3, 0x3]}) 4.276899273s ago: executing program 2 (id=555): syz_mount_image$vfat(&(0x7f0000000280), &(0x7f00000002c0)='./file0\x00', 0x10000, 0xffffffffffffffff, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x21d000, 0x0) pivot_root(&(0x7f0000000380)='./file0/../file0/../file0\x00', &(0x7f00000000c0)='./file0\x00') 4.10139127s ago: executing program 2 (id=556): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x800, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000010c0)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000380)={r2}, &(0x7f00000000c0)=0x8) 3.209856271s ago: executing program 2 (id=560): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b00000007000000010001000800000001000000", @ANYRES32, @ANYBLOB="00e9ff000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x65, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000600)="c9f7b98600"/14, 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.840563926s ago: executing program 34 (id=560): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b00000007000000010001000800000001000000", @ANYRES32, @ANYBLOB="00e9ff000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x65, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000600)="c9f7b98600"/14, 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.501670541s ago: executing program 4 (id=568): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000000041}, 0xc) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000480)={{{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in=@private=0xa010100, 0x0, 0x0, 0x4e20, 0x0, 0x2}, {0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x9c0, 0x3}, {0xffffbffffffffffc, 0x0, 0x0, 0x1}, 0x0, 0x0, 0x1, 0x0, 0x1}, {{@in=@empty, 0x4d3, 0x3c}, 0xa, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xffffffff, 0x4, 0x0, 0x0, 0x3, 0x4000000, 0x6}}, 0xe8) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) 1.381027444s ago: executing program 4 (id=569): syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000700)='./file1\x00', 0x0, &(0x7f0000000000), 0xfe, 0x250, &(0x7f0000000300)="$eJzs3T9oJFUcB/DvzO565m7RUxtB/AMiooFwdoLN2SgcyHGICCqciNgod8J5h11iZWOhtUoqmyB2RktJE2wUwSpqitgIGiwMFlqs7M4G8mc1ZnfdkcznA5OZybyZ3xt2vm+3ebsBGutskvNJWknmk3SSFHsb3FctZ4e7y3Prl5Ne7+lfi0G7ar+ye96ZJEtJHk2yVhZ5tZ3cWH1+6/eNJx9853rngY9Wn5ub6U0ObW9tPrXz4cW3P73wyI2vv/35YpHz6e67r+krRvyvXSS3/xfF/ieKdt094N+49OYn3/Vzf0eS+wf576RM9eK9e+2mtU4e/uDvzn3vl2/ummVfgenr9Tr998ClHtA4ZZJuinIhSbVdlgsL1Wf471uny9euXntj/pWr16+8XPdIBUxLN9l84vNTn505kP+fWlX+gZOrn/9nLq380N/eadXdG2Am7q5W/fzPv7j4UOQfGkf+obnkH5pL/qG55B+aS/6hueQfTrDOPx+Wf2gu+Yfmkn9orr35BwCapXdqnFnDt05/IjIwc3WPPwAAAAAAAAAAAAAAAAAAwGHLc+uXd5dxr1Ecs/2X7yfbjydpj6rfGvwecXLz4O/p34p+s3212uN2dOiFeye8wIQ+rnn29S0/1lv/q3vqrb94JVl6K8m5dvvw81cMn7/x3XbE8c5LExY4poP5fOzZ2dY/6M+Veutf2Ei+6I8/50aNP2XuHKxHjz/do79i+Uiv/zHhBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJiZvwIAAP//1rxsXQ==") openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) truncate(&(0x7f0000000900)='./file1\x00', 0x3000000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x181441, 0x148) fallocate(r0, 0x20, 0x4000, 0x8000) 1.180274971s ago: executing program 4 (id=570): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='fd\x00') fchdir(r0) exit(0xfffffffffffffffd) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, 0x0, 0xffffffffffffff9c, 0x0, 0x44) 177.783659ms ago: executing program 4 (id=571): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x3, {0x41, 0x0, 0x80000}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r1, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, &(0x7f0000000280)=[{&(0x7f00000000c0)="eda9", 0x2}], 0x1}, 0x20000800) recvmmsg(r1, &(0x7f0000002940)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000480)=""/216, 0xd8}], 0x1, &(0x7f00000005c0), 0x1800}, 0xee0}], 0x1, 0x2041, 0x0) 99.099343ms ago: executing program 4 (id=572): r0 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) r1 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x101003) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r1, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000200)={0x800, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0x800, 0x3, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x9, 0x1ff, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x403, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x0, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) 0s ago: executing program 4 (id=573): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) kernel console output (not intermixed with test programs): .894444][ T5608] dump_stack_lvl+0xe8/0x150 [ 95.894470][ T5608] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 95.894495][ T5608] f2fs_write_end_bio+0xda7/0x11c0 [ 95.894530][ T5608] __submit_merged_bio+0x258/0x6a0 [ 95.894548][ T5608] ? rcu_is_watching+0x16/0xb0 [ 95.894571][ T5608] f2fs_submit_merged_write_cond+0x1ef/0x590 [ 95.894594][ T5608] ? __pfx_f2fs_submit_merged_write_cond+0x10/0x10 [ 95.894635][ T5608] f2fs_write_data_pages+0x2a13/0x36e0 [ 95.894687][ T5608] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 95.894704][ T5608] ? is_bpf_text_address+0x26/0x2b0 [ 95.894733][ T5608] ? arch_stack_walk+0xfb/0x150 [ 95.894781][ T5608] ? add_lock_to_list+0xc7/0x100 [ 95.894800][ T5608] ? lockdep_unlock+0x5c/0xd0 [ 95.894815][ T5608] ? __lock_acquire+0x1511/0x2de0 [ 95.894858][ T5608] ? do_raw_spin_lock+0x12b/0x2f0 [ 95.894886][ T5608] ? do_raw_spin_unlock+0xf5/0x200 [ 95.894904][ T5608] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 95.894924][ T5608] do_writepages+0x338/0x560 [ 95.894951][ T5608] ? do_raw_spin_unlock+0xf5/0x200 [ 95.894973][ T5608] filemap_fdatawrite+0x1e9/0x2f0 [ 95.894994][ T5608] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 95.895054][ T5608] ? do_raw_spin_unlock+0xf5/0x200 [ 95.895076][ T5608] f2fs_sync_dirty_inodes+0x471/0x970 [ 95.895109][ T5608] f2fs_write_checkpoint+0x860/0x24d0 [ 95.895164][ T5608] kill_f2fs_super+0x2dc/0x700 [ 95.895194][ T5608] ? rcu_do_enqueue+0x616/0x870 [ 95.895211][ T5608] ? lockdep_hardirqs_on+0x7b/0x110 [ 95.895229][ T5608] ? __pfx_kill_f2fs_super+0x10/0x10 [ 95.895262][ T5608] ? __pfx_call_rcu+0x10/0x10 [ 95.895284][ T5608] ? shrinker_free+0x2a7/0x3b0 [ 95.895305][ T5608] deactivate_locked_super+0xbe/0x110 [ 95.895326][ T5608] cleanup_mnt+0x3d3/0x460 [ 95.895348][ T5608] task_work_run+0x1d9/0x260 [ 95.895371][ T5608] ? __pfx_task_work_run+0x10/0x10 [ 95.895399][ T5608] exit_to_user_mode_loop+0x204/0x770 [ 95.895418][ T5608] ? rcu_is_watching+0x16/0xb0 [ 95.895440][ T5608] do_syscall_64+0x328/0x520 [ 95.895458][ T5608] ? trace_irq_disable+0x3b/0x140 [ 95.895475][ T5608] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.895494][ T5608] ? clear_bhb_loop+0x70/0xc0 [ 95.895516][ T5608] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.895534][ T5608] RIP: 0033:0x7f3e8959f397 [ 95.895553][ T5608] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 95.895567][ T5608] RSP: 002b:00007ffc90dc9128 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 95.895587][ T5608] RAX: 0000000000000000 RBX: 00007f3e896344bb RCX: 00007f3e8959f397 [ 95.895600][ T5608] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc90dc91e0 [ 95.895613][ T5608] RBP: 00007ffc90dc91e0 R08: 00007ffc90dca1e0 R09: 00000000ffffffff [ 95.895626][ T5608] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc90dca270 [ 95.895638][ T5608] R13: 00007f3e896344bb R14: 0000000000017628 R15: 00007ffc90dca2b0 [ 95.895668][ T5608] [ 95.913436][ T5608] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 96.244911][ T32] usb 6-1: 2:0: failed to get current value for ch 1 (-71) [ 96.293447][ T5611] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 96.306166][ T32] usb 6-1: USB disconnect, device number 2 [ 96.677263][ T2257] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 96.710807][ T6419] loop5: detected capacity change from 0 to 512 [ 96.725014][ T6419] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 96.738011][ T6419] EXT4-fs error (device loop5): ext4_orphan_get:1429: comm syz.5.178: bad orphan inode 131083 [ 96.738040][ T6419] loop5: lost filesystem error report for type 5 error -117 [ 96.749803][ T6419] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 96.825325][ T2257] usb 2-1: Using ep0 maxpacket: 32 [ 96.827455][ T2257] usb 2-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 96.833224][ T2257] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 96.842493][ T2257] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 96.842518][ T2257] usb 2-1: Product: syz [ 96.842532][ T2257] usb 2-1: Manufacturer: syz [ 96.842545][ T2257] usb 2-1: SerialNumber: syz [ 96.850524][ T6424] Illegal XDP return value 4294967274 on prog (id 8) dev syz_tun, expect packet loss! [ 96.853746][ T2257] usb 2-1: config 0 descriptor?? [ 96.855055][ T6411] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 96.858135][ T2257] hub 2-1:0.0: bad descriptor, ignoring hub [ 96.858157][ T2257] hub 2-1:0.0: probe with driver hub failed with error -5 [ 97.063869][ T5850] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 97.504135][ T6443] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.151322624.0), cmd(2) [ 97.629333][ T6411] usb 2-1: reset high-speed USB device number 6 using dummy_hcd [ 97.775448][ T6433] loop0: detected capacity change from 0 to 32768 [ 97.804529][ T6433] BTRFS: device fsid db05bf05-c4f4-4d41-ba1f-eb57295b561b devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.180 (6433) [ 97.819965][ T6430] loop2: detected capacity change from 0 to 40427 [ 97.823918][ T6411] usb 2-1: device firmware changed [ 97.833914][ T5612] usb 2-1: USB disconnect, device number 6 [ 97.871667][ T6430] F2FS-fs (loop2): invalid crc value [ 97.873566][ T6433] BTRFS info (device loop0): first mount of filesystem db05bf05-c4f4-4d41-ba1f-eb57295b561b [ 97.873595][ T6433] BTRFS info (device loop0): using xxhash64 checksum algorithm [ 98.047786][ T5612] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 98.053861][ T6433] BTRFS info (device loop0): enabling ssd optimizations [ 98.053886][ T6433] BTRFS info (device loop0): turning on async discard [ 98.053901][ T6433] BTRFS info (device loop0): enabling free space tree [ 98.195521][ T5612] usb 2-1: Using ep0 maxpacket: 32 [ 98.196247][ T5612] usb 2-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 98.197243][ T5612] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 98.200105][ T5612] usb 2-1: string descriptor 0 read error: -22 [ 98.200210][ T5612] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 98.222873][ T6430] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 [ 98.269719][ T6430] F2FS-fs (loop2): f2fs_disable_checkpoint starts, unusable: 0 [ 98.269745][ T6430] F2FS-fs (loop2): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 98.271298][ T5612] usb 2-1: config 0 descriptor?? [ 98.273543][ T6434] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 98.274761][ T5612] hub 2-1:0.0: bad descriptor, ignoring hub [ 98.274783][ T5612] hub 2-1:0.0: probe with driver hub failed with error -5 [ 98.307376][ T6430] F2FS-fs (loop2): Start checkpoint disabled! [ 98.382196][ T6430] F2FS-fs (loop2): f2fs_disable_checkpoint finishes, err:0 [ 98.390940][ T6430] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 98.454973][ T5608] BTRFS info (device loop0): last unmount of filesystem db05bf05-c4f4-4d41-ba1f-eb57295b561b [ 98.516839][ T10] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 98.648187][ T61] kworker/u8:4: attempt to access beyond end of device [ 98.648187][ T61] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 98.648456][ T61] CPU: 0 UID: 0 PID: 61 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full) [ 98.648492][ T61] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 98.648505][ T61] Workqueue: writeback wb_workfn (flush-7:2) [ 98.648533][ T61] Call Trace: [ 98.648540][ T61] [ 98.648548][ T61] dump_stack_lvl+0xe8/0x150 [ 98.648571][ T61] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 98.648596][ T61] f2fs_write_end_bio+0xda7/0x11c0 [ 98.648632][ T61] __submit_merged_bio+0x258/0x6a0 [ 98.648651][ T61] ? rcu_is_watching+0x16/0xb0 [ 98.648676][ T61] f2fs_submit_merged_write_cond+0x1ef/0x590 [ 98.648699][ T61] ? __pfx_f2fs_submit_merged_write_cond+0x10/0x10 [ 98.648742][ T61] f2fs_write_data_pages+0x2a13/0x36e0 [ 98.648797][ T61] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 98.648859][ T61] ? __lock_acquire+0x747/0x2de0 [ 98.648885][ T61] ? __lock_acquire+0x747/0x2de0 [ 98.648919][ T61] ? lock_acquire+0x115/0x350 [ 98.648952][ T61] ? lock_acquire+0x115/0x350 [ 98.648968][ T61] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 98.648988][ T61] do_writepages+0x338/0x560 [ 98.649015][ T61] ? reacquire_held_locks+0x117/0x1a0 [ 98.649032][ T61] ? writeback_sb_inodes+0x450/0x1af0 [ 98.649056][ T61] __writeback_single_inode+0x136/0x1220 [ 98.649078][ T61] ? do_raw_spin_unlock+0xf5/0x200 [ 98.649101][ T61] writeback_sb_inodes+0x9de/0x1af0 [ 98.649117][ T61] ? __lock_acquire+0x747/0x2de0 [ 98.649159][ T61] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 98.649220][ T61] ? rcu_is_watching+0x16/0xb0 [ 98.649239][ T61] ? queue_io+0x2d3/0x470 [ 98.649260][ T61] wb_writeback+0x41c/0xad0 [ 98.649280][ T61] ? queue_io+0x2c1/0x470 [ 98.649304][ T61] ? __pfx_wb_writeback+0x10/0x10 [ 98.649320][ T61] ? do_raw_spin_lock+0x12b/0x2f0 [ 98.649355][ T61] wb_workfn+0x431/0x10f0 [ 98.649376][ T61] ? __lock_acquire+0x747/0x2de0 [ 98.649406][ T61] ? __pfx_wb_workfn+0x10/0x10 [ 98.649434][ T61] ? do_raw_spin_lock+0x12b/0x2f0 [ 98.649465][ T61] ? lock_acquire+0x115/0x350 [ 98.649527][ T61] ? rcu_is_watching+0x16/0xb0 [ 98.649549][ T61] ? process_scheduled_works+0x97a/0x1630 [ 98.649569][ T61] process_scheduled_works+0xc3d/0x1630 [ 98.649620][ T61] ? __pfx_process_scheduled_works+0x10/0x10 [ 98.649646][ T61] ? assign_work+0x3cf/0x5d0 [ 98.649670][ T61] worker_thread+0xa47/0xfb0 [ 98.649702][ T61] ? __kthread_parkme+0x71/0x1f0 [ 98.649731][ T61] kthread+0x38b/0x480 [ 98.649749][ T61] ? __pfx_worker_thread+0x10/0x10 [ 98.649765][ T61] ? __pfx_kthread+0x10/0x10 [ 98.649784][ T61] ret_from_fork+0x514/0xb70 [ 98.649805][ T61] ? __pfx_ret_from_fork+0x10/0x10 [ 98.649823][ T61] ? __switch_to+0xc78/0x1410 [ 98.649844][ T61] ? __pfx_kthread+0x10/0x10 [ 98.649863][ T61] ret_from_fork_asm+0x1a/0x30 [ 98.649898][ T61] [ 98.668751][ T10] usb 5-1: New USB device found: idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 98.672756][ T61] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 98.679451][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.679473][ T10] usb 5-1: Product: syz [ 98.679495][ T10] usb 5-1: Manufacturer: syz [ 98.679508][ T10] usb 5-1: SerialNumber: syz [ 98.690487][ T10] usb 5-1: config 0 descriptor?? [ 98.750687][ T10] hub 5-1:0.0: bad descriptor, ignoring hub [ 98.750712][ T10] hub 5-1:0.0: probe with driver hub failed with error -5 [ 98.766893][ T5612] usb 2-1: USB disconnect, device number 7 [ 98.790717][ T993] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 98.936369][ T993] usb 6-1: Using ep0 maxpacket: 16 [ 98.939855][ T993] usb 6-1: New USB device found: idVendor=045e, idProduct=07da, bcdDevice=0.00 [ 98.951138][ T993] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 98.951188][ T993] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 98.951209][ T993] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 98.951245][ T993] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.961532][ T10] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 99.101227][ T993] usb 6-1: config 0 descriptor?? [ 99.149031][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 99.153391][ T10] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 99.153449][ T10] usb 5-1: media controller created [ 99.299819][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 99.615893][ T10] DVB: Unable to find symbol dib7000p_attach() [ 99.615918][ T10] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 99.631544][ T993] input: HID 045e:07da as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:045E:07DA.0002/input/input7 [ 99.822887][ T10] rc_core: IR keymap rc-dib0700-rc5 not found [ 99.822905][ T10] Registered IR keymap rc-empty [ 99.823764][ T10] dvb-usb: could not initialize remote control. [ 99.823775][ T10] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 99.873478][ T10] usb 5-1: USB disconnect, device number 5 [ 100.012764][ T993] microsoft 0003:045E:07DA.0002: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 100.057723][ T993] usb 6-1: USB disconnect, device number 3 [ 100.201689][ T6516] fido_id[6516]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/6-1/report_descriptor': No such file or directory [ 100.320480][ T10] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 100.398692][ T6527] xt_hashlimit: size too large, truncated to 1048576 [ 100.633545][ T6532] warning: `syz.5.201' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 100.860102][ T6541] loop5: detected capacity change from 0 to 512 [ 100.992870][ T6547] device-mapper: ioctl: only supply one of name or uuid, cmd(9) [ 101.114952][ T6553] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.207'. [ 101.292299][ T6565] loop5: detected capacity change from 0 to 512 [ 101.293940][ T6565] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 101.296410][ T993] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 101.325024][ T6565] EXT4-fs (loop5): 1 truncate cleaned up [ 101.331885][ T6565] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 101.346937][ T4942] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 101.382636][ T5850] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 101.391385][ T10] usb 3-1: new low-speed USB device number 6 using dummy_hcd [ 101.439492][ T33] kauditd_printk_skb: 18 callbacks suppressed [ 101.439509][ T33] audit: type=1326 audit(1790784390.029:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6568 comm="syz.5.215" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8844f9e159 code=0x0 [ 101.446171][ T993] usb 1-1: Using ep0 maxpacket: 16 [ 101.448097][ T993] usb 1-1: New USB device found: idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 101.449501][ T993] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 101.449523][ T993] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 101.451954][ T993] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.451974][ T993] usb 1-1: Product: syz [ 101.451987][ T993] usb 1-1: Manufacturer: syz [ 101.451999][ T993] usb 1-1: SerialNumber: syz [ 101.457077][ T993] usb 1-1: config 0 descriptor?? [ 101.484330][ T993] mcba_usb 1-1:0.0 can0: couldn't setup read URBs [ 101.484351][ T993] mcba_usb 1-1:0.0 can0: couldn't start device: -90 [ 101.496447][ T2257] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 101.502630][ T4942] usb 5-1: New USB device found: idVendor=7d25, idProduct=a415, bcdDevice=0.40 [ 101.541096][ T4942] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 101.541114][ T4942] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 101.541124][ T4942] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 101.541148][ T4942] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 101.541162][ T4942] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 101.547407][ T10] usb 3-1: New USB device found: idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 101.549380][ T993] mcba_usb 1-1:0.0: probe with driver mcba_usb failed with error -90 [ 101.551364][ T10] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 101.551384][ T10] usb 3-1: config 0 has no interface number 0 [ 101.551420][ T10] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 101.551443][ T10] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 101.551479][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.555834][ T10] usb 3-1: config 0 descriptor?? [ 101.556500][ T6555] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 101.606136][ T10] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 101.622777][ T4942] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 101.622801][ T4942] usb 5-1: Product: syz [ 101.622816][ T4942] usb 5-1: Manufacturer: syz [ 101.647004][ T2257] usb 2-1: New USB device found: idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 101.648301][ T2257] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 101.648345][ T2257] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 101.649425][ T2257] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 101.649445][ T2257] usb 2-1: Manufacturer: syz [ 101.654779][ T2257] usb 2-1: config 0 descriptor?? [ 101.741155][ T10] usb 1-1: USB disconnect, device number 4 [ 101.786708][ T4942] cdc_wdm 5-1:1.0: skipping garbage [ 101.786727][ T4942] cdc_wdm 5-1:1.0: skipping garbage [ 101.809774][ T4942] cdc_wdm 5-1:1.0: cdc-wdm1: USB WDM device [ 101.809809][ T4942] cdc_wdm 5-1:1.0: Unknown control protocol [ 101.834231][ T4942] usb 3-1: USB disconnect, device number 6 [ 101.836786][ T2257] rc_core: IR keymap rc-hauppauge not found [ 101.836800][ T2257] Registered IR keymap rc-empty [ 101.872012][ T2257] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 101.885096][ T2257] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input9 [ 102.111309][ C0] igorplugusb 2-1:0.0: receive overflow invalid: 255 [ 102.196415][ T4942] usb 5-1: USB disconnect, device number 6 [ 102.315751][ T5714] usb 2-1: USB disconnect, device number 8 [ 102.837687][ T6587] loop4: detected capacity change from 0 to 512 [ 102.901986][ T6587] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 102.902086][ T6587] ext4 filesystem being mounted at /40/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 103.130297][ T5611] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 103.356200][ T6594] loop1: detected capacity change from 0 to 32768 [ 103.368080][ T6594] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 103.368100][ T6594] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 103.452995][ T6594] gfs2: fsid=syz:syz.0: journal 0 mapped with 1 extents in 0ms [ 103.465027][ T10] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 103.465046][ T10] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 103.823791][ T10] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 358ms [ 103.843077][ T10] gfs2: fsid=syz:syz.0: jid=0: Done [ 103.843811][ T6594] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 103.995075][ T6600] loop2: detected capacity change from 0 to 32768 [ 104.004370][ T6600] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.226 (6600) [ 104.129972][ T6600] BTRFS info (device loop2): first mount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 104.130002][ T6600] BTRFS info (device loop2): using crc32c checksum algorithm [ 104.170030][ T6596] loop5: detected capacity change from 0 to 40427 [ 104.206601][ T6596] F2FS-fs (loop5): invalid crc value [ 104.321178][ T6600] BTRFS info (device loop2): enabling ssd optimizations [ 104.321318][ T6600] BTRFS info (device loop2): turning on async discard [ 104.321335][ T6600] BTRFS info (device loop2): enabling free space tree [ 104.380643][ T6600] BTRFS critical (device loop2 state E): emergency shutdown [ 104.524466][ T5621] BTRFS info (device loop2 state E): last unmount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 104.647463][ T6596] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 104.691850][ T6596] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e4 [ 104.880585][ T6636] loop1: detected capacity change from 0 to 2048 [ 104.971910][ T6636] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 104.971932][ T6636] UDF-fs: Scanning with blocksize 512 failed [ 105.004055][ T6596] syz.5.224: attempt to access beyond end of device [ 105.004055][ T6596] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 105.024694][ T6596] CPU: 0 UID: 0 PID: 6596 Comm: syz.5.224 Not tainted syzkaller #0 PREEMPT(full) [ 105.024723][ T6596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 105.024735][ T6596] Call Trace: [ 105.024743][ T6596] [ 105.024752][ T6596] dump_stack_lvl+0xe8/0x150 [ 105.024779][ T6596] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 105.024807][ T6596] f2fs_write_end_bio+0xda7/0x11c0 [ 105.024848][ T6596] __submit_merged_bio+0x258/0x6a0 [ 105.024868][ T6596] ? rcu_is_watching+0x16/0xb0 [ 105.024894][ T6596] f2fs_submit_merged_write_cond+0x1ef/0x590 [ 105.024926][ T6596] ? __pfx_f2fs_submit_merged_write_cond+0x10/0x10 [ 105.024974][ T6596] f2fs_write_data_pages+0x2a13/0x36e0 [ 105.024992][ T6596] ? __lock_acquire+0x747/0x2de0 [ 105.025047][ T6596] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 105.025065][ T6596] ? is_bpf_text_address+0x26/0x2b0 [ 105.025097][ T6596] ? arch_stack_walk+0xfb/0x150 [ 105.025148][ T6596] ? add_lock_to_list+0xc7/0x100 [ 105.025168][ T6596] ? lockdep_unlock+0x5c/0xd0 [ 105.025184][ T6596] ? __lock_acquire+0x1511/0x2de0 [ 105.025223][ T6596] ? __lock_acquire+0x747/0x2de0 [ 105.025248][ T6596] ? do_raw_spin_lock+0x12b/0x2f0 [ 105.025280][ T6596] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 105.025301][ T6596] do_writepages+0x338/0x560 [ 105.025333][ T6596] ? do_raw_spin_unlock+0xf5/0x200 [ 105.025358][ T6596] filemap_fdatawrite+0x1e9/0x2f0 [ 105.025382][ T6596] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 105.025451][ T6596] ? do_raw_spin_unlock+0xf5/0x200 [ 105.025475][ T6596] f2fs_sync_dirty_inodes+0x471/0x970 [ 105.025510][ T6596] f2fs_write_checkpoint+0x860/0x24d0 [ 105.025561][ T6596] f2fs_issue_checkpoint+0x424/0x6f0 [ 105.025589][ T6596] ? __pfx_f2fs_issue_checkpoint+0x10/0x10 [ 105.025609][ T6596] ? __pfx_from_kgid+0x10/0x10 [ 105.025636][ T6596] ? rcu_is_watching+0x16/0xb0 [ 105.025657][ T6596] ? __up_read+0x29c/0x930 [ 105.025673][ T6596] ? f2fs_update_inode+0x157a/0x2660 [ 105.025735][ T6596] ? f2fs_sync_fs+0x1f2/0x3c0 [ 105.025757][ T6596] f2fs_unlink+0x225/0x600 [ 105.025780][ T6596] vfs_rmdir+0x3e6/0x6a0 [ 105.025799][ T6596] ? bpf_lsm_path_rmdir+0x9/0x20 [ 105.025822][ T6596] filename_rmdir+0x292/0x520 [ 105.025849][ T6596] ? __pfx_filename_rmdir+0x10/0x10 [ 105.025877][ T6596] ? do_getname+0x151/0x250 [ 105.025898][ T6596] __se_sys_rmdir+0x2e/0x140 [ 105.025928][ T6596] do_syscall_64+0x166/0x520 [ 105.025947][ T6596] ? trace_irq_disable+0x3b/0x140 [ 105.025965][ T6596] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.025986][ T6596] ? clear_bhb_loop+0x70/0xc0 [ 105.026007][ T6596] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.026025][ T6596] RIP: 0033:0x7f8844f9e159 [ 105.026044][ T6596] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.026061][ T6596] RSP: 002b:00007f8845f2d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 105.026083][ T6596] RAX: ffffffffffffffda RBX: 00007f8845225fa0 RCX: 00007f8844f9e159 [ 105.026098][ T6596] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000080 [ 105.026112][ T6596] RBP: 00007f884503506b R08: 0000000000000000 R09: 0000000000000000 [ 105.026125][ T6596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.026137][ T6596] R13: 00007f8845226038 R14: 00007f8845225fa0 R15: 00007fffebc17ec8 [ 105.026168][ T6596] [ 105.076408][ T6596] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 105.164016][ T6636] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 105.749027][ T6657] tipc: Started in network mode [ 105.749057][ T6657] tipc: Node identity ac14140f, cluster identity 4711 [ 105.749809][ T6657] tipc: New replicast peer: 255.255.255.255 [ 105.767743][ T6657] tipc: Enabled bearer , priority 10 [ 105.998900][ T6669] loop8: detected capacity change from 0 to 8 [ 106.003655][ T6669] Dev loop8: unable to read RDB block 8 [ 106.003704][ T6669] loop8: unable to read partition table [ 106.003891][ T6669] loop8: partition table beyond EOD, truncated [ 106.005437][ T6669] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 106.064002][ T6642] loop0: detected capacity change from 0 to 32768 [ 106.097500][ T6672] loop1: detected capacity change from 0 to 16 [ 106.130529][ T6672] erofs (device loop1): mounted with root inode @ nid 36. [ 106.841382][ T6703] loop5: detected capacity change from 0 to 2048 [ 106.880475][ T2257] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 106.894857][ T6703] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 106.930217][ T10] tipc: Node number set to 2886997007 [ 107.037090][ T2257] usb 2-1: Using ep0 maxpacket: 8 [ 107.038389][ T2257] usb 2-1: New USB device found: idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 107.039872][ T2257] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 107.039914][ T2257] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.053966][ T2257] usb 2-1: config 0 descriptor?? [ 107.166088][ T6710] loop5: detected capacity change from 0 to 4096 [ 107.199917][ T10] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 107.281837][ T2257] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 107.324651][ T6706] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.261 (6706) [ 107.347719][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 107.349121][ T10] usb 5-1: New USB device found: idVendor=0225, idProduct=0000, bcdDevice=0.00 [ 107.351758][ T10] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 107.351781][ T10] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 107.351822][ T10] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 107.351845][ T10] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 107.351882][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.377630][ T10] hub 5-1:1.0: bad descriptor, ignoring hub [ 107.377656][ T10] hub 5-1:1.0: probe with driver hub failed with error -5 [ 107.382821][ T10] cdc_wdm 5-1:1.0: skipping garbage [ 107.382840][ T10] cdc_wdm 5-1:1.0: skipping garbage [ 107.394470][ T10] cdc_wdm 5-1:1.0: cdc-wdm1: USB WDM device [ 107.394489][ T10] cdc_wdm 5-1:1.0: Unknown control protocol [ 107.400042][ T6706] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 107.400070][ T6706] BTRFS info (device loop0): using sha256 checksum algorithm [ 107.546229][ T5706] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 107.561413][ T6706] BTRFS info (device loop0): enabling ssd optimizations [ 107.561460][ T6706] BTRFS info (device loop0): turning on sync discard [ 107.561475][ T6706] BTRFS info (device loop0): enabling free space tree [ 107.684450][ T5608] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 107.705419][ T5706] usb 3-1: Using ep0 maxpacket: 32 [ 107.709059][ T5706] usb 3-1: New USB device found: idVendor=044e, idProduct=120b, bcdDevice=0.00 [ 107.712535][ T5706] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 107.712586][ T5706] usb 3-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 107.712610][ T5706] usb 3-1: config 0 interface 0 has no altsetting 0 [ 107.712639][ T5706] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.725574][ T5706] usb 3-1: config 0 descriptor?? [ 107.747080][ T10] usb 2-1: USB disconnect, device number 9 [ 107.980065][ T993] usb 5-1: USB disconnect, device number 7 [ 108.288343][ T993] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 108.446636][ T993] usb 6-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 108.451247][ T993] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.460100][ T993] usb 6-1: config 0 descriptor?? [ 108.679449][ T993] udl 6-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 108.767551][ T5706] hid-alps 0003:044E:120B.0003: failed to read command (-71) [ 108.767606][ T5706] hid-alps 0003:044E:120B.0003: failed to change TP mode (-71) [ 108.776201][ T5706] hid-alps 0003:044E:120B.0003: hidraw0: USB HID v80.00 Joystick [HID 044e:120b] on usb-dummy_hcd.2-1/input0 [ 108.806309][ T5706] usb 3-1: USB disconnect, device number 7 [ 108.922834][ T6751] set_capacity_and_notify: 1 callbacks suppressed [ 108.922853][ T6751] loop1: detected capacity change from 0 to 1024 [ 108.924991][ T6751] EXT4-fs: Ignoring removed nomblk_io_submit option [ 108.961996][ T993] [drm] Initialized udl 0.0.1 for 6-1:0.0 on minor 1 [ 108.962020][ T993] [drm] Initialized udl on minor 1 [ 108.963920][ T6750] fido_id[6750]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 108.966790][ T6753] loop0: detected capacity change from 0 to 512 [ 108.978724][ T6753] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 109.003624][ T6751] EXT4-fs (loop1): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 109.003723][ T6751] ext4 filesystem being mounted at /47/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 109.039215][ T6753] EXT4-fs error (device loop0): ext4_orphan_get:1429: comm syz.0.273: bad orphan inode 131083 [ 109.039245][ T6753] loop0: lost filesystem error report for type 5 error -117 [ 109.053629][ T6753] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 109.153189][ T6751] EXT4-fs error (device loop1): ext4_map_blocks:832: inode #15: comm syz.1.272: lblock 0 mapped to illegal pblock 0 (length 1) [ 109.178480][ T6751] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 109.178511][ T6751] EXT4-fs (loop1): This should not happen!! Data will be lost [ 109.178511][ T6751] [ 109.230318][ T6758] EXT4-fs error (device loop1): ext4_validate_block_bitmap:445: comm syz.1.272: bg 0: block 112: padding at end of block bitmap is not set [ 109.273451][ T6758] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 16 with max blocks 51 with error 28 [ 109.273485][ T6758] EXT4-fs (loop1): This should not happen!! Data will be lost [ 109.273485][ T6758] [ 109.273522][ T6758] EXT4-fs (loop1): Total free blocks count 0 [ 109.273535][ T6758] EXT4-fs (loop1): Free/Dirty block details [ 109.273570][ T6758] EXT4-fs (loop1): free_blocks=0 [ 109.273613][ T6758] EXT4-fs (loop1): dirty_blocks=64 [ 109.273625][ T6758] EXT4-fs (loop1): Block reservation details [ 109.584049][ T5608] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 109.741391][ T6764] loop2: detected capacity change from 0 to 1024 [ 109.743343][ T6764] EXT4-fs: Ignoring removed orlov option [ 109.820353][ T6764] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 109.903650][ T5621] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 109.956192][ T6775] loop5: detected capacity change from 0 to 4095 [ 110.032314][ T6776] FAULT_INJECTION: forcing a failure. [ 110.032314][ T6776] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 110.032346][ T6776] CPU: 0 UID: 0 PID: 6776 Comm: syz.1.281 Not tainted syzkaller #0 PREEMPT(full) [ 110.032369][ T6776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 110.032379][ T6776] Call Trace: [ 110.032387][ T6776] [ 110.032395][ T6776] dump_stack_lvl+0xe8/0x150 [ 110.032424][ T6776] should_fail_ex+0x3eb/0x540 [ 110.032450][ T6776] _copy_from_user+0x2d/0xb0 [ 110.032471][ T6776] __se_sys_mbind+0x3ad/0x10e0 [ 110.032500][ T6776] ? __pfx___se_sys_mbind+0x10/0x10 [ 110.032518][ T6776] ? __fget_files+0x3a2/0x420 [ 110.032536][ T6776] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 110.032564][ T6776] ? __se_sys_futex+0x3a8/0x450 [ 110.032591][ T6776] ? rcu_is_watching+0x16/0xb0 [ 110.032617][ T6776] ? __x64_sys_mbind+0x21/0xf0 [ 110.032639][ T6776] do_syscall_64+0x166/0x520 [ 110.032657][ T6776] ? trace_irq_disable+0x3b/0x140 [ 110.032675][ T6776] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.032695][ T6776] ? clear_bhb_loop+0x70/0xc0 [ 110.032716][ T6776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.032735][ T6776] RIP: 0033:0x7ffa23b9e159 [ 110.032752][ T6776] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 110.032766][ T6776] RSP: 002b:00007ffa24acb028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ed [ 110.032786][ T6776] RAX: ffffffffffffffda RBX: 00007ffa23e25fa0 RCX: 00007ffa23b9e159 [ 110.032800][ T6776] RDX: 0000000000000001 RSI: 0000000000004000 RDI: 0000200000ffa000 [ 110.032811][ T6776] RBP: 00007ffa23c3506b R08: 000000000000007f R09: 0000000000000001 [ 110.032823][ T6776] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000000 [ 110.032834][ T6776] R13: 00007ffa23e26038 R14: 00007ffa23e25fa0 R15: 00007ffc98e6c638 [ 110.032862][ T6776] [ 110.304053][ T6775] Buffer I/O error on dev loop5, logical block 511, async page read [ 110.304882][ T5620] Buffer I/O error on dev loop5, logical block 511, async page read [ 111.209472][ T6789] netlink: 56 bytes leftover after parsing attributes in process `syz.1.286'. [ 111.268974][ T6785] loop4: detected capacity change from 0 to 40427 [ 111.282996][ T6785] F2FS-fs (loop4): Invalid SB checksum offset: 0 [ 111.283022][ T6785] F2FS-fs (loop4): Can't find valid F2FS filesystem in 2th superblock [ 111.284369][ T6785] F2FS-fs (loop4): invalid crc value [ 111.414318][ T6796] loop2: detected capacity change from 0 to 512 [ 111.425062][ T6796] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 111.435418][ T6796] EXT4-fs error (device loop2): ext4_orphan_get:1429: comm syz.2.288: bad orphan inode 131083 [ 111.435445][ T6796] loop2: lost filesystem error report for type 5 error -117 [ 111.446457][ C0] EXT4-fs (loop2): error count since last fsck: 1 [ 111.446478][ C0] EXT4-fs (loop2): initial error at time 1790784400: ext4_orphan_get:1429 [ 111.446500][ C0] EXT4-fs (loop2): last error at time 1790784400: ext4_orphan_get:1429 [ 111.490151][ T6796] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 111.534220][ T6785] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 111.561144][ T6785] F2FS-fs (loop4): Try to recover 2th superblock, ret: 0 [ 111.561170][ T6785] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 111.628912][ T33] audit: type=1800 audit(1790784400.219:46): pid=6785 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.285" name="file1" dev="loop4" ino=10 res=0 errno=-22 [ 111.639689][ T5706] usb 2-1: new low-speed USB device number 10 using dummy_hcd [ 111.705031][ T5621] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 111.736597][ T4942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 111.786866][ T5706] usb 2-1: New USB device found: idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 111.788241][ T5706] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 111.788264][ T5706] usb 2-1: config 0 has no interface number 0 [ 111.788301][ T5706] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 111.788348][ T5706] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 111.788386][ T5706] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.793163][ T5706] usb 2-1: config 0 descriptor?? [ 111.794719][ T6794] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 111.825718][ T5706] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 111.876084][ T10] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 112.026733][ T10] usb 1-1: New USB device found: idVendor=0926, idProduct=3333, bcdDevice=0.40 [ 112.028670][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 112.028717][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 112.044618][ T5706] usb 2-1: USB disconnect, device number 10 [ 112.072526][ T10] usb 1-1: config 0 descriptor?? [ 112.097360][ T6785] syz.4.285: attempt to access beyond end of device [ 112.097360][ T6785] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 112.101330][ T6785] CPU: 1 UID: 0 PID: 6785 Comm: syz.4.285 Not tainted syzkaller #0 PREEMPT(full) [ 112.101356][ T6785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 112.101367][ T6785] Call Trace: [ 112.101374][ T6785] [ 112.101382][ T6785] dump_stack_lvl+0xe8/0x150 [ 112.101410][ T6785] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 112.101439][ T6785] f2fs_write_end_bio+0xda7/0x11c0 [ 112.101487][ T6785] __submit_merged_bio+0x258/0x6a0 [ 112.101505][ T6785] ? rcu_is_watching+0x16/0xb0 [ 112.101532][ T6785] f2fs_submit_merged_write_cond+0x1ef/0x590 [ 112.101556][ T6785] ? __pfx_f2fs_submit_merged_write_cond+0x10/0x10 [ 112.101602][ T6785] f2fs_write_data_pages+0x2a13/0x36e0 [ 112.101668][ T6785] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 112.101704][ T6785] ? is_bpf_text_address+0x292/0x2b0 [ 112.101724][ T6785] ? is_bpf_text_address+0x26/0x2b0 [ 112.101775][ T6785] ? stack_trace_save+0xa9/0x100 [ 112.101795][ T6785] ? __pfx_stack_trace_save+0x10/0x10 [ 112.101840][ T6785] ? lockdep_unlock+0x5c/0xd0 [ 112.101858][ T6785] ? __lock_acquire+0x1511/0x2de0 [ 112.101912][ T6785] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 112.101934][ T6785] do_writepages+0x338/0x560 [ 112.101969][ T6785] ? do_raw_spin_unlock+0xf5/0x200 [ 112.101996][ T6785] filemap_fdatawrite+0x1e9/0x2f0 [ 112.102021][ T6785] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 112.102106][ T6785] ? do_raw_spin_unlock+0xf5/0x200 [ 112.102133][ T6785] f2fs_sync_dirty_inodes+0x471/0x970 [ 112.102171][ T6785] f2fs_write_checkpoint+0x860/0x24d0 [ 112.102238][ T6785] f2fs_gc+0x1ee9/0x25b0 [ 112.102256][ T6785] ? check_noncircular+0xdb/0x150 [ 112.102311][ T6785] ? __pfx_f2fs_gc+0x10/0x10 [ 112.102365][ T6785] ? __pfx_f2fs_submit_all_merged_ipu_writes+0x10/0x10 [ 112.102391][ T6785] ? rcu_is_watching+0x16/0xb0 [ 112.102417][ T6785] f2fs_balance_fs+0x61c/0x810 [ 112.102446][ T6785] ? __pfx_f2fs_balance_fs+0x10/0x10 [ 112.102463][ T6785] ? rcu_is_watching+0x16/0xb0 [ 112.102483][ T6785] ? __up_read+0x29c/0x930 [ 112.102514][ T6785] ? trace_lock_elapsed_time_end+0xf1/0xbc0 [ 112.102534][ T6785] ? restore_priority+0x1af/0x450 [ 112.102562][ T6785] f2fs_map_blocks+0x3df8/0x4c40 [ 112.102630][ T6785] ? __pfx_f2fs_map_blocks+0x10/0x10 [ 112.102646][ T6785] ? invalidate_inode_pages2_range+0xa71/0xb20 [ 112.102668][ T6785] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 112.102698][ T6785] ? __pfx_invalidate_inode_pages2_range+0x10/0x10 [ 112.102722][ T6785] ? filemap_check_errors+0xd2/0x120 [ 112.102739][ T6785] ? __f2fs_overwrite_io+0xda/0x3e0 [ 112.102766][ T6785] ? __pfx_filemap_write_and_wait_range+0x10/0x10 [ 112.102805][ T6785] f2fs_iomap_next+0x41b/0xc60 [ 112.102837][ T6785] ? __pfx_f2fs_iomap_next+0x10/0x10 [ 112.102865][ T6785] ? rcu_is_watching+0x16/0xb0 [ 112.102888][ T6785] ? __kasan_kmalloc+0x93/0xb0 [ 112.102913][ T6785] iomap_iter+0xe2/0xec0 [ 112.102932][ T6785] ? blk_start_plug+0x6e/0x1b0 [ 112.102956][ T6785] __iomap_dio_rw+0xc87/0x1c40 [ 112.102995][ T6785] ? __lock_acquire+0x1511/0x2de0 [ 112.103020][ T6785] ? __pfx___iomap_dio_rw+0x10/0x10 [ 112.103060][ T6785] ? lock_acquire+0x115/0x350 [ 112.103107][ T6785] ? down_read+0x2b9/0x320 [ 112.103132][ T6785] f2fs_file_write_iter+0x1a70/0x2c10 [ 112.103181][ T6785] ? __pfx_f2fs_file_write_iter+0x10/0x10 [ 112.103223][ T6785] vfs_write+0x612/0xba0 [ 112.103254][ T6785] ? __pfx_vfs_write+0x10/0x10 [ 112.103279][ T6785] ? __fget_files+0x3a2/0x420 [ 112.103307][ T6785] ? __fget_files+0x2a/0x420 [ 112.103333][ T6785] ? fdget+0x1ac/0x250 [ 112.103361][ T6785] ksys_write+0x150/0x270 [ 112.103384][ T6785] ? __pfx_ksys_write+0x10/0x10 [ 112.103417][ T6785] do_syscall_64+0x166/0x520 [ 112.103435][ T6785] ? trace_irq_disable+0x3b/0x140 [ 112.103453][ T6785] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.103473][ T6785] ? clear_bhb_loop+0x70/0xc0 [ 112.103494][ T6785] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.103513][ T6785] RIP: 0033:0x7f030759e159 [ 112.103541][ T6785] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.103557][ T6785] RSP: 002b:00007f03084ee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 112.103585][ T6785] RAX: ffffffffffffffda RBX: 00007f0307825fa0 RCX: 00007f030759e159 [ 112.103600][ T6785] RDX: 00000000ffffffd7 RSI: 0000200000000000 RDI: 0000000000000004 [ 112.103613][ T6785] RBP: 00007f030763506b R08: 0000000000000000 R09: 0000000000000000 [ 112.103625][ T6785] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 112.103636][ T6785] R13: 00007f0307826038 R14: 00007f0307825fa0 R15: 00007ffeaf8f1d38 [ 112.103677][ T6785] [ 112.104466][ T6785] F2FS-fs (loop4): Stopped filesystem due to reason: 3 [ 112.201032][ T6785] syz.4.285: attempt to access beyond end of device [ 112.201032][ T6785] loop4: rw=34817, sector=53256, nr_sectors = 8 limit=40427 [ 112.320013][ T10] usbhid 1-1:0.0: can't add hid device: -71 [ 112.320163][ T10] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 112.344377][ T10] usb 1-1: USB disconnect, device number 5 [ 112.713133][ T6808] loop2: detected capacity change from 0 to 32768 [ 112.721608][ T6808] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.292 (6808) [ 112.730477][ T6808] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 112.730514][ T6808] BTRFS info (device loop2): using sha256 checksum algorithm [ 112.775666][ T5714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 112.805470][ T6808] BTRFS info (device loop2): enabling ssd optimizations [ 112.805503][ T6808] BTRFS info (device loop2): turning on sync discard [ 112.805519][ T6808] BTRFS info (device loop2): enabling free space tree [ 112.836310][ T10] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 112.908055][ T6825] loop4: detected capacity change from 0 to 512 [ 112.913107][ T6825] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 112.949174][ T6825] EXT4-fs (loop4): 1 truncate cleaned up [ 112.976706][ T6825] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 112.980487][ T5621] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 113.005398][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 113.006122][ T10] usb 1-1: New USB device found: idVendor=0f11, idProduct=1021, bcdDevice=0.40 [ 113.007142][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 113.007181][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 113.012981][ T10] usb 1-1: config 0 descriptor?? [ 113.025611][ T10] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 113.081839][ T10] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 113.190538][ T6831] EXT4-fs (loop4): shut down requested (1) [ 113.278767][ T5611] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.282074][ T10] usb 1-1: USB disconnect, device number 6 [ 113.305446][ T5714] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 113.312011][ T10] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 113.341050][ T6833] loop2: detected capacity change from 0 to 1024 [ 113.342011][ T6833] EXT4-fs: Ignoring removed orlov option [ 113.416574][ T6833] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 113.463506][ T5714] usb 2-1: New USB device found: idVendor=7d25, idProduct=a415, bcdDevice=0.40 [ 113.475204][ T5714] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 113.475283][ T5714] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 113.475301][ T5714] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 113.475342][ T5714] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 113.475365][ T5714] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 113.517928][ T5714] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 113.517955][ T5714] usb 2-1: Product: syz [ 113.517980][ T5714] usb 2-1: Manufacturer: syz [ 113.558027][ T5714] cdc_wdm 2-1:1.0: skipping garbage [ 113.558048][ T5714] cdc_wdm 2-1:1.0: skipping garbage [ 113.569243][ T5714] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 113.569262][ T5714] cdc_wdm 2-1:1.0: Unknown control protocol [ 113.590320][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 113.612718][ T6839] overlayfs: invalid origin (00000079000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000) [ 113.736420][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 113.740867][ T5621] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.816704][ T5612] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 114.023705][ T10] usb 2-1: USB disconnect, device number 11 [ 114.063303][ T993] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffff92 [ 114.063798][ T993] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 114.095069][ T993] usb 6-1: USB disconnect, device number 4 [ 114.240416][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 114.477373][ T6860] loop4: detected capacity change from 0 to 32768 [ 114.493529][ T6860] (syz.4.307,6860,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 114.512930][ T6860] (syz.4.307,6860,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 114.543337][ T6860] JBD2: Ignoring recovery information on journal [ 114.592703][ T6860] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 114.706873][ T6869] FAULT_INJECTION: forcing a failure. [ 114.706873][ T6869] name failslab, interval 1, probability 0, space 0, times 0 [ 114.706901][ T6869] CPU: 1 UID: 0 PID: 6869 Comm: syz.1.310 Not tainted syzkaller #0 PREEMPT(full) [ 114.706920][ T6869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 114.706930][ T6869] Call Trace: [ 114.706938][ T6869] [ 114.706946][ T6869] dump_stack_lvl+0xe8/0x150 [ 114.706974][ T6869] should_fail_ex+0x3eb/0x540 [ 114.706999][ T6869] should_failslab+0xa8/0x100 [ 114.707022][ T6869] __kvmalloc_node_noprof+0x171/0x820 [ 114.707044][ T6869] ? __se_sys_setgroups+0xf2/0x4d0 [ 114.707063][ T6869] ? __se_sys_setgroups+0xf2/0x4d0 [ 114.707088][ T6869] __se_sys_setgroups+0xf2/0x4d0 [ 114.707116][ T6869] do_syscall_64+0x166/0x520 [ 114.707135][ T6869] ? trace_irq_disable+0x3b/0x140 [ 114.707153][ T6869] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.707172][ T6869] ? clear_bhb_loop+0x70/0xc0 [ 114.707192][ T6869] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.707211][ T6869] RIP: 0033:0x7ffa23b9e159 [ 114.707230][ T6869] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.707247][ T6869] RSP: 002b:00007ffa24acb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000074 [ 114.707270][ T6869] RAX: ffffffffffffffda RBX: 00007ffa23e25fa0 RCX: 00007ffa23b9e159 [ 114.707291][ T6869] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 114.707303][ T6869] RBP: 00007ffa23c3506b R08: 0000000000000000 R09: 0000000000000000 [ 114.707315][ T6869] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 114.707328][ T6869] R13: 00007ffa23e26038 R14: 00007ffa23e25fa0 R15: 00007ffc98e6c638 [ 114.707357][ T6869] [ 114.773792][ T6870] loop5: detected capacity change from 0 to 1024 [ 114.785545][ T6870] EXT4-fs: Ignoring removed orlov option [ 114.847846][ T6870] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 114.860176][ T5714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 114.869342][ T5612] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 115.048508][ T6870] overlayfs: invalid origin (00000079000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000) [ 115.069842][ T6876] netlink: 8 bytes leftover after parsing attributes in process `syz.2.311'. [ 115.291632][ T5611] ocfs2: Unmounting device (7,4) on (node local) [ 115.332945][ T5850] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 115.449212][ T6878] loop1: detected capacity change from 0 to 32768 [ 115.535213][ T6878] XFS (loop1): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 115.600579][ T6897] FAULT_INJECTION: forcing a failure. [ 115.600579][ T6897] name failslab, interval 1, probability 0, space 0, times 0 [ 115.600613][ T6897] CPU: 0 UID: 0 PID: 6897 Comm: syz.0.317 Not tainted syzkaller #0 PREEMPT(full) [ 115.600650][ T6897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 115.600662][ T6897] Call Trace: [ 115.600669][ T6897] [ 115.600677][ T6897] dump_stack_lvl+0xe8/0x150 [ 115.600703][ T6897] should_fail_ex+0x3eb/0x540 [ 115.600732][ T6897] should_failslab+0xa8/0x100 [ 115.600755][ T6897] kmem_cache_alloc_lru_noprof+0xa2/0x5f0 [ 115.600775][ T6897] ? __lock_acquire+0x747/0x2de0 [ 115.600795][ T6897] ? __d_alloc+0x37/0x7f0 [ 115.600812][ T6897] ? __d_alloc+0x37/0x7f0 [ 115.600834][ T6897] __d_alloc+0x37/0x7f0 [ 115.600857][ T6897] d_alloc_pseudo+0x21/0xc0 [ 115.600878][ T6897] alloc_path_pseudo+0x107/0x220 [ 115.600901][ T6897] ? __pfx_alloc_path_pseudo+0x10/0x10 [ 115.600929][ T6897] alloc_file_pseudo+0xa8/0x1e0 [ 115.600951][ T6897] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 115.600981][ T6897] anon_inode_getfd+0xca/0x1f0 [ 115.601006][ T6897] __se_sys_fsopen+0x232/0x2c0 [ 115.601029][ T6897] do_syscall_64+0x166/0x520 [ 115.601047][ T6897] ? trace_irq_disable+0x3b/0x140 [ 115.601065][ T6897] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.601085][ T6897] ? clear_bhb_loop+0x70/0xc0 [ 115.601107][ T6897] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.601126][ T6897] RIP: 0033:0x7f3e8959e159 [ 115.601145][ T6897] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 115.601161][ T6897] RSP: 002b:00007f3e8a52d028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 115.601182][ T6897] RAX: ffffffffffffffda RBX: 00007f3e89825fa0 RCX: 00007f3e8959e159 [ 115.601196][ T6897] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100 [ 115.601208][ T6897] RBP: 00007f3e8963506b R08: 0000000000000000 R09: 0000000000000000 [ 115.601221][ T6897] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 115.601241][ T6897] R13: 00007f3e89826038 R14: 00007f3e89825fa0 R15: 00007ffc90dc9eb8 [ 115.601273][ T6897] [ 115.688258][ T6878] XFS (loop1): Ending clean mount [ 115.751323][ T6878] XFS (loop1): Quotacheck needed: Please wait. [ 115.895571][ T5714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 115.902691][ T6878] XFS (loop1): Quotacheck: Done. [ 115.987415][ T5610] XFS (loop1): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 116.267332][ T5612] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 116.416124][ T5612] usb 6-1: New USB device found: idVendor=27b8, idProduct=01ed, bcdDevice=0.00 [ 116.417150][ T5612] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 116.417178][ T5612] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 116.417213][ T5612] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.469658][ T5612] usb 6-1: config 0 descriptor?? [ 116.768926][ T6937] jffs2: notice: (6937) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 116.832151][ T6940] netlink: 28 bytes leftover after parsing attributes in process `syz.0.335'. [ 116.909668][ T5612] hid-led 0003:27B8:01ED.0004: unknown main item tag 0x0 [ 116.909705][ T5612] hid-led 0003:27B8:01ED.0004: unknown main item tag 0x0 [ 116.909730][ T5612] hid-led 0003:27B8:01ED.0004: unknown main item tag 0x0 [ 116.909756][ T5612] hid-led 0003:27B8:01ED.0004: unknown main item tag 0x0 [ 116.909781][ T5612] hid-led 0003:27B8:01ED.0004: unknown main item tag 0x0 [ 116.959214][ T4942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 116.990228][ T6943] netlink: 8 bytes leftover after parsing attributes in process `syz.2.336'. [ 117.095874][ T5612] hid-led 0003:27B8:01ED.0004: probe with driver hid-led failed with error -71 [ 117.123329][ T6951] sctp: [Deprecated]: syz.4.338 (pid 6951) Use of struct sctp_assoc_value in delayed_ack socket option. [ 117.123329][ T6951] Use struct sctp_sack_info instead [ 117.150677][ T5612] usb 6-1: USB disconnect, device number 5 [ 117.710651][ T6947] loop0: detected capacity change from 0 to 32768 [ 117.798869][ T33] audit: type=1800 audit(1790784406.389:47): pid=6947 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.337" name="file1" dev="loop0" ino=4 res=0 errno=-22 [ 117.895476][ T5706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 117.978121][ T32] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 118.125045][ T6972] loop0: detected capacity change from 0 to 2048 [ 118.193382][ T6975] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 118.316656][ T6974] loop4: detected capacity change from 0 to 32768 [ 118.558243][ T6978] loop2: detected capacity change from 0 to 1024 [ 118.569935][ T6978] EXT4-fs: Ignoring removed nomblk_io_submit option [ 118.623743][ T6978] EXT4-fs (loop2): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 118.623896][ T6978] ext4 filesystem being mounted at /67/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 118.650662][ T6985] loop1: detected capacity change from 0 to 2048 [ 118.679378][ T6985] UDF-fs: error (device loop1): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 118.681292][ T6985] UDF-fs: error (device loop1): udf_read_tagged: tag checksum failed, block 160: 0xd2 != 0xd4 [ 118.689212][ T6985] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 118.779416][ T6978] EXT4-fs error (device loop2): ext4_map_blocks:832: inode #15: comm syz.2.356: lblock 0 mapped to illegal pblock 0 (length 1) [ 118.810737][ T6978] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 118.810771][ T6978] EXT4-fs (loop2): This should not happen!! Data will be lost [ 118.810771][ T6978] [ 118.888108][ T6990] EXT4-fs error (device loop2): ext4_validate_block_bitmap:445: comm syz.2.356: bg 0: block 112: padding at end of block bitmap is not set [ 118.920378][ T6990] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 16 with max blocks 51 with error 28 [ 118.920409][ T6990] EXT4-fs (loop2): This should not happen!! Data will be lost [ 118.920409][ T6990] [ 118.920423][ T6990] EXT4-fs (loop2): Total free blocks count 0 [ 118.920437][ T6990] EXT4-fs (loop2): Free/Dirty block details [ 118.920450][ T6990] EXT4-fs (loop2): free_blocks=0 [ 118.920463][ T6990] EXT4-fs (loop2): dirty_blocks=64 [ 118.920475][ T6990] EXT4-fs (loop2): Block reservation details [ 119.016500][ T32] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 119.192002][ T6992] loop0: detected capacity change from 0 to 32768 [ 119.208224][ T6992] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 119.208243][ T6992] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 119.249343][ T6992] gfs2: fsid=syz:syz.0: journal 0 mapped with 1 extents in 0ms [ 119.255678][ T993] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 119.255695][ T993] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 119.322473][ T7001] FAULT_INJECTION: forcing a failure. [ 119.322473][ T7001] name failslab, interval 1, probability 0, space 0, times 0 [ 119.322519][ T7001] CPU: 0 UID: 0 PID: 7001 Comm: syz.1.351 Not tainted syzkaller #0 PREEMPT(full) [ 119.322543][ T7001] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 119.322555][ T7001] Call Trace: [ 119.322563][ T7001] [ 119.322572][ T7001] dump_stack_lvl+0xe8/0x150 [ 119.322611][ T7001] should_fail_ex+0x3eb/0x540 [ 119.322637][ T7001] should_failslab+0xa8/0x100 [ 119.322657][ T7001] ? prepare_creds+0x30/0x820 [ 119.322676][ T7001] kmem_cache_alloc_noprof+0x9c/0x600 [ 119.322699][ T7001] ? prepare_creds+0x30/0x820 [ 119.322723][ T7001] prepare_creds+0x30/0x820 [ 119.322747][ T7001] cap_task_prctl+0x550/0xa40 [ 119.322771][ T7001] security_task_prctl+0xf6/0x190 [ 119.322798][ T7001] __se_sys_prctl+0xbf/0x1910 [ 119.322823][ T7001] ? __pfx___se_sys_prctl+0x10/0x10 [ 119.322847][ T7001] ? __x64_sys_prctl+0x20/0xc0 [ 119.322868][ T7001] do_syscall_64+0x166/0x520 [ 119.322887][ T7001] ? trace_irq_disable+0x3b/0x140 [ 119.322904][ T7001] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.322924][ T7001] ? clear_bhb_loop+0x70/0xc0 [ 119.322950][ T7001] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.322970][ T7001] RIP: 0033:0x7ffa23b9e159 [ 119.322993][ T7001] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.323013][ T7001] RSP: 002b:00007ffa24acb028 EFLAGS: 00000246 ORIG_RAX: 000000000000009d [ 119.323038][ T7001] RAX: ffffffffffffffda RBX: 00007ffa23e25fa0 RCX: 00007ffa23b9e159 [ 119.323053][ T7001] RDX: 0000000000000014 RSI: 0000000000000003 RDI: 000000000000002f [ 119.323065][ T7001] RBP: 00007ffa23c3506b R08: 0000000000000000 R09: 0000000000000000 [ 119.323078][ T7001] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 119.323089][ T7001] R13: 00007ffa23e26038 R14: 00007ffa23e25fa0 R15: 00007ffc98e6c638 [ 119.323121][ T7001] [ 119.678798][ T993] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 423ms [ 119.680236][ T993] gfs2: fsid=syz:syz.0: jid=0: Done [ 119.680278][ T6992] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 119.784884][ T7011] netlink: 20 bytes leftover after parsing attributes in process `syz.2.357'. [ 119.785032][ T7011] Zero length message leads to an empty skb [ 120.004638][ T6994] loop5: detected capacity change from 0 to 40427 [ 120.032183][ T6994] F2FS-fs (loop5): Invalid SB checksum offset: 0 [ 120.032204][ T6994] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 120.050215][ T6994] F2FS-fs (loop5): invalid crc value [ 120.062276][ T32] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 120.135822][ T5612] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 120.285608][ T5612] usb 2-1: Using ep0 maxpacket: 8 [ 120.286798][ T5612] usb 2-1: New USB device found: idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 120.310513][ T5612] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 120.310539][ T5612] usb 2-1: config 0 has no interface number 0 [ 120.310576][ T5612] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 120.310598][ T5612] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 120.310621][ T5612] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 120.310645][ T5612] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 120.310684][ T5612] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 120.388746][ T5612] usb 2-1: config 0 descriptor?? [ 120.419516][ T5612] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 120.432101][ T6994] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 120.453067][ T6994] F2FS-fs (loop5): Try to recover 2th superblock, ret: 0 [ 120.453093][ T6994] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 120.544593][ T33] audit: type=1800 audit(1790784409.129:48): pid=6994 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.349" name="file1" dev="loop5" ino=10 res=0 errno=-22 [ 120.621055][ T993] usb 2-1: USB disconnect, device number 12 [ 120.621172][ C0] ldusb 2-1:0.55: usb_submit_urb failed (-19) [ 120.653570][ T993] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 120.936891][ T993] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 121.095565][ T5612] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 121.172602][ T6994] syz.5.349: attempt to access beyond end of device [ 121.172602][ T6994] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 121.193493][ T6994] CPU: 1 UID: 0 PID: 6994 Comm: syz.5.349 Not tainted syzkaller #0 PREEMPT(full) [ 121.193519][ T6994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 121.193530][ T6994] Call Trace: [ 121.193538][ T6994] [ 121.193547][ T6994] dump_stack_lvl+0xe8/0x150 [ 121.193574][ T6994] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 121.193602][ T6994] f2fs_write_end_bio+0xda7/0x11c0 [ 121.193642][ T6994] __submit_merged_bio+0x258/0x6a0 [ 121.193662][ T6994] ? rcu_is_watching+0x16/0xb0 [ 121.193688][ T6994] f2fs_submit_merged_write_cond+0x1ef/0x590 [ 121.193713][ T6994] ? __pfx_f2fs_submit_merged_write_cond+0x10/0x10 [ 121.193769][ T6994] f2fs_write_data_pages+0x2a13/0x36e0 [ 121.193789][ T6994] ? ktime_get+0x1f5/0x220 [ 121.193846][ T6994] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 121.193882][ T6994] ? is_bpf_text_address+0x292/0x2b0 [ 121.193901][ T6994] ? is_bpf_text_address+0x26/0x2b0 [ 121.193950][ T6994] ? stack_trace_save+0xa9/0x100 [ 121.193970][ T6994] ? __pfx_stack_trace_save+0x10/0x10 [ 121.194009][ T6994] ? lockdep_unlock+0x5c/0xd0 [ 121.194026][ T6994] ? __lock_acquire+0x1511/0x2de0 [ 121.194076][ T6994] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 121.194098][ T6994] do_writepages+0x338/0x560 [ 121.194131][ T6994] ? do_raw_spin_unlock+0xf5/0x200 [ 121.194156][ T6994] filemap_fdatawrite+0x1e9/0x2f0 [ 121.194181][ T6994] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 121.194252][ T6994] ? do_raw_spin_unlock+0xf5/0x200 [ 121.194277][ T6994] f2fs_sync_dirty_inodes+0x471/0x970 [ 121.194315][ T6994] f2fs_write_checkpoint+0x860/0x24d0 [ 121.194376][ T6994] f2fs_gc+0x1ee9/0x25b0 [ 121.194393][ T6994] ? look_up_lock_class+0x57/0x110 [ 121.194447][ T6994] ? __pfx_f2fs_gc+0x10/0x10 [ 121.194498][ T6994] ? __pfx_f2fs_submit_all_merged_ipu_writes+0x10/0x10 [ 121.194523][ T6994] ? rcu_is_watching+0x16/0xb0 [ 121.194546][ T6994] f2fs_balance_fs+0x61c/0x810 [ 121.194571][ T6994] ? __pfx_f2fs_balance_fs+0x10/0x10 [ 121.194587][ T6994] ? rcu_is_watching+0x16/0xb0 [ 121.194605][ T6994] ? __up_read+0x29c/0x930 [ 121.194636][ T6994] ? trace_lock_elapsed_time_end+0xf1/0xbc0 [ 121.194654][ T6994] ? restore_priority+0x1af/0x450 [ 121.194679][ T6994] f2fs_map_blocks+0x3df8/0x4c40 [ 121.194754][ T6994] ? __pfx_f2fs_map_blocks+0x10/0x10 [ 121.194772][ T6994] ? invalidate_inode_pages2_range+0xa71/0xb20 [ 121.194805][ T6994] ? __pfx_invalidate_inode_pages2_range+0x10/0x10 [ 121.194829][ T6994] ? filemap_check_errors+0xd2/0x120 [ 121.194848][ T6994] ? __f2fs_overwrite_io+0xda/0x3e0 [ 121.194876][ T6994] ? __pfx_filemap_write_and_wait_range+0x10/0x10 [ 121.194914][ T6994] f2fs_iomap_next+0x41b/0xc60 [ 121.194946][ T6994] ? __pfx_f2fs_iomap_next+0x10/0x10 [ 121.194974][ T6994] ? rcu_is_watching+0x16/0xb0 [ 121.194997][ T6994] ? __kasan_kmalloc+0x93/0xb0 [ 121.195025][ T6994] iomap_iter+0xe2/0xec0 [ 121.195046][ T6994] ? blk_start_plug+0x6e/0x1b0 [ 121.195069][ T6994] __iomap_dio_rw+0xc87/0x1c40 [ 121.195111][ T6994] ? __lock_acquire+0x747/0x2de0 [ 121.195136][ T6994] ? __pfx___iomap_dio_rw+0x10/0x10 [ 121.195178][ T6994] ? lock_acquire+0x115/0x350 [ 121.195217][ T6994] ? down_read+0x2b9/0x320 [ 121.195238][ T6994] f2fs_file_write_iter+0x1a70/0x2c10 [ 121.195287][ T6994] ? __pfx_f2fs_file_write_iter+0x10/0x10 [ 121.195327][ T6994] vfs_write+0x612/0xba0 [ 121.195357][ T6994] ? __pfx_vfs_write+0x10/0x10 [ 121.195381][ T6994] ? __fget_files+0x3a2/0x420 [ 121.195399][ T6994] ? __fget_files+0x2a/0x420 [ 121.195421][ T6994] ? fdget+0x1ac/0x250 [ 121.195447][ T6994] ksys_write+0x150/0x270 [ 121.195468][ T6994] ? __pfx_ksys_write+0x10/0x10 [ 121.195499][ T6994] do_syscall_64+0x166/0x520 [ 121.195516][ T6994] ? trace_irq_disable+0x3b/0x140 [ 121.195533][ T6994] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.195554][ T6994] ? clear_bhb_loop+0x70/0xc0 [ 121.195576][ T6994] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.195596][ T6994] RIP: 0033:0x7f8844f9e159 [ 121.195615][ T6994] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 121.195632][ T6994] RSP: 002b:00007f8845f2d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 121.195654][ T6994] RAX: ffffffffffffffda RBX: 00007f8845225fa0 RCX: 00007f8844f9e159 [ 121.195669][ T6994] RDX: 00000000ffffffd7 RSI: 0000200000000000 RDI: 0000000000000004 [ 121.195682][ T6994] RBP: 00007f884503506b R08: 0000000000000000 R09: 0000000000000000 [ 121.195694][ T6994] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 121.195706][ T6994] R13: 00007f8845226038 R14: 00007f8845225fa0 R15: 00007fffebc17ec8 [ 121.195769][ T6994] [ 121.357013][ T6994] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 121.357521][ T6994] syz.5.349: attempt to access beyond end of device [ 121.357521][ T6994] loop5: rw=34817, sector=53256, nr_sectors = 8 limit=40427 [ 121.529210][ T7036] CacheFiles: Failed to register: -95 [ 121.655539][ T993] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 121.806084][ T993] usb 3-1: New USB device found: idVendor=104f, idProduct=0004, bcdDevice=1.00 [ 121.807311][ T993] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 121.807336][ T993] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 121.808824][ T993] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 121.808847][ T993] usb 3-1: Product: syz [ 121.808861][ T993] usb 3-1: Manufacturer: syz [ 121.842235][ T993] iuu_phoenix 3-1:1.0: iuu_phoenix converter detected [ 121.860559][ T993] usb 3-1: iuu_phoenix converter now attached to ttyUSB0 [ 121.906978][ T7032] loop0: detected capacity change from 0 to 32768 [ 121.909880][ T7032] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.362 (7032) [ 121.938529][ T7032] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 121.938560][ T7032] BTRFS info (device loop0): using crc32c checksum algorithm [ 122.092202][ T7032] BTRFS info (device loop0): enabling ssd optimizations [ 122.092228][ T7032] BTRFS info (device loop0): turning on flush-on-commit [ 122.092243][ T7032] BTRFS info (device loop0): enabling free space tree [ 122.092258][ T7032] BTRFS info (device loop0): enabling auto defrag [ 122.092275][ T7032] BTRFS info (device loop0): use lzo compression, level 1 [ 122.092293][ T7032] BTRFS info (device loop0): max_inline set to 0 [ 122.135629][ T5612] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 122.291874][ T5608] BTRFS info (device loop0): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 122.315314][ T32] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 122.469215][ T32] usb 5-1: Using ep0 maxpacket: 32 [ 122.469941][ T32] usb 5-1: New USB device found: idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 122.472010][ T32] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 122.472033][ T32] usb 5-1: config 0 has no interface number 0 [ 122.509855][ T32] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.509883][ T32] usb 5-1: Product: syz [ 122.509897][ T32] usb 5-1: Manufacturer: syz [ 122.509910][ T32] usb 5-1: SerialNumber: syz [ 122.524211][ T32] usb 5-1: config 0 descriptor?? [ 122.745349][ T4942] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 122.896862][ T4942] usb 6-1: Using ep0 maxpacket: 8 [ 122.897719][ T4942] usb 6-1: New USB device found: idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 122.898871][ T4942] usb 6-1: config index 0 descriptor too short (expected 74, got 45) [ 122.898916][ T4942] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 122.898941][ T4942] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 122.898964][ T4942] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 122.898987][ T4942] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 122.899009][ T4942] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 122.899047][ T4942] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.007735][ T32] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 123.007765][ T32] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 123.092513][ T7087] FAULT_INJECTION: forcing a failure. [ 123.092513][ T7087] name failslab, interval 1, probability 0, space 0, times 0 [ 123.092544][ T7087] CPU: 1 UID: 0 PID: 7087 Comm: syz.0.375 Not tainted syzkaller #0 PREEMPT(full) [ 123.092567][ T7087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 123.092579][ T7087] Call Trace: [ 123.092586][ T7087] [ 123.092595][ T7087] dump_stack_lvl+0xe8/0x150 [ 123.092624][ T7087] should_fail_ex+0x3eb/0x540 [ 123.092649][ T7087] should_failslab+0xa8/0x100 [ 123.092672][ T7087] __kmalloc_cache_noprof+0x9e/0x600 [ 123.092692][ T7087] ? getname_long+0x50/0x130 [ 123.092709][ T7087] ? getname_long+0x50/0x130 [ 123.092735][ T7087] getname_long+0x50/0x130 [ 123.092754][ T7087] do_getname+0x181/0x250 [ 123.092778][ T7087] __se_sys_symlink+0x3a/0x2b0 [ 123.092800][ T7087] do_syscall_64+0x166/0x520 [ 123.092820][ T7087] ? trace_irq_disable+0x3b/0x140 [ 123.092838][ T7087] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.092859][ T7087] ? clear_bhb_loop+0x70/0xc0 [ 123.092880][ T7087] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.092901][ T7087] RIP: 0033:0x7f3e8959e159 [ 123.092920][ T7087] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.092936][ T7087] RSP: 002b:00007f3e8a52d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 123.092959][ T7087] RAX: ffffffffffffffda RBX: 00007f3e89825fa0 RCX: 00007f3e8959e159 [ 123.092974][ T7087] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000000 [ 123.092987][ T7087] RBP: 00007f3e8963506b R08: 0000000000000000 R09: 0000000000000000 [ 123.093000][ T7087] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 123.093017][ T7087] R13: 00007f3e89826038 R14: 00007f3e89825fa0 R15: 00007ffc90dc9eb8 [ 123.093046][ T7087] [ 123.111470][ T7034] iuu_phoenix ttyUSB0: iuu_open - failed submitting read urb, error -90 [ 123.117748][ T5714] usb 3-1: USB disconnect, device number 8 [ 123.170107][ T5714] iuu_phoenix ttyUSB0: iuu_phoenix converter now disconnected from ttyUSB0 [ 123.171367][ T4942] usb 6-1: usb_control_msg returned -32 [ 123.171409][ T4942] usbtmc 6-1:16.0: can't read capabilities [ 123.184934][ T5714] iuu_phoenix 3-1:1.0: device disconnected [ 123.211082][ T5612] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 123.476651][ T32] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000108: -71 [ 123.477161][ T32] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -71 [ 123.506143][ T32] usb 5-1: USB disconnect, device number 8 [ 123.724137][ T7101] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 123.820431][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 123.988811][ T5706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 124.216654][ T5791] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 124.226427][ T5714] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 124.375855][ T5714] usb 1-1: Using ep0 maxpacket: 16 [ 124.379355][ T5714] usb 1-1: New USB device found: idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 124.380366][ T5714] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 124.380384][ T5714] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 124.382408][ T5714] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.382429][ T5714] usb 1-1: Product: syz [ 124.382442][ T5714] usb 1-1: Manufacturer: syz [ 124.382456][ T5714] usb 1-1: SerialNumber: syz [ 124.389393][ T5714] usb 1-1: config 0 descriptor?? [ 124.395666][ T5714] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 124.395709][ T5714] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 125.024710][ T5714] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 125.028353][ T5714] em28xx 1-1:0.0: Config register raw data: 0x41 [ 125.196782][ T7130] loop2: detected capacity change from 0 to 4096 [ 125.202112][ T7130] ntfs3(loop2): Different NTFS sector size (4096) and media sector size (512). [ 125.255631][ T5714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 125.257514][ T10] usb 1-1: USB disconnect, device number 7 [ 125.259781][ T10] em28xx 1-1:0.0: Disconnecting em28xx [ 125.300056][ T10] em28xx: Freeing device [ 125.315039][ T7130] ntfs3(loop2): ino=3, ntfs_set_state failed, -22. [ 125.315068][ T7130] ntfs3(loop2): Failed to initialize $Extend/$Reparse. [ 125.400548][ T7130] ntfs3(loop2): ino=1e, mi_enum_attr [ 125.400575][ T7130] ntfs3(loop2): ino=1e, mi_enum_attr [ 125.474406][ T1519] ntfs3(loop2): ino=3, ntfs3_write_inode failed, -22. [ 125.490269][ T5621] ntfs3(loop2): ino=3, ntfs_set_state failed, -22. [ 125.490300][ T5621] ntfs3(loop2): Mark volume as dirty due to NTFS errors [ 125.490316][ T5621] ntfs3(loop2): ino=3, ntfs_set_state failed, -22. [ 125.491777][ T1519] ntfs3(loop2): ino=3, ntfs3_write_inode failed, -22. [ 125.538561][ T32] usb 6-1: USB disconnect, device number 6 [ 125.895706][ T7132] loop2: detected capacity change from 0 to 32768 [ 125.901447][ T7132] (syz.2.389,7132,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 125.925701][ T7132] (syz.2.389,7132,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 125.965112][ T7132] JBD2: Ignoring recovery information on journal [ 126.012725][ T7132] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 126.197273][ T32] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 126.300137][ T5714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 126.334117][ T5621] ocfs2: Unmounting device (7,2) on (node local) [ 126.357721][ T32] usb 6-1: New USB device found: idVendor=104f, idProduct=0004, bcdDevice=1.00 [ 126.362972][ T32] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 126.362997][ T32] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 126.366719][ T32] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 126.366741][ T32] usb 6-1: Product: syz [ 126.366755][ T32] usb 6-1: Manufacturer: syz [ 126.405316][ T32] iuu_phoenix 6-1:1.0: iuu_phoenix converter detected [ 126.424198][ T32] usb 6-1: iuu_phoenix converter now attached to ttyUSB0 [ 126.484947][ T7149] netlink: 16 bytes leftover after parsing attributes in process `syz.1.398'. [ 126.700907][ T7156] netlink: 'syz.4.400': attribute type 11 has an invalid length. [ 126.914929][ T7165] netlink: 8 bytes leftover after parsing attributes in process `syz.1.404'. [ 127.019817][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 127.305337][ T4942] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 127.335518][ T32] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 127.368389][ T7177] loop4: detected capacity change from 0 to 256 [ 127.372033][ T7171] loop1: detected capacity change from 0 to 40427 [ 127.374981][ T7177] exfat: Deprecated parameter 'utf8' [ 127.382942][ T7171] F2FS-fs (loop1): Corrupted extension count (327717 + 1 > 64) [ 127.382990][ T7171] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 127.395519][ T7171] F2FS-fs (loop1): build fault injection rate: 771 [ 127.396229][ T7177] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0xffade8b4, utbl_chksum : 0xe619d30d) [ 127.398710][ T7171] F2FS-fs (loop1): invalid crc value [ 127.456053][ T4942] usb 3-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 127.457175][ T4942] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 127.457246][ T4942] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 127.457269][ T4942] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 127.458876][ T4942] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 127.458898][ T4942] usb 3-1: Product: syz [ 127.458936][ T4942] usb 3-1: Manufacturer: syz [ 127.463551][ T7173] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 127.472892][ T4942] garmin_gps 3-1:1.0: Garmin GPS usb/tty converter detected [ 127.509009][ T10] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 127.536915][ T4942] usb 3-1: Garmin GPS usb/tty converter now attached to ttyUSB1 [ 127.646394][ T7171] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 127.661580][ T7171] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 127.661605][ T7171] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 127.695399][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 127.697349][ T10] usb 1-1: New USB device found: idVendor=1e7d, idProduct=2d5a, bcdDevice=0.00 [ 127.700437][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 127.700465][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 127.700501][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.731593][ T10] usb 1-1: config 0 descriptor?? [ 127.745955][ T7134] iuu_phoenix ttyUSB0: iuu_open - failed submitting read urb, error -90 [ 127.755056][ T7173] iuu_phoenix ttyUSB0: iuu_open - failed submitting read urb, error -90 [ 127.774204][ T5706] usb 6-1: USB disconnect, device number 7 [ 127.792819][ T5706] iuu_phoenix ttyUSB0: iuu_phoenix converter now disconnected from ttyUSB0 [ 127.793447][ T5706] iuu_phoenix 6-1:1.0: device disconnected [ 127.802207][ T4942] usb 3-1: USB disconnect, device number 9 [ 127.849832][ T4942] garmin_gps ttyUSB1: Garmin GPS usb/tty converter now disconnected from ttyUSB1 [ 127.850458][ T4942] garmin_gps 3-1:1.0: device disconnected [ 127.873018][ T7182] F2FS-fs (loop1): Stopped filesystem due to reason: 0 [ 128.202836][ T10] savu 0003:1E7D:2D5A.0005: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.0-1/input0 [ 128.376740][ T4942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 128.467024][ T5714] usb 1-1: USB disconnect, device number 8 [ 128.489935][ T10] usb 5-1: new low-speed USB device number 9 using dummy_hcd [ 128.504212][ T7200] loop2: detected capacity change from 0 to 512 [ 128.512441][ T7200] EXT4-fs: Ignoring removed bh option [ 128.542189][ T7200] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a842c128, mo2=0002] [ 128.542310][ T7200] System zones: 1-12 [ 128.560388][ T7200] EXT4-fs (loop2): 1 truncate cleaned up [ 128.568185][ T7200] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 128.636171][ T10] usb 5-1: New USB device found: idVendor=1b1c, idProduct=1c1f, bcdDevice=0.00 [ 128.637299][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 128.637327][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 64, setting to 8 [ 128.637350][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 128.637386][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.640565][ T10] usb 5-1: config 0 descriptor?? [ 128.644366][ T7193] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 128.749276][ T5621] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 128.926904][ T7216] overlayfs: failed to decode file handle (len=5, type=248, flags=0, err=-22) [ 129.083465][ T10] corsair-psu 0003:1B1C:1C1F.0006: unknown main item tag 0x3 [ 129.083675][ T10] corsair-psu 0003:1B1C:1C1F.0006: unknown main item tag 0x0 [ 129.083703][ T10] corsair-psu 0003:1B1C:1C1F.0006: unknown main item tag 0x0 [ 129.083725][ T10] corsair-psu 0003:1B1C:1C1F.0006: unknown main item tag 0x0 [ 129.083750][ T10] corsair-psu 0003:1B1C:1C1F.0006: unknown main item tag 0x0 [ 129.083774][ T10] corsair-psu 0003:1B1C:1C1F.0006: unknown main item tag 0x0 [ 129.083797][ T10] corsair-psu 0003:1B1C:1C1F.0006: unknown main item tag 0x0 [ 129.083822][ T10] corsair-psu 0003:1B1C:1C1F.0006: unknown main item tag 0x0 [ 129.083846][ T10] corsair-psu 0003:1B1C:1C1F.0006: unknown main item tag 0x0 [ 129.104404][ T7220] loop2: detected capacity change from 0 to 4096 [ 129.111823][ T7220] ntfs3(loop2): Different NTFS sector size (4096) and media sector size (512). [ 129.181085][ T10] corsair-psu 0003:1B1C:1C1F.0006: hidraw0: USB HID v0.04 Device [HID 1b1c:1c1f] on usb-dummy_hcd.4-1/input0 [ 129.232994][ T7220] ntfs3(loop2): ino=19, mi_enum_attr [ 129.244636][ T7220] ntfs3(loop2): Failed to initialize $Extend/$ObjId. [ 129.253201][ T10] corsair-psu 0003:1B1C:1C1F.0006: unable to initialize device (-38) [ 129.276528][ T10] corsair-psu 0003:1B1C:1C1F.0006: probe with driver corsair-psu failed with error -38 [ 129.340544][ T32] usb 5-1: USB disconnect, device number 9 [ 129.374595][ T7224] fido_id[7224]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 129.418511][ T5714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 129.470425][ T7218] loop1: detected capacity change from 0 to 32768 [ 129.546760][ T7218] JBD2: Ignoring recovery information on journal [ 129.616858][ T7218] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 129.707545][ T5610] ocfs2: Unmounting device (7,1) on (node local) [ 129.787524][ T5714] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 129.800273][ T7229] loop5: detected capacity change from 0 to 32768 [ 129.822368][ T7229] (syz.5.429,7229,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 129.829010][ T7229] (syz.5.429,7229,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 129.894043][ T7229] JBD2: Ignoring recovery information on journal [ 129.943109][ T7229] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 129.943912][ T5714] usb 1-1: New USB device found: idVendor=104f, idProduct=0004, bcdDevice=1.00 [ 129.946768][ T5714] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 129.946792][ T5714] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 129.948725][ T5714] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 129.948747][ T5714] usb 1-1: Product: syz [ 129.948759][ T5714] usb 1-1: Manufacturer: syz [ 129.970381][ T5714] iuu_phoenix 1-1:1.0: iuu_phoenix converter detected [ 129.994600][ T5714] usb 1-1: iuu_phoenix converter now attached to ttyUSB0 [ 130.058614][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 130.246747][ T5850] ocfs2: Unmounting device (7,5) on (node local) [ 130.440789][ T7244] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 130.455934][ T5714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 130.618243][ T7239] loop1: detected capacity change from 0 to 40427 [ 130.633494][ T7239] F2FS-fs (loop1): Corrupted extension count (64 + 1 > 64) [ 130.633520][ T7239] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 130.654972][ T7239] F2FS-fs (loop1): Image doesn't support compression [ 130.679251][ T7239] F2FS-fs (loop1): invalid crc value [ 130.774421][ T7239] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 130.789126][ T7239] F2FS-fs (loop1): f2fs_disable_checkpoint starts, unusable: 0 [ 130.789151][ T7239] F2FS-fs (loop1): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 130.789175][ T7239] F2FS-fs (loop1): Start checkpoint disabled! [ 130.822030][ T7239] F2FS-fs (loop1): f2fs_disable_checkpoint finishes, err:0 [ 130.824267][ T7239] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 130.824290][ T7239] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 131.011460][ T7239] VFS:Filesystem freeze failed [ 131.257187][ T7227] iuu_phoenix ttyUSB0: iuu_open - failed submitting read urb, error -90 [ 131.278861][ T5706] usb 1-1: USB disconnect, device number 9 [ 131.324925][ T5706] iuu_phoenix ttyUSB0: iuu_phoenix converter now disconnected from ttyUSB0 [ 131.334842][ T5706] iuu_phoenix 1-1:1.0: device disconnected [ 131.410709][ T7263] netlink: 5 bytes leftover after parsing attributes in process `syz.5.442'. [ 131.480832][ T7265] batadv_slave_0: entered promiscuous mode [ 131.482015][ T7264] batadv_slave_0: left promiscuous mode [ 131.497432][ T4942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 131.678795][ T7271] input: syz0 as /devices/virtual/input/input11 [ 131.902128][ T7254] loop2: detected capacity change from 0 to 40427 [ 131.914198][ T7254] F2FS-fs (loop2): Invalid SB checksum offset: 0 [ 131.914219][ T7254] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 131.921337][ T7254] F2FS-fs (loop2): invalid crc value [ 131.949377][ T7260] loop4: detected capacity change from 0 to 32768 [ 132.060356][ T33] audit: type=1800 audit(1790784420.649:49): pid=7260 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.439" name="file1" dev="loop4" ino=4 res=0 errno=-22 [ 132.391708][ T7254] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 132.458222][ T7254] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0 [ 132.458250][ T7254] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 132.536579][ T5714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 132.643733][ T33] audit: type=1800 audit(1790784421.229:50): pid=7254 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.436" name="file1" dev="loop2" ino=10 res=0 errno=-22 [ 132.772043][ T7311] syzkaller1: entered promiscuous mode [ 132.772066][ T7311] syzkaller1: entered allmulticast mode [ 132.784491][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.784546][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.096729][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 133.303650][ T7326] device-mapper: ioctl: device name cannot be "control", ".", or ".." [ 133.418743][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 133.510939][ T7254] syz.2.436: attempt to access beyond end of device [ 133.510939][ T7254] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 133.514756][ T7254] CPU: 0 UID: 0 PID: 7254 Comm: syz.2.436 Not tainted syzkaller #0 PREEMPT(full) [ 133.514784][ T7254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 133.514797][ T7254] Call Trace: [ 133.514805][ T7254] [ 133.514814][ T7254] dump_stack_lvl+0xe8/0x150 [ 133.514844][ T7254] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 133.514873][ T7254] f2fs_write_end_bio+0xda7/0x11c0 [ 133.514914][ T7254] __submit_merged_bio+0x258/0x6a0 [ 133.514934][ T7254] ? rcu_is_watching+0x16/0xb0 [ 133.514962][ T7254] f2fs_submit_merged_write_cond+0x1ef/0x590 [ 133.514987][ T7254] ? __pfx_f2fs_submit_merged_write_cond+0x10/0x10 [ 133.515046][ T7254] f2fs_write_data_pages+0x2a13/0x36e0 [ 133.515109][ T7254] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 133.515144][ T7254] ? is_bpf_text_address+0x292/0x2b0 [ 133.515163][ T7254] ? is_bpf_text_address+0x26/0x2b0 [ 133.515216][ T7254] ? stack_trace_save+0xa9/0x100 [ 133.515233][ T7254] ? __pfx_stack_trace_save+0x10/0x10 [ 133.515269][ T7254] ? lockdep_unlock+0x5c/0xd0 [ 133.515286][ T7254] ? __lock_acquire+0x1511/0x2de0 [ 133.515332][ T7254] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 133.515354][ T7254] do_writepages+0x338/0x560 [ 133.515387][ T7254] ? do_raw_spin_unlock+0xf5/0x200 [ 133.515412][ T7254] filemap_fdatawrite+0x1e9/0x2f0 [ 133.515437][ T7254] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 133.515508][ T7254] ? do_raw_spin_unlock+0xf5/0x200 [ 133.515533][ T7254] f2fs_sync_dirty_inodes+0x471/0x970 [ 133.515572][ T7254] f2fs_write_checkpoint+0x860/0x24d0 [ 133.515635][ T7254] f2fs_gc+0x1ee9/0x25b0 [ 133.515654][ T7254] ? look_up_lock_class+0x57/0x110 [ 133.515707][ T7254] ? __pfx_f2fs_gc+0x10/0x10 [ 133.515758][ T7254] ? __pfx_f2fs_submit_all_merged_ipu_writes+0x10/0x10 [ 133.515783][ T7254] ? rcu_is_watching+0x16/0xb0 [ 133.515809][ T7254] f2fs_balance_fs+0x61c/0x810 [ 133.515836][ T7254] ? __pfx_f2fs_balance_fs+0x10/0x10 [ 133.515853][ T7254] ? rcu_is_watching+0x16/0xb0 [ 133.515874][ T7254] ? __up_read+0x29c/0x930 [ 133.515907][ T7254] ? trace_lock_elapsed_time_end+0xf1/0xbc0 [ 133.515926][ T7254] ? restore_priority+0x1af/0x450 [ 133.515955][ T7254] f2fs_map_blocks+0x3df8/0x4c40 [ 133.516030][ T7254] ? __pfx_f2fs_map_blocks+0x10/0x10 [ 133.516047][ T7254] ? invalidate_inode_pages2_range+0xa71/0xb20 [ 133.516081][ T7254] ? __pfx_invalidate_inode_pages2_range+0x10/0x10 [ 133.516106][ T7254] ? filemap_check_errors+0xd2/0x120 [ 133.516125][ T7254] ? __f2fs_overwrite_io+0xda/0x3e0 [ 133.516152][ T7254] ? __pfx_filemap_write_and_wait_range+0x10/0x10 [ 133.516190][ T7254] f2fs_iomap_next+0x41b/0xc60 [ 133.516222][ T7254] ? __pfx_f2fs_iomap_next+0x10/0x10 [ 133.516249][ T7254] ? rcu_is_watching+0x16/0xb0 [ 133.516273][ T7254] ? __kasan_kmalloc+0x93/0xb0 [ 133.516300][ T7254] iomap_iter+0xe2/0xec0 [ 133.516321][ T7254] ? blk_start_plug+0x6e/0x1b0 [ 133.516344][ T7254] __iomap_dio_rw+0xc87/0x1c40 [ 133.516386][ T7254] ? __lock_acquire+0x747/0x2de0 [ 133.516410][ T7254] ? __pfx___iomap_dio_rw+0x10/0x10 [ 133.516452][ T7254] ? lock_acquire+0x115/0x350 [ 133.516491][ T7254] ? down_read+0x2b9/0x320 [ 133.516514][ T7254] f2fs_file_write_iter+0x1a70/0x2c10 [ 133.516565][ T7254] ? __pfx_f2fs_file_write_iter+0x10/0x10 [ 133.516606][ T7254] vfs_write+0x612/0xba0 [ 133.516638][ T7254] ? __pfx_vfs_write+0x10/0x10 [ 133.516662][ T7254] ? __fget_files+0x3a2/0x420 [ 133.516680][ T7254] ? __fget_files+0x2a/0x420 [ 133.516704][ T7254] ? fdget+0x1ac/0x250 [ 133.516731][ T7254] ksys_write+0x150/0x270 [ 133.516754][ T7254] ? __pfx_ksys_write+0x10/0x10 [ 133.516787][ T7254] do_syscall_64+0x166/0x520 [ 133.516806][ T7254] ? trace_irq_disable+0x3b/0x140 [ 133.516823][ T7254] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 133.516844][ T7254] ? clear_bhb_loop+0x70/0xc0 [ 133.516867][ T7254] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 133.516887][ T7254] RIP: 0033:0x7f0909b9e159 [ 133.516905][ T7254] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 133.516921][ T7254] RSP: 002b:00007f090a98e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 133.516943][ T7254] RAX: ffffffffffffffda RBX: 00007f0909e25fa0 RCX: 00007f0909b9e159 [ 133.516958][ T7254] RDX: 00000000ffffffd7 RSI: 0000200000000000 RDI: 0000000000000004 [ 133.516971][ T7254] RBP: 00007f0909c3506b R08: 0000000000000000 R09: 0000000000000000 [ 133.516983][ T7254] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 133.516995][ T7254] R13: 00007f0909e26038 R14: 00007f0909e25fa0 R15: 00007ffeae0c6788 [ 133.517037][ T7254] [ 133.581187][ T5714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 133.597665][ T7254] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 133.598312][ T7254] syz.2.436: attempt to access beyond end of device [ 133.598312][ T7254] loop2: rw=34817, sector=53256, nr_sectors = 8 limit=40427 [ 134.055789][ T4930] Bluetooth: hci1: command 0x0c1a tx timeout [ 134.059248][ T5706] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 134.059280][ T5706] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 134.302309][ T7338] loop0: detected capacity change from 0 to 32768 [ 134.404779][ T7338] ea_get: invalid extended attribute [ 134.615713][ T5714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 134.930707][ T7342] loop1: detected capacity change from 0 to 32768 [ 134.946495][ T7342] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.465 (7342) [ 134.988675][ T7342] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 134.988710][ T7342] BTRFS info (device loop1): using crc32c checksum algorithm [ 135.140946][ T7342] BTRFS info (device loop1): enabling ssd optimizations [ 135.140977][ T7342] BTRFS info (device loop1): turning on async discard [ 135.140993][ T7342] BTRFS info (device loop1): enabling free space tree [ 135.338397][ T2257] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 135.654271][ T7398] loop2: detected capacity change from 0 to 512 [ 135.662174][ T5714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 135.686246][ T2257] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 135.737365][ T5610] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 135.881116][ T2257] hid-generic 0000:0000:0000.0007: hidraw0: HID v0.00 Device [syz1] on syz0 [ 135.979179][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 136.245334][ T4930] Bluetooth: hci2: command 0x0c1a tx timeout [ 136.336063][ T5714] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 136.452042][ T7410] loop0: detected capacity change from 0 to 2048 [ 136.486085][ T5714] usb 3-1: New USB device found: idVendor=0d49, idProduct=7000, bcdDevice=0.01 [ 136.487235][ T5714] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 136.487258][ T5714] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 136.489293][ T5714] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.489315][ T5714] usb 3-1: Product: syz [ 136.489329][ T5714] usb 3-1: Manufacturer: syz [ 136.489343][ T5714] usb 3-1: SerialNumber: syz [ 136.769970][ T5714] usb 3-1: USB disconnect, device number 10 [ 136.897413][ T7403] loop5: detected capacity change from 0 to 131072 [ 136.900187][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 136.901539][ T5706] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 136.901559][ T5706] Bluetooth: hci2: Error when powering off device on rfkill (-110) [ 136.928944][ T32] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 136.943197][ T7403] F2FS-fs (loop5): invalid crc value [ 137.065491][ T7403] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 137.082560][ T7403] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e4 [ 137.130722][ T7410] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 137.130825][ T7410] ext4 filesystem being mounted at /112/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 137.311539][ T7430] EXT4-fs error (device loop0): ext4_validate_block_bitmap:445: comm syz.0.480: bg 0: block 345: padding at end of block bitmap is not set [ 137.351363][ T7430] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 120 with error 117 [ 137.351397][ T7430] EXT4-fs (loop0): This should not happen!! Data will be lost [ 137.351397][ T7430] [ 137.630464][ T1481] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 8 with error 28 [ 137.630497][ T1481] EXT4-fs (loop0): This should not happen!! Data will be lost [ 137.630497][ T1481] [ 137.630511][ T1481] EXT4-fs (loop0): Total free blocks count 0 [ 137.630524][ T1481] EXT4-fs (loop0): Free/Dirty block details [ 137.630556][ T1481] EXT4-fs (loop0): free_blocks=0 [ 137.630582][ T1481] EXT4-fs (loop0): dirty_blocks=208 [ 137.630593][ T1481] EXT4-fs (loop0): Block reservation details [ 137.802187][ T5608] EXT4-fs warning (device loop0): ext4_evict_inode:196: inode #15: comm syz-executor: data will be lost [ 137.975539][ T4942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 138.179425][ T7458] loop0: detected capacity change from 0 to 1024 [ 138.260137][ T7458] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 138.324721][ T33] audit: type=1800 audit(1790784426.909:51): pid=7458 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.485" name="file1" dev="loop0" ino=17 res=0 errno=-22 [ 138.416413][ T7449] loop5: detected capacity change from 0 to 128 [ 138.442406][ T7449] hpfs: hpfs_map_sector(): read error [ 138.442433][ T7449] hpfs: filesystem error: can't load hotfix map; already mounted read-only [ 138.476695][ T7449] hpfs: hpfs_map_sector(): read error [ 138.535882][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 138.537295][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 138.949843][ T7474] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 139.019283][ T5714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 139.070696][ T7444] loop1: detected capacity change from 0 to 32768 [ 139.097361][ T4930] Bluetooth: hci3: command 0x0c1a tx timeout [ 139.097470][ T5706] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 139.097486][ T5706] Bluetooth: hci3: Error when powering off device on rfkill (-110) [ 139.100297][ T7444] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.484 (7444) [ 139.131609][ T7444] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 139.131641][ T7444] BTRFS info (device loop1): using crc32c checksum algorithm [ 139.159961][ T7462] loop4: detected capacity change from 0 to 40427 [ 139.190549][ T5608] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 139.193670][ T7462] F2FS-fs (loop4): Corrupted extension count (64 + 1 > 64) [ 139.193694][ T7462] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 139.209129][ T7462] F2FS-fs (loop4): Image doesn't support compression [ 139.223568][ T7462] F2FS-fs (loop4): invalid crc value [ 139.375115][ T7444] BTRFS info (device loop1): enabling ssd optimizations [ 139.375144][ T7444] BTRFS info (device loop1): turning on flush-on-commit [ 139.375159][ T7444] BTRFS info (device loop1): enabling free space tree [ 139.375175][ T7444] BTRFS info (device loop1): enabling auto defrag [ 139.375191][ T7444] BTRFS info (device loop1): use lzo compression, level 1 [ 139.376084][ T7444] BTRFS info (device loop1): max_inline set to 0 [ 139.422994][ T7497] loop2: detected capacity change from 0 to 256 [ 139.454434][ T7487] pimreg: entered allmulticast mode [ 139.467749][ T7462] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 139.483436][ T7462] F2FS-fs (loop4): f2fs_disable_checkpoint starts, unusable: 0 [ 139.483462][ T7462] F2FS-fs (loop4): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 139.483485][ T7462] F2FS-fs (loop4): Start checkpoint disabled! [ 139.514338][ T7497] exFAT-fs (loop2): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3163b44b, utbl_chksum : 0xe619d30d) [ 139.533469][ T7487] pimreg: left allmulticast mode [ 139.564073][ T7462] F2FS-fs (loop4): f2fs_disable_checkpoint finishes, err:0 [ 139.575361][ T7462] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 139.575387][ T7462] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 139.663762][ T7462] VFS:Filesystem freeze failed [ 139.875526][ T2257] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 140.025625][ T7513] loop5: detected capacity change from 0 to 512 [ 140.040996][ T2257] usb 1-1: New USB device found: idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 140.043919][ T2257] usb 1-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 140.043950][ T2257] usb 1-1: config 0 interface 0 altsetting 255 endpoint 0x8F has invalid wMaxPacketSize 0 [ 140.043971][ T2257] usb 1-1: config 0 interface 0 has no altsetting 0 [ 140.054086][ T7513] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 140.059397][ T5714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 140.078240][ T7513] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c018, mo2=0082] [ 140.078358][ T7513] System zones: 1-12 [ 140.082223][ T2257] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 140.082249][ T2257] usb 1-1: Product: syz [ 140.082264][ T2257] usb 1-1: Manufacturer: syz [ 140.082277][ T2257] usb 1-1: SerialNumber: syz [ 140.087832][ T7513] EXT4-fs (loop5): 1 truncate cleaned up [ 140.170398][ T7513] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 140.171006][ T2257] usb 1-1: config 0 descriptor?? [ 140.174832][ T5610] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 140.247085][ T2257] usb 1-1: selecting invalid altsetting 0 [ 140.278619][ T7513] EXT4-fs warning (device loop5): ext4_group_extend:1885: will only finish group (8193 blocks, 7937 new) [ 140.332165][ T7513] EXT4-fs warning (device loop5): ext4_group_extend:1890: can't read last block, resize aborted [ 140.777886][ T5850] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 140.820925][ T2257] usb 1-1: USB disconnect, device number 10 [ 141.100040][ T4942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 141.187968][ T7505] udevd[7505]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 141.323524][ T7534] veth0: entered promiscuous mode [ 141.335363][ T5706] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 141.335386][ T5706] Bluetooth: hci4: Error when powering off device on rfkill (-110) [ 141.335435][ T4930] Bluetooth: hci4: command 0x0c1a tx timeout [ 141.355167][ T7532] veth0: left promiscuous mode [ 141.387598][ T7537] netlink: 4 bytes leftover after parsing attributes in process `syz.4.497'. [ 141.439616][ T7540] loop4: detected capacity change from 0 to 128 [ 141.468068][ T7540] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 141.471104][ T7540] ext4 filesystem being mounted at /103/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 141.576508][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 141.578148][ T7544] netlink: 24 bytes leftover after parsing attributes in process `syz.0.509'. [ 141.578246][ T7544] netlink: 24 bytes leftover after parsing attributes in process `syz.0.509'. [ 141.712865][ T5611] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 141.891430][ T7551] loop4: detected capacity change from 0 to 1764 [ 142.138795][ T5714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 142.305469][ T7568] FAULT_INJECTION: forcing a failure. [ 142.305469][ T7568] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 142.305497][ T7568] CPU: 1 UID: 0 PID: 7568 Comm: syz.5.518 Not tainted syzkaller #0 PREEMPT(full) [ 142.305515][ T7568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 142.305525][ T7568] Call Trace: [ 142.305532][ T7568] [ 142.305539][ T7568] dump_stack_lvl+0xe8/0x150 [ 142.305563][ T7568] should_fail_ex+0x3eb/0x540 [ 142.305585][ T7568] _copy_from_user+0x2d/0xb0 [ 142.305603][ T7568] prctl_set_mm+0x578/0x13d0 [ 142.305624][ T7568] ? rcu_is_watching+0x16/0xb0 [ 142.305642][ T7568] ? trace_sched_exit_tp+0x3a/0x130 [ 142.305662][ T7568] ? __lock_acquire+0x747/0x2de0 [ 142.305684][ T7568] ? plist_check_list+0x2ef/0x310 [ 142.305713][ T7568] ? __pfx_prctl_set_mm+0x10/0x10 [ 142.305767][ T7568] ? __pfx_futex_wake_mark+0x10/0x10 [ 142.305789][ T7568] ? try_to_wake_up+0x8ce/0x14e0 [ 142.305817][ T7568] ? futex_wait+0x2a2/0x390 [ 142.305839][ T7568] ? __pfx_futex_wait+0x10/0x10 [ 142.305871][ T7568] ? do_futex+0x3e7/0x4e0 [ 142.305892][ T7568] ? cap_task_prctl+0x1bb/0xa40 [ 142.305911][ T7568] ? static_key_count+0x41/0x70 [ 142.305928][ T7568] ? security_task_prctl+0x163/0x190 [ 142.305949][ T7568] __se_sys_prctl+0x206/0x1910 [ 142.305972][ T7568] ? __pfx___se_sys_prctl+0x10/0x10 [ 142.305993][ T7568] ? __x64_sys_prctl+0x20/0xc0 [ 142.306011][ T7568] do_syscall_64+0x166/0x520 [ 142.306029][ T7568] ? trace_irq_disable+0x3b/0x140 [ 142.306046][ T7568] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.306064][ T7568] ? clear_bhb_loop+0x70/0xc0 [ 142.306083][ T7568] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.306101][ T7568] RIP: 0033:0x7f8844f9e159 [ 142.306119][ T7568] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 142.306136][ T7568] RSP: 002b:00007f8845f2d028 EFLAGS: 00000246 ORIG_RAX: 000000000000009d [ 142.306157][ T7568] RAX: ffffffffffffffda RBX: 00007f8845225fa0 RCX: 00007f8844f9e159 [ 142.306173][ T7568] RDX: ffffffffffffffff RSI: 000000000000000c RDI: 0000000000000023 [ 142.306186][ T7568] RBP: 00007f884503506b R08: 0000000000000000 R09: 0000000000000000 [ 142.306199][ T7568] R10: 00000000000001c0 R11: 0000000000000246 R12: 0000000000000000 [ 142.306221][ T7568] R13: 00007f8845226038 R14: 00007f8845225fa0 R15: 00007fffebc17ec8 [ 142.306250][ T7568] [ 142.584584][ T7577] loop1: detected capacity change from 0 to 512 [ 142.735979][ T7563] loop4: detected capacity change from 0 to 32768 [ 142.784725][ T7577] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 142.784828][ T7577] ext4 filesystem being mounted at /92/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 142.848778][ T7563] XFS (loop4): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 142.938234][ T7578] loop5: detected capacity change from 0 to 32768 [ 142.946970][ T5610] EXT4-fs error (device loop1): ext4_ext_check_inode:521: inode #11: comm syz-executor: pblk 0 bad header/extent: invalid magic - magic 0, entries 0, max 0(0), depth 0(0) [ 142.991108][ T7578] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 142.991129][ T7578] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 143.012574][ T5610] EXT4-fs error (device loop1): ext4_ext_check_inode:521: inode #11: comm syz-executor: pblk 0 bad header/extent: invalid magic - magic 0, entries 0, max 0(0), depth 0(0) [ 143.085114][ T7578] gfs2: fsid=syz:syz.0: journal 0 mapped with 1 extents in 0ms [ 143.144538][ T7563] XFS (loop4): Ending clean mount [ 143.159118][ T7563] XFS (loop4): Quotacheck needed: Please wait. [ 143.190435][ T9] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 143.190452][ T9] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 143.308230][ T4942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 143.427713][ T7563] XFS (loop4): Quotacheck: Done. [ 143.464753][ T5610] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 143.569697][ T7596] Invalid argument reading file caps for ./file0 [ 143.600971][ T9] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 410ms [ 143.601154][ T9] gfs2: fsid=syz:syz.0: jid=0: Done [ 143.601191][ T7578] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 143.616960][ T5611] XFS (loop4): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 143.788317][ T268] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.912789][ T7600] netlink: 24 bytes leftover after parsing attributes in process `syz.0.530'. [ 144.144585][ T268] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.377377][ T5791] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 144.529218][ T268] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.558927][ T5714] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 144.621241][ T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 144.628391][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 144.630476][ T54] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 144.636957][ T54] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 144.654964][ T54] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 144.665727][ T54] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 144.696609][ T7616] loop4: detected capacity change from 0 to 512 [ 144.743946][ T7616] EXT4-fs error (device loop4): ext4_orphan_get:1403: inode #15: comm syz.4.536: iget: bad i_size value: 38620345925642 [ 144.743991][ T7616] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 144.757284][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 144.757311][ C1] EXT4-fs (loop4): initial error at time 1790784433: ext4_orphan_get:1403: inode 15 [ 144.757344][ C1] EXT4-fs (loop4): last error at time 1790784433: ext4_orphan_get:1403: inode 15 [ 144.783197][ T5714] usb 1-1: New USB device found: idVendor=0525, idProduct=a4a1, bcdDevice=0.40 [ 144.786036][ T7616] EXT4-fs error (device loop4): ext4_orphan_get:1408: comm syz.4.536: couldn't read orphan inode 15 (err -117) [ 144.786064][ T7616] loop4: lost filesystem error report for type 5 error -117 [ 144.788212][ T7616] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 144.833983][ T5714] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 64 [ 144.834014][ T5714] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1024 [ 144.859331][ T5714] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.859357][ T5714] usb 1-1: Product: syz [ 144.859369][ T5714] usb 1-1: Manufacturer: syz [ 144.859383][ T5714] usb 1-1: SerialNumber: syz [ 144.924024][ T4930] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 144.926882][ T4930] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 144.927280][ T4930] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 144.928131][ T4930] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 144.930068][ T4930] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 144.984242][ T5611] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 145.052521][ T268] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.127789][ T5714] cdc_ncm 1-1:1.0: bind() failure [ 145.133637][ T5714] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 145.133679][ T5714] cdc_ncm 1-1:1.1: bind() failure [ 145.158216][ T5714] usb 1-1: USB disconnect, device number 11 [ 145.184289][ T7629] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0, syncid = 1, id = 0 [ 145.416189][ T5714] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 145.497654][ T9] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 145.498621][ T268] bridge_slave_1: left allmulticast mode [ 145.498644][ T268] bridge_slave_1: left promiscuous mode [ 145.498837][ T268] bridge0: port 2(bridge_slave_1) entered disabled state [ 145.514184][ T268] bridge_slave_0: left allmulticast mode [ 145.514209][ T268] bridge_slave_0: left promiscuous mode [ 145.514405][ T268] bridge0: port 1(bridge_slave_0) entered disabled state [ 145.662296][ T9] usb 3-1: New USB device found: idVendor=056a, idProduct=5012, bcdDevice=0.00 [ 145.663294][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 145.663321][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 145.663356][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.669123][ T9] usb 3-1: config 0 descriptor?? [ 145.883793][ T268] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 145.899009][ T268] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 145.901183][ T268] bond0 (unregistering): Released all slaves [ 146.134102][ T9] wacom 0003:056A:5012.0008: unknown main item tag 0x0 [ 146.134138][ T9] wacom 0003:056A:5012.0008: unknown main item tag 0x0 [ 146.134161][ T9] wacom 0003:056A:5012.0008: unknown main item tag 0x0 [ 146.134183][ T9] wacom 0003:056A:5012.0008: unknown main item tag 0x0 [ 146.134204][ T9] wacom 0003:056A:5012.0008: unknown main item tag 0x0 [ 146.134226][ T9] wacom 0003:056A:5012.0008: unknown main item tag 0x0 [ 146.134250][ T9] wacom 0003:056A:5012.0008: unknown main item tag 0x0 [ 146.134273][ T9] wacom 0003:056A:5012.0008: unknown main item tag 0x0 [ 146.134296][ T9] wacom 0003:056A:5012.0008: unknown main item tag 0x0 [ 146.134318][ T9] wacom 0003:056A:5012.0008: unknown main item tag 0x0 [ 146.154178][ T9] wacom 0003:056A:5012.0008: reserved main item tag 0xd [ 146.165520][ T9] wacom 0003:056A:5012.0008: Unknown device_type for 'HID 056a:5012'. Ignoring. [ 146.360474][ T9] usb 3-1: USB disconnect, device number 11 [ 146.639843][ T7673] loop4: detected capacity change from 0 to 4096 [ 146.655531][ T7673] ntfs3(loop4): Different NTFS sector size (4096) and media sector size (512). [ 146.773996][ T7673] ntfs3(loop4): ino=19, mi_enum_attr [ 146.774028][ T7673] ntfs3(loop4): Mark volume as dirty due to NTFS errors [ 146.878855][ T7673] ntfs3(loop4): failed to convert "c46c" to cp855 [ 146.919657][ T7673] ntfs3(loop4): ino=20, mi_enum_attr [ 146.993269][ T268] hsr_slave_0: left promiscuous mode [ 147.001705][ T268] hsr_slave_1: left promiscuous mode [ 147.002590][ T268] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 147.002610][ T268] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 147.014034][ T268] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 147.014055][ T268] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 147.025681][ T4930] Bluetooth: hci2: command tx timeout [ 147.091804][ T268] veth1_macvtap: left promiscuous mode [ 147.091840][ T268] veth0_macvtap: left promiscuous mode [ 147.091933][ T268] veth1_vlan: left promiscuous mode [ 147.091995][ T268] veth0_vlan: left promiscuous mode [ 147.216395][ T993] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 147.279153][ T7686] loop4: detected capacity change from 0 to 2048 [ 147.294586][ T7686] hpfs: filesystem error: invalid size in superblock: ffffffff; already mounted read-only [ 147.410170][ T993] usb 6-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 147.417324][ T993] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.428701][ T993] usb 6-1: config 0 descriptor?? [ 147.644976][ T993] udl 6-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 147.729821][ T268] team0 (unregistering): Port device team_slave_1 removed [ 147.751350][ T268] team0 (unregistering): Port device team_slave_0 removed [ 147.865377][ T993] [drm] Initialized udl 0.0.1 for 6-1:0.0 on minor 1 [ 147.865403][ T993] [drm] Initialized udl on minor 1 [ 147.940287][ T5276] 8021q: adding VLAN 0 to HW filter on device eth5 [ 147.981974][ T7691] ªªªªª»: renamed from dummy0 (while UP) [ 148.532269][ T7613] bridge0: port 1(bridge_slave_0) entered blocking state [ 148.532453][ T7613] bridge0: port 1(bridge_slave_0) entered disabled state [ 148.532581][ T7613] bridge_slave_0: entered allmulticast mode [ 148.534334][ T7613] bridge_slave_0: entered promiscuous mode [ 148.572803][ T7613] bridge0: port 2(bridge_slave_1) entered blocking state [ 148.574506][ T7613] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.574640][ T7613] bridge_slave_1: entered allmulticast mode [ 148.602186][ T7613] bridge_slave_1: entered promiscuous mode [ 148.655614][ T7613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 148.658931][ T7613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 148.724691][ T7613] team0: Port device team_slave_0 added [ 148.738609][ T7613] team0: Port device team_slave_1 added [ 148.829305][ T7613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 148.829321][ T7613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 148.829340][ T7613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 148.846747][ T7613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 148.846764][ T7613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 148.846811][ T7613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 148.875005][ T54] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 148.894113][ T54] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 148.895693][ T54] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 148.896727][ T54] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 148.897414][ T54] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 148.918634][ T7613] hsr_slave_0: entered promiscuous mode [ 148.919767][ T7613] hsr_slave_1: entered promiscuous mode [ 148.920531][ T7613] debugfs: 'hsr0' already exists in 'hsr' [ 148.920556][ T7613] Cannot create hsr debugfs directory [ 149.095435][ T4930] Bluetooth: hci2: command tx timeout [ 149.195012][ T5276] 8021q: adding VLAN 0 to HW filter on device eth6 [ 149.627278][ T7613] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 149.650349][ T7613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 149.651215][ T7613] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 149.669865][ T7613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 149.674064][ T7613] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 149.695060][ T7613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 149.708671][ T7613] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 149.718596][ T7613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 149.997073][ T7762] loop4: detected capacity change from 0 to 128 [ 150.060898][ T7762] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 150.066790][ T7762] ext4 filesystem being mounted at /122/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 150.197503][ T5611] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 150.277637][ T7613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 150.325896][ T7613] 8021q: adding VLAN 0 to HW filter on device team0 [ 150.351700][ T1180] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.351800][ T1180] bridge0: port 1(bridge_slave_0) entered forwarding state [ 150.380341][ T5276] 8021q: adding VLAN 0 to HW filter on device eth7 [ 150.384835][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.384932][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 150.491346][ T7719] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.491564][ T7719] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.491675][ T7719] bridge_slave_0: entered allmulticast mode [ 150.494590][ T7719] bridge_slave_0: entered promiscuous mode [ 150.529460][ T7719] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.529583][ T7719] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.529949][ T7719] bridge_slave_1: entered allmulticast mode [ 150.531489][ T7719] bridge_slave_1: entered promiscuous mode [ 150.614646][ T7719] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 150.632121][ T7719] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 150.683727][ T7719] team0: Port device team_slave_0 added [ 150.693728][ T7719] team0: Port device team_slave_1 added [ 150.749578][ T7719] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 150.749596][ T7719] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 150.749620][ T7719] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 150.753074][ T7719] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 150.753088][ T7719] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 150.753112][ T7719] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 150.936252][ T4930] Bluetooth: hci4: command tx timeout [ 150.985115][ T7719] hsr_slave_0: entered promiscuous mode [ 150.992876][ T7719] hsr_slave_1: entered promiscuous mode [ 150.993550][ T7719] debugfs: 'hsr0' already exists in 'hsr' [ 150.993568][ T7719] Cannot create hsr debugfs directory [ 151.175783][ T4930] Bluetooth: hci2: command tx timeout [ 151.434577][ T5276] 8021q: adding VLAN 0 to HW filter on device eth8 [ 151.586009][ T7719] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 151.592275][ T7719] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 151.593753][ T7719] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 151.621018][ T7719] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 151.621861][ T7719] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 151.643998][ T7719] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 151.652510][ T7719] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 151.664167][ T7719] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 151.733070][ T7808] [ 151.735434][ T7808] ====================================================== [ 151.742442][ T7808] WARNING: possible circular locking dependency detected [ 151.749450][ T7808] syzkaller #0 Not tainted [ 151.753845][ T7808] ------------------------------------------------------ [ 151.760850][ T7808] modprobe/7808 is trying to acquire lock: [ 151.766629][ T7808] ffff888075cd3480 (DCACHE_PAR_LOOKUP){+.+.}-{0:0}, at: __d_alloc_parallel+0x39e/0x1700 [ 151.776345][ T7808] [ 151.776345][ T7808] but task is already holding lock: [ 151.783685][ T7808] ffff888033589eb0 (&type->i_mutex_dir_key#3){++++}-{4:4}, at: lookup_open+0x221/0x1970 [ 151.793407][ T7808] [ 151.793407][ T7808] which lock already depends on the new lock. [ 151.793407][ T7808] [ 151.803789][ T7808] [ 151.803789][ T7808] the existing dependency chain (in reverse order) is: [ 151.812808][ T7808] [ 151.812808][ T7808] -> #1 (&type->i_mutex_dir_key#3){++++}-{4:4}: [ 151.821213][ T7808] down_read+0x45/0x320 [ 151.825879][ T7808] lookup_slow+0x46/0x80 [ 151.830649][ T7808] ovl_lookup_single+0x323/0xe90 [ 151.836089][ T7808] ovl_lookup_layer+0x377/0x440 [ 151.841448][ T7808] ovl_lookup+0x9ae/0x1c80 [ 151.846359][ T7808] __lookup_slow+0x1fb/0x2f0 [ 151.851447][ T7808] lookup_slow+0x59/0x80 [ 151.856207][ T7808] path_lookupat+0x3f5/0x8c0 [ 151.861294][ T7808] filename_lookup+0x265/0x5d0 [ 151.866553][ T7808] user_path_at+0x40/0x160 [ 151.871466][ T7808] __se_sys_mount+0x2dc/0x420 [ 151.876637][ T7808] do_syscall_64+0x166/0x520 [ 151.881727][ T7808] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 151.888135][ T7808] [ 151.888135][ T7808] -> #0 (DCACHE_PAR_LOOKUP){+.+.}-{0:0}: [ 151.895931][ T7808] __lock_acquire+0x164c/0x2de0 [ 151.901305][ T7808] lock_acquire+0x115/0x350 [ 151.906306][ T7808] __d_alloc_parallel+0xc32/0x1700 [ 151.911936][ T7808] lookup_open+0x2c2/0x1970 [ 151.916935][ T7808] path_openat+0x673/0x1da0 [ 151.921935][ T7808] do_file_open+0x23e/0x4a0 [ 151.926938][ T7808] do_sys_openat2+0x115/0x200 [ 151.932114][ T7808] __x64_sys_openat+0x138/0x170 [ 151.937459][ T7808] do_syscall_64+0x166/0x520 [ 151.942548][ T7808] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 151.948953][ T7808] [ 151.948953][ T7808] other info that might help us debug this: [ 151.948953][ T7808] [ 151.959165][ T7808] Possible unsafe locking scenario: [ 151.959165][ T7808] [ 151.966599][ T7808] CPU0 CPU1 [ 151.971946][ T7808] ---- ---- [ 151.977291][ T7808] rlock(&type->i_mutex_dir_key#3); [ 151.982562][ T7808] lock(DCACHE_PAR_LOOKUP); [ 151.989648][ T7808] lock(&type->i_mutex_dir_key#3); [ 151.997351][ T7808] lock(DCACHE_PAR_LOOKUP); [ 152.001918][ T7808] [ 152.001918][ T7808] *** DEADLOCK *** [ 152.001918][ T7808] [ 152.010037][ T7808] locks held by modprobe/7808: 1, last CPU#0: [ 152.016094][ T7808] #0: ffff888033589eb0 (&type->i_mutex_dir_key#3){++++}-{4:4}, at: lookup_open+0x221/0x1970 [ 152.026249][ T7808] [ 152.026249][ T7808] stack backtrace: [ 152.032141][ T7808] CPU: 0 UID: 0 PID: 7808 Comm: modprobe Not tainted syzkaller #0 PREEMPT(full) [ 152.041223][ T7808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 152.051278][ T7808] Call Trace: [ 152.054558][ T7808] [ 152.057471][ T7808] dump_stack_lvl+0xe8/0x150 [ 152.062048][ T7808] print_circular_bug+0x2e2/0x300 [ 152.067051][ T7808] check_noncircular+0x12f/0x150 [ 152.071991][ T7808] __lock_acquire+0x164c/0x2de0 [ 152.076831][ T7808] ? rcu_is_watching+0x16/0xb0 [ 152.081592][ T7808] lock_acquire+0x115/0x350 [ 152.086073][ T7808] ? __d_alloc_parallel+0x39e/0x1700 [ 152.091346][ T7808] ? __d_alloc_parallel+0x39e/0x1700 [ 152.096606][ T7808] ? __d_alloc_parallel+0x39e/0x1700 [ 152.101868][ T7808] __d_alloc_parallel+0xc32/0x1700 [ 152.106956][ T7808] ? __d_alloc_parallel+0x39e/0x1700 [ 152.112220][ T7808] ? __d_alloc_parallel+0x39e/0x1700 [ 152.117484][ T7808] ? __pfx___d_alloc_parallel+0x10/0x10 [ 152.123029][ T7808] ? __d_lookup+0x6f3/0x790 [ 152.127507][ T7808] ? d_lookup+0x1f/0xa0 [ 152.131660][ T7808] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 152.137790][ T7808] ? lockdep_hardirqs_on+0x7b/0x110 [ 152.142972][ T7808] lookup_open+0x2c2/0x1970 [ 152.147460][ T7808] path_openat+0x673/0x1da0 [ 152.151944][ T7808] do_file_open+0x23e/0x4a0 [ 152.156425][ T7808] ? __pfx_do_file_open+0x10/0x10 [ 152.161516][ T7808] ? _raw_spin_unlock+0x28/0x50 [ 152.166346][ T7808] ? alloc_fd+0x6af/0x760 [ 152.170655][ T7808] do_sys_openat2+0x115/0x200 [ 152.175312][ T7808] ? __pfx_do_sys_openat2+0x10/0x10 [ 152.180492][ T7808] ? do_user_addr_fault+0xd3f/0x1480 [ 152.185755][ T7808] __x64_sys_openat+0x138/0x170 [ 152.190619][ T7808] do_syscall_64+0x166/0x520 [ 152.195190][ T7808] ? trace_irq_disable+0x3b/0x140 [ 152.200199][ T7808] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.206247][ T7808] ? clear_bhb_loop+0x70/0xc0 [ 152.210902][ T7808] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.216773][ T7808] RIP: 0033:0x7fb6449ad0ba [ 152.221172][ T7808] Code: 41 89 f2 48 89 54 24 e0 41 83 e2 40 75 2a 89 f0 f7 d0 a9 00 00 41 00 74 1f 89 f2 b8 01 01 00 00 48 89 fe bf 9c ff ff ff 0f 05 <48> 3d 00 f0 ff ff 77 2e c3 0f 1f 44 00 00 48 8d 44 24 08 c7 44 24 [ 152.240781][ T7808] RSP: 002b:00007ffcef229ad8 EFLAGS: 00000206 ORIG_RAX: 0000000000000101 [ 152.249189][ T7808] RAX: ffffffffffffffda RBX: 00007ffcef229b50 RCX: 00007fb6449ad0ba [ 152.257142][ T7808] RDX: 0000000000080000 RSI: 00007ffcef229b50 RDI: 00000000ffffff9c [ 152.265091][ T7808] RBP: 00007ffcef229b40 R08: 00007ffcef229d47 R09: 0000000000000000 [ 152.273042][ T7808] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000016 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 152.281014][ T7808] R13: 00007fb644981000 R14: 00007ffcef229d60 R15: 0000000000000000 [ 152.288971][ T7808] [ 152.439391][ T7802] syz.4.573 (7802): drop_caches: 2 [ 152.869591][ T61] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.937567][ T993] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffff92 [ 152.937814][ T993] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 152.941996][ T61] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.943023][ T9] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 152.943473][ T9] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 152.943586][ T9] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 152.947713][ T993] usb 6-1: USB disconnect, device number 8 [ 153.031209][ T61] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 153.061957][ T61] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 153.136003][ T61] bridge_slave_1: left allmulticast mode [ 153.136025][ T61] bridge_slave_1: left promiscuous mode [ 153.136149][ T61] bridge0: port 2(bridge_slave_1) entered disabled state [ 153.137543][ T61] bridge_slave_0: left allmulticast mode [ 153.137555][ T61] bridge_slave_0: left promiscuous mode [ 153.137633][ T61] bridge0: port 1(bridge_slave_0) entered disabled state [ 153.230059][ T61] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 153.231204][ T61] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 153.231892][ T61] bond0 (unregistering): Released all slaves [ 153.293035][ T61] tipc: Disabling bearer [ 153.293243][ T61] tipc: Left network mode [ 153.414162][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 153.414183][ T61] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 153.414663][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 153.414678][ T61] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 153.448224][ T61] veth1_macvtap: left promiscuous mode [ 153.448253][ T61] veth0_macvtap: left promiscuous mode [ 153.448323][ T61] veth1_vlan: left promiscuous mode [ 153.448364][ T61] veth0_vlan: left promiscuous mode [ 153.591462][ T61] team0 (unregistering): Port device team_slave_1 removed [ 153.594064][ T61] team0 (unregistering): Port device team_slave_0 removed [ 153.669134][ T5276] 8021q: adding VLAN 0 to HW filter on device eth9 [ 153.924886][ T5276] 8021q: adding VLAN 0 to HW filter on device eth10 [ 154.150806][ T61] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.168689][ T5276] 8021q: adding VLAN 0 to HW filter on device eth11 [ 154.186744][ T61] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.231921][ T61] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.261381][ T61] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.364608][ T61] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.399918][ T61] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.431669][ T61] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.450640][ T5276] 8021q: adding VLAN 0 to HW filter on device eth12 [ 154.477971][ T61] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.712746][ T5276] 8021q: adding VLAN 0 to HW filter on device eth13 [ 154.783988][ T61] bridge_slave_1: left allmulticast mode [ 154.784020][ T61] bridge_slave_1: left promiscuous mode [ 154.784190][ T61] bridge0: port 2(bridge_slave_1) entered disabled state [ 154.797454][ T61] bridge_slave_0: left allmulticast mode [ 154.797476][ T61] bridge_slave_0: left promiscuous mode [ 154.797776][ T61] bridge0: port 1(bridge_slave_0) entered disabled state [ 154.830753][ T61] bridge_slave_1: left allmulticast mode [ 154.830770][ T61] bridge_slave_1: left promiscuous mode [ 154.830859][ T61] bridge0: port 2(bridge_slave_1) entered disabled state [ 154.831795][ T61] bridge_slave_0: left allmulticast mode [ 154.831807][ T61] bridge_slave_0: left promiscuous mode [ 154.831875][ T61] bridge0: port 1(bridge_slave_0) entered disabled state [ 154.876140][ T61] bridge_slave_1: left allmulticast mode [ 154.876156][ T61] bridge_slave_1: left promiscuous mode [ 154.876259][ T61] bridge0: port 2(bridge_slave_1) entered disabled state [ 154.878513][ T61] bridge_slave_0: left allmulticast mode [ 154.878527][ T61] bridge_slave_0: left promiscuous mode [ 154.878617][ T61] bridge0: port 1(bridge_slave_0) entered disabled state [ 154.916038][ T61] bridge_slave_1: left allmulticast mode [ 154.916060][ T61] bridge_slave_1: left promiscuous mode [ 154.916186][ T61] bridge0: port 2(bridge_slave_1) entered disabled state [ 154.917210][ T61] bridge_slave_0: left allmulticast mode [ 154.917223][ T61] bridge_slave_0: left promiscuous mode [ 154.917292][ T61] bridge0: port 1(bridge_slave_0) entered disabled state [ 155.058780][ T61] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 155.060054][ T61] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 155.060882][ T61] bond0 (unregistering): Released all slaves [ 155.136661][ T61] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 155.138089][ T61] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 155.138994][ T61] bond0 (unregistering): Released all slaves [ 155.184712][ T61] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 155.194583][ T61] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 155.198558][ T61] bond0 (unregistering): Released all slaves [ 155.221997][ T61] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 155.223074][ T61] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 155.223738][ T61] bond0 (unregistering): Released all slaves [ 155.238347][ T5276] 8021q: adding VLAN 0 to HW filter on device eth14 [ 155.316922][ T61] IPVS: stopping master sync thread 7629 ... [ 155.471631][ T61] hsr_slave_0: left promiscuous mode [ 155.472056][ T61] hsr_slave_1: left promiscuous mode [ 155.472904][ T61] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 155.473280][ T61] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 155.494118][ T61] hsr_slave_0: left promiscuous mode [ 155.495981][ T61] hsr_slave_1: left promiscuous mode [ 155.496505][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 155.496520][ T61] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 155.502905][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 155.502920][ T61] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 155.548019][ T61] hsr_slave_0: left promiscuous mode [ 155.548328][ T61] hsr_slave_1: left promiscuous mode [ 155.548660][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 155.548671][ T61] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 155.548995][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 155.549009][ T61] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 155.552001][ T61] hsr_slave_0: left promiscuous mode [ 155.552406][ T61] hsr_slave_1: left promiscuous mode [ 155.552901][ T61] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 155.553266][ T61] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 155.573486][ T61] veth1_macvtap: left promiscuous mode [ 155.573513][ T61] veth0_macvtap: left promiscuous mode [ 155.573580][ T61] veth1_vlan: left promiscuous mode [ 155.573621][ T61] veth0_vlan: left promiscuous mode [ 155.581417][ T61] veth1_macvtap: left promiscuous mode [ 155.581442][ T61] veth0_macvtap: left promiscuous mode [ 155.581536][ T61] veth1_vlan: left promiscuous mode [ 155.581586][ T61] veth0_vlan: left promiscuous mode [ 155.767775][ T61] team0 (unregistering): Port device team_slave_1 removed [ 155.771395][ T61] team0 (unregistering): Port device team_slave_0 removed [ 155.859271][ T61] team0 (unregistering): Port device team_slave_1 removed [ 155.862846][ T61] team0 (unregistering): Port device team_slave_0 removed [ 155.971944][ T61] team0 (unregistering): Port device team_slave_1 removed [ 155.974599][ T61] team0 (unregistering): Port device team_slave_0 removed [ 156.053450][ T61] team0 (unregistering): Port device team_slave_1 removed [ 156.071370][ T61] team0 (unregistering): Port device team_slave_0 removed [ 156.104014][ T5276] 8021q: adding VLAN 0 to HW filter on device eth15 [ 156.391753][ T5276] 8021q: adding VLAN 0 to HW filter on device eth16 [ 156.652745][ T5276] 8021q: adding VLAN 0 to HW filter on device eth17 [ 156.892335][ T5276] 8021q: adding VLAN 0 to HW filter on device eth18 [ 157.079866][ T5276] 8021q: adding VLAN 0 to HW filter on device eth19 [ 157.286455][ T5276] 8021q: adding VLAN 0 to HW filter on device eth20 [ 157.482190][ T5276] 8021q: adding VLAN 0 to HW filter on device eth21 [ 157.688791][ T5276] 8021q: adding VLAN 0 to HW filter on device eth22 [ 157.888074][ T5276] 8021q: adding VLAN 0 to HW filter on device eth23 [ 158.112358][ T5276] 8021q: adding VLAN 0 to HW filter on device eth24 [ 158.325049][ T5276] 8021q: adding VLAN 0 to HW filter on device eth25 [ 158.524306][ T5276] 8021q: adding VLAN 0 to HW filter on device eth26 [ 158.728649][ T5276] 8021q: adding VLAN 0 to HW filter on device eth27 [ 158.936443][ T5276] 8021q: adding VLAN 0 to HW filter on device eth28