last executing test programs: 1m1.866029438s ago: executing program 2 (id=3358): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000100001000000e7472cbcbbb7b541000a70000000060a010400000000000000000200000344000480400001800e000100627974656f726465720000002c00028008000140000000"], 0x98}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="7c0000001000010400"/20, @ANYRES32=r1, @ANYBLOB="00000000000000005c001280110001006272696467655f736c617665000000004400058005"], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x800) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 1m1.710839892s ago: executing program 2 (id=3359): epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000100)) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x24, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x0, 0xc}, {}, {0x10, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x20048084}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000", @ANYRES32=r5, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r8, @ANYBLOB="0000000003120100500012800b000100627269646765000040000280080005000100000006002700000000000800010015000800050025000000000008000400000000000c002e"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) 1m1.431524108s ago: executing program 2 (id=3361): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f0000000280)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file7\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0x0) 1m1.000025808s ago: executing program 2 (id=3363): r0 = io_uring_setup(0x800068f6, &(0x7f0000000840)={0x0, 0x8d0b, 0x10, 0xfffffffd, 0x8100016c}) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000080)={r1, 0xf, 0x25, 0x2, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff}, 0x40) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000040}, 0x0) syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000440)={[{@utf8}, {@rodir}, {@fat=@usefree}, {@shortname_lower}, {@shortname_winnt}, {@fat=@check_normal}, {@utf8}, {@fat=@discard}, {@rodir}, {@utf8no}, {@fat=@flush}, {@shortname_winnt}, {@rodir}]}, 0x0, 0x2be, &(0x7f0000002880)="$eJzs3cFr024YwPFn7dZ2HVt7GD/4CeKDXvQStvoXFNlALChzFfUgZC7V0tiUplYq4nbz6t8xPHpSUP+BXbx5Fy9DELxMECNrkq3tquvGaqb9fmDk3fvm6ftmbzKehOXd1s3nDyol1yiZDYmlVGIi67Itkt0pBcaCbaxdTkindbkw9fXD6eu3bl/JFwoLS6qL+eWLOVWdOfPm0ZMXZ981pm68nHmdlM3sna0vuY+b/23+v/VjOfx0R8TUFcdpmCu2patlt2KoXrMt07W0XHWtekM72ku2U6u11KyuTqdrdct11ay2tGK1tOFoo95S855ZrqphGDqdllETP3REcWNpycwPZTCIwmS/yno9b8b7NhY3/sSgAADAyRJV/n+/7GrZ1arTld/vz/9jcoj8X2Sk8/+jqkU9AAzVTv6fDq7fbuT/AAAAAAAAAAAAAAAAAAAAAAD8DbY9L+N5Xibchl9JEUmJSPh91OPEcDD/o63jxb2UiP2sWWwW/a3fni9JWWyxZG5C5Hv7fAj45cXLhYU5bcvKW3steFdwvVmMSzKMD2X7x8/78boTH/S/tiYTku7sPycZme0fn+sT3ywm5Pw5Lxn0bIkhGXl/VxyxZbV9Xu/FP51XvXS10BM/2d7vl8aGNycAAAAAABw3Q3dlu+9//dUkDUPDZUN62v3KvecDkjng+UDP/fW4nBqP7rgBAAAAABglbkIqpm1bdbf1+F8vhP//4Fg+UCTqw0kNuvO4iAQ1r07KXAxSiIlIb9PEvpr+hfhvZ/mbd0D4Z5Hu62L2yNOdiPqH6cV3z9VPD/0rYJDwKH8rAQAAABiGMOnnz9kBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIjOoKuIhfsfZRGyju7i0RwlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcDL8DAAA//9xXRHz") r3 = syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000500)='./file0\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1333404, 0x0) mount$bind(&(0x7f0000000340)='./file0\x00', &(0x7f00000002c0)='./file0/file0\x00', 0x0, 0x13481, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) read$FUSE(r3, &(0x7f0000000840)={0x2020}, 0x2020) close_range(r0, 0xffffffffffffffff, 0x0) 1m0.599675838s ago: executing program 2 (id=3364): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RVERSION(r1, &(0x7f0000001bc0)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@access_any}, {@noextend}]}}) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) 1m0.07627808s ago: executing program 2 (id=3366): getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000080)={0x9, 0x7a40, 0x5, 0xe0, 0xe, 0x1, 0x0, 0x7fdf, r0}, 0x20) 59.802544746s ago: executing program 32 (id=3366): getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000080)={0x9, 0x7a40, 0x5, 0xe0, 0xe, 0x1, 0x0, 0x7fdf, r0}, 0x20) 58.524388946s ago: executing program 0 (id=3371): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000003c0)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f00000002c0)={r2, 0x11, 0x6, @random="08d32bfb45c9"}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x100, {0x0, 0x0, 0x0, r2, {0xe, 0x1}}}, 0x24}}, 0x4) 58.131760625s ago: executing program 0 (id=3374): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newnexthop={0x2c, 0x68, 0x401, 0xfffffffc, 0x0, {}, [@NHA_GROUP={0xc, 0x2, [{0x1}]}, @NHA_OIF={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 57.861395572s ago: executing program 0 (id=3376): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1904000014"], 0x48) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325}) io_uring_enter(r0, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) 57.576020669s ago: executing program 0 (id=3381): madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_mount_image$vfat(&(0x7f0000000140), &(0x7f00000002c0)='./file0\x00', 0x2048c5, &(0x7f0000000440)={[{@rodir}, {@shortname_winnt}, {@uni_xlateno}, {@numtail}, {@uni_xlate}, {@utf8}, {@shortname_mixed}, {@utf8}, {@fat=@flush}, {@fat=@dos1xfloppy}, {@shortname_lower}, {@shortname_win95}, {@utf8no}]}, 0x0, 0x2c7, &(0x7f0000002b80)="$eJzs3EFrE1sUwPHTTJumLW2yKA/eg4cH3ehmaOMnCNKCGFBqI+pCmNqJhoxJmImRiNjuxJ2fo7h0paB+gW7cuRc3RRDcdCGONJmJMR2btFqnbf4/KHM7Z87MHe69cKbQu3X92b1y0TOLVl0SKZWEyLpsi2R2WoGR4JhotZPSbV3OTX15///VGzcv5fL5hSXVxdzy+ayqzpx6/eDR89Nv61PXXsy8GpfNzK2tz9kPm/9s/rv1bTm8e1XE0pVqtW6tOLaulryyqXrFsS3P1lLFs926WuqG8aJTrdWaalVWpydrru15alWaWrabWq9q3W2qdccqVdQ0TZ2elGFj7DujsLG0ZOUOpTOIw0TUSdfNWUZksLDxNzoFAACOlrjq/7slT0ueVqo79f0e9X9CuuN96n+Roa7/D6r261BkPYnjZCRcvl0rOkT9DwAAAAAAAAAAAAAAAAAAAADAcbDt+2nf99PhMfwZF5GUiIS/x91PHI4Bxt9g/E+urn/cS4k4TxqFRqF9bMc7m0PMjYl8bc2HQLu9eDG/MKctGXnjrAX5a42CITtzKFeUUudhmej8+Xa+duevyZhMhvmO2JKVtMxG52cj8huFpJw9448HT7bFlLS8uy1VcWS1Na9/5D+eV71wOd+TP9G6DgAAAACAk8DUjl3f7624qeG2IT3x9snO9/mcpPv8faDn+3pU/huN770BAAAAABgmXlLKluPYrtd82K/xNMgZ6OIj2Ag3s/0jNxSJ+3VSg148KiLBmZfx9dnYd1ZCRHpDY7vORDeM3xvlTyI/r4vZ2Ic7qiFJkb4X+0Znrn68314Be9159y7BAAAAAE6GsPofibsjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMsYF3GgscZKOyrscZ8bwlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcDR8DwAA//9KIAfL") r0 = syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='./file0/file0\x00', 0x0, 0x13481, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) read$FUSE(r0, &(0x7f0000000840)={0x2020}, 0x2020) 57.341557314s ago: executing program 0 (id=3382): r0 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) symlink(&(0x7f00000005c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', &(0x7f00000002c0)='.\x02\x00') ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000680)={0x1, [[0xffffffff, 0xffffffff, 0xffffffff, 0x4000001, 0xffffffff, 0xfffffffc, 0xffffffff, 0xffffffff], [0xfffffffb, 0x2, 0xfffffffd, 0xa, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0x2a5a, 0x22, 0xffffffff, 0xffffffff, 0x3, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0xa, 0x186a0, 0x0, 0x0, 0x1}, {0x103, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x101000, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x20ffd, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x80383, 0x0) r2 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x63, 0x86, 0x35, 0x10, 0xcf3, 0x1010, 0x3687, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7f, 0x4, 0x50, 0x0, "", [{{0x9, 0x4, 0x7c, 0xb, 0x0, 0xa4, 0xca, 0xd4}}]}}]}}, &(0x7f0000000040)={0x0, 0x0, 0x5, 0x0}) syz_usb_disconnect(r2) r3 = syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x763, 0x2003, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x10, 0x2, {0x8, 0xb, 0x1, 0x1, 0x1, 0x8, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0x1, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x0, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}}) r4 = socket$netlink(0x10, 0x3, 0x0) writev(r4, &(0x7f0000000040)=[{&(0x7f0000000000)="290000002000190f00003fffffffda0602000000fde80001dd0000040d001800ea11c21d0005000000", 0x29}], 0x1) syz_usb_control_io(r3, 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r1, 0x40085112, &(0x7f0000000000)=@e={0xff, 0xa, 0x2, 0x4, @SEQ_NOTEON=@special, 0x7f, 0x7, 0x2}) ioctl$SNDRV_PCM_IOCTL_REWIND(r0, 0x40084146, &(0x7f0000000000)=0x9) r5 = syz_io_uring_setup(0xf00, &(0x7f0000000140)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r6, r7, r8, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r5, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) r9 = userfaultfd(0x801) ioctl$UFFDIO_API(r9, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x380}) ioctl$UFFDIO_REGISTER(r9, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r9, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00001b1000/0x4000)=nil, 0x400000, 0x2, 0x2}) r10 = syz_open_procfs$pagemap(0x0, &(0x7f0000000000)) ioctl$PAGEMAP_SCAN(r10, 0xc0606610, &(0x7f0000000100)={0x60, 0x0, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x2000000, 0x0, 0x0, 0x400, 0x10, 0x4a, 0x0, 0x2}) r11 = syz_open_dev$vim2m(&(0x7f0000000e40), 0x8, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r11, 0xc0405602, &(0x7f0000000000)={0x1f, 0x2, 0x3, "a677c17a067fd75f4600000069aece62bd255776000000000000004000", 0x4745504a}) r12 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r12, 0x5423, &(0x7f00000000c0)=0xe) ioctl$TCSETSW2(r12, 0x80047456, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x2, 0x1, "23f555d9adb42d4408020e90d1beaa82dc1ecf"}) ioctl$SNDRV_PCM_IOCTL_PAUSE(r0, 0x40044145, &(0x7f00000000c0)=0xf73f) 57.127794669s ago: executing program 0 (id=3383): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RVERSION(r1, &(0x7f0000001bc0)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@access_any}, {@noextend}]}}) setxattr$incfs_metadata(&(0x7f0000000080)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0, 0x1) 56.66515885s ago: executing program 33 (id=3383): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RVERSION(r1, &(0x7f0000001bc0)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@access_any}, {@noextend}]}}) setxattr$incfs_metadata(&(0x7f0000000080)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0, 0x1) 6.532991797s ago: executing program 4 (id=3664): bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000300)="ab", 0x1, 0x0, &(0x7f0000000380)={0x2, 0x4e22, @local}, 0x10) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000003c0)='@', 0x1}, {0x0}], 0x2, &(0x7f0000000080)=[@sndinfo={0x20, 0x84, 0x2, {0x4, 0x41, 0x7e}}], 0x20, 0x4048800}, 0x0) 6.41053375s ago: executing program 4 (id=3665): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000480)='./file0\x00', 0x18000, &(0x7f0000000640)=ANY=[@ANYRES32=0x0, @ANYRES16, @ANYRESOCT, @ANYRES8=0x0, @ANYRES32=0x0, @ANYRES64, @ANYRESDEC=0x0], 0x1, 0x304, &(0x7f0000000bc0)="$eJzs3M9PE2kYwPGnPyhtCZTDZje7yYZ3dy/rZQLVs9IYSIxNJEiNPxKTAabadGxJp8HUGJGTV+PNf8AD4ciNRPkHuHjTixdvXEw8yME4ptMZSssUpLSUH99PQubhfd5nOm9byDMNL1u3Xz7KZy0tq5clGFUSEBHZFhmWoHgC7jHoxBHZ7blcGPj64e+bd+5eT6XTE9NKTaZmLiaVUkMjbx8/jbnT1vtlc/j+1pfk583fN//c+jHzMGepnKUKxbLS1WzxU1mfNQ01n7PymlJTpqFbhsoVLKNUyxdr+axZXFioKL0wPxhfKBmWpfRCReWNiioXVblUUaEHeq6gNE1Tg3HBQTIr09N6qs3iuQ5fDLqkVErpIRGJ7clkVnpyQQAAoKea+/+gqE72/6v/bpQHbq0Nuf3/esSv/7/0sXauhv4/KiK+/b/3+L79v364/n9vR3RK2XZbZUfq/3EyjET2DAXqYTVZSulx9+fXsXxvddQJ6P8BAAAAAAAAAAAAAAAAAAAAADgNtm07Ydt2wjt6X/0iEnU2ltS+9ykNiciVHlwyOugIrz/OgPrGvfCQiPliMbOYqR3dCRsiYjqvf0K+O+8HVzX2dh6pqmF5Zy659UuLmZCTSWUlJ6YYMiaJPmmut+3Ja+mJMVXTWN8n8d31SUnIb/71Sd/6iPz/3656TRLyfk6KYsq8u2HOq382ptTVG+mm+pgzDwAAAACAs0BTO3zv3zWtVb5Wv3N/Pdr0+UCofn896nt/Hpa/wr1dOwAAAAAA54VVeZLXTdMo7QSDItI4EpPmOZ0Mwl06s7fCX63y/paheyvdJ/AevCEVdQc7/rQEDvG0tAiC0k7VSHU1qin1z7LP2vcLvI+NWs2RqXF35HXLOd0J/nj15lvnTnh5LXrAStsPQvu/AfqO57cPAAAAgONUb/q9kfHeXhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOfQcfx3tF6vEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgpfgYAAP//2a0C7Q==") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) fdatasync(r0) 6.151989305s ago: executing program 4 (id=3668): r0 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) symlink(&(0x7f00000005c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', &(0x7f00000002c0)='.\x02\x00') ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000680)={0x1, [[0xffffffff, 0xffffffff, 0xffffffff, 0x4000001, 0xffffffff, 0xfffffffc, 0xffffffff, 0xffffffff], [0xfffffffb, 0x2, 0xfffffffd, 0xa, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0x2a5a, 0x22, 0xffffffff, 0xffffffff, 0x3, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0xa, 0x186a0, 0x0, 0x0, 0x1}, {0x103, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x101000, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x20ffd, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x80383, 0x0) r2 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x63, 0x86, 0x35, 0x10, 0xcf3, 0x1010, 0x3687, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7f, 0x4, 0x50, 0x0, "", [{{0x9, 0x4, 0x7c, 0xb, 0x0, 0xa4, 0xca, 0xd4}}]}}]}}, 0x0) syz_usb_disconnect(r2) r3 = syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8f, 0x763, 0x2003, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x4, 0x10, 0x2, {0x8, 0xb, 0x1, 0x1, 0x1, 0x8, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5409, 0x1, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x2, 0x1, 0x80, {0x8, 0x25, 0x1, 0x80, 0x0, 0x6, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x81, 0x6, 0x9, {0x8, 0x25, 0x1, 0x0, 0x3c, 0x3, 0x9}}}}}}}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) writev(r4, &(0x7f0000000040)=[{&(0x7f0000000000)="290000002000190f00003fffffffda0602000000fde80001dd0000040d001800ea11c21d0005000000", 0x29}], 0x1) syz_usb_control_io(r3, 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r1, 0x40085112, &(0x7f0000000000)=@e={0xff, 0xa, 0x2, 0x4, @SEQ_NOTEON=@special, 0x7f, 0x7, 0x2}) ioctl$SNDRV_PCM_IOCTL_REWIND(r0, 0x40084146, &(0x7f0000000000)=0x9) r5 = syz_io_uring_setup(0xf00, &(0x7f0000000140)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r6, r7, r8, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r5, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) r9 = userfaultfd(0x801) ioctl$UFFDIO_API(r9, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x380}) ioctl$UFFDIO_REGISTER(r9, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r9, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00001b1000/0x4000)=nil, 0x400000, 0x2, 0x2}) r10 = syz_open_procfs$pagemap(0x0, &(0x7f0000000000)) ioctl$PAGEMAP_SCAN(r10, 0xc0606610, &(0x7f0000000100)={0x60, 0x0, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x2000000, 0x0, 0x0, 0x400, 0x10, 0x4a, 0x0, 0x2}) r11 = syz_open_dev$vim2m(&(0x7f0000000e40), 0x8, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r11, 0xc0405602, &(0x7f0000000000)={0x1f, 0x2, 0x3, "a677c17a067fd75f4600000069aece62bd255776000000000000004000", 0x4745504a}) r12 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r12, 0x5423, &(0x7f00000000c0)=0xe) ioctl$TCSETSW2(r12, 0x80047456, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x2, 0x1, "23f555d9adb42d4408020e90d1beaa82dc1ecf"}) ioctl$SNDRV_PCM_IOCTL_PAUSE(r0, 0x40044145, &(0x7f00000000c0)=0xf73f) 5.467938052s ago: executing program 1 (id=3671): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x143) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) syz_clone3(0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000280)=[@in={0x2, 0x4e20, @rand_addr=0x64010101}]}, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r3, 0x0, 0x20000000, 0x0) ptrace$setregs(0xf, r3, 0x2000200003, 0xffffffffffffffff) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x1fa, 0x3, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0x1}]}) 4.887990285s ago: executing program 1 (id=3675): r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f00000000c0)=0x11) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, 0x0) syz_usb_connect$hid(0x2, 0x3f, 0x0, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x10, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000d1000c0000000000010000b7080000000000007b8af8ff00000000b70800000f0000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800eb0085000000b60000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback=0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r2, 0x0, 0xe, 0x0, &(0x7f00000000c0)="9dbaac999f69835fc48373a1ee57", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001800050000000000000000002d000000000000010000000005000100080000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100090000000c000500000000000a000000300000001800050000000000000000002d0000000000000100000000050001000a0000000c000500000000000a000000300000001800050000000000000000002d0000000000000100000000050001000b0000000c000500000000000a000000300000001800050000000000000000002d0000000000000100000000050001000c0000000c000500000000000a000000300000001800050000000000000000002d0000000000000100000000050001000d0000000c000500000000000a000000300000001800050000000000000000002d0000000000000100000000050001000e0000000c000500000000000a000000300000001800050000000000000000002d0000000000000100000000050001000f0000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100100000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100110000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100120000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100130000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100140000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100150000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100160000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100170000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100180000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100190000000c000500000000000a000000300000001800050000000000000000002d0000000000000100000000050001001a0000000c000500000000000a000000300000001800050000000000000000002d0000000000000100000000050001"], 0x1bb0}}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x9, 0x2, 0x180, 0x4, 0x10, 0xf1, 0x7, 0x7fffffffffffe, 0x5, 0x4, 0x9, 0x7f, 0x800000000f4a, 0x100000000, 0xbdb], 0xc000, 0x4000}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) accept4$unix(0xffffffffffffffff, &(0x7f00000002c0)=@abs, &(0x7f0000000340)=0x6e, 0x100000) syz_clone(0x102c8000, 0x0, 0xfffffffffffffef7, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) 4.225776501s ago: executing program 4 (id=3680): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = userfaultfd(0x1) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x54c, 0x42f, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x0, 0xfe}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0}, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xffffffffffffff2c}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x64a, &(0x7f0000000040)={0x0, 0x8835c, 0xc000, 0x20000a, 0x33c}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x8, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0x3, 0x3}, {0xe, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f00008e5000/0x400000)=nil) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x7f}) write$sndseq(r4, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000180)={0x217, @time={0x65757100, 0x5}, 0x0, {}, 0x67, 0x2}) 3.320190452s ago: executing program 3 (id=3684): r0 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r0, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000300)="ab", 0x1, 0x0, &(0x7f0000000380)={0x2, 0x4e22, @local}, 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000003c0)='@', 0x1}, {0x0}], 0x2, &(0x7f0000000080)=[@sndinfo={0x20, 0x84, 0x2, {0x4, 0x41, 0x7e}}], 0x20, 0x4048800}, 0x0) 2.252179057s ago: executing program 3 (id=3687): r0 = socket$inet_tcp(0x2, 0x1, 0x0) splice(r0, 0x0, r0, 0xfffffffffffffffc, 0x5, 0x4) 1.970172474s ago: executing program 3 (id=3689): mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000040)={0x0, 0x0, "0007f8f9951e76c13f64323723e7eecdf40c363423eb3d259266f79c37865c6c1a4640ce1b22bb3327ef4f001d34c09f39c3539e4f8d3ee0878ae95bc7f52363c468b257ff3e24852548deb01efd54f11ed2c41d078b9cf1fc8f72566153c97e4af37017ea6b16b694bb4a6e4606c3fb19d1d2bd3c8c4e97da2213f9d5c3b90400000000040000c279f03558083906666827d61dcc3a633bffff250b5a293e3877adc1660edbc9a0307a0a170e7f5670e419dc44febf7ddc73fd4a5a0b6c28665f7f46c7084e17c809268103c7114ab40a68e528329d97afc3612e325c1eb4a3ab2e156aaf44480000000000000000000000000000000000aed500", "0615e456c196e819a321fdb3690bfab19538829a732a01781564ef7738cb5b82a704b3952f81c68bb4ceeaad63206f88201638e87c4981cbf9332cbc9c4d69e392bd33237ece7ad91e44edac0da8dacad81adf2e08c21ad6b44ce1f90bd618c255ca40cdb411485fb48a51d329c816b3488c7d032ef69c502c6e1236bd381efd410165988847c1dcb98a18ca2b853910e52044fa3b3026cb88de269537c8f26ffc3b15cbf279832bfc90bd95939043182e88050dfd2a4784a5d1453610fb1f1c2bac36c3ecd3e6fb756ef8880debeef3636afd981d8af4ab119928448f90351aec118b233cce7e4a1e49738d9679d33610a15b37bcd36e6a7cba931151b9c9ba5779d550e9ab21603a43a25f3b4895d8dc4f3ce0e7d5e964e888169ea79a0848e9338b3d34d62e963fbf98834f4455419907f0ffdb76373af77a34edee7789f56e7f01bdab9614a0d460f791a06e6cf5243bf2b3a1624a80ec7e1116f1c81f5ef4b895be74bf67eea9193428b58a8b62b7976d3d2e59796c46ec918c83cd49c3f43dbd2967586966c19ace7b0bef5f94eb333b362649f1bfa114f8b1f126e97ec672cff77e2130823fa7a1df6762c6a8917815e9f0a409ed32b133df7dc9afceffcd472b35145c83c9167764d25ce214133c6170adeb6653b30b226a3b6ff1363ac862a540c7fab584cd051ce7ee951e0f121d43cff75afbdec6bc6f6e8f7db58c8086751320d22ee8542e915cabc536e3767e9a9230c9ae8b92398f0ca2a7141ea4588af7afde10e5ec2a6fe85ba5712e126629d4e3998fc4721cb638f2ef8356049e3448466e2c400d5e8baf843fa399907cb526b791c5350ce29204cb6fe50b892a69ec6dbecc28f032a745738faa12c2a34222942fef0ec0511da5fe0b565ceac429da7cc25cfe0320b40a514723e2392a6a361032343edb79fd83cd0a354837153542fd61b3156b54c566036e493250c3a3214738e3cacc24a50d5dfd17d5008b4ca629c3062f3417cb69c48b8b888ae51256bb4e6c68e95a71a00383ad9df263f6a775ded64fef20ed5cb5f31c33cb86f839d00a12e40cd31219113619c4e0585454cb1776278bfd7f5c4275792afb790e83ff0fc6925355c7aee7a070477d9ec2292366e39b9dc66f7adcf449a1a718e5217183faf0f679efc5cef20bcdcf2d12ea0684084ec0d693256e280025b23b5a08b7b1ebe7d41fb045793f971d6ee066604818cb09d86c1eda99a44c35476a113fd5d1a7543f8f99424ebb78dd9e00d719502a6eafa743a061fa3fa55e4deaa0a011b6b9d633f10e0c9446b5a2e3f6d6014ab00695366c1a6bf0c32f703aebb7988c7d4d322681458e85626302c70f37628835e1fcfff1da3099c0b4af433eb9a51f9609f2c0c09a98b18880c846b34d6ac0210f073765666100976ee1d928893f983580ea47a012144633b98e02c3e81869534ab985eb3a73e0bac892dac949f85db949285a6a7a490b1075467226af23df82d8dd09b7282490fbb3ada9ed4cae8f761aefbe0701de6b132f12044c58ac1c2607c8f51361de5bed021dea13fd0a440263cf0b304522a324b581ab274e7bdae5994316657b5c0ab0220d9b08739729f7a35d436878c182aec4f08dd161c11ee5b7937fae7835e8bfe98a44c8d4bbb2e0eee0cb5d7c93517e96a9fc8132e60f3ef7c735bea1934b37df451f981c8d9210e61278c871e6dad6ceb89aa4d7245658a63e65cec7b81d307426a60a31cc917844a14e1d9ad83bef1c9f736d1836687c950d1275caece0d46ab9f3b0e95d9cf560eb8134e8346b35e0a6f60e6a87a14c4aeb3e0d06158390660a52a6e44b524c1e16de2bf99870f78fc81d267072bc63e97d3f26d23fd59799ff2c847d6a724cebc2377a582ba73d99a610a095c28d66c60910ac64b7d18847fa98fd8508002e0a149b082c731575b2e2763e67c821ba29eecd8b8c87981c4fb1fbbaaa4e8aa077ec98de1362fc7af7a0ac5e3297fd0d924124b2e255b5cc4f6b0873f3d34418d5ae0d6f734628f38cb9b856b2db3fbb2fafb76983eabc51a348e55789e997fa25cbe6e5031bd2e33d4e2686f964a65d1abf7f96a20a8b270b1522ace4adf6fdade5cd3f101574960d13267e2382f70027ebe5ef7f9418e14e6a8a130d2aec2253c8fe21825e3295774db0c9b1340ea28a96589ba0d9f79aa61b92aea6f704ef7f716d849b8c77e6922e198a086d8133491d0bb85b925825a6d307d7cc8f09c655aa3edabf84c75560dfb279ee3e8b825323279edc58c3161e72cf9ae02ef80d500da922c0abeb8b164abd9c17ef7c02e89000d67b0c2ddd078cacbf37c4826be3845948d598980d63c1d7aade89d0637d80a4c102a35eb027a08ef90cc20d17fc514926914e68e5de54b861200ffa4ce1cbc16e4ecf342a1176cdb561f7dea38b3ae0fd81260f72d34e6f33d364cf313d3b3161410dcbf5f0f0579a1d235b49bb5d27f85825b94f1899e7846d0292ad912d934574f9d55d2152dbfb39d662e6e0f2496182d012af8b4bebbdfa1d68e3e988869fb5cd9612db97e6cc574444f4b5025ec9827bafc55341bf6ad3fd4fab2ee43f343cb9bcec0c38384b5699e5c6d5973ba591978275c51a40200d340b9ed3681f08c69f58320f538f9cd78a34eb6ed55710d2478ea4bd15813921817b42f88f1bb038033b519668f0a2e8693b9a19c7bcf96eec04bda625b31c32f4286be922ab2c87aa30310c8f46551450d5bc26b5fbfdedaae0f756384023bb9a28d3200cfeaedd63d6afe076513e8ad73d16607cd4ede16344e60d8707357e82b1089258c56d851a435e23ce0919825e04471dd61a44c43e87c2959d4e89311a30ee8be010094d0ef109bb210dda58b21b685b9e9c078c9ded6117d9a88dd7799291969851cd4c3f22b5f870a275a692188dafcf6e89ba87b0eb61011de031fda25fb3349901d40da2bbdb76eda417c9fafd90fb23504ab150ca0033ea1d00000000000086ba3aaa79d0df4f2e4e4afa565e66d28aa167f835d080bf1d41d0e52dbf81c671f8eacae234bf4fc328302671fab46613b73daf2ace80aff2f80f6a9d84b82480178cc612aa90adfc80ab3bba7d1527fc6ab04f009011bf093494a0d329df4e53d855b1c0ff6a25d22052b3a778e1ca2fbe59c9eeedf99e13682d06da269560524ffa0f404b73b946edf900ee958ceba09a051e27a620fb78e7a352c182c8c2981ce822eeaf6323965b4b3f322d40d406a158b6f3cf5d74822de952fefc341d0dead6c1c8fed8e48e0a85b51c1dcc7796d3f45bb1f50467a475da76c356c9e031b096867da1dbb89c3a038d475dbcdb2df1278d5dba55c2fb5ba6a9778c2a244198491f0f711cdb2ef0332f347afffb1b098b4c59041ccb0c286bb2dd40e7ec713f6ffe0b1067678c748615dae3c1e090f3739a9035767fb9972580d19fdef49a5071f99c3706b8fa4991f430721cf3ca11af0e3bd7c4d0cd0ab5b7d98ee66730c20a098110e4a15ce0bfc88c41fe375f261fe3557e14eb5ff4a2cdf6a008fd7b6702951b8456e940fbd269a0f3ed515ac03cfecce67027d579e1226bd7b7381827453550343566508d38790ee838c3bf85c6c91a45e7a44752f57313533a3e82e4042e65d346afb20c0527575f79080aef4e1aa8d5868d190c8d37bdae7592e41bed37b9d4c30d8126d3debde02dff25f5ef1e48133e2a41cd55347bd23dcce57a00189619db629c530dc112d22ac72bce353681264b5175be40b3ba84408d0f56762cc720e96c128447be7128748e185be2640115556bac64d060207e629b0144e501c1c49c6abd15c7982b01e22da2ad04bb28df1a27f31e18040c16406071d798bb40d901d001e22cc5ed870d08702f49f0021814cdd814901a13c7ab061bb4b8172c639b3449e24f656fee58186e69e6874ea95d946da781b49ca080ffb4a3c87746c661f43e9be52d0ba2ee368b9c143687c8846abac599069decf41e69fddcadf31c5f715917df12df4eedbfcc5805fe8e661b8fcd7b130d7bcc4a9a152de93a15dddacf3cf52479956185a3c5000d18ddce0236d5858c0d8761bca7446e3d30f3e8f48d5e8f86a60cbe46f038b1028ffd35590bdacfeebb86e28d42a923bdc3f9a307b919341a2a7dda096d41070db245c2c424aedd4a4bb9863169454d09f25fd0aa2da7bfc97ad7aca886dd998e041133e07899ad48f7cda600de48ac3951152dfbe6331b8acae24cfd2dd2b14696c75040685c756942a0d049ee9863a2e480388f93876f3910ecb3a59fa16c25b2b3636a542f92744495e10a4ce37f19f5c2256e2d61775d388e2a86b52f76add2f956aa02501f5badb94da12595b2bbf88b05dc70caae6766fd3df4f299d0ff71c8787249b255ea49b3d33b3f1a8c9403cb75d64264465c3578538382b23d721f8a49134020ca2d9e887d9949624ac6d63322b6507e277a0020db9bfa2928ff0100000000000095adfe6b374ffa27001d37d3bbe725e75c257834572026c511f57dce67153a4008f9e75e07ed9237f600005800ee667c137fc78bc4fd4ebf4d228979ab0ccafbcd8b8daad76fb2abcfc585377ea6e19f170db898b950a7b0f4e75466a2ba26e7d60e0a6f5c54a3fe78677f3362c5b01ae791b6ece4f3b758d05a8e4e4ea7e4866ee67750ce2769f72a9f45780eadfae73b42d4dd4c614c797c694ece8af88cc732edabfa26ace57de54835c7551154dfa3be11a0d3b5845ac97b2da84410a652e72cd563acbb2b02bb59370cebaaa80014e3ad280944eae6fbf8d5f85237257bb5b8e5ec3e52dc06f8394176b325a577804e9eb78d7015172d17ed15f905f705d56687f53988bb207c74fbeb2b03a700258e835362886239f4d8f1c2cf6d4d10ff26d2579ea40a5fb99e5b6d01cdeda050d3faa78ed674f2899be08332086c8bf0410a7d06099c50a2d949d49a0f21b43bcdfbdf435875cf5a9def46db63746574ee8a5b1fbcef411154e914dd9e5bb1b1bd2944581083fb66a017e7972df3daefc487e4198cb281d3a80637d52b41738b7f1a57c867d5b2ee5d72465657593339506fd0c3807cd6445eb54cfb5ca9d35ef93eec6383224ebf85197eb6ed75f6c324f6a0345a25be6bb52ed347e57ccb059b903fb7db4e9f46513a4158ce29c1f5d6081b556bbc471e89225cad81aed34dae0f90ee8e7237b3b286e29b49d7a1700c537b28571f7d7e2a55e10792d6f7779ddefa3febdea5693048372a45903c035a96c6cfbe6f6c2b754581aac02f8a70e698be6e37fd411cf4b76317b47683f6b0f80dfdeef3a9767c7e5c303cf786093a21477431fea0458023953700"}) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x7}, 0x20, 0x40001000000000, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000440)={{0x0, 0x3938700}}, 0x0) syz_pidfd_open(0x0, 0x0) 1.760122479s ago: executing program 5 (id=3690): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x8001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000002c0)={'batadv_slave_0\x00', 0x400}) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) r3 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioprio_get$pid(0x2, 0x0) ioctl$VIDIOC_G_SELECTION(r3, 0xc040565e, &(0x7f0000000140)={0x2, 0x0, 0x2, {0xfffffff3, 0xffffffff, 0xfffffffe, 0x9}}) ioctl$PPPIOCSMAXCID(r1, 0x40047451, 0x0) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000100)=0x4) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000000240)="00214500002c00000000400600000a0000010a00000200500050000000010000f801601003000000000001010101", 0x2e}], 0x1, 0x0, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f00000001c0)="002145000014000b0000000600000a0000010a000002005000500000000200000002601003e80000000001000101", 0x2e}], 0x1, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write(r4, &(0x7f0000000080)='4', 0x1) r5 = memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) r6 = dup(r5) write$binfmt_elf32(r6, &(0x7f00000013c0)=ANY=[@ANYBLOB="7f454c464a030101050000000000000002000300040000003e03000038000000d600000097700000fe03200001000780080007000000000003000000020000000200000000040000e90a000001000080490000d757000000"], 0x58) r7 = fanotify_init(0x200, 0x0) fanotify_mark(r7, 0x1, 0x8001030, r6, 0x0) execveat(r6, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) madvise(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x6, &(0x7f0000006680)) umount2(0x0, 0xb) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x5c, 0x1, 0x1, 0x101, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @mcast2}}}]}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0xc49}]}]}, 0x5c}}, 0x0) 1.71885976s ago: executing program 3 (id=3691): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000100001000000e7472cbcbbb7b541000a70000000060a010400000000000000000200000344000480400001800e000100627974656f726465720000002c0002800800014000000009080002"], 0x98}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="7c0000001000010400"/20, @ANYRES32=r1, @ANYBLOB="00000000000000005c001280110001006272696467655f736c617665"], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x800) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 1.487637715s ago: executing program 1 (id=3692): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RVERSION(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18, 0x0, 0x0, {0xffffffffffffffff}}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f00000001c0), 0x2000000, &(0x7f0000000340)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB]) 1.409552787s ago: executing program 3 (id=3693): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) 1.147132743s ago: executing program 1 (id=3694): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000740)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r1, 0x10, 0x0, @in={0x2, 0x4e23, @empty}}}, 0x90) 1.106156444s ago: executing program 5 (id=3695): r0 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r0, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000300)="ab", 0x1, 0x0, &(0x7f0000000380)={0x2, 0x4e22, @local}, 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000003c0)='@', 0x1}, {0x0}], 0x2, &(0x7f0000000080)=[@sndinfo={0x20, 0x84, 0x2, {0x4, 0x41, 0x7e}}], 0x20, 0x4048800}, 0x0) 1.067377625s ago: executing program 4 (id=3696): r0 = syz_open_dev$cec(&(0x7f0000000180), 0x0, 0x149102) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000240)={"06a5bd99", 0xb, 0xff, 0x81, 0x8, 0x580, "3937f25922553cf0675b125c1df2e5", "d1463244", "d9970237", "ffffffff", ["a0acd1765bbd5f7240aec1fa", "5e948407d342355215d49472", "21a10d22b538118c8f26ecf9", "28caa7b24d22d8518a961613"]}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000040)={[0x7, 0xc, 0x6, 0xfffffffffffffffd, 0x8, 0x5, 0x4, 0x2, 0x8, 0x4, 0x3, 0x3, 0x1932be21, 0x100000000, 0x4, 0x4], 0xeeee0000, 0x40600}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) pwritev2(r1, &(0x7f00000008c0)=[{&(0x7f00000001c0)="5fb25ce756fc17247cc725b4db079bee80f3005d", 0x14}], 0x1, 0x4, 0x6, 0x15) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f00000000c0)={0x1, 0x0, [{0x287, 0x0, 0x3}]}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac9", 0x3}], 0x1}}], 0x1, 0x24088000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x9, 0x0, 0x0, 0x0, 0x13, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r4 = syz_open_dev$loop(&(0x7f0000000100), 0x4, 0x2001) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r5, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f00000002c0)={r5, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x13, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2827e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac008000000000000200", "f4bd000000801900", [0x8, 0xffffffff9673e359]}}) 792.240891ms ago: executing program 5 (id=3697): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) r1 = accept(r0, 0x0, 0x0) sendto$inet(r1, &(0x7f0000000080)="65119c7341fde705ea937a207481d939dc9a847d3509edf4744cfe767b7b9be49f20bce83bc45d86d5f211fe0d313d260f569d2c82c8a483e185d82428d4fc9a0000", 0xfffffffffffffeda, 0x1, 0x0, 0x0) 789.359951ms ago: executing program 1 (id=3698): r0 = socket$inet6(0xa, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x20) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='7', 0x1) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f00000008c0)=[@in6={0xa, 0x4e21, 0x3, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2c}}, 0xfffff07c}], 0x1c) 591.991686ms ago: executing program 5 (id=3699): r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/vlan/config\x00') mount$9p_fd(0x0, &(0x7f00000002c0)='.\x00', &(0x7f0000000040), 0x8000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}}) 204.914536ms ago: executing program 4 (id=3700): r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f00000000c0)=0x11) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, 0x0) syz_usb_connect$hid(0x2, 0x3f, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080), 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x10, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000d1000c0000000000010000b7080000000000007b8af8ff00000000b70800000f0000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800eb0085000000b60000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback=0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r1, 0x0, 0xe, 0x0, &(0x7f00000000c0)="9dbaac999f69835fc48373a1ee57", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001800050000000000000000002d000000000000010000000005000100080000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100090000000c000500000000000a000000300000001800050000000000000000002d0000000000000100000000050001000a0000000c000500000000000a000000300000001800050000000000000000002d0000000000000100000000050001000b0000000c000500000000000a000000300000001800050000000000000000002d0000000000000100000000050001000c0000000c000500000000000a000000300000001800050000000000000000002d0000000000000100000000050001000d0000000c000500000000000a000000300000001800050000000000000000002d0000000000000100000000050001000e0000000c000500000000000a000000300000001800050000000000000000002d0000000000000100000000050001000f0000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100100000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100110000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100120000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100130000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100140000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100150000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100160000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100170000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100180000000c000500000000000a000000300000001800050000000000000000002d000000000000010000000005000100190000000c000500000000000a000000300000001800050000000000000000002d0000000000000100000000050001001a0000000c000500000000000a000000300000001800050000000000000000002d0000000000000100000000050001"], 0x1bb0}}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x9, 0x2, 0x180, 0x4, 0x10, 0xf1, 0x7, 0x7fffffffffffe, 0x5, 0x4, 0x9, 0x7f, 0x800000000f4a, 0x100000000, 0xbdb], 0xc000, 0x4000}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) accept4$unix(0xffffffffffffffff, &(0x7f00000002c0)=@abs, &(0x7f0000000340)=0x6e, 0x100000) syz_clone(0x102c8000, 0x0, 0xfffffffffffffef7, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) 91.085658ms ago: executing program 5 (id=3701): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000100001000000e7472cbcbbb7b541000a70000000060a010400000000000000000200000344000480400001800e000100627974656f726465720000002c0002800800014000000009080002"], 0x98}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="7c0000001000010400"/20, @ANYRES32=r1, @ANYBLOB="00000000000000005c001280110001006272696467655f736c6176650000000044"], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x800) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 67.890579ms ago: executing program 1 (id=3702): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RVERSION(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18, 0x0, 0x0, {0xffffffffffffffff}}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f00000001c0), 0x2000000, &(0x7f0000000340)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB=',posixacl,version']) 4.25454ms ago: executing program 5 (id=3703): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x8001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000002c0)={'batadv_slave_0\x00', 0x400}) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) r3 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioprio_get$pid(0x2, 0x0) ioctl$VIDIOC_G_SELECTION(r3, 0xc040565e, &(0x7f0000000140)={0x2, 0x0, 0x2, {0xfffffff3, 0xffffffff, 0xfffffffe, 0x9}}) ioctl$PPPIOCSMAXCID(r1, 0x40047451, 0x0) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000100)=0x4) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000000240)="00214500002c00000000400600000a0000010a00000200500050000000010000f801601003000000000001010101", 0x2e}], 0x1, 0x0, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f00000001c0)="002145000014000b0000000600000a0000010a000002005000500000000200000002601003e80000000001000101", 0x2e}], 0x1, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write(r4, &(0x7f0000000080)='4', 0x1) r5 = memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) r6 = dup(r5) write$binfmt_elf32(r6, &(0x7f00000013c0)=ANY=[@ANYBLOB="7f454c464a030101050000000000000002000300040000003e03000038000000d600000097700000fe03200001000780080007000000000003000000020000000200000000040000e90a000001000080490000d757000000"], 0x58) r7 = fanotify_init(0x200, 0x0) fanotify_mark(r7, 0x1, 0x8001030, r6, 0x0) execveat(r6, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) madvise(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x6, &(0x7f0000006680)) umount2(0x0, 0xb) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x5c, 0x1, 0x1, 0x101, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @mcast2}}}]}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0xc49}]}]}, 0x5c}}, 0x0) 0s ago: executing program 3 (id=3704): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = userfaultfd(0x1) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x54c, 0x42f, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x0, 0xfe}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0}, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xffffffffffffff2c}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x64a, &(0x7f0000000040)={0x0, 0x8835c, 0xc000, 0x20000a, 0x33c}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x8, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0x3, 0x3}, {0xe, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f00008e5000/0x400000)=nil) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00', 0x7f}) write$sndseq(r4, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000180)={0x217, @time={0x65757100, 0x5}, 0x0, {}, 0x67, 0x2}) kernel console output (not intermixed with test programs): 695.832351][T14813] ovl_dir_read+0x26/0x560 [ 695.837816][T14813] ? ovl_path_next+0x1ff/0x340 [ 695.842628][T14813] ovl_dir_read_merged+0x166/0x350 [ 695.847808][T14813] ? ovl_check_empty_dir+0x440/0x440 [ 695.853103][T14813] ? ovl_fill_real+0x4f0/0x4f0 [ 695.857889][T14813] ovl_iterate+0xdbf/0x2020 [ 695.862424][T14813] ? ovl_cache_put+0x190/0x190 [ 695.867230][T14813] ? __might_sleep+0xe0/0xe0 [ 695.871852][T14813] ? read_lock_is_recursive+0x20/0x20 [ 695.877246][T14813] ? down_write+0x16e/0x200 [ 695.881839][T14813] ? down_read_killable+0x340/0x340 [ 695.887068][T14813] ? ovl_cache_put+0x190/0x190 [ 695.891858][T14813] wrap_directory_iterator+0x92/0xd0 [ 695.897193][T14813] iterate_dir+0x1bd/0x590 [ 695.901654][T14813] __se_sys_getdents64+0xf6/0x270 [ 695.906697][T14813] ? __x64_sys_getdents64+0x80/0x80 [ 695.911931][T14813] ? filldir+0x620/0x620 [ 695.916194][T14813] ? lockdep_hardirqs_on+0x98/0x150 [ 695.921427][T14813] do_syscall_64+0x55/0xb0 [ 695.925860][T14813] ? clear_bhb_loop+0x40/0x90 [ 695.930719][T14813] ? clear_bhb_loop+0x40/0x90 [ 695.935422][T14813] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 695.941354][T14813] RIP: 0033:0x7f47c2f9e159 [ 695.945825][T14813] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 695.965560][T14813] RSP: 002b:00007f47c3d8a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 695.974160][T14813] RAX: ffffffffffffffda RBX: 00007f47c3225fa0 RCX: 00007f47c2f9e159 [ 695.982183][T14813] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 695.990293][T14813] RBP: 00007f47c3035024 R08: 0000000000000000 R09: 0000000000000000 [ 695.998315][T14813] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 696.006357][T14813] R13: 00007f47c3226038 R14: 00007f47c3225fa0 R15: 00007fffe7f50008 [ 696.014384][T14813] [ 696.021124][T11839] usb 4-1: reset high-speed USB device number 72 using dummy_hcd [ 696.213553][T11839] usb 4-1: device firmware changed [ 696.226468][T11839] usb 4-1: USB disconnect, device number 72 [ 696.266097][T14819] fuse: Bad value for 'rootmode' [ 696.390120][T11839] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 696.517080][T14823] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2964'. [ 696.544870][T14825] loop4: detected capacity change from 0 to 7 [ 696.553375][T14825] Dev loop4: unable to read RDB block 7 [ 696.559129][T14825] loop4: AHDI p1 p2 p3 [ 696.564157][T14825] loop4: partition table partially beyond EOD, truncated [ 696.571913][T14825] loop4: p1 start 1601398130 is beyond EOD, truncated [ 696.578738][T14825] loop4: p2 start 1702059890 is beyond EOD, truncated [ 696.600199][T11839] usb 4-1: Using ep0 maxpacket: 16 [ 696.628036][T11839] usb 4-1: config 127 has an invalid interface number: 124 but max is 0 [ 696.642249][T11839] usb 4-1: config 127 has no interface number 0 [ 696.654277][T11839] usb 4-1: config 127 interface 124 has no altsetting 0 [ 696.677016][T11839] usb 4-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 696.696946][T11839] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 696.714789][T11839] usb 4-1: Product: syz [ 696.723669][T11839] usb 4-1: Manufacturer: syz [ 696.729536][T11839] usb 4-1: SerialNumber: syz [ 697.111297][ T9] usb 1-1: USB disconnect, device number 59 [ 697.339261][T14839] fuse: Bad value for 'rootmode' [ 697.659634][T14846] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2974'. [ 697.716488][T14849] loop3: detected capacity change from 0 to 7 [ 697.736759][T14849] Dev loop3: unable to read RDB block 7 [ 697.757371][T14849] loop3: unable to read partition table [ 697.773084][T14849] loop3: partition table beyond EOD, truncated [ 697.793980][T14849] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 698.075266][T11839] usb 4-1: USB disconnect, device number 73 [ 698.363811][T14861] fuse: Bad value for 'rootmode' [ 698.641302][T11839] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 698.840070][T11839] usb 4-1: Using ep0 maxpacket: 8 [ 698.855763][T11839] usb 4-1: config index 0 descriptor too short (expected 74, got 45) [ 698.881989][T11839] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 698.924807][T11839] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 699.000135][T11839] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 26232, setting to 64 [ 699.071254][T11839] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 699.143974][T11839] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 699.240119][T11839] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 699.485054][T11839] usbtmc 4-1:16.0: bulk endpoints not found [ 700.340558][ T9] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 700.498680][T14884] loop3: detected capacity change from 0 to 7 [ 700.509242][T14884] Dev loop3: unable to read RDB block 7 [ 700.518976][T14884] loop3: unable to read partition table [ 700.524994][T14884] loop3: partition table beyond EOD, truncated [ 700.531487][T14884] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 700.540921][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 700.556904][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 700.578189][ T9] usb 2-1: config 127 has an invalid interface number: 124 but max is 0 [ 700.599976][ T9] usb 2-1: config 127 has no interface number 0 [ 700.606495][ T9] usb 2-1: config 127 interface 124 has no altsetting 0 [ 700.622861][ T9] usb 2-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 700.632457][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 700.641292][ T9] usb 2-1: Product: syz [ 700.645977][ T9] usb 2-1: Manufacturer: syz [ 700.651375][ T9] usb 2-1: SerialNumber: syz [ 700.902219][T14889] fuse: Unknown parameter 'use00000000000000000000' [ 701.519819][T12812] usb 4-1: USB disconnect, device number 74 [ 701.550037][ T9] usb 2-1: reset high-speed USB device number 86 using dummy_hcd [ 701.812706][ T9] usb 2-1: device firmware changed [ 701.843573][T14907] loop3: detected capacity change from 0 to 7 [ 701.845420][ T9] usb 2-1: USB disconnect, device number 86 [ 701.882292][T14907] Dev loop3: unable to read RDB block 7 [ 701.887966][T14907] loop3: unable to read partition table [ 701.920432][T14907] loop3: partition table beyond EOD, truncated [ 701.947247][T14907] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 702.051880][ T9] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 702.279455][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 702.293038][ T9] usb 2-1: config 127 has an invalid interface number: 124 but max is 0 [ 702.312599][ T9] usb 2-1: config 127 has no interface number 0 [ 702.319185][ T9] usb 2-1: config 127 interface 124 has no altsetting 0 [ 702.347663][ T9] usb 2-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 702.367872][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 702.380142][ T9] usb 2-1: Product: syz [ 702.384379][ T9] usb 2-1: Manufacturer: syz [ 702.409984][ T9] usb 2-1: SerialNumber: syz [ 702.440605][T14917] fuse: Unknown parameter 'use00000000000000000000' [ 703.140207][ T23] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 703.350879][ T23] usb 4-1: Using ep0 maxpacket: 8 [ 703.358494][ T23] usb 4-1: config index 0 descriptor too short (expected 74, got 45) [ 703.371169][ T23] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 703.388978][ T23] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 703.399649][ T23] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 26232, setting to 64 [ 703.414816][ T23] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 703.458831][ T23] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 703.472907][ T23] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 703.490830][ T23] usbtmc 4-1:16.0: bulk endpoints not found [ 703.574253][ T5789] Bluetooth: hci0: command 0x0406 tx timeout [ 703.691015][T14947] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3012'. [ 703.775283][ T9] usb 2-1: USB disconnect, device number 87 [ 704.689351][T14968] fuse: Bad value for 'fd' [ 704.709068][T14968] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3019'. [ 705.160045][ T9] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 705.370005][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 705.383057][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 705.405270][ T9] usb 2-1: config 127 has an invalid interface number: 124 but max is 0 [ 705.425762][ T9] usb 2-1: config 127 has no interface number 0 [ 705.441433][ T9] usb 2-1: config 127 interface 124 has no altsetting 0 [ 705.465896][ T9] usb 2-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 705.489790][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 705.514066][ T9] usb 2-1: Product: syz [ 705.533239][ T9] usb 2-1: Manufacturer: syz [ 705.547074][ T9] usb 2-1: SerialNumber: syz [ 705.703769][T14972] loop4: detected capacity change from 0 to 7 [ 705.734097][T14972] Dev loop4: unable to read RDB block 7 [ 705.744441][T14972] loop4: unable to read partition table [ 705.752461][T14972] loop4: partition table beyond EOD, truncated [ 705.758921][T14972] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 705.899133][ T5820] usb 4-1: USB disconnect, device number 75 [ 705.910751][T14975] loop3: detected capacity change from 0 to 7 [ 705.919361][T14975] Dev loop3: unable to read RDB block 7 [ 705.934053][T14975] loop3: unable to read partition table [ 705.944115][T14975] loop3: partition table beyond EOD, truncated [ 705.952711][T14975] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 705.969427][ T5141] Dev loop3: unable to read RDB block 7 [ 705.978281][ T5141] loop3: unable to read partition table [ 705.996997][ T5141] loop3: partition table beyond EOD, truncated [ 706.450107][ T9] usb 2-1: reset high-speed USB device number 88 using dummy_hcd [ 706.555790][T14992] fuse: Bad value for 'fd' [ 706.579134][T14992] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3029'. [ 706.654599][ T9] usb 2-1: device firmware changed [ 706.660269][ T5817] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 706.680987][ T9] usb 2-1: USB disconnect, device number 88 [ 706.840192][ T5817] usb 4-1: Using ep0 maxpacket: 16 [ 706.848200][ T5817] usb 4-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 706.859298][ T5817] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 706.872974][ T9] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 706.892663][ T5817] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 706.910411][ T5817] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 706.929314][ T5817] usb 4-1: Product: syz [ 706.934558][ T5817] usb 4-1: Manufacturer: syz [ 706.939295][ T5817] usb 4-1: SerialNumber: syz [ 706.995836][T15002] loop3: detected capacity change from 0 to 7 [ 707.018648][T15002] Dev loop3: unable to read RDB block 7 [ 707.030448][T15002] loop3: unable to read partition table [ 707.039703][T15002] loop3: partition table beyond EOD, truncated [ 707.050864][T15002] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 707.082790][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 707.095435][ T9] usb 2-1: config 127 has an invalid interface number: 124 but max is 0 [ 707.104292][ T9] usb 2-1: config 127 has no interface number 0 [ 707.117754][ T9] usb 2-1: config 127 interface 124 has no altsetting 0 [ 707.137886][ T9] usb 2-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 707.157342][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 707.173598][ T9] usb 2-1: Product: syz [ 707.183555][ T9] usb 2-1: Manufacturer: syz [ 707.190702][ T5817] usb 4-1: 0:2 : does not exist [ 707.193183][ T9] usb 2-1: SerialNumber: syz [ 707.213537][ T5817] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 707.264415][ T5817] usb 4-1: USB disconnect, device number 76 [ 707.334162][ T8913] udevd[8913]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 707.860864][T15018] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 708.064434][T15028] fuse: Bad value for 'fd' [ 708.080504][T15028] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3043'. [ 708.448964][ T9] usb 2-1: USB disconnect, device number 89 [ 708.518235][T15035] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3046'. [ 709.391605][T15053] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3055'. [ 709.440037][ T5817] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 709.498381][T11839] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 709.630098][ T5817] usb 3-1: Using ep0 maxpacket: 16 [ 709.637107][ T5817] usb 3-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 709.648109][ T5817] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 709.659334][ T5817] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 709.679429][ T5817] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 709.689032][ T5817] usb 3-1: Product: syz [ 709.696334][ T5817] usb 3-1: Manufacturer: syz [ 709.703191][T15060] fuse: Bad value for 'fd' [ 709.709196][T11839] usb 1-1: Using ep0 maxpacket: 16 [ 709.714727][ T5817] usb 3-1: SerialNumber: syz [ 709.722497][T11839] usb 1-1: unable to get BOS descriptor or descriptor too short [ 709.743387][T11839] usb 1-1: config 127 has an invalid interface number: 124 but max is 0 [ 709.767914][T15060] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3058'. [ 709.776129][T11839] usb 1-1: config 127 has no interface number 0 [ 709.783426][T11839] usb 1-1: config 127 interface 124 has no altsetting 0 [ 709.803394][T11839] usb 1-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 709.824812][T11839] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 709.839562][T11839] usb 1-1: Product: syz [ 709.844433][T11839] usb 1-1: Manufacturer: syz [ 709.849159][T11839] usb 1-1: SerialNumber: syz [ 709.906147][T15064] loop3: detected capacity change from 0 to 7 [ 709.917220][T15064] Dev loop3: unable to read RDB block 7 [ 709.923662][T15064] loop3: unable to read partition table [ 709.930890][T15064] loop3: partition table beyond EOD, truncated [ 709.943424][T15064] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 709.979638][ T5817] usb 3-1: 0:2 : does not exist [ 710.007063][ T5817] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 710.071149][ T5817] usb 3-1: USB disconnect, device number 63 [ 710.138829][ T6220] udevd[6220]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 710.432629][T15072] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3064'. [ 710.760797][T15080] loop3: detected capacity change from 0 to 128 [ 710.761122][T11839] usb 1-1: reset high-speed USB device number 60 using dummy_hcd [ 710.982408][T11839] usb 1-1: device firmware changed [ 711.018936][T11839] usb 1-1: USB disconnect, device number 60 [ 711.200194][T11839] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 711.223827][T15092] Illegal XDP return value 2524341800 on prog (id 55) dev N/A, expect packet loss! [ 711.249879][T15095] fuse: Bad value for 'fd' [ 711.298424][T15095] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3073'. [ 711.380628][T11839] usb 1-1: Using ep0 maxpacket: 16 [ 711.389149][T11839] usb 1-1: config 127 has an invalid interface number: 124 but max is 0 [ 711.406875][T11839] usb 1-1: config 127 has no interface number 0 [ 711.422324][T11839] usb 1-1: config 127 interface 124 has no altsetting 0 [ 711.444509][T11839] usb 1-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 711.462230][T11839] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.483522][T11839] usb 1-1: Product: syz [ 711.492481][T11839] usb 1-1: Manufacturer: syz [ 711.502801][T11839] usb 1-1: SerialNumber: syz [ 711.617710][T15103] loop3: detected capacity change from 0 to 7 [ 711.626419][T15103] Dev loop3: unable to read RDB block 7 [ 711.636154][T15103] loop3: unable to read partition table [ 711.643335][T15103] loop3: partition table beyond EOD, truncated [ 711.649743][T15103] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 711.741108][ T9] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 711.950009][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 711.959087][ T9] usb 4-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 711.970109][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 711.982789][ T9] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 711.992650][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 712.002976][ T9] usb 4-1: Product: syz [ 712.007206][ T9] usb 4-1: Manufacturer: syz [ 712.011969][ T9] usb 4-1: SerialNumber: syz [ 712.277520][ T9] usb 4-1: 0:2 : does not exist [ 712.303681][ T9] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 712.370458][ T9] usb 4-1: USB disconnect, device number 77 [ 712.601215][T15123] loop4: detected capacity change from 0 to 7 [ 712.628486][T15123] Dev loop4: unable to read RDB block 7 [ 712.640937][T15123] loop4: unable to read partition table [ 712.646902][T15123] loop4: partition table beyond EOD, truncated [ 712.669992][T15123] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 712.750250][T11839] usb 1-1: USB disconnect, device number 61 [ 712.973009][T15137] fuse: Bad value for 'fd' [ 712.998503][T15137] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3091'. [ 713.009655][T15138] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3093'. [ 714.086123][T15165] loop4: detected capacity change from 0 to 7 [ 714.128536][T15165] Dev loop4: unable to read RDB block 7 [ 714.140354][T15165] loop4: unable to read partition table [ 714.150346][ T5817] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 714.156609][T15165] loop4: partition table beyond EOD, truncated [ 714.217955][T15165] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 714.270404][ T5141] Dev loop4: unable to read RDB block 7 [ 714.279756][ T5141] loop4: unable to read partition table [ 714.291901][ T5141] loop4: partition table beyond EOD, truncated [ 714.350128][ T5817] usb 4-1: Using ep0 maxpacket: 16 [ 714.374601][ T5817] usb 4-1: unable to get BOS descriptor or descriptor too short [ 714.396550][ T5817] usb 4-1: config 127 has an invalid interface number: 124 but max is 0 [ 714.425637][ T5817] usb 4-1: config 127 has no interface number 0 [ 714.456376][ T5817] usb 4-1: config 127 interface 124 has no altsetting 0 [ 714.473315][T15187] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3100'. [ 714.495440][ T5817] usb 4-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 714.507763][ T5817] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 714.519650][ T5817] usb 4-1: Product: syz [ 714.531070][ T5817] usb 4-1: Manufacturer: syz [ 714.535738][ T5817] usb 4-1: SerialNumber: syz [ 714.869284][T15191] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3103'. [ 715.460180][ T5817] usb 4-1: reset high-speed USB device number 78 using dummy_hcd [ 715.551900][T15204] fuse: Invalid rootmode [ 715.598913][T15204] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3107'. [ 715.668422][ T5817] usb 4-1: device firmware changed [ 715.696146][ T5817] usb 4-1: USB disconnect, device number 78 [ 715.834403][T15208] loop4: detected capacity change from 0 to 7 [ 715.870074][ T5817] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 715.880587][T15208] Dev loop4: unable to read RDB block 7 [ 715.890835][T15208] loop4: unable to read partition table [ 715.900137][T15208] loop4: partition table beyond EOD, truncated [ 715.917432][T15208] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 716.080104][ T5817] usb 4-1: Using ep0 maxpacket: 16 [ 716.102737][ T5817] usb 4-1: config 127 has an invalid interface number: 124 but max is 0 [ 716.131384][ T5817] usb 4-1: config 127 has no interface number 0 [ 716.148039][ T5817] usb 4-1: config 127 interface 124 has no altsetting 0 [ 716.168770][ T5817] usb 4-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 716.191438][ T5817] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 716.199693][ T5817] usb 4-1: Product: syz [ 716.208549][ T5817] usb 4-1: Manufacturer: syz [ 716.227699][ T5817] usb 4-1: SerialNumber: syz [ 716.284351][ T5817] usb 4-1: can't set config #127, error -71 [ 716.298645][ T5817] usb 4-1: USB disconnect, device number 79 [ 716.753903][T15228] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3118'. [ 717.010312][T11839] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 717.210132][T11839] usb 1-1: Using ep0 maxpacket: 16 [ 717.217628][T11839] usb 1-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 717.230494][T11839] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 717.243304][T11839] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 717.245675][T15237] fuse: Invalid rootmode [ 717.271731][T11839] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 717.290575][T11839] usb 1-1: Product: syz [ 717.294818][T11839] usb 1-1: Manufacturer: syz [ 717.295831][T15237] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3122'. [ 717.299449][T11839] usb 1-1: SerialNumber: syz [ 717.390108][ T23] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 717.563167][T11839] usb 1-1: 0:2 : does not exist [ 717.580715][ T23] usb 2-1: Using ep0 maxpacket: 16 [ 717.591685][T11839] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 717.599710][ T23] usb 2-1: unable to get BOS descriptor or descriptor too short [ 717.623621][ T23] usb 2-1: config 127 has an invalid interface number: 124 but max is 0 [ 717.642635][ T23] usb 2-1: config 127 has no interface number 0 [ 717.661051][ T23] usb 2-1: config 127 interface 124 has no altsetting 0 [ 717.670338][T11839] usb 1-1: USB disconnect, device number 62 [ 717.685981][ T23] usb 2-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 717.703396][ T23] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 717.714132][ T23] usb 2-1: Product: syz [ 717.723635][ T23] usb 2-1: Manufacturer: syz [ 717.728332][ T23] usb 2-1: SerialNumber: syz [ 717.750301][ T6220] udevd[6220]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 717.912093][T15250] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3128'. [ 718.304759][T15258] loop4: detected capacity change from 0 to 7 [ 718.328518][T15258] Dev loop4: unable to read RDB block 7 [ 718.340185][T15258] loop4: unable to read partition table [ 718.350387][T15258] loop4: partition table beyond EOD, truncated [ 718.367081][T15258] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 718.640083][ T23] usb 2-1: reset high-speed USB device number 90 using dummy_hcd [ 718.853818][ T23] usb 2-1: device firmware changed [ 718.872307][ T23] usb 2-1: USB disconnect, device number 90 [ 718.882873][T15272] fuse: Invalid rootmode [ 718.930358][ T5789] Bluetooth: hci1: command 0x0406 tx timeout [ 718.931102][T15272] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3138'. [ 719.050174][ T23] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 719.217371][T15275] 9pnet_fd: Insufficient options for proto=fd [ 719.230082][ T23] usb 2-1: Using ep0 maxpacket: 16 [ 719.238754][ T23] usb 2-1: config 127 has an invalid interface number: 124 but max is 0 [ 719.269638][ T23] usb 2-1: config 127 has no interface number 0 [ 719.276207][ T23] usb 2-1: config 127 interface 124 has no altsetting 0 [ 719.299573][ T23] usb 2-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 719.325380][ T23] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 719.334620][ T23] usb 2-1: Product: syz [ 719.338797][T15279] loop2: detected capacity change from 0 to 128 [ 719.356616][ T23] usb 2-1: Manufacturer: syz [ 719.369825][ T23] usb 2-1: SerialNumber: syz [ 720.060784][T15296] 9pnet_fd: Insufficient options for proto=fd [ 720.530206][ T5818] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 720.690691][ T23] usb 2-1: USB disconnect, device number 91 [ 720.722320][ T5818] usb 4-1: config 1 has an invalid interface number: 3 but max is 0 [ 720.730980][ T5818] usb 4-1: config 1 has no interface number 0 [ 720.740314][ T5818] usb 4-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 720.767472][ T5818] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 720.788141][ T5818] usb 4-1: Product: syz [ 720.792416][T15305] loop4: detected capacity change from 0 to 7 [ 720.797844][T15305] Dev loop4: unable to read RDB block 7 [ 720.818543][T15305] loop4: unable to read partition table [ 720.824627][ T5818] usb 4-1: Manufacturer: syz [ 720.824862][T15305] loop4: partition table beyond EOD, [ 720.829254][ T5818] usb 4-1: SerialNumber: syz [ 720.849341][T15305] truncated [ 720.869341][T15305] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 721.075513][T15309] fuse: Bad value for 'rootmode' [ 721.085864][T15300] binder: BINDER_SET_CONTEXT_MGR already set [ 721.102329][T15300] binder: 15299:15300 ioctl 4018620d 200000004a80 returned -16 [ 721.114368][T15309] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3154'. [ 721.146685][ T5818] usb 4-1: 3:1 : does not exist [ 721.154039][ T5818] usb 4-1: 3:2 : does not exist [ 721.220844][ T5818] usb 4-1: USB disconnect, device number 80 [ 721.297424][ T6220] udevd[6220]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 722.086307][T15315] loop1: detected capacity change from 0 to 32768 [ 722.140513][ T9] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 722.330487][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 722.340621][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 722.356268][ T9] usb 1-1: config 127 has an invalid interface number: 124 but max is 0 [ 722.368503][ T9] usb 1-1: config 127 has no interface number 0 [ 722.385404][ T9] usb 1-1: config 127 interface 124 has no altsetting 0 [ 722.405928][ T9] usb 1-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 722.430025][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 722.446047][ T9] usb 1-1: Product: syz [ 722.457139][ T9] usb 1-1: Manufacturer: syz [ 722.472207][ T9] usb 1-1: SerialNumber: syz [ 723.177542][T15348] fuse: Bad value for 'rootmode' [ 723.190286][T15348] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3169'. [ 723.271196][T12812] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 723.299344][T15350] capability: warning: `syz.1.3170' uses 32-bit capabilities (legacy support in use) [ 723.400178][ T9] usb 1-1: reset high-speed USB device number 63 using dummy_hcd [ 723.474934][T12812] usb 4-1: config 1 has an invalid interface number: 3 but max is 0 [ 723.488120][T12812] usb 4-1: config 1 has no interface number 0 [ 723.498847][T12812] usb 4-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 723.508458][T12812] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 723.517513][T12812] usb 4-1: Product: syz [ 723.522122][T12812] usb 4-1: Manufacturer: syz [ 723.526766][T12812] usb 4-1: SerialNumber: syz [ 723.600729][ T9] usb 1-1: device firmware changed [ 723.611879][T15352] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3171'. [ 723.624105][ T9] usb 1-1: USB disconnect, device number 63 [ 723.765053][T12812] usb 4-1: 3:1 : does not exist [ 723.771477][T12812] usb 4-1: 3:2 : does not exist [ 723.799975][ T9] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 723.808239][T12812] usb 4-1: USB disconnect, device number 81 [ 723.878041][ T6220] udevd[6220]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 724.010145][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 724.038224][ T9] usb 1-1: config 127 has an invalid interface number: 124 but max is 0 [ 724.060013][ T9] usb 1-1: config 127 has no interface number 0 [ 724.078655][ T9] usb 1-1: config 127 interface 124 has no altsetting 0 [ 724.096813][ T9] usb 1-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 724.108453][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 724.120014][ T9] usb 1-1: Product: syz [ 724.124299][ T9] usb 1-1: Manufacturer: syz [ 724.134376][ T9] usb 1-1: SerialNumber: syz [ 724.506799][T15367] FAULT_INJECTION: forcing a failure. [ 724.506799][T15367] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 724.546105][T15367] CPU: 1 PID: 15367 Comm: syz.3.3177 Not tainted syzkaller #0 [ 724.553648][T15367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 724.563755][T15367] Call Trace: [ 724.567087][T15367] [ 724.570061][T15367] dump_stack_lvl+0x18c/0x250 [ 724.574977][T15367] ? show_regs_print_info+0x20/0x20 [ 724.582165][T15367] ? load_image+0x420/0x420 [ 724.586684][T15367] ? __lock_acquire+0x7d80/0x7d80 [ 724.591742][T15367] should_fail_ex+0x394/0x4c0 [ 724.596465][T15367] prepare_alloc_pages+0x1e1/0x5b0 [ 724.601616][T15367] __alloc_pages+0x134/0x460 [ 724.606258][T15367] ? zone_statistics+0x170/0x170 [ 724.611409][T15367] ? lockdep_init_map_type+0x9c/0x8e0 [ 724.616836][T15367] ? lockdep_softirqs_off+0x440/0x440 [ 724.622267][T15367] ? free_zapped_rcu+0x250/0x250 [ 724.623718][T15369] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3178'. [ 724.627248][T15367] __kmalloc_large_node+0x8c/0x1f0 [ 724.641354][T15367] ? io_alloc_hash_table+0x2d/0xb0 [ 724.646810][T15367] __kmalloc+0x114/0x240 [ 724.651113][T15367] ? init_hash_table+0xc7/0xe0 [ 724.655931][T15367] io_alloc_hash_table+0x2d/0xb0 [ 724.660903][T15367] io_ring_ctx_alloc+0x160/0xc10 [ 724.665885][T15367] io_uring_create+0x2df/0x1330 [ 724.670765][T15367] ? __might_fault+0xc6/0x120 [ 724.675497][T15367] ? __might_fault+0xaa/0x120 [ 724.680304][T15367] __se_sys_io_uring_setup+0x29f/0x2b0 [ 724.685808][T15367] ? __x64_sys_io_uring_setup+0x60/0x60 [ 724.691457][T15367] ? lockdep_hardirqs_on+0x98/0x150 [ 724.696691][T15367] do_syscall_64+0x55/0xb0 [ 724.701146][T15367] ? clear_bhb_loop+0x40/0x90 [ 724.705960][T15367] ? clear_bhb_loop+0x40/0x90 [ 724.710672][T15367] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 724.716593][T15367] RIP: 0033:0x7fbd9f39e159 [ 724.721023][T15367] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 724.740683][T15367] RSP: 002b:00007fbda020d028 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 724.749151][T15367] RAX: ffffffffffffffda RBX: 00007fbd9f625fa0 RCX: 00007fbd9f39e159 [ 724.757249][T15367] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 000000000000162e [ 724.765575][T15367] RBP: 00007fbd9f435024 R08: 0000000000000000 R09: 0000000000000000 [ 724.773585][T15367] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 724.781561][T15367] R13: 00007fbd9f626038 R14: 00007fbd9f625fa0 R15: 00007ffd61fc4e68 [ 724.789725][T15367] [ 724.942921][T15372] netlink: 'syz.3.3179': attribute type 1 has an invalid length. [ 725.004358][T15372] 8021q: adding VLAN 0 to HW filter on device bond1 [ 725.034345][T15376] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3179'. [ 725.048881][T15376] bond1: entered promiscuous mode [ 725.055931][T15376] bond1: entered allmulticast mode [ 725.267683][T15383] fuse: Bad value for 'rootmode' [ 725.301821][T15383] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3182'. [ 725.315563][T15385] loop3: detected capacity change from 0 to 128 [ 725.379655][ T8913] blk_print_req_error: 15 callbacks suppressed [ 725.379675][ T8913] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 725.430539][ T9] usb 1-1: USB disconnect, device number 64 [ 725.632359][T15393] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3188'. [ 725.700094][ T5818] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 725.729722][T15395] FAULT_INJECTION: forcing a failure. [ 725.729722][T15395] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 725.743836][T15395] CPU: 0 PID: 15395 Comm: syz.3.3189 Not tainted syzkaller #0 [ 725.751434][T15395] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 725.761595][T15395] Call Trace: [ 725.764989][T15395] [ 725.767942][T15395] dump_stack_lvl+0x18c/0x250 [ 725.772652][T15395] ? show_regs_print_info+0x20/0x20 [ 725.777977][T15395] ? load_image+0x420/0x420 [ 725.782498][T15395] ? __might_fault+0xaa/0x120 [ 725.787189][T15395] ? __lock_acquire+0x7d80/0x7d80 [ 725.792237][T15395] should_fail_ex+0x394/0x4c0 [ 725.796933][T15395] _copy_to_iter+0x1ce/0x1110 [ 725.801633][T15395] ? __asan_memset+0x22/0x40 [ 725.806260][T15395] ? iov_iter_init+0x1e0/0x1e0 [ 725.811043][T15395] ? crng_make_state+0x142/0x700 [ 725.816076][T15395] get_random_bytes_user+0x1d1/0x3d0 [ 725.821404][T15395] ? mix_interrupt_randomness+0x2e0/0x2e0 [ 725.827176][T15395] ? do_futex+0x35d/0x3e0 [ 725.831604][T15395] ? import_single_range+0x130/0x230 [ 725.836930][T15395] __x64_sys_getrandom+0x1a6/0x2b0 [ 725.842073][T15395] ? add_disk_randomness+0xd0/0xd0 [ 725.847208][T15395] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 725.853210][T15395] ? lock_chain_count+0x20/0x20 [ 725.858081][T15395] ? lockdep_hardirqs_on+0x98/0x150 [ 725.863301][T15395] do_syscall_64+0x55/0xb0 [ 725.867731][T15395] ? clear_bhb_loop+0x40/0x90 [ 725.872432][T15395] ? clear_bhb_loop+0x40/0x90 [ 725.877143][T15395] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 725.883052][T15395] RIP: 0033:0x7fbd9f39e159 [ 725.887495][T15395] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 725.907120][T15395] RSP: 002b:00007fbda020d028 EFLAGS: 00000246 ORIG_RAX: 000000000000013e [ 725.915559][T15395] RAX: ffffffffffffffda RBX: 00007fbd9f625fa0 RCX: 00007fbd9f39e159 [ 725.923548][T15395] RDX: 0000000000000000 RSI: 00000000ffffff9a RDI: 0000200000000240 [ 725.931534][T15395] RBP: 00007fbd9f435024 R08: 0000000000000000 R09: 0000000000000000 [ 725.939518][T15395] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 725.947514][T15395] R13: 00007fbd9f626038 R14: 00007fbd9f625fa0 R15: 00007ffd61fc4e68 [ 725.955516][T15395] [ 726.064480][ T5818] usb 2-1: config 1 has an invalid interface number: 3 but max is 0 [ 726.082201][ T5818] usb 2-1: config 1 has no interface number 0 [ 726.092209][ T5818] usb 2-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 726.101830][ T5818] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 726.110281][ T5818] usb 2-1: Product: syz [ 726.114934][ T5818] usb 2-1: Manufacturer: syz [ 726.119575][ T5818] usb 2-1: SerialNumber: syz [ 726.352500][ T5818] usb 2-1: 3:1 : does not exist [ 726.378916][ T5818] usb 2-1: 3:2 : does not exist [ 726.443965][ T5818] usb 2-1: USB disconnect, device number 92 [ 726.490289][T12812] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 726.668269][T15411] loop4: detected capacity change from 0 to 7 [ 726.676125][T15411] Dev loop4: unable to read RDB block 7 [ 726.682341][T15411] loop4: unable to read partition table [ 726.688250][T15411] loop4: partition table beyond EOD, truncated [ 726.696008][T15411] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 726.700604][T12812] usb 4-1: Using ep0 maxpacket: 16 [ 726.724377][T12812] usb 4-1: unable to get BOS descriptor or descriptor too short [ 726.734232][T12812] usb 4-1: config 127 has an invalid interface number: 124 but max is 0 [ 726.757062][T12812] usb 4-1: config 127 has no interface number 0 [ 726.772320][T12812] usb 4-1: config 127 interface 124 has no altsetting 0 [ 726.813394][T12812] usb 4-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 726.824099][T12812] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 726.838916][T12812] usb 4-1: Product: syz [ 726.844628][T12812] usb 4-1: Manufacturer: syz [ 726.849427][T12812] usb 4-1: SerialNumber: syz [ 726.854678][ T9] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 726.941808][T15415] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3198'. [ 727.097898][ T9] usb 3-1: config 255 has an invalid interface number: 227 but max is 0 [ 727.121312][ T9] usb 3-1: config 255 has no interface number 0 [ 727.128759][ T9] usb 3-1: config 255 interface 227 has no altsetting 0 [ 727.141055][ T9] usb 3-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 727.158463][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 727.167073][ T9] usb 3-1: Product: syz [ 727.171957][ T9] usb 3-1: Manufacturer: syz [ 727.176973][T15420] fuse: Unknown parameter 'use00000000000000000000' [ 727.183763][ T9] usb 3-1: SerialNumber: syz [ 727.219476][T15420] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3200'. [ 727.534208][T15407] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 727.549153][T15407] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 727.640363][ T9] usb 3-1: USB disconnect, device number 64 [ 727.790741][T12812] usb 4-1: reset high-speed USB device number 82 using dummy_hcd [ 727.904618][T15435] loop4: detected capacity change from 0 to 7 [ 727.921951][T15435] Dev loop4: unable to read RDB block 7 [ 727.927599][T15435] loop4: unable to read partition table [ 727.943643][T15435] loop4: partition table beyond EOD, truncated [ 727.960699][T15435] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 728.014452][T12812] usb 4-1: device firmware changed [ 728.052534][T12812] usb 4-1: USB disconnect, device number 82 [ 728.171636][T15439] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3209'. [ 728.194215][T15441] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 728.250122][T12812] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 728.300913][ T23] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 728.364613][T15445] overlayfs: statfs failed on './file0' [ 728.397400][T15447] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 728.457693][T12812] usb 4-1: Using ep0 maxpacket: 16 [ 728.492710][T12812] usb 4-1: config 127 has an invalid interface number: 124 but max is 0 [ 728.509466][T12812] usb 4-1: config 127 has no interface number 0 [ 728.516171][ T23] usb 2-1: config 1 has an invalid interface number: 3 but max is 0 [ 728.517553][T12812] usb 4-1: config 127 interface 124 has no altsetting 0 [ 728.528677][ T23] usb 2-1: config 1 has no interface number 0 [ 728.560986][T12812] usb 4-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 728.566639][ T23] usb 2-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 728.579325][T12812] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.579365][T12812] usb 4-1: Product: syz [ 728.600135][ T23] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.610410][T12812] usb 4-1: Manufacturer: syz [ 728.617699][ T23] usb 2-1: Product: syz [ 728.628248][T12812] usb 4-1: SerialNumber: syz [ 728.630042][ T23] usb 2-1: Manufacturer: syz [ 728.649311][ T23] usb 2-1: SerialNumber: syz [ 728.782641][T15454] fuse: Unknown parameter 'use00000000000000000000' [ 728.799732][T15454] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3215'. [ 728.891403][ T5820] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 728.924925][ T23] usb 2-1: 3:1 : does not exist [ 728.940465][ T23] usb 2-1: 3:2 : does not exist [ 728.995865][ T23] usb 2-1: USB disconnect, device number 93 [ 729.101134][ T5820] usb 3-1: Using ep0 maxpacket: 16 [ 729.113602][ T5820] usb 3-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 729.125204][ T5820] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 729.136880][ T5820] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 729.146186][ T5820] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 729.155197][ T5820] usb 3-1: Product: syz [ 729.159514][ T5820] usb 3-1: Manufacturer: syz [ 729.164306][ T5820] usb 3-1: SerialNumber: syz [ 729.387536][ T5820] usb 3-1: 0:2 : does not exist [ 729.398656][ T5820] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 729.423635][ T5820] usb 3-1: USB disconnect, device number 65 [ 729.480522][ T8913] udevd[8913]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 729.771093][T15461] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3218'. [ 729.911097][T12812] usb 4-1: USB disconnect, device number 83 [ 730.346076][T15480] fuse: Unknown parameter 'use00000000000000000000' [ 730.356521][T15480] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3225'. [ 730.439716][T15483] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3228'. [ 730.481119][ T23] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 730.651301][T15485] overlayfs: failed to resolve './bus': -2 [ 730.672354][ T23] usb 4-1: config 1 has an invalid interface number: 3 but max is 0 [ 730.692329][ T23] usb 4-1: config 1 has no interface number 0 [ 730.723412][ T23] usb 4-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 730.740141][ T23] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 730.749794][ T23] usb 4-1: Product: syz [ 730.760627][ T23] usb 4-1: Manufacturer: syz [ 730.769245][ T23] usb 4-1: SerialNumber: syz [ 731.037307][ T23] usb 4-1: 3:1 : does not exist [ 731.060067][ T23] usb 4-1: 3:2 : does not exist [ 731.130249][ T23] usb 4-1: USB disconnect, device number 84 [ 731.185952][ T6220] udevd[6220]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 731.392674][T15504] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3238'. [ 731.598609][T15508] overlayfs: failed to resolve './bus': -2 [ 731.846016][T15514] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 731.984328][T15520] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3246'. [ 731.996354][T15521] fuse: Unknown parameter 'user_i00000000000000000000' [ 732.021696][T15521] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3245'. [ 732.114705][T15526] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3248'. [ 732.462878][T15532] overlayfs: failed to resolve './bus': -2 [ 732.610483][T12812] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 732.813220][T12812] usb 3-1: config 1 has an invalid interface number: 3 but max is 0 [ 732.831705][T12812] usb 3-1: config 1 has no interface number 0 [ 732.842347][T12812] usb 3-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 732.870094][T12812] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 732.910233][T12812] usb 3-1: Product: syz [ 732.914479][T12812] usb 3-1: Manufacturer: syz [ 732.919152][T12812] usb 3-1: SerialNumber: syz [ 732.948081][T15540] block device autoloading is deprecated and will be removed. [ 732.955494][T15544] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3256'. [ 733.191064][T12812] usb 3-1: 3:1 : does not exist [ 733.196022][T12812] usb 3-1: 3:2 : does not exist [ 733.222895][T15549] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3258'. [ 733.264893][T12812] usb 3-1: USB disconnect, device number 66 [ 733.319585][ T6220] udevd[6220]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 733.726290][T15563] fuse: Unknown parameter 'user_i00000000000000000000' [ 733.764733][T15563] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3264'. [ 733.937478][T15567] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3266'. [ 734.304281][T15574] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3269'. [ 734.676318][T15587] loop2: detected capacity change from 0 to 256 [ 734.705577][T15589] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3275'. [ 734.830555][ T5817] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 734.886079][T15587] FAT-fs (loop2): error, fat_get_cluster: invalid start cluster (i_pos 196, start 00000001) [ 735.091758][ T5817] usb 4-1: config 1 has an invalid interface number: 3 but max is 0 [ 735.105271][ T5817] usb 4-1: config 1 has no interface number 0 [ 735.126279][ T5817] usb 4-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 735.150135][ T5817] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 735.173178][ T5817] usb 4-1: Product: syz [ 735.177419][ T5817] usb 4-1: Manufacturer: syz [ 735.192809][T15600] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3281'. [ 735.210039][ T5817] usb 4-1: SerialNumber: syz [ 735.471895][ T5817] usb 4-1: 3:1 : does not exist [ 735.476866][ T5817] usb 4-1: 3:2 : does not exist [ 735.545421][ T5817] usb 4-1: USB disconnect, device number 85 [ 735.624211][ T6220] udevd[6220]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 735.800140][ T5820] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 735.950024][ T5820] usb 3-1: device descriptor read/64, error -71 [ 736.220182][ T5820] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 736.380718][ T5820] usb 3-1: device descriptor read/64, error -71 [ 736.500686][ T5820] usb usb3-port1: attempt power cycle [ 736.931155][ T5820] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 736.991219][ T5820] usb 3-1: device descriptor read/8, error -71 [ 737.060128][ T3065] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 737.209302][T15650] overlayfs: workdir and upperdir must reside under the same mount [ 737.218649][T15652] __nla_validate_parse: 3 callbacks suppressed [ 737.218685][T15652] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3306'. [ 737.260667][ T5820] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 737.273573][ T3065] usb 4-1: config 1 has an invalid interface number: 3 but max is 0 [ 737.299315][ T3065] usb 4-1: config 1 has no interface number 0 [ 737.311050][ T5820] usb 3-1: device descriptor read/8, error -71 [ 737.320483][ T3065] usb 4-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 737.329670][ T3065] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 737.355926][ T3065] usb 4-1: Product: syz [ 737.360414][ T3065] usb 4-1: Manufacturer: syz [ 737.365050][ T3065] usb 4-1: SerialNumber: syz [ 737.441478][ T5820] usb usb3-port1: unable to enumerate USB device [ 737.585747][T15636] binder: BINDER_SET_CONTEXT_MGR already set [ 737.592299][T15636] binder: 15635:15636 ioctl 4018620d 200000004a80 returned -16 [ 737.611466][ T3065] usb 4-1: 3:1 : does not exist [ 737.616419][ T3065] usb 4-1: 3:2 : does not exist [ 737.690143][ T3065] usb 4-1: USB disconnect, device number 86 [ 737.716259][ T6220] udevd[6220]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 737.949809][T15669] FAULT_INJECTION: forcing a failure. [ 737.949809][T15669] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 737.964939][T15669] CPU: 0 PID: 15669 Comm: syz.1.3314 Not tainted syzkaller #0 [ 737.972456][T15669] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 737.982524][T15669] Call Trace: [ 737.985828][T15669] [ 737.988802][T15669] dump_stack_lvl+0x18c/0x250 [ 737.993512][T15669] ? show_regs_print_info+0x20/0x20 [ 737.998898][T15669] ? load_image+0x420/0x420 [ 738.003434][T15669] ? __lock_acquire+0x7d80/0x7d80 [ 738.008566][T15669] ? __virt_addr_valid+0x10c/0x380 [ 738.013739][T15669] should_fail_ex+0x394/0x4c0 [ 738.018443][T15669] _copy_to_user+0x2f/0xa0 [ 738.022882][T15669] bpf_vlog_reverse_ubuf+0x2ad/0x3a0 [ 738.028214][T15669] bpf_vlog_finalize+0x1b3/0x3e0 [ 738.033208][T15669] btf_new_fd+0x4ca/0x9e0 [ 738.037570][T15669] ? bpf_btf_show_fdinfo+0x80/0x80 [ 738.042716][T15669] ? capable+0x88/0xe0 [ 738.047026][T15669] __sys_bpf+0x670/0x890 [ 738.051320][T15669] ? bpf_link_show_fdinfo+0x390/0x390 [ 738.056839][T15669] ? lock_chain_count+0x20/0x20 [ 738.061818][T15669] __x64_sys_bpf+0x7c/0x90 [ 738.066257][T15669] do_syscall_64+0x55/0xb0 [ 738.070768][T15669] ? clear_bhb_loop+0x40/0x90 [ 738.075479][T15669] ? clear_bhb_loop+0x40/0x90 [ 738.080190][T15669] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 738.086108][T15669] RIP: 0033:0x7f9fef79e159 [ 738.090541][T15669] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 738.110263][T15669] RSP: 002b:00007f9ff0647028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 738.118741][T15669] RAX: ffffffffffffffda RBX: 00007f9fefa25fa0 RCX: 00007f9fef79e159 [ 738.126792][T15669] RDX: 0000000000000028 RSI: 0000200000000180 RDI: 0000000000000012 [ 738.134810][T15669] RBP: 00007f9fef835024 R08: 0000000000000000 R09: 0000000000000000 [ 738.142889][T15669] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 738.150887][T15669] R13: 00007f9fefa26038 R14: 00007f9fefa25fa0 R15: 00007fffd83ed478 [ 738.159070][T15669] [ 738.429189][T15674] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3317'. [ 739.545699][T15716] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3329'. [ 739.590072][ T5817] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 739.650178][ T5437] veth1_vlan: left promiscuous mode [ 739.790087][ T5817] usb 1-1: Using ep0 maxpacket: 32 [ 739.808695][ T5817] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 739.840588][ T5817] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 739.863090][ T5817] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 739.880217][ T5817] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 739.899591][ T5817] usb 1-1: Product: syz [ 739.908922][ T5817] usb 1-1: Manufacturer: syz [ 739.929005][ T5817] usb 1-1: SerialNumber: syz [ 739.956599][ T5817] usb 1-1: config 0 descriptor?? [ 740.105680][T15732] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3333'. [ 740.683550][T15751] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3340'. [ 740.898982][T15756] loop4: detected capacity change from 0 to 7 [ 740.902083][T15756] Dev loop4: unable to read RDB block 7 [ 740.902133][T15756] loop4: unable to read partition table [ 740.902362][T15756] loop4: partition table beyond EOD, truncated [ 740.902382][T15756] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 741.191536][T15765] FAULT_INJECTION: forcing a failure. [ 741.191536][T15765] name failslab, interval 1, probability 0, space 0, times 0 [ 741.233668][T15765] CPU: 0 PID: 15765 Comm: syz.1.3343 Not tainted syzkaller #0 [ 741.241248][T15765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 741.252421][T15765] Call Trace: [ 741.255841][T15765] [ 741.258819][T15765] dump_stack_lvl+0x18c/0x250 [ 741.263564][T15765] ? show_regs_print_info+0x20/0x20 [ 741.268818][T15765] ? load_image+0x420/0x420 [ 741.273556][T15765] ? __might_sleep+0xe0/0xe0 [ 741.278288][T15765] ? __lock_acquire+0x7d80/0x7d80 [ 741.283373][T15765] should_fail_ex+0x394/0x4c0 [ 741.288113][T15765] should_failslab+0x9/0x20 [ 741.292680][T15765] slab_pre_alloc_hook+0x59/0x300 [ 741.297784][T15765] ? wakeup_source_sysfs_add+0x57/0x2c0 [ 741.303452][T15765] __kmem_cache_alloc_node+0x53/0x250 [ 741.308898][T15765] ? wakeup_source_sysfs_add+0x57/0x2c0 [ 741.314512][T15765] kmalloc_trace+0x2a/0xe0 [ 741.318992][T15765] wakeup_source_sysfs_add+0x57/0x2c0 [ 741.324431][T15765] wakeup_source_register+0x163/0x240 [ 741.329870][T15765] ep_insert+0xeb2/0x1990 [ 741.334283][T15765] ? ep_loop_check+0x1b0/0x1b0 [ 741.339138][T15765] ? __lock_acquire+0x7d80/0x7d80 [ 741.344773][T15765] do_epoll_ctl+0x8bc/0xf40 [ 741.349437][T15765] __x64_sys_epoll_ctl+0x166/0x1b0 [ 741.354617][T15765] ? ep_modify+0xa80/0xa80 [ 741.359189][T15765] ? lockdep_hardirqs_on+0x98/0x150 [ 741.364453][T15765] do_syscall_64+0x55/0xb0 [ 741.368920][T15765] ? clear_bhb_loop+0x40/0x90 [ 741.373650][T15765] ? clear_bhb_loop+0x40/0x90 [ 741.378477][T15765] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 741.384431][T15765] RIP: 0033:0x7f9fef79e159 [ 741.388976][T15765] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 741.408817][T15765] RSP: 002b:00007f9ff0647028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 741.417470][T15765] RAX: ffffffffffffffda RBX: 00007f9fefa25fa0 RCX: 00007f9fef79e159 [ 741.425491][T15765] RDX: 0000000000000004 RSI: 0000000000000001 RDI: 0000000000000005 [ 741.433519][T15765] RBP: 00007f9fef835024 R08: 0000000000000000 R09: 0000000000000000 [ 741.441544][T15765] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 741.447501][T15773] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3345'. [ 741.449567][T15765] R13: 00007f9fefa26038 R14: 00007f9fefa25fa0 R15: 00007fffd83ed478 [ 741.466802][T15765] [ 741.864941][T15779] netlink: 'syz.3.3347': attribute type 1 has an invalid length. [ 741.887636][T15779] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3347'. [ 742.170260][T15787] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3350'. [ 742.398716][ T3065] usb 1-1: USB disconnect, device number 65 [ 742.430182][ T5820] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 742.534712][T15797] futex_wake_op: syz.2.3354 tries to shift op by -1; fix this program [ 742.640548][ T5820] usb 2-1: Using ep0 maxpacket: 16 [ 742.663246][ T5820] usb 2-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 742.684181][ T5820] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 742.704697][ T5820] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 742.766408][ T5820] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 742.850426][ T5820] usb 2-1: Product: syz [ 742.860790][ T5820] usb 2-1: Manufacturer: syz [ 742.874023][ T5820] usb 2-1: SerialNumber: syz [ 743.097281][ T5820] usb 2-1: 0:2 : does not exist [ 743.148743][T15806] netlink: 'syz.2.3358': attribute type 1 has an invalid length. [ 743.150143][ T5820] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 743.173899][T15806] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3358'. [ 743.331144][ T5820] usb 2-1: USB disconnect, device number 94 [ 743.352391][T15808] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3359'. [ 743.471729][ T6220] udevd[6220]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 743.704306][T15811] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3360'. [ 744.030045][ T5818] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 744.165949][T15819] loop2: detected capacity change from 0 to 128 [ 744.220664][ T5818] usb 2-1: Using ep0 maxpacket: 32 [ 744.251008][ T5818] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 744.304813][ T5818] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 744.364939][ T5818] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 744.375186][T13358] FAT-fs (loop2): error, invalid access to FAT (entry 0xffff0000) [ 744.390093][ T5818] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 744.403775][T13358] FAT-fs (loop2): Filesystem has been set read-only [ 744.434801][ T5818] usb 2-1: Product: syz [ 744.439019][ T5818] usb 2-1: Manufacturer: syz [ 744.445420][T13358] FAT-fs (loop2): error, corrupted directory (invalid entries) [ 744.461035][T13358] FAT-fs (loop2): error, corrupted directory (invalid entries) [ 744.485905][ T5818] usb 2-1: SerialNumber: syz [ 744.526672][ T5818] usb 2-1: config 0 descriptor?? [ 744.720756][T13358] bond0: (slave syz_tun): Releasing backup interface [ 745.455658][ T5789] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 745.465467][ T5789] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 745.477787][ T5789] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 745.486680][ T5789] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 745.496113][ T5789] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 745.503842][ T5789] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 745.675840][T15827] chnl_net:caif_netlink_parms(): no params data found [ 745.763916][T15827] bridge0: port 1(bridge_slave_0) entered blocking state [ 745.775485][T15827] bridge0: port 1(bridge_slave_0) entered disabled state [ 745.803697][T15827] bridge_slave_0: entered allmulticast mode [ 745.833976][T15827] bridge_slave_0: entered promiscuous mode [ 745.859166][T15827] bridge0: port 2(bridge_slave_1) entered blocking state [ 745.867807][T15827] bridge0: port 2(bridge_slave_1) entered disabled state [ 745.875438][T15827] bridge_slave_1: entered allmulticast mode [ 745.883486][T15827] bridge_slave_1: entered promiscuous mode [ 745.963522][T15827] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 745.977335][T15827] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 745.982544][T15840] FAULT_INJECTION: forcing a failure. [ 745.982544][T15840] name failslab, interval 1, probability 0, space 0, times 0 [ 746.013131][T15840] CPU: 0 PID: 15840 Comm: syz.3.3370 Not tainted syzkaller #0 [ 746.020699][T15840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 746.030804][T15840] Call Trace: [ 746.034133][T15840] [ 746.035376][T15827] team0: Port device team_slave_0 added [ 746.037083][T15840] dump_stack_lvl+0x18c/0x250 [ 746.037125][T15840] ? show_regs_print_info+0x20/0x20 [ 746.047871][T15827] team0: Port device team_slave_1 added [ 746.053887][T15840] ? load_image+0x420/0x420 [ 746.053928][T15840] ? __might_sleep+0xe0/0xe0 [ 746.053956][T15840] ? __lock_acquire+0x7d80/0x7d80 [ 746.053986][T15840] should_fail_ex+0x394/0x4c0 [ 746.054021][T15840] should_failslab+0x9/0x20 [ 746.054050][T15840] slab_pre_alloc_hook+0x59/0x300 [ 746.054082][T15840] ? prepend_path+0x8a7/0x950 [ 746.054104][T15840] ? tomoyo_encode+0x2ad/0x570 [ 746.054170][T15840] ? tomoyo_encode+0x2ad/0x570 [ 746.054199][T15840] __kmem_cache_alloc_node+0x53/0x250 [ 746.054234][T15840] ? tomoyo_encode+0x2ad/0x570 [ 746.054263][T15840] __kmalloc+0xa7/0x240 [ 746.087520][T15827] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 746.088215][T15840] tomoyo_encode+0x2ad/0x570 [ 746.093060][T15827] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 746.097671][T15840] tomoyo_realpath_from_path+0x57c/0x5c0 [ 746.103269][T15827] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 746.107797][T15840] ? tomoyo_domain+0xd6/0x120 [ 746.115795][T15827] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 746.116743][T15840] tomoyo_path_number_perm+0x248/0x5e0 [ 746.124702][T15827] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 746.128615][T15840] ? tomoyo_path_number_perm+0x217/0x5e0 [ 746.167738][T15827] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 746.170618][T15840] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 746.170659][T15840] ? __seccomp_filter+0x84c/0x1ca0 [ 746.170735][T15840] ? __fget_files+0x28/0x460 [ 746.170779][T15840] security_file_ioctl+0x70/0xa0 [ 746.250701][T15840] __se_sys_ioctl+0x48/0x170 [ 746.255360][T15840] do_syscall_64+0x55/0xb0 [ 746.259786][T15840] ? clear_bhb_loop+0x40/0x90 [ 746.264558][T15840] ? clear_bhb_loop+0x40/0x90 [ 746.269354][T15840] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 746.275282][T15840] RIP: 0033:0x7fbd9f39e159 [ 746.279818][T15840] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 746.299435][T15840] RSP: 002b:00007fbda020d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 746.307957][T15840] RAX: ffffffffffffffda RBX: 00007fbd9f625fa0 RCX: 00007fbd9f39e159 [ 746.315955][T15840] RDX: 0000200000000040 RSI: 00000000c0184800 RDI: 0000000000000004 [ 746.323940][T15840] RBP: 00007fbd9f435024 R08: 0000000000000000 R09: 0000000000000000 [ 746.331935][T15840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 746.339927][T15840] R13: 00007fbd9f626038 R14: 00007fbd9f625fa0 R15: 00007ffd61fc4e68 [ 746.347934][T15840] [ 746.363068][T15840] ERROR: Out of memory at tomoyo_realpath_from_path. [ 746.390386][T15827] hsr_slave_0: entered promiscuous mode [ 746.410645][T15827] hsr_slave_1: entered promiscuous mode [ 746.417217][T15827] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 746.434581][T15827] Cannot create hsr debugfs directory [ 746.490749][T15844] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3371'. [ 746.500402][T15844] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 746.628886][T15844] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 746.824836][T15850] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3373'. [ 746.885473][ T5820] usb 2-1: USB disconnect, device number 95 [ 747.264713][T15827] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 747.299693][T15827] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 747.326411][T15827] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 747.354098][T15827] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 747.488025][T15868] loop0: detected capacity change from 0 to 128 [ 747.555899][T15827] 8021q: adding VLAN 0 to HW filter on device bond0 [ 747.570774][ T5784] Bluetooth: hci1: command tx timeout [ 747.578577][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.586467][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.615134][T12991] FAT-fs (loop0): error, corrupted directory (invalid entries) [ 747.623391][T12991] FAT-fs (loop0): error, corrupted directory (invalid entries) [ 747.623783][T15827] 8021q: adding VLAN 0 to HW filter on device team0 [ 747.675550][T15170] bridge0: port 1(bridge_slave_0) entered blocking state [ 747.682929][T15170] bridge0: port 1(bridge_slave_0) entered forwarding state [ 747.705640][T15170] bridge0: port 2(bridge_slave_1) entered blocking state [ 747.712926][T15170] bridge0: port 2(bridge_slave_1) entered forwarding state [ 747.740193][ T5817] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 747.750279][T12991] bond0: (slave syz_tun): Releasing backup interface [ 747.914807][T15184] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 747.931018][ T5817] usb 2-1: Using ep0 maxpacket: 16 [ 747.948147][ T5817] usb 2-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 747.959572][ T5817] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 747.982872][ T5817] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 748.006824][ T5817] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 748.050291][ T5817] usb 2-1: Product: syz [ 748.054532][ T5817] usb 2-1: Manufacturer: syz [ 748.059164][ T5817] usb 2-1: SerialNumber: syz [ 748.074008][T15184] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.229821][T15184] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.353713][ T5817] usb 2-1: 0:2 : does not exist [ 748.381539][T15184] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.397853][ T5817] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 748.481362][ T5817] usb 2-1: USB disconnect, device number 96 [ 748.593208][ T6220] udevd[6220]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 748.847147][T15827] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 749.351838][ T5789] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 749.363405][ T5789] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 749.375470][ T5789] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 749.394267][ T5789] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 749.413517][ T5789] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 749.421232][ T5789] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 749.660430][ T5784] Bluetooth: hci1: command tx timeout [ 749.730351][ T8] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 749.930324][ T8] usb 2-1: Using ep0 maxpacket: 16 [ 749.972850][ T8] usb 2-1: unable to get BOS descriptor or descriptor too short [ 749.986792][ T8] usb 2-1: config 127 has an invalid interface number: 124 but max is 0 [ 750.007106][ T8] usb 2-1: config 127 has no interface number 0 [ 750.019676][ T8] usb 2-1: config 127 interface 124 has no altsetting 0 [ 750.035939][ T8] usb 2-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 750.065152][ T8] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 750.085398][ T8] usb 2-1: Product: syz [ 750.089674][ T8] usb 2-1: Manufacturer: syz [ 750.116430][ T8] usb 2-1: SerialNumber: syz [ 750.352321][T15827] veth0_vlan: entered promiscuous mode [ 750.504105][T15827] veth1_vlan: entered promiscuous mode [ 750.894401][T15920] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3394'. [ 750.975717][T15827] veth0_macvtap: entered promiscuous mode [ 751.004608][T15888] chnl_net:caif_netlink_parms(): no params data found [ 751.060317][ T8] usb 2-1: reset high-speed USB device number 97 using dummy_hcd [ 751.255821][T15827] veth1_macvtap: entered promiscuous mode [ 751.274445][ T8] usb 2-1: device firmware changed [ 751.293782][ T8] usb 2-1: USB disconnect, device number 97 [ 751.477439][T15184] hsr_slave_0: left promiscuous mode [ 751.490223][ T5784] Bluetooth: hci2: command tx timeout [ 751.501291][T15184] hsr_slave_1: left promiscuous mode [ 751.508964][T15184] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 751.509506][T15931] loop3: detected capacity change from 0 to 512 [ 751.527355][ T8] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 751.535356][T15184] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 751.554573][T15184] bridge_slave_1: left allmulticast mode [ 751.586818][T15184] bridge_slave_1: left promiscuous mode [ 751.625486][T15184] bridge0: port 2(bridge_slave_1) entered disabled state [ 751.672239][T15184] bridge_slave_0: left allmulticast mode [ 751.689659][T15184] bridge_slave_0: left promiscuous mode [ 751.699340][T15184] bridge0: port 1(bridge_slave_0) entered disabled state [ 751.740383][ T5784] Bluetooth: hci1: command tx timeout [ 751.750207][ T8] usb 2-1: Using ep0 maxpacket: 16 [ 751.820269][ T8] usb 2-1: config 127 has an invalid interface number: 124 but max is 0 [ 751.828698][ T8] usb 2-1: config 127 has no interface number 0 [ 751.865317][ T8] usb 2-1: config 127 interface 124 has no altsetting 0 [ 751.873742][T15184] veth1_vlan: left promiscuous mode [ 751.879180][T15184] veth0_vlan: left promiscuous mode [ 751.926420][ T8] usb 2-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 751.946604][ T8] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 751.971655][ T8] usb 2-1: Product: syz [ 751.975901][ T8] usb 2-1: Manufacturer: syz [ 752.006569][ T8] usb 2-1: SerialNumber: syz [ 753.309180][T15184] team0 (unregistering): Port device team_slave_1 removed [ 753.390842][T15184] team0 (unregistering): Port device team_slave_0 removed [ 753.488165][T15184] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 753.568788][T15184] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 753.578635][ T5784] Bluetooth: hci2: command tx timeout [ 753.818698][ T5784] Bluetooth: hci1: command tx timeout [ 754.096461][T15184] bond0 (unregistering): Released all slaves [ 754.278776][T15827] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 754.315517][T15827] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.327337][T15827] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 754.339127][T15827] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.349518][T15827] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 754.360144][T15827] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.370135][T15827] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 754.381074][T15827] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.404534][T15827] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 754.477335][T15827] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 754.530621][T15827] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.557135][T15827] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 754.580099][T15827] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.601043][T15827] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 754.612336][T15827] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.622662][T15827] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 754.633887][T15827] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.692037][T15827] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 754.775025][T15827] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 754.830081][T15827] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 754.870210][T15827] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 754.879084][T15827] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 754.945227][T15888] bridge0: port 1(bridge_slave_0) entered blocking state [ 754.964337][T15888] bridge0: port 1(bridge_slave_0) entered disabled state [ 754.998152][T15888] bridge_slave_0: entered allmulticast mode [ 755.011622][T15888] bridge_slave_0: entered promiscuous mode [ 755.053269][T15888] bridge0: port 2(bridge_slave_1) entered blocking state [ 755.082133][T15888] bridge0: port 2(bridge_slave_1) entered disabled state [ 755.089461][T15888] bridge_slave_1: entered allmulticast mode [ 755.132257][T15888] bridge_slave_1: entered promiscuous mode [ 755.149257][T15971] loop1: detected capacity change from 0 to 256 [ 755.234442][T15967] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3401'. [ 755.265427][ T8] usb 2-1: USB disconnect, device number 98 [ 755.475378][T15888] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 755.506963][T15888] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 755.650231][ T5784] Bluetooth: hci2: command tx timeout [ 755.746280][T15888] team0: Port device team_slave_0 added [ 755.786939][T15888] team0: Port device team_slave_1 added [ 755.901151][T15888] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 755.908180][T15888] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 755.966362][T15888] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 756.018276][T15888] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 756.030306][T15888] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 756.066595][T15888] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 756.093050][T15987] bridge1: entered allmulticast mode [ 756.142864][ T1136] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 756.165842][ T1136] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 756.167186][T15888] hsr_slave_0: entered promiscuous mode [ 756.201636][T15888] hsr_slave_1: entered promiscuous mode [ 756.210991][T15888] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 756.218628][T15888] Cannot create hsr debugfs directory [ 756.249984][ T8] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 756.352202][ T3502] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 756.374501][ T3502] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 756.431135][ T8] usb 2-1: device descriptor read/64, error -71 [ 756.720041][ T8] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 756.795038][T16000] netlink: 'syz.4.3367': attribute type 1 has an invalid length. [ 756.804141][T16000] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3367'. [ 756.814220][T16000] bridge0: port 2(bridge_slave_1) entered disabled state [ 756.822248][T16000] bridge0: port 2(bridge_slave_1) entered blocking state [ 756.829454][T16000] bridge0: port 2(bridge_slave_1) entered forwarding state [ 756.910105][ T8] usb 2-1: device descriptor read/64, error -71 [ 756.952636][T15888] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 756.979795][T15888] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 757.016464][T15888] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 757.030297][ T8] usb usb2-port1: attempt power cycle [ 757.041568][T15888] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 757.062911][T16006] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3411'. [ 757.084322][T16006] bridge0: port 2(bridge_slave_1) entered disabled state [ 757.092304][T16006] bridge0: port 1(bridge_slave_0) entered disabled state [ 757.450441][ T8] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 757.464091][T15888] 8021q: adding VLAN 0 to HW filter on device bond0 [ 757.505356][ T8] usb 2-1: device descriptor read/8, error -71 [ 757.565088][T15888] 8021q: adding VLAN 0 to HW filter on device team0 [ 757.658087][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 757.665462][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 757.684440][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 757.691850][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 757.730654][ T5784] Bluetooth: hci2: command tx timeout [ 757.820055][ T8] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 757.884593][ T8] usb 2-1: device descriptor read/8, error -71 [ 758.011230][ T8] usb usb2-port1: unable to enumerate USB device [ 758.126202][T16032] netlink: 7 bytes leftover after parsing attributes in process `syz.4.3418'. [ 758.527408][T16045] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 758.596748][T15888] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 759.211827][T16073] ucma_write: process 645 (syz.1.3428) changed security contexts after opening file descriptor, this is not allowed. [ 759.585223][T15888] veth0_vlan: entered promiscuous mode [ 759.637282][T15888] veth1_vlan: entered promiscuous mode [ 759.788827][T15888] veth0_macvtap: entered promiscuous mode [ 759.802020][T16088] FAULT_INJECTION: forcing a failure. [ 759.802020][T16088] name failslab, interval 1, probability 0, space 0, times 0 [ 759.818925][T15888] veth1_macvtap: entered promiscuous mode [ 759.844410][T16088] CPU: 0 PID: 16088 Comm: syz.1.3430 Not tainted syzkaller #0 [ 759.851977][T16088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 759.862175][T16088] Call Trace: [ 759.865685][T16088] [ 759.868672][T16088] dump_stack_lvl+0x18c/0x250 [ 759.873417][T16088] ? show_regs_print_info+0x20/0x20 [ 759.878680][T16088] ? load_image+0x420/0x420 [ 759.883244][T16088] ? __might_sleep+0xe0/0xe0 [ 759.887961][T16088] ? __lock_acquire+0x7d80/0x7d80 [ 759.893310][T16088] should_fail_ex+0x394/0x4c0 [ 759.898050][T16088] should_failslab+0x9/0x20 [ 759.902701][T16088] slab_pre_alloc_hook+0x59/0x300 [ 759.908058][T16088] kmem_cache_alloc+0x5a/0x2c0 [ 759.912966][T16088] ? _sctp_make_chunk+0x14b/0x430 [ 759.918096][T16088] _sctp_make_chunk+0x14b/0x430 [ 759.922968][T16088] sctp_make_datafrag_empty+0x12b/0x240 [ 759.928536][T16088] ? sctp_make_ecne+0x350/0x350 [ 759.933413][T16088] ? __check_object_size+0x4fc/0xa40 [ 759.939420][T16088] ? sctp_user_addto_chunk+0xa4/0x220 [ 759.944839][T16088] sctp_datamsg_from_user+0x72e/0xee0 [ 759.950295][T16088] sctp_sendmsg_to_asoc+0xfdd/0x17f0 [ 759.955757][T16088] ? mark_lock+0x94/0x320 [ 759.960201][T16088] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 759.966213][T16088] ? sctp_sendmsg_check_sflags+0x2d0/0x2d0 [ 759.972040][T16088] ? __local_bh_enable_ip+0x13a/0x1c0 [ 759.977441][T16088] ? _local_bh_enable+0xa0/0xa0 [ 759.982314][T16088] ? sctp_sendmsg_check_sflags+0x18d/0x2d0 [ 759.988145][T16088] sctp_sendmsg+0x1afa/0x27b0 [ 759.992869][T16088] ? sctp_getsockopt+0xb60/0xb60 [ 759.997831][T16088] ? aa_af_perm+0x330/0x330 [ 760.002474][T16088] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 760.008937][T16088] ? sock_rps_record_flow+0x19/0x3f0 [ 760.014400][T16088] ? inet_send_prepare+0x250/0x250 [ 760.019543][T16088] ? inet_sendmsg+0x7e/0x2a0 [ 760.024161][T16088] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 760.029562][T16088] ? inet_send_prepare+0x250/0x250 [ 760.034784][T16088] sock_sendmsg+0x23b/0x3a0 [ 760.039378][T16088] ? read_lock_is_recursive+0x20/0x20 [ 760.044824][T16088] ? __sock_tx_timestamp+0xb0/0xb0 [ 760.050078][T16088] ? __asan_memset+0x22/0x40 [ 760.054726][T16088] ? iov_iter_bvec+0xd4/0x1b0 [ 760.059471][T16088] splice_to_socket+0xb92/0x1270 [ 760.064836][T16088] ? iter_file_splice_write+0xcf0/0xcf0 [ 760.070506][T16088] ? aa_path_link+0xf80/0xf80 [ 760.075216][T16088] ? futex_wait+0x4a7/0x5c0 [ 760.079859][T16088] ? common_file_perm+0x198/0x1f0 [ 760.085039][T16088] ? fsnotify_perm+0x5d/0x5e0 [ 760.089848][T16088] ? security_file_permission+0x79/0xa0 [ 760.095427][T16088] ? iter_file_splice_write+0xcf0/0xcf0 [ 760.101009][T16088] do_splice+0xe45/0x1b20 [ 760.105384][T16088] ? vfs_write+0x5de/0x9a0 [ 760.109832][T16088] ? __fget_files+0x28/0x460 [ 760.114493][T16088] ? wait_for_space+0x2d0/0x2d0 [ 760.119370][T16088] ? __fdget+0x180/0x210 [ 760.123637][T16088] __se_sys_splice+0x398/0x4a0 [ 760.128464][T16088] ? __x64_sys_splice+0xf0/0xf0 [ 760.133389][T16088] ? __x64_sys_splice+0x21/0xf0 [ 760.138282][T16088] do_syscall_64+0x55/0xb0 [ 760.142724][T16088] ? clear_bhb_loop+0x40/0x90 [ 760.147458][T16088] ? clear_bhb_loop+0x40/0x90 [ 760.152276][T16088] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 760.158207][T16088] RIP: 0033:0x7f9fef79e159 [ 760.162647][T16088] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 760.182278][T16088] RSP: 002b:00007f9ff0626028 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 760.190799][T16088] RAX: ffffffffffffffda RBX: 00007f9fefa26090 RCX: 00007f9fef79e159 [ 760.198792][T16088] RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000006 [ 760.206782][T16088] RBP: 00007f9fef835024 R08: 000000000000ffff R09: 0000000000000002 [ 760.214804][T16088] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 760.223067][T16088] R13: 00007f9fefa26128 R14: 00007f9fefa26090 R15: 00007fffd83ed478 [ 760.231078][T16088] [ 760.269275][T15888] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 760.318950][T15888] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 760.335178][T15888] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 760.350033][T15888] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 760.376700][T15888] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 760.438176][T15888] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 760.469754][T15888] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 760.490305][T15888] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 760.493835][T16100] loop4: detected capacity change from 0 to 7 [ 760.510205][T15888] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 760.510227][T15888] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 760.549417][T15888] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 760.565370][T15888] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 760.565397][T15888] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 760.565411][T15888] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 760.565426][T15888] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 760.565439][T15888] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 760.565454][T15888] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 760.565466][T15888] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 760.565481][T15888] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 760.565493][T15888] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 760.565508][T15888] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 760.567195][T15888] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 760.576438][T16100] Dev loop4: unable to read RDB block 7 [ 760.576497][T16100] loop4: unable to read partition table [ 760.576735][T16100] loop4: partition table beyond EOD, truncated [ 760.576776][T16100] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 760.610164][T15888] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 760.610211][T15888] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 760.610242][T15888] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 760.610271][T15888] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 760.968991][T11839] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 761.109597][T15170] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 761.130262][T11839] usb 4-1: device descriptor read/64, error -71 [ 761.131674][T15170] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 761.278055][T15170] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 761.298788][T15170] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 761.400545][T11839] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 761.560079][T11839] usb 4-1: device descriptor read/64, error -71 [ 761.680374][T11839] usb usb4-port1: attempt power cycle [ 762.110599][T11839] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 762.180762][T11839] usb 4-1: device descriptor read/8, error -71 [ 762.451408][T11839] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 762.501740][T11839] usb 4-1: device descriptor read/8, error -71 [ 762.624370][T11839] usb usb4-port1: unable to enumerate USB device [ 762.976376][T16164] gretap1: entered promiscuous mode [ 763.450085][T16173] FAULT_INJECTION: forcing a failure. [ 763.450085][T16173] name fail_futex, interval 1, probability 0, space 0, times 1 [ 763.494998][T16173] CPU: 0 PID: 16173 Comm: syz.1.3455 Not tainted syzkaller #0 [ 763.502631][T16173] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 763.512733][T16173] Call Trace: [ 763.516046][T16173] [ 763.519015][T16173] dump_stack_lvl+0x18c/0x250 [ 763.523754][T16173] ? show_regs_print_info+0x20/0x20 [ 763.529008][T16173] ? load_image+0x420/0x420 [ 763.533576][T16173] should_fail_ex+0x394/0x4c0 [ 763.538314][T16173] get_futex_key+0x136/0x1030 [ 763.543039][T16173] ? preempt_schedule_thunk+0x1a/0x30 [ 763.548514][T16173] ? try_to_wake_up+0x6f5/0x10e0 [ 763.553508][T16173] ? futex_setup_timer+0xc0/0xc0 [ 763.558510][T16173] futex_wake+0x127/0x4f0 [ 763.562897][T16173] ? futex_wake_mark+0x150/0x150 [ 763.568059][T16173] ? do_raw_spin_lock+0x11f/0x2b0 [ 763.573250][T16173] do_futex+0x35d/0x3e0 [ 763.577463][T16173] ? __lock_acquire+0x7d80/0x7d80 [ 763.582544][T16173] ? __ia32_sys_get_robust_list+0x110/0x110 [ 763.588499][T16173] __se_sys_futex+0x3a9/0x440 [ 763.593225][T16173] ? __x64_sys_rt_sigprocmask+0xb0/0xb0 [ 763.598832][T16173] ? __x64_sys_futex+0xf0/0xf0 [ 763.603658][T16173] ? __x64_sys_futex+0x21/0xf0 [ 763.608511][T16173] do_syscall_64+0x55/0xb0 [ 763.612960][T16173] ? clear_bhb_loop+0x40/0x90 [ 763.617665][T16173] ? clear_bhb_loop+0x40/0x90 [ 763.622370][T16173] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 763.628290][T16173] RIP: 0033:0x7f9fef79e159 [ 763.632724][T16173] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 763.652356][T16173] RSP: 002b:00007f9ff06470e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 763.660794][T16173] RAX: ffffffffffffffda RBX: 00007f9fefa25fa8 RCX: 00007f9fef79e159 [ 763.668782][T16173] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f9fefa25fac [ 763.676854][T16173] RBP: 00007f9fefa25fa0 R08: 0000000000745d1e R09: 0000000000000000 [ 763.684840][T16173] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 763.692824][T16173] R13: 00007f9fefa26038 R14: 00007fffd83ed390 R15: 00007fffd83ed478 [ 763.700826][T16173] [ 763.797593][T16175] loop4: detected capacity change from 0 to 7 [ 763.811222][T16175] Dev loop4: unable to read RDB block 7 [ 763.830935][T16175] loop4: unable to read partition table [ 763.836904][T16175] loop4: partition table beyond EOD, truncated [ 763.870128][T16175] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 763.934298][T16182] loop5: detected capacity change from 0 to 128 [ 766.764838][T16238] loop5: detected capacity change from 0 to 128 [ 766.789202][T16238] FAT-fs (loop5): Unrecognized mount option "ÿÿÿÿÿÿÿÿ" or missing value [ 767.302695][T16255] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3478'. [ 767.386963][T16255] bridge0: port 2(bridge_slave_1) entered disabled state [ 767.394721][T16255] bridge0: port 1(bridge_slave_0) entered disabled state [ 767.543444][T16262] syzkaller0: entered promiscuous mode [ 767.576543][T16262] syzkaller0: entered allmulticast mode [ 767.760380][T16266] tun0: tun_chr_ioctl cmd 1074025680 [ 768.461914][T16285] FAULT_INJECTION: forcing a failure. [ 768.461914][T16285] name failslab, interval 1, probability 0, space 0, times 0 [ 768.498400][T16285] CPU: 1 PID: 16285 Comm: syz.4.3489 Not tainted syzkaller #0 [ 768.505969][T16285] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 768.516094][T16285] Call Trace: [ 768.519421][T16285] [ 768.522395][T16285] dump_stack_lvl+0x18c/0x250 [ 768.527139][T16285] ? show_regs_print_info+0x20/0x20 [ 768.532396][T16285] ? load_image+0x420/0x420 [ 768.537044][T16285] ? __might_sleep+0xe0/0xe0 [ 768.541878][T16285] ? __lock_acquire+0x7d80/0x7d80 [ 768.546992][T16285] should_fail_ex+0x394/0x4c0 [ 768.551751][T16285] should_failslab+0x9/0x20 [ 768.556319][T16285] slab_pre_alloc_hook+0x59/0x300 [ 768.561543][T16285] ? newseg+0x235/0xb10 [ 768.565774][T16285] __kmem_cache_alloc_node+0x53/0x250 [ 768.571236][T16285] ? newseg+0x235/0xb10 [ 768.575428][T16285] kmalloc_trace+0x2a/0xe0 [ 768.580068][T16285] newseg+0x235/0xb10 [ 768.584080][T16285] ? ksys_shmget+0x140/0x140 [ 768.588717][T16285] ? file_end_write+0x159/0x250 [ 768.593773][T16285] ipcget+0x1d1/0xe10 [ 768.597783][T16285] ? do_futex+0x2ff/0x3e0 [ 768.602277][T16285] ? __ia32_sys_get_robust_list+0x110/0x110 [ 768.608561][T16285] ? ipc_obtain_object_check+0x1a0/0x1a0 [ 768.614250][T16285] __x64_sys_shmget+0x141/0x180 [ 768.619148][T16285] ? lock_chain_count+0x20/0x20 [ 768.624066][T16285] ? shm_more_checks+0x80/0x80 [ 768.628862][T16285] ? lockdep_hardirqs_on+0x98/0x150 [ 768.634094][T16285] do_syscall_64+0x55/0xb0 [ 768.638537][T16285] ? clear_bhb_loop+0x40/0x90 [ 768.643261][T16285] ? clear_bhb_loop+0x40/0x90 [ 768.647960][T16285] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 768.653872][T16285] RIP: 0033:0x7fddc939e159 [ 768.658304][T16285] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 768.677935][T16285] RSP: 002b:00007fddc75f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000001d [ 768.686371][T16285] RAX: ffffffffffffffda RBX: 00007fddc9625fa0 RCX: 00007fddc939e159 [ 768.694360][T16285] RDX: 0000000000000800 RSI: 0000000000002000 RDI: 0000000000000000 [ 768.702360][T16285] RBP: 00007fddc9435024 R08: 0000000000000000 R09: 0000000000000000 [ 768.710373][T16285] R10: 0000200000fc2000 R11: 0000000000000246 R12: 0000000000000000 [ 768.718378][T16285] R13: 00007fddc9626038 R14: 00007fddc9625fa0 R15: 00007fff9c2c1c98 [ 768.726497][T16285] [ 768.850052][ T5820] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 769.070124][ T5820] usb 6-1: Using ep0 maxpacket: 16 [ 769.077787][ T5820] usb 6-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 769.119428][ T5820] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 769.141244][ T5820] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 769.161740][ T5820] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 769.170025][ T5820] usb 6-1: Product: syz [ 769.174232][ T5820] usb 6-1: Manufacturer: syz [ 769.178868][ T5820] usb 6-1: SerialNumber: syz [ 769.447447][ T5820] usb 6-1: 0:2 : does not exist [ 769.473194][ T5820] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 769.569420][ T5820] usb 6-1: USB disconnect, device number 2 [ 769.741026][ T6220] udevd[6220]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 772.683778][T16347] loop4: detected capacity change from 0 to 32768 [ 772.782103][T16357] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3499'. [ 773.041421][T16362] FAULT_INJECTION: forcing a failure. [ 773.041421][T16362] name failslab, interval 1, probability 0, space 0, times 0 [ 773.080311][T16362] CPU: 1 PID: 16362 Comm: syz.1.3506 Not tainted syzkaller #0 [ 773.087864][T16362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 773.098067][T16362] Call Trace: [ 773.101398][T16362] [ 773.104370][T16362] dump_stack_lvl+0x18c/0x250 [ 773.109102][T16362] ? show_regs_print_info+0x20/0x20 [ 773.114351][T16362] ? load_image+0x420/0x420 [ 773.118904][T16362] ? __might_sleep+0xe0/0xe0 [ 773.123912][T16362] ? __lock_acquire+0x7d80/0x7d80 [ 773.128991][T16362] ? mark_lock+0x94/0x320 [ 773.133467][T16362] should_fail_ex+0x394/0x4c0 [ 773.138208][T16362] should_failslab+0x9/0x20 [ 773.142843][T16362] slab_pre_alloc_hook+0x59/0x300 [ 773.147907][T16362] kmem_cache_alloc+0x5a/0x2c0 [ 773.152706][T16362] ? mas_alloc_nodes+0x2f8/0x8c0 [ 773.157876][T16362] mas_alloc_nodes+0x2f8/0x8c0 [ 773.163388][T16362] mas_preallocate+0xa1f/0x1170 [ 773.168281][T16362] ? lockdep_softirqs_off+0x440/0x440 [ 773.173687][T16362] ? mas_destroy+0x20a0/0x20a0 [ 773.178490][T16362] ? vma_iter_config+0xe6/0x270 [ 773.183374][T16362] __split_vma+0x2dd/0xc20 [ 773.187833][T16362] ? mmap_write_unlock+0x160/0x160 [ 773.192987][T16362] ? split_vma+0x8f/0x110 [ 773.197365][T16362] madvise_update_vma+0x4e9/0xda0 [ 773.202433][T16362] ? __ia32_sys_process_madvise+0xc0/0xc0 [ 773.208191][T16362] do_madvise+0x145c/0x3790 [ 773.212717][T16362] ? __lock_acquire+0x7d80/0x7d80 [ 773.217774][T16362] ? madvise_set_anon_name+0x440/0x440 [ 773.223249][T16362] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 773.229164][T16362] ? _raw_spin_unlock+0x40/0x40 [ 773.234031][T16362] ? preempt_schedule_thunk+0x1a/0x30 [ 773.239631][T16362] ? try_to_wake_up+0x6f5/0x10e0 [ 773.244589][T16362] ? wake_up_q+0xca/0x100 [ 773.248943][T16362] ? futex_wake+0x42a/0x4f0 [ 773.253472][T16362] ? futex_wake_mark+0x150/0x150 [ 773.258432][T16362] ? create_io_thread+0x190/0x190 [ 773.263498][T16362] ? file_end_write+0x159/0x250 [ 773.269716][T16362] ? vfs_write+0x5de/0x9a0 [ 773.274190][T16362] ? do_futex+0x35d/0x3e0 [ 773.278549][T16362] ? __ia32_sys_get_robust_list+0x110/0x110 [ 773.284470][T16362] ? __x64_sys_clone+0x1b7/0x230 [ 773.289448][T16362] ? lock_chain_count+0x20/0x20 [ 773.294342][T16362] __x64_sys_madvise+0xa6/0xc0 [ 773.299217][T16362] do_syscall_64+0x55/0xb0 [ 773.303649][T16362] ? clear_bhb_loop+0x40/0x90 [ 773.308346][T16362] ? clear_bhb_loop+0x40/0x90 [ 773.313041][T16362] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 773.318953][T16362] RIP: 0033:0x7f9fef79e159 [ 773.323407][T16362] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 773.343084][T16362] RSP: 002b:00007f9ff0647028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 773.351539][T16362] RAX: ffffffffffffffda RBX: 00007f9fefa25fa0 RCX: 00007f9fef79e159 [ 773.359535][T16362] RDX: 000000000000000e RSI: 0000000000800000 RDI: 0000200000000000 [ 773.367554][T16362] RBP: 00007f9fef835024 R08: 0000000000000000 R09: 0000000000000000 [ 773.375571][T16362] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 773.383567][T16362] R13: 00007f9fefa26038 R14: 00007f9fefa25fa0 R15: 00007fffd83ed478 [ 773.391582][T16362] [ 774.070245][T11839] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 774.245304][T16386] xt_connbytes: Forcing CT accounting to be enabled [ 774.252360][T11839] usb 6-1: Using ep0 maxpacket: 8 [ 774.259469][T11839] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 774.279358][T11839] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 774.300089][T11839] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 774.336910][T11839] usb 6-1: New USB device found, idVendor=054c, idProduct=042f, bcdDevice= 0.00 [ 774.378821][T11839] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 774.408471][T11839] usb 6-1: config 0 descriptor?? [ 774.760331][T16382] loop4: detected capacity change from 0 to 32768 [ 774.832595][T16382] loop4: p1 p3 < > [ 775.451792][T16404] 9pnet_fd: Insufficient options for proto=fd [ 775.989064][ T6220] udevd[6220]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 775.996234][ T8913] udevd[8913]: inotify_add_watch(7, /dev/loop4p3, 10) failed: No such file or directory [ 776.113057][ T6220] udevd[6220]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 776.124392][ T8913] udevd[8913]: inotify_add_watch(7, /dev/loop4p3, 10) failed: No such file or directory [ 776.515945][T16430] FAULT_INJECTION: forcing a failure. [ 776.515945][T16430] name failslab, interval 1, probability 0, space 0, times 0 [ 776.540941][T16430] CPU: 1 PID: 16430 Comm: syz.4.3531 Not tainted syzkaller #0 [ 776.548922][T16430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 776.559027][T16430] Call Trace: [ 776.562360][T16430] [ 776.565327][T16430] dump_stack_lvl+0x18c/0x250 [ 776.570061][T16430] ? show_regs_print_info+0x20/0x20 [ 776.575309][T16430] ? load_image+0x420/0x420 [ 776.579870][T16430] ? __might_sleep+0xe0/0xe0 [ 776.584513][T16430] ? __lock_acquire+0x7d80/0x7d80 [ 776.589592][T16430] should_fail_ex+0x394/0x4c0 [ 776.594321][T16430] should_failslab+0x9/0x20 [ 776.598852][T16430] slab_pre_alloc_hook+0x59/0x300 [ 776.604508][T16430] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 776.610419][T16430] ? sk_prot_alloc+0xe7/0x210 [ 776.615138][T16430] ? sk_prot_alloc+0xe7/0x210 [ 776.619922][T16430] __kmem_cache_alloc_node+0x53/0x250 [ 776.625425][T16430] ? sk_prot_alloc+0xe7/0x210 [ 776.630126][T16430] __kmalloc+0xa7/0x240 [ 776.634436][T16430] sk_prot_alloc+0xe7/0x210 [ 776.639044][T16430] ? sk_alloc+0x24/0x350 [ 776.643311][T16430] sk_alloc+0x3a/0x350 [ 776.647417][T16430] __netlink_create+0x6c/0x290 [ 776.652274][T16430] netlink_create+0x3ee/0x5c0 [ 776.656966][T16430] ? rtnetlink_rcv+0x20/0x20 [ 776.661609][T16430] __sock_create+0x49e/0x940 [ 776.666297][T16430] __sys_socket+0xd7/0x1b0 [ 776.670736][T16430] __x64_sys_socket+0x7a/0x90 [ 776.675448][T16430] do_syscall_64+0x55/0xb0 [ 776.679987][T16430] ? clear_bhb_loop+0x40/0x90 [ 776.684940][T16430] ? clear_bhb_loop+0x40/0x90 [ 776.689657][T16430] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 776.695572][T16430] RIP: 0033:0x7fddc939e159 [ 776.700009][T16430] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 776.719632][T16430] RSP: 002b:00007fddc75f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 776.728166][T16430] RAX: ffffffffffffffda RBX: 00007fddc9625fa0 RCX: 00007fddc939e159 [ 776.736177][T16430] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000010 [ 776.744163][T16430] RBP: 00007fddc9435024 R08: 0000000000000000 R09: 0000000000000000 [ 776.752148][T16430] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 776.760220][T16430] R13: 00007fddc9626038 R14: 00007fddc9625fa0 R15: 00007fff9c2c1c98 [ 776.768220][T16430] [ 776.953610][T11839] usbhid 6-1:0.0: can't add hid device: -71 [ 776.986116][T11839] usbhid: probe of 6-1:0.0 failed with error -71 [ 777.030434][T11839] usb 6-1: USB disconnect, device number 3 [ 777.337995][T16449] FAULT_INJECTION: forcing a failure. [ 777.337995][T16449] name failslab, interval 1, probability 0, space 0, times 0 [ 777.402349][T16449] CPU: 0 PID: 16449 Comm: syz.4.3538 Not tainted syzkaller #0 [ 777.409894][T16449] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 777.420082][T16449] Call Trace: [ 777.423404][T16449] [ 777.426381][T16449] dump_stack_lvl+0x18c/0x250 [ 777.431121][T16449] ? show_regs_print_info+0x20/0x20 [ 777.436586][T16449] ? load_image+0x420/0x420 [ 777.441155][T16449] ? __might_sleep+0xe0/0xe0 [ 777.445818][T16449] ? __lock_acquire+0x7d80/0x7d80 [ 777.450911][T16449] should_fail_ex+0x394/0x4c0 [ 777.455666][T16449] should_failslab+0x9/0x20 [ 777.460244][T16449] slab_pre_alloc_hook+0x59/0x300 [ 777.465338][T16449] ? memcg_list_lru_alloc+0x335/0xb00 [ 777.470768][T16449] ? memcg_list_lru_alloc+0x335/0xb00 [ 777.476204][T16449] __kmem_cache_alloc_node+0x53/0x250 [ 777.481657][T16449] ? memcg_list_lru_alloc+0x335/0xb00 [ 777.487081][T16449] __kmalloc+0xa7/0x240 [ 777.491308][T16449] memcg_list_lru_alloc+0x335/0xb00 [ 777.496573][T16449] ? memcg_reparent_list_lrus+0x860/0x860 [ 777.502354][T16449] ? get_obj_cgroup_from_current+0xd4/0x280 [ 777.510438][T16449] ? get_obj_cgroup_from_current+0xd4/0x280 [ 777.516435][T16449] slab_pre_alloc_hook+0x2ad/0x300 [ 777.521616][T16449] ? slab_pre_alloc_hook+0xb1/0x300 [ 777.526888][T16449] kmem_cache_alloc_lru+0x4d/0x2b0 [ 777.532154][T16449] ? __d_alloc+0x31/0x710 [ 777.536544][T16449] __d_alloc+0x31/0x710 [ 777.540773][T16449] d_alloc_parallel+0xe0/0x1590 [ 777.545670][T16449] ? __asan_memset+0x22/0x40 [ 777.550319][T16449] ? lockdep_init_map_type+0x9c/0x8e0 [ 777.555796][T16449] ? lockdep_softirqs_off+0x440/0x440 [ 777.561276][T16449] ? d_hash_and_lookup+0x1b0/0x1b0 [ 777.566464][T16449] ? __init_waitqueue_head+0xa8/0x140 [ 777.571887][T16449] __lookup_slow+0x138/0x400 [ 777.576506][T16449] ? lookup_one_len+0x2e0/0x2e0 [ 777.581403][T16449] lookup_one_len+0x1a1/0x2e0 [ 777.586101][T16449] ? lookup_one_common+0x450/0x450 [ 777.591227][T16449] ? __mnt_want_write+0x223/0x2a0 [ 777.596292][T16449] do_mq_open+0x25f/0x760 [ 777.600658][T16449] ? mq_clear_sbinfo+0x90/0x90 [ 777.605454][T16449] __x64_sys_mq_open+0x186/0x1e0 [ 777.610412][T16449] ? proc_ipc_sem_dointvec+0x180/0x180 [ 777.615922][T16449] ? lockdep_hardirqs_on+0x98/0x150 [ 777.621258][T16449] do_syscall_64+0x55/0xb0 [ 777.625702][T16449] ? clear_bhb_loop+0x40/0x90 [ 777.630423][T16449] ? clear_bhb_loop+0x40/0x90 [ 777.635122][T16449] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 777.641051][T16449] RIP: 0033:0x7fddc939e159 [ 777.645494][T16449] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 777.665123][T16449] RSP: 002b:00007fddc75f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 777.673566][T16449] RAX: ffffffffffffffda RBX: 00007fddc9625fa0 RCX: 00007fddc939e159 [ 777.681654][T16449] RDX: 0000000000000000 RSI: 0000000000000042 RDI: 00002000005a1ffb [ 777.689644][T16449] RBP: 00007fddc9435024 R08: 0000000000000000 R09: 0000000000000000 [ 777.697632][T16449] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 777.705618][T16449] R13: 00007fddc9626038 R14: 00007fddc9625fa0 R15: 00007fff9c2c1c98 [ 777.713639][T16449] [ 778.260176][ T5817] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 778.288336][T16475] netlink: 7 bytes leftover after parsing attributes in process `syz.5.3548'. [ 778.429793][T15173] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 778.450243][ T5817] usb 2-1: Using ep0 maxpacket: 8 [ 778.462135][ T5817] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 778.499665][ T5817] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 778.522688][ T5817] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 778.536544][ T5817] usb 2-1: New USB device found, idVendor=054c, idProduct=042f, bcdDevice= 0.00 [ 778.569179][ T5817] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 778.610399][ T5817] usb 2-1: config 0 descriptor?? [ 778.668556][T15173] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 778.848230][T15173] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 778.983849][T15173] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 779.036998][T16496] FAULT_INJECTION: forcing a failure. [ 779.036998][T16496] name failslab, interval 1, probability 0, space 0, times 0 [ 779.050149][T16496] CPU: 0 PID: 16496 Comm: syz.5.3556 Not tainted syzkaller #0 [ 779.057664][T16496] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 779.068125][T16496] Call Trace: [ 779.071470][T16496] [ 779.074458][T16496] dump_stack_lvl+0x18c/0x250 [ 779.079219][T16496] ? show_regs_print_info+0x20/0x20 [ 779.084477][T16496] ? load_image+0x420/0x420 [ 779.089134][T16496] ? __might_sleep+0xe0/0xe0 [ 779.093795][T16496] ? __lock_acquire+0x7d80/0x7d80 [ 779.098896][T16496] should_fail_ex+0x394/0x4c0 [ 779.103638][T16496] should_failslab+0x9/0x20 [ 779.108202][T16496] slab_pre_alloc_hook+0x59/0x300 [ 779.113290][T16496] kmem_cache_alloc+0x5a/0x2c0 [ 779.118116][T16496] ? getname_kernel+0x5a/0x2f0 [ 779.122945][T16496] getname_kernel+0x5a/0x2f0 [ 779.127687][T16496] do_coredump+0x1c5b/0x24a0 [ 779.132353][T16496] ? nfs_stat_to_errno+0x170/0x170 [ 779.137546][T16496] ? lock_chain_count+0x20/0x20 [ 779.142471][T16496] ? _raw_spin_unlock_irq+0x23/0x50 [ 779.147812][T16496] ? lockdep_hardirqs_on+0x98/0x150 [ 779.153081][T16496] get_signal+0x10da/0x1390 [ 779.157658][T16496] arch_do_signal_or_restart+0xc2/0x7b0 [ 779.163285][T16496] ? _raw_spin_unlock+0x40/0x40 [ 779.168182][T16496] ? get_sigframe_size+0x20/0x20 [ 779.173170][T16496] ? __send_signal_locked+0xb42/0xe00 [ 779.178617][T16496] ? exit_to_user_mode_loop+0x3b/0x110 [ 779.184136][T16496] exit_to_user_mode_loop+0x70/0x110 [ 779.189476][T16496] exit_to_user_mode_prepare+0xee/0x180 [ 779.195093][T16496] syscall_exit_to_user_mode+0x1a/0x50 [ 779.200614][T16496] do_syscall_64+0x61/0xb0 [ 779.205090][T16496] ? clear_bhb_loop+0x40/0x90 [ 779.209821][T16496] ? clear_bhb_loop+0x40/0x90 [ 779.214553][T16496] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 779.220682][T16496] RIP: 0033:0x7fdee2b9e159 [ 779.225186][T16496] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 779.245028][T16496] RSP: 002b:00007fdee39f60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 779.253515][T16496] RAX: 00000000000000ca RBX: 00007fdee2e25fa8 RCX: 00007fdee2b9e159 [ 779.261532][T16496] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fdee2e25fac [ 779.269543][T16496] RBP: 00007fdee2e25fa0 R08: 0000000000745d1e R09: 0000000000000000 [ 779.277560][T16496] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 779.285667][T16496] R13: 00007fdee2e26038 R14: 00007ffddee05270 R15: 00007ffddee05358 [ 779.293699][T16496] [ 779.544259][T16505] netlink: 7 bytes leftover after parsing attributes in process `syz.4.3558'. [ 779.844973][T16510] loop4: detected capacity change from 0 to 256 [ 779.885432][T16510] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 780.482145][T16521] loop3: detected capacity change from 0 to 256 [ 781.070117][ T5817] usbhid 2-1:0.0: can't add hid device: -71 [ 781.076220][ T5817] usbhid: probe of 2-1:0.0 failed with error -71 [ 781.140174][ T5817] usb 2-1: USB disconnect, device number 103 [ 781.625508][T16542] loop1: detected capacity change from 0 to 256 [ 781.672288][T16542] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 781.861434][ T5820] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 782.060493][ T5820] usb 5-1: Using ep0 maxpacket: 16 [ 782.068403][T15173] hsr_slave_0: left promiscuous mode [ 782.069982][ T5820] usb 5-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 782.084441][T15173] hsr_slave_1: left promiscuous mode [ 782.099777][T15173] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 782.117858][ T5820] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 782.138179][T15173] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 782.146628][ T5820] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 782.157885][ T5820] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 782.172125][ T5820] usb 5-1: Product: syz [ 782.182061][ T5820] usb 5-1: Manufacturer: syz [ 782.189815][T15173] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 782.192144][ T5820] usb 5-1: SerialNumber: syz [ 782.234833][T15173] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 782.334206][T15173] bridge_slave_1: left allmulticast mode [ 782.363458][T15173] bridge_slave_1: left promiscuous mode [ 782.369413][T15173] bridge0: port 2(bridge_slave_1) entered disabled state [ 782.416410][T15173] bridge_slave_0: left allmulticast mode [ 782.433031][T15173] bridge_slave_0: left promiscuous mode [ 782.461021][T15173] bridge0: port 1(bridge_slave_0) entered disabled state [ 782.469323][ T5820] usb 5-1: 0:2 : does not exist [ 782.501823][ T5820] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 782.587143][ T5820] usb 5-1: USB disconnect, device number 2 [ 782.668930][T15173] veth1_vlan: left promiscuous mode [ 782.684738][T15173] veth0_vlan: left promiscuous mode [ 782.692626][ T6220] udevd[6220]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 783.129473][T16569] loop3: detected capacity change from 0 to 164 [ 783.297436][T16569] rock: corrupted directory entry. extent=41 out of volume (nzones=41) [ 783.437201][T16569] rock: corrupted directory entry. extent=41 out of volume (nzones=41) [ 783.578522][T16575] loop4: detected capacity change from 0 to 256 [ 783.623648][T16575] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 784.010325][ T23] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 784.210104][ T23] usb 6-1: Using ep0 maxpacket: 8 [ 784.217810][ T23] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 784.258559][ T23] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 784.281107][ T23] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 784.305443][ T23] usb 6-1: New USB device found, idVendor=054c, idProduct=042f, bcdDevice= 0.00 [ 784.326098][ T23] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 784.356307][ T23] usb 6-1: config 0 descriptor?? [ 784.728047][T15173] team0 (unregistering): Port device team_slave_1 removed [ 784.808693][T15173] team0 (unregistering): Port device team_slave_0 removed [ 784.905131][T15173] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 784.998605][T15173] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 785.277867][ T27] audit: type=1800 audit(785.228:1454): pid=16596 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3586" name="/" dev="fuse" ino=4 res=0 errno=0 [ 785.689710][T15173] bond0 (unregistering): Released all slaves [ 786.259333][T16612] loop4: detected capacity change from 0 to 256 [ 786.297412][T16612] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 786.496060][T16612] Process accounting resumed [ 786.534394][T16612] FAT-fs (loop4): error, corrupted file size (i_pos 196, 16779264) [ 786.569255][T16612] FAT-fs (loop4): Filesystem has been set read-only [ 786.622067][T11839] FAT-fs (loop4): error, corrupted file size (i_pos 196, 16779264) [ 786.802576][ T23] usbhid 6-1:0.0: can't add hid device: -71 [ 786.839068][ T23] usbhid: probe of 6-1:0.0 failed with error -71 [ 786.862776][ T23] usb 6-1: USB disconnect, device number 4 [ 787.519678][T16645] loop1: detected capacity change from 0 to 256 [ 787.567279][T16645] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 787.716107][T16645] Process accounting resumed [ 787.743491][T16645] FAT-fs (loop1): error, corrupted file size (i_pos 196, 16779264) [ 787.771226][T16645] FAT-fs (loop1): Filesystem has been set read-only [ 787.852355][ T788] FAT-fs (loop1): error, corrupted file size (i_pos 196, 16779264) [ 787.930535][ T23] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 788.098860][T16661] loop4: detected capacity change from 0 to 512 [ 788.142825][T16661] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 788.170130][ T23] usb 6-1: Using ep0 maxpacket: 8 [ 788.187034][ T23] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 788.218645][ T23] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 788.278953][ T23] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 788.313116][ T23] usb 6-1: New USB device found, idVendor=054c, idProduct=042f, bcdDevice= 0.00 [ 788.348116][ T23] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 788.399830][ T23] usb 6-1: config 0 descriptor?? [ 789.073698][T16686] loop1: detected capacity change from 0 to 256 [ 789.139472][T16686] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 789.359212][T16685] Process accounting resumed [ 789.396026][T16685] FAT-fs (loop1): error, corrupted file size (i_pos 196, 16779264) [ 789.426119][T16685] FAT-fs (loop1): Filesystem has been set read-only [ 789.467920][ T8] FAT-fs (loop1): error, corrupted file size (i_pos 196, 16779264) [ 790.505691][T16705] netlink: 92 bytes leftover after parsing attributes in process `syz.4.3619'. [ 790.980544][T16711] syzkaller0: entered allmulticast mode [ 791.092465][T16711] syzkaller0 (unregistering): left allmulticast mode [ 791.517786][ T23] usbhid 6-1:0.0: can't add hid device: -71 [ 791.526808][ T23] usbhid: probe of 6-1:0.0 failed with error -71 [ 791.540181][ T23] usb 6-1: USB disconnect, device number 5 [ 792.395607][T16740] netlink: 92 bytes leftover after parsing attributes in process `syz.5.3631'. [ 792.660719][ T8] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 792.739980][ T23] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 792.860098][ T8] usb 2-1: Using ep0 maxpacket: 16 [ 792.930146][ T23] usb 4-1: Using ep0 maxpacket: 8 [ 792.939458][ T23] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 792.984684][ T23] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 793.026018][ T23] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 793.078635][ T23] usb 4-1: New USB device found, idVendor=054c, idProduct=042f, bcdDevice= 0.00 [ 793.113806][ T23] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 793.120291][T16736] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 793.166346][ T23] usb 4-1: config 0 descriptor?? [ 793.209058][T16736] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 793.533729][ T8] usb 2-1: unable to get BOS descriptor or descriptor too short [ 793.572457][ T8] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 793.590239][ T8] usb 2-1: can't read configurations, error -71 [ 795.404859][T16796] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3642'. [ 795.618699][ T23] usbhid 4-1:0.0: can't add hid device: -71 [ 795.636556][ T23] usbhid: probe of 4-1:0.0 failed with error -71 [ 795.661591][ T23] usb 4-1: USB disconnect, device number 91 [ 795.831185][T16804] loop1: detected capacity change from 0 to 128 [ 795.918368][T16804] syz.1.3645: attempt to access beyond end of device [ 795.918368][T16804] loop1: rw=2049, sector=138, nr_sectors = 2 limit=128 [ 796.016322][T16804] syz.1.3645: attempt to access beyond end of device [ 796.016322][T16804] loop1: rw=2049, sector=138, nr_sectors = 2 limit=128 [ 796.370278][ T8] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 796.552683][T16829] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3653'. [ 796.600233][ T8] usb 6-1: Using ep0 maxpacket: 16 [ 796.790167][ T23] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 796.825790][T16812] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 796.870656][T16812] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 796.990156][ T23] usb 4-1: Using ep0 maxpacket: 8 [ 797.003642][ T23] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 797.044071][ T23] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 797.088897][ T23] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 797.136375][ T23] usb 4-1: New USB device found, idVendor=054c, idProduct=042f, bcdDevice= 0.00 [ 797.157957][ T23] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 797.191107][ T8] usb 6-1: unable to get BOS descriptor or descriptor too short [ 797.192274][ T23] usb 4-1: config 0 descriptor?? [ 797.216629][ T8] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 797.245151][ T8] usb 6-1: can't read configurations, error -71 [ 797.716451][T16854] loop4: detected capacity change from 0 to 7 [ 797.736461][T16854] Dev loop4: unable to read RDB block 7 [ 797.749549][T16854] loop4: unable to read partition table [ 797.755976][T16854] loop4: partition table beyond EOD, truncated [ 797.774175][T16854] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 798.348056][T16872] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3662'. [ 798.641167][T16880] loop4: detected capacity change from 0 to 128 [ 799.120672][T16889] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3669'. [ 799.210035][ T788] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 799.400216][ T788] usb 5-1: Using ep0 maxpacket: 16 [ 799.602965][ T23] usbhid 4-1:0.0: can't add hid device: -71 [ 799.621178][T16887] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 799.630042][ T23] usbhid: probe of 4-1:0.0 failed with error -71 [ 799.660478][ T23] usb 4-1: USB disconnect, device number 92 [ 799.670975][T16887] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 799.787582][T16901] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3672'. [ 799.995402][ T788] usb 5-1: unable to get BOS descriptor or descriptor too short [ 800.052752][ T788] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 800.080004][ T788] usb 5-1: can't read configurations, error -71 [ 800.502768][T16926] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3678'. [ 801.220104][ T788] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 801.365594][T16943] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3682'. [ 801.420043][ T788] usb 5-1: Using ep0 maxpacket: 8 [ 801.487744][ T788] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 801.546023][ T788] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 801.670543][ T788] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 801.726909][ T788] usb 5-1: New USB device found, idVendor=054c, idProduct=042f, bcdDevice= 0.00 [ 801.748087][ T788] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 801.791752][ T788] usb 5-1: config 0 descriptor?? [ 802.945205][T16968] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3688'. [ 803.436764][T16978] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3691'. [ 803.884730][ T788] usbhid 5-1:0.0: can't add hid device: -71 [ 803.914100][ T788] usbhid: probe of 5-1:0.0 failed with error -71 [ 803.962601][ T788] usb 5-1: USB disconnect, device number 4 [ 804.142746][T16993] loop4: detected capacity change from 0 to 7 [ 804.180172][T16993] Dev loop4: unable to read RDB block 7 [ 804.185850][T16993] loop4: unable to read partition table [ 804.217026][T16993] loop4: partition table beyond EOD, truncated [ 804.238077][T16993] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 804.371959][T17002] FAULT_INJECTION: forcing a failure. [ 804.371959][T17002] name failslab, interval 1, probability 0, space 0, times 0 [ 804.385369][T17002] CPU: 1 PID: 17002 Comm: syz.1.3698 Not tainted syzkaller #0 [ 804.392992][T17002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 804.403099][T17002] Call Trace: [ 804.406687][T17002] [ 804.409676][T17002] dump_stack_lvl+0x18c/0x250 [ 804.414427][T17002] ? show_regs_print_info+0x20/0x20 [ 804.419687][T17002] ? load_image+0x420/0x420 [ 804.424520][T17002] should_fail_ex+0x394/0x4c0 [ 804.429340][T17002] should_failslab+0x9/0x20 [ 804.433897][T17002] slab_pre_alloc_hook+0x59/0x300 [ 804.439067][T17002] kmem_cache_alloc+0x5a/0x2c0 [ 804.443881][T17002] ? sctp_get_port_local+0x69f/0x15d0 [ 804.449400][T17002] sctp_get_port_local+0x69f/0x15d0 [ 804.454747][T17002] ? sctp_do_bind+0x8f0/0x8f0 [ 804.460074][T17002] ? sctp_bind_addr_match+0x30/0x2a0 [ 804.465394][T17002] sctp_do_bind+0x4c0/0x8f0 [ 804.469951][T17002] sctp_connect_new_asoc+0x26a/0x6a0 [ 804.475288][T17002] ? __sctp_connect+0xd80/0xd80 [ 804.480185][T17002] ? sctp_get_af_specific+0x29/0x70 [ 804.485420][T17002] ? sctp_inet6_send_verify+0x80/0x300 [ 804.491011][T17002] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 804.496896][T17002] __sctp_connect+0x5b7/0xd80 [ 804.501626][T17002] ? sctp_send_asconf+0x170/0x170 [ 804.506682][T17002] ? __local_bh_enable_ip+0x13a/0x1c0 [ 804.512074][T17002] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 804.517657][T17002] ? security_sctp_bind_connect+0x89/0xb0 [ 804.523400][T17002] sctp_setsockopt_connectx+0x104/0x1a0 [ 804.528980][T17002] sctp_setsockopt+0x6d8/0x11e0 [ 804.534025][T17002] ? sock_common_recvmsg+0x190/0x190 [ 804.539327][T17002] do_sock_setsockopt+0x175/0x1a0 [ 804.544373][T17002] ? __fdget+0x180/0x210 [ 804.548645][T17002] __x64_sys_setsockopt+0x182/0x200 [ 804.553869][T17002] do_syscall_64+0x55/0xb0 [ 804.558308][T17002] ? clear_bhb_loop+0x40/0x90 [ 804.563005][T17002] ? clear_bhb_loop+0x40/0x90 [ 804.567703][T17002] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 804.573613][T17002] RIP: 0033:0x7f9fef79e159 [ 804.578064][T17002] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 804.597695][T17002] RSP: 002b:00007f9ff0647028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 804.606247][T17002] RAX: ffffffffffffffda RBX: 00007f9fefa25fa0 RCX: 00007f9fef79e159 [ 804.614286][T17002] RDX: 000000000000006e RSI: 0000000000000084 RDI: 0000000000000003 [ 804.622313][T17002] RBP: 00007f9fef835024 R08: 000000000000001c R09: 0000000000000000 [ 804.630324][T17002] R10: 00002000000008c0 R11: 0000000000000246 R12: 0000000000000000 [ 804.638314][T17002] R13: 00007f9fefa26038 R14: 00007f9fefa25fa0 R15: 00007fffd83ed478 [ 804.646322][T17002] [ 804.850324][T17012] netlink: 68 bytes leftover after parsing attributes in process `syz.5.3701'. [ 805.049736][T17015] ------------[ cut here ]------------ [ 805.055836][T17015] WARNING: CPU: 0 PID: 17015 at mm/page_alloc.c:4477 __alloc_pages+0x2e4/0x460 [ 805.064904][T17015] Modules linked in: [ 805.068828][T17015] CPU: 0 PID: 17015 Comm: syz.1.3702 Not tainted syzkaller #0 [ 805.076435][T17015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 805.086572][T17015] RIP: 0010:__alloc_pages+0x2e4/0x460 [ 805.092092][T17015] Code: 0c 25 28 00 00 00 48 3b 8c 24 a0 00 00 00 0f 85 9f 00 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 c6 05 a2 14 a3 0c 01 <0f> 0b eb a4 a9 00 00 08 00 8b 74 24 0c 75 3e 44 89 f1 81 e1 7f ff [ 805.112379][T17015] RSP: 0018:ffffc9000d2ffa80 EFLAGS: 00010246 [ 805.118468][T17015] RAX: ffffc9000d2ffa00 RBX: 1ffff92001a5ff54 RCX: 0000000000000000 [ 805.127033][T17015] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000d2ffae8 [ 805.135435][T17015] RBP: ffffc9000d2ffb80 R08: ffffc9000d2ffae7 R09: 0000000000000000 [ 805.143532][T17015] R10: ffffc9000d2ffac0 R11: fffff52001a5ff5d R12: 0000000000000014 [ 805.151616][T17015] R13: 0000000000000000 R14: 0000000000040d40 R15: dffffc0000000000 [ 805.159596][T17015] FS: 00007f9ff06476c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 805.168578][T17015] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 805.175637][T17015] CR2: 00007fdee2e185a0 CR3: 000000002d11c000 CR4: 00000000003526f0 [ 805.183803][T17015] Call Trace: [ 805.187091][T17015] [ 805.190175][T17015] ? zone_statistics+0x170/0x170 [ 805.195632][T17015] ? v9fs_fid_find+0x270/0x270 [ 805.200545][T17015] __kmalloc_large_node+0x8c/0x1f0 [ 805.205720][T17015] ? v9fs_fid_get_acl+0x4f/0xf0 [ 805.210670][T17015] __kmalloc+0x114/0x240 [ 805.214958][T17015] v9fs_fid_get_acl+0x4f/0xf0 [ 805.219649][T17015] v9fs_get_acl+0x11b/0x350 [ 805.224248][T17015] v9fs_mount+0x860/0xb40 [ 805.228612][T17015] ? trace_xrep_findroot_block+0x1f0/0x1f0 [ 805.234691][T17015] legacy_get_tree+0xea/0x180 [ 805.239383][T17015] ? trace_xrep_findroot_block+0x1f0/0x1f0 [ 805.245264][T17015] vfs_get_tree+0x8c/0x280 [ 805.249688][T17015] do_new_mount+0x24a/0xa40 [ 805.254370][T17015] __se_sys_mount+0x2e7/0x3d0 [ 805.259075][T17015] ? __x64_sys_mount+0xc0/0xc0 [ 805.263877][T17015] ? lockdep_hardirqs_on+0x98/0x150 [ 805.269080][T17015] ? __x64_sys_mount+0x20/0xc0 [ 805.273874][T17015] do_syscall_64+0x55/0xb0 [ 805.278305][T17015] ? clear_bhb_loop+0x40/0x90 [ 805.283018][T17015] ? clear_bhb_loop+0x40/0x90 [ 805.287700][T17015] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 805.293626][T17015] RIP: 0033:0x7f9fef79e159 [ 805.298559][T17015] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 805.318278][T17015] RSP: 002b:00007f9ff0647028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 805.326741][T17015] RAX: ffffffffffffffda RBX: 00007f9fefa25fa0 RCX: 00007f9fef79e159 [ 805.335108][T17015] RDX: 00002000000001c0 RSI: 0000200000000240 RDI: 0000000000000000 [ 805.343174][T17015] RBP: 00007f9fef835024 R08: 0000200000000340 R09: 0000000000000000 [ 805.351212][T17015] R10: 0000000002000000 R11: 0000000000000246 R12: 0000000000000000 [ 805.359201][T17015] R13: 00007f9fefa26038 R14: 00007f9fefa25fa0 R15: 00007fffd83ed478 [ 805.367229][T17015] [ 805.370311][T17015] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 805.377674][T17015] CPU: 0 PID: 17015 Comm: syz.1.3702 Not tainted syzkaller #0 [ 805.385129][T17015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 805.395185][T17015] Call Trace: [ 805.398549][T17015] [ 805.401485][T17015] dump_stack_lvl+0x18c/0x250 [ 805.406175][T17015] ? show_regs_print_info+0x20/0x20 [ 805.411386][T17015] ? load_image+0x420/0x420 [ 805.415916][T17015] panic+0x2ca/0x720 [ 805.419835][T17015] ? bpf_jit_dump+0xd0/0xd0 [ 805.424597][T17015] __warn+0x2e0/0x470 [ 805.428609][T17015] ? __alloc_pages+0x2e4/0x460 [ 805.433376][T17015] ? __alloc_pages+0x2e4/0x460 [ 805.438146][T17015] report_bug+0x2be/0x4f0 [ 805.442498][T17015] ? __alloc_pages+0x2e4/0x460 [ 805.447273][T17015] ? __alloc_pages+0x2e4/0x460 [ 805.452035][T17015] ? __alloc_pages+0x2e6/0x460 [ 805.456901][T17015] handle_bug+0xcf/0x120 [ 805.461150][T17015] exc_invalid_op+0x1a/0x50 [ 805.465746][T17015] asm_exc_invalid_op+0x1a/0x20 [ 805.470609][T17015] RIP: 0010:__alloc_pages+0x2e4/0x460 [ 805.475989][T17015] Code: 0c 25 28 00 00 00 48 3b 8c 24 a0 00 00 00 0f 85 9f 00 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 c6 05 a2 14 a3 0c 01 <0f> 0b eb a4 a9 00 00 08 00 8b 74 24 0c 75 3e 44 89 f1 81 e1 7f ff [ 805.495600][T17015] RSP: 0018:ffffc9000d2ffa80 EFLAGS: 00010246 [ 805.501803][T17015] RAX: ffffc9000d2ffa00 RBX: 1ffff92001a5ff54 RCX: 0000000000000000 [ 805.509798][T17015] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000d2ffae8 [ 805.517771][T17015] RBP: ffffc9000d2ffb80 R08: ffffc9000d2ffae7 R09: 0000000000000000 [ 805.525742][T17015] R10: ffffc9000d2ffac0 R11: fffff52001a5ff5d R12: 0000000000000014 [ 805.533741][T17015] R13: 0000000000000000 R14: 0000000000040d40 R15: dffffc0000000000 [ 805.541742][T17015] ? zone_statistics+0x170/0x170 [ 805.546695][T17015] ? v9fs_fid_find+0x270/0x270 [ 805.551468][T17015] __kmalloc_large_node+0x8c/0x1f0 [ 805.556585][T17015] ? v9fs_fid_get_acl+0x4f/0xf0 [ 805.561451][T17015] __kmalloc+0x114/0x240 [ 805.565721][T17015] v9fs_fid_get_acl+0x4f/0xf0 [ 805.570420][T17015] v9fs_get_acl+0x11b/0x350 [ 805.574941][T17015] v9fs_mount+0x860/0xb40 [ 805.579300][T17015] ? trace_xrep_findroot_block+0x1f0/0x1f0 [ 805.585118][T17015] legacy_get_tree+0xea/0x180 [ 805.589811][T17015] ? trace_xrep_findroot_block+0x1f0/0x1f0 [ 805.595626][T17015] vfs_get_tree+0x8c/0x280 [ 805.600049][T17015] do_new_mount+0x24a/0xa40 [ 805.604553][T17015] __se_sys_mount+0x2e7/0x3d0 [ 805.609253][T17015] ? __x64_sys_mount+0xc0/0xc0 [ 805.614038][T17015] ? lockdep_hardirqs_on+0x98/0x150 [ 805.619255][T17015] ? __x64_sys_mount+0x20/0xc0 [ 805.624027][T17015] do_syscall_64+0x55/0xb0 [ 805.628452][T17015] ? clear_bhb_loop+0x40/0x90 [ 805.633172][T17015] ? clear_bhb_loop+0x40/0x90 [ 805.637859][T17015] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 805.643805][T17015] RIP: 0033:0x7f9fef79e159 [ 805.648233][T17015] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 805.667878][T17015] RSP: 002b:00007f9ff0647028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 805.676322][T17015] RAX: ffffffffffffffda RBX: 00007f9fefa25fa0 RCX: 00007f9fef79e159 [ 805.684295][T17015] RDX: 00002000000001c0 RSI: 0000200000000240 RDI: 0000000000000000 [ 805.692267][T17015] RBP: 00007f9fef835024 R08: 0000200000000340 R09: 0000000000000000 [ 805.700234][T17015] R10: 0000000002000000 R11: 0000000000000246 R12: 0000000000000000 [ 805.708204][T17015] R13: 00007f9fefa26038 R14: 00007f9fefa25fa0 R15: 00007fffd83ed478 [ 805.716203][T17015] [ 805.719420][T17015] Kernel Offset: disabled [ 805.723855][T17015] Rebooting in 86400 seconds..