last executing test programs: 5.560032868s ago: executing program 3 (id=643): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000480)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x0, 0xfffe}, {0x6, 0x24, 0x1a, 0x0, 0xc}}, {{0x9, 0x5, 0x81, 0x3, 0x200}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x0, 0x40}}, {{0x9, 0x5, 0x3, 0x2, 0x20}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 3.153111s ago: executing program 0 (id=659): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000001c0)={{0x8080000, 0x6000, 0x0, 0x9, 0xfd, 0xe4, 0x40, 0x7, 0x0, 0x2b, 0x16}, {0x200000, 0x10000, 0x3, 0x0, 0x40, 0x5, 0x7d, 0x6, 0x5, 0x3, 0x4, 0xb7}, {0x5000, 0xf000, 0xe, 0x5, 0x3, 0x7, 0x4, 0x9, 0x1, 0xa8, 0x44, 0x4}, {0x8080000, 0xeeee0000, 0x9, 0x6, 0x4, 0x42, 0x9, 0xff, 0x8, 0x6, 0xe}, {0x10000, 0xe000, 0xb, 0x3, 0x3, 0x6, 0xac, 0x7f, 0x7, 0x2, 0xdb}, {0x10000, 0x100000, 0xc, 0x5, 0xb1, 0x9, 0x21, 0x82, 0x6, 0x0, 0x1}, {0x3000, 0x8000000, 0x4, 0x1, 0x2, 0x5, 0x7, 0x1, 0x5, 0x81, 0x1, 0x74}, {0x0, 0x1000, 0x10, 0x5, 0xf, 0x7, 0xc, 0x30, 0x2, 0xc, 0x9, 0x9}, {0x10000, 0x8}, {0x2000, 0x5}, 0x80020031, 0x0, 0x8000000, 0x2124, 0x10000000000003, 0x500, 0x9000, [0xf90000000000, 0x1, 0x80, 0xfff]}) 2.692222661s ago: executing program 3 (id=661): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="2ef26f0f3566b842000f00d8b805000000b9a00000000f01c166baf80cb8b7351187ef66bafc0cb000ee0fde460b0f0130670f01c28fe868cfe20a", 0x3b}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@textreal={0x8, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.677535712s ago: executing program 2 (id=663): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x109181, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000036000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x56, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000000c0)) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.370688589s ago: executing program 0 (id=665): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x18, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000040)="67f30f2172f6c5970f300f917709360f35c4e2e1bb3bb9b20100000f32440f20c0350b000000440f22c00fae353800000066b8a8008ec8", 0x37}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.122328616s ago: executing program 2 (id=668): openat(0xffffffffffffff9c, 0x0, 0x40040, 0x6ab858183a7ef6ba) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/kvm/kvm_entry/enable\x00', 0x282, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f00000000c0)=""/87, 0x57}], 0x1, 0x110, 0x0) 1.887958421s ago: executing program 4 (id=669): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x802) munmap(&(0x7f000045e000/0x1000)=nil, 0x1000) mremap(&(0x7f0000dde000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000bb3000/0x1000)=nil) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mremap(&(0x7f00006bd000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000721000/0x4000)=nil) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) 1.887658601s ago: executing program 2 (id=670): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) pipe2$9p(&(0x7f0000000480)={0xffffffffffffffff}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) close_range(r0, r1, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r2, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000001540), 0x1000000, &(0x7f0000001640)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}}) 1.679583507s ago: executing program 4 (id=671): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0b00000005000000020000000400000005"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) close(0x3) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x3, 0x100005, 0xb, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000380), &(0x7f0000000380), 0x2, r2}, 0x38) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x11, 0x15, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000100850000000100000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000010000850000008200000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000a80)={r3, 0x0, 0x0}, 0x10) 1.641552698s ago: executing program 1 (id=672): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) 1.491766342s ago: executing program 1 (id=673): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000380)="4e813cbfba79cae0486c4303d9d8aba8e590094c6a6abac2699434a0b1dba046dbb65b2bef2c084c9d2fdb6f360ba4b44f3149af2c08b294d85798eefc119c9e6350f6abde287c8c1f22a37eea52ccdb66a949fb2f13b679c294fa4438894a24738c10ba6567cc48484056e977d51e4dad09966502d46af3c54584c358658e52", 0x80, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='bbr', 0x3) shutdown(r0, 0x1) 1.460321163s ago: executing program 4 (id=674): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1}) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x58, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300, 0x1ffe5}}, [@filter_kind_options=@f_flower={{0xb}, {0x28, 0x2, [@TCA_FLOWER_KEY_ENC_KEY_ID={0x8, 0x1a, 0x5}, @TCA_FLOWER_KEY_ENC_IPV4_SRC={0x8, 0x1b, @broadcast}, @TCA_FLOWER_KEY_ENC_IPV6_DST={0x14, 0x21, @remote}]}}]}, 0x58}}, 0x0) 1.348596245s ago: executing program 3 (id=675): r0 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000040)={0x1d, 0x0, 0x0, {0x0, 0xf1, 0x4}, 0xfe}, 0x18) connect$can_j1939(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x10000000000008) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x38, 0x1412, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1000000}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x38}}, 0x0) 1.211872549s ago: executing program 1 (id=676): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x21) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000001ec0)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x0, 0x16}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1b, 0x20, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x12}}, {0x4e20, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x1, 0x3, 0x7, 0x100, @void}}}}}, 0x2e) 1.17208962s ago: executing program 4 (id=677): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) close(0xffffffffffffffff) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000080)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000fedbdf25030000005800018044000400200001000a004e220000000500002d003a2d003a0040ffffe000000102000000200002000a00000000000000ff0100000000000000000000000000019c0000000d0001007564703a"], 0x6c}, 0x1, 0x0, 0x0, 0x20000014}, 0x20040084) 1.105242892s ago: executing program 0 (id=678): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000003, 0x13, r2, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000000c0)={[0x5, 0x9, 0x9, 0x100000004, 0x0, 0x400000, 0x3, 0xfffffffffbfffffc, 0xffff, 0x7fffffffffffffff, 0xc1, 0x2, 0x6, 0x4, 0x6, 0x5], 0xd5d5c004, 0x305342}) ioctl$KVM_CAP_EXCEPTION_PAYLOAD(r1, 0x4068aea3, &(0x7f0000000000)={0xa4, 0x0, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 941.144976ms ago: executing program 4 (id=679): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000680)=@newtfilter={0x5c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r3, {0x8, 0x7}, {}, {0x8, 0x3}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x10, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0xffa, 0x1, 0x1}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x100c}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x26044028}, 0x800) 820.325979ms ago: executing program 2 (id=680): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x15) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000000)={0xfffffffb}, 0x10) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x0, 0x80) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40086602, &(0x7f0000000000)) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40086602, &(0x7f0000000140)) 713.656172ms ago: executing program 0 (id=681): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r2, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002000000050017"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) 670.160873ms ago: executing program 3 (id=682): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80, 0xd}, 'port1\x00', 0xf3, 0x1b1c06, 0xfffffffa, 0x4, 0x1000000, 0x0, 0x1, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) r3 = dup3(r2, r1, 0x0) ioctl$SNDCTL_SEQ_RESET(r3, 0x5100) close_range(r0, 0xffffffffffffffff, 0x0) 577.472515ms ago: executing program 1 (id=683): open(&(0x7f00000003c0)='./file2\x00', 0x81, 0x10dd722b6e14c3dd) mmap$IORING_OFF_SQ_RING(0x0, 0xc00001, 0x3000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000400), 0x8080, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x3) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000680), 0x101402, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000040)=0x1) ioctl$PPPIOCCONNECT(r1, 0x4004743a, 0x0) 569.702735ms ago: executing program 2 (id=684): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000001c0)={{0x2000, 0x41000, 0x8, 0x9, 0x3, 0xe4, 0x40, 0x3, 0x0, 0x30, 0x15}, {0x41000, 0x3000, 0xe, 0x0, 0x40, 0x4, 0x7d, 0x9, 0x58, 0x3, 0x3, 0x1}, {0xdddd1000, 0xe000, 0xe, 0x5, 0x3, 0x2, 0xfe, 0x89, 0x1, 0xab, 0x5, 0x82}, {0x6000, 0xdddd0000, 0x3, 0x5d, 0x4, 0x43, 0x3, 0xfa, 0x80, 0xb, 0xe}, {0x0, 0x9000, 0x9, 0x1, 0x3, 0x7, 0xab, 0x8, 0x7, 0x83, 0xff, 0x82}, {0x1000, 0x80a0000, 0xc, 0xa0, 0xb1, 0x8, 0x1, 0xd, 0x88, 0xf, 0x4, 0xfd}, {0x54000, 0xeeee0000, 0x4, 0x5, 0x7, 0x2, 0xb, 0x0, 0x5, 0x81, 0xff, 0x70}, {0xd000, 0x1000, 0x0, 0x5, 0xf, 0x7, 0x1, 0x18, 0x2, 0x3, 0x7, 0x9}, {0xb000, 0x2d}, {0x1, 0x7fff}, 0x80000031, 0x0, 0x6000, 0x42024, 0x400000000000000b, 0x1, 0x70000, [0x6840000000000002, 0x3, 0x10de, 0xff]}) 480.982917ms ago: executing program 4 (id=685): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x28000000000, 0x840) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000740)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300042e010203010902120001000000000904"], 0x0) ioctl$EVIOCRMFF(r0, 0x550c, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f00000008c0)={0x34, &(0x7f0000000600)={0x20, 0x12}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r1, 0x0, &(0x7f0000000540)={0x44, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 362.546161ms ago: executing program 1 (id=686): r0 = inotify_init() r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2002, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x7c, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 295.954242ms ago: executing program 3 (id=687): syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xb, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000180000002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000004c0)={r0, 0x3, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x44) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) bpf$ENABLE_STATS(0x20, 0x0, 0x0) write$cgroup_subtree(r1, &(0x7f0000000380)=ANY=[], 0x66) 245.078503ms ago: executing program 0 (id=688): r0 = socket(0x10, 0x803, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0xffe0, 0xffe0}, {0x0, 0x9}, {0xf, 0xfff6}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x8, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x4}]}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 212.816924ms ago: executing program 1 (id=689): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000002c0)={0x1, &(0x7f0000000200)=[{0x6, 0x1, 0x7, 0x7fffffff}]}) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) exit(0xffff) io_uring_enter(0xffffffffffffffff, 0x2cbc, 0x366, 0x12, 0x0, 0x0) wait4(r0, 0x0, 0x8, 0x0) 129.179866ms ago: executing program 2 (id=690): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r3, {0xb, 0x1}, {0x5}, {0x1}}}, 0x24}}, 0x41814) 94.173388ms ago: executing program 3 (id=691): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/icmp\x00') mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000300)='fd\x00') fchdir(r0) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) exit(0x5c7b) open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) 0s ago: executing program 0 (id=692): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='-2 -4 +3\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='8\x00', 0x2) mount$nfs(0x0, &(0x7f0000000180)='127.0.0.1:/\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='nolock,addr=127.0.0.1,vers=3']) kernel console output (not intermixed with test programs): 211: failed to load regulatory.db [ 91.661633][ T4432] hpfs: hpfs_map_sector(): read error [ 91.678254][ T4432] hpfs: code page support is disabled [ 91.709439][ T4432] hpfs: hpfs_map_4sectors(): unaligned read [ 91.784519][ T4469] loop2: detected capacity change from 0 to 128 [ 91.791706][ T4432] hpfs: hpfs_map_4sectors(): unaligned read [ 91.865463][ T4432] hpfs: filesystem error: unable to find root dir [ 91.947425][ T4432] hpfs: hpfs_map_4sectors(): unaligned read [ 91.949329][ T4469] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a80ec018, mo2=0002] [ 91.971447][ T4472] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 92.089169][ T4469] System zones: 1-3, 19-19, 35-36 [ 92.125998][ T4469] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 92.148005][ T4479] loop4: detected capacity change from 0 to 512 [ 92.167830][ T4469] ext4 filesystem being mounted at /2/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 92.300990][ T4479] FAT-fs (loop4): error, corrupted file size (i_pos 53, 9216) [ 92.335534][ T4479] FAT-fs (loop4): error, corrupted file size (i_pos 53, 8960) [ 92.357238][ T4485] loop0: detected capacity change from 0 to 128 [ 92.365541][ T4479] FAT-fs (loop4): error, corrupted file size (i_pos 53, 8960) [ 92.397810][ T4485] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a80fc018, mo2=0002] [ 92.406693][ T4485] System zones: 1-3, 19-19, 35-36 [ 92.414184][ T4485] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 92.436690][ T4485] ext4 filesystem being mounted at /2/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 92.515226][ T4485] EXT4-fs warning (device loop0): verify_group_input:151: Cannot add at group 3391 (only 1 groups) [ 92.677196][ T4281] EXT4-fs (loop2): unmounting filesystem. [ 92.695912][ T4286] EXT4-fs (loop0): unmounting filesystem. [ 92.808387][ T4366] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 92.922696][ T4492] syz.4.15 uses obsolete (PF_INET,SOCK_PACKET) [ 93.011528][ T4366] usb 4-1: config index 0 descriptor too short (expected 45, got 36) [ 93.031316][ T4366] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 93.058293][ T4366] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 93.074393][ T4366] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 93.108132][ T4366] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 93.117552][ T4366] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.159208][ T4366] usb 4-1: config 0 descriptor?? [ 93.490651][ T4503] device dummy0 entered promiscuous mode [ 93.521996][ T4503] device netdevsim0 entered promiscuous mode [ 93.537324][ T4449] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 93.584102][ T4366] plantronics 0003:047F:FFFF.0001: unknown main item tag 0xd [ 93.613887][ T4366] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 93.659597][ T4366] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 93.748511][ T4494] loop1: detected capacity change from 0 to 40427 [ 93.835997][ T4494] F2FS-fs (loop1): invalid crc value [ 93.932513][ T4494] F2FS-fs (loop1): Found nat_bits in checkpoint [ 93.947963][ T4369] usb 4-1: USB disconnect, device number 3 [ 94.101621][ T4494] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 94.111120][ T4510] fido_id[4510]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 94.156403][ T4517] i2c i2c-0: new_device: Instantiated device stusb160x at 0x48 [ 94.225754][ T4517] rt1719: probe of 0-0049 failed with error -5 [ 94.245174][ T4494] syz.1.16: attempt to access beyond end of device [ 94.245174][ T4494] loop1: rw=524288, sector=45064, nr_sectors = 8 limit=40427 [ 94.263031][ T4517] i2c i2c-0: new_device: Instantiated device rt1719 at 0x49 [ 94.272582][ T4494] syz.1.16: attempt to access beyond end of device [ 94.272582][ T4494] loop1: rw=0, sector=45064, nr_sectors = 8 limit=40427 [ 94.293091][ T4494] syz.1.16: attempt to access beyond end of device [ 94.293091][ T4494] loop1: rw=0, sector=45064, nr_sectors = 8 limit=40427 [ 94.397286][ T4272] syz-executor: attempt to access beyond end of device [ 94.397286][ T4272] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 94.508943][ T4523] loop2: detected capacity change from 0 to 256 [ 94.549427][ T4523] exfat: Deprecated parameter 'namecase' [ 94.612254][ T4523] exFAT-fs (loop2): failed to load upcase table (idx : 0x0001fe89, chksum : 0xc374f927, utbl_chksum : 0xe619d30d) [ 94.717454][ T4523] process 'syz.2.25' launched '/dev/fd/4/éq‰Y’3aK' with NULL argv: empty string added [ 94.837739][ T4525] loop8: detected capacity change from 0 to 8 [ 94.928600][ T4525] loop8: [CUMANA/ADFS] p1 [ADFS] p1 [ 94.949809][ T4525] loop8: partition table partially beyond EOD, truncated [ 94.979824][ T4525] loop8: p1 size 2645487272 extends beyond EOD, truncated [ 95.136831][ T4362] udevd[4362]: inotify_add_watch(7, /dev/loop8p1, 10) failed: No such file or directory [ 95.154028][ T4529] loop2: detected capacity change from 0 to 2048 [ 95.274065][ T4529] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 95.310462][ T4533] loop3: detected capacity change from 0 to 1024 [ 95.424355][ T4533] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 95.433244][ T4533] ext4 filesystem being mounted at /5/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 95.463431][ T4533] EXT4-fs error (device loop3): ext4_map_blocks:747: inode #15: comm syz.3.29: lblock 0 mapped to illegal pblock 0 (length 1) [ 95.521855][ T4533] EXT4-fs (loop3): Remounting filesystem read-only [ 95.572490][ T4533] EXT4-fs warning (device loop3): ext4_resize_begin:84: There are errors in the filesystem, so online resizing is not allowed [ 95.781234][ T4541] loop2: detected capacity change from 0 to 128 [ 95.882408][ T4284] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 95.892255][ T4284] CPU: 1 PID: 4284 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 95.899849][ T4284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 95.910037][ T4284] Workqueue: hci4 hci_rx_work [ 95.914796][ T4284] Call Trace: [ 95.918115][ T4284] [ 95.921084][ T4284] dump_stack_lvl+0x188/0x24e [ 95.925814][ T4284] ? show_regs_print_info+0x12/0x12 [ 95.931063][ T4284] ? load_image+0x410/0x410 [ 95.935631][ T4284] sysfs_create_dir_ns+0x26a/0x290 [ 95.940798][ T4284] ? __lock_acquire+0x7c40/0x7c40 [ 95.945869][ T4284] ? sysfs_warn_dup+0xa0/0xa0 [ 95.950596][ T4284] ? do_raw_spin_unlock+0x11d/0x230 [ 95.955844][ T4284] kobject_add_internal+0x617/0xca0 [ 95.961095][ T4284] kobject_add+0x160/0x230 [ 95.965555][ T4284] ? kobject_init+0x1c0/0x1c0 [ 95.970301][ T4284] ? __raw_spin_lock_init+0x41/0x100 [ 95.975626][ T4284] ? klist_children_get+0x50/0x50 [ 95.980705][ T4284] ? get_device_parent+0x121/0x3e0 [ 95.985868][ T4284] device_add+0x470/0x1050 [ 95.990339][ T4284] hci_conn_add_sysfs+0xd1/0x1e0 [ 95.995356][ T4284] le_conn_complete_evt+0xfac/0x15c0 [ 96.000710][ T4284] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 96.007009][ T4284] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 96.012707][ T4284] ? mutex_unlock+0x10/0x10 [ 96.017299][ T4284] ? skb_pull_data+0xec/0x1f0 [ 96.022021][ T4284] hci_le_conn_complete_evt+0x183/0x440 [ 96.027711][ T4284] ? hci_remote_host_features_evt+0x230/0x230 [ 96.033828][ T4284] hci_event_packet+0x7b3/0x1290 [ 96.039003][ T4284] ? __lock_acquire+0x7c40/0x7c40 [ 96.044081][ T4284] ? bis_list+0x280/0x280 [ 96.048458][ T4284] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 96.054403][ T4284] ? kcov_remote_start+0x4b0/0x7e0 [ 96.059564][ T4284] ? do_machine_check+0x380/0x750 [ 96.064642][ T4284] ? hci_send_to_monitor+0x9c/0x4a0 [ 96.069906][ T4284] hci_rx_work+0x3eb/0xd40 [ 96.074374][ T4284] ? _raw_spin_unlock+0x40/0x40 [ 96.079278][ T4284] ? process_one_work+0x7b4/0x1160 [ 96.084442][ T4284] process_one_work+0x8ab/0x1160 [ 96.089444][ T4284] ? worker_detach_from_pool+0x240/0x240 [ 96.095122][ T4284] ? _raw_spin_lock_irq+0xb7/0xf0 [ 96.100206][ T4284] ? _raw_spin_lock_irqsave+0x100/0x100 [ 96.105805][ T4284] ? wq_worker_running+0x97/0x190 [ 96.110888][ T4284] worker_thread+0xaf5/0x12a0 [ 96.115646][ T4284] kthread+0x29d/0x330 [ 96.119755][ T4284] ? worker_clr_flags+0x1a0/0x1a0 [ 96.124820][ T4284] ? kthread_blkcg+0xd0/0xd0 [ 96.129488][ T4284] ret_from_fork+0x1f/0x30 [ 96.133973][ T4284] [ 96.137039][ C1] vkms_vblank_simulate: vblank timer overrun [ 96.147983][ T4536] EXT4-fs error (device loop3): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 112: padding at end of block bitmap is not set [ 96.186660][ T4284] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 96.200962][ T4284] Bluetooth: hci4: failed to register connection device [ 96.251756][ T4536] EXT4-fs (loop3): Remounting filesystem read-only [ 96.738165][ C0] sched: RT throttling activated [ 96.863281][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 96.930709][ T4539] loop1: detected capacity change from 0 to 131072 [ 96.945210][ T4539] F2FS-fs (loop1): Wrong CP boundary, start(512) end(1536) blocks(0) [ 96.953429][ T4539] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 96.964528][ T4539] F2FS-fs (loop1): invalid crc value [ 97.001564][ T4554] loop0: detected capacity change from 0 to 512 [ 97.023303][ T4553] loop2: detected capacity change from 0 to 512 [ 97.034075][ T4558] loop8: detected capacity change from 0 to 7 [ 97.055167][ T4539] F2FS-fs (loop1): Found nat_bits in checkpoint [ 97.088770][ T4553] EXT4-fs: Ignoring removed bh option [ 97.110905][ T4554] EXT4-fs error (device loop0): ext4_iget_extra_inode:4763: inode #17: comm syz.0.37: corrupted in-inode xattr [ 97.126978][ T4558] Dev loop8: unable to read RDB block 7 [ 97.136810][ T4539] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 97.144148][ T4539] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 97.158467][ T4558] loop8: unable to read partition table [ 97.171585][ T4554] EXT4-fs error (device loop0): ext4_orphan_get:1410: comm syz.0.37: couldn't read orphan inode 17 (err -117) [ 97.189794][ T4553] EXT4-fs (loop2): 1 truncate cleaned up [ 97.195510][ T4553] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 97.220872][ T4558] loop8: partition table beyond EOD, truncated [ 97.249682][ T4554] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 97.279454][ T4558] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 97.326507][ T4553] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.34: invalid indirect mapped block 4294901760 (level 0) [ 97.422615][ T26] audit: type=1800 audit(1786062030.604:2): pid=4554 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.37" name="file2" dev="loop0" ino=16 res=0 errno=0 [ 97.485865][ T4553] EXT4-fs (loop2): Remounting filesystem read-only [ 97.652366][ T4286] EXT4-fs (loop0): unmounting filesystem. [ 97.748046][ T4281] EXT4-fs (loop2): unmounting filesystem. [ 97.947618][ T4572] loop2: detected capacity change from 0 to 512 [ 97.997891][ T4572] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 98.134726][ T4572] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 48 vs 41 free clusters [ 98.288845][ T4572] Quota error (device loop2): write_blk: dquota write failed [ 98.306147][ T4572] Quota error (device loop2): find_free_dqentry: Can't write quota data block 5 [ 98.368369][ T4572] Quota error (device loop2): write_blk: dquota write failed [ 98.388535][ T4572] Quota error (device loop2): qtree_write_dquot: Error -28 occurred while creating quota [ 98.409885][ T4572] EXT4-fs error (device loop2): ext4_acquire_dquot:6841: comm syz.2.41: Failed to acquire dquot type 1 [ 98.463916][ T4572] EXT4-fs (loop2): 1 truncate cleaned up [ 98.488349][ T4572] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 98.574060][ T4572] EXT4-fs (loop2): shut down requested (2) [ 98.617039][ T4572] EXT4-fs (loop2): re-mounted. Quota mode: writeback. [ 98.698607][ T4366] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 98.737085][ T4281] EXT4-fs (loop2): unmounting filesystem. [ 98.890083][ T4366] usb 1-1: config 0 interface 0 has no altsetting 0 [ 98.896836][ T4366] usb 1-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 98.936566][ T4366] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.959986][ T4366] usb 1-1: config 0 descriptor?? [ 99.138289][ T4326] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 99.232295][ T4582] loop3: detected capacity change from 0 to 32768 [ 99.259500][ T4582] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop3 scanned by syz.3.44 (4582) [ 99.331195][ T4326] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 99.358475][ T4582] BTRFS info (device loop3): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 99.369338][ T4326] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 99.384234][ T4366] creative-sb0540 0003:041E:3100.0002: unknown main item tag 0x0 [ 99.408298][ T4366] creative-sb0540 0003:041E:3100.0002: unknown main item tag 0x0 [ 99.416181][ T4366] creative-sb0540 0003:041E:3100.0002: collection stack underflow [ 99.424371][ T4582] BTRFS info (device loop3): using blake2b (blake2b-256-generic) checksum algorithm [ 99.434779][ T4582] BTRFS info (device loop3): enabling ssd optimizations [ 99.443979][ T4326] usb 3-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 99.458206][ T4326] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 99.466302][ T4326] usb 3-1: Product: syz [ 99.470657][ T4366] creative-sb0540 0003:041E:3100.0002: item 0 0 0 12 parsing failed [ 99.478832][ T4582] BTRFS info (device loop3): setting nodatasum [ 99.485049][ T4582] BTRFS info (device loop3): enabling auto defrag [ 99.495866][ T4366] creative-sb0540 0003:041E:3100.0002: parse failed [ 99.504035][ T4326] usb 3-1: Manufacturer: syz [ 99.508778][ T4582] BTRFS info (device loop3): using free space tree [ 99.518436][ T4366] creative-sb0540: probe of 0003:041E:3100.0002 failed with error -22 [ 99.531566][ T4586] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 99.565025][ T4586] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 99.581183][ T4326] usb_debug 3-1:1.0: debug converter detected [ 99.601217][ T4326] usb 3-1: debug converter now attached to ttyUSB0 [ 99.605334][ T4319] usb 1-1: USB disconnect, device number 2 [ 99.817219][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 99.888956][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 99.938860][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 99.948241][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 99.964560][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 99.973953][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 99.997372][ T26] audit: type=1800 audit(1786062033.174:3): pid=4620 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.44" name="bus" dev="loop3" ino=263 res=0 errno=0 [ 100.001240][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.026895][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.036274][ C1] vkms_vblank_simulate: vblank timer overrun [ 100.045820][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.055174][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.065297][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.074622][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.098238][ T26] audit: type=1800 audit(1786062033.224:4): pid=4582 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.44" name="bus" dev="loop3" ino=263 res=0 errno=0 [ 100.125390][ T4622] loop1: detected capacity change from 0 to 128 [ 100.135068][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.144422][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.158531][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.167907][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.208477][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.217836][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.262002][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.271412][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.282642][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.292015][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.302915][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.312273][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.323934][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.333294][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.348497][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.357865][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.409103][ T4622] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 100.409130][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.409201][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.481419][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.490841][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.501118][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.510453][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.548687][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.558036][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.569031][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.578392][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.589572][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.598945][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.611894][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.621249][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.632074][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.641519][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.651896][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.661255][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.678841][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.688212][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.698100][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.707534][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.717337][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.726727][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.736675][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.746013][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.756583][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.765933][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.776023][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.785351][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.811101][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.820506][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.846142][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.855535][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.866049][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.875400][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.896321][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.905721][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.920449][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.929819][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.952763][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.962160][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.976056][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.985428][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 100.998691][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.008097][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.031722][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.041204][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.071147][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.080740][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.099580][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.109069][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.120422][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.130219][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.166601][ T4629] loop0: detected capacity change from 0 to 256 [ 101.181321][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.190899][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.201191][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.210542][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.254837][ T4629] exfat: Deprecated parameter 'namecase' [ 101.281967][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.291326][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.303257][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.312587][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.350271][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.359655][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.370134][ T4273] BTRFS info (device loop3): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 101.371442][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.390014][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.402913][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.412284][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.423911][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.433261][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.444612][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.453967][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.464964][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.474313][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.488543][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.497892][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.516850][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 101.526255][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 102.217868][ T4640] Illegal XDP return value 4294967274 on prog (id 4) dev syz_tun, expect packet loss! [ 102.485075][ T4631] loop4: detected capacity change from 0 to 131072 [ 102.499733][ C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 102.510179][ T4631] F2FS-fs (loop4): Wrong CP boundary, start(512) end(1536) blocks(0) [ 102.532397][ T4274] usb 3-1: USB disconnect, device number 2 [ 102.539197][ T4629] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x36dfe6b4, utbl_chksum : 0xe619d30d) [ 102.545786][ T4631] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 102.581566][ T4631] F2FS-fs (loop4): invalid crc value [ 102.648880][ T4274] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 102.695675][ T4274] usb_debug 3-1:1.0: device disconnected [ 102.714845][ T4631] F2FS-fs (loop4): Found nat_bits in checkpoint [ 102.787852][ T4631] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 102.795054][ T4631] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 102.981957][ T4653] ieee802154 phy0 wpan0: encryption failed: -22 [ 104.169546][ T4644] loop1: detected capacity change from 0 to 32768 [ 104.352582][ T4644] XFS (loop1): Mounting V5 Filesystem [ 104.473497][ T4644] XFS (loop1): Ending clean mount [ 104.729098][ T4272] XFS (loop1): Unmounting Filesystem [ 104.945600][ T4673] loop3: detected capacity change from 0 to 4096 [ 105.162761][ T4677] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 105.759183][ T4671] loop4: detected capacity change from 0 to 32768 [ 105.787677][ T4671] BTRFS: device fsid a6a605fc-d5f1-4e66-8595-3726e2b761d6 devid 1 transid 8 /dev/loop4 scanned by syz.4.68 (4671) [ 105.890577][ T4671] BTRFS info (device loop4): first mount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 105.934818][ T4671] BTRFS info (device loop4): using blake2b (blake2b-256-generic) checksum algorithm [ 105.957605][ T4692] loop0: detected capacity change from 0 to 256 [ 105.969175][ T4671] BTRFS info (device loop4): using free space tree [ 105.988371][ T4366] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 106.097188][ T4698] ieee802154 phy0 wpan0: encryption failed: -22 [ 106.280292][ T4366] usb 3-1: Using ep0 maxpacket: 16 [ 106.340975][ T4366] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 106.655349][ T4366] usb 3-1: New USB device found, idVendor=1223, idProduct=3f07, bcdDevice= 0.00 [ 106.885871][ T4366] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.902389][ T4366] usb 3-1: config 0 descriptor?? [ 106.954834][ T4671] BTRFS info (device loop4): enabling ssd optimizations [ 107.328725][ T4366] ortek 0003:1223:3F07.0003: unknown main item tag 0x7 [ 107.335698][ T4366] ortek 0003:1223:3F07.0003: unknown main item tag 0x0 [ 107.352462][ T4683] loop1: detected capacity change from 0 to 32768 [ 107.363790][ T4366] ortek 0003:1223:3F07.0003: item fetching failed at offset 32/41 [ 107.365511][ T4282] BTRFS info (device loop4): last unmount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 107.383377][ T4366] ortek: probe of 0003:1223:3F07.0003 failed with error -22 [ 107.416996][ T4683] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop1 scanned by syz.1.69 (4683) [ 107.554821][ T4366] usb 3-1: USB disconnect, device number 3 [ 107.618059][ T4683] BTRFS info (device loop1): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 107.702938][ T4683] BTRFS info (device loop1): using blake2b (blake2b-256-generic) checksum algorithm [ 107.713587][ T4683] BTRFS info (device loop1): enabling ssd optimizations [ 107.721160][ T4683] BTRFS info (device loop1): setting nodatasum [ 107.727554][ T4683] BTRFS info (device loop1): enabling auto defrag [ 107.734379][ T4683] BTRFS info (device loop1): using free space tree [ 107.840567][ T4737] loop4: detected capacity change from 0 to 1024 [ 107.923798][ T4747] loop0: detected capacity change from 0 to 1024 [ 107.945489][ T4737] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 107.968985][ T4737] ext4 filesystem being mounted at /20/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 107.996947][ T4747] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 108.081980][ T4737] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #15: block 3: comm syz.4.82: lblock 3 mapped to illegal pblock 3 (length 1) [ 108.098438][ T4747] ext4 filesystem being mounted at /16/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 108.149339][ T4747] EXT4-fs error (device loop0): ext4_map_blocks:747: inode #15: comm syz.0.84: lblock 0 mapped to illegal pblock 0 (length 1) [ 108.208257][ T4737] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 1 with error 117 [ 108.269278][ T26] audit: type=1800 audit(1786062041.454:5): pid=4683 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.69" name="bus" dev="loop1" ino=263 res=0 errno=0 [ 108.299719][ T4747] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 108.314126][ T4737] EXT4-fs (loop4): This should not happen!! Data will be lost [ 108.314126][ T4737] [ 108.338296][ T4747] EXT4-fs (loop0): This should not happen!! Data will be lost [ 108.338296][ T4747] [ 108.367229][ T26] audit: type=1800 audit(1786062041.474:6): pid=4683 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.69" name="bus" dev="loop1" ino=263 res=0 errno=0 [ 108.389944][ T4762] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: block 3: comm syz.4.82: lblock 3 mapped to illegal pblock 3 (length 1) [ 108.472586][ T4770] loop2: detected capacity change from 0 to 1024 [ 108.483653][ T26] audit: type=1800 audit(1786062041.664:7): pid=4762 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.82" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 108.546214][ T4773] ieee802154 phy0 wpan0: encryption failed: -22 [ 108.646308][ T4770] EXT4-fs: Ignoring removed orlov option [ 109.110312][ T4770] EXT4-fs: Invalid want_extra_isize 5 [ 109.388941][ T4286] EXT4-fs (loop0): unmounting filesystem. [ 109.522256][ T4282] EXT4-fs (loop4): unmounting filesystem. [ 109.573935][ T4272] BTRFS info (device loop1): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 109.665001][ T4777] loop0: detected capacity change from 0 to 1024 [ 109.714099][ T4777] EXT4-fs: Ignoring removed bh option [ 109.764153][ T4779] loop4: detected capacity change from 0 to 256 [ 109.814471][ T4779] exfat: Deprecated parameter 'namecase' [ 109.851421][ T4779] exfat: Deprecated parameter 'namecase' [ 109.917132][ T4777] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 109.954969][ T4779] exFAT-fs (loop4): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 110.102950][ T4785] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2802: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 110.326218][ T4286] EXT4-fs (loop0): unmounting filesystem. [ 110.568074][ T4775] loop3: detected capacity change from 0 to 32768 [ 110.738894][ T4775] JBD2: Ignoring recovery information on journal [ 110.768492][ T4366] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 110.797905][ T4804] netlink: 20 bytes leftover after parsing attributes in process `syz.2.98'. [ 110.856588][ T4775] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 110.970737][ T4366] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 111.015298][ T4366] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 111.053828][ T4366] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 111.077350][ T4366] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.123305][ T4814] device syzkaller1 entered promiscuous mode [ 111.136014][ T26] audit: type=1800 audit(1786062044.314:8): pid=4813 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.88" name="file1" dev="loop3" ino=17058 res=0 errno=0 [ 111.140747][ T4366] usb 2-1: config 0 descriptor?? [ 111.500075][ T4273] ocfs2: Unmounting device (7,3) on (node local) [ 111.604418][ T4366] keytouch 0003:0926:3333.0004: fixing up Keytouch IEC report descriptor [ 111.637701][ T4366] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0926:3333.0004/input/input6 [ 111.703511][ T4827] netlink: 324 bytes leftover after parsing attributes in process `syz.0.106'. [ 111.724195][ T4827] netlink: 16 bytes leftover after parsing attributes in process `syz.0.106'. [ 111.828662][ T4366] keytouch 0003:0926:3333.0004: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 111.892354][ T4366] usb 2-1: USB disconnect, device number 2 [ 112.017332][ T4837] loop3: detected capacity change from 0 to 1024 [ 112.073705][ T4837] EXT4-fs: Ignoring removed bh option [ 112.143682][ T4837] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 112.302624][ T4847] loop0: detected capacity change from 0 to 512 [ 112.323679][ T4835] fido_id[4835]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 112.379495][ T26] audit: type=1800 audit(1786062045.564:9): pid=4837 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.105" name="file1" dev="loop3" ino=15 res=0 errno=0 [ 112.654221][ T4857] netlink: 'syz.1.114': attribute type 29 has an invalid length. [ 112.683110][ T4857] netlink: 'syz.1.114': attribute type 29 has an invalid length. [ 112.706729][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 112.717660][ T4858] netlink: 'syz.1.114': attribute type 29 has an invalid length. [ 112.802815][ T4857] netlink: 'syz.1.114': attribute type 29 has an invalid length. [ 112.829028][ T4857] netlink: 'syz.1.114': attribute type 29 has an invalid length. [ 112.839480][ T4847] EXT4-fs (loop0): Test dummy encryption mode enabled [ 112.877240][ T4847] EXT4-fs error (device loop0): ext4_orphan_get:1405: inode #15: comm syz.0.112: inode has both inline data and extents flags [ 113.045744][ T4847] EXT4-fs error (device loop0): ext4_orphan_get:1410: comm syz.0.112: couldn't read orphan inode 15 (err -117) [ 113.077560][ T4847] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 113.453417][ T4881] netlink: 12 bytes leftover after parsing attributes in process `syz.1.122'. [ 113.550583][ T4847] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 113.768491][ T4286] EXT4-fs (loop0): unmounting filesystem. [ 114.412652][ T4908] loop1: detected capacity change from 0 to 2048 [ 114.432642][ T4911] capability: warning: `syz.0.133' uses 32-bit capabilities (legacy support in use) [ 114.453884][ T4908] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 115.008083][ T4929] clocksource: Switched to clocksource acpi_pm [ 115.036463][ T4929] clocksource: Switched to clocksource tsc [ 115.406253][ T4947] ieee802154 phy0 wpan0: encryption failed: -22 [ 116.241252][ T4948] loop2: detected capacity change from 0 to 128 [ 116.277687][ T4948] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a80ec018, mo2=0002] [ 116.345349][ T4948] System zones: 1-3, 19-19, 35-36 [ 116.386622][ T4948] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 116.447506][ T4948] ext4 filesystem being mounted at /35/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 117.615539][ T4973] netlink: 'syz.0.152': attribute type 4 has an invalid length. [ 117.653120][ T4281] EXT4-fs (loop2): unmounting filesystem. [ 117.864109][ T4942] loop3: detected capacity change from 0 to 40427 [ 117.920377][ T4942] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 117.954292][ T4942] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 118.004294][ T4942] F2FS-fs (loop3): invalid crc value [ 118.077154][ T4942] F2FS-fs (loop3): Found nat_bits in checkpoint [ 118.411559][ T4966] loop4: detected capacity change from 0 to 32768 [ 118.476200][ T4966] JBD2: Ignoring recovery information on journal [ 118.588050][ T4966] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 118.662595][ T4999] loop3: detected capacity change from 0 to 256 [ 118.705735][ T4999] FAT-fs (loop3): Directory bread(block 1285) failed [ 118.730215][ T4999] FAT-fs (loop3): Directory bread(block 1286) failed [ 118.763667][ T4999] FAT-fs (loop3): Directory bread(block 1287) failed [ 118.797315][ T4999] FAT-fs (loop3): Directory bread(block 1288) failed [ 118.866316][ T4999] FAT-fs (loop3): Directory bread(block 1285) failed [ 118.890046][ T4999] FAT-fs (loop3): Directory bread(block 1286) failed [ 118.907132][ T4999] FAT-fs (loop3): Directory bread(block 1287) failed [ 118.929341][ T4999] FAT-fs (loop3): Directory bread(block 1288) failed [ 118.949470][ T4282] ocfs2: Unmounting device (7,4) on (node local) [ 118.997897][ T5000] FAT-fs (loop3): Directory bread(block 1285) failed [ 119.025859][ T5000] FAT-fs (loop3): Directory bread(block 1286) failed [ 119.161722][ T4982] loop2: detected capacity change from 0 to 32768 [ 119.203593][ T4982] BTRFS: device fsid a6a605fc-d5f1-4e66-8595-3726e2b761d6 devid 1 transid 8 /dev/loop2 scanned by syz.2.154 (4982) [ 119.296529][ T4982] BTRFS info (device loop2): first mount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 119.346326][ T4982] BTRFS info (device loop2): using blake2b (blake2b-256-generic) checksum algorithm [ 119.403491][ T4982] BTRFS info (device loop2): using free space tree [ 119.493254][ T4988] loop0: detected capacity change from 0 to 40427 [ 119.519602][ T4988] F2FS-fs (loop0): invalid crc value [ 119.630668][ T4988] F2FS-fs (loop0): Found nat_bits in checkpoint [ 119.675210][ T4982] BTRFS info (device loop2): enabling ssd optimizations [ 119.695982][ T5032] capability: warning: `syz.4.162' uses deprecated v2 capabilities in a way that may be insecure [ 119.939839][ T4988] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 120.223270][ T4281] BTRFS info (device loop2): last unmount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 120.564150][ T4988] syz.0.155: attempt to access beyond end of device [ 120.564150][ T4988] loop0: rw=524288, sector=45064, nr_sectors = 8 limit=40427 [ 120.642187][ T5040] loop4: detected capacity change from 0 to 256 [ 120.754555][ T4988] syz.0.155: attempt to access beyond end of device [ 120.754555][ T4988] loop0: rw=0, sector=45064, nr_sectors = 8 limit=40427 [ 120.770169][ T4988] syz.0.155: attempt to access beyond end of device [ 120.770169][ T4988] loop0: rw=0, sector=45064, nr_sectors = 8 limit=40427 [ 120.832026][ T5040] exfat: Deprecated parameter 'namecase' [ 120.837785][ T5040] exfat: Deprecated parameter 'namecase' [ 120.860289][ T5040] exfat: Deprecated parameter 'namecase' [ 120.916822][ T5040] exFAT-fs (loop4): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 121.026246][ T4286] syz-executor: attempt to access beyond end of device [ 121.026246][ T4286] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 121.293500][ T4349] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 121.476308][ T5049] loop4: detected capacity change from 0 to 512 [ 121.498272][ T4349] usb 2-1: Using ep0 maxpacket: 32 [ 121.517188][ T4349] usb 2-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 121.545256][ T4349] usb 2-1: config 0 interface 0 has no altsetting 0 [ 121.566340][ T4349] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 121.583286][ T4349] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.597995][ T5049] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 121.637367][ T5049] ext4 filesystem being mounted at /42/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 121.663004][ T4349] usb 2-1: config 0 descriptor?? [ 121.779951][ T5056] loop0: detected capacity change from 0 to 1024 [ 121.787379][ T5056] EXT4-fs: Ignoring removed nobh option [ 121.794561][ T5056] EXT4-fs: Ignoring removed bh option [ 121.847028][ T5056] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a802c028, mo2=0002] [ 121.869769][ T5056] System zones: 0-1, 3-12 [ 121.875344][ T5056] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 121.931348][ T4282] EXT4-fs (loop4): unmounting filesystem. [ 122.022918][ T5056] overlayfs: conflicting lowerdir path [ 122.048456][ T4366] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 122.086483][ T5064] loop4: detected capacity change from 0 to 256 [ 122.193624][ T4286] EXT4-fs (loop0): unmounting filesystem. [ 122.253667][ T4366] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 122.277507][ T4366] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 122.316758][ T4366] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 122.344254][ T4366] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.405147][ T5071] loop0: detected capacity change from 0 to 512 [ 122.499212][ T4349] corsair-cpro 0003:1B1C:0C10.0005: hidraw0: USB HID v4.06 Device [HID 1b1c:0c10] on usb-dummy_hcd.1-1/input0 [ 122.526348][ T5071] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 122.562873][ T5071] ext4 filesystem being mounted at /33/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 122.614544][ T4366] usb 4-1: usb_control_msg returned -32 [ 122.620430][ T4366] usbtmc 4-1:16.0: can't read capabilities [ 122.695114][ T4349] corsair-cpro: probe of 0003:1B1C:0C10.0005 failed with error -71 [ 122.934746][ T4366] usb 4-1: USB disconnect, device number 4 [ 123.513036][ T4349] usb 2-1: USB disconnect, device number 3 [ 123.635140][ T4286] EXT4-fs (loop0): unmounting filesystem. [ 123.874160][ T5081] fido_id[5081]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 123.920332][ T5088] device-mapper: ioctl: Invalid ioctl structure: name t, dev f800 [ 123.952845][ T5090] loop3: detected capacity change from 0 to 2048 [ 123.984038][ T5090] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 124.093873][ T4362] udevd[4362]: incorrect nilfs2 checksum on /dev/loop3 [ 124.128376][ T5095] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 124.207888][ T5095] NILFS (loop3): vblocknr = 23 has abnormal lifetime: start cno (= 4294967298) > current cno (= 3) [ 124.241134][ T5095] NILFS error (device loop3): nilfs_bmap_propagate: broken bmap (inode number=4) [ 124.295034][ T5095] Remounting filesystem read-only [ 124.466541][ T4273] NILFS (loop3): disposed unprocessed dirty file(s) when stopping log writer [ 124.966039][ T5122] ieee802154 phy0 wpan0: encryption failed: -22 [ 125.877657][ T5123] loop1: detected capacity change from 0 to 8192 [ 126.228393][ T4349] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 126.282527][ T26] audit: type=1804 audit(1786062059.468:10): pid=5140 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.193" name="/newroot/35/file2/file0" dev="loop1" ino=1048599 res=1 errno=0 [ 126.433149][ T4349] usb 4-1: config index 0 descriptor too short (expected 61220, got 36) [ 126.467716][ T4349] usb 4-1: config 191 has too many interfaces: 102, using maximum allowed: 32 [ 126.499657][ T4349] usb 4-1: config 191 has an invalid descriptor of length 0, skipping remainder of the config [ 126.539932][ T4349] usb 4-1: config 191 has 0 interfaces, different from the descriptor's value: 102 [ 126.572403][ T4349] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 126.602736][ T4349] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.816289][ T5163] loop4: detected capacity change from 0 to 8 [ 126.965491][ T5163] SQUASHFS error: xz decompression failed, data probably corrupt [ 126.965615][ T5168] loop0: detected capacity change from 0 to 256 [ 127.012076][ T5163] SQUASHFS error: Failed to read block 0x108: -5 [ 127.035017][ T5163] SQUASHFS error: Unable to read metadata cache entry [106] [ 127.056464][ T4349] usb 4-1: string descriptor 0 read error: -71 [ 127.067045][ T5168] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 127.075031][ T4349] usb 4-1: USB disconnect, device number 5 [ 127.088555][ T5163] SQUASHFS error: Unable to read inode 0x11f [ 127.257675][ T26] audit: type=1800 audit(1786062060.438:11): pid=5168 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.207" name="file1" dev="loop0" ino=1048600 res=0 errno=0 [ 127.876334][ T5191] netlink: 8 bytes leftover after parsing attributes in process `syz.1.213'. [ 128.196014][ T5201] loop0: detected capacity change from 0 to 1024 [ 128.238389][ T4349] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 128.433367][ T4349] usb 3-1: config 4 has an invalid interface number: 44 but max is 0 [ 128.469015][ T4349] usb 3-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 128.525323][ T4349] usb 3-1: config 4 has no interface number 0 [ 128.542255][ T4349] usb 3-1: config 4 interface 44 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 4 [ 128.584225][ T4349] usb 3-1: config 4 interface 44 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 128.636036][ T4349] usb 3-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice= 5.20 [ 128.665910][ T4349] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.696385][ T4349] usb 3-1: Product: syz [ 128.710532][ T4349] usb 3-1: Manufacturer: syz [ 128.724155][ T4349] usb 3-1: SerialNumber: syz [ 128.855317][ T4286] hfsplus: node 4:3 still has 1 user(s)! [ 129.149003][ T4349] dvb-usb: found a 'Gigabyte U7000' in warm state. [ 129.207121][ T4349] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 129.216869][ T5197] loop3: detected capacity change from 0 to 32768 [ 129.252954][ T4349] dvbdev: DVB: registering new adapter (Gigabyte U7000) [ 129.264599][ T5197] BTRFS: device fsid a6a605fc-d5f1-4e66-8595-3726e2b761d6 devid 1 transid 8 /dev/loop3 scanned by syz.3.215 (5197) [ 129.298810][ T4349] usb 3-1: media controller created [ 129.307798][ T4349] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 129.337247][ T5197] BTRFS info (device loop3): first mount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 129.373889][ T5197] BTRFS info (device loop3): using blake2b (blake2b-256-generic) checksum algorithm [ 129.410562][ T5197] BTRFS info (device loop3): using free space tree [ 129.591049][ T5197] BTRFS info (device loop3): enabling ssd optimizations [ 129.774584][ T4349] DVB: Unable to find symbol dib7000p_attach() [ 129.790241][ T4349] dvb-usb: no frontend was attached by 'Gigabyte U7000' [ 129.956329][ T4273] BTRFS info (device loop3): last unmount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 130.102998][ T4349] rc_core: IR keymap rc-dib0700-rc5 not found [ 130.138674][ T4349] Registered IR keymap rc-empty [ 130.155582][ T4349] dvb-usb: could not initialize remote control. [ 130.182318][ T4349] dvb-usb: Gigabyte U7000 successfully initialized and connected. [ 130.234210][ T4349] usb 3-1: USB disconnect, device number 4 [ 130.333302][ T4349] dvb-usb: Gigabyte U7000 successfully deinitialized and disconnected. [ 130.654940][ T5258] netlink: 'syz.4.228': attribute type 3 has an invalid length. [ 130.675817][ T5261] loop0: detected capacity change from 0 to 256 [ 130.698956][ T5258] netlink: 'syz.4.228': attribute type 8 has an invalid length. [ 130.723483][ T5261] exfat: Deprecated parameter 'utf8' [ 130.747793][ T5258] netlink: 'syz.4.228': attribute type 4 has an invalid length. [ 130.751739][ T5261] exfat: Deprecated parameter 'utf8' [ 130.773147][ T5264] loop3: detected capacity change from 0 to 164 [ 130.796836][ T5258] netlink: 'syz.4.228': attribute type 7 has an invalid length. [ 130.832277][ T5258] netlink: 199012 bytes leftover after parsing attributes in process `syz.4.228'. [ 130.865130][ T5261] exFAT-fs (loop0): failed to load upcase table (idx : 0x0001fe89, chksum : 0x70f4f936, utbl_chksum : 0xe619d30d) [ 131.196803][ T5269] loop4: detected capacity change from 0 to 128 [ 131.259226][ T5269] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a80ec018, mo2=0002] [ 131.267399][ T5269] System zones: 1-3, 19-19, 35-36 [ 131.354366][ T5269] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 131.398600][ T5269] ext4 filesystem being mounted at /56/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 131.638298][ T4725] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 131.740468][ T5287] loop0: detected capacity change from 0 to 2048 [ 131.776151][ T4282] EXT4-fs (loop4): unmounting filesystem. [ 131.799899][ T5287] NILFS (loop0): invalid segment: Magic number mismatch [ 131.829737][ T5287] NILFS (loop0): trying rollback from an earlier position [ 131.840639][ T4725] usb 4-1: unable to get BOS descriptor or descriptor too short [ 131.881755][ T4725] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 131.926797][ T4725] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 131.958143][ T5287] NILFS (loop0): recovery complete [ 131.983406][ T4725] usb 4-1: string descriptor 0 read error: -22 [ 131.998359][ T5292] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 132.024959][ T4725] usb 4-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 132.059129][ T4725] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 132.114000][ T4725] usb 4-1: selecting invalid altsetting 1 [ 132.137042][ T4725] usb 4-1: unit 6 not found! [ 132.610725][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.617516][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.688585][ T4731] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 132.812523][ T4286] NILFS (loop0): disposed unprocessed dirty file(s) when stopping log writer [ 132.878265][ T4731] usb 3-1: Using ep0 maxpacket: 32 [ 132.893401][ T4731] usb 3-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 132.918217][ T4731] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 132.954144][ T4731] usb 3-1: Product: syz [ 132.959169][ T4731] usb 3-1: Manufacturer: syz [ 132.968539][ T4731] usb 3-1: SerialNumber: syz [ 132.982413][ T4731] usb 3-1: config 0 descriptor?? [ 133.137439][ T4725] usb 4-1: 2:0: failed to get current value for ch 0 (-71) [ 133.221769][ T5305] loop4: detected capacity change from 0 to 40427 [ 133.245512][ T4731] RobotFuzz Open Source InterFace, OSIF 3-1:0.0: version d4.15 found at bus 003 address 005 [ 133.258204][ T4725] snd-usb-audio: probe of 4-1:1.0 failed with error -22 [ 133.267381][ T5305] F2FS-fs (loop4): Corrupted extension count (64 + 1 > 64) [ 133.310533][ T4725] usb 4-1: USB disconnect, device number 6 [ 133.330814][ T5305] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 133.361581][ T5305] F2FS-fs (loop4): invalid crc value [ 133.378098][ T5305] F2FS-fs (loop4): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 133.456059][ T5305] F2FS-fs (loop4): Start checkpoint disabled! [ 133.503900][ T5305] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 133.519128][ T5305] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 133.560403][ T4367] udevd[4367]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 133.735609][ T5301] i2c i2c-1: failure sending STOP [ 133.749290][ T4725] usb 3-1: USB disconnect, device number 5 [ 133.779069][ T4441] kworker/u4:30: attempt to access beyond end of device [ 133.779069][ T4441] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 134.321163][ T5335] netlink: 24 bytes leftover after parsing attributes in process `syz.4.253'. [ 134.360981][ T5335] netlink: 24 bytes leftover after parsing attributes in process `syz.4.253'. [ 134.378466][ T5335] Zero length message leads to an empty skb [ 134.496624][ T5337] loop0: detected capacity change from 0 to 2048 [ 134.540213][ T5324] loop1: detected capacity change from 0 to 32768 [ 134.606927][ T5324] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.251 (5324) [ 134.620798][ T5337] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 134.647243][ T5337] ext4 filesystem being mounted at /48/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 134.713280][ T5324] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 134.737348][ T5337] fs-verity: sha256 using implementation "sha256-avx2" [ 134.758497][ T5324] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 134.817004][ T5324] BTRFS info (device loop1): setting nodatasum [ 134.868238][ T5324] BTRFS info (device loop1): force zlib compression, level 3 [ 134.875715][ T5324] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_LZO (0x8) [ 134.935675][ T4286] EXT4-fs (loop0): unmounting filesystem. [ 134.943397][ T5324] BTRFS info (device loop1): use lzo compression, level 0 [ 134.983907][ T5324] BTRFS info (device loop1): turning on flush-on-commit [ 135.008852][ T5324] BTRFS info (device loop1): enabling auto defrag [ 135.015447][ T5324] BTRFS info (device loop1): max_inline at 4096 [ 135.088514][ T5324] BTRFS info (device loop1): using free space tree [ 135.188319][ T4349] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 135.271091][ T5324] BTRFS info (device loop1): enabling ssd optimizations [ 135.358355][ T4725] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 135.380721][ T4349] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 135.413212][ T4349] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 135.454032][ T4349] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 135.498106][ T4349] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 135.522873][ T4349] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.546302][ T4349] usb 5-1: config 0 descriptor?? [ 135.562127][ T4725] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 135.576438][ T4725] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 136.045928][ T4349] plantronics 0003:047F:FFFF.0006: No inputs registered, leaving [ 136.290915][ T4725] usb 3-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 0.00 [ 136.300205][ T4725] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 136.325803][ T4272] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 136.338962][ T4349] plantronics 0003:047F:FFFF.0006: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 136.420345][ T4349] usb 5-1: USB disconnect, device number 2 [ 136.742411][ T5379] fido_id[5379]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 136.913120][ T4362] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 10 /dev/loop1 scanned by udevd (4362) [ 137.028238][ T5388] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 137.230256][ T5388] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 137.256962][ T5388] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 137.282319][ T5388] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 137.313465][ T5388] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.347088][ T5384] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 137.364418][ T4725] gud 3-1:1.0: USB-1: Failed to add properties (ret=-5) [ 137.375262][ T4725] gud 3-1:1.0: Failed to get connectors (error=-5) [ 137.403361][ T4725] gud: probe of 3-1:1.0 failed with error -5 [ 137.517028][ T5405] loop4: detected capacity change from 0 to 8192 [ 137.571442][ T4732] usb 3-1: USB disconnect, device number 6 [ 137.816266][ T4731] usb 4-1: USB disconnect, device number 7 [ 137.915782][ T26] audit: type=1804 audit(1786062071.098:12): pid=5411 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.270" name="/newroot/63/file2/file0" dev="loop4" ino=1048602 res=1 errno=0 [ 138.296697][ T5423] netlink: 16 bytes leftover after parsing attributes in process `syz.1.279'. [ 139.331532][ T5432] Bluetooth: MGMT ver 1.22 [ 139.425031][ T5437] jffs2: notice: (5437) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 139.698461][ T4369] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 139.898423][ T4369] usb 3-1: Using ep0 maxpacket: 32 [ 139.907118][ T4369] usb 3-1: unable to get BOS descriptor or descriptor too short [ 139.915724][ T5448] loop0: detected capacity change from 0 to 8192 [ 139.931591][ T4369] usb 3-1: config 8 has an invalid interface number: 94 but max is 0 [ 139.970620][ T4369] usb 3-1: config 8 has no interface number 0 [ 140.016237][ T4369] usb 3-1: config 8 interface 94 has no altsetting 0 [ 140.054259][ T4369] usb 3-1: New USB device found, idVendor=0458, idProduct=7003, bcdDevice=fc.62 [ 140.076572][ T4369] usb 3-1: New USB device strings: Mfr=13, Product=2, SerialNumber=3 [ 140.087707][ T4369] usb 3-1: Product: syz [ 140.105263][ T4369] usb 3-1: Manufacturer: syz [ 140.110160][ T4369] usb 3-1: SerialNumber: syz [ 140.138333][ T26] audit: type=1804 audit(1786062073.318:13): pid=5456 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.287" name="/newroot/56/file2/file0" dev="loop0" ino=1048603 res=1 errno=0 [ 140.194324][ T5460] TCP: request_sock_subflow_v6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 140.238358][ T4732] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 140.430179][ T4732] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 140.451623][ T4732] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 140.504447][ T4732] usb 4-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 140.531874][ T4732] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 140.548310][ T4732] usb 4-1: Product: syz [ 140.552572][ T4732] usb 4-1: Manufacturer: syz [ 140.557211][ T4732] usb 4-1: SerialNumber: syz [ 140.594559][ T4369] gspca_main: sn9c2028-2.14.0 probing 0458:7003 [ 140.789044][ T4369] gspca_sn9c2028: read1 error -32 [ 140.795380][ T4732] usblp 4-1:1.0: usblp0: USB Bidirectional printer dev 8 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 140.797073][ T4369] gspca_sn9c2028: read1 error -32 [ 140.848318][ T4326] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 141.030565][ T4726] usb 4-1: USB disconnect, device number 8 [ 141.047003][ T4726] usblp0: removed [ 141.053829][ T4326] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 141.070975][ T4326] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 141.094553][ T4369] usb 3-1: USB disconnect, device number 7 [ 141.106572][ T4326] usb 5-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 141.152093][ T4326] usb 5-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 141.170675][ T4326] usb 5-1: Manufacturer: syz [ 141.192747][ T4326] usb 5-1: config 0 descriptor?? [ 141.315782][ T5485] loop0: detected capacity change from 0 to 256 [ 141.574346][ T5489] loop0: detected capacity change from 0 to 512 [ 141.590878][ T5489] ext4: Bad value for 'barrier' [ 141.847380][ T5496] netlink: 8 bytes leftover after parsing attributes in process `syz.0.307'. [ 142.230113][ T4326] uclogic 0003:256C:006D.0007: v1 frame probing failed: -71 [ 142.242175][ T4326] uclogic 0003:256C:006D.0007: failed probing parameters: -71 [ 142.266659][ T4326] uclogic: probe of 0003:256C:006D.0007 failed with error -71 [ 142.308111][ T4326] usb 5-1: USB disconnect, device number 3 [ 142.431578][ T5512] loop2: detected capacity change from 0 to 512 [ 142.485230][ T5512] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 142.521446][ T5512] ext4 filesystem being mounted at /65/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 142.628477][ T5388] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 142.818399][ T5388] usb 2-1: Using ep0 maxpacket: 32 [ 142.825883][ T5388] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 142.887183][ T5388] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 142.914433][ T5512] EXT4-fs warning (device loop2): verify_group_input:169: Last group not full [ 142.930420][ T5388] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 142.940947][ T5388] usb 2-1: Product: syz [ 142.945179][ T5388] usb 2-1: Manufacturer: syz [ 142.950318][ T5388] usb 2-1: SerialNumber: syz [ 142.961099][ T5388] usb 2-1: config 0 descriptor?? [ 142.968317][ T5509] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 142.987652][ T5388] hub 2-1:0.0: bad descriptor, ignoring hub [ 143.005161][ T5388] hub: probe of 2-1:0.0 failed with error -5 [ 143.059277][ T4281] EXT4-fs (loop2): unmounting filesystem. [ 143.158396][ T4731] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 143.238484][ T4326] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 143.347737][ T4366] usb 2-1: USB disconnect, device number 4 [ 143.360794][ T4731] usb 1-1: unable to get BOS descriptor or descriptor too short [ 143.374271][ T4731] usb 1-1: not running at top speed; connect to a high speed hub [ 143.384145][ T4731] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 143.395025][ T4731] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 143.407739][ T4731] usb 1-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 143.413051][ T5388] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 143.418579][ T4731] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.433100][ T4326] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 143.442333][ T4731] usb 1-1: Product: syz [ 143.453233][ T4326] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 143.454956][ T4731] usb 1-1: Manufacturer: syz [ 143.465186][ T4326] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 143.473208][ T4731] usb 1-1: SerialNumber: syz [ 143.484227][ T4326] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.503122][ T5525] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 143.538363][ T4732] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 143.650215][ T5388] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 143.660235][ T5388] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 143.673322][ T5388] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 143.683228][ T5388] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.705431][ T4731] usb 1-1: 3:0: cannot get min/max values for control 4 (id 3) [ 143.717775][ T4731] usb 1-1: 3:0: cannot get min/max values for control 5 (id 3) [ 143.734339][ T4731] usb 1-1: 3:0: failed to get current value for ch 1 (-71) [ 143.749892][ T4732] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 143.761674][ T4732] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 143.773186][ T4731] usb 1-1: 3:0: failed to get current value for ch 0 (-71) [ 143.780769][ T4732] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 143.796549][ T4732] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 143.820392][ T4731] usb 1-1: 3:0: cannot get min/max values for control 5 (id 3) [ 143.834226][ T4732] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.874698][ T4731] usb 1-1: USB disconnect, device number 3 [ 143.904253][ T4732] usb 5-1: config 0 descriptor?? [ 143.916532][ T5388] usb 3-1: usb_control_msg returned -32 [ 143.926466][ T5388] usbtmc 3-1:16.0: can't read capabilities [ 143.926674][ T4725] usb 4-1: USB disconnect, device number 9 [ 143.988584][ T4564] udevd[4564]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 144.104293][ T26] audit: type=1326 audit(1786062077.288:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5535 comm="syz.1.323" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb5ec19e0d9 code=0x0 [ 144.148495][ T5388] usb 3-1: USB disconnect, device number 8 [ 144.347673][ T4732] plantronics 0003:047F:FFFF.0008: unknown main item tag 0xd [ 144.364677][ T4732] plantronics 0003:047F:FFFF.0008: No inputs registered, leaving [ 144.390259][ T4732] plantronics 0003:047F:FFFF.0008: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 144.668901][ T4366] usb 5-1: USB disconnect, device number 4 [ 144.918429][ T4732] usb 4-1: new full-speed USB device number 10 using dummy_hcd [ 145.078378][ T4725] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 145.140294][ T4732] usb 4-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 145.161803][ T4732] usb 4-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 145.181464][ T4732] usb 4-1: config 0 interface 0 has no altsetting 0 [ 145.198265][ T4732] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 145.208077][ T4732] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.226223][ T4732] usb 4-1: config 0 descriptor?? [ 145.282789][ T4725] usb 3-1: Using ep0 maxpacket: 32 [ 145.292208][ T4725] usb 3-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 145.313520][ T4725] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.326331][ T4725] usb 3-1: config 0 descriptor?? [ 145.340906][ T4725] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 145.617049][ T5553] loop4: detected capacity change from 0 to 32768 [ 145.643092][ T4732] mcp2221 0003:04D8:00DD.0009: unbalanced delimiter at end of report description [ 145.653198][ T5553] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop4 scanned by syz.4.329 (5553) [ 145.657354][ T4732] mcp2221 0003:04D8:00DD.0009: can't parse reports [ 145.677927][ T4732] mcp2221: probe of 0003:04D8:00DD.0009 failed with error -22 [ 145.716482][ T5553] BTRFS info (device loop4): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 145.737853][ T5553] BTRFS info (device loop4): using blake2b (blake2b-256-generic) checksum algorithm [ 145.754485][ T5553] BTRFS info (device loop4): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 145.764382][ T5553] BTRFS info (device loop4): use zstd compression, level 3 [ 145.772117][ T5553] BTRFS info (device loop4): use no compression [ 145.780763][ T5553] BTRFS info (device loop4): using free space tree [ 145.873391][ T4732] usb 4-1: USB disconnect, device number 10 [ 145.914217][ T5553] BTRFS info (device loop4): enabling ssd optimizations [ 146.071431][ T4282] BTRFS info (device loop4): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 146.502582][ T5578] jffs2: notice: (5578) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 146.625587][ T4725] gspca_nw80x: reg_w err -71 [ 146.630703][ T4725] nw80x: probe of 3-1:0.0 failed with error -71 [ 146.645547][ T4725] usb 3-1: USB disconnect, device number 9 [ 146.694746][ T5574] loop3: detected capacity change from 0 to 8192 [ 146.841461][ T5587] loop1: detected capacity change from 0 to 512 [ 146.911604][ T5587] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 146.927566][ T26] audit: type=1804 audit(1786062080.108:15): pid=5583 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.330" name="/newroot/44/file2/file0" dev="loop3" ino=1048605 res=1 errno=0 [ 146.960705][ T5587] EXT4-fs error (device loop1): ext4_get_branch:178: inode #13: block 1024: comm syz.1.333: invalid block [ 146.986136][ T5587] EXT4-fs (loop1): 1 truncate cleaned up [ 146.992772][ T5587] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 147.025360][ T5587] EXT4-fs error (device loop1): __ext4_remount:6650: comm syz.1.333: Abort forced by user [ 147.080953][ T5587] EXT4-fs (loop1): re-mounted. Quota mode: writeback. [ 147.098346][ T5387] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 147.226309][ T4272] EXT4-fs (loop1): unmounting filesystem. [ 147.288308][ T5387] usb 1-1: Using ep0 maxpacket: 16 [ 147.301435][ T5387] usb 1-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 147.351697][ T5387] usb 1-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 147.382730][ T5387] usb 1-1: Product: syz [ 147.386999][ T5387] usb 1-1: Manufacturer: syz [ 147.420820][ T5387] usb 1-1: SerialNumber: syz [ 147.457670][ T5387] usb 1-1: config 0 descriptor?? [ 147.472653][ T5594] loop2: detected capacity change from 0 to 2048 [ 147.554024][ T5594] NILFS (loop2): invalid segment: Magic number mismatch [ 147.586352][ T5594] NILFS (loop2): trying rollback from an earlier position [ 147.598240][ T5388] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 147.634968][ T5594] NILFS (loop2): recovery complete [ 147.680665][ T5596] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 147.698374][ T4732] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 147.747919][ T5387] usb 1-1: USB disconnect, device number 4 [ 147.791478][ T5388] usb 4-1: Using ep0 maxpacket: 8 [ 147.803535][ T5388] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 147.840966][ T5598] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 64993 [ 147.843640][ T5388] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 147.866215][ T5388] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.886809][ T5388] usb 4-1: config 0 descriptor?? [ 147.928274][ T4732] usb 2-1: Using ep0 maxpacket: 32 [ 147.936183][ T4732] usb 2-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 147.955983][ T4732] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.986518][ T4732] usb 2-1: config 0 descriptor?? [ 148.016844][ T4732] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 148.105783][ T5388] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 148.666828][ T4281] NILFS (loop2): disposed unprocessed dirty file(s) when stopping log writer [ 148.668746][ T4725] usb 4-1: USB disconnect, device number 11 [ 149.234619][ T4732] gspca_nw80x: reg_w err -71 [ 149.240244][ T5387] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 149.249750][ T4732] nw80x: probe of 2-1:0.0 failed with error -71 [ 149.262819][ T4732] usb 2-1: USB disconnect, device number 5 [ 149.418462][ T5387] usb 1-1: Using ep0 maxpacket: 16 [ 149.427573][ T5387] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 149.440923][ T5387] usb 1-1: config 0 interface 0 has no altsetting 0 [ 149.447774][ T5387] usb 1-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 149.463620][ T5387] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 149.489297][ T5623] loop4: detected capacity change from 0 to 256 [ 149.497874][ T5387] usb 1-1: config 0 descriptor?? [ 149.536908][ T5623] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x0f9fe206, utbl_chksum : 0xe619d30d) [ 149.907027][ T5619] loop3: detected capacity change from 0 to 40427 [ 149.921585][ T5619] F2FS-fs (loop3): Corrupted extension count (64 + 1 > 64) [ 149.933148][ T5619] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 149.961492][ T5387] nzxt-smart2 0003:1E71:2009.000A: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.0-1/input0 [ 150.010257][ T5619] F2FS-fs (loop3): invalid crc value [ 150.033417][ T5629] loop1: detected capacity change from 0 to 256 [ 150.044926][ T5619] F2FS-fs (loop3): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 150.127940][ T5629] exFAT-fs (loop1): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 150.352158][ T5387] usb 1-1: USB disconnect, device number 5 [ 150.380519][ T5619] F2FS-fs (loop3): Start checkpoint disabled! [ 150.460171][ T5619] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 150.478474][ T5619] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 150.557862][ T5632] fido_id[5632]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 150.750764][ T4441] kworker/u4:30: attempt to access beyond end of device [ 150.750764][ T4441] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 150.879974][ T5642] loop4: detected capacity change from 0 to 512 [ 150.971888][ T5642] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 151.079770][ T5642] ext4 filesystem being mounted at /82/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 151.267819][ T5649] loop2: detected capacity change from 0 to 1024 [ 151.312642][ T5649] EXT4-fs: Ignoring removed oldalloc option [ 151.351622][ T5649] EXT4-fs: Ignoring removed bh option [ 151.389415][ T5649] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 151.423430][ T5649] ext4 filesystem being mounted at /72/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 151.477805][ T5649] EXT4-fs error (device loop2): ext4_map_blocks:747: inode #15: comm syz.2.357: lblock 0 mapped to illegal pblock 0 (length 1) [ 151.576497][ T5649] EXT4-fs (loop2): Remounting filesystem read-only [ 151.605538][ T5656] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #15: comm syz.2.357: lblock 0 mapped to illegal pblock 0 (length 1) [ 151.653871][ T5656] EXT4-fs (loop2): Remounting filesystem read-only [ 151.661497][ T5659] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #15: comm syz.2.357: lblock 0 mapped to illegal pblock 0 (length 1) [ 151.704025][ T5659] EXT4-fs (loop2): Remounting filesystem read-only [ 151.715029][ T4282] EXT4-fs (loop4): unmounting filesystem. [ 151.716355][ T5659] EXT4-fs error (device loop2): ext4_ext_remove_space:2945: inode #15: comm syz.2.357: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 2, max 4(4), depth 0(0) [ 151.740957][ T5659] EXT4-fs (loop2): Remounting filesystem read-only [ 151.752012][ T5648] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #15: comm syz.2.357: lblock 0 mapped to illegal pblock 0 (length 1) [ 151.765551][ T5659] EXT4-fs error (device loop2) in ext4_setattr:5695: Corrupt filesystem [ 151.817880][ T5648] EXT4-fs (loop2): Remounting filesystem read-only [ 151.835236][ T5659] EXT4-fs (loop2): Remounting filesystem read-only [ 151.868443][ T5656] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #15: comm syz.2.357: lblock 0 mapped to illegal pblock 0 (length 1) [ 151.945852][ T5656] EXT4-fs (loop2): Remounting filesystem read-only [ 151.968057][ T5648] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #15: comm syz.2.357: lblock 0 mapped to illegal pblock 0 (length 1) [ 151.998282][ T5648] EXT4-fs (loop2): Remounting filesystem read-only [ 152.026223][ T5649] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #15: comm syz.2.357: lblock 0 mapped to illegal pblock 0 (length 1) [ 152.065597][ T5666] loop0: detected capacity change from 0 to 128 [ 152.072792][ T5649] EXT4-fs (loop2): Remounting filesystem read-only [ 152.102583][ T5656] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #15: comm syz.2.357: lblock 0 mapped to illegal pblock 0 (length 1) [ 152.118085][ T5666] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 152.127523][ T5666] ext4 filesystem being mounted at /76/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 152.256670][ T5658] loop1: detected capacity change from 0 to 32768 [ 152.298733][ T5658] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 152.316347][ T5658] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 152.325876][ T5658] BTRFS info (device loop1): setting nodatasum [ 152.332261][ T5658] BTRFS info (device loop1): force zlib compression, level 3 [ 152.341557][ T5658] BTRFS info (device loop1): turning on sync discard [ 152.360343][ T5658] BTRFS info (device loop1): turning on flush-on-commit [ 152.367542][ T5658] BTRFS info (device loop1): max_inline at 0 [ 152.393430][ T5658] BTRFS info (device loop1): turning off discard [ 152.408264][ T5658] BTRFS info (device loop1): using free space tree [ 152.500371][ T4286] EXT4-fs (loop0): unmounting filesystem. [ 152.620993][ T5675] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 152.628893][ T5675] IPv6: NLM_F_CREATE should be set when creating new route [ 152.663126][ T5658] BTRFS info (device loop1): enabling ssd optimizations [ 152.725996][ T5675] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 152.922626][ T4272] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 153.215280][ T4564] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 10 /dev/loop1 scanned by udevd (4564) [ 154.333361][ T5708] loop4: detected capacity change from 0 to 2048 [ 154.372595][ T5708] NILFS (loop4): invalid segment: Magic number mismatch [ 154.408248][ T5708] NILFS (loop4): trying rollback from an earlier position [ 154.474729][ T5708] NILFS (loop4): recovery complete [ 154.528425][ T5713] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 154.552467][ T5712] loop3: detected capacity change from 0 to 2048 [ 154.654991][ T5712] "syz.3.372" (5712) uses obsolete ecb(arc4) skcipher [ 155.044068][ T5719] loop3: detected capacity change from 0 to 512 [ 155.086663][ T5719] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 155.178340][ T5693] loop0: detected capacity change from 0 to 32768 [ 155.278690][ T5693] XFS (loop0): Mounting V5 Filesystem [ 155.431254][ T5693] XFS (loop0): Ending clean mount [ 155.558350][ T4725] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 155.594867][ T5715] loop2: detected capacity change from 0 to 32768 [ 155.744733][ T4282] NILFS (loop4): disposed unprocessed dirty file(s) when stopping log writer [ 155.768468][ T4725] usb 2-1: Using ep0 maxpacket: 16 [ 155.780603][ T4725] usb 2-1: config 0 has no interfaces? [ 155.785429][ T4286] XFS (loop0): Unmounting Filesystem [ 155.826841][ T4725] usb 2-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 155.862487][ T4725] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 155.909483][ T4725] usb 2-1: config 0 descriptor?? [ 156.146310][ T4732] usb 2-1: USB disconnect, device number 6 [ 157.401145][ T5748] loop2: detected capacity change from 0 to 512 [ 157.442762][ T5748] EXT4-fs: Ignoring removed bh option [ 157.451464][ T5748] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 157.465270][ T5748] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 157.548087][ T5748] EXT4-fs (loop2): 1 truncate cleaned up [ 157.571670][ T5748] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 157.718425][ T4725] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 157.817262][ T4281] EXT4-fs (loop2): unmounting filesystem. [ 157.930650][ T4725] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 157.960623][ T4725] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 157.997872][ T4725] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 158.028390][ T5767] loop4: detected capacity change from 0 to 1024 [ 158.035242][ T4725] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 158.044381][ T5767] EXT4-fs: Ignoring removed oldalloc option [ 158.052427][ T5767] EXT4-fs: Ignoring removed orlov option [ 158.150845][ T5767] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 158.234875][ T5773] device netdevsim0 entered promiscuous mode [ 158.242978][ T5773] device netdevsim0 left promiscuous mode [ 158.295674][ T4725] usb 1-1: usb_control_msg returned -32 [ 158.302112][ T4725] usbtmc 1-1:16.0: can't read capabilities [ 158.319518][ T5774] device netdevsim0 entered promiscuous mode [ 158.362005][ T5774] device netdevsim0 left promiscuous mode [ 158.376660][ T4282] EXT4-fs (loop4): unmounting filesystem. [ 158.383190][ T5390] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 158.557887][ T5697] usb 1-1: USB disconnect, device number 6 [ 158.574996][ T5390] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 158.592889][ T5781] netlink: 4 bytes leftover after parsing attributes in process `syz.2.394'. [ 158.610237][ T5390] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.638339][ T5390] usb 4-1: Product: syz [ 158.642631][ T5390] usb 4-1: Manufacturer: syz [ 158.647444][ T5390] usb 4-1: SerialNumber: syz [ 158.896140][ T5390] usb 4-1: Unused bulk IN endpoint found: 0x83 [ 158.918273][ T5390] usb 4-1: Not enough endpoints found in device, aborting! [ 159.042896][ T5792] device pim6reg1 entered promiscuous mode [ 159.221168][ T5797] loop2: detected capacity change from 0 to 2048 [ 159.284106][ T5797] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 159.360533][ T5802] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 159.454902][ T5802] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 672 with error 28 [ 159.479584][ T5802] EXT4-fs (loop2): This should not happen!! Data will be lost [ 159.479584][ T5802] [ 159.510776][ T5802] EXT4-fs (loop2): Total free blocks count 0 [ 159.516933][ T5802] EXT4-fs (loop2): Free/Dirty block details [ 159.533637][ T5802] EXT4-fs (loop2): free_blocks=2415919104 [ 159.553962][ T5802] EXT4-fs (loop2): dirty_blocks=672 [ 159.559819][ T4731] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 159.573057][ T5802] EXT4-fs (loop2): Block reservation details [ 159.588286][ T5802] EXT4-fs (loop2): i_reserved_data_blocks=42 [ 159.742882][ T4281] EXT4-fs (loop2): unmounting filesystem. [ 159.769462][ T4731] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 159.780121][ T4731] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 159.791854][ T4731] usb 5-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 0.00 [ 159.810502][ T4731] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 160.002815][ T5804] loop1: detected capacity change from 0 to 40427 [ 160.038554][ T5804] F2FS-fs (loop1): invalid crc value [ 160.059218][ T5804] F2FS-fs (loop1): Found nat_bits in checkpoint [ 160.117191][ T5804] F2FS-fs (loop1): Start checkpoint disabled! [ 160.143559][ T5804] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 160.402194][ T4414] kworker/u4:18: attempt to access beyond end of device [ 160.402194][ T4414] loop1: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 160.861235][ T4731] gud 5-1:1.0: USB-1: Failed to add properties (ret=-5) [ 160.870944][ T4731] gud 5-1:1.0: Failed to get connectors (error=-5) [ 160.884535][ T4731] gud: probe of 5-1:1.0 failed with error -5 [ 161.068095][ T4731] usb 5-1: USB disconnect, device number 5 [ 161.134816][ T5819] loop2: detected capacity change from 0 to 65536 [ 161.176398][ T5819] XFS (loop2): Mounting V5 Filesystem [ 161.206483][ T5819] XFS (loop2): Ending clean mount [ 161.227506][ T5819] XFS (loop2): Metadata corruption detected at xfs_dinode_verify+0x2d4/0x1120, inode 0x26 dinode [ 161.240423][ T5819] XFS (loop2): Unmount and run xfs_repair [ 161.246234][ T5819] XFS (loop2): First 128 bytes of corrupted metadata buffer: [ 161.258414][ T5819] 00000000: 49 4e 81 ed 03 02 00 00 00 00 00 00 00 00 00 00 IN.............. [ 161.277847][ T5819] 00000010: 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 161.298867][ T5819] 00000020: 34 f7 58 68 7a bb 44 4d 34 f7 58 68 7a bb 44 4d 4.Xhz.DM4.Xhz.DM [ 161.328502][ T5819] 00000030: 34 f7 58 68 7a bb 44 4d 00 00 00 00 00 00 00 0a 4.Xhz.DM........ [ 161.337620][ T5819] 00000040: 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 01 ................ [ 161.355566][ T5819] 00000050: 00 00 25 01 00 00 00 00 00 00 00 00 38 7c 45 d7 ..%.........8|E. [ 161.368322][ T5386] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 161.392257][ T5819] 00000060: ff ff ff ff da a2 56 a4 00 00 00 00 00 00 00 08 ......V......... [ 161.418224][ T5819] 00000070: 00 00 00 01 00 00 00 10 00 00 00 00 00 00 00 08 ................ [ 161.430720][ T5837] XFS (loop2): Metadata corruption detected at xfs_dinode_verify+0x2d4/0x1120, inode 0x26 dinode [ 161.448395][ T5837] XFS (loop2): Unmount and run xfs_repair [ 161.458388][ T5837] XFS (loop2): First 128 bytes of corrupted metadata buffer: [ 161.468211][ T5837] 00000000: 49 4e 81 ed 03 02 00 00 00 00 00 00 00 00 00 00 IN.............. [ 161.477754][ T5837] 00000010: 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 161.508589][ T5837] 00000020: 34 f7 58 68 7a bb 44 4d 34 f7 58 68 7a bb 44 4d 4.Xhz.DM4.Xhz.DM [ 161.517990][ T5837] 00000030: 34 f7 58 68 7a bb 44 4d 00 00 00 00 00 00 00 0a 4.Xhz.DM........ [ 161.527967][ T5837] 00000040: 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 01 ................ [ 161.537399][ T5837] 00000050: 00 00 25 01 00 00 00 00 00 00 00 00 38 7c 45 d7 ..%.........8|E. [ 161.547143][ T5837] 00000060: ff ff ff ff da a2 56 a4 00 00 00 00 00 00 00 08 ......V......... [ 161.557743][ T5837] 00000070: 00 00 00 01 00 00 00 10 00 00 00 00 00 00 00 08 ................ [ 161.568221][ T5386] usb 2-1: Using ep0 maxpacket: 8 [ 161.575434][ T5386] usb 2-1: config 0 interface 0 has no altsetting 0 [ 161.590184][ T5386] usb 2-1: New USB device found, idVendor=056a, idProduct=0057, bcdDevice= 0.00 [ 161.640779][ T5386] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.685715][ T5386] usb 2-1: config 0 descriptor?? [ 161.725952][ T4281] XFS (loop2): Unmounting Filesystem [ 162.140696][ T5386] wacom 0003:056A:0057.000B: unknown main item tag 0x1 [ 162.147715][ T5386] wacom 0003:056A:0057.000B: ignoring exceeding usage max [ 162.216077][ T5697] usb 4-1: USB disconnect, device number 12 [ 162.223300][ T5386] wacom 0003:056A:0057.000B: hidraw0: USB HID v0.81 Device [HID 056a:0057] on usb-dummy_hcd.1-1/input0 [ 162.372605][ T5386] usb 2-1: USB disconnect, device number 7 [ 162.518583][ T5853] fido_id[5853]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 162.593641][ T5861] netlink: 8 bytes leftover after parsing attributes in process `syz.3.421'. [ 164.497462][ T5888] loop1: detected capacity change from 0 to 32768 [ 165.005213][ T5888] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop1 scanned by syz.1.430 (5888) [ 165.090616][ T5888] BTRFS info (device loop1): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 165.145365][ T5888] BTRFS info (device loop1): using blake2b (blake2b-256-generic) checksum algorithm [ 165.175465][ T5888] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 165.206724][ T5888] BTRFS info (device loop1): use zstd compression, level 3 [ 165.241288][ T5888] BTRFS info (device loop1): use no compression [ 165.257947][ T5888] BTRFS info (device loop1): using free space tree [ 165.527857][ T5931] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 165.600697][ T5931] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 165.616835][ T5888] BTRFS info (device loop1): enabling ssd optimizations [ 166.114714][ T4272] BTRFS info (device loop1): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 166.305021][ T5924] loop0: detected capacity change from 0 to 131072 [ 166.352047][ T5924] F2FS-fs (loop0): Found nat_bits in checkpoint [ 166.397623][ T5924] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 166.420592][ T5924] F2FS-fs (loop0): lookup inode (7) has corrupted xattr [ 166.460246][ T5924] F2FS-fs (loop0): lookup inode (7) has corrupted xattr [ 166.468456][ T5924] F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=fff70000, run fsck to fix. [ 168.459861][ T5984] netlink: 4 bytes leftover after parsing attributes in process `syz.0.447'. [ 169.329457][ T5982] loop2: detected capacity change from 0 to 32768 [ 169.381274][ T5982] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop2 scanned by syz.2.453 (5982) [ 169.416524][ T5982] BTRFS info (device loop2): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 169.446077][ T5982] BTRFS info (device loop2): using blake2b (blake2b-256-generic) checksum algorithm [ 169.480947][ T5982] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 169.512030][ T5982] BTRFS info (device loop2): use zstd compression, level 3 [ 169.543822][ T5982] BTRFS info (device loop2): using free space tree [ 169.837492][ T5982] BTRFS info (device loop2): enabling ssd optimizations [ 169.896280][ T26] audit: type=1800 audit(1786062103.074:16): pid=5982 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.453" name="bus" dev="loop2" ino=263 res=0 errno=0 [ 170.093444][ T4281] BTRFS info (device loop2): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 170.137541][ T6047] device netdevsim0 entered promiscuous mode [ 170.382446][ T6047] device netdevsim0 left promiscuous mode [ 170.459179][ T6050] device netdevsim0 entered promiscuous mode [ 170.491314][ T6050] device netdevsim0 left promiscuous mode [ 170.772404][ T6058] loop0: detected capacity change from 0 to 4096 [ 170.804791][ T6058] EXT4-fs: inline encryption not supported [ 170.829240][ T6058] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 170.888730][ T6058] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=280ee1a8, mo2=0003] [ 170.963694][ T6058] System zones: 0-5 [ 171.012423][ T6058] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 171.196416][ T6076] overlayfs: conflicting lowerdir path [ 171.369366][ T4286] EXT4-fs (loop0): unmounting filesystem. [ 171.504498][ T6084] netlink: 8 bytes leftover after parsing attributes in process `syz.2.480'. [ 171.552486][ T6084] IPv6: ADDRCONF(NETDEV_CHANGE): gre1: link becomes ready [ 171.606790][ T6089] IPv6: ADDRCONF(NETDEV_CHANGE): gre1: link becomes ready [ 172.078288][ T6102] ieee802154 phy0 wpan0: encryption failed: -22 [ 173.764537][ T6115] loop3: detected capacity change from 0 to 128 [ 173.807885][ T6120] loop1: detected capacity change from 0 to 512 [ 173.864602][ T6115] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 173.891121][ T6120] EXT4-fs warning (device loop1): ext4_xattr_inode_get:506: inode #11: comm syz.1.488: EA inode hash validation failed [ 173.905477][ T6115] ext4 filesystem being mounted at /79/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 173.938489][ T4731] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 174.029819][ T6120] EXT4-fs error (device loop1): ext4_do_update_inode:5279: inode #15: comm syz.1.488: corrupted inode contents [ 174.100734][ T6120] EXT4-fs (loop1): Remounting filesystem read-only [ 174.132085][ T6120] EXT4-fs error (device loop1): ext4_dirty_inode:6156: inode #15: comm syz.1.488: mark_inode_dirty error [ 174.145013][ T4731] usb 5-1: New USB device found, idVendor=0b48, idProduct=1006, bcdDevice= 1.00 [ 174.175095][ T4731] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.201253][ T4731] usb 5-1: Product: syz [ 174.208411][ T4731] usb 5-1: Manufacturer: syz [ 174.218578][ T4731] usb 5-1: SerialNumber: syz [ 174.235151][ T6120] EXT4-fs (loop1): Remounting filesystem read-only [ 174.252855][ T6120] EXT4-fs error (device loop1): ext4_do_update_inode:5279: inode #15: comm syz.1.488: corrupted inode contents [ 174.273297][ T6120] EXT4-fs (loop1): Remounting filesystem read-only [ 174.298091][ T6120] EXT4-fs error (device loop1): ext4_xattr_delete_inode:2947: inode #15: comm syz.1.488: mark_inode_dirty error [ 174.317204][ T6120] EXT4-fs (loop1): Remounting filesystem read-only [ 174.324803][ T6120] EXT4-fs error (device loop1): ext4_xattr_delete_inode:2950: inode #15: comm syz.1.488: mark inode dirty (error -117) [ 174.344985][ T6120] EXT4-fs (loop1): Remounting filesystem read-only [ 174.351999][ T6120] EXT4-fs warning (device loop1): ext4_evict_inode:301: xattr delete (err -117) [ 174.362550][ T6120] EXT4-fs (loop1): 1 orphan inode deleted [ 174.368502][ T6120] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 174.675095][ T4731] dvbdev: DVB: registering new adapter (DEC3000-s) [ 174.685383][ T4272] EXT4-fs (loop1): unmounting filesystem. [ 174.686065][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 174.749386][ T4731] usb 5-1: DVB: registering adapter 1 frontend 0 (TechnoTrend/Hauppauge DEC3000-s Frontend)... [ 174.883625][ T4731] ttusb_dec_send_command: command bulk message failed: error -71 [ 174.952972][ T4731] usb 5-1: USB disconnect, device number 6 [ 174.958724][ T6138] loop1: detected capacity change from 0 to 1024 [ 174.999364][ T6138] EXT4-fs: Ignoring removed oldalloc option [ 175.005388][ T6138] EXT4-fs: Ignoring removed bh option [ 175.083768][ T6138] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 175.093394][ T6138] ext4 filesystem being mounted at /103/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 175.145218][ T6147] netlink: 4 bytes leftover after parsing attributes in process `syz.3.498'. [ 175.352893][ T6152] ieee802154 phy0 wpan0: encryption failed: -22 [ 175.978559][ T6138] EXT4-fs error (device loop1): ext4_map_blocks:747: inode #15: comm syz.1.495: lblock 0 mapped to illegal pblock 0 (length 1) [ 175.995940][ T6138] EXT4-fs (loop1): Remounting filesystem read-only [ 176.005700][ T6149] EXT4-fs error (device loop1): ext4_map_blocks:637: inode #15: comm syz.1.495: lblock 0 mapped to illegal pblock 0 (length 1) [ 176.041429][ T6149] EXT4-fs (loop1): Remounting filesystem read-only [ 176.068807][ T6149] EXT4-fs error (device loop1): ext4_ext_remove_space:2945: inode #15: comm syz.1.495: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 2, max 4(4), depth 0(0) [ 176.108032][ T6149] EXT4-fs (loop1): Remounting filesystem read-only [ 176.131015][ T6149] EXT4-fs error (device loop1) in ext4_setattr:5695: Corrupt filesystem [ 176.168200][ T6149] EXT4-fs (loop1): Remounting filesystem read-only [ 176.320239][ T6157] loop0: detected capacity change from 0 to 512 [ 176.349236][ T6157] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem [ 176.351135][ T4272] EXT4-fs (loop1): unmounting filesystem. [ 176.433785][ T6157] EXT4-fs error (device loop0): ext4_validate_block_bitmap:429: comm syz.0.501: bg 0: block 104: invalid block bitmap [ 176.567234][ T6157] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 176.600104][ T6157] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #11: comm syz.0.501: invalid indirect mapped block 1 (level 1) [ 176.771341][ T6157] EXT4-fs (loop0): 1 truncate cleaned up [ 176.790116][ T6157] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 176.870893][ T6157] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 177.074826][ T4286] EXT4-fs (loop0): unmounting filesystem. [ 177.534007][ T6197] ieee802154 phy0 wpan0: encryption failed: -22 [ 178.518526][ T6204] loop1: detected capacity change from 0 to 1024 [ 178.526061][ T6204] EXT4-fs: Ignoring removed nomblk_io_submit option [ 178.550546][ T6179] loop4: detected capacity change from 0 to 32768 [ 178.644698][ T6204] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 178.657300][ T6219] loop3: detected capacity change from 0 to 64 [ 178.698540][ T6179] XFS (loop4): Mounting V5 Filesystem [ 178.719972][ T6204] ext4 filesystem being mounted at /108/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 178.813754][ T26] audit: type=1800 audit(1786062111.994:17): pid=6219 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.517" name="file1" dev="loop3" ino=21 res=0 errno=0 [ 178.912227][ T6179] XFS (loop4): Ending clean mount [ 178.923585][ T6204] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.516: bg 0: block 112: padding at end of block bitmap is not set [ 179.037274][ T26] audit: type=1800 audit(1786062112.214:18): pid=6179 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.507" name="file1" dev="loop4" ino=6150 res=0 errno=0 [ 179.090779][ T6204] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 16 with max blocks 52 with error 28 [ 179.117282][ T6179] XFS (loop4): WARNING: Reset corrupted AGFL on AG 0. 1 blocks leaked. Please unmount and run xfs_repair. [ 179.151480][ T6204] EXT4-fs (loop1): This should not happen!! Data will be lost [ 179.151480][ T6204] [ 179.178422][ T6204] EXT4-fs (loop1): Total free blocks count 0 [ 179.215360][ T6204] EXT4-fs (loop1): Free/Dirty block details [ 179.250989][ T6204] EXT4-fs (loop1): free_blocks=0 [ 179.276209][ T6204] EXT4-fs (loop1): dirty_blocks=64 [ 179.294228][ T6204] EXT4-fs (loop1): Block reservation details [ 179.375216][ T6204] EXT4-fs (loop1): i_reserved_data_blocks=4 [ 179.481799][ T6179] syz.4.507 (6179) used greatest stack depth: 20080 bytes left [ 179.523732][ T4282] XFS (loop4): Unmounting Filesystem [ 179.532801][ T4272] EXT4-fs (loop1): unmounting filesystem. [ 179.698361][ T5385] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 179.898549][ T5385] usb 1-1: Using ep0 maxpacket: 8 [ 179.906594][ T5385] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 179.935657][ T5385] usb 1-1: config 179 has no interface number 0 [ 179.954420][ T5385] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 179.986555][ T5385] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 180.018224][ T5385] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 180.049324][ T5385] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 180.086886][ T6240] ieee802154 phy0 wpan0: encryption failed: -22 [ 180.265817][ T5385] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 180.489200][ T5385] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 180.690030][ T5385] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.905499][ T6234] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 180.926630][ T4449] kworker/u4:33: attempt to access beyond end of device [ 180.926630][ T4449] loop3: rw=1, sector=131, nr_sectors = 288 limit=64 [ 180.945161][ T4449] kworker/u4:33: attempt to access beyond end of device [ 180.945161][ T4449] loop3: rw=1, sector=987, nr_sectors = 192 limit=64 [ 180.994192][ T6232] loop2: detected capacity change from 0 to 40427 [ 181.001406][ T4449] kworker/u4:33: attempt to access beyond end of device [ 181.001406][ T4449] loop3: rw=1, sector=1263, nr_sectors = 152 limit=64 [ 181.040028][ T4449] kworker/u4:33: attempt to access beyond end of device [ 181.040028][ T4449] loop3: rw=1, sector=1491, nr_sectors = 1 limit=64 [ 181.054223][ T4449] Buffer I/O error on dev loop3, logical block 1491, lost async page write [ 181.063469][ T4449] kworker/u4:33: attempt to access beyond end of device [ 181.063469][ T4449] loop3: rw=1, sector=1492, nr_sectors = 1 limit=64 [ 181.079986][ T6232] F2FS-fs (loop2): invalid crc value [ 181.094337][ T4449] Buffer I/O error on dev loop3, logical block 1492, lost async page write [ 181.103321][ T4449] kworker/u4:33: attempt to access beyond end of device [ 181.103321][ T4449] loop3: rw=1, sector=1493, nr_sectors = 1 limit=64 [ 181.118741][ T4449] Buffer I/O error on dev loop3, logical block 1493, lost async page write [ 181.128419][ T4449] kworker/u4:33: attempt to access beyond end of device [ 181.128419][ T4449] loop3: rw=1, sector=1494, nr_sectors = 1 limit=64 [ 181.142221][ T4449] Buffer I/O error on dev loop3, logical block 1494, lost async page write [ 181.151146][ T4449] kworker/u4:33: attempt to access beyond end of device [ 181.151146][ T4449] loop3: rw=1, sector=1751, nr_sectors = 1 limit=64 [ 181.159316][ T6232] F2FS-fs (loop2): Found nat_bits in checkpoint [ 181.176491][ T6247] netlink: 'syz.1.527': attribute type 15 has an invalid length. [ 181.209549][ T4449] Buffer I/O error on dev loop3, logical block 1751, lost async page write [ 181.220852][ T4449] kworker/u4:33: attempt to access beyond end of device [ 181.220852][ T4449] loop3: rw=1, sector=1752, nr_sectors = 1 limit=64 [ 181.234935][ T6247] netlink: 4 bytes leftover after parsing attributes in process `syz.1.527'. [ 181.254892][ T4449] Buffer I/O error on dev loop3, logical block 1752, lost async page write [ 181.282552][ T6247] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 2816 - 0 [ 181.292525][ T6247] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 2816 - 0 [ 181.301365][ T6247] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 2816 - 0 [ 181.310166][ T6247] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 2816 - 0 [ 181.335014][ T5385] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input12 [ 181.357774][ T4449] kworker/u4:33: attempt to access beyond end of device [ 181.357774][ T4449] loop3: rw=1, sector=1753, nr_sectors = 1 limit=64 [ 181.395118][ T4449] Buffer I/O error on dev loop3, logical block 1753, lost async page write [ 181.455247][ T4449] Buffer I/O error on dev loop3, logical block 1754, lost async page write [ 181.482300][ T4449] Buffer I/O error on dev loop3, logical block 3231, lost async page write [ 181.526592][ T4449] Buffer I/O error on dev loop3, logical block 3232, lost async page write [ 181.544896][ T4725] usb 1-1: USB disconnect, device number 7 [ 181.545098][ C1] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 181.559154][ C1] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 181.580979][ T4725] xpad 1-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 181.594322][ T6232] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 181.676367][ T6247] netlink: 'syz.1.527': attribute type 15 has an invalid length. [ 181.698603][ T6247] netlink: 4 bytes leftover after parsing attributes in process `syz.1.527'. [ 182.042832][ T6264] loop1: detected capacity change from 0 to 512 [ 182.120999][ T6264] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 1 overlaps superblock [ 182.141380][ T6264] EXT4-fs (loop1): ext4_check_descriptors: Inode bitmap for group 1 overlaps superblock [ 182.172753][ T6264] EXT4-fs (loop1): ext4_check_descriptors: Inode table for group 1 overlaps superblock [ 182.210783][ T6264] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 182.233865][ T6264] [EXT4 FS bs=4096, gc=2, bpg=35, ipg=32, mo=e040e01c, mo2=0000] [ 182.289476][ T6264] EXT4-fs (loop1): failed to initialize system zone (-117) [ 182.318464][ T6264] EXT4-fs (loop1): mount failed [ 182.338341][ T4731] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 182.525186][ T6273] netlink: 679 bytes leftover after parsing attributes in process `syz.4.533'. [ 182.541705][ T4731] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 182.580282][ T4731] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 182.607902][ T4731] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.657129][ T4731] usb 4-1: config 0 descriptor?? [ 182.904244][ T4731] usbhid 4-1:0.0: can't add hid device: -71 [ 182.919650][ T4731] usbhid: probe of 4-1:0.0 failed with error -71 [ 182.933479][ T4731] usb 4-1: USB disconnect, device number 13 [ 183.518411][ T4731] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 183.728402][ T4731] usb 4-1: Using ep0 maxpacket: 16 [ 183.736004][ T4731] usb 4-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 183.771012][ T4731] usb 4-1: config 0 interface 0 has no altsetting 0 [ 183.808291][ T4731] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 183.847888][ T4731] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 183.872855][ T4731] usb 4-1: config 0 descriptor?? [ 184.314043][ T4731] mcp2221 0003:04D8:00DD.000C: USB HID v0.01 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 184.471221][ T6310] loop4: detected capacity change from 0 to 128 [ 184.639806][ T4725] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 184.739055][ T6317] loop2: detected capacity change from 0 to 512 [ 184.781606][ T4731] usb 4-1: USB disconnect, device number 14 [ 184.874440][ T6317] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 184.890999][ T4725] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 184.928614][ T4725] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 184.939197][ T6317] ext4 filesystem being mounted at /117/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 184.962344][ T4725] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 184.992458][ T6324] loop1: detected capacity change from 0 to 2048 [ 185.021336][ T6324] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 185.054431][ T4725] usb 1-1: New USB device found, idVendor=04ca, idProduct=f001, bcdDevice= 1.00 [ 185.084355][ T4725] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.139433][ T4725] usb 1-1: Product: syz [ 185.143698][ T4725] usb 1-1: Manufacturer: syz [ 185.183091][ T4725] usb 1-1: SerialNumber: syz [ 185.221836][ T6306] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 185.232046][ T6306] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 185.248359][ T6306] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 185.260092][ T4725] dvb-usb: found a 'LITE-ON USB2.0 DVB-T Tuner' in warm state. [ 185.272100][ T4725] dvb-usb: bulk message failed: -71 (3/0) [ 185.283698][ T4725] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 185.294016][ T4725] dvbdev: DVB: registering new adapter (LITE-ON USB2.0 DVB-T Tuner) [ 185.302899][ T4725] usb 1-1: media controller created [ 185.334569][ T4281] EXT4-fs (loop2): unmounting filesystem. [ 185.350229][ T4725] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 185.780445][ T6338] loop4: detected capacity change from 0 to 8 [ 185.827744][ T6338] SQUASHFS error: Failed to read block 0x62: -5 [ 185.848296][ T6338] squashfs image failed sanity check [ 185.903841][ T6338] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 186.194918][ T6345] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 186.459659][ T4725] dvb-usb: bulk message failed: -71 (6/0) [ 186.487742][ T4725] dvb-usb: bulk message failed: -71 (6/0) [ 186.519325][ T4725] dvb-usb: no frontend was attached by 'LITE-ON USB2.0 DVB-T Tuner' [ 186.551830][ T4725] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input13 [ 186.582974][ T4725] dvb-usb: schedule remote query interval to 150 msecs. [ 186.622788][ T4725] dvb-usb: LITE-ON USB2.0 DVB-T Tuner successfully initialized and connected. [ 186.667994][ T4725] usb 1-1: USB disconnect, device number 8 [ 186.829804][ T4725] dvb-usb: LITE-ON USB2.0 DVB-T Tuner successfully deinitialized and disconnected. [ 186.871344][ T6357] loop3: detected capacity change from 0 to 1024 [ 186.897029][ T6354] loop2: detected capacity change from 0 to 8192 [ 186.966252][ T6354] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 186.966257][ T6357] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 186.998718][ T6354] REISERFS (device loop2): found reiserfs format "3.5" with non-standard journal [ 187.043058][ T6354] REISERFS (device loop2): using ordered data mode [ 187.098279][ T6354] reiserfs: using flush barriers [ 187.126194][ T6354] REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 187.180299][ T6366] EXT4-fs error (device loop3): ext4_get_max_inline_size:116: inode #18: comm syz.3.566: can't get inode location 18 [ 187.225511][ T6354] REISERFS (device loop2): checking transaction log (loop2) [ 187.297677][ T6366] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5952: Out of memory [ 187.311613][ T6354] REISERFS (device loop2): Using r5 hash to sort names [ 187.350666][ T6354] REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage. [ 187.362904][ T6366] EXT4-fs error (device loop3): ext4_dirty_inode:6156: inode #18: comm syz.3.566: mark_inode_dirty error [ 187.401342][ T6366] EXT4-fs warning (device loop3): ext4_read_block_bitmap_nowait:486: Cannot get buffer for block bitmap - block_group = 0, block_bitmap = 7278273066370725442 [ 187.465169][ T6366] EXT4-fs warning (device loop3): ext4_read_block_bitmap_nowait:486: Cannot get buffer for block bitmap - block_group = 0, block_bitmap = 7278273066370725442 [ 187.497040][ T6366] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5952: Out of memory [ 187.554409][ T6366] EXT4-fs error (device loop3): ext4_dirty_inode:6156: inode #18: comm syz.3.566: mark_inode_dirty error [ 187.590410][ T6366] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5952: Out of memory [ 187.688295][ T6366] EXT4-fs error (device loop3): ext4_ext_truncate:4475: inode #18: comm syz.3.566: mark_inode_dirty error [ 187.738673][ T6366] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5952: Out of memory [ 187.775237][ T6366] EXT4-fs error (device loop3): ext4_truncate:4325: inode #18: comm syz.3.566: mark_inode_dirty error [ 187.787826][ T6355] loop1: detected capacity change from 0 to 40427 [ 187.816988][ T6355] F2FS-fs (loop1): invalid crc value [ 187.887624][ T6355] F2FS-fs (loop1): Found nat_bits in checkpoint [ 187.934564][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 187.989022][ T6355] F2FS-fs (loop1): Cannot turn on quotas: -2 on 0 [ 188.023695][ T6355] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 188.142418][ T6384] netlink: 8 bytes leftover after parsing attributes in process `syz.3.572'. [ 188.311544][ T4272] bio_check_eod: 819 callbacks suppressed [ 188.311562][ T4272] syz-executor: attempt to access beyond end of device [ 188.311562][ T4272] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 189.640133][ T6426] loop1: detected capacity change from 0 to 128 [ 189.711075][ T6426] EXT4-fs (loop1): Test dummy encryption mode enabled [ 189.800344][ T6433] netlink: 4 bytes leftover after parsing attributes in process `syz.2.586'. [ 189.810249][ T6426] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 189.819940][ T6426] ext4 filesystem being mounted at /121/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 190.514498][ T6426] fscrypt (loop1): Missing crypto API support for AES-256-XTS (API name: "xts(aes)") [ 190.722887][ T4272] EXT4-fs (loop1): unmounting filesystem. [ 190.950729][ T6469] loop4: detected capacity change from 0 to 128 [ 190.989706][ T6469] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 191.129896][ T26] audit: type=1800 audit(1786062124.304:19): pid=6469 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.594" name="file1" dev="loop4" ino=94 res=0 errno=0 [ 191.172638][ T6469] UDF-fs: error (device loop4): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 191.225925][ T6469] UDF-fs: error (device loop4): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 192.403889][ T6483] loop1: detected capacity change from 0 to 32768 [ 192.488832][ T6483] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop1 scanned by syz.1.598 (6483) [ 192.633962][ T6483] BTRFS info (device loop1): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 192.669303][ T6483] BTRFS info (device loop1): using blake2b (blake2b-256-generic) checksum algorithm [ 192.768400][ T6483] BTRFS info (device loop1): using free space tree [ 193.648026][ T6483] BTRFS info (device loop1): enabling ssd optimizations [ 193.863485][ T4731] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 194.043401][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.050264][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.068413][ T4731] usb 3-1: Using ep0 maxpacket: 8 [ 194.087856][ T4731] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 194.138187][ T4731] usb 3-1: config 179 has no interface number 0 [ 194.144637][ T4731] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 194.202507][ T4731] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 194.249783][ T4731] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 194.269996][ T4272] BTRFS info (device loop1): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 194.323348][ T4731] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 194.374166][ T4731] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 194.466374][ T4731] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 194.509470][ T4731] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.547071][ T6532] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 195.002666][ T128] input: Generic X-Box pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:179.65/input/input14 [ 195.312436][ T4326] usb 3-1: USB disconnect, device number 10 [ 195.312521][ C0] xpad 3-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 195.326791][ C0] xpad 3-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 195.336933][ T4326] xpad 3-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 195.454668][ T6576] netlink: 20 bytes leftover after parsing attributes in process `syz.3.621'. [ 195.537611][ T6577] netlink: 20 bytes leftover after parsing attributes in process `syz.3.621'. [ 195.575574][ T5388] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 195.790497][ T5388] usb 5-1: config 1 interface 0 altsetting 13 endpoint 0x81 has invalid maxpacket 16416, setting to 1024 [ 195.813928][ T5388] usb 5-1: config 1 interface 0 altsetting 13 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 195.851546][ T5388] usb 5-1: config 1 interface 0 has no altsetting 0 [ 195.917773][ T5388] usb 5-1: string descriptor 0 read error: -22 [ 195.948311][ T5388] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 195.957433][ T5388] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 196.425041][ T5388] keytouch 0003:0926:3333.000D: fixing up Keytouch IEC report descriptor [ 196.488101][ T5388] input: HID 0926:3333 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/0003:0926:3333.000D/input/input15 [ 196.675966][ T6612] device gtp0 entered promiscuous mode [ 196.693466][ T5388] keytouch 0003:0926:3333.000D: input,hidraw0: USB HID v0.05 Keyboard [HID 0926:3333] on usb-dummy_hcd.4-1/input0 [ 196.761487][ T5388] usb 5-1: USB disconnect, device number 7 [ 196.861366][ T6612] team0: Device gtp0 is of different type [ 197.110197][ T6616] fido_id[6616]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 197.216510][ T6622] netlink: 40 bytes leftover after parsing attributes in process `syz.3.634'. [ 198.198363][ T128] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 198.435791][ T128] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 198.462085][ T128] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 32 [ 198.494567][ T128] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 198.537478][ T128] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.545942][ T128] usb 4-1: Product: syz [ 198.556014][ T128] usb 4-1: Manufacturer: syz [ 198.561176][ T128] usb 4-1: SerialNumber: syz [ 198.606459][ T5388] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 198.785155][ T6654] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 198.798776][ T26] audit: type=1804 audit(1786062131.974:20): pid=6674 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.648" name="/newroot/131/file0/file1" dev="overlay" ino=709 res=1 errno=0 [ 198.814308][ T5388] usb 1-1: config 0 has no interfaces? [ 198.828240][ T5388] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 198.857727][ T5388] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 198.897919][ T5388] usb 1-1: config 0 descriptor?? [ 199.077804][ T6678] loop4: detected capacity change from 0 to 4096 [ 199.133920][ T6667] netlink: 8 bytes leftover after parsing attributes in process `syz.0.646'. [ 199.155520][ T4326] usb 1-1: USB disconnect, device number 9 [ 199.183672][ T6678] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 199.429486][ T6654] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 199.447203][ T4282] EXT4-fs (loop4): unmounting filesystem. [ 199.653160][ T128] cdc_ncm 4-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 199.668113][ T128] cdc_ncm 4-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 199.692369][ T128] cdc_ncm 4-1:1.0: setting rx_max = 2048 [ 199.853789][ T128] cdc_ncm 4-1:1.0: setting tx_max = 88 [ 200.042494][ T6701] loop2: detected capacity change from 0 to 512 [ 200.123857][ T128] cdc_ncm 4-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.3-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 200.153008][ T6701] EXT4-fs error (device loop2): ext4_orphan_get:1431: comm syz.2.656: bad orphan inode 15 [ 200.168708][ T6701] ext4_test_bit(bit=14, block=5) = 0 [ 200.246313][ T128] usb 4-1: USB disconnect, device number 15 [ 200.257939][ T6701] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 200.321399][ T128] cdc_ncm 4-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.3-1, CDC NCM (NO ZLP) [ 200.654882][ T4281] EXT4-fs (loop2): unmounting filesystem. [ 201.302285][ T6734] netlink: 4 bytes leftover after parsing attributes in process `syz.1.667'. [ 201.354829][ T6734] device erspan0 entered promiscuous mode [ 201.404451][ T6734] device macvtap1 entered promiscuous mode [ 201.493164][ T6735] device erspan0 left promiscuous mode [ 201.523957][ T6735] device macvtap1 left promiscuous mode [ 202.070364][ T6752] lo speed is unknown, defaulting to 1000 [ 202.077290][ T6752] lo speed is unknown, defaulting to 1000 [ 202.095508][ T6752] lo speed is unknown, defaulting to 1000 [ 202.125376][ T6752] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 202.146928][ T6752] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 202.261741][ T6758] tipc: Started in network mode [ 202.283477][ T6758] tipc: Node identity 00002d003a2d003a0040ffffe0000001, cluster identity 4711 [ 202.299559][ T6758] tipc: Enabling of bearer rejected, failed to enable media [ 202.314560][ T6752] lo speed is unknown, defaulting to 1000 [ 202.335776][ T6752] lo speed is unknown, defaulting to 1000 [ 202.375649][ T6752] lo speed is unknown, defaulting to 1000 [ 202.424106][ T6752] lo speed is unknown, defaulting to 1000 [ 202.449944][ T6752] lo speed is unknown, defaulting to 1000 [ 202.591186][ T6765] netlink: 8 bytes leftover after parsing attributes in process `syz.4.679'. [ 202.716873][ T6769] netlink: 52 bytes leftover after parsing attributes in process `syz.0.681'. [ 202.779449][ T6769] bridge0: port 2(bridge_slave_1) entered disabled state [ 202.787396][ T6769] bridge0: port 1(bridge_slave_0) entered disabled state [ 202.905446][ T6772] netlink: 52 bytes leftover after parsing attributes in process `syz.0.681'. [ 203.418360][ T4725] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 203.432879][ T6794] svc: failed to register nfsdv3 RPC service (errno 101). [ 203.447200][ T6794] svc: failed to register nfsaclv3 RPC service (errno 101). [ 203.608963][ T4725] usb 5-1: Using ep0 maxpacket: 8 [ 203.620564][ T4725] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 203.625242][ T6794] ================================================================== [ 203.637781][ T6794] BUG: KASAN: use-after-free in nfsd_svc+0x996/0xab0 [ 203.644526][ T6794] Read of size 4 at addr ffff888056fe5854 by task syz.0.692/6794 [ 203.645630][ T4725] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 203.652274][ T6794] [ 203.652302][ T6794] CPU: 1 PID: 6794 Comm: syz.0.692 Not tainted syzkaller #0 [ 203.652323][ T6794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 203.652341][ T6794] Call Trace: [ 203.652350][ T6794] [ 203.652359][ T6794] dump_stack_lvl+0x188/0x24e [ 203.652395][ T6794] ? __lock_acquire+0x7c40/0x7c40 [ 203.681337][ T4725] usb 5-1: Product: syz [ 203.683419][ T6794] ? show_regs_print_info+0x12/0x12 [ 203.683458][ T6794] ? load_image+0x410/0x410 [ 203.690303][ T4725] usb 5-1: Manufacturer: syz [ 203.691132][ T6794] ? __virt_addr_valid+0x467/0x540 [ 203.719878][ T6794] ? nfsd_svc+0x996/0xab0 [ 203.721056][ T4725] usb 5-1: SerialNumber: syz [ 203.724245][ T6794] print_report+0xa8/0x210 [ 203.724278][ T6794] kasan_report+0x10b/0x140 [ 203.737879][ T6794] ? nfsd_svc+0x996/0xab0 [ 203.742272][ T6794] nfsd_svc+0x996/0xab0 [ 203.746496][ T6794] write_threads+0x2ea/0x350 [ 203.751144][ T6794] ? write_unlock_fs+0x1f0/0x1f0 [ 203.756148][ T6794] ? __might_fault+0xc2/0x120 [ 203.760902][ T6794] ? _copy_from_user+0x10b/0x170 [ 203.765901][ T6794] ? simple_transaction_get+0x119/0x140 [ 203.771506][ T6794] nfsctl_transaction_write+0x105/0x150 [ 203.777117][ T6794] ? nfsctl_transaction_read+0x1b0/0x1b0 [ 203.782814][ T6794] vfs_write+0x2dc/0x9a0 [ 203.787210][ T6794] ? file_end_write+0x250/0x250 [ 203.790192][ T4725] usb 5-1: config 0 descriptor?? [ 203.792102][ T6794] ? __fget_files+0x28/0x460 [ 203.801701][ T6794] ? __fget_files+0x3fc/0x460 [ 203.806451][ T6794] ? __fdget_pos+0x2ae/0x360 [ 203.811231][ T6794] ? ksys_write+0x70/0x260 [ 203.815709][ T6794] ksys_write+0x14d/0x260 [ 203.820091][ T6794] ? __ia32_sys_read+0x80/0x80 [ 203.824915][ T6794] ? lockdep_hardirqs_on+0x94/0x140 [ 203.830166][ T6794] do_syscall_64+0x4c/0xa0 [ 203.834636][ T6794] ? clear_bhb_loop+0x60/0xb0 [ 203.839370][ T6794] ? clear_bhb_loop+0x60/0xb0 [ 203.844107][ T6794] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 203.850075][ T6794] RIP: 0033:0x7f5d91d9e0d9 [ 203.854544][ T6794] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 203.874305][ T6794] RSP: 002b:00007f5d92d30028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 203.882818][ T6794] RAX: ffffffffffffffda RBX: 00007f5d92025fa0 RCX: 00007f5d91d9e0d9 [ 203.890844][ T6794] RDX: 0000000000000002 RSI: 0000200000000140 RDI: 0000000000000004 [ 203.898867][ T6794] RBP: 00007f5d91e35024 R08: 0000000000000000 R09: 0000000000000000 [ 203.906896][ T6794] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 203.914964][ T6794] R13: 00007f5d92026038 R14: 00007f5d92025fa0 R15: 00007fffe2afec28 [ 203.922997][ T6794] [ 203.926067][ T6794] [ 203.928424][ T6794] Allocated by task 6794: [ 203.932787][ T6794] kasan_set_track+0x4b/0x70 [ 203.937434][ T6794] __kasan_kmalloc+0x8e/0xa0 [ 203.942106][ T6794] __svc_create+0x60/0x9d0 [ 203.946570][ T6794] svc_create_pooled+0x71f/0x8c0 [ 203.951550][ T6794] nfsd_create_serv+0x2f9/0x700 [ 203.956454][ T6794] nfsd_svc+0x17f/0xab0 [ 203.960660][ T6794] write_threads+0x2ea/0x350 [ 203.965297][ T6794] nfsctl_transaction_write+0x105/0x150 [ 203.970894][ T6794] vfs_write+0x2dc/0x9a0 [ 203.975184][ T6794] ksys_write+0x14d/0x260 [ 203.979563][ T6794] do_syscall_64+0x4c/0xa0 [ 203.984031][ T6794] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 203.989979][ T6794] [ 203.992336][ T6794] Freed by task 6794: [ 203.996350][ T6794] kasan_set_track+0x4b/0x70 [ 204.001079][ T6794] kasan_save_free_info+0x27/0x40 [ 204.006146][ T6794] ____kasan_slab_free+0x126/0x1f0 [ 204.011310][ T6794] slab_free_freelist_hook+0x133/0x1b0 [ 204.015247][ T4725] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 204.016804][ T6794] __kmem_cache_free+0xb6/0x200 [ 204.030079][ T6794] nfsd_svc+0x75e/0xab0 [ 204.034281][ T6794] write_threads+0x2ea/0x350 [ 204.038916][ T6794] nfsctl_transaction_write+0x105/0x150 [ 204.044516][ T6794] vfs_write+0x2dc/0x9a0 [ 204.048819][ T6794] ksys_write+0x14d/0x260 [ 204.053213][ T6794] do_syscall_64+0x4c/0xa0 [ 204.057678][ T6794] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 204.063628][ T6794] [ 204.065992][ T6794] The buggy address belongs to the object at ffff888056fe5800 [ 204.065992][ T6794] which belongs to the cache kmalloc-512 of size 512 [ 204.080186][ T6794] The buggy address is located 84 bytes inside of [ 204.080186][ T6794] 512-byte region [ffff888056fe5800, ffff888056fe5a00) [ 204.093424][ T6794] [ 204.095790][ T6794] The buggy address belongs to the physical page: [ 204.102342][ T6794] page:ffffea00015bf900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x56fe4 [ 204.112582][ T6794] head:ffffea00015bf900 order:2 compound_mapcount:0 compound_pincount:0 [ 204.120960][ T6794] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 204.129023][ T6794] raw: 00fff00000010200 0000000000000000 dead000000000001 ffff888017441c80 [ 204.137650][ T6794] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 204.146264][ T6794] page dumped because: kasan: bad access detected [ 204.152723][ T6794] page_owner tracks the page as allocated [ 204.158475][ T6794] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4286, tgid 4286 (syz-executor), ts 82525097466, free_ts 25204644789 [ 204.179893][ T6794] post_alloc_hook+0x173/0x1a0 [ 204.184807][ T6794] get_page_from_freelist+0x206b/0x2180 [ 204.190421][ T6794] __alloc_pages+0x1ec/0x4f0 [ 204.195158][ T6794] alloc_slab_page+0x5d/0x180 [ 204.199886][ T6794] new_slab+0x87/0x2d0 [ 204.204016][ T6794] ___slab_alloc+0xbc5/0x1240 [ 204.208746][ T6794] __kmem_cache_alloc_node+0x126/0x270 [ 204.214250][ T6794] __kmalloc_node_track_caller+0xa0/0x240 [ 204.220031][ T6794] __alloc_skb+0x226/0x7d0 [ 204.224498][ T6794] alloc_uevent_skb+0x7d/0x230 [ 204.229307][ T6794] kobject_uevent_net_broadcast+0x17e/0x530 [ 204.235261][ T6794] kobject_uevent_env+0x555/0x890 [ 204.240344][ T6794] device_add+0xac2/0x1050 [ 204.244903][ T6794] netdev_register_kobject+0x184/0x320 [ 204.250421][ T6794] register_netdevice+0x133a/0x1b80 [ 204.255675][ T6794] ipvlan_link_new+0x389/0xae0 [ 204.260489][ T6794] page last free stack trace: [ 204.265198][ T6794] free_unref_page_prepare+0x8e5/0x9e0 [ 204.270715][ T6794] free_unref_page+0x2e/0x3f0 [ 204.275447][ T6794] free_contig_range+0x9d/0x150 [ 204.280342][ T6794] destroy_args+0xef/0xa0e [ 204.284814][ T6794] debug_vm_pgtable+0x33c/0x38e [ 204.289717][ T6794] do_one_initcall+0x257/0x800 [ 204.294532][ T6794] do_initcall_level+0x13d/0x1ed [ 204.299524][ T6794] do_initcalls+0x4b/0x8a [ 204.303896][ T6794] kernel_init_freeable+0x401/0x5ab [ 204.309147][ T6794] kernel_init+0x19/0x1b0 [ 204.313522][ T6794] ret_from_fork+0x1f/0x30 [ 204.318014][ T6794] [ 204.320376][ T6794] Memory state around the buggy address: [ 204.326049][ T6794] ffff888056fe5700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 204.334164][ T6794] ffff888056fe5780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 204.342269][ T6794] >ffff888056fe5800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 204.350369][ T6794] ^ [ 204.357171][ T6794] ffff888056fe5880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 204.365281][ T6794] ffff888056fe5900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 204.373381][ T6794] ================================================================== [ 204.443363][ T4725] dvb_usb_rtl28xxu: probe of 5-1:0.0 failed with error -71 [ 204.452197][ T6800] loop2: detected capacity change from 0 to 1024 [ 204.461712][ T4725] usb 5-1: USB disconnect, device number 8 [ 204.506792][ T6800] EXT4-fs: inline encryption not supported [ 204.538350][ T6800] EXT4-fs: Ignoring removed bh option [ 204.543976][ T6794] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 204.551212][ T6794] CPU: 0 PID: 6794 Comm: syz.0.692 Not tainted syzkaller #0 [ 204.558541][ T6794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 204.568644][ T6794] Call Trace: [ 204.571950][ T6794] [ 204.574913][ T6794] dump_stack_lvl+0x188/0x24e [ 204.579632][ T6794] ? memcpy+0x3c/0x60 [ 204.583643][ T6794] ? show_regs_print_info+0x12/0x12 [ 204.588870][ T6794] ? load_image+0x410/0x410 [ 204.593405][ T6794] panic+0x2d3/0x710 [ 204.597333][ T6794] ? bpf_jit_dump+0xd0/0xd0 [ 204.601866][ T6794] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 204.607871][ T6794] ? _raw_spin_unlock+0x40/0x40 [ 204.612747][ T6794] ? print_memory_metadata+0x314/0x400 [ 204.618239][ T6794] check_panic_on_warn+0x80/0xa0 [ 204.623212][ T6794] ? nfsd_svc+0x996/0xab0 [ 204.627565][ T6794] end_report+0x66/0x110 [ 204.631841][ T6794] kasan_report+0x118/0x140 [ 204.636375][ T6794] ? nfsd_svc+0x996/0xab0 [ 204.640734][ T6794] nfsd_svc+0x996/0xab0 [ 204.644924][ T6794] write_threads+0x2ea/0x350 [ 204.649553][ T6794] ? write_unlock_fs+0x1f0/0x1f0 [ 204.654523][ T6794] ? __might_fault+0xc2/0x120 [ 204.659223][ T6794] ? _copy_from_user+0x10b/0x170 [ 204.664186][ T6794] ? simple_transaction_get+0x119/0x140 [ 204.669757][ T6794] nfsctl_transaction_write+0x105/0x150 [ 204.675349][ T6794] ? nfsctl_transaction_read+0x1b0/0x1b0 [ 204.681011][ T6794] vfs_write+0x2dc/0x9a0 [ 204.685290][ T6794] ? file_end_write+0x250/0x250 [ 204.690170][ T6794] ? __fget_files+0x28/0x460 [ 204.694787][ T6794] ? __fget_files+0x3fc/0x460 [ 204.699496][ T6794] ? __fdget_pos+0x2ae/0x360 [ 204.704119][ T6794] ? ksys_write+0x70/0x260 [ 204.708562][ T6794] ksys_write+0x14d/0x260 [ 204.712940][ T6794] ? __ia32_sys_read+0x80/0x80 [ 204.717738][ T6794] ? lockdep_hardirqs_on+0x94/0x140 [ 204.722972][ T6794] do_syscall_64+0x4c/0xa0 [ 204.727419][ T6794] ? clear_bhb_loop+0x60/0xb0 [ 204.732123][ T6794] ? clear_bhb_loop+0x60/0xb0 [ 204.736837][ T6794] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 204.742755][ T6794] RIP: 0033:0x7f5d91d9e0d9 [ 204.747213][ T6794] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 204.766928][ T6794] RSP: 002b:00007f5d92d30028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 204.775391][ T6794] RAX: ffffffffffffffda RBX: 00007f5d92025fa0 RCX: 00007f5d91d9e0d9 [ 204.783383][ T6794] RDX: 0000000000000002 RSI: 0000200000000140 RDI: 0000000000000004 [ 204.791381][ T6794] RBP: 00007f5d91e35024 R08: 0000000000000000 R09: 0000000000000000 [ 204.799375][ T6794] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 204.807370][ T6794] R13: 00007f5d92026038 R14: 00007f5d92025fa0 R15: 00007fffe2afec28 [ 204.815369][ T6794] [ 204.818988][ T6794] Kernel Offset: disabled [ 204.823324][ T6794] Rebooting in 86400 seconds..