last executing test programs: 2m16.541095083s ago: executing program 1 (id=3133): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x21081e, &(0x7f00000001c0)={[{@grpquota}, {@nogrpid}, {@quota}]}, 0x1, 0x50c, &(0x7f0000000ac0)="$eJzs3c9vI1cdAPCvnThxsmmTlh4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKDNShwGzXiS9WbtjbX54Sj+fKTRvDfP6+97yc57yTe2XwAj62ZE7EfERER8GBGz+fVCfsR7nSN93MODByuHBw9WCpEkH/yrkLWn16Lr36Ru5M9ZjogffS/ip4Wn47Z29zaW6/Xp7bw+325szbd29+6sN5bXamu1zWp1aXFp4Z27b1fPbayvNSby0lc//+P+t36edmsmv9I9jvPUGXrpOE5qPCJ+cBHBhmAsH8/EsDvCcylGxMsR8Xp2/8/GWPbdBACusySZjWS2uw4AXHfFLAdWKFbyXMBMFIuVSieH90pMF+vNVvv2/ebO5monVzYXpeL99XptIc8VzkWpkNYXs/LjevVE/W5EvBQRv5ycyuqVlWZ9dZg/+ADACLtxYv3/72Rn/QcArrnysDsAAFw66z8AjB7rPwCMHus/AIyezvo/NexuAACXyO//ADB6rP8AMFJ++P776ZEc5p9/vfrR7s5G86M7q7XWRqWxs1JZaW5vVdaazbXsM3sapz1fvdncWnwrdj6e+/ZWqz3f2t2712jubLbvZZ/rfa9Wyh61fwkjAwD6eem1z/5SSFfkd6eyI7r2cigNtWfARSsOuwPA0IwNuwPA0NjtC0bXGX7Hlx6Aa6LHFr1PKPd6g1CSJMnFdQm4YLe+JP8Po6or/+9VwDBi5P9hdA2Q//cSAbimkqQw6J7/MegDAYCrTY4f6PP3/5fz8+/yPw78ZPXkIz69yF4BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA1Xa0/28l3+hzJorFSiXihYiYi1Lh/nq9thARL0bEnydLk2l9cch9BgDOqvj3Qr7/163ZN2eeaHr1xnFxIiJ+9usPfvXxcru9/aeIicK/J4+utz/Nr1cvv/cAwOmO1unsHI+SJL/+8ODBytFxmf35x3cjotyJf3gwEYfH8cdjPDuXoxQR0/8p5PWOQlfu4iz2P4mIL/YafyFmshxIZ+fTk/HT2C9cavziE/GLWVvnnH4tvnAOfYFR81k6/7zX6/4rxs3s3Pv+L2cz1Nnl81/6VCuH2Rz4OP7R/DfWZ/67OWiMt/7w/U5p6um2TyK+PB5xFPuwa/45il/oE//NAeP/9Suvvt6vLflNxK3oHb871ny7sTXf2t27s95YXqut1Tar1aXFpYV37r5dnc9y1PP9V4N/vnv7xX5t6finu+J3ZtRO1PIp4//6gOP/7f8+/PHXnhH/m2/0Gn8xXnlG/HRN/MaA8Zenf1/u15bGX+3z9T/t+397wPif/23vqW3DAYDhae3ubSzX67VtBYWrX0j/y16BbvQsfOeyYk1E76ZfvNG5p080Jclzxeo3Y5xH1g24Co5v+oh4NOzOAAAAAAAAAAAAAAAAPZ18989kRJz3O5aGPUYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACur/8HAAD//9q5zQ4=") r0 = openat(0xffffffffffffff9c, 0x0, 0x42042, 0x138) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x40) pwrite64(r1, &(0x7f0000000140)='2', 0xfdef, 0xfecc) fallocate(r0, 0x10, 0x10c00, 0x8000) 2m15.629825052s ago: executing program 1 (id=3136): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x0, 0x0, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x2b, 0x3f, 0x68, 0x0, 0x60, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, {[@timestamp={0x44, 0x4, 0xf0, 0x0, 0x1}]}}, "11f3305280f125e6e11a9314b296b53b5d25867c0a8c27b6478984da4eb57d56be4ee0efb45c21"}}, 0x4d) 2m13.65488598s ago: executing program 1 (id=3145): sendmsg$rds(0xffffffffffffffff, 0x0, 0x40080) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./my_debugfs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./my_debugfs\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./my_debugfs/usb/devices\x00', 0x0, 0x0) read(r0, &(0x7f0000000500)=""/100, 0x7ffe) 2m12.723750095s ago: executing program 1 (id=3147): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) acct(&(0x7f0000000100)='./file1\x00') acct(0x0) acct(0x0) acct(0x0) mount(0x0, &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./pipefs/gssd/clntXX/gssd\x00', 0x2, 0x0) r0 = fsopen(&(0x7f0000000300)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000400)='source\x00', &(0x7f0000000500)='127.0.0.1:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000600)='addr\x00', &(0x7f0000000700)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000a00)='vers\x00', &(0x7f0000000b00)='4.0\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 2m12.354858825s ago: executing program 1 (id=3150): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) syz_usb_connect(0x2, 0x24, &(0x7f0000001b40)={{0x12, 0x1, 0x300, 0xaa, 0x7c, 0x5f, 0x20, 0xeb1, 0x7007, 0x208, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x35, 0x2, 0x50, 0xa0, "", [{{0x9, 0x4, 0x9a, 0x4, 0x0, 0x66, 0x97, 0x5c, 0x1}}]}}]}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r3) sendmsg$NLBL_MGMT_C_ADDDEF(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000040000001400050003030000000a0000005dc00006000000080002000500000014000600ff01000a00f2f3f31f000a0000000001060001"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x4040000) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000180)="f5", 0x1}], 0x1, 0x0, 0x0, 0x4044040}}], 0x1, 0x40015) sendmsg$NLBL_MGMT_C_ADDDEF(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x24008000}, 0x4040000) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys_mnt\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/module/damon_reclaim/parameters/enabled\x00', 0x1, 0x0) write(r5, &(0x7f0000000240)='TH', 0x2) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8931, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@mpls_delroute={0x24, 0x18, 0x9, 0x70bd28, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_TTL_PROPAGATE={0x5, 0x1a, 0xb}]}, 0x24}}, 0x0) 2m5.177760385s ago: executing program 1 (id=3166): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0xc054) socket(0x1e, 0x4, 0x0) write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="5001", @ANYRES8=r1], 0x14) 2m0.76764225s ago: executing program 0 (id=3178): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) recvmmsg(r0, &(0x7f0000000fc0)=[{{0x0, 0x0, 0x0}, 0xd}, {{0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000c40)=""/241, 0xf1}], 0x1}, 0x81620c3}], 0x2, 0x10002, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0], 0x48}}, 0x0) 1m58.706172287s ago: executing program 0 (id=3181): r0 = socket$inet_tcp(0x2, 0x1, 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x6) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000)=0x800, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) listen(r0, 0x5) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e24, @loopback}, 0x10) r3 = accept$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000180), 0x4) setsockopt$inet_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000200)=@gcm_128={{0x303}, "1234567812345678", "12345678123456781234567812345678", "12345678", "1234567812345678"}, 0x28) setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000180), 0x4) setsockopt$inet_tcp_TLS_RX(r3, 0x11a, 0x2, &(0x7f0000000200)=@gcm_128={{0x303}, "1234567812345678", "12345678123456781234567812345678", "12345678", "1234567812345678"}, 0x28) sendto$inet(r1, &(0x7f0000000300)='\x00', 0x4000, 0x40, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000400), 0x4000, 0x0, 0x0, 0x0) 1m58.183248952s ago: executing program 4 (id=3185): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n', @ANYRES32=0x0, @ANYBLOB='\b\x00'], 0x30}}, 0x0) r1 = socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001040)=ANY=[@ANYBLOB="200000001600010a00000000000000000a0000000c00008008"], 0x20}, 0x1, 0x0, 0x0, 0x20040041}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r1) 1m57.757764087s ago: executing program 3 (id=3187): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00006dbffc), 0x4) sendmsg$xdp(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)="0000000000aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9de3350c0a498396b28c7d1784d04aa38922721cb7816094cb82950fd012efd26d", 0x5a}, {&(0x7f0000000900)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000003c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c9e6045c361eb", 0x36}], 0x3}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) 1m57.563476558s ago: executing program 3 (id=3188): socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$kcm(0x11, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) socket(0x2, 0x80805, 0x0) r0 = open(&(0x7f0000000280)='.\x00', 0x20000, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c00000003080102000000074441980000000000050003"], 0x1c}, 0x1, 0x0, 0x0, 0x24008851}, 0xbe2763db2f8a9c7d) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000180), 0xfea7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r3 = openat$cgroup_ro(r0, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r5, @ANYBLOB="ff830500000700ffffff", @ANYRES8=r0], 0x4}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendfile(r4, r3, 0x0, 0x100000002) 1m57.545226355s ago: executing program 0 (id=3189): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x42141, 0x0) close(r6) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b929, 0x25dfdc01, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0xd, 0xb}, {0x8, 0xf}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 1m57.398515911s ago: executing program 4 (id=3190): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) recvmmsg(r0, &(0x7f0000000fc0)=[{{0x0, 0x0, 0x0}, 0xd}, {{0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000c40)=""/241, 0xf1}], 0x1}, 0x81620c3}], 0x2, 0x10002, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0], 0x48}}, 0x0) 1m56.884483382s ago: executing program 2 (id=3191): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) syz_usb_connect(0x2, 0x24, &(0x7f0000001b40)={{0x12, 0x1, 0x300, 0xaa, 0x7c, 0x5f, 0x20, 0xeb1, 0x7007, 0x208, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x35, 0x2, 0x50, 0xa0, "", [{{0x9, 0x4, 0x9a, 0x4, 0x0, 0x66, 0x97, 0x5c, 0x1}}]}}]}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r3) sendmsg$NLBL_MGMT_C_ADDDEF(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000040000001400050003030000000a0000005dc00006000000080002000500000014000600ff01000a00f2f3f31f000a0000000001060001"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x4040000) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000180)="f5", 0x1}], 0x1, 0x0, 0x0, 0x4044040}}], 0x1, 0x40015) sendmsg$NLBL_MGMT_C_ADDDEF(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x24008000}, 0x4040000) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys_mnt\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/module/damon_reclaim/parameters/enabled\x00', 0x1, 0x0) write(r5, &(0x7f0000000240)='TH', 0x2) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8931, &(0x7f0000000a80)={'dummy0\x00'}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, 0x0, 0x0) 1m56.837751704s ago: executing program 3 (id=3192): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001000010000000000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB='\b\x00'], 0x30}}, 0x0) r1 = socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001040)=ANY=[@ANYBLOB="200000001600010a00000000000000000a0000000c00008008"], 0x20}, 0x1, 0x0, 0x0, 0x20040041}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r1) 1m56.535817615s ago: executing program 3 (id=3193): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0xc054) r4 = socket(0x1e, 0x4, 0x0) write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="5001", @ANYRES16=r4], 0x14) 1m56.481839557s ago: executing program 0 (id=3194): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x100) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1d, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b70000008100003bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071104200000000001d400500000000004704000001ed00000703000000000000cd440000000000006b0a00fe000000007303000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646c0200000000000000020000e35208b0bb0d2cd829e654400e2438ec649dc76128610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda82fc9c4d7ecc7a803bf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714f62ba7a54f0c33d39000d0bfed3a6a59ff616236fd8f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a107464ffffff7f00000000617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce963b0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06fa2e04cfe0649226c697d9e8eaade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00023ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88f15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40fc5d2f55ff07c53147de202ce517b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661061173f359e9052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff26b61aac8aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e26534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c3f000000315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336dfaa6d5d164301190bc2d4c04087729033342045804a28082abc3b47623028271722fb515f31e0dd115a292f1e68481a62cd15ea5460a29c60b1058fb7aa9bf4ee3cbe11b03711a15d730646b72d074dab1e8c429339f3460d324c17a4a8bfc7d7eab45bef00664d6dc8230"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, &(0x7f00000003c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@nfs_export_on}]}) syz_open_dev$ptys(0xc, 0x3, 0x1) unlinkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0x200) 1m56.285079263s ago: executing program 4 (id=3195): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0xa0380, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8000) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffff8, {0x0, 0x0, 0x0, r4, {0xb, 0xd}, {}, {0x8}}}, 0x24}}, 0x40004) recvmmsg(r5, &(0x7f0000000b40)=[{{0x0, 0x0, &(0x7f0000009f00)}, 0x3}], 0x1, 0x40010022, 0x0) 1m54.806920327s ago: executing program 3 (id=3196): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}], 0x70}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0x1, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 1m54.271880498s ago: executing program 4 (id=3197): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)="0000000000aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9de3350c0a498396b28c7d1784d04aa38922721cb7816094cb82950fd012efd26d", 0x5a}, {&(0x7f0000000900)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000003c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c9e6045c361eb", 0x36}], 0x3}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) 1m53.450164552s ago: executing program 2 (id=3198): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={0x28, 0x0, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_TAGLST={0x4}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}]}, 0x28}}, 0x0) 1m52.983415123s ago: executing program 4 (id=3199): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0xa0380, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8000) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffff8, {0x0, 0x0, 0x0, r4, {0xb, 0xd}, {}, {0x8}}}, 0x24}}, 0x40004) recvmmsg(r5, 0x0, 0x0, 0x40010022, 0x0) 1m52.545780587s ago: executing program 2 (id=3200): sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001800)={&(0x7f00000014c0)=ANY=[@ANYBLOB, @ANYRES16, @ANYBLOB="010027bd7000fedbdf25150000004c000980080002000a000000080002009e10000008000100880200000800010003000000080001"], 0x304}, 0x1, 0x0, 0x0, 0x8951}, 0x20044000) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000014c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000fcdbdf250100000008000100000000000400048008000200010000001c0008800400078814000780080006"], 0x44}}, 0x0) 1m51.865349667s ago: executing program 2 (id=3201): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newlink={0x20, 0x12, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00}}, 0x20}}, 0x0) read(r0, &(0x7f0000000140)=""/166, 0xa6) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="7800000010000305000000000000000000cf0100", @ANYRES32=0x0, @ANYBLOB="83000000000000002000128008000100677265"], 0x78}}, 0x0) 1m51.559552946s ago: executing program 0 (id=3202): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000540), r0) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={0x38, r1, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_TAGLST={0x14, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x2}, {0x5, 0x3, 0x6}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}]}, 0x38}}, 0x0) 1m51.147844981s ago: executing program 0 (id=3203): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000008c0)=ANY=[@ANYBLOB="381700001800290200000000ffdb"], 0x1738}}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1m50.378740485s ago: executing program 2 (id=3204): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c0200", @ANYRES16=r1, @ANYBLOB="010000000000000000000100000024000300a05ca84f6c9c8e3853e2fd7a70ae0fb20fa152600cb00845174f08076f8d7843e40108804400202024000100000000000100000000000000fdffff01000000000000000000000000000000001400040003000000ac1414bb00000000000000000600050000000000000100802400020073e591ec06154031d3954ac0e16752e72640f08b5281a8461d17d26d12f2bbb6060005000021000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39228c00098028000080"], 0x22c}}, 0x0) 1m50.375139008s ago: executing program 3 (id=3205): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0xc054) r4 = socket(0x1e, 0x4, 0x0) write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="5001", @ANYRES16=r4], 0x14) 1m50.171437533s ago: executing program 4 (id=3206): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0x3, 0x0, 0xe4}]}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x4, 0x4) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000b80)="91f8a9848519def38491bbc4173c3c6f357d0272b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b78938a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5e9838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d500891e58a3f851ff5c85244beacba25d854577d68ca555e88fc249340ab9bdd86", 0xc5}], 0x1}}, {{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000e40)="31fdffffffffffffff74098b2e5e55a1828636f60fbf", 0x16}], 0x1}}], 0x2, 0x2090) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 1m49.845199007s ago: executing program 2 (id=3207): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) syz_usb_connect(0x2, 0x24, &(0x7f0000001b40)={{0x12, 0x1, 0x300, 0xaa, 0x7c, 0x5f, 0x20, 0xeb1, 0x7007, 0x208, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x35, 0x2, 0x50, 0xa0, "", [{{0x9, 0x4, 0x9a, 0x4, 0x0, 0x66, 0x97, 0x5c, 0x1}}]}}]}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r3) sendmsg$NLBL_MGMT_C_ADDDEF(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000040000001400050003030000000a0000005dc00006000000080002000500000014000600ff01000a00f2f3f31f000a0000000001060001"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x4040000) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000180)="f5", 0x1}], 0x1, 0x0, 0x0, 0x4044040}}], 0x1, 0x40015) sendmsg$NLBL_MGMT_C_ADDDEF(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x24008000}, 0x4040000) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys_mnt\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys_mnt/module/damon_reclaim/parameters/enabled\x00', 0x1, 0x0) write(r5, &(0x7f0000000240)='TH', 0x2) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8931, &(0x7f0000000a80)={'dummy0\x00'}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, 0x0, 0x0) 0s ago: executing program 32 (id=3203): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000008c0)=ANY=[@ANYBLOB="381700001800290200000000ffdb"], 0x1738}}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) kernel console output (not intermixed with test programs): [ 823.291449][ T6592] f2fs_write_end_bio+0x1211/0x16e0 [ 823.291471][ T6592] ? blkg_put+0x22/0x240 [ 823.291508][ T6592] __submit_merged_bio+0x258/0x6a0 [ 823.291533][ T6592] ? rcu_is_watching+0x16/0xb0 [ 823.291559][ T6592] __submit_merged_write_cond+0x3c9/0x4e0 [ 823.291592][ T6592] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 823.291639][ T6592] f2fs_write_data_pages+0x2a27/0x36f0 [ 823.291699][ T6592] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 823.291738][ T6592] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 823.291810][ T6592] ? __lock_acquire+0x6df/0x2e50 [ 823.291852][ T6592] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 823.291880][ T6592] do_writepages+0x338/0x560 [ 823.291903][ T6592] ? do_raw_spin_lock+0x12b/0x2f0 [ 823.291931][ T6592] ? reacquire_held_locks+0x117/0x1a0 [ 823.291951][ T6592] ? writeback_sb_inodes+0x450/0x1b00 [ 823.291983][ T6592] __writeback_single_inode+0x136/0x1220 [ 823.292014][ T6592] ? do_raw_spin_unlock+0xf5/0x200 [ 823.292042][ T6592] writeback_sb_inodes+0x9de/0x1b00 [ 823.292093][ T6592] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 823.292160][ T6592] ? rcu_is_watching+0x16/0xb0 [ 823.292180][ T6592] ? queue_io+0x2d3/0x470 [ 823.292209][ T6592] wb_writeback+0x41c/0xad0 [ 823.292238][ T6592] ? queue_io+0x1e1/0x470 [ 823.292270][ T6592] ? __pfx_wb_writeback+0x10/0x10 [ 823.292293][ T6592] ? do_raw_spin_lock+0x12b/0x2f0 [ 823.292333][ T6592] wb_workfn+0x431/0x10f0 [ 823.292373][ T6592] ? __pfx_wb_workfn+0x10/0x10 [ 823.292398][ T6592] ? rcu_is_watching+0x16/0xb0 [ 823.292419][ T6592] ? trace_hrtimer_start+0x82/0x200 [ 823.292456][ T6592] ? do_raw_spin_lock+0x12b/0x2f0 [ 823.292487][ T6592] ? lock_acquire+0x115/0x350 [ 823.292514][ T6592] ? rcu_is_watching+0x16/0xb0 [ 823.292536][ T6592] ? process_scheduled_works+0x97a/0x1630 [ 823.292560][ T6592] process_scheduled_works+0xc3d/0x1630 [ 823.292612][ T6592] ? __pfx_process_scheduled_works+0x10/0x10 [ 823.292643][ T6592] ? assign_work+0x3cf/0x5d0 [ 823.292670][ T6592] worker_thread+0xa47/0xfb0 [ 823.292706][ T6592] ? __kthread_parkme+0x71/0x1f0 [ 823.292741][ T6592] kthread+0x38b/0x480 [ 823.292760][ T6592] ? __pfx_worker_thread+0x10/0x10 [ 823.292782][ T6592] ? __pfx_kthread+0x10/0x10 [ 823.292800][ T6592] ret_from_fork+0x514/0xb70 [ 823.292831][ T6592] ? __pfx_ret_from_fork+0x10/0x10 [ 823.292858][ T6592] ? __switch_to+0xc89/0x1420 [ 823.292885][ T6592] ? __pfx_kthread+0x10/0x10 [ 823.292904][ T6592] ret_from_fork_asm+0x1a/0x30 [ 823.292945][ T6592] [ 823.294523][ T6592] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 823.891397][T14941] overlayfs: missing 'lowerdir' [ 824.669314][T14955] fuse: Bad value for 'fd' [ 824.696577][T14957] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2414'. [ 825.577716][ T988] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 825.686183][T14967] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 825.727051][ T988] usb 2-1: device descriptor read/64, error -71 [ 826.087008][ T988] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 826.237034][ T988] usb 2-1: device descriptor read/64, error -71 [ 826.367097][ T988] usb usb2-port1: attempt power cycle [ 827.149053][ T988] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 827.178439][ T988] usb 2-1: device descriptor read/8, error -71 [ 827.357055][ T4943] usb 1-1: new high-speed USB device number 75 using dummy_hcd [ 827.387987][T14995] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2426'. [ 827.619588][T14999] overlayfs: missing 'lowerdir' [ 827.740632][ T31] audit: type=1107 audit(1786619201.823:81): pid=14997 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 827.755180][ T988] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 828.234299][ T988] usb 2-1: device descriptor read/8, error -71 [ 828.267033][ T4943] usb 1-1: Using ep0 maxpacket: 16 [ 828.269054][ T4943] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 828.274343][ T4943] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 828.274372][ T4943] usb 1-1: Product: syz [ 828.274401][ T4943] usb 1-1: Manufacturer: syz [ 828.274418][ T4943] usb 1-1: SerialNumber: syz [ 828.417501][ T988] usb usb2-port1: unable to enumerate USB device [ 828.424569][ T4943] usb 1-1: config 0 descriptor?? [ 828.441640][ T4943] asix 1-1:0.0: probe with driver asix failed with error -22 [ 828.478458][T15007] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2429'. [ 828.501414][T15007] ip6gre1: entered promiscuous mode [ 828.501460][T15007] ip6gre1: entered allmulticast mode [ 828.553391][T15008] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 828.644047][T14987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 828.653263][T14987] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 828.669110][ T5731] usb 1-1: USB disconnect, device number 75 [ 828.848552][T15014] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2433'. [ 830.798680][T15019] 9pnet_fd: p9_fd_create_tcp (15019): problem connecting socket to 127.0.0.1 [ 830.880248][T15038] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 831.062545][T15043] loop1: detected capacity change from 0 to 128 [ 831.127036][ T5766] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 832.188564][ T5766] usb 1-1: device descriptor read/64, error -71 [ 832.200783][T15043] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 832.325121][T15043] ext4 filesystem being mounted at /473/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 832.711672][T15074] overlayfs: missing 'lowerdir' [ 832.928512][ T5766] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 833.012298][T15078] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2451'. [ 833.028964][ T5614] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 833.081141][ T5766] usb 1-1: device descriptor read/64, error -71 [ 833.187376][ T5766] usb usb1-port1: attempt power cycle [ 833.537036][ T5766] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 833.567673][ T5766] usb 1-1: device descriptor read/8, error -71 [ 833.818618][ T5766] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 833.848031][ T5766] usb 1-1: device descriptor read/8, error -71 [ 833.854375][T15092] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2457'. [ 834.136671][ T5766] usb usb1-port1: unable to enumerate USB device [ 834.290573][T15092] bridge4: port 1(veth7) entered blocking state [ 834.670407][ T59] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 834.700556][T15092] bridge4: port 1(veth7) entered disabled state [ 834.708350][T15092] veth7: entered allmulticast mode [ 834.721343][T15092] veth7: entered promiscuous mode [ 836.247821][T15138] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2473'. [ 836.452642][T15138] bridge0: port 1(veth5) entered blocking state [ 836.454023][T15138] bridge0: port 1(veth5) entered disabled state [ 836.454173][T15138] veth5: entered allmulticast mode [ 836.461791][T15138] veth5: entered promiscuous mode [ 836.690775][T15126] loop0: detected capacity change from 0 to 40427 [ 836.692980][T15126] F2FS-fs (loop0): invalid crc value [ 836.943406][T15126] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 836.978997][T15126] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 837.319166][T15155] overlayfs: missing 'lowerdir' [ 838.193505][ T5621] syz-executor: attempt to access beyond end of device [ 838.193505][ T5621] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 838.219723][ T5621] CPU: 1 UID: 0 PID: 5621 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 838.219757][ T5621] Tainted: [L]=SOFTLOCKUP [ 838.219765][ T5621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 838.219777][ T5621] Call Trace: [ 838.219787][ T5621] [ 838.219796][ T5621] dump_stack_lvl+0xe8/0x150 [ 838.219831][ T5621] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 838.219866][ T5621] f2fs_write_end_bio+0x1211/0x16e0 [ 838.219890][ T5621] ? blkg_put+0x22/0x240 [ 838.219935][ T5621] __submit_merged_bio+0x258/0x6a0 [ 838.219961][ T5621] ? rcu_is_watching+0x16/0xb0 [ 838.219991][ T5621] __submit_merged_write_cond+0x3c9/0x4e0 [ 838.220028][ T5621] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 838.220083][ T5621] f2fs_write_data_pages+0x2a27/0x36f0 [ 838.220155][ T5621] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 838.220242][ T5621] ? ktime_get+0x45/0x220 [ 838.220270][ T5621] ? __bfs+0x153/0x290 [ 838.220288][ T5621] ? __pfx_hlock_conflict+0x10/0x10 [ 838.220333][ T5621] ? lockdep_unlock+0x5c/0xd0 [ 838.220358][ T5621] ? __lock_acquire+0x14b9/0x2e50 [ 838.220410][ T5621] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 838.220440][ T5621] do_writepages+0x338/0x560 [ 838.220478][ T5621] ? do_raw_spin_unlock+0xf5/0x200 [ 838.220509][ T5621] filemap_fdatawrite+0x1e9/0x2f0 [ 838.220538][ T5621] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 838.220617][ T5621] ? do_raw_spin_unlock+0xf5/0x200 [ 838.220647][ T5621] f2fs_sync_dirty_inodes+0x30e/0x830 [ 838.220685][ T5621] f2fs_write_checkpoint+0xa3d/0x2710 [ 838.220705][ T5621] ? __lock_acquire+0x6df/0x2e50 [ 838.220762][ T5621] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 838.220826][ T5621] ? try_to_wake_up+0x8b6/0x14d0 [ 838.220865][ T5621] kill_f2fs_super+0x2dd/0x700 [ 838.220906][ T5621] ? __pfx_kill_f2fs_super+0x10/0x10 [ 838.220950][ T5621] ? call_rcu+0x64d/0x8b0 [ 838.220972][ T5621] ? lockdep_hardirqs_on+0x7b/0x110 [ 838.221019][ T5621] deactivate_locked_super+0xbc/0x110 [ 838.221053][ T5621] cleanup_mnt+0x3d3/0x460 [ 838.221081][ T5621] task_work_run+0x1d9/0x270 [ 838.221106][ T5621] ? __pfx_task_work_run+0x10/0x10 [ 838.221140][ T5621] exit_to_user_mode_loop+0x204/0x770 [ 838.221160][ T5621] ? rcu_is_watching+0x16/0xb0 [ 838.221193][ T5621] do_syscall_64+0x328/0x520 [ 838.221220][ T5621] ? trace_irq_disable+0x3b/0x140 [ 838.221238][ T5621] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 838.221259][ T5621] ? clear_bhb_loop+0x70/0xc0 [ 838.221284][ T5621] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 838.221304][ T5621] RIP: 0033:0x7f8dad99f317 [ 838.221323][ T5621] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 838.221341][ T5621] RSP: 002b:00007ffdf4f1d678 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 838.221362][ T5621] RAX: 0000000000000000 RBX: 00007f8dada34474 RCX: 00007f8dad99f317 [ 838.221376][ T5621] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdf4f1d730 [ 838.221389][ T5621] RBP: 00007ffdf4f1d730 R08: 00007ffdf4f1e730 R09: 00000000ffffffff [ 838.221402][ T5621] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdf4f1e7c0 [ 838.221415][ T5621] R13: 00007f8dada34474 R14: 00000000000cc957 R15: 00007ffdf4f1e800 [ 838.221451][ T5621] [ 838.590741][ T5621] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 839.157955][T15162] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2480'. [ 839.958852][T15173] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 840.744419][ T10] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 840.772072][T15195] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2491'. [ 840.842690][T15198] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 840.899213][ T10] usb 1-1: New USB device found, idVendor=046d, idProduct=c626, bcdDevice= 0.40 [ 840.900250][ T10] usb 1-1: too many endpoints for config 1 interface 0 altsetting 13: 65, using maximum allowed: 30 [ 840.900307][ T10] usb 1-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 65 [ 840.900337][ T10] usb 1-1: config 1 interface 0 has no altsetting 0 [ 840.905836][ T10] usb 1-1: string descriptor 0 read error: -22 [ 840.908885][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 841.066740][ T988] usb 2-1: new full-speed USB device number 64 using dummy_hcd [ 841.093442][T15204] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 842.553522][ T10] hid_parser_main: 453 callbacks suppressed [ 842.553548][ T10] logitech 0003:046D:C626.0041: unknown main item tag 0x2 [ 842.553578][ T10] logitech 0003:046D:C626.0041: unexpected long global item [ 842.560860][ T10] logitech 0003:046D:C626.0041: parse failed [ 842.560964][ T10] logitech 0003:046D:C626.0041: probe with driver logitech failed with error -22 [ 842.614071][ T988] usb 2-1: not running at top speed; connect to a high speed hub [ 842.615442][ T988] usb 2-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice= 1.00 [ 842.636130][ T988] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 842.636172][ T988] usb 2-1: Product: syz [ 842.636208][ T988] usb 2-1: Manufacturer: syz [ 842.636226][ T988] usb 2-1: SerialNumber: syz [ 842.677986][ T988] keyspan 2-1:1.0: Keyspan 4 port adapter converter detected [ 842.703711][ T988] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 842.729444][ T988] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 842.782507][ T988] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 842.800288][ T988] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 843.756472][ T988] usb 2-1: USB disconnect, device number 64 [ 843.796321][ T988] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 843.836103][ T988] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 843.853425][ T988] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 843.868511][ T988] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 843.879335][ T988] keyspan 2-1:1.0: device disconnected [ 843.889424][T15230] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 844.226819][ T5731] usb 1-1: USB disconnect, device number 80 [ 844.351643][T15241] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2504'. [ 844.553197][T15249] loop1: detected capacity change from 0 to 512 [ 844.561111][T15249] ext4: Unknown parameter 'subj_type' [ 844.768356][T15255] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 844.768356][T15255] The task syz.1.2508 (15255) triggered the difference, watch for misbehavior. [ 844.957675][T15259] overlayfs: failed to clone upperpath [ 846.353045][T15271] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 846.482697][T15280] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2516'. [ 847.462446][T15301] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2522'. [ 848.500425][T15313] Process accounting resumed [ 848.894012][T15346] netlink: 'syz.2.2533': attribute type 83 has an invalid length. [ 848.993541][T15348] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2535'. [ 849.088248][T15354] loop0: detected capacity change from 0 to 512 [ 849.108913][T15354] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 849.131451][T15354] EXT4-fs (loop0): 1 truncate cleaned up [ 849.140584][T15354] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 849.727820][T15369] tipc: Started in network mode [ 849.727875][T15369] tipc: Node identity ac141441, cluster identity 4711 [ 849.734012][T15369] tipc: Enabled bearer , priority 10 [ 849.905905][ T5621] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 850.096422][T15355] Process accounting resumed [ 850.962793][ T5731] tipc: Node number set to 2886997057 [ 851.325122][T15395] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2547'. [ 852.496533][T15425] overlayfs: missing 'workdir' [ 852.560741][T15428] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2559'. [ 852.624050][T15430] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2560'. [ 853.163986][T15442] ip6gre1: entered promiscuous mode [ 853.183663][T15442] ip6gre1: entered allmulticast mode [ 853.623501][T15456] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2571'. [ 853.937106][ T9] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 854.658334][ T9] usb 2-1: New USB device found, idVendor=046d, idProduct=c626, bcdDevice= 0.40 [ 854.659413][ T9] usb 2-1: too many endpoints for config 1 interface 0 altsetting 13: 65, using maximum allowed: 30 [ 854.659452][ T9] usb 2-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 65 [ 854.659476][ T9] usb 2-1: config 1 interface 0 has no altsetting 0 [ 854.662075][ T9] usb 2-1: string descriptor 0 read error: -22 [ 854.662196][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 854.741639][T15473] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2577'. [ 854.975143][T15476] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2579'. [ 854.982549][T15476] ip6gre1: entered promiscuous mode [ 854.982577][T15476] ip6gre1: entered allmulticast mode [ 855.419441][ T9] usbhid 2-1:1.0: can't add hid device: -71 [ 855.420122][ T9] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 855.512795][ T9] usb 2-1: USB disconnect, device number 65 [ 856.398476][T15502] loop0: detected capacity change from 0 to 164 [ 858.424218][T15517] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2589'. [ 858.658104][T15523] loop0: detected capacity change from 0 to 128 [ 858.717228][T15523] syz.0.2592: attempt to access beyond end of device [ 858.717228][T15523] loop0: rw=2049, sector=178, nr_sectors = 4 limit=128 [ 858.733517][T15522] syz.0.2592: attempt to access beyond end of device [ 858.733517][T15522] loop0: rw=2049, sector=138, nr_sectors = 40 limit=128 [ 858.789036][T15521] tipc: Enabled bearer , priority 10 [ 859.257050][ T5731] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 859.407429][ T5731] usb 1-1: Using ep0 maxpacket: 16 [ 859.416373][ T5731] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 859.436015][ T5731] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 859.436060][ T5731] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 859.462900][ T5731] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 859.462963][ T5731] usb 1-1: Product: syz [ 859.463003][ T5731] usb 1-1: Manufacturer: syz [ 859.463021][ T5731] usb 1-1: SerialNumber: syz [ 859.638304][ T5731] usb 1-1: config 0 descriptor?? [ 859.692609][T15539] Process accounting resumed [ 859.949649][ T9] usb 1-1: USB disconnect, device number 81 [ 860.159248][ T5795] tipc: Node number set to 2763364384 [ 860.167996][ T988] Process accounting resumed [ 860.423265][T15561] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2602'. [ 861.412029][T15558] Process accounting resumed [ 862.934777][T15610] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2617'. [ 862.960151][T15611] loop0: detected capacity change from 0 to 1024 [ 862.970348][T15611] EXT4-fs: Ignoring removed bh option [ 862.980799][T15611] EXT4-fs (loop0): stripe (17) is not aligned with cluster size (16), stripe is disabled [ 863.014343][T15611] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 863.306153][T15593] loop1: detected capacity change from 0 to 40427 [ 863.400616][T15593] F2FS-fs (loop1): Corrupted extension count (64 + 1 > 64) [ 863.400661][T15593] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 863.401047][T15593] F2FS-fs (loop1): Image doesn't support compression [ 863.403474][T15593] F2FS-fs (loop1): invalid crc value [ 863.724767][T15593] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 863.790271][T15593] F2FS-fs (loop1): f2fs_disable_checkpoint starts, unusable: 0 [ 863.790322][T15593] F2FS-fs (loop1): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 863.790347][T15593] F2FS-fs (loop1): Start checkpoint disabled! [ 864.121675][T15593] F2FS-fs (loop1): f2fs_disable_checkpoint finishes, err:0 [ 864.437621][T15635] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2622'. [ 864.499160][T15593] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 864.499320][T15593] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 864.718529][T15593] F2FS-fs (loop1): ino:10, start:0, end:8192, need to trigger GC to reclaim enough free segment when checkpoint is enabled [ 864.853680][ T6592] kworker/u8:12: attempt to access beyond end of device [ 864.853680][ T6592] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 864.874708][ T6592] CPU: 0 UID: 0 PID: 6592 Comm: kworker/u8:12 Tainted: G L syzkaller #0 PREEMPT(full) [ 864.874741][ T6592] Tainted: [L]=SOFTLOCKUP [ 864.874748][ T6592] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 864.874761][ T6592] Workqueue: writeback wb_workfn (flush-7:1) [ 864.874796][ T6592] Call Trace: [ 864.874804][ T6592] [ 864.874814][ T6592] dump_stack_lvl+0xe8/0x150 [ 864.874844][ T6592] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 864.874877][ T6592] f2fs_write_end_bio+0x1211/0x16e0 [ 864.874900][ T6592] ? blkg_put+0x22/0x240 [ 864.874943][ T6592] __submit_merged_bio+0x258/0x6a0 [ 864.874968][ T6592] ? rcu_is_watching+0x16/0xb0 [ 864.874997][ T6592] __submit_merged_write_cond+0x3c9/0x4e0 [ 864.875034][ T6592] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 864.875087][ T6592] f2fs_write_data_pages+0x2a27/0x36f0 [ 864.875155][ T6592] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 864.875198][ T6592] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 864.875283][ T6592] ? __lock_acquire+0x6df/0x2e50 [ 864.875327][ T6592] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 864.875357][ T6592] do_writepages+0x338/0x560 [ 864.875383][ T6592] ? do_raw_spin_lock+0x12b/0x2f0 [ 864.875413][ T6592] ? reacquire_held_locks+0x117/0x1a0 [ 864.875435][ T6592] ? writeback_sb_inodes+0x450/0x1b00 [ 864.875470][ T6592] __writeback_single_inode+0x136/0x1220 [ 864.875502][ T6592] ? do_raw_spin_unlock+0xf5/0x200 [ 864.875532][ T6592] writeback_sb_inodes+0x9de/0x1b00 [ 864.875591][ T6592] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 864.875678][ T6592] ? rcu_is_watching+0x16/0xb0 [ 864.875701][ T6592] ? queue_io+0x2d3/0x470 [ 864.875733][ T6592] wb_writeback+0x41c/0xad0 [ 864.875765][ T6592] ? queue_io+0x1e1/0x470 [ 864.875799][ T6592] ? __pfx_wb_writeback+0x10/0x10 [ 864.875825][ T6592] ? do_raw_spin_lock+0x12b/0x2f0 [ 864.875869][ T6592] wb_workfn+0x431/0x10f0 [ 864.875916][ T6592] ? __pfx_wb_workfn+0x10/0x10 [ 864.875943][ T6592] ? irqentry_exit+0x218/0x910 [ 864.875972][ T6592] ? lockdep_hardirqs_on+0x7b/0x110 [ 864.876006][ T6592] ? do_raw_spin_lock+0x12b/0x2f0 [ 864.876042][ T6592] ? lock_acquire+0x115/0x350 [ 864.876072][ T6592] ? rcu_is_watching+0x16/0xb0 [ 864.876096][ T6592] ? process_scheduled_works+0x97a/0x1630 [ 864.876122][ T6592] process_scheduled_works+0xc3d/0x1630 [ 864.876181][ T6592] ? __pfx_process_scheduled_works+0x10/0x10 [ 864.876213][ T6592] ? assign_work+0x3cf/0x5d0 [ 864.876243][ T6592] worker_thread+0xa47/0xfb0 [ 864.876286][ T6592] ? __kthread_parkme+0x71/0x1f0 [ 864.876325][ T6592] kthread+0x38b/0x480 [ 864.876345][ T6592] ? __pfx_worker_thread+0x10/0x10 [ 864.876368][ T6592] ? __pfx_kthread+0x10/0x10 [ 864.876389][ T6592] ret_from_fork+0x514/0xb70 [ 864.876421][ T6592] ? __pfx_ret_from_fork+0x10/0x10 [ 864.876449][ T6592] ? __switch_to+0xc89/0x1420 [ 864.876478][ T6592] ? __pfx_kthread+0x10/0x10 [ 864.876499][ T6592] ret_from_fork_asm+0x1a/0x30 [ 864.876547][ T6592] [ 865.072436][ T6592] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 865.373548][ T5621] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 865.789692][T15653] fuse: Bad value for 'fd' [ 866.171362][T15666] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2635'. [ 866.340015][T12234] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 866.661969][T15674] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2626'. [ 867.777963][T15686] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2643'. [ 867.804186][T15686] ip6gre1: entered promiscuous mode [ 867.804235][T15686] ip6gre1: entered allmulticast mode [ 867.843217][T15688] fuse: Bad value for 'fd' [ 868.893338][T15699] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2647'. [ 868.970651][T15699] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2647'. [ 869.080100][T15699] bridge6: port 1(veth11) entered blocking state [ 869.082018][T15699] bridge6: port 1(veth11) entered disabled state [ 869.082191][T15699] veth11: entered allmulticast mode [ 869.091085][T15699] veth11: entered promiscuous mode [ 869.401700][T15719] fuse: Bad value for 'fd' [ 869.916963][T15705] 9pnet_fd: p9_fd_create_tcp (15705): problem connecting socket to 127.0.0.1 [ 870.029257][T15732] loop0: detected capacity change from 0 to 164 [ 870.450962][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.451038][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.688708][T15736] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 870.942945][T15729] loop1: detected capacity change from 0 to 40427 [ 870.947562][T15729] F2FS-fs (loop1): Corrupted extension count (64 + 1 > 64) [ 870.947587][T15729] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 870.953017][T15729] F2FS-fs (loop1): Image doesn't support compression [ 870.953802][T15729] F2FS-fs (loop1): invalid crc value [ 871.219608][T15729] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 871.245030][T15729] F2FS-fs (loop1): f2fs_disable_checkpoint starts, unusable: 0 [ 871.252812][T15729] F2FS-fs (loop1): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 871.263896][T15729] F2FS-fs (loop1): Start checkpoint disabled! [ 871.307137][T15729] F2FS-fs (loop1): f2fs_disable_checkpoint finishes, err:0 [ 871.318172][T15729] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 871.318216][T15729] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 872.143694][ T50] kworker/u8:3: attempt to access beyond end of device [ 872.143694][ T50] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 872.158397][ T50] CPU: 1 UID: 0 PID: 50 Comm: kworker/u8:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 872.158429][ T50] Tainted: [L]=SOFTLOCKUP [ 872.158437][ T50] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 872.158449][ T50] Workqueue: writeback wb_workfn (flush-7:1) [ 872.158484][ T50] Call Trace: [ 872.158493][ T50] [ 872.158501][ T50] dump_stack_lvl+0xe8/0x150 [ 872.158538][ T50] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 872.158570][ T50] f2fs_write_end_bio+0x1211/0x16e0 [ 872.158592][ T50] ? blkg_put+0x22/0x240 [ 872.158634][ T50] __submit_merged_bio+0x258/0x6a0 [ 872.158658][ T50] ? rcu_is_watching+0x16/0xb0 [ 872.158685][ T50] __submit_merged_write_cond+0x3c9/0x4e0 [ 872.158718][ T50] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 872.158766][ T50] f2fs_write_data_pages+0x2a27/0x36f0 [ 872.158829][ T50] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 872.158870][ T50] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 872.158925][ T50] ? __pfx_f2fs_balance_fs_bg+0x10/0x10 [ 872.158970][ T50] ? __lock_acquire+0x6df/0x2e50 [ 872.159005][ T50] ? set_shrinker_bit+0x7c/0x350 [ 872.159032][ T50] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 872.159062][ T50] do_writepages+0x338/0x560 [ 872.159094][ T50] ? reacquire_held_locks+0x117/0x1a0 [ 872.159115][ T50] ? writeback_sb_inodes+0x450/0x1b00 [ 872.159150][ T50] __writeback_single_inode+0x136/0x1220 [ 872.159182][ T50] ? do_raw_spin_unlock+0xf5/0x200 [ 872.159210][ T50] writeback_sb_inodes+0x9de/0x1b00 [ 872.159234][ T50] ? __lock_acquire+0x6df/0x2e50 [ 872.159268][ T50] ? lock_acquire+0x115/0x350 [ 872.159293][ T50] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 872.159363][ T50] ? rcu_is_watching+0x16/0xb0 [ 872.159384][ T50] ? queue_io+0x2d3/0x470 [ 872.159414][ T50] wb_writeback+0x41c/0xad0 [ 872.159444][ T50] ? queue_io+0x1e1/0x470 [ 872.159476][ T50] ? __pfx_wb_writeback+0x10/0x10 [ 872.159504][ T50] ? do_raw_spin_lock+0x12b/0x2f0 [ 872.159551][ T50] wb_workfn+0x431/0x10f0 [ 872.159593][ T50] ? __pfx_wb_workfn+0x10/0x10 [ 872.159619][ T50] ? rcu_is_watching+0x16/0xb0 [ 872.159640][ T50] ? trace_hrtimer_start+0x82/0x200 [ 872.159672][ T50] ? do_raw_spin_lock+0x12b/0x2f0 [ 872.159706][ T50] ? lock_acquire+0x115/0x350 [ 872.159734][ T50] ? rcu_is_watching+0x16/0xb0 [ 872.159757][ T50] ? process_scheduled_works+0x97a/0x1630 [ 872.159782][ T50] process_scheduled_works+0xc3d/0x1630 [ 872.159840][ T50] ? __pfx_process_scheduled_works+0x10/0x10 [ 872.159872][ T50] ? assign_work+0x3cf/0x5d0 [ 872.159901][ T50] worker_thread+0xa47/0xfb0 [ 872.159941][ T50] ? __kthread_parkme+0x71/0x1f0 [ 872.159978][ T50] kthread+0x38b/0x480 [ 872.159998][ T50] ? __pfx_worker_thread+0x10/0x10 [ 872.160020][ T50] ? __pfx_kthread+0x10/0x10 [ 872.160039][ T50] ret_from_fork+0x514/0xb70 [ 872.160071][ T50] ? __pfx_ret_from_fork+0x10/0x10 [ 872.160098][ T50] ? __switch_to+0xc89/0x1420 [ 872.160126][ T50] ? __pfx_kthread+0x10/0x10 [ 872.160146][ T50] ret_from_fork_asm+0x1a/0x30 [ 872.160190][ T50] [ 872.240273][ T50] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 872.814510][ T5795] Process accounting resumed [ 873.413047][T15783] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 873.516602][T15786] Process accounting resumed [ 873.838511][T15797] loop1: detected capacity change from 0 to 1024 [ 873.839535][T15797] EXT4-fs: Ignoring removed bh option [ 873.860804][T15797] EXT4-fs (loop1): stripe (17) is not aligned with cluster size (16), stripe is disabled [ 873.940517][T15797] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 874.656872][T15825] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2695'. [ 874.724220][T15827] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2696'. [ 874.772565][T15827] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2696'. [ 874.804839][T15827] bridge6: port 1(veth13) entered blocking state [ 874.805036][T15827] bridge6: port 1(veth13) entered disabled state [ 874.805222][T15827] veth13: entered allmulticast mode [ 874.808592][T15827] veth13: entered promiscuous mode [ 875.267802][T15839] overlayfs: failed to clone upperpath [ 876.109732][ T5614] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 876.203656][T15851] loop0: detected capacity change from 0 to 512 [ 876.213092][T15851] ext4: Unknown parameter 'subj_type' [ 876.365983][T15862] loop1: detected capacity change from 0 to 512 [ 876.380073][T15862] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 876.412085][T15862] EXT4-fs (loop1): 1 truncate cleaned up [ 876.419852][T15862] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 876.944839][ T5614] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 878.391984][T15889] loop0: detected capacity change from 0 to 40427 [ 878.408517][T15889] F2FS-fs (loop0): Corrupted extension count (64 + 1 > 64) [ 878.416511][T15889] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 878.426423][T15889] F2FS-fs (loop0): Image doesn't support compression [ 878.442872][T15889] F2FS-fs (loop0): invalid crc value [ 878.762203][T15889] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 878.852818][T15889] F2FS-fs (loop0): f2fs_disable_checkpoint starts, unusable: 0 [ 878.860693][T15889] F2FS-fs (loop0): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 878.872142][T15889] F2FS-fs (loop0): Start checkpoint disabled! [ 878.887970][T15889] F2FS-fs (loop0): f2fs_disable_checkpoint finishes, err:0 [ 878.897104][T15889] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 878.905140][T15889] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 878.994854][T15936] 9p: Bad value for 'rfdno' [ 879.152145][ T6592] kworker/u8:12: attempt to access beyond end of device [ 879.152145][ T6592] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 879.153477][ T6592] CPU: 0 UID: 0 PID: 6592 Comm: kworker/u8:12 Tainted: G L syzkaller #0 PREEMPT(full) [ 879.153505][ T6592] Tainted: [L]=SOFTLOCKUP [ 879.153512][ T6592] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 879.153524][ T6592] Workqueue: writeback wb_workfn (flush-7:0) [ 879.153558][ T6592] Call Trace: [ 879.153566][ T6592] [ 879.153574][ T6592] dump_stack_lvl+0xe8/0x150 [ 879.153602][ T6592] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 879.153632][ T6592] f2fs_write_end_bio+0x1211/0x16e0 [ 879.153654][ T6592] ? blkg_put+0x22/0x240 [ 879.153692][ T6592] __submit_merged_bio+0x258/0x6a0 [ 879.153715][ T6592] ? rcu_is_watching+0x16/0xb0 [ 879.153742][ T6592] __submit_merged_write_cond+0x3c9/0x4e0 [ 879.153774][ T6592] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 879.153820][ T6592] f2fs_write_data_pages+0x2a27/0x36f0 [ 879.153881][ T6592] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 879.153920][ T6592] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 879.153972][ T6592] ? __pfx_f2fs_balance_fs_bg+0x10/0x10 [ 879.154012][ T6592] ? __lock_acquire+0x6df/0x2e50 [ 879.154045][ T6592] ? set_shrinker_bit+0x7c/0x350 [ 879.154072][ T6592] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 879.154099][ T6592] do_writepages+0x338/0x560 [ 879.154128][ T6592] ? reacquire_held_locks+0x117/0x1a0 [ 879.154150][ T6592] ? writeback_sb_inodes+0x450/0x1b00 [ 879.154182][ T6592] __writeback_single_inode+0x136/0x1220 [ 879.154211][ T6592] ? do_raw_spin_unlock+0xf5/0x200 [ 879.154240][ T6592] writeback_sb_inodes+0x9de/0x1b00 [ 879.154265][ T6592] ? __lock_acquire+0x6df/0x2e50 [ 879.154297][ T6592] ? lock_acquire+0x115/0x350 [ 879.154320][ T6592] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 879.154387][ T6592] ? rcu_is_watching+0x16/0xb0 [ 879.154408][ T6592] ? queue_io+0x2d3/0x470 [ 879.154437][ T6592] wb_writeback+0x41c/0xad0 [ 879.154472][ T6592] ? queue_io+0x1e1/0x470 [ 879.154502][ T6592] ? __pfx_wb_writeback+0x10/0x10 [ 879.154527][ T6592] ? do_raw_spin_lock+0x12b/0x2f0 [ 879.154566][ T6592] wb_workfn+0x431/0x10f0 [ 879.154606][ T6592] ? __pfx_wb_workfn+0x10/0x10 [ 879.154632][ T6592] ? perf_cgroup_switch+0xe6/0x920 [ 879.154658][ T6592] ? do_raw_spin_lock+0x12b/0x2f0 [ 879.154691][ T6592] ? lock_acquire+0x115/0x350 [ 879.154717][ T6592] ? rcu_is_watching+0x16/0xb0 [ 879.154739][ T6592] ? process_scheduled_works+0x97a/0x1630 [ 879.154764][ T6592] process_scheduled_works+0xc3d/0x1630 [ 879.154819][ T6592] ? __pfx_process_scheduled_works+0x10/0x10 [ 879.154849][ T6592] ? assign_work+0x3cf/0x5d0 [ 879.154876][ T6592] worker_thread+0xa47/0xfb0 [ 879.154913][ T6592] ? __kthread_parkme+0x71/0x1f0 [ 879.154947][ T6592] kthread+0x38b/0x480 [ 879.154965][ T6592] ? __pfx_worker_thread+0x10/0x10 [ 879.154987][ T6592] ? __pfx_kthread+0x10/0x10 [ 879.155006][ T6592] ret_from_fork+0x514/0xb70 [ 879.155035][ T6592] ? __pfx_ret_from_fork+0x10/0x10 [ 879.155062][ T6592] ? __switch_to+0xc89/0x1420 [ 879.155089][ T6592] ? __pfx_kthread+0x10/0x10 [ 879.155108][ T6592] ret_from_fork_asm+0x1a/0x30 [ 879.155150][ T6592] [ 879.165373][ T6592] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 879.241791][ T5795] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 879.420060][ T5795] usb 2-1: Using ep0 maxpacket: 16 [ 879.429833][ T5795] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 879.511251][ T5795] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 879.511294][ T5795] usb 2-1: Product: syz [ 879.511328][ T5795] usb 2-1: Manufacturer: syz [ 879.511346][ T5795] usb 2-1: SerialNumber: syz [ 879.548230][ T5795] usb 2-1: config 0 descriptor?? [ 879.557648][ T5795] asix 2-1:0.0: probe with driver asix failed with error -22 [ 879.760604][ T5795] usb 2-1: USB disconnect, device number 66 [ 879.997970][T15955] 9p: Bad value for 'rfdno' [ 882.102774][T15973] loop0: detected capacity change from 0 to 40427 [ 882.119680][T15973] F2FS-fs (loop0): Corrupted extension count (64 + 1 > 64) [ 882.127083][T15973] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 882.135879][T15973] F2FS-fs (loop0): Image doesn't support compression [ 882.145319][T15973] F2FS-fs (loop0): invalid crc value [ 882.435130][T15973] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 882.453893][T15973] F2FS-fs (loop0): f2fs_disable_checkpoint starts, unusable: 0 [ 882.453958][T15973] F2FS-fs (loop0): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 882.455342][T15973] F2FS-fs (loop0): Start checkpoint disabled! [ 882.503100][T15973] F2FS-fs (loop0): f2fs_disable_checkpoint finishes, err:0 [ 882.514377][T15973] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 882.521606][T15973] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 882.621043][ T4943] Process accounting resumed [ 882.823707][ T1045] kworker/u8:7: attempt to access beyond end of device [ 882.823707][ T1045] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 882.823803][ T1045] CPU: 1 UID: 0 PID: 1045 Comm: kworker/u8:7 Tainted: G L syzkaller #0 PREEMPT(full) [ 882.823830][ T1045] Tainted: [L]=SOFTLOCKUP [ 882.823837][ T1045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 882.823849][ T1045] Workqueue: writeback wb_workfn (flush-7:0) [ 882.823885][ T1045] Call Trace: [ 882.823892][ T1045] [ 882.823901][ T1045] dump_stack_lvl+0xe8/0x150 [ 882.823931][ T1045] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 882.823962][ T1045] f2fs_write_end_bio+0x1211/0x16e0 [ 882.823986][ T1045] ? blkg_put+0x22/0x240 [ 882.824025][ T1045] __submit_merged_bio+0x258/0x6a0 [ 882.824049][ T1045] ? rcu_is_watching+0x16/0xb0 [ 882.824075][ T1045] __submit_merged_write_cond+0x3c9/0x4e0 [ 882.824108][ T1045] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 882.824154][ T1045] f2fs_write_data_pages+0x2a27/0x36f0 [ 882.824213][ T1045] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 882.824253][ T1045] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 882.824303][ T1045] ? __pfx_f2fs_balance_fs_bg+0x10/0x10 [ 882.824344][ T1045] ? __lock_acquire+0x6df/0x2e50 [ 882.824377][ T1045] ? set_shrinker_bit+0x7c/0x350 [ 882.824403][ T1045] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 882.824431][ T1045] do_writepages+0x338/0x560 [ 882.824461][ T1045] ? reacquire_held_locks+0x117/0x1a0 [ 882.824481][ T1045] ? writeback_sb_inodes+0x450/0x1b00 [ 882.824512][ T1045] __writeback_single_inode+0x136/0x1220 [ 882.824542][ T1045] ? do_raw_spin_unlock+0xf5/0x200 [ 882.824570][ T1045] writeback_sb_inodes+0x9de/0x1b00 [ 882.824595][ T1045] ? __lock_acquire+0x6df/0x2e50 [ 882.824627][ T1045] ? lock_acquire+0x115/0x350 [ 882.824650][ T1045] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 882.824722][ T1045] ? rcu_is_watching+0x16/0xb0 [ 882.824744][ T1045] ? queue_io+0x2d3/0x470 [ 882.824773][ T1045] wb_writeback+0x41c/0xad0 [ 882.824801][ T1045] ? queue_io+0x1e1/0x470 [ 882.824833][ T1045] ? __pfx_wb_writeback+0x10/0x10 [ 882.824857][ T1045] ? do_raw_spin_lock+0x12b/0x2f0 [ 882.824896][ T1045] wb_workfn+0x431/0x10f0 [ 882.824936][ T1045] ? __pfx_wb_workfn+0x10/0x10 [ 882.824961][ T1045] ? rcu_is_watching+0x16/0xb0 [ 882.824981][ T1045] ? trace_hrtimer_start+0x82/0x200 [ 882.825010][ T1045] ? do_raw_spin_lock+0x12b/0x2f0 [ 882.825042][ T1045] ? lock_acquire+0x115/0x350 [ 882.825068][ T1045] ? rcu_is_watching+0x16/0xb0 [ 882.825090][ T1045] ? process_scheduled_works+0x97a/0x1630 [ 882.825114][ T1045] process_scheduled_works+0xc3d/0x1630 [ 882.825167][ T1045] ? __pfx_process_scheduled_works+0x10/0x10 [ 882.825197][ T1045] ? assign_work+0x3cf/0x5d0 [ 882.825223][ T1045] worker_thread+0xa47/0xfb0 [ 882.825273][ T1045] kthread+0x38b/0x480 [ 882.825291][ T1045] ? __pfx_worker_thread+0x10/0x10 [ 882.825313][ T1045] ? __pfx_kthread+0x10/0x10 [ 882.825331][ T1045] ret_from_fork+0x514/0xb70 [ 882.825362][ T1045] ? __pfx_ret_from_fork+0x10/0x10 [ 882.825389][ T1045] ? __switch_to+0xc89/0x1420 [ 882.825415][ T1045] ? __pfx_kthread+0x10/0x10 [ 882.825433][ T1045] ret_from_fork_asm+0x1a/0x30 [ 882.825475][ T1045] [ 882.825562][ T1045] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 882.832650][ T988] loop0: lost filesystem error report for type 5 error -108 [ 883.237986][ T31] audit: type=1326 audit(1786619257.323:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15999 comm="syz.1.2757" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6ab139e0d9 code=0x0 [ 885.002541][T16044] overlayfs: failed to clone upperpath [ 885.644400][T16053] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2773'. [ 886.027943][ T988] Process accounting resumed [ 887.690026][T16106] netlink: 300 bytes leftover after parsing attributes in process `syz.0.2791'. [ 887.750472][ T31] audit: type=1326 audit(1786619261.843:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16108 comm="syz.1.2792" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6ab139e0d9 code=0x0 [ 887.769546][T16111] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2793'. [ 888.043550][T16124] fuse: Unknown parameter 'use00000000000000000000' [ 889.340388][T16154] fuse: Unknown parameter 'user_i00000000000000000000' [ 890.099300][T16161] loop0: detected capacity change from 0 to 2048 [ 890.129647][T16161] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 890.694763][T16185] fuse: Bad value for 'fd' [ 890.712672][ T5621] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 890.825540][ T31] audit: type=1326 audit(1786619264.913:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16188 comm="syz.0.2821" exe="/root/ci-upstream-linux-next-kasan-gce-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8dad99e0d9 code=0x0 [ 891.494191][ T5620] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 891.502853][ T5620] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 891.510595][ T5620] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 891.519032][ T5620] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 891.526695][ T5620] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 892.556772][T16240] loop0: detected capacity change from 0 to 1024 [ 892.598277][T16240] EXT4-fs (loop0): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 892.598392][T16240] ext4 filesystem being mounted at /570/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 892.689303][T16240] EXT4-fs error (device loop0): ext4_free_blocks:6719: comm syz.0.2839: Freeing blocks not in datazone - block = 0, count = 16 [ 892.806367][ T5621] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 893.378696][T16268] fuse: Bad value for 'fd' [ 893.609407][T16277] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2848'. [ 893.635388][T12100] Bluetooth: hci5: command tx timeout [ 893.916431][T16281] loop1: detected capacity change from 0 to 512 [ 894.005127][T16281] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 894.018248][T16281] ext4 filesystem being mounted at /541/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 894.087514][T16285] bridge0: port 1(vlan2) entered blocking state [ 894.087707][T16285] bridge0: port 1(vlan2) entered disabled state [ 894.087884][T16285] vlan2: entered allmulticast mode [ 894.087903][T16285] bridge0: entered allmulticast mode [ 894.087943][T16285] bridge0: entered promiscuous mode [ 894.102328][T16285] vlan2: left allmulticast mode [ 894.102352][T16285] bridge0: left allmulticast mode [ 894.132853][ T4943] bridge0: left promiscuous mode [ 894.223483][ T5614] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 894.381261][T16292] loop1: detected capacity change from 0 to 128 [ 894.424629][T16292] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 894.438317][T16292] ext4 filesystem being mounted at /542/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 895.392252][ T5614] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 895.392449][T11636] veth1_to_team: left allmulticast mode [ 895.392504][T11636] veth1_to_team: left promiscuous mode [ 895.395901][T11636] bridge0: port 1(veth1_to_team) entered disabled state [ 895.466758][T11636] veth7: left allmulticast mode [ 895.466805][T11636] veth7: left promiscuous mode [ 895.467618][T11636] bridge3: port 1(veth7) entered disabled state [ 895.506415][T11636] veth0_to_bond: left allmulticast mode [ 895.506466][T11636] veth0_to_bond: left promiscuous mode [ 895.506675][T11636] bridge4: port 1(veth0_to_bond) entered disabled state [ 895.513594][T16312] loop0: detected capacity change from 0 to 1024 [ 895.514622][T16312] EXT4-fs: Ignoring removed bh option [ 895.535654][T16312] EXT4-fs (loop0): stripe (17) is not aligned with cluster size (16), stripe is disabled [ 895.561196][T11636] veth11: left allmulticast mode [ 895.561237][T11636] veth11: left promiscuous mode [ 895.561438][T11636] bridge5: port 1(veth11) entered disabled state [ 895.584175][T16312] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 895.605946][T11636] veth13: left allmulticast mode [ 895.619772][T11636] veth13: left promiscuous mode [ 895.710505][T12100] Bluetooth: hci5: command tx timeout [ 895.794804][T11636] bridge6: port 1(veth13) entered disabled state [ 896.476738][ T5621] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 896.679462][T16340] loop0: detected capacity change from 0 to 256 [ 896.702121][T11636] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 896.779219][T11636] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 896.938547][T11636] bond0 (unregistering): Released all slaves [ 897.171844][ T5277] 8021q: adding VLAN 0 to HW filter on device eth1 [ 897.272645][T16200] bridge0: port 1(bridge_slave_0) entered blocking state [ 897.272764][T16200] bridge0: port 1(bridge_slave_0) entered disabled state [ 897.293500][T16200] bridge_slave_0: entered allmulticast mode [ 897.308015][T16200] bridge_slave_0: entered promiscuous mode [ 897.335037][T16200] bridge0: port 2(bridge_slave_1) entered blocking state [ 897.335160][T16200] bridge0: port 2(bridge_slave_1) entered disabled state [ 897.335329][T16200] bridge_slave_1: entered allmulticast mode [ 897.390039][T16200] bridge_slave_1: entered promiscuous mode [ 898.061009][T12100] Bluetooth: hci5: command tx timeout [ 898.339003][ T59] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 898.389026][T16200] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 898.458423][T16200] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 899.356615][T16200] team0: Port device team_slave_0 added [ 899.377413][T16200] team0: Port device team_slave_1 added [ 899.615766][T16200] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 899.615802][T16200] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 899.615826][T16200] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 899.682060][T16386] loop0: detected capacity change from 0 to 2048 [ 899.707346][ T988] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 899.746823][T16386] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 899.748501][T16386] ext4 filesystem being mounted at /580/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 899.858725][ T988] usb 2-1: Using ep0 maxpacket: 16 [ 899.860414][ T988] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 899.861533][ T988] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 899.861554][ T988] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 899.873050][ T988] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 899.873073][ T988] usb 2-1: Product: syz [ 899.873087][ T988] usb 2-1: Manufacturer: syz [ 899.873100][ T988] usb 2-1: SerialNumber: syz [ 899.890107][ T988] usb 2-1: config 0 descriptor?? [ 900.051774][ T5621] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 900.097168][T12100] Bluetooth: hci5: command tx timeout [ 900.115394][T16200] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 900.115437][T16200] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 900.115460][T16200] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 900.126413][ T988] usb 2-1: USB disconnect, device number 67 [ 900.484954][T16200] hsr_slave_0: entered promiscuous mode [ 900.490252][T16200] hsr_slave_1: entered promiscuous mode [ 900.495408][T16200] debugfs: 'hsr0' already exists in 'hsr' [ 900.495436][T16200] Cannot create hsr debugfs directory [ 900.605703][T11636] hsr_slave_0: left promiscuous mode [ 900.611295][T11636] hsr_slave_1: left promiscuous mode [ 900.618705][T11636] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 900.632513][T11636] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 900.655198][T11636] batman_adv: batadv0: Removing interface: macsec1 [ 901.749702][T16426] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 901.906773][T11636] team0 (unregistering): Port device team_slave_1 removed [ 901.928595][T11636] team0 (unregistering): Port device team_slave_0 removed [ 902.195716][ T5277] 8021q: adding VLAN 0 to HW filter on device eth2 [ 902.473811][T16437] netlink: 84 bytes leftover after parsing attributes in process `syz.2.2891'. [ 903.351166][T16449] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2895'. [ 903.678800][T16459] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2896'. [ 904.105228][T16472] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 904.348682][T16481] netlink: 84 bytes leftover after parsing attributes in process `syz.3.2904'. [ 905.133793][T16477] loop1: detected capacity change from 0 to 40427 [ 905.142005][T16477] F2FS-fs (loop1): Corrupted extension count (64 + 1 > 64) [ 905.142062][T16477] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 905.143541][T16477] F2FS-fs (loop1): Image doesn't support compression [ 905.154459][T16477] F2FS-fs (loop1): invalid crc value [ 905.214844][T16501] loop0: detected capacity change from 0 to 2048 [ 905.334718][T16501] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 905.334847][T16501] ext4 filesystem being mounted at /588/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 905.486529][T16200] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 905.495099][T16477] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 905.570662][T16477] F2FS-fs (loop1): f2fs_disable_checkpoint starts, unusable: 0 [ 905.570712][T16477] F2FS-fs (loop1): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 905.570737][T16477] F2FS-fs (loop1): Start checkpoint disabled! [ 905.593591][T16200] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 905.595068][T16200] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 905.668760][T16200] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 905.677389][T16200] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 905.732228][T16200] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 905.734514][T16200] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 905.774090][T16200] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 905.781611][T16477] F2FS-fs (loop1): f2fs_disable_checkpoint finishes, err:0 [ 905.793212][T16477] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 905.793267][T16477] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 906.365446][T16531] F2FS-fs (loop1): ino:10, start:0, end:8192, need to trigger GC to reclaim enough free segment when checkpoint is enabled [ 906.701620][ T6592] kworker/u8:12: attempt to access beyond end of device [ 906.701620][ T6592] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 906.721557][ T6592] CPU: 1 UID: 0 PID: 6592 Comm: kworker/u8:12 Tainted: G L syzkaller #0 PREEMPT(full) [ 906.721590][ T6592] Tainted: [L]=SOFTLOCKUP [ 906.721598][ T6592] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 906.721610][ T6592] Workqueue: writeback wb_workfn (flush-7:1) [ 906.721647][ T6592] Call Trace: [ 906.721655][ T6592] [ 906.721664][ T6592] dump_stack_lvl+0xe8/0x150 [ 906.721694][ T6592] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 906.721726][ T6592] f2fs_write_end_bio+0x1211/0x16e0 [ 906.721761][ T6592] ? blkg_put+0x22/0x240 [ 906.721801][ T6592] __submit_merged_bio+0x258/0x6a0 [ 906.721826][ T6592] ? rcu_is_watching+0x16/0xb0 [ 906.721855][ T6592] __submit_merged_write_cond+0x3c9/0x4e0 [ 906.721890][ T6592] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 906.721941][ T6592] f2fs_write_data_pages+0x2a27/0x36f0 [ 906.722010][ T6592] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 906.722052][ T6592] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 906.722134][ T6592] ? __lock_acquire+0x6df/0x2e50 [ 906.722177][ T6592] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 906.722206][ T6592] do_writepages+0x338/0x560 [ 906.722231][ T6592] ? do_raw_spin_lock+0x12b/0x2f0 [ 906.722260][ T6592] ? reacquire_held_locks+0x117/0x1a0 [ 906.722281][ T6592] ? writeback_sb_inodes+0x450/0x1b00 [ 906.722316][ T6592] __writeback_single_inode+0x136/0x1220 [ 906.722348][ T6592] ? do_raw_spin_unlock+0xf5/0x200 [ 906.722378][ T6592] writeback_sb_inodes+0x9de/0x1b00 [ 906.722435][ T6592] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 906.722511][ T6592] ? rcu_is_watching+0x16/0xb0 [ 906.722533][ T6592] ? queue_io+0x2d3/0x470 [ 906.722565][ T6592] wb_writeback+0x41c/0xad0 [ 906.722595][ T6592] ? queue_io+0x1e1/0x470 [ 906.722629][ T6592] ? __pfx_wb_writeback+0x10/0x10 [ 906.722654][ T6592] ? do_raw_spin_lock+0x12b/0x2f0 [ 906.722697][ T6592] wb_workfn+0x431/0x10f0 [ 906.722748][ T6592] ? __pfx_wb_workfn+0x10/0x10 [ 906.722774][ T6592] ? rcu_is_watching+0x16/0xb0 [ 906.722796][ T6592] ? trace_hrtimer_start+0x82/0x200 [ 906.722829][ T6592] ? do_raw_spin_lock+0x12b/0x2f0 [ 906.722864][ T6592] ? lock_acquire+0x115/0x350 [ 906.722892][ T6592] ? rcu_is_watching+0x16/0xb0 [ 906.722915][ T6592] ? process_scheduled_works+0x97a/0x1630 [ 906.722941][ T6592] process_scheduled_works+0xc3d/0x1630 [ 906.723001][ T6592] ? __pfx_process_scheduled_works+0x10/0x10 [ 906.723032][ T6592] ? assign_work+0x3cf/0x5d0 [ 906.723062][ T6592] worker_thread+0xa47/0xfb0 [ 906.723103][ T6592] ? __kthread_parkme+0x71/0x1f0 [ 906.723141][ T6592] kthread+0x38b/0x480 [ 906.723160][ T6592] ? __pfx_worker_thread+0x10/0x10 [ 906.723182][ T6592] ? __pfx_kthread+0x10/0x10 [ 906.723202][ T6592] ret_from_fork+0x514/0xb70 [ 906.723234][ T6592] ? __pfx_ret_from_fork+0x10/0x10 [ 906.723262][ T6592] ? __switch_to+0xc89/0x1420 [ 906.723290][ T6592] ? __pfx_kthread+0x10/0x10 [ 906.723310][ T6592] ret_from_fork_asm+0x1a/0x30 [ 906.723357][ T6592] [ 906.925896][T16200] 8021q: adding VLAN 0 to HW filter on device bond0 [ 906.951951][ T6592] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 906.956585][ T6847] EXT4-fs error (device loop0): ext4_validate_block_bitmap:445: comm kworker/u8:13: bg 0: block 345: padding at end of block bitmap is not set [ 906.961128][ T6847] EXT4-fs (loop0): Remounting filesystem read-only [ 906.987315][ T6052] EXT4-fs warning (device loop0): ext4_convert_unwritten_extents:5172: inode #15: block 1: len 15: ext4_map_blocks returned -30 [ 907.026860][T16200] 8021q: adding VLAN 0 to HW filter on device team0 [ 907.070282][T11636] bridge0: port 1(bridge_slave_0) entered blocking state [ 907.070412][T11636] bridge0: port 1(bridge_slave_0) entered forwarding state [ 907.133729][T11636] bridge0: port 2(bridge_slave_1) entered blocking state [ 907.133863][T11636] bridge0: port 2(bridge_slave_1) entered forwarding state [ 907.289889][ T5621] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 907.614713][T16556] loop1: detected capacity change from 0 to 256 [ 907.716630][T16557] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 908.845119][T16200] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 908.972204][T16597] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2925'. [ 910.041544][T16200] veth0_vlan: entered promiscuous mode [ 910.164134][T16200] veth1_vlan: entered promiscuous mode [ 910.249261][ T9] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 910.281304][T16200] veth0_macvtap: entered promiscuous mode [ 910.296607][T16200] veth1_macvtap: entered promiscuous mode [ 910.367980][T16200] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 910.397764][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 910.398472][ T9] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 910.403747][T16200] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 910.404962][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 910.404985][ T9] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 910.411692][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 910.411715][ T9] usb 1-1: Product: syz [ 910.411728][ T9] usb 1-1: Manufacturer: syz [ 910.411742][ T9] usb 1-1: SerialNumber: syz [ 910.425631][ T9] usb 1-1: config 0 descriptor?? [ 910.471516][ T6052] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.471699][ T6052] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.471734][ T6052] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.518964][ T6847] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.658971][T16636] loop1: detected capacity change from 0 to 1024 [ 910.778615][T16636] EXT4-fs: Ignoring removed bh option [ 910.821189][T16636] EXT4-fs (loop1): stripe (17) is not aligned with cluster size (16), stripe is disabled [ 910.837941][ T5800] usb 1-1: USB disconnect, device number 82 [ 911.229384][T16636] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 911.391273][T16649] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2936'. [ 911.471469][T16651] 9pnet_virtio: no channels available for device 127.0.0.1 [ 911.752959][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 911.761364][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 911.905129][T16656] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2937'. [ 911.934765][ T5614] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 912.023936][T11636] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 912.023972][T11636] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 912.160212][T16662] loop1: detected capacity change from 0 to 512 [ 912.193059][T16662] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 912.193382][T16662] EXT4-fs (loop1): orphan cleanup on readonly fs [ 912.279754][T16662] Quota error (device loop1): find_block_dqentry: Quota for id 0 referenced but not present [ 912.304598][T16662] Quota error (device loop1): qtree_read_dquot: Can't read quota structure for id 0 [ 912.331645][T16662] EXT4-fs error (device loop1): ext4_acquire_dquot:7069: comm syz.1.2939: Failed to acquire dquot type 1 [ 912.344786][T16662] loop1: lost filesystem error report for type 5 error -5 [ 912.347659][ C1] EXT4-fs (loop1): initial error at time 1786619286: ext4_acquire_dquot:7069 [ 912.347718][ C1] EXT4-fs (loop1): last error at time 1786619286: ext4_acquire_dquot:7069 [ 912.380647][T16662] EXT4-fs (loop1): Remounting filesystem read-only [ 912.403406][T16662] EXT4-fs (loop1): 1 truncate cleaned up [ 912.419489][T16662] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 912.422263][T16668] netlink: 'syz.0.2943': attribute type 10 has an invalid length. [ 912.450421][T16668] 8021q: adding VLAN 0 to HW filter on device team0 [ 912.461169][T16668] bond0: (slave team0): Enslaving as an active interface with an up link [ 912.736122][ T5614] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 913.108939][T12100] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 913.122844][T12100] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 913.132941][T12100] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 913.138478][T12100] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 913.139087][T12100] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 913.411371][T16643] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 913.566944][T16643] usb 5-1: Using ep0 maxpacket: 16 [ 913.572813][T16643] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 913.583157][T16643] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 913.583193][T16643] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 913.610108][T16643] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 913.610148][T16643] usb 5-1: Product: syz [ 913.610179][T16643] usb 5-1: Manufacturer: syz [ 913.610196][T16643] usb 5-1: SerialNumber: syz [ 913.673380][T16643] usb 5-1: config 0 descriptor?? [ 913.921890][ T5795] usb 5-1: USB disconnect, device number 86 [ 914.842099][T16681] bridge0: port 1(bridge_slave_0) entered blocking state [ 914.844501][T16681] bridge0: port 1(bridge_slave_0) entered disabled state [ 914.844689][T16681] bridge_slave_0: entered allmulticast mode [ 914.868632][T16681] bridge_slave_0: entered promiscuous mode [ 914.871741][T16681] bridge0: port 2(bridge_slave_1) entered blocking state [ 914.871835][T16681] bridge0: port 2(bridge_slave_1) entered disabled state [ 914.871960][T16681] bridge_slave_1: entered allmulticast mode [ 914.873647][T16681] bridge_slave_1: entered promiscuous mode [ 915.106103][T16681] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 915.114593][T16681] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 915.181899][T16681] team0: Port device team_slave_0 added [ 915.191319][T16681] team0: Port device team_slave_1 added [ 915.245171][T12100] Bluetooth: hci3: command tx timeout [ 915.472940][T16681] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 915.472979][T16681] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 915.473001][T16681] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 915.475121][T16681] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 915.475135][T16681] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 915.475173][T16681] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 915.890022][ T142] veth3: left allmulticast mode [ 915.890071][ T142] veth3: left promiscuous mode [ 915.891570][ T142] bridge2: port 1(veth3) entered disabled state [ 915.913327][ T142] veth5: left allmulticast mode [ 915.913353][ T142] veth5: left promiscuous mode [ 915.917486][ T142] bridge0: port 1(veth5) entered disabled state [ 916.572641][T16745] netlink: 300 bytes leftover after parsing attributes in process `syz.3.2961'. [ 916.625110][ T142] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 916.639196][ T142] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 916.661508][ T142] bond0 (unregistering): Released all slaves [ 916.773007][T16736] bridge0: port 2(vlan2) entered blocking state [ 916.773140][T16736] bridge0: port 2(vlan2) entered disabled state [ 916.773293][T16736] vlan2: entered allmulticast mode [ 916.773308][T16736] bridge0: entered allmulticast mode [ 916.809919][T16736] vlan2: left allmulticast mode [ 916.809963][T16736] bridge0: left allmulticast mode [ 916.865415][T16741] bridge_slave_0: left allmulticast mode [ 916.869415][T16741] bridge_slave_0: left promiscuous mode [ 916.869619][T16741] bridge0: port 1(bridge_slave_0) entered disabled state [ 916.890872][T16741] bridge_slave_1: left allmulticast mode [ 916.890904][T16741] bridge_slave_1: left promiscuous mode [ 916.891578][T16741] bridge0: port 2(bridge_slave_1) entered disabled state [ 916.914243][T16741] bond0: (slave bond_slave_0): Releasing backup interface [ 916.926248][T16741] bond0: (slave bond_slave_1): Releasing backup interface [ 916.946410][T16741] team0: Port device team_slave_0 removed [ 916.954630][T16741] team0: Port device team_slave_1 removed [ 916.955661][T16741] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 916.955681][T16741] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 916.963309][T16741] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 916.963332][T16741] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 916.970789][T16741] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 917.013229][T16681] hsr_slave_0: entered promiscuous mode [ 917.016375][T16681] hsr_slave_1: entered promiscuous mode [ 917.022360][T16681] debugfs: 'hsr0' already exists in 'hsr' [ 917.022383][T16681] Cannot create hsr debugfs directory [ 917.030795][ T142] tipc: Left network mode [ 917.032242][ T5277] 8021q: adding VLAN 0 to HW filter on device eth1 [ 917.360884][T16757] syz_tun: left allmulticast mode [ 917.366468][T16757] syz_tun: left promiscuous mode [ 917.371887][T16757] bridge0: port 3(syz_tun) entered disabled state [ 917.392218][T12100] Bluetooth: hci3: command tx timeout [ 917.402469][T16757] bridge_slave_0: left allmulticast mode [ 917.425839][T16757] bridge_slave_0: left promiscuous mode [ 917.426100][T16757] bridge0: port 1(bridge_slave_0) entered disabled state [ 917.463926][T16757] bridge_slave_1: left allmulticast mode [ 917.463972][T16757] bridge_slave_1: left promiscuous mode [ 917.464155][T16757] bridge0: port 2(bridge_slave_1) entered disabled state [ 917.492810][T16757] veth0_to_bond: left allmulticast mode [ 917.492837][T16757] veth0_to_bond: left promiscuous mode [ 917.493024][T16757] bridge2: port 1(veth0_to_bond) entered disabled state [ 917.569946][T16757] bond0: (slave bond_slave_0): Releasing backup interface [ 917.588286][T16757] bond0: (slave bond_slave_1): Releasing backup interface [ 917.610071][T16757] team0: Port device team_slave_0 removed [ 917.645075][T16757] team0: Port device team_slave_1 removed [ 917.652004][T16757] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 917.663550][T16757] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 917.685120][T16757] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 918.340323][ T5277] 8021q: adding VLAN 0 to HW filter on device eth2 [ 918.454525][ T142] hsr_slave_0: left promiscuous mode [ 918.460223][ T142] hsr_slave_1: left promiscuous mode [ 918.461168][ T142] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 918.467615][ T142] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 918.474135][ T142] batman_adv: batadv0: Removing interface: macsec1 [ 919.351134][T16821] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2982'. [ 919.424654][ T142] team0 (unregistering): Port device team_slave_1 removed [ 919.457226][T12100] Bluetooth: hci3: command tx timeout [ 919.479067][ T142] team0 (unregistering): Port device team_slave_0 removed [ 920.656089][T16843] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2987'. [ 920.886258][T16851] netlink: 300 bytes leftover after parsing attributes in process `syz.4.2988'. [ 920.940870][T16853] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2989'. [ 921.550098][T12100] Bluetooth: hci3: command tx timeout [ 921.585372][T16864] 9pnet_virtio: no channels available for device 127.0.0.1 [ 921.716689][T16866] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2993'. [ 921.976622][T16870] fuse: Unknown parameter 'fd0x0000000000000003' [ 922.240100][T16873] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 922.609388][T16681] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 922.695313][T16681] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 922.696112][T16681] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 922.732587][T16681] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 922.745552][T16681] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 922.775024][T16681] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 922.784789][T16681] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 922.819677][T16681] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 923.034303][T16900] loop0: detected capacity change from 0 to 512 [ 923.075957][T16900] EXT4-fs error (device loop0): ext4_orphan_get:1403: inode #15: comm syz.0.3001: iget: bad i_size value: 38620345925642 [ 923.076013][T16900] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 923.076937][ C0] EXT4-fs (loop0): error count since last fsck: 1 [ 923.076956][ C0] EXT4-fs (loop0): initial error at time 1786619297: ext4_orphan_get:1403: inode 15 [ 923.076985][ C0] EXT4-fs (loop0): last error at time 1786619297: ext4_orphan_get:1403: inode 15 [ 923.130147][T16900] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.3001: couldn't read orphan inode 15 (err -117) [ 923.130200][T16900] loop0: lost filesystem error report for type 5 error -117 [ 923.149185][T16900] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 923.197014][T16906] EXT4-fs error (device loop0): ext4_validate_block_bitmap:436: comm ext4lazyinit: bg 0: block 5: invalid block bitmap [ 923.397891][ T5621] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 923.409191][T16681] 8021q: adding VLAN 0 to HW filter on device bond0 [ 923.498673][T16681] 8021q: adding VLAN 0 to HW filter on device team0 [ 923.542513][ T6052] bridge0: port 1(bridge_slave_0) entered blocking state [ 923.542651][ T6052] bridge0: port 1(bridge_slave_0) entered forwarding state [ 923.590684][T11636] bridge0: port 2(bridge_slave_1) entered blocking state [ 923.590799][T11636] bridge0: port 2(bridge_slave_1) entered forwarding state [ 924.808899][T16935] fuse: fd is not a fuse device [ 924.876129][T16938] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3009'. [ 925.398179][T16925] loop0: detected capacity change from 0 to 40427 [ 925.410949][T16925] F2FS-fs (loop0): Corrupted extension count (64 + 1 > 64) [ 925.411004][T16925] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 925.413120][T16925] F2FS-fs (loop0): Image doesn't support compression [ 925.415496][T16925] F2FS-fs (loop0): invalid crc value [ 925.510826][T16960] loop4: detected capacity change from 0 to 512 [ 925.538728][T16960] EXT4-fs error (device loop4): ext4_orphan_get:1403: inode #15: comm syz.4.3015: iget: bad i_size value: 38620345925642 [ 925.538828][T16960] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 925.551775][ C0] EXT4-fs (loop4): error count since last fsck: 1 [ 925.551803][ C0] EXT4-fs (loop4): initial error at time 1786619299: ext4_orphan_get:1403: inode 15 [ 925.551835][ C0] EXT4-fs (loop4): last error at time 1786619299: ext4_orphan_get:1403: inode 15 [ 925.589050][T16960] EXT4-fs error (device loop4): ext4_orphan_get:1408: comm syz.4.3015: couldn't read orphan inode 15 (err -117) [ 925.589101][T16960] loop4: lost filesystem error report for type 5 error -117 [ 925.610898][T16960] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 925.692520][T16925] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 925.706332][T16925] F2FS-fs (loop0): f2fs_disable_checkpoint starts, unusable: 0 [ 925.715261][T16925] F2FS-fs (loop0): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 925.726419][T16925] F2FS-fs (loop0): Start checkpoint disabled! [ 925.794495][T16925] F2FS-fs (loop0): f2fs_disable_checkpoint finishes, err:0 [ 925.809451][T16925] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 925.809479][T16925] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 926.055926][ T6847] EXT4-fs error (device loop4): ext4_validate_block_bitmap:436: comm kworker/u8:13: bg 0: block 5: invalid block bitmap [ 926.348077][T16977] F2FS-fs (loop0): ino:10, start:0, end:8192, need to trigger GC to reclaim enough free segment when checkpoint is enabled [ 926.529285][ T6847] EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 56 with error 28 [ 926.574547][ T6847] EXT4-fs (loop4): This should not happen!! Data will be lost [ 926.574547][ T6847] [ 926.585463][ T6847] EXT4-fs (loop4): Total free blocks count 0 [ 926.593121][ T6847] EXT4-fs (loop4): Free/Dirty block details [ 926.599565][ T6847] EXT4-fs (loop4): free_blocks=0 [ 926.604888][ T6847] EXT4-fs (loop4): dirty_blocks=60 [ 926.610571][ T6847] EXT4-fs (loop4): Block reservation details [ 926.616961][ T6847] EXT4-fs (loop4): i_reserved_data_blocks=60 [ 926.647745][ T142] kworker/u8:5: attempt to access beyond end of device [ 926.647745][ T142] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 926.647844][ T142] CPU: 0 UID: 0 PID: 142 Comm: kworker/u8:5 Tainted: G L syzkaller #0 PREEMPT(full) [ 926.647867][ T142] Tainted: [L]=SOFTLOCKUP [ 926.647874][ T142] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 926.647886][ T142] Workqueue: writeback wb_workfn (flush-7:0) [ 926.647919][ T142] Call Trace: [ 926.647927][ T142] [ 926.647936][ T142] dump_stack_lvl+0xe8/0x150 [ 926.647965][ T142] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 926.647996][ T142] f2fs_write_end_bio+0x1211/0x16e0 [ 926.648018][ T142] ? blkg_put+0x22/0x240 [ 926.648058][ T142] __submit_merged_bio+0x258/0x6a0 [ 926.648090][ T142] ? rcu_is_watching+0x16/0xb0 [ 926.648118][ T142] __submit_merged_write_cond+0x3c9/0x4e0 [ 926.648153][ T142] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 926.648203][ T142] f2fs_write_data_pages+0x2a27/0x36f0 [ 926.648268][ T142] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 926.648309][ T142] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 926.648388][ T142] ? __lock_acquire+0x6df/0x2e50 [ 926.648429][ T142] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 926.648458][ T142] do_writepages+0x338/0x560 [ 926.648482][ T142] ? do_raw_spin_lock+0x12b/0x2f0 [ 926.648511][ T142] ? reacquire_held_locks+0x117/0x1a0 [ 926.648531][ T142] ? writeback_sb_inodes+0x450/0x1b00 [ 926.648564][ T142] __writeback_single_inode+0x136/0x1220 [ 926.648594][ T142] ? do_raw_spin_unlock+0xf5/0x200 [ 926.648623][ T142] writeback_sb_inodes+0x9de/0x1b00 [ 926.648684][ T142] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 926.648756][ T142] ? rcu_is_watching+0x16/0xb0 [ 926.648777][ T142] ? queue_io+0x2d3/0x470 [ 926.648808][ T142] wb_writeback+0x41c/0xad0 [ 926.648837][ T142] ? queue_io+0x1e1/0x470 [ 926.648870][ T142] ? __pfx_wb_writeback+0x10/0x10 [ 926.648894][ T142] ? do_raw_spin_lock+0x12b/0x2f0 [ 926.648936][ T142] wb_workfn+0x431/0x10f0 [ 926.648979][ T142] ? __pfx_wb_workfn+0x10/0x10 [ 926.649017][ T142] ? do_raw_spin_lock+0x12b/0x2f0 [ 926.649050][ T142] ? lock_acquire+0x115/0x350 [ 926.649078][ T142] ? rcu_is_watching+0x16/0xb0 [ 926.649106][ T142] ? process_scheduled_works+0x97a/0x1630 [ 926.649131][ T142] process_scheduled_works+0xc3d/0x1630 [ 926.649189][ T142] ? __pfx_process_scheduled_works+0x10/0x10 [ 926.649220][ T142] ? assign_work+0x3cf/0x5d0 [ 926.649249][ T142] worker_thread+0xa47/0xfb0 [ 926.649306][ T142] kthread+0x38b/0x480 [ 926.649325][ T142] ? __pfx_worker_thread+0x10/0x10 [ 926.649346][ T142] ? __pfx_kthread+0x10/0x10 [ 926.649366][ T142] ret_from_fork+0x514/0xb70 [ 926.649398][ T142] ? __pfx_ret_from_fork+0x10/0x10 [ 926.649425][ T142] ? __switch_to+0xc89/0x1420 [ 926.649452][ T142] ? __pfx_kthread+0x10/0x10 [ 926.649472][ T142] ret_from_fork_asm+0x1a/0x30 [ 926.649517][ T142] [ 926.655562][ T142] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 926.714659][T16200] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 927.140245][T16681] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 927.256398][T16990] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3019'. [ 927.331325][T16681] veth0_vlan: entered promiscuous mode [ 927.388074][T16681] veth1_vlan: entered promiscuous mode [ 927.521033][T17000] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3018'. [ 927.600803][T16681] veth0_macvtap: entered promiscuous mode [ 927.631181][T16681] veth1_macvtap: entered promiscuous mode [ 927.705350][T16681] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 927.745220][T16681] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 927.938960][T11636] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 927.939344][T11636] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 927.939397][T11636] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 927.992941][ T6592] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 928.103232][T12234] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 928.103272][T12234] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 928.304289][ T6592] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 928.304327][ T6592] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 928.304338][T17019] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3028'. [ 928.723669][T17029] loop2: detected capacity change from 0 to 1024 [ 928.731140][T17029] EXT4-fs: Ignoring removed bh option [ 928.739307][T17029] EXT4-fs (loop2): stripe (17) is not aligned with cluster size (16), stripe is disabled [ 928.789324][T17029] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 929.691027][T16681] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 930.117499][T12100] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 930.130246][T12100] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 930.161359][T12100] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 930.172880][T12100] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 930.181113][T12100] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 930.338670][ T50] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 930.837354][T17037] loop2: detected capacity change from 0 to 40427 [ 930.844837][T17037] F2FS-fs (loop2): Corrupted extension count (64 + 1 > 64) [ 930.844892][T17037] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 930.845168][T17037] F2FS-fs (loop2): Image doesn't support compression [ 930.847211][T17037] F2FS-fs (loop2): invalid crc value [ 930.960758][T17037] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 930.998475][T17037] F2FS-fs (loop2): f2fs_disable_checkpoint starts, unusable: 0 [ 931.006248][T17037] F2FS-fs (loop2): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 931.017280][T17037] F2FS-fs (loop2): Start checkpoint disabled! [ 931.168381][T17037] F2FS-fs (loop2): f2fs_disable_checkpoint finishes, err:0 [ 931.184267][T17037] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 931.191589][T17037] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 931.707884][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.707962][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.933731][ T6847] kworker/u8:13: attempt to access beyond end of device [ 931.933731][ T6847] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 931.953779][ T6847] CPU: 0 UID: 0 PID: 6847 Comm: kworker/u8:13 Tainted: G L syzkaller #0 PREEMPT(full) [ 931.953811][ T6847] Tainted: [L]=SOFTLOCKUP [ 931.953818][ T6847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 931.953829][ T6847] Workqueue: writeback wb_workfn (flush-7:2) [ 931.953861][ T6847] Call Trace: [ 931.953868][ T6847] [ 931.953877][ T6847] dump_stack_lvl+0xe8/0x150 [ 931.953906][ T6847] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 931.953934][ T6847] f2fs_write_end_bio+0x1211/0x16e0 [ 931.953956][ T6847] ? blkg_put+0x22/0x240 [ 931.953994][ T6847] __submit_merged_bio+0x258/0x6a0 [ 931.954017][ T6847] ? rcu_is_watching+0x16/0xb0 [ 931.954045][ T6847] __submit_merged_write_cond+0x3c9/0x4e0 [ 931.954078][ T6847] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 931.954123][ T6847] f2fs_write_data_pages+0x2a27/0x36f0 [ 931.954197][ T6847] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 931.954238][ T6847] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 931.954291][ T6847] ? __pfx_f2fs_balance_fs_bg+0x10/0x10 [ 931.954335][ T6847] ? __lock_acquire+0x6df/0x2e50 [ 931.954371][ T6847] ? set_shrinker_bit+0x7c/0x350 [ 931.954399][ T6847] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 931.954428][ T6847] do_writepages+0x338/0x560 [ 931.954459][ T6847] ? reacquire_held_locks+0x117/0x1a0 [ 931.954481][ T6847] ? writeback_sb_inodes+0x450/0x1b00 [ 931.954514][ T6847] __writeback_single_inode+0x136/0x1220 [ 931.954546][ T6847] ? do_raw_spin_unlock+0xf5/0x200 [ 931.954576][ T6847] writeback_sb_inodes+0x9de/0x1b00 [ 931.954602][ T6847] ? __lock_acquire+0x6df/0x2e50 [ 931.954635][ T6847] ? lock_acquire+0x115/0x350 [ 931.954660][ T6847] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 931.954730][ T6847] ? rcu_is_watching+0x16/0xb0 [ 931.954751][ T6847] ? queue_io+0x2d3/0x470 [ 931.954779][ T6847] wb_writeback+0x41c/0xad0 [ 931.954809][ T6847] ? queue_io+0x1e1/0x470 [ 931.954841][ T6847] ? __pfx_wb_writeback+0x10/0x10 [ 931.954866][ T6847] ? do_raw_spin_lock+0x12b/0x2f0 [ 931.954905][ T6847] wb_workfn+0x431/0x10f0 [ 931.954948][ T6847] ? __pfx_wb_workfn+0x10/0x10 [ 931.954977][ T6847] ? rcu_is_watching+0x16/0xb0 [ 931.955000][ T6847] ? trace_hrtimer_start+0x82/0x200 [ 931.955032][ T6847] ? do_raw_spin_lock+0x12b/0x2f0 [ 931.955066][ T6847] ? lock_acquire+0x115/0x350 [ 931.955095][ T6847] ? rcu_is_watching+0x16/0xb0 [ 931.955118][ T6847] ? process_scheduled_works+0x97a/0x1630 [ 931.955150][ T6847] process_scheduled_works+0xc3d/0x1630 [ 931.955207][ T6847] ? __pfx_process_scheduled_works+0x10/0x10 [ 931.955238][ T6847] ? assign_work+0x3cf/0x5d0 [ 931.955268][ T6847] worker_thread+0xa47/0xfb0 [ 931.955307][ T6847] ? __kthread_parkme+0x71/0x1f0 [ 931.955345][ T6847] kthread+0x38b/0x480 [ 931.955364][ T6847] ? __pfx_worker_thread+0x10/0x10 [ 931.955387][ T6847] ? __pfx_kthread+0x10/0x10 [ 931.955406][ T6847] ret_from_fork+0x514/0xb70 [ 931.955437][ T6847] ? __pfx_ret_from_fork+0x10/0x10 [ 931.955466][ T6847] ? __switch_to+0xc89/0x1420 [ 931.955494][ T6847] ? __pfx_kthread+0x10/0x10 [ 931.955514][ T6847] ret_from_fork_asm+0x1a/0x30 [ 931.955560][ T6847] [ 931.956261][ T6847] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 932.054972][T17072] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3041'. [ 932.258644][ T5620] Bluetooth: hci2: command tx timeout [ 932.621708][T17087] overlayfs: failed to clone upperpath [ 933.602446][T17041] bridge0: port 1(bridge_slave_0) entered blocking state [ 933.602564][T17041] bridge0: port 1(bridge_slave_0) entered disabled state [ 933.602739][T17041] bridge_slave_0: entered allmulticast mode [ 933.610050][T17041] bridge_slave_0: entered promiscuous mode [ 933.626469][T17041] bridge0: port 2(bridge_slave_1) entered blocking state [ 933.626569][T17041] bridge0: port 2(bridge_slave_1) entered disabled state [ 933.626720][T17041] bridge_slave_1: entered allmulticast mode [ 933.638003][T17041] bridge_slave_1: entered promiscuous mode [ 933.748423][T17041] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 933.758375][T17041] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 933.772294][T17098] loop4: detected capacity change from 0 to 1024 [ 933.787757][T17098] EXT4-fs: Ignoring removed bh option [ 933.811491][T17098] EXT4-fs (loop4): stripe (17) is not aligned with cluster size (16), stripe is disabled [ 933.878994][T17041] team0: Port device team_slave_0 added [ 933.889915][T17041] team0: Port device team_slave_1 added [ 933.901950][T17098] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 933.949461][T17041] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 933.949502][T17041] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 933.949526][T17041] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 933.951761][T17041] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 933.951775][T17041] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 933.951799][T17041] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 934.019877][T17041] hsr_slave_0: entered promiscuous mode [ 934.020919][T17041] hsr_slave_1: entered promiscuous mode [ 934.337360][ T5620] Bluetooth: hci2: command tx timeout [ 934.679317][T17041] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 934.936256][T17041] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 935.263921][T16200] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 935.322656][T17041] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 937.167107][ T5620] Bluetooth: hci2: command tx timeout [ 937.529700][T17041] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 937.903961][T17150] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 938.089081][T17041] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 938.121157][T17041] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 938.127914][T17041] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 938.131611][T17041] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 938.132752][T17041] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 938.140175][T17041] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 938.141290][T17041] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 938.145936][T17041] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 938.378247][T17041] 8021q: adding VLAN 0 to HW filter on device bond0 [ 938.408143][T17041] 8021q: adding VLAN 0 to HW filter on device team0 [ 938.422647][ T6592] bridge0: port 1(bridge_slave_0) entered blocking state [ 938.422772][ T6592] bridge0: port 1(bridge_slave_0) entered forwarding state [ 938.445260][ T6847] bridge0: port 2(bridge_slave_1) entered blocking state [ 938.445391][ T6847] bridge0: port 2(bridge_slave_1) entered forwarding state [ 939.267318][ T5620] Bluetooth: hci2: command tx timeout [ 940.494565][T17191] fuse: fd is not a fuse device [ 940.702431][T17198] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 940.729667][T17041] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 940.805456][T17041] veth0_vlan: entered promiscuous mode [ 940.829312][T17041] veth1_vlan: entered promiscuous mode [ 940.869342][T17041] veth0_macvtap: entered promiscuous mode [ 940.883499][T17041] veth1_macvtap: entered promiscuous mode [ 940.908058][T17041] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 940.931474][T17041] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 941.159808][T11636] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 941.714151][T11626] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 941.725321][T11626] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 941.728850][ T59] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 942.100242][T11637] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 942.100265][T11637] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 942.152316][T17222] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3084'. [ 942.230782][T11636] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 942.230830][T11636] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 943.204172][T12100] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 943.216451][T12100] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 943.225977][T12100] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 943.231768][T12100] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 943.232634][T12100] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 943.254799][T17230] loop2: detected capacity change from 0 to 40427 [ 943.277323][T17230] F2FS-fs (loop2): Corrupted extension count (64 + 1 > 64) [ 943.284650][T17230] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 943.304525][T17230] F2FS-fs (loop2): Image doesn't support compression [ 943.315734][T17230] F2FS-fs (loop2): invalid crc value [ 943.520547][T17252] loop0: detected capacity change from 0 to 1024 [ 943.574177][T17252] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 943.683976][T17041] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 943.749185][T17230] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 943.960483][T17230] F2FS-fs (loop2): f2fs_disable_checkpoint starts, unusable: 0 [ 943.968618][T17230] F2FS-fs (loop2): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 943.980489][T17230] F2FS-fs (loop2): Start checkpoint disabled! [ 944.053971][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.064222][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.074925][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.085047][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.095252][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.106049][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.138636][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.170620][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.186362][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.211645][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.248381][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.258987][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.270744][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.281791][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.292290][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.302822][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.318205][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.331486][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.342145][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.352410][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.363027][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.391492][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.401888][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.412113][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.422456][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.439035][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.449545][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.459244][T17230] F2FS-fs (loop2): f2fs_disable_checkpoint finishes, err:0 [ 944.603142][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.604568][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.605853][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.607279][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.608329][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.610173][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.611213][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.612450][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.613508][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.614518][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.615488][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.616562][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.618087][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.619184][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.620157][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.621155][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.622187][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.623154][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.624178][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.625163][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.626148][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.627988][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.629073][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.630043][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.631056][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.632095][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.633088][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.634161][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.635208][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.636516][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.638433][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.639443][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.640441][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.641454][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.642425][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.643442][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.644421][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.645385][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.646354][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.648333][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.649379][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.650380][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.651389][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.652424][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.653393][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.654359][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.655318][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.656343][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.658205][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.659259][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.861215][T17230] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 944.861286][T17230] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 944.987152][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.988407][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.991166][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.998630][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 944.999705][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.000698][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.001766][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.002836][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.003897][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.004942][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.005946][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.031545][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.032740][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.033895][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.034926][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.035904][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.060461][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.072047][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.082437][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.083737][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.094079][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.105327][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.112105][T17264] 9pnet_fd: p9_fd_create_tcp (17264): problem connecting socket to 127.0.0.1 [ 945.585515][T17275] F2FS-fs (loop2): ino:10, start:0, end:8192, need to trigger GC to reclaim enough free segment when checkpoint is enabled [ 945.730434][T12100] Bluetooth: hci4: command tx timeout [ 946.002009][ T1045] kworker/u8:7: attempt to access beyond end of device [ 946.002009][ T1045] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 946.002087][ T1045] CPU: 1 UID: 0 PID: 1045 Comm: kworker/u8:7 Tainted: G L syzkaller #0 PREEMPT(full) [ 946.002112][ T1045] Tainted: [L]=SOFTLOCKUP [ 946.002120][ T1045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 946.002131][ T1045] Workqueue: writeback wb_workfn (flush-7:2) [ 946.002166][ T1045] Call Trace: [ 946.002173][ T1045] [ 946.002182][ T1045] dump_stack_lvl+0xe8/0x150 [ 946.002215][ T1045] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 946.002247][ T1045] f2fs_write_end_bio+0x1211/0x16e0 [ 946.002268][ T1045] ? blkg_put+0x22/0x240 [ 946.002309][ T1045] __submit_merged_bio+0x258/0x6a0 [ 946.002332][ T1045] ? rcu_is_watching+0x16/0xb0 [ 946.002360][ T1045] __submit_merged_write_cond+0x3c9/0x4e0 [ 946.002394][ T1045] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 946.002441][ T1045] f2fs_write_data_pages+0x2a27/0x36f0 [ 946.002505][ T1045] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 946.002547][ T1045] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 946.002625][ T1045] ? __lock_acquire+0x6df/0x2e50 [ 946.002666][ T1045] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 946.002694][ T1045] do_writepages+0x338/0x560 [ 946.002718][ T1045] ? do_raw_spin_lock+0x12b/0x2f0 [ 946.002747][ T1045] ? reacquire_held_locks+0x117/0x1a0 [ 946.002767][ T1045] ? writeback_sb_inodes+0x450/0x1b00 [ 946.002799][ T1045] __writeback_single_inode+0x136/0x1220 [ 946.002830][ T1045] ? do_raw_spin_unlock+0xf5/0x200 [ 946.002860][ T1045] writeback_sb_inodes+0x9de/0x1b00 [ 946.002914][ T1045] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 946.002992][ T1045] ? rcu_is_watching+0x16/0xb0 [ 946.003013][ T1045] ? queue_io+0x2d3/0x470 [ 946.003043][ T1045] wb_writeback+0x41c/0xad0 [ 946.003073][ T1045] ? queue_io+0x1e1/0x470 [ 946.003105][ T1045] ? __pfx_wb_writeback+0x10/0x10 [ 946.003129][ T1045] ? do_raw_spin_lock+0x12b/0x2f0 [ 946.003171][ T1045] wb_workfn+0x431/0x10f0 [ 946.003213][ T1045] ? __pfx_wb_workfn+0x10/0x10 [ 946.003239][ T1045] ? rcu_is_watching+0x16/0xb0 [ 946.003261][ T1045] ? trace_hrtimer_start+0x82/0x200 [ 946.003292][ T1045] ? do_raw_spin_lock+0x12b/0x2f0 [ 946.003326][ T1045] ? lock_acquire+0x115/0x350 [ 946.003354][ T1045] ? rcu_is_watching+0x16/0xb0 [ 946.003377][ T1045] ? process_scheduled_works+0x97a/0x1630 [ 946.003401][ T1045] process_scheduled_works+0xc3d/0x1630 [ 946.003459][ T1045] ? __pfx_process_scheduled_works+0x10/0x10 [ 946.003490][ T1045] ? assign_work+0x3cf/0x5d0 [ 946.003518][ T1045] worker_thread+0xa47/0xfb0 [ 946.003573][ T1045] kthread+0x38b/0x480 [ 946.003591][ T1045] ? __pfx_worker_thread+0x10/0x10 [ 946.003612][ T1045] ? __pfx_kthread+0x10/0x10 [ 946.003632][ T1045] ret_from_fork+0x514/0xb70 [ 946.003663][ T1045] ? __pfx_ret_from_fork+0x10/0x10 [ 946.003690][ T1045] ? __switch_to+0xc89/0x1420 [ 946.003717][ T1045] ? __pfx_kthread+0x10/0x10 [ 946.003737][ T1045] ret_from_fork_asm+0x1a/0x30 [ 946.003781][ T1045] [ 946.046919][ T1045] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 946.375032][T17283] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3098'. [ 946.904152][T17243] bridge0: port 1(bridge_slave_0) entered blocking state [ 946.904321][T17243] bridge0: port 1(bridge_slave_0) entered disabled state [ 946.904495][T17243] bridge_slave_0: entered allmulticast mode [ 946.937987][T17243] bridge_slave_0: entered promiscuous mode [ 946.951347][T17243] bridge0: port 2(bridge_slave_1) entered blocking state [ 946.957324][T17243] bridge0: port 2(bridge_slave_1) entered disabled state [ 946.957498][T17243] bridge_slave_1: entered allmulticast mode [ 946.987937][T17243] bridge_slave_1: entered promiscuous mode [ 947.032506][T17300] loop4: detected capacity change from 0 to 1024 [ 947.096166][T17300] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 947.160754][T17243] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 947.164394][T17243] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 947.305242][T17243] team0: Port device team_slave_0 added [ 947.308710][T17243] team0: Port device team_slave_1 added [ 947.481073][T17243] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 947.481111][T17243] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 947.481134][T17243] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 947.501597][T17243] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 947.501615][T17243] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 947.501638][T17243] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 947.625151][T16200] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 947.745119][T17243] hsr_slave_0: entered promiscuous mode [ 947.749403][T17243] hsr_slave_1: entered promiscuous mode [ 947.750246][T17243] debugfs: 'hsr0' already exists in 'hsr' [ 947.750265][T17243] Cannot create hsr debugfs directory [ 947.786980][ T5620] Bluetooth: hci4: command tx timeout [ 947.814462][T17314] device-mapper: ioctl: Invalid ioctl structure: name żą, dev fff85a7b [ 947.943001][T17319] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3111'. [ 948.020760][T17321] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3113'. [ 948.557977][ T1045] veth5: left allmulticast mode [ 948.558023][ T1045] veth5: left promiscuous mode [ 948.558507][ T1045] bridge3: port 1(veth5) entered disabled state [ 948.587702][ T1045] veth7: left allmulticast mode [ 948.587728][ T1045] veth7: left promiscuous mode [ 948.588065][ T1045] bridge4: port 1(veth7) entered disabled state [ 949.046490][T17333] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 949.715058][ T1045] bond0 (unregistering): Released all slaves [ 949.858282][ T5620] Bluetooth: hci4: command tx timeout [ 949.939821][T17325] loop2: detected capacity change from 0 to 40427 [ 949.957832][T17325] F2FS-fs (loop2): Corrupted extension count (64 + 1 > 64) [ 949.957857][T17325] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 949.958755][T17325] F2FS-fs (loop2): Image doesn't support compression [ 949.959693][T17325] F2FS-fs (loop2): invalid crc value [ 950.578811][T17325] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 950.618437][T17325] F2FS-fs (loop2): f2fs_disable_checkpoint starts, unusable: 0 [ 950.618484][T17325] F2FS-fs (loop2): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 950.618836][T17325] F2FS-fs (loop2): Start checkpoint disabled! [ 950.686234][ T1045] tipc: Disabling bearer [ 950.686467][ T1045] tipc: Left network mode [ 950.737905][T17357] loop4: detected capacity change from 0 to 1024 [ 950.950088][T17325] F2FS-fs (loop2): f2fs_disable_checkpoint finishes, err:0 [ 951.043401][T17325] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 951.043445][T17325] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 951.251271][T17357] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 952.052237][ T5620] Bluetooth: hci4: command tx timeout [ 952.176816][T16200] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 952.959847][ T10] usb 5-1: new full-speed USB device number 87 using dummy_hcd [ 953.050611][ T1045] hsr_slave_0: left promiscuous mode [ 953.077715][ T1045] hsr_slave_1: left promiscuous mode [ 953.085978][ T1045] batman_adv: batadv0: Removing interface: macsec1 [ 953.620795][T17385] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 954.901967][T17403] loop1: detected capacity change from 0 to 512 [ 955.014892][T17403] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 955.034336][T17403] ext4 filesystem being mounted at /617/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 955.579741][ T5614] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 956.201098][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 956.217095][ T10] usb 5-1: New USB device found, idVendor=0eb1, idProduct=7007, bcdDevice= 2.08 [ 956.233053][ T10] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 956.235160][ T10] usb 5-1: can't read configurations, error -71 [ 956.933858][T17243] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 957.003131][T17243] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 957.015522][T17243] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 957.195875][T17243] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 957.338783][T17435] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3142'. [ 957.357556][T17435] netlink: 80 bytes leftover after parsing attributes in process `syz.2.3142'. [ 957.390801][T17243] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 957.452497][T17243] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 957.484464][T17243] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 957.547397][T17243] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 957.687126][T17437] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 958.742940][T17462] netlink: 300 bytes leftover after parsing attributes in process `syz.4.3148'. [ 958.870080][T17464] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3149'. [ 959.029924][T17467] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3151'. [ 959.515145][T17243] 8021q: adding VLAN 0 to HW filter on device bond0 [ 959.643275][T17243] 8021q: adding VLAN 0 to HW filter on device team0 [ 959.676392][ T6847] bridge0: port 1(bridge_slave_0) entered blocking state [ 959.676542][ T6847] bridge0: port 1(bridge_slave_0) entered forwarding state [ 959.692884][ T10] usb 2-1: new full-speed USB device number 68 using dummy_hcd [ 959.723322][ T6847] bridge0: port 2(bridge_slave_1) entered blocking state [ 959.723451][ T6847] bridge0: port 2(bridge_slave_1) entered forwarding state [ 959.803179][T17243] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 959.814233][T17243] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 961.674479][T17243] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 961.852127][T17243] veth0_vlan: entered promiscuous mode [ 961.909372][T17243] veth1_vlan: entered promiscuous mode [ 961.984697][T17243] veth0_macvtap: entered promiscuous mode [ 962.014036][T17243] veth1_macvtap: entered promiscuous mode [ 962.056576][T17243] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 962.100949][T17469] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 962.121907][T17243] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 962.203297][ T1045] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 962.280044][ T43] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 962.299549][ T43] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 962.323450][ T1045] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 962.346122][ T43] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 962.952070][T17500] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 963.012420][T17503] netlink: 300 bytes leftover after parsing attributes in process `syz.4.3158'. [ 963.100601][T17505] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3160'. [ 963.459758][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 963.468423][ T10] usb 2-1: New USB device found, idVendor=0eb1, idProduct=7007, bcdDevice= 2.08 [ 963.478445][ T10] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 963.478495][ T10] usb 2-1: can't read configurations, error -71 [ 963.518165][ T6847] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 963.518203][ T6847] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 966.226679][T11636] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 966.226717][T11636] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 966.543520][T17529] loop2: detected capacity change from 0 to 1024 [ 966.560691][T17529] EXT4-fs (loop2): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 966.626141][ C1] sched: DL replenish lagged too much [ 966.743738][T17533] loop3: detected capacity change from 0 to 1024 [ 966.769943][T17533] EXT4-fs: Ignoring removed bh option [ 966.785853][T17533] EXT4-fs (loop3): stripe (17) is not aligned with cluster size (16), stripe is disabled [ 966.862397][T17529] EXT4-fs error (device loop2): ext4_map_blocks:790: inode #3: block 2: comm syz.2.3167: lblock 2 mapped to illegal pblock 2 (length 1) [ 966.891586][T17533] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 966.941476][T17529] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 966.946903][ C0] EXT4-fs (loop2): error count since last fsck: 1 [ 966.946940][ C0] EXT4-fs (loop2): initial error at time 1786619341: ext4_map_blocks:790: inode 3: block 2 [ 966.946990][ C0] EXT4-fs (loop2): last error at time 1786619341: ext4_map_blocks:790: inode 3: block 2 [ 966.998816][T17529] Quota error (device loop2): qtree_write_dquot: dquota write failed [ 966.998969][T17529] EXT4-fs error (device loop2): ext4_map_blocks:790: inode #3: block 48: comm syz.2.3167: lblock 0 mapped to illegal pblock 48 (length 1) [ 966.999018][T17529] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 967.030859][T17529] Quota error (device loop2): v2_write_file_info: Can't write info structure [ 967.030901][T17529] EXT4-fs error (device loop2): ext4_acquire_dquot:7069: comm syz.2.3167: Failed to acquire dquot type 0 [ 967.030938][T17529] loop2: lost filesystem error report for type 5 error -117 [ 967.068802][T17529] EXT4-fs error (device loop2) in ext4_reserve_inode_write:6517: Corrupt filesystem [ 967.110690][T17529] loop2: lost filesystem error report for type 5 error -117 [ 967.314200][T17529] EXT4-fs error (device loop2): ext4_evict_inode:269: inode #11: comm syz.2.3167: mark_inode_dirty error [ 967.314342][T17529] loop2: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 967.342217][T17529] EXT4-fs warning (device loop2): ext4_evict_inode:272: couldn't mark inode dirty (err -117) [ 967.342412][T17529] EXT4-fs (loop2): 1 orphan inode deleted [ 967.391493][T17529] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 967.413305][ T59] EXT4-fs error (device loop2): ext4_map_blocks:790: inode #3: block 1: comm kworker/u8:4: lblock 1 mapped to illegal pblock 1 (length 1) [ 967.454948][ T59] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 967.594277][ T59] Quota error (device loop2): remove_tree: Can't read quota data block 1 [ 967.615922][ T59] EXT4-fs error (device loop2): ext4_release_dquot:7105: comm kworker/u8:4: Failed to release dquot type 0 [ 967.880456][T16681] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 967.908173][T16681] EXT4-fs error (device loop2): __ext4_get_inode_loc:4916: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 967.960081][T16681] loop2: lost filesystem error report for type 5 error -117 [ 968.026166][T12100] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 968.056055][T16681] EXT4-fs error (device loop2) in ext4_reserve_inode_write:6517: Corrupt filesystem [ 968.056096][T16681] loop2: lost filesystem error report for type 5 error -117 [ 968.069700][T12100] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 968.090795][T12100] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 968.101968][T12100] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 968.103547][T12100] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 968.187427][T16681] EXT4-fs error (device loop2): ext4_quota_off:7353: inode #3: comm syz-executor: mark_inode_dirty error [ 968.187471][T16681] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 968.202944][T16681] EXT4-fs error (device loop2): __ext4_get_inode_loc:4916: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 968.202993][T16681] loop2: lost filesystem error report for type 5 error -117 [ 968.843340][T17555] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 969.898904][ T9] usb 3-1: new full-speed USB device number 94 using dummy_hcd [ 970.180661][ T5620] Bluetooth: hci1: command tx timeout [ 970.829184][T12234] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 971.723409][T17243] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 972.265980][ T5620] Bluetooth: hci1: command tx timeout [ 972.364778][T17584] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3180'. [ 972.375897][T17584] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3180'. [ 972.575805][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 972.594566][ T9] usb 3-1: New USB device found, idVendor=0eb1, idProduct=7007, bcdDevice= 2.08 [ 972.608527][ T9] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 972.608581][ T9] usb 3-1: can't read configurations, error -71 [ 972.676526][T12234] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 973.233945][T17596] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3185'. [ 973.519687][T12234] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 973.950253][T12234] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 974.066764][T17607] tipc: Started in network mode [ 974.073166][T17607] tipc: Node identity 4acdff12ef11, cluster identity 4711 [ 974.084854][T17607] tipc: Enabled bearer , priority 0 [ 974.157409][T17611] tipc: Resetting bearer [ 974.341460][ T5620] Bluetooth: hci1: command tx timeout [ 974.491113][T17617] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3192'. [ 974.506531][T17604] tipc: Disabling bearer [ 974.756967][T16643] usb 3-1: new full-speed USB device number 96 using dummy_hcd [ 976.255378][T17539] bridge0: port 1(bridge_slave_0) entered blocking state [ 976.266442][T17539] bridge0: port 1(bridge_slave_0) entered disabled state [ 976.274531][T17539] bridge_slave_0: entered allmulticast mode [ 976.282934][T17539] bridge_slave_0: entered promiscuous mode [ 976.292938][T17539] bridge0: port 2(bridge_slave_1) entered blocking state [ 976.300757][T17539] bridge0: port 2(bridge_slave_1) entered disabled state [ 976.308279][T17539] bridge_slave_1: entered allmulticast mode [ 976.351001][T17539] bridge_slave_1: entered promiscuous mode [ 976.420899][ T5620] Bluetooth: hci1: command tx timeout [ 976.967692][T12234] veth1_to_hsr: left allmulticast mode [ 976.967743][T12234] veth1_to_hsr: left promiscuous mode [ 976.980049][T12234] bridge0: port 1(veth1_to_hsr) entered disabled state [ 977.373173][T12234] veth5: left allmulticast mode [ 977.378677][T12234] veth5: left promiscuous mode [ 977.378953][T12234] bridge2: port 1(veth5) entered disabled state [ 977.594127][T16643] usb 3-1: unable to get BOS descriptor or descriptor too short [ 977.609947][T16643] usb 3-1: New USB device found, idVendor=0eb1, idProduct=7007, bcdDevice= 2.08 [ 977.622754][T16643] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 977.622807][T16643] usb 3-1: can't read configurations, error -71 [ 977.690626][T12234] veth0_to_bond: left allmulticast mode [ 977.704508][T12234] veth0_to_bond: left promiscuous mode [ 977.704737][T12234] bridge4: port 1(veth0_to_bond) entered disabled state [ 977.812257][T12234] veth9: left allmulticast mode [ 977.812300][T12234] veth9: left promiscuous mode [ 977.812506][T12234] bridge5: port 1(veth9) entered disabled state [ 977.911751][T12234] veth11: left allmulticast mode [ 977.917315][T12234] veth11: left promiscuous mode [ 977.922662][T12234] bridge6: port 1(veth11) entered disabled state [ 979.149111][T17670] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3200'. [ 979.897539][T12234] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 979.926192][T12234] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 979.960687][T12234] bond0 (unregistering): Released all slaves [ 980.020880][T17539] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 980.065953][T17539] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 980.605594][T12234] tipc: Disabling bearer [ 980.605735][T12234] tipc: Left network mode [ 980.839808][T17539] team0: Port device team_slave_0 added [ 980.906987][T17539] team0: Port device team_slave_1 added [ 981.046701][ T5277] 8021q: adding VLAN 0 to HW filter on device eth1 [ 981.253381][T17539] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 981.265480][T17539] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 981.292118][T17539] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 981.352548][T17539] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 981.352581][T17539] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 981.352620][T17539] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 984.604739][T17698] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 993.268490][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.281593][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 1013.946709][T11637] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1016.075207][T12100] Bluetooth: hci5: command 0x0406 tx timeout [ 1045.720288][T17710] Bluetooth: hci3: command tx timeout [ 1054.697098][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.711761][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 1058.819575][ T5620] Bluetooth: hci2: command 0x0406 tx timeout [ 1080.132890][T12100] Bluetooth: hci4: command tx timeout [ 1116.217931][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.234208][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 1117.919721][T17710] Bluetooth: hci1: command tx timeout [ 1160.841949][ T32] INFO: task dhcpcd:5276 blocked for more than 144 seconds. [ 1160.855596][ T32] Tainted: G L syzkaller #0 [ 1160.870329][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1160.884532][ T32] task:dhcpcd state:D stack:25032 pid:5276 tgid:5276 ppid:1 task_flags:0x400140 flags:0x00080000 [ 1160.912430][ T32] Call Trace: [ 1160.926842][ T32] [ 1160.941233][ T32] __schedule+0x1b4d/0x59e0 [ 1160.955548][ T32] ? stack_depot_save_flags+0x33/0x7f0 [ 1160.985182][ T32] ? __pfx___schedule+0x10/0x10 [ 1161.000129][ T32] ? schedule+0x90/0x2b0 [ 1161.014589][ T32] schedule+0x164/0x2b0 [ 1161.029047][ T32] schedule_preempt_disabled+0x13/0x30 [ 1161.043362][ T32] __mutex_lock+0x7c1/0x1550 [ 1161.073757][ T32] ? __mutex_lock+0x5d4/0x1550 [ 1161.088902][ T32] ? nl80211_pre_doit+0x5e/0x890 [ 1161.103326][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 1161.117777][ T32] ? trace_kmalloc+0x2a/0xf0 [ 1161.132227][ T32] ? __kmalloc_noprof+0x38c/0x720 [ 1161.146608][ T32] ? __nla_parse+0x40/0x60 [ 1161.161104][ T32] nl80211_pre_doit+0x5e/0x890 [ 1161.176715][ T32] genl_family_rcv_msg_doit+0x1db/0x340 [ 1161.205252][ T32] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1161.219678][ T32] ? __lock_acquire+0x6df/0x2e50 [ 1161.234019][ T32] ? __lock_acquire+0x6df/0x2e50 [ 1161.249108][ T32] genl_rcv_msg+0x614/0x7a0 [ 1161.263507][ T32] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1161.279008][ T32] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 1161.294144][ T32] ? __pfx_nl80211_get_wiphy+0x10/0x10 [ 1161.308533][ T32] ? __pfx_nl80211_post_doit+0x10/0x10 [ 1161.323262][ T32] netlink_rcv_skb+0x226/0x4a0 [ 1161.337588][ T32] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1161.352081][ T32] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1161.366516][ T32] ? down_read+0x2be/0x330 [ 1161.382267][ T32] genl_rcv+0x28/0x40 [ 1161.397433][ T32] netlink_unicast+0x7bd/0x940 [ 1161.411892][ T32] netlink_sendmsg+0x813/0xb40 [ 1161.426363][ T32] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1161.440818][ T32] ? apparmor_socket_sendmsg+0x98/0x360 [ 1161.455355][ T32] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1161.469876][ T32] sock_sendmsg_nosec+0x13a/0x180 [ 1161.486566][ T32] ____sys_sendmsg+0x54e/0x850 [ 1161.501777][ T32] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1161.516279][ T32] ? import_iovec+0x73/0xa0 [ 1161.530687][ T32] ___sys_sendmsg+0x2a5/0x360 [ 1161.545029][ T32] ? __pfx____sys_sendmsg+0x10/0x10 [ 1161.559599][ T32] __x64_sys_sendmsg+0x1b1/0x290 [ 1161.574125][ T32] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1161.589611][ T32] ? __seccomp_permit_syscall+0xe7/0x2b0 [ 1161.604724][ T32] do_syscall_64+0x166/0x520 [ 1161.619137][ T32] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1161.633677][ T32] ? clear_bhb_loop+0x70/0xc0 [ 1161.648010][ T32] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1161.662431][ T32] RIP: 0033:0x7f92c1623407 [ 1161.677682][ T32] RSP: 002b:00007ffc7bb7c880 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 1161.709227][ T32] RAX: ffffffffffffffda RBX: 00007f92c1599780 RCX: 00007f92c1623407 [ 1161.723914][ T32] RDX: 0000000000000000 RSI: 00007ffc7bb7c900 RDI: 000000000000000e [ 1161.738642][ T32] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1161.753517][ T32] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1161.768150][ T32] R13: 000000000000000e R14: 00007ffc7bb90dc0 R15: 00005644d278e760 [ 1161.782796][ T32] [ 1161.798385][ T32] [ 1161.798385][ T32] Showing all locks held in the system: [ 1161.813381][ T32] locks held by kthreadd/2: 1, last CPU#0: [ 1161.828073][ T32] #0: ffffffff8eea49f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 1161.918986][ T32] locks held by kworker/R-rcu_g/4: 1, on CPU#1: [ 1161.933455][ T32] #0: ffffffff8ebf91e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 1162.023461][ T32] locks held by kworker/R-kvfre/6: 1, on CPU#1: [ 1162.040180][ T32] #0: ffffffff8ebf91e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 1162.130534][ T32] locks held by kworker/0:0/9: 3, last CPU#0: [ 1162.145099][ T32] #0: ffff8880478a6d40 ((wq_completion)wg-kex-wg2#12){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1162.253160][ T32] #1: ffffc900000e7c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1162.344270][ T32] #2: ffff888051fc0330 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 1162.435103][ T32] locks held by kworker/0:1/10: 2, last CPU#0: [ 1162.449573][ T32] #0: ffff8880478a6940 ((wq_completion)wg-crypt-wg2#6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1162.555011][ T32] #1: ffffc900000f7c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1162.645725][ T32] locks held by kworker/R-mm_pe/14: 1, on CPU#0: [ 1162.660542][ T32] #0: ffffffff8ebf91e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 1162.751234][ T32] locks held by kworker/1:1/30: 4, last CPU#1: [ 1162.765750][ T32] #0: ffff88807a4e2540 ((wq_completion)wg-kex-wg0#10){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1162.870819][ T32] #1: ffffc90000a57c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630