last executing test programs: 11m28.751480337s ago: executing program 0 (id=7714): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000140)={0x0, 0x1, 0xe}, 0x8) 11m28.504193378s ago: executing program 0 (id=7718): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) msync(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x6) 11m28.278949568s ago: executing program 0 (id=7723): syz_mount_image$ntfs3(&(0x7f0000000040), &(0x7f0000000080)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='sparse,acl,nohidden,iocharset=cp1250 [ 1276.678072][T24382] dump_stack_lvl+0xe8/0x150 [ 1276.678108][T24382] f2fs_handle_critical_error+0x37c/0x540 [ 1276.678138][T24382] f2fs_write_end_io+0xcdb/0xff0 [ 1276.678181][T24382] __submit_merged_bio+0x256/0x700 [ 1276.678214][T24382] __submit_merged_write_cond+0x3c9/0x4e0 [ 1276.678244][T24382] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 1276.678287][T24382] f2fs_write_data_pages+0x2975/0x35e0 [ 1276.678340][T24382] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 1276.678374][T24382] ? css_rstat_updated+0x23a/0x530 [ 1276.678419][T24382] ? mod_memcg_lruvec_state+0x20c/0x440 [ 1276.678443][T24382] ? __lock_acquire+0x6b5/0x2cf0 [ 1276.678480][T24382] ? __lock_acquire+0x6b5/0x2cf0 [ 1276.678507][T24382] ? do_raw_spin_lock+0x12b/0x2f0 [ 1276.678537][T24382] ? do_raw_spin_unlock+0xf5/0x210 [ 1276.678557][T24382] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 1276.678581][T24382] do_writepages+0x32e/0x550 [ 1276.678617][T24382] ? do_raw_spin_unlock+0xf5/0x210 [ 1276.678641][T24382] filemap_fdatawrite+0x1e9/0x2f0 [ 1276.678664][T24382] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 1276.678727][T24382] ? do_raw_spin_unlock+0xf5/0x210 [ 1276.678751][T24382] f2fs_sync_dirty_inodes+0x30e/0x860 [ 1276.678795][T24382] f2fs_write_checkpoint+0x9df/0x26a0 [ 1276.678848][T24382] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 1276.678931][T24382] kill_f2fs_super+0x314/0x720 [ 1276.678960][T24382] ? __pfx_kill_f2fs_super+0x10/0x10 [ 1276.679034][T24382] ? lockdep_hardirqs_on+0x7a/0x110 [ 1276.679077][T24382] deactivate_locked_super+0xbc/0x130 [ 1276.679107][T24382] cleanup_mnt+0x437/0x4d0 [ 1276.679149][T24382] ? _raw_spin_unlock_irq+0x23/0x50 [ 1276.679178][T24382] task_work_run+0x1d9/0x270 [ 1276.679209][T24382] ? __pfx_task_work_run+0x10/0x10 [ 1276.679267][T24382] exit_to_user_mode_loop+0xed/0x480 [ 1276.679305][T24382] ? rcu_is_watching+0x15/0xb0 [ 1276.679339][T24382] do_syscall_64+0x32d/0xf80 [ 1276.679357][T24382] ? trace_irq_disable+0x3b/0x150 [ 1276.679379][T24382] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1276.679398][T24382] ? clear_bhb_loop+0x40/0x90 [ 1276.679434][T24382] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1276.679475][T24382] RIP: 0033:0x7fa816d9d9d7 [ 1276.679499][T24382] Code: a2 c7 05 1c ed 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 1276.679514][T24382] RSP: 002b:00007ffc63c82948 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 1276.679543][T24382] RAX: 0000000000000000 RBX: 00007fa816e31f90 RCX: 00007fa816d9d9d7 [ 1276.679555][T24382] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc63c82a00 [ 1276.679565][T24382] RBP: 00007ffc63c82a00 R08: 00007ffc63c83a00 R09: 00000000ffffffff [ 1276.679577][T24382] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc63c83a90 [ 1276.679594][T24382] R13: 00007fa816e31f90 R14: 000000000014c76e R15: 00007ffc63c83ad0 [ 1276.679622][T24382] [ 1276.715836][ T796] IPVS: starting estimator thread 0... [ 1276.741618][T24382] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 1276.966089][T24141] IPVS: using max 31 ests per chain, 74400 per kthread [ 1277.185688][ T5824] BTRFS info (device loop3): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 1277.355786][ T30] audit: type=1326 audit(1362.611:663): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24161 comm="syz.7.15737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f474ff9c799 code=0x7ffc0000 [ 1277.397929][ T30] audit: type=1326 audit(1362.665:664): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24161 comm="syz.7.15737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f474ff9c799 code=0x7ffc0000 [ 1277.509007][T24163] loop7: detected capacity change from 0 to 4096 [ 1277.527686][ T30] audit: type=1326 audit(1362.675:665): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24161 comm="syz.7.15737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f474ff9c799 code=0x7ffc0000 [ 1277.620726][ T30] audit: type=1326 audit(1362.675:666): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24161 comm="syz.7.15737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f474ff9c502 code=0x7ffc0000 [ 1277.674300][T24163] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1277.692154][ T30] audit: type=1326 audit(1362.708:667): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24161 comm="syz.7.15737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f474ff5cfce code=0x7ffc0000 [ 1277.715668][ T30] audit: type=1326 audit(1362.783:668): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24161 comm="syz.7.15737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7f474ff9c5c7 code=0x7ffc0000 [ 1277.739162][ T30] audit: type=1326 audit(1362.793:669): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24161 comm="syz.7.15737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f474ff5cfce code=0x7ffc0000 [ 1277.762501][ T30] audit: type=1326 audit(1362.793:670): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24161 comm="syz.7.15737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f474ff9c42b code=0x7ffc0000 [ 1277.784708][ T30] audit: type=1326 audit(1362.869:671): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24161 comm="syz.7.15737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f474ff5cfce code=0x7ffc0000 [ 1277.810915][ T30] audit: type=1326 audit(1362.869:672): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24161 comm="syz.7.15737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f474ff5cfce code=0x7ffc0000 [ 1278.009586][T24163] EXT4-fs error (device loop7): ext4_do_update_inode:5569: inode #15: comm syz.7.15737: corrupted inode contents [ 1278.072774][T24163] loop7: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 1278.094125][T24163] EXT4-fs error (device loop7): ext4_dirty_inode:6450: inode #15: comm syz.7.15737: mark_inode_dirty error [ 1278.173934][T24195] netlink: 'syz.3.15733': attribute type 15 has an invalid length. [ 1278.189366][T24163] loop7: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 1278.189968][T24163] EXT4-fs error (device loop7): ext4_do_update_inode:5569: inode #15: comm syz.7.15737: corrupted inode contents [ 1278.237253][T24163] loop7: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 1278.240128][T24163] EXT4-fs error (device loop7): __ext4_ext_dirty:207: inode #15: comm syz.7.15737: mark_inode_dirty error [ 1278.280499][T24163] loop7: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 1278.280922][T24163] EXT4-fs error (device loop7): ext4_do_update_inode:5569: inode #15: comm syz.7.15737: corrupted inode contents [ 1278.308893][T24163] loop7: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 1278.341100][T24163] EXT4-fs error (device loop7): __ext4_ext_dirty:207: inode #15: comm syz.7.15737: mark_inode_dirty error [ 1278.428163][T24163] loop7: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 1278.429026][T24163] EXT4-fs error (device loop7): ext4_do_update_inode:5569: inode #15: comm syz.7.15737: corrupted inode contents [ 1278.490501][T24163] loop7: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 1278.508188][T24163] EXT4-fs error (device loop7): ext4_truncate:4587: inode #15: comm syz.7.15737: mark_inode_dirty error [ 1278.585484][T24163] loop7: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 1278.587549][T24163] EXT4-fs error (device loop7): ext4_evict_inode:266: comm syz.7.15737: couldn't truncate inode 15 (err -117) [ 1278.676404][T24213] ipvlan0: entered promiscuous mode [ 1278.818598][ T809] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1279.005730][T24231] loop7: detected capacity change from 0 to 256 [ 1279.052335][T24231] FAT-fs (loop7): Directory bread(block 64) failed [ 1279.087933][T24231] FAT-fs (loop7): Directory bread(block 65) failed [ 1279.098955][T24231] FAT-fs (loop7): Directory bread(block 66) failed [ 1279.117955][T24231] FAT-fs (loop7): Directory bread(block 67) failed [ 1279.138568][T24231] FAT-fs (loop7): Directory bread(block 68) failed [ 1279.154981][T24194] loop5: detected capacity change from 0 to 32768 [ 1279.167524][T24231] FAT-fs (loop7): Directory bread(block 69) failed [ 1279.186147][T24231] FAT-fs (loop7): Directory bread(block 70) failed [ 1279.219554][T24194] XFS (loop5): DAX unsupported by block device. Turning off DAX. [ 1279.229569][T24231] FAT-fs (loop7): Directory bread(block 71) failed [ 1279.259099][T24231] FAT-fs (loop7): Directory bread(block 72) failed [ 1279.268241][T24194] XFS (loop5): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 1279.279302][T24231] FAT-fs (loop7): Directory bread(block 73) failed [ 1279.344136][T24194] XFS (loop5): Ending clean mount [ 1279.387852][T24194] XFS (loop5): Quotacheck needed: Please wait. [ 1279.752613][T24194] XFS (loop5): Quotacheck: Done. [ 1279.759040][T24276] blktrace: Concurrent blktraces are not allowed on sg0 [ 1280.035631][T24382] XFS (loop5): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 1280.734228][T24332] loop3: detected capacity change from 0 to 8 [ 1280.890800][T24345] overlayfs: failed to resolve '/ õ0Ç'‹;éanM>~fÝ»Ÿ·÷”4*J¦ÑN&»€è«KÊ': -2 [ 1281.069826][T24354] loop5: detected capacity change from 0 to 128 [ 1281.149503][T24360] syz.6.15785 (24360): drop_caches: 4 [ 1281.159482][T24354] EXT4-fs (loop5): Test dummy encryption mode enabled [ 1281.220558][T24354] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1281.409413][T24382] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1281.519554][T24371] loop3: detected capacity change from 0 to 4096 [ 1281.573647][T24371] ntfs3(loop3): Different NTFS sector size (2048) and media sector size (512). [ 1281.932920][T24342] loop4: detected capacity change from 0 to 32768 [ 1281.982106][T24342] [ 1281.982106][T24342] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 1281.982106][T24342] [ 1282.121045][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 1282.121063][ T30] audit: type=1326 audit(1367.740:681): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24414 comm="syz.7.15797" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f474ff9c799 code=0x7ffc0000 [ 1282.153552][T24416] loop5: detected capacity change from 0 to 64 [ 1282.265306][ T30] audit: type=1326 audit(1367.740:682): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24414 comm="syz.7.15797" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f474ff9c799 code=0x7ffc0000 [ 1282.333853][ T30] audit: type=1326 audit(1367.793:683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24414 comm="syz.7.15797" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f474ff9c799 code=0x7ffc0000 [ 1282.356819][ T30] audit: type=1326 audit(1367.825:684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24414 comm="syz.7.15797" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f474ff9c799 code=0x7ffc0000 [ 1282.411569][T24342] read_mapping_page failed! [ 1282.427448][T24342] ERROR: (device loop4): txCommit: [ 1282.427448][T24342] [ 1282.458599][ T30] audit: type=1326 audit(1367.825:685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24414 comm="syz.7.15797" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f474ff9c799 code=0x7ffc0000 [ 1282.547919][ T30] audit: type=1326 audit(1367.836:686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24414 comm="syz.7.15797" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f474ff9c799 code=0x7ffc0000 [ 1282.621278][T24438] loop5: detected capacity change from 0 to 128 [ 1282.633135][ T5815] [ 1282.633135][ T5815] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 1282.633135][ T5815] [ 1282.643674][ T30] audit: type=1326 audit(1367.836:687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24414 comm="syz.7.15797" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f474ff9c799 code=0x7ffc0000 [ 1282.643721][ T30] audit: type=1326 audit(1367.836:688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24414 comm="syz.7.15797" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f474ff9c799 code=0x7ffc0000 [ 1282.661385][T24440] loop6: detected capacity change from 0 to 1024 [ 1282.685768][T24438] FAT-fs (loop5): Directory bread(block 524322) failed [ 1282.730780][T24438] FAT-fs (loop5): Directory bread(block 524323) failed [ 1282.734248][ T5815] [ 1282.734248][ T5815] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 1282.734248][ T5815] [ 1282.745815][T24438] FAT-fs (loop5): Directory bread(block 524324) failed [ 1282.787559][T24438] FAT-fs (loop5): Directory bread(block 524325) failed [ 1282.815053][T24440] hfsplus: bad catalog entry type [ 1282.837498][T24438] FAT-fs (loop5): Directory bread(block 524326) failed [ 1282.893763][T24438] FAT-fs (loop5): Directory bread(block 524327) failed [ 1282.931317][T24438] FAT-fs (loop5): Directory bread(block 524328) failed [ 1282.942381][ T49] hfsplus: b-tree write err: -5, ino 25 [ 1282.962160][T24456] loop7: detected capacity change from 0 to 256 [ 1282.962959][T24438] FAT-fs (loop5): Directory bread(block 524329) failed [ 1282.979783][ T49] hfsplus: b-tree write err: -5, ino 4 [ 1283.003248][ T49] hfsplus: b-tree write err: -5, ino 2 [ 1283.110000][T24438] FAT-fs (loop5): Directory bread(block 524322) failed [ 1283.122591][T24438] FAT-fs (loop5): Directory bread(block 524323) failed [ 1283.175107][T24465] F2FS-fs: Conflicting test_dummy_encryption options [ 1283.625483][T24494] loop4: detected capacity change from 0 to 2048 [ 1283.653323][T24494] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 1024) [ 1283.739832][T24509] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1283.798187][T24510] loop5: detected capacity change from 0 to 512 [ 1283.865343][T24510] EXT4-fs (loop5): 1 orphan inode deleted [ 1283.884286][T17081] Quota error (device loop5): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 1283.953638][T17081] EXT4-fs error (device loop5): ext4_release_dquot:7037: comm kworker/u8:6: Failed to release dquot type 1 [ 1283.965334][T17081] loop5: lost filesystem error report for type 5 error -117 [ 1283.978411][T24510] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1284.041089][T24510] EXT4-fs: Ignoring sb option on remount [ 1284.061066][T24510] EXT4-fs: Remounting fs w/o journal so ignoring data_err option [ 1284.082666][T24510] EXT4-fs: Cannot change journaled quota options when quota turned on [ 1284.289021][T24543] loop7: detected capacity change from 0 to 512 [ 1284.298336][T24382] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1284.353636][T24543] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 1284.387655][T24550] loop4: detected capacity change from 0 to 1024 [ 1284.446834][T24543] EXT4-fs error (device loop7): ext4_orphan_get:1417: comm syz.7.15827: bad orphan inode 16 [ 1284.469349][ T36] hfsplus: b-tree write err: -5, ino 25 [ 1284.484878][T24543] loop7: lost filesystem error report for type 5 error -117 [ 1284.485833][T24543] ext4_test_bit(bit=15, block=4) = 0 [ 1284.493240][ C0] EXT4-fs (loop7): error count since last fsck: 1 [ 1284.493261][ C0] EXT4-fs (loop7): initial error at time 1370: ext4_orphan_get:1417 [ 1284.493285][ C0] EXT4-fs (loop7): last error at time 1370: ext4_orphan_get:1417 [ 1284.517498][ T36] hfsplus: b-tree write err: -5, ino 4 [ 1284.531016][T24543] EXT4-fs (loop7): 1 orphan inode deleted [ 1284.552818][ T36] hfsplus: b-tree write err: -5, ino 2 [ 1284.583881][T24543] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1284.793065][ T809] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1285.982798][T24651] loop3: detected capacity change from 0 to 4096 [ 1286.068231][T24659] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1286.311599][T24614] loop6: detected capacity change from 0 to 32768 [ 1286.369190][T24614] XFS (loop6): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 1286.579813][T24614] XFS (loop6): Ending clean mount [ 1286.612237][T24614] XFS (loop6): Quotacheck needed: Please wait. [ 1287.133825][T24614] XFS (loop6): Quotacheck: Done. [ 1287.155014][T24720] netlink: 168 bytes leftover after parsing attributes in process `syz.5.15871'. [ 1287.181796][T24722] bridge0: entered promiscuous mode [ 1287.228222][T24722] macvtap1: entered promiscuous mode [ 1287.263233][T24722] macvtap1: entered allmulticast mode [ 1287.269919][T24722] bridge0: entered allmulticast mode [ 1287.319211][T24722] bridge0: port 3(macvtap1) entered blocking state [ 1287.356505][T24722] bridge0: port 3(macvtap1) entered disabled state [ 1287.405826][T24614] XFS (loop6): User initiated shutdown received. [ 1287.414349][T24614] XFS (loop6): Metadata I/O Error (0x4) detected at xfs_fs_goingdown+0x105/0x150 (fs/xfs/xfs_fsops.c:456). Shutting down filesystem. [ 1287.428928][T24614] XFS (loop6): Please unmount the filesystem and rectify the problem(s) [ 1287.436276][T24722] bridge0: left allmulticast mode [ 1287.449774][T24722] bridge0: left promiscuous mode [ 1287.497605][T26338] XFS (loop6): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 1287.621580][T24734] sp0: Synchronizing with TNC [ 1287.975028][T24763] netlink: 12 bytes leftover after parsing attributes in process `syz.5.15882'. [ 1288.587741][T24757] loop7: detected capacity change from 0 to 32768 [ 1288.679307][T24803] loop6: detected capacity change from 0 to 8 [ 1288.710023][T24803] cramfs: empty filesystem [ 1288.739232][ T5835] udevd[5835]: incorrect cramfs checksum on /dev/loop6 [ 1288.804115][ T5835] udevd[5835]: incorrect cramfs checksum on /dev/loop6 [ 1289.590088][ T796] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 1289.705917][T24873] tipc: Enabling of bearer rejected, failed to enable media [ 1289.728520][ T30] audit: type=1326 audit(1375.904:689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24875 comm="syz.3.15909" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa47d59c799 code=0x7ffc0000 [ 1289.771519][ T10] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 1289.797555][ T30] audit: type=1326 audit(1375.937:690): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24875 comm="syz.3.15909" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa47d59c799 code=0x7ffc0000 [ 1289.826393][ T796] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1289.843343][ T796] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1289.862337][ T796] usb 7-1: Product: syz [ 1289.871327][ T796] usb 7-1: Manufacturer: syz [ 1289.882352][ T30] audit: type=1326 audit(1375.947:691): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24875 comm="syz.3.15909" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa47d59c799 code=0x7ffc0000 [ 1289.893231][T24884] netlink: 8 bytes leftover after parsing attributes in process `syz.7.15911'. [ 1289.906722][ T796] usb 7-1: SerialNumber: syz [ 1289.938151][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 1289.961990][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1289.986955][ T796] usb 7-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1290.007745][ T10] usb 6-1: New USB device found, idVendor=056a, idProduct=0059, bcdDevice= 0.00 [ 1290.017315][ T30] audit: type=1326 audit(1375.947:692): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24875 comm="syz.3.15909" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa47d59c799 code=0x7ffc0000 [ 1290.028552][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1290.079450][ T10] usb 6-1: config 0 descriptor?? [ 1290.119070][T21360] usb 7-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1290.122857][ T30] audit: type=1326 audit(1375.947:693): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24875 comm="syz.3.15909" exe="/root/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7fa47d59c799 code=0x7ffc0000 [ 1290.134969][ T10] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 1290.234740][ T30] audit: type=1326 audit(1375.947:694): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24875 comm="syz.3.15909" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa47d59c799 code=0x7ffc0000 [ 1290.237748][ C0] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 1290.324879][ T30] audit: type=1326 audit(1375.947:695): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24875 comm="syz.3.15909" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa47d59c799 code=0x7ffc0000 [ 1290.363763][T24858] netlink: 24 bytes leftover after parsing attributes in process `syz.5.15903'. [ 1290.380765][ T30] audit: type=1326 audit(1375.958:696): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24875 comm="syz.3.15909" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa47d59c799 code=0x7ffc0000 [ 1290.387138][ C0] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 1290.413036][ T10] usb 6-1: USB disconnect, device number 26 [ 1290.493560][ T30] audit: type=1326 audit(1375.958:697): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24875 comm="syz.3.15909" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa47d59c799 code=0x7ffc0000 [ 1290.668996][ T796] usb 7-1: USB disconnect, device number 33 [ 1290.678167][ T30] audit: type=1326 audit(1375.958:698): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24875 comm="syz.3.15909" exe="/root/syz-executor" sig=0 arch=c000003e syscall=72 compat=0 ip=0x7fa47d59c799 code=0x7ffc0000 [ 1291.068390][T24901] loop3: detected capacity change from 0 to 32768 [ 1291.113907][T24901] XFS (loop3): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 1291.148021][T21360] ath9k_htc 7-1:1.0: ath9k_htc: Target is unresponsive [ 1291.172235][T21360] ath9k_htc: Failed to initialize the device [ 1291.199549][ T796] usb 7-1: ath9k_htc: USB layer deinitialized [ 1291.245526][T24901] XFS (loop3): Ending clean mount [ 1291.300973][T24901] XFS (loop3): Quotacheck needed: Please wait. [ 1291.548775][ T796] usb 7-1: new full-speed USB device number 34 using dummy_hcd [ 1291.618366][T24901] XFS (loop3): Quotacheck: Done. [ 1291.746858][ T796] usb 7-1: not running at top speed; connect to a high speed hub [ 1291.762430][ T796] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1291.780029][ T796] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1291.809526][ T796] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 512, setting to 64 [ 1291.846032][ T796] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 1291.868687][ T5824] XFS (loop3): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 1291.870120][ T796] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1291.886674][ T796] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1291.899523][ T796] usb 7-1: Product: syz [ 1291.905989][ T796] usb 7-1: Manufacturer: syz [ 1291.911868][ T796] usb 7-1: SerialNumber: syz [ 1291.922622][T24843] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1291.941176][T24843] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1291.958367][T24843] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1291.958771][T24987] loop5: detected capacity change from 0 to 4096 [ 1291.990368][T24843] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1292.012327][T24993] NILFS (loop5): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1292.026970][T24987] NILFS error (device loop5): nilfs_bmap_lookup_at_level: broken bmap (inode number=6) [ 1292.038369][ T796] usb 7-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1292.277486][ T10] usb 7-1: ath9k_htc: Firmware - ath9k_htc/htc_9271-1.4.0.fw download failed [ 1292.277754][ T5819] usb 7-1: USB disconnect, device number 34 [ 1292.350347][T24987] NILFS (loop5): mounting fs with errors [ 1292.390831][ T5819] usb 7-1: ath9k_htc: USB layer deinitialized [ 1292.682406][T24989] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 1293.522022][T25076] netlink: 8 bytes leftover after parsing attributes in process `syz.7.15949'. [ 1293.539733][T25074] netlink: 8 bytes leftover after parsing attributes in process `syz.3.15948'. [ 1293.575807][T25076] bond0: option lp_interval: invalid value (18446744073709551612) [ 1293.597109][T25076] bond0: option lp_interval: allowed values 1 - 2147483647 [ 1293.718090][T25040] loop6: detected capacity change from 0 to 32768 [ 1293.754036][T25040] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.15940 (25040) [ 1293.801665][T25040] BTRFS info (device loop6): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1293.834536][T25040] BTRFS info (device loop6): using crc32c checksum algorithm [ 1293.968058][ T12] BTRFS warning (device loop6): checksum verify failed on logical 5332992 mirror 1 wanted 0x0a5e5d25 found 0xcee3a718 level 0 [ 1294.156707][T25118] loop3: detected capacity change from 0 to 64 [ 1294.224941][T25040] BTRFS warning (device loop6): couldn't read tree root [ 1294.277308][T25040] BTRFS warning (device loop6): try to load backup roots slot 1 [ 1294.313204][ T3480] BTRFS warning (device loop6): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0xe06dfc66 level 0 [ 1294.371846][T25040] BTRFS warning (device loop6): couldn't read tree root [ 1294.400091][T25040] BTRFS warning (device loop6): try to load backup roots slot 2 [ 1294.428256][ T12] BTRFS error (device loop6): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 1294.468296][T25040] BTRFS warning (device loop6): couldn't read tree root [ 1294.497466][T25040] BTRFS warning (device loop6): try to load backup roots slot 3 [ 1294.528081][T25040] BTRFS info (device loop6): checking UUID tree [ 1294.538993][T25040] BTRFS info (device loop6): setting nodatasum [ 1294.539022][T25040] BTRFS info (device loop6): enabling ssd optimizations [ 1294.539041][T25040] BTRFS info (device loop6): turning on flush-on-commit [ 1294.539058][T25040] BTRFS info (device loop6): turning on async discard [ 1294.539075][T25040] BTRFS info (device loop6): enabling free space tree [ 1294.539093][T25040] BTRFS info (device loop6): trying to use backup root at mount time [ 1294.539111][T25040] BTRFS info (device loop6): max_inline set to 0 [ 1294.980760][T25093] loop7: detected capacity change from 0 to 32768 [ 1295.020171][T26338] BTRFS info (device loop6): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1295.381485][T25126] loop5: detected capacity change from 0 to 32768 [ 1295.442911][T25126] [ 1295.442911][T25126] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 1295.442911][T25126] [ 1295.585982][T25126] ERROR: (device loop5): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 0 [ 1295.585982][T25126] [ 1295.641563][T25126] JFS: Invalid stbl[1] = -128 for inode 2, block = 0 [ 1295.763605][ T66] [ 1295.763605][ T66] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 1295.763605][ T66] [ 1295.824228][ T66] [ 1295.824228][ T66] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 1295.824228][ T66] [ 1295.861110][T24382] [ 1295.861110][T24382] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 1295.861110][T24382] [ 1295.912062][ T112] [ 1295.912062][ T112] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 1295.912062][ T112] [ 1295.994055][T24382] [ 1295.994055][T24382] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 1295.994055][T24382] [ 1296.434697][T25215] netlink: 'syz.4.15973': attribute type 10 has an invalid length. [ 1296.455636][T25215] veth1_vlan: entered allmulticast mode [ 1296.484674][T25221] netlink: 40 bytes leftover after parsing attributes in process `syz.3.15974'. [ 1296.517699][T25215] team0: Port device macvlan0 added [ 1296.611656][T25228] loop6: detected capacity change from 0 to 164 [ 1296.883403][ T5825] Bluetooth: hci4: unexpected event for opcode 0x080c [ 1297.555099][T25236] loop3: detected capacity change from 0 to 32768 [ 1297.606465][T25236] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.15976 (25236) [ 1297.673724][T25236] BTRFS info (device loop3): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 1297.704212][T25236] BTRFS info (device loop3): using blake2b checksum algorithm [ 1297.838040][T25236] BTRFS info (device loop3): enabling ssd optimizations [ 1297.871763][T25260] loop6: detected capacity change from 0 to 40427 [ 1297.887904][T25236] BTRFS info (device loop3): turning on async discard [ 1297.896982][T25260] F2FS-fs (loop6): invalid crc value [ 1297.916253][T25236] BTRFS info (device loop3): enabling free space tree [ 1297.969891][T25236] BTRFS info (device loop3): use zstd compression, level 3 [ 1298.018762][T25260] F2FS-fs (loop6): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 1298.037302][T25260] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 1298.215111][T25315] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 1298.245774][T25315] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 1298.257493][T26338] syz-executor: attempt to access beyond end of device [ 1298.257493][T26338] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 1298.297086][T26338] CPU: 1 UID: 0 PID: 26338 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 1298.297117][T26338] Tainted: [L]=SOFTLOCKUP [ 1298.297124][T26338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1298.297135][T26338] Call Trace: [ 1298.297143][T26338] [ 1298.297151][T26338] dump_stack_lvl+0xe8/0x150 [ 1298.297181][T26338] f2fs_handle_critical_error+0x37c/0x540 [ 1298.297211][T26338] f2fs_write_end_io+0xcdb/0xff0 [ 1298.297253][T26338] __submit_merged_bio+0x256/0x700 [ 1298.297282][T26338] __submit_merged_write_cond+0x3c9/0x4e0 [ 1298.297312][T26338] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 1298.297357][T26338] f2fs_write_data_pages+0x2975/0x35e0 [ 1298.297414][T26338] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 1298.297434][T26338] ? do_raw_spin_lock+0x12b/0x2f0 [ 1298.297510][T26338] ? finish_task_switch+0x41f/0xbe0 [ 1298.297536][T26338] ? __lock_acquire+0x6b5/0x2cf0 [ 1298.297574][T26338] ? __lock_acquire+0x6b5/0x2cf0 [ 1298.297602][T26338] ? do_raw_spin_lock+0x12b/0x2f0 [ 1298.297632][T26338] ? do_raw_spin_unlock+0xf5/0x210 [ 1298.297653][T26338] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 1298.297675][T26338] do_writepages+0x32e/0x550 [ 1298.297709][T26338] ? do_raw_spin_unlock+0xf5/0x210 [ 1298.297731][T26338] filemap_fdatawrite+0x1e9/0x2f0 [ 1298.297751][T26338] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 1298.297814][T26338] ? do_raw_spin_unlock+0xf5/0x210 [ 1298.297839][T26338] f2fs_sync_dirty_inodes+0x30e/0x860 [ 1298.297879][T26338] f2fs_write_checkpoint+0x9df/0x26a0 [ 1298.297925][T26338] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 1298.297991][T26338] kill_f2fs_super+0x314/0x720 [ 1298.298022][T26338] ? __pfx_kill_f2fs_super+0x10/0x10 [ 1298.298058][T26338] ? lockdep_hardirqs_on+0x7a/0x110 [ 1298.298091][T26338] deactivate_locked_super+0xbc/0x130 [ 1298.298115][T26338] cleanup_mnt+0x437/0x4d0 [ 1298.298137][T26338] ? _raw_spin_unlock_irq+0x23/0x50 [ 1298.298166][T26338] task_work_run+0x1d9/0x270 [ 1298.298190][T26338] ? __pfx_task_work_run+0x10/0x10 [ 1298.298220][T26338] exit_to_user_mode_loop+0xed/0x480 [ 1298.298270][T26338] ? rcu_is_watching+0x15/0xb0 [ 1298.298299][T26338] do_syscall_64+0x32d/0xf80 [ 1298.298317][T26338] ? trace_irq_disable+0x3b/0x150 [ 1298.298334][T26338] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1298.298351][T26338] ? clear_bhb_loop+0x40/0x90 [ 1298.298371][T26338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1298.298386][T26338] RIP: 0033:0x7f53dbd9d9d7 [ 1298.298403][T26338] Code: a2 c7 05 1c ed 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 1298.298415][T26338] RSP: 002b:00007fff9ac44708 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 1298.298433][T26338] RAX: 0000000000000000 RBX: 00007f53dbe31f90 RCX: 00007f53dbd9d9d7 [ 1298.298445][T26338] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff9ac447c0 [ 1298.298456][T26338] RBP: 00007fff9ac447c0 R08: 00007fff9ac457c0 R09: 00000000ffffffff [ 1298.298476][T26338] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff9ac45850 [ 1298.298487][T26338] R13: 00007f53dbe31f90 R14: 0000000000152205 R15: 00007fff9ac45890 [ 1298.298518][T26338] [ 1298.298537][T26338] F2FS-fs (loop6): Stopped filesystem due to reason: 3 [ 1298.532811][T25285] loop7: detected capacity change from 0 to 32768 [ 1298.694954][T25285] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop7 (7:7) scanned by syz.7.15989 (25285) [ 1298.704248][ T5824] BTRFS info (device loop3): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 1298.795316][T25285] BTRFS info (device loop7): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 1298.820328][T25285] BTRFS info (device loop7): using sha256 checksum algorithm [ 1298.917982][T25333] loop5: detected capacity change from 0 to 512 [ 1299.013496][T25333] EXT4-fs: Ignoring removed nomblk_io_submit option [ 1299.039112][T25285] BTRFS info (device loop7): rebuilding free space tree [ 1299.080953][T25333] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 1299.187689][T25333] EXT4-fs error (device loop5): ext4_orphan_get:1417: comm syz.5.15996: bad orphan inode 131083 [ 1299.237277][T25285] BTRFS info (device loop7): disabling free space tree [ 1299.240932][T25333] loop5: lost filesystem error report for type 5 error -117 [ 1299.245125][T25285] BTRFS info (device loop7): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 1299.259966][T25333] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1299.263293][T25285] BTRFS info (device loop7): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 1299.326205][T25285] BTRFS info (device loop7): setting nodatasum [ 1299.356044][T25285] BTRFS info (device loop7): setting nodatacow [ 1299.395106][T25285] BTRFS info (device loop7): turning off barriers [ 1299.432245][T25285] BTRFS info (device loop7): force clearing of disk cache [ 1299.522542][T25356] overlayfs: upper fs needs to support d_type. [ 1299.699548][T25362] loop3: detected capacity change from 0 to 1024 [ 1299.740273][T24382] EXT4-fs error (device loop5): ext4_readdir:265: inode #2: block 13: comm syz-executor: path /1675/bus: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 1299.828005][T25362] EXT4-fs (loop3): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 1299.995448][T25362] EXT4-fs error (device loop3): ext4_map_blocks:818: inode #15: comm syz.3.15998: lblock 0 mapped to illegal pblock 0 (length 1) [ 1300.088378][T25362] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 1300.121297][T25362] EXT4-fs (loop3): This should not happen!! Data will be lost [ 1300.121297][T25362] [ 1300.179878][ T809] BTRFS info (device loop7): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 1300.315204][ T5824] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 1300.617780][T25390] loop3: detected capacity change from 0 to 2048 [ 1300.662181][T22685] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1300.702368][T25390] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1300.869185][T25390] EXT4-fs error (device loop3): ext4_find_extent:939: inode #2: comm syz.3.16003: pblk 1 bad header/extent: invalid magic - magic 2, entries 0, max 3(0), depth 0(4) [ 1301.004049][T25390] EXT4-fs (loop3): Remounting filesystem read-only [ 1301.162275][T25388] loop6: detected capacity change from 0 to 32768 [ 1301.183380][T25388] (syz.6.16004,25388,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 1301.220259][T25388] (syz.6.16004,25388,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 1301.242835][ T5824] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1301.547491][T25388] JBD2: Ignoring recovery information on journal [ 1301.681018][T25388] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode. [ 1301.687463][ T66] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1301.827905][ T36] ocfs2: Finishing quota recovery on device (7,6) for slot 0 [ 1302.125382][T11540] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1302.138895][T26338] ocfs2: Unmounting device (7,6) on (node local) [ 1302.189247][T11540] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1302.205899][T11540] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1302.225822][T11540] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1302.250730][T11540] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1302.383629][ T66] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1302.395274][T25418] loop7: detected capacity change from 0 to 32768 [ 1302.457497][T25418] XFS (loop7): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 1302.645690][T25458] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16017'. [ 1302.663539][T25418] XFS (loop7): Ending clean mount [ 1302.762535][ T66] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1302.846769][T25418] XFS (loop7): Quotacheck needed: Please wait. [ 1303.037492][ T66] bond0: (slave netdevsim0): Releasing backup interface [ 1303.046651][ T66] netdevsim netdevsim5 netdevsim0 (unregistering): left allmulticast mode [ 1303.140258][ T66] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1303.171139][T25418] XFS (loop7): Quotacheck: Done. [ 1303.307026][T25480] loop4: detected capacity change from 0 to 2048 [ 1303.326847][ T809] XFS (loop7): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 1303.392753][T25484] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1303.429661][T25424] wg1 speed is unknown, defaulting to 1000 [ 1303.491000][ T30] kauditd_printk_skb: 19 callbacks suppressed [ 1303.491017][ T30] audit: type=1800 audit(1390.678:718): pid=25480 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.16023" name="file2" dev="loop4" ino=16 res=0 errno=0 [ 1303.861939][T25501] netlink: 'syz.4.16027': attribute type 13 has an invalid length. [ 1304.023003][T25511] loop6: detected capacity change from 0 to 64 [ 1304.036003][T25511] minix: block size(59136) > page size(4096) not supported by filesystem [ 1304.080088][T25511] Trying to free block not in datazone [ 1304.091707][T25501] veth1_vlan: left allmulticast mode [ 1304.103222][T25511] Trying to free block not in datazone [ 1304.110542][T25511] Trying to free block not in datazone [ 1304.137780][T25511] Trying to free block not in datazone [ 1304.191578][T25511] Trying to free block not in datazone [ 1304.218415][T25511] Trying to free block not in datazone [ 1304.221637][T11540] Bluetooth: hci4: command tx timeout [ 1304.252802][T25511] Trying to free block not in datazone [ 1304.282704][T25511] Trying to free block not in datazone [ 1304.302592][T25521] netlink: 12 bytes leftover after parsing attributes in process `syz.7.16032'. [ 1304.303988][T25511] Trying to free block not in datazone [ 1304.318586][T25511] Trying to free block not in datazone [ 1304.361506][T25511] Trying to free block not in datazone [ 1304.386222][T25511] Trying to free block not in datazone [ 1304.402527][T25524] loop3: detected capacity change from 0 to 1024 [ 1304.402950][T25511] Trying to free block not in datazone [ 1304.449827][T25511] Trying to free block not in datazone [ 1304.463757][T25524] EXT4-fs (loop3): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 1304.505260][T25511] Trying to free block not in datazone [ 1304.531214][ T5824] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 1304.546194][T25511] Trying to free block not in datazone [ 1304.631167][T25511] Trying to free block not in datazone [ 1304.646476][T25511] Trying to free block not in datazone [ 1304.671929][T25511] Trying to free block not in datazone [ 1304.694013][T25511] Trying to free block not in datazone [ 1304.721487][T25511] Trying to free block not in datazone [ 1304.742551][T25511] Trying to free block not in datazone [ 1304.764472][T25511] Trying to free block not in datazone [ 1304.788979][T25511] Trying to free block not in datazone [ 1304.844161][T25511] Trying to free block not in datazone [ 1304.860853][T17081] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 20001 - 0 [ 1304.875275][T25511] Trying to free block not in datazone [ 1304.877551][T25552] netlink: 4768 bytes leftover after parsing attributes in process `syz.7.16038'. [ 1304.885729][T25511] Trying to free block not in datazone [ 1304.895849][T17081] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 20001 - 0 [ 1304.895892][T17081] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 20001 - 0 [ 1304.895925][T17081] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 20001 - 0 [ 1304.938898][T25511] Trying to free block not in datazone [ 1304.954187][T25511] Trying to free block not in datazone [ 1304.960948][T25511] Trying to free block not in datazone [ 1304.961418][T25544] loop3: detected capacity change from 0 to 4096 [ 1304.966570][T25511] Trying to free block not in datazone [ 1304.997256][T25511] Trying to free block not in datazone [ 1305.004078][T25511] Trying to free block not in datazone [ 1305.051056][T25562] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1305.053151][T25511] Trying to free block not in datazone [ 1305.104921][T25544] NILFS error (device loop3): nilfs_bmap_lookup_contig: broken bmap (inode number=12) [ 1305.118239][T25511] Trying to free block not in datazone [ 1305.145156][T25570] netlink: 4 bytes leftover after parsing attributes in process `syz.7.16039'. [ 1305.156673][T25511] Trying to free block not in datazone [ 1305.168094][T25511] Trying to free block not in datazone [ 1305.184506][T25544] Remounting filesystem read-only [ 1305.195182][T25511] Trying to free block not in datazone [ 1305.195195][T25511] Trying to free block not in datazone [ 1305.195202][T25511] Trying to free block not in datazone [ 1305.195208][T25511] Trying to free block not in datazone [ 1305.195214][T25511] Trying to free block not in datazone [ 1305.195220][T25511] Trying to free block not in datazone [ 1305.195227][T25511] Trying to free block not in datazone [ 1305.195233][T25511] Trying to free block not in datazone [ 1305.195239][T25511] Trying to free block not in datazone [ 1305.195246][T25511] Trying to free block not in datazone [ 1305.195252][T25511] Trying to free block not in datazone [ 1305.195259][T25511] Trying to free block not in datazone [ 1305.195265][T25511] Trying to free block not in datazone [ 1305.195272][T25511] Trying to free block not in datazone [ 1305.195279][T25511] Trying to free block not in datazone [ 1305.195285][T25511] Trying to free block not in datazone [ 1305.195292][T25511] Trying to free block not in datazone [ 1305.195298][T25511] Trying to free block not in datazone [ 1305.195305][T25511] Trying to free block not in datazone [ 1305.195311][T25511] Trying to free block not in datazone [ 1305.195317][T25511] Trying to free block not in datazone [ 1305.195324][T25511] Trying to free block not in datazone [ 1305.195331][T25511] Trying to free block not in datazone [ 1305.195337][T25511] Trying to free block not in datazone [ 1305.195343][T25511] Trying to free block not in datazone [ 1305.195350][T25511] Trying to free block not in datazone [ 1305.195357][T25511] Trying to free block not in datazone [ 1305.195363][T25511] Trying to free block not in datazone [ 1305.195370][T25511] Trying to free block not in datazone [ 1305.195378][T25511] Trying to free block not in datazone [ 1305.195384][T25511] Trying to free block not in datazone [ 1305.195391][T25511] Trying to free block not in datazone [ 1305.195396][T25511] Trying to free block not in datazone [ 1305.195402][T25511] Trying to free block not in datazone [ 1305.195408][T25511] Trying to free block not in datazone [ 1305.195414][T25511] Trying to free block not in datazone [ 1305.195420][T25511] Trying to free block not in datazone [ 1305.195426][T25511] Trying to free block not in datazone [ 1305.195432][T25511] Trying to free block not in datazone [ 1305.195438][T25511] Trying to free block not in datazone [ 1305.195444][T25511] Trying to free block not in datazone [ 1305.195450][T25511] Trying to free block not in datazone [ 1305.195456][T25511] Trying to free block not in datazone [ 1305.195463][T25511] Trying to free block not in datazone [ 1305.195468][T25511] Trying to free block not in datazone [ 1305.195475][T25511] Trying to free block not in datazone [ 1305.195480][T25511] Trying to free block not in datazone [ 1305.195486][T25511] Trying to free block not in datazone [ 1305.195492][T25511] Trying to free block not in datazone [ 1305.195498][T25511] Trying to free block not in datazone [ 1305.195504][T25511] Trying to free block not in datazone [ 1305.195510][T25511] Trying to free block not in datazone [ 1305.195516][T25511] Trying to free block not in datazone [ 1305.195521][T25511] Trying to free block not in datazone [ 1305.195527][T25511] Trying to free block not in datazone [ 1305.195533][T25511] Trying to free block not in datazone [ 1305.195540][T25511] Trying to free block not in datazone [ 1305.195545][T25511] Trying to free block not in datazone [ 1305.195552][T25511] Trying to free block not in datazone [ 1305.195558][T25511] Trying to free block not in datazone [ 1305.195564][T25511] Trying to free block not in datazone [ 1305.195570][T25511] Trying to free block not in datazone [ 1305.195576][T25511] Trying to free block not in datazone [ 1305.195582][T25511] Trying to free block not in datazone [ 1305.195589][T25511] Trying to free block not in datazone [ 1305.195596][T25511] Trying to free block not in datazone [ 1305.195602][T25511] Trying to free block not in datazone [ 1305.195607][T25511] Trying to free block not in datazone [ 1305.195613][T25511] Trying to free block not in datazone [ 1305.195619][T25511] Trying to free block not in datazone [ 1305.195625][T25511] Trying to free block not in datazone [ 1305.195631][T25511] Trying to free block not in datazone [ 1305.195638][T25511] Trying to free block not in datazone [ 1305.195644][T25511] Trying to free block not in datazone [ 1305.195650][T25511] Trying to free block not in datazone [ 1305.195657][T25511] Trying to free block not in datazone [ 1305.195663][T25511] Trying to free block not in datazone [ 1305.195669][T25511] Trying to free block not in datazone [ 1305.195675][T25511] Trying to free block not in datazone [ 1305.195681][T25511] Trying to free block not in datazone [ 1305.195687][T25511] Trying to free block not in datazone [ 1305.195693][T25511] Trying to free block not in datazone [ 1305.195699][T25511] Trying to free block not in datazone [ 1305.195705][T25511] Trying to free block not in datazone [ 1305.195711][T25511] Trying to free block not in datazone [ 1305.195717][T25511] Trying to free block not in datazone [ 1305.195723][T25511] Trying to free block not in datazone [ 1305.195729][T25511] Trying to free block not in datazone [ 1305.195735][T25511] Trying to free block not in datazone [ 1305.195741][T25511] Trying to free block not in datazone [ 1305.195747][T25511] Trying to free block not in datazone [ 1305.195753][T25511] Trying to free block not in datazone [ 1305.195759][T25511] Trying to free block not in datazone [ 1305.195766][T25511] Trying to free block not in datazone [ 1305.195772][T25511] Trying to free block not in datazone [ 1305.195779][T25511] Trying to free block not in datazone [ 1305.195785][T25511] Trying to free block not in datazone [ 1305.195791][T25511] Trying to free block not in datazone [ 1305.195797][T25511] Trying to free block not in datazone [ 1305.195804][T25511] Trying to free block not in datazone [ 1305.195810][T25511] Trying to free block not in datazone [ 1305.195817][T25511] Trying to free block not in datazone [ 1305.195823][T25511] Trying to free block not in datazone [ 1305.195829][T25511] Trying to free block not in datazone [ 1305.195836][T25511] Trying to free block not in datazone [ 1305.195842][T25511] Trying to free block not in datazone [ 1305.195849][T25511] Trying to free block not in datazone [ 1305.195855][T25511] Trying to free block not in datazone [ 1305.195861][T25511] Trying to free block not in datazone [ 1305.195867][T25511] Trying to free block not in datazone [ 1305.195873][T25511] Trying to free block not in datazone [ 1305.195879][T25511] Trying to free block not in datazone [ 1305.195885][T25511] Trying to free block not in datazone [ 1305.195891][T25511] Trying to free block not in datazone [ 1305.195897][T25511] Trying to free block not in datazone [ 1305.195903][T25511] Trying to free block not in datazone [ 1305.195909][T25511] Trying to free block not in datazone [ 1305.195916][T25511] Trying to free block not in datazone [ 1305.195922][T25511] Trying to free block not in datazone [ 1305.195928][T25511] Trying to free block not in datazone [ 1305.195935][T25511] Trying to free block not in datazone [ 1305.195941][T25511] Trying to free block not in datazone [ 1305.195948][T25511] Trying to free block not in datazone [ 1305.195954][T25511] Trying to free block not in datazone [ 1305.195960][T25511] Trying to free block not in datazone [ 1305.195967][T25511] Trying to free block not in datazone [ 1305.195973][T25511] Trying to free block not in datazone [ 1305.195980][T25511] Trying to free block not in datazone [ 1305.195986][T25511] Trying to free block not in datazone [ 1305.195993][T25511] Trying to free block not in datazone [ 1305.195999][T25511] Trying to free block not in datazone [ 1305.196005][T25511] Trying to free block not in datazone [ 1305.196011][T25511] Trying to free block not in datazone [ 1305.196017][T25511] Trying to free block not in datazone [ 1305.196023][T25511] Trying to free block not in datazone [ 1305.196030][T25511] Trying to free block not in datazone [ 1305.196036][T25511] Trying to free block not in datazone [ 1305.196042][T25511] Trying to free block not in datazone [ 1305.196048][T25511] Trying to free block not in datazone [ 1305.196055][T25511] Trying to free block not in datazone [ 1305.196063][T25511] Trying to free block not in datazone [ 1305.196070][T25511] Trying to free block not in datazone [ 1305.196078][T25511] Trying to free block not in datazone [ 1305.196094][T25511] Trying to free block not in datazone [ 1305.196101][T25511] Trying to free block not in datazone [ 1305.196108][T25511] Trying to free block not in datazone [ 1305.196116][T25511] Trying to free block not in datazone [ 1305.196123][T25511] Trying to free block not in datazone [ 1305.196131][T25511] Trying to free block not in datazone [ 1305.196138][T25511] Trying to free block not in datazone [ 1305.196146][T25511] Trying to free block not in datazone [ 1305.196153][T25511] Trying to free block not in datazone [ 1305.196160][T25511] Trying to free block not in datazone [ 1305.196168][T25511] Trying to free block not in datazone [ 1305.196176][T25511] Trying to free block not in datazone [ 1305.196183][T25511] Trying to free block not in datazone [ 1305.196191][T25511] Trying to free block not in datazone [ 1305.196199][T25511] Trying to free block not in datazone [ 1305.196207][T25511] Trying to free block not in datazone [ 1305.196534][T25511] Trying to free block not in datazone [ 1305.196544][T25511] Trying to free block not in datazone [ 1305.196553][T25511] Trying to free block not in datazone [ 1305.196562][T25511] Trying to free block not in datazone [ 1305.196570][T25511] Trying to free block not in datazone [ 1305.196579][T25511] Trying to free block not in datazone [ 1305.196587][T25511] Trying to free block not in datazone [ 1305.196595][T25511] Trying to free block not in datazone [ 1305.196603][T25511] Trying to free block not in datazone [ 1305.196612][T25511] Trying to free block not in datazone [ 1305.196620][T25511] Trying to free block not in datazone [ 1305.196629][T25511] Trying to free block not in datazone [ 1305.196637][T25511] Trying to free block not in datazone [ 1305.196646][T25511] Trying to free block not in datazone [ 1305.196655][T25511] Trying to free block not in datazone [ 1305.196663][T25511] Trying to free block not in datazone [ 1305.196672][T25511] Trying to free block not in datazone [ 1305.196681][T25511] Trying to free block not in datazone [ 1305.196689][T25511] Trying to free block not in datazone [ 1305.196698][T25511] Trying to free block not in datazone [ 1305.196706][T25511] Trying to free block not in datazone [ 1305.196714][T25511] Trying to free block not in datazone [ 1305.196723][T25511] Trying to free block not in datazone [ 1305.196731][T25511] Trying to free block not in datazone [ 1305.196740][T25511] Trying to free block not in datazone [ 1305.196750][T25511] Trying to free block not in datazone [ 1305.196758][T25511] Trying to free block not in datazone [ 1305.196767][T25511] Trying to free block not in datazone [ 1305.196775][T25511] Trying to free block not in datazone [ 1305.196784][T25511] Trying to free block not in datazone [ 1305.196793][T25511] Trying to free block not in datazone [ 1305.196802][T25511] Trying to free block not in datazone [ 1305.196811][T25511] Trying to free block not in datazone [ 1305.196819][T25511] Trying to free block not in datazone [ 1305.196828][T25511] Trying to free block not in datazone [ 1305.196836][T25511] Trying to free block not in datazone [ 1305.196845][T25511] Trying to free block not in datazone [ 1305.196854][T25511] Trying to free block not in datazone [ 1305.196862][T25511] Trying to free block not in datazone [ 1305.196871][T25511] Trying to free block not in datazone [ 1305.196880][T25511] Trying to free block not in datazone [ 1305.196889][T25511] Trying to free block not in datazone [ 1305.196897][T25511] Trying to free block not in datazone [ 1305.196905][T25511] Trying to free block not in datazone [ 1305.196914][T25511] Trying to free block not in datazone [ 1305.196923][T25511] Trying to free block not in datazone [ 1305.196931][T25511] Trying to free block not in datazone [ 1305.196940][T25511] Trying to free block not in datazone [ 1305.196948][T25511] Trying to free block not in datazone [ 1305.196957][T25511] Trying to free block not in datazone [ 1305.196965][T25511] Trying to free block not in datazone [ 1305.196974][T25511] Trying to free block not in datazone [ 1305.196982][T25511] Trying to free block not in datazone [ 1305.196991][T25511] Trying to free block not in datazone [ 1305.197000][T25511] Trying to free block not in datazone [ 1305.197009][T25511] Trying to free block not in datazone [ 1305.197017][T25511] Trying to free block not in datazone [ 1305.197026][T25511] Trying to free block not in datazone [ 1305.197034][T25511] Trying to free block not in datazone [ 1305.197044][T25511] Trying to free block not in datazone [ 1305.199199][T25511] Trying to free block not in datazone [ 1306.000998][T25553] loop4: detected capacity change from 0 to 32768 [ 1306.123855][T25424] chnl_net:caif_netlink_parms(): no params data found [ 1306.135874][T11540] Bluetooth: hci4: command tx timeout [ 1306.191085][T25553] (syz.4.16037,25553,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 1306.295652][ T66] bond0: left allmulticast mode [ 1306.563812][T25553] (syz.4.16037,25553,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 1306.579531][ T66] bond_slave_0: left allmulticast mode [ 1306.586975][ T66] bond_slave_1: left allmulticast mode [ 1306.593919][ T66] bond4: left allmulticast mode [ 1306.599112][ T66] batadv0: left allmulticast mode [ 1306.605704][ T66] mac80211_hwsim hwsim36 wlan1: left allmulticast mode [ 1306.635476][ T66] bridge0: port 4(bond0) entered disabled state [ 1306.644364][T25641] loop3: detected capacity change from 0 to 256 [ 1306.651549][T25553] JBD2: Ignoring recovery information on journal [ 1306.706467][ T66] bridge_slave_1: left allmulticast mode [ 1306.712601][ T66] bridge_slave_1: left promiscuous mode [ 1306.718425][ T66] bridge0: port 2(bridge_slave_1) entered disabled state [ 1306.779174][ T66] bridge_slave_0: left allmulticast mode [ 1306.805243][ T66] bridge_slave_0: left promiscuous mode [ 1306.826487][ T66] bridge0: port 1(bridge_slave_0) entered disabled state [ 1306.827880][T25553] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 1306.859681][T25641] FAT-fs (loop3): Directory bread(block 64) failed [ 1306.884663][T25641] FAT-fs (loop3): Directory bread(block 65) failed [ 1306.923664][T25641] FAT-fs (loop3): Directory bread(block 66) failed [ 1306.965827][T25641] FAT-fs (loop3): Directory bread(block 67) failed [ 1307.005180][T25641] FAT-fs (loop3): Directory bread(block 68) failed [ 1307.037164][T25641] FAT-fs (loop3): Directory bread(block 69) failed [ 1307.073602][T25641] FAT-fs (loop3): Directory bread(block 70) failed [ 1307.096299][T25641] FAT-fs (loop3): Directory bread(block 71) failed [ 1307.129878][T25641] FAT-fs (loop3): Directory bread(block 72) failed [ 1307.129913][T25641] FAT-fs (loop3): Directory bread(block 73) failed [ 1307.498799][ T5815] ocfs2: Unmounting device (7,4) on (node local) [ 1307.868001][T25687] loop6: detected capacity change from 0 to 8 [ 1308.072331][T25619] Bluetooth: hci4: command tx timeout [ 1308.246028][T25702] netlink: 28 bytes leftover after parsing attributes in process `syz.7.16053'. [ 1308.476218][ T66] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1308.493058][ T66] bond_slave_0: left promiscuous mode [ 1308.526616][ T66] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1308.549822][ T66] bond_slave_1: left promiscuous mode [ 1308.559866][ T66] bond0 (unregistering): (slave bond4): Releasing backup interface [ 1308.570123][ T66] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 1308.587541][ T66] batadv0: left promiscuous mode [ 1308.596042][T25683] loop3: detected capacity change from 0 to 32768 [ 1308.633213][ T66] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 1308.645223][ T66] mac80211_hwsim hwsim36 wlan1: left promiscuous mode [ 1308.645428][T25683] XFS (loop3): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 1308.677582][ T66] bond0 (unregistering): Released all slaves [ 1308.699330][T25683] XFS (loop3): Ending clean mount [ 1308.704303][ T66] bond1 (unregistering): Released all slaves [ 1308.761391][ T66] bond2 (unregistering): Released all slaves [ 1308.798484][ T5824] XFS (loop3): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 1308.821605][ T66] bond3 (unregistering): Released all slaves [ 1308.851966][ T66] bond4 (unregistering): Released all slaves [ 1309.006362][T25709] sp0: Synchronizing with TNC [ 1309.586542][T25424] bridge0: port 1(bridge_slave_0) entered blocking state [ 1309.615107][T25424] bridge0: port 1(bridge_slave_0) entered disabled state [ 1309.624611][T25424] bridge_slave_0: entered allmulticast mode [ 1309.642245][T25424] bridge_slave_0: entered promiscuous mode [ 1309.838036][T25793] loop7: detected capacity change from 0 to 4096 [ 1309.852051][T25793] ntfs3(loop7): Different NTFS sector size (4096) and media sector size (512). [ 1309.915233][T25793] ntfs3(loop7): ino=3, ntfs_set_state failed, -22. [ 1309.928049][T25424] bridge0: port 2(bridge_slave_1) entered blocking state [ 1309.967759][T25424] bridge0: port 2(bridge_slave_1) entered disabled state [ 1309.978005][T25793] ntfs3(loop7): Failed to initialize $Extend/$Reparse. [ 1310.012165][T25619] Bluetooth: hci4: command tx timeout [ 1310.019129][T25424] bridge_slave_1: entered allmulticast mode [ 1310.028629][T25793] ntfs3(loop7): ino=3, ntfs_set_label failed, -22. [ 1310.065668][T25424] bridge_slave_1: entered promiscuous mode [ 1310.139465][T25812] loop6: detected capacity change from 0 to 2048 [ 1310.232029][T25812] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1310.236026][T17081] ntfs3(loop7): ino=3, ntfs3_write_inode failed, -22. [ 1310.280762][ T809] ntfs3(loop7): ino=3, ntfs_set_state failed, -22. [ 1310.303272][ T809] ntfs3(loop7): Mark volume as dirty due to NTFS errors [ 1310.329114][ T809] ntfs3(loop7): ino=3, ntfs_set_state failed, -22. [ 1310.359333][T25424] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1310.376203][T17081] ntfs3(loop7): ino=3, ntfs3_write_inode failed, -22. [ 1310.539510][T25424] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1310.654574][T25854] loop7: detected capacity change from 0 to 512 [ 1310.695662][T25854] EXT4-fs error (device loop7): ext4_do_update_inode:5569: inode #3: comm syz.7.16064: corrupted inode contents [ 1310.759458][T25854] loop7: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 1310.760117][T25854] EXT4-fs error (device loop7): ext4_dirty_inode:6450: inode #3: comm syz.7.16064: mark_inode_dirty error [ 1310.769332][ C0] EXT4-fs (loop7): error count since last fsck: 1 [ 1310.769356][ C0] EXT4-fs (loop7): initial error at time 1398: ext4_do_update_inode:5569: inode 3 [ 1310.769389][ C0] EXT4-fs (loop7): last error at time 1398: ext4_do_update_inode:5569: inode 3 [ 1310.807003][T25854] loop7: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 1310.818848][T25854] EXT4-fs error (device loop7): ext4_do_update_inode:5569: inode #3: comm syz.7.16064: corrupted inode contents [ 1310.913846][T25424] team0: Port device team_slave_0 added [ 1310.929918][T25854] loop7: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 1310.935640][T25854] EXT4-fs error (device loop7): __ext4_ext_dirty:207: inode #3: comm syz.7.16064: mark_inode_dirty error [ 1311.026891][T25424] team0: Port device team_slave_1 added [ 1311.040808][T25854] loop7: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 1311.047259][T25854] Quota error (device loop7): write_blk: dquota write failed [ 1311.072627][T25854] Quota error (device loop7): qtree_write_dquot: Error -117 occurred while creating quota [ 1311.111766][T25854] EXT4-fs error (device loop7): ext4_acquire_dquot:7001: comm syz.7.16064: Failed to acquire dquot type 0 [ 1311.125604][T25854] loop7: lost filesystem error report for type 5 error -117 [ 1311.180063][T25854] EXT4-fs error (device loop7): ext4_do_update_inode:5569: inode #16: comm syz.7.16064: corrupted inode contents [ 1311.220570][T25424] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1311.242487][T25854] loop7: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 1311.248172][T25854] EXT4-fs error (device loop7): ext4_dirty_inode:6450: inode #16: comm syz.7.16064: mark_inode_dirty error [ 1311.249058][T25424] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1311.288687][T25854] loop7: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 1311.307876][T25424] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1311.332092][T25854] EXT4-fs error (device loop7): ext4_do_update_inode:5569: inode #16: comm syz.7.16064: corrupted inode contents [ 1311.351198][T25927] netlink: 8 bytes leftover after parsing attributes in process `syz.6.16074'. [ 1311.368498][T25854] loop7: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 1311.404356][T25424] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1311.425203][T25424] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1311.436106][T25854] EXT4-fs error (device loop7): __ext4_ext_dirty:207: inode #16: comm syz.7.16064: mark_inode_dirty error [ 1311.452447][T25424] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1311.502723][T25854] loop7: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 1311.503196][T25854] EXT4-fs error (device loop7): ext4_do_update_inode:5569: inode #16: comm syz.7.16064: corrupted inode contents [ 1311.543392][T25854] loop7: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 1311.544677][T25854] EXT4-fs error (device loop7) in ext4_orphan_del:303: Corrupt filesystem [ 1311.577745][T25854] loop7: lost filesystem error report for type 5 error -117 [ 1311.580656][T25854] EXT4-fs error (device loop7): ext4_do_update_inode:5569: inode #16: comm syz.7.16064: corrupted inode contents [ 1311.643508][T25854] loop7: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 1311.649183][T25854] EXT4-fs error (device loop7): ext4_truncate:4587: inode #16: comm syz.7.16064: mark_inode_dirty error [ 1311.709539][T25854] EXT4-fs error (device loop7) in ext4_process_orphan:345: Corrupt filesystem [ 1311.733224][T25854] loop7: lost filesystem error report for type 5 error -117 [ 1311.734627][T25854] EXT4-fs (loop7): 1 truncate cleaned up [ 1311.797391][T25854] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1311.836848][T25424] hsr_slave_0: entered promiscuous mode [ 1311.882187][T25424] hsr_slave_1: entered promiscuous mode [ 1311.919935][T25424] debugfs: 'hsr0' already exists in 'hsr' [ 1311.941076][T25424] Cannot create hsr debugfs directory [ 1312.062329][ T809] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1312.204947][T25982] loop3: detected capacity change from 0 to 16 [ 1312.284460][T25982] erofs (device loop3): mounted with root inode @ nid 36. [ 1312.579391][T25933] loop4: detected capacity change from 0 to 32768 [ 1312.603285][T25933] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.16075 (25933) [ 1312.673471][T25933] BTRFS info (device loop4): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 1312.702351][T25933] BTRFS info (device loop4): using blake2b checksum algorithm [ 1312.862256][ T30] audit: type=1326 audit(1400.721:719): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26047 comm="syz.6.16086" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f53dbd9c799 code=0x7ffc0000 [ 1313.000576][ T30] audit: type=1326 audit(1400.753:720): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26047 comm="syz.6.16086" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f53dbd9c799 code=0x7ffc0000 [ 1313.024866][T25933] BTRFS info (device loop4): enabling ssd optimizations [ 1313.033047][T25933] BTRFS info (device loop4): turning on async discard [ 1313.040155][T26056] netlink: 12 bytes leftover after parsing attributes in process `syz.6.16087'. [ 1313.051394][ T30] audit: type=1326 audit(1400.753:721): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26047 comm="syz.6.16086" exe="/root/syz-executor" sig=0 arch=c000003e syscall=73 compat=0 ip=0x7f53dbd9c799 code=0x7ffc0000 [ 1313.074780][ T66] hsr_slave_0: left promiscuous mode [ 1313.092606][T25933] BTRFS info (device loop4): enabling free space tree [ 1313.099551][ T66] hsr_slave_1: left promiscuous mode [ 1313.127680][ T66] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1313.142039][ T66] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1313.156382][ T30] audit: type=1326 audit(1400.753:722): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26047 comm="syz.6.16086" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f53dbd9c799 code=0x7ffc0000 [ 1313.212046][ T66] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1313.252286][ T66] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1313.265953][ T30] audit: type=1326 audit(1400.753:723): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26047 comm="syz.6.16086" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f53dbd9c799 code=0x7ffc0000 [ 1313.362714][ T66] veth1_macvtap: left promiscuous mode [ 1313.373824][ T66] veth0_macvtap: left promiscuous mode [ 1313.402176][ T66] veth1_vlan: left promiscuous mode [ 1313.521088][ T5815] BTRFS info (device loop4): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 1314.175186][T26094] 9pnet: Limiting 'msize' to 1048576 as this is the maximum supported by transport fd [ 1314.834705][T26087] loop3: detected capacity change from 0 to 32768 [ 1314.841843][ T66] team0 (unregistering): Port device team_slave_1 removed [ 1314.853817][T26112] loop7: detected capacity change from 0 to 512 [ 1314.890629][ T66] team0 (unregistering): Port device team_slave_0 removed [ 1314.900779][T26087] XFS (loop3): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 1314.917439][T26112] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1315.001302][T26087] XFS (loop3): Ending clean mount [ 1315.031336][T26087] XFS (loop3): Quotacheck needed: Please wait. [ 1315.057360][T26112] EXT4-fs (loop7): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 1315.103334][T26112] EXT4-fs (loop7): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 1315.174679][ T3480] XFS (loop3): Metadata CRC error detected at xfs_agfl_read_verify+0x139/0x200, xfs_agfl block 0x3 [ 1315.190469][ T3480] XFS (loop3): Unmount and run xfs_repair [ 1315.205822][ T3480] XFS (loop3): First 128 bytes of corrupted metadata buffer: [ 1315.206234][ T809] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1315.214827][ T3480] 00000000: 58 41 46 ff 07 00 00 00 bf dc 47 fc 10 d8 4e ed XAF.......G...N. [ 1315.235624][ T3480] 00000010: a5 62 11 a8 31 b3 f7 91 00 00 00 00 00 00 00 00 .b..1........... [ 1315.284166][ T3480] 00000020: a5 3b c8 8a ff ff ff ff 00 00 00 07 00 00 00 08 .;.............. [ 1315.294492][ T3480] 00000030: 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c ................ [ 1315.331717][T26056] netlink: 40 bytes leftover after parsing attributes in process `syz.6.16087'. [ 1315.356431][ T3480] 00000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1315.401009][ T3480] 00000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1315.443365][ T3480] 00000060: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1315.474706][ T3480] 00000070: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ [ 1315.488273][ T3480] XFS (loop3): metadata I/O error in "xfs_alloc_read_agfl+0x233/0x430" at daddr 0x3 len 1 error 74 [ 1315.506836][ T3480] loop3: lost filesystem error report for type 5 error -117 [ 1315.568031][T26163] loop7: detected capacity change from 0 to 128 [ 1315.572172][T26087] XFS (loop3): Quotacheck: Unsuccessful (Error -117): Disabling quotas. [ 1315.594116][T26087] loop3: lost filesystem error report for type 5 error -117 [ 1315.806533][ T5824] XFS (loop3): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 1315.973829][ T5824] XFS (loop3): Uncorrected metadata errors detected; please run xfs_repair. [ 1316.436112][ T66] IPVS: stop unused estimator thread 0... [ 1316.867080][T26225] loop6: detected capacity change from 0 to 4096 [ 1316.928212][T26230] NILFS (loop6): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1316.985188][T26225] NILFS error (device loop6): nilfs_dotdot: directory #12 missing '.' [ 1317.050721][T26225] Remounting filesystem read-only [ 1317.407021][T25424] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1317.423378][T25424] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1317.436171][T25424] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1317.454990][T25424] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1317.827321][T25424] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1317.927933][T25424] 8021q: adding VLAN 0 to HW filter on device team0 [ 1317.937369][T26276] loop4: detected capacity change from 0 to 512 [ 1317.964128][T17081] bridge0: port 1(bridge_slave_0) entered blocking state [ 1317.971359][T17081] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1317.983309][T26276] EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem [ 1318.022924][T17081] bridge0: port 2(bridge_slave_1) entered blocking state [ 1318.030183][T17081] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1318.086780][T26276] EXT4-fs error (device loop4): ext4_orphan_get:1417: comm syz.4.16120: bad orphan inode 15 [ 1318.137449][T26239] loop6: detected capacity change from 0 to 32768 [ 1318.148918][T26276] loop4: lost filesystem error report for type 5 error -117 [ 1318.149327][T26276] ext4_test_bit(bit=14, block=18) = 1 [ 1318.156696][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 1318.156716][ C1] EXT4-fs (loop4): initial error at time 1406: ext4_orphan_get:1417 [ 1318.156745][ C1] EXT4-fs (loop4): last error at time 1406: ext4_orphan_get:1417 [ 1318.189304][T26282] loop3: detected capacity change from 0 to 4096 [ 1318.233066][T26276] is_bad_inode(inode)=0 [ 1318.238043][T26276] NEXT_ORPHAN(inode)=1023 [ 1318.243761][T26276] max_ino=32 [ 1318.247008][T26276] i_nlink=0 [ 1318.252639][T26276] EXT4-fs error (device loop4): ext4_xattr_delete_inode:2970: inode #15: comm syz.4.16120: corrupted xattr block 19: invalid header [ 1318.255359][T26239] XFS (loop6): Mounting V5 Filesystem 9f1cad42-11bd-4e12-8f0b-f07876b81d9a [ 1318.267382][T26276] fserror_report: 1 callbacks suppressed [ 1318.267401][T26276] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 1318.286043][T26276] EXT4-fs warning (device loop4): ext4_evict_inode:275: xattr delete (err -117) [ 1318.313539][T26276] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0009-000000000000 r/w without journal. Quota mode: none. [ 1318.357865][T26276] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz.4.16120: bg 0: block 449: padding at end of block bitmap is not set [ 1318.383221][T26294] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1318.448312][ T5815] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0009-000000000000. [ 1318.509065][T26282] NILFS error (device loop3): nilfs_dotdot: directory #12 missing '.' [ 1318.554438][T26239] XFS (loop6): Ending clean mount [ 1318.620597][T26282] Remounting filesystem read-only [ 1318.752033][ T5824] NILFS (loop3): disposed unprocessed dirty file(s) when detaching log writer [ 1318.777796][T26338] XFS (loop6): Unmounting Filesystem 9f1cad42-11bd-4e12-8f0b-f07876b81d9a [ 1318.798259][T25424] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1318.947912][ T30] audit: type=1326 audit(1407.255:724): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26316 comm="syz.3.16123" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa47d59c799 code=0x0 [ 1319.609717][T26345] loop6: detected capacity change from 0 to 1024 [ 1319.636599][T26345] EXT4-fs: Ignoring removed mblk_io_submit option [ 1319.650821][T25424] veth0_vlan: entered promiscuous mode [ 1319.699527][T26353] loop7: detected capacity change from 0 to 8 [ 1319.746874][T26353] SQUASHFS error: zlib decompression failed, data probably corrupt [ 1319.764015][T25424] veth1_vlan: entered promiscuous mode [ 1319.799740][T26353] SQUASHFS error: Failed to read block 0x9b: -5 [ 1319.848790][T26353] SQUASHFS error: Unable to read metadata cache entry [99] [ 1319.860252][T26360] loop4: detected capacity change from 0 to 2048 [ 1319.880523][T26353] SQUASHFS error: Unable to read inode 0x127 [ 1319.893978][T26360] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 1024) [ 1319.930591][T25424] veth0_macvtap: entered promiscuous mode [ 1319.963118][T25424] veth1_macvtap: entered promiscuous mode [ 1319.986756][T26369] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1320.109049][T25424] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1320.171633][T26374] netlink: 56 bytes leftover after parsing attributes in process `syz.6.16135'. [ 1320.241016][T25424] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1320.321405][ T66] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1320.365450][ T66] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1320.373269][T26385] netlink: 8 bytes leftover after parsing attributes in process `syz.7.16138'. [ 1320.396597][ T66] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1320.420850][ T66] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1320.722486][ T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1320.749420][ T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1320.919951][ T66] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1320.946370][ T66] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1321.126532][T26366] loop3: detected capacity change from 0 to 40427 [ 1321.403722][T26381] loop4: detected capacity change from 0 to 40427 [ 1321.428625][T26366] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 1321.447352][T26381] F2FS-fs (loop4): Invalid SB checksum offset: 0 [ 1321.460643][T26381] F2FS-fs (loop4): Can't find valid F2FS filesystem in 2th superblock [ 1321.471191][T26366] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 1321.488614][T26381] F2FS-fs (loop4): invalid crc value [ 1321.832517][T26381] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 1321.879486][T26381] F2FS-fs (loop4): Try to recover 2th superblock, ret: -30 [ 1321.907151][T26381] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 1322.292034][T26423] loop6: detected capacity change from 0 to 32768 [ 1322.331813][T26423] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.16147 (26423) [ 1322.382170][T26423] BTRFS info (device loop6): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 1322.410100][T26423] BTRFS info (device loop6): using sha256 checksum algorithm [ 1322.592399][T26477] loop4: detected capacity change from 0 to 64 [ 1322.644650][T26477] hfs: bad catalog entry type 0 [ 1322.683583][T26449] mkiss: ax0: crc mode is auto. [ 1322.700713][T26423] BTRFS info (device loop6): rebuilding free space tree [ 1322.759071][T26438] loop7: detected capacity change from 0 to 40427 [ 1322.788543][T26423] BTRFS info (device loop6): disabling free space tree [ 1322.814406][T26423] BTRFS info (device loop6): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 1322.830111][T26438] F2FS-fs (loop7): Invalid log sectors per block(0) log sectorsize(9) [ 1322.848552][T26438] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock [ 1322.858050][T26423] BTRFS info (device loop6): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 1322.872406][T26438] F2FS-fs (loop7): Image doesn't support compression [ 1322.891080][T26438] F2FS-fs (loop7): build fault injection type: 0x1 [ 1322.914497][T26438] F2FS-fs (loop7): invalid crc value [ 1322.925586][T26423] BTRFS info (device loop6): setting nodatasum [ 1322.955906][T26423] BTRFS info (device loop6): setting nodatacow [ 1323.023324][T26423] BTRFS info (device loop6): turning off barriers [ 1323.050756][T26423] BTRFS info (device loop6): force clearing of disk cache [ 1323.144109][T26438] F2FS-fs (loop7): f2fs_check_nid_range: out-of-range nid=ff000000, run fsck to fix. [ 1323.186162][T26438] F2FS-fs (loop7): sanity_check_inode: inode (ino=3) has corrupted i_xattr_nid: 4278190080, run fsck to fix. [ 1323.199543][T26438] F2FS-fs (loop7): Failed to read root inode [ 1323.439293][T26338] BTRFS info (device loop6): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 1323.806220][T26524] loop8: detected capacity change from 0 to 512 [ 1324.089606][ T30] audit: type=1326 audit(1412.770:725): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26540 comm="syz.6.16164" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f53dbd9c799 code=0x0 [ 1324.191501][T26524] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1324.509439][T26524] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1324.559455][T26524] EXT4-fs (loop8): changing journal_checksum during remount not supported; ignoring [ 1324.617163][T26524] EXT4-fs (loop8): re-mounted 00000000-0000-0000-0000-000000000000. [ 1324.800930][T25424] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1324.824265][T26571] netlink: 256 bytes leftover after parsing attributes in process `syz.7.16172'. [ 1324.877634][T26571] netlink: 64 bytes leftover after parsing attributes in process `syz.7.16172'. [ 1325.148236][T26590] loop6: detected capacity change from 0 to 512 [ 1325.168555][T26590] EXT4-fs: Ignoring removed nomblk_io_submit option [ 1325.193913][T26590] EXT4-fs: Ignoring removed mblk_io_submit option [ 1325.248853][T26590] EXT4-fs (loop6): Cannot turn on journaled quota: type 0: error -2 [ 1325.271402][T26590] EXT4-fs (loop6): Cannot turn on journaled quota: type 1: error -2 [ 1325.299078][T26590] EXT4-fs (loop6): 1 truncate cleaned up [ 1325.307767][T26562] loop4: detected capacity change from 0 to 32768 [ 1325.329353][T26562] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.16168 (26562) [ 1325.336979][T26590] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1325.404362][T26562] BTRFS info (device loop4): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1325.452649][T26562] BTRFS info (device loop4): using crc32c checksum algorithm [ 1325.490411][T26590] EXT4-fs error (device loop6): ext4_map_blocks:776: inode #2: block 4: comm syz.6.16175: lblock 0 mapped to illegal pblock 4 (length 1) [ 1325.546053][T26590] EXT4-fs (loop6): Remounting filesystem read-only [ 1325.615116][T26562] BTRFS info (device loop4): allowing degraded mounts [ 1325.629713][T26562] BTRFS info (device loop4): enabling ssd optimizations [ 1325.680043][T26562] BTRFS info (device loop4): turning on async discard [ 1325.688900][T26338] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1325.709867][T26562] BTRFS info (device loop4): enabling free space tree [ 1325.772690][T26562] BTRFS info (device loop4): enabling auto defrag [ 1325.782534][T26562] BTRFS info (device loop4): force lzo compression, level 1 [ 1326.087349][T26641] netlink: 12 bytes leftover after parsing attributes in process `syz.3.16184'. [ 1326.113955][T26641] netlink: 'syz.3.16184': attribute type 2 has an invalid length. [ 1326.160199][T26641] netlink: 'syz.3.16184': attribute type 1 has an invalid length. [ 1326.196411][T26641] netlink: 4 bytes leftover after parsing attributes in process `syz.3.16184'. [ 1326.394586][T26593] loop7: detected capacity change from 0 to 32768 [ 1326.716408][T26660] IPVS: ip_vs_edit_dest(): server weight less than zero [ 1326.981640][ T5815] BTRFS info (device loop4): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1327.000075][T26666] loop3: detected capacity change from 0 to 64 [ 1327.856604][T26706] netlink: 552 bytes leftover after parsing attributes in process `syz.3.16200'. [ 1328.163438][T26720] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1328.334223][T26723] loop8: detected capacity change from 0 to 4096 [ 1328.675058][T26736] NILFS (loop8): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1328.709278][T26689] loop7: detected capacity change from 0 to 32768 [ 1328.789061][T26689] ERROR: (device loop7): xtTruncate_pmap: xt_getpage: xtree page corrupt [ 1328.789061][T26689] [ 1328.956057][T26689] ERROR: (device loop7): remounting filesystem as read-only [ 1328.993318][T26689] ERROR: (device loop7): jfs_rename: [ 1328.993318][T26689] [ 1329.169787][ T809] ERROR: (device loop7): xtTruncate: xt_getpage: xtree page corrupt [ 1329.169787][ T809] [ 1329.211705][ T809] ERROR: (device loop7): remounting filesystem as read-only [ 1329.244915][T26700] loop4: detected capacity change from 0 to 40427 [ 1329.281164][T26700] F2FS-fs (loop4): invalid crc value [ 1329.560980][T26777] loop8: detected capacity change from 0 to 2048 [ 1329.601170][T26777] UDF-fs: error (device loop8): udf_read_tagged: read failed, block=18576, location=18576 [ 1329.611885][T26700] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 1329.656135][T26700] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 1329.675130][T26777] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1329.810257][ T30] audit: type=1800 audit(1418.907:726): pid=26700 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.16190" name="file0" dev="loop4" ino=10 res=0 errno=0 [ 1329.925750][ T5815] syz-executor: attempt to access beyond end of device [ 1329.925750][ T5815] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 1330.027014][ T5815] CPU: 1 UID: 0 PID: 5815 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 1330.027045][ T5815] Tainted: [L]=SOFTLOCKUP [ 1330.027052][ T5815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1330.027063][ T5815] Call Trace: [ 1330.027071][ T5815] [ 1330.027080][ T5815] dump_stack_lvl+0xe8/0x150 [ 1330.027109][ T5815] f2fs_handle_critical_error+0x37c/0x540 [ 1330.027139][ T5815] f2fs_write_end_io+0xcdb/0xff0 [ 1330.027182][ T5815] __submit_merged_bio+0x256/0x700 [ 1330.027211][ T5815] __submit_merged_write_cond+0x3c9/0x4e0 [ 1330.027244][ T5815] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 1330.027292][ T5815] f2fs_write_data_pages+0x2975/0x35e0 [ 1330.027351][ T5815] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 1330.027386][ T5815] ? css_rstat_updated+0x23a/0x530 [ 1330.027434][ T5815] ? mod_memcg_lruvec_state+0x20c/0x440 [ 1330.027467][ T5815] ? __lock_acquire+0x6b5/0x2cf0 [ 1330.027504][ T5815] ? __lock_acquire+0x6b5/0x2cf0 [ 1330.027532][ T5815] ? do_raw_spin_lock+0x12b/0x2f0 [ 1330.027564][ T5815] ? do_raw_spin_unlock+0xf5/0x210 [ 1330.027585][ T5815] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 1330.027610][ T5815] do_writepages+0x32e/0x550 [ 1330.027649][ T5815] ? do_raw_spin_unlock+0xf5/0x210 [ 1330.027672][ T5815] filemap_fdatawrite+0x1e9/0x2f0 [ 1330.027695][ T5815] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 1330.027757][ T5815] ? do_raw_spin_unlock+0xf5/0x210 [ 1330.027781][ T5815] f2fs_sync_dirty_inodes+0x30e/0x860 [ 1330.027820][ T5815] f2fs_write_checkpoint+0x9df/0x26a0 [ 1330.027879][ T5815] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 1330.027960][ T5815] kill_f2fs_super+0x314/0x720 [ 1330.027991][ T5815] ? __pfx_kill_f2fs_super+0x10/0x10 [ 1330.028027][ T5815] ? lockdep_hardirqs_on+0x7a/0x110 [ 1330.028060][ T5815] deactivate_locked_super+0xbc/0x130 [ 1330.028084][ T5815] cleanup_mnt+0x437/0x4d0 [ 1330.028105][ T5815] ? _raw_spin_unlock_irq+0x23/0x50 [ 1330.028133][ T5815] task_work_run+0x1d9/0x270 [ 1330.028159][ T5815] ? __pfx_task_work_run+0x10/0x10 [ 1330.028190][ T5815] exit_to_user_mode_loop+0xed/0x480 [ 1330.028215][ T5815] ? rcu_is_watching+0x15/0xb0 [ 1330.028244][ T5815] do_syscall_64+0x32d/0xf80 [ 1330.028263][ T5815] ? trace_irq_disable+0x3b/0x150 [ 1330.028280][ T5815] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1330.028298][ T5815] ? clear_bhb_loop+0x40/0x90 [ 1330.028321][ T5815] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1330.028339][ T5815] RIP: 0033:0x7f5ddb79d9d7 [ 1330.028357][ T5815] Code: a2 c7 05 1c ed 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 1330.028372][ T5815] RSP: 002b:00007ffe7ef6eae8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 1330.028391][ T5815] RAX: 0000000000000000 RBX: 00007f5ddb831f90 RCX: 00007f5ddb79d9d7 [ 1330.028403][ T5815] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe7ef6eba0 [ 1330.028415][ T5815] RBP: 00007ffe7ef6eba0 R08: 00007ffe7ef6fba0 R09: 00000000ffffffff [ 1330.028428][ T5815] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe7ef6fc30 [ 1330.028439][ T5815] R13: 00007f5ddb831f90 R14: 000000000015a6d2 R15: 00007ffe7ef6fc70 [ 1330.028478][ T5815] [ 1330.028744][ T5815] F2FS-fs (loop4): Stopped filesystem due to reason: 3 [ 1330.638298][T26823] loop7: detected capacity change from 0 to 64 [ 1331.020539][T26838] loop7: detected capacity change from 0 to 256 [ 1331.058124][T26838] exfat: Deprecated parameter 'utf8' [ 1331.140775][T26838] exFAT-fs (loop7): failed to load upcase table (idx : 0x00010000, chksum : 0xa7bed01f, utbl_chksum : 0xe619d30d) [ 1331.296283][T26800] loop8: detected capacity change from 0 to 32768 [ 1331.347327][T26800] BTRFS: device fsid a6a605fc-d5f1-4e66-8595-3726e2b761d6 devid 1 transid 8 /dev/loop8 (7:8) scanned by syz.8.16217 (26800) [ 1331.403964][T26800] BTRFS info (device loop8): first mount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 1331.452639][T26800] BTRFS info (device loop8): using blake2b checksum algorithm [ 1331.514165][ T796] usb 7-1: new full-speed USB device number 35 using dummy_hcd [ 1331.718178][ T796] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1331.730622][T26800] BTRFS info (device loop8 state EC): enabling ssd optimizations [ 1331.751553][ T796] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1331.770118][T26800] BTRFS info (device loop8 state EC): using spread ssd allocation scheme [ 1331.770749][T26807] loop3: detected capacity change from 0 to 40427 [ 1331.810350][ T796] usb 7-1: New USB device found, idVendor=0458, idProduct=5005, bcdDevice= 0.00 [ 1331.825304][T26800] BTRFS info (device loop8 state EC): turning off barriers [ 1331.856483][ T796] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1331.867148][T26800] BTRFS info (device loop8 state EC): enabling free space tree [ 1331.871478][T26895] netlink: 256 bytes leftover after parsing attributes in process `syz.4.16233'. [ 1331.893549][T26807] F2FS-fs (loop3): invalid crc value [ 1331.894325][T26800] BTRFS info (device loop8 state EC): enabling auto defrag [ 1331.916441][ T796] usb 7-1: config 0 descriptor?? [ 1331.950163][T26800] BTRFS info (device loop8 state EC): ignoring data csums [ 1331.975381][T26800] BTRFS info (device loop8 state EC): force zlib compression, level 3 [ 1332.212968][T25424] BTRFS info (device loop8 state EC): last unmount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 1332.251700][T26807] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 1332.293751][T26807] F2FS-fs (loop3): Start checkpoint disabled! [ 1332.361534][T26807] F2FS-fs (loop3): f2fs_disable_checkpoint() finish, err:0 [ 1332.408084][ T796] kye 0003:0458:5005.001C: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 1332.440776][ T796] kye 0003:0458:5005.001C: unknown main item tag 0x0 [ 1332.446330][T26807] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 1332.499090][ T796] kye 0003:0458:5005.001C: unknown main item tag 0x0 [ 1332.552039][ T796] kye 0003:0458:5005.001C: unknown main item tag 0x0 [ 1332.590643][ T796] kye 0003:0458:5005.001C: unknown main item tag 0x0 [ 1332.621761][ T796] kye 0003:0458:5005.001C: unknown main item tag 0x0 [ 1332.637801][T26922] binder: 26921:26922 ioctl 541b 0 returned -22 [ 1332.654851][ T796] kye 0003:0458:5005.001C: unknown main item tag 0x0 [ 1332.679040][ T796] kye 0003:0458:5005.001C: unknown main item tag 0x0 [ 1332.750236][ T796] kye 0003:0458:5005.001C: hidraw0: USB HID v10.00 Device [HID 0458:5005] on usb-dummy_hcd.6-1/input0 [ 1332.818137][ T796] kye 0003:0458:5005.001C: tablet-enabling feature report not found [ 1332.838337][T17081] kworker/u8:6: attempt to access beyond end of device [ 1332.838337][T17081] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 1332.856045][ T796] kye 0003:0458:5005.001C: tablet enabling failed [ 1332.896836][T17081] CPU: 0 UID: 0 PID: 17081 Comm: kworker/u8:6 Tainted: G L syzkaller #0 PREEMPT(full) [ 1332.896867][T17081] Tainted: [L]=SOFTLOCKUP [ 1332.896873][T17081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1332.896885][T17081] Workqueue: writeback wb_workfn (flush-7:3) [ 1332.896915][T17081] Call Trace: [ 1332.896923][T17081] [ 1332.896931][T17081] dump_stack_lvl+0xe8/0x150 [ 1332.896958][T17081] f2fs_handle_critical_error+0x37c/0x540 [ 1332.896987][T17081] f2fs_write_end_io+0xcdb/0xff0 [ 1332.897028][T17081] __submit_merged_bio+0x256/0x700 [ 1332.897056][T17081] __submit_merged_write_cond+0x3c9/0x4e0 [ 1332.897087][T17081] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 1332.897131][T17081] f2fs_write_data_pages+0x2975/0x35e0 [ 1332.897189][T17081] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 1332.897225][T17081] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 1332.897282][T17081] ? __pfx_f2fs_balance_fs_bg+0x10/0x10 [ 1332.897346][T17081] ? __lock_acquire+0x6b5/0x2cf0 [ 1332.897387][T17081] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 1332.897412][T17081] do_writepages+0x32e/0x550 [ 1332.897445][T17081] ? reacquire_held_locks+0x104/0x190 [ 1332.897469][T17081] ? writeback_sb_inodes+0x477/0x1a20 [ 1332.897494][T17081] __writeback_single_inode+0x133/0x11a0 [ 1332.897516][T17081] ? do_raw_spin_unlock+0xf5/0x210 [ 1332.897540][T17081] writeback_sb_inodes+0x992/0x1a20 [ 1332.897578][T17081] ? __lock_acquire+0x6b5/0x2cf0 [ 1332.897606][T17081] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 1332.897623][T17081] ? do_raw_spin_lock+0x12b/0x2f0 [ 1332.897681][T17081] ? rcu_is_watching+0x15/0xb0 [ 1332.897715][T17081] wb_writeback+0x456/0xb70 [ 1332.897737][T17081] ? queue_io+0x241/0x4a0 [ 1332.897763][T17081] ? __pfx_wb_writeback+0x10/0x10 [ 1332.897779][T17081] ? do_raw_spin_lock+0x12b/0x2f0 [ 1332.897815][T17081] wb_workfn+0x414/0xf50 [ 1332.897841][T17081] ? look_up_lock_class+0x57/0x110 [ 1332.897872][T17081] ? __pfx_wb_workfn+0x10/0x10 [ 1332.897899][T17081] ? do_raw_spin_lock+0x12b/0x2f0 [ 1332.897924][T17081] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1332.897964][T17081] ? process_one_work+0x870/0x1720 [ 1332.897987][T17081] process_one_work+0x963/0x1720 [ 1332.898032][T17081] ? __pfx_process_one_work+0x10/0x10 [ 1332.898053][T17081] ? do_raw_spin_lock+0x12b/0x2f0 [ 1332.898088][T17081] worker_thread+0xb46/0x1140 [ 1332.898136][T17081] kthread+0x388/0x470 [ 1332.898155][T17081] ? __pfx_worker_thread+0x10/0x10 [ 1332.898176][T17081] ? __pfx_kthread+0x10/0x10 [ 1332.898195][T17081] ret_from_fork+0x51e/0xb90 [ 1332.898222][T17081] ? __pfx_ret_from_fork+0x10/0x10 [ 1332.898244][T17081] ? __switch_to+0xc7d/0x1450 [ 1332.898269][T17081] ? __pfx_kthread+0x10/0x10 [ 1332.898288][T17081] ret_from_fork_asm+0x1a/0x30 [ 1332.898329][T17081] [ 1332.901199][ T796] usb 7-1: USB disconnect, device number 35 [ 1333.029089][T26927] loop4: detected capacity change from 0 to 4096 [ 1333.033388][T17081] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 1333.082553][T26927] ntfs3(loop4): Different NTFS sector size (2048) and media sector size (512). [ 1333.435413][T26927] ntfs3(loop4): Failed to initialize $Extend/$ObjId. [ 1333.457909][T26892] loop7: detected capacity change from 0 to 40427 [ 1333.510592][T26892] F2FS-fs (loop7): Image doesn't support compression [ 1333.559562][T26892] F2FS-fs (loop7): build fault injection rate: 684 [ 1333.641557][T26892] F2FS-fs (loop7): build fault injection type: 0x35f7 [ 1333.673019][T26892] F2FS-fs (loop7): invalid crc value [ 1334.098189][T26892] F2FS-fs (loop7): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 1334.162328][T26892] F2FS-fs (loop7): Start checkpoint disabled! [ 1334.215495][T26892] F2FS-fs (loop7): f2fs_disable_checkpoint() finish, err:0 [ 1334.263795][T26892] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e6 [ 1334.382499][ T30] audit: type=1800 audit(1423.810:727): pid=26892 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.16232" name="file1" dev="loop7" ino=10 res=0 errno=0 [ 1334.550818][T17081] kworker/u8:6: attempt to access beyond end of device [ 1334.550818][T17081] loop7: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 1334.585372][T17081] CPU: 1 UID: 0 PID: 17081 Comm: kworker/u8:6 Tainted: G L syzkaller #0 PREEMPT(full) [ 1334.585402][T17081] Tainted: [L]=SOFTLOCKUP [ 1334.585409][T17081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1334.585422][T17081] Workqueue: writeback wb_workfn (flush-7:7) [ 1334.585455][T17081] Call Trace: [ 1334.585463][T17081] [ 1334.585473][T17081] dump_stack_lvl+0xe8/0x150 [ 1334.585500][T17081] f2fs_handle_critical_error+0x37c/0x540 [ 1334.585531][T17081] f2fs_write_end_io+0xcdb/0xff0 [ 1334.585575][T17081] __submit_merged_bio+0x256/0x700 [ 1334.585605][T17081] __submit_merged_write_cond+0x3c9/0x4e0 [ 1334.585645][T17081] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 1334.585695][T17081] f2fs_write_data_pages+0x2975/0x35e0 [ 1334.585759][T17081] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 1334.585798][T17081] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 1334.585861][T17081] ? __pfx_f2fs_balance_fs_bg+0x10/0x10 [ 1334.585909][T17081] ? __lock_acquire+0x6b5/0x2cf0 [ 1334.585953][T17081] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 1334.585979][T17081] do_writepages+0x32e/0x550 [ 1334.586014][T17081] ? reacquire_held_locks+0x104/0x190 [ 1334.586037][T17081] ? writeback_sb_inodes+0x477/0x1a20 [ 1334.586060][T17081] __writeback_single_inode+0x133/0x11a0 [ 1334.586081][T17081] ? do_raw_spin_unlock+0xf5/0x210 [ 1334.586106][T17081] writeback_sb_inodes+0x992/0x1a20 [ 1334.586146][T17081] ? __lock_acquire+0x6b5/0x2cf0 [ 1334.586175][T17081] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 1334.586193][T17081] ? do_raw_spin_lock+0x12b/0x2f0 [ 1334.586252][T17081] ? rcu_is_watching+0x15/0xb0 [ 1334.586285][T17081] wb_writeback+0x456/0xb70 [ 1334.586307][T17081] ? queue_io+0x241/0x4a0 [ 1334.586333][T17081] ? __pfx_wb_writeback+0x10/0x10 [ 1334.586349][T17081] ? do_raw_spin_lock+0x12b/0x2f0 [ 1334.586384][T17081] wb_workfn+0x414/0xf50 [ 1334.586410][T17081] ? look_up_lock_class+0x57/0x110 [ 1334.586444][T17081] ? __pfx_wb_workfn+0x10/0x10 [ 1334.586470][T17081] ? do_raw_spin_lock+0x12b/0x2f0 [ 1334.586490][T17081] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1334.586534][T17081] ? process_one_work+0x870/0x1720 [ 1334.586556][T17081] process_one_work+0x963/0x1720 [ 1334.586604][T17081] ? __pfx_process_one_work+0x10/0x10 [ 1334.586633][T17081] ? do_raw_spin_lock+0x12b/0x2f0 [ 1334.586672][T17081] worker_thread+0xb46/0x1140 [ 1334.586725][T17081] kthread+0x388/0x470 [ 1334.586746][T17081] ? __pfx_worker_thread+0x10/0x10 [ 1334.586767][T17081] ? __pfx_kthread+0x10/0x10 [ 1334.586788][T17081] ret_from_fork+0x51e/0xb90 [ 1334.586816][T17081] ? __pfx_ret_from_fork+0x10/0x10 [ 1334.586838][T17081] ? __switch_to+0xc7d/0x1450 [ 1334.586865][T17081] ? __pfx_kthread+0x10/0x10 [ 1334.586886][T17081] ret_from_fork_asm+0x1a/0x30 [ 1334.586923][T17081] [ 1334.852397][T17081] F2FS-fs (loop7): Stopped filesystem due to reason: 3 [ 1335.128564][T26983] loop4: detected capacity change from 0 to 40427 [ 1335.137928][T26983] F2FS-fs (loop4): build fault injection rate: 771 [ 1335.147313][T26983] F2FS-fs (loop4): invalid crc value [ 1335.423589][T27025] netlink: 80 bytes leftover after parsing attributes in process `syz.6.16258'. [ 1335.460304][T26983] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 1335.486546][T26983] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 1335.657722][ T5815] syz-executor: attempt to access beyond end of device [ 1335.657722][ T5815] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 1335.749033][ T5815] CPU: 1 UID: 0 PID: 5815 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 1335.749070][ T5815] Tainted: [L]=SOFTLOCKUP [ 1335.749077][ T5815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1335.749088][ T5815] Call Trace: [ 1335.749096][ T5815] [ 1335.749103][ T5815] dump_stack_lvl+0xe8/0x150 [ 1335.749133][ T5815] f2fs_handle_critical_error+0x37c/0x540 [ 1335.749164][ T5815] f2fs_write_end_io+0xcdb/0xff0 [ 1335.749206][ T5815] __submit_merged_bio+0x256/0x700 [ 1335.749235][ T5815] __submit_merged_write_cond+0x3c9/0x4e0 [ 1335.749266][ T5815] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 1335.749310][ T5815] f2fs_write_data_pages+0x2975/0x35e0 [ 1335.749433][ T5815] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 1335.749472][ T5815] ? css_rstat_updated+0x23a/0x530 [ 1335.749517][ T5815] ? mod_memcg_lruvec_state+0x20c/0x440 [ 1335.749541][ T5815] ? __lock_acquire+0x6b5/0x2cf0 [ 1335.749578][ T5815] ? __lock_acquire+0x6b5/0x2cf0 [ 1335.749604][ T5815] ? do_raw_spin_lock+0x12b/0x2f0 [ 1335.749634][ T5815] ? do_raw_spin_unlock+0xf5/0x210 [ 1335.749655][ T5815] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 1335.749678][ T5815] do_writepages+0x32e/0x550 [ 1335.749713][ T5815] ? do_raw_spin_unlock+0xf5/0x210 [ 1335.749737][ T5815] filemap_fdatawrite+0x1e9/0x2f0 [ 1335.749758][ T5815] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 1335.749812][ T5815] ? do_raw_spin_unlock+0xf5/0x210 [ 1335.749833][ T5815] f2fs_sync_dirty_inodes+0x30e/0x860 [ 1335.749872][ T5815] f2fs_write_checkpoint+0x9df/0x26a0 [ 1335.749996][ T5815] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 1335.750060][ T5815] ? kfree+0x1c1/0x630 [ 1335.750079][ T5815] ? f2fs_stop_gc_thread+0x7f/0xb0 [ 1335.750106][ T5815] kill_f2fs_super+0x314/0x720 [ 1335.750138][ T5815] ? __pfx_kill_f2fs_super+0x10/0x10 [ 1335.750175][ T5815] ? lockdep_hardirqs_on+0x7a/0x110 [ 1335.750208][ T5815] deactivate_locked_super+0xbc/0x130 [ 1335.750263][ T5815] cleanup_mnt+0x437/0x4d0 [ 1335.750286][ T5815] ? _raw_spin_unlock_irq+0x23/0x50 [ 1335.750316][ T5815] task_work_run+0x1d9/0x270 [ 1335.750339][ T5815] ? __pfx_task_work_run+0x10/0x10 [ 1335.750370][ T5815] exit_to_user_mode_loop+0xed/0x480 [ 1335.750390][ T5815] ? rcu_is_watching+0x15/0xb0 [ 1335.750419][ T5815] do_syscall_64+0x32d/0xf80 [ 1335.750437][ T5815] ? trace_irq_disable+0x3b/0x150 [ 1335.750455][ T5815] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1335.750473][ T5815] ? clear_bhb_loop+0x40/0x90 [ 1335.750496][ T5815] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1335.750514][ T5815] RIP: 0033:0x7f5ddb79d9d7 [ 1335.750533][ T5815] Code: a2 c7 05 1c ed 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 1335.750547][ T5815] RSP: 002b:00007ffe7ef6eae8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 1335.750568][ T5815] RAX: 0000000000000000 RBX: 00007f5ddb831f90 RCX: 00007f5ddb79d9d7 [ 1335.750581][ T5815] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe7ef6eba0 [ 1335.750593][ T5815] RBP: 00007ffe7ef6eba0 R08: 00007ffe7ef6fba0 R09: 00000000ffffffff [ 1335.750605][ T5815] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe7ef6fc30 [ 1335.750617][ T5815] R13: 00007f5ddb831f90 R14: 000000000015bed8 R15: 00007ffe7ef6fc70 [ 1335.750649][ T5815] [ 1335.750658][ T5815] F2FS-fs (loop4): Stopped filesystem due to reason: 3 [ 1336.203031][T27055] netlink: 12 bytes leftover after parsing attributes in process `syz.8.16269'. [ 1336.509767][T27073] loop7: detected capacity change from 0 to 2048 [ 1336.559004][T27080] NILFS (loop7): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1336.795173][T27085] loop8: detected capacity change from 0 to 1024 [ 1336.854493][T27085] EXT4-fs (loop8): ext4_check_descriptors: Checksum for group 0 failed (51269!=20869) [ 1336.893520][T27085] EXT4-fs (loop8): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 1336.958670][T27085] EXT4-fs error (device loop8): ext4_get_journal_inode:5863: inode #32: comm syz.8.16276: iget: special inode unallocated [ 1336.981526][T27094] netlink: 16 bytes leftover after parsing attributes in process `syz.6.16278'. [ 1337.000957][T27085] loop8: lost file I/O error report for ino 32 type 5 pos 0x0 len 0x0 error -117 [ 1337.001237][T27085] EXT4-fs (loop8): Remounting filesystem read-only [ 1337.010489][ C1] EXT4-fs (loop8): error count since last fsck: 1 [ 1337.010511][ C1] EXT4-fs (loop8): initial error at time 1426: ext4_get_journal_inode:5863: inode 32 [ 1337.010544][ C1] EXT4-fs (loop8): last error at time 1426: ext4_get_journal_inode:5863: inode 32 [ 1337.090487][T27085] EXT4-fs (loop8): no journal found [ 1337.115600][T27085] EXT4-fs (loop8): can't get journal size [ 1337.122309][T27085] EXT4-fs (loop8): filesystem is read-only [ 1337.140039][T27085] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 1337.227967][T27068] loop3: detected capacity change from 0 to 32768 [ 1337.279369][T25424] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1337.359534][T27110] netlink: 12 bytes leftover after parsing attributes in process `syz.4.16282'. [ 1337.411532][T27068] overlayfs: upper fs needs to support d_type. [ 1337.456902][T27068] overlayfs: upper fs does not support tmpfile. [ 1337.533986][T27121] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(3) [ 1337.538032][T27068] read_mapping_page failed! [ 1337.540531][T27121] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1337.558211][T27121] vhci_hcd vhci_hcd.0: Device attached [ 1337.595591][T27068] ERROR: (device loop3): txCommit: [ 1337.595591][T27068] [ 1337.625980][T27068] ERROR: (device loop3): remounting filesystem as read-only [ 1337.643711][T27132] netlink: 8 bytes leftover after parsing attributes in process `syz.6.16287'. [ 1337.680818][T27132] netlink: 8 bytes leftover after parsing attributes in process `syz.6.16287'. [ 1337.701585][T27130] loop4: detected capacity change from 0 to 4096 [ 1337.710491][T27132] netlink: 8 bytes leftover after parsing attributes in process `syz.6.16287'. [ 1337.741197][T27130] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1337.765104][T27137] vivid-000: disconnect [ 1337.794388][T27135] vivid-000: reconnect [ 1337.801333][T21360] usb 49-1: new low-speed USB device number 2 using vhci_hcd [ 1338.414484][T27130] EXT4-fs error (device loop4): ext4_do_update_inode:5569: inode #15: comm syz.4.16286: corrupted inode contents [ 1338.464142][T27130] EXT4-fs error (device loop4): ext4_dirty_inode:6450: inode #15: comm syz.4.16286: mark_inode_dirty error [ 1338.491017][T27130] EXT4-fs error (device loop4): ext4_do_update_inode:5569: inode #15: comm syz.4.16286: corrupted inode contents [ 1338.511560][T27130] EXT4-fs error (device loop4): __ext4_ext_dirty:207: inode #15: comm syz.4.16286: mark_inode_dirty error [ 1338.547968][T27130] EXT4-fs error (device loop4): ext4_do_update_inode:5569: inode #15: comm syz.4.16286: corrupted inode contents [ 1338.585040][T27130] EXT4-fs error (device loop4): __ext4_ext_dirty:207: inode #15: comm syz.4.16286: mark_inode_dirty error [ 1338.588876][T19907] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 1338.598926][T27184] ================================================================== [ 1338.613195][T27184] BUG: KASAN: use-after-free in fuse_copy_do+0x193/0x380 [ 1338.617003][T27130] EXT4-fs error (device loop4): ext4_do_update_inode:5569: inode #15: comm syz.4.16286: corrupted inode contents [ 1338.620244][T27184] Write of size 2 at addr ffff88804933bfff by task syz.3.16300/27184 [ 1338.620265][T27184] [ 1338.620279][T27184] CPU: 0 UID: 0 PID: 27184 Comm: syz.3.16300 Tainted: G L syzkaller #0 PREEMPT(full) [ 1338.620306][T27184] Tainted: [L]=SOFTLOCKUP [ 1338.620313][T27184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1338.620324][T27184] Call Trace: [ 1338.620332][T27184] [ 1338.620342][T27184] dump_stack_lvl+0xe8/0x150 [ 1338.620371][T27184] print_report+0xba/0x230 [ 1338.620391][T27184] ? fuse_copy_do+0x193/0x380 [ 1338.620414][T27184] kasan_report+0x117/0x150 [ 1338.620442][T27184] ? fuse_copy_do+0x193/0x380 [ 1338.620465][T27184] kasan_check_range+0x264/0x2c0 [ 1338.620491][T27184] ? fuse_copy_do+0x193/0x380 [ 1338.620510][T27184] __asan_memcpy+0x40/0x70 [ 1338.620531][T27184] fuse_copy_do+0x193/0x380 [ 1338.620555][T27184] fuse_copy_folio+0xefc/0x1b00 [ 1338.620588][T27184] ? __folio_batch_add_and_move+0x78b/0xc50 [ 1338.620614][T27184] ? filemap_add_folio+0x356/0x530 [ 1338.620641][T27184] fuse_dev_do_write+0x2b9d/0x4060 [ 1338.620675][T27184] ? __pfx_fuse_dev_do_write+0x10/0x10 [ 1338.620705][T27184] ? aa_file_perm+0x192/0x15e0 [ 1338.620731][T27184] ? aa_file_perm+0x50e/0x15e0 [ 1338.620754][T27184] ? aa_file_perm+0x192/0x15e0 [ 1338.620779][T27184] ? __pfx___futex_wait+0x10/0x10 [ 1338.620797][T27184] ? __pfx_aa_file_perm+0x10/0x10 [ 1338.620822][T27184] ? __pfx_futex_wake_mark+0x10/0x10 [ 1338.620846][T27184] fuse_dev_write+0x177/0x220 [ 1338.620872][T27184] ? __pfx_fuse_dev_write+0x10/0x10 [ 1338.620899][T27184] ? bpf_lsm_file_permission+0x9/0x20 [ 1338.620924][T27184] ? security_file_permission+0x75/0x260 [ 1338.620950][T27184] vfs_write+0x61d/0xb90 [ 1338.620978][T27184] ? __pfx_vfs_write+0x10/0x10 [ 1338.621006][T27184] ? __fget_files+0x2a/0x420 [ 1338.621031][T27184] ksys_write+0x150/0x270 [ 1338.621055][T27184] ? __pfx_ksys_write+0x10/0x10 [ 1338.621084][T27184] do_syscall_64+0x14d/0xf80 [ 1338.621104][T27184] ? trace_irq_disable+0x3b/0x150 [ 1338.621123][T27184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1338.621143][T27184] ? clear_bhb_loop+0x40/0x90 [ 1338.621164][T27184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1338.621183][T27184] RIP: 0033:0x7fa47d59c799 [ 1338.621202][T27184] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1338.621219][T27184] RSP: 002b:00007fa47e4d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1338.621239][T27184] RAX: ffffffffffffffda RBX: 00007fa47d815fa0 RCX: 00007fa47d59c799 [ 1338.621254][T27184] RDX: 000000000000002a RSI: 0000200000000000 RDI: 0000000000000003 [ 1338.621267][T27184] RBP: 00007fa47d632bd9 R08: 0000000000000000 R09: 0000000000000000 [ 1338.621280][T27184] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1338.621293][T27184] R13: 00007fa47d816038 R14: 00007fa47d815fa0 R15: 00007ffe4d411c18 [ 1338.621316][T27184] [ 1338.621323][T27184] [ 1338.654743][T27130] EXT4-fs error (device loop4): ext4_truncate:4587: inode #15: comm syz.4.16286: mark_inode_dirty error [ 1338.658668][T27184] The buggy address belongs to the physical page: [ 1338.658682][T27184] page: refcount:3 mapcount:0 mapping:ffff888077a81720 index:0x7 pfn:0x4933b [ 1338.658712][T27184] memcg:ffff888037de5480 [ 1338.670442][T27130] EXT4-fs error (device loop4) in ext4_setattr:5983: Corrupt filesystem [ 1338.672058][T27184] aops:empty_aops ino:1 dentry name(?):"/" [ 1338.672089][T27184] flags: 0xfff00000000005(locked|referenced|node=0|zone=1|lastcpupid=0x7ff) [ 1338.672116][T27184] raw: 00fff00000000005 0000000000000000 dead000000000122 ffff888077a81720 [ 1338.672135][T27184] raw: 0000000000000007 0000000000000000 00000003ffffffff ffff888037de5480 [ 1338.672147][T27184] page dumped because: kasan: bad access detected [ 1338.672169][T27184] page_owner tracks the page as allocated [ 1338.672178][T27184] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 27184, tgid 27183 (syz.3.16300), ts 1338597852525, free_ts 1338408129990 [ 1338.672212][T27184] post_alloc_hook+0x231/0x280 [ 1338.672237][T27184] get_page_from_freelist+0x23a1/0x2440 [ 1338.672266][T27184] __alloc_frozen_pages_noprof+0x18d/0x380 [ 1338.672293][T27184] alloc_pages_mpol+0x232/0x4a0 [ 1338.672320][T27184] alloc_pages_noprof+0xa8/0x190 [ 1338.672347][T27184] folio_alloc_noprof+0x1e/0x30 [ 1338.672374][T27184] filemap_alloc_folio_noprof+0x111/0x470 [ 1338.672396][T27184] __filemap_get_folio_mpol+0x3fc/0xb00 [ 1338.672420][T27184] fuse_dev_do_write+0x298b/0x4060 [ 1338.672447][T27184] fuse_dev_write+0x177/0x220 [ 1338.672471][T27184] vfs_write+0x61d/0xb90 [ 1338.672495][T27184] ksys_write+0x150/0x270 [ 1338.672519][T27184] do_syscall_64+0x14d/0xf80 [ 1338.672539][T27184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1338.672557][T27184] page last free pid 5824 tgid 5824 stack trace: [ 1338.672569][T27184] free_unref_folios+0xd71/0x1530 [ 1338.672593][T27184] folios_put_refs+0x9ff/0xb40 [ 1338.672619][T27184] shmem_undo_range+0x52c/0x1660 [ 1338.672637][T27184] shmem_evict_inode+0x289/0xae0 [ 1338.672663][T27184] evict+0x61e/0xb10 [ 1338.672688][T27184] __dentry_kill+0x1a2/0x5e0 [ 1338.672715][T27184] finish_dput+0xc9/0x480 [ 1338.672734][T27184] __fput+0x691/0xa70 [ 1338.672754][T27184] task_work_run+0x1d9/0x270 [ 1338.672774][T27184] exit_to_user_mode_loop+0xed/0x480 [ 1338.672799][T27184] do_syscall_64+0x32d/0xf80 [ 1338.672817][T27184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1338.672837][T27184] [ 1338.672844][T27184] Memory state around the buggy address: [ 1338.672856][T27184] ffff88804933bf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1338.672871][T27184] ffff88804933bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1338.672886][T27184] >ffff88804933c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1338.672898][T27184] ^ [ 1338.672909][T27184] ffff88804933c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1338.672924][T27184] ffff88804933c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1338.672936][T27184] ================================================================== [ 1338.693718][T27184] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1338.693747][T27184] CPU: 0 UID: 0 PID: 27184 Comm: syz.3.16300 Tainted: G L syzkaller #0 PREEMPT(full) [ 1338.693777][T27184] Tainted: [L]=SOFTLOCKUP [ 1338.693786][T27184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1338.693800][T27184] Call Trace: [ 1338.693810][T27184] [ 1338.693820][T27184] vpanic+0x56c/0xa60 [ 1338.693853][T27184] ? __pfx_vpanic+0x10/0x10 [ 1338.693882][T27184] ? __pfx___schedule+0x10/0x10 [ 1338.693905][T27184] panic+0xc5/0xd0 [ 1338.693932][T27184] ? __pfx_panic+0x10/0x10 [ 1338.693958][T27184] ? preempt_schedule_thunk+0x16/0x30 [ 1338.693982][T27184] ? fuse_copy_do+0x193/0x380 [ 1339.289330][T27184] check_panic_on_warn+0x89/0xb0 [ 1339.294268][T27184] ? fuse_copy_do+0x193/0x380 [ 1339.298944][T27184] end_report+0x73/0x180 [ 1339.303187][T27184] ? fuse_copy_do+0x193/0x380 [ 1339.307859][T27184] kasan_report+0x128/0x150 [ 1339.312360][T27184] ? fuse_copy_do+0x193/0x380 [ 1339.317039][T27184] kasan_check_range+0x264/0x2c0 [ 1339.321973][T27184] ? fuse_copy_do+0x193/0x380 [ 1339.326643][T27184] __asan_memcpy+0x40/0x70 [ 1339.331049][T27184] fuse_copy_do+0x193/0x380 [ 1339.335546][T27184] fuse_copy_folio+0xefc/0x1b00 [ 1339.340392][T27184] ? __folio_batch_add_and_move+0x78b/0xc50 [ 1339.346279][T27184] ? filemap_add_folio+0x356/0x530 [ 1339.351394][T27184] fuse_dev_do_write+0x2b9d/0x4060 [ 1339.356513][T27184] ? __pfx_fuse_dev_do_write+0x10/0x10 [ 1339.361977][T27184] ? aa_file_perm+0x192/0x15e0 [ 1339.366747][T27184] ? aa_file_perm+0x50e/0x15e0 [ 1339.371507][T27184] ? aa_file_perm+0x192/0x15e0 [ 1339.376265][T27184] ? __pfx___futex_wait+0x10/0x10 [ 1339.381277][T27184] ? __pfx_aa_file_perm+0x10/0x10 [ 1339.386290][T27184] ? __pfx_futex_wake_mark+0x10/0x10 [ 1339.391566][T27184] fuse_dev_write+0x177/0x220 [ 1339.396237][T27184] ? __pfx_fuse_dev_write+0x10/0x10 [ 1339.401429][T27184] ? bpf_lsm_file_permission+0x9/0x20 [ 1339.406795][T27184] ? security_file_permission+0x75/0x260 [ 1339.412422][T27184] vfs_write+0x61d/0xb90 [ 1339.416663][T27184] ? __pfx_vfs_write+0x10/0x10 [ 1339.421422][T27184] ? __fget_files+0x2a/0x420 [ 1339.426012][T27184] ksys_write+0x150/0x270 [ 1339.430332][T27184] ? __pfx_ksys_write+0x10/0x10 [ 1339.435178][T27184] do_syscall_64+0x14d/0xf80 [ 1339.439766][T27184] ? trace_irq_disable+0x3b/0x150 [ 1339.444778][T27184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1339.450832][T27184] ? clear_bhb_loop+0x40/0x90 [ 1339.455500][T27184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1339.461381][T27184] RIP: 0033:0x7fa47d59c799 [ 1339.465784][T27184] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1339.485384][T27184] RSP: 002b:00007fa47e4d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1339.493805][T27184] RAX: ffffffffffffffda RBX: 00007fa47d815fa0 RCX: 00007fa47d59c799 [ 1339.501776][T27184] RDX: 000000000000002a RSI: 0000200000000000 RDI: 0000000000000003 [ 1339.509745][T27184] RBP: 00007fa47d632bd9 R08: 0000000000000000 R09: 0000000000000000 [ 1339.517722][T27184] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1339.525695][T27184] R13: 00007fa47d816038 R14: 00007fa47d815fa0 R15: 00007ffe4d411c18 [ 1339.533684][T27184] [ 1339.536980][T27184] Kernel Offset: disabled [ 1339.541467][T27184] Rebooting in 86400 seconds..