last executing test programs: 15.688263885s ago: executing program 3 (id=1725): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) setns(0xc9, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_linger(r2, 0x1, 0x3d, &(0x7f0000000080)={0xb}, 0x8) sendmmsg$sock(r2, &(0x7f0000000300)=[{{&(0x7f0000000000)=@qipcrtr={0x2a, 0x2, 0x3fff}, 0x80, 0x0, 0x0, &(0x7f0000000280)=[@txtime={{0x18, 0x1, 0x3d, 0x1}}], 0x18}}], 0x1, 0x200088d0) socket$netlink(0x10, 0x3, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x3, 0x121003) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="04230d00c80001"], 0x10) 15.06657073s ago: executing program 3 (id=1730): r0 = syz_open_dev$sndctrl(&(0x7f0000000580), 0x0, 0x0) r1 = gettid() ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000080)={{0x1088, 0x0, 0x2, 0x80, 'syz1\x00', 0x8200000}, 0x2, 0x400, 0x1, r1, 0x0, 0x7, 'syz1\x00', 0x0}) 11.114190627s ago: executing program 3 (id=1743): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/68, 0x44}], 0x1}, 0x0) 8.796357064s ago: executing program 0 (id=1752): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000200)=ANY=[@ANYBLOB="12010002000000404b0c00010001000000010902270001010080320904000003ff0000000705830308000a0705810220000007050202"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='./dev/ttyUSB0\x00', 0x2, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 8.796059834s ago: executing program 3 (id=1753): setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e20, 0x7, @private0={0xfc, 0x0, '\x00', 0x1}, 0x3}, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6={0xa, 0x4e20, 0x9, @loopback, 0x7}], 0x48) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000180)={0x1, @pix={0x0, 0xe7, 0x58595556, 0x7, 0x0, 0x0, 0x8, 0xfffffffd, 0x0, 0x2000000, 0x2}}) 8.261498307s ago: executing program 3 (id=1755): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) setitimer(0x1, &(0x7f0000000340)={{}, {0x0, 0x2710}}, 0x0) r3 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31) sendmmsg$inet6(r3, &(0x7f0000002940), 0x40000000000017d, 0x888) 7.167216934s ago: executing program 3 (id=1760): syz_mount_image$ext4(&(0x7f0000000540)='ext4\x00', &(0x7f0000000280)='./file0\x00', 0x22000406, &(0x7f0000001a80)={[{@data_ordered}, {@noblock_validity}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x9}}, {@journal_async_commit}, {@nolazytime}, {@data_writeback, 0x2e}, {@journal_async_commit}, {@resuid}, {@commit={'commit', 0x3d, 0x9}}, {@commit={'commit', 0x3d, 0x800}}], [], 0x2c}, 0x84, 0x4f6, &(0x7f00000022c0)="$eJzs3M1vFOUfAPDvTOkbFFr4kZ/yolTR2Ii2tKBy8KBGEy4aEz3gsZZKkAKG1kQIkWIMHo1/AXo0MfHkRS+aqFEvarzq3ZgQwwXUxNTM7kx32+5ut1torfv5JNt9nplnXr7PzDP77DzbCaBtDWZ/koi+iPg5IvrL2YUFBstvN69fnPjj+sWJJObmXvg9KZW7cf3iRFG0WG5LnhlKI9K3k9hTY7vT5y+cGp+amjyX50dmTr82Mn3+wsMnT4+fmDwxeWbsyJHDh0Yfe3TskabiuLTM/CyuG7vfPLt319GX3nt2Yi5e/vajbH/78vnVcZQNNLXdRgZjMOZylaldpb/3r3rt/y5boze683SyafHcy2u/QzSlIyKyw9VZav/90RGVg9cfz7w1n/lynXYQuG2yz6btS6Z25O/p/OcX8F+UaOPQpopP/Oz7b/Fay/7Herv2ZPZ3shT/zfz1/XPlukmz77IDEV299Zf/f41pPZXkXP8y2++rdLauRs37EA0kTZcEAJj3edb/eahW/y9d0LfZlo+hDETEgYjYERH/i4idkc6XuSMi7lzh9gcX5Zf2f35s0Ptavaz/93g+tlW8ynOKuJL53NZS/J3JKyenJg/mdTIUnd1ZfrTBNr54+qd3683L4j82++fV4pVtP3uvlEh/29S9cJnj4zPjqwh5gWuXI4lNteJP5kcCshrYFRG7W1h/VmcnH/xwb5betmXp/OXjb2DJONPKzX0Q8UD5+M/GovgLSXlL9cYnR3piavLgSHFWLPXdD1eer853VqUXxN/TXEw9rQZbw7XLEZtrnv95/EUzKMZrp/P8V31Nb+PKL+/U/U6z9PgncWy2ukR+/vdWqi07/7uSF0vprnzaG+MzM+dGIz7LJyyYPlZZW5EvymfxD+1fGH/5e3GaXeP+fj9fbk9EZCfxXRFxd0Tsy/f9noi4NyL2N4j/m6fue7VxDbV4/t8CWfzHGx3/iIGkery+hUTHqa8/rbf95q5/h0upoXxK9fWvq856m93B1dYfAAAAbARpaQw6SYcjYtFtxtgZm9Ops9MzBwbj9TPHy7+VH4jOtLjT1V91P3Q0vzdc5McW5Q9FxPbSL416S/nhibNTW9cpZqBsS1X7L18L0nR4uDzv14713jvgtlvROFr1j84+/uTW7wywpm7BODqwQWn/0L60f2hf2j+0r1rt/1LEzXXYFWCNtfr5v/gHA8DGo/8Pban0ZFbtH9qX9g9taem/xOePW8muCa3/y//UjqOreWLA7U/M9be+eNSfNbvyFXY0V7h4+kXTa26ucBJRhJM2iKtGItLKlL/yp0mWpnSWy3Q1v6trn0iXLfPEcrXRuaJnYvTUqI19eaI7Ippdz6U1q9XiCpF4yiQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCh/RMAAP//3Wzjzw==") r0 = bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$XFS_IOC_DIOINFO(r0, 0x800c581e, &(0x7f00000000c0)) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) prctl$PR_SET_MM_EXE_FILE(0x2a, 0xd, 0xffffffffffffffff) openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x121302, 0x0) syz_open_dev$MSR(0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000140), 0x1, 0x481, &(0x7f0000000600)="$eJzs3M2PU1UbAPDntjPDy9c7o+IHiIKikWicYQZUlmA0caGJiS5wOXYGghTGMKMRQrS6wKUhcW9cmvAXuNKNUVcmbnVvSIhhA7q65rb3Dm2nrczQWsf+fknpOT23Pefh3NOec8+0AYys/dk/ScSOiPglIiYb2dYD9jfubt24VPnjxqVKEmn6xu9J/bibNy5VikOL520vMrXWx5stX7h4Zr5aXTyf52dWzr47s3zh4rOnz86fWjy1eG7u6NEjh2dfeH7uub7EmbXp5p4Pl/bufuWtK69VTlx5+4erSRF/Sxzv96W+ppduVi4ST/arln+JnU3pZGyIDWFdshMy667x+vifjHLc7rzJePmToTYOGKg0TdMt3YtrKfAflsSwWwAMR/45n0TUKtkauHk9PwquH28sgLK4b+W3RslYlPJjxtvWt/2UrbZO1P78IrtF2/UUAIBB+OZ4476Y+92ef5RaruIfy/eGpiLinoi4NyLui4hdEXF/RDwQEQ9GxENNz+m079OufZNk7fyndG1Dgd2h6xN5Ys38r5j9xVQ5z+2sxz+enDxdXTwUEf+PiIMxviXLz/ao49uXfv6sW9n+pvlfdsvqL+aCeTuujbVdoFuYX5nfaLztrn8csWessbfXGn+yuhOQ9ePuiNizb2N1nH76q73dyv4+/h76sM+UfhnxVGNvsxZt8Uc+909670/O/C+qi4dmirNirR9/uvx6U7Yy2ZS5q/j7IOv/bdG5/3NTSfN+7fL667j866dd1zR3eP5PND8nO/8nkjfr6aLgg/mVlfOzERPJq/njx/LHW+urHzd3+/gs/oMHOsVfqr/HFf8TD0dEdhI/EhGPRsS+vO2PRcTjEXGgR/zfv/jEOxuPf7Cy+BfW1f9dE8Xe9pqi8pnvvq6XFJ011SP+JDr0/5F66mD+SKf3v8nWUyR6tvT83ZzNAAAAsPmUImJHJKXp1XSpND3d+Hv5XbGtVF1aXnnm5NJ75xYa3xGYivFScaVrcvV6aNRm82X91XJEVj6X54vrpYfz68afl7fW89OVperCsIOHEbe9y/jP/FYeduuAgfN9LRhdGx3/aZp+1OemAP8wn/8wuox/GF0dxv/WtnyP3wgANrNOn/8W9jAazP9hdBn/MLqMfxhdxj+MpPyb8GN38gX/gSWy95/h1b7+RJoOqfaJ4ce+mojS0GqPYce+vkSS/5ZGOvC6il+W6ccL1l/ILgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDp/RUAAP//S+LZpQ==") r4 = timerfd_create(0x0, 0x0) read(r4, 0x0, 0x0) timerfd_settime(r4, 0x3, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0) add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000080)={0x0, 0x97}, 0x0, &(0x7f00000008c0)="eb2bcb44032c2a3a518de900279744e05b2853d82c107d0fd00990b531004a27f0395fdb7d3b545b60ff5be75bcb1d85878c1cbdb120730ded7b4d10b0612763631dd3db62ddf7f7999797e2aa4cded6713302261b487e569f8fac402918be4ee374a4257d4bf67e86ff4beee88b1e3e5bac3ad4dea44fc08db9f741b76996bf785368bc3b2081640008000000000000cd90d32ebcf5ea", 0x0) 6.188337768s ago: executing program 0 (id=1766): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000006000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000080)="36450f6fe3c74424020600000088442406000000000f01142466b87a000f00d066b876000f00d0400f9ce4660f38823d00300000410f01dfb9800000c00f3235000400000f3045f7b300000000430f21e3420f00d5", 0x56}], 0x1, 0x0, 0x0, 0xb7) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40280, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text64={0x40, 0x0}], 0x1, 0x6b, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 6.13244517s ago: executing program 1 (id=1767): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newqdisc={0x68, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x4}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x3c, 0x2, [@TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x9}, @TCA_FQ_FLOW_REFILL_DELAY={0x8, 0x9, 0x9}, @TCA_FQ_BUCKETS_LOG={0x8, 0x8, 0x14}, @TCA_FQ_INITIAL_QUANTUM={0x8, 0x4, 0x2}, @TCA_FQ_TIMER_SLACK={0x8, 0xd, 0x8}, @TCA_FQ_LOW_RATE_THRESHOLD={0x8, 0xb, 0x1f6}, @TCA_FQ_FLOW_DEFAULT_RATE={0x8, 0x6, 0x2}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x4000000}, 0x4c840) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f00000000c0)={0x0, 0x0, 0x0, 'queue1\x00', 0x9}) socket(0x29, 0x5, 0x4) openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=ANY=[@ANYBLOB="240000001b1401002abdd444d446df250800010000000000090002"], 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x40810) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r4, 0x0, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = dup(r5) write$UHID_INPUT(r6, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, 0x0) 5.873025116s ago: executing program 1 (id=1771): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x240, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000240)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x4}, @TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0xfe}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40080c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r3, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000088a8ffff86ddee1611d4b8bf4a31accb", 0x26}], 0x1}, 0x80) 5.658698671s ago: executing program 0 (id=1773): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001a00)=ANY=[@ANYBLOB="18000000030000000000000026d0000095002b000000000093adff012255f674412d02000000880b5f04596a5e99fce658be2f200c699223886d8be4b50000005ab527ee3697f98125f30e6326996a3cfee33025a30b45bdcf2c69d105e5e55a1d273683623f1a5dc6e3c7e20eb7a98ecf3bd2cf898e924abe26ac296f660e69ba982fd76e00dcff7f0000ca6b78ad833488cfe4109eaf009eddcf21f5c63cde2f00150200000001000000520a0000151d010000000100bf00000000cc587424363da52001a3cdf2000000db74596fd72c002a60c1bc7dc8c38b7d2e13c50424b9dd1145d03ff45f70685c6bd9ff41c69b7de406e89dcbb7677e65a88a8407a9e7f9c0e91028b0856eb1ed9474480737a55ebb0bd701f7fb21135c6172eba7eb8a341f07e5a2d1e88b3cfc22df01e4bac9d97328fa2a82b5e8741e02056d93a433f50479387467824262852c7939db5672d07cdbe8e14abf56497e5d56dbe37551b870b2851c3f0a1a9ebfcba105a6ccdd01b0f04edb256c0200000073f6db43661bd7f0e2536ffbfe5ca31b4083145531458b7d1e341c6b351ebc5223f54d6bec93f4ef088e5d1be2515226988d664709ff03f1aa3dc7f1580ace9bf2afd28d0700000000000000d6eb372713255012e028cb2654d493a0b43bf21375709f348f5eda2967199cc936859a538100070000000000dc10e13ef227f627a40000ad1fa253d33fa74f172d3407ae4e1e347c0c6ef9dd2b6bb700000000000000000c586272c3f4d79bc36315745cb149f3cb385e6add14652003c7cdd3324f07d134d3a6c718bbd1aafe1140cff0be4c6f8df084c5e9734ae30aa9af030025f01ab03a9b1074407136bc506031f0916a39d3057d55183612b39e73ae8e6dc30356886a831836469e2051d937eb85f3f2d5ae2c1dca476b97419a3b76ed62409d004d7fbe362145d19605d760df4c5124ca325d374b371867a79b35c6617fc3327191fbf514573f0e30d1d60be2168fffc2f3dccd599a2cb77f124e22f87673675805494db821f39b50d938d5fd8c6b2a3a324c257bc9110971b749ccd74089ed6b86f81ca3ba47d8f71d290ed1b1a11f7a67125170c88c3b6a50692cc0064fc6bbd312536ac15016c85c6332226401b110da9c786eeca22debc99335587b54c13c3107008fa069af8223b38ced735c2d906551004d8dc10d88738488da01ffa4add56474573c964a270000f2f16625c0c10200000000c7a5ca60fdad159f2e44171f39638410020000004825d081f2d987f05c534187738655d7dc958f2046fa0c1619a6554b82d9c162eb61ca74f1ffdaccf0ea5f06e0fca8b27ff3983ab74fd3d560700a1fab44e77e312b3b129e000302d613916c9bcf9f0000fac73a5b6bfb27f88dba816020be760f7b45e001efada8000000000000fdaf4660402f7b3b79a433e08074ea2462974a00040000eb01352638f56dae0249d15ba8767259658878b7492cfbacde9b57cf4de00788adce638190f3570e0b4c80ef682df22201270955afb6008846557ee3bc09fda6dbb6550d597300eb82a184c96ffde5a30e5433e866665b98ca2002c804c22ff2634b7bfbf5c0d586cda5b45fd00dede1e88a4d41dee7cc76d7a23d06acb1d2d4c58faea84158bb440df2a694f4cdcaa4f65c22efffffffffffdd00000000d503d79986958115ae07b70f991430b7fb475d77b869ee02000000000000000000001ffff0ef89b2a68d2b05c995445d8a7700bcdfbec74fb2dd163e863315e84498dfb52bb93f6c9084659ce777ddac563c8596c2b1d8180289a61faa95a82bf1cfb7f2fd7252e9322abe282c33445d443a67467893b9bf0d1c8130ae6b226900000635376413c29f7c6f7b7e29b9a0c64e68328661f0c06e21f7d7dc22174ea4447a6f60edef3a4168d40200fbc71104512efe8e5d7d934aa289b4bd2b870000000000000000000007000000002000000000009b777883a02f0593dfc4cb4114b9f9cf4ad155110cc6ace2b322ac31bfa27847c799c8009a1ea5b98e525e6383ad7fd9795170e7b11e247603c2ff49a11459c7f606d729d3979676bffb3049166bb84a0f061991bd57c2566c10c282352aba05b6164ef876915a3f2491e4793e590dcc71de10da96366c1e992c0068c940dd4422c9882d3aa0f8a797b8fea6efcfb5276b7679f15559edaa977504cc0b2f777acb907ebf5fc14add71d0bca37405ded69b77ab4a3d7487fd04000000de17e1e13b93669b79556abb722d9c085b189b5fd1f30e8dc813f608830b110001732135e8e7262f290000923bfb6b41ff3792cee2fc37eee739c3e36a4bc80112968ec0d8902eced1fe552018014a463abbbf7ccd6a92a5734e3ebfca9b6e88e031f31de2183652e77c164c646a1cfd3710aa4205d8d4d4f974133ccb1e49feb42664eccd809c0ba8917eda87489e8946d5c8156197bcb66fd5606c63e3389ee9e8552381646365066ef9a36a449c96485c22ad1aa423b7b89efbc6cd54000bb0ea5f4f1e8773144fb6ac9a44d43593d77e66aa7ed7f3d4e7b211590c738888d02b2dbb0b2ba73ec72e1d8d7360a128499dd19e1e7b9b0671f4f58515b45ecb9964f3c4ddb8234391d514f8d996d8d6dd7f8fadfee2d7a0035638ce27c2936cb04b30a0eb0cde0000000000000040000000ec3c12ecee8fc3a40000000000000000e215b00ce2570b930723cbadb4033d1b8aaa2cfb3fb89e4a6e89737fd6232218a9e0c099d1eb59d60b3cca089785642f327139bc4394fb6d547a9b3c22599e780c1da7433fb47615d372e3fffe9703e37d5c87d513165278650738efcc04d27b766cf7f60066edd292f6c8a2174f391ed164bb1816819ceb3e378e776d422bc946cd9501accebeac3a5b31d8abc68ae537cd44a04e6bc21c35a7beab2610c51e593676bf635a20f597f4631b91454d182f826071f5210bd6d93173589929b23801e63c2266fde13b5a04b8d48be057c752bc415a756ea9b4d34156c4f73dd5e5924ef101a5fcdaf37c7ba2c4a9de9b000000000000000000000000000000a73b862e4b63c245616b522345587d0ee65a6902bdd0abd941e8aba37510b222ae544f395edd1b92ad53fc68f08ea00edc5e10d768836169dd296d56b306e8b75778c37571792a6c3d8b02ef378ebd59422cdd008bef6f80a80a68641ea5ed4f1126bb676098c10bf663eb3fb8c839364d28fd046dc64b35f9c3397ce6f4ad357b0000000000090000000088c7a8e2638f650a6f04a6f33a090f59414d6ebcbc687e66d600000000bd0a58ea6d36fc2cf9b9a71c137a2a22adb1006f371d4faf47285fd66fe0389afb96854bb360edcdf11b4ff6dd578bba93e949d240cde9b5836cb46032484dc19c93db7b6e5afa10547c78e76a3111557346e52566df196fd630561bb908fff4d2e19562aabd43742a26a43799f8636fa04ceb40c9e4ca1cfbbc7b949cd245a3ee118fd0d4f639444539af8766028d4ac4d4c548e290199e0dacbb4f6796b39bf32934d941ba2f88e3ebd0cf8e24f99eca86e4ca9b2cd2b54044a7fc4631572a6378a32df288785f146275c1f548e2a0c1016744e05f9de5044373d7650125027547eefe7b2d8c8871bb65395fae99d8456883705bfdfb00001854b2e5efa8aaf25827d659f592b1575281ec125de7fb91cd81d91dcb19f5cdf1e1e2b4a8a1389753a09110538689e38e07fb2dc72bd4fd11d7bc16aac5d85c6101bb722895248e463a5fb45ce0e564e90cb19d5993b471687ae4165e29cf2f58082115f5f8569896eedfd798733223e6d6584997510c374912ab798bd4af4654c01bb2c411bc36468ddd62b4eba5cfc8953526e0e5b1359797956152d0098ce47c62c3fe5a23219389622b7f65bf03527d25c3941b9cf1ffeedf6d99082bb57ea871c12213cc40900f83033bc18c529171fae324c315bc6ce358831d0230412212acfd5fc8d5cb0d028cf568e8bb40e27befe2ff01f7c6674a4d86d900633ea36641e0a781ea0ea7f2d928b8b22e2f97dd13348927375baea6863bef4acf4299096ada5cdd2a0eaafaa760a79d102d1e0c0000000000000000007926653b8d79ce16a432f124786a0bc3c5b7d196822492ae1ccf91aeac16406ad6f9cd3d96d57fceba8360ae49f73351814c9c2972f11064aaf3739d9100f9c0e4d0cb17d50c82e305ba7d62cf1cc6da26e34982a8c74dd8122cf5b5e7c34fd2712a0cef05e4d8ec7dd363219676bd9b19943185b132eb35a695e208dfa5cecdb1d6425c8879063c0f11bd64291a4209ee6dc1d9e9010013f6148c603e6a335e298efd6ab5cccc47a2c568c6afec54f8251bd840752addf200371361c9eedf05ed98585cf6d99e9e56055064bda2d373369761238c278147cd0eb7799f6b9c9fcaa3fd282154994f5b25420c86db9b6401e885de1c615a719a1c83e8fbbb181282dbaf3313a4e4a4877e9f37607e2cd6da0cf6371ec06a75f5a4206b2418ad8897ae149085d63f01f22eca44033234b3930b4d5da756669a1d59d69e7de54abf439988ed7ec33c2d0a901bb0985a24878984d8a4340fa9a356d100926fb5f2ef9976366a61b8cc2bcb1c072b0e9c564852388e1edff10d75b3832792e471cc15b40380f94d834243080158603fbc9134d6983c540525447478984611c0d9666941bfc0a30db47a8828b6e5c51aee2094599b4ce52795750e1764f1657ca8c5633c71287239dddf5c651496f7bbd148c937f083d2e4e0197dbc6ff0649c749707b17399b1d7efad23abb8b40b38704737e15662ae4913a4a001cd3b71c7af75b5ffad9780650c800a40ca80ddc41987919142fd28dbf22db5f4c435415a03455e1d55d1783ccef97d7e4655cf839d06f06e137bbe462a03b3100231914b19739dd57b4f12d026ad0c7fd3"], &(0x7f00002bf000)='GPL\x00', 0x4, 0x436, &(0x7f0000000040)=""/183, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffc95}, 0x48) ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000001c00)=r2) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r3, &(0x7f0000000280)="05660f2c285430f6314a20779e86", 0xe, 0x200c085, &(0x7f00000001c0)={0x11, 0x3, r4, 0x1, 0xfc, 0x6, @multicast}, 0x14) 5.343934559s ago: executing program 1 (id=1776): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)='\x00!E\x00', 0x4}], 0x1, 0x0, 0x0) 4.89760165s ago: executing program 1 (id=1778): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000400)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010800040000fbdbdf250b00000008000300", @ANYRES32=r2, @ANYBLOB="040007000800370002000000c33355a7"], 0x28}}, 0x40014) 4.740760174s ago: executing program 1 (id=1780): read(0xffffffffffffffff, &(0x7f0000000100)=""/194, 0xc2) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_BLANKSCREEN(r4, 0x560e, &(0x7f0000000000)) fsopen(&(0x7f0000000040)='sysfs\x00', 0x0) ioctl$KDSKBENT(r4, 0x4b47, 0x0) ioctl$TIOCSWINSZ(r4, 0x5414, &(0x7f0000000040)={0x9, 0x2, 0x1000, 0x6}) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) readv(r5, &(0x7f0000000040)=[{0x0}], 0x1) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000000)={'team_slave_0\x00', {0x2, 0x4e26, @rand_addr=0xfffffc13}}) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x5, 0x5, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0x24}, [@call={0x85, 0x0, 0x0, 0xe}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0xf, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x6, 0x0, 0x0) 3.397858197s ago: executing program 1 (id=1782): syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000009000008250200000000000000010902"], 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE(0xffffffffffffffff, 0x50009401, &(0x7f0000000180)={{}, "afe1658d587e93ab4b5fca380cdddd71e95c81000bac90d9689507b96ace5d2f9f55fddb8b36c7cac9209681a5fa01cd3874b06f2fcadd0d6c3b2543560ad96ffb3b3bb528250d54c3849e85a72f9805820433eaf86b855cc6bb316351ebf38753b22f619e6525c21a5050c57297595293366a0ed2ad9b308f845f1d9af97cf6384f5ec26ca2afea4eb950f209116b1d8b58fe396fcfb8ae0b8898f212b216cbb7d1bbd57a726d194a29a4e15e035b8162b139c67404e6a503db799c06078f56258de59c08f1812611aff6d4485a01f3413b9b4a11412629c2a4810db413d940af170b313dcf9a1e08e0156a7784c413ffa69bfb6b135b6093ad19c7f8bc70e5f9a0bcf07eb164c44642489845d93c25064c768ff253b3faf52378653b61ed2f3460a2221e6d9b2c04e99cd9fe74c005a330a08f558771a77771a1d1eb8b110912dbc327e07869f73b857cb841b5a47296a81d956c030dee87fda743cf9e56d08856a82ee26a390ac2569a31ca9beccda0251f28b124ee1e8ea6babc1b1e2d81fc795de9620301d65ded5865c5a9f6ce7422536d40694c2aa987542364f7f0bb75bdb0182d10b18a64045c7dadc0c82a47eab7e735fe240f27bb5da305cd08c86314a4a5fef8487c96bc1ea97409d73e1cc6ceba35f74eea39f2bf881833298b1e1a201eb9ea9c0754d41ef9a91b4deefcaeff08ee35a1f31b2d780b3934d5913626ef4a0f31c8e057e43ff14fc6fbf5e4a86b906b1ba320f3c52b629974a1324d97067935df1e4340b071130ee953bababf9dc0229e4a2f29cf1ae2713ffe85a5a9bd374c928ed416e1bd2516657bd4d3a9ac114ed279fcd89645245df7c55454fc367513ffae594d5236b320ad103f2d0956b3da7344a29fc910040027ca8b239d00ab5e79eeb83e25275fb61ceb65f6ace88cb43f106e128330ae709e19f209afd87b934dbd0faf470dfb52fdfd73bfa9a7a983b36d78469568ae69a0481cdc764c554d5ac03e607781cf3a5e209bffce2276529929d800f6d9b8a2f100108d7b883b5ce5e19da38ae5c99a8351b4e41c538fee7299a890edc630abbfe604c0b8847a7b5b4eec1dc00ed60e95b5374270ec634ff6d6ccbcd08145f9df1c2082c9447482ed42b4d0ea9a73bc9a68e36ee9e118bb5c08e1e7c2bd2627e82902d2c6f0da90bdbc52103f3992663653fd2b41a4294aa8f222812fa8b5e1864b75748f992bc2b396c03e202e8bfe9a1ccca1cb8b28c9c6faa47cc6b871140ddc45a0d02c752175a0498c3ba30e79c12d6ebbc32d5533d0216529e0f713eac725fe41bad4c9051d364bf38e3b72641510b09b2645447ea13b440d568adc9aa9ce85c967d78a14bdbd2fcfe0c7324a556ee841fc9ffd7a3c784fe41a349ced68e01c145db8847a547086c5595b9f6299bf7432e0e9c9a4a9108a24f7ad49c18a3ec771953480a0a0fdfeaded6b74f174ea2def77a0b9799f6b75a77a6314a4165e194be616eb5c98726d88da79f54fd01d39e751837a6bd0d77ca79073b3a7e62686fd8e089b0258645db505bb674174d626b1d1cfdf0f32b0d880884b73c63bc78a231a8cb45a12884907c021f87cdd7b2f1de020044666d38a866983c8ffa0cc6963a745c108e80a3b54eedac65b68c897043d914f146ba4ca18a61e144e7746d31879fa7ae7c2a43747e6060d79669bf9a8edcc229b7f1a0fe239b398692a6a65acd19c58442dfa8997430aab89aae8fb8f201bb1fd58605cf9dfe5c85a15e0928542a8fd7768f4b7750c7aeab8d9ced7c9fdea6cc38bc38209f608cc3d7c8bc9240b5b7d1661b8bfd231f30047befefd70183fb8330d184394159cd4153990c6a43ccded133adecced28499e73c4b25ee86e5d68848670736362931be74fe0aab5708ce05f4d6d7a068c590d36f99a0ba3501df60d9c01f54a7c366727287996de354c4a3a5e1ece988e5f59087c730afa107edbab31de441a88061ad799fefef86254a2f2891aa47420dd3f6267833a5345bf001d10c9f1fd121401ae846a9a5df517210cd0beb50a5139854aa1747115bca24522dae42667ef9ce893c4db108941198ed5323f582f11c4b13385f60b3038fa661f3ed276504fb51fb966ef88cbbb953c269ea2ed989ced5e8988839c55b398dbce98ce1e976c2065b2ded80f929dc6ef8afad6b61145686ce14e2d26f0694fda1e52a6c5155c0d8ea91544c76548a25376f13de7245b48e7298421d2c2433a472a8c89c3e621c5370654e1c7bba0f3d8bdf40c36cdbf02f6b5a7c4138b9e3931896fd89272b4d61a9875c00ba0d8d1bd960b9aaee3b6f127db1155680d7eefc5eaa6d4c648fca303706796bef110fbdb731d9e671f937e55ebf5d2e64f7cdcc073c905c134e8d3852689ed81c95be0c259816e7ff7b979557684aa1b6c2dd42754bda93e3e55c5ffc1122c988ca171fd57ab24ebe789e819c60ff3f9f1a9465ff4a9bdc5c2b2d9c351ffef5ab375f9024e297a26642b15108781fdf3c55d0aa9a8cb68ba93b7b13cd6d05b9b16502d7f9d72d015059e7999cc4ed880fd5ebf626ea409b9f0c4ded2974bb3daf88cc1930818dc3e09200897389211d3e780faa0acd64e37c60924a3fd0a16a7146a41b1b01e43fecf610c7d11d42baac5a60db7638077162cd58b3f734070e81ee71c5092422eaac366b41dd996723124df9005cbae4e2ec47f8a06616bd7faa5da6c0200c872c2ef929a16c823c57f2d4f798061e49102cab3af65a5cc9f8856dc5d3c0de1440c4d8df50a7ec09491d2e651ee5f5a76b8fc2d20a07def1a8951b9770f85728b42cd9dafce7c341c26a90b7d1c2e36f03f74eda3bfb2c40eec5c454c38e90f4d31e6a0f23b2ad53a429f73761713181b7839792cc494f21c5be9dd7f167a6681720ccd3cfcdd4b427058b995505a82993805a1860d5ea75e61c216ec9594adfd39cab47511578d57e312f2f3e0d2da8f2d8dbe3fc1fd281bdd8e7dbd203e4ec3e7d3b468ad2b81a76c5bac460f497e3cdb6bf0c6be5ceae4bd488b9597b13a37885b95426d8ea06760516ec13aa339084407d1f45e331e5dd77ac73306f70996728a0d67b48a833e9a3ddf22968e898b59e4b4c9a16aa9ea8120202737746e1a5ec2cca9640d69df2b27900de7abe573b7c023a88d7f3fcc3469a3a4e7f9f9095a6fed55fbb1d3582807407e62b55a38d33e70a0203513f30d37a4e6f03acd9d0fd2f3438eb485aa5e693806c002efd0811ab92518c41856039d7f36cf9981981231b3cea3493f0e8988bd05d3d424a5bfc8d1cdfd0e09e3ce12cab6edfb7f6d80c1edbb4d1d51a1500b0876e13e5173bfeba378c71046e70b590cf542094d01f458a3cec642fb1ce13a992765eca608579e85f03e7d871dbdbd882ce4821a944179e48a920d346ae21b08ee043cbbf3284c3a67d9b9417a5fed1202ca537f7711650f692df044f145587467dfdd45405d7caeb064bfa12b52057e90d2b5d2885bbaf032db769654af272dd78bb8ec8446344d0c1ca57d51fe1243e0a02ada90371e75418223f171f014f9a970964828cdd9faf3b66789cefd0374437f2a271c2765d9876943fb93205cb12448d4cccf68c28259e85a540e013ac77414a147fb1e0f0fc4a4d859a928eaef6e952a103a944052534c9264c85f4200cc8b465f66725c779f49312a308dda8fe7e423ebbee16e64ad6e112b3efd95584160f08c83595fdddfa39c4b89867fcf23085a24c53a6d846863b95f5605beb9b0a1cc6d191524da81ce89c0f7767652d887661b5299e300f2e83a6c962cf9089d82b139f4bedcc14bbf6611258d52e1f3d5a5e3ac05cfa4d066550b2180c31695a52da12c1412e55cdbe6660d86fe4c8eda51f2adf34b81af8ec55b549c3bbcc588c5f074e0dc76bb9bbd0cdea26dd47d84d9321f970912d374a081c9ebb74700a0792dbbb2da41ae7e3aa5230bdd260bd208b68100dc2f7bf2132d7cb34084e999b6ee2b91356ce766523a80359147af20fa15febc42b89d43e4a48d13cb8ed6678f346aa981954e0520ea8cd0a0c16281e57f33a5e3fd97d55d24386832c17f22b1c1fb91d5b1f362f3bc8aa8369c18444fc10e9d1285f6a3bcf24e2606b69fbd89f337f7ee3c27b1a2c7e8dec2c38c84c6712de1e7f1d790d86d8e0a402c40d406d39c13879f4d103adcbca13570eadcd424f8e06155885b054e1d7f994723fd22a6d704a89e6b126271ec5c19ea7b814c36f9ca9a0223da630324ca0f2a3010f4e53426d8d514bcc3303e6fa429c00244b918c01a444f74dd376bccb5709ed103514484a67240c4b992c722601e27dee6ba8b37608ba66e2065f8298a6df8c0a491113bf10e0bf18867dda3e1170fa1853b355fdf41898de4a339927872e8d9fb8a4d1c31833ac1355695a20c75ff6dafb70244a3754cb58feee89045e3408da902a7987e6a66dad0f044951a560954ee812abe142e9a4db701bdc46fabb0b98b4be01dadd629cffc661a3816744bcacdc38777494289ba156b272ade8f4ed3e32ce48958863b09bb09fb6999281164c0c5b50a77350d5f3c78d951fa76d1db68587e58bd40f824a68fd59c4ebd4f7e22e8e1458911012472b876ab15ca8c48ef664b1da41bd1ad9a5b799a1de8b2962c477f1726cbbe4f285a5c387842ac723b3877f5826503b68602c4bdaea94544b4b056142876d995d0db128a38f5c4547f12cf9d1cbc678cd42eebf67519484ab251855dbda09dd04ddc031860a69fd592fa1c12d59adc4699c246a666f6f6c20c1a21562f05f8db43ff424cea0d16789a6a69dc8552f4865bb3fac5b650b549432a0383c8f95c79084ca4841903f0c04319135f2bfc94ec8837374f0c1eccaacf8a0722d54b1a0e748a79e6c7ecdcdbfe376d080d9747a9a5a13cc7eb4111345216d1c787f05c992df3712d2a194ac325bb568abc6a97011bc62110ee12ba209d76f690ddb4e4b417f5b5db52ee7ad97159dfcf82b1c2a4eb5a97396fa24e52ba1c47330f7caca91b2965bac75dbcb86ac85a07b774dbf82be5fc92a8621e80973418d94a0bc10905a3815e04d1a668ea8cb5ffb293893b06bd372c75b477118b78dd69a04097ca8ff8f8fb21a5293d2fe6785e33d15d61008c4ca84121a8e48fabba3656250fba7e058ffc1705c7fa13509fc7c96fc9b16d0b21a26b11ebfc3325a2ca682bc014ec54dc8433af105ada5566f491d3ebe5e1e5f0859b28a576fb7978f2a1b4897890c1c9b0c1f4f8c7351ca738a6100c4f64092d865bc65a8b92007b117e5a4dd7988d3281aa2ccebb36f9af5032eeca2c8a72888c84346d3945507a6bb956b84f03d88a90bb9ecc466c7d94a3670783e11b312ecb4f9eb8489df8d129110b6bd710138476c8be75327e9ea6a0b94b8567b31692fee2d9c17d7e20d3d23cc4d317710537f608793e87d9158cd61a43306898da40d01b544fc951ccd13f11b4b8fbf47d694df601fd6677d796818571ee3125089316e3d33c5684affe9f29f12186bb5dc4c5eaee94e41d07a03c9c59db95bc42c23da55c497caa6a64c73ea3059a8c80955a9730666a0e02c3bf87cfb79542d84a529d7bf9c3ac60b323952fa439c2e5fd512c3bfe3770178b4e8d7efa223bd76830a6b8b604e15773d63d9fec504ea6561793723ff4f6fbdd016372e1a98a9252e8d1607512e5397c78498f68d3792ef7a28f74f4b15358afa5674d4340863a2897af87499bd073a06aef8215f76c9418f5b82b79b77f0a01dfc059b510794cda70b7daf2c74950652e"}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000171c000104293d7000ffdbdf250700000093691180d6941919c4d7e78fde4d5352716f4966", @ANYRES32, @ANYBLOB="800006070a000200aaaaaaaaaa2a00"], 0x28}, 0x1, 0x0, 0x0, 0x2000c880}, 0x9840) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) 3.372344367s ago: executing program 4 (id=1783): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'xfrm0\x00', 0x0}) r2 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r2, &(0x7f0000000180)='`', 0x500, 0x0, &(0x7f0000000240)={0x2f, 0x0, r1, 0x1, 0x0, 0x6, @local}, 0x14) 3.26028285s ago: executing program 0 (id=1784): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$netlink(0x10, 0x3, 0xb) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, 0x0) sendmsg$BATADV_CMD_SET_MESH(r5, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20804}, 0x44800) memfd_create(&(0x7f00000001c0)='^\x00', 0x2) getsockopt$sock_buf(r5, 0x1, 0x1a, &(0x7f0000000000)=""/132, &(0x7f00000000c0)=0x84) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r6, 0x29, 0x41, &(0x7f0000000380)={'nat\x00', 0x2, [{}, {}]}, 0x48) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000001900)={0x2, {0xc, 0x116, 0x5, 0x8, 0x200}}) truncate(&(0x7f0000000100)='./file1\x00', 0xffffffffffff0001) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000480)=@bpf_tracing={0x1a, 0x3, &(0x7f0000000180)=@raw=[@alu={0x4, 0x1, 0x9, 0x8, 0x4, 0xfffffffffffffffe, 0x10}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7}], &(0x7f0000000240)='GPL\x00', 0x6, 0x20, &(0x7f0000000280)=""/32, 0x41100, 0x0, '\x00', 0x0, 0x18, 0xffffffffffffffff, 0x8, &(0x7f0000000300)={0x7, 0x2}, 0x8, 0x10, &(0x7f0000000340)={0x5, 0xa, 0x2, 0x200}, 0x10, 0x302e1, 0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000400)=[{0x2, 0x4, 0x5}, {0x3, 0x4, 0xc, 0x1}, {0x5, 0x2, 0x3}, {0x4, 0x5, 0x10, 0x4}, {0x1, 0x4, 0x7, 0x1}, {0x4, 0x4, 0xd, 0x1}]}, 0x94) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000680)={&(0x7f0000000580)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x4c, 0x4c, 0xa, [@func={0x4, 0x0, 0x0, 0xc, 0x5}, @var={0xa, 0x0, 0x0, 0xe, 0x1, 0x2}, @typedef={0x7, 0x0, 0x0, 0x8, 0x1}, @restrict={0x5, 0x0, 0x0, 0xb, 0x4}, @struct={0x3, 0x1, 0x0, 0x4, 0x1, 0x8f, [{0xd, 0x4, 0x401}]}]}, {0x0, [0x0, 0x0, 0x61, 0x61, 0x5f, 0x30, 0x61, 0x5f]}}, &(0x7f0000000640)=""/24, 0x6e, 0x18}, 0x28) 3.25988454s ago: executing program 2 (id=1785): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000004c0)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x50}}, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) setxattr$trusted_overlay_opaque(0x0, &(0x7f0000000100), &(0x7f0000000180), 0x2, 0x1) write(r2, &(0x7f0000000200)='1', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x3, 'sh\x00', 0x1, 0x4, 0x6d}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r4, 0x0, 0x485, 0x0, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) setsockopt$inet6_buf(r3, 0x29, 0x2b, &(0x7f0000000040)="a9f5e1970472f434892ad948d98e1680c8a9025644ace352580b46d759c836d929670973d4d2696ff3dfbebf7ae30846cd7f9a0da6de8686020e1448cc6c584c2d150ab13f456b712095709df6ef49c4350aecea9363179d", 0x58) unshare(0x42000000) 3.068169915s ago: executing program 4 (id=1786): bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='dummy_hcd.0', 0xb) 2.488279569s ago: executing program 4 (id=1787): mmap(&(0x7f000091d000/0x12000)=nil, 0x12000, 0xf, 0x30, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x8081, 0x0) write(r1, &(0x7f0000000200)='md0\n\x00', 0x4) close(r0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x8, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) r7 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r7, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x8, 0x4003, 0x400, 0x0, {0xa, 0x1000, 0xb9c, @local}}}, 0x32) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001280), r8) sendmsg$L2TP_CMD_TUNNEL_GET(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="14000000", @ANYRES16=r9, @ANYBLOB="2503000000000000000008"], 0x14}}, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a00000000040000020000000200000000000000010000000000000000000000000000000000000000000000000000000201000000000100") ioctl(r2, 0x40140921, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006000000") ioctl(r2, 0x400c0930, 0x0) ioctl(r2, 0x40140921, &(0x7f0000000440)="020000000100000002000000ffffff") r10 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r10, &(0x7f0000000600)='3\n\x00', 0x2) syz_emit_vhci(&(0x7f0000000180)=ANY=[@ANYBLOB], 0xd) close(r10) 1.702606899s ago: executing program 0 (id=1788): syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x48) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, 0x0, 0x55fdb4595c3d8036) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) prlimit64(r0, 0x0, &(0x7f0000000040)={0x4, 0x8000000000000001}, &(0x7f0000000100)) 1.671878739s ago: executing program 2 (id=1789): r0 = syz_open_procfs(0x0, 0x0) newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x2000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000002a80), 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = getpid() sched_setscheduler(r2, 0x2, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f00000001c0)={r2, 0x0, 0xd}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r3, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, 0x0, 0x0) bind$inet(r4, 0x0, 0x0) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r5, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @broadcast}, 0x2, 0x9800, 0xfffffffd}}, 0x2e) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r6, &(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x3}}, 0x26) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) ioctl$PPPIOCATTCHAN(r7, 0x40047438, &(0x7f0000000500)=0x2) ioctl$PPPIOCBRIDGECHAN(r7, 0x40047435, &(0x7f0000000200)=0x1) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x10, 0x0, 0x7fff7ffc}]}) close_range(r8, 0xffffffffffffffff, 0x0) 1.380318296s ago: executing program 2 (id=1790): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000700)={{0x14}, [@NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x4009}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELCHAIN={0x14, 0x5, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0x1}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x5c}, 0x1, 0x0, 0x0, 0x10}, 0x8084) 1.23657799s ago: executing program 2 (id=1791): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_SETRSUBD(r0, 0x6410) 875.815339ms ago: executing program 2 (id=1792): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='vegas', 0x5) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004000}, 0x0) write$binfmt_script(r0, &(0x7f0000000200), 0xfffffd9d) 663.035674ms ago: executing program 4 (id=1793): r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) ioctl$KVM_TPR_ACCESS_REPORTING(0xffffffffffffffff, 0xc028ae92, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000023c0)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c0002800500010000000000240002801400018008000100ac1e000908000200ac1efe010c000280050001000000000008000740ff"], 0x64}}, 0x0) syz_genetlink_get_family_id$fou(&(0x7f00000000c0), r0) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x200c1) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="3800000002011d04000000000000000002000000240001801400018008000100e000000108000200e00000010c000280050001"], 0x38}}, 0x0) syz_open_dev$media(0x0, 0x4, 0x101080) 491.951568ms ago: executing program 2 (id=1794): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x14, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}}, 0x14}, 0x1, 0x0, 0x0, 0x40810}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 196.278396ms ago: executing program 0 (id=1795): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000380)=@delqdisc={0x434, 0x25, 0x100, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0xa, 0x7}, {0x0, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x3, 0xfffffff8, 0x4, 0x40, 0x2, 0x2, 0x5, 0x7fff, 0x4, 0x1, 0x6, 0x1c8, 0x7, 0x0, 0x5, 0x1, 0x8, 0x9, 0x9, 0x9, 0xf9, 0x200, 0x1, 0x5, 0x6, 0xfff, 0x9, 0x1, 0x80, 0x10000, 0x0, 0x6, 0xff, 0x4, 0x6, 0x9, 0xe6c1, 0x2, 0x65, 0x6, 0x5, 0x71, 0x1f146d7e, 0x80000001, 0x89, 0xe9, 0x80000001, 0x2, 0xff, 0x8, 0xffff8dc2, 0x400, 0x0, 0x2, 0xffff, 0x10001, 0x0, 0x2, 0x8, 0xa000000, 0x0, 0x5, 0x8, 0x3, 0x4, 0x401, 0x5, 0x8, 0x4ad1, 0x1, 0x25b1, 0x5, 0xfff, 0x0, 0xe, 0xffffffff, 0x3, 0x5, 0x3ff, 0xfff, 0x8, 0xf, 0x0, 0x4, 0x626cfd3b, 0x0, 0x60df8662, 0x2, 0x5, 0x4, 0xc6, 0x8, 0x7, 0xfffffffa, 0xc, 0x4, 0xffffffff, 0xa80, 0x0, 0x7, 0x2, 0x0, 0xff, 0x8, 0x7, 0xc, 0xfdc1, 0x77f, 0x4, 0xfffffff0, 0x4, 0x7fff, 0x1000, 0x1, 0x1f1f, 0x3, 0x665195e5, 0x5, 0x7, 0x5, 0x6, 0x7, 0x4, 0x800, 0x101, 0x400, 0x2, 0x6, 0xd, 0x9, 0x7, 0xc5, 0x99, 0x4, 0x2e9, 0x4, 0x3, 0x401, 0xfffffffe, 0x7, 0x80000000, 0x8, 0x0, 0x4, 0x37, 0x4, 0x31, 0x2, 0x2, 0x3, 0x6, 0x1, 0x690c, 0x368d, 0x9, 0x2, 0xe, 0x8, 0x7, 0x5597, 0x3, 0x7, 0x7fff, 0x62, 0xf6, 0x5, 0x0, 0x7fffffff, 0xd, 0x9, 0x2, 0x100, 0x6, 0x101, 0x5, 0x2, 0x3, 0x4, 0xfc8d, 0x8, 0x3ff, 0x3, 0x0, 0x3, 0x5, 0x9, 0x5, 0x8000, 0x1, 0x7, 0x20000, 0x4, 0x2, 0x9f85, 0x65, 0x4, 0x0, 0x7ff, 0x4, 0x6, 0x7, 0xd92, 0x40, 0xfff, 0xe1, 0x8, 0x426, 0x5, 0x9, 0x1, 0x1000, 0x9, 0x36ae765f, 0x401, 0x9, 0x200000, 0x3, 0x4, 0x5, 0x0, 0x89, 0x5, 0x80000000, 0x9c4, 0x1, 0x41632842, 0x6, 0x10, 0x2, 0x8001, 0x5, 0x100, 0x8, 0x9, 0xfe64, 0xd, 0x1c2, 0x2, 0x6, 0x2, 0x80000001, 0xa, 0x6, 0xfffffffc, 0x5, 0x3, 0x7f, 0x400000, 0x5, 0x3, 0x6, 0x8001, 0x10001, 0x5, 0x4, 0x7]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x40000}, 0x8010) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 58.929699ms ago: executing program 4 (id=1796): 0s ago: executing program 4 (id=1797): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x2, 0x0) close(0x3) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f00000010c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f00000001c0)) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000080)='./cgroup\x00', 0x0, 0x2000010, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x20004000) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x11) accept$unix(0xffffffffffffffff, &(0x7f0000000200)=@abs, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/functions/uvc.0/streaming/color_matching/my_color2\x00', 0x1ff) kernel console output (not intermixed with test programs): [ 234.957290][ T7467] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: comm syz.3.1041: inode #1: comm syz.3.1041: iget: illegal inode # [ 234.987255][ T4271] EXT4-fs (loop0): unmounting filesystem. [ 235.032120][ T7467] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.1041: error while reading EA inode 1 err=-117 [ 235.152366][ T7467] EXT4-fs (loop3): 1 orphan inode deleted [ 235.178764][ T7477] loop0: detected capacity change from 0 to 1024 [ 235.211572][ T7477] EXT4-fs: Ignoring removed nomblk_io_submit option [ 235.238745][ T7467] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 235.291921][ T7477] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 235.318701][ T7467] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.1041: invalid indirect mapped block 234881024 (level 0) [ 235.840601][ T4279] EXT4-fs (loop3): unmounting filesystem. [ 236.048753][ T4271] EXT4-fs (loop0): unmounting filesystem. [ 236.944855][ T7509] loop1: detected capacity change from 0 to 128 [ 237.268208][ T7509] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 237.538217][ T7515] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1053'. [ 237.810777][ T7518] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1054'. [ 237.858619][ T7509] ext4 filesystem being mounted at /200/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 238.947544][ T4272] EXT4-fs (loop1): unmounting filesystem. [ 239.574295][ T7559] device syzkaller0 entered promiscuous mode [ 239.698408][ T7561] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1067'. [ 240.004682][ T7567] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1068'. [ 242.447783][ T7600] device syzkaller0 entered promiscuous mode [ 243.906928][ T7608] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1079'. [ 245.700361][ T7650] loop3: detected capacity change from 0 to 512 [ 245.746570][ T7650] ext4: Bad value for 'data' [ 246.031120][ T7652] loop3: detected capacity change from 0 to 512 [ 246.094820][ T7652] EXT4-fs error (device loop3): mb_free_blocks:1839: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 246.111116][ T7652] EXT4-fs error (device loop3): ext4_do_update_inode:5279: inode #11: comm syz.3.1096: corrupted inode contents [ 246.125404][ T7652] EXT4-fs error (device loop3): ext4_dirty_inode:6156: inode #11: comm syz.3.1096: mark_inode_dirty error [ 246.144851][ T7652] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.1096: invalid indirect mapped block 1 (level 1) [ 246.158637][ T7652] EXT4-fs error (device loop3): ext4_do_update_inode:5279: inode #11: comm syz.3.1096: corrupted inode contents [ 246.176557][ T7652] EXT4-fs error (device loop3) in ext4_orphan_del:303: Corrupt filesystem [ 246.185868][ T7652] EXT4-fs error (device loop3): ext4_do_update_inode:5279: inode #11: comm syz.3.1096: corrupted inode contents [ 246.230055][ T7652] EXT4-fs error (device loop3): ext4_truncate:4325: inode #11: comm syz.3.1096: mark_inode_dirty error [ 246.252814][ T7652] EXT4-fs error (device loop3) in ext4_process_orphan:345: Corrupt filesystem [ 246.283705][ T7652] EXT4-fs (loop3): 1 truncate cleaned up [ 246.289516][ T7652] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 246.483445][ T7660] device syzkaller0 entered promiscuous mode [ 246.765442][ T4279] EXT4-fs (loop3): unmounting filesystem. [ 248.458972][ T7709] device syzkaller0 entered promiscuous mode [ 249.418957][ T7734] netlink: 244 bytes leftover after parsing attributes in process `syz.1.1124'. [ 250.306127][ T7753] device syzkaller0 entered promiscuous mode [ 250.580449][ T7760] loop4: detected capacity change from 0 to 1024 [ 250.670201][ T7762] netlink: 244 bytes leftover after parsing attributes in process `syz.2.1136'. [ 250.705365][ T7760] EXT4-fs: Ignoring removed nomblk_io_submit option [ 250.763997][ T7760] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 251.189342][ T7771] loop2: detected capacity change from 0 to 128 [ 251.246613][ T7771] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 251.338651][ T7771] ext4 filesystem being mounted at /219/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 251.679498][ T4282] EXT4-fs (loop4): unmounting filesystem. [ 251.920713][ T4273] EXT4-fs (loop2): unmounting filesystem. [ 252.699194][ T7794] netlink: 244 bytes leftover after parsing attributes in process `syz.2.1147'. [ 252.955908][ T7798] device syzkaller0 entered promiscuous mode [ 253.141297][ T7803] loop4: detected capacity change from 0 to 128 [ 253.223701][ T7803] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 253.243254][ T7803] ext4 filesystem being mounted at /248/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 254.088978][ T4282] EXT4-fs (loop4): unmounting filesystem. [ 254.447269][ T7828] netlink: 120 bytes leftover after parsing attributes in process `syz.1.1161'. [ 254.762427][ T7832] ptrace attach of "ci2-linux-6-1-kasan/syz-executor exec"[4279] was attempted by "ci2-linux-6-1-kasan/syz-executor exec"[7832] [ 255.292028][ T7838] device syzkaller0 entered promiscuous mode [ 255.658605][ T7854] loop4: detected capacity change from 0 to 2048 [ 255.723006][ T7854] EXT4-fs: Ignoring removed i_version option [ 255.742234][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.947782][ T7854] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 255.977358][ T7854] ext4 filesystem being mounted at /251/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 261.448218][ T7903] loop0: detected capacity change from 0 to 1024 [ 261.473518][ T7903] EXT4-fs: Ignoring removed nomblk_io_submit option [ 261.516587][ T7903] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 262.028681][ T4271] EXT4-fs (loop0): unmounting filesystem. [ 262.320909][ T7844] device syzkaller0 entered promiscuous mode [ 262.332296][ T7864] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 262.352009][ T7864] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 262.393624][ T4282] EXT4-fs (loop4): unmounting filesystem. [ 264.351901][ T7947] loop1: detected capacity change from 0 to 2048 [ 264.359686][ T7947] EXT4-fs: Ignoring removed i_version option [ 264.370410][ T7945] device syzkaller0 entered promiscuous mode [ 264.463705][ T7947] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 264.484633][ T7947] ext4 filesystem being mounted at /218/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 264.925404][ T7960] netlink: 160 bytes leftover after parsing attributes in process `syz.4.1202'. [ 266.734237][ T7983] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1209'. [ 271.535775][ T7955] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 271.545432][ T7955] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 271.601142][ T4272] EXT4-fs (loop1): unmounting filesystem. [ 271.724218][ T8014] device syzkaller0 entered promiscuous mode [ 271.820082][ T8041] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1222'. [ 274.405682][ T8075] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1234'. [ 278.743785][ T8129] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1253'. [ 278.956120][ T8134] loop0: detected capacity change from 0 to 512 [ 279.068585][ T8134] EXT4-fs error (device loop0): ext4_xattr_inode_iget:401: comm syz.0.1255: inode #1: comm syz.0.1255: iget: illegal inode # [ 279.084044][ T8137] device syzkaller0 entered promiscuous mode [ 279.165571][ T8134] EXT4-fs error (device loop0): ext4_xattr_inode_iget:406: comm syz.0.1255: error while reading EA inode 1 err=-117 [ 279.191793][ T8134] EXT4-fs error (device loop0): ext4_xattr_inode_iget:401: comm syz.0.1255: inode #1: comm syz.0.1255: iget: illegal inode # [ 279.221277][ T8134] EXT4-fs error (device loop0): ext4_xattr_inode_iget:406: comm syz.0.1255: error while reading EA inode 1 err=-117 [ 279.285714][ T8134] EXT4-fs (loop0): 1 orphan inode deleted [ 279.302066][ T8134] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 279.354685][ T8134] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.1255: invalid indirect mapped block 234881024 (level 0) [ 279.621962][ T4271] EXT4-fs (loop0): unmounting filesystem. [ 279.930271][ T8168] loop3: detected capacity change from 0 to 2048 [ 279.989963][ T8168] EXT4-fs: Ignoring removed i_version option [ 280.152380][ T8168] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 280.192031][ T8168] ext4 filesystem being mounted at /244/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 282.557514][ T8156] device syzkaller0 entered promiscuous mode [ 282.568024][ T8183] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 282.587951][ T8183] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 282.856640][ T4279] EXT4-fs (loop3): unmounting filesystem. [ 282.858637][ T8205] loop2: detected capacity change from 0 to 512 [ 282.901300][ T8205] EXT4-fs error (device loop2): ext4_xattr_inode_iget:401: comm syz.2.1272: inode #1: comm syz.2.1272: iget: illegal inode # [ 282.922317][ T8205] EXT4-fs error (device loop2): ext4_xattr_inode_iget:406: comm syz.2.1272: error while reading EA inode 1 err=-117 [ 282.935732][ T8205] EXT4-fs error (device loop2): ext4_xattr_inode_iget:401: comm syz.2.1272: inode #1: comm syz.2.1272: iget: illegal inode # [ 282.951400][ T8205] EXT4-fs error (device loop2): ext4_xattr_inode_iget:406: comm syz.2.1272: error while reading EA inode 1 err=-117 [ 282.970898][ T8205] EXT4-fs (loop2): 1 orphan inode deleted [ 282.977860][ T8205] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 282.994705][ T8205] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.1272: invalid indirect mapped block 234881024 (level 0) [ 283.190227][ T4273] EXT4-fs (loop2): unmounting filesystem. [ 285.293260][ T8231] device syzkaller0 entered promiscuous mode [ 285.310045][ T8245] loop4: detected capacity change from 0 to 2048 [ 285.325230][ T8245] EXT4-fs: Ignoring removed i_version option [ 285.482776][ T8245] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 285.508584][ T8245] ext4 filesystem being mounted at /269/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 288.992172][ T8271] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 289.000734][ T8271] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 289.273415][ T4282] EXT4-fs (loop4): unmounting filesystem. [ 289.709086][ T8320] device syzkaller0 entered promiscuous mode [ 289.888618][ T8324] loop2: detected capacity change from 0 to 512 [ 289.919319][ T8324] ext4: Bad value for 'data' [ 290.119669][ T8327] loop1: detected capacity change from 0 to 2048 [ 290.127148][ T8327] EXT4-fs: Ignoring removed i_version option [ 290.199492][ T8327] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 290.247869][ T8327] ext4 filesystem being mounted at /240/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 290.278548][ T8334] loop2: detected capacity change from 0 to 512 [ 290.318377][ T8334] EXT4-fs error (device loop2): mb_free_blocks:1839: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 290.333355][ T8334] EXT4-fs error (device loop2): ext4_do_update_inode:5279: inode #11: comm syz.2.1307: corrupted inode contents [ 290.441923][ T8334] EXT4-fs error (device loop2): ext4_dirty_inode:6156: inode #11: comm syz.2.1307: mark_inode_dirty error [ 290.558073][ T8334] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.1307: invalid indirect mapped block 1 (level 1) [ 290.588096][ T8334] EXT4-fs error (device loop2): ext4_do_update_inode:5279: inode #11: comm syz.2.1307: corrupted inode contents [ 290.603256][ T8334] EXT4-fs error (device loop2) in ext4_orphan_del:303: Corrupt filesystem [ 290.619219][ T8334] EXT4-fs error (device loop2): ext4_do_update_inode:5279: inode #11: comm syz.2.1307: corrupted inode contents [ 290.636244][ T8340] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 290.646297][ T8340] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 290.691474][ T8334] EXT4-fs error (device loop2): ext4_truncate:4325: inode #11: comm syz.2.1307: mark_inode_dirty error [ 290.706126][ T8334] EXT4-fs error (device loop2) in ext4_process_orphan:345: Corrupt filesystem [ 290.723093][ T8334] EXT4-fs (loop2): 1 truncate cleaned up [ 290.728851][ T8334] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 290.985749][ T4272] EXT4-fs (loop1): unmounting filesystem. [ 291.004399][ T8344] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1312'. [ 291.413952][ T8356] device syzkaller0 entered promiscuous mode [ 292.138162][ T4273] EXT4-fs (loop2): unmounting filesystem. [ 292.229520][ T8372] loop0: detected capacity change from 0 to 2048 [ 292.254144][ T8372] EXT4-fs: Ignoring removed i_version option [ 292.317045][ T8372] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 292.339477][ T8372] ext4 filesystem being mounted at /281/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 292.651562][ T8379] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 293.062329][ T8379] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 293.232731][ T4271] EXT4-fs (loop0): unmounting filesystem. [ 293.309465][ T8387] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1326'. [ 293.692811][ T8396] device syzkaller0 entered promiscuous mode [ 294.479134][ T8411] loop3: detected capacity change from 0 to 2048 [ 294.523854][ T8411] EXT4-fs: Ignoring removed i_version option [ 294.610365][ T8415] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1339'. [ 294.634080][ T8411] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 294.679992][ T8411] ext4 filesystem being mounted at /261/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 295.813979][ T8427] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 295.959833][ T8427] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 296.488987][ T4279] EXT4-fs (loop3): unmounting filesystem. [ 296.509210][ T8435] device syzkaller0 entered promiscuous mode [ 298.081946][ T8453] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1352'. [ 305.811273][ T8589] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1396'. [ 307.099883][ T8601] loop3: detected capacity change from 0 to 128 [ 308.012802][ T8601] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 308.262865][ T8601] ext4 filesystem being mounted at /276/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 309.064526][ T8626] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1409'. [ 309.124128][ T4279] EXT4-fs (loop3): unmounting filesystem. [ 309.973160][ T8641] device syzkaller0 entered promiscuous mode [ 311.443771][ T8656] loop2: detected capacity change from 0 to 128 [ 311.674473][ T8665] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1423'. [ 311.675294][ T8656] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 311.858797][ T8656] ext4 filesystem being mounted at /280/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 312.784914][ T4273] EXT4-fs (loop2): unmounting filesystem. [ 315.321258][ T8707] loop3: detected capacity change from 0 to 128 [ 315.422614][ T8707] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 315.444131][ T8707] ext4 filesystem being mounted at /283/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 316.053063][ T8713] loop2: detected capacity change from 0 to 2048 [ 316.060277][ T8713] EXT4-fs: Ignoring removed i_version option [ 316.314226][ T8713] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 316.472174][ T8713] ext4 filesystem being mounted at /283/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 316.965302][ T4279] EXT4-fs (loop3): unmounting filesystem. [ 317.123477][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 319.402246][ T8754] loop0: detected capacity change from 0 to 128 [ 319.782996][ T4273] EXT4-fs (loop2): unmounting filesystem. [ 320.026133][ T8759] loop1: detected capacity change from 0 to 128 [ 320.297503][ T8759] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 320.390072][ T8759] ext4 filesystem being mounted at /270/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 321.097066][ T8774] loop4: detected capacity change from 0 to 512 [ 321.244932][ T8774] ext4: Bad value for 'data' [ 321.387677][ T4265] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 321.465405][ T4272] EXT4-fs (loop1): unmounting filesystem. [ 322.501699][ T8754] EXT4-fs: failed to create workqueue [ 322.507153][ T8754] EXT4-fs (loop0): mount failed [ 323.374578][ T8564] syz.0.1385 (8564) used greatest stack depth: 19344 bytes left [ 324.019392][ T8788] loop4: detected capacity change from 0 to 512 [ 324.540467][ T8788] EXT4-fs error (device loop4): mb_free_blocks:1839: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 324.571820][ T8788] EXT4-fs error (device loop4): ext4_do_update_inode:5279: inode #11: comm syz.4.1462: corrupted inode contents [ 324.717049][ T8788] EXT4-fs error (device loop4): ext4_dirty_inode:6156: inode #11: comm syz.4.1462: mark_inode_dirty error [ 324.787394][ T8788] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #11: comm syz.4.1462: invalid indirect mapped block 1 (level 1) [ 325.017541][ T8788] EXT4-fs error (device loop4): ext4_do_update_inode:5279: inode #11: comm syz.4.1462: corrupted inode contents [ 325.146363][ T8788] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 325.190086][ T8788] EXT4-fs error (device loop4): ext4_do_update_inode:5279: inode #11: comm syz.4.1462: corrupted inode contents [ 325.311670][ T8788] EXT4-fs error (device loop4): ext4_truncate:4325: inode #11: comm syz.4.1462: mark_inode_dirty error [ 325.360009][ T8788] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 325.383270][ T8788] EXT4-fs (loop4): 1 truncate cleaned up [ 325.389110][ T8788] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 325.866182][ T8798] loop1: detected capacity change from 0 to 2048 [ 326.061377][ T8798] EXT4-fs: Ignoring removed i_version option [ 326.170884][ T8798] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 326.311877][ T8798] ext4 filesystem being mounted at /273/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 327.120760][ T8496] syz.4.1364 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 327.411779][ T8496] CPU: 1 PID: 8496 Comm: syz.4.1364 Not tainted syzkaller #0 [ 327.419237][ T8496] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 327.429333][ T8496] Call Trace: [ 327.432651][ T8496] [ 327.435642][ T8496] dump_stack_lvl+0x188/0x24e [ 327.440346][ T8496] ? ___ratelimit+0x14e/0x610 [ 327.445051][ T8496] ? show_regs_print_info+0x12/0x12 [ 327.450272][ T8496] ? load_image+0x410/0x410 [ 327.454789][ T8496] ? ___ratelimit+0x474/0x610 [ 327.459486][ T8496] ? radix_tree_cpu_dead+0x160/0x160 [ 327.464883][ T8496] dump_header+0xd8/0x820 [ 327.469336][ T8496] oom_kill_process+0x361/0x550 [ 327.474293][ T8496] out_of_memory+0xe25/0x1220 [ 327.479004][ T8496] ? mutex_lock_nested+0x10/0x10 [ 327.483992][ T8496] ? unregister_oom_notifier+0x20/0x20 [ 327.489517][ T8496] mem_cgroup_out_of_memory+0x2c0/0x390 [ 327.495121][ T8496] ? mem_cgroup_oom_trylock+0x210/0x210 [ 327.500711][ T8496] ? do_raw_spin_unlock+0x11d/0x230 [ 327.504960][ T8813] loop0: detected capacity change from 0 to 128 [ 327.506027][ T8496] try_charge_memcg+0xc9d/0x17c0 [ 327.517251][ T8496] ? percpu_ref_put+0x180/0x180 [ 327.522153][ T8496] ? mark_lock+0x94/0x320 [ 327.526549][ T8496] ? get_mem_cgroup_from_mm+0x34/0x290 [ 327.532040][ T8496] charge_memcg+0x117/0x3b0 [ 327.536666][ T8496] ? __mem_cgroup_charge+0x80/0x80 [ 327.541818][ T8496] ? get_mem_cgroup_from_mm+0x34/0x290 [ 327.547294][ T8496] ? get_mem_cgroup_from_mm+0x34/0x290 [ 327.552761][ T8496] ? get_mem_cgroup_from_mm+0x1ae/0x290 [ 327.558317][ T8496] __mem_cgroup_charge+0x21/0x80 [ 327.563266][ T8496] shmem_add_to_page_cache+0x8d7/0x1c90 [ 327.568850][ T8496] ? __filemap_get_folio+0x10f/0xde0 [ 327.574176][ T8496] ? __filemap_get_folio+0x10f/0xde0 [ 327.579474][ T8496] ? put_page+0x270/0x270 [ 327.583824][ T8496] shmem_get_folio_gfp+0x1663/0x35e0 [ 327.589145][ T8496] ? __lock_acquire+0x7c40/0x7c40 [ 327.594204][ T8496] shmem_fault+0x1b6/0x790 [ 327.598647][ T8496] ? shmem_fallocate+0xfc0/0xfc0 [ 327.603613][ T8496] ? filemap_map_pages+0x1ae/0x11e0 [ 327.608834][ T8496] ? filemap_read_folio+0x7a0/0x7a0 [ 327.614043][ T8496] ? count_memcg_event_mm+0x8a/0x3c0 [ 327.619341][ T8496] __do_fault+0x13b/0x4e0 [ 327.623820][ T8496] ? handle_mm_fault+0x2600/0x3d40 [ 327.628949][ T8496] handle_mm_fault+0x2610/0x3d40 [ 327.633901][ T8496] ? numa_migrate_prep+0x250/0x250 [ 327.639030][ T8496] __get_user_pages+0x40d/0xec0 [ 327.643895][ T8496] ? populate_vma_page_range+0x2b0/0x2b0 [ 327.649558][ T8496] ? up_write+0x1b6/0x410 [ 327.653909][ T8496] ? __generic_file_write_iter+0x148/0x2a0 [ 327.659749][ T8496] ? get_dump_page+0xee/0x670 [ 327.664484][ T8496] ? down_read_killable+0x1cc/0x340 [ 327.669700][ T8496] get_dump_page+0x18c/0x670 [ 327.674311][ T8496] ? fault_in_readable+0x1f0/0x1f0 [ 327.679445][ T8496] ? kasan_check_range+0x80/0x290 [ 327.684484][ T8496] ? iov_iter_bvec+0x4a/0x1f0 [ 327.689172][ T8496] dump_user_range+0x123/0x840 [ 327.693961][ T8496] ? dump_skip+0x40/0x40 [ 327.698230][ T8496] ? dump_emit+0x74/0xe0 [ 327.702512][ T8496] ? dump_emit+0xa2/0xe0 [ 327.706776][ T8496] ? elf_core_dump+0x2aa9/0x3630 [ 327.711724][ T8496] elf_core_dump+0x30ca/0x3630 [ 327.716550][ T8496] ? load_elf_binary+0x2820/0x2820 [ 327.721677][ T8496] ? dump_vma_snapshot+0xaea/0xe40 [ 327.726829][ T8496] ? verify_lock_unused+0x140/0x140 [ 327.732048][ T8496] ? __lock_acquire+0x7c40/0x7c40 [ 327.737089][ T8496] ? mas_next_entry+0xe03/0xe90 [ 327.741974][ T8496] ? rcu_read_lock_any_held+0xb0/0x130 [ 327.747616][ T8496] ? 0xffffffffff600000 [ 327.751783][ T8496] ? getname_kernel+0x142/0x2f0 [ 327.756658][ T8496] do_coredump+0x16c1/0x2480 [ 327.761275][ T8496] ? nfs_stat_to_errno+0x170/0x170 [ 327.766420][ T8496] ? lock_chain_count+0x20/0x20 [ 327.771337][ T8496] ? _raw_spin_unlock_irq+0x1f/0x40 [ 327.776582][ T8496] ? lockdep_hardirqs_on+0x94/0x140 [ 327.781789][ T8496] get_signal+0x1093/0x1340 [ 327.786317][ T8496] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 327.792315][ T8496] arch_do_signal_or_restart+0xc4/0x1310 [ 327.797977][ T8496] ? __send_signal_locked+0xb38/0xde0 [ 327.803389][ T8496] ? get_sigframe_size+0x10/0x10 [ 327.808426][ T8496] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 327.814424][ T8496] ? exit_to_user_mode_loop+0x3b/0x110 [ 327.819897][ T8496] exit_to_user_mode_loop+0x70/0x110 [ 327.825282][ T8496] exit_to_user_mode_prepare+0xee/0x180 [ 327.830976][ T8496] irqentry_exit_to_user_mode+0x5/0x30 [ 327.836457][ T8496] exc_page_fault+0x88/0x100 [ 327.841055][ T8496] asm_exc_page_fault+0x22/0x30 [ 327.845917][ T8496] RIP: 0033:0x7fe9bd053bd7 [ 327.850344][ T8496] Code: e8 fe f9 ff ff 89 f2 48 8d 3d 5d 4f 1b 00 48 8d 35 c3 0a 1e 00 31 c0 e8 37 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 327.869958][ T8496] RSP: 002b:00007fe9be04e120 EFLAGS: 00010202 [ 327.876030][ T8496] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007fe9bd19e0d9 [ 327.884005][ T8496] RDX: 00007fe9be04e140 RSI: 00007fe9be04e270 RDI: 000000000000000b [ 327.891978][ T8496] RBP: 00007fe9bd235024 R08: 0000000000000000 R09: 0000000000000000 [ 327.899953][ T8496] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 327.907925][ T8496] R13: 00007fe9bd426038 R14: 00007fe9bd425fa0 R15: 00007fff50e4a9a8 [ 327.915913][ T8496] [ 328.166697][ T8813] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 328.331687][ T8496] memory: usage 307188kB, limit 307200kB, failcnt 4139 [ 328.339679][ T8496] memory+swap: usage 322272kB, limit 9007199254740988kB, failcnt 0 [ 328.383384][ T4272] EXT4-fs (loop1): unmounting filesystem. [ 328.401404][ T8813] ext4 filesystem being mounted at /311/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 328.461739][ T8496] kmem: usage 2368kB, limit 9007199254740988kB, failcnt 0 [ 328.469007][ T8496] Memory cgroup stats for /syz4: [ 328.469671][ T8496] anon 1093632 [ 328.469671][ T8496] file 311042048 [ 328.469671][ T8496] kernel 2424832 [ 328.469671][ T8496] kernel_stack 131072 [ 328.469671][ T8496] pagetables 782336 [ 328.469671][ T8496] sec_pagetables 0 [ 328.469671][ T8496] percpu 22144 [ 328.469671][ T8496] sock 0 [ 328.469671][ T8496] vmalloc 0 [ 328.469671][ T8496] shmem 311009280 [ 328.469671][ T8496] zswap 0 [ 328.469671][ T8496] zswapped 0 [ 328.469671][ T8496] file_mapped 157237248 [ 328.469671][ T8496] file_dirty 32768 [ 328.469671][ T8496] file_writeback 0 [ 328.469671][ T8496] swapcached 15446016 [ 328.469671][ T8496] anon_thp 0 [ 328.469671][ T8496] file_thp 0 [ 328.469671][ T8496] shmem_thp 0 [ 328.469671][ T8496] inactive_anon 172285952 [ 328.469671][ T8496] active_anon 139816960 [ 328.469671][ T8496] inactive_file 0 [ 328.469671][ T8496] active_file 32768 [ 328.469671][ T8496] unevictable 0 [ 328.469671][ T8496] slab_reclaimable 976408 [ 328.469671][ T8496] slab_unreclaimable 423416 [ 328.959509][ T8496] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz4,mems_allowed=0-1,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.1364,pid=8496,uid=0 [ 329.022926][ T8496] Memory cgroup out of memory: Killed process 8496 (syz.4.1364) total-vm:200548kB, anon-rss:1552kB, file-rss:20608kB, shmem-rss:89888kB, UID:0 pgtables:296kB oom_score_adj:1000 [ 329.192053][ T8806] syz.3.1470 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 329.226921][ T8806] CPU: 0 PID: 8806 Comm: syz.3.1470 Not tainted syzkaller #0 [ 329.234375][ T8806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 329.244453][ T8806] Call Trace: [ 329.247755][ T8806] [ 329.250714][ T8806] dump_stack_lvl+0x188/0x24e [ 329.255425][ T8806] ? ___ratelimit+0x14e/0x610 [ 329.260137][ T8806] ? show_regs_print_info+0x12/0x12 [ 329.265375][ T8806] ? load_image+0x410/0x410 [ 329.269903][ T8806] ? ___ratelimit+0x474/0x610 [ 329.274616][ T8806] ? radix_tree_cpu_dead+0x160/0x160 [ 329.279955][ T8806] dump_header+0xd8/0x820 [ 329.284297][ T8806] oom_kill_process+0x361/0x550 [ 329.289161][ T8806] out_of_memory+0xe25/0x1220 [ 329.293840][ T8806] ? __mutex_lock+0x3ba/0xae0 [ 329.298526][ T8806] ? mutex_lock_nested+0x10/0x10 [ 329.303468][ T8806] ? unregister_oom_notifier+0x20/0x20 [ 329.308937][ T8806] mem_cgroup_out_of_memory+0x2c0/0x390 [ 329.314503][ T8806] ? mem_cgroup_oom_trylock+0x210/0x210 [ 329.320064][ T8806] ? do_raw_spin_unlock+0x11d/0x230 [ 329.325280][ T8806] try_charge_memcg+0xc9d/0x17c0 [ 329.330246][ T8806] ? percpu_ref_put+0x180/0x180 [ 329.335118][ T8806] ? get_mem_cgroup_from_mm+0x34/0x290 [ 329.340593][ T8806] charge_memcg+0x117/0x3b0 [ 329.345119][ T8806] ? __mem_cgroup_charge+0x80/0x80 [ 329.350235][ T8806] ? get_mem_cgroup_from_mm+0x34/0x290 [ 329.355699][ T8806] ? get_mem_cgroup_from_mm+0x34/0x290 [ 329.361164][ T8806] ? get_mem_cgroup_from_mm+0x1ae/0x290 [ 329.366713][ T8806] __mem_cgroup_charge+0x21/0x80 [ 329.371658][ T8806] shmem_add_to_page_cache+0x8d7/0x1c90 [ 329.377213][ T8806] ? __filemap_get_folio+0x10f/0xde0 [ 329.382507][ T8806] ? __filemap_get_folio+0x10f/0xde0 [ 329.387834][ T8806] ? put_page+0x270/0x270 [ 329.392182][ T8806] shmem_get_folio_gfp+0x1663/0x35e0 [ 329.397487][ T8806] ? __lock_acquire+0x7c40/0x7c40 [ 329.402530][ T8806] shmem_fault+0x1b6/0x790 [ 329.406960][ T8806] ? shmem_fallocate+0xfc0/0xfc0 [ 329.411902][ T8806] ? filemap_map_pages+0x1ae/0x11e0 [ 329.417110][ T8806] ? filemap_read_folio+0x7a0/0x7a0 [ 329.422313][ T8806] ? count_memcg_event_mm+0x8a/0x3c0 [ 329.427609][ T8806] __do_fault+0x13b/0x4e0 [ 329.431943][ T8806] ? handle_mm_fault+0x2600/0x3d40 [ 329.437056][ T8806] handle_mm_fault+0x2610/0x3d40 [ 329.442010][ T8806] ? numa_migrate_prep+0x250/0x250 [ 329.447136][ T8806] __get_user_pages+0x40d/0xec0 [ 329.452001][ T8806] ? populate_vma_page_range+0x2b0/0x2b0 [ 329.457649][ T8806] ? up_write+0x1b6/0x410 [ 329.462018][ T8806] ? __generic_file_write_iter+0x148/0x2a0 [ 329.467836][ T8806] ? get_dump_page+0xee/0x670 [ 329.472523][ T8806] ? down_read_killable+0x1cc/0x340 [ 329.477729][ T8806] get_dump_page+0x18c/0x670 [ 329.482335][ T8806] ? fault_in_readable+0x1f0/0x1f0 [ 329.487463][ T8806] ? iov_iter_bvec+0x4a/0x1f0 [ 329.492148][ T8806] dump_user_range+0x123/0x840 [ 329.496932][ T8806] ? dump_skip+0x40/0x40 [ 329.501178][ T8806] ? dump_emit+0x74/0xe0 [ 329.505440][ T8806] ? dump_emit+0xa2/0xe0 [ 329.509689][ T8806] ? elf_core_dump+0x2aa9/0x3630 [ 329.514630][ T8806] elf_core_dump+0x30ca/0x3630 [ 329.519412][ T8806] ? load_elf_binary+0x2820/0x2820 [ 329.524532][ T8806] ? dump_vma_snapshot+0xaea/0xe40 [ 329.529654][ T8806] ? verify_lock_unused+0x140/0x140 [ 329.534952][ T8806] ? __lock_acquire+0x7c40/0x7c40 [ 329.539982][ T8806] ? mas_next_entry+0xe03/0xe90 [ 329.544866][ T8806] ? rcu_read_lock_any_held+0xb0/0x130 [ 329.550334][ T8806] ? 0xffffffffff600000 [ 329.554491][ T8806] ? getname_kernel+0x142/0x2f0 [ 329.559353][ T8806] do_coredump+0x16c1/0x2480 [ 329.563967][ T8806] ? nfs_stat_to_errno+0x170/0x170 [ 329.569099][ T8806] ? lock_chain_count+0x20/0x20 [ 329.573981][ T8806] ? _raw_spin_unlock_irq+0x1f/0x40 [ 329.579196][ T8806] ? lockdep_hardirqs_on+0x94/0x140 [ 329.584442][ T8806] get_signal+0x1093/0x1340 [ 329.588963][ T8806] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 329.594964][ T8806] arch_do_signal_or_restart+0xc4/0x1310 [ 329.600636][ T8806] ? __send_signal_locked+0xb38/0xde0 [ 329.606027][ T8806] ? get_sigframe_size+0x10/0x10 [ 329.610979][ T8806] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 329.616976][ T8806] ? exit_to_user_mode_loop+0x3b/0x110 [ 329.622450][ T8806] exit_to_user_mode_loop+0x70/0x110 [ 329.627748][ T8806] exit_to_user_mode_prepare+0xee/0x180 [ 329.633324][ T8806] irqentry_exit_to_user_mode+0x5/0x30 [ 329.638789][ T8806] exc_page_fault+0x88/0x100 [ 329.643596][ T8806] asm_exc_page_fault+0x22/0x30 [ 329.648469][ T8806] RIP: 0033:0x7fa2fee53bd7 [ 329.652898][ T8806] Code: e8 fe f9 ff ff 89 f2 48 8d 3d 5d 4f 1b 00 48 8d 35 c3 0a 1e 00 31 c0 e8 37 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 329.672536][ T8806] RSP: 002b:00007fa2ffeb6120 EFLAGS: 00010202 [ 329.678610][ T8806] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007fa2fef9e0d9 [ 329.686605][ T8806] RDX: 00007fa2ffeb6140 RSI: 00007fa2ffeb6270 RDI: 000000000000000b [ 329.694587][ T8806] RBP: 00007fa2ff035024 R08: 0000000000000000 R09: 0000000000000000 [ 329.702575][ T8806] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 329.710548][ T8806] R13: 00007fa2ff226038 R14: 00007fa2ff225fa0 R15: 00007ffffb2c0c18 [ 329.718557][ T8806] [ 330.501833][ T8806] memory: usage 307200kB, limit 307200kB, failcnt 9674 [ 330.508752][ T8806] memory+swap: usage 368900kB, limit 9007199254740988kB, failcnt 0 [ 330.532726][ T8806] kmem: usage 2476kB, limit 9007199254740988kB, failcnt 0 [ 330.539899][ T8806] Memory cgroup stats for /syz3: [ 330.540082][ T8806] anon 1331200 [ 330.540082][ T8806] file 310706176 [ 330.540082][ T8806] kernel 2535424 [ 330.540082][ T8806] kernel_stack 196608 [ 330.540082][ T8806] pagetables 864256 [ 330.540082][ T8806] sec_pagetables 0 [ 330.540082][ T8806] percpu 0 [ 330.540082][ T8806] sock 0 [ 330.540082][ T8806] vmalloc 0 [ 330.540082][ T8806] shmem 310702080 [ 330.540082][ T8806] zswap 0 [ 330.540082][ T8806] zswapped 0 [ 330.540082][ T8806] file_mapped 186933248 [ 330.540082][ T8806] file_dirty 4096 [ 330.540082][ T8806] file_writeback 0 [ 330.540082][ T8806] swapcached 63180800 [ 330.540082][ T8806] anon_thp 0 [ 330.540082][ T8806] file_thp 0 [ 330.540082][ T8806] shmem_thp 0 [ 330.540082][ T8806] inactive_anon 201412608 [ 330.540082][ T8806] active_anon 110620672 [ 330.540082][ T8806] inactive_file 0 [ 330.540082][ T8806] active_file 4096 [ 330.540082][ T8806] unevictable 0 [ 330.540082][ T8806] slab_reclaimable 1078528 [ 330.540082][ T8806] slab_unreclaimable 296088 [ 330.747877][ T8806] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz3,mems_allowed=0-1,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.1359,pid=8476,uid=0 [ 330.776778][ T4271] EXT4-fs (loop0): unmounting filesystem. [ 330.811877][ T8806] Memory cgroup out of memory: Killed process 8476 (syz.3.1359) total-vm:200552kB, anon-rss:1540kB, file-rss:20608kB, shmem-rss:100712kB, UID:0 pgtables:300kB oom_score_adj:1000 [ 330.883070][ T8363] syz.1.1320 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 330.912150][ T8363] CPU: 1 PID: 8363 Comm: syz.1.1320 Not tainted syzkaller #0 [ 330.919593][ T8363] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 330.929665][ T8363] Call Trace: [ 330.932959][ T8363] [ 330.935902][ T8363] dump_stack_lvl+0x188/0x24e [ 330.940621][ T8363] ? ___ratelimit+0x14e/0x610 [ 330.945328][ T8363] ? show_regs_print_info+0x12/0x12 [ 330.950651][ T8363] ? load_image+0x410/0x410 [ 330.955173][ T8363] ? ___ratelimit+0x474/0x610 [ 330.959878][ T8363] ? radix_tree_cpu_dead+0x160/0x160 [ 330.965277][ T8363] dump_header+0xd8/0x820 [ 330.969671][ T8363] oom_kill_process+0x361/0x550 [ 330.974572][ T8363] out_of_memory+0xe25/0x1220 [ 330.979275][ T8363] ? __mutex_lock+0x3ba/0xae0 [ 330.983994][ T8363] ? mutex_lock_nested+0x10/0x10 [ 330.988978][ T8363] ? unregister_oom_notifier+0x20/0x20 [ 330.994477][ T8363] mem_cgroup_out_of_memory+0x2c0/0x390 [ 331.000066][ T8363] ? mem_cgroup_oom_trylock+0x210/0x210 [ 331.005645][ T8363] ? do_raw_spin_unlock+0x11d/0x230 [ 331.010856][ T8363] try_charge_memcg+0xc9d/0x17c0 [ 331.015838][ T8363] ? percpu_ref_put+0x180/0x180 [ 331.020710][ T8363] ? mark_lock+0x94/0x320 [ 331.025077][ T8363] ? get_mem_cgroup_from_mm+0x34/0x290 [ 331.030561][ T8363] charge_memcg+0x117/0x3b0 [ 331.035190][ T8363] ? __mem_cgroup_charge+0x80/0x80 [ 331.040325][ T8363] ? get_mem_cgroup_from_mm+0x34/0x290 [ 331.045808][ T8363] ? get_mem_cgroup_from_mm+0x34/0x290 [ 331.051298][ T8363] ? get_mem_cgroup_from_mm+0x1ae/0x290 [ 331.056931][ T8363] __mem_cgroup_charge+0x21/0x80 [ 331.061907][ T8363] shmem_add_to_page_cache+0x8d7/0x1c90 [ 331.067472][ T8363] ? __filemap_get_folio+0x10f/0xde0 [ 331.072785][ T8363] ? __filemap_get_folio+0x10f/0xde0 [ 331.078098][ T8363] ? put_page+0x270/0x270 [ 331.082470][ T8363] shmem_get_folio_gfp+0x1663/0x35e0 [ 331.087812][ T8363] ? __lock_acquire+0x7c40/0x7c40 [ 331.092885][ T8363] shmem_fault+0x1b6/0x790 [ 331.097342][ T8363] ? shmem_fallocate+0xfc0/0xfc0 [ 331.102316][ T8363] ? filemap_map_pages+0x1ae/0x11e0 [ 331.107554][ T8363] ? filemap_read_folio+0x7a0/0x7a0 [ 331.112779][ T8363] ? count_memcg_event_mm+0x8a/0x3c0 [ 331.118106][ T8363] __do_fault+0x13b/0x4e0 [ 331.122474][ T8363] ? handle_mm_fault+0x2600/0x3d40 [ 331.127603][ T8363] handle_mm_fault+0x2610/0x3d40 [ 331.132574][ T8363] ? numa_migrate_prep+0x250/0x250 [ 331.137815][ T8363] __get_user_pages+0x40d/0xec0 [ 331.142702][ T8363] ? populate_vma_page_range+0x2b0/0x2b0 [ 331.148361][ T8363] ? up_write+0x1b6/0x410 [ 331.152732][ T8363] ? __generic_file_write_iter+0x148/0x2a0 [ 331.158575][ T8363] ? get_dump_page+0xee/0x670 [ 331.163284][ T8363] ? down_read_killable+0x1cc/0x340 [ 331.168511][ T8363] get_dump_page+0x18c/0x670 [ 331.173144][ T8363] ? fault_in_readable+0x1f0/0x1f0 [ 331.178286][ T8363] ? dump_user_range+0x511/0x840 [ 331.183253][ T8363] ? iov_iter_bvec+0x4a/0x1f0 [ 331.187964][ T8363] dump_user_range+0x123/0x840 [ 331.192769][ T8363] ? dump_skip+0x40/0x40 [ 331.197029][ T8363] ? dump_emit+0x74/0xe0 [ 331.201312][ T8363] ? dump_emit+0xa2/0xe0 [ 331.205575][ T8363] ? elf_core_dump+0x2aa9/0x3630 [ 331.210550][ T8363] elf_core_dump+0x30ca/0x3630 [ 331.215379][ T8363] ? load_elf_binary+0x2820/0x2820 [ 331.220577][ T8363] ? dump_vma_snapshot+0xaea/0xe40 [ 331.225817][ T8363] ? verify_lock_unused+0x140/0x140 [ 331.231071][ T8363] ? __lock_acquire+0x7c40/0x7c40 [ 331.231544][ T29] oom_reaper: reaped process 8496 (syz.4.1364), now anon-rss:0kB, file-rss:20480kB, shmem-rss:28416kB [ 331.236112][ T8363] ? mas_next_entry+0xe03/0xe90 [ 331.236167][ T8363] ? rcu_read_lock_any_held+0xb0/0x130 [ 331.257417][ T8363] ? 0xffffffffff600000 [ 331.261587][ T8363] ? getname_kernel+0x142/0x2f0 [ 331.266490][ T8363] do_coredump+0x16c1/0x2480 [ 331.271146][ T8363] ? nfs_stat_to_errno+0x170/0x170 [ 331.276311][ T8363] ? lock_chain_count+0x20/0x20 [ 331.281194][ T8363] ? _raw_spin_unlock_irq+0x1f/0x40 [ 331.286433][ T8363] ? lockdep_hardirqs_on+0x94/0x140 [ 331.291665][ T8363] get_signal+0x1093/0x1340 [ 331.296214][ T8363] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 331.302263][ T8363] arch_do_signal_or_restart+0xc4/0x1310 [ 331.308030][ T8363] ? __send_signal_locked+0xb38/0xde0 [ 331.313453][ T8363] ? get_sigframe_size+0x10/0x10 [ 331.318433][ T8363] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 331.324459][ T8363] ? exit_to_user_mode_loop+0x3b/0x110 [ 331.329998][ T8363] exit_to_user_mode_loop+0x70/0x110 [ 331.335325][ T8363] exit_to_user_mode_prepare+0xee/0x180 [ 331.340903][ T8363] irqentry_exit_to_user_mode+0x5/0x30 [ 331.346391][ T8363] exc_page_fault+0x88/0x100 [ 331.351037][ T8363] asm_exc_page_fault+0x22/0x30 [ 331.355929][ T8363] RIP: 0033:0x7f3f43853bd7 [ 331.360366][ T8363] Code: e8 fe f9 ff ff 89 f2 48 8d 3d 5d 4f 1b 00 48 8d 35 c3 0a 1e 00 31 c0 e8 37 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 331.380263][ T8363] RSP: 002b:00007f3f44891120 EFLAGS: 00010202 [ 331.386363][ T8363] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007f3f4399e0d9 [ 331.394715][ T8363] RDX: 00007f3f44891140 RSI: 00007f3f44891270 RDI: 000000000000000b [ 331.402722][ T8363] RBP: 00007f3f43a35024 R08: 0000000000000000 R09: 0000000000000000 [ 331.410719][ T8363] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 331.418726][ T8363] R13: 00007f3f43c26038 R14: 00007f3f43c25fa0 R15: 00007ffc8d647e28 [ 331.426832][ T8363] [ 331.519978][ T4282] EXT4-fs (loop4): unmounting filesystem. [ 332.024840][ T8363] memory: usage 307200kB, limit 307200kB, failcnt 4056 [ 332.041721][ T8363] memory+swap: usage 323828kB, limit 9007199254740988kB, failcnt 0 [ 332.052237][ T8363] kmem: usage 2984kB, limit 9007199254740988kB, failcnt 0 [ 332.059397][ T8363] Memory cgroup stats for /syz1: [ 332.059597][ T8363] anon 671744 [ 332.059597][ T8363] file 310845440 [ 332.059597][ T8363] kernel 3055616 [ 332.059597][ T8363] kernel_stack 131072 [ 332.059597][ T8363] pagetables 581632 [ 332.059597][ T8363] sec_pagetables 0 [ 332.059597][ T8363] percpu 1184 [ 332.059597][ T8363] sock 0 [ 332.059597][ T8363] vmalloc 0 [ 332.059597][ T8363] shmem 310738944 [ 332.059597][ T8363] zswap 0 [ 332.059597][ T8363] zswapped 0 [ 332.059597][ T8363] file_mapped 151838720 [ 332.059597][ T8363] file_dirty 106496 [ 332.059597][ T8363] file_writeback 0 [ 332.059597][ T8363] swapcached 17027072 [ 332.059597][ T8363] anon_thp 0 [ 332.059597][ T8363] file_thp 0 [ 332.059597][ T8363] shmem_thp 0 [ 332.059597][ T8363] inactive_anon 14118912 [ 332.059597][ T8363] active_anon 297291776 [ 332.059597][ T8363] inactive_file 0 [ 332.059597][ T8363] active_file 106496 [ 332.059597][ T8363] unevictable 0 [ 332.059597][ T8363] slab_reclaimable 950064 [ 332.059597][ T8363] slab_unreclaimable 1317816 [ 332.211940][ T8363] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.1320,pid=8363,uid=0 [ 332.237461][ T8363] Memory cgroup out of memory: Killed process 8363 (syz.1.1320) total-vm:202600kB, anon-rss:1540kB, file-rss:20608kB, shmem-rss:118136kB, UID:0 pgtables:336kB oom_score_adj:1000 [ 332.279065][ T8631] syz.2.1410 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 332.303733][ T8631] CPU: 0 PID: 8631 Comm: syz.2.1410 Not tainted syzkaller #0 [ 332.311178][ T8631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 332.321261][ T8631] Call Trace: [ 332.324569][ T8631] [ 332.327520][ T8631] dump_stack_lvl+0x188/0x24e [ 332.332348][ T8631] ? ___ratelimit+0x14e/0x610 [ 332.337050][ T8631] ? show_regs_print_info+0x12/0x12 [ 332.342325][ T8631] ? load_image+0x410/0x410 [ 332.346857][ T8631] ? ___ratelimit+0x474/0x610 [ 332.351603][ T8631] ? radix_tree_cpu_dead+0x160/0x160 [ 332.356955][ T8631] dump_header+0xd8/0x820 [ 332.361323][ T8631] oom_kill_process+0x361/0x550 [ 332.366246][ T8631] out_of_memory+0xe25/0x1220 [ 332.370970][ T8631] ? __mutex_lock+0x3ba/0xae0 [ 332.375685][ T8631] ? mutex_lock_nested+0x10/0x10 [ 332.380653][ T8631] ? unregister_oom_notifier+0x20/0x20 [ 332.386153][ T8631] mem_cgroup_out_of_memory+0x2c0/0x390 [ 332.391827][ T8631] ? mem_cgroup_oom_trylock+0x210/0x210 [ 332.397428][ T8631] ? do_raw_spin_unlock+0x11d/0x230 [ 332.402670][ T8631] try_charge_memcg+0xc9d/0x17c0 [ 332.407664][ T8631] ? percpu_ref_put+0x180/0x180 [ 332.412543][ T8631] ? mark_lock+0x94/0x320 [ 332.416923][ T8631] ? get_mem_cgroup_from_mm+0x34/0x290 [ 332.422419][ T8631] charge_memcg+0x117/0x3b0 [ 332.426954][ T8631] ? __mem_cgroup_charge+0x80/0x80 [ 332.432119][ T8631] ? get_mem_cgroup_from_mm+0x34/0x290 [ 332.437616][ T8631] ? get_mem_cgroup_from_mm+0x34/0x290 [ 332.443115][ T8631] ? get_mem_cgroup_from_mm+0x1ae/0x290 [ 332.448700][ T8631] __mem_cgroup_charge+0x21/0x80 [ 332.453673][ T8631] shmem_add_to_page_cache+0x8d7/0x1c90 [ 332.459241][ T8631] ? __filemap_get_folio+0x10f/0xde0 [ 332.464575][ T8631] ? __filemap_get_folio+0x10f/0xde0 [ 332.469925][ T8631] ? put_page+0x270/0x270 [ 332.474322][ T8631] shmem_get_folio_gfp+0x1663/0x35e0 [ 332.479643][ T8631] ? __lock_acquire+0x7c40/0x7c40 [ 332.484716][ T8631] shmem_fault+0x1b6/0x790 [ 332.489162][ T8631] ? shmem_fallocate+0xfc0/0xfc0 [ 332.494121][ T8631] ? filemap_map_pages+0x1ae/0x11e0 [ 332.499343][ T8631] ? filemap_read_folio+0x7a0/0x7a0 [ 332.504570][ T8631] ? count_memcg_event_mm+0x8a/0x3c0 [ 332.509888][ T8631] __do_fault+0x13b/0x4e0 [ 332.514234][ T8631] ? handle_mm_fault+0x2600/0x3d40 [ 332.519365][ T8631] handle_mm_fault+0x2610/0x3d40 [ 332.524337][ T8631] ? numa_migrate_prep+0x250/0x250 [ 332.529496][ T8631] __get_user_pages+0x40d/0xec0 [ 332.534384][ T8631] ? populate_vma_page_range+0x2b0/0x2b0 [ 332.540047][ T8631] ? up_write+0x1b6/0x410 [ 332.544406][ T8631] ? __generic_file_write_iter+0x148/0x2a0 [ 332.550260][ T8631] ? get_dump_page+0xee/0x670 [ 332.554966][ T8631] ? down_read_killable+0x1cc/0x340 [ 332.560188][ T8631] get_dump_page+0x18c/0x670 [ 332.564813][ T8631] ? fault_in_readable+0x1f0/0x1f0 [ 332.569956][ T8631] ? dump_user_range+0x2a0/0x840 [ 332.574928][ T8631] ? iov_iter_bvec+0x4a/0x1f0 [ 332.579631][ T8631] dump_user_range+0x123/0x840 [ 332.584445][ T8631] ? dump_skip+0x40/0x40 [ 332.588801][ T8631] ? dump_emit+0x74/0xe0 [ 332.593082][ T8631] ? dump_emit+0xa2/0xe0 [ 332.597361][ T8631] ? elf_core_dump+0x2aa9/0x3630 [ 332.602322][ T8631] elf_core_dump+0x30ca/0x3630 [ 332.607137][ T8631] ? load_elf_binary+0x2820/0x2820 [ 332.612277][ T8631] ? dump_vma_snapshot+0xaea/0xe40 [ 332.617416][ T8631] ? verify_lock_unused+0x140/0x140 [ 332.622653][ T8631] ? __lock_acquire+0x7c40/0x7c40 [ 332.627709][ T8631] ? mas_next_entry+0xe03/0xe90 [ 332.632632][ T8631] ? rcu_read_lock_any_held+0xb0/0x130 [ 332.638116][ T8631] ? 0xffffffffff600000 [ 332.642296][ T8631] ? getname_kernel+0x142/0x2f0 [ 332.647198][ T8631] do_coredump+0x16c1/0x2480 [ 332.651861][ T8631] ? nfs_stat_to_errno+0x170/0x170 [ 332.657041][ T8631] ? lock_chain_count+0x20/0x20 [ 332.661950][ T8631] ? _raw_spin_unlock_irq+0x1f/0x40 [ 332.667180][ T8631] ? lockdep_hardirqs_on+0x94/0x140 [ 332.672405][ T8631] get_signal+0x1093/0x1340 [ 332.676950][ T8631] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 332.683031][ T8631] arch_do_signal_or_restart+0xc4/0x1310 [ 332.688706][ T8631] ? __send_signal_locked+0xb38/0xde0 [ 332.694125][ T8631] ? get_sigframe_size+0x10/0x10 [ 332.699099][ T8631] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 332.705125][ T8631] ? exit_to_user_mode_loop+0x3b/0x110 [ 332.710628][ T8631] exit_to_user_mode_loop+0x70/0x110 [ 332.715956][ T8631] exit_to_user_mode_prepare+0xee/0x180 [ 332.721564][ T8631] irqentry_exit_to_user_mode+0x5/0x30 [ 332.727060][ T8631] exc_page_fault+0x88/0x100 [ 332.731678][ T8631] asm_exc_page_fault+0x22/0x30 [ 332.736559][ T8631] RIP: 0033:0x7fcddec53bd7 [ 332.741085][ T8631] Code: e8 fe f9 ff ff 89 f2 48 8d 3d 5d 4f 1b 00 48 8d 35 c3 0a 1e 00 31 c0 e8 37 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 332.760730][ T8631] RSP: 002b:00007fcddfb74120 EFLAGS: 00010202 [ 332.766829][ T8631] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007fcdded9e0d9 [ 332.774885][ T8631] RDX: 00007fcddfb74140 RSI: 00007fcddfb74270 RDI: 000000000000000b [ 332.782884][ T8631] RBP: 00007fcddee35024 R08: 0000000000000000 R09: 0000000000000000 [ 332.790878][ T8631] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 332.798900][ T8631] R13: 00007fcddf026038 R14: 00007fcddf025fa0 R15: 00007ffca7390158 [ 332.806977][ T8631] [ 333.466624][ T8631] memory: usage 307200kB, limit 307200kB, failcnt 2042 [ 333.481692][ T8631] memory+swap: usage 307200kB, limit 9007199254740988kB, failcnt 0 [ 333.489638][ T8631] kmem: usage 2392kB, limit 9007199254740988kB, failcnt 0 [ 333.521696][ T8631] Memory cgroup stats for /syz2: [ 333.521893][ T8631] anon 4247552 [ 333.521893][ T8631] file 307875840 [ 333.521893][ T8631] kernel 2449408 [ 333.521893][ T8631] kernel_stack 262144 [ 333.521893][ T8631] pagetables 876544 [ 333.521893][ T8631] sec_pagetables 0 [ 333.521893][ T8631] percpu 0 [ 333.521893][ T8631] sock 0 [ 333.521893][ T8631] vmalloc 0 [ 333.521893][ T8631] shmem 301576192 [ 333.521893][ T8631] zswap 0 [ 333.521893][ T8631] zswapped 0 [ 333.521893][ T8631] file_mapped 157077504 [ 333.521893][ T8631] file_dirty 8192 [ 333.521893][ T8631] file_writeback 0 [ 333.521893][ T8631] swapcached 0 [ 333.521893][ T8631] anon_thp 0 [ 333.521893][ T8631] file_thp 0 [ 333.521893][ T8631] shmem_thp 0 [ 333.521893][ T8631] inactive_anon 6955008 [ 333.521893][ T8631] active_anon 298868736 [ 333.521893][ T8631] inactive_file 0 [ 333.521893][ T8631] active_file 8192 [ 333.521893][ T8631] unevictable 6291456 [ 333.521893][ T8631] slab_reclaimable 901360 [ 333.521893][ T8631] slab_unreclaimable 299912 [ 333.692805][ T8631] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz2,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.1410,pid=8633,uid=0 [ 333.728224][ T8631] Memory cgroup out of memory: Killed process 8633 (syz.2.1410) total-vm:202732kB, anon-rss:1552kB, file-rss:20608kB, shmem-rss:60320kB, UID:0 pgtables:232kB oom_score_adj:1000 [ 333.855351][ T8541] syz.0.1379 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 333.906194][ T8541] CPU: 1 PID: 8541 Comm: syz.0.1379 Not tainted syzkaller #0 [ 333.913633][ T8541] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 333.923813][ T8541] Call Trace: [ 333.927134][ T8541] [ 333.930077][ T8541] dump_stack_lvl+0x188/0x24e [ 333.934783][ T8541] ? ___ratelimit+0x14e/0x610 [ 333.939487][ T8541] ? show_regs_print_info+0x12/0x12 [ 333.944723][ T8541] ? load_image+0x410/0x410 [ 333.949266][ T8541] ? ___ratelimit+0x474/0x610 [ 333.953983][ T8541] ? radix_tree_cpu_dead+0x160/0x160 [ 333.959305][ T8541] dump_header+0xd8/0x820 [ 333.963685][ T8541] oom_kill_process+0x361/0x550 [ 333.968566][ T8541] out_of_memory+0xe25/0x1220 [ 333.973282][ T8541] ? __mutex_lock+0x3ba/0xae0 [ 333.978013][ T8541] ? mutex_lock_nested+0x10/0x10 [ 333.982980][ T8541] ? unregister_oom_notifier+0x20/0x20 [ 333.988480][ T8541] mem_cgroup_out_of_memory+0x2c0/0x390 [ 333.994063][ T8541] ? mem_cgroup_oom_trylock+0x210/0x210 [ 333.999649][ T8541] ? do_raw_spin_unlock+0x11d/0x230 [ 334.004877][ T8541] try_charge_memcg+0xc9d/0x17c0 [ 334.009881][ T8541] ? percpu_ref_put+0x180/0x180 [ 334.014787][ T8541] ? get_mem_cgroup_from_mm+0x34/0x290 [ 334.020280][ T8541] charge_memcg+0x117/0x3b0 [ 334.024811][ T8541] ? __mem_cgroup_charge+0x80/0x80 [ 334.029963][ T8541] ? get_mem_cgroup_from_mm+0x34/0x290 [ 334.035456][ T8541] ? get_mem_cgroup_from_mm+0x34/0x290 [ 334.040945][ T8541] ? get_mem_cgroup_from_mm+0x1ae/0x290 [ 334.046515][ T8541] __mem_cgroup_charge+0x21/0x80 [ 334.051477][ T8541] shmem_add_to_page_cache+0x8d7/0x1c90 [ 334.057047][ T8541] ? __filemap_get_folio+0x10f/0xde0 [ 334.062366][ T8541] ? __filemap_get_folio+0x10f/0xde0 [ 334.067681][ T8541] ? put_page+0x270/0x270 [ 334.072047][ T8541] ? mark_lock+0x94/0x320 [ 334.076412][ T8541] shmem_get_folio_gfp+0x1663/0x35e0 [ 334.081761][ T8541] shmem_write_begin+0xee/0x3f0 [ 334.086655][ T8541] generic_perform_write+0x2fa/0x5c0 [ 334.091991][ T8541] ? generic_file_direct_write+0x330/0x330 [ 334.097833][ T8541] ? __file_remove_privs+0x5f0/0x5f0 [ 334.103144][ T8541] ? rwsem_write_trylock+0x135/0x1c0 [ 334.108466][ T8541] ? clear_nonspinnable+0x60/0x60 [ 334.113515][ T8541] ? generic_write_checks_count+0x363/0x440 [ 334.119450][ T8541] __generic_file_write_iter+0x148/0x2a0 [ 334.125125][ T8541] generic_file_write_iter+0xab/0x2e0 [ 334.130537][ T8541] __kernel_write_iter+0x298/0x690 [ 334.135873][ T8541] ? vfs_read+0x960/0x960 [ 334.140241][ T8541] ? dump_user_range+0x511/0x840 [ 334.145249][ T8541] ? iov_iter_bvec+0x4a/0x1f0 [ 334.149957][ T8541] dump_user_range+0x40a/0x840 [ 334.154765][ T8541] ? dump_skip+0x40/0x40 [ 334.159032][ T8541] ? dump_emit+0x74/0xe0 [ 334.163312][ T8541] ? dump_emit+0xa2/0xe0 [ 334.167592][ T8541] ? elf_core_dump+0x2aa9/0x3630 [ 334.172566][ T8541] elf_core_dump+0x30ca/0x3630 [ 334.177371][ T8541] ? load_elf_binary+0x2820/0x2820 [ 334.182511][ T8541] ? dump_vma_snapshot+0xaea/0xe40 [ 334.187662][ T8541] ? verify_lock_unused+0x140/0x140 [ 334.190257][ T8476] syz.3.1359 (8476) used greatest stack depth: 18768 bytes left [ 334.192868][ T8541] ? __lock_acquire+0x7c40/0x7c40 [ 334.205587][ T8541] ? mas_next_entry+0xe03/0xe90 [ 334.210498][ T8541] ? rcu_read_lock_any_held+0xb0/0x130 [ 334.215986][ T8541] ? 0xffffffffff600000 [ 334.220160][ T8541] ? getname_kernel+0x142/0x2f0 [ 334.225043][ T8541] do_coredump+0x16c1/0x2480 [ 334.229855][ T8541] ? nfs_stat_to_errno+0x170/0x170 [ 334.235019][ T8541] ? lock_chain_count+0x20/0x20 [ 334.239944][ T8541] ? _raw_spin_unlock_irq+0x1f/0x40 [ 334.245172][ T8541] ? lockdep_hardirqs_on+0x94/0x140 [ 334.250403][ T8541] get_signal+0x1093/0x1340 [ 334.254958][ T8541] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 334.260983][ T8541] arch_do_signal_or_restart+0xc4/0x1310 [ 334.266665][ T8541] ? __send_signal_locked+0xb38/0xde0 [ 334.272211][ T8541] ? get_sigframe_size+0x10/0x10 [ 334.277196][ T8541] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 334.283254][ T8541] ? exit_to_user_mode_loop+0x3b/0x110 [ 334.288842][ T8541] exit_to_user_mode_loop+0x70/0x110 [ 334.294265][ T8541] exit_to_user_mode_prepare+0xee/0x180 [ 334.299841][ T8541] irqentry_exit_to_user_mode+0x5/0x30 [ 334.305339][ T8541] exc_page_fault+0x88/0x100 [ 334.309970][ T8541] asm_exc_page_fault+0x22/0x30 [ 334.314845][ T8541] RIP: 0033:0x7f0435853bd7 [ 334.319275][ T8541] Code: e8 fe f9 ff ff 89 f2 48 8d 3d 5d 4f 1b 00 48 8d 35 c3 0a 1e 00 31 c0 e8 37 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 334.339000][ T8541] RSP: 002b:00007f04368fe120 EFLAGS: 00010202 [ 334.345125][ T8541] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007f043599e0d9 [ 334.353128][ T8541] RDX: 00007f04368fe140 RSI: 00007f04368fe270 RDI: 000000000000000b [ 334.361115][ T8541] RBP: 00007f0435a35024 R08: 0000000000000000 R09: 0000000000000000 [ 334.369111][ T8541] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 334.377129][ T8541] R13: 00007f0435c26038 R14: 00007f0435c25fa0 R15: 00007ffe26bbc658 [ 334.385145][ T8541] [ 334.398487][ T8541] memory: usage 307200kB, limit 307200kB, failcnt 7569 [ 334.405517][ T8541] memory+swap: usage 338784kB, limit 9007199254740988kB, failcnt 0 [ 334.413792][ T8541] kmem: usage 2248kB, limit 9007199254740988kB, failcnt 0 [ 334.420930][ T8541] Memory cgroup stats for /syz0: [ 334.421292][ T8541] anon 712704 [ 334.421292][ T8541] file 311558144 [ 334.421292][ T8541] kernel 2301952 [ 334.421292][ T8541] kernel_stack 131072 [ 334.421292][ T8541] pagetables 618496 [ 334.421292][ T8541] sec_pagetables 0 [ 334.421292][ T8541] percpu 3552 [ 334.421292][ T8541] sock 0 [ 334.421292][ T8541] vmalloc 0 [ 334.421292][ T8541] shmem 311443456 [ 334.421292][ T8541] zswap 0 [ 334.421292][ T8541] zswapped 0 [ 334.421292][ T8541] file_mapped 172003328 [ 334.421292][ T8541] file_dirty 114688 [ 334.421292][ T8541] file_writeback 0 [ 334.421292][ T8541] swapcached 32604160 [ 334.421292][ T8541] anon_thp 0 [ 334.421292][ T8541] file_thp 0 [ 334.421292][ T8541] shmem_thp 0 [ 334.421292][ T8541] inactive_anon 240869376 [ 334.421292][ T8541] active_anon 71286784 [ 334.421292][ T8541] inactive_file 0 [ 334.421292][ T8541] active_file 114688 [ 334.421292][ T8541] unevictable 0 [ 334.421292][ T8541] slab_reclaimable 1081024 [ 334.421292][ T8541] slab_unreclaimable 391472 [ 334.561686][ T8541] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.1376,pid=8527,uid=0 [ 334.579305][ T8541] Memory cgroup out of memory: Killed process 8527 (syz.0.1376) total-vm:200552kB, anon-rss:1540kB, file-rss:20608kB, shmem-rss:97016kB, UID:0 pgtables:296kB oom_score_adj:1000 [ 335.914999][ T29] oom_reaper: reaped process 8633 (syz.2.1410), now anon-rss:0kB, file-rss:20480kB, shmem-rss:40080kB [ 336.509153][ T8856] loop3: detected capacity change from 0 to 512 [ 336.601798][ T8856] ext4: Bad value for 'data' [ 336.847559][ T4265] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 337.094447][ T8861] loop2: detected capacity change from 0 to 128 [ 337.428945][ T8861] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 337.549484][ T8861] ext4 filesystem being mounted at /294/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 338.540039][ T4273] EXT4-fs (loop2): unmounting filesystem. [ 339.012491][ T8887] loop3: detected capacity change from 0 to 512 [ 339.254838][ T8887] EXT4-fs error (device loop3): mb_free_blocks:1839: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 339.496722][ T8887] EXT4-fs error (device loop3): ext4_do_update_inode:5279: inode #11: comm syz.3.1490: corrupted inode contents [ 339.639836][ T8887] EXT4-fs error (device loop3): ext4_dirty_inode:6156: inode #11: comm syz.3.1490: mark_inode_dirty error [ 339.878677][ T8887] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.1490: invalid indirect mapped block 1 (level 1) [ 340.218801][ T8887] EXT4-fs error (device loop3): ext4_do_update_inode:5279: inode #11: comm syz.3.1490: corrupted inode contents [ 340.432093][ T8887] EXT4-fs error (device loop3) in ext4_orphan_del:303: Corrupt filesystem [ 340.570562][ T8887] EXT4-fs error (device loop3): ext4_do_update_inode:5279: inode #11: comm syz.3.1490: corrupted inode contents [ 340.723992][ T8887] EXT4-fs error (device loop3): ext4_truncate:4325: inode #11: comm syz.3.1490: mark_inode_dirty error [ 341.004077][ T8887] EXT4-fs error (device loop3) in ext4_process_orphan:345: Corrupt filesystem [ 341.164096][ T8887] EXT4-fs (loop3): 1 truncate cleaned up [ 341.169830][ T8887] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 341.828115][ T8916] loop1: detected capacity change from 0 to 128 [ 341.949427][ T8916] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 342.087795][ T8916] ext4 filesystem being mounted at /279/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 342.574125][ T4272] EXT4-fs (loop1): unmounting filesystem. [ 344.237381][ T8946] loop4: detected capacity change from 0 to 128 [ 344.334816][ T4279] EXT4-fs (loop3): unmounting filesystem. [ 346.277124][ T8972] loop1: detected capacity change from 0 to 512 [ 346.386010][ T8972] ext4: Bad value for 'data' [ 346.497324][ T8527] syz.0.1376 (8527) used greatest stack depth: 18608 bytes left [ 347.307705][ T8946] EXT4-fs: error -4 creating inode table initialization thread [ 347.372355][ T8946] EXT4-fs (loop4): mount failed [ 349.390380][ T9010] device syzkaller0 entered promiscuous mode [ 349.494488][ T9013] loop4: detected capacity change from 0 to 128 [ 349.626549][ T9013] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 349.752731][ T9013] ext4 filesystem being mounted at /319/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 350.561024][ T4282] EXT4-fs (loop4): unmounting filesystem. [ 351.261049][ T8806] syz.3.1470 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 351.428260][ T8806] CPU: 1 PID: 8806 Comm: syz.3.1470 Not tainted syzkaller #0 [ 351.435705][ T8806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 351.445775][ T8806] Call Trace: [ 351.449064][ T8806] [ 351.452006][ T8806] dump_stack_lvl+0x188/0x24e [ 351.456717][ T8806] ? ___ratelimit+0x14e/0x610 [ 351.461425][ T8806] ? show_regs_print_info+0x12/0x12 [ 351.466656][ T8806] ? load_image+0x410/0x410 [ 351.471187][ T8806] ? ___ratelimit+0x474/0x610 [ 351.475895][ T8806] ? radix_tree_cpu_dead+0x160/0x160 [ 351.481222][ T8806] dump_header+0xd8/0x820 [ 351.485592][ T8806] oom_kill_process+0x361/0x550 [ 351.490479][ T8806] out_of_memory+0xe25/0x1220 [ 351.495195][ T8806] ? print_unlock_imbalance_bug+0x160/0x160 [ 351.501125][ T8806] ? mutex_lock_nested+0x10/0x10 [ 351.506104][ T8806] ? unregister_oom_notifier+0x20/0x20 [ 351.511608][ T8806] mem_cgroup_out_of_memory+0x2c0/0x390 [ 351.517205][ T8806] ? mem_cgroup_oom_trylock+0x210/0x210 [ 351.522782][ T8806] ? do_raw_spin_unlock+0x11d/0x230 [ 351.527999][ T8806] try_charge_memcg+0xc9d/0x17c0 [ 351.532990][ T8806] ? percpu_ref_put+0x180/0x180 [ 351.537905][ T8806] ? get_mem_cgroup_from_mm+0x34/0x290 [ 351.543402][ T8806] charge_memcg+0x117/0x3b0 [ 351.548116][ T8806] ? __mem_cgroup_charge+0x80/0x80 [ 351.553254][ T8806] ? get_mem_cgroup_from_mm+0x34/0x290 [ 351.558734][ T8806] ? get_mem_cgroup_from_mm+0x34/0x290 [ 351.564221][ T8806] ? get_mem_cgroup_from_mm+0x1ae/0x290 [ 351.569791][ T8806] __mem_cgroup_charge+0x21/0x80 [ 351.574756][ T8806] shmem_add_to_page_cache+0x8d7/0x1c90 [ 351.580329][ T8806] ? __filemap_get_folio+0x10f/0xde0 [ 351.585651][ T8806] ? __filemap_get_folio+0x10f/0xde0 [ 351.590976][ T8806] ? put_page+0x270/0x270 [ 351.595345][ T8806] ? mark_lock+0x94/0x320 [ 351.599714][ T8806] shmem_get_folio_gfp+0x1663/0x35e0 [ 351.605064][ T8806] shmem_write_begin+0xee/0x3f0 [ 351.609994][ T8806] generic_perform_write+0x2fa/0x5c0 [ 351.615329][ T8806] ? generic_file_direct_write+0x330/0x330 [ 351.621167][ T8806] ? __file_remove_privs+0x5f0/0x5f0 [ 351.626563][ T8806] ? rwsem_write_trylock+0x135/0x1c0 [ 351.631893][ T8806] ? clear_nonspinnable+0x60/0x60 [ 351.636948][ T8806] ? generic_write_checks_count+0x363/0x440 [ 351.642881][ T8806] __generic_file_write_iter+0x148/0x2a0 [ 351.648559][ T8806] generic_file_write_iter+0xab/0x2e0 [ 351.653977][ T8806] __kernel_write_iter+0x298/0x690 [ 351.659135][ T8806] ? vfs_read+0x960/0x960 [ 351.663511][ T8806] ? iov_iter_bvec+0x4a/0x1f0 [ 351.668231][ T8806] dump_user_range+0x40a/0x840 [ 351.673041][ T8806] ? dump_skip+0x40/0x40 [ 351.677309][ T8806] ? dump_emit+0x74/0xe0 [ 351.681604][ T8806] ? dump_emit+0xa2/0xe0 [ 351.685882][ T8806] ? elf_core_dump+0x2aa9/0x3630 [ 351.690852][ T8806] elf_core_dump+0x30ca/0x3630 [ 351.695668][ T8806] ? load_elf_binary+0x2820/0x2820 [ 351.700812][ T8806] ? dump_vma_snapshot+0xaea/0xe40 [ 351.705954][ T8806] ? verify_lock_unused+0x140/0x140 [ 351.711181][ T8806] ? __lock_acquire+0x7c40/0x7c40 [ 351.716238][ T8806] ? mas_next_entry+0xe03/0xe90 [ 351.721156][ T8806] ? rcu_read_lock_any_held+0xb0/0x130 [ 351.726641][ T8806] ? 0xffffffffff600000 [ 351.730815][ T8806] ? getname_kernel+0x142/0x2f0 [ 351.735707][ T8806] do_coredump+0x16c1/0x2480 [ 351.740352][ T8806] ? nfs_stat_to_errno+0x170/0x170 [ 351.745521][ T8806] ? lock_chain_count+0x20/0x20 [ 351.750411][ T8806] ? _raw_spin_unlock_irq+0x1f/0x40 [ 351.755635][ T8806] ? lockdep_hardirqs_on+0x94/0x140 [ 351.760852][ T8806] get_signal+0x1093/0x1340 [ 351.765391][ T8806] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 351.771408][ T8806] arch_do_signal_or_restart+0xc4/0x1310 [ 351.777068][ T8806] ? __send_signal_locked+0xb38/0xde0 [ 351.782474][ T8806] ? get_sigframe_size+0x10/0x10 [ 351.787447][ T8806] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 351.793471][ T8806] ? exit_to_user_mode_loop+0x3b/0x110 [ 351.798967][ T8806] exit_to_user_mode_loop+0x70/0x110 [ 351.804281][ T8806] exit_to_user_mode_prepare+0xee/0x180 [ 351.809855][ T8806] irqentry_exit_to_user_mode+0x5/0x30 [ 351.815333][ T8806] exc_page_fault+0x88/0x100 [ 351.819944][ T8806] asm_exc_page_fault+0x22/0x30 [ 351.824816][ T8806] RIP: 0033:0x7fa2fee53bd7 [ 351.829247][ T8806] Code: e8 fe f9 ff ff 89 f2 48 8d 3d 5d 4f 1b 00 48 8d 35 c3 0a 1e 00 31 c0 e8 37 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 351.848877][ T8806] RSP: 002b:00007fa2ffeb6120 EFLAGS: 00010202 [ 351.854971][ T8806] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007fa2fef9e0d9 [ 351.862959][ T8806] RDX: 00007fa2ffeb6140 RSI: 00007fa2ffeb6270 RDI: 000000000000000b [ 351.870947][ T8806] RBP: 00007fa2ff035024 R08: 0000000000000000 R09: 0000000000000000 [ 351.878940][ T8806] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 351.886933][ T8806] R13: 00007fa2ff226038 R14: 00007fa2ff225fa0 R15: 00007ffffb2c0c18 [ 351.894949][ T8806] [ 353.034377][ T9056] device syzkaller0 entered promiscuous mode [ 353.097241][ T8806] memory: usage 307200kB, limit 307200kB, failcnt 17490 [ 353.114760][ T8806] memory+swap: usage 365640kB, limit 9007199254740988kB, failcnt 0 [ 353.132024][ T8806] kmem: usage 2300kB, limit 9007199254740988kB, failcnt 0 [ 353.149526][ T8806] Memory cgroup stats for /syz3: [ 353.149705][ T8806] anon 1019904 [ 353.149705][ T8806] file 311197696 [ 353.149705][ T8806] kernel 2355200 [ 353.149705][ T8806] kernel_stack 163840 [ 353.149705][ T8806] pagetables 757760 [ 353.149705][ T8806] sec_pagetables 0 [ 353.149705][ T8806] percpu 0 [ 353.149705][ T8806] sock 0 [ 353.149705][ T8806] vmalloc 0 [ 353.149705][ T8806] shmem 311193600 [ 353.149705][ T8806] zswap 0 [ 353.149705][ T8806] zswapped 0 [ 353.149705][ T8806] file_mapped 181784576 [ 353.149705][ T8806] file_dirty 4096 [ 353.149705][ T8806] file_writeback 0 [ 353.149705][ T8806] swapcached 107630592 [ 353.149705][ T8806] anon_thp 0 [ 353.149705][ T8806] file_thp 0 [ 353.149705][ T8806] shmem_thp 0 [ 353.149705][ T8806] inactive_anon 238620672 [ 353.149705][ T8806] active_anon 73592832 [ 353.149705][ T8806] inactive_file 0 [ 353.149705][ T8806] active_file 4096 [ 353.149705][ T8806] unevictable 0 [ 353.149705][ T8806] slab_reclaimable 1073760 [ 353.149705][ T8806] slab_unreclaimable 271160 [ 353.357252][ T8806] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz3,mems_allowed=0-1,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.1388,pid=8571,uid=0 [ 353.391730][ T8806] Memory cgroup out of memory: Killed process 8571 (syz.3.1388) total-vm:200552kB, anon-rss:1376kB, file-rss:20608kB, shmem-rss:89120kB, UID:0 pgtables:292kB oom_score_adj:1000 [ 353.501291][ T9029] syz.4.1550 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 353.520620][ T9029] CPU: 0 PID: 9029 Comm: syz.4.1550 Not tainted syzkaller #0 [ 353.528064][ T9029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 353.538137][ T9029] Call Trace: [ 353.541416][ T9029] [ 353.544349][ T9029] dump_stack_lvl+0x188/0x24e [ 353.549035][ T9029] ? ___ratelimit+0x14e/0x610 [ 353.553713][ T9029] ? show_regs_print_info+0x12/0x12 [ 353.558925][ T9029] ? load_image+0x410/0x410 [ 353.563436][ T9029] ? ___ratelimit+0x474/0x610 [ 353.568201][ T9029] ? radix_tree_cpu_dead+0x160/0x160 [ 353.573494][ T9029] dump_header+0xd8/0x820 [ 353.577829][ T9029] oom_kill_process+0x361/0x550 [ 353.582682][ T9029] out_of_memory+0xe25/0x1220 [ 353.587352][ T9029] ? __mutex_lock+0x3ba/0xae0 [ 353.592035][ T9029] ? mutex_lock_nested+0x10/0x10 [ 353.596977][ T9029] ? unregister_oom_notifier+0x20/0x20 [ 353.602438][ T9029] mem_cgroup_out_of_memory+0x2c0/0x390 [ 353.607990][ T9029] ? mem_cgroup_oom_trylock+0x210/0x210 [ 353.613544][ T9029] ? do_raw_spin_unlock+0x11d/0x230 [ 353.618744][ T9029] try_charge_memcg+0xc9d/0x17c0 [ 353.623701][ T9029] ? percpu_ref_put+0x180/0x180 [ 353.628557][ T9029] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 353.634294][ T9029] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 353.640279][ T9029] ? percpu_ref_tryget+0x15/0x180 [ 353.645306][ T9029] ? percpu_ref_tryget+0x15/0x180 [ 353.650332][ T9029] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 353.656056][ T9029] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 353.661866][ T9029] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 353.667684][ T9029] obj_cgroup_charge+0x36a/0x620 [ 353.672636][ T9029] ? obj_cgroup_charge+0xe9/0x620 [ 353.677662][ T9029] ? mod_objcg_mlstate+0x320/0x320 [ 353.682773][ T9029] ? percpu_ref_tryget+0x15/0x180 [ 353.687799][ T9029] ? percpu_ref_tryget+0x15/0x180 [ 353.692835][ T9029] ? get_obj_cgroup_from_current+0xd0/0x280 [ 353.698731][ T9029] slab_pre_alloc_hook+0x2e2/0x300 [ 353.703844][ T9029] kmem_cache_alloc+0x56/0x2f0 [ 353.708610][ T9029] ? create_new_namespaces+0x34/0x700 [ 353.713983][ T9029] ? copy_namespaces+0x55/0x410 [ 353.718832][ T9029] create_new_namespaces+0x34/0x700 [ 353.724027][ T9029] ? apparmor_capable+0x12c/0x190 [ 353.729056][ T9029] ? bpf_lsm_capable+0x5/0x10 [ 353.733736][ T9029] ? security_capable+0x85/0xb0 [ 353.738592][ T9029] ? copy_namespaces+0x55/0x410 [ 353.743442][ T9029] ? copy_namespaces+0x55/0x410 [ 353.748290][ T9029] copy_namespaces+0x3ae/0x410 [ 353.753056][ T9029] copy_process+0x199b/0x4070 [ 353.757744][ T9029] ? copy_process+0x974/0x4070 [ 353.762536][ T9029] ? idle_dummy+0x10/0x10 [ 353.766868][ T9029] ? tomoyo_path_number_perm+0x205/0x650 [ 353.772506][ T9029] kernel_clone+0x24b/0x900 [ 353.777008][ T9029] ? create_io_thread+0x170/0x170 [ 353.782036][ T9029] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 353.788022][ T9029] __x64_sys_clone+0x1a7/0x220 [ 353.792790][ T9029] ? __ia32_sys_vfork+0x140/0x140 [ 353.797822][ T9029] ? lock_chain_count+0x20/0x20 [ 353.802682][ T9029] ? lockdep_hardirqs_on+0x94/0x140 [ 353.807881][ T9029] do_syscall_64+0x4c/0xa0 [ 353.812305][ T9029] ? clear_bhb_loop+0x60/0xb0 [ 353.816982][ T9029] ? clear_bhb_loop+0x60/0xb0 [ 353.821665][ T9029] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 353.827560][ T9029] RIP: 0033:0x7fe9bd19e0d9 [ 353.832001][ T9029] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 353.851612][ T9029] RSP: 002b:00007fe9be06cfd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 353.860028][ T9029] RAX: ffffffffffffffda RBX: 00007fe9bd425fa0 RCX: 00007fe9bd19e0d9 [ 353.867999][ T9029] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020b84211 [ 353.875967][ T9029] RBP: 00007fe9bd235024 R08: 0000000000000000 R09: 0000000000000000 [ 353.883937][ T9029] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 353.891905][ T9029] R13: 00007fe9bd426038 R14: 00007fe9bd425fa0 R15: 00007fff50e4a9a8 [ 353.899892][ T9029] [ 354.332636][ T9029] memory: usage 307200kB, limit 307200kB, failcnt 12540 [ 354.340116][ T9029] memory+swap: usage 332812kB, limit 9007199254740988kB, failcnt 0 [ 354.348658][ T9029] kmem: usage 2312kB, limit 9007199254740988kB, failcnt 0 [ 354.356336][ T9029] Memory cgroup stats for /syz4: [ 354.356755][ T9029] anon 397312 [ 354.356755][ T9029] file 311808000 [ 354.356755][ T9029] kernel 2367488 [ 354.356755][ T9029] kernel_stack 163840 [ 354.356755][ T9029] pagetables 741376 [ 354.356755][ T9029] sec_pagetables 0 [ 354.356755][ T9029] percpu 22144 [ 354.356755][ T9029] sock 0 [ 354.356755][ T9029] vmalloc 0 [ 354.356755][ T9029] shmem 311795712 [ 354.356755][ T9029] zswap 0 [ 354.356755][ T9029] zswapped 0 [ 354.356755][ T9029] file_mapped 159010816 [ 354.356755][ T9029] file_dirty 12288 [ 354.356755][ T9029] file_writeback 0 [ 354.356755][ T9029] swapcached 41672704 [ 354.356755][ T9029] anon_thp 0 [ 354.356755][ T9029] file_thp 0 [ 354.356755][ T9029] shmem_thp 0 [ 354.356755][ T9029] inactive_anon 167145472 [ 354.356755][ T9029] active_anon 145047552 [ 354.356755][ T9029] inactive_file 0 [ 354.356755][ T9029] active_file 12288 [ 354.356755][ T9029] unevictable 0 [ 354.356755][ T9029] slab_reclaimable 991984 [ 354.356755][ T9029] slab_unreclaimable 371816 [ 354.522834][ T9063] loop2: detected capacity change from 0 to 512 [ 355.074017][ T9029] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz4,mems_allowed=0-1,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.1435,pid=8702,uid=0 [ 355.091809][ T9029] Memory cgroup out of memory: Killed process 8702 (syz.4.1435) total-vm:200552kB, anon-rss:1388kB, file-rss:20608kB, shmem-rss:79724kB, UID:0 pgtables:272kB oom_score_adj:1000 [ 355.118594][ T9063] EXT4-fs error (device loop2): mb_free_blocks:1839: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 355.133197][ T9063] EXT4-fs error (device loop2): ext4_do_update_inode:5279: inode #11: comm syz.2.1565: corrupted inode contents [ 355.148966][ T9063] EXT4-fs error (device loop2): ext4_dirty_inode:6156: inode #11: comm syz.2.1565: mark_inode_dirty error [ 355.161002][ T9063] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.1565: invalid indirect mapped block 1 (level 1) [ 355.181963][ T9063] EXT4-fs error (device loop2): ext4_do_update_inode:5279: inode #11: comm syz.2.1565: corrupted inode contents [ 355.224632][ T9063] EXT4-fs error (device loop2) in ext4_orphan_del:303: Corrupt filesystem [ 355.233787][ T9063] EXT4-fs error (device loop2): ext4_do_update_inode:5279: inode #11: comm syz.2.1565: corrupted inode contents [ 355.247554][ T9063] EXT4-fs error (device loop2): ext4_truncate:4325: inode #11: comm syz.2.1565: mark_inode_dirty error [ 355.259167][ T9063] EXT4-fs error (device loop2) in ext4_process_orphan:345: Corrupt filesystem [ 355.298845][ T9063] EXT4-fs (loop2): 1 truncate cleaned up [ 355.304704][ T9063] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 355.517103][ T29] oom_reaper: reaped process 8571 (syz.3.1388), now anon-rss:0kB, file-rss:20480kB, shmem-rss:52712kB [ 356.146925][ T4273] EXT4-fs (loop2): unmounting filesystem. [ 356.199164][ T9060] syz.3.1553 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 356.527281][ T9060] CPU: 1 PID: 9060 Comm: syz.3.1553 Not tainted syzkaller #0 [ 356.534735][ T9060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 356.544818][ T9060] Call Trace: [ 356.548107][ T9060] [ 356.551050][ T9060] dump_stack_lvl+0x188/0x24e [ 356.555760][ T9060] ? ___ratelimit+0x14e/0x610 [ 356.560454][ T9060] ? show_regs_print_info+0x12/0x12 [ 356.565682][ T9060] ? load_image+0x410/0x410 [ 356.570198][ T9060] ? ___ratelimit+0x474/0x610 [ 356.574904][ T9060] ? radix_tree_cpu_dead+0x160/0x160 [ 356.580219][ T9060] dump_header+0xd8/0x820 [ 356.584583][ T9060] oom_kill_process+0x361/0x550 [ 356.589465][ T9060] out_of_memory+0xe25/0x1220 [ 356.594173][ T9060] ? print_unlock_imbalance_bug+0x160/0x160 [ 356.600103][ T9060] ? mutex_lock_nested+0x10/0x10 [ 356.605063][ T9060] ? unregister_oom_notifier+0x20/0x20 [ 356.610557][ T9060] mem_cgroup_out_of_memory+0x2c0/0x390 [ 356.616130][ T9060] ? mem_cgroup_oom_trylock+0x210/0x210 [ 356.621713][ T9060] ? do_raw_spin_unlock+0x11d/0x230 [ 356.626933][ T9060] try_charge_memcg+0xc9d/0x17c0 [ 356.631926][ T9060] ? percpu_ref_put+0x180/0x180 [ 356.636802][ T9060] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 356.642567][ T9060] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 356.648324][ T9060] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 356.654089][ T9060] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 356.659931][ T9060] __memcg_kmem_charge_page+0x220/0x380 [ 356.665510][ T9060] memcg_charge_kernel_stack+0x322/0x6d0 [ 356.671169][ T9060] dup_task_struct+0x3eb/0x700 [ 356.675959][ T9060] ? lockdep_hardirqs_on+0x94/0x140 [ 356.681183][ T9060] copy_process+0x621/0x4070 [ 356.685824][ T9060] ? verify_lock_unused+0x140/0x140 [ 356.691055][ T9060] ? idle_dummy+0x10/0x10 [ 356.695414][ T9060] kernel_clone+0x24b/0x900 [ 356.699948][ T9060] ? create_io_thread+0x170/0x170 [ 356.705021][ T9060] __se_sys_clone3+0x32d/0x3f0 [ 356.709807][ T9060] ? __x64_sys_clone3+0x60/0x60 [ 356.714675][ T9060] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 356.720694][ T9060] ? _copy_to_user+0xea/0x130 [ 356.725412][ T9060] ? lockdep_hardirqs_on+0x94/0x140 [ 356.730636][ T9060] do_syscall_64+0x4c/0xa0 [ 356.735078][ T9060] ? clear_bhb_loop+0x60/0xb0 [ 356.739788][ T9060] ? clear_bhb_loop+0x60/0xb0 [ 356.744496][ T9060] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 356.750412][ T9060] RIP: 0033:0x7fa2fef9eec9 [ 356.754846][ T9060] Code: 90 b8 01 00 00 00 b9 01 00 00 00 eb ec 0f 1f 40 00 b8 ea ff ff ff 48 85 ff 74 28 48 85 d2 74 23 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 14 74 01 c3 31 ed 4c 89 c7 ff d2 48 89 c7 b8 3c 00 00 [ 356.774480][ T9060] RSP: 002b:00007ffffb2c0ad8 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3 [ 356.782921][ T9060] RAX: ffffffffffffffda RBX: 00007fa2fef5a460 RCX: 00007fa2fef9eec9 [ 356.790927][ T9060] RDX: 00007fa2fef5a460 RSI: 0000000000000058 RDI: 00007ffffb2c0b30 [ 356.798926][ T9060] RBP: 00007fa2ffed56c0 R08: 00007fa2ffed56c0 R09: 00007ffffb2c0c17 [ 356.806926][ T9060] R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffffe8 [ 356.814925][ T9060] R13: 000000000000004d R14: 00007ffffb2c0b30 R15: 00007ffffb2c0c18 [ 356.822936][ T9060] [ 357.101708][ T9060] memory: usage 298340kB, limit 307200kB, failcnt 18048 [ 357.151737][ T9060] memory+swap: usage 360244kB, limit 9007199254740988kB, failcnt 0 [ 357.183579][ T9060] kmem: usage 2144kB, limit 9007199254740988kB, failcnt 0 [ 357.221265][ T9060] Memory cgroup stats for /syz3: [ 357.221462][ T9060] anon 794624 [ 357.221462][ T9060] file 302448640 [ 357.221462][ T9060] kernel 2195456 [ 357.221462][ T9060] kernel_stack 163840 [ 357.221462][ T9060] pagetables 581632 [ 357.221462][ T9060] sec_pagetables 0 [ 357.221462][ T9060] percpu 0 [ 357.221462][ T9060] sock 0 [ 357.221462][ T9060] vmalloc 0 [ 357.221462][ T9060] shmem 302444544 [ 357.221462][ T9060] zswap 0 [ 357.221462][ T9060] zswapped 0 [ 357.221462][ T9060] file_mapped 92155904 [ 357.221462][ T9060] file_dirty 4096 [ 357.221462][ T9060] file_writeback 0 [ 357.221462][ T9060] swapcached 111345664 [ 357.221462][ T9060] anon_thp 0 [ 357.221462][ T9060] file_thp 0 [ 357.221462][ T9060] shmem_thp 0 [ 357.221462][ T9060] inactive_anon 186691584 [ 357.221462][ T9060] active_anon 116547584 [ 357.221462][ T9060] inactive_file 0 [ 357.221462][ T9060] active_file 4096 [ 357.221462][ T9060] unevictable 0 [ 357.221462][ T9060] slab_reclaimable 1060344 [ 357.221462][ T9060] slab_unreclaimable 274944 [ 357.365670][ T8541] syz.0.1379 (8541) used greatest stack depth: 18368 bytes left [ 357.675492][ T9090] loop1: detected capacity change from 0 to 128 [ 357.740515][ T9090] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 357.770321][ T9060] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz3,mems_allowed=0-1,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.1449,pid=8738,uid=0 [ 357.885079][ T9060] Memory cgroup out of memory: Killed process 8738 (syz.3.1449) total-vm:200684kB, anon-rss:1536kB, file-rss:20608kB, shmem-rss:51184kB, UID:0 pgtables:216kB oom_score_adj:1000 [ 357.892099][ T9090] ext4 filesystem being mounted at /298/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 358.038033][ T4273] syz-executor invoked oom-killer: gfp_mask=0xdc0(GFP_KERNEL|__GFP_ZERO), order=0, oom_score_adj=0 [ 358.078752][ T4273] CPU: 1 PID: 4273 Comm: syz-executor Not tainted syzkaller #0 [ 358.086378][ T4273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 358.096455][ T4273] Call Trace: [ 358.099744][ T4273] [ 358.102685][ T4273] dump_stack_lvl+0x188/0x24e [ 358.107389][ T4273] ? ___ratelimit+0x14e/0x610 [ 358.112102][ T4273] ? show_regs_print_info+0x12/0x12 [ 358.117337][ T4273] ? load_image+0x410/0x410 [ 358.121861][ T4273] ? ___ratelimit+0x474/0x610 [ 358.126558][ T4273] ? radix_tree_cpu_dead+0x160/0x160 [ 358.131864][ T4273] dump_header+0xd8/0x820 [ 358.136215][ T4273] oom_kill_process+0x361/0x550 [ 358.141092][ T4273] out_of_memory+0xe25/0x1220 [ 358.145783][ T4273] ? __mutex_lock+0x3ba/0xae0 [ 358.150492][ T4273] ? mutex_lock_nested+0x10/0x10 [ 358.155454][ T4273] ? unregister_oom_notifier+0x20/0x20 [ 358.160940][ T4273] mem_cgroup_out_of_memory+0x2c0/0x390 [ 358.166511][ T4273] ? mem_cgroup_oom_trylock+0x210/0x210 [ 358.172093][ T4273] ? do_raw_spin_unlock+0x11d/0x230 [ 358.177314][ T4273] try_charge_memcg+0xc9d/0x17c0 [ 358.182295][ T4273] ? percpu_ref_put+0x180/0x180 [ 358.187206][ T4273] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 358.192963][ T4273] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 358.198961][ T4273] ? percpu_ref_tryget+0x15/0x180 [ 358.203990][ T4273] ? percpu_ref_tryget+0x15/0x180 [ 358.209035][ T4273] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 358.214761][ T4273] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 358.220482][ T4273] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 358.226287][ T4273] obj_cgroup_charge+0x36a/0x620 [ 358.231226][ T4273] ? obj_cgroup_charge+0xe9/0x620 [ 358.236250][ T4273] ? mod_objcg_mlstate+0x320/0x320 [ 358.241363][ T4273] ? percpu_ref_tryget+0x15/0x180 [ 358.246398][ T4273] ? get_obj_cgroup_from_current+0xd0/0x280 [ 358.252296][ T4273] slab_pre_alloc_hook+0x2e2/0x300 [ 358.257404][ T4273] ? is_bpf_text_address+0x22/0x2a0 [ 358.262598][ T4273] kmem_cache_alloc+0x56/0x2f0 [ 358.267354][ T4273] ? __alloc_file+0x25/0x230 [ 358.271947][ T4273] __alloc_file+0x25/0x230 [ 358.276361][ T4273] alloc_empty_file+0x90/0x180 [ 358.281121][ T4273] path_openat+0x11c/0x2f10 [ 358.285628][ T4273] ? __lock_acquire+0x1465/0x7c40 [ 358.290668][ T4273] ? verify_lock_unused+0x140/0x140 [ 358.295867][ T4273] ? kasan_set_track+0x4b/0x70 [ 358.300631][ T4273] ? verify_lock_unused+0x140/0x140 [ 358.305827][ T4273] ? do_sys_openat2+0xdd/0x4f0 [ 358.310590][ T4273] ? __x64_sys_openat+0x135/0x160 [ 358.315612][ T4273] ? do_syscall_64+0x4c/0xa0 [ 358.320208][ T4273] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 358.326283][ T4273] ? do_filp_open+0x420/0x420 [ 358.330973][ T4273] do_filp_open+0x1ee/0x420 [ 358.335477][ T4273] ? vfs_tmpfile+0x470/0x470 [ 358.340082][ T4273] ? _raw_spin_unlock+0x24/0x40 [ 358.344934][ T4273] ? alloc_fd+0x590/0x640 [ 358.349270][ T4273] do_sys_openat2+0x14b/0x4f0 [ 358.353952][ T4273] ? do_sys_open+0xe0/0xe0 [ 358.358367][ T4273] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 358.364349][ T4273] ? lock_chain_count+0x20/0x20 [ 358.369204][ T4273] __x64_sys_openat+0x135/0x160 [ 358.374066][ T4273] do_syscall_64+0x4c/0xa0 [ 358.378493][ T4273] ? clear_bhb_loop+0x60/0xb0 [ 358.383174][ T4273] ? clear_bhb_loop+0x60/0xb0 [ 358.387852][ T4273] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 358.393745][ T4273] RIP: 0033:0x7fcdded9d3fc [ 358.398174][ T4273] Code: 4c 89 54 24 18 41 89 f2 41 83 e2 40 75 40 89 f0 f7 d0 a9 00 00 41 00 74 35 89 f2 b8 01 01 00 00 48 89 fe bf 9c ff ff ff 0f 05 <48> 3d 00 f0 ff ff 77 44 48 8b 54 24 18 64 48 2b 14 25 28 00 00 00 [ 358.417777][ T4273] RSP: 002b:00007ffca738f360 EFLAGS: 00000206 ORIG_RAX: 0000000000000101 [ 358.426189][ T4273] RAX: ffffffffffffffda RBX: 00007fcddee34474 RCX: 00007fcdded9d3fc [ 358.434158][ T4273] RDX: 0000000000090800 RSI: 00007ffca7390510 RDI: 00000000ffffff9c [ 358.442123][ T4273] RBP: 00007ffca73904fc R08: 0000000000000000 R09: 0000000000000000 [ 358.450088][ T4273] R10: 0000000000000000 R11: 0000000000000206 R12: 00007ffca7390510 [ 358.458058][ T4273] R13: 00007fcddee34474 R14: 00000000000571f7 R15: 00007ffca7390550 [ 358.466045][ T4273] [ 358.476858][ T9097] device syzkaller0 entered promiscuous mode [ 358.508731][ T4273] memory: usage 307200kB, limit 307200kB, failcnt 9780 [ 358.521807][ T4273] memory+swap: usage 342860kB, limit 9007199254740988kB, failcnt 0 [ 358.530803][ T4273] kmem: usage 2264kB, limit 9007199254740988kB, failcnt 0 [ 358.553891][ T4273] Memory cgroup stats for /syz2: [ 358.554077][ T4273] anon 438272 [ 358.554077][ T4273] file 311816192 [ 358.554077][ T4273] kernel 2318336 [ 358.554077][ T4273] kernel_stack 163840 [ 358.554077][ T4273] pagetables 798720 [ 358.554077][ T4273] sec_pagetables 0 [ 358.554077][ T4273] percpu 0 [ 358.554077][ T4273] sock 0 [ 358.554077][ T4273] vmalloc 0 [ 358.554077][ T4273] shmem 311775232 [ 358.554077][ T4273] zswap 0 [ 358.554077][ T4273] zswapped 0 [ 358.554077][ T4273] file_mapped 164364288 [ 358.554077][ T4273] file_dirty 0 [ 358.554077][ T4273] file_writeback 0 [ 358.554077][ T4273] swapcached 41365504 [ 358.554077][ T4273] anon_thp 0 [ 358.554077][ T4273] file_thp 0 [ 358.554077][ T4273] shmem_thp 0 [ 358.554077][ T4273] inactive_anon 188186624 [ 358.554077][ T4273] active_anon 124026880 [ 358.554077][ T4273] inactive_file 0 [ 358.554077][ T4273] active_file 40960 [ 358.554077][ T4273] unevictable 0 [ 358.554077][ T4273] slab_reclaimable 1023408 [ 358.554077][ T4273] slab_unreclaimable 248128 [ 358.662076][ T4273] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz2,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.1410,pid=8631,uid=0 [ 358.682566][ T4273] Memory cgroup out of memory: Killed process 8631 (syz.2.1410) total-vm:202596kB, anon-rss:1376kB, file-rss:20608kB, shmem-rss:95804kB, UID:0 pgtables:296kB oom_score_adj:1000 [ 359.317776][ T4272] EXT4-fs (loop1): unmounting filesystem. [ 359.994376][ T29] oom_reaper: reaped process 8738 (syz.3.1449), now anon-rss:0kB, file-rss:20480kB, shmem-rss:27696kB [ 360.567927][ T9120] loop4: detected capacity change from 0 to 2048 [ 360.607879][ T9120] EXT4-fs: Ignoring removed i_version option [ 360.794642][ T29] oom_reaper: reaped process 8631 (syz.2.1410), now anon-rss:0kB, file-rss:20480kB, shmem-rss:9164kB [ 360.807128][ T9120] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 360.942490][ T9120] ext4 filesystem being mounted at /325/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 361.939764][ T4282] EXT4-fs (loop4): unmounting filesystem. [ 363.729451][ T8702] syz.4.1435 (8702) used greatest stack depth: 18320 bytes left [ 364.504490][ T9169] loop2: detected capacity change from 0 to 128 [ 364.538526][ T9169] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 364.629367][ T9169] ext4 filesystem being mounted at /311/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 365.892610][ T4273] EXT4-fs (loop2): unmounting filesystem. [ 367.494696][ T9212] loop1: detected capacity change from 0 to 128 [ 367.797110][ T9212] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 367.919633][ T9212] ext4 filesystem being mounted at /307/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 368.463895][ T4272] EXT4-fs (loop1): unmounting filesystem. [ 369.659001][ T9253] loop4: detected capacity change from 0 to 128 [ 369.782857][ T9254] device syzkaller0 entered promiscuous mode [ 369.830663][ T9253] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 369.895726][ T9253] ext4 filesystem being mounted at /340/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 370.919008][ T4282] EXT4-fs (loop4): unmounting filesystem. [ 372.814983][ T9303] device syzkaller0 entered promiscuous mode [ 373.735817][ T8631] syz.2.1410 (8631) used greatest stack depth: 18064 bytes left [ 374.374465][ T9335] loop3: detected capacity change from 0 to 128 [ 374.732882][ T9335] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 374.911822][ T9335] ext4 filesystem being mounted at /315/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 375.655395][ T4279] EXT4-fs (loop3): unmounting filesystem. [ 377.543689][ T9403] device syzkaller0 entered promiscuous mode [ 377.648766][ T9407] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 378.131187][ T9413] netlink: 'syz.4.1689': attribute type 1 has an invalid length. [ 378.250779][ T9413] device bond2 entered promiscuous mode [ 378.292742][ T9413] 8021q: adding VLAN 0 to HW filter on device bond2 [ 378.374605][ T9421] 8021q: adding VLAN 0 to HW filter on device bond2 [ 378.422020][ T9421] bond2: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 378.435626][ T9425] jffs2: notice: (9425) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 378.441272][ T9421] bond2: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 378.514767][ T9421] bond2: (slave ip6gre1): making interface the new active one [ 378.546645][ T9421] device ip6gre1 entered promiscuous mode [ 378.555023][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.599775][ T9421] bond2: (slave ip6gre1): Enslaving as an active interface with an up link [ 378.924054][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 379.089119][ T9437] loop2: detected capacity change from 0 to 128 [ 379.195823][ T9437] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 379.232473][ T9437] ext4 filesystem being mounted at /327/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 379.427523][ T5044] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 379.631772][ T5044] usb 2-1: Using ep0 maxpacket: 8 [ 379.645505][ T5044] usb 2-1: config 0 has no interfaces? [ 379.658643][ T5044] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 379.679402][ T5044] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 379.702889][ T5044] usb 2-1: config 0 descriptor?? [ 379.947179][ T4319] usb 2-1: USB disconnect, device number 5 [ 380.050836][ T4273] EXT4-fs (loop2): unmounting filesystem. [ 381.291809][ T4319] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 381.487269][ T4319] usb 5-1: Using ep0 maxpacket: 8 [ 381.496449][ T4319] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 381.518245][ T4319] usb 5-1: config 0 has no interface number 0 [ 381.534527][ T4319] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 381.579164][ T4319] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 381.595998][ T4319] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 381.620643][ T4319] usb 5-1: config 0 descriptor?? [ 381.684406][ T4319] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 381.839379][ T9462] syz.3.1700 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 381.878430][ T9462] CPU: 0 PID: 9462 Comm: syz.3.1700 Not tainted syzkaller #0 [ 381.885884][ T9462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 381.895974][ T9462] Call Trace: [ 381.899272][ T9462] [ 381.902229][ T9462] dump_stack_lvl+0x188/0x24e [ 381.906940][ T9462] ? ___ratelimit+0x14e/0x610 [ 381.911647][ T9462] ? show_regs_print_info+0x12/0x12 [ 381.916877][ T9462] ? load_image+0x410/0x410 [ 381.921409][ T9462] ? ___ratelimit+0x474/0x610 [ 381.926122][ T9462] ? radix_tree_cpu_dead+0x160/0x160 [ 381.931441][ T9462] dump_header+0xd8/0x820 [ 381.935815][ T9462] oom_kill_process+0x361/0x550 [ 381.940694][ T9462] out_of_memory+0xe25/0x1220 [ 381.945402][ T9462] ? print_unlock_imbalance_bug+0x160/0x160 [ 381.951330][ T9462] ? mutex_lock_nested+0x10/0x10 [ 381.956386][ T9462] ? unregister_oom_notifier+0x20/0x20 [ 381.961883][ T9462] mem_cgroup_out_of_memory+0x2c0/0x390 [ 381.967467][ T9462] ? mem_cgroup_oom_trylock+0x210/0x210 [ 381.973056][ T9462] ? do_raw_spin_unlock+0x11d/0x230 [ 381.978288][ T9462] try_charge_memcg+0xc9d/0x17c0 [ 381.983285][ T9462] ? percpu_ref_put+0x180/0x180 [ 381.988195][ T9462] ? get_mem_cgroup_from_mm+0x34/0x290 [ 381.993691][ T9462] charge_memcg+0x117/0x3b0 [ 381.998234][ T9462] ? __mem_cgroup_charge+0x80/0x80 [ 382.003379][ T9462] ? get_mem_cgroup_from_mm+0x34/0x290 [ 382.008876][ T9462] ? get_mem_cgroup_from_mm+0x34/0x290 [ 382.014374][ T9462] ? get_mem_cgroup_from_mm+0x1ae/0x290 [ 382.019961][ T9462] __mem_cgroup_charge+0x21/0x80 [ 382.024942][ T9462] handle_mm_fault+0x207c/0x3d40 [ 382.029926][ T9462] ? numa_migrate_prep+0x250/0x250 [ 382.035091][ T9462] __get_user_pages+0x40d/0xec0 [ 382.039994][ T9462] ? populate_vma_page_range+0x2b0/0x2b0 [ 382.045680][ T9462] populate_vma_page_range+0x214/0x2b0 [ 382.051184][ T9462] __mm_populate+0x25c/0x380 [ 382.055815][ T9462] ? check_vma_flags+0x4c0/0x4c0 [ 382.060793][ T9462] ? up_write+0x1b6/0x410 [ 382.065156][ T9462] ? do_mlock+0x194/0x640 [ 382.069515][ T9462] do_mlock+0x53a/0x640 [ 382.073703][ T9462] ? lru_gen_add_folio+0xe20/0xe20 [ 382.078849][ T9462] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 382.084867][ T9462] ? lock_chain_count+0x20/0x20 [ 382.089764][ T9462] ? syscall_enter_from_user_mode+0x21/0x80 [ 382.095696][ T9462] __x64_sys_mlock+0x5c/0x70 [ 382.100330][ T9462] do_syscall_64+0x4c/0xa0 [ 382.104787][ T9462] ? clear_bhb_loop+0x60/0xb0 [ 382.106773][ T4319] usb 5-1: USB disconnect, device number 4 [ 382.109483][ T9462] ? clear_bhb_loop+0x60/0xb0 [ 382.119993][ T9462] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 382.125920][ T9462] RIP: 0033:0x7fa2fef9e0d9 [ 382.130359][ T9462] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 382.150041][ T9462] RSP: 002b:00007fa2ffeb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000095 [ 382.158491][ T9462] RAX: ffffffffffffffda RBX: 00007fa2ff226090 RCX: 00007fa2fef9e0d9 [ 382.166493][ T9462] RDX: 0000000000000000 RSI: 0000000000800000 RDI: 0000200000000000 [ 382.174494][ T9462] RBP: 00007fa2ff035024 R08: 0000000000000000 R09: 0000000000000000 [ 382.182493][ T9462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 382.190490][ T9462] R13: 00007fa2ff226128 R14: 00007fa2ff226090 R15: 00007ffffb2c0c18 [ 382.198499][ T9462] [ 382.741666][ T9462] memory: usage 96kB, limit 96kB, failcnt 43 [ 382.801814][ T9462] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 382.809430][ T9462] kmem: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 382.932353][ T9488] device syzkaller0 entered promiscuous mode [ 383.012364][ T9462] Memory cgroup stats for /syz3/test: [ 383.012805][ T9462] anon 94208 [ 383.012805][ T9462] file 0 [ 383.012805][ T9462] kernel 4096 [ 383.012805][ T9462] kernel_stack 0 [ 383.012805][ T9462] pagetables 0 [ 383.012805][ T9462] sec_pagetables 0 [ 383.012805][ T9462] percpu 0 [ 383.012805][ T9462] sock 0 [ 383.012805][ T9462] vmalloc 0 [ 383.012805][ T9462] shmem 0 [ 383.012805][ T9462] zswap 0 [ 383.012805][ T9462] zswapped 0 [ 383.012805][ T9462] file_mapped 0 [ 383.012805][ T9462] file_dirty 0 [ 383.012805][ T9462] file_writeback 0 [ 383.012805][ T9462] swapcached 0 [ 383.012805][ T9462] anon_thp 0 [ 383.012805][ T9462] file_thp 0 [ 383.012805][ T9462] shmem_thp 0 [ 383.012805][ T9462] inactive_anon 0 [ 383.012805][ T9462] active_anon 0 [ 383.012805][ T9462] inactive_file 0 [ 383.012805][ T9462] active_file 0 [ 383.012805][ T9462] unevictable 94208 [ 383.012805][ T9462] slab_reclaimable 0 [ 383.012805][ T9462] slab_unreclaimable 344 [ 383.012805][ T9462] slab 344 [ 383.012805][ T9462] workingset_refault_anon 0 [ 383.264302][ T9462] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.1700,pid=9456,uid=0 [ 383.351012][ T9462] Memory cgroup out of memory: Killed process 9462 (syz.3.1700) total-vm:108792kB, anon-rss:1452kB, file-rss:27432kB, shmem-rss:0kB, UID:0 pgtables:148kB oom_score_adj:1000 [ 383.385880][ T9495] loop1: detected capacity change from 0 to 128 [ 383.484423][ T9495] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 383.515558][ T9495] ext4 filesystem being mounted at /329/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 383.617337][ T4278] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 383.627567][ T4278] CPU: 0 PID: 4278 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 383.635143][ T4278] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 383.645256][ T4278] Workqueue: hci0 hci_rx_work [ 383.649975][ T4278] Call Trace: [ 383.653286][ T4278] [ 383.656225][ T4278] dump_stack_lvl+0x188/0x24e [ 383.660920][ T4278] ? show_regs_print_info+0x12/0x12 [ 383.666129][ T4278] ? load_image+0x410/0x410 [ 383.670647][ T4278] sysfs_create_dir_ns+0x26a/0x290 [ 383.675766][ T4278] ? __lock_acquire+0x7c40/0x7c40 [ 383.680836][ T4278] ? sysfs_warn_dup+0xa0/0xa0 [ 383.685522][ T4278] ? do_raw_spin_unlock+0x11d/0x230 [ 383.690720][ T4278] kobject_add_internal+0x617/0xca0 [ 383.695928][ T4278] kobject_add+0x160/0x230 [ 383.700359][ T4278] ? kobject_init+0x1c0/0x1c0 [ 383.705038][ T4278] ? __raw_spin_lock_init+0x41/0x100 [ 383.710323][ T4278] ? klist_children_get+0x50/0x50 [ 383.715353][ T4278] ? get_device_parent+0x121/0x3e0 [ 383.720469][ T4278] device_add+0x470/0x1050 [ 383.724894][ T4278] hci_conn_add_sysfs+0xd1/0x1e0 [ 383.729839][ T4278] le_conn_complete_evt+0xfac/0x15c0 [ 383.735144][ T4278] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 383.741406][ T4278] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 383.747041][ T4278] ? mutex_unlock+0x10/0x10 [ 383.751541][ T4278] ? skb_pull_data+0xec/0x1f0 [ 383.756246][ T4278] hci_le_conn_complete_evt+0x183/0x440 [ 383.761808][ T4278] ? hci_remote_host_features_evt+0x230/0x230 [ 383.767899][ T4278] hci_event_packet+0x7b3/0x1290 [ 383.772841][ T4278] ? __lock_acquire+0x7c40/0x7c40 [ 383.777869][ T4278] ? hci_conn_valid+0x220/0x220 [ 383.782715][ T4278] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 383.788614][ T4278] ? kcov_remote_start+0x4b0/0x7e0 [ 383.793724][ T4278] ? patch_conexant_auto+0xfe0/0x1690 [ 383.799186][ T4278] ? hci_send_to_monitor+0x9c/0x4a0 [ 383.804388][ T4278] hci_rx_work+0x3eb/0xd40 [ 383.808806][ T4278] ? _raw_spin_unlock+0x40/0x40 [ 383.813664][ T4278] ? process_one_work+0x7b4/0x1160 [ 383.818777][ T4278] process_one_work+0x8ab/0x1160 [ 383.823725][ T4278] ? worker_detach_from_pool+0x240/0x240 [ 383.829362][ T4278] ? _raw_spin_lock_irq+0xb7/0xf0 [ 383.834390][ T4278] ? _raw_spin_lock_irqsave+0x100/0x100 [ 383.839937][ T4278] ? wq_worker_running+0x97/0x190 [ 383.844971][ T4278] worker_thread+0xaf5/0x12a0 [ 383.849672][ T4278] kthread+0x29d/0x330 [ 383.853740][ T4278] ? worker_clr_flags+0x1a0/0x1a0 [ 383.858765][ T4278] ? kthread_blkcg+0xd0/0xd0 [ 383.863355][ T4278] ret_from_fork+0x1f/0x30 [ 383.867791][ T4278] [ 383.872436][ T4278] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 383.887572][ T4278] Bluetooth: hci0: failed to register connection device [ 384.401450][ T4272] EXT4-fs (loop1): unmounting filesystem. [ 384.866447][ T9520] nvmet: adding nsid 1 to subsystem testsubsys [ 384.951477][ T9529] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1719'. [ 385.265709][ T9536] loop4: detected capacity change from 0 to 2048 [ 385.323904][ T9536] EXT4-fs: Ignoring removed i_version option [ 385.383134][ T9536] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 385.445610][ T9536] ext4 filesystem being mounted at /359/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 385.478590][ T9542] device syzkaller0 entered promiscuous mode [ 385.924561][ T9552] loop0: detected capacity change from 0 to 128 [ 386.529697][ T9552] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 386.571230][ T9163] syz.0.1594 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 386.581337][ T9163] CPU: 0 PID: 9163 Comm: syz.0.1594 Not tainted syzkaller #0 [ 386.588743][ T9163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 386.598811][ T9163] Call Trace: [ 386.602090][ T9163] [ 386.605026][ T9163] dump_stack_lvl+0x188/0x24e [ 386.609737][ T9163] ? ___ratelimit+0x14e/0x610 [ 386.614417][ T9163] ? show_regs_print_info+0x12/0x12 [ 386.619624][ T9163] ? load_image+0x410/0x410 [ 386.624178][ T9163] ? ___ratelimit+0x474/0x610 [ 386.628856][ T9163] ? radix_tree_cpu_dead+0x160/0x160 [ 386.634145][ T9163] dump_header+0xd8/0x820 [ 386.638488][ T9163] oom_kill_process+0x361/0x550 [ 386.643347][ T9163] out_of_memory+0xe25/0x1220 [ 386.648026][ T9163] ? print_unlock_imbalance_bug+0x160/0x160 [ 386.653948][ T9163] ? mutex_lock_nested+0x10/0x10 [ 386.658933][ T9163] ? unregister_oom_notifier+0x20/0x20 [ 386.664417][ T9163] mem_cgroup_out_of_memory+0x2c0/0x390 [ 386.669975][ T9163] ? mem_cgroup_oom_trylock+0x210/0x210 [ 386.675533][ T9163] ? do_raw_spin_unlock+0x11d/0x230 [ 386.680734][ T9163] try_charge_memcg+0xc9d/0x17c0 [ 386.685690][ T9163] ? percpu_ref_put+0x180/0x180 [ 386.690561][ T9163] ? get_mem_cgroup_from_mm+0x34/0x290 [ 386.696025][ T9163] charge_memcg+0x117/0x3b0 [ 386.700532][ T9163] ? __mem_cgroup_charge+0x80/0x80 [ 386.705642][ T9163] ? get_mem_cgroup_from_mm+0x34/0x290 [ 386.711098][ T9163] ? get_mem_cgroup_from_mm+0x34/0x290 [ 386.716555][ T9163] ? get_mem_cgroup_from_mm+0x1ae/0x290 [ 386.722108][ T9163] __mem_cgroup_charge+0x21/0x80 [ 386.727050][ T9163] shmem_add_to_page_cache+0x8d7/0x1c90 [ 386.732604][ T9163] ? __filemap_get_folio+0x10f/0xde0 [ 386.737898][ T9163] ? __filemap_get_folio+0x10f/0xde0 [ 386.743237][ T9163] ? put_page+0x270/0x270 [ 386.747581][ T9163] shmem_get_folio_gfp+0x1663/0x35e0 [ 386.752875][ T9163] ? __lock_acquire+0x7c40/0x7c40 [ 386.757918][ T9163] shmem_fault+0x1b6/0x790 [ 386.762351][ T9163] ? shmem_fallocate+0xfc0/0xfc0 [ 386.767294][ T9163] ? filemap_map_pages+0x1ae/0x11e0 [ 386.772500][ T9163] ? filemap_read_folio+0x7a0/0x7a0 [ 386.777696][ T9163] ? count_memcg_event_mm+0x8a/0x3c0 [ 386.782990][ T9163] __do_fault+0x13b/0x4e0 [ 386.787319][ T9163] ? handle_mm_fault+0x2600/0x3d40 [ 386.792431][ T9163] handle_mm_fault+0x2610/0x3d40 [ 386.797383][ T9163] ? numa_migrate_prep+0x250/0x250 [ 386.802511][ T9163] __get_user_pages+0x40d/0xec0 [ 386.807379][ T9163] ? populate_vma_page_range+0x2b0/0x2b0 [ 386.813018][ T9163] ? up_write+0x1b6/0x410 [ 386.817349][ T9163] ? __generic_file_write_iter+0x148/0x2a0 [ 386.823168][ T9163] ? get_dump_page+0xee/0x670 [ 386.827849][ T9163] ? down_read_killable+0x1cc/0x340 [ 386.833055][ T9163] get_dump_page+0x18c/0x670 [ 386.837654][ T9163] ? fault_in_readable+0x1f0/0x1f0 [ 386.842770][ T9163] ? iov_iter_bvec+0x4a/0x1f0 [ 386.847451][ T9163] dump_user_range+0x123/0x840 [ 386.852229][ T9163] ? dump_skip+0x40/0x40 [ 386.856473][ T9163] ? dump_emit+0x74/0xe0 [ 386.860729][ T9163] ? dump_emit+0xa2/0xe0 [ 386.864978][ T9163] ? elf_core_dump+0x2aa9/0x3630 [ 386.869926][ T9163] elf_core_dump+0x30ca/0x3630 [ 386.874797][ T9163] ? load_elf_binary+0x2820/0x2820 [ 386.879915][ T9163] ? dump_vma_snapshot+0xaea/0xe40 [ 386.885042][ T9163] ? verify_lock_unused+0x140/0x140 [ 386.890248][ T9163] ? __lock_acquire+0x7c40/0x7c40 [ 386.895278][ T9163] ? mas_next_entry+0xe03/0xe90 [ 386.900158][ T9163] ? rcu_read_lock_any_held+0xb0/0x130 [ 386.905623][ T9163] ? 0xffffffffff600000 [ 386.909784][ T9163] ? getname_kernel+0x142/0x2f0 [ 386.914642][ T9163] do_coredump+0x16c1/0x2480 [ 386.919251][ T9163] ? nfs_stat_to_errno+0x170/0x170 [ 386.924386][ T9163] ? lock_chain_count+0x20/0x20 [ 386.929250][ T9163] ? _raw_spin_unlock_irq+0x1f/0x40 [ 386.934450][ T9163] ? lockdep_hardirqs_on+0x94/0x140 [ 386.939735][ T9163] get_signal+0x1093/0x1340 [ 386.944250][ T9163] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 386.950245][ T9163] arch_do_signal_or_restart+0xc4/0x1310 [ 386.955888][ T9163] ? __send_signal_locked+0xb38/0xde0 [ 386.961275][ T9163] ? get_sigframe_size+0x10/0x10 [ 386.966220][ T9163] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 386.972213][ T9163] ? exit_to_user_mode_loop+0x3b/0x110 [ 386.977683][ T9163] exit_to_user_mode_loop+0x70/0x110 [ 386.982972][ T9163] exit_to_user_mode_prepare+0xee/0x180 [ 386.988521][ T9163] irqentry_exit_to_user_mode+0x5/0x30 [ 386.993986][ T9163] exc_page_fault+0x88/0x100 [ 386.998580][ T9163] asm_exc_page_fault+0x22/0x30 [ 387.003435][ T9163] RIP: 0033:0x7f0435853bd7 [ 387.007847][ T9163] Code: e8 fe f9 ff ff 89 f2 48 8d 3d 5d 4f 1b 00 48 8d 35 c3 0a 1e 00 31 c0 e8 37 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 387.027454][ T9163] RSP: 002b:00007f04368fe120 EFLAGS: 00010202 [ 387.033521][ T9163] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007f043599e0d9 [ 387.041487][ T9163] RDX: 00007f04368fe140 RSI: 00007f04368fe270 RDI: 000000000000000b [ 387.049458][ T9163] RBP: 00007f0435a35024 R08: 0000000000000000 R09: 0000000000000000 [ 387.057427][ T9163] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 387.065394][ T9163] R13: 00007f0435c26038 R14: 00007f0435c25fa0 R15: 00007ffe26bbc658 [ 387.073380][ T9163] [ 387.080823][ T9568] loop1: detected capacity change from 0 to 128 [ 387.101001][ T9163] memory: usage 307200kB, limit 307200kB, failcnt 19059 [ 387.148923][ T9163] memory+swap: usage 376144kB, limit 9007199254740988kB, failcnt 0 [ 387.168376][ T9568] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 387.191960][ T9568] ext4 filesystem being mounted at /336/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 387.214750][ T9163] kmem: usage 2572kB, limit 9007199254740988kB, failcnt 0 [ 387.307712][ T9163] Memory cgroup stats for /syz0: [ 387.307912][ T9163] anon 667648 [ 387.307912][ T9163] file 311271424 [ 387.307912][ T9163] kernel 2633728 [ 387.307912][ T9163] kernel_stack 163840 [ 387.307912][ T9163] pagetables 757760 [ 387.307912][ T9163] sec_pagetables 0 [ 387.307912][ T9163] percpu 3552 [ 387.307912][ T9163] sock 0 [ 387.307912][ T9163] vmalloc 0 [ 387.307912][ T9163] shmem 311218176 [ 387.307912][ T9163] zswap 0 [ 387.307912][ T9163] zswapped 0 [ 387.307912][ T9163] file_mapped 190861312 [ 387.307912][ T9163] file_dirty 53248 [ 387.307912][ T9163] file_writeback 0 [ 387.307912][ T9163] swapcached 108888064 [ 387.307912][ T9163] anon_thp 0 [ 387.307912][ T9163] file_thp 0 [ 387.307912][ T9163] shmem_thp 0 [ 387.307912][ T9163] inactive_anon 75739136 [ 387.307912][ T9163] active_anon 236146688 [ 387.307912][ T9163] inactive_file 0 [ 387.307912][ T9163] active_file 53248 [ 387.307912][ T9163] unevictable 0 [ 387.307912][ T9163] slab_reclaimable 1191352 [ 387.307912][ T9163] slab_unreclaimable 426752 [ 387.436638][ T4278] Bluetooth: hci3: command 0x9800 tx timeout [ 387.451560][ T9163] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.1568,pid=9076,uid=0 [ 387.474134][ T9163] Memory cgroup out of memory: Killed process 9076 (syz.0.1568) total-vm:200552kB, anon-rss:1532kB, file-rss:20608kB, shmem-rss:120776kB, UID:0 pgtables:344kB oom_score_adj:1000 [ 387.492217][ T8806] syz.3.1470 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 387.514160][ T8806] CPU: 0 PID: 8806 Comm: syz.3.1470 Not tainted syzkaller #0 [ 387.521620][ T8806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 387.531700][ T8806] Call Trace: [ 387.534994][ T8806] [ 387.537939][ T8806] dump_stack_lvl+0x188/0x24e [ 387.542647][ T8806] ? ___ratelimit+0x14e/0x610 [ 387.547353][ T8806] ? show_regs_print_info+0x12/0x12 [ 387.552583][ T8806] ? load_image+0x410/0x410 [ 387.557104][ T8806] ? ___ratelimit+0x474/0x610 [ 387.561810][ T8806] ? radix_tree_cpu_dead+0x160/0x160 [ 387.567120][ T8806] dump_header+0xd8/0x820 [ 387.571490][ T8806] oom_kill_process+0x361/0x550 [ 387.576364][ T8806] out_of_memory+0xe25/0x1220 [ 387.581070][ T8806] ? __mutex_lock+0x3ba/0xae0 [ 387.585783][ T8806] ? mutex_lock_nested+0x10/0x10 [ 387.590746][ T8806] ? unregister_oom_notifier+0x20/0x20 [ 387.596243][ T8806] mem_cgroup_out_of_memory+0x2c0/0x390 [ 387.601819][ T8806] ? mem_cgroup_oom_trylock+0x210/0x210 [ 387.607403][ T8806] ? do_raw_spin_unlock+0x11d/0x230 [ 387.612641][ T8806] try_charge_memcg+0xc9d/0x17c0 [ 387.617636][ T8806] ? percpu_ref_put+0x180/0x180 [ 387.622542][ T8806] ? get_mem_cgroup_from_mm+0x34/0x290 [ 387.628044][ T8806] charge_memcg+0x117/0x3b0 [ 387.632587][ T8806] ? __mem_cgroup_charge+0x80/0x80 [ 387.637739][ T8806] ? get_mem_cgroup_from_mm+0x34/0x290 [ 387.643229][ T8806] ? get_mem_cgroup_from_mm+0x34/0x290 [ 387.648722][ T8806] ? get_mem_cgroup_from_mm+0x1ae/0x290 [ 387.654304][ T8806] __mem_cgroup_charge+0x21/0x80 [ 387.659276][ T8806] shmem_add_to_page_cache+0x8d7/0x1c90 [ 387.664855][ T8806] ? __filemap_get_folio+0x10f/0xde0 [ 387.670181][ T8806] ? __filemap_get_folio+0x10f/0xde0 [ 387.675512][ T8806] ? put_page+0x270/0x270 [ 387.679887][ T8806] ? mark_lock+0x94/0x320 [ 387.684355][ T8806] shmem_get_folio_gfp+0x1663/0x35e0 [ 387.689708][ T8806] shmem_write_begin+0xee/0x3f0 [ 387.694781][ T8806] generic_perform_write+0x2fa/0x5c0 [ 387.700116][ T8806] ? generic_file_direct_write+0x330/0x330 [ 387.706006][ T8806] ? __file_remove_privs+0x5f0/0x5f0 [ 387.711333][ T8806] ? rwsem_write_trylock+0x135/0x1c0 [ 387.716653][ T8806] ? clear_nonspinnable+0x60/0x60 [ 387.721705][ T8806] ? generic_write_checks_count+0x363/0x440 [ 387.727634][ T8806] __generic_file_write_iter+0x148/0x2a0 [ 387.733319][ T8806] generic_file_write_iter+0xab/0x2e0 [ 387.738736][ T8806] __kernel_write_iter+0x298/0x690 [ 387.743890][ T8806] ? vfs_read+0x960/0x960 [ 387.748263][ T8806] ? iov_iter_bvec+0x4a/0x1f0 [ 387.752974][ T8806] dump_user_range+0x40a/0x840 [ 387.757777][ T8806] ? dump_skip+0x40/0x40 [ 387.762046][ T8806] ? dump_emit+0x74/0xe0 [ 387.766339][ T8806] ? dump_emit+0xa2/0xe0 [ 387.770610][ T8806] ? elf_core_dump+0x2aa9/0x3630 [ 387.775580][ T8806] elf_core_dump+0x30ca/0x3630 [ 387.780456][ T8806] ? load_elf_binary+0x2820/0x2820 [ 387.785606][ T8806] ? dump_vma_snapshot+0xaea/0xe40 [ 387.790757][ T8806] ? verify_lock_unused+0x140/0x140 [ 387.795987][ T8806] ? __lock_acquire+0x7c40/0x7c40 [ 387.801040][ T8806] ? mas_next_entry+0xe03/0xe90 [ 387.805962][ T8806] ? rcu_read_lock_any_held+0xb0/0x130 [ 387.811450][ T8806] ? 0xffffffffff600000 [ 387.815624][ T8806] ? getname_kernel+0x142/0x2f0 [ 387.820511][ T8806] do_coredump+0x16c1/0x2480 [ 387.825159][ T8806] ? nfs_stat_to_errno+0x170/0x170 [ 387.830324][ T8806] ? lock_chain_count+0x20/0x20 [ 387.835217][ T8806] ? _raw_spin_unlock_irq+0x1f/0x40 [ 387.840442][ T8806] ? lockdep_hardirqs_on+0x94/0x140 [ 387.845685][ T8806] get_signal+0x1093/0x1340 [ 387.850233][ T8806] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 387.856255][ T8806] arch_do_signal_or_restart+0xc4/0x1310 [ 387.861929][ T8806] ? __send_signal_locked+0xb38/0xde0 [ 387.867337][ T8806] ? get_sigframe_size+0x10/0x10 [ 387.872306][ T8806] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 387.878324][ T8806] ? exit_to_user_mode_loop+0x3b/0x110 [ 387.883816][ T8806] exit_to_user_mode_loop+0x70/0x110 [ 387.889133][ T8806] exit_to_user_mode_prepare+0xee/0x180 [ 387.894707][ T8806] irqentry_exit_to_user_mode+0x5/0x30 [ 387.900197][ T8806] exc_page_fault+0x88/0x100 [ 387.904815][ T8806] asm_exc_page_fault+0x22/0x30 [ 387.909697][ T8806] RIP: 0033:0x7fa2fee53bd7 [ 387.914130][ T8806] Code: e8 fe f9 ff ff 89 f2 48 8d 3d 5d 4f 1b 00 48 8d 35 c3 0a 1e 00 31 c0 e8 37 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 387.933810][ T8806] RSP: 002b:00007fa2ffeb6120 EFLAGS: 00010202 [ 387.939912][ T8806] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007fa2fef9e0d9 [ 387.947909][ T8806] RDX: 00007fa2ffeb6140 RSI: 00007fa2ffeb6270 RDI: 000000000000000b [ 387.955908][ T8806] RBP: 00007fa2ff035024 R08: 0000000000000000 R09: 0000000000000000 [ 387.963912][ T8806] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 387.971913][ T8806] R13: 00007fa2ff226038 R14: 00007fa2ff225fa0 R15: 00007ffffb2c0c18 [ 387.979927][ T8806] [ 387.992463][ T8806] memory: usage 307200kB, limit 307200kB, failcnt 27050 [ 387.999460][ T8806] memory+swap: usage 362932kB, limit 9007199254740988kB, failcnt 0 [ 388.008213][ T8806] kmem: usage 2136kB, limit 9007199254740988kB, failcnt 0 [ 388.031681][ T8806] Memory cgroup stats for /syz3: [ 388.031877][ T8806] anon 282624 [ 388.031877][ T8806] file 312102912 [ 388.031877][ T8806] kernel 2187264 [ 388.031877][ T8806] kernel_stack 163840 [ 388.031877][ T8806] pagetables 663552 [ 388.031877][ T8806] sec_pagetables 0 [ 388.031877][ T8806] percpu 9888 [ 388.031877][ T8806] sock 0 [ 388.031877][ T8806] vmalloc 0 [ 388.031877][ T8806] shmem 312000512 [ 388.031877][ T8806] zswap 0 [ 388.031877][ T8806] zswapped 0 [ 388.031877][ T8806] file_mapped 183230464 [ 388.031877][ T8806] file_dirty 102400 [ 388.031877][ T8806] file_writeback 0 [ 388.031877][ T8806] swapcached 167587840 [ 388.031877][ T8806] anon_thp 0 [ 388.031877][ T8806] file_thp 0 [ 388.031877][ T8806] shmem_thp 0 [ 388.031877][ T8806] inactive_anon 66408448 [ 388.031877][ T8806] active_anon 245874688 [ 388.031877][ T8806] inactive_file 0 [ 388.031877][ T8806] active_file 102400 [ 388.031877][ T8806] unevictable 0 [ 388.031877][ T8806] slab_reclaimable 1069456 [ 388.031877][ T8806] slab_unreclaimable 219064 [ 388.065107][ T4272] EXT4-fs (loop1): unmounting filesystem. [ 388.212206][ T4282] EXT4-fs (loop4): unmounting filesystem. [ 388.212884][ T8806] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz3,mems_allowed=0-1,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.1470,pid=8806,uid=0 [ 388.237631][ T8806] Memory cgroup out of memory: Killed process 8806 (syz.3.1470) total-vm:202600kB, anon-rss:1244kB, file-rss:20608kB, shmem-rss:106876kB, UID:0 pgtables:316kB oom_score_adj:1000 [ 388.401857][ T9552] ext4 filesystem being mounted at /371/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 388.960544][ T9587] 9pnet_virtio: no channels available for device syz [ 389.211338][ T9589] device syzkaller0 entered promiscuous mode [ 389.348285][ T9592] device syzkaller0 entered promiscuous mode [ 389.357123][ T4271] EXT4-fs (loop0): unmounting filesystem. [ 389.947148][ T9597] loop0: detected capacity change from 0 to 512 [ 390.131383][ T9597] ext4: Bad value for 'data' [ 390.531756][ T4278] Bluetooth: Wrong link type (-22) [ 390.543951][ T29] oom_reaper: reaped process 8806 (syz.3.1470), now anon-rss:0kB, file-rss:9792kB, shmem-rss:0kB [ 390.676487][ T9012] syz.3.1544 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 390.721685][ T9012] CPU: 1 PID: 9012 Comm: syz.3.1544 Not tainted syzkaller #0 [ 390.729139][ T9012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 390.739223][ T9012] Call Trace: [ 390.742518][ T9012] [ 390.745455][ T9012] dump_stack_lvl+0x188/0x24e [ 390.750182][ T9012] ? ___ratelimit+0x14e/0x610 [ 390.754896][ T9012] ? show_regs_print_info+0x12/0x12 [ 390.760137][ T9012] ? load_image+0x410/0x410 [ 390.764669][ T9012] ? ___ratelimit+0x474/0x610 [ 390.769372][ T9012] ? radix_tree_cpu_dead+0x160/0x160 [ 390.774676][ T9012] dump_header+0xd8/0x820 [ 390.779032][ T9012] oom_kill_process+0x361/0x550 [ 390.783901][ T9012] out_of_memory+0xe25/0x1220 [ 390.788586][ T9012] ? mutex_lock_nested+0x10/0x10 [ 390.793525][ T9012] ? unregister_oom_notifier+0x20/0x20 [ 390.798989][ T9012] mem_cgroup_out_of_memory+0x2c0/0x390 [ 390.804542][ T9012] ? mem_cgroup_oom_trylock+0x210/0x210 [ 390.810098][ T9012] ? do_raw_spin_unlock+0x11d/0x230 [ 390.815304][ T9012] try_charge_memcg+0xc9d/0x17c0 [ 390.820263][ T9012] ? percpu_ref_put+0x180/0x180 [ 390.825111][ T9012] ? mark_lock+0x94/0x320 [ 390.829460][ T9012] ? get_mem_cgroup_from_mm+0x34/0x290 [ 390.834927][ T9012] charge_memcg+0x117/0x3b0 [ 390.839431][ T9012] ? __mem_cgroup_charge+0x80/0x80 [ 390.844543][ T9012] ? get_mem_cgroup_from_mm+0x34/0x290 [ 390.850004][ T9012] ? get_mem_cgroup_from_mm+0x34/0x290 [ 390.855465][ T9012] ? get_mem_cgroup_from_mm+0x1ae/0x290 [ 390.861012][ T9012] __mem_cgroup_charge+0x21/0x80 [ 390.865954][ T9012] shmem_add_to_page_cache+0x8d7/0x1c90 [ 390.871504][ T9012] ? __filemap_get_folio+0x10f/0xde0 [ 390.876795][ T9012] ? __filemap_get_folio+0x10f/0xde0 [ 390.882085][ T9012] ? put_page+0x270/0x270 [ 390.886446][ T9012] ? mark_lock+0x94/0x320 [ 390.890818][ T9012] shmem_get_folio_gfp+0x1663/0x35e0 [ 390.896133][ T9012] ? __lock_acquire+0x7c40/0x7c40 [ 390.901186][ T9012] shmem_fault+0x1b6/0x790 [ 390.905638][ T9012] ? shmem_fallocate+0xfc0/0xfc0 [ 390.910622][ T9012] ? filemap_map_pages+0x1ae/0x11e0 [ 390.915829][ T9012] ? count_memcg_event_mm+0x36b/0x3c0 [ 390.921200][ T9012] ? filemap_read_folio+0x7a0/0x7a0 [ 390.926397][ T9012] ? count_memcg_event_mm+0x8a/0x3c0 [ 390.931685][ T9012] __do_fault+0x13b/0x4e0 [ 390.936012][ T9012] ? handle_mm_fault+0x2600/0x3d40 [ 390.941122][ T9012] handle_mm_fault+0x2610/0x3d40 [ 390.946097][ T9012] ? numa_migrate_prep+0x250/0x250 [ 390.951245][ T9012] __get_user_pages+0x40d/0xec0 [ 390.956119][ T9012] ? populate_vma_page_range+0x2b0/0x2b0 [ 390.961764][ T9012] ? up_write+0x1b6/0x410 [ 390.966121][ T9012] ? __generic_file_write_iter+0x148/0x2a0 [ 390.971947][ T9012] ? get_dump_page+0xee/0x670 [ 390.976632][ T9012] ? down_read_killable+0x1cc/0x340 [ 390.981844][ T9012] get_dump_page+0x18c/0x670 [ 390.986485][ T9012] ? fault_in_readable+0x1f0/0x1f0 [ 390.991610][ T9012] ? kasan_check_range+0x84/0x290 [ 390.996656][ T9012] ? iov_iter_bvec+0x4a/0x1f0 [ 391.001375][ T9012] dump_user_range+0x123/0x840 [ 391.006162][ T9012] ? dump_skip+0x40/0x40 [ 391.010419][ T9012] ? dump_emit+0x74/0xe0 [ 391.014688][ T9012] ? dump_emit+0xa2/0xe0 [ 391.018961][ T9012] ? elf_core_dump+0x2aa9/0x3630 [ 391.023916][ T9012] elf_core_dump+0x30ca/0x3630 [ 391.028703][ T9012] ? load_elf_binary+0x2820/0x2820 [ 391.033823][ T9012] ? dump_vma_snapshot+0xaea/0xe40 [ 391.038959][ T9012] ? verify_lock_unused+0x140/0x140 [ 391.044180][ T9012] ? __lock_acquire+0x7c40/0x7c40 [ 391.049311][ T9012] ? mas_next_entry+0xe03/0xe90 [ 391.054202][ T9012] ? rcu_read_lock_any_held+0xb0/0x130 [ 391.059669][ T9012] ? 0xffffffffff600000 [ 391.063839][ T9012] ? getname_kernel+0x142/0x2f0 [ 391.068709][ T9012] do_coredump+0x16c1/0x2480 [ 391.073331][ T9012] ? nfs_stat_to_errno+0x170/0x170 [ 391.078490][ T9012] ? lock_chain_count+0x20/0x20 [ 391.083388][ T9012] ? _raw_spin_unlock_irq+0x1f/0x40 [ 391.088589][ T9012] ? lockdep_hardirqs_on+0x94/0x140 [ 391.093788][ T9012] get_signal+0x1093/0x1340 [ 391.098301][ T9012] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 391.104289][ T9012] arch_do_signal_or_restart+0xc4/0x1310 [ 391.109927][ T9012] ? __send_signal_locked+0xb38/0xde0 [ 391.115308][ T9012] ? get_sigframe_size+0x10/0x10 [ 391.120268][ T9012] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 391.126276][ T9012] ? exit_to_user_mode_loop+0x3b/0x110 [ 391.131749][ T9012] exit_to_user_mode_loop+0x70/0x110 [ 391.137041][ T9012] exit_to_user_mode_prepare+0xee/0x180 [ 391.142591][ T9012] irqentry_exit_to_user_mode+0x5/0x30 [ 391.148047][ T9012] exc_page_fault+0x88/0x100 [ 391.152637][ T9012] asm_exc_page_fault+0x22/0x30 [ 391.157486][ T9012] RIP: 0033:0x7fa2fee53bd7 [ 391.161896][ T9012] Code: e8 fe f9 ff ff 89 f2 48 8d 3d 5d 4f 1b 00 48 8d 35 c3 0a 1e 00 31 c0 e8 37 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 391.181499][ T9012] RSP: 002b:00007fa2ffe74120 EFLAGS: 00010202 [ 391.187565][ T9012] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007fa2fef9e0d9 [ 391.195531][ T9012] RDX: 00007fa2ffe74140 RSI: 00007fa2ffe74270 RDI: 000000000000000b [ 391.203497][ T9012] RBP: 00007fa2ff035024 R08: 0000000000000000 R09: 0000000000000000 [ 391.211461][ T9012] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 391.219425][ T9012] R13: 00007fa2ff226218 R14: 00007fa2ff226180 R15: 00007ffffb2c0c18 [ 391.227406][ T9012] [ 391.230501][ C1] vkms_vblank_simulate: vblank timer overrun [ 391.377572][ T9012] memory: usage 305840kB, limit 307200kB, failcnt 27513 [ 391.418044][ T9012] memory+swap: usage 361532kB, limit 9007199254740988kB, failcnt 0 [ 391.480711][ T9012] kmem: usage 1820kB, limit 9007199254740988kB, failcnt 0 [ 391.542016][ T9012] Memory cgroup stats for /syz3: [ 391.542207][ T9012] anon 360448 [ 391.542207][ T9012] file 310894592 [ 391.542207][ T9012] kernel 1863680 [ 391.542207][ T9012] kernel_stack 163840 [ 391.542207][ T9012] pagetables 364544 [ 391.542207][ T9012] sec_pagetables 0 [ 391.542207][ T9012] percpu 9888 [ 391.542207][ T9012] sock 0 [ 391.542207][ T9012] vmalloc 0 [ 391.542207][ T9012] shmem 310665216 [ 391.542207][ T9012] zswap 0 [ 391.542207][ T9012] zswapped 0 [ 391.542207][ T9012] file_mapped 73936896 [ 391.542207][ T9012] file_dirty 102400 [ 391.542207][ T9012] file_writeback 0 [ 391.542207][ T9012] swapcached 167849984 [ 391.542207][ T9012] anon_thp 0 [ 391.542207][ T9012] file_thp 0 [ 391.542207][ T9012] shmem_thp 0 [ 391.542207][ T9012] inactive_anon 133316608 [ 391.542207][ T9012] active_anon 177704960 [ 391.542207][ T9012] inactive_file 0 [ 391.542207][ T9012] active_file 229376 [ 391.542207][ T9012] unevictable 0 [ 391.542207][ T9012] slab_reclaimable 1070496 [ 391.542207][ T9012] slab_unreclaimable 199104 [ 391.644215][ T9597] loop0: detected capacity change from 0 to 512 [ 391.676989][ T9012] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz3,mems_allowed=0-1,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.1544,pid=9012,uid=0 [ 391.697595][ T9012] Memory cgroup out of memory: Killed process 9012 (syz.3.1544) total-vm:200816kB, anon-rss:1380kB, file-rss:20608kB, shmem-rss:71912kB, UID:0 pgtables:244kB oom_score_adj:1000 [ 391.712944][ T9597] EXT4-fs error (device loop0): mb_free_blocks:1839: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 391.730183][ T9597] EXT4-fs error (device loop0): ext4_do_update_inode:5279: inode #11: comm syz.0.1740: corrupted inode contents [ 391.749005][ T9597] EXT4-fs error (device loop0): ext4_dirty_inode:6156: inode #11: comm syz.0.1740: mark_inode_dirty error [ 391.761524][ T9597] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #11: comm syz.0.1740: invalid indirect mapped block 1 (level 1) [ 391.779726][ T9597] EXT4-fs error (device loop0): ext4_do_update_inode:5279: inode #11: comm syz.0.1740: corrupted inode contents [ 391.794151][ T9597] EXT4-fs error (device loop0) in ext4_orphan_del:303: Corrupt filesystem [ 391.803517][ T9597] EXT4-fs error (device loop0): ext4_do_update_inode:5279: inode #11: comm syz.0.1740: corrupted inode contents [ 391.815856][ T9597] EXT4-fs error (device loop0): ext4_truncate:4325: inode #11: comm syz.0.1740: mark_inode_dirty error [ 391.827958][ T9597] EXT4-fs error (device loop0) in ext4_process_orphan:345: Corrupt filesystem [ 391.837684][ T9597] EXT4-fs (loop0): 1 truncate cleaned up [ 391.843456][ T9597] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 392.109121][ T4271] EXT4-fs (loop0): unmounting filesystem. [ 392.269603][ T9622] loop4: detected capacity change from 0 to 128 [ 392.340292][ T9622] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 392.381983][ T9622] ext4 filesystem being mounted at /367/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 392.511799][ T126] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 392.719184][ T126] usb 2-1: Using ep0 maxpacket: 8 [ 392.726422][ T126] usb 2-1: config 0 has no interfaces? [ 392.743322][ T126] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 392.777931][ T126] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 392.815292][ T126] usb 2-1: config 0 descriptor?? [ 392.921468][ T4282] EXT4-fs (loop4): unmounting filesystem. [ 392.991766][ T4318] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 393.011571][ T9637] IPv6: ADDRCONF(NETDEV_CHANGE): eql: link becomes ready [ 393.046213][ T126] usb 2-1: USB disconnect, device number 6 [ 393.065521][ T9637] IPv6: ADDRCONF(NETDEV_CHANGE): wpan0: link becomes ready [ 393.078502][ T9637] IPv6: ADDRCONF(NETDEV_CHANGE): nr0: link becomes ready [ 393.122259][ T9637] IPv6: ADDRCONF(NETDEV_CHANGE): nr1: link becomes ready [ 393.129890][ T9637] IPv6: ADDRCONF(NETDEV_CHANGE): nr2: link becomes ready [ 393.142717][ T9637] IPv6: ADDRCONF(NETDEV_CHANGE): nr3: link becomes ready [ 393.160134][ T9637] IPv6: ADDRCONF(NETDEV_CHANGE): nr4: link becomes ready [ 393.183122][ T4318] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32 [ 393.192930][ T9637] IPv6: ADDRCONF(NETDEV_CHANGE): lapb0: link becomes ready [ 393.207701][ T9637] IPv6: ADDRCONF(NETDEV_CHANGE): lapb1: link becomes ready [ 393.218546][ T4318] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 393.227482][ T9637] IPv6: ADDRCONF(NETDEV_CHANGE): lapb2: link becomes ready [ 393.248512][ T4318] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 393.253623][ T9637] IPv6: ADDRCONF(NETDEV_CHANGE): lapb3: link becomes ready [ 393.277369][ T4318] usb 1-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice= 1.00 [ 393.287192][ T9637] IPv6: ADDRCONF(NETDEV_CHANGE): lapb4: link becomes ready [ 393.304353][ T4318] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 393.305833][ T9637] IPv6: ADDRCONF(NETDEV_CHANGE): lapb5: link becomes ready [ 393.338595][ T9634] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 393.488371][ T4318] cyberjack 1-1:1.0: Reiner SCT Cyberjack USB card reader converter detected [ 393.955876][ T4318] usb 1-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 394.081809][ T4318] usb 1-1: USB disconnect, device number 2 [ 394.155177][ T4318] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 394.209335][ T4318] cyberjack 1-1:1.0: device disconnected [ 394.302306][ T9650] device syzkaller0 entered promiscuous mode [ 394.322969][ T9654] loop3: detected capacity change from 0 to 512 [ 394.388457][ T9654] ext4: Bad value for 'data' [ 395.321111][ T9669] sch_fq: defrate 2 ignored. [ 395.412320][ T9671] device syzkaller0 entered promiscuous mode [ 395.633617][ T9680] device syzkaller0 entered promiscuous mode [ 395.909924][ T9692] loop3: detected capacity change from 0 to 512 [ 395.981405][ T9692] EXT4-fs error (device loop3): mb_free_blocks:1839: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 395.996232][ T9692] EXT4-fs error (device loop3): ext4_do_update_inode:5279: inode #11: comm syz.3.1760: corrupted inode contents [ 396.022766][ T9692] EXT4-fs error (device loop3): ext4_dirty_inode:6156: inode #11: comm syz.3.1760: mark_inode_dirty error [ 396.037128][ T9692] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.1760: invalid indirect mapped block 1 (level 1) [ 396.052083][ T9692] EXT4-fs error (device loop3): ext4_do_update_inode:5279: inode #11: comm syz.3.1760: corrupted inode contents [ 396.064454][ T9692] EXT4-fs error (device loop3) in ext4_orphan_del:303: Corrupt filesystem [ 396.075271][ T9692] EXT4-fs error (device loop3): ext4_do_update_inode:5279: inode #11: comm syz.3.1760: corrupted inode contents [ 396.087633][ T9692] EXT4-fs error (device loop3): ext4_truncate:4325: inode #11: comm syz.3.1760: mark_inode_dirty error [ 396.099580][ T9692] EXT4-fs error (device loop3) in ext4_process_orphan:345: Corrupt filesystem [ 396.109112][ T9692] EXT4-fs (loop3): 1 truncate cleaned up [ 396.114850][ T9692] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 396.741654][ T0] NOHZ tick-stop error: local softirq work is pending, handler #30a!!! [ 398.572817][ T9725] dummy_hcd dummy_hcd.0: remove, state 4 [ 398.580761][ T9725] usb usb1: USB disconnect, device number 1 [ 398.641990][ T9725] dummy_hcd dummy_hcd.0: stopped [ 398.647024][ T9725] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 399.578300][ T9731] block device autoloading is deprecated and will be removed. [ 400.012016][ T9730] md/raid10:md0: not clean -- starting background reconstruction [ 400.091858][ T9730] md/raid10:md0: active with 1 out of 2 devices [ 400.104331][ T9730] md0: detected capacity change from 0 to 2048 [ 400.157788][ T9743] md: resync of RAID array md0 [ 400.226987][ T9743] md: md0: resync done. [ 400.357624][ T9749] md: recovery of RAID array md0 [ 400.451183][ T9749] md: md0: recovery done. [ 400.861773][ T126] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 401.074794][ T126] usb 2-1: Using ep0 maxpacket: 8 [ 401.085791][ T126] usb 2-1: config 0 has no interfaces? [ 401.144507][ T126] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 401.171403][ T126] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.210975][ T126] usb 2-1: config 0 descriptor?? [ 401.278353][ T9764] gadgetfs: bound to dummy_udc driver [ 401.321980][ T9764] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 401.333763][ T9764] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 401.342196][ T9764] CPU: 1 PID: 9764 Comm: syz.0.1795 Not tainted syzkaller #0 [ 401.349587][ T9764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 401.359664][ T9764] RIP: 0010:dummy_udc_start+0xb7/0x1d0 [ 401.365151][ T9764] Code: 00 00 ff 24 c5 40 f0 3e 8b e8 e5 30 02 fb eb 13 e8 de 30 02 fb eb 0c e8 d7 30 02 fb eb 05 e8 d0 30 02 fb 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 6a 6a 53 fb 4d 8b 36 4c 89 f7 e8 [ 401.384786][ T9764] RSP: 0018:ffffc900047f78b0 EFLAGS: 00010246 [ 401.390856][ T9764] RAX: 0000000000000000 RBX: ffffffff8d80b7e0 RCX: 0000000000080000 [ 401.398829][ T9764] RDX: ffffc90005459000 RSI: 0000000000013140 RDI: 0000000000013141 [ 401.406798][ T9764] RBP: ffff88814637f000 R08: ffff88802f075a00 R09: 0000000000000004 [ 401.414764][ T9764] R10: 0000000000000005 R11: 0000000000000002 R12: dffffc0000000000 [ 401.422734][ T9764] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003 [ 401.430698][ T9764] FS: 00007f043691d6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 401.439625][ T9764] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 401.446205][ T9764] CR2: 000000110c259e4e CR3: 000000007d5c1000 CR4: 00000000003526e0 [ 401.454180][ T9764] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 401.462151][ T9764] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 401.470118][ T9764] Call Trace: [ 401.473388][ T9764] [ 401.476313][ T9764] ? dummy_pullup+0x120/0x120 [ 401.481002][ T9764] gadget_bind_driver+0x38c/0x760 [ 401.486036][ T9764] ? gadget_match_driver+0x130/0x130 [ 401.491326][ T9764] really_probe+0x24a/0xb40 [ 401.495833][ T9764] ? pm_runtime_barrier+0x147/0x1c0 [ 401.501032][ T9764] __driver_probe_device+0x1f5/0x390 [ 401.506407][ T9764] driver_probe_device+0x4f/0x420 [ 401.511433][ T9764] __driver_attach+0x43d/0x6c0 [ 401.516195][ T9764] ? driver_attach+0x40/0x40 [ 401.520784][ T9764] bus_for_each_dev+0x182/0x1f0 [ 401.525629][ T9764] ? kobject_add+0x230/0x230 [ 401.530251][ T9764] ? bus_remove_file+0xd0/0xd0 [ 401.535012][ T9764] ? do_raw_spin_unlock+0x11d/0x230 [ 401.540209][ T9764] bus_add_driver+0x324/0x5d0 [ 401.544886][ T9764] driver_register+0x32d/0x430 [ 401.549650][ T9764] usb_gadget_register_driver_owner+0xf5/0x260 [ 401.555811][ T9764] dev_config+0xe45/0x1260 [ 401.560272][ T9764] ? rcu_read_lock_any_held+0xb0/0x130 [ 401.565736][ T9764] ? rcu_read_lock_bh_held+0xf0/0xf0 [ 401.571025][ T9764] ? end_current_label_crit_section+0x14b/0x170 [ 401.577273][ T9764] ? ep0_read+0x1880/0x1880 [ 401.581808][ T9764] ? common_file_perm+0x171/0x1c0 [ 401.586844][ T9764] ? ep0_read+0x1880/0x1880 [ 401.591352][ T9764] vfs_write+0x2dc/0x9a0 [ 401.595600][ T9764] ? file_end_write+0x250/0x250 [ 401.600453][ T9764] ? __fget_files+0x28/0x460 [ 401.605044][ T9764] ? __fget_files+0x3fc/0x460 [ 401.609728][ T9764] ? __fdget_pos+0x2ae/0x360 [ 401.614327][ T9764] ? ksys_write+0x70/0x260 [ 401.618756][ T9764] ksys_write+0x14d/0x260 [ 401.623089][ T9764] ? __ia32_sys_read+0x80/0x80 [ 401.627859][ T9764] ? lockdep_hardirqs_on+0x94/0x140 [ 401.633055][ T9764] do_syscall_64+0x4c/0xa0 [ 401.637471][ T9764] ? clear_bhb_loop+0x60/0xb0 [ 401.642150][ T9764] ? clear_bhb_loop+0x60/0xb0 [ 401.646914][ T9764] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 401.652809][ T9764] RIP: 0033:0x7f043599e0d9 [ 401.657225][ T9764] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 401.676834][ T9764] RSP: 002b:00007f043691d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 401.685244][ T9764] RAX: ffffffffffffffda RBX: 00007f0435c25fa0 RCX: 00007f043599e0d9 [ 401.693211][ T9764] RDX: 0000000000000048 RSI: 0000200000000200 RDI: 0000000000000003 [ 401.701180][ T9764] RBP: 00007f0435a35024 R08: 0000000000000000 R09: 0000000000000000 [ 401.709144][ T9764] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 401.717114][ T9764] R13: 00007f0435c26038 R14: 00007f0435c25fa0 R15: 00007ffe26bbc658 [ 401.725088][ T9764] [ 401.728115][ T9764] Modules linked in: [ 401.767699][ T126] usb 2-1: USB disconnect, device number 7 [ 401.833828][ T9012] syz.3.1544 (9012) used greatest stack depth: 17968 bytes left [ 401.866507][ T9764] ---[ end trace 0000000000000000 ]--- [ 401.872193][ T9764] RIP: 0010:dummy_udc_start+0xb7/0x1d0 [ 401.884037][ T4279] EXT4-fs (loop3): unmounting filesystem. [ 401.920861][ T9764] Code: 00 00 ff 24 c5 40 f0 3e 8b e8 e5 30 02 fb eb 13 e8 de 30 02 fb eb 0c e8 d7 30 02 fb eb 05 e8 d0 30 02 fb 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 6a 6a 53 fb 4d 8b 36 4c 89 f7 e8 [ 401.942385][ T9764] RSP: 0018:ffffc900047f78b0 EFLAGS: 00010246 [ 401.948617][ T9764] RAX: 0000000000000000 RBX: ffffffff8d80b7e0 RCX: 0000000000080000 [ 401.960330][ T9764] RDX: ffffc90005459000 RSI: 0000000000013140 RDI: 0000000000013141 [ 401.971586][ T9764] RBP: ffff88814637f000 R08: ffff88802f075a00 R09: 0000000000000004 [ 401.981115][ T9764] R10: 0000000000000005 R11: 0000000000000002 R12: dffffc0000000000 [ 401.990040][ T9764] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003 [ 401.999509][ T9764] FS: 00007f043691d6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 402.006828][ T8806] syz.3.1470 (8806) used greatest stack depth: 17712 bytes left [ 402.009428][ T9764] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 402.024514][ T9764] CR2: 00007fcddeff14b8 CR3: 000000007d5c1000 CR4: 00000000003506e0 [ 402.032923][ T9764] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 402.041097][ T9764] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 402.050921][ T9764] Kernel panic - not syncing: Fatal exception [ 402.057288][ T9764] Kernel Offset: disabled [ 402.061619][ T9764] Rebooting in 86400 seconds..