last executing test programs: 4m48.273848175s ago: executing program 1 (id=7277): r0 = socket$netlink(0x10, 0x3, 0x15) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f00000005c0)=@get={0x1, &(0x7f00000018c0)=""/4096, 0x3d}) 4m48.101381938s ago: executing program 1 (id=7280): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$inet(r0, &(0x7f0000002780)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1400000000000000100100000d00000001000000000000001400000000000000100100000a"], 0x30}, 0x0) 4m47.826564369s ago: executing program 1 (id=7285): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./file2\x00', 0x10050, &(0x7f0000000840), 0x3, 0x52c, &(0x7f0000000880)="$eJzs3dFrLFcZAPBvJtnb5N7UpOqDFqzFVm6qZpM03jb4UBVEnwpqxddrTDYhZJO9JBt7E4pN8Q8QRLTgiz75IvgHCNIX30Uo6ItPoqJoe6sPCm1HZnb23pvNbpJ73WQg+f3gZOfMzM73nQ179pydYSeAS+vJiJiOiJGIeCYiJsv1aVnioFPy/d6588pyXpLIspfeSiIp13WP9Uj5eK182lhEfP0rEd9Ojsbd2dvfWGo2G9tlfba9mbybZfsz65tLa421xtbCwvxzi88v3licG0o7pyLihS/99Uff//mXX/j1Z17+082/T383T+u/WfZq9LRjmDpNrxWvRddoRGyfRbCKjBYt7LhRcS4AABwvH+9/MCI+UYz/J2OkGM0BAAAAF0n2+Yl4N4nIAAAAgAsrjYiJSNJ6eb3vRKRpvd65hvfDcTVttnban15t7W6t5NsipqKWrq43G3PltQNTUUvy+nx5jW23/mxPfSEiHouIH06OF/X6cqu5UvWXHwAAAHBJXOuZ//97sjP/LxxUnBwAAAAwPFNVJwAAAACcOfN/AAAAuPjM/wEAAOBC++qLL+Yl697/euWfsbvR+s7MSmNno765u1xfbm3fqq+1WmvFb/ZtnnS8Zqt167OxtXt7tt3Yac/u7O3f3GztbrVvrh+6BTYAAABwjh77+Bt/SCLi4HPjRcldKbfVIrKR+3cerSJD4KykD7LzX84uD+D83f/5Pl5hHsD5M6SHy6tWdQJA5ZITtg+8eOe3w88FAAA4G9c/Ovj8/1urlaYGnLHy/H9y0vwfuHhGqk4AqEzn/N/7WUfV2QDnqXbcCMCkAC68dDjn/0+4lDDRoQAAQMUmipKk9XIeMBFpWq9HPFrcFqCWrK43G3MR8YGI+P1k7ZG8Pl88MzGaBwAAAAAAAAAAAAAAAAAAAAAAAIBTyrIksocx88eHehoAAABw/iLSv3XvzHV98umJ3u8HriT/mSweI+Lln7z049tL7fb2fL7+7bvr26+X65+t4hsMAAAAoFd3nt6dxwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAML1z55XlbjnPuP/4YkRM9Ys/GmPF41jUIuLqv5IYve95SUSMDCH+wWsR8ZF+8ZM8rZgqszgU/0pEGhHjw4rf9/U/Jn504l8bQny4zN7I+58v9Hv/pfFk8dj//Tdalv/X4P4vvdv/jQzo/x4ddNDa4erjb/5ydmD81yIeH+3f/3TjJ/nx+sR/6pRt/NY39vcHbct+FnG9X/+XHI412968Nbuztz+zvrm01lhrbC0szD+3+PzijcW52dX1ZqP82zfGDz72q/fv1d470v6rx/S/RfsHvP5Pn7L97715+86HOos9/5moxU+zbPqp/v//wqeOxu9+9n2y3Cuv569h+vo3+8Z/4he/e2JQbnn7Vwa0f+yE9k+fsv3PfO17fz7lrgDAOdjZ299YajYb2xYsPMBCPu6sPI0kkji6aan6xDoLr5bvsaVm9902pCP/ppwc3V3zdnn8ISZfQV8EAACcrXuD/t4tSTUJAQAAAAAAAAAAAAAAAAAAwCV04s+ADdqURsQpf06sN+ZBNU0FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADjW/wIAAP//ngbSgw==") lstat(&(0x7f0000000180)='./file2\x00', 0x0) 4m47.329181288s ago: executing program 1 (id=7293): syz_mount_image$exfat(&(0x7f0000000480), &(0x7f0000000000)='./file0\x00', 0x800, &(0x7f0000000580)={[{@errors_continue}, {@utf8}, {@iocharset={'iocharset', 0x3d, 'cp850'}}, {@fmask={'fmask', 0x3d, 0x8c1}}, {@iocharset={'iocharset', 0x3d, 'macinuit'}}, {@allow_utime={'allow_utime', 0x3d, 0x4}}, {@keep_last_dots}, {@errors_remount}, {@keep_last_dots}, {@iocharset={'iocharset', 0x3d, 'macinuit'}}, {@namecase}]}, 0x1, 0x1531, &(0x7f0000001f80)="$eJzs3AucTtX6OPDnWWvtMSS9TXIZ1lrP5k1imSTJJUkuSZIkSW4JSZMcSUgMuSUNSch1SC5DSC4Tk8b9fr8kJEmTJCG5Jev/Ef7qVL9zzu/0O86neb6fz/5Yz+z9rP287/Ne1t6YbzoOqtageuV6RAT/FrzwRxIAxAJAPwC4BgACACgdVzru/P7sEpP+vZOwP9fDqVe6AnYlcf+zNu5/1sb9z9q4/1kb9z9r4/5nbdz/rI37z1hWtnFq/mt5y7ob3///66vzh3v4+/8vJLPE6C9Wl7i+E0DMP5vC/c/auP9/WcE/cxD3P2vj/mdVsVe6APZfgN//f0lNfh1m+8MDuf9ZG/efsazsSt9/vtIbRLL2c3ClX3+MMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxrKGU/6i0+AVAFwKr3RdjDHGGGOMMcYY+/P4bFe6AsYYY4wxxhhjjP3fQxAgQUEAMZANYiE75AABAFdDLrgGInAtxMF1kBuuhzyQF/JBfoiHAlAQNBiwQBBCISgMUbgBisCNUBRugmJQHByUgAS4GUrCLVAKboXScBuUgduhLJSD8lAB7oCKcCdUgrugMtwNVaAqVIPqcA/UgHuhJtwHteB+qA0PQB14EOrCQ1APHob68Ag0gEehITwGjaAxNIGm0Ox/lf8idIWXoBt0hyToAT3hZegFvaEP9IV+8Ar0h1dhALwGyTAQBsHrMBjegCHwJgyFYTAc3oIRMBJGwWgYA2MhBcbBeHgbJsA7MBEmwWSYAqkwFabBuzAdZsBMeA9mwfswG+bAXJgHafABzIcFkA4fwkL4CDJgESyGJbAUlsFyWAErYRWshjWwFtbBetgAG2ETbIYtsBW2wXb4GHbAJ7ATdsFu+BT2wGf/Yv7Jv8vvhICAAgUqVBiDMRiLsZgDc2BOzIm5MBdGMIJxGIe5MTfmwTyYD/NhPMZjQSyIBg0SEhbCQhjFKBbBIlgUi2IxLIYOHSZgApbEW7AUlsLSWBrLYBksi+WwHFbAClgRK2IlrISVsTJWwSpYDavhPXgP9sCaWBNrYS2sjbUv3Z7CelgP62N9bIANsCE2xEbYCJtgE2yGzbA5NscW2AJbYStsja2xDbbBREzEttgW22E7bI/tsQN2wI7YETthZ+yc+WI2wJfwJeyOVUQP7Ik9sRcmZ+uDfbEvvoL98VV8FV/DZByIg/B1fB3fwCF4AofiMByOw7GiGImjcDSSGIspmILjcTxOwAk4ESfhJJyCqTgVp+E0nI4zcAa+h7PwfXwf5+AcnIdpmIbzcQGmYzouxJOYgYtwMS7BpbgMl+IKXIkrcDWuwdW4DtfhBtyAm3ATbsEtuA234ceoAPAT3IW7MBn34B7ci3txH+7D/bgfMzETD+ABPIgH8RAewsN4GI/gUTyGR/E4HscTeBJP4Sk8g2fwLD4f/1X9j29alQziPCWUiBExIlbEihwih8gpcopcIpeIiIiIE3Eit8gt8og8Ip/IJ+JFvCgoCgojjCARxgCAiIqoKCKKiKKiqCgmigknnEgQCaKkKClKiVKitLhNlBG3i7KinGjpKogKoqJo5SqJu0RlUVlUEVVFNVFdVBc1RA1RU9QUtUQtUVvUFnXEg6Ku6IF98GFxvjMNxEBsKAZhI9FYyIufYM3FEGwhWopW4kkxDIdiG9HcJYpnRFsxCtuJv4nR+JzoIMZiR/GC6CQ6iy7iRdFVtHDdRHcxEXuInmIK9hK9RR/RV0zHquI9nJW9mnhNJIuBYpB4XczDN8QQ8aYYKoaJ4eItMUKMFKPEaDFGjBUpYpwYL94WE8Q7YqKYJCaLKSJVTBXTxLtiupghZor3xCzxvpgt5oi5Yp5IEx+I+WKBSBcfioXiI5EhFonFYolYKpaJ5WKFWClWidVijVgr1on1YoPYKDaJzWKL2Cq2ie3iY7FDfCJ2il1it/hU7BGfib3ic7FPfCH2iy9FpvhKHBBfi4PiG3FIfCsOi+/EEXFUHBPfi+PiB3FCnBSnxGlxRvwozoqfxDnhBUiUQkqpZCBjZDYZK7PLHPIqmVMGF5/da2WcvE7mltfLPDKvzCfzy3hZQBaUWhppJclQFpKFZVTeIIvIG2VReZMsJotLJ0vIBHmzLClvkaXkrbK0vE2WkbfLsrKcLC8ryDtkRXmnhMiFc1SRVWU1WV3eI5PgXllT3idryftlbfmArCMflHXlQ7KefFjWl4/IBvJR2VA+JhvJxrKJbCqbycdlc/mEbCFbylbySdlaPiXbyKdlonxGtpX+4kvkOdlBPi87yhdkJ9lZdpE/yXPSy26yu4QeIHvKl2Uv2Vv2kX1lP/mK7C9flQPkazJZDpSD5OtysHxDDpFvyqFymBwu35Ij5Eg5So6WY+RYmSLHyfHybTlBviMnyklyspwiU+VU2efiTDOl/If5b/9O/oCfz75BbpSb5Ga5RW6V2+R2+bHcIXfInXKn3C13yz1yj9wr98p9cp/cL/fLTJkpD8gD8qA8KA/JQ/KwPCyPyKPytPxeHpc/yBPypDwpT8sz8ow8e/E5AIVKKKmUClSMyqZiVXaVQ12lcqqrVS51jYqoa1Wcuk7lVterPCqvyqfyq3hVQBVUWhllFalQFVKFVVTdgBdfMKqYKq6cKqES1M3/Sr4qom5URdVNv8q/VF/SH9TXTDVTzVVz1UK1UK1UK9VatVZtVBuVqBJVW9VWtVPtVHvVXnVQHVRH1VF1Up1UF9VFdVVdVTfVTSWpJNVTvax6qd6qj+qr+qlXVH/VXw1QA1SySlaD1CA1WA1WQ9QQNVQNVcPVcDVCjVCj1Cg1Ro1RKSpFjVfj1QQ1QU1UE9VkNVmlqlQ1TU1T09V0NVPNVLPULDVbzVZz1VyVptLUfDVfpat0tVAtVBlqkVqklqglaplaplaoFWqVWqXWqDVqnVqnMtRGtVFtVpvVVrVVbVfb1Q61Q+1UO9VutVvtUXvUXrVX7VP71H61X2WqTHVAHVAH1UF1SB1Sh9VhdUQdUcfUMXVcHVcn1Al1Sp1SZ9QZdVadVefUufPLvkAEIlCBCmKCmCA2iA1yBDmCnEHOIFeQK4gEkSAuiAtyB9cHeYK8Qb4gfxAfFAgKBjowgQ3ExaZHgxuCIsGNQdHgpqBYUDxwQYkgIbg5KBncEpQKbg1KB7cFZYLbg7JBuaB8UCG4I6gY3BlUCu4KKgd3B1WCqkG1oHpwT1AjuDeoGdwX1AruD2oHDwR1ggeDusFDQb3g4aB+8EjQIHg0aBg8FjQKGgdNgqZBsz91fu9P5H3CddPddZLuoXvql3Uv3Vv30X11P/2K7q9f1QP0azpZD9SD9Ot6sH5DD9Fv6qF6mB6u39Ij9Eg9So/WY/RYnaLH6fH6bT1Bv6Mn6kl6sp6iU/VUPU2/q6frGXqmfk/P0u/r2XqOnqvn6TT9gZ6vF+h0/aFeqD/SGXqRXqyX6KV6mV6uV+iVepVerdfotXqdXq836I16k96st+itepverj/WO/QneqfepXfrT/Ue/Zneqz/X+/QXer/+Umfqr/QB/bU+qL/Rh/S3+rD+Th/RR/Ux/b0+rn/QJ/RJfUqf1mf0j/qs/kmf0/784v7817tRRpkYE2NiTazJYXKYnCanyWVymYiJmDgTZ3Kb3CaPyWPymXwm3sSbgqagOY8MmUKmkImaqCliipiipqgpZooZZ5xJMAmmpClpSplSprQpbcqYMqasKWvKm/LmDnOHudPcae4yd5m7zd2mqqlqqpvqpoapYWqamqaWqWVqm9qmjqlj6pq6pp6pZ+qb+qaBaWAamoamkWlkmpgmpplpZpqb5qaFaWFamVamtWlt2pg2JtEkmramrWln2pn2pr3pYDqYjqaj6WQ6mS6mi+lquppupptJMkmmp+lpeplepo/pY/qZfqa/6W8GmAEm2SSbQWaQGWwGmyFmiBlqhpnh5xeqZqQZZUZ/O8aMNSkmxYw3480EM8FMNBPNZDPZpJpUM81MM9PNdDPTzDSzzCwz28w2c81ck2bSzHwz36SbdLPQLDQZJsMsNovNUrPULDfLzUqz0qw2q81aWGvWm/Vmo9loNpvNZqvZarab7WaH2WF2mp1mt9lt9pg9Zq/Za/aZfWa/2W8yTaY5YA6Yg+agOWQOmcPmsDlijphj5pg5bo6bE+aEOWVOmTMm78XvS29ibXabw15lc9qrbS57jf37OJ/Nb+NtAVvQapvH5v1VbKy1Re1Ntpgtbp0tYRPszb+Jy9pytrytYO+wFe2dttJv4hr2XlvT3mdr2fttdXvPr+La9gFbxz5q6yIC2Ma2vm1qG9hHbUP7mG1kG9smtqltbZ+ybezTNtE+Y9vaZ38Tz7cL7Eq7yq62a+xOu8uesqftQfuNPWN/tN1sd9vPvmL721ftAPuaTbYDfxMPt2/ZEXakHWVH2zF27G/iyXaKTbVT7TT7rp1uZ/wmTrMf2Fk23c62c+xcO+/n+HxN6fZDu9B+ZDNsAIvtErvULrPL7Yr/X+sSu86utxvsDvuJ3Wy32K12m91+aSFsd9nd9lO7x35mD9iv7T77hd1vD9lM+9XP8fnHd8h+aw/b7+wRe9Qes9/b4/YH9XPuyF4A9kf7vf3JnrPeAiEBSVIUUAxlo1jKTjnoKspJV1MuuoYidC3F0XWUm66nPJSX8lF+iqcCVJA0GbJEFFIhKkxRuoEulVeMipOjEpRAN1NJuoVK0a1Umm6jMnQ7laVyVJ4q0B1Uke6kSnQXVaa7qQpVpWpUne6hGnQv1aT7qBbdT7XpAapDD1Jdeojq0cNUnx6hBvQoNaTHqBE1pibUlJrR49ScnqAW1JJa0ZPUmp6iNvQ0JdIz1JaepXb0N2pPz1EHep460gvUiTpTF3qRutJL1I26UxL1oJ70MvWi3tSH+lI/eoX606s0gF6jZBpIg+h1Gkxv0BB6k4bSMBpOb9EIGkmjaDSNobGUQuNoPL1NE+gdmkiTaDJNoVSaStPoXZpOM2gmvUez6H2aTXNoLs2jNPqA5tMCSqcPaSF9RBm0iBbTElpKy2g5raCVtIpW0xpaS+toPW2gjbSJNtMW2krbaDt9TDvoE9pJu2g3fUp76DPaS5/TPvqC9tOXlElf0QH6mg7SN3SIvvXd6Ts6QkfpGH1Px+kHOkEn6RSdpjP0I52ln+gceYIQQxHKUIVBGBNmC2PD7GGO8KowZ3h1mCu8JoyE14Zx4XVh7vD6ME+YN8wX5g/jwwJhwVCHJrQhhWFYKCwcRsMbwiLhjWHREMNiYfHQhSXChPDmsGR4S1gqvDUsHd4WlglvD8uG5cJH768Q3hFWDO8MK4V3hZXDu8MqYdWwWlg9vCesEd4b1gzvC2uF94elwgfCOuGDYd3wobBe+HBYP3wkbBA+GjYMHwsbhY3DJmHTsFn4eNg8fCJsEbYMW4VPhq3Dp8I24dNhYvhM2DZ89uf9Dyz44/1JYY+wZ/hy+HLo/X1ybnReNC36QXR+dEE0PfphdGH0o2hGdFF0cXRJdGl0WXR5dEV0ZXRVdHV0TXRtdF10fXRD1Pvq2cChE0465QIX47K5WJfd5XBXuZzuapfLXeMi7loX565zud31Lo/L6/K5/C7eFXAFnXbGWUcudIVcYRd1N7gi7kZX1N3kirnizrkSLsE1dc1cM9fcPeFauJaulXvSPemeck+5p93T7hnX1j3r2rm/ufbuOdfBPe+edy+4Tq6z6+JedF3duFwX3pNJrqfr6Xq5Xq6P6+P6uX6uv+vvBrgBLtklu0FukBvsBrshbogb6oa64W64G+FGuFFulBvjxrgUl+LGu/FugpvgJrqJbrKb7FJdqpvmprnpbrqrOOPCWWa72W6um+vSXJqb786vGdPdQrfQZbgMt9gtdkvdUrfcLXcr3Uq32q12a91at96tdxvdRrfZbXZb3Va33W13O9wOt9Nfc2FSt8ftdXvdPrfP7Xdfukz3lTvgvnYH3TfukPvWHXbfuSPuqDvmvnfH3Q/uhDvpTrnT7oz70Z11P7lzzruUyLjI+MjbkQmRdyITI5MikyNTIqmRqZFpkXcj0yMzIjMj70VmRd6PzI7MicyNzIukRT6IzI8siKRHPowsjHwUyYgsiiyOLIksjSyLeF9gc+gL+cI+6m/wRfyNvqi/yRfzxb3zJXyCv9mX9Lf4Uv5WX9rf5sv4231ZX86X94/5Rr6xb+Kb+mb+cd/cP+Fb+Ja+lX/St/ZP+Tb+aZ/on/Ft/bO+nf+bb++f8x38876jf8F38p19F/+i7+pf8t18d5/ke/ie/mXfy/f2fXxf38+/4vv7V/0A/5pP9gP9IP+6H+zf8EP8m36oH+aHx7zlR1y6RIaxPsWP8+P9236Cf8dP9JP8ZD/Fp/qpfpp/10/3M/xM/56f5d/3s/0cP9fP82n+Az/fL/Dp/kO/0H/kM/yiSzeV/XK/wq/0q/xqv8av9ev8er/Bb/Sb/Ga/xW/12/x2/7Hf4T/xO/0uv9t/6vf4z/xe/7nf57/w+/2XPtN/5Q/4r/1B/40/5L/1h/13/og/6o/57/1x/4M/4U/6U/60P+N/9Gf9T/4c/581xhhjjLF/yrjLQ/HrPRdu5/f4nRzxi4N7AsDVW/Jn/nL/+RXl2jwXxr1FfOsIADzTvePDl7YqVZKSki4emyEhKDwH4NLfBJ0XA5fjRdAKnoJEaAklf7f+3qLzGfoH80dvA8jxi5xYuBxfnv9zAEz6nfkff3L4/DLhqbj/Yf45AEULX87JDpfjRdDq5/srLaHUH9Sft/kv64/97fzZv0gBaPGLnJxwOb5cfwI8Ac9C4q+OZIwxxhhjjDHGLugtyre/dP156V98/t71eby6nJMNLsf/6PqcMcYYY4wxxhhjV95znbs8/XhiYsv2//qg0v8q658eNIT/q5l58LsD7wEu/UQBwL85IcD5gfxPPopN/5FzJV986/z9rqWnfQD/Ha38MwZX+IOJMcYYY4wx9qe7vOj/9c/VlSqIMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhjLgv4Tv07sSj9GxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhj7Er7fwEAAP//nXwDKg==") mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x109041, 0x0) 4m46.927130868s ago: executing program 1 (id=7300): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)="d80000001c0081044e81f782db44b904021d080201000000120000a118000c000600142603600e3b08000f0100810401a8001600200001400300000803600cfab94dcf5c0461c1d67ffc94007134cf6ee08000a0e408e8d8ef075c11503c13223e3f52a98516277ce06bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006000000000000008065b44f95caae586a81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) 4m46.236018073s ago: executing program 1 (id=7311): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f00000001c0)=0x2001) 4m45.810651581s ago: executing program 32 (id=7311): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f00000001c0)=0x2001) 2.169866889s ago: executing program 5 (id=11250): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="600000000206010100000000000000000000000005000100070000000900020073797a3000000000140007800800124000050000080008400000000012000300686173683a6e65742c706f72740000000500050002040000050004"], 0x60}}, 0x0) 1.734430994s ago: executing program 0 (id=11256): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0, 0x200}], 0x1, &(0x7f00000002c0)={0x0, 0x989680}, 0x0, 0x0) 1.685214688s ago: executing program 5 (id=11257): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000540), 0x42a00) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000000580)={{0x3, 0x0, 0x1, 0x1, 0x1}, 0x5, 0xc, 0x400001}) 1.519432462s ago: executing program 5 (id=11261): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000005fc0)={@initdev={0xfe, 0x88, '\x00', 0xff, 0x0}, @remote, @mcast2, 0x5, 0x8000, 0x40, 0x400, 0x1000, 0x14c0014}) 1.45243126s ago: executing program 4 (id=11263): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@bloom_filter={0x1e, 0x0, 0xca, 0x3, 0x0, 0x1}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0xf, &(0x7f0000000000)=@ringbuf={{0x18, 0x2}, {{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0x2}, {}, {0x85, 0x0, 0x0, 0x9c}}}, &(0x7f0000000c80)='syzkaller\x00'}, 0x94) 1.385922643s ago: executing program 0 (id=11264): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000800)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@in=@dev={0xac, 0x14, 0x14, 0x28}, 0x1, 0x33}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {0x0, 0xfffffffffffffc00}, {}, {}, 0x0, 0x3502, 0xa, 0x0, 0x0, 0x18}, [@offload={0xc, 0x1c, {0x0, 0x6}}, @algo_auth_trunc={0x4c, 0x14, {{'sha1\x00'}}}]}, 0x148}}, 0x0) 1.186158765s ago: executing program 5 (id=11265): r0 = syz_open_dev$vim2m(&(0x7f0000000200), 0x7fc, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405668, &(0x7f00000001c0)={0x5, 0x0, 0x1, "0000087aba10fdfffffb05001400", 0x3136564e}) 1.172603352s ago: executing program 2 (id=11267): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCADDRT(r0, 0x890b, &(0x7f0000000140)={0xfd00, @l2tp={0x2, 0x0, @local, 0x3, 0x1000000}, @can, @generic={0x18, "15afa44fecffffff0180000200"}, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0xffffffff, 0xfffc}) 1.171812136s ago: executing program 4 (id=11268): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000240)=ANY=[@ANYBLOB="e80000006c00010029bd7000fc2a6c709d2d4b0b", @ANYRES32, @ANYBLOB="001000008000000008000f0020000000040035"], 0xe8}}, 0x0) 962.891717ms ago: executing program 0 (id=11269): r0 = socket(0x28, 0x5, 0x0) getpeername$l2tp(r0, 0x0, 0x0) 962.747623ms ago: executing program 5 (id=11270): r0 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r0, &(0x7f0000000380)={0x2c, 0x25}, 0x10) 962.204213ms ago: executing program 3 (id=11271): r0 = fsopen(&(0x7f0000000000)='9p\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000003c0)='s\x1d\xf2nye{\xc49\x9f\x8aB\xc1i\xb3\xb2\x90\xfd+OF\xbeZ\tjw\xe6\x0ew?\xda\xf6\xd7\xc2\\\xf6`\xce\xd3\xb1\xe0\xabC\xa6L\xaf\xc9Pd\x01 \xdf&M\xe1\r\x14\x9e(\xa8\xc8\x97~\xfb\xc9~\xa5\xcf+r\x03t\xa5\xb1^\x91\xb0Cl\xaf\xcb\xf3[\xc3L\x887\xde\x88\xa2\x1a\x81\xd2\xd0\xb1,\x83\x16ZoaI\b\xb0XA\x84\x82\x03@b\x9c\xc9<)\xaf\xae\x96i\xdcji\xa3\x90\x9e\xcdZx\xa9E}\n\x83:\xc0\xac3\x05\xa1\x8c~q\xdd3\xf9T\xbf\xc4b\x80\x0e\x1b\xa2\xe6M\x8cD\x98\xc1\x96\xb1\f\xf9:\xadQg/\x13O\x80\xd2{{2\xce\x1c\x9b\x9ba\x1b\xc5Y\x85\x9c\xd0', &(0x7f0000000980)='//\xf2/\x06\b/?\\o\xdc\xea\x95\x9a)\x00bb\x8a\x80\x91\xdf\\/\\\xf9\rmD\x94)U\xfb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\x00\x00\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6h\xd1\x1d\xac\xaa\xfb\xc7Y\xcd\xc5n\xeb\xab\xf70\x99\xef\x8b and [ 1075.286033][T14541] usb 4-1: USB disconnect, device number 22 [ 1075.303171][T30009] netlink: 'syz.4.10141': attribute type 30 has an invalid length. [ 1075.334921][T30011] loop5: detected capacity change from 0 to 256 [ 1075.449458][T30011] FAT-fs (loop5): Directory bread(block 64) failed [ 1075.473287][T30011] FAT-fs (loop5): Directory bread(block 65) failed [ 1075.496522][T30011] FAT-fs (loop5): Directory bread(block 66) failed [ 1075.520585][T30011] FAT-fs (loop5): Directory bread(block 67) failed [ 1075.540700][T30011] FAT-fs (loop5): Directory bread(block 68) failed [ 1075.560904][T30011] FAT-fs (loop5): Directory bread(block 69) failed [ 1075.581237][T30011] FAT-fs (loop5): Directory bread(block 70) failed [ 1075.595348][T30011] FAT-fs (loop5): Directory bread(block 71) failed [ 1075.617169][T30011] FAT-fs (loop5): Directory bread(block 72) failed [ 1075.641846][T30011] FAT-fs (loop5): Directory bread(block 73) failed [ 1076.206127][T30036] netlink: 176 bytes leftover after parsing attributes in process `syz.5.10155'. [ 1076.667023][T30014] loop2: detected capacity change from 0 to 32768 [ 1076.776130][T30014] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 1077.183392][ T5868] ocfs2: Unmounting device (7,2) on (node local) [ 1077.529484][T30085] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1077.533279][T30079] loop5: detected capacity change from 0 to 2048 [ 1077.579553][T30085] overlayfs: missing 'lowerdir' [ 1077.674182][T30079] UDF-fs: error (device loop5): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 1077.745671][T30079] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1078.827490][T30133] loop5: detected capacity change from 0 to 64 [ 1078.950928][T30133] Trying to free block not in datazone [ 1079.191704][T30143] loop2: detected capacity change from 0 to 2048 [ 1079.269045][T30143] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1079.764418][T30167] netlink: 'syz.4.10208': attribute type 13 has an invalid length. [ 1080.180343][T30167] bridge0: port 2(bridge_slave_1) entered disabled state [ 1080.187746][T30167] bridge0: port 1(bridge_slave_0) entered disabled state [ 1080.479759][T30167] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1080.507199][T30167] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1080.885804][ T13] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1080.925414][ T13] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1080.955166][ T49] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1080.964160][ T49] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1081.975086][T30229] netlink: 'syz.4.10239': attribute type 10 has an invalid length. [ 1081.999550][T30196] loop2: detected capacity change from 0 to 32768 [ 1082.011329][T30229] team0: Device ipvlan1 failed to register rx_handler [ 1082.092260][T30196] XFS (loop2): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 1082.153408][T30243] netlink: 16 bytes leftover after parsing attributes in process `syz.3.10242'. [ 1082.325218][T30196] XFS (loop2): Ending clean mount [ 1082.496336][ T5868] XFS (loop2): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 1082.865087][T30264] netlink: 128 bytes leftover after parsing attributes in process `syz.4.10254'. [ 1083.350508][T30285] netlink: 72 bytes leftover after parsing attributes in process `syz.3.10263'. [ 1083.698488][T30296] loop3: detected capacity change from 0 to 256 [ 1083.797371][ T5968] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 1083.961447][T30303] loop3: detected capacity change from 0 to 512 [ 1083.964915][ T5968] usb 3-1: Using ep0 maxpacket: 32 [ 1083.980058][T30265] loop5: detected capacity change from 0 to 32768 [ 1083.994182][ T5968] usb 3-1: New USB device found, idVendor=04e8, idProduct=6601, bcdDevice=81.9b [ 1084.022142][ T5968] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1084.050931][T30303] EXT4-fs error (device loop3): ext4_orphan_get:1418: comm syz.3.10272: bad orphan inode 4 [ 1084.054805][ T5968] usb 3-1: Product: syz [ 1084.075081][ T5968] usb 3-1: Manufacturer: syz [ 1084.079925][ T5968] usb 3-1: SerialNumber: syz [ 1084.093891][T30265] jfs_strtoUCS: char2uni returned -22. [ 1084.099891][T30265] charset = cp949, char = 0xd4 [ 1084.118177][T30303] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1084.131282][T30303] ext4 filesystem being mounted at /2051/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 1084.308176][ T5968] visor 3-1:1.0: Handspring Visor / Palm OS converter detected [ 1084.363535][ T5877] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1084.385822][ T5968] usb 3-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 1084.423557][ T5968] usb 3-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 1084.574850][T30315] netlink: 44 bytes leftover after parsing attributes in process `syz.4.10277'. [ 1084.585334][ T5957] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 1084.591920][ T5968] usb 3-1: USB disconnect, device number 25 [ 1084.631949][ T5968] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 1084.700945][ T5968] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 1084.742205][ T5968] visor 3-1:1.0: device disconnected [ 1084.793849][ T5957] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1084.825005][ T5957] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1084.875366][ T5957] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1084.884467][ T5957] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1084.940224][T30310] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 1084.960502][ T5957] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1085.255060][ T5957] usb 6-1: USB disconnect, device number 12 [ 1085.807181][ T30] audit: type=1326 audit(1754371097.950:244): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30351 comm="syz.4.10295" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f171138eb69 code=0x7ffc0000 [ 1085.881523][ T30] audit: type=1326 audit(1754371097.970:245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30351 comm="syz.4.10295" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f171138eb69 code=0x7ffc0000 [ 1085.965645][ T30] audit: type=1326 audit(1754371097.980:246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30351 comm="syz.4.10295" exe="/root/syz-executor" sig=0 arch=c000003e syscall=297 compat=0 ip=0x7f171138eb69 code=0x7ffc0000 [ 1086.090259][ T30] audit: type=1326 audit(1754371097.980:247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30351 comm="syz.4.10295" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f171138eb69 code=0x7ffc0000 [ 1086.183706][ T30] audit: type=1326 audit(1754371097.980:248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30351 comm="syz.4.10295" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f171138eb69 code=0x7ffc0000 [ 1086.349080][T30373] loop2: detected capacity change from 0 to 512 [ 1086.423677][T30373] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 1086.536879][T30373] EXT4-fs (loop2): 1 truncate cleaned up [ 1086.581199][T30373] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1086.589289][T30383] netlink: 72 bytes leftover after parsing attributes in process `syz.5.10308'. [ 1086.603563][T30383] netlink: 72 bytes leftover after parsing attributes in process `syz.5.10308'. [ 1086.761661][ T5968] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 1086.875177][ T10] usb 3-1: new full-speed USB device number 26 using dummy_hcd [ 1086.927327][ T5968] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1086.937842][ T5968] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1086.950279][ T5968] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1087.040614][ T5968] usb 4-1: New USB device found, idVendor=8086, idProduct=0b5b, bcdDevice=e1.c5 [ 1087.052851][ T5968] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1087.075129][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1087.090445][ T5968] usb 4-1: Product: syz [ 1087.095041][ T10] usb 3-1: not running at top speed; connect to a high speed hub [ 1087.105486][T30397] loop5: detected capacity change from 0 to 1764 [ 1087.111878][ T5968] usb 4-1: Manufacturer: syz [ 1087.120538][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1087.133081][ T5968] usb 4-1: SerialNumber: syz [ 1087.138672][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1087.151498][ T5968] usb 4-1: config 0 descriptor?? [ 1087.165402][ T10] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1087.183822][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1087.193069][ T10] usb 3-1: Product: syz [ 1087.205052][ T10] usb 3-1: Manufacturer: syz [ 1087.209770][ T10] usb 3-1: SerialNumber: syz [ 1087.216652][T30397] iso9660: Corrupted directory entry in block 2 of inode 1920 [ 1087.347053][T30405] netlink: 'syz.4.10319': attribute type 8 has an invalid length. [ 1087.371193][ T5968] usb 4-1: Found UVC 34.00 device syz (8086:0b5b) [ 1087.400036][ T5968] usb 4-1: No valid video chain found. [ 1087.433165][ T5968] usb 4-1: USB disconnect, device number 23 [ 1087.495120][ T10] usb 3-1: 0:2 : does not exist [ 1087.509501][ T10] usb 3-1: unit 0 not found! [ 1087.557699][ T10] usb 3-1: USB disconnect, device number 26 [ 1087.609222][ T5922] udevd[5922]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1087.815563][T30413] loop5: detected capacity change from 0 to 2048 [ 1087.850473][T30413] EXT4-fs: Ignoring removed mblk_io_submit option [ 1087.966762][T30413] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1088.069002][T30413] EXT4-fs error (device loop5): ext4_validate_block_bitmap:441: comm syz.5.10323: bg 0: block 234: padding at end of block bitmap is not set [ 1088.107390][T30420] netlink: 'syz.3.10325': attribute type 1 has an invalid length. [ 1088.125601][ T5868] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1088.162093][T30420] netlink: 224 bytes leftover after parsing attributes in process `syz.3.10325'. [ 1088.195118][T30413] EXT4-fs (loop5): Remounting filesystem read-only [ 1088.343321][T23371] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1088.558616][T30411] loop4: detected capacity change from 0 to 32768 [ 1088.606653][T30411] BTRFS: device fsid e417788f-7a09-42b2-9266-8ddc5d5d35d2 devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.10322 (30411) [ 1088.695482][T30411] BTRFS info (device loop4): first mount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 1088.721980][T30438] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10334'. [ 1088.751553][T30411] BTRFS info (device loop4): using xxhash64 (xxhash64-generic) checksum algorithm [ 1088.781172][T30442] binder: Bad value for 'stats' [ 1088.795116][T30411] BTRFS info (device loop4): disk space caching is enabled [ 1088.819922][T30411] BTRFS warning (device loop4): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2 [ 1088.988413][T30411] BTRFS info (device loop4): rebuilding free space tree [ 1088.995800][ T10] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 1089.033181][T30411] BTRFS info (device loop4): disabling free space tree [ 1089.055228][T30411] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 1089.086142][T30411] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 1089.160152][T30466] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 1089.166733][T30466] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 1089.194917][T30466] vhci_hcd vhci_hcd.0: Device attached [ 1089.210939][ T10] usb 4-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 1089.240995][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1089.264418][ T10] usb 4-1: Product: syz [ 1089.274763][ T10] usb 4-1: Manufacturer: syz [ 1089.289635][ T10] usb 4-1: SerialNumber: syz [ 1089.298872][ T5872] BTRFS info (device loop4): last unmount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 1089.318401][ T10] r8152-cfgselector 4-1: Unknown version 0x0000 [ 1089.330024][ T10] r8152-cfgselector 4-1: config 0 descriptor?? [ 1089.445622][T14541] usb 43-1: new high-speed USB device number 2 using vhci_hcd [ 1089.556262][T30472] netlink: 16 bytes leftover after parsing attributes in process `syz.4.10340'. [ 1089.813045][ T10] r8152-cfgselector 4-1: USB disconnect, device number 24 [ 1089.857377][T30476] netlink: 'syz.4.10343': attribute type 1 has an invalid length. [ 1089.869530][T30436] loop2: detected capacity change from 0 to 40427 [ 1089.933304][T30467] vhci_hcd: connection reset by peer [ 1089.940005][T30436] F2FS-fs (loop2): invalid crc value [ 1089.947600][ T64] vhci_hcd: stop threads [ 1089.954790][ T64] vhci_hcd: release socket [ 1089.960812][ T64] vhci_hcd: disconnect device [ 1090.228884][T30483] __vm_enough_memory: pid: 30483, comm: syz.0.10346, bytes: 4115879641088 not enough memory for the allocation [ 1090.255581][T30436] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 1090.271281][T30436] F2FS-fs (loop2): Start checkpoint disabled! [ 1090.297723][T30436] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 1090.422962][T30488] sit0: entered promiscuous mode [ 1090.483144][ T13] kworker/u8:1: attempt to access beyond end of device [ 1090.483144][ T13] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 1090.506568][T30488] netlink: 21 bytes leftover after parsing attributes in process `syz.0.10348'. [ 1090.539280][ T13] CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted 6.16.0-next-20250805-syzkaller #0 PREEMPT(full) [ 1090.539312][ T13] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1090.539338][ T13] Workqueue: writeback wb_workfn (flush-7:2) [ 1090.539372][ T13] Call Trace: [ 1090.539381][ T13] [ 1090.539390][ T13] dump_stack_lvl+0x189/0x250 [ 1090.539425][ T13] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1090.539451][ T13] ? __pfx_queue_work_on+0x10/0x10 [ 1090.539471][ T13] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 1090.539499][ T13] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1090.539544][ T13] f2fs_handle_critical_error+0x37c/0x540 [ 1090.539582][ T13] f2fs_write_end_io+0x886/0xb60 [ 1090.539630][ T13] __submit_merged_bio+0x27a/0x6a0 [ 1090.539669][ T13] __submit_merged_write_cond+0x255/0x530 [ 1090.539710][ T13] f2fs_write_data_pages+0x261d/0x3000 [ 1090.539800][ T13] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 1090.539849][ T13] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 1090.539921][ T13] ? __pfx_f2fs_balance_fs_bg+0x10/0x10 [ 1090.539971][ T13] ? trace_f2fs_writepages+0x7f/0x200 [ 1090.540001][ T13] ? f2fs_write_node_pages+0x478/0x6e0 [ 1090.540038][ T13] ? __pfx_f2fs_write_node_pages+0x10/0x10 [ 1090.540088][ T13] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 1090.540121][ T13] do_writepages+0x32b/0x550 [ 1090.540180][ T13] ? reacquire_held_locks+0x127/0x1d0 [ 1090.540201][ T13] ? writeback_sb_inodes+0x384/0x1010 [ 1090.540243][ T13] __writeback_single_inode+0x145/0xff0 [ 1090.540271][ T13] ? do_raw_spin_unlock+0x122/0x240 [ 1090.540304][ T13] writeback_sb_inodes+0x6c7/0x1010 [ 1090.540386][ T13] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 1090.540479][ T13] ? rcu_is_watching+0x15/0xb0 [ 1090.540516][ T13] wb_writeback+0x43b/0xaf0 [ 1090.540557][ T13] ? queue_io+0x3a1/0x590 [ 1090.540597][ T13] ? __pfx_wb_writeback+0x10/0x10 [ 1090.540638][ T13] ? _raw_spin_unlock_irq+0x23/0x50 [ 1090.540672][ T13] wb_workfn+0x409/0xef0 [ 1090.540718][ T13] ? __pfx_wb_workfn+0x10/0x10 [ 1090.540749][ T13] ? __lock_acquire+0xab9/0xd20 [ 1090.540796][ T13] ? process_scheduled_works+0x9ef/0x17b0 [ 1090.540829][ T13] ? _raw_spin_unlock_irq+0x23/0x50 [ 1090.540861][ T13] ? process_scheduled_works+0x9ef/0x17b0 [ 1090.540881][ T13] ? process_scheduled_works+0x9ef/0x17b0 [ 1090.540906][ T13] process_scheduled_works+0xade/0x17b0 [ 1090.540968][ T13] ? __pfx_process_scheduled_works+0x10/0x10 [ 1090.541016][ T13] worker_thread+0x8a0/0xda0 [ 1090.541079][ T13] kthread+0x70e/0x8a0 [ 1090.541111][ T13] ? __pfx_worker_thread+0x10/0x10 [ 1090.541132][ T13] ? __pfx_kthread+0x10/0x10 [ 1090.541160][ T13] ? _raw_spin_unlock_irq+0x23/0x50 [ 1090.541184][ T13] ? lockdep_hardirqs_on+0x9c/0x150 [ 1090.541216][ T13] ? __pfx_kthread+0x10/0x10 [ 1090.541245][ T13] ret_from_fork+0x3f9/0x770 [ 1090.541273][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 1090.541304][ T13] ? __switch_to_asm+0x39/0x70 [ 1090.541338][ T13] ? __switch_to_asm+0x33/0x70 [ 1090.541363][ T13] ? __pfx_kthread+0x10/0x10 [ 1090.541390][ T13] ret_from_fork_asm+0x1a/0x30 [ 1090.541441][ T13] [ 1090.541450][ T13] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 1090.670540][T30494] loop3: detected capacity change from 0 to 256 [ 1091.117037][T30494] FAT-fs (loop3): Directory bread(block 64) failed [ 1091.153265][T30494] FAT-fs (loop3): Directory bread(block 65) failed [ 1091.180678][T30494] FAT-fs (loop3): Directory bread(block 66) failed [ 1091.193580][T30486] loop4: detected capacity change from 0 to 32768 [ 1091.207197][T30494] FAT-fs (loop3): Directory bread(block 67) failed [ 1091.213863][T30494] FAT-fs (loop3): Directory bread(block 68) failed [ 1091.259148][T30494] FAT-fs (loop3): Directory bread(block 69) failed [ 1091.276482][T30494] FAT-fs (loop3): Directory bread(block 70) failed [ 1091.280240][T30486] (syz.4.10347,30486,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 1091.302697][T30494] FAT-fs (loop3): Directory bread(block 71) failed [ 1091.318951][T30486] (syz.4.10347,30486,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 1091.363644][T30494] FAT-fs (loop3): Directory bread(block 72) failed [ 1091.393981][T30494] FAT-fs (loop3): Directory bread(block 73) failed [ 1091.461951][T30486] JBD2: Ignoring recovery information on journal [ 1091.526077][T30503] netlink: 'syz.5.10356': attribute type 27 has an invalid length. [ 1091.584311][T30503] netlink: 152 bytes leftover after parsing attributes in process `syz.5.10356'. [ 1091.625829][T30486] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 1091.658900][T30503] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1091.998454][ T5872] ocfs2: Unmounting device (7,4) on (node local) [ 1092.654284][ T10] usb 6-1: new full-speed USB device number 13 using dummy_hcd [ 1092.829249][ T10] usb 6-1: not running at top speed; connect to a high speed hub [ 1092.875021][ T10] usb 6-1: config 1 has an invalid interface number: 78 but max is 0 [ 1092.883169][ T10] usb 6-1: config 1 has no interface number 0 [ 1092.922148][ T10] usb 6-1: config 1 interface 78 has no altsetting 0 [ 1092.949872][ T10] usb 6-1: string descriptor 0 read error: -22 [ 1092.964020][ T10] usb 6-1: New USB device found, idVendor=11ba, idProduct=1001, bcdDevice=ec.57 [ 1092.974523][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1093.013365][T30511] loop2: detected capacity change from 0 to 32768 [ 1093.018324][ T10] pvrusb2: Hardware description: OnAir USB2 Hybrid USB tuner [ 1093.029842][ T10] usb 6-1: selecting invalid altsetting 0 [ 1093.062985][T30511] BTRFS: device fsid e417788f-7a09-42b2-9266-8ddc5d5d35d2 devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.10358 (30511) [ 1093.110322][T30511] BTRFS info (device loop2): first mount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 1093.149469][T30511] BTRFS info (device loop2): using xxhash64 (xxhash64-generic) checksum algorithm [ 1093.189559][T30511] BTRFS info (device loop2): using free-space-tree [ 1093.271078][ T2344] pvrusb2: control-write URB failure, status=-71 [ 1093.272054][ T5957] usb 6-1: USB disconnect, device number 13 [ 1093.278251][ T2344] pvrusb2: Device being rendered inoperable [ 1093.304377][ T2344] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1093.366377][ T2344] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1093.380145][T30559] loop3: detected capacity change from 0 to 256 [ 1093.430108][T30511] BTRFS info (device loop2): rebuilding free space tree [ 1093.637421][T30511] BTRFS info (device loop2): balance: start -sdrange=65536..8,limit=38654705666,limit=2..9,stripes=3..4 [ 1093.657058][T30511] BTRFS info (device loop2): balance: ended with status: 0 [ 1093.820945][ T5868] BTRFS info (device loop2): last unmount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 1093.926998][T30575] loop4: detected capacity change from 0 to 64 [ 1094.070142][T30579] loop3: detected capacity change from 0 to 512 [ 1094.160567][T30579] EXT4-fs (loop3): orphan cleanup on readonly fs [ 1094.253183][T30579] Quota error (device loop3): v2_read_file_info: Block with free entry 2 out of range (1, 0). [ 1094.264828][T30579] EXT4-fs warning (device loop3): ext4_enable_quotas:7168: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 1094.291336][T30579] EXT4-fs (loop3): Cannot turn on quotas: error -117 [ 1094.348382][T30579] EXT4-fs error (device loop3): ext4_ext_check_inode:523: inode #13: comm syz.3.10385: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 1094.465721][T30579] EXT4-fs error (device loop3): ext4_orphan_get:1397: comm syz.3.10385: couldn't read orphan inode 13 (err -117) [ 1094.529196][T30579] EXT4-fs (loop3): mounted filesystem 00000000-0000-0b00-0000-000000000000 ro without journal. Quota mode: writeback. [ 1094.605471][T30579] tmpfs: Unknown parameter '\bX1oIT&w^pBj 1-Î'4' [ 1094.634427][T14541] vhci_hcd: vhci_device speed not set [ 1094.822253][ T5877] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0b00-0000-000000000000. [ 1095.097589][T30601] loop5: detected capacity change from 0 to 4096 [ 1095.150216][T30601] ntfs3(loop5): Different NTFS sector size (2048) and media sector size (512). [ 1095.547742][T30617] loop3: detected capacity change from 0 to 256 [ 1095.625386][T30617] exfat: Deprecated parameter 'namecase' [ 1095.631177][T30617] exfat: Deprecated parameter 'utf8' [ 1095.746134][T30617] exFAT-fs (loop3): failed to load upcase table (idx : 0x0001ff53, chksum : 0xd72bb7d8, utbl_chksum : 0xe619d30d) [ 1095.753598][T30622] loop4: detected capacity change from 0 to 512 [ 1095.853534][T30622] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1095.928908][T30622] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1096.008317][T30622] ext4 filesystem being mounted at /2090/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1096.033320][T30629] lo speed is unknown, defaulting to 1000 [ 1096.043848][T30629] lo speed is unknown, defaulting to 1000 [ 1096.055419][T30629] lo speed is unknown, defaulting to 1000 [ 1096.198709][T30622] EXT4-fs error (device loop4): ext4_get_verity_descriptor_location:335: inode #15: comm syz.4.10404: verity file corrupted; can't find descriptor [ 1096.260108][T30622] EXT4-fs (loop4): Remounting filesystem read-only [ 1096.286708][T30622] fs-verity (loop4, inode 15): Error -117 getting verity descriptor size [ 1096.426312][ T5872] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1096.463241][T30640] netlink: 'syz.0.10411': attribute type 5 has an invalid length. [ 1096.533384][T30640] netlink: 3657 bytes leftover after parsing attributes in process `syz.0.10411'. [ 1097.261575][T30661] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10420'. [ 1097.295757][T30661] netlink: 20 bytes leftover after parsing attributes in process `syz.0.10420'. [ 1097.308209][T30629] infiniband syz0: set active [ 1097.316122][ T5957] lo speed is unknown, defaulting to 1000 [ 1097.353219][T30629] infiniband syz0: added lo [ 1097.383705][T30629] syz0: rxe_create_cq: returned err = -12 [ 1097.434848][T30629] infiniband syz0: Couldn't create ib_mad CQ [ 1097.441093][T30629] infiniband syz0: Couldn't open port 1 [ 1097.568884][T30670] netlink: 'syz.3.10424': attribute type 1 has an invalid length. [ 1097.586673][T30670] netlink: 244 bytes leftover after parsing attributes in process `syz.3.10424'. [ 1097.641992][T30629] RDS/IB: syz0: added [ 1097.680783][T30629] smc: adding ib device syz0 with port count 1 [ 1097.707157][T30629] smc: ib device syz0 port 1 has pnetid [ 1097.717247][ T5957] lo speed is unknown, defaulting to 1000 [ 1097.749578][T30629] lo speed is unknown, defaulting to 1000 [ 1097.774191][T30676] netlink: 36 bytes leftover after parsing attributes in process `syz.0.10427'. [ 1097.781592][T30645] loop4: detected capacity change from 0 to 32768 [ 1097.882583][ T30] audit: type=1800 audit(1754371110.020:249): pid=30645 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.10412" name="file1" dev="loop4" ino=4 res=0 errno=0 [ 1098.125220][T30687] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10431'. [ 1098.674664][T30695] loop4: detected capacity change from 0 to 8192 [ 1098.978203][T30629] lo speed is unknown, defaulting to 1000 [ 1098.986274][T30713] netlink: 96 bytes leftover after parsing attributes in process `syz.5.10444'. [ 1100.040979][T30629] lo speed is unknown, defaulting to 1000 [ 1100.093663][T30709] loop3: detected capacity change from 0 to 32768 [ 1100.260984][T30719] loop4: detected capacity change from 0 to 32768 [ 1100.278871][T30709] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 1100.360195][T30709] (syz.3.10442,30709,1):ocfs2_check_dir_entry:325 ERROR: bad entry in directory #65: rec_len is too small for name_len - offset=0, inode=65, rec_len=16, name_len=8 [ 1100.453848][T30709] (syz.3.10442,30709,1):ocfs2_prepare_dir_for_insert:4302 ERROR: status = -2 [ 1100.528067][T30709] (syz.3.10442,30709,1):ocfs2_mknod:301 ERROR: status = -2 [ 1100.576418][T30709] (syz.3.10442,30709,1):ocfs2_mknod:505 ERROR: status = -2 [ 1100.607709][T30709] (syz.3.10442,30709,1):ocfs2_create:678 ERROR: status = -2 [ 1100.739162][ T5877] ocfs2: Unmounting device (7,3) on (node local) [ 1101.043843][T30760] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10466'. [ 1101.081598][T30629] lo speed is unknown, defaulting to 1000 [ 1101.400149][T30772] loop3: detected capacity change from 0 to 1764 [ 1101.461507][T30766] loop5: detected capacity change from 0 to 4096 [ 1101.484667][T30772] iso9660: Corrupted directory entry in block 2 of inode 1920 [ 1101.806837][T30780] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10474'. [ 1102.161704][T30629] lo speed is unknown, defaulting to 1000 [ 1102.326655][ T30] audit: type=1400 audit(1754371114.470:250): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-22 profile="unconfined" name="&" pid=30796 comm="syz.3.10483" [ 1102.564284][T30805] netlink: 40 bytes leftover after parsing attributes in process `syz.3.10487'. [ 1102.593684][T30805] netlink: 40 bytes leftover after parsing attributes in process `syz.3.10487'. [ 1102.983728][T30815] netlink: 132 bytes leftover after parsing attributes in process `syz.5.10492'. [ 1104.161656][T30854] comedi comedi4: bad chanlist[1]=0x000000e7 chan=231 range length=2 [ 1104.278884][T30857] loop4: detected capacity change from 0 to 1024 [ 1104.339194][T30859] loop3: detected capacity change from 0 to 64 [ 1104.911684][T30878] netlink: 'syz.4.10523': attribute type 1 has an invalid length. [ 1104.925995][T30878] netlink: 'syz.4.10523': attribute type 1 has an invalid length. [ 1105.635598][T30904] netlink: 'syz.3.10535': attribute type 2 has an invalid length. [ 1105.645064][T30904] netlink: 119 bytes leftover after parsing attributes in process `syz.3.10535'. [ 1105.738897][T30863] loop5: detected capacity change from 0 to 32768 [ 1105.770429][T30863] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.10516 (30863) [ 1105.852068][T30863] BTRFS info (device loop5): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1105.852904][T30910] netlink: 44 bytes leftover after parsing attributes in process `syz.0.10540'. [ 1105.908870][T30910] netlink: 32 bytes leftover after parsing attributes in process `syz.0.10540'. [ 1105.911636][T30863] BTRFS info (device loop5): using sha256 (sha256-lib) checksum algorithm [ 1105.983569][T30863] BTRFS info (device loop5): using free-space-tree [ 1106.066050][ T30] audit: type=1326 audit(1754371118.191:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30916 comm="syz.2.10542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f471cd8eb69 code=0x7ffc0000 [ 1106.163473][ T30] audit: type=1326 audit(1754371118.191:252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30916 comm="syz.2.10542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f471cd8eb69 code=0x7ffc0000 [ 1106.376510][T30941] netlink: 'syz.2.10546': attribute type 10 has an invalid length. [ 1106.453651][T30941] team0: Device dummy0 is up. Set it down before adding it as a team port [ 1106.500985][T23371] BTRFS info (device loop5): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1106.963513][T30958] loop2: detected capacity change from 0 to 256 [ 1107.355826][T30969] loop3: detected capacity change from 0 to 64 [ 1107.751531][T30982] binder: 30980:30982 ioctl 40046210 0 returned -14 [ 1108.165683][T30997] loop5: detected capacity change from 0 to 1024 [ 1108.239377][T31000] ip6gretap1: entered promiscuous mode [ 1108.398081][ T13] hfsplus: b-tree write err: -5, ino 4 [ 1108.523730][T31011] netlink: 16 bytes leftover after parsing attributes in process `syz.0.10580'. [ 1108.713032][T31006] loop4: detected capacity change from 0 to 8192 [ 1109.363702][ T5957] usb 3-1: new full-speed USB device number 27 using dummy_hcd [ 1109.386157][T31036] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1110.092752][ T5957] usb 3-1: config 0 has an invalid interface number: 107 but max is 0 [ 1110.123402][ T5957] usb 3-1: config 0 has no interface number 0 [ 1110.135923][ T5957] usb 3-1: config 0 interface 107 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 10 [ 1110.187122][ T5957] usb 3-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1110.211619][ T5957] usb 3-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 1110.257348][ T5957] usb 3-1: Product: syz [ 1110.261579][ T5957] usb 3-1: Manufacturer: syz [ 1110.296554][ T5957] usb 3-1: SerialNumber: syz [ 1110.324921][ T5957] usb 3-1: config 0 descriptor?? [ 1110.347920][ T5957] keyspan 3-1:0.107: Keyspan 4 port adapter converter detected [ 1110.386151][ T5957] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 81 [ 1110.408381][T31059] netlink: 'syz.3.10604': attribute type 2 has an invalid length. [ 1110.410223][ T5957] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 1 [ 1110.424665][T31059] netlink: 'syz.3.10604': attribute type 1 has an invalid length. [ 1110.469274][ T5957] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 1110.491684][ T5957] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 2 [ 1110.553810][ T5957] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 1110.587591][ T5957] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 4 [ 1110.636976][ T5957] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 1110.669555][ T5957] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 6 [ 1110.697341][T31065] loop4: detected capacity change from 0 to 256 [ 1110.707579][ T5957] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 1110.727636][T31065] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 1110.823224][ T5957] usb 3-1: USB disconnect, device number 27 [ 1110.907447][ T5957] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 1111.034557][ T5957] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 1111.104475][ T5957] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 1111.165642][ T5957] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 1111.219391][ T5957] keyspan 3-1:0.107: device disconnected [ 1111.334987][T31081] loop3: detected capacity change from 0 to 2048 [ 1111.358508][T31085] loop4: detected capacity change from 0 to 16 [ 1111.402515][T31081] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1111.447630][T31085] cramfs: Error -3 while decompressing! [ 1111.466022][T31085] cramfs: ffffffff99be3628(27)->ffff88806b54f000(4096) [ 1111.480768][ T30] audit: type=1326 audit(1754371123.621:253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31087 comm="syz.5.10619" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe482d8eb69 code=0x7ffc0000 [ 1111.526399][T31085] cramfs: Error -3 while decompressing! [ 1111.532009][T31085] cramfs: ffffffff99be3643(16)->ffff88807cc4c000(4096) [ 1111.568040][ T30] audit: type=1326 audit(1754371123.641:254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31087 comm="syz.5.10619" exe="/root/syz-executor" sig=0 arch=c000003e syscall=12 compat=0 ip=0x7fe482d8eb69 code=0x7ffc0000 [ 1111.625093][T31085] cramfs: Error -3 while decompressing! [ 1111.655635][T31085] cramfs: ffffffff99be3628(27)->ffff88806b54f000(4096) [ 1111.679999][ T30] audit: type=1326 audit(1754371123.641:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31087 comm="syz.5.10619" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe482d8eb69 code=0x7ffc0000 [ 1111.696093][T31093] loop2: detected capacity change from 0 to 128 [ 1111.782550][ T30] audit: type=1326 audit(1754371123.641:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31087 comm="syz.5.10619" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe482d8eb69 code=0x7ffc0000 [ 1111.912278][T31093] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000100) [ 1111.923560][ T30] audit: type=1800 audit(1754371123.861:257): pid=31085 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.10617" name="file2" dev="loop4" ino=348 res=0 errno=0 [ 1111.958395][T31093] FAT-fs (loop2): Filesystem has been set read-only [ 1112.496828][T31123] overlayfs: empty lowerdir [ 1112.580347][T31120] loop2: detected capacity change from 0 to 4096 [ 1112.628500][T31120] ntfs3(loop2): Different NTFS sector size (2048) and media sector size (512). [ 1112.729531][T31120] ntfs3(loop2): Failed to initialize $Extend/$ObjId. [ 1113.218035][T31139] loop3: detected capacity change from 0 to 1024 [ 1113.565157][T31118] loop4: detected capacity change from 0 to 32768 [ 1114.098456][T31166] loop2: detected capacity change from 0 to 512 [ 1114.136846][T31166] EXT4-fs: Ignoring removed nomblk_io_submit option [ 1114.183138][T31166] EXT4-fs (loop2): filesystem is read-only [ 1114.250885][T31166] EXT4-fs (loop2): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 1114.330288][T31166] EXT4-fs (loop2): filesystem is read-only [ 1114.346385][T31166] EXT4-fs (loop2): orphan cleanup on readonly fs [ 1114.372340][T31166] EXT4-fs error (device loop2): ext4_orphan_get:1392: inode #16: comm syz.2.10656: iget: bad i_size value: 648518346341360424 [ 1114.403521][T31166] EXT4-fs error (device loop2): ext4_orphan_get:1397: comm syz.2.10656: couldn't read orphan inode 16 (err -117) [ 1114.435279][T31118] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 1114.508817][T31166] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 1114.758787][ T5868] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1115.076414][T31204] loop5: detected capacity change from 0 to 1024 [ 1115.119150][T31204] EXT4-fs (loop5): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 1115.182168][T31204] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (38281!=20869) [ 1115.218020][T31204] EXT4-fs (loop5): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 1115.248725][T31204] EXT4-fs error (device loop5): ext4_ext_check_inode:523: inode #3: comm syz.5.10675: pblk 0 bad header/extent: too large eh_max - magic f30a, entries 2, max 15(4), depth 0(0) [ 1115.338323][T31204] EXT4-fs (loop5): no journal found [ 1115.350209][T31204] EXT4-fs (loop5): can't get journal size [ 1115.395619][T31204] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 1115.644674][T23371] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1115.843159][T31237] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10692'. [ 1115.975991][T31243] loop3: detected capacity change from 0 to 256 [ 1116.099710][T31243] FAT-fs (loop3): Directory bread(block 64) failed [ 1116.129925][T31243] FAT-fs (loop3): Directory bread(block 65) failed [ 1116.183042][T31243] FAT-fs (loop3): Directory bread(block 66) failed [ 1116.189634][T31243] FAT-fs (loop3): Directory bread(block 67) failed [ 1116.225606][T31243] FAT-fs (loop3): Directory bread(block 68) failed [ 1116.232228][T31243] FAT-fs (loop3): Directory bread(block 69) failed [ 1116.283176][T31243] FAT-fs (loop3): Directory bread(block 70) failed [ 1116.289859][T31243] FAT-fs (loop3): Directory bread(block 71) failed [ 1116.330903][T31255] loop5: detected capacity change from 0 to 2048 [ 1116.337576][T31243] FAT-fs (loop3): Directory bread(block 72) failed [ 1116.348005][T31243] FAT-fs (loop3): Directory bread(block 73) failed [ 1116.367636][T31255] UDF-fs: error (device loop5): udf_read_tagged: read failed, block=2362, location=2362 [ 1116.418809][T31259] netlink: 'syz.2.10701': attribute type 1 has an invalid length. [ 1116.429921][T31255] UDF-fs: error (device loop5): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 1116.450527][T31259] netlink: 224 bytes leftover after parsing attributes in process `syz.2.10701'. [ 1116.472405][T31255] UDF-fs: error (device loop5): udf_read_tagged: tag checksum failed, block 160: 0xd2 != 0xd4 [ 1116.524474][T31255] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1116.653263][ T5957] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 1116.679776][T31266] netlink: 'syz.2.10704': attribute type 12 has an invalid length. [ 1116.833037][ T5957] usb 5-1: Using ep0 maxpacket: 8 [ 1116.853967][ T5957] usb 5-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 1116.881525][ T5957] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1116.900506][ T5957] usb 5-1: Product: syz [ 1116.914603][ T5957] usb 5-1: Manufacturer: syz [ 1116.926940][ T5957] usb 5-1: SerialNumber: syz [ 1116.954060][ T5957] usb 5-1: config 0 descriptor?? [ 1117.148880][T31284] [U] .h0FwZ,iqgҏV2sO [ 1117.180288][T31284] [U] ` w*BBOLhU [ 1117.184951][T31284] [U] w$n|#%o.z\̧mРw [ 1117.211257][T31284] [U] R{ꫢ S [ 1117.272069][T31281] [U] [ 1117.309967][T31290] loop5: detected capacity change from 0 to 256 [ 1117.354202][T31290] exfat: Deprecated parameter 'namecase' [ 1117.359985][T31290] exfat: Deprecated parameter 'namecase' [ 1117.424418][T31290] exfat: Deprecated parameter 'utf8' [ 1117.496815][T31290] exFAT-fs (loop5): failed to load upcase table (idx : 0x00012366, chksum : 0xd06b6363, utbl_chksum : 0xe619d30d) [ 1117.634720][ T5957] usb 5-1: USB disconnect, device number 19 [ 1117.756055][ C1] vkms_vblank_simulate: vblank timer overrun [ 1117.978902][ T5922] udevd[5922]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1118.310875][T31318] loop3: detected capacity change from 0 to 2048 [ 1118.375886][T31316] loop2: detected capacity change from 0 to 4096 [ 1118.381954][T31318] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found [ 1118.395281][T31323] loop5: detected capacity change from 0 to 1024 [ 1118.402130][T31316] ntfs3(loop2): Different NTFS sector size (2048) and media sector size (512). [ 1118.418348][T31325] netlink: 'syz.4.10734': attribute type 1 has an invalid length. [ 1118.426694][T31318] UDF-fs: Scanning with blocksize 512 failed [ 1118.440550][T31325] netlink: 224 bytes leftover after parsing attributes in process `syz.4.10734'. [ 1118.449717][T31323] hfsplus: Filesystem is marked locked, mounting read-only. [ 1118.494552][T31318] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1118.540153][T31316] ntfs3(loop2): Failed to initialize $Extend/$ObjId. [ 1118.691415][T31327] netlink: 'syz.5.10735': attribute type 32 has an invalid length. [ 1119.106840][T31340] loop3: detected capacity change from 0 to 512 [ 1119.190225][T31340] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1119.318312][ T5877] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1119.814216][T31371] netlink: 16 bytes leftover after parsing attributes in process `syz.2.10756'. [ 1120.049217][T31380] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10758'. [ 1120.601439][T31368] loop4: detected capacity change from 0 to 32768 [ 1120.652734][T31368] BTRFS: device fsid e417788f-7a09-42b2-9266-8ddc5d5d35d2 devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.10753 (31368) [ 1120.724339][T31368] BTRFS info (device loop4): first mount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 1120.777778][T31368] BTRFS info (device loop4): using xxhash64 (xxhash64-generic) checksum algorithm [ 1120.824542][T31368] BTRFS info (device loop4): disk space caching is enabled [ 1120.831835][T31368] BTRFS warning (device loop4): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2 [ 1120.899923][T31409] loop3: detected capacity change from 0 to 256 [ 1121.106909][T31426] (unnamed net_device) (uninitialized): option lp_interval: invalid value (18446744071562067969) [ 1121.144931][T31428] loop5: detected capacity change from 0 to 64 [ 1121.155133][T31409] exFAT-fs (loop3): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x76936814, utbl_chksum : 0xe619d30d) [ 1121.212189][T31426] (unnamed net_device) (uninitialized): option lp_interval: allowed values 1 - 2147483647 [ 1121.229863][T31368] BTRFS info (device loop4): rebuilding free space tree [ 1121.310433][T31368] BTRFS info (device loop4): disabling free space tree [ 1121.346323][T31368] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 1121.381625][T31368] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 1121.748642][ T5872] BTRFS info (device loop4): last unmount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 1121.788119][T31444] loop5: detected capacity change from 0 to 64 [ 1121.893696][T31447] netlink: 'syz.0.10787': attribute type 5 has an invalid length. [ 1121.961340][T31447] netlink: 'syz.0.10787': attribute type 7 has an invalid length. [ 1122.048441][T31447] : entered promiscuous mode [ 1122.285897][T31457] netlink: 'syz.5.10791': attribute type 79 has an invalid length. [ 1122.665063][T31471] binder: 31470:31471 ioctl c0306201 0 returned -14 [ 1122.902650][ T24] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 1123.099485][ T24] usb 4-1: config 0 has an invalid interface number: 69 but max is 0 [ 1123.123389][ T24] usb 4-1: config 0 has no interface number 0 [ 1123.143903][ T24] usb 4-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 1123.194114][ T24] usb 4-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1123.242871][ T24] usb 4-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 1123.272488][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1123.292579][ T24] usb 4-1: Product: syz [ 1123.296879][ T24] usb 4-1: Manufacturer: syz [ 1123.301585][ T24] usb 4-1: SerialNumber: syz [ 1123.326757][ T24] usb 4-1: config 0 descriptor?? [ 1123.333721][T31473] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1123.374661][ T24] cyberjack 4-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 1123.426089][ T24] usb 4-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 1123.482089][T31492] loop4: detected capacity change from 0 to 2048 [ 1123.524937][T31492] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 1024) [ 1123.652053][T31495] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1123.815007][ T24] usb 4-1: USB disconnect, device number 25 [ 1123.847618][ T24] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 1123.915471][ T24] cyberjack 4-1:0.69: device disconnected [ 1124.434265][T31483] loop2: detected capacity change from 0 to 40427 [ 1124.496774][T31483] F2FS-fs (loop2): invalid crc value [ 1124.558212][ T30] audit: type=1326 audit(1754371136.702:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31514 comm="syz.4.10818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f171138eb69 code=0x7ffc0000 [ 1124.652431][ T30] audit: type=1326 audit(1754371136.702:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31514 comm="syz.4.10818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f171138eb69 code=0x7ffc0000 [ 1124.757543][ T30] audit: type=1326 audit(1754371136.742:260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31514 comm="syz.4.10818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=194 compat=0 ip=0x7f171138eb69 code=0x7ffc0000 [ 1124.882401][ T30] audit: type=1326 audit(1754371136.742:261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31514 comm="syz.4.10818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f171138eb69 code=0x7ffc0000 [ 1124.979573][ T30] audit: type=1326 audit(1754371136.742:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31514 comm="syz.4.10818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f171138eb69 code=0x7ffc0000 [ 1125.000938][T31483] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 1125.067997][T31483] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 1125.427284][T31545] netlink: 232 bytes leftover after parsing attributes in process `syz.3.10832'. [ 1125.472964][T31545] netlink: 232 bytes leftover after parsing attributes in process `syz.3.10832'. [ 1125.499419][T31545] netlink: 52 bytes leftover after parsing attributes in process `syz.3.10832'. [ 1125.712388][ T24] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 1125.789402][T31559] netlink: 32 bytes leftover after parsing attributes in process `syz.0.10839'. [ 1125.862377][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 1125.879586][ T24] usb 5-1: config index 0 descriptor too short (expected 35577, got 27) [ 1125.892839][T31561] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1125.901821][ T24] usb 5-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 1125.932183][ T24] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1125.972353][ T24] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 1125.987017][ T24] usb 5-1: config 1 has no interface number 0 [ 1126.017615][ T24] usb 5-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 1126.052362][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1126.100827][ T24] snd_usb_pod 5-1:1.1: Line 6 Pocket POD found [ 1126.247058][T31571] loop2: detected capacity change from 0 to 2048 [ 1126.279054][T31571] UDF-fs: error (device loop2): udf_process_sequence: Primary Volume Descriptor not found! [ 1126.302046][ T24] snd_usb_pod 5-1:1.1: set_interface failed [ 1126.304357][T31576] netlink: 'syz.5.10847': attribute type 15 has an invalid length. [ 1126.336502][ T24] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now disconnected [ 1126.345754][T31571] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1126.375125][ T24] snd_usb_pod 5-1:1.1: probe with driver snd_usb_pod failed with error -71 [ 1126.400918][ T24] usb 5-1: USB disconnect, device number 20 [ 1126.725491][T31589] loop3: detected capacity change from 0 to 256 [ 1126.751732][T31590] loop5: detected capacity change from 0 to 1024 [ 1126.854142][T31590] syz.5.10852: attempt to access beyond end of device [ 1126.854142][T31590] loop5: rw=0, sector=393308, nr_sectors = 2 limit=1024 [ 1126.928216][T31589] FAT-fs (loop3): Directory bread(block 64) failed [ 1126.958966][T31589] FAT-fs (loop3): Directory bread(block 65) failed [ 1126.972403][T31589] FAT-fs (loop3): Directory bread(block 66) failed [ 1126.982278][T31589] FAT-fs (loop3): Directory bread(block 67) failed [ 1126.988946][T31589] FAT-fs (loop3): Directory bread(block 68) failed [ 1127.029933][T31589] FAT-fs (loop3): Directory bread(block 69) failed [ 1127.041184][T31589] FAT-fs (loop3): Directory bread(block 70) failed [ 1127.049186][T31589] FAT-fs (loop3): Directory bread(block 71) failed [ 1127.056252][T31589] FAT-fs (loop3): Directory bread(block 72) failed [ 1127.065454][T31589] FAT-fs (loop3): Directory bread(block 73) failed [ 1127.226672][T31589] syz.3.10853: attempt to access beyond end of device [ 1127.226672][T31589] loop3: rw=524288, sector=1160, nr_sectors = 4 limit=256 [ 1127.261739][T31589] syz.3.10853: attempt to access beyond end of device [ 1127.261739][T31589] loop3: rw=0, sector=1160, nr_sectors = 4 limit=256 [ 1127.276713][ T30] audit: type=1800 audit(1754371139.422:263): pid=31589 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.10853" name="file0" dev="loop3" ino=1048703 res=0 errno=0 [ 1127.700887][T31617] loop5: detected capacity change from 0 to 1024 [ 1127.882590][T31622] loop4: detected capacity change from 0 to 2048 [ 1127.967523][T31622] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1127.971749][T31628] loop3: detected capacity change from 0 to 64 [ 1127.990990][T30746] hfsplus: b-tree write err: -5, ino 4 [ 1128.085716][T31628] syz.3.10871: attempt to access beyond end of device [ 1128.085716][T31628] loop3: rw=0, sector=268435468, nr_sectors = 2 limit=64 [ 1128.162782][T31628] Buffer I/O error on dev loop3, logical block 134217734, async page read [ 1128.188697][ T5872] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1128.229346][T31628] syz.3.10871: attempt to access beyond end of device [ 1128.229346][T31628] loop3: rw=0, sector=268435468, nr_sectors = 2 limit=64 [ 1128.282442][T31628] Buffer I/O error on dev loop3, logical block 134217734, async page read [ 1128.626247][T31603] loop2: detected capacity change from 0 to 32768 [ 1128.713349][T31603] [ 1128.713349][T31603] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 1128.713349][T31603] [ 1128.763230][T31603] ERROR: (device loop2): ea_get: invalid ea.flag [ 1128.763230][T31603] [ 1128.842308][T31603] ERROR: (device loop2): remounting filesystem as read-only [ 1129.457085][ T30] audit: type=1326 audit(1754371141.602:264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31662 comm="syz.5.10889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe482d8eb69 code=0x7ffc0000 [ 1129.552133][ T30] audit: type=1326 audit(1754371141.602:265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31662 comm="syz.5.10889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe482d8eb69 code=0x7ffc0000 [ 1129.656194][ T30] audit: type=1326 audit(1754371141.642:266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31662 comm="syz.5.10889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7fe482d8eb69 code=0x7ffc0000 [ 1129.800902][ T30] audit: type=1326 audit(1754371141.682:267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31666 comm="syz.5.10889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fe482dc1425 code=0x7ffc0000 [ 1129.882093][ T30] audit: type=1326 audit(1754371141.682:268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31662 comm="syz.5.10889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe482d8eb69 code=0x7ffc0000 [ 1130.004223][ T30] audit: type=1326 audit(1754371141.722:269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31662 comm="syz.5.10889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe482d8eb69 code=0x7ffc0000 [ 1130.082636][ T30] audit: type=1326 audit(1754371141.902:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31666 comm="syz.5.10889" exe="/root/syz-executor" sig=0 arch=c000003e syscall=60 compat=0 ip=0x7fe482d8eb69 code=0x7ffc0000 [ 1130.181101][T31685] netlink: 'syz.4.10897': attribute type 3 has an invalid length. [ 1130.207512][T31688] libceph: resolve '40' (ret=-3): failed [ 1130.463959][T31695] loop5: detected capacity change from 0 to 1024 [ 1130.504230][T31695] EXT4-fs: Ignoring removed nobh option [ 1130.537648][T31695] EXT4-fs: Ignoring removed oldalloc option [ 1130.591914][T31695] EXT4-fs: Ignoring removed bh option [ 1130.638377][T31695] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-001000000000 r/w without journal. Quota mode: none. [ 1130.697000][T31698] loop3: detected capacity change from 0 to 4096 [ 1130.768038][T31698] ntfs3(loop3): Different NTFS sector size (2048) and media sector size (512). [ 1130.896648][T23371] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-001000000000. [ 1131.221588][T31723] kAFS: unable to lookup cell 'syz0.riX<̧+R!K+K4[Ed<6c7( n@8A5W/7|{?hT8#&3r?3Ufile.run_lock#2){++++}-{4:4}, at: run_unpack_ex+0x7e5/0xba0 [ 1158.050659][ T676] [ 1158.050659][ T676] but task is already holding lock: [ 1158.058057][ T676] ffff888078194270 (&wnd->rw_lock){++++}-{4:4}, at: run_unpack_ex+0x701/0xba0 [ 1158.067148][ T676] [ 1158.067148][ T676] which lock already depends on the new lock. [ 1158.067148][ T676] [ 1158.077553][ T676] [ 1158.077553][ T676] the existing dependency chain (in reverse order) is: [ 1158.086571][ T676] [ 1158.086571][ T676] -> #1 (&wnd->rw_lock){++++}-{4:4}: [ 1158.094079][ T676] lock_acquire+0x120/0x360 [ 1158.099118][ T676] down_write_nested+0x9d/0x200 [ 1158.104584][ T676] mark_as_free_ex+0x3e/0x390 [ 1158.109788][ T676] run_deallocate_ex+0x187/0x2f0 [ 1158.115247][ T676] attr_set_size+0xeb9/0x2c70 [ 1158.120448][ T676] ntfs_setattr+0x7d0/0xbe0 [ 1158.125471][ T676] notify_change+0xb33/0xe40 [ 1158.130581][ T676] do_truncate+0x1a4/0x220 [ 1158.135534][ T676] vfs_truncate+0x493/0x520 [ 1158.140559][ T676] do_sys_truncate+0xdb/0x190 [ 1158.145758][ T676] __x64_sys_truncate+0x5b/0x70 [ 1158.151134][ T676] do_syscall_64+0xfa/0x3b0 [ 1158.156175][ T676] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1158.162590][ T676] [ 1158.162590][ T676] -> #0 (&ni->file.run_lock#2){++++}-{4:4}: [ 1158.170694][ T676] validate_chain+0xb9b/0x2140 [ 1158.175983][ T676] __lock_acquire+0xab9/0xd20 [ 1158.181189][ T676] lock_acquire+0x120/0x360 [ 1158.186233][ T676] down_read+0x46/0x2e0 [ 1158.190918][ T676] run_unpack_ex+0x7e5/0xba0 [ 1158.196046][ T676] ntfs_iget5+0x232b/0x37c0 [ 1158.201077][ T676] dir_search_u+0x1df/0x2c0 [ 1158.206104][ T676] ntfs_lookup+0xfb/0x1f0 [ 1158.210951][ T676] path_openat+0x1101/0x3830 [ 1158.216065][ T676] do_filp_open+0x1fa/0x410 [ 1158.221099][ T676] do_sys_openat2+0x121/0x1c0 [ 1158.226309][ T676] __x64_sys_openat+0x138/0x170 [ 1158.231676][ T676] do_syscall_64+0xfa/0x3b0 [ 1158.236704][ T676] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1158.243120][ T676] [ 1158.243120][ T676] other info that might help us debug this: [ 1158.243120][ T676] [ 1158.253344][ T676] Possible unsafe locking scenario: [ 1158.253344][ T676] [ 1158.260793][ T676] CPU0 CPU1 [ 1158.266157][ T676] ---- ---- [ 1158.271518][ T676] lock(&wnd->rw_lock); [ 1158.275765][ T676] lock(&ni->file.run_lock#2); [ 1158.283143][ T676] lock(&wnd->rw_lock); [ 1158.289907][ T676] rlock(&ni->file.run_lock#2); [ 1158.294943][ T676] [ 1158.294943][ T676] *** DEADLOCK *** [ 1158.294943][ T676] [ 1158.303087][ T676] 3 locks held by syz.5.11276/676: [ 1158.308191][ T676] #0: ffff88804e578af0 (&type->i_mutex_dir_key#15){++++}-{4:4}, at: path_openat+0x8cb/0x3830 [ 1158.318477][ T676] #1: ffff88804e578858 (&ni->ni_lock#2/6){+.+.}-{4:4}, at: ntfs_lookup+0xee/0x1f0 [ 1158.327811][ T676] #2: ffff888078194270 (&wnd->rw_lock){++++}-{4:4}, at: run_unpack_ex+0x701/0xba0 [ 1158.337142][ T676] [ 1158.337142][ T676] stack backtrace: [ 1158.343034][ T676] CPU: 0 UID: 0 PID: 676 Comm: syz.5.11276 Not tainted 6.16.0-next-20250805-syzkaller #0 PREEMPT(full) [ 1158.343055][ T676] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1158.343065][ T676] Call Trace: [ 1158.343073][ T676] [ 1158.343080][ T676] dump_stack_lvl+0x189/0x250 [ 1158.343104][ T676] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1158.343122][ T676] ? __pfx__printk+0x10/0x10 [ 1158.343142][ T676] ? stack_trace_save+0x9c/0xe0 [ 1158.343167][ T676] print_circular_bug+0x2ee/0x310 [ 1158.343188][ T676] check_noncircular+0x134/0x160 [ 1158.343208][ T676] validate_chain+0xb9b/0x2140 [ 1158.343233][ T676] __lock_acquire+0xab9/0xd20 [ 1158.343258][ T676] ? run_unpack_ex+0x7e5/0xba0 [ 1158.343276][ T676] lock_acquire+0x120/0x360 [ 1158.343297][ T676] ? run_unpack_ex+0x7e5/0xba0 [ 1158.343317][ T676] ? wnd_set_used_safe+0x2d4/0x320 [ 1158.343338][ T676] down_read+0x46/0x2e0 [ 1158.343361][ T676] ? run_unpack_ex+0x7e5/0xba0 [ 1158.343380][ T676] run_unpack_ex+0x7e5/0xba0 [ 1158.343404][ T676] ? __pfx_run_unpack_ex+0x10/0x10 [ 1158.343422][ T676] ? inode_set_ctime_to_ts+0x126/0x2f0 [ 1158.343440][ T676] ? __pfx_inode_set_ctime_to_ts+0x10/0x10 [ 1158.343459][ T676] ? mi_enum_attr+0x743/0x9f0 [ 1158.343476][ T676] ntfs_iget5+0x232b/0x37c0 [ 1158.343511][ T676] ? __pfx_ntfs_iget5+0x10/0x10 [ 1158.343531][ T676] ? __pfx_indx_find+0x10/0x10 [ 1158.343554][ T676] ? __kasan_kmalloc+0x93/0xb0 [ 1158.343579][ T676] dir_search_u+0x1df/0x2c0 [ 1158.343599][ T676] ? __pfx_dir_search_u+0x10/0x10 [ 1158.343619][ T676] ? __pfx_ntfs_nls_to_utf16+0x10/0x10 [ 1158.343639][ T676] ? kmem_cache_alloc_noprof+0x21a/0x3c0 [ 1158.343659][ T676] ? ntfs_lookup+0x51/0x1f0 [ 1158.343676][ T676] ntfs_lookup+0xfb/0x1f0 [ 1158.343693][ T676] path_openat+0x1101/0x3830 [ 1158.343711][ T676] ? arch_stack_walk+0xfc/0x150 [ 1158.343740][ T676] ? __pfx_path_openat+0x10/0x10 [ 1158.343757][ T676] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1158.343780][ T676] do_filp_open+0x1fa/0x410 [ 1158.343798][ T676] ? __lock_acquire+0xab9/0xd20 [ 1158.343821][ T676] ? __pfx_do_filp_open+0x10/0x10 [ 1158.343846][ T676] ? _raw_spin_unlock+0x28/0x50 [ 1158.343864][ T676] ? alloc_fd+0x64c/0x6c0 [ 1158.343889][ T676] do_sys_openat2+0x121/0x1c0 [ 1158.343905][ T676] ? __se_sys_futex+0x36f/0x400 [ 1158.343924][ T676] ? __pfx_do_sys_openat2+0x10/0x10 [ 1158.343943][ T676] ? rcu_is_watching+0x15/0xb0 [ 1158.343959][ T676] __x64_sys_openat+0x138/0x170 [ 1158.343978][ T676] do_syscall_64+0xfa/0x3b0 [ 1158.343999][ T676] ? lockdep_hardirqs_on+0x9c/0x150 [ 1158.344027][ T676] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1158.344042][ T676] ? clear_bhb_loop+0x60/0xb0 [ 1158.344060][ T676] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1158.344075][ T676] RIP: 0033:0x7fe482d8eb69 [ 1158.344090][ T676] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1158.344104][ T676] RSP: 002b:00007fe483b85038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1158.344122][ T676] RAX: ffffffffffffffda RBX: 00007fe482fb5fa0 RCX: 00007fe482d8eb69 [ 1158.344135][ T676] RDX: 0000000000088100 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 1158.344148][ T676] RBP: 00007fe482e11df1 R08: 0000000000000000 R09: 0000000000000000 [ 1158.344159][ T676] R10: 0000000000000161 R11: 0000000000000246 R12: 0000000000000000 [ 1158.344169][ T676] R13: 0000000000000000 R14: 00007fe482fb5fa0 R15: 00007ffe60169da8 [ 1158.344187][ T676] [ 1158.722764][ T30] audit: type=1800 audit(1754371170.854:287): pid=676 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.11276" name="file2" dev="loop5" ino=31 res=0 errno=0 [ 1158.734694][ T715] xfrm0: entered promiscuous mode [ 1158.747644][ T715] xfrm0: entered allmulticast mode [ 1158.760499][ T5930] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 1158.931123][ T5930] usb 5-1: Using ep0 maxpacket: 32 [ 1158.937555][ T5930] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 1158.946041][ T5930] usb 5-1: config 0 has no interface number 0 [ 1158.954724][ T5930] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1158.963870][ T5930] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1158.972474][ T5930] usb 5-1: Product: syz [ 1158.976649][ T5930] usb 5-1: Manufacturer: syz [ 1158.981267][ T5930] usb 5-1: SerialNumber: syz [ 1158.987022][ T5930] usb 5-1: config 0 descriptor?? [ 1158.994440][ T5930] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1159.195787][ T5930] usb 5-1: qt2_setup_urbs - submit read urb failed -8 [ 1159.202731][ T5930] quatech2 5-1:0.51: probe with driver quatech2 failed with error -8 [ 1159.399684][ T5930] usb 5-1: USB disconnect, device number 25