last executing test programs: 24.158728693s ago: executing program 4 (id=602): r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000300), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/diskstats\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x106f) sendmsg$nl_route(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000005c0)=ANY=[@ANYBLOB="50000000100001060100000000000000000000006400000000000000000000000c00030076786c616e300000240012800c00010076786c616e00000014000280050019000100000005001e00010000"], 0x50}}, 0x0) ioctl(0xffffffffffffffff, 0x3b8f, &(0x7f0000000800)="2800000006000000010000000400"/23) 21.952796239s ago: executing program 4 (id=607): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000140), 0x2, 0x141102) writev(r0, &(0x7f0000000280)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$CEC_RECEIVE(0xffffffffffffffff, 0xc0386106, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x2c, 0x0, 0x1, 0x70bd2c, 0x0, {0x10}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}]}]}, 0x2c}}, 0x4044890) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={'sha384\x00'}}) r1 = syz_open_dev$usbmon(0x0, 0x0, 0x40400) r2 = syz_mount_image$vfat(&(0x7f0000000680), &(0x7f00000006c0)='./file1\x00', 0x1004808, &(0x7f0000000700)=ANY=[@ANYBLOB='uni_xlate=1,iocharset=eaccenteuro,shortname=win95,codepage=866,iocharset=macroman,rodir,uni_xlate=0,shortname=win95,shortname=win95,utf8=0,rodir,rodir,uni_xlate=1,shortname=lower,shortname=winnt,\x00'], 0x21, 0x2b0, &(0x7f0000000800)="$eJzs3ctqJFUYB/B/9S0dFboXrkSwQBeuwsw8wQSJMJiV0gvdaHAyIOkwkEiDF4yzmr3gynfwHXwAN76BC5eCO7MQS9KXpKe7chlpE8n8fpv+us731Xeq6nQCgT755PX9vYePDx89+frXdLtFGvdzP8dF+mlk5tsAALfJcVXlj2ristxWOkmq3vRd4xqmBwD8B46rqnnV3/8AwO3wwYcfvbe5vb31fll2k/2no0GxluTpaDAZ33yUzzLMbu6kl7+S6tQkfuXB9lZaZTn7Y8BoPYNk/+Ofp+83f0/G9XfTS3+xvjPNKsfy1v7RaHDS+eS1nZeKZLMqJin30surSdXO9CSTl3cfbG/dK5frM+jk7Td/mM7/791spJdfPs3jDPNwfIqz+m/uluU71fd/fjVu1B4kxdFosDbOO1M1r+WBAAAAAAAAAAAAAAAAAAAAAADwQtgoT/Xn98+Z7QbY3qgfP3d/oOkOP0dz++vcKctyto3PaNDOpL6V11pp3dyVAwAAAAAAAAAAAAAAAAAAwP/H4Rdf7u0Mh7sHzwQ/VSfB+oU5i0Fr7sjsa/31yZ9fesK9H5MrNX3uIM3p1IbFUotiNrSCXmvPk7xe1zSN8+5ha5jJ5L+7SovmM0/wjVVd4IXBbHXt7RS5JLlbv0jm5jxbhgeHRd2CbI2Hls5c1dy65rnT6Kzo2jsv/9vy9dob1Zn7qC5WdU+e5NyR9oo/KQuKlf7cAQAAAAAAAAAAAAAAAAAAlp196Te/LQ0+uZEpAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMC1O/v//6dB+otHFoOjafH4SGNnWFyQvHZwWNO2f82XCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwC33TwAAAP//svhQ2Q==") r3 = socket(0x1e, 0x1, 0x0) connect$tipc(r3, &(0x7f00000004c0)=@id, 0x10) recvfrom$unix(r3, &(0x7f0000000f40)=""/41, 0x29, 0x10003, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000b00)='rdma.current\x00', 0x275a, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000b40)={'filter\x00'}, 0x0) close_range(r1, r2, 0x100000000000000) r4 = syz_open_dev$video(0x0, 0x8, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r4, 0xc0205648, &(0x7f0000000440)={0x4, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000480)={0x98f90d, 0x2009c, '\x00', @string=0x0}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_emit_ethernet(0x142, &(0x7f0000000b80)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @broadcast, @void, {@ipv6={0x86dd, @gre_packet={0x5, 0x6, "78ae0b", 0x10c, 0x2f, 0xff, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, {[@dstopts={0x1, 0x14, '\x00', [@generic={0x5, 0x4c, "ea9c9abf08afe44cd6c14bd875a02d69e24a24387a2bf58eb4049f371f66edaf1758fb6289f79e10fdd0a35e324d7ac70ae741015bf4392d2b5000c59768bb7b6ac421a4a2de8c5ca4fe83e1"}, @enc_lim={0x4, 0x1, 0x9}, @generic={0x80, 0x1, '+'}, @calipso={0x7, 0x10, {0x1, 0x2, 0x40, 0x6, [0x7]}}, @calipso={0x7, 0x18, {0x0, 0x4, 0x5, 0x80, [0x2, 0x8]}}, @pad1, @hao={0xc9, 0x10, @private2={0xfc, 0x2, '\x00', 0x1}}, @hao={0xc9, 0x10, @mcast1}]}, @dstopts={0x3b, 0x1, '\x00', [@ra, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}]}], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x1}, {0x8, 0x88be, 0x4, {{0x1, 0x1, 0x2, 0x2, 0x1, 0x0, 0x7, 0x1a}, 0x1, {0x6}}}, {0x8, 0x22eb, 0x1, {{0x4, 0x2, 0xd, 0x1, 0x0, 0x1, 0x3}, 0x2, {0x7d70, 0x1, 0x2, 0x9, 0x0, 0x0, 0x3, 0x1}}}, {0x8, 0x6558, 0x1}}}}}}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r5, 0xffffffffffffffff, 0x2c, 0x0, @void}, 0x10) 15.488727931s ago: executing program 4 (id=612): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) futex(0x0, 0xd, 0x2, 0x0, 0x0, 0x400000) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f0000000140)=[{&(0x7f00000000c0)="580000001400192340834b80040d8c560a117436c37900000ec00100000058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100070c100000000000224e0000", 0x58}], 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) dup3(r5, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x10000000000) 15.426087183s ago: executing program 2 (id=613): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x40, 0x0) timerfd_create(0x0, 0x800) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = io_uring_setup(0x7, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee7, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000140), 0x10) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./proc_mnt\x00', &(0x7f00000002c0)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc_mnt/net/can/rcvlist_sff\x00', 0x0, 0x0) read(r4, &(0x7f0000000400)=""/1, 0x1000) 15.341345105s ago: executing program 3 (id=615): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="400100001000010028bd7000fddbdf25ac1414aa00"/32, @ANYRES32=0x0, @ANYRESOCT=r0, @ANYBLOB="fc000000000000000000000000000000000000206c000000e0000001000000000000000000000000feffffffffffffff000000000000000000000000000000000100000000000008c80200000000010006000000000000000000000000000400000000", @ANYRESOCT=r0], 0x140}, 0x1, 0x0, 0x0, 0x4075}, 0x4800) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000005c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x80580, 0x0) r2 = syz_mount_image$nilfs2(&(0x7f0000000000), &(0x7f0000000140)='./file0\x00', 0x10010, &(0x7f0000000180)=ANY=[], 0x5, 0xa5a, &(0x7f0000000b40)="$eJzs3U1sHFcBAOA3a6/z22ZTHGrS0CYU2vJTu3FM+ImAVM2FqKm4Vaq4RElaIpyASCVI1UOSEzdaVeHK76mX8qNK5IKinrhUopG49FQ4cCAKUiUO0JC48vq99e7zbmbt2J6s9/uk2bdv3tt9b3ZnZmdn5r0XgKFVaz7OzEwUIVy+8saRfz32zy0hXBlfzNFoPo62xeohhCLGR7P3+2BkIbz14asnuoVFmG4+pnh47kbrtdtCCBfC3nA1NMLuy9def3f62WMXj17a996bh66vzdIDAMBw+c7VQzO7/v7Xh3Z+9NbDh8Om1vx0fN6I8e3xuP9wPPBPx/+10Bkv2qZ2Y1m+0TjVsnwjXfK1l1PP8o32KH8se996j3ybSsofaZvXbblhkKX1uBGK2mRHvFabnFz4Tx6a/+vHismzp2dfPFdRRYFV959HQgh7Taahny42N4jq67Gu09yOqvdAAAvy64VLXMjPLNyd1ruN9lf+jadr3V8Pq2C913/lD1b5v71oj8Pq2ahrU1qutB1tj/G26whnQpf7l/Ltby5/42z7T++XX4+o91nPXtcRBuX6Qq96jqxzPVaqV/3z9WKj+kYM0+fwzSy9ffvJv9NB+Y6B7v7r/L/JNLTTkuPbO8jvlQE2tvy+ubkopef39eXpm0rSN5ekbylJ39qRa2n6tpLXwzD748s/C68Vi//z8//0yz0fns6z3RfD+5dZn/x85HLLH7tDbD3Kd4zEIPnT8edPffXkC9cW7v8vWuv/7bi+743xRtyarsYM6Xxhfl69de9/o7OcWo98D2T1ua9L/ubz8c58xfji+4S2/cySekx0vm5Hr3x7OvM1snxb4rQ5q29+fLI1e106/kj71fR5jWbLW8+WYyyrR9qv7IxhXg9YibQ+9rr/P62fE6FevHh69tRTMZ7W07+M1DfNz99fXtTvVrvuwN3pt/3PROhs/7O9Nb9ea98v7FicX7TvFxrZ/Oke8w/EePqd+97Ilub8yRM/mD252gsPQ+7c+Ve+f3x29tSPPPHEE09aT6reMwFrberlMz+cOnf+lSdPnzn+0qmXTp09cPDggenpg187MDPVPK6faj+6BzaSxR/9qmsCAAAAAAAAAAAA9OvHR49c+9s7X3l/of3/Yvu/1P4/3fmb2v//tFho615rmx+6jAOY2gHu7JLezJN1sDqW5avH6RNZfcezcnZlr/tkDFvj+MX2/6m4vF/XVJ8Hs/l5/70pX9adwJL+UsayXkfy8QI/E8NLMfx1gAoVW7rPjmFZ/9ZpXU/9UyyjX4ruBVOJ9L2lLyX1Y5Laf/fq1ynt/3euQx1ZfevRnLDqZQS6+/cQ9//dPHZZw/f/zf3VL+Pm3mmbqq6bqfppbs4oHsC9oerxP9N5zxSe/fO3N89PKduNpzv3l3n/pXA37vXxJ5W/scb/bI1/19f+7+bS0RMaKyv3f7+4/n5bsWF3v/vffPlTP9DjeQl3PhP90Xz5NxcX5fHQX/lzv8rKzy8I9elmXP70+W/ts/wly7+nrKTzb3eb+/9YfvrYnni03/IXalzUOuuRnzdO1//y88bJrWz5T650+Vc4UOPtWD4Ms0EZZ3a5+hj/t6ls/N8lVnn8317y+zC+HONpR5juc8hHOFlm/VuR9DuwK3v/ouT3zfi/g+3rMSzbHtL4v2l9bHSJ19ri9S6f7Ubd18Cg+uDevf63+ENVfV1M/X5f1dfDtIxpbm5ubU9olai0cCr//Kv+n1B1+VV//mXy8X/zY/h8/N88PR//N0/Px//N0/Px9fL0rVl6/nnm4//m6Q9m75uPDzyR/cHO0z9V8vrdJekPlaTvKUn/dEn6vpL0h0vSHylJf6Ak/dGS9M+WpH+uJP2xkvQnStI/X5K+0aX2KMO6/DDM8vZ5tn8YHql9ba/tf7wkHRhcP39r/zMv/OG7jYX2/2Ot8yHpOt7hGK/H/84/ifH8undoi8+nvRPj/8jS7/XzHTBM8v4z8t/3x0vSgcGV7vOyfcMQKrq3k+i336pex/kMli/E8Isx/FIMn4zhZAynYrg/htPrVD/WxjO/f/vQa8Xi//0dWXq/95Pn7YHyfqIO9Fmf/PzAcu/Hz/vxW667LX+FzcEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqU2s+zsxMFCFcvvLGkeePnZ6an/OtVo5G83G0LVZvvS6Ep2I4EsNfxie3Pnz1RHt4O4ZFmA5FKFrzw3M3WiVtCyFcCHvD1dAIuy9fe/3d6WePXTx6ad97bx66vnafAAAAAGx8HwcAAP//V88c0Q==") mount$fuse(0x0, &(0x7f00000015c0)='./file0\x00', 0x0, 0x810, 0x0) ioctl$NILFS_IOCTL_SYNC(r2, 0x80086e8a, 0x0) ioctl(0xffffffffffffffff, 0x40946400, &(0x7f0000000100)) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) write$cgroup_int(r3, 0x0, 0x0) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r4, 0xc0383e04, 0x0) 12.469432137s ago: executing program 3 (id=620): socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000001340)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000001380)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000013c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000001400)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000001440), 0x0, 0x0) read$msr(r3, 0x0, 0x0) r4 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r4, &(0x7f000001a5c0)={0xa, 0x9004, 0x0, @local, 0x9}, 0x1c) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb01001800000000000000200000002000000004000000010000000000000104000000200000000100000000000001080000004000000000"], 0x0, 0x3c}, 0x28) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32=r5, @ANYBLOB="010000000200"/28], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r6, &(0x7f0000000200)="03", &(0x7f0000000240)}, 0x20) 12.35633086s ago: executing program 2 (id=621): socket$nl_generic(0x10, 0x3, 0x10) epoll_create(0x9) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xf, 0x204031, 0xffffffffffffffff, 0x2d5c000) sched_setscheduler(0x0, 0x1, &(0x7f0000000700)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000740)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r1, &(0x7f0000000800)=""/102392, 0x18ff8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a010400000000000000000200000a0900010073797a300000000040000000030a010400000000000000000200000a0900010073797a30000000200900030073797a3000000000140004800800014000000003080002400000000048000000060a010400000000000000000200000a0900010073797a30000200000900020073797a30000000001c00048018000180080001"], 0xd0}}, 0x0) 12.263116352s ago: executing program 4 (id=623): socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0xc41a, &(0x7f00000001c0)={[{@noblock_validity}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x9}}, {@stripe={'stripe', 0x3d, 0xee9}}, {@nodioread_nolock}, {@discard}, {@usrjquota, 0x2e}, {@nouid32}, {@noauto_da_alloc}, {@jqfmt_vfsv0}, {@barrier}, {@nogrpid}], [], 0x2c}, 0x1, 0x477, &(0x7f0000000280)="$eJzs289vFFUcAPDvbFt+YyviDxC1ij8af7S0oHLwgtGEi4mJHvBYSyFIoYbWRAiR6gGPhpNH9WjiX+BJLkY9abzq3ZgQw0U0kYyZ3ZllaXeX7W63C+znk0x33uybed83M6998940gL41mv1IIrZFxG8RMRwRA8szjFY+rl09P/PP1fMzSaTpW38l2W7x99XzM0XWJP/cmifGStVNKyycPXdyem5u9kyenlg89f7EwtlzL5w4NX189vjs6amDBw/sn3z5pakX16Se27NYd380v2fX4XcuvTFz5NK7P36TBbct/762HhUjHZc5GqMNT8BTHR/99rI9/2x4wbktZW19MCKGyu1/OAbKqYrheP2TngYHdFWapunGFVurPYClFLiLJdHrCIDeKP7QZ8+/xbKO3Y+eu3Ko8gCU1ftavlS+GYxSnmeo5vl2rY1GxJGlf7/Ilqg7DgEAsLa+y/o/z9fr/5XigZp89+RzQyMRcW9E7IiI+yJiZ0TcH1HO+2BEPLTK8keXpW+Ufz0fhPplc/u1u7UrhyJ5JZ/burn/V/T+YmQgT20v138oOXZibnZffk7GYmhjlp5sUsbl1379rNF3tf2/bMnKL/qCeRx/Di4boDs6vTjdSZ1rXfm4PAZ4YWX9k+pMQBIRuyJidxvH3xQRJ579ek91w4aag+aa17+JwTYCWib9KuKZyvVfimX1j5pQm8xPTmyKudl9E8VdsdJPP198s1H5t77+3ZVd/y117/9q/UeS2vnahdWXcfH3Txs+07R7/29I3i6vF7fTh9OLi2cmIzYkSyu3T93Yt0gX+bP6j+2t3/53RFz/Mt/v4YjIbuJHIuLRiHgsj/3xiHgiIvY2qf8Prz75Xvv1766s/kdXdf1XvzJw8vtvG5Xf2vU/UF4by7e08vuv1QA7OXcAAABwpyiV34FPSuPV9VJpfLzyDv/O2FKam19YfO7Y/Aenj1belR+JoVIx0jVcMx46mY+5FOmpfKy4SO8vjxunaZpuLqfHZ+bnujWnDrRma4P2n/ljoNfRAV1Xnkc7+Hlrmf2HF9xVbppHH+pdHMD6W4P3aIA7lPYP/Uv7h/5Vr/1fiLjWg1CAdebvP/Qv7R/6l/YP/Uv7h77Uyf/1N1vZcbhbR74TVy5HRKM8A20feWNEdBrh01vb3T1KvT6rra8U77RVt5TqZP6vVxFm17HVzBdivQLr8S8mAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACANfJ/AAAA///tr+cS") prlimit64(0x0, 0xe, &(0x7f0000000700)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000740)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000780)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000800)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000880), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000900)=0x6) r3 = socket$inet6(0xa, 0x2, 0x3a) r4 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r4, &(0x7f0000002a00)={0xa, 0x4e24, 0x81000, @empty}, 0x1c) add_key(&(0x7f0000004a80)='asymmetric\x00', 0x0, &(0x7f0000004ac0)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657930820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b716380327727385edb72ae6e0decfbb66d017fe95566dfbf1d76780228fbb57ff8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cde982d4b55b2d321f1c9d55f844f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb0252799c", 0x3ff, 0xffffffffffffffff) sendmmsg$inet6(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4000880) syz_mount_image$vfat(&(0x7f0000004fc0), &(0x7f0000005000)='./bus\x00', 0x307b87f, 0x0, 0x3, 0x0, &(0x7f0000005040)) syz_open_dev$loop(&(0x7f0000005100), 0x81, 0x141200) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) 11.308900466s ago: executing program 3 (id=625): shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000280)=""/181) openat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x8042, 0x40) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000400), 0xa000, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000440)=0x6, 0x7fec) syz_clone3(&(0x7f0000000480)={0xa3800000, &(0x7f0000000500)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000540)=0x0) io_submit(r1, 0x1, &(0x7f0000000580)=[&(0x7f00000005c0)={0x0, 0x0, 0x0, 0x5, 0x6, r0, 0x0}]) openat$binderfs_feature(0xffffffffffffff9c, &(0x7f00000003c0)='./binderfs/features/oneway_spam_detection\x00', 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000b00)={0x0, 0x40, 0x0, [0x2, 0x1eb, 0xfffffffffffffffe, 0x9, 0x3], [0x2, 0x2, 0x8, 0xfffffefffffffffe, 0x4, 0xfffffffffffffff9, 0x6, 0x1, 0xfffffffffffffffb, 0xc68, 0x5, 0xf, 0xfffffffffffffff8, 0x2494, 0xb, 0xfd, 0x2, 0x5fb3, 0x2000000000937, 0x200, 0x4, 0x2, 0x1, 0x4, 0x400, 0x7fffffff, 0x7, 0x3, 0x5, 0x9, 0x4, 0x4000000009, 0xffffffffffdffffc, 0x8000180000, 0xc, 0x1cf5, 0x800000000eb, 0x10000, 0x2, 0x800000000000000, 0xe559, 0x6, 0x9, 0x5, 0x95, 0x0, 0x5fc, 0x1001, 0x3, 0xfc6, 0x85, 0xcb14, 0x4005, 0x480000001, 0x8008000000000001, 0x40000000000756, 0x3, 0x5, 0x4, 0x8, 0xc2d8, 0x7, 0x4, 0x9, 0xf, 0x100000003, 0x400000020200, 0xb7, 0x1, 0x9, 0xa, 0x1000002a, 0x4, 0x40000000000002, 0xffffffffffffffff, 0x400000000000001, 0xfffffffffffff001, 0x408, 0x8100, 0x80000000, 0x2, 0x0, 0x2000000000, 0x5, 0x3a57, 0x7ff, 0x8, 0xd, 0x5, 0x1, 0x7, 0x2a, 0x8, 0x1d, 0x1000000000000145, 0x7, 0xe518, 0x8, 0x14, 0xffffffffffff81fb, 0x8000000000000, 0x8000000000000001, 0x3ff, 0xf, 0x5, 0x3400000000000000, 0x80003, 0x100, 0x38f9, 0x4, 0x1, 0x40a, 0x200200000000c, 0x43a, 0x3b, 0x1, 0x4000000ffcf, 0x100000400, 0x3, 0x2, 0x7fff]}) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000600)={0x1, &(0x7f0000000640)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=[@sndinfo={0x20, 0x84, 0x2, {0x1ff, 0x8, 0x7fff, 0x8}}], 0x20, 0x400c0}, 0x4080) r3 = creat(&(0x7f0000000700)='./file0\x00', 0x106) close(r3) r4 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r4, 0x0) recvmmsg(r4, &(0x7f0000006bc0)=[{{0x0, 0x0, 0x0}}], 0x300, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000006c00)='./file0\x00', &(0x7f0000006c40), 0x9, &(0x7f0000006c80)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=0x0]) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) r5 = userfaultfd(0x80001) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000f80)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x2, 0x0, 0x401d031, 0xffffffffffffffff, 0x0) 11.227977158s ago: executing program 0 (id=626): openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2001, 0x0) madvise(&(0x7f0000a30000/0x3000)=nil, 0x3000, 0x10) mlock2(&(0x7f000072d000/0x1000)=nil, 0x1000, 0x0) set_mempolicy(0x6005, &(0x7f00000005c0)=0xfffffffffffffffd, 0x4) syz_io_uring_setup(0xf00, 0x0, 0x0, 0x0, &(0x7f0000000700)) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000740)='numa_maps\x00') read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) 9.247149278s ago: executing program 0 (id=627): mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x800, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x16, 0x0, &(0x7f0000000d00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) ioctl$USBDEVFS_CLEAR_HALT(r3, 0x80045515, &(0x7f0000000300)={0x1, 0x1}) r4 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r4, 0x13) waitid(0x1, r4, 0x0, 0xb, &(0x7f00000003c0)) clock_adjtime(0x0, &(0x7f0000000040)={0x37db, 0xf4243, 0xfffffffffffffffc, 0x0, 0x0, 0x9, 0x0, 0x0, 0x3, 0x80000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x3, 0xffffffffffffffff, 0x0, 0x1, 0x6}) 8.949515035s ago: executing program 1 (id=628): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/target/core/rd_mcp_0/dev0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000140)='rd_pages=102', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r1, &(0x7f00000001c0)='1\n\x00', 0x3) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000002c0)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0) close(r2) symlinkat(&(0x7f00000004c0)='./config/target/core/rd_mcp_0/dev0\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0/virtual_scsi_port\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/enable\x00', 0x2, 0x0) write(r3, &(0x7f0000000580)='1\n\x00', 0x3) write(0xffffffffffffffff, &(0x7f0000000600)='dummy_udc.0\n\x00', 0xd) nanosleep(&(0x7f0000000640)={0x1}, 0x0) syz_open_dev$sg(&(0x7f0000000680), 0x1, 0x2) 8.38077662s ago: executing program 0 (id=629): r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000300), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/diskstats\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x106f) sendmsg$nl_route(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000005c0)=ANY=[@ANYBLOB="50000000100001060100000000000000000000006400000000000000000000000c00030076786c616e300000240012800c00010076786c616e00000014000280050019000100000005001e00010000"], 0x50}}, 0x0) ioctl(0xffffffffffffffff, 0x3b8f, &(0x7f0000000800)="2800000006000000010000000400"/23) 7.413177074s ago: executing program 0 (id=630): syz_usb_connect(0x6, 0x371, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x6ad01, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)) sysfs$3(0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x842, 0x0) ptrace$ARCH_FORCE_TAGGED_SVA(0x1e, 0x0, 0x0, 0x4004) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat2$dir(0xffffffffffffff9c, 0x0, &(0x7f0000000180)={0x40040, 0xd2, 0xf}, 0x18) unshare(0x20000) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000003c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x4, 0xea, 0x440, 0x0, 0x10, 0x0, 0x4}, 0x9c) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000580)={0x1c, 0x36, 0x1, 0x470fd2b, 0x25dfdbfc, {0x5}, [@typed={0x8, 0x4, 0x0, 0x0, @u32=0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24040050}, 0x24008004) bind$inet6(r1, 0x0, 0x0) sendto$inet6(r1, &(0x7f0000000600)='X', 0x34000, 0x0, &(0x7f0000000640)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000680), 0x8000, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'ip6tnl0\x00'}) sendmsg$nl_route_sched(r3, &(0x7f0000000700)={0x0, 0x0, 0x0}, 0x80080c0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000a00)={'gre0\x00'}) sendmsg$nl_route_sched(r4, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40088c1}, 0x4804) 7.344315896s ago: executing program 2 (id=631): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="400100001000010028bd7000fddbdf25ac1414aa00"/32, @ANYRES32=0x0, @ANYRESOCT=r0, @ANYBLOB="fc000000000000000000000000000000000000206c000000e0000001000000000000000000000000feffffffffffffff000000000000000000000000000000000100000000000008c80200000000010006000000000000000000000000000400000000", @ANYRESOCT=r0], 0x140}, 0x1, 0x0, 0x0, 0x4075}, 0x4800) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000005c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$bind(0x0, &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x80580, 0x0) r2 = syz_mount_image$nilfs2(&(0x7f0000000000), &(0x7f0000000140)='./file0\x00', 0x10010, &(0x7f0000000180)=ANY=[], 0x5, 0xa5a, &(0x7f0000000b40)="$eJzs3U1sHFcBAOA3a6/z22ZTHGrS0CYU2vJTu3FM+ImAVM2FqKm4Vaq4RElaIpyASCVI1UOSEzdaVeHK76mX8qNK5IKinrhUopG49FQ4cCAKUiUO0JC48vq99e7zbmbt2J6s9/uk2bdv3tt9b3ZnZmdn5r0XgKFVaz7OzEwUIVy+8saRfz32zy0hXBlfzNFoPo62xeohhCLGR7P3+2BkIbz14asnuoVFmG4+pnh47kbrtdtCCBfC3nA1NMLuy9def3f62WMXj17a996bh66vzdIDAMBw+c7VQzO7/v7Xh3Z+9NbDh8Om1vx0fN6I8e3xuP9wPPBPx/+10Bkv2qZ2Y1m+0TjVsnwjXfK1l1PP8o32KH8se996j3ybSsofaZvXbblhkKX1uBGK2mRHvFabnFz4Tx6a/+vHismzp2dfPFdRRYFV959HQgh7Taahny42N4jq67Gu09yOqvdAAAvy64VLXMjPLNyd1ruN9lf+jadr3V8Pq2C913/lD1b5v71oj8Pq2ahrU1qutB1tj/G26whnQpf7l/Ltby5/42z7T++XX4+o91nPXtcRBuX6Qq96jqxzPVaqV/3z9WKj+kYM0+fwzSy9ffvJv9NB+Y6B7v7r/L/JNLTTkuPbO8jvlQE2tvy+ubkopef39eXpm0rSN5ekbylJ39qRa2n6tpLXwzD748s/C68Vi//z8//0yz0fns6z3RfD+5dZn/x85HLLH7tDbD3Kd4zEIPnT8edPffXkC9cW7v8vWuv/7bi+743xRtyarsYM6Xxhfl69de9/o7OcWo98D2T1ua9L/ubz8c58xfji+4S2/cySekx0vm5Hr3x7OvM1snxb4rQ5q29+fLI1e106/kj71fR5jWbLW8+WYyyrR9qv7IxhXg9YibQ+9rr/P62fE6FevHh69tRTMZ7W07+M1DfNz99fXtTvVrvuwN3pt/3PROhs/7O9Nb9ea98v7FicX7TvFxrZ/Oke8w/EePqd+97Ilub8yRM/mD252gsPQ+7c+Ve+f3x29tSPPPHEE09aT6reMwFrberlMz+cOnf+lSdPnzn+0qmXTp09cPDggenpg187MDPVPK6faj+6BzaSxR/9qmsCAAAAAAAAAAAA9OvHR49c+9s7X3l/of3/Yvu/1P4/3fmb2v//tFho615rmx+6jAOY2gHu7JLezJN1sDqW5avH6RNZfcezcnZlr/tkDFvj+MX2/6m4vF/XVJ8Hs/l5/70pX9adwJL+UsayXkfy8QI/E8NLMfx1gAoVW7rPjmFZ/9ZpXU/9UyyjX4ruBVOJ9L2lLyX1Y5Laf/fq1ynt/3euQx1ZfevRnLDqZQS6+/cQ9//dPHZZw/f/zf3VL+Pm3mmbqq6bqfppbs4oHsC9oerxP9N5zxSe/fO3N89PKduNpzv3l3n/pXA37vXxJ5W/scb/bI1/19f+7+bS0RMaKyv3f7+4/n5bsWF3v/vffPlTP9DjeQl3PhP90Xz5NxcX5fHQX/lzv8rKzy8I9elmXP70+W/ts/wly7+nrKTzb3eb+/9YfvrYnni03/IXalzUOuuRnzdO1//y88bJrWz5T650+Vc4UOPtWD4Ms0EZZ3a5+hj/t6ls/N8lVnn8317y+zC+HONpR5juc8hHOFlm/VuR9DuwK3v/ouT3zfi/g+3rMSzbHtL4v2l9bHSJ19ri9S6f7Ubd18Cg+uDevf63+ENVfV1M/X5f1dfDtIxpbm5ubU9olai0cCr//Kv+n1B1+VV//mXy8X/zY/h8/N88PR//N0/Px//N0/Px9fL0rVl6/nnm4//m6Q9m75uPDzyR/cHO0z9V8vrdJekPlaTvKUn/dEn6vpL0h0vSHylJf6Ak/dGS9M+WpH+uJP2xkvQnStI/X5K+0aX2KMO6/DDM8vZ5tn8YHql9ba/tf7wkHRhcP39r/zMv/OG7jYX2/2Ot8yHpOt7hGK/H/84/ifH8undoi8+nvRPj/8jS7/XzHTBM8v4z8t/3x0vSgcGV7vOyfcMQKrq3k+i336pex/kMli/E8Isx/FIMn4zhZAynYrg/htPrVD/WxjO/f/vQa8Xi//0dWXq/95Pn7YHyfqIO9Fmf/PzAcu/Hz/vxW667LX+FzcEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqU2s+zsxMFCFcvvLGkeePnZ6an/OtVo5G83G0LVZvvS6Ep2I4EsNfxie3Pnz1RHt4O4ZFmA5FKFrzw3M3WiVtCyFcCHvD1dAIuy9fe/3d6WePXTx6ad97bx66vnafAAAAAGx8HwcAAP//V88c0Q==") mount$fuse(0x0, &(0x7f00000015c0)='./file0\x00', 0x0, 0x810, 0x0) ioctl$NILFS_IOCTL_SYNC(r2, 0x80086e8a, 0x0) ioctl(0xffffffffffffffff, 0x40946400, &(0x7f0000000100)) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) write$cgroup_int(r3, 0x0, 0x0) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r4, 0xc0383e04, 0x0) 6.285469962s ago: executing program 4 (id=632): r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)=@newtfilter={0x9c, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x9}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x68, 0x2, [@TCA_U32_POLICE={0x40, 0x6, [@TCA_POLICE_TBF={0x3c, 0x1, {0xf, 0x20000000, 0x6ed, 0xfffffff8, 0xfb10, {0x4, 0x2, 0x1, 0x8, 0x8}, {0xc, 0x2, 0x5, 0xfffc, 0x44, 0x8}, 0x78, 0x9, 0x6}}]}, @TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}]}}, @TCA_RATE={0x6, 0x5, {0xa5, 0x6}}]}, 0x9c}}, 0x24040084) 6.254797343s ago: executing program 1 (id=633): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x11, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000000000000000000400008500000061000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000008000000850000006900000095"], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000700)={r1, 0x18000000000002a0, 0xcc0, 0x0, &(0x7f0000000780)="ce010000009a697f65360c5e88a8", 0x0, 0x5dee, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 3.892601873s ago: executing program 1 (id=634): socket$kcm(0x11, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r1 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r1, &(0x7f0000000100)=@in={0x2, 0x3210, @rand_addr=0xac140001}, 0x10) listen(r1, 0x5) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000100001c11223344000800000005000500000005c1080008"], 0x4a) 3.892360763s ago: executing program 2 (id=635): socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000001340)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000001380)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000013c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000001400)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000001440), 0x0, 0x0) read$msr(r3, 0x0, 0x0) r4 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r4, &(0x7f000001a5c0)={0xa, 0x9004, 0x0, @local, 0x9}, 0x1c) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb01001800000000000000200000002000000004000000010000000000000104000000200000000100000000000001080000004000000000"], 0x0, 0x3c}, 0x28) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32=r5, @ANYBLOB="010000000200"/28], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r6, &(0x7f0000000200)="03", &(0x7f0000000240)}, 0x20) 3.852447444s ago: executing program 3 (id=636): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) setpgid(r0, r0) setpgid(0x0, r0) wait4(r0, 0x0, 0x2, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x0, 0x0, 0x0) socket(0x10, 0x3, 0x0) waitid(0x2, r0, 0x0, 0x4, 0x0) setpgid(r1, r1) setpgid(0x0, r1) syz_emit_ethernet(0x11, 0x0, 0x0) 2.962688786s ago: executing program 0 (id=637): socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f00000043c0)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000004400)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000004440)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000004480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000044c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000004540), 0x651, 0x0) recvmmsg(r1, &(0x7f0000004580), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000045c0)=0x6) socket$inet6(0xa, 0x2, 0x3a) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000004600)={0x1, 0x0, 0x8, 0x3}) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x27, &(0x7f0000004640)={@multicast1, @local}, 0xc) 2.891607688s ago: executing program 2 (id=638): prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) sendmsg$TIPC_NL_BEARER_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="010028bd700bfbdbdf"], 0x14}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x9) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2.844333939s ago: executing program 1 (id=639): mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x800, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x16, &(0x7f0000000600)=ANY=[], &(0x7f0000000d00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) ioctl$USBDEVFS_CLEAR_HALT(r3, 0x80045515, &(0x7f0000000300)={0x1, 0x1}) r4 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r4, 0x13) waitid(0x1, r4, 0x0, 0xb, &(0x7f00000003c0)) clock_adjtime(0x0, &(0x7f0000000040)={0x37db, 0xf4243, 0xfffffffffffffffc, 0x0, 0x0, 0x9, 0x0, 0x0, 0x3, 0x80000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x3, 0xffffffffffffffff, 0x0, 0x1, 0x6}) 1.862721744s ago: executing program 0 (id=640): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @cgroup_sysctl=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x44f, 0xb65a, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x10, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000580)={0x0, 0x22, 0x18, {[@local=@item_4={0x3, 0x2, 0x3, "043369eb"}, @local=@item_4={0x3, 0x2, 0x8, "fc1328b4"}, @main=@item_012={0x2, 0x0, 0xa, "193e"}, @local=@item_4={0x3, 0x2, 0xa, "0400f4b8"}, @local=@item_4={0x3, 0x2, 0x2, "04ded228"}, @local=@item_012={0x0, 0x2, 0xa}]}}, 0x0}, 0x0) socket$inet6(0xa, 0x800, 0x3e41) 1.839971214s ago: executing program 1 (id=641): socket$nl_generic(0x10, 0x3, 0x10) epoll_create(0x9) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xf, 0x204031, 0xffffffffffffffff, 0x2d5c000) sched_setscheduler(0x0, 0x1, &(0x7f0000000700)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000740)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r1, &(0x7f0000000800)=""/102392, 0x18ff8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a010400000000000000000200000a0900010073797a300000000040000000030a010400000000000000000200000a0900010073797a30000000200900030073797a3000000000140004800800014000000003080002400000000048000000060a010400000000000000000200000a0900010073797a30000200000900020073797a30000000001c00048018000180080001"], 0xd0}}, 0x0) 1.778446426s ago: executing program 4 (id=642): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000480)='./binderfs/binder0\x00', 0x802, 0x0) socket$inet6(0xa, 0x3, 0x88) r0 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f00000004c0)=ANY=[@ANYBLOB="1201020079db8540da0b77010b7d000000010902120004000000000904", @ANYRES32=r0, @ANYRES16=r0], 0x0) 1.074950393s ago: executing program 3 (id=643): socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0xc41a, &(0x7f00000001c0)={[{@noblock_validity}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x9}}, {@stripe={'stripe', 0x3d, 0xee9}}, {@nodioread_nolock}, {@discard}, {@usrjquota, 0x2e}, {@nouid32}, {@noauto_da_alloc}, {@jqfmt_vfsv0}, {@barrier}, {@nogrpid}], [], 0x2c}, 0x1, 0x477, &(0x7f0000000280)="$eJzs289vFFUcAPDvbFt+YyviDxC1ij8af7S0oHLwgtGEi4mJHvBYSyFIoYbWRAiR6gGPhpNH9WjiX+BJLkY9abzq3ZgQw0U0kYyZ3ZllaXeX7W63C+znk0x33uybed83M6998940gL41mv1IIrZFxG8RMRwRA8szjFY+rl09P/PP1fMzSaTpW38l2W7x99XzM0XWJP/cmifGStVNKyycPXdyem5u9kyenlg89f7EwtlzL5w4NX189vjs6amDBw/sn3z5pakX16Se27NYd380v2fX4XcuvTFz5NK7P36TBbct/762HhUjHZc5GqMNT8BTHR/99rI9/2x4wbktZW19MCKGyu1/OAbKqYrheP2TngYHdFWapunGFVurPYClFLiLJdHrCIDeKP7QZ8+/xbKO3Y+eu3Ko8gCU1ftavlS+GYxSnmeo5vl2rY1GxJGlf7/Ilqg7DgEAsLa+y/o/z9fr/5XigZp89+RzQyMRcW9E7IiI+yJiZ0TcH1HO+2BEPLTK8keXpW+Ufz0fhPplc/u1u7UrhyJ5JZ/burn/V/T+YmQgT20v138oOXZibnZffk7GYmhjlp5sUsbl1379rNF3tf2/bMnKL/qCeRx/Di4boDs6vTjdSZ1rXfm4PAZ4YWX9k+pMQBIRuyJidxvH3xQRJ579ek91w4aag+aa17+JwTYCWib9KuKZyvVfimX1j5pQm8xPTmyKudl9E8VdsdJPP198s1H5t77+3ZVd/y117/9q/UeS2vnahdWXcfH3Txs+07R7/29I3i6vF7fTh9OLi2cmIzYkSyu3T93Yt0gX+bP6j+2t3/53RFz/Mt/v4YjIbuJHIuLRiHgsj/3xiHgiIvY2qf8Prz75Xvv1766s/kdXdf1XvzJw8vtvG5Xf2vU/UF4by7e08vuv1QA7OXcAAABwpyiV34FPSuPV9VJpfLzyDv/O2FKam19YfO7Y/Aenj1belR+JoVIx0jVcMx46mY+5FOmpfKy4SO8vjxunaZpuLqfHZ+bnujWnDrRma4P2n/ljoNfRAV1Xnkc7+Hlrmf2HF9xVbppHH+pdHMD6W4P3aIA7lPYP/Uv7h/5Vr/1fiLjWg1CAdebvP/Qv7R/6l/YP/Uv7h77Uyf/1N1vZcbhbR74TVy5HRKM8A20feWNEdBrh01vb3T1KvT6rra8U77RVt5TqZP6vVxFm17HVzBdivQLr8S8mAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACANfJ/AAAA///tr+cS") prlimit64(0x0, 0xe, &(0x7f0000000700)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000740)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000780)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000800)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000880), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000900)=0x6) r3 = socket$inet6(0xa, 0x2, 0x3a) r4 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r4, &(0x7f0000002a00)={0xa, 0x4e24, 0x81000, @empty}, 0x1c) add_key(&(0x7f0000004a80)='asymmetric\x00', 0x0, &(0x7f0000004ac0)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657930820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b716380327727385edb72ae6e0decfbb66d017fe95566dfbf1d76780228fbb57ff8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cde982d4b55b2d321f1c9d55f844f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb0252799c", 0x3ff, 0xffffffffffffffff) sendmmsg$inet6(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4000880) syz_mount_image$vfat(&(0x7f0000004fc0), &(0x7f0000005000)='./bus\x00', 0x307b87f, 0x0, 0x3, 0x0, &(0x7f0000005040)) syz_open_dev$loop(&(0x7f0000005100), 0x81, 0x141200) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) 164.779776ms ago: executing program 3 (id=644): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x19, 0x3, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = fsopen(&(0x7f0000000740)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000780)={r0, r2, 0x16}, 0x13) socket$packet(0x11, 0x3, 0x300) r3 = socket$inet(0x2, 0x2, 0x1) setsockopt$inet_int(r3, 0x0, 0xf, &(0x7f0000000240)=0xfffffffc, 0x4) 13.64403ms ago: executing program 1 (id=645): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x40e02, 0x0) write$rfkill(r0, &(0x7f0000000040)={0x0, 0x2, 0x3, 0x1, 0x1}, 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x20) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x81084000, 0x0, 0x0, 0x0, 0x0, 0x0) preadv(r1, &(0x7f0000001b00)=[{&(0x7f00000009c0)=""/239, 0xef}], 0x1, 0x2, 0x0) 0s ago: executing program 2 (id=646): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="400100001000010028bd7000fddbdf25ac1414aa00"/32, @ANYRES32=0x0, @ANYRESOCT=r0, @ANYBLOB="fc000000000000000000000000000000000000206c000000e0000001000000000000000000000000feffffffffffffff000000000000000000000000000000000100000000000008c80200000000010006000000000000000000000000000400000000", @ANYRESOCT=r0], 0x140}, 0x1, 0x0, 0x0, 0x4075}, 0x4800) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000005c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$bind(0x0, &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x80580, 0x0) r2 = syz_mount_image$nilfs2(&(0x7f0000000000), &(0x7f0000000140)='./file0\x00', 0x10010, &(0x7f0000000180)=ANY=[], 0x5, 0xa5a, &(0x7f0000000b40)="$eJzs3U1sHFcBAOA3a6/z22ZTHGrS0CYU2vJTu3FM+ImAVM2FqKm4Vaq4RElaIpyASCVI1UOSEzdaVeHK76mX8qNK5IKinrhUopG49FQ4cCAKUiUO0JC48vq99e7zbmbt2J6s9/uk2bdv3tt9b3ZnZmdn5r0XgKFVaz7OzEwUIVy+8saRfz32zy0hXBlfzNFoPo62xeohhCLGR7P3+2BkIbz14asnuoVFmG4+pnh47kbrtdtCCBfC3nA1NMLuy9def3f62WMXj17a996bh66vzdIDAMBw+c7VQzO7/v7Xh3Z+9NbDh8Om1vx0fN6I8e3xuP9wPPBPx/+10Bkv2qZ2Y1m+0TjVsnwjXfK1l1PP8o32KH8se996j3ybSsofaZvXbblhkKX1uBGK2mRHvFabnFz4Tx6a/+vHismzp2dfPFdRRYFV959HQgh7Taahny42N4jq67Gu09yOqvdAAAvy64VLXMjPLNyd1ruN9lf+jadr3V8Pq2C913/lD1b5v71oj8Pq2ahrU1qutB1tj/G26whnQpf7l/Ltby5/42z7T++XX4+o91nPXtcRBuX6Qq96jqxzPVaqV/3z9WKj+kYM0+fwzSy9ffvJv9NB+Y6B7v7r/L/JNLTTkuPbO8jvlQE2tvy+ubkopef39eXpm0rSN5ekbylJ39qRa2n6tpLXwzD748s/C68Vi//z8//0yz0fns6z3RfD+5dZn/x85HLLH7tDbD3Kd4zEIPnT8edPffXkC9cW7v8vWuv/7bi+743xRtyarsYM6Xxhfl69de9/o7OcWo98D2T1ua9L/ubz8c58xfji+4S2/cySekx0vm5Hr3x7OvM1snxb4rQ5q29+fLI1e106/kj71fR5jWbLW8+WYyyrR9qv7IxhXg9YibQ+9rr/P62fE6FevHh69tRTMZ7W07+M1DfNz99fXtTvVrvuwN3pt/3PROhs/7O9Nb9ea98v7FicX7TvFxrZ/Oke8w/EePqd+97Ilub8yRM/mD252gsPQ+7c+Ve+f3x29tSPPPHEE09aT6reMwFrberlMz+cOnf+lSdPnzn+0qmXTp09cPDggenpg187MDPVPK6faj+6BzaSxR/9qmsCAAAAAAAAAAAA9OvHR49c+9s7X3l/of3/Yvu/1P4/3fmb2v//tFho615rmx+6jAOY2gHu7JLezJN1sDqW5avH6RNZfcezcnZlr/tkDFvj+MX2/6m4vF/XVJ8Hs/l5/70pX9adwJL+UsayXkfy8QI/E8NLMfx1gAoVW7rPjmFZ/9ZpXU/9UyyjX4ruBVOJ9L2lLyX1Y5Laf/fq1ynt/3euQx1ZfevRnLDqZQS6+/cQ9//dPHZZw/f/zf3VL+Pm3mmbqq6bqfppbs4oHsC9oerxP9N5zxSe/fO3N89PKduNpzv3l3n/pXA37vXxJ5W/scb/bI1/19f+7+bS0RMaKyv3f7+4/n5bsWF3v/vffPlTP9DjeQl3PhP90Xz5NxcX5fHQX/lzv8rKzy8I9elmXP70+W/ts/wly7+nrKTzb3eb+/9YfvrYnni03/IXalzUOuuRnzdO1//y88bJrWz5T650+Vc4UOPtWD4Ms0EZZ3a5+hj/t6ls/N8lVnn8317y+zC+HONpR5juc8hHOFlm/VuR9DuwK3v/ouT3zfi/g+3rMSzbHtL4v2l9bHSJ19ri9S6f7Ubd18Cg+uDevf63+ENVfV1M/X5f1dfDtIxpbm5ubU9olai0cCr//Kv+n1B1+VV//mXy8X/zY/h8/N88PR//N0/Px//N0/Px9fL0rVl6/nnm4//m6Q9m75uPDzyR/cHO0z9V8vrdJekPlaTvKUn/dEn6vpL0h0vSHylJf6Ak/dGS9M+WpH+uJP2xkvQnStI/X5K+0aX2KMO6/DDM8vZ5tn8YHql9ba/tf7wkHRhcP39r/zMv/OG7jYX2/2Ot8yHpOt7hGK/H/84/ifH8undoi8+nvRPj/8jS7/XzHTBM8v4z8t/3x0vSgcGV7vOyfcMQKrq3k+i336pex/kMli/E8Isx/FIMn4zhZAynYrg/htPrVD/WxjO/f/vQa8Xi//0dWXq/95Pn7YHyfqIO9Fmf/PzAcu/Hz/vxW667LX+FzcEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqU2s+zsxMFCFcvvLGkeePnZ6an/OtVo5G83G0LVZvvS6Ep2I4EsNfxie3Pnz1RHt4O4ZFmA5FKFrzw3M3WiVtCyFcCHvD1dAIuy9fe/3d6WePXTx6ad97bx66vnafAAAAAGx8HwcAAP//V88c0Q==") mount$fuse(0x0, &(0x7f00000015c0)='./file0\x00', 0x0, 0x810, 0x0) ioctl$NILFS_IOCTL_SYNC(r2, 0x80086e8a, 0x0) ioctl(0xffffffffffffffff, 0x40946400, &(0x7f0000000100)) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) write$cgroup_int(r3, 0x0, 0x0) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e66ccdb9e581a38ebb0ddd5f307e56", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r4, 0xc0383e04, 0x0) kernel console output (not intermixed with test programs): 50:50 [ 75.421297][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.463988][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 78.168244][ T4328] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.196090][ T4328] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.331833][ T4321] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 78.459178][ T4333] loop2: detected capacity change from 0 to 256 [ 78.576629][ T4265] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 80.515379][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #100!!! [ 80.545346][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #202!!! [ 80.575349][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! [ 80.645306][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #38a!!! [ 80.660524][ T4348] loop1: detected capacity change from 0 to 2048 [ 80.675362][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #38a!!! [ 80.715325][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #302!!! [ 80.735347][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #392!!! [ 80.765338][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #392!!! [ 80.795343][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #392!!! [ 80.825339][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #392!!! [ 81.459744][ T4348] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 81.792240][ T4350] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 81.838181][ T4348] NILFS error (device loop1): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 81.861566][ T4348] Remounting filesystem read-only [ 82.049687][ T4345] Zero length message leads to an empty skb [ 82.146472][ T4354] loop0: detected capacity change from 0 to 1024 [ 83.386837][ T4368] loop1: detected capacity change from 0 to 512 [ 83.958751][ T4373] loop3: detected capacity change from 0 to 512 [ 84.169186][ T4366] syz.4.11 (4366): drop_caches: 2 [ 84.176564][ T4365] syz.4.11 (4365): drop_caches: 2 [ 84.183280][ T4365] syz.4.11 (4365): drop_caches: 2 [ 84.619525][ T4373] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 84.694276][ T4368] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 84.860248][ T4373] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.14: invalid indirect mapped block 256 (level 1) [ 84.883703][ T4368] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.13: invalid indirect mapped block 256 (level 1) [ 85.193414][ T4368] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.13: invalid indirect mapped block 2683928664 (level 1) [ 85.249225][ T4373] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.14: invalid indirect mapped block 2683928664 (level 1) [ 85.326176][ T4368] EXT4-fs (loop1): 1 truncate cleaned up [ 85.332283][ T4373] EXT4-fs (loop3): 1 truncate cleaned up [ 85.345394][ T4373] EXT4-fs (loop3): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 85.377010][ T4368] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 86.607168][ T4383] netlink: 12 bytes leftover after parsing attributes in process `syz.2.16'. [ 87.203933][ T1107] cfg80211: failed to load regulatory.db [ 87.413539][ T4393] netlink: 28 bytes leftover after parsing attributes in process `syz.0.15'. [ 87.599322][ T1107] rxe_eth0 speed is unknown, defaulting to 1000 [ 91.203903][ T4416] loop3: detected capacity change from 0 to 256 [ 92.452633][ T4425] jffs2: notice: (4425) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 96.565827][ T4450] netlink: 12 bytes leftover after parsing attributes in process `syz.4.29'. [ 96.922446][ T4447] loop2: detected capacity change from 0 to 512 [ 98.800856][ T4458] loop0: detected capacity change from 0 to 128 [ 98.989056][ T4447] EXT4-fs: error -4 creating inode table initialization thread [ 99.119903][ T4466] loop1: detected capacity change from 0 to 1024 [ 99.249589][ T4470] syz.3.33 (4470): drop_caches: 2 [ 99.521905][ T4468] syz.3.33 (4468): drop_caches: 2 [ 99.528947][ T4468] syz.3.33 (4468): drop_caches: 2 [ 99.547845][ T4447] EXT4-fs (loop2): mount failed [ 99.561646][ T4458] EXT4-fs (loop0): mounted filesystem without journal. Opts: noquota,nombcache,,errors=continue. Quota mode: none. [ 99.645923][ T4458] ext4 filesystem being mounted at /4/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 99.670468][ T4466] EXT4-fs (loop1): inline encryption not supported [ 99.677188][ T4466] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 99.684570][ T4466] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 100.589369][ T4466] EXT4-fs (loop1): mounted filesystem without journal. Opts: jqfmt=vfsv0,auto_da_alloc,noblock_validity,grpquota,inlinecrypt,delalloc,nomblk_io_submit,errors=remount-ro,dioread_nolock,. Quota mode: writeback. [ 100.638605][ T4466] ext4 filesystem being mounted at /7/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 100.777138][ T4466] EXT4-fs (loop1): shut down requested (0) [ 100.834782][ T4477] device syzkaller0 entered promiscuous mode [ 100.862134][ T4478] EXT4-fs (loop1): shut down requested (0) [ 100.979425][ T4480] loop0: detected capacity change from 0 to 512 [ 101.128848][ T4480] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 101.174109][ T4480] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.34: invalid indirect mapped block 256 (level 1) [ 101.197910][ T4480] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.34: invalid indirect mapped block 2683928664 (level 1) [ 101.312275][ T4480] EXT4-fs (loop0): 1 truncate cleaned up [ 101.335902][ T4480] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 101.391210][ T4486] loop1: detected capacity change from 0 to 4096 [ 102.203390][ T4489] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:476: comm syz.0.34: Invalid block bitmap block 3 in block_group 0 [ 102.358455][ T4486] ntfs3: Unknown parameter 'nocase' [ 103.115905][ T4498] netlink: 12 bytes leftover after parsing attributes in process `syz.2.41'. [ 103.611719][ T4503] FAULT_INJECTION: forcing a failure. [ 103.611719][ T4503] name failslab, interval 1, probability 0, space 0, times 1 [ 103.683918][ T4503] CPU: 1 PID: 4503 Comm: syz.4.31 Not tainted syzkaller #0 [ 103.691380][ T4503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 103.701510][ T4503] Call Trace: [ 103.704845][ T4503] [ 103.707816][ T4503] dump_stack_lvl+0x188/0x250 [ 103.712563][ T4503] ? show_regs_print_info+0x20/0x20 [ 103.717819][ T4503] ? load_image+0x410/0x410 [ 103.722401][ T4503] ? __might_sleep+0xf0/0xf0 [ 103.727045][ T4503] ? __lock_acquire+0x7d40/0x7d40 [ 103.732137][ T4503] should_fail+0x383/0x4b0 [ 103.736631][ T4503] should_failslab+0x5/0x20 [ 103.741202][ T4503] slab_pre_alloc_hook+0x51/0xc0 [ 103.746360][ T4503] __kmalloc_node+0x6d/0x3a0 [ 103.751017][ T4503] ? memcg_alloc_page_obj_cgroups+0x7d/0x120 [ 103.757068][ T4503] memcg_alloc_page_obj_cgroups+0x7d/0x120 [ 103.762944][ T4503] slab_post_alloc_hook+0xba/0x380 [ 103.768127][ T4503] ? __d_alloc+0x27/0x6d0 [ 103.772516][ T4503] kmem_cache_alloc+0x15d/0x280 [ 103.777600][ T4503] __d_alloc+0x27/0x6d0 [ 103.781814][ T4503] ? d_alloc_pseudo+0xe/0x70 [ 103.786459][ T4503] d_alloc_pseudo+0x19/0x70 [ 103.791019][ T4503] alloc_file_pseudo+0xe0/0x200 [ 103.795928][ T4503] ? alloc_empty_file_noaccount+0x80/0x80 [ 103.801718][ T4503] sock_alloc_file+0xb3/0x240 [ 103.806450][ T4503] xs_local_connect+0x138/0x830 [ 103.811330][ T4503] ? __lock_acquire+0x7d40/0x7d40 [ 103.816392][ T4503] ? xs_local_set_port+0x10/0x10 [ 103.821371][ T4503] ? preempt_schedule_thunk+0x16/0x18 [ 103.826776][ T4503] xprt_connect+0x5f7/0x800 [ 103.831357][ T4503] ? call_bind+0x1c0/0x1c0 [ 103.835815][ T4503] __rpc_execute+0x2cc/0x1010 [ 103.840725][ T4503] ? rpc_make_runnable+0x1b0/0x1b0 [ 103.845879][ T4503] ? __wake_up_bit+0x120/0x120 [ 103.850866][ T4503] ? do_raw_spin_lock+0x128/0x2f0 [ 103.856027][ T4503] ? rpc_make_runnable+0xa9/0x1b0 [ 103.861222][ T4503] rpc_execute+0x176/0x320 [ 103.865696][ T4503] rpc_run_task+0x5b8/0x790 [ 103.870238][ T4503] rpc_create_xprt+0x523/0x9c0 [ 103.875125][ T4503] ? rpc_create+0x7e0/0x7e0 [ 103.879833][ T4503] ? kstrdup+0x4d/0x70 [ 103.884078][ T4503] ? memcpy+0x3c/0x60 [ 103.888116][ T4503] ? xprt_create_transport+0x41d/0x5b0 [ 103.893603][ T4503] rpc_create+0x55f/0x7e0 [ 103.897949][ T4503] ? rpc_cleanup_clids+0x20/0x20 [ 103.902928][ T4503] set_gssp_clnt+0x18c/0x2d0 [ 103.907545][ T4503] ? write_gssp+0x280/0x280 [ 103.912087][ T4503] ? _kstrtoull+0x3cb/0x4e0 [ 103.916697][ T4503] write_gssp+0x1d5/0x280 [ 103.921133][ T4503] ? read_gssp+0x2e0/0x2e0 [ 103.925580][ T4503] ? rcu_read_lock_any_held+0xb0/0x130 [ 103.931093][ T4503] ? rcu_read_lock_bh_held+0xf0/0xf0 [ 103.936439][ T4503] ? end_current_label_crit_section+0x14b/0x170 [ 103.942756][ T4503] ? read_gssp+0x2e0/0x2e0 [ 103.947199][ T4503] proc_reg_write+0x1dd/0x2c0 [ 103.951902][ T4503] ? proc_reg_llseek+0x280/0x280 [ 103.956861][ T4503] vfs_write+0x304/0xd70 [ 103.961146][ T4503] ? file_end_write+0x250/0x250 [ 103.966142][ T4503] ? mutex_lock_nested+0x17/0x20 [ 103.971104][ T4503] ? __fdget_pos+0x2bf/0x370 [ 103.975704][ T4503] ? ksys_write+0x70/0x260 [ 103.980175][ T4503] ksys_write+0x153/0x260 [ 103.984532][ T4503] ? __ia32_sys_read+0x80/0x80 [ 103.989316][ T4503] ? lockdep_hardirqs_on+0x94/0x140 [ 103.994547][ T4503] do_syscall_64+0x4c/0xa0 [ 103.998983][ T4503] ? clear_bhb_loop+0x30/0x80 [ 104.003716][ T4503] ? clear_bhb_loop+0x30/0x80 [ 104.008411][ T4503] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 104.014333][ T4503] RIP: 0033:0x7f46c8275559 [ 104.018771][ T4503] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.038393][ T4503] RSP: 002b:00007f46c64cc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 104.046831][ T4503] RAX: ffffffffffffffda RBX: 00007f46c84fbfa0 RCX: 00007f46c8275559 [ 104.054907][ T4503] RDX: 0000000000000001 RSI: 0000200000000100 RDI: 0000000000000005 [ 104.062917][ T4503] RBP: 00007f46c830cb20 R08: 0000000000000000 R09: 0000000000000000 [ 104.070926][ T4503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.078911][ T4503] R13: 00007f46c84fc038 R14: 00007f46c84fbfa0 R15: 00007ffea186aef8 [ 104.086908][ T4503] [ 104.138584][ T4506] block device autoloading is deprecated and will be removed. [ 104.183902][ T4514] loop3: detected capacity change from 0 to 256 [ 104.467539][ T4518] netlink: 28 bytes leftover after parsing attributes in process `syz.1.46'. [ 105.480948][ T4520] syz.0.47 (4520): drop_caches: 2 [ 105.486384][ T4520] syz.0.47 (4520): drop_caches: 2 [ 105.493101][ T4520] syz.0.47 (4520): drop_caches: 2 [ 105.674844][ T4514] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 105.718259][ T26] audit: type=1800 audit(1792693556.744:2): pid=4514 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.44" name="file1" dev="loop3" ino=1048630 res=0 errno=0 [ 105.870511][ T4524] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 105.955450][ T4524] CIFS mount error: No usable UNC path provided in device string! [ 105.955450][ T4524] [ 105.992054][ T4526] FAULT_INJECTION: forcing a failure. [ 105.992054][ T4526] name failslab, interval 1, probability 0, space 0, times 0 [ 106.015630][ T4530] jffs2: notice: (4530) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 106.037414][ T4524] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 106.094297][ T4526] CPU: 0 PID: 4526 Comm: syz.1.49 Not tainted syzkaller #0 [ 106.101572][ T4526] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 106.111716][ T4526] Call Trace: [ 106.116622][ T4526] [ 106.119640][ T4526] dump_stack_lvl+0x188/0x250 [ 106.124372][ T4526] ? show_regs_print_info+0x20/0x20 [ 106.129625][ T4526] ? load_image+0x410/0x410 [ 106.134180][ T4526] ? __might_sleep+0xf0/0xf0 [ 106.138820][ T4526] ? __lock_acquire+0x7d40/0x7d40 [ 106.143896][ T4526] ? _find_next_bit+0x1f0/0x200 [ 106.148794][ T4526] should_fail+0x383/0x4b0 [ 106.153264][ T4526] should_failslab+0x5/0x20 [ 106.157813][ T4526] slab_pre_alloc_hook+0x51/0xc0 [ 106.162804][ T4526] kmem_cache_alloc_trace+0x47/0x290 [ 106.168424][ T4526] ? percpu_ref_init+0xc0/0x340 [ 106.173356][ T4526] ? rcu_lock_release+0x20/0x20 [ 106.178251][ T4526] percpu_ref_init+0xc0/0x340 [ 106.182999][ T4526] blkg_alloc+0xc6/0x640 [ 106.187304][ T4526] blkcg_init_queue+0x26/0x430 [ 106.192121][ T4526] blk_alloc_queue+0x427/0x580 [ 106.196979][ T4526] __blk_alloc_disk+0x15/0x60 [ 106.201740][ T4526] dm_create+0x57f/0xf90 [ 106.206045][ T4526] dev_create+0x12e/0x2c0 [ 106.210428][ T4526] ? list_devices+0x820/0x820 [ 106.215158][ T4526] ? __might_fault+0xb3/0x110 [ 106.219900][ T4526] ? _copy_from_user+0x111/0x170 [ 106.224896][ T4526] dm_ctl_ioctl+0x947/0xd00 [ 106.229494][ T4526] ? list_devices+0x820/0x820 [ 106.234220][ T4526] ? dm_poll+0x120/0x120 [ 106.238556][ T4526] ? bpf_lsm_file_ioctl+0x5/0x10 [ 106.243549][ T4526] ? security_file_ioctl+0x7c/0xa0 [ 106.248718][ T4526] ? dm_poll+0x120/0x120 [ 106.253014][ T4526] __se_sys_ioctl+0xfa/0x170 [ 106.257653][ T4526] do_syscall_64+0x4c/0xa0 [ 106.262243][ T4526] ? clear_bhb_loop+0x30/0x80 [ 106.267005][ T4526] ? clear_bhb_loop+0x30/0x80 [ 106.271729][ T4526] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 106.277683][ T4526] RIP: 0033:0x7fe66f3ef559 [ 106.282153][ T4526] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 106.301803][ T4526] RSP: 002b:00007fe66d646028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 106.310279][ T4526] RAX: ffffffffffffffda RBX: 00007fe66f675fa0 RCX: 00007fe66f3ef559 [ 106.318303][ T4526] RDX: 00002000000018c0 RSI: 00000000c138fd03 RDI: 0000000000000004 [ 106.326560][ T4526] RBP: 00007fe66f486b20 R08: 0000000000000000 R09: 0000000000000000 [ 106.334580][ T4526] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 106.342591][ T4526] R13: 00007fe66f676038 R14: 00007fe66f675fa0 R15: 00007ffecbe22168 [ 106.350742][ T4526] [ 106.375974][ T4533] loop0: detected capacity change from 0 to 512 [ 107.358904][ T4533] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 107.376669][ T4533] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.51: invalid indirect mapped block 256 (level 1) [ 107.478585][ T4547] syz.1.54 (4547): drop_caches: 2 [ 107.487794][ T4547] syz.1.54 (4547): drop_caches: 2 [ 107.500486][ T4547] syz.1.54 (4547): drop_caches: 2 [ 108.294444][ T4533] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.51: invalid indirect mapped block 2683928664 (level 1) [ 108.373229][ T4533] EXT4-fs (loop0): 1 truncate cleaned up [ 108.389248][ T4533] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 108.565392][ T4544] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:476: comm ext4lazyinit: Invalid block bitmap block 3 in block_group 0 [ 108.601129][ T4553] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:476: comm syz.0.51: Invalid block bitmap block 3 in block_group 0 [ 108.990273][ T4560] loop1: detected capacity change from 0 to 512 [ 109.077313][ T4561] tc_dump_action: action bad kind [ 110.273733][ T4560] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 110.296808][ T4560] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.57: invalid indirect mapped block 256 (level 1) [ 110.366172][ T4560] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.57: invalid indirect mapped block 2683928664 (level 1) [ 110.425696][ T4560] EXT4-fs (loop1): 1 truncate cleaned up [ 110.431656][ T4560] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 112.991059][ T4578] loop2: detected capacity change from 0 to 1024 [ 113.264059][ T4585] syz.1.63 (4585): drop_caches: 2 [ 113.272260][ T4585] syz.1.63 (4585): drop_caches: 2 [ 113.286540][ T4582] syz.1.63 (4582): drop_caches: 2 [ 114.120983][ T4601] syz.0.67 (4601): drop_caches: 2 [ 114.131689][ T4601] syz.0.67 (4601): drop_caches: 2 [ 114.144200][ T4601] syz.0.67 (4601): drop_caches: 2 [ 115.183851][ T4609] FAULT_INJECTION: forcing a failure. [ 115.183851][ T4609] name failslab, interval 1, probability 0, space 0, times 0 [ 115.316450][ T4609] CPU: 0 PID: 4609 Comm: syz.3.70 Not tainted syzkaller #0 [ 115.323745][ T4609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 115.333845][ T4609] Call Trace: [ 115.337161][ T4609] [ 115.340102][ T4609] dump_stack_lvl+0x188/0x250 [ 115.344810][ T4609] ? show_regs_print_info+0x20/0x20 [ 115.350070][ T4609] ? load_image+0x410/0x410 [ 115.354607][ T4609] ? __might_sleep+0xf0/0xf0 [ 115.359297][ T4609] ? __lock_acquire+0x7d40/0x7d40 [ 115.364345][ T4609] should_fail+0x383/0x4b0 [ 115.368780][ T4609] should_failslab+0x5/0x20 [ 115.373303][ T4609] slab_pre_alloc_hook+0x51/0xc0 [ 115.378275][ T4609] kmem_cache_alloc_trace+0x47/0x290 [ 115.383583][ T4609] ? cma_alloc_port+0xb5/0x5f0 [ 115.388404][ T4609] cma_alloc_port+0xb5/0x5f0 [ 115.393033][ T4609] rdma_bind_addr+0xe27/0x37e0 [ 115.397863][ T4609] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 115.403777][ T4609] ? rdma_listen+0xde0/0xde0 [ 115.408398][ T4609] ? rdma_listen+0x26b/0xde0 [ 115.413041][ T4609] rdma_listen+0x278/0xde0 [ 115.417476][ T4609] ? mutex_lock_io_nested+0x60/0x60 [ 115.422696][ T4609] ? rdma_set_afonly+0x120/0x120 [ 115.427700][ T4609] ucma_listen+0x17b/0x260 [ 115.432169][ T4609] ? ucma_connect+0x590/0x590 [ 115.436990][ T4609] ? __might_fault+0xb3/0x110 [ 115.441689][ T4609] ? _copy_from_user+0x111/0x170 [ 115.446641][ T4609] ucma_write+0x24e/0x2f0 [ 115.451042][ T4609] ? ucma_get_global_nl_info+0x70/0x70 [ 115.456518][ T4609] ? common_file_perm+0x171/0x1c0 [ 115.461561][ T4609] ? fsnotify_perm+0x5d/0x560 [ 115.466259][ T4609] ? security_file_permission+0x75/0xa0 [ 115.471852][ T4609] ? ucma_get_global_nl_info+0x70/0x70 [ 115.477335][ T4609] vfs_write+0x304/0xd70 [ 115.481600][ T4609] ? file_end_write+0x250/0x250 [ 115.486474][ T4609] ? __fget_files+0x402/0x470 [ 115.491175][ T4609] ? __fdget_pos+0x1e2/0x370 [ 115.495775][ T4609] ? ksys_write+0x70/0x260 [ 115.500228][ T4609] ksys_write+0x153/0x260 [ 115.504574][ T4609] ? __ia32_sys_read+0x80/0x80 [ 115.509363][ T4609] ? lockdep_hardirqs_on+0x94/0x140 [ 115.514595][ T4609] do_syscall_64+0x4c/0xa0 [ 115.519049][ T4609] ? clear_bhb_loop+0x30/0x80 [ 115.523762][ T4609] ? clear_bhb_loop+0x30/0x80 [ 115.528454][ T4609] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 115.534374][ T4609] RIP: 0033:0x7f020ffa5559 [ 115.538908][ T4609] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 115.558532][ T4609] RSP: 002b:00007f020e1fc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 115.566964][ T4609] RAX: ffffffffffffffda RBX: 00007f021022bfa0 RCX: 00007f020ffa5559 [ 115.574947][ T4609] RDX: 00000000fffffcda RSI: 0000200000000900 RDI: 0000000000000004 [ 115.582937][ T4609] RBP: 00007f021003cb20 R08: 0000000000000000 R09: 0000000000000000 [ 115.590921][ T4609] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 115.598935][ T4609] R13: 00007f021022c038 R14: 00007f021022bfa0 R15: 00007fff4e04d928 [ 115.606956][ T4609] [ 115.655454][ T4612] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 117.006248][ T4204] Bluetooth: Wrong link type (-22) [ 118.575234][ T4650] syz.1.81 (4650): drop_caches: 2 [ 118.584652][ T4650] syz.1.81 (4650): drop_caches: 2 [ 118.595771][ T4650] syz.1.81 (4650): drop_caches: 2 [ 119.639810][ T4274] rpcbind: server 127.0.0.1 not responding, timed out [ 119.732484][ T4657] loop4: detected capacity change from 0 to 512 [ 119.835485][ T4196] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 120.071903][ T4657] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2 [ 120.180883][ T4657] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.84: invalid indirect mapped block 256 (level 1) [ 120.236864][ T4196] usb 3-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 120.334879][ T4657] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.84: invalid indirect mapped block 2683928664 (level 1) [ 120.407781][ T4196] usb 3-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 120.506976][ T4657] EXT4-fs (loop4): 1 truncate cleaned up [ 120.543847][ T4657] EXT4-fs (loop4): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 120.679854][ T4196] usb 3-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 120.690809][ T4196] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.713136][ T4196] usb 3-1: Product: syz [ 120.727664][ T4196] usb 3-1: Manufacturer: syz [ 120.742603][ T4196] usb 3-1: SerialNumber: syz [ 120.858836][ T4196] ti_usb_3410_5052 3-1:2.0: TI USB 5052 2 port adapter converter detected [ 120.954389][ T4666] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:476: comm syz.4.84: Invalid block bitmap block 3 in block_group 0 [ 121.142670][ T4196] usb 3-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 121.212895][ T4196] usb 3-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 122.001520][ T4678] loop1: detected capacity change from 0 to 2048 [ 122.056503][ T4678] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 122.145064][ T4680] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 122.164501][ T4678] NILFS error (device loop1): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 122.178450][ T4678] Remounting filesystem read-only [ 123.456791][ T4659] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set config on port 0, -110 [ 123.675810][ T4659] ti_usb_3410_5052_2 ttyUSB0: ti_write_byte - failed, -32 [ 125.622080][ T4659] ti_usb_3410_5052_2 ttyUSB0: ti_set_termios - cannot set modem control on port 0, -32 [ 125.648592][ T4659] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot send open command (2), -32 [ 125.707437][ T4699] usb 3-1: USB disconnect, device number 2 [ 125.927723][ T4699] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 126.092629][ T4699] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 126.114094][ T4699] ti_usb_3410_5052 3-1:2.0: device disconnected [ 126.599657][ T4709] loop0: detected capacity change from 0 to 512 [ 127.619408][ T4709] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 127.673156][ T4709] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.96: invalid indirect mapped block 256 (level 1) [ 127.734098][ T4709] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.96: invalid indirect mapped block 2683928664 (level 1) [ 127.779254][ T4709] EXT4-fs (loop0): 1 truncate cleaned up [ 127.794424][ T4709] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 130.816945][ T4336] rpcbind: server 127.0.0.1 not responding, timed out [ 130.923544][ T4724] syz.2.100 (4724): drop_caches: 2 [ 131.023515][ T4724] syz.2.100 (4724): drop_caches: 2 [ 131.241527][ T4725] syz.2.100 (4725): drop_caches: 2 [ 131.374642][ T4729] loop0: detected capacity change from 0 to 2048 [ 131.465169][ T4729] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 131.721375][ T4730] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 131.740091][ T4729] NILFS error (device loop0): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 131.763910][ T4729] Remounting filesystem read-only [ 132.165560][ T4321] rpcbind: server 127.0.0.1 not responding, timed out [ 132.746875][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.753283][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.818912][ T4739] loop2: detected capacity change from 0 to 1024 [ 133.228664][ T4742] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.647693][ T4274] rpcbind: server 127.0.0.1 not responding, timed out [ 135.059265][ T4742] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 135.260598][ T4742] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 135.446961][ T4762] loop3: detected capacity change from 0 to 512 [ 135.462878][ T4742] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 135.588047][ T4762] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 135.602528][ T4762] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.111: invalid indirect mapped block 256 (level 1) [ 135.623840][ T4762] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.111: invalid indirect mapped block 2683928664 (level 1) [ 135.645940][ T4762] EXT4-fs (loop3): 1 truncate cleaned up [ 135.651665][ T4762] EXT4-fs (loop3): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 136.149115][ T4772] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:476: comm syz.3.111: Invalid block bitmap block 3 in block_group 0 [ 137.272847][ T4742] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.334372][ T4742] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.369994][ T4742] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.393905][ T4742] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.733169][ T4780] loop0: detected capacity change from 0 to 2048 [ 140.761555][ T4780] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 141.167524][ T4781] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 141.201039][ T4780] NILFS error (device loop0): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 141.214804][ T4780] Remounting filesystem read-only [ 141.519137][ T4786] loop3: detected capacity change from 0 to 1024 [ 143.749403][ T4795] loop4: detected capacity change from 0 to 512 [ 145.633787][ T4814] loop2: detected capacity change from 0 to 2048 [ 146.146886][ T4814] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 146.722919][ T4816] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 146.768215][ T4814] NILFS error (device loop2): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 146.781493][ T4814] Remounting filesystem read-only [ 147.118612][ T4824] loop4: detected capacity change from 0 to 256 [ 147.372752][ T4823] FAULT_INJECTION: forcing a failure. [ 147.372752][ T4823] name failslab, interval 1, probability 0, space 0, times 0 [ 147.556207][ T4823] CPU: 1 PID: 4823 Comm: syz.1.113 Not tainted syzkaller #0 [ 147.563591][ T4823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 147.573718][ T4823] Call Trace: [ 147.577035][ T4823] [ 147.580000][ T4823] dump_stack_lvl+0x188/0x250 [ 147.584745][ T4823] ? show_regs_print_info+0x20/0x20 [ 147.589984][ T4823] ? load_image+0x410/0x410 [ 147.594530][ T4823] ? __might_sleep+0xf0/0xf0 [ 147.599188][ T4823] ? __lock_acquire+0x7d40/0x7d40 [ 147.604257][ T4823] should_fail+0x383/0x4b0 [ 147.608743][ T4823] should_failslab+0x5/0x20 [ 147.613289][ T4823] slab_pre_alloc_hook+0x51/0xc0 [ 147.618278][ T4823] kmem_cache_alloc_node_trace+0x4a/0x2f0 [ 147.624039][ T4823] ? sbitmap_queue_init_node+0x201/0xa60 [ 147.629712][ T4823] ? __init_waitqueue_head+0xa4/0x140 [ 147.635136][ T4823] sbitmap_queue_init_node+0x201/0xa60 [ 147.640651][ T4823] blk_mq_init_tags+0x1d1/0x370 [ 147.645549][ T4823] blk_mq_alloc_rq_map+0x7f/0x1a0 [ 147.650623][ T4823] __blk_mq_alloc_map_and_request+0x8e/0x320 [ 147.656746][ T4823] blk_mq_alloc_map_and_requests+0xd0/0x4d0 [ 147.662698][ T4823] blk_mq_alloc_tag_set+0x794/0xf30 [ 147.667946][ T4823] loop_add+0x257/0x890 [ 147.672156][ T4823] loop_control_ioctl+0x124/0x550 [ 147.677230][ T4823] ? xor_init+0x60/0x60 [ 147.681429][ T4823] ? bpf_lsm_file_ioctl+0x5/0x10 [ 147.686408][ T4823] ? security_file_ioctl+0x7c/0xa0 [ 147.691590][ T4823] ? xor_init+0x60/0x60 [ 147.695790][ T4823] __se_sys_ioctl+0xfa/0x170 [ 147.700451][ T4823] do_syscall_64+0x4c/0xa0 [ 147.704932][ T4823] ? clear_bhb_loop+0x30/0x80 [ 147.709689][ T4823] ? clear_bhb_loop+0x30/0x80 [ 147.714415][ T4823] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 147.720376][ T4823] RIP: 0033:0x7fe66f3ef559 [ 147.724831][ T4823] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 147.744474][ T4823] RSP: 002b:00007fe66d646028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 147.752937][ T4823] RAX: ffffffffffffffda RBX: 00007fe66f675fa0 RCX: 00007fe66f3ef559 [ 147.760948][ T4823] RDX: 00000000ffffffe4 RSI: 0000000000004c80 RDI: 0000000000000004 [ 147.768980][ T4823] RBP: 00007fe66f486b20 R08: 0000000000000000 R09: 0000000000000000 [ 147.776987][ T4823] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 147.784992][ T4823] R13: 00007fe66f676038 R14: 00007fe66f675fa0 R15: 00007ffecbe22168 [ 147.793019][ T4823] [ 148.121698][ T4830] loop2: detected capacity change from 0 to 2048 [ 148.212096][ T4830] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 148.690664][ T4831] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 148.723166][ T4830] NILFS error (device loop2): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 148.738202][ T4830] Remounting filesystem read-only [ 149.128527][ T4823] blk-mq: reduced tag depth (128 -> 64) [ 150.322262][ T4274] rpcbind: server 127.0.0.1 not responding, timed out [ 151.396315][ T4839] syz.1.135 (4839): drop_caches: 2 [ 151.417280][ T4839] syz.1.135 (4839): drop_caches: 2 [ 151.434684][ T4839] syz.1.135 (4839): drop_caches: 2 [ 152.427055][ T4847] loop2: detected capacity change from 0 to 512 [ 152.473112][ T4845] loop3: detected capacity change from 0 to 2048 [ 152.587799][ T4847] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 152.626450][ T4845] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 152.650128][ T4847] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.137: invalid indirect mapped block 256 (level 1) [ 152.670998][ T4847] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.137: invalid indirect mapped block 2683928664 (level 1) [ 152.705322][ T4847] EXT4-fs (loop2): 1 truncate cleaned up [ 152.745499][ T4852] syz.4.138 (4852): drop_caches: 2 [ 152.761619][ T4852] syz.4.138 (4852): drop_caches: 2 [ 153.513263][ T4847] EXT4-fs (loop2): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 153.789122][ T4853] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:476: comm syz.2.137: Invalid block bitmap block 3 in block_group 0 [ 154.116174][ T4845] netlink: 36 bytes leftover after parsing attributes in process `syz.3.134'. [ 154.131215][ T4859] loop0: detected capacity change from 0 to 512 [ 154.147253][ T4845] netlink: 68 bytes leftover after parsing attributes in process `syz.3.134'. [ 154.334058][ T4859] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 154.359991][ T4861] loop4: detected capacity change from 0 to 1024 [ 154.522190][ T4859] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.125: invalid indirect mapped block 256 (level 1) [ 154.676301][ T4859] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.125: invalid indirect mapped block 2683928664 (level 1) [ 155.035446][ T4859] EXT4-fs (loop0): 1 truncate cleaned up [ 155.041290][ T4859] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 155.177325][ T4865] loop1: detected capacity change from 0 to 2048 [ 155.224964][ T4867] loop2: detected capacity change from 0 to 164 [ 155.490532][ T4871] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:476: comm syz.0.125: Invalid block bitmap block 3 in block_group 0 [ 155.969062][ T4865] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 156.119573][ T4870] netlink: 28 bytes leftover after parsing attributes in process `syz.3.143'. [ 156.309190][ T4875] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 156.325430][ T4856] NILFS error (device loop1): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 158.010002][ T4856] Remounting filesystem read-only [ 158.119500][ T4883] netlink: 12 bytes leftover after parsing attributes in process `syz.4.144'. [ 158.821415][ T4892] loop4: detected capacity change from 0 to 256 [ 159.818036][ T4894] loop2: detected capacity change from 0 to 512 [ 159.922559][ T4903] syz.1.149 (4903): drop_caches: 2 [ 159.946087][ T4902] loop0: detected capacity change from 0 to 2048 [ 159.964048][ T4894] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 159.988812][ T4897] syz.1.149 (4897): drop_caches: 2 [ 160.046230][ T4903] syz.1.149 (4903): drop_caches: 2 [ 160.126556][ T4894] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.151: invalid indirect mapped block 256 (level 1) [ 160.151174][ T4894] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.151: invalid indirect mapped block 2683928664 (level 1) [ 160.206096][ T4894] EXT4-fs (loop2): 1 truncate cleaned up [ 160.211829][ T4894] EXT4-fs (loop2): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 160.245179][ T4902] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 160.350532][ T4911] loop4: detected capacity change from 0 to 512 [ 160.431589][ T4911] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 160.518937][ T4323] udevd[4323]: incorrect nilfs2 checksum on /dev/loop0 [ 160.528600][ T4913] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 160.546421][ T4898] NILFS error (device loop0): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 160.559082][ T4898] Remounting filesystem read-only [ 160.569264][ T4912] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:476: comm syz.2.151: Invalid block bitmap block 3 in block_group 0 [ 160.607794][ T4911] EXT4-fs (loop4): 1 truncate cleaned up [ 160.613510][ T4911] EXT4-fs (loop4): mounted filesystem without journal. Opts: noload,max_dir_size_kb=0x0000000000000001,usrjquota=,noload,data_err=ignore,usrjquota=,,errors=continue. Quota mode: none. [ 161.817213][ T4919] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 162.468083][ T4921] sched: RT throttling activated [ 163.110187][ T4926] loop2: detected capacity change from 0 to 164 [ 164.574817][ T4932] loop1: detected capacity change from 0 to 2048 [ 164.805657][ T4949] usb usb8: usbfs: process 4949 (syz.2.160) did not claim interface 0 before use [ 168.156077][ T4957] syz.0.165 (4957): drop_caches: 2 [ 168.165185][ T4957] syz.0.165 (4957): drop_caches: 2 [ 168.175497][ T4297] udevd[4297]: incorrect nilfs2 checksum on /dev/loop1 [ 168.196468][ T4957] syz.0.165 (4957): drop_caches: 2 [ 168.484799][ T2303] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 169.131465][ T4971] FAULT_INJECTION: forcing a failure. [ 169.131465][ T4971] name failslab, interval 1, probability 0, space 0, times 0 [ 169.144301][ T4971] CPU: 1 PID: 4971 Comm: syz.4.169 Not tainted syzkaller #0 [ 169.151636][ T4971] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 169.161726][ T4971] Call Trace: [ 169.165032][ T4971] [ 169.167990][ T4971] dump_stack_lvl+0x188/0x250 [ 169.172697][ T4971] ? show_regs_print_info+0x20/0x20 [ 169.177941][ T4971] ? load_image+0x410/0x410 [ 169.182509][ T4971] should_fail+0x383/0x4b0 [ 169.186977][ T4971] should_failslab+0x5/0x20 [ 169.191511][ T4971] slab_pre_alloc_hook+0x51/0xc0 [ 169.196474][ T4971] ? skb_clone+0x1bd/0x350 [ 169.200913][ T4971] kmem_cache_alloc+0x3d/0x280 [ 169.205699][ T4971] skb_clone+0x1bd/0x350 [ 169.209967][ T4971] __netlink_deliver_tap+0x3cb/0x7c0 [ 169.215289][ T4971] netlink_deliver_tap+0x16c/0x180 [ 169.220426][ T4971] netlink_unicast+0x759/0x940 [ 169.225225][ T4971] netlink_sendmsg+0x8ba/0xbe0 [ 169.230016][ T4971] ? netlink_getsockopt+0x570/0x570 [ 169.235236][ T4971] ? aa_sock_msg_perm+0x94/0x150 [ 169.240200][ T4971] ? apparmor_socket_sendmsg+0x88/0x230 [ 169.245778][ T4971] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 169.251104][ T4971] ? security_socket_sendmsg+0x7c/0xa0 [ 169.256591][ T4971] __sys_sendto+0x46d/0x620 [ 169.261304][ T4971] ? __ia32_sys_getpeername+0x80/0x80 [ 169.266745][ T4971] ? lock_chain_count+0x20/0x20 [ 169.271659][ T4971] __x64_sys_sendto+0xda/0xf0 [ 169.276372][ T4971] do_syscall_64+0x4c/0xa0 [ 169.280815][ T4971] ? clear_bhb_loop+0x30/0x80 [ 169.285529][ T4971] ? clear_bhb_loop+0x30/0x80 [ 169.290233][ T4971] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 169.296151][ T4971] RIP: 0033:0x7f46c8235d8e [ 169.300592][ T4971] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 169.320272][ T4971] RSP: 002b:00007f46c64cae88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 169.328722][ T4971] RAX: ffffffffffffffda RBX: 00007f46c64cc6c0 RCX: 00007f46c8235d8e [ 169.336718][ T4971] RDX: 000000000000001c RSI: 00007f46c64cb000 RDI: 0000000000000003 [ 169.344722][ T4971] RBP: 0000000000000000 R08: 00007f46c64caf04 R09: 000000000000000c [ 169.352736][ T4971] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 169.360726][ T4971] R13: 00007f46c64caf58 R14: 00007f46c64cb000 R15: 0000000000000000 [ 169.368739][ T4971] [ 169.693085][ T2303] usb 4-1: Using ep0 maxpacket: 32 [ 169.742001][ T4987] loop2: detected capacity change from 0 to 164 [ 171.603804][ T2303] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 173.576750][ T2303] usb 4-1: can't read configurations, error -71 [ 174.213058][ T5001] FAULT_INJECTION: forcing a failure. [ 174.213058][ T5001] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 174.260791][ T5001] CPU: 1 PID: 5001 Comm: syz.3.177 Not tainted syzkaller #0 [ 174.268136][ T5001] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 174.278209][ T5001] Call Trace: [ 174.281511][ T5001] [ 174.284466][ T5001] dump_stack_lvl+0x188/0x250 [ 174.289170][ T5001] ? show_regs_print_info+0x20/0x20 [ 174.294448][ T5001] ? load_image+0x410/0x410 [ 174.298982][ T5001] ? __lock_acquire+0x7d40/0x7d40 [ 174.304033][ T5001] should_fail+0x383/0x4b0 [ 174.308491][ T5001] prepare_alloc_pages+0x1e3/0x5b0 [ 174.313648][ T5001] __alloc_pages+0x11b/0x480 [ 174.318267][ T5001] ? zone_statistics+0x170/0x170 [ 174.323244][ T5001] ? trace_kmalloc_node+0x1f/0xa0 [ 174.328290][ T5001] ? __kmalloc_node+0x261/0x3a0 [ 174.333168][ T5001] bpf_ringbuf_alloc+0x10c/0x4d0 [ 174.338135][ T5001] ? bpf_map_init_from_attr+0x146/0x300 [ 174.343692][ T5001] ringbuf_map_alloc+0x1d1/0x300 [ 174.348656][ T5001] map_create+0x481/0x2330 [ 174.353168][ T5001] ? bpf_lsm_bpf+0x5/0x10 [ 174.357598][ T5001] __sys_bpf+0x30a/0x6f0 [ 174.361869][ T5001] ? bpf_link_show_fdinfo+0x380/0x380 [ 174.367283][ T5001] __x64_sys_bpf+0x78/0x90 [ 174.371716][ T5001] do_syscall_64+0x4c/0xa0 [ 174.376294][ T5001] ? clear_bhb_loop+0x30/0x80 [ 174.381219][ T5001] ? clear_bhb_loop+0x30/0x80 [ 174.385926][ T5001] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 174.391830][ T5001] RIP: 0033:0x7f020ffa5559 [ 174.396258][ T5001] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 174.415878][ T5001] RSP: 002b:00007f020e1fc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 174.424323][ T5001] RAX: ffffffffffffffda RBX: 00007f021022bfa0 RCX: 00007f020ffa5559 [ 174.432334][ T5001] RDX: 0000000000000050 RSI: 0000200000000340 RDI: 0000000000000000 [ 174.440508][ T5001] RBP: 00007f021003cb20 R08: 0000000000000000 R09: 0000000000000000 [ 174.448486][ T5001] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 174.456512][ T5001] R13: 00007f021022c038 R14: 00007f021022bfa0 R15: 00007fff4e04d928 [ 174.464521][ T5001] [ 174.467678][ C1] vkms_vblank_simulate: vblank timer overrun [ 174.501427][ T5004] loop2: detected capacity change from 0 to 512 [ 176.241997][ T5011] syz.0.181 (5011): drop_caches: 2 [ 176.262446][ T5011] syz.0.181 (5011): drop_caches: 2 [ 176.622541][ T5011] syz.0.181 (5011): drop_caches: 2 [ 177.876699][ T5004] EXT4-fs: failed to create workqueue [ 177.962198][ T5004] EXT4-fs (loop2): mount failed [ 182.235397][ T5054] FAULT_INJECTION: forcing a failure. [ 182.235397][ T5054] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 182.250301][ T5054] CPU: 1 PID: 5054 Comm: syz.4.195 Not tainted syzkaller #0 [ 182.257773][ T5054] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 182.267870][ T5054] Call Trace: [ 182.271184][ T5054] [ 182.274152][ T5054] dump_stack_lvl+0x188/0x250 [ 182.278896][ T5054] ? show_regs_print_info+0x20/0x20 [ 182.284169][ T5054] ? load_image+0x410/0x410 [ 182.288716][ T5054] ? __lock_acquire+0x7d40/0x7d40 [ 182.293789][ T5054] should_fail+0x383/0x4b0 [ 182.298249][ T5054] prepare_alloc_pages+0x1e3/0x5b0 [ 182.303452][ T5054] __alloc_pages+0x11b/0x480 [ 182.308086][ T5054] ? zone_statistics+0x170/0x170 [ 182.313067][ T5054] ? trace_kmalloc_node+0x1f/0xa0 [ 182.318126][ T5054] ? __kmalloc_node+0x261/0x3a0 [ 182.323026][ T5054] bpf_ringbuf_alloc+0x232/0x4d0 [ 182.328014][ T5054] ringbuf_map_alloc+0x1d1/0x300 [ 182.333021][ T5054] map_create+0x481/0x2330 [ 182.337478][ T5054] ? bpf_lsm_bpf+0x5/0x10 [ 182.341845][ T5054] __sys_bpf+0x30a/0x6f0 [ 182.346131][ T5054] ? bpf_link_show_fdinfo+0x380/0x380 [ 182.351565][ T5054] __x64_sys_bpf+0x78/0x90 [ 182.356018][ T5054] do_syscall_64+0x4c/0xa0 [ 182.360477][ T5054] ? clear_bhb_loop+0x30/0x80 [ 182.365192][ T5054] ? clear_bhb_loop+0x30/0x80 [ 182.369914][ T5054] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 182.375850][ T5054] RIP: 0033:0x7f46c8275559 [ 182.380299][ T5054] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 182.400034][ T5054] RSP: 002b:00007f46c64cc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 182.408508][ T5054] RAX: ffffffffffffffda RBX: 00007f46c84fbfa0 RCX: 00007f46c8275559 [ 182.416524][ T5054] RDX: 0000000000000050 RSI: 0000200000000340 RDI: 0000000000000000 [ 182.424543][ T5054] RBP: 00007f46c830cb20 R08: 0000000000000000 R09: 0000000000000000 [ 182.432581][ T5054] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 182.440609][ T5054] R13: 00007f46c84fc038 R14: 00007f46c84fbfa0 R15: 00007ffea186aef8 [ 182.448637][ T5054] [ 182.451939][ C1] vkms_vblank_simulate: vblank timer overrun [ 182.479238][ T5052] syz.3.194 (5052): drop_caches: 2 [ 182.490617][ T5052] syz.3.194 (5052): drop_caches: 2 [ 182.509406][ T5052] syz.3.194 (5052): drop_caches: 2 [ 182.539010][ T5048] loop1: detected capacity change from 0 to 512 [ 182.645959][ T5062] ip_tables: iptables: counters copy to user failed while replacing table [ 183.169857][ T5048] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 184.434131][ T5048] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.193: invalid indirect mapped block 256 (level 1) [ 184.615964][ T5048] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.193: invalid indirect mapped block 2683928664 (level 1) [ 184.654226][ T5068] loop0: detected capacity change from 0 to 512 [ 184.860188][ T5048] EXT4-fs (loop1): 1 truncate cleaned up [ 184.984334][ T5048] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 185.026155][ T5068] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 185.199401][ T5068] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.199: invalid indirect mapped block 256 (level 1) [ 185.480902][ T5068] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.199: invalid indirect mapped block 2683928664 (level 1) [ 185.719756][ T5068] EXT4-fs (loop0): 1 truncate cleaned up [ 185.789356][ T5068] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 188.973619][ T5095] netlink: 76 bytes leftover after parsing attributes in process `syz.1.203'. [ 190.166644][ T5098] netlink: 28 bytes leftover after parsing attributes in process `syz.4.206'. [ 190.454307][ T5097] loop2: detected capacity change from 0 to 2048 [ 190.492598][ T5097] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 190.508766][ T5100] netlink: 'syz.1.208': attribute type 1 has an invalid length. [ 190.557259][ T5104] loop4: detected capacity change from 0 to 164 [ 190.568203][ T5100] netlink: 244 bytes leftover after parsing attributes in process `syz.1.208'. [ 190.582075][ T5069] udevd[5069]: incorrect nilfs2 checksum on /dev/loop2 [ 190.604807][ T5105] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 190.627541][ T5094] NILFS error (device loop2): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 190.698735][ T5094] Remounting filesystem read-only [ 190.737189][ T5110] syz.0.211 (5110): drop_caches: 2 [ 190.759619][ T5110] syz.0.211 (5110): drop_caches: 2 [ 190.773042][ T5110] syz.0.211 (5110): drop_caches: 2 [ 190.790882][ T4192] Bluetooth: hci2: command 0x0406 tx timeout [ 190.809371][ T4192] Bluetooth: hci0: command 0x0406 tx timeout [ 190.815529][ T4192] Bluetooth: hci4: command 0x0406 tx timeout [ 190.821881][ T4192] Bluetooth: hci3: command 0x0406 tx timeout [ 190.827427][ T4332] Bluetooth: hci1: command 0x0406 tx timeout [ 190.914630][ T5111] loop1: detected capacity change from 0 to 512 [ 191.205684][ T5111] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 191.367826][ T5111] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.212: invalid indirect mapped block 256 (level 1) [ 191.638423][ T5111] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.212: invalid indirect mapped block 2683928664 (level 1) [ 191.878491][ T5111] EXT4-fs (loop1): 1 truncate cleaned up [ 191.897602][ T5111] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 191.997951][ T5121] usb usb8: usbfs: process 5121 (syz.4.213) did not claim interface 0 before use [ 192.142159][ T5122] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:476: comm syz.1.212: Invalid block bitmap block 3 in block_group 0 [ 193.799625][ T5142] netlink: 76 bytes leftover after parsing attributes in process `syz.2.218'. [ 193.857007][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.863375][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 196.178947][ T5149] netlink: 28 bytes leftover after parsing attributes in process `syz.0.222'. [ 196.713262][ T5155] loop2: detected capacity change from 0 to 164 [ 196.788626][ T5157] loop1: detected capacity change from 0 to 2048 [ 196.840844][ T5157] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 196.877854][ T5161] loop0: detected capacity change from 0 to 8 [ 197.471118][ T5164] loop3: detected capacity change from 0 to 512 [ 197.693616][ T5178] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 197.711701][ T5154] NILFS error (device loop1): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 197.889631][ T5160] udevd[5160]: incorrect nilfs2 checksum on /dev/loop1 [ 198.525392][ T5164] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 198.545238][ T5154] Remounting filesystem read-only [ 198.555982][ T5164] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.227: invalid indirect mapped block 256 (level 1) [ 198.578925][ T5164] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.227: invalid indirect mapped block 2683928664 (level 1) [ 198.597581][ T5164] EXT4-fs (loop3): 1 truncate cleaned up [ 198.603517][ T5164] EXT4-fs (loop3): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 198.629063][ C1] vkms_vblank_simulate: vblank timer overrun [ 198.880356][ T5185] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:476: comm syz.3.227: Invalid block bitmap block 3 in block_group 0 [ 199.094841][ T5187] syz.0.230 (5187): drop_caches: 2 [ 199.129204][ T5187] syz.0.230 (5187): drop_caches: 2 [ 199.146930][ T5187] syz.0.230 (5187): drop_caches: 2 [ 202.346846][ T5209] netlink: 28 bytes leftover after parsing attributes in process `syz.4.236'. [ 202.736751][ T5208] loop3: detected capacity change from 0 to 164 [ 204.379447][ T5221] loop4: detected capacity change from 0 to 1024 [ 208.826644][ T5249] loop4: detected capacity change from 0 to 512 [ 209.054123][ T5249] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2 [ 209.737674][ T5249] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.251: invalid indirect mapped block 256 (level 1) [ 209.877386][ T5249] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.251: invalid indirect mapped block 2683928664 (level 1) [ 210.017998][ T5267] loop3: detected capacity change from 0 to 164 [ 210.040926][ T5270] rxe_eth0 speed is unknown, defaulting to 1000 [ 210.065783][ T5249] EXT4-fs (loop4): 1 truncate cleaned up [ 210.071499][ T5249] EXT4-fs (loop4): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 210.246557][ T5271] loop1: detected capacity change from 0 to 512 [ 210.335322][ T5273] loop2: detected capacity change from 0 to 512 [ 210.380551][ T5261] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:476: comm ext4lazyinit: Invalid block bitmap block 3 in block_group 0 [ 210.405241][ T5271] EXT4-fs (loop1): orphan cleanup on readonly fs [ 210.443944][ T5271] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #15: comm syz.1.255: corrupted inode contents [ 210.462922][ T5271] EXT4-fs error (device loop1) in ext4_orphan_del:303: Corrupt filesystem [ 210.476277][ T5271] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #15: comm syz.1.255: corrupted inode contents [ 210.503806][ T5271] EXT4-fs error (device loop1): ext4_evict_inode:332: inode #15: comm syz.1.255: mark_inode_dirty error [ 210.540830][ T5271] EXT4-fs (loop1): 1 orphan inode deleted [ 210.577135][ T5278] loop3: detected capacity change from 0 to 1024 [ 210.604316][ T5271] EXT4-fs (loop1): mounted filesystem without journal. Opts: nodioread_nolock,resuid=0x0000000000000000,debug_want_extra_isize=0x000000000000005c,nouid32,mb_optimize_scan=0x0000000000000001,acl,init_itable=0x0000000000008d55,,errors=continue. Quota mode: none. [ 210.642054][ T5279] loop0: detected capacity change from 0 to 256 [ 210.673872][ T5273] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 210.687922][ T5273] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.256: invalid indirect mapped block 256 (level 1) [ 210.743847][ T5273] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.256: invalid indirect mapped block 2683928664 (level 1) [ 210.844327][ T5273] EXT4-fs (loop2): 1 truncate cleaned up [ 210.887236][ T5273] EXT4-fs (loop2): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 211.233464][ T5291] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:476: comm syz.2.256: Invalid block bitmap block 3 in block_group 0 [ 211.738931][ T5287] netlink: 12 bytes leftover after parsing attributes in process `syz.1.261'. [ 211.809338][ T5301] netlink: 40 bytes leftover after parsing attributes in process `syz.4.263'. [ 213.625763][ T5319] loop4: detected capacity change from 0 to 164 [ 214.448509][ T5330] loop1: detected capacity change from 0 to 1024 [ 214.469925][ T5328] loop3: detected capacity change from 0 to 512 [ 214.513186][ T5330] EXT4-fs (loop1): mounted filesystem without journal. Opts: quota,max_batch_time=0x0000000000000007,errors=remount-ro,min_batch_time=0x0000000000000080,. Quota mode: writeback. [ 214.532989][ C1] vkms_vblank_simulate: vblank timer overrun [ 214.593641][ T5337] loop0: detected capacity change from 0 to 1024 [ 214.597186][ T5336] loop4: detected capacity change from 0 to 2048 [ 214.609503][ T5328] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 214.681118][ T5328] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.270: invalid indirect mapped block 256 (level 1) [ 214.717103][ T5328] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.270: invalid indirect mapped block 2683928664 (level 1) [ 214.760844][ T5328] EXT4-fs (loop3): 1 truncate cleaned up [ 214.766807][ T5328] EXT4-fs (loop3): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 214.835127][ T5336] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 215.179568][ T5349] netlink: 28 bytes leftover after parsing attributes in process `syz.0.275'. [ 215.871759][ T5353] loop1: detected capacity change from 0 to 512 [ 215.957118][ T5353] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 215.988089][ T5358] loop2: detected capacity change from 0 to 512 [ 216.004292][ T5353] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.274: invalid indirect mapped block 256 (level 1) [ 216.045325][ T5353] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.274: invalid indirect mapped block 2683928664 (level 1) [ 216.090543][ T4335] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 216.116954][ T5353] EXT4-fs (loop1): 1 truncate cleaned up [ 216.123350][ T5353] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 216.161064][ T5358] EXT4-fs (loop2): 1 truncate cleaned up [ 216.167013][ T5358] EXT4-fs (loop2): mounted filesystem without journal. Opts: bsddf,,errors=continue. Quota mode: none. [ 216.355329][ T4335] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 674 with error 28 [ 216.375120][ T4335] EXT4-fs (loop4): This should not happen!! Data will be lost [ 216.375120][ T4335] [ 216.630898][ T5368] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:476: comm syz.1.274: Invalid block bitmap block 3 in block_group 0 [ 217.640518][ T5333] EXT4-fs error (device loop2): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 465: padding at end of block bitmap is not set [ 217.672158][ T4335] EXT4-fs (loop4): Total free blocks count 0 [ 217.871381][ T4274] rpcbind: server 127.0.0.1 not responding, timed out [ 217.921151][ T4335] EXT4-fs (loop4): Free/Dirty block details [ 217.951800][ T4335] EXT4-fs (loop4): free_blocks=4096 [ 217.967485][ T4335] EXT4-fs (loop4): dirty_blocks=688 [ 217.982691][ T4335] EXT4-fs (loop4): Block reservation details [ 217.998959][ T4335] EXT4-fs (loop4): i_reserved_data_blocks=43 [ 218.220663][ T5379] loop1: detected capacity change from 0 to 164 [ 220.018269][ T5377] binder: 5376:5377 ioctl c0306201 0 returned -14 [ 221.545766][ T4335] rpcbind: server 127.0.0.1 not responding, timed out [ 221.729908][ T5400] loop4: detected capacity change from 0 to 128 [ 222.210628][ T5400] FAT-fs (loop4): Unrecognized mount option "d" or missing value [ 222.343106][ T5405] loop1: detected capacity change from 0 to 512 [ 223.105160][ T5413] netlink: 12 bytes leftover after parsing attributes in process `syz.0.290'. [ 225.154088][ T5405] EXT4-fs: error -4 creating inode table initialization thread [ 225.551445][ T5405] EXT4-fs (loop1): mount failed [ 226.166746][ T4334] rpcbind: server 127.0.0.1 not responding, timed out [ 227.564920][ T5435] loop4: detected capacity change from 0 to 164 [ 227.844680][ T5443] netlink: 76 bytes leftover after parsing attributes in process `syz.3.298'. [ 228.695348][ T5442] loop1: detected capacity change from 0 to 2048 [ 228.763531][ T5442] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 228.787451][ T5449] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 228.798065][ T5442] NILFS error (device loop1): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 228.812073][ T5442] Remounting filesystem read-only [ 228.844928][ T5448] loop0: detected capacity change from 0 to 512 [ 230.677141][ T5448] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 230.697069][ T5448] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.301: invalid indirect mapped block 256 (level 1) [ 230.757725][ T5448] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.301: invalid indirect mapped block 2683928664 (level 1) [ 230.823650][ T5448] EXT4-fs (loop0): 1 truncate cleaned up [ 230.877810][ T5448] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 231.369534][ T5466] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:476: comm syz.0.301: Invalid block bitmap block 3 in block_group 0 [ 232.587603][ T154] rpcbind: server 127.0.0.1 not responding, timed out [ 232.708899][ T5471] loop1: detected capacity change from 0 to 1024 [ 233.989966][ T5479] loop2: detected capacity change from 0 to 4096 [ 234.373771][ T5492] netlink: 76 bytes leftover after parsing attributes in process `syz.1.310'. [ 235.470759][ T5496] netlink: 12 bytes leftover after parsing attributes in process `syz.0.311'. [ 235.540638][ T5499] loop1: detected capacity change from 0 to 164 [ 235.588058][ T5479] EXT4-fs (loop2): Test dummy encryption mode enabled [ 237.351187][ T5479] EXT4-fs: failed to create workqueue [ 237.397331][ T5479] EXT4-fs (loop2): mount failed [ 237.476452][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.519686][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.541120][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.577669][ T5515] loop1: detected capacity change from 0 to 512 [ 237.615715][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.795737][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.803356][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.814991][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.826626][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.834323][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.841881][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.859811][ T5515] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 237.869027][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.869089][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.869122][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.869146][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.869171][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.869195][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.869220][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.869244][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 237.869268][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.122513][ T5515] EXT4-fs error (device loop1): ext4_orphan_get:1436: comm syz.1.314: bad orphan inode 13 [ 238.133297][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.142517][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.150176][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.158180][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.165646][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.173378][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.180905][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.188582][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.196017][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.203676][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.214974][ T5515] ext4_test_bit(bit=12, block=18) = 1 [ 238.224883][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.233073][ T5515] is_bad_inode(inode)=0 [ 238.248795][ T5515] NEXT_ORPHAN(inode)=0 [ 238.253103][ T5515] max_ino=32 [ 238.256505][ T5515] i_nlink=1 [ 238.260396][ T5515] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 238.477907][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.485529][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.493685][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.501960][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.510626][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.595151][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.668567][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.740923][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.814976][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.894352][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 238.991321][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 239.064070][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 239.251707][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 239.323612][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 239.371309][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 239.393141][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 239.421451][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 239.441772][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 239.449777][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 239.478293][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 239.505225][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.561598][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.581587][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.871338][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.878921][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.886499][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.894397][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.901835][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.909347][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.916902][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.924429][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.931903][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.939445][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.946965][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.954473][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.961907][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.975698][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.984205][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.991965][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 240.999554][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.007046][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.014525][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.021958][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.030134][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.037682][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.045204][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.052803][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.060268][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.070673][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.080749][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.096686][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.106462][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.117384][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.127314][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.138238][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.148074][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.158909][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.168842][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.179696][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.189465][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.197405][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.205167][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.216070][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.224690][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.235656][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.244693][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.255500][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.263958][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.271377][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.283118][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.290712][ T4192] hid-generic 0000:0000:0004.0001: unknown main item tag 0x0 [ 241.311699][ T4192] hid-generic 0000:0000:0004.0001: hidraw0: HID v0.03 Device [syz1] on syz0 [ 241.470783][ T5545] fido_id[5545]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 241.847790][ T5555] netlink: 76 bytes leftover after parsing attributes in process `syz.4.325'. [ 242.991707][ T5558] loop2: detected capacity change from 0 to 164 [ 244.929524][ T5570] loop3: detected capacity change from 0 to 128 [ 247.186833][ T5581] loop1: detected capacity change from 0 to 256 [ 249.057255][ T5597] loop1: detected capacity change from 0 to 164 [ 249.159717][ T5601] netlink: 76 bytes leftover after parsing attributes in process `syz.3.338'. [ 249.823405][ T5611] loop0: detected capacity change from 0 to 2048 [ 250.121245][ T5611] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 250.315104][ T5613] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 251.665786][ T5611] NILFS error (device loop0): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 253.415458][ T5611] Remounting filesystem read-only [ 255.541181][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.553991][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.725536][ T5684] loop4: detected capacity change from 0 to 256 [ 257.010301][ T5695] loop2: detected capacity change from 0 to 128 [ 257.061556][ T5695] FAT-fs (loop2): Unrecognized mount option "d" or missing value [ 258.376525][ T5714] ip_tables: iptables: counters copy to user failed while replacing table [ 258.404826][ T5718] FAULT_INJECTION: forcing a failure. [ 258.404826][ T5718] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 258.501274][ T5718] CPU: 0 PID: 5718 Comm: syz.2.360 Not tainted syzkaller #0 [ 258.508645][ T5718] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 258.518756][ T5718] Call Trace: [ 258.522091][ T5718] [ 258.525056][ T5718] dump_stack_lvl+0x188/0x250 [ 258.529786][ T5718] ? show_regs_print_info+0x20/0x20 [ 258.535163][ T5718] ? load_image+0x410/0x410 [ 258.539728][ T5718] ? __lock_acquire+0x7d40/0x7d40 [ 258.544833][ T5718] should_fail+0x383/0x4b0 [ 258.549296][ T5718] _copy_from_iter+0x234/0x1160 [ 258.554188][ T5718] ? __lock_acquire+0x7d40/0x7d40 [ 258.559271][ T5718] ? copy_mc_pipe_to_iter+0x7d0/0x7d0 [ 258.564706][ T5718] ? __virt_addr_valid+0x3c6/0x470 [ 258.569866][ T5718] ? __phys_addr_symbol+0x2b/0x70 [ 258.574941][ T5718] ? __check_object_size+0x30c/0x410 [ 258.580277][ T5718] netlink_sendmsg+0x758/0xbe0 [ 258.585107][ T5718] ? netlink_getsockopt+0x570/0x570 [ 258.590344][ T5718] ? aa_sock_msg_perm+0x94/0x150 [ 258.595324][ T5718] ? apparmor_socket_sendmsg+0x88/0x230 [ 258.600916][ T5718] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 258.606255][ T5718] ? security_socket_sendmsg+0x7c/0xa0 [ 258.611758][ T5718] __sys_sendto+0x46d/0x620 [ 258.616311][ T5718] ? __ia32_sys_getpeername+0x80/0x80 [ 258.621750][ T5718] ? lock_chain_count+0x20/0x20 [ 258.626658][ T5718] __x64_sys_sendto+0xda/0xf0 [ 258.631391][ T5718] do_syscall_64+0x4c/0xa0 [ 258.635846][ T5718] ? clear_bhb_loop+0x30/0x80 [ 258.640561][ T5718] ? clear_bhb_loop+0x30/0x80 [ 258.645279][ T5718] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 258.651214][ T5718] RIP: 0033:0x7f2f579e0d8e [ 258.655678][ T5718] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 258.675345][ T5718] RSP: 002b:00007f2f55c75e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 258.683814][ T5718] RAX: ffffffffffffffda RBX: 00007f2f55c776c0 RCX: 00007f2f579e0d8e [ 258.691833][ T5718] RDX: 000000000000001c RSI: 00007f2f55c76000 RDI: 0000000000000003 [ 258.699855][ T5718] RBP: 0000000000000000 R08: 00007f2f55c75f04 R09: 000000000000000c [ 258.707918][ T5718] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 258.715935][ T5718] R13: 00007f2f55c75f58 R14: 00007f2f55c76000 R15: 0000000000000000 [ 258.723966][ T5718] [ 260.031504][ T5739] loop0: detected capacity change from 0 to 256 [ 260.969973][ T5743] loop1: detected capacity change from 0 to 164 [ 262.910625][ T5771] netlink: 12 bytes leftover after parsing attributes in process `syz.4.378'. [ 263.071834][ T5765] binder: 5732:5765 ioctl c0306201 0 returned -14 [ 265.040862][ T5783] loop2: detected capacity change from 0 to 164 [ 265.144080][ T5786] usb usb8: usbfs: process 5786 (syz.0.381) did not claim interface 0 before use [ 265.338750][ T5789] device syzkaller0 entered promiscuous mode [ 267.120200][ T5818] netlink: 76 bytes leftover after parsing attributes in process `syz.0.389'. [ 267.922191][ T5823] loop0: detected capacity change from 0 to 512 [ 267.994528][ T5819] netlink: 12 bytes leftover after parsing attributes in process `syz.2.390'. [ 268.177131][ T5823] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 269.455366][ T5823] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.391: invalid indirect mapped block 256 (level 1) [ 269.925144][ T5823] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.391: invalid indirect mapped block 2683928664 (level 1) [ 269.992916][ T5823] EXT4-fs (loop0): 1 truncate cleaned up [ 270.126683][ T5823] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 270.298752][ T5830] usb usb8: usbfs: process 5830 (syz.1.393) did not claim interface 0 before use [ 270.558580][ T5835] loop1: detected capacity change from 0 to 164 [ 270.622954][ T5836] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:476: comm syz.0.391: Invalid block bitmap block 3 in block_group 0 [ 271.105301][ T4321] rpcbind: server 127.0.0.1 not responding, timed out [ 271.239051][ T5840] device syzkaller0 entered promiscuous mode [ 271.456725][ T5845] loop1: detected capacity change from 0 to 2048 [ 271.478237][ T5845] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 271.923140][ T5853] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 272.338729][ T5845] NILFS error (device loop1): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 272.358418][ T5845] Remounting filesystem read-only [ 272.745559][ T5856] loop2: detected capacity change from 0 to 8192 [ 272.826251][ T5856] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 272.997552][ T5866] netlink: 76 bytes leftover after parsing attributes in process `syz.4.402'. [ 275.159243][ T5872] loop0: detected capacity change from 0 to 512 [ 275.528207][ T5875] usb usb8: usbfs: process 5875 (syz.2.404) did not claim interface 0 before use [ 275.662455][ T5872] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 275.697505][ T5872] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.406: invalid indirect mapped block 256 (level 1) [ 275.757378][ T5872] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.406: invalid indirect mapped block 2683928664 (level 1) [ 275.782780][ T5883] loop4: detected capacity change from 0 to 164 [ 275.845690][ T5872] EXT4-fs (loop0): 1 truncate cleaned up [ 275.861842][ T5887] loop2: detected capacity change from 0 to 128 [ 275.877660][ T5872] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 275.934463][ T5887] FAT-fs (loop2): Unrecognized mount option "d" or missing value [ 277.300009][ T5894] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:476: comm syz.0.406: Invalid block bitmap block 3 in block_group 0 [ 277.460536][ T5640] rpcbind: server 127.0.0.1 not responding, timed out [ 277.486800][ T5896] loop4: detected capacity change from 0 to 512 [ 277.618023][ T5896] FAT-fs (loop4): Unrecognized mount option "ÿÿÿÿÿÿÿÿÿÿÿÿÿ" or missing value [ 278.078692][ T5896] loop4: detected capacity change from 0 to 512 [ 278.756073][ T5902] loop3: detected capacity change from 0 to 2048 [ 278.776733][ T5909] loop2: detected capacity change from 0 to 512 [ 278.791891][ T5902] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 278.825192][ T5910] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 278.838903][ T5902] NILFS error (device loop3): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 278.850970][ T5902] Remounting filesystem read-only [ 278.880514][ T5912] loop0: detected capacity change from 0 to 1024 [ 278.915357][ T5909] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 278.937337][ T5896] EXT4-fs (loop4): mounted filesystem without journal. Opts: noauto_da_alloc,errors=remount-ro,. Quota mode: writeback. [ 278.977276][ T5896] ext4 filesystem being mounted at /81/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 279.026282][ T5909] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.414: invalid indirect mapped block 256 (level 1) [ 279.046719][ T5909] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.414: invalid indirect mapped block 2683928664 (level 1) [ 280.964840][ T5909] EXT4-fs (loop2): 1 truncate cleaned up [ 280.972552][ T5909] EXT4-fs (loop2): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 281.251153][ T5927] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:476: comm syz.2.414: Invalid block bitmap block 3 in block_group 0 [ 281.432402][ T5929] loop3: detected capacity change from 0 to 164 [ 281.625712][ T5932] loop0: detected capacity change from 0 to 512 [ 282.180052][ T5942] usb usb8: usbfs: process 5942 (syz.4.418) did not claim interface 0 before use [ 282.735392][ T5932] EXT4-fs (loop0): 1 truncate cleaned up [ 282.744502][ T5932] EXT4-fs (loop0): mounted filesystem without journal. Opts: bsddf,,errors=continue. Quota mode: none. [ 283.418347][ T5953] loop2: detected capacity change from 0 to 128 [ 283.899609][ T5953] FAT-fs (loop2): Unrecognized mount option "d" or missing value [ 284.133090][ T5915] EXT4-fs error (device loop0): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 465: padding at end of block bitmap is not set [ 286.530216][ T5973] loop0: detected capacity change from 0 to 16 [ 286.556367][ T5973] erofs: (device loop0): mounted with root inode @ nid 36. [ 286.693416][ T5973] erofs: (device loop0): find_target_block_classic: corrupted dir block 67108936 @ nid 36 [ 286.726611][ T5975] loop3: detected capacity change from 0 to 512 [ 286.979722][ T5977] loop2: detected capacity change from 0 to 512 [ 286.987329][ T5975] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 287.025300][ T5975] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.432: invalid indirect mapped block 256 (level 1) [ 287.039902][ T5975] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.432: invalid indirect mapped block 2683928664 (level 1) [ 287.071530][ T5975] EXT4-fs (loop3): 1 truncate cleaned up [ 287.207646][ T5975] EXT4-fs (loop3): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 287.290316][ T5977] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 288.123971][ T5977] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.433: invalid indirect mapped block 256 (level 1) [ 288.315617][ T5988] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:476: comm syz.3.432: Invalid block bitmap block 3 in block_group 0 [ 288.436950][ T5989] usb usb8: usbfs: process 5989 (syz.0.435) did not claim interface 0 before use [ 288.500320][ T5977] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.433: invalid indirect mapped block 2683928664 (level 1) [ 288.588704][ T5977] EXT4-fs (loop2): 1 truncate cleaned up [ 288.602427][ T5977] EXT4-fs (loop2): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 288.980190][ T6000] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:476: comm syz.2.433: Invalid block bitmap block 3 in block_group 0 [ 289.959404][ T6005] loop3: detected capacity change from 0 to 512 [ 290.367302][ T6007] loop0: detected capacity change from 0 to 512 [ 290.506865][ T6011] loop2: detected capacity change from 0 to 512 [ 290.628859][ T6014] loop4: detected capacity change from 0 to 256 [ 290.638355][ T6005] EXT4-fs (loop3): 1 truncate cleaned up [ 290.670042][ T6005] EXT4-fs (loop3): mounted filesystem without journal. Opts: bsddf,,errors=continue. Quota mode: none. [ 290.687218][ T6007] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 290.695951][ T6011] EXT4-fs (loop2): 1 truncate cleaned up [ 290.717761][ T6011] EXT4-fs (loop2): mounted filesystem without journal. Opts: bsddf,,errors=continue. Quota mode: none. [ 290.917834][ T6007] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.441: invalid indirect mapped block 256 (level 1) [ 290.949392][ T6007] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.441: invalid indirect mapped block 2683928664 (level 1) [ 290.952378][ T6014] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 291.463771][ T6012] EXT4-fs error (device loop3): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 465: padding at end of block bitmap is not set [ 291.506647][ T6007] EXT4-fs (loop0): 1 truncate cleaned up [ 291.512378][ T6007] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 291.911640][ T6024] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:476: comm syz.0.441: Invalid block bitmap block 3 in block_group 0 [ 292.421949][ T6023] device syzkaller0 entered promiscuous mode [ 292.889186][ T4327] rpcbind: server 127.0.0.1 not responding, timed out [ 293.125392][ T6039] loop3: detected capacity change from 0 to 512 [ 293.160019][ T6039] EXT4-fs (loop3): Ignoring removed nobh option [ 293.187051][ T6039] EXT4-fs (loop3): Ignoring removed oldalloc option [ 293.203081][ T6039] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 293.243751][ T6039] EXT4-fs (loop3): mounted filesystem without journal. Opts: nojournal_checksum,init_itable,nobh,oldalloc,dioread_nolock,barrier,grpid,data_err=ignore,,errors=continue. Quota mode: writeback. [ 293.269075][ T6039] ext4 filesystem being mounted at /90/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 293.919445][ T6042] EXT4-fs error (device loop3): ext4_empty_dir:3147: inode #12: block 32: comm syz.3.448: bad entry in directory: rec_len is too small for name_len - offset=0, inode=12, rec_len=12, size=2048 fake=0 [ 294.031583][ T6046] netlink: 8 bytes leftover after parsing attributes in process `syz.2.449'. [ 294.050065][ T6042] EXT4-fs warning (device loop3): ext4_empty_dir:3149: inode #12: comm syz.3.448: directory missing '.' [ 294.109872][ T6050] loop1: detected capacity change from 0 to 2048 [ 294.171431][ T6050] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 294.881209][ T6060] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 295.435900][ T6062] loop2: detected capacity change from 0 to 512 [ 295.751125][ T6062] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 295.936577][ T6062] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.453: invalid indirect mapped block 256 (level 1) [ 296.078235][ T6062] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.453: invalid indirect mapped block 2683928664 (level 1) [ 296.216669][ T6062] EXT4-fs (loop2): 1 truncate cleaned up [ 296.255223][ T6062] EXT4-fs (loop2): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 296.281516][ C1] vkms_vblank_simulate: vblank timer overrun [ 296.689962][ T6062] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:476: comm syz.2.453: Invalid block bitmap block 3 in block_group 0 [ 297.457300][ T6074] usb usb8: usbfs: process 6074 (syz.3.454) did not claim interface 0 before use [ 300.109503][ T6067] binder: 6064:6067 ioctl c0306201 0 returned -14 [ 300.477292][ T6089] loop3: detected capacity change from 0 to 512 [ 300.533165][ T6093] syz.2.460 (6093): drop_caches: 2 [ 300.549889][ T6092] loop1: detected capacity change from 0 to 256 [ 300.830531][ T6089] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 300.865763][ T6096] loop4: detected capacity change from 0 to 2048 [ 300.889365][ T6089] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.458: invalid indirect mapped block 256 (level 1) [ 301.050224][ T6089] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.458: invalid indirect mapped block 2683928664 (level 1) [ 302.257252][ T6096] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 1024) [ 302.272686][ T6089] EXT4-fs (loop3): 1 truncate cleaned up [ 302.291150][ T6103] loop0: detected capacity change from 0 to 512 [ 302.329690][ T6089] EXT4-fs (loop3): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 302.362847][ T6110] loop2: detected capacity change from 0 to 2048 [ 302.404948][ T6103] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 302.562890][ T6097] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:476: comm ext4lazyinit: Invalid block bitmap block 3 in block_group 0 [ 302.579988][ T6103] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.462: invalid indirect mapped block 256 (level 1) [ 302.593927][ T5394] udevd[5394]: incorrect nilfs2 checksum on /dev/loop4 [ 302.672439][ T6114] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:476: comm syz.3.458: Invalid block bitmap block 3 in block_group 0 [ 303.390444][ T6103] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.462: invalid indirect mapped block 2683928664 (level 1) [ 303.405537][ T6112] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 303.421184][ T6096] NILFS error (device loop4): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 303.444767][ T6110] EXT4-fs (loop2): mounted filesystem without journal. Opts: auto_da_alloc=0x0000000000000006,user_xattr,,errors=continue. Quota mode: none. [ 303.460375][ T6103] EXT4-fs (loop0): 1 truncate cleaned up [ 303.468494][ T6110] ext4 filesystem being mounted at /94/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 303.480830][ T6103] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 303.480923][ T6096] Remounting filesystem read-only [ 304.289551][ T4287] rpcbind: server 127.0.0.1 not responding, timed out [ 304.631770][ T6126] loop4: detected capacity change from 0 to 512 [ 304.754424][ T6128] loop1: detected capacity change from 0 to 512 [ 304.781192][ T6126] EXT4-fs (loop4): 1 truncate cleaned up [ 304.787006][ T6126] EXT4-fs (loop4): mounted filesystem without journal. Opts: bsddf,,errors=continue. Quota mode: none. [ 305.239145][ T6097] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:476: comm ext4lazyinit: Invalid block bitmap block 3 in block_group 0 [ 305.309906][ T6128] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 305.464109][ T6128] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.469: invalid indirect mapped block 256 (level 1) [ 306.082126][ T6128] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.469: invalid indirect mapped block 2683928664 (level 1) [ 306.127783][ T6128] EXT4-fs (loop1): 1 truncate cleaned up [ 306.134817][ T6128] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 306.190494][ T1167] rpcbind: server 127.0.0.1 not responding, timed out [ 306.710133][ T6097] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:476: comm ext4lazyinit: Invalid block bitmap block 3 in block_group 0 [ 306.846908][ T6151] loop2: detected capacity change from 0 to 2048 [ 306.855724][ T6152] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:476: comm syz.1.469: Invalid block bitmap block 3 in block_group 0 [ 308.680355][ T6151] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 308.732795][ T6155] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 311.974815][ T6161] loop2: detected capacity change from 0 to 512 [ 312.118671][ T6163] usb usb8: usbfs: process 6163 (syz.1.476) did not claim interface 0 before use [ 313.162912][ T6161] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 313.249251][ T6171] loop0: detected capacity change from 0 to 2048 [ 313.262343][ T6161] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.475: invalid indirect mapped block 256 (level 1) [ 313.277641][ T6168] binder: 6166:6168 ioctl c0306201 0 returned -14 [ 313.364831][ T6161] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.475: invalid indirect mapped block 2683928664 (level 1) [ 313.439170][ T6178] syz.3.480 (6178): drop_caches: 2 [ 313.482933][ T6171] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 313.549273][ T5427] udevd[5427]: incorrect nilfs2 checksum on /dev/loop0 [ 313.569334][ T6161] EXT4-fs (loop2): 1 truncate cleaned up [ 313.603655][ T6179] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 314.345687][ T6161] EXT4-fs (loop2): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 314.371413][ C1] vkms_vblank_simulate: vblank timer overrun [ 314.398491][ T6171] NILFS error (device loop0): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 314.486810][ T6171] Remounting filesystem read-only [ 314.806213][ T6184] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:476: comm syz.2.475: Invalid block bitmap block 3 in block_group 0 [ 314.980929][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 314.987377][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.032585][ T6195] loop2: detected capacity change from 0 to 512 [ 316.137608][ T6198] loop3: detected capacity change from 0 to 2048 [ 316.159267][ T6195] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 316.202082][ T6198] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 316.247200][ T6200] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 316.270596][ T6197] NILFS error (device loop3): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 316.295962][ T6195] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.484: invalid indirect mapped block 256 (level 1) [ 316.313101][ T6197] Remounting filesystem read-only [ 316.373498][ T6195] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.484: invalid indirect mapped block 2683928664 (level 1) [ 316.467042][ T6195] EXT4-fs (loop2): 1 truncate cleaned up [ 316.577090][ T6195] EXT4-fs (loop2): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 318.315305][ T6205] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:476: comm syz.2.484: Invalid block bitmap block 3 in block_group 0 [ 318.654673][ T6209] loop3: detected capacity change from 0 to 512 [ 318.701607][ T6207] usb usb8: usbfs: process 6207 (syz.0.488) did not claim interface 0 before use [ 318.737636][ T6209] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 318.780826][ T6209] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.487: invalid indirect mapped block 256 (level 1) [ 318.919494][ T6209] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.487: invalid indirect mapped block 2683928664 (level 1) [ 318.976959][ T6209] EXT4-fs (loop3): 1 truncate cleaned up [ 319.001715][ T6219] loop2: detected capacity change from 0 to 512 [ 319.008898][ T6209] EXT4-fs (loop3): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 319.034418][ C1] vkms_vblank_simulate: vblank timer overrun [ 320.017080][ T6226] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:476: comm syz.3.487: Invalid block bitmap block 3 in block_group 0 [ 321.229628][ T6219] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 321.282470][ T6219] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.489: invalid indirect mapped block 256 (level 1) [ 321.544086][ T6219] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.489: invalid indirect mapped block 2683928664 (level 1) [ 322.385543][ T6219] EXT4-fs (loop2): 1 truncate cleaned up [ 322.413517][ T6219] EXT4-fs (loop2): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 322.439818][ C1] vkms_vblank_simulate: vblank timer overrun [ 322.446933][ T4287] rpcbind: server 127.0.0.1 not responding, timed out [ 323.866228][ T6233] loop0: detected capacity change from 0 to 512 [ 324.832307][ T6235] loop3: detected capacity change from 0 to 2048 [ 326.713177][ T6233] EXT4-fs: failed to create workqueue [ 326.894765][ T6233] EXT4-fs (loop0): mount failed [ 326.919669][ T5394] udevd[5394]: incorrect nilfs2 checksum on /dev/loop3 [ 327.072539][ T6248] loop2: detected capacity change from 0 to 2048 [ 327.087245][ T6252] loop1: detected capacity change from 0 to 512 [ 327.165900][ T6248] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 327.182826][ T6250] loop3: detected capacity change from 0 to 164 [ 327.206051][ T6255] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 327.221781][ T6252] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 327.240027][ T6248] NILFS error (device loop2): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 327.253553][ T6248] Remounting filesystem read-only [ 327.268009][ T6252] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.500: invalid indirect mapped block 256 (level 1) [ 327.296160][ T6252] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.500: invalid indirect mapped block 2683928664 (level 1) [ 327.361861][ T6252] EXT4-fs (loop1): 1 truncate cleaned up [ 327.377975][ T6252] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 327.648610][ T6259] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:476: comm syz.1.500: Invalid block bitmap block 3 in block_group 0 [ 330.239995][ T6265] loop3: detected capacity change from 0 to 512 [ 330.380874][ T6265] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 330.435696][ T6270] loop1: detected capacity change from 0 to 512 [ 330.442941][ T6265] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.505: invalid indirect mapped block 256 (level 1) [ 330.558406][ T6265] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.505: invalid indirect mapped block 2683928664 (level 1) [ 330.586834][ T6270] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 330.643439][ T6265] EXT4-fs (loop3): 1 truncate cleaned up [ 330.713645][ T6265] EXT4-fs (loop3): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 330.834172][ T6270] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.504: invalid indirect mapped block 256 (level 1) [ 331.067781][ T6270] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.504: invalid indirect mapped block 2683928664 (level 1) [ 331.335904][ T6270] EXT4-fs (loop1): 1 truncate cleaned up [ 331.647675][ T6279] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:476: comm syz.3.505: Invalid block bitmap block 3 in block_group 0 [ 332.405664][ T6270] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 334.077491][ T6272] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:476: comm ext4lazyinit: Invalid block bitmap block 3 in block_group 0 [ 334.446861][ T6283] usb usb8: usbfs: process 6283 (syz.4.501) did not claim interface 0 before use [ 334.537725][ T6287] loop2: detected capacity change from 0 to 512 [ 335.495677][ T6291] loop3: detected capacity change from 0 to 2048 [ 335.546740][ T6298] syz.0.510 (6298): drop_caches: 2 [ 335.554078][ T6298] syz.0.510 (6298): drop_caches: 2 [ 335.573264][ T6298] syz.0.510 (6298): drop_caches: 2 [ 335.696494][ T6287] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 335.730218][ T6299] binder: 6289:6299 ioctl c0306201 0 returned -14 [ 335.776298][ T6287] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.509: invalid indirect mapped block 256 (level 1) [ 335.994995][ T6287] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.509: invalid indirect mapped block 2683928664 (level 1) [ 336.675786][ T6291] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 336.702272][ T5394] udevd[5394]: incorrect nilfs2 checksum on /dev/loop3 [ 336.763887][ T6287] EXT4-fs (loop2): 1 truncate cleaned up [ 336.769708][ T6287] EXT4-fs (loop2): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 336.832278][ T6302] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 336.855612][ T6291] NILFS error (device loop3): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 337.055896][ T6291] Remounting filesystem read-only [ 337.146415][ T6304] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:476: comm syz.2.509: Invalid block bitmap block 3 in block_group 0 [ 339.983297][ T6312] loop2: detected capacity change from 0 to 2048 [ 340.009924][ T6315] loop0: detected capacity change from 0 to 512 [ 340.991512][ T6312] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 341.041758][ T6324] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 341.055552][ T6312] NILFS error (device loop2): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 341.067821][ T6312] Remounting filesystem read-only [ 341.106005][ T6315] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 341.175505][ T6315] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.516: invalid indirect mapped block 256 (level 1) [ 341.283215][ T6315] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.516: invalid indirect mapped block 2683928664 (level 1) [ 341.339556][ T6315] EXT4-fs (loop0): 1 truncate cleaned up [ 341.397865][ T6315] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 341.838454][ T6339] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:476: comm syz.0.516: Invalid block bitmap block 3 in block_group 0 [ 341.962949][ T6343] loop1: detected capacity change from 0 to 512 [ 343.023692][ T6343] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 343.769765][ T6343] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.520: invalid indirect mapped block 256 (level 1) [ 343.869618][ T6343] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.520: invalid indirect mapped block 2683928664 (level 1) [ 343.937227][ T6354] binder: 6345:6354 ioctl c0306201 0 returned -14 [ 346.238307][ T6343] EXT4-fs (loop1): 1 truncate cleaned up [ 346.438958][ T6343] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 350.603902][ T6376] syz.3.528 (6376): drop_caches: 2 [ 350.614286][ T6376] syz.3.528 (6376): drop_caches: 2 [ 350.632048][ T6376] syz.3.528 (6376): drop_caches: 2 [ 351.511612][ T6380] loop1: detected capacity change from 0 to 2048 [ 351.526154][ T6381] loop4: detected capacity change from 0 to 512 [ 351.564468][ T6380] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 351.628013][ T6384] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 351.643199][ T6380] NILFS error (device loop1): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 351.655492][ T6380] Remounting filesystem read-only [ 351.774691][ T6381] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2 [ 351.783158][ T6381] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.531: invalid indirect mapped block 256 (level 1) [ 351.808449][ T6381] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.531: invalid indirect mapped block 2683928664 (level 1) [ 351.854056][ T6381] EXT4-fs (loop4): 1 truncate cleaned up [ 351.859779][ T6381] EXT4-fs (loop4): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 351.885312][ C1] vkms_vblank_simulate: vblank timer overrun [ 352.150006][ T6391] loop1: detected capacity change from 0 to 512 [ 352.157477][ T6392] loop2: detected capacity change from 0 to 512 [ 352.206719][ T6391] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 352.264696][ T6392] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 352.326435][ T6392] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.525: invalid indirect mapped block 256 (level 1) [ 352.337336][ T6391] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.532: invalid indirect mapped block 256 (level 1) [ 352.364438][ T6392] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.525: invalid indirect mapped block 2683928664 (level 1) [ 352.382453][ T6391] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.532: invalid indirect mapped block 2683928664 (level 1) [ 352.386001][ T6392] EXT4-fs (loop2): 1 truncate cleaned up [ 352.511954][ T6392] EXT4-fs (loop2): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 352.542139][ T6391] EXT4-fs (loop1): 1 truncate cleaned up [ 352.547857][ T6391] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 352.573410][ C1] vkms_vblank_simulate: vblank timer overrun [ 352.870866][ T6401] loop0: detected capacity change from 0 to 164 [ 352.923109][ T6402] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:476: comm syz.1.532: Invalid block bitmap block 3 in block_group 0 [ 352.957979][ T6404] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:476: comm syz.2.525: Invalid block bitmap block 3 in block_group 0 [ 357.923152][ T6420] binder: 6415:6420 ioctl c0306201 0 returned -14 [ 360.147617][ T6437] loop3: detected capacity change from 0 to 2048 [ 360.180908][ T6443] loop1: detected capacity change from 0 to 512 [ 360.197981][ T6437] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 360.234362][ T6444] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 360.248126][ T6437] NILFS error (device loop3): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 360.260546][ T6437] Remounting filesystem read-only [ 360.341557][ T6443] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 360.520709][ T6443] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.545: invalid indirect mapped block 256 (level 1) [ 360.693308][ T6443] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.545: invalid indirect mapped block 2683928664 (level 1) [ 361.035516][ T6443] EXT4-fs (loop1): 1 truncate cleaned up [ 361.138529][ T6443] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 361.204232][ T6452] loop3: detected capacity change from 0 to 512 [ 361.335089][ T6452] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 361.438788][ T6452] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.547: invalid indirect mapped block 256 (level 1) [ 361.488207][ T6455] loop0: detected capacity change from 0 to 512 [ 361.519189][ T6452] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.547: invalid indirect mapped block 2683928664 (level 1) [ 361.566842][ T6452] EXT4-fs (loop3): 1 truncate cleaned up [ 361.572588][ T6452] EXT4-fs (loop3): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 361.600112][ T6456] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:476: comm syz.1.545: Invalid block bitmap block 3 in block_group 0 [ 361.655343][ T6455] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 361.683141][ T6455] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.548: invalid indirect mapped block 256 (level 1) [ 361.704940][ T6455] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.548: invalid indirect mapped block 2683928664 (level 1) [ 361.900029][ T6455] EXT4-fs (loop0): 1 truncate cleaned up [ 361.907518][ T6455] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 362.001735][ T6463] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:476: comm syz.3.547: Invalid block bitmap block 3 in block_group 0 [ 362.476858][ T6466] syz.4.544 (6466): drop_caches: 2 [ 362.485673][ T6466] syz.4.544 (6466): drop_caches: 2 [ 362.501960][ T6470] syz.4.544 (6470): drop_caches: 2 [ 364.710428][ T6487] loop2: detected capacity change from 0 to 2048 [ 364.803810][ T6493] binder: 6490:6493 ioctl c0306201 0 returned -14 [ 365.312582][ T6487] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 365.436521][ T6377] udevd[6377]: incorrect nilfs2 checksum on /dev/loop2 [ 365.447339][ T6497] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 365.488718][ T6487] NILFS error (device loop2): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 365.551543][ T6487] Remounting filesystem read-only [ 365.679593][ T6448] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:476: comm ext4lazyinit: Invalid block bitmap block 3 in block_group 0 [ 370.243219][ T6518] loop2: detected capacity change from 0 to 512 [ 371.279421][ T6523] usb usb8: usbfs: process 6523 (syz.4.563) did not claim interface 0 before use [ 371.336445][ T6518] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 371.345888][ T6518] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.561: invalid indirect mapped block 256 (level 1) [ 371.375405][ T6518] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.561: invalid indirect mapped block 2683928664 (level 1) [ 371.426112][ T6518] EXT4-fs (loop2): 1 truncate cleaned up [ 371.438160][ T6518] EXT4-fs (loop2): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 371.765529][ T6531] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:476: comm syz.2.561: Invalid block bitmap block 3 in block_group 0 [ 373.322011][ T6543] syz.4.566 (6543): drop_caches: 2 [ 373.329300][ T6543] syz.4.566 (6543): drop_caches: 2 [ 373.341900][ T6543] syz.4.566 (6543): drop_caches: 2 [ 374.402128][ T6544] loop1: detected capacity change from 0 to 2048 [ 374.459135][ T6544] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 374.465884][ T6377] udevd[6377]: incorrect nilfs2 checksum on /dev/loop1 [ 375.000516][ T6561] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 375.026512][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 375.033050][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 375.062701][ T6542] NILFS error (device loop1): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 375.349414][ T6542] Remounting filesystem read-only [ 377.397459][ T6579] loop4: detected capacity change from 0 to 512 [ 377.750232][ T6580] loop0: detected capacity change from 0 to 256 [ 377.770081][ T6579] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2 [ 377.935885][ T6579] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.576: invalid indirect mapped block 256 (level 1) [ 378.799510][ T6579] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.576: invalid indirect mapped block 2683928664 (level 1) [ 378.816516][ T6579] EXT4-fs (loop4): 1 truncate cleaned up [ 378.822197][ T6579] EXT4-fs (loop4): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 378.847756][ C1] vkms_vblank_simulate: vblank timer overrun [ 378.912743][ T6589] usb usb8: usbfs: process 6589 (syz.2.577) did not claim interface 0 before use [ 378.963572][ T6585] binder: 6584:6585 ioctl c0306201 0 returned -14 [ 379.598583][ T6596] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:476: comm syz.4.576: Invalid block bitmap block 3 in block_group 0 [ 380.063978][ T6607] device syzkaller0 entered promiscuous mode [ 386.961297][ T6629] loop1: detected capacity change from 0 to 512 [ 387.222844][ T6631] loop0: detected capacity change from 0 to 512 [ 387.239880][ T6629] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 387.262841][ T6629] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.587: invalid indirect mapped block 256 (level 1) [ 387.320108][ T6629] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.587: invalid indirect mapped block 2683928664 (level 1) [ 387.892716][ T6631] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 388.136573][ T6629] EXT4-fs (loop1): 1 truncate cleaned up [ 388.154818][ T6631] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.590: invalid indirect mapped block 256 (level 1) [ 388.170973][ T6629] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 388.205766][ T6631] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #13: comm syz.0.590: invalid indirect mapped block 2683928664 (level 1) [ 388.356294][ T6643] usb usb8: usbfs: process 6643 (syz.4.592) did not claim interface 0 before use [ 388.432182][ T6631] EXT4-fs (loop0): 1 truncate cleaned up [ 388.437910][ T6631] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 388.635066][ T6647] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:476: comm syz.1.587: Invalid block bitmap block 3 in block_group 0 [ 388.780685][ T6635] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:476: comm ext4lazyinit: Invalid block bitmap block 3 in block_group 0 [ 388.799011][ T6649] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:476: comm syz.0.590: Invalid block bitmap block 3 in block_group 0 [ 389.171851][ T6657] netlink: 28 bytes leftover after parsing attributes in process `syz.2.595'. [ 392.345395][ T6682] loop3: detected capacity change from 0 to 256 [ 392.419970][ T6675] binder: 6672:6675 ioctl c0306201 0 returned -14 [ 393.412505][ T6683] loop2: detected capacity change from 0 to 2048 [ 394.203560][ T6683] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 394.247951][ T6688] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 394.267862][ T6671] NILFS error (device loop2): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 394.280866][ T6671] Remounting filesystem read-only [ 394.417425][ T6689] netlink: 12 bytes leftover after parsing attributes in process `syz.0.599'. [ 394.651303][ T6695] usb usb8: usbfs: process 6695 (syz.1.603) did not claim interface 0 before use [ 398.037273][ T6711] loop4: detected capacity change from 0 to 256 [ 400.043356][ T6709] loop2: detected capacity change from 0 to 512 [ 400.287819][ T6709] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 400.349671][ T6709] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.605: invalid indirect mapped block 256 (level 1) [ 400.405367][ T6709] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.605: invalid indirect mapped block 2683928664 (level 1) [ 401.989190][ T6709] EXT4-fs (loop2): 1 truncate cleaned up [ 401.995140][ T6709] EXT4-fs (loop2): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 403.107426][ T6743] usb usb8: usbfs: process 6743 (syz.0.616) did not claim interface 0 before use [ 403.716092][ T6740] loop3: detected capacity change from 0 to 2048 [ 403.841744][ T6740] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 403.872513][ T6686] udevd[6686]: incorrect nilfs2 checksum on /dev/loop3 [ 403.962162][ T6734] binder: 6731:6734 ioctl c0306201 0 returned -14 [ 403.982703][ T6748] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 404.006680][ T6733] NILFS error (device loop3): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 404.031982][ T6733] Remounting filesystem read-only [ 406.052458][ T6764] binder: 6762:6764 ioctl c018620c 200000000380 returned -22 [ 408.248488][ T6767] loop4: detected capacity change from 0 to 512 [ 408.445613][ T6779] usb usb8: usbfs: process 6779 (syz.0.627) did not claim interface 0 before use [ 408.515320][ T6767] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2 [ 408.566376][ T6767] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.623: invalid indirect mapped block 256 (level 1) [ 408.604065][ T6767] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.623: invalid indirect mapped block 2683928664 (level 1) [ 409.266423][ T6767] EXT4-fs (loop4): 1 truncate cleaned up [ 409.303216][ T6767] EXT4-fs (loop4): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 412.970417][ T6783] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:476: comm ext4lazyinit: Invalid block bitmap block 3 in block_group 0 [ 414.845640][ T6820] usb usb8: usbfs: process 6820 (syz.1.639) did not claim interface 0 before use [ 415.943361][ T4265] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 416.034282][ T6833] netlink: 12 bytes leftover after parsing attributes in process `syz.1.641'. [ 416.146674][ T4325] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 416.225730][ T6833] netlink: 12 bytes leftover after parsing attributes in process `syz.1.641'. [ 416.301914][ T4265] usb 1-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 416.340795][ T4265] usb 1-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 416.459931][ T4265] usb 1-1: config 0 interface 0 has no altsetting 0 [ 416.489957][ T6837] loop3: detected capacity change from 0 to 512 [ 416.505475][ T4325] usb 5-1: config 0 has an invalid interface number: 5 but max is 3 [ 416.545640][ T4325] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 4 [ 416.566309][ T6833] netlink: 12 bytes leftover after parsing attributes in process `syz.1.641'. [ 416.575621][ T6837] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 416.590269][ T4265] usb 1-1: New USB device found, idVendor=044f, idProduct=b65a, bcdDevice= 0.00 [ 416.595718][ T6837] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.643: invalid indirect mapped block 256 (level 1) [ 416.613966][ T6837] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz.3.643: invalid indirect mapped block 2683928664 (level 1) [ 416.635378][ T6837] EXT4-fs (loop3): 1 truncate cleaned up [ 416.641426][ T6837] EXT4-fs (loop3): mounted filesystem without journal. Opts: noblock_validity,max_dir_size_kb=0x0000000000000009,stripe=0x0000000000000ee9,nodioread_nolock,discard,usrjquota=.nouid32,noauto_da_alloc,jqfmt=vfsv0,barrier,nogrpid,,,errors=continue. Quota mode: writeback. [ 416.642263][ T4325] usb 5-1: config 0 has no interface number 0 [ 416.683722][ T4265] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 416.866424][ T6843] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:476: comm syz.3.643: Invalid block bitmap block 3 in block_group 0 [ 416.910185][ T4265] usb 1-1: config 0 descriptor?? [ 416.989901][ T4325] usb 5-1: New USB device found, idVendor=0bda, idProduct=0177, bcdDevice=7d.0b [ 417.041382][ T4325] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 417.133867][ T4325] usb 5-1: config 0 descriptor?? [ 417.225619][ T4325] ums-realtek 5-1:0.5: USB Mass Storage device detected [ 417.392182][ T4265] thrustmaster 0003:044F:B65A.0002: ignoring exceeding usage max [ 417.427671][ T4265] thrustmaster 0003:044F:B65A.0002: unbalanced collection at end of report description [ 417.465523][ T4265] thrustmaster 0003:044F:B65A.0002: parse failed [ 417.504310][ T4325] usb 5-1: USB disconnect, device number 2 [ 417.519547][ T4265] thrustmaster: probe of 0003:044F:B65A.0002 failed with error -22 [ 417.533416][ T6851] [ 417.535811][ T6851] ====================================================== [ 417.542842][ T6851] WARNING: possible circular locking dependency detected [ 417.549927][ T6851] syzkaller #0 Not tainted [ 417.554341][ T6851] ------------------------------------------------------ [ 417.561354][ T6851] syz.1.645/6851 is trying to acquire lock: [ 417.567264][ T6851] ffff888061558f98 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xfa/0x210 [ 417.577871][ T6851] [ 417.577871][ T6851] but task is already holding lock: [ 417.585279][ T6851] ffff8880615593f0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x5f/0x1020 [ 417.594661][ T6851] [ 417.594661][ T6851] which lock already depends on the new lock. [ 417.594661][ T6851] [ 417.605101][ T6851] [ 417.605101][ T6851] the existing dependency chain (in reverse order) is: [ 417.614163][ T6851] [ 417.614163][ T6851] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 417.621874][ T6851] __mutex_lock_common+0x1e5/0x2400 [ 417.627641][ T6851] mutex_lock_nested+0x17/0x20 [ 417.632973][ T6851] hci_dev_do_close+0x5f/0x1020 [ 417.638374][ T6851] hci_rfkill_set_block+0x101/0x180 [ 417.644137][ T6851] rfkill_set_block+0x1c1/0x3c0 [ 417.649546][ T6851] rfkill_fop_write+0x453/0x560 [ 417.655133][ T6851] vfs_write+0x304/0xd70 [ 417.660026][ T6851] ksys_write+0x153/0x260 [ 417.664895][ T6851] do_syscall_64+0x4c/0xa0 [ 417.669853][ T6851] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 417.676309][ T6851] [ 417.676309][ T6851] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 417.684315][ T6851] __mutex_lock_common+0x1e5/0x2400 [ 417.690053][ T6851] mutex_lock_nested+0x17/0x20 [ 417.695373][ T6851] rfkill_register+0x2f/0x970 [ 417.700579][ T6851] hci_register_dev+0x459/0x980 [ 417.705978][ T6851] vhci_create_device+0x32e/0x5c0 [ 417.711708][ T6851] vhci_write+0x389/0x440 [ 417.716571][ T6851] vfs_write+0x748/0xd70 [ 417.721373][ T6851] ksys_write+0x153/0x260 [ 417.726339][ T6851] do_syscall_64+0x4c/0xa0 [ 417.731325][ T6851] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 417.737991][ T6851] [ 417.737991][ T6851] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 417.745908][ T6851] __mutex_lock_common+0x1e5/0x2400 [ 417.751716][ T6851] mutex_lock_nested+0x17/0x20 [ 417.757051][ T6851] vhci_send_frame+0x88/0x100 [ 417.762326][ T6851] hci_send_frame+0x1a9/0x2e0 [ 417.767542][ T6851] hci_tx_work+0x9b5/0x16d0 [ 417.772577][ T6851] process_one_work+0x867/0xff0 [ 417.777965][ T6851] worker_thread+0xad7/0x12a0 [ 417.783173][ T6851] kthread+0x42e/0x520 [ 417.787770][ T6851] ret_from_fork+0x1f/0x30 [ 417.792716][ T6851] [ 417.792716][ T6851] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 417.801937][ T6851] __lock_acquire+0x38f7/0x7d40 [ 417.807348][ T6851] lock_acquire+0x19f/0x400 [ 417.812388][ T6851] __flush_work+0x116/0x210 [ 417.817484][ T6851] hci_dev_do_close+0x201/0x1020 [ 417.822974][ T6851] hci_rfkill_set_block+0x101/0x180 [ 417.828738][ T6851] rfkill_set_block+0x1c1/0x3c0 [ 417.834152][ T6851] rfkill_fop_write+0x453/0x560 [ 417.839558][ T6851] vfs_write+0x304/0xd70 [ 417.844336][ T6851] ksys_write+0x153/0x260 [ 417.849202][ T6851] do_syscall_64+0x4c/0xa0 [ 417.854146][ T6851] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 417.860571][ T6851] [ 417.860571][ T6851] other info that might help us debug this: [ 417.860571][ T6851] [ 417.870803][ T6851] Chain exists of: [ 417.870803][ T6851] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 417.870803][ T6851] [ 417.885755][ T6851] Possible unsafe locking scenario: [ 417.885755][ T6851] [ 417.893396][ T6851] CPU0 CPU1 [ 417.898778][ T6851] ---- ---- [ 417.904172][ T6851] lock(&hdev->req_lock); [ 417.908608][ T6851] lock(rfkill_global_mutex); [ 417.915906][ T6851] lock(&hdev->req_lock); [ 417.922868][ T6851] lock((work_completion)(&hdev->tx_work)); [ 417.928857][ T6851] [ 417.928857][ T6851] *** DEADLOCK *** [ 417.928857][ T6851] [ 417.937037][ T6851] 2 locks held by syz.1.645/6851: [ 417.942070][ T6851] #0: ffffffff8e4d7308 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x1ae/0x560 [ 417.952178][ T6851] #1: ffff8880615593f0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x5f/0x1020 [ 417.962059][ T6851] [ 417.962059][ T6851] stack backtrace: [ 417.967970][ T6851] CPU: 1 PID: 6851 Comm: syz.1.645 Not tainted syzkaller #0 [ 417.975481][ T6851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 417.985544][ T6851] Call Trace: [ 417.988832][ T6851] [ 417.991774][ T6851] dump_stack_lvl+0x188/0x250 [ 417.996467][ T6851] ? load_image+0x410/0x410 [ 418.000976][ T6851] ? show_regs_print_info+0x20/0x20 [ 418.006188][ T6851] ? print_circular_bug+0x12b/0x1a0 [ 418.011409][ T6851] check_noncircular+0x2f8/0x400 [ 418.016357][ T6851] ? look_up_lock_class+0x71/0x110 [ 418.021482][ T6851] ? print_deadlock_bug+0x5d0/0x5d0 [ 418.026712][ T6851] ? lockdep_lock+0xf1/0x1f0 [ 418.031325][ T6851] ? mark_lock+0x94/0x320 [ 418.035695][ T6851] ? _find_first_zero_bit+0xd1/0xf0 [ 418.040919][ T6851] __lock_acquire+0x38f7/0x7d40 [ 418.045788][ T6851] ? mark_lock+0x94/0x320 [ 418.050178][ T6851] ? verify_lock_unused+0x140/0x140 [ 418.055420][ T6851] ? __lock_acquire+0x12df/0x7d40 [ 418.060479][ T6851] ? start_flush_work+0x784/0x830 [ 418.065526][ T6851] lock_acquire+0x19f/0x400 [ 418.070044][ T6851] ? __flush_work+0xfa/0x210 [ 418.074651][ T6851] ? verify_lock_unused+0x140/0x140 [ 418.079874][ T6851] ? read_lock_is_recursive+0x10/0x10 [ 418.085320][ T6851] __flush_work+0x116/0x210 [ 418.089864][ T6851] ? __flush_work+0xfa/0x210 [ 418.094488][ T6851] ? flush_work+0x20/0x20 [ 418.098836][ T6851] ? rcu_lock_release+0x5/0x20 [ 418.103615][ T6851] ? __lock_acquire+0x7d40/0x7d40 [ 418.108674][ T6851] hci_dev_do_close+0x201/0x1020 [ 418.113647][ T6851] hci_rfkill_set_block+0x101/0x180 [ 418.118856][ T6851] ? rcu_lock_release+0x20/0x20 [ 418.123713][ T6851] rfkill_set_block+0x1c1/0x3c0 [ 418.128570][ T6851] rfkill_fop_write+0x453/0x560 [ 418.133447][ T6851] ? rfkill_fop_read+0x560/0x560 [ 418.138389][ T6851] ? common_file_perm+0x160/0x1c0 [ 418.143445][ T6851] ? fsnotify_perm+0x5d/0x560 [ 418.148125][ T6851] ? security_file_permission+0x75/0xa0 [ 418.153673][ T6851] ? rfkill_fop_read+0x560/0x560 [ 418.158617][ T6851] vfs_write+0x304/0xd70 [ 418.162880][ T6851] ? file_end_write+0x250/0x250 [ 418.167740][ T6851] ? __fget_files+0x402/0x470 [ 418.172428][ T6851] ? __fdget_pos+0x1e2/0x370 [ 418.177016][ T6851] ? ksys_write+0x70/0x260 [ 418.181437][ T6851] ksys_write+0x153/0x260 [ 418.185822][ T6851] ? __ia32_sys_read+0x80/0x80 [ 418.190588][ T6851] ? lockdep_hardirqs_on+0x94/0x140 [ 418.195793][ T6851] do_syscall_64+0x4c/0xa0 [ 418.200247][ T6851] ? clear_bhb_loop+0x30/0x80 [ 418.205020][ T6851] ? clear_bhb_loop+0x30/0x80 [ 418.209715][ T6851] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 418.215640][ T6851] RIP: 0033:0x7fe66f3ef559 [ 418.220059][ T6851] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 418.239672][ T6851] RSP: 002b:00007fe66d646028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 418.248096][ T6851] RAX: ffffffffffffffda RBX: 00007fe66f675fa0 RCX: 00007fe66f3ef559 [ 418.256075][ T6851] RDX: 0000000000000008 RSI: 0000200000000040 RDI: 0000000000000003 [ 418.264088][ T6851] RBP: 00007fe66f486b20 R08: 0000000000000000 R09: 0000000000000000 [ 418.272080][ T6851] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 418.280059][ T6851] R13: 00007fe66f676038 R14: 00007fe66f675fa0 R15: 00007ffecbe22168 [ 418.288048][ T6851] [ 418.314380][ T4265] usb 1-1: USB disconnect, device number 3 [ 418.725942][ T6856] loop2: detected capacity change from 0 to 2048 [ 418.871463][ T6856] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 418.903827][ T6846] udevd[6846]: incorrect nilfs2 checksum on /dev/loop2 [ 418.935936][ T6863] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 418.949005][ T6855] NILFS error (device loop2): __nilfs_read_inode: invalid file type bits in mode 0177777 for inode 12 [ 418.997810][ T6855] Remounting filesystem read-only