last executing test programs: 4.063919137s ago: executing program 0 (id=6018): r0 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000140)={0x53, 0x0, 0xfd, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000300)="5538b9edff00000008ffffff01a26ccc143bc638b65f69d33b5ab57cf52671dc2d7b21178e751ed07500d83b77ea4beb9c4d4c362f69d05192fac58367ffe9779c6752fbdfc72b65c241364dee74e143fd791b70a2bbdbf4d0eb9b5ea7d2a2487b11a25a69d07e232a840bb5bacb14fd42890807191c52c541e28eba71ee2994d17e53d06732a861fbe148757981fdb1a412d834198e1aa1f5241010e87578fb4069800e64d8d46304771ab67e0325aa78c0b404aaa733e2eb7ec56870b6932912eb693d2a48fce52a88fa8f1250bda6fb2825d72773800f3ea37fbf9fd2038bd92db025776dbd835b638d3a3972f76886a46f1bbcbefeebbbbb1ccfa2", 0x0, 0xff600000, 0x0, 0x0, 0x0}) 3.897071211s ago: executing program 0 (id=6026): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)={{0x0, 0xd1}}) 3.700417526s ago: executing program 0 (id=6035): syz_mount_image$udf(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x1000a05, &(0x7f0000000200)=ANY=[@ANYBLOB="66696c657365743d3030303030303030303030313032352c726f6f746469723d30303030303030303030303030303030303030332c706172746974696f6e3d30303030303030303030303030303030303030302c6769643d69676e6f7265006e6f6164696e6963622cde6661736b3d30303030303030303030303030303030303030343732302c62733d30303030303030303030303230303030303030362c6769643d69676e6f72652c12e7473721b0c36853f83b3237931f7bf54d593a4b0e2a94b2208a0318c4095a29b12750ca47c7a60cd523accdee2710fd9dc6171d154f9426ce2b8e251b4badf115"], 0x0, 0xc3c, &(0x7f0000000ec0)="$eJzs3UFsHNd9B+D/G5FaUm4qJk4Vu43bdVukMmO5sqSYilW4q5pmG0CWiVDMLQBXJKUuTJEESTWykbZMLz30EKAoesiJQGsUSNHAqIugR7Z1geTiQ5FTT0QLG0HRA1sECFDA2GJm30pLirIYUZQo+/ts6rc7897sezPDGYrQmxcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQMTvvHL+5PPpYbcCAHiQLk589eQp938A+ES55O//AAAAAAAAAAAAAABw0KUo4vFIsXhxM01V7zsGLrTmr9+YHB3budpgqmoeqsqXXwPPnzp95ksvjJzt5kfXv9+ejNcmLp2vv7xwbXFpdnl5dqY+Od+aXpgpdr2FnevP3nOLhssdUIuI6zNXrizXTz13esvqG0Mf1B47NnRu5JkTT3XK3qhPjo6NTfSU6eu/50+/zZ1GeByOIk5Eime/9+PUjIhqh+1xX9zl3Nlvg1UnhqtOTI6OVR2ZazXnV8qV490dUUTUeyo1uvvoARyLPWlErJbNLxs8XHZvYrG51Lw8N1sfby6ttFZaC/PjqdPasj/1KOJsiliLiI3a7ZvrjyL6IsV3jm6myxFxqLsfvlgNDL5zO3b/nbUvynbW+yPWikfgmB1gtSji1Ujxk3ePx3S5z/JXfCHi1TK/H/FWmS9FpPLEOBPx/g7nEY+mvijiz8rjf24zzVTXg+515cLX6l+Zv7LQU7Z7Xdnb/aGdz54Hfn8Y3JYPxgG/Ng1EEc3qir+Z7v2HHQAAAAAAAAAAAAAAAADut8Eo4slI8cq//UE1rjiqcelHz4387tCnbo4ZTxFP3GU7Kf4vnouI1WJ3Y3IP5yHE42k8pYc8lviTbCCK+MM8/u9bD7sxAAAAAAAAAAAAAAAAAAAAn2hF/ChSvPje8bQWvXOKt+av1i81L891ZoXtzv3bnTO93W6366mTjZxTOVdzruVcz7mRM4pcP2cj51TO1ZxrRUQtItbz+42ccSjXz9nIOZVzNedazvWcGzmjL9fP2cg5lXM151rO9ZwbOeOAzN0LAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPBxUkQRH0aKb39jM0WKiEbEVHRyvfawWwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlGqpiHciRf33GjeX9UVEqv7vOF7+cSYah8v8TDRGynwpGudzNqvsa3zrIbSfvelPRfwwUtQG3r55wD/VOf79nXc3T4N465u33v1iXycPdVcOfVB77NjRcyNjv/zEnV6nnRowfKE1f/1GfXJ0bGyiZ3Ff/vTP9Cwbyp9b3J+uExHLb7z5enNubnbp3l+Up8Aeqnux6xeH7ed7e9HOZ/vPWj36DkDjH9KLh3xh4oEo7//vR4rffO/fuzf87s9/P9d5d/MOHz/9o1v3/xe3b2if7v+P9yx7Mf800t8XMbBybbH/WMTA8htvnmhda16dvTo7f+bkyS+PjHz59Mn+wxEDV1q/EhGdV3OzJ/e8qwAAAAAAAAAAAAAAAAAerFTEb0eK5g83Uz0iblTjtYbOjTxz4qlDcagab7Vl3NZrE5fO119euLa4NLu8PDtTn5xvTS/MzO724waq4V6To2P70pm7Gtzn9g8OvLyw+MZS6+rvr+y4/sjA+cvLK0vN6Z1Xx2AUEY3eJcNVgydHx6pGz7Wa81XV8R0H0/3s+lMR/xEpps/U09N5WR7/t32E/5bx/6vbN7RP4/8+3bOs/MyUivhppPiNP38inq7aeSRu22e53F9HiuGzn8/l4nBZrtuGznMFOiMDy7L/Eyn+/sOtZbvjIR+/Vfb5Xe/YR0R5/I9Ginf+9Lvxq3lZ35bnP+x8/I9s39Auj3/7j7fVu8vx/2zPsiNbnldwf/r/SVce/xOR4qXH345fy8v6PuL5H91nbxzPhW8+n2Ofvv/bPZWG8uf++n3qOwAAAAAAAAAAwKOsPxXxN5HiqbG+9EJetpt//zezfUP79O+/PtezbOb+zFd01xdhiikAAAAAPib6UxE/ihRXV96+OYZ66/jvnvGfv3XrF2Ojadva6vd8P189N+B+/v6v11D+3Km9dxsAAAAAAAAAAAAAAAAAAAAOlJSKeCHPpz61w3zqgz3l1iPFK//1bC6XjpXluvPAD1V/DlxcmD9xfm5uYbq50rw8N1ufWGxOz5Z1PxspNv/q87luUc2v/vS2tnTnYl+KFGN/2y3bmYu9Ozd5Zz7wzlzsZdlPR4r//LutZbvzWP/CrbKnyrJ/GSm+/o87lz12q+zpsux3I8UPvl7vlj1Slu0+H/Vzt8o+N73gUaEAAAAAAAAAAAAAAAAAAADsXX8q4k8ixX9fW7s5lj/P/9/f87by1jd75vvf5kY1z/9QNf//nV7fy/z/Q7fX+LDdEdE+eo+9BgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAgy1FEW9GisWLm2m9Vr7vGLjQmr9+Y3J0bOdqg6mqeagqX34NPH/q9JkvvTBytpsfXf9+ezJem7h0vv7ywrXFpdnl5dmZ+uR8a3phZnbXW9hr/e2Gqx1Qv/b69ZkrV5brp547vWX1jaEPao8dGzo38syJp7plJ0fHxiZ6yvT13/On3ybdYfnhKOIvIsWz3/tx+qdaRBF73xd3OXf222DVieGqE5OjY1VH5lrN+ZVy5Xh3RxQR9Z5Kje4+egDHYk8aEatl88sGD5fdm1hsLjUvz83Wx5tLK62V1sL8eOq0tuxPPYo4myLWImKjdvvm+qOI1yPFd45upn+uRRzq7ocvXpz46slTd25HsY993IWynfX+iLXiEThmB1gtiviHSPGTd4/Hv9Qi+qLzFV+IeLXM70e8FZ3jncoT40zE+zucRzya+qKI/y2P/7nN9G6tvB50rysXvlb/yso7vWW715VH/v7wIB3wa9NAFPGD6oq/mf7V9zUAAAAAAAAAAAAAAADAAVLEL0WKF987nqrxwd1B0Uut+av1S83Lc51hfd2xf93V7Xa7XU+dbOScyrmacy3nes6NnFHk+jkbZQ6021P5/WrOtZzrOTdyxqFcP2cj51TO1ZxrOddzbuSMvlw/ZyPnVM7VnGs513Nu5IwDMnYPAAAAAAAAAAAAAAAAAAD4eCmq/1J8+xubqV3rzC89FZ1cNx/ox97/BwAA//8Mp/j3") statfs(&(0x7f0000005d40)='./file0\x00', &(0x7f0000005d80)=""/79) 3.251342364s ago: executing program 0 (id=6050): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000f700850000004f0000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x10, 0x10, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 2.942480249s ago: executing program 0 (id=6055): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x10, 0x3, &(0x7f0000000080)=@framed, &(0x7f00000000c0)='GPL\x00', 0x3, 0x1000, &(0x7f0000000300)=""/4096}, 0x80) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000001800)={@cgroup, r0, 0x7}, 0x14) 2.658338122s ago: executing program 1 (id=6061): r0 = fsopen(&(0x7f0000000280)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='source', &(0x7f0000000f80)='//\xf2b\x06\b\xba\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b/\\/\xf9\\mD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b= 504) [ 521.982158][ T4132] usb-storage 2-1:0.0: Quirks match for vid 04e6 pid 000b: 4 [ 522.014624][T16150] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 522.096704][T16150] F2FS-fs (loop2): invalid crc value [ 522.124094][T16150] F2FS-fs (loop2): Found nat_bits in checkpoint [ 522.131529][T16196] loop4: detected capacity change from 0 to 2048 [ 522.161421][T13118] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 522.193521][T13118] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.201938][T13118] usb 4-1: Product: syz [ 522.216490][T13118] usb 4-1: Manufacturer: syz [ 522.216605][T16150] F2FS-fs (loop2): Start checkpoint disabled! [ 522.221191][T13118] usb 4-1: SerialNumber: syz [ 522.224001][ T4125] usb 2-1: USB disconnect, device number 2 [ 522.250931][T16196] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 1024) [ 522.278132][T16150] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 522.306303][T16202] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 522.307457][T16196] attempt to access beyond end of device [ 522.307457][T16196] loop4: rw=524288, want=33554432, limit=2048 [ 522.340859][T16150] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 522.392471][T16150] F2FS-fs (loop2): switch discard_unit option is not allowed [ 522.434563][T16196] NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16) [ 522.468271][T16196] Remounting filesystem read-only [ 522.556280][ T4151] NILFS (loop4): discard dirty page: offset=4096, ino=6 [ 522.597111][ T4151] NILFS (loop4): discard dirty block: blocknr=39, size=1024 [ 522.623057][ T4151] NILFS (loop4): discard dirty block: blocknr=18446744073709551615, size=1024 [ 522.653263][T13118] usb 4-1: USB disconnect, device number 117 [ 522.675305][ T4151] NILFS (loop4): discard dirty block: blocknr=18446744073709551615, size=1024 [ 522.697307][ T4151] NILFS (loop4): discard dirty block: blocknr=18446744073709551615, size=1024 [ 522.739327][ T4151] NILFS (loop4): disposed unprocessed dirty file(s) when detaching log writer [ 522.753021][ T4151] NILFS (loop4): discard dirty page: offset=0, ino=3 [ 522.760225][ T4151] NILFS (loop4): discard dirty block: blocknr=18446744073709551615, size=1024 [ 522.781472][ T4151] NILFS (loop4): discard dirty block: blocknr=18446744073709551615, size=1024 [ 522.790354][ T4151] NILFS (loop4): discard dirty block: blocknr=44, size=1024 [ 522.824960][ T4151] NILFS (loop4): discard dirty block: blocknr=18446744073709551615, size=1024 [ 522.949568][ T4093] udevd[4093]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 522.951454][ T150] block nbd2: Attempted send on invalid socket [ 522.972076][ T150] blk_update_request: I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 523.198095][T16226] netlink: 448 bytes leftover after parsing attributes in process `syz.3.5446'. [ 523.239543][T16226] unsupported nla_type 14345 [ 523.279071][T16232] mmap: syz.2.5451 (16232): VmData 54239232 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 523.637496][ T4128] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 524.155560][T16296] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5481'. [ 524.237334][ T4128] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 524.263836][ T4128] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 524.278862][ T4128] usb 2-1: Product: syz [ 524.283049][ T4128] usb 2-1: Manufacturer: syz [ 524.289928][ T4128] usb 2-1: SerialNumber: syz [ 524.344002][ T4128] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 524.409733][T16309] netlink: 'syz.4.5489': attribute type 75 has an invalid length. [ 524.591523][T16317] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 524.821437][T16338] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5501'. [ 525.027783][ T4128] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 525.238401][T16350] loop2: detected capacity change from 0 to 2048 [ 525.325163][T16358] netlink: 'syz.0.5512': attribute type 29 has an invalid length. [ 525.355184][T16358] netlink: 'syz.0.5512': attribute type 29 has an invalid length. [ 525.369071][T16350] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 525.483783][T13118] usb 2-1: USB disconnect, device number 3 [ 525.549197][T16360] loop4: detected capacity change from 0 to 8192 [ 525.679867][T16366] loop2: detected capacity change from 0 to 256 [ 525.716899][T16360] REISERFS (device loop4): found reiserfs format "3.5" with non-standard journal [ 525.731590][T16360] REISERFS (device loop4): using ordered data mode [ 525.744420][T16360] reiserfs: using flush barriers [ 525.753138][T16360] REISERFS (device loop4): journal params: device loop4, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 525.882559][T16360] REISERFS (device loop4): checking transaction log (loop4) [ 525.955047][T16360] REISERFS (device loop4): Using r5 hash to sort names [ 526.204934][ T4128] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 526.211931][ T4128] ath9k_htc: Failed to initialize the device [ 526.219636][ T1389] ieee802154 phy0 wpan0: encryption failed: -22 [ 526.226496][ T1389] ieee802154 phy1 wpan1: encryption failed: -22 [ 526.245316][T13118] usb 2-1: ath9k_htc: USB layer deinitialized [ 526.260139][T16382] damon: invalid nr_regions. min (3) > max (0) [ 526.289931][T16384] loop2: detected capacity change from 0 to 1024 [ 526.379645][T16384] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpquota,auto_da_alloc=0x0000000000000004,resuid=0x0000000000000000,max_batch_time=0x0000000000000003,i_version,usrquota,data_err=ignore,data_err=abort,,errors=continue. Quota mode: writeback. [ 526.808837][T16405] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5535'. [ 526.983253][T16402] loop4: detected capacity change from 0 to 8192 [ 527.002801][ T5236] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 527.075684][T16402] REISERFS warning (device loop4): super-6506 reiserfs_getopt: bad value "sma" for option "tails" [ 527.075684][T16402] [ 527.273895][ T5236] usb 4-1: Using ep0 maxpacket: 16 [ 527.402506][ T5236] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 527.410527][ T5236] usb 4-1: config 0 has no interface number 0 [ 527.436992][ T5236] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 527.477070][ T5236] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 527.637873][ T5236] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 527.648424][ T5236] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 527.656615][ T5236] usb 4-1: Product: syz [ 527.699070][ T5236] usb 4-1: SerialNumber: syz [ 527.725238][ T5236] usb 4-1: config 0 descriptor?? [ 527.768187][ T5236] usbhid 4-1:0.8: couldn't find an input interrupt endpoint [ 527.986823][ T5236] usb 4-1: USB disconnect, device number 118 [ 528.073072][T16426] loop4: detected capacity change from 0 to 256 [ 528.074921][T16409] loop2: detected capacity change from 0 to 40427 [ 528.183692][T16426] exfat: Deprecated parameter 'utf8' [ 528.229948][T16409] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 528.258329][T16409] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 528.264081][T16426] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0xc61f63e4, utbl_chksum : 0xe619d30d) [ 528.300057][T16409] F2FS-fs (loop2): invalid crc value [ 528.416945][T16409] F2FS-fs (loop2): Found nat_bits in checkpoint [ 528.623296][T16409] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 528.630372][T16409] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 528.714596][T16409] attempt to access beyond end of device [ 528.714596][T16409] loop2: rw=2049, want=45104, limit=40427 [ 528.895578][ T4132] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 529.439843][T16442] loop4: detected capacity change from 0 to 32768 [ 529.563292][ T4132] usb 4-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 529.584607][ T4132] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.603566][ T4132] usb 4-1: Product: syz [ 529.616329][ T4132] usb 4-1: Manufacturer: syz [ 529.621148][ T4132] usb 4-1: SerialNumber: syz [ 529.631181][ T4132] usb 4-1: config 0 descriptor?? [ 529.643053][T16442] gfs2: fsid=#.!%.'\': Trying to join cluster "lock_nolock", "#.!%.'\'" [ 529.682538][ T4132] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 529.688149][T16442] gfs2: fsid=#.!%.'\': Now mounting FS (format 1801)... [ 529.716688][T16442] gfs2: fsid=#.!%.'\'.s: journal 0 mapped with 18 extents in 0ms [ 529.787746][T13118] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 529.917568][T16482] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5567'. [ 529.946333][T16442] gfs2: fsid=#.!%.'\'.s: first mount done, others may mount [ 529.951317][T16482] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5567'. [ 530.130394][ T4132] gspca_sunplus: reg_w_riv err -71 [ 530.135582][ T4132] sunplus: probe of 4-1:0.0 failed with error -71 [ 530.142729][ T4128] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 530.185136][ T4132] usb 4-1: USB disconnect, device number 119 [ 530.236783][T13118] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 530.317770][T16492] tmpfs: Bad value for 'mpol' [ 530.440602][ T4128] usb 2-1: Using ep0 maxpacket: 16 [ 530.461874][T13118] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0093, bcdDevice=23.5a [ 530.497271][T13118] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 530.509810][T13118] usb 1-1: Product: syz [ 530.513995][T13118] usb 1-1: Manufacturer: syz [ 530.523051][ T4129] usb 3-1: new high-speed USB device number 123 using dummy_hcd [ 530.535858][T13118] usb 1-1: SerialNumber: syz [ 530.551685][T13118] usb 1-1: config 0 descriptor?? [ 530.616041][T16500] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5576'. [ 530.773063][ T4128] usb 2-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 530.793414][ T4128] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 530.801466][ T4128] usb 2-1: Product: syz [ 530.824798][ T4128] usb 2-1: Manufacturer: syz [ 530.829903][ T4129] usb 3-1: Using ep0 maxpacket: 8 [ 530.835631][ T4128] usb 2-1: SerialNumber: syz [ 530.854004][ T4128] usb 2-1: config 0 descriptor?? [ 530.872089][T16512] loop4: detected capacity change from 0 to 64 [ 530.900509][T13118] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-8 [ 530.907849][T13118] dvb_usb_af9035: probe of 1-1:0.0 failed with error -8 [ 530.933630][ T4128] visor 2-1:0.0: Sony Clie 3.5 converter detected [ 530.942585][T13118] usb 1-1: USB disconnect, device number 117 [ 530.985700][ T4129] usb 3-1: config 0 has an invalid interface number: 15 but max is 0 [ 531.000397][ T4129] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 531.022887][T16512] UBIFS error (pid: 16512): cannot open "./file0", error -22 [ 531.032986][ T4129] usb 3-1: config 0 has no interface number 0 [ 531.170094][ T150] block nbd4: Attempted send on invalid socket [ 531.176293][ T150] blk_update_request: I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 531.211317][T16518] efs: cannot read volume header [ 531.263954][ T4129] usb 3-1: New USB device found, idVendor=15c2, idProduct=003b, bcdDevice=66.3e [ 531.298582][ T4129] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 531.346952][ T4129] usb 3-1: Product: syz [ 531.371548][ T4129] usb 3-1: Manufacturer: syz [ 531.392278][ T4128] usb 2-1: clie_3_5_startup: get interface number failed: -71 [ 531.400151][ T4128] visor: probe of 2-1:0.0 failed with error -71 [ 531.407751][ T4129] usb 3-1: SerialNumber: syz [ 531.437515][ T4129] usb 3-1: config 0 descriptor?? [ 531.446293][ T4128] usb 2-1: USB disconnect, device number 4 [ 531.464242][T16528] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5589'. [ 531.607069][T16534] netlink: 491 bytes leftover after parsing attributes in process `syz.4.5593'. [ 531.735601][ T4129] imon 3-1:0.15: unable to register, err -19 [ 531.774853][ T4129] usb 3-1: USB disconnect, device number 123 [ 531.850632][T16546] netlink: 'syz.3.5598': attribute type 1 has an invalid length. [ 531.866498][T16540] loop4: detected capacity change from 0 to 4096 [ 531.871579][T16546] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5598'. [ 531.953920][T16540] ntfs3: loop4: ino=3, Correct links count -> 2. [ 532.505714][ T4128] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 532.698609][T16589] x_tables: duplicate underflow at hook 4 [ 532.897249][T16603] loop4: detected capacity change from 0 to 16 [ 532.962524][ T4128] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 532.991944][T16603] erofs: (device loop4): mounted with root inode @ nid 36. [ 533.015142][T16603] loop4: Can't mount, would change RO state [ 533.157199][ T4128] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0093, bcdDevice=23.5a [ 533.177144][ T4128] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 533.183546][T16625] AppArmor: change_hat: Invalid input '0' [ 533.221193][ T4128] usb 4-1: Product: syz [ 533.264428][ T4128] usb 4-1: Manufacturer: syz [ 533.269062][ T4128] usb 4-1: SerialNumber: syz [ 533.307314][T16627] proc: Bad value for 'gid' [ 533.312940][ T4128] usb 4-1: config 0 descriptor?? [ 533.387819][T16639] kAFS: unparsable volume name [ 533.417149][ T2517] block nbd0: Attempted send on invalid socket [ 533.423348][ T2517] blk_update_request: I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 533.468075][T16638] efs: cannot read volume header [ 533.620585][T16645] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5646'. [ 533.642028][T16647] loop4: detected capacity change from 0 to 256 [ 533.662727][ T4128] usb 4-1: dvb_usb_v2: usb_bulk_msg() failed=-8 [ 533.669050][ T4128] dvb_usb_af9035: probe of 4-1:0.0 failed with error -8 [ 533.681074][T16645] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5646'. [ 533.697589][ T4128] usb 4-1: USB disconnect, device number 120 [ 533.713568][T16645] netlink: 48 bytes leftover after parsing attributes in process `syz.2.5646'. [ 533.733481][T16649] tmpfs: Bad value for 'mpol' [ 533.812133][T16647] FAT-fs (loop4): Directory bread(block 64) failed [ 533.818726][T16647] FAT-fs (loop4): Directory bread(block 65) failed [ 533.880504][T16647] FAT-fs (loop4): Directory bread(block 66) failed [ 533.903746][T16647] FAT-fs (loop4): Directory bread(block 67) failed [ 533.905718][T14270] Bluetooth: hci5: command 0x0406 tx timeout [ 533.935454][T16647] FAT-fs (loop4): Directory bread(block 68) failed [ 533.959700][T16647] FAT-fs (loop4): Directory bread(block 69) failed [ 533.976278][T16647] FAT-fs (loop4): Directory bread(block 70) failed [ 534.004795][T16647] FAT-fs (loop4): Directory bread(block 71) failed [ 534.011425][T16647] FAT-fs (loop4): Directory bread(block 72) failed [ 534.056426][T16647] FAT-fs (loop4): Directory bread(block 73) failed [ 534.095701][T16658] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5654'. [ 534.404106][T16661] loop2: detected capacity change from 0 to 4096 [ 534.483454][T16661] ntfs3: loop2: ino=3, Correct links count -> 2. [ 534.620589][T16680] loop4: detected capacity change from 0 to 256 [ 534.722517][T16680] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x205ad3fc, utbl_chksum : 0xe619d30d) [ 534.724523][T16688] loop2: detected capacity change from 0 to 64 [ 534.824064][T16688] UBIFS error (pid: 16688): cannot open "./file0", error -22 [ 534.938129][T16697] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5671'. [ 535.034191][T16704] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 535.052072][T16706] netlink: 'syz.3.5676': attribute type 7 has an invalid length. [ 535.060062][T16706] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.5676'. [ 535.167834][ T4132] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 535.414032][ T4128] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 535.585237][ T4132] usb 5-1: config index 0 descriptor too short (expected 35577, got 27) [ 535.594860][ T4132] usb 5-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 535.646869][ T4132] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 535.677118][ T4132] usb 5-1: config 1 has no interface number 0 [ 535.702979][ T4128] usb 1-1: Using ep0 maxpacket: 8 [ 535.713703][ T4132] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 535.754199][ T4132] usb 5-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 535.789863][ T25] audit: type=1326 audit(1723800469.496:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16740 comm="syz.2.5694" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f524154e9b9 code=0x7ffc0000 [ 535.825381][ T4132] usb 5-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d6.01 [ 535.856701][ T4128] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 535.867248][ T4132] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 535.880293][T16747] netlink: 172 bytes leftover after parsing attributes in process `syz.1.5695'. [ 535.894796][ T25] audit: type=1326 audit(1723800469.515:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16740 comm="syz.2.5694" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f524154e9b9 code=0x7ffc0000 [ 535.895374][ T4128] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 535.919472][T16747] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5695'. [ 535.943806][T16749] loop2: detected capacity change from 0 to 8 [ 535.948885][ T4128] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 535.996701][ T25] audit: type=1326 audit(1723800469.515:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16740 comm="syz.2.5694" exe="/root/syz-executor" sig=0 arch=c000003e syscall=140 compat=0 ip=0x7f524154e9b9 code=0x7ffc0000 [ 536.026061][ T4132] snd_usb_pod 5-1:1.1: Line 6 Pocket POD found [ 536.155329][ T25] audit: type=1326 audit(1723800469.515:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16740 comm="syz.2.5694" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f524154e9b9 code=0x7ffc0000 [ 536.178336][ T4128] usb 1-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice=7e.6b [ 536.192750][ T4128] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.221888][ T4128] usb 1-1: Product: syz [ 536.226088][ T4128] usb 1-1: Manufacturer: syz [ 536.249139][ T4132] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now attached [ 536.267558][ T4128] usb 1-1: SerialNumber: syz [ 536.277481][ T4128] usb 1-1: config 0 descriptor?? [ 536.294272][ T25] audit: type=1326 audit(1723800469.515:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16740 comm="syz.2.5694" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f524154e9b9 code=0x7ffc0000 [ 536.497616][ T4128] usb 5-1: USB disconnect, device number 8 [ 536.524965][ T4128] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now disconnected [ 536.625479][ T4132] usb 1-1: USB disconnect, device number 118 [ 537.091124][T16764] netlink: 'syz.2.5702': attribute type 6 has an invalid length. [ 537.439535][T16779] loop2: detected capacity change from 0 to 64 [ 537.709504][T16784] syz.0.5715 uses obsolete (PF_INET,SOCK_PACKET) [ 538.324931][T16792] delete_channel: no stack [ 538.502165][T16804] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5725'. [ 538.651531][T16814] program syz.4.5730 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 538.761569][T16823] IPv6: sit2: Disabled Multicast RS [ 538.922895][ T25] audit: type=1400 audit(1723800472.413:15): apparmor="DENIED" operation="setprocattr" info="fscreate" error=-22 profile="unconfined" pid=16836 comm="syz.2.5742" [ 538.962741][T16839] tmpfs: Bad value for 'mpol' [ 539.068098][T16846] netlink: 'syz.1.5746': attribute type 75 has an invalid length. [ 539.083903][ T4129] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 539.196911][T16858] tmpfs: Bad value for 'mpol' [ 539.371559][ T4129] usb 1-1: Using ep0 maxpacket: 8 [ 539.464806][T16872] loop4: detected capacity change from 0 to 2048 [ 539.510803][ T4129] usb 1-1: config 0 has an invalid interface number: 33 but max is 1 [ 539.519237][ T4129] usb 1-1: config 0 has no interface number 1 [ 539.547504][ T4129] usb 1-1: config 0 interface 33 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 539.564493][T16872] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 539.601120][ T4129] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 2039, setting to 1024 [ 539.655130][ T4129] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 539.863715][ T4129] usb 1-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 539.888793][ T4129] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 539.931712][ T4129] usb 1-1: Product: syz [ 539.935901][ T4129] usb 1-1: Manufacturer: syz [ 539.992718][ T4129] usb 1-1: SerialNumber: syz [ 540.025499][ T4129] usb 1-1: config 0 descriptor?? [ 540.101809][ T4129] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 540.136583][T16894] loop2: detected capacity change from 0 to 4096 [ 540.184584][ T4132] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 540.219779][T16894] ntfs3: loop2: Different NTFS' sector size (4096) and media sector size (512) [ 540.237071][T16896] loop4: detected capacity change from 0 to 4096 [ 540.280068][T16896] ntfs: (device loop4): check_mft_mirror(): $MFT and $MFTMirr (record 1) do not match. Run ntfsfix or chkdsk. [ 540.331034][ T4147] ntfs3: loop2: ntfs_sync_fs r=1a failed, -22. [ 540.334179][T16896] ntfs: (device loop4): load_system_files(): $MFTMirr does not match $MFT. Mounting read-only. Run ntfsfix and/or chkdsk. [ 540.349660][ T4147] ntfs3: loop2: Mark volume as dirty due to NTFS errors [ 540.357729][ T4129] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 540.359446][ T2148] pvrusb2: Invalid read control endpoint [ 540.375886][ T2148] usb 1-1: Direct firmware load for v4l-pvrusb2-29xxx-01.fw failed with error -2 [ 540.406464][T16896] ntfs: (device loop4): ntfs_read_locked_inode(): First extent of $DATA attribute has non zero lowest_vcn. [ 540.416529][ T4147] ntfs3: loop2: ntfs_evict_inode r=1a failed, -22. [ 540.426794][ T2148] usb 1-1: Falling back to sysfs fallback for: v4l-pvrusb2-29xxx-01.fw [ 540.431577][ T4129] usb 1-1: USB disconnect, device number 119 [ 540.483987][T16896] ntfs: (device loop4): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0xa as bad. Run chkdsk. [ 540.497728][ T4132] usb 2-1: Using ep0 maxpacket: 32 [ 540.546120][T16896] ntfs: volume version 3.1. [ 540.633905][ T4132] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 540.655290][ T4132] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 540.665074][ T4132] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 540.752097][ T4132] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 540.791215][ T4132] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 540.829458][ T4132] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 540.879734][T16911] openvswitch: netlink: Duplicate key (type 16). [ 541.071987][T16923] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5783'. [ 541.090866][ T4132] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 541.109296][ T4132] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 541.127402][ T4132] usb 2-1: Product: syz [ 541.135193][ T4132] usb 2-1: Manufacturer: syz [ 541.143648][ T4132] usb 2-1: SerialNumber: syz [ 541.191020][ T4132] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found [ 541.202656][ T4132] cdc_ncm 2-1:1.0: bind() failure [ 541.224286][ T4132] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 541.250136][ T4132] cdc_ncm 2-1:1.1: bind() failure [ 541.457680][ T4132] usb 2-1: USB disconnect, device number 5 [ 541.489448][ T13] usb 3-1: new full-speed USB device number 124 using dummy_hcd [ 541.775797][T16954] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5798'. [ 541.831562][T13118] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 541.874708][ T13] usb 3-1: config index 0 descriptor too short (expected 35577, got 27) [ 541.892377][ T13] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 541.922436][ T13] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 541.924390][T16959] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5800'. [ 541.943705][ T13] usb 3-1: config 1 has no interface number 0 [ 541.964951][ T13] usb 3-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 541.998167][ T13] usb 3-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 542.022270][ T13] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d6.01 [ 542.050158][ T13] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 542.120094][ T13] snd_usb_pod 3-1:1.1: Line 6 Pocket POD found [ 542.131218][T13118] usb 4-1: Using ep0 maxpacket: 8 [ 542.281602][T13118] usb 4-1: config 0 has an invalid interface number: 33 but max is 1 [ 542.289831][T13118] usb 4-1: config 0 has no interface number 1 [ 542.299330][T16978] netlink: 132 bytes leftover after parsing attributes in process `syz.4.5810'. [ 542.313423][T13118] usb 4-1: config 0 interface 33 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 542.334360][T13118] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 2039, setting to 1024 [ 542.367071][ T13] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now attached [ 542.371448][T13118] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 542.607231][ T13] usb 3-1: USB disconnect, device number 124 [ 542.618712][T16987] netlink: 'syz.4.5815': attribute type 16 has an invalid length. [ 542.634652][T13118] usb 4-1: New USB device found, idVendor=2040, idProduct=2950, bcdDevice=85.f1 [ 542.635623][ T13] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now disconnected [ 542.643737][T13118] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 542.643761][T13118] usb 4-1: Product: syz [ 542.643775][T13118] usb 4-1: Manufacturer: syz [ 542.660965][T16987] netlink: 'syz.4.5815': attribute type 17 has an invalid length. [ 542.676254][T13118] usb 4-1: SerialNumber: syz [ 542.718579][T13118] usb 4-1: config 0 descriptor?? [ 542.786020][T13118] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 543.010783][T13118] pvrusb2: Hardware description: WinTV PVR USB2 Model 29xxx [ 543.061882][T13118] usb 4-1: USB disconnect, device number 121 [ 543.082785][T13118] pvrusb2: Device being rendered inoperable [ 543.103110][T13118] pvrusb2: Device being rendered inoperable [ 543.239965][T16987] bridge0: port 2(bridge_slave_1) entered disabled state [ 543.248056][T16987] bridge0: port 1(bridge_slave_0) entered disabled state [ 544.140462][T16987] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 544.223213][T16987] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 544.929725][T16987] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 544.943641][T16987] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 544.972884][T16987] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 544.991194][T16987] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 545.221746][T17018] IPv6: sit1: Disabled Multicast RS [ 545.735286][T17070] netlink: 204 bytes leftover after parsing attributes in process `syz.2.5856'. [ 545.752372][T17072] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5855'. [ 545.839829][T17078] ipt_CLUSTERIP: no config found for 127.0.0.1, need 'new' [ 546.121565][T17101] netlink: 'syz.1.5870': attribute type 3 has an invalid length. [ 546.297277][T17112] loop2: detected capacity change from 0 to 512 [ 546.360891][T17112] UDF-fs: warning (device loop2): udf_load_vrs: No VRS found [ 546.395746][T17112] UDF-fs: Scanning with blocksize 512 failed [ 546.422467][T17112] UDF-fs: warning (device loop2): udf_load_vrs: No VRS found [ 546.459950][T17112] UDF-fs: Scanning with blocksize 1024 failed [ 546.484260][T17112] UDF-fs: warning (device loop2): udf_load_vrs: No VRS found [ 546.506295][T17112] UDF-fs: Scanning with blocksize 2048 failed [ 546.517483][T17112] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 546.551026][T17112] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 546.943823][T17142] loop2: detected capacity change from 0 to 4096 [ 546.996913][T17152] netlink: 212908 bytes leftover after parsing attributes in process `syz.1.5894'. [ 547.013125][T17142] ntfs3: loop2: Different NTFS' sector size (4096) and media sector size (512) [ 547.035813][T17154] xt_l2tp: missing protocol rule (udp|l2tpip) [ 547.049337][T17152] netlink: zone id is out of range [ 547.551802][T17171] SET target dimension over the limit! [ 547.850272][T17183] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5907'. [ 548.174633][ T4132] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 548.448075][T17214] netlink: 'syz.2.5922': attribute type 16 has an invalid length. [ 548.475593][T17214] netlink: 'syz.2.5922': attribute type 17 has an invalid length. [ 548.515322][T17214] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 548.541198][T17214] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 548.541548][T17163] loop4: detected capacity change from 0 to 32768 [ 548.557955][T17214] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 548.579791][T17214] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 548.602471][T17163] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop4 scanned by syz.4.5899 (17163) [ 548.642048][T17163] BTRFS info (device loop4): using sha256 (sha256-avx2) checksum algorithm [ 548.655956][ T4132] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 548.688147][T17163] BTRFS info (device loop4): using free space tree [ 548.698815][ T4132] usb 4-1: New USB device found, idVendor=5bd3, idProduct=317c, bcdDevice= 4.5e [ 548.709731][T17163] BTRFS info (device loop4): has skinny extents [ 548.728228][ T4132] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 548.761538][ T4132] usb 4-1: config 0 descriptor?? [ 548.817258][ T4132] usb 4-1: bad CDC descriptors [ 548.887022][T17163] BTRFS info (device loop4): enabling ssd optimizations [ 549.046692][T17241] (unnamed net_device) (uninitialized): option arp_all_targets: invalid value (524288) [ 549.068528][ T4132] usb 4-1: USB disconnect, device number 122 [ 549.165303][T17243] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5928'. [ 549.457379][T17253] netlink: 'syz.4.5926': attribute type 11 has an invalid length. [ 549.465872][T17253] netlink: 105120 bytes leftover after parsing attributes in process `syz.4.5926'. [ 549.941349][T17287] loop2: detected capacity change from 0 to 64 [ 550.023095][T17287] MINIX-fs: mounting unchecked file system, running fsck is recommended [ 550.345969][ T4128] Bluetooth: hci0: command 0x0406 tx timeout [ 550.605292][T17333] loop2: detected capacity change from 0 to 1764 [ 550.778858][T17345] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5977'. [ 550.816655][T17345] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5977'. [ 550.848832][ T5234] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 550.943992][T17356] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 551.007478][T17359] loop2: detected capacity change from 0 to 2048 [ 551.027139][T17361] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 551.034413][T17361] IPv6: NLM_F_CREATE should be set when creating new route [ 551.041703][T17361] IPv6: NLM_F_CREATE should be set when creating new route [ 551.084062][T17363] netlink: 'syz.3.5987': attribute type 16 has an invalid length. [ 551.104972][T17363] netlink: 'syz.3.5987': attribute type 17 has an invalid length. [ 551.137477][T17359] UDF-fs: error (device loop2): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 551.158429][T17363] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 551.193487][T17363] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 551.226384][T17363] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 551.233936][ T5234] usb 5-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad [ 551.234835][T17363] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 551.277676][ T5234] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 551.307105][ T5234] usb 5-1: config 0 descriptor?? [ 551.409894][ T5234] gspca_main: spca508-2.14.0 probing 8086:0110 [ 551.425733][T17373] x_tables: unsorted entry at hook 1 [ 551.685921][T17390] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 551.693172][T17390] IPv6: NLM_F_CREATE should be set when creating new route [ 551.700485][T17390] IPv6: NLM_F_CREATE should be set when creating new route [ 551.832900][T17399] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6003'. [ 551.862842][T17399] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6003'. [ 551.875573][ T5234] gspca_spca508: reg_read err -71 [ 551.898397][ T5234] gspca_spca508: reg_read err -71 [ 551.918256][ T5234] gspca_spca508: reg_read err -71 [ 551.950591][ T5234] gspca_spca508: reg_read err -71 [ 551.976146][ T5234] gspca_spca508: reg write: error -71 [ 551.979410][T17409] binder: 17407:17409 ioctl c018620b 0 returned -14 [ 551.995386][T17408] netlink: 'syz.1.6007': attribute type 16 has an invalid length. [ 552.004151][ T5234] spca508: probe of 5-1:0.0 failed with error -71 [ 552.027482][ T5234] usb 5-1: USB disconnect, device number 9 [ 552.034607][T17408] netlink: 'syz.1.6007': attribute type 17 has an invalid length. [ 552.131676][T17413] binder: 17412:17413 ioctl 541b 0 returned -22 [ 552.654584][T17457] loop2: detected capacity change from 0 to 1024 [ 552.795894][T17459] loop4: detected capacity change from 0 to 2048 [ 552.935990][T17477] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 553.010727][T17459] NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16) [ 553.066024][T17459] Remounting filesystem read-only [ 553.071672][T17459] NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16) [ 553.125871][T17459] NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16) [ 553.159008][T17459] NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16) [ 553.176627][ T150] block nbd3: Attempted send on invalid socket [ 553.183131][ T150] blk_update_request: I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 553.209464][T17459] NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16) [ 553.213593][ T150] block nbd3: Attempted send on invalid socket [ 553.226893][ T150] blk_update_request: I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 553.238239][ T2517] block nbd3: Attempted send on invalid socket [ 553.240673][T17459] NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16) [ 553.244437][ T2517] blk_update_request: I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 553.265187][ T25] kauditd_printk_skb: 12 callbacks suppressed [ 553.265205][ T25] audit: type=1800 audit(1723800485.819:16): pid=17459 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.6033" name="file2" dev="loop4" ino=16 res=0 errno=0 [ 553.275952][T17459] syz.4.6033 (17459) used greatest stack depth: 18784 bytes left [ 553.299352][ T150] block nbd3: Attempted send on invalid socket [ 553.305522][ T150] blk_update_request: I/O error, dev nbd3, sector 18 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 553.330541][ T150] block nbd3: Attempted send on invalid socket [ 553.336776][ T150] blk_update_request: I/O error, dev nbd3, sector 30 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 553.350844][ T150] block nbd3: Attempted send on invalid socket [ 553.357131][ T150] blk_update_request: I/O error, dev nbd3, sector 36 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 553.368274][T17493] VFS: unable to find oldfs superblock on device nbd3 [ 553.988352][T17539] netlink: 3 bytes leftover after parsing attributes in process `syz.3.6071'. [ 554.015709][T17539] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 554.442804][ T4132] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 554.485625][T17569] xt_CT: You must specify a L4 protocol and not use inversions on it [ 554.597495][T17574] netlink: 7 bytes leftover after parsing attributes in process `syz.4.6088'. [ 554.631476][T17574] netlink: 7 bytes leftover after parsing attributes in process `syz.4.6088'. [ 555.031329][ T4132] usb 2-1: New USB device found, idVendor=2c42, idProduct=1602, bcdDevice=da.64 [ 555.069148][ T4132] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 555.081761][ T4132] usb 2-1: Product: syz [ 555.087171][ T4132] usb 2-1: Manufacturer: syz [ 555.107114][ T4132] usb 2-1: SerialNumber: syz [ 555.138926][ T4132] usb 2-1: config 0 descriptor?? [ 555.157555][T17598] loop2: detected capacity change from 0 to 1764 [ 555.192152][ T4132] hub 2-1:0.0: bad descriptor, ignoring hub [ 555.198130][ T4132] hub: probe of 2-1:0.0 failed with error -5 [ 555.227640][ T4132] f81232 2-1:0.0: f81534a converter detected [ 555.421663][T17607] loop2: detected capacity change from 0 to 256 [ 555.438443][ T4132] usb 2-1: f81534a converter now attached to ttyUSB0 [ 555.557683][T17607] FAT-fs (loop2): Directory bread(block 64) failed [ 555.587818][T17607] FAT-fs (loop2): Directory bread(block 65) failed [ 555.597065][T17607] FAT-fs (loop2): Directory bread(block 66) failed [ 555.636778][T17607] FAT-fs (loop2): Directory bread(block 67) failed [ 555.661366][T17607] FAT-fs (loop2): Directory bread(block 68) failed [ 555.671474][T17607] FAT-fs (loop2): Directory bread(block 69) failed [ 555.705726][T17607] FAT-fs (loop2): Directory bread(block 70) failed [ 555.712287][T17607] FAT-fs (loop2): Directory bread(block 71) failed [ 555.735215][T17607] FAT-fs (loop2): Directory bread(block 72) failed [ 555.767535][T17607] FAT-fs (loop2): Directory bread(block 73) failed [ 555.780513][ T4132] usb 2-1: USB disconnect, device number 6 [ 555.797746][ T4132] f81534a ttyUSB0: f81534a converter now disconnected from ttyUSB0 [ 555.842608][ T4132] f81232 2-1:0.0: device disconnected [ 556.336135][ T27] INFO: task syz.1.3204:10839 blocked for more than 143 seconds. [ 556.353513][ T27] Not tainted 5.15.164-syzkaller #0 [ 556.381064][ T27] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 556.432823][ T27] task:syz.1.3204 state:D stack:23584 pid:10839 ppid: 4142 flags:0x00004004 [ 556.476046][ T27] Call Trace: [ 556.479351][ T27] [ 556.482291][ T27] __schedule+0x12c4/0x45b0 [ 556.517573][ T27] ? __lock_acquire+0x1295/0x1ff0 [ 556.536499][ T27] ? release_firmware_map_entry+0x190/0x190 [ 556.558373][ T27] ? do_raw_spin_unlock+0x137/0x8b0 [ 556.568131][ T27] schedule+0x11b/0x1f0 [ 556.572754][ T27] xlog_grant_head_wait+0x381/0x900 [ 556.577980][ T27] xlog_grant_head_check+0x295/0x480 [ 556.583916][ T27] ? xlog_grant_push_ail+0xd0/0xd0 [ 556.589059][ T27] xfs_log_reserve+0x3b8/0xb10 [ 556.594277][ T27] ? xlog_grant_head_check+0x480/0x480 [ 556.599845][ T27] ? xfs_mod_fdblocks+0x1ca/0x480 [ 556.621441][ T27] xfs_trans_reserve+0x23d/0x690 [ 556.639524][ T27] xfs_trans_alloc+0x420/0x7f0 [ 556.655388][ T27] xfs_trans_alloc_inode+0x129/0x450 [ 556.673099][ T27] ? xfs_trans_dup+0x620/0x620 [ 556.688778][ T27] xfs_attr_set+0x848/0x1460 [ 556.693508][ T27] ? xfs_attr_remove_iter+0xd30/0xd30 [ 556.698909][ T27] ? lockdep_unlock+0x166/0x300 [ 556.734662][ T27] xfs_xattr_set+0x227/0x3a0 [ 556.739378][ T27] ? xfs_xattr_get+0x2f0/0x2f0 [ 556.760940][ T27] ? aa_get_newest_label+0xf9/0x6c0 [ 556.782533][ T27] ? evm_protect_xattr+0x33b/0xa70 [ 556.788068][ T27] ? xfs_xattr_get+0x2f0/0x2f0 [ 556.792856][ T27] __vfs_setxattr+0x3e7/0x420 [ 556.806388][ T27] __vfs_setxattr_noperm+0x12a/0x5e0 [ 556.817381][ T27] vfs_setxattr+0x21d/0x420 [ 556.821918][ T27] ? asm_exc_page_fault+0x22/0x30 [ 556.854629][ T27] ? xattr_permission+0x4f0/0x4f0 [ 556.859711][ T27] ? copy_user_enhanced_fast_string+0xe/0x40 [ 556.885551][ T27] ? _copy_from_user+0x10f/0x170 [ 556.901407][ T27] setxattr+0x27e/0x2e0 [ 556.914673][ T27] ? path_setxattr+0x2a0/0x2a0 [ 556.919499][ T27] ? preempt_count_add+0x8f/0x180 [ 556.954886][ T27] ? __mnt_want_write+0x1e6/0x260 [ 556.965552][ T27] path_setxattr+0x1bc/0x2a0 [ 556.979030][ T27] ? simple_xattr_list_add+0xf0/0xf0 [ 556.984357][ T27] ? syscall_enter_from_user_mode+0x2e/0x240 [ 557.023330][ T27] __x64_sys_setxattr+0xb7/0xd0 [ 557.037727][ T27] do_syscall_64+0x3b/0xb0 [ 557.052304][ T27] ? clear_bhb_loop+0x15/0x70 [ 557.068091][ T27] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 557.087218][ T27] RIP: 0033:0x7f66b12fe9b9 [ 557.100035][ T27] RSP: 002b:00007f66af77b038 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc [ 557.124383][ T27] RAX: ffffffffffffffda RBX: 00007f66b149af80 RCX: 00007f66b12fe9b9 [ 557.133975][T17639] loop2: detected capacity change from 0 to 32768 [ 557.145463][ T27] RDX: 0000000020000100 RSI: 0000000020000340 RDI: 0000000020000040 [ 557.168559][ T27] RBP: 00007f66b136c8d8 R08: 0000000000000000 R09: 0000000000000000 [ 557.177514][ T27] R10: 000000000000fc21 R11: 0000000000000246 R12: 0000000000000000 [ 557.208131][ T27] R13: 0000000000000000 R14: 00007f66b149af80 R15: 00007fff6ae1a7a8 [ 557.218612][ T27] [ 557.221716][ T27] [ 557.221716][ T27] Showing all locks held in the system: [ 557.236632][ T27] 1 lock held by khungtaskd/27: [ 557.251480][ T27] #0: ffffffff8c91fb20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 [ 557.289107][ T27] 2 locks held by kworker/u4:2/154: [ 557.294450][ T27] 2 locks held by pvrusb2-context/2148: [ 557.308669][ T27] #0: ffff888023800188 (&hdw->big_lock_mutex){+.+.}-{3:3}, at: pvr2_hdw_initialize+0xc6/0x3cc0 [ 557.319573][ T27] #1: ffffffff8c7cff90 (umhelper_sem){++++}-{3:3}, at: usermodehelper_read_trylock+0x138/0x360 [ 557.338969][ T27] 2 locks held by getty/3329: [ 557.344043][ T27] #0: ffff88802449f098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 [ 557.362697][ T27] #1: ffffc9000209b2e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6af/0x1db0 [ 557.372855][ T27] 4 locks held by udevd/4093: [ 557.388527][ T27] #0: ffff888025692d58 (&p->lock){+.+.}-{3:3}, at: seq_read_iter+0xae/0xd10 [ 557.401932][ T27] #1: ffff88805c8f0888 (&of->mutex){+.+.}-{3:3}, at: kernfs_seq_start+0x50/0x3b0 [ 557.420878][ T27] #2: ffff88805cda32c0 (kn->active#32){++++}-{0:0}, at: kernfs_seq_start+0x6f/0x3b0 [ 557.435086][ T27] #3: ffff888068a1b220 (&dev->mutex){....}-{3:3}, at: uevent_show+0x17e/0x340 [ 557.448815][ T27] 1 lock held by udevd/4094: [ 557.453425][ T27] #0: ffff88801b28d118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x14d/0xa50 [ 557.472696][ T27] 2 locks held by kworker/1:6/4124: [ 557.478055][ T27] #0: ffff88805c8f8138 ((wq_completion)xfs-sync/loop1){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 [ 557.497021][ T27] #1: ffffc90004b57d20 ((work_completion)(&(&log->l_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 [ 557.512714][ T27] 6 locks held by kworker/1:11/4129: [ 557.518018][ T27] #0: ffff888142582538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 [ 557.539430][ T27] #1: ffffc90004ba7d20 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 [ 557.559641][ T27] #2: ffff88801e7f5220 (&dev->mutex){....}-{3:3}, at: hub_event+0x208/0x54c0 [ 557.572044][ T27] #3: ffff888068a1b220 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0xfa/0x8c0 [ 557.586957][ T27] #4: ffff88807467d1a8 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xc2/0x7f0 [ 557.602827][ T27] #5: ffff888023800188 (&hdw->big_lock_mutex){+.+.}-{3:3}, at: pvr2_hdw_disconnect+0x6a/0x510 [ 557.624423][ T27] 3 locks held by syz.1.3204/10839: [ 557.629658][ T27] #0: ffff88801e9cc460 (sb_writers#21){.+.+}-{0:0}, at: mnt_want_write+0x3b/0x80 [ 557.642592][ T27] #1: ffff8880674b2880 (&inode->i_sb->s_type->i_mutex_dir_key){++++}-{3:3}, at: vfs_setxattr+0x1dd/0x420 [ 557.661233][ T27] #2: ffff88801e9cc650 (sb_internal#3){.+.+}-{0:0}, at: xfs_trans_alloc_inode+0x129/0x450 [ 557.673800][ T27] 2 locks held by kworker/0:34/14267: [ 557.679189][ T27] #0: ffff888064714d38 ((wq_completion)xfs-sync/loop3){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 [ 557.700343][ T27] #1: ffffc9000b34fd20 ((work_completion)(&(&log->l_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 [ 557.719243][ T27] 3 locks held by syz.3.4693/14618: [ 557.724465][ T27] #0: ffff8880757e8460 (sb_writers#21){.+.+}-{0:0}, at: mnt_want_write+0x3b/0x80 [ 557.743245][ T27] #1: ffff888053954680 (&inode->i_sb->s_type->i_mutex_dir_key){++++}-{3:3}, at: vfs_setxattr+0x1dd/0x420 [ 557.757117][ T27] #2: ffff8880757e8650 (sb_internal#3){.+.+}-{0:0}, at: xfs_trans_alloc_inode+0x129/0x450 [ 557.776899][ T27] 1 lock held by syz.0.4814/14875: [ 557.786851][ T27] 2 locks held by syz.2.6120/17639: [ 557.799959][ T27] #0: ffff88801b28d118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_put+0xfb/0x790 [ 557.810888][ T27] #1: ffff88801b298468 (&lo->lo_mutex){+.+.}-{3:3}, at: lo_release+0x4d/0x1f0 [ 557.830767][ T27] [ 557.833123][ T27] ============================================= [ 557.833123][ T27] [ 557.887472][ T27] NMI backtrace for cpu 1 [ 557.891828][ T27] CPU: 1 PID: 27 Comm: khungtaskd Not tainted 5.15.164-syzkaller #0 [ 557.899810][ T27] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 557.909871][ T27] Call Trace: [ 557.913157][ T27] [ 557.916088][ T27] dump_stack_lvl+0x1e3/0x2d0 [ 557.920862][ T27] ? io_uring_drop_tctx_refs+0x1a0/0x1a0 [ 557.926515][ T27] ? panic+0x860/0x860 [ 557.930678][ T27] ? nmi_cpu_backtrace+0x23b/0x4a0 [ 557.935794][ T27] nmi_cpu_backtrace+0x46a/0x4a0 [ 557.940730][ T27] ? __wake_up_klogd+0xd5/0x100 [ 557.945585][ T27] ? nmi_trigger_cpumask_backtrace+0x2a0/0x2a0 [ 557.951745][ T27] ? _printk+0xd1/0x120 [ 557.955900][ T27] ? panic+0x860/0x860 [ 557.959968][ T27] ? __wake_up_klogd+0xcc/0x100 [ 557.964816][ T27] ? panic+0x860/0x860 [ 557.968898][ T27] ? __rcu_read_unlock+0x92/0x100 [ 557.973921][ T27] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 557.979988][ T27] nmi_trigger_cpumask_backtrace+0x181/0x2a0 [ 557.985975][ T27] watchdog+0xe72/0xeb0 [ 557.990143][ T27] kthread+0x3f6/0x4f0 [ 557.994210][ T27] ? hungtask_pm_notify+0x50/0x50 [ 557.999235][ T27] ? kthread_blkcg+0xd0/0xd0 [ 558.003825][ T27] ret_from_fork+0x1f/0x30 [ 558.008253][ T27] [ 558.011969][ T27] Sending NMI from CPU 1 to CPUs 0: [ 558.017591][ C0] NMI backtrace for cpu 0 [ 558.017602][ C0] CPU: 0 PID: 17613 Comm: syz.4.6107 Not tainted 5.15.164-syzkaller #0 [ 558.017620][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 558.017629][ C0] RIP: 0010:page_memcg+0x189/0x380 [ 558.017651][ C0] Code: 6d ef 1c 00 48 8b 5d 00 bd 00 02 00 00 be 00 02 00 00 48 21 de 31 ff e8 55 1f d3 ff 48 21 dd 0f 85 84 01 00 00 e8 67 1b d3 ff <49> 83 e7 fc e9 0a 01 00 00 48 85 ed 0f 85 2d 01 00 00 e8 50 1b d3 [ 558.017664][ C0] RSP: 0018:ffffc900031f7280 EFLAGS: 00000093 [ 558.017677][ C0] RAX: ffffffff81ad45f9 RBX: 00fff00000080016 RCX: ffff888020069dc0 [ 558.017689][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 558.017699][ C0] RBP: 0000000000000000 R08: ffffffff81ad45eb R09: fffff9400014e739 [ 558.017709][ C0] R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffffd400014e739 [ 558.017720][ C0] R13: 00fff00000080016 R14: ffffea0000a739c0 R15: ffff888017278000 [ 558.017731][ C0] FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 [ 558.017744][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 558.017754][ C0] CR2: 00007fb5949942d8 CR3: 0000000074881000 CR4: 00000000003506f0 [ 558.017767][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 558.017776][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 558.017786][ C0] Call Trace: [ 558.017790][ C0] [ 558.017796][ C0] ? nmi_cpu_backtrace+0x39f/0x4a0 [ 558.017814][ C0] ? read_lock_is_recursive+0x10/0x10 [ 558.017831][ C0] ? nmi_trigger_cpumask_backtrace+0x2a0/0x2a0 [ 558.017847][ C0] ? unknown_nmi_error+0xd0/0xd0 [ 558.017869][ C0] ? nmi_cpu_backtrace_handler+0x8/0x10 [ 558.017884][ C0] ? nmi_handle+0xf7/0x370 [ 558.017900][ C0] ? page_memcg+0x189/0x380 [ 558.017915][ C0] ? default_do_nmi+0x62/0x150 [ 558.017930][ C0] ? exc_nmi+0xa8/0x100 [ 558.017944][ C0] ? end_repeat_nmi+0x16/0x31 [ 558.017963][ C0] ? page_memcg+0x17b/0x380 [ 558.017977][ C0] ? page_memcg+0x189/0x380 [ 558.017993][ C0] ? page_memcg+0x189/0x380 [ 558.018007][ C0] ? page_memcg+0x189/0x380 [ 558.018023][ C0] ? page_memcg+0x189/0x380 [ 558.018038][ C0] [ 558.018043][ C0] [ 558.018049][ C0] release_pages+0x820/0x1f40 [ 558.018070][ C0] ? lru_cache_disable+0x30/0x30 [ 558.018086][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 558.018101][ C0] ? lockdep_hardirqs_on+0x94/0x130 [ 558.018121][ C0] __pagevec_release+0x80/0xf0 [ 558.018137][ C0] shmem_undo_range+0x67a/0x1b50 [ 558.018159][ C0] ? shmem_truncate_range+0xa0/0xa0 [ 558.018186][ C0] ? __lock_acquire+0x1ff0/0x1ff0 [ 558.018199][ C0] ? do_raw_spin_lock+0x14a/0x370 [ 558.018221][ C0] shmem_evict_inode+0x21b/0xa00 [ 558.018236][ C0] ? _raw_spin_unlock+0x24/0x40 [ 558.018250][ C0] ? inode_wait_for_writeback+0x21f/0x280 [ 558.018269][ C0] ? shmem_free_in_core_inode+0xb0/0xb0 [ 558.018286][ C0] ? bit_waitqueue+0x30/0x30 [ 558.018304][ C0] ? do_raw_spin_unlock+0x137/0x8b0 [ 558.018320][ C0] ? shmem_free_in_core_inode+0xb0/0xb0 [ 558.018335][ C0] evict+0x2a4/0x620 [ 558.018353][ C0] __dentry_kill+0x436/0x650 [ 558.018371][ C0] dentry_kill+0xbb/0x290 [ 558.018388][ C0] dput+0xd8/0x1a0 [ 558.018402][ C0] __fput+0x636/0x8e0 [ 558.018423][ C0] task_work_run+0x129/0x1a0 [ 558.018442][ C0] do_exit+0x6a3/0x2480 [ 558.018461][ C0] ? put_task_struct+0x80/0x80 [ 558.018482][ C0] ? get_signal+0x8ac/0x14e0 [ 558.018497][ C0] do_group_exit+0x144/0x310 [ 558.018513][ C0] ? lockdep_hardirqs_on+0x94/0x130 [ 558.018530][ C0] get_signal+0xc66/0x14e0 [ 558.018550][ C0] arch_do_signal_or_restart+0xc3/0x1890 [ 558.018573][ C0] ? force_sig_fault_to_task+0x1c0/0x1c0 [ 558.018599][ C0] ? get_sigframe_size+0x10/0x10 [ 558.018616][ C0] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 558.018637][ C0] ? exit_to_user_mode_loop+0x39/0x130 [ 558.018653][ C0] exit_to_user_mode_loop+0x97/0x130 [ 558.018668][ C0] exit_to_user_mode_prepare+0xb1/0x140 [ 558.018683][ C0] irqentry_exit_to_user_mode+0x5/0x30 [ 558.018699][ C0] exc_page_fault+0x342/0x700 [ 558.018717][ C0] asm_exc_page_fault+0x22/0x30 [ 558.018732][ C0] RIP: 0033:0x7fa5eef973d7 [ 558.018744][ C0] Code: Unable to access opcode bytes at RIP 0x7fa5eef973ad. [ 558.018751][ C0] RSP: 002b:00007fa5ed532120 EFLAGS: 00010202 [ 558.018763][ C0] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007fa5ef0d49b9 [ 558.018772][ C0] RDX: 00007fa5ed532140 RSI: 00007fa5ed532270 RDI: 000000000000000b [ 558.018781][ C0] RBP: 00007fa5ef1428d8 R08: 0000000000000000 R09: 0000000000000000 [ 558.018791][ C0] R10: 0000000020001140 R11: 0000000000000206 R12: 0000000000000000 [ 558.018800][ C0] R13: 0000000000000001 R14: 00007fa5ef270f80 R15: 00007ffdb3ac7d28 [ 558.018817][ C0] [ 558.531095][ T27] Kernel panic - not syncing: hung_task: blocked tasks [ 558.537105][T17639] XFS (loop2): Mounting V5 Filesystem [ 558.537955][ T27] CPU: 1 PID: 27 Comm: khungtaskd Not tainted 5.15.164-syzkaller #0 [ 558.537976][ T27] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 558.537986][ T27] Call Trace: [ 558.564596][ T27] [ 558.567532][ T27] dump_stack_lvl+0x1e3/0x2d0 [ 558.572217][ T27] ? io_uring_drop_tctx_refs+0x1a0/0x1a0 [ 558.577860][ T27] ? panic+0x860/0x860 [ 558.581940][ T27] panic+0x318/0x860 [ 558.585843][ T27] ? schedule_preempt_disabled+0x20/0x20 [ 558.591477][ T27] ? nmi_trigger_cpumask_backtrace+0x221/0x2a0 [ 558.597634][ T27] ? fb_is_primary_device+0xd0/0xd0 [ 558.602840][ T27] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 558.603731][T17639] XFS (loop2): Ending clean mount [ 558.608909][ T27] ? nmi_trigger_cpumask_backtrace+0x221/0x2a0 [ 558.608933][ T27] ? nmi_trigger_cpumask_backtrace+0x281/0x2a0 [ 558.608953][ T27] ? nmi_trigger_cpumask_backtrace+0x286/0x2a0 [ 558.628360][T17639] XFS (loop2): Quotacheck needed: Please wait. [ 558.632325][ T27] watchdog+0xeb0/0xeb0 [ 558.632361][ T27] kthread+0x3f6/0x4f0 [ 558.646654][ T27] ? hungtask_pm_notify+0x50/0x50 [ 558.651682][ T27] ? kthread_blkcg+0xd0/0xd0 [ 558.656274][ T27] ret_from_fork+0x1f/0x30 [ 558.660707][ T27] [ 558.663833][ T27] Kernel Offset: disabled [ 558.672458][ T27] Rebooting in 86400 seconds..