last executing test programs: 2.740793793s ago: executing program 1 (id=151): r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$IMADDTIMER(r0, 0x80044940, &(0x7f0000000240)=0xffffffffffffffff) ioctl$IMADDTIMER(r0, 0x80044940, &(0x7f0000000200)=0x14) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r1, 0xffffffffffffffff, 0x0) 2.388205085s ago: executing program 1 (id=154): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x12, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_ONE_REG(r2, 0x4048aecb, &(0x7f0000000340)=@riscv64_csr={0x8030000000300001, 0x0}) 1.964363428s ago: executing program 1 (id=158): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x8, 0x0) sendfile(r0, r1, 0x0, 0x2) 1.827674042s ago: executing program 1 (id=159): syz_mount_image$vfat(&(0x7f00000005c0), &(0x7f00000000c0)='./file0\x00', 0x10840, &(0x7f0000000700)=ANY=[@ANYBLOB='iocharset=utf8,shortname=winnt,shortname=win95\x00\x00ni_xlate=0,showexec,shortname=winnt,shortname=win95,nonumtairodir,nonumtail=0,shortname=mixed,nfs=nostale_ro,utf8=0,\x00', @ANYRES32, @ANYRES64, @ANYRESOCT, @ANYRESHEX], 0x1, 0x26c, &(0x7f0000000340)="$eJzs3U9rU1kYB+A3bTpJC0OyGCgzDMwdZjOr0HaYfcrQgWECipKFriw2RWlqoYWCLtruit9Bv4Iu3QouxK1fQASpghvrqgshEm//JDWJjZpG7PNs+nLu++Ock17upYueXPl1eWlhZW1xd3cn8vlMZMtRjr1MFGMkRiO1FQDA92Sv0Yg3jdSw1wIAnA7vfwA4e3q9/zNbh2PnT39lAMCgfNHf/yMDWRIAMGAXL13+f7ZSmbuQJPmI5e316no1/Zlen12M61GPWkxFId5FNA6l9b//VeamkqaXxcgvb46k+c316mh7fjoKUeycn05SUW3mDvJjMbGffzYRtZiJQvzUOT/TMf9D/PlHy/ylKMTTq7ES9ViIZjbN5yJiYzpJ/jlXOZbPfegDAAAAAAAAAAAAAAAAAAAAAIBBKCWHiu3n36Tn95RK3a6n+dbzgcZ7nQ/U2Dx2vk42fskOd+8AAAAAAAAAAAAAAAAAAADwrVi7eWtpvl6vrfYqbjy592gnlwY+2dy7yOzP219qu2fP+Ml2caz48fcXdzpdykWu38/n84qxiGgdSfanfPjbACf9WsXjnWs//7U2+Xe3nsi2jtxubrWtp8uNlB3UB/66ENG1J9/3Ddla3D8oym8/6jm4lWqr48P+xU3eLc8/2Hj+6qSpHg+NxuggHkUAAAAAAAAAAAAAAAAAAHDmHf3T77BXAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADDc/T9//0WuWgbyXdt3hr2HgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4H0AAAD//7qXlSU=") openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip6_tables_names\x00') syz_open_dev$evdev(&(0x7f0000000100), 0x2, 0x862b01) syz_usb_connect(0x0, 0x5a, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000ec13b2106d04f308280b0102030109024800010000000009046900000e0100002b4101", @ANYRESHEX, @ANYRES64=r0], 0x0) 1.721862476s ago: executing program 2 (id=160): syz_mount_image$squashfs(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x804cd8, &(0x7f00000000c0)=ANY=[@ANYRES8=0x0, @ANYRES32=0x0], 0x3, 0x232, &(0x7f0000000500)="$eJzslb9uE0EQxn97t/HFYKTUVJGwSBqI7UiIMl1egAfAco5g5cwfnyWwZcmGJg00vEQkaioqCiToKRAC0SQFSDRBVEHI6G5nz3dgOzYK3X2SPd/OfjO7e7uzezu8H3rAr+N+gxViKEp8VAoNrCnjOykY+13sSPBFm3ZV/M/FHokNu713Twzt7dWDwG+H3WnEIyZKwVSNJTIs1ta3X6ZEesJgVnlq6rePsx7FRLEDzF7PWRIHZVc67uq4xvV31CDj8eh9GmuKhpjYItMH9WZ/sQvZrv6LOZdTlLR/djljjYOQ1XnOTWalhvwoZT5U8HVilNob/OumLPG/9x1iEm3uzxIztsmQD88mf9WYuBJelPMT7exi81HMJ36a9XQNkctgoa08mniwx4fE4/Q8oa2acPuRraD3x/1GxG4CWzKvHfOTcjKaqPFabrrId1HDEJTLSFmNhq2osQZsdFr3NsJu70qzVd/1d/07tdrmtcqb81KiowE0A7+ylBoiKeohCc6l+iPtZ510pVTEkXZqEqcKmLlpJQKJXb9krGsqHicVm85h8r5KlmcvAJcWN7jMMvBgqFahJtnKRNnccbCL5lYz8Ks6NU84wWE57rjauBvs7KNQoqwcoHFs2CFLSaOGaUTp/c3ryfL3xZbj/+Vk6gdiD8Xat8u+STrO8E1a60Mo8LDe6bTt40W7mvhqBY2wlWRkR0a1r6G9k8se80MtoM2RI0eOHDly5Dhz/A4AAP//Z98fTg==") munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r0 = open(&(0x7f0000000140)='.\x00', 0x0, 0x112) getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) 1.536486652s ago: executing program 3 (id=161): unshare(0x28000600) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x6, &(0x7f0000000000)=0x9, 0x8, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x3}}, 0x12) 1.462584034s ago: executing program 0 (id=162): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_SUPPORTED_HV_CPUID_cpu(r2, 0xc008aec1, 0x0) ioctl$KVM_GET_LAPIC(r2, 0x8400ae8e, 0x0) 1.407900126s ago: executing program 2 (id=163): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000300)={@val={0x0, 0x8863}, @val={0x0, 0x0, 0x3, 0x0, 0x1}, @mpls={[], @ipv4=@gre={{0x6, 0x4, 0x0, 0x0, 0xfc0, 0x0, 0x11, 0x0, 0x21, 0x0, @broadcast, @broadcast, {[@lsrr={0x83, 0x3, 0xb8}]}}, {{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, [], "50726483718ba3e6d08f7571cc59e627d3ed353e879da15784c220746fc2eba11f56fe932b544f53b43a34b265bd5d44fd387d1b56b3b8767c382bc52ee2b8fcbbd661f151afd5315d5f502920c297a3916d7ea039eb558ebb06336662367e15363058de9b806035d5c980832248d1fc96c6b2fb2a4dffa91026dd0228974f70bea2a8e3150d9aae345d6e19f2"}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [], "ac10ef31176d1af88e863d588661a0756365388ef6f2d7b69fb82dc9e7de475e5aad52fa5b61fb1730a4f8ba342b81d86460c5cc35df8bdc3e55e1e92140c9ed10cfd396d4fb331e1901da8dfd47cd7431fd6cb967f7d84f0ba6de4a73b26c286edc3684534e70f60b30b7aefec9309c13a29b35e134d47c3579870d43bcc2babd71412ade39c68b036b5e7a6e90c25efe7a5b3ff3fae0fe7459e71cb431cb8f6a45a9a21d938cbd1de67fde856f05154095c3d86b9f4bac02987d8a06aae5f8d3da56748f1f6b1e9de4d1afaea08c70a943b080bf77494e5dcc17fe38bb0a0b36a008f7805cfdbe5a89e2e12e013b6ff42e3f9e825f3d604768f87273edad56c12c8a5eacd9b63ea6fa1ecf16139cb19c579c4f0a125a755439e6dc9c1637c0d23c1c281af2982cca306b2d3dbaede299bfe4f2ebd822abfabafef3f159049cc24f01a412fafe3d43841a6a4dbed78566e34544a074d4c01cedbb22527e955e8f93ef5a927fdec293a3c78693cae45de7481fdf0f65a43b50d26904594676b7af375752c99e2ba3e00286ab9d438af7b8834c0e71d245c0428ecc5a59f29ab0bca9b1913b9bb5373a94e1daae374d0ed7e7ffd0a1188c83e61e8ee28625483a96a246b9e1cdc8da085de61834a15afd5e7726d711c5ecc008914b9b9f35603330113e548e4509516bac6bc1150b2ace667a540ec84d22c0d0200056918fa3ac596cddd501f7b34f3b97c12c3c10e4b0c67ef01059c2feed93f9169498278daabd27d8537882a87b2edd4b2e6789b90d065ba7a064b2b4ecc1622c8662b3145844c12491ee85dd2acbe057479db9d24e500d9f1af37745f39e7fc7d4e513fa839556155db1ba6d62465a464184f2f4f9c4c822e64c6a357d7bc06caf64db283f0a3a427b400b7dd4df488c9e30db1fdb1774038d32557b69f9c1eba7ec66309bc68c19200aa5f05ec21c1cc9a12667cbae2863198913eac1de18df558c1b5fbceb0e6b521e120e98b39ecc8cabb6c25cdc31d827eeb549fe548f6b29d4f65b176ea0a20411d750f02c660cba2c62935fad8c51324f6f437daa53c81ff2e19b94140f1d72a2540b3fa74ffe85c696a4e4411d4449744ca4b5e8b921c7d62208b88a1df38030c4e09cd264a9c534259737ed6ea798cbc2d0054845dc84e97295efad0f5228fc61710e75a4445a889e230887845fa7f02be62593c352cb344a0f947bdb6c4cf3aab5ecedbd4fdde781c496db32a51f700b2fc19b2c36e257bbb2c735e0f03cd9e49700aee6edaa6952bdc2feef2d2e5463b6778fde3c7ef73477e22a181816883192beee132b3866c4ec977e0cd0b995de650c4c7d3e6e483685f75f9d82f69868d67e64a59e7320707847040bed7bb8c24d5e6a1da326d3226e71933484a2c619592a00db3b086d5fee139abaae14d65698937ef8c066acc7134f085e1e8ccd04a67e128c2d775740f0727c14dfbf8a2ed7f25d353285ab0fd03a8788d725163d27ac13ced25669301f672fb1f404451d85e92e1d0049fa9558c8492cc336ddd5133cb1b307f2901341fb6a021e1b751f22412e76fad6ea2b4a7d756559619fa47b22bc55ef8fdc19fbd6136becc60ff19748e60452e704752c82beb4861ea118875e9fe75a9e6c10c8b922dd8054ef8dd15963db6d505e7eab028322801bb4328d8257e726d937ca83c8efca320c8ecd24313eb5e8114c604781ed936a82740340ac6692bfc3613d2f49bf8284cf60cee6513fd154034e49af838146872e8735962da7f7bbd301f2fd85e597c1b6f8418352ebec83286f9dfab4a0b4dbb8b9c7b55aaf9ac1628d1493c1786c78a8a0b8c58596f1e1ba92b7fcdb80e867fdd299c78b902ac2de3c6d6bad6c5fb0c5db603b7c3c7ff8a64dc4488e07d2b506db960db1503ad72dab8ef405549a5f12a62052be8f7ad3fad32ba8560a8874c06f815ec9912dfcc16d8e0f8c9ab9afceae435a63dcdd1dc6b1e4d186f306ec1c8af08e69ad8fc9860c9bad1af0654c51e0711ecfa47c6b4411010076c975057db6609b47fda736f6ef81863387e3c971479a572145aab35a24475ffea35c1626b644ba12ef8d92cf9310f722b493b2da8ea4c5dcd99d75167e1404642aafbf5db3f8ce95382d7bbd550c0bae73af75dc913ead260ce475b30879d4279efeae49e88b0071661725e9ec5b3579c1716d70971fd301d8ee090a98120bf35ffa62101077362a2a3564022b0bff01e76e641fc01ff731a834509600aadeffe2f00276de348a3c57778865063bd8e348b6e68b5c74298ba911a184f5bfdefd6473272c174c9e644abdf22b3ac39e246ae947ffef4773bcfec3b2a8d03dc8971471dfc50cd5ef6d32ae3486f7d14b0137e80a313910d9bc87aed8c41c6563f646b39c2a26f4add083ab6efb5753fc6b78e7907b9cd8a2cabdf87e202239fffc99e0446915c3bc147635398f73201d7369902225184d8da01641759645bf92b5d73ab153f2150264c3333ce12747ce2642aa04aeeb85513170a67dd93b010e8fd0f3cb290e1fc0040d32bdad7d8b41c4f2d10a3c170dbc3e264e29714a34dd220c2bf3e273d7cb3a9397b16a47c85cca75e4cac2def7c976fb7f38b24bdb8f80486e9cec55574d9f2864085289fd2fc497a3a7fab762877629db9ff70201f07897246f9f5211ced9266b732e9988805669dc1bc8e4ddd235562c7785e2379f1f0dd1e71a98b6d204e6c1a1ee163ceb35f6c436bb2547522bed2a55814a3f5f53d3eceee6c847c12af75fdc8452116ab891a5c6424a79b33c4b56a5412700a907f3eca800fcfba133f8bab9ebae32c699b548aff3ac702699f293fceb7445a7107956adad16a6b73a2fe0c88232f2d9831b238b92c511e4a6e02f784ee328bd979c4728ba0f86cc4ed9a69c6d5bc23496729a6512c4664006afc08de2f4dd89e52108f7c081d11facccb91ebc82415691b6bf05818638b3a4d809ae307f4b2d867a34417dbaad8c01a3773d8ebe56890230bd4a2e2a027d59839e1710cb5d25cec245ed8f86b7d4ed8e4ec48c53387ab1ea059406bf2612a6c730750b41a47bdf51cbec2c3f1b07fd6aba2ea390e138868d71f0a73990e87b383757a199f53bcd25f93b15efaf84a9a3758f5cbc2223a809ba784a5af2d36a3b99e3d143310ecf2bb9d2dd8fe9defdfa3d82e005c52514f13beb97476fb7a0f7ab62892977c9da0b950dbbc89bdd58472619f3bdbf46def88488e7bdf0633ee908a4e4e795e92037b74db18672e168514e2ad0a2df94357f2dc2c593b251894657c6bea65abfcd76b7037bd5817ab73be94f00031150f375442e0f0d0e7236ed4150637c14f62ecb6713f897889d77d814ead5774d726f307fe32c020cdefda72151798fcde65af6fbe6594eeb078a8c414b949c0c2217a0cc82049c43f6fb3cb7c00fc0305b86dddde708dd8a61a63e799abdd49d6ff1c41b8ecb230891037ca36d7a7e1f6280f52a5d45ff872f11df408ae09fc9b9d371ccf4f2777626ad84426d925dac9bbacc785acb5c29cbf9d6aec77d5ac48778ab4682b7bb611f342a72c26417a5e432e5d956844e19739e61999a78c615acc09f415032031ac6cb839da764331d131acbe66b502e7f1a5b9dc68df7f5524e7bc6fdfa982b39af2cbff69052d04be78821282dbfc034e64943004375f16cf4741526aaafebfc1a6d4a38d4c345aa22c94922f145b6c449a216b6c382565598125156fad8097c2e7ea65063cdfe34e50fb75939f3b3cf5ab8a3448ead3cc36358f45b0eaabf8ff2b64a1923407226f24420978d03d6bcefc2b45a74425017c11146e25f6d41912f39afecaa19090123ea2605994978b00a347aba322cd10822933e3f5988477ce1b2aff651553ec4977b185e5c7aaa4c64b4fb49cfc0cad75e85c0617e19f26fd0932a4bba0821d5a4d9449773c2d3c25e8aee59155346502b72a4d6818f143695acd5b83a336d02e2d1b9da5740e287c4694012f9648656c51cd44431c54301ea55f48197d1280421793598db89820937aa6a41d69618f55fd9c40dc0742e77d4ddf4a68a6cecba47ff0a22e2734bc9556193642b92838c891b4ed109af35190332aabb9aab184076cfc99f08814bebe47fccd12005ad926a643c791ecda50458a1106a033408fb90da10f8d6e42b3a462e9f9a1a2752c21967884ea79a1148f3dd0304bef05747458c7859dbf7f6df08074e9ac221677b70546909329c5557adb255cc33c1f9b762188e2498a7744f066df3fb8bee6261db37489b63f9bda047a06cbc588ff1255e3b63a86a5ca353160e0dc4088ea691c768f5d36397cb64c6db2d5bd39473a9d1209d021b8017434874ed5f99d9fc27d5549eaecdcfb7093549acaea45610221192942e108def0efbc004bbfef195af7dcdc0b75097eba13d621c2ca5ee3bfd2845b21a910e8ea21536768e1e5081997ae7415a55e58e1294d8ff3bc95faf96a65501b922382f4f75a0f938b290fd66bb3ccdc33734bafa18a3765d23f151951b8c8c6939de018c4e9ca253dff4a1fc70a601bba8c2e146a79166745e5fd1748c638a7a945e5f5aea0a93c7861446ef5996e37231e573245dae58b168c0564c8b27ada3fde66bb00f51f7e47970855d1057739ccf583666055187173bfd1454a5fbcfd59f39b6ad63fbfbe0fea9a6b336a41ec316acedd38cc6fab7de1190c97bed6e8f1cdb47d59941955f87a59d953c0f60f68a63fcf8f6f76b3eb5d79d94a2eeb3fb28781b1bbd31937c6f6e2d6fa7d2f4134702fdc0a2250bbec420c73a89c1643379235a492c2cbb3280ec3e676fcc1b33aaa645234eebefb1c28c52646a33c1989a386d537cd5ebf89f50b575b37b9a337f653919a569229009"}, {0x8, 0x88be, 0x0, {{0x0, 0x1, 0x5}}}, {}, {0x8, 0x6558, 0x0, "20e62929c11cb0549208c925145acbdc02d1fec745f9b654f2d97c9269199fc2293765cfbba8e22fa0ba230c891eb5a9490864bc2e2993a2831d52a0f75fda3f213ec297d9acaa7a8aedc6826e3274b7f48681313b4b677b469a77dd667c84aaf2766d84d9f6dd1b6aa2ab1860b1394813e57c4c6d557a4d049d74cdc674b82da3e6c6f0b9a890edc47dd5a6801c24ba1da62ac03a3620d1f109122a34cd8f552730c4239a81f09bc9174d89403e8011a5436bc7abbd69d49f68a786837a51689f7a4b422061f4768c9052c000016fffffe700e53f083b13e53ef485d121779c5da2b6ce80f9cc4a030570a1cc071d9a6845b6018baaa77418d5fb030700f7b63620c369c466108465b7c7967c0c84a9b828118c9ba7808abfe69f783c3795ecbe1714d91d56b64b9e8e7f86d3fff9c8084b5ec69fcf586b23c29dc078db3fda0fe8cfaed8ab7a5a39bc2ec6a1410270ea7d41ecbd90e45fc60062bc"}}}}}, 0xfce) 1.341823168s ago: executing program 3 (id=164): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0xb, 0x0, 0x0, 0x0, 0x1c, {[@window={0xa, 0x3}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0x4e) 1.250256851s ago: executing program 2 (id=165): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0x1400c, &(0x7f0000000840)={[{@stripe={'stripe', 0x3d, 0x3d}}, {@init_itable}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x3, 0x457, &(0x7f0000000bc0)="$eJzs281vFOUfAPDvTLvl11/BVsQ38KWKRuJLSwGVgwc1mnjAxEQPevDQtAtBFjC0JkJIBGPwZIyJd+PRf8GTXozxZOJV74aEGC6CpzWzO9PuLrtLt+x2kf18koHnmZc+3+/OPLvPzLMbwMiazf5JIrZHxO8RMV2vNu8wW//v2tXzS9evnl9Kolp9+6+ktt/fV88vFbsWx03llX1pRPpZEnvatLty9tyJxUqlfCavz6+e/HB+5ey5546fXDxWPlY+deDw4UMHF1584cDzfclzKtK89MZ7X7155Ium/Fvy6JPZbhufrFb73Nxw7WgoJ+NDDISejEVEdrpKtf4/HWOxfvKm4/VPhxocMFDVarU61XnzhSpwB0uiua7Lw6goPuiz+99iaR0EvDy44cfQXXmlfgOU5X0tX+pbxteeGJRa7m/7aTYi3r3wzzfZEoN5DgEA0OSHbPzzbDbaaR3/pXFfw3535XNDMxFxd0TsjIh74lTsioh7I2r73h8RD/TYfuskyY3jn/TyphLboGz891I+t9U8/itGfzEzltd21PIvJUePV8r766/J+/kwurzQpY0fX/vty07bGsd/2ZK1X4wF8zguj29rPmZ5cXXxVnJudOVixO7xdvknazMBSUQ8GBG7N9nG8ae/e6jTtpvn30Uf5pmq30Y8VT//F6Il/0LSfX5y/n9RKe+fL66KG/3y66W3OrV/S/n3QXb+/9/2+l/LfyZpnK9d6b2NS3983vGeZrPX/0TyTq08ka/7eHF19cxCxERypB504/oD68cW9WL/LP99e9v3/52x/krsiYjsIn44Ih6JiEfz2B+LiMcjYm+X/H9+9YkPWtdNbjj/wcryX+7p/K8XJqJ1TfvC2Imfvm9qdGa9mOd/vfv5P1Qr7cvXbOT9byNxbe5qBgAAgP+eNCK2R5LOrZXTdG6u/h3+XRFp5fTK6jNHT390arn+G4GZKKXFk67phuehC/ltfb1+MSLqXy0oth/Mnxt/PTZZq88tna4sDzt5GHFTHfp/VvlzbNjRAQPn91owunrq/8ng4gC2ns9/GF299f9tA4sD2Gqldv1/chiRAFuv3ef/J0OIA9h6Lf3ftB+MEM//YHTp/zC69H8YSSuTcfMfyXctFH9pk4ffsYUo3RZhDKwQ6W0RhsKACsN9XwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOiXfwMAAP//EBbjLA==") truncate(&(0x7f0000000940)='./file1\x00', 0x8da6) r0 = open(&(0x7f00000000c0)='./file1\x00', 0x66842, 0x21) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x8, 0xffff7fff, 0xc, 0x9, 0x101}) pwritev2(r0, &(0x7f0000000280)=[{&(0x7f00000001c0)="afdc", 0x2}], 0x1, 0x2000, 0x8, 0x3) 1.183782643s ago: executing program 0 (id=166): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r1, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_RW(r0, 0x3ba0, &(0x7f0000001200)={0x48, 0x8, r2, 0x0, 0xffff, 0x1, &(0x7f0000000480)='|', 0x1}) 1.092635916s ago: executing program 3 (id=167): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r0, &(0x7f00000006c0)=[{&(0x7f0000000080)="2e9b5b0007e03dd65193dfb6c575963f86dd6067", 0x14}, {&(0x7f00000001c0)="b700001811005abeef4ba0d598", 0xd}, {&(0x7f0000000200)="37a8a6c41ef711513a5555633f6e4259616da007f3c18c191f6ffa14306d06c4fd", 0x21}], 0x3) 1.020035158s ago: executing program 0 (id=168): unshare(0xa020480) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b70000008100003bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071104200000000001d400500000000004704000001ed00000f030000000000002c440000000000006b0a00fe000000007303000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646c0200000000000000020000e35208b0bb0d2cd829e654400e2438ec649dc76128610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda82fc9c4d7ecc7a803bf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714f62ba7a54f0c33d39000d0bfed3a6a59ff616236fd8f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a107464ffffff7f00000000617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce963b0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06fa2e04cfe0649226c697d9e8eaade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00023ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88f15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40fc5d2f55ff07c53147de202ce517b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661061173f359e9052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff26b61aac8aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e26534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c3f000000315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336dfaa6d5d164301190bc2d4c04087729033342045804a28082abc3b47623028271722fb515f31e0dd115a292f1e68481a62cd15ea5460a29c60b1058fb7aa9bf4ee3cbe11b03711a15d730646b72d074dab1e8c429339f3460d324c17a4a8bfc7d7eab45bef00664d6dc82300000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000000180)=r1) 839.452534ms ago: executing program 2 (id=169): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x208810, &(0x7f0000000100), 0xff, 0x4c4, &(0x7f00000001c0)="$eJzs3MtrXFUYAPDvTh59N7HWamtro1UsPpImrdqFCxUFQQVBFxXcxCSttWkrTQRbgqYidSkF9+JS8C9w50bUhQhuFVxKoWgQmnY1cl9tMp1MHk0yaeb3g8mcc5/nu+eemTP35N4AWlZP+ieJ2BoRf0REV56dvUBP/jY9NTF0fWpiKIlq9a1/kmy5a1MTQ+Wi5XpbiszBSkTl8yReSGp2uiFi7PyFU4OjoyPnikl946c/7Bs7f+Hpk6cHT4ycGDkzcPTokcP9zz078MyyxJnGdW3PJ2f37n71nctvDB27/N7P36XF2rUvnz8zjnldrw2ovp70qP1bzdTOe2wRZb8bbJuRTtqbWBAWpS0i0urqyNp/V7TFrcrrilc+a2rhgBWVfjdtmHv2ZBVYx5KoO/m1VS8IsMrKL/r092/5WqWux5pw9cWIziI9PTUxNH0z/vaoFNM7VnD/PRFxbPLG1+krFnsdAgBgCbK+zVP1+n+V2JW952Md24sxlO6IuCcidkTEvRGxMyLui8iWvT8644F85WrXAvffU5O/vf9TuVK3zMsk7f89P6PvNz0j/uKtu63Ibcvi70iOnxwdOVQck4PRsSHN9zfYxw8v//7lXPNm9v/SV7r/si9YFOBKe80FuuHB8cHlOghXL0bsaa8Xf3JzJCA9A3ZHxJ7FbXp7mTj5xLd751po/vgbWIZxpuo3EY/n9T8ZNfGXksbjk30bY3TkUF95Vtzul98uvVkkO2vn3VH8yyCt/82zz/9izsXiveu/NP6x8xc6YnR05NxYOm3zovZx6c8v5vxNs9TzvzN5Oxuz/vX9fNrHg+Pj5/ojOpPXs3x5oLPpA7fWLfPl8mn8Bw/Ub/87inXS+B+MiPQk3hcRD0XE/qLsD0fEIxFxoEH8P7306AcN4k8iiabW/3Ddz78kYmOW6C7qPx+vX0Ki7dSP3881Yr6w+j8Sk9lnbS77/JtH43K1Rznlzo8gAAAArH2ViNgaSaU3T/dsjUqltzf/H/6dcaNarY6NP3n87EdnhvN7BLqjo1Je6eqacT20P5kstpjnB4prxeX8w8V146/aNmX53qGzo8NNjh1a3ZbZ7T/K9p/6u63ZpQNWnPu1oHXVtv9Kk8oBrL6FfP/7LQDrU532v6kZ5QBWn9//0Lrqtf9Pa/L6/7A+3d7+/6rzyDpgPdL/h9al/UPr0v6hJS30Lv7yeQpLfgjArER5s8DSt7Nxnjv813KiZ0W2XNbQsm55/3S+0WLKprg1KyoNVq8sal+TC1743c5Z5Zl9iq6Jyl2hRNpilrJ6bJ/vWRhzJeo8rAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOAu9H8AAAD//0N93Y4=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fstat(r0, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r1, r1) link(&(0x7f0000000140)='.\x00', &(0x7f0000000180)='./file0\x00') 707.306418ms ago: executing program 0 (id=170): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000940)={{0x0, 0x2001, 0x257f, 0x5}, 'syz0\x00', 0x38}) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x12) ioctl$UI_DEV_CREATE(r0, 0x5501) write$input_event(r0, &(0x7f0000000340)={{0x77359400}, 0x12, 0x40, 0x7}, 0x18) 706.778628ms ago: executing program 3 (id=171): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS(r1, 0x4068aea3, &(0x7f0000000080)={0x74, 0x0, 0x18}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000440)={0x2, 0x0, [{0x1, 0x4, 0x0, 0xfffffff1, 0x1, 0x5, 0x9}, {0xa, 0x5, 0x0, 0x9, 0x721, 0x1, 0x6}]}) 463.999926ms ago: executing program 0 (id=172): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}, {@verity_on}], [], 0x2c}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file1\x00', 0x40, 0x83) fadvise64(r0, 0x4, 0x4000000000080010, 0x1) 463.307256ms ago: executing program 3 (id=173): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000001240)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0xb29, 0x14}, @ipv4=@udp={{0x6, 0x4, 0x3, 0x1b, 0x65, 0x66, 0x0, 0x1, 0x11, 0x0, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x3a}, {[@timestamp={0x44, 0x4, 0x1e, 0x0, 0x6}]}}, {0x4e20, 0x4e21, 0x4d, 0x0, @wg=@data={0x4, 0x202, 0x1ff, "e8771ac366586e56f446dcd22ec94c672f1cd650516a2fbeddd0cb5cffc4ef63a1c2be9551171e48bb8559ac9077c099289048d76d"}}}}, 0x73) 408.348558ms ago: executing program 2 (id=174): r0 = fsopen(&(0x7f0000000040)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x3) fchdir(r1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000700)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) 232.778743ms ago: executing program 1 (id=175): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f00000002c0)={0x3f}) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f0000001740)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x200000, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdf51, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x9], [0x0, 0x0, 0x4, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xffffffff, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x2, 0x0, 0xfaea, 0x0, 0x0, 0x0, 0x6, 0xfffffea3], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x45c) 231.976963ms ago: executing program 0 (id=176): r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0xfffffffffffffff0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007d, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000d, 0x4008031, 0xffffffffffffffff, 0x0) r2 = dup3(r0, r1, 0x0) read$FUSE(r2, &(0x7f0000004f40)={0x2020}, 0x2020) 157.178126ms ago: executing program 3 (id=177): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) io_setup(0x9, 0x0) syz_open_dev$hidraw(&(0x7f0000000080), 0x7fff, 0x400) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, 0x0, 0x4000) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x34, 0x0, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000040)={0xf0f003, 0x1}) socket(0x10, 0x2, 0x0) futex(0x0, 0x6, 0x0, 0x0, 0x0, 0x0) ioctl$F2FS_IOC_RESIZE_FS(0xffffffffffffffff, 0x4008f510, 0x0) futex(0x0, 0x87, 0x0, 0x0, 0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x2, 0x2800) r4 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000340)={'vcan0\x00'}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000005840)={0x0, 0x0, 0x0}, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGKBMODE(r6, 0x4bfa, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e02100418"], 0x7) 81.672188ms ago: executing program 1 (id=178): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000004c0)={0x2, 0x0, [{0x3000, 0x1000, &(0x7f0000000bc0)=""/4096}, {0x58000, 0x38, &(0x7f0000000080)=""/56}]}) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f00000001c0)=0x304008000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f00000003c0)={0x1}) 0s ago: executing program 2 (id=179): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) ppoll(&(0x7f00000000c0)=[{r0, 0x60}], 0x1, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): no interfaces have a carrier [ 47.207692][ T5433] 8021q: adding VLAN 0 to HW filter on device bond0 [ 47.223676][ T5433] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: OK Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.82' (ED25519) to the list of known hosts. syzkaller login: [ 66.941643][ T5755] cgroup: Unknown subsys name 'net' [ 67.078162][ T5755] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 68.443415][ T5755] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 70.451898][ T5770] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 70.460834][ T5085] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 70.469029][ T5085] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 70.477173][ T5085] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 70.485063][ T5085] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 70.492771][ T5085] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 70.505902][ T5776] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 70.516277][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 70.532120][ T5778] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 70.533713][ T5782] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 70.548343][ T51] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 70.557033][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 70.564286][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 70.572565][ T5782] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 70.580255][ T5782] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 70.588108][ T5782] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 70.595802][ T5782] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 70.603661][ T5782] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 70.611013][ T5782] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 70.622558][ T5770] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 70.630344][ T5770] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 70.642041][ T5770] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 70.663454][ T5783] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 70.672834][ T5783] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 70.953208][ T5768] chnl_net:caif_netlink_parms(): no params data found [ 71.010266][ T5767] chnl_net:caif_netlink_parms(): no params data found [ 71.101989][ T5768] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.109672][ T5768] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.117100][ T5768] bridge_slave_0: entered allmulticast mode [ 71.123820][ T5768] bridge_slave_0: entered promiscuous mode [ 71.132746][ T5768] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.139885][ T5768] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.147440][ T5768] bridge_slave_1: entered allmulticast mode [ 71.154734][ T5768] bridge_slave_1: entered promiscuous mode [ 71.209651][ T5768] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.235414][ T5768] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.293023][ T5768] team0: Port device team_slave_0 added [ 71.299146][ T5767] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.306636][ T5767] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.314371][ T5767] bridge_slave_0: entered allmulticast mode [ 71.321018][ T5767] bridge_slave_0: entered promiscuous mode [ 71.329887][ T5768] team0: Port device team_slave_1 added [ 71.349723][ T5772] chnl_net:caif_netlink_parms(): no params data found [ 71.360739][ T5767] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.367977][ T5767] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.375411][ T5767] bridge_slave_1: entered allmulticast mode [ 71.382436][ T5767] bridge_slave_1: entered promiscuous mode [ 71.388941][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 71.450488][ T5768] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.457651][ T5768] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.483980][ T5768] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.497527][ T5768] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.498089][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.504558][ T5768] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.521780][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.536811][ T5768] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.564970][ T5767] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.578061][ T5767] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.659217][ T5767] team0: Port device team_slave_0 added [ 71.681071][ T5768] hsr_slave_0: entered promiscuous mode [ 71.687379][ T5768] hsr_slave_1: entered promiscuous mode [ 71.696904][ T5767] team0: Port device team_slave_1 added [ 71.728851][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.736096][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.743611][ T5774] bridge_slave_0: entered allmulticast mode [ 71.750244][ T5774] bridge_slave_0: entered promiscuous mode [ 71.777189][ T5767] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.784291][ T5767] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.810429][ T5767] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.821615][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.831428][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.838825][ T5774] bridge_slave_1: entered allmulticast mode [ 71.847783][ T5774] bridge_slave_1: entered promiscuous mode [ 71.854820][ T5772] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.864351][ T5772] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.871469][ T5772] bridge_slave_0: entered allmulticast mode [ 71.878357][ T5772] bridge_slave_0: entered promiscuous mode [ 71.888272][ T5772] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.895719][ T5772] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.903001][ T5772] bridge_slave_1: entered allmulticast mode [ 71.909686][ T5772] bridge_slave_1: entered promiscuous mode [ 71.916890][ T5767] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.924085][ T5767] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.950269][ T5767] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.007092][ T5772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.020515][ T5772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.045517][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.087984][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.114928][ T5772] team0: Port device team_slave_0 added [ 72.123282][ T5772] team0: Port device team_slave_1 added [ 72.175577][ T5774] team0: Port device team_slave_0 added [ 72.189858][ T5774] team0: Port device team_slave_1 added [ 72.201212][ T5767] hsr_slave_0: entered promiscuous mode [ 72.207448][ T5767] hsr_slave_1: entered promiscuous mode [ 72.214093][ T5767] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 72.221966][ T5767] Cannot create hsr debugfs directory [ 72.228074][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.236010][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.262017][ T5772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.274824][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.281898][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.307973][ T5772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.367506][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.374806][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.401046][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.436857][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.443952][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.470046][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.556448][ T5772] hsr_slave_0: entered promiscuous mode [ 72.563086][ T5772] hsr_slave_1: entered promiscuous mode [ 72.569076][ T5772] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 72.577267][ T5772] Cannot create hsr debugfs directory [ 72.583002][ T5783] Bluetooth: hci0: command tx timeout [ 72.599223][ T5774] hsr_slave_0: entered promiscuous mode [ 72.606172][ T5774] hsr_slave_1: entered promiscuous mode [ 72.614485][ T5774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 72.622185][ T5774] Cannot create hsr debugfs directory [ 72.742048][ T5085] Bluetooth: hci3: command tx timeout [ 72.747699][ T5085] Bluetooth: hci1: command tx timeout [ 72.753641][ T5783] Bluetooth: hci2: command tx timeout [ 72.836530][ T5768] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 72.850002][ T5768] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 72.884598][ T5768] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 72.895301][ T5768] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 72.997520][ T5767] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 73.008465][ T5767] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 73.026571][ T5767] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 73.037938][ T5767] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 73.107555][ T5772] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 73.122742][ T5772] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 73.136698][ T5772] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 73.158245][ T5772] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 73.221296][ T5774] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 73.240263][ T5774] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 73.258345][ T5774] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 73.268998][ T5774] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 73.353900][ T5768] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.425227][ T5768] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.439926][ T5767] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.456710][ T78] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.464124][ T78] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.494928][ T5772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.511207][ T78] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.518333][ T78] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.555042][ T5767] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.570856][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.585750][ T5772] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.606769][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.613893][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.625399][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.646643][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.653866][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.663871][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.670961][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.680711][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.687823][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.712593][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.719742][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.733217][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.740324][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.807595][ T5768] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 74.237087][ T5768] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.305378][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.335165][ T5767] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.355216][ T5772] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.417367][ T5768] veth0_vlan: entered promiscuous mode [ 74.451279][ T5768] veth1_vlan: entered promiscuous mode [ 74.467172][ T5774] veth0_vlan: entered promiscuous mode [ 74.479413][ T5772] veth0_vlan: entered promiscuous mode [ 74.500737][ T5774] veth1_vlan: entered promiscuous mode [ 74.518097][ T5772] veth1_vlan: entered promiscuous mode [ 74.526978][ T5767] veth0_vlan: entered promiscuous mode [ 74.548147][ T5767] veth1_vlan: entered promiscuous mode [ 74.612459][ T5768] veth0_macvtap: entered promiscuous mode [ 74.625469][ T5767] veth0_macvtap: entered promiscuous mode [ 74.638951][ T5768] veth1_macvtap: entered promiscuous mode [ 74.650491][ T5774] veth0_macvtap: entered promiscuous mode [ 74.664946][ T5085] Bluetooth: hci0: command tx timeout [ 74.674382][ T5768] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.685109][ T5767] veth1_macvtap: entered promiscuous mode [ 74.693728][ T5772] veth0_macvtap: entered promiscuous mode [ 74.709341][ T5768] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.721504][ T5772] veth1_macvtap: entered promiscuous mode [ 74.731184][ T5774] veth1_macvtap: entered promiscuous mode [ 74.740585][ T5768] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.752045][ T5768] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.760773][ T5768] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.769601][ T5768] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.802173][ T5767] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.813048][ T5767] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.822151][ T5085] Bluetooth: hci1: command tx timeout [ 74.828239][ T5085] Bluetooth: hci2: command tx timeout [ 74.829185][ T5767] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.834892][ T5783] Bluetooth: hci3: command tx timeout [ 74.866965][ T5767] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.880856][ T5767] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.893641][ T5767] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.907391][ T5767] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.916270][ T5767] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.925076][ T5767] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.933929][ T5767] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.947130][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.958145][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.968309][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.979296][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.992055][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.005553][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.017476][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.027471][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.038208][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.048196][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.060947][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.075386][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.088165][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.098748][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.108599][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.119205][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.130599][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.150280][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.167047][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.177306][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.187936][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.197877][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.208754][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.220084][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.232361][ T5772] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.241410][ T5772] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.250769][ T5772] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.259725][ T5772] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.305009][ T5774] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.314117][ T5774] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.324155][ T5774] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.333160][ T5774] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.347327][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.365488][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.424264][ T1134] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.442926][ T1134] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.537748][ T1134] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.562011][ T1134] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.637802][ T78] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.652329][ T78] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.663935][ T5832] syz.2.3[5832]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 75.684555][ T5832] loop2: detected capacity change from 0 to 128 [ 75.711560][ T1134] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.741960][ T1134] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.799102][ T1134] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.814561][ T1134] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.889458][ T78] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.922813][ T78] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.972755][ T1134] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.994398][ T1134] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.301687][ T5845] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 76.360306][ T5836] loop1: detected capacity change from 0 to 8192 [ 76.449877][ T5844] loop0: detected capacity change from 0 to 8192 [ 76.495723][ T5844] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 76.588181][ T5844] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 76.588382][ T5844] REISERFS (device loop0): using ordered data mode [ 76.588393][ T5844] reiserfs: using flush barriers [ 76.592173][ T5851] syz.2.7 uses obsolete (PF_INET,SOCK_PACKET) [ 76.602903][ T5844] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 76.603659][ T5844] REISERFS (device loop0): checking transaction log (loop0) [ 76.742198][ T5783] Bluetooth: hci0: command tx timeout [ 76.903106][ T5783] Bluetooth: hci3: command tx timeout [ 76.908618][ T5085] Bluetooth: hci2: command tx timeout [ 76.914361][ T5770] Bluetooth: hci1: command tx timeout [ 76.927560][ T5844] REISERFS (device loop0): Using tea hash to sort names [ 76.994095][ T5844] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 77.120184][ T5859] loop3: detected capacity change from 0 to 256 [ 77.500280][ T5868] loop8: detected capacity change from 0 to 7 [ 77.536516][ T5868] Dev loop8: unable to read RDB block 7 [ 77.555529][ T5868] loop8: unable to read partition table [ 77.579017][ T5868] loop8: partition table beyond EOD, truncated [ 77.599993][ T5868] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 77.840036][ T5879] loop1: detected capacity change from 0 to 64 [ 77.860234][ T5881] loop2: detected capacity change from 0 to 256 [ 78.369691][ T5889] loop3: detected capacity change from 0 to 2048 [ 78.428637][ T5889] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 78.487310][ T5877] loop0: detected capacity change from 0 to 32768 [ 78.581221][ T5877] XFS (loop0): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 78.724128][ T5877] XFS (loop0): Ending clean mount [ 78.824683][ T5783] Bluetooth: hci0: command tx timeout [ 78.982894][ T5783] Bluetooth: hci3: command tx timeout [ 78.982972][ T5770] Bluetooth: hci1: command tx timeout [ 78.993919][ T5085] Bluetooth: hci2: command tx timeout [ 79.099537][ T5774] XFS (loop0): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 79.173741][ T5890] loop2: detected capacity change from 0 to 32768 [ 79.245680][ T5890] XFS (loop2): Mounting V5 Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a [ 79.363215][ T5890] XFS (loop2): Ending clean mount [ 79.534343][ T3387] XFS (loop2): Metadata CRC error detected at xfs_allocbt_read_verify+0x42/0xd0, xfs_bnobt block 0x4 [ 79.572122][ T3387] XFS (loop2): Unmount and run xfs_repair [ 79.577945][ T3387] XFS (loop2): First 128 bytes of corrupted metadata buffer: [ 79.614044][ T3387] 00000000: 41 42 33 42 00 00 00 03 ff ff ff ff ff ff ff ff AB3B............ [ 79.639749][ T3387] 00000010: 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 10 ................ [ 79.674842][ T3387] 00000020: ed 37 bf 6e 74 ea 4e 01 f8 ba 5f ee 27 4b 0f 3a .7.nt.N..._.'K.: [ 79.706464][ T3387] 00000030: 00 00 00 00 f6 3b 25 b5 00 00 00 07 00 00 00 01 .....;%......... [ 79.732304][ T3387] 00000040: 00 00 0b fe 00 00 00 02 00 00 0c 20 00 00 13 e0 ........... .... [ 79.751410][ T3387] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 79.772370][ T3387] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 79.799475][ T3387] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 79.822050][ T5890] XFS (loop2): metadata I/O error in "xfs_btree_read_buf_block+0x1df/0x2e0" at daddr 0x4 len 4 error 74 [ 79.844254][ T5890] XFS (loop2): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x519/0x8b0 (fs/xfs/xfs_trans_buf.c:296). Shutting down filesystem. [ 79.859991][ T5890] XFS (loop2): Please unmount the filesystem and rectify the problem(s) [ 79.958627][ T5768] XFS (loop2): Unmounting Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a [ 80.102602][ T5942] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 80.154065][ T5943] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 80.182026][ T5943] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 80.201393][ T5943] REISERFS (device loop0): using ordered data mode [ 80.223525][ T5943] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 80.277845][ T5949] can0: slcan on ttyS3. [ 80.286632][ T5943] REISERFS (device loop0): checking transaction log (loop0) [ 80.296880][ T5942] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 80.337879][ T5943] REISERFS (device loop0): Using r5 hash to sort names [ 80.343390][ T5942] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 80.364582][ T5943] REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 SD] (nlink == 1) not found (pos 2) [ 80.366383][ T5942] EXT4-fs (loop1): This should not happen!! Data will be lost [ 80.366383][ T5942] [ 80.412669][ T5949] can0 (unregistered): slcan off ttyS3. [ 80.434035][ T5949] Falling back ldisc for ttyS3. [ 80.439063][ T5943] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 80.441271][ T5942] EXT4-fs (loop1): Total free blocks count 0 [ 80.481971][ T5942] EXT4-fs (loop1): Free/Dirty block details [ 80.498225][ T5942] EXT4-fs (loop1): free_blocks=2415919104 [ 80.506403][ T5942] EXT4-fs (loop1): dirty_blocks=16 [ 80.511637][ T5942] EXT4-fs (loop1): Block reservation details [ 80.519322][ T5942] EXT4-fs (loop1): i_reserved_data_blocks=1 [ 80.531090][ T5943] REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 SD] (nlink == 1) not found (pos 2) [ 80.569522][ T5943] REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 SD] (nlink == 1) not found (pos 2) [ 80.660103][ T5953] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 80.759010][ T5952] syz.2.36: attempt to access beyond end of device [ 80.759010][ T5952] loop2: rw=0, sector=70368744185984, nr_sectors = 2 limit=4096 [ 80.760522][ T5767] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 80.792260][ T5952] syz.2.36: attempt to access beyond end of device [ 80.792260][ T5952] loop2: rw=0, sector=67108864, nr_sectors = 2 limit=4096 [ 80.841889][ T5952] syz.2.36: attempt to access beyond end of device [ 80.841889][ T5952] loop2: rw=0, sector=131070, nr_sectors = 2 limit=4096 [ 80.873696][ T5952] NILFS (loop2): nilfs_ioctl_move_inode_block: conflicting data buffer: ino=0, cno=0, offset=0, blocknr=65535, vblocknr=0 [ 80.893073][ T5952] NILFS (loop2): error -17 preparing GC: cannot read source blocks [ 81.001176][ T5961] set_capacity_and_notify: 3 callbacks suppressed [ 81.001190][ T5961] loop1: detected capacity change from 0 to 256 [ 81.042799][ T5961] ======================================================= [ 81.042799][ T5961] WARNING: The mand mount option has been deprecated and [ 81.042799][ T5961] and is ignored by this kernel. Remove the mand [ 81.042799][ T5961] option from the mount to silence this warning. [ 81.042799][ T5961] ======================================================= [ 81.184115][ T5961] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xb89b369d, utbl_chksum : 0xe619d30d) [ 81.280309][ T5961] exFAT-fs (loop1): error, tried to truncate zeroed cluster. [ 81.321609][ T5961] exFAT-fs (loop1): Filesystem has been set read-only [ 81.394415][ T5969] loop0: detected capacity change from 0 to 256 [ 82.066390][ T5829] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 82.091058][ T5981] loop3: detected capacity change from 0 to 128 [ 82.177394][ T5983] Bluetooth: MGMT ver 1.22 [ 82.221135][ T5966] loop2: detected capacity change from 0 to 40427 [ 82.274549][ T5966] F2FS-fs (loop2): invalid crc value [ 82.297600][ T5829] usb 1-1: Using ep0 maxpacket: 32 [ 82.316992][ T5966] F2FS-fs (loop2): Found nat_bits in checkpoint [ 82.331927][ T5829] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 82.386215][ T5829] usb 1-1: config 0 has no interface number 0 [ 82.418774][ T5829] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 82.452487][ T5829] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.464772][ T5988] loop1: detected capacity change from 0 to 2048 [ 82.491810][ T5829] usb 1-1: Product: syz [ 82.510040][ T5988] UDF-fs: error (device loop1): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 82.517062][ T5829] usb 1-1: Manufacturer: syz [ 82.538674][ T5829] usb 1-1: SerialNumber: syz [ 82.561875][ T5829] usb 1-1: config 0 descriptor?? [ 82.573067][ T5988] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 82.602904][ T5829] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 82.614950][ T5966] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 82.617569][ T5988] UDF-fs: Scanning with blocksize 512 failed [ 82.680839][ T5988] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 82.767742][ T5991] syzkaller1: entered promiscuous mode [ 82.803616][ T5991] syzkaller1: entered allmulticast mode [ 82.837381][ T27] audit: type=1800 audit(1781154892.029:2): pid=5988 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.51" name="file1" dev="loop1" ino=838 res=0 errno=0 [ 82.867068][ T5829] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 82.919901][ T5829] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 83.336713][ T5994] loop3: detected capacity change from 0 to 4096 [ 83.373989][ T5994] ntfs3: loop3: Different NTFS sector size (4096) and media sector size (512). [ 83.390043][ C0] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 83.403342][ T5829] usb 1-1: USB disconnect, device number 2 [ 83.451538][ T5829] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 83.510948][ T5829] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 83.554007][ T5829] quatech2 1-1:0.51: device disconnected [ 83.567280][ T5994] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 83.592424][ T5994] ntfs3: loop3: Failed to initialize $Extend/$ObjId. [ 83.730369][ T6000] loop2: detected capacity change from 0 to 512 [ 83.745464][ T6000] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 83.752714][ T27] audit: type=1800 audit(1781154892.949:3): pid=5994 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.54" name="file1" dev="loop3" ino=24 res=0 errno=0 [ 83.786609][ T6000] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 83.826302][ T6000] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 191 vs 220 free clusters [ 83.862177][ T6000] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2855: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 83.895922][ T6000] EXT4-fs (loop2): 1 truncate cleaned up [ 83.904358][ T6000] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 84.081146][ T6006] loop1: detected capacity change from 0 to 512 [ 84.181659][ T6008] loop0: detected capacity change from 0 to 1024 [ 84.225856][ T6000] EXT4-fs (loop2): shut down requested (1) [ 84.268649][ T6008] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 84.407340][ T5768] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 84.567789][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 84.722858][ T6022] loop0: detected capacity change from 0 to 1024 [ 85.198310][ T6028] ntfs: (device loop3): check_mft_mirror(): $MFT and $MFTMirr (record 1) do not match. Run ntfsfix or chkdsk. [ 85.210988][ T6015] F2FS-fs (loop1): Insane cp_payload (553648128 >= 504) [ 85.231967][ T6015] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 85.240428][ T6028] ntfs: (device loop3): load_system_files(): $MFTMirr does not match $MFT. Mounting read-only. Run ntfsfix and/or chkdsk. [ 85.271158][ T6015] F2FS-fs (loop1): invalid crc value [ 85.283012][ T6028] ntfs: (device loop3): ntfs_read_locked_inode(): First extent of $DATA attribute has non zero lowest_vcn. [ 85.305118][ T6028] ntfs: (device loop3): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0xa as bad. Run chkdsk. [ 85.326976][ T6015] F2FS-fs (loop1): Found nat_bits in checkpoint [ 85.349546][ T6028] ntfs: (device loop3): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 85.405438][ T6028] ntfs: volume version 3.1. [ 85.424694][ T6028] ntfs: (device loop3): ntfs_check_logfile(): Did not find any restart pages in $LogFile and it was not empty. [ 85.472728][ T6028] ntfs: (device loop3): load_system_files(): Failed to load $LogFile. Will not be able to remount read-write. Mount in Windows. [ 85.481858][ T3387] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 85.494860][ T6028] ntfs: (device loop3): ntfs_lookup_inode_by_name(): Index entry out of bounds in directory inode 0x5. [ 85.506019][ T6015] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 85.519921][ T6015] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 85.701934][ T3387] usb 1-1: Using ep0 maxpacket: 16 [ 85.716039][ T3387] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 85.751969][ T3387] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.767235][ T6015] syz.1.61: attempt to access beyond end of device [ 85.767235][ T6015] loop1: rw=34817, sector=77832, nr_sectors = 8 limit=40427 [ 85.791943][ T3387] usb 1-1: Product: syz [ 85.796156][ T3387] usb 1-1: Manufacturer: syz [ 85.800769][ T3387] usb 1-1: SerialNumber: syz [ 85.823983][ T3387] r8152-cfgselector 1-1: config 0 descriptor?? [ 85.879173][ T5767] syz-executor: attempt to access beyond end of device [ 85.879173][ T5767] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 85.920907][ T5767] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 85.921627][ T6026] XFS (loop2): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 86.036661][ T6026] XFS (loop2): Ending clean mount [ 86.268684][ T3387] r8152-cfgselector 1-1: Unknown version 0x0000 [ 86.298297][ T3387] r8152-cfgselector 1-1: USB disconnect, device number 3 [ 86.417904][ T5768] XFS (loop2): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 86.579800][ T6037] set_capacity_and_notify: 3 callbacks suppressed [ 86.579814][ T6037] loop3: detected capacity change from 0 to 32768 [ 86.749030][ T6037] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 86.858729][ T9] cfg80211: failed to load regulatory.db [ 87.099492][ T5772] ocfs2: Unmounting device (7,3) on (node local) [ 87.131588][ T6058] loop1: detected capacity change from 0 to 512 [ 87.183430][ T6058] EXT4-fs: Ignoring removed i_version option [ 87.276046][ T6058] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 87.334140][ T6058] EXT4-fs error (device loop1): ext4_orphan_get:1404: inode #15: comm syz.1.76: inode has both inline data and extents flags [ 87.405320][ T6058] EXT4-fs error (device loop1): ext4_orphan_get:1409: comm syz.1.76: couldn't read orphan inode 15 (err -117) [ 87.415356][ T6067] loop3: detected capacity change from 0 to 1024 [ 87.477519][ T6058] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 87.773268][ T6067] hfsplus: request for non-existent node 62977 in B*Tree [ 87.801793][ T5767] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 87.804703][ T6067] hfsplus: request for non-existent node 62977 in B*Tree [ 87.962823][ T1134] hfsplus: b-tree write err: -5, ino 3 [ 88.391963][ T5830] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 88.524389][ T6089] loop1: detected capacity change from 0 to 4096 [ 88.528981][ T6088] loop2: detected capacity change from 0 to 4096 [ 88.614448][ T5830] usb 4-1: Using ep0 maxpacket: 8 [ 88.624868][ T5830] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 88.639282][ T5830] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 88.650682][ T5830] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 88.666829][ T5830] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 88.678401][ T5830] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 88.688907][ T5830] usb 4-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 88.718634][ T5830] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 88.772850][ T5830] usb 4-1: config 0 descriptor?? [ 88.793305][ T6088] ntfs3: loop2: ino=3, ntfs_set_state failed, -22. [ 88.799905][ T6088] ntfs3: loop2: Failed to initialize $Extend/$ObjId. [ 88.820729][ T6078] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 88.949628][ T27] kauditd_printk_skb: 9 callbacks suppressed [ 88.949643][ T27] audit: type=1804 audit(1781154898.149:5): pid=6089 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.86" name="/newroot/24/file0/file0" dev="loop1" ino=0 res=1 errno=0 [ 88.954946][ T6094] loop0: detected capacity change from 0 to 256 [ 89.032806][ T6094] exFAT-fs (loop0): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x32e3664b, utbl_chksum : 0xe619d30d) [ 89.163682][ T11] ntfs3: loop2: ino=3, ntfs3_write_inode failed, -22. [ 89.198161][ T5768] ntfs3: loop2: ino=3, ntfs_set_state failed, -22. [ 89.210080][ T5085] Bluetooth: hci4: Received unexpected HCI Event 0x00 [ 89.217953][ T5768] ntfs3: loop2: Mark volume as dirty due to NTFS errors [ 89.218312][ T5085] Bluetooth: hci4: Received unexpected HCI Event 0x00 [ 89.238015][ T5768] ntfs3: loop2: ino=3, ntfs_set_state failed, -22. [ 89.255491][ T1078] ntfs3: loop2: ino=3, ntfs3_write_inode failed, -22. [ 89.330685][ T6099] loop2: detected capacity change from 0 to 64 [ 89.410294][ T5770] Bluetooth: hci4: Opcode 0x0c03 failed: -71 [ 89.420521][ T5830] usb 4-1: USB disconnect, device number 2 [ 89.562250][ T5757] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 89.652061][ T5812] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 89.761816][ T5757] usb 2-1: Using ep0 maxpacket: 16 [ 89.768684][ T5757] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 89.778858][ T5757] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 89.793048][ T5757] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 89.802346][ T5757] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 89.810362][ T5757] usb 2-1: SerialNumber: syz [ 89.824429][ T5757] usb 2-1: 0:2 : does not exist [ 89.851975][ T5812] usb 1-1: Using ep0 maxpacket: 32 [ 89.859077][ T5812] usb 1-1: config index 0 descriptor too short (expected 35577, got 27) [ 89.867698][ T5812] usb 1-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 89.876378][ T5812] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 89.885394][ T5812] usb 1-1: config 1 has no interface number 0 [ 89.891522][ T5812] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 89.902480][ T5812] usb 1-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 89.915415][ T5812] usb 1-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 89.924882][ T5812] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.954675][ T5812] snd_usb_pod 1-1:1.1: Line 6 Pocket POD found [ 90.155823][ T5812] snd_usb_pod 1-1:1.1: Line 6 Pocket POD now attached [ 90.285178][ T5830] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 90.476951][ T5830] usb 4-1: Using ep0 maxpacket: 8 [ 90.484802][ T5830] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 90.496109][ T5830] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 90.508803][ T5830] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.527664][ T5830] usb 4-1: config 0 descriptor?? [ 90.637198][ T5780] usb 1-1: USB disconnect, device number 4 [ 90.656752][ T5780] snd_usb_pod 1-1:1.1: Line 6 Pocket POD now disconnected [ 90.660172][ T5757] usb 2-1: 5:0: failed to get current value for ch 1 (-22) [ 90.686501][ T5757] usb 2-1: 5:0: failed to get current value for ch 2 (-22) [ 90.704906][ T5757] usb 2-1: 5:0: failed to get current value for ch 3 (-22) [ 90.727292][ T5757] usb 2-1: 5:0: cannot get min/max values for control 5 (id 5) [ 90.755673][ T5830] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 90.776536][ T5757] usb 2-1: 5:0: cannot get min/max values for control 5 (id 5) [ 90.791371][ T5757] usb 2-1: USB disconnect, device number 2 [ 90.968106][ T5812] usb 4-1: USB disconnect, device number 3 [ 90.968135][ C1] iowarrior 4-1:0.0: iowarrior_callback - usb_submit_urb failed with result -19 [ 91.303762][ T6114] loop1: detected capacity change from 0 to 2048 [ 91.321110][ T6114] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 91.546789][ T6116] loop1: detected capacity change from 0 to 64 [ 91.681514][ T6112] loop0: detected capacity change from 0 to 40427 [ 91.698196][ T6112] F2FS-fs (loop0): build fault injection attr: rate: 14, type: 0x7ffff [ 91.728526][ T6112] F2FS-fs (loop0): invalid crc value [ 91.748576][ T6112] F2FS-fs (loop0): Found nat_bits in checkpoint [ 91.880478][ T6118] loop1: detected capacity change from 0 to 4096 [ 91.923546][ T6112] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 92.108198][ T6118] ntfs3: Cannot use different iocharset when remounting! [ 92.118744][ T5774] syz-executor: attempt to access beyond end of device [ 92.118744][ T5774] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 92.121552][ T6118] ntfs3: loop1: failed to convert "0080" to maciceland [ 92.144123][ T5774] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 92.155018][ T6118] ntfs3: loop1: failed to convert name for inode 1e. [ 92.624038][ T6133] loop1: detected capacity change from 0 to 512 [ 92.633173][ T6133] EXT4-fs: Ignoring removed oldalloc option [ 92.648995][ T6133] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 92.704302][ T6133] EXT4-fs error (device loop1): __ext4_fill_super:5517: inode #2: comm syz.1.104: inode has both inline data and extents flags [ 92.718172][ T6133] EXT4-fs (loop1): get root inode failed [ 92.724020][ T6133] EXT4-fs (loop1): mount failed [ 92.972070][ T5812] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 93.085327][ T5780] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 93.161865][ T5812] usb 1-1: Using ep0 maxpacket: 32 [ 93.168455][ T5812] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 93.180652][ T5812] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 93.189771][ T5812] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 93.198979][ T5812] usb 1-1: Product: syz [ 93.203219][ T5812] usb 1-1: Manufacturer: syz [ 93.207801][ T5812] usb 1-1: SerialNumber: syz [ 93.217377][ T5812] usb 1-1: config 0 descriptor?? [ 93.223419][ T6135] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 93.231834][ T5812] hub 1-1:0.0: bad descriptor, ignoring hub [ 93.237765][ T5812] hub: probe of 1-1:0.0 failed with error -5 [ 93.271873][ T5780] usb 2-1: Using ep0 maxpacket: 8 [ 93.278873][ T5780] usb 2-1: unable to get BOS descriptor or descriptor too short [ 93.288256][ T5780] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 93.299052][ T5780] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 93.313517][ T5780] usb 2-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40 [ 93.331830][ T5780] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.340484][ T5780] usb 2-1: Product: syz [ 93.345259][ T5780] usb 2-1: Manufacturer: syz [ 93.350779][ T5780] usb 2-1: SerialNumber: syz [ 93.592226][ T5757] usb 1-1: USB disconnect, device number 5 [ 93.661899][ T5812] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 93.686356][ T6143] loop2: detected capacity change from 0 to 4096 [ 93.782104][ T5780] usb 2-1: 0:2 : does not exist [ 93.808279][ T5780] usb 2-1: USB disconnect, device number 3 [ 93.849807][ T5784] udevd[5784]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 93.885544][ T5812] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 93.903153][ T5812] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 93.934000][ T5812] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 93.955544][ T5812] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 93.964794][ T5812] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.978118][ T5812] usb 4-1: config 0 descriptor?? [ 94.161909][ T5830] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 94.363516][ T5830] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 94.374668][ T5830] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 94.384531][ T5830] usb 3-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 94.393615][ T5830] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.404378][ T5830] usb 3-1: config 0 descriptor?? [ 94.437423][ T5812] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 94.478580][ T5812] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 94.734083][ T6147] loop0: detected capacity change from 0 to 32768 [ 94.785678][ T5780] usb 4-1: USB disconnect, device number 4 [ 94.799686][ T6147] JBD2: Ignoring recovery information on journal [ 94.931078][ T6147] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 95.119891][ T6150] loop1: detected capacity change from 0 to 40427 [ 95.139351][ T5774] ocfs2: Unmounting device (7,0) on (node local) [ 95.139544][ T6150] F2FS-fs (loop1): build fault injection attr: rate: 16, type: 0x7ffff [ 95.156692][ T6150] F2FS-fs (loop1): build fault injection attr: rate: 0, type: 0x7698c [ 95.186637][ T6150] F2FS-fs (loop1): invalid crc value [ 95.212362][ T6150] F2FS-fs (loop1): inject invalid blkaddr in f2fs_is_valid_blkaddr of f2fs_ra_meta_pages+0x21d/0x9b0 [ 95.243897][ T5830] hid-led: probe of 0003:27B8:01ED.0002 failed with error -71 [ 95.244626][ T6150] F2FS-fs (loop1): Found nat_bits in checkpoint [ 95.272814][ T5830] usb 3-1: USB disconnect, device number 2 [ 95.347096][ T6150] F2FS-fs (loop1): inject invalid blkaddr in f2fs_is_valid_blkaddr of f2fs_ra_meta_pages+0x21d/0x9b0 [ 95.421134][ T6150] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 95.525881][ T6150] F2FS-fs (loop1): inject page alloc in f2fs_grab_cache_page of f2fs_new_node_page+0x13a/0x910 [ 95.623380][ T6150] F2FS-fs (loop1): inject invalid blkaddr in f2fs_is_valid_blkaddr of f2fs_map_blocks+0xcfe/0x40f0 [ 95.646532][ T6150] syz.1.111: attempt to access beyond end of device [ 95.646532][ T6150] loop1: rw=0, sector=45064, nr_sectors = 8 limit=40427 [ 95.700411][ T5767] syz-executor: attempt to access beyond end of device [ 95.700411][ T5767] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 95.716511][ T5767] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 95.839662][ T6166] macvtap1: entered promiscuous mode [ 95.852584][ T6166] dummy0: entered promiscuous mode [ 95.865636][ T6166] team0: Device macvtap1 failed to register rx_handler [ 95.876084][ T6166] dummy0: left promiscuous mode [ 96.158818][ T6173] loop3: detected capacity change from 0 to 512 [ 96.191834][ T6173] EXT4-fs error (device loop3): ext4_iget_extra_inode:4739: inode #15: comm syz.3.120: corrupted in-inode xattr: invalid ea_ino [ 96.212770][ T6173] EXT4-fs error (device loop3): ext4_orphan_get:1409: comm syz.3.120: couldn't read orphan inode 15 (err -117) [ 96.243973][ T5757] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 96.253406][ T6173] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000500000000 r/w without journal. Quota mode: none. [ 96.355118][ T6180] loop0: detected capacity change from 0 to 128 [ 96.464169][ T5757] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 96.490688][ T5772] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000500000000. [ 96.607174][ T5757] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 96.621516][ T5757] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 96.630881][ T5757] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.722992][ T6184] loop0: detected capacity change from 0 to 64 [ 97.531875][ T5757] usb 3-1: GET_CAPABILITIES returned 0 [ 97.537439][ T5757] usbtmc 3-1:16.0: can't read capabilities [ 97.557500][ T5757] usb 3-1: USB disconnect, device number 3 [ 97.991858][ T9] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 98.085301][ T5812] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 98.197286][ T9] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 98.205714][ T9] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 98.216397][ T9] usb 1-1: config 220 has no interface number 2 [ 98.222802][ T9] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 98.236877][ T9] usb 1-1: config 220 interface 0 has no altsetting 0 [ 98.243743][ T9] usb 1-1: config 220 interface 76 has no altsetting 0 [ 98.250836][ T9] usb 1-1: config 220 interface 1 has no altsetting 0 [ 98.259593][ T9] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 98.268803][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.277029][ T5812] usb 2-1: Using ep0 maxpacket: 32 [ 98.282233][ T9] usb 1-1: Product: syz [ 98.286416][ T9] usb 1-1: Manufacturer: syz [ 98.291016][ T9] usb 1-1: SerialNumber: syz [ 98.297613][ T5812] usb 2-1: config index 0 descriptor too short (expected 156, got 27) [ 98.306195][ T5812] usb 2-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 98.317919][ T5812] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 98.331191][ T5812] usb 2-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 98.347327][ T5812] usb 2-1: config 0 interface 0 has no altsetting 0 [ 98.356221][ T5812] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 98.361991][ T5780] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 98.365352][ T5812] usb 2-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 98.381231][ T5812] usb 2-1: Product: syz [ 98.385480][ T5812] usb 2-1: Manufacturer: syz [ 98.390096][ T5812] usb 2-1: SerialNumber: syz [ 98.397397][ T5812] usb 2-1: config 0 descriptor?? [ 98.404743][ T5812] ldusb 2-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 98.416240][ T5812] ldusb 2-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 98.555996][ T5780] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 98.567027][ T5780] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.567276][ T9] usb 1-1: Found UVC 7.01 device syz (8086:0b07) [ 98.575181][ T5780] usb 3-1: Product: syz [ 98.585873][ T9] usb 1-1: No valid video chain found. [ 98.586010][ T9] usb 1-1: selecting invalid altsetting 0 [ 98.599739][ T9] usb 1-1: selecting invalid altsetting 0 [ 98.613087][ T5780] usb 3-1: Manufacturer: syz [ 98.616047][ T9] usbtest: probe of 1-1:220.1 failed with error -22 [ 98.617880][ T5780] usb 3-1: SerialNumber: syz [ 98.640650][ T9] usb 1-1: USB disconnect, device number 6 [ 98.649336][ T5780] usb 3-1: config 0 descriptor?? [ 98.942986][ T5830] usb 2-1: USB disconnect, device number 4 [ 98.957846][ T5830] ldusb 2-1:0.0: LD USB Device #0 now disconnected [ 99.069159][ T5780] usb 3-1: Firmware version (0.0) predates our first public release. [ 99.077364][ T5780] usb 3-1: Please update to version 0.2 or newer [ 99.087437][ T5780] usb 3-1: Firmware: build [ 99.182131][ T6205] loop0: detected capacity change from 0 to 4096 [ 99.190336][ T6205] ntfs3: loop0: Different NTFS sector size (4096) and media sector size (512). [ 99.255672][ T6205] ntfs3: Cannot use different iocharset when remounting! [ 99.328277][ T5780] usb 3-1: USB disconnect, device number 4 [ 99.951332][ T1134] Bluetooth: (null): Invalid header checksum [ 100.062890][ T5775] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 100.079732][ T1134] Bluetooth: (null): Invalid header checksum [ 100.175853][ T1134] Bluetooth: (null): Invalid header checksum [ 100.260481][ T1134] Bluetooth: (null): Invalid header checksum [ 100.313371][ T1134] Bluetooth: (null): Invalid header checksum [ 100.357618][ T5775] usb 2-1: config 0 has no interfaces? [ 100.363682][ T1134] Bluetooth: (null): Invalid header checksum [ 100.379485][ T5775] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 100.390499][ T5775] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.403416][ T5775] usb 2-1: Product: syz [ 100.407607][ T5775] usb 2-1: Manufacturer: syz [ 100.444563][ T49] Bluetooth: (null): Invalid header checksum [ 100.455756][ T5775] usb 2-1: SerialNumber: syz [ 100.492325][ T5775] usb 2-1: config 0 descriptor?? [ 100.563583][ T78] Bluetooth: (null): Invalid header checksum [ 100.599525][ T6218] loop2: detected capacity change from 0 to 1024 [ 100.613422][ T6218] EXT4-fs: Ignoring removed bh option [ 100.654083][ T6218] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 100.669248][ T1078] Bluetooth: (null): Invalid header checksum [ 100.723830][ T3387] usb 2-1: USB disconnect, device number 5 [ 100.938519][ T5768] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 101.225627][ T6220] loop0: detected capacity change from 0 to 32768 [ 101.247325][ T6235] syzkaller1: entered promiscuous mode [ 101.255738][ T6220] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz.0.135 (6220) [ 101.262679][ T6235] syzkaller1: entered allmulticast mode [ 101.336187][ T6220] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 101.361281][ T6220] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm [ 101.396395][ T6220] BTRFS info (device loop0): setting nodatacow, compression disabled [ 101.405921][ T6220] BTRFS info (device loop0): turning on flush-on-commit [ 101.414804][ T6220] BTRFS info (device loop0): setting incompat feature flag for COMPRESS_LZO (0x8) [ 101.424550][ T6220] BTRFS info (device loop0): use lzo compression, level 0 [ 101.431962][ T6220] BTRFS info (device loop0): setting nodatasum [ 101.438714][ T6220] BTRFS info (device loop0): use no compression [ 101.445508][ T6220] BTRFS info (device loop0): trying to use backup root at mount time [ 101.466158][ T6220] BTRFS info (device loop0): max_inline at 0 [ 101.491952][ T6220] BTRFS info (device loop0): using free space tree [ 101.596928][ T6239] loop1: detected capacity change from 0 to 2048 [ 101.644600][ T49] BTRFS warning (device loop0): checksum verify failed on logical 5332992 mirror 1 wanted 0x0a5e5d25 found 0xcee3a718 level 0 [ 101.654324][ T6239] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 101.692139][ T6220] BTRFS warning (device loop0): couldn't read tree root [ 101.699177][ T6220] BTRFS warning (device loop0): try to load backup roots slot 1 [ 101.733316][ T78] BTRFS warning (device loop0): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0xe06dfc66 level 0 [ 101.780386][ T6220] BTRFS warning (device loop0): couldn't read tree root [ 101.800216][ T6220] BTRFS warning (device loop0): try to load backup roots slot 2 [ 101.814498][ T6259] loop3: detected capacity change from 0 to 4096 [ 101.843179][ T12] BTRFS error (device loop0): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 101.863949][ T6259] ntfs3: loop3: Different NTFS sector size (4096) and media sector size (512). [ 101.883387][ T6220] BTRFS warning (device loop0): couldn't read tree root [ 101.890421][ T6220] BTRFS warning (device loop0): try to load backup roots slot 3 [ 102.018344][ T6220] BTRFS info (device loop0): enabling ssd optimizations [ 102.054205][ T6220] BTRFS info (device loop0): auto enabling async discard [ 102.078249][ T6220] BTRFS info (device loop0): rebuilding free space tree [ 102.090379][ T6259] ntfs3: loop3: failed to convert "c46c" to cp865 [ 102.114285][ T6267] vivid-002: disconnect [ 102.130381][ T6266] vivid-002: reconnect [ 102.218267][ T6220] BTRFS info (device loop0): checking UUID tree [ 102.369394][ T27] audit: type=1800 audit(1781154911.569:6): pid=6220 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.135" name="file1" dev="loop0" ino=257 res=0 errno=0 [ 102.417106][ T6276] loop2: detected capacity change from 0 to 512 [ 102.527932][ T6276] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 102.626424][ T6276] ext4 filesystem being mounted at /34/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 102.764626][ T5774] BTRFS info (device loop0): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 102.796439][ T6276] EXT4-fs warning (device loop2): ext4_group_add:1722: Can't resize non-sparse filesystem further [ 102.909781][ T5768] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 103.285865][ T6295] loop1: detected capacity change from 0 to 256 [ 103.296301][ T6295] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 103.324466][ T6297] loop0: detected capacity change from 0 to 256 [ 103.388375][ T6297] exFAT-fs (loop0): failed to load upcase table (idx : 0x00011bf5, chksum : 0xcea91b8a, utbl_chksum : 0xe619d30d) [ 103.389064][ T6299] loop2: detected capacity change from 0 to 8 [ 103.417531][ T6297] exFAT-fs (loop0): bogus allocation bitmap size(need : 2, cur : 17179869186) [ 103.643117][ T3387] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 103.854643][ T3387] usb 2-1: Using ep0 maxpacket: 16 [ 103.867856][ T3387] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 103.891927][ T3387] usb 2-1: config 0 has an invalid descriptor of length 116, skipping remainder of the config [ 103.905617][ T6310] loop2: detected capacity change from 0 to 512 [ 103.914576][ T3387] usb 2-1: config 0 has no interface number 0 [ 103.927763][ T3387] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 103.956161][ T3387] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.965755][ T6310] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 103.986249][ T3387] usb 2-1: Product: syz [ 103.990473][ T3387] usb 2-1: Manufacturer: syz [ 103.996590][ T3387] usb 2-1: SerialNumber: syz [ 104.004460][ T3387] usb 2-1: config 0 descriptor?? [ 104.020482][ T6310] EXT4-fs error (device loop2): ext4_orphan_get:1430: comm syz.2.165: bad orphan inode 131083 [ 104.048918][ T6310] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 104.100411][ T27] audit: type=1800 audit(1781154913.299:7): pid=6310 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.165" name="file1" dev="loop2" ino=15 res=0 errno=0 [ 104.200780][ T5768] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 104.242292][ T3387] usb 2-1: Found UVC 0.00 device syz (046d:08f3) [ 104.254984][ T3387] usb 2-1: No valid video chain found. [ 104.275247][ T3387] usb 2-1: USB disconnect, device number 6 [ 104.307370][ T6320] loop2: detected capacity change from 0 to 512 [ 104.335918][ T6320] EXT4-fs error (device loop2): ext4_orphan_get:1404: inode #15: comm syz.2.169: inode has both inline data and extents flags [ 104.394623][ T6320] EXT4-fs error (device loop2): ext4_orphan_get:1409: comm syz.2.169: couldn't read orphan inode 15 (err -117) [ 104.423122][ T6325] input: syz0 as /devices/virtual/input/input5 [ 104.434468][ T6320] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000070000 r/w without journal. Quota mode: writeback. [ 104.634633][ T5768] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000070000. [ 104.654270][ T6329] syzkaller1: entered promiscuous mode [ 104.660616][ T6329] syzkaller1: entered allmulticast mode [ 105.092459][ T5770] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 105.103705][ T5770] CPU: 0 PID: 5770 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 105.111290][ T5770] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 105.121368][ T5770] Workqueue: hci0 hci_rx_work [ 105.126103][ T5770] Call Trace: [ 105.129397][ T5770] [ 105.132339][ T5770] dump_stack_lvl+0x18c/0x250 [ 105.137049][ T5770] ? show_regs_print_info+0x20/0x20 [ 105.142270][ T5770] ? load_image+0x420/0x420 [ 105.146804][ T5770] sysfs_create_dir_ns+0x26e/0x2a0 [ 105.151939][ T5770] ? sysfs_warn_dup+0xa0/0xa0 [ 105.156636][ T5770] ? do_raw_spin_unlock+0x121/0x230 [ 105.161860][ T5770] kobject_add_internal+0x61c/0xcc0 [ 105.167092][ T5770] kobject_add+0x164/0x240 [ 105.171532][ T5770] ? __rwlock_init+0x150/0x150 [ 105.176327][ T5770] ? kobject_init+0x1e0/0x1e0 [ 105.181046][ T5770] ? _raw_spin_unlock+0x28/0x40 [ 105.185940][ T5770] ? get_device_parent+0x366/0x390 [ 105.191085][ T5770] device_add+0x408/0xc50 [ 105.195448][ T5770] hci_conn_add_sysfs+0xd5/0x1e0 [ 105.200419][ T5770] le_conn_complete_evt+0xf5d/0x1540 [ 105.205734][ T5770] ? hci_event_packet+0x4cb/0x1270 [ 105.210884][ T5770] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 105.217157][ T5770] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 105.222822][ T5770] ? skb_pull_data+0xfb/0x200 [ 105.227529][ T5770] hci_le_conn_complete_evt+0x187/0x440 [ 105.233112][ T5770] ? hci_remote_host_features_evt+0x150/0x150 [ 105.239209][ T5770] hci_event_packet+0x7ba/0x1270 [ 105.244186][ T5770] ? bis_list+0x290/0x290 [ 105.248550][ T5770] ? lockdep_hardirqs_on+0x98/0x150 [ 105.253779][ T5770] ? hci_send_to_monitor+0xd7/0x4f0 [ 105.259009][ T5770] hci_rx_work+0x43a/0xd60 [ 105.263470][ T5770] ? process_scheduled_works+0x96f/0x15d0 [ 105.269216][ T5770] process_scheduled_works+0xa5d/0x15d0 [ 105.274819][ T5770] ? worker_attach_to_pool+0x380/0x380 [ 105.280312][ T5770] ? assign_work+0x3d2/0x5d0 [ 105.284936][ T5770] worker_thread+0xa55/0xfc0 [ 105.289552][ T5770] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 105.295470][ T5770] ? _raw_spin_unlock+0x40/0x40 [ 105.300352][ T5770] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 105.306297][ T5770] kthread+0x2fa/0x390 [ 105.310389][ T5770] ? pr_cont_work+0x560/0x560 [ 105.315092][ T5770] ? kthread_blkcg+0xd0/0xd0 [ 105.319786][ T5770] ret_from_fork+0x48/0x80 [ 105.324228][ T5770] ? kthread_blkcg+0xd0/0xd0 [ 105.328840][ T5770] ret_from_fork_asm+0x11/0x20 [ 105.333643][ T5770] [ 105.349577][ T5770] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 105.363845][ T5770] Bluetooth: hci0: failed to register connection device [ 105.380480][ T5770] ================================================================== [ 105.388593][ T5770] BUG: KASAN: slab-use-after-free in l2cap_connect_cfm+0x6df/0x1070 [ 105.396607][ T5770] Read of size 8 at addr ffff888023bda480 by task kworker/u5:2/5770 [ 105.404606][ T5770] [ 105.406944][ T5770] CPU: 0 PID: 5770 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 105.414503][ T5770] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 105.424573][ T5770] Workqueue: hci0 hci_rx_work [ 105.429289][ T5770] Call Trace: [ 105.432587][ T5770] [ 105.435531][ T5770] dump_stack_lvl+0x18c/0x250 [ 105.440238][ T5770] ? __lock_acquire+0x7d40/0x7d40 [ 105.445285][ T5770] ? show_regs_print_info+0x20/0x20 [ 105.450506][ T5770] ? load_image+0x420/0x420 [ 105.455035][ T5770] ? __virt_addr_valid+0x469/0x540 [ 105.460174][ T5770] print_report+0xa8/0x210 [ 105.464624][ T5770] ? l2cap_connect_cfm+0x6df/0x1070 [ 105.469829][ T5770] kasan_report+0x117/0x150 [ 105.474343][ T5770] ? l2cap_connect_cfm+0x6df/0x1070 [ 105.479537][ T5770] l2cap_connect_cfm+0x6df/0x1070 [ 105.484557][ T5770] ? l2cap_ertm_resend+0x1040/0x1040 [ 105.489834][ T5770] ? l2cap_ertm_resend+0x1040/0x1040 [ 105.495109][ T5770] hci_connect_cfm+0x8f/0x130 [ 105.499860][ T5770] le_conn_complete_evt+0xfdc/0x1540 [ 105.505142][ T5770] ? hci_event_packet+0x4cb/0x1270 [ 105.510256][ T5770] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 105.516493][ T5770] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 105.522124][ T5770] ? skb_pull_data+0xfb/0x200 [ 105.526801][ T5770] hci_le_conn_complete_evt+0x187/0x440 [ 105.532343][ T5770] ? hci_remote_host_features_evt+0x150/0x150 [ 105.538409][ T5770] hci_event_packet+0x7ba/0x1270 [ 105.543345][ T5770] ? bis_list+0x290/0x290 [ 105.547668][ T5770] ? lockdep_hardirqs_on+0x98/0x150 [ 105.552863][ T5770] ? hci_send_to_monitor+0xd7/0x4f0 [ 105.558084][ T5770] hci_rx_work+0x43a/0xd60 [ 105.562502][ T5770] ? process_scheduled_works+0x96f/0x15d0 [ 105.568216][ T5770] process_scheduled_works+0xa5d/0x15d0 [ 105.573766][ T5770] ? worker_attach_to_pool+0x380/0x380 [ 105.579217][ T5770] ? assign_work+0x3d2/0x5d0 [ 105.583805][ T5770] worker_thread+0xa55/0xfc0 [ 105.588387][ T5770] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 105.594291][ T5770] ? _raw_spin_unlock+0x40/0x40 [ 105.599135][ T5770] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 105.605029][ T5770] kthread+0x2fa/0x390 [ 105.609090][ T5770] ? pr_cont_work+0x560/0x560 [ 105.613765][ T5770] ? kthread_blkcg+0xd0/0xd0 [ 105.618347][ T5770] ret_from_fork+0x48/0x80 [ 105.622755][ T5770] ? kthread_blkcg+0xd0/0xd0 [ 105.627333][ T5770] ret_from_fork_asm+0x11/0x20 [ 105.632181][ T5770] [ 105.635186][ T5770] [ 105.637582][ T5770] Allocated by task 5770: [ 105.641891][ T5770] kasan_set_track+0x4e/0x70 [ 105.646491][ T5770] __kasan_kmalloc+0x8f/0xa0 [ 105.651068][ T5770] l2cap_chan_create+0x50/0x760 [ 105.655912][ T5770] l2cap_sock_new_connection_cb+0x191/0x2b0 [ 105.661796][ T5770] l2cap_connect_cfm+0x375/0x1070 [ 105.666808][ T5770] hci_connect_cfm+0x8f/0x130 [ 105.671481][ T5770] le_conn_complete_evt+0xfdc/0x1540 [ 105.677018][ T5770] hci_le_conn_complete_evt+0x187/0x440 [ 105.682580][ T5770] hci_event_packet+0x7ba/0x1270 [ 105.687520][ T5770] hci_rx_work+0x43a/0xd60 [ 105.691926][ T5770] process_scheduled_works+0xa5d/0x15d0 [ 105.697466][ T5770] worker_thread+0xa55/0xfc0 [ 105.702061][ T5770] kthread+0x2fa/0x390 [ 105.706121][ T5770] ret_from_fork+0x48/0x80 [ 105.710529][ T5770] ret_from_fork_asm+0x11/0x20 [ 105.715291][ T5770] [ 105.717601][ T5770] Freed by task 6343: [ 105.721562][ T5770] kasan_set_track+0x4e/0x70 [ 105.726148][ T5770] kasan_save_free_info+0x2e/0x50 [ 105.731165][ T5770] ____kasan_slab_free+0x126/0x1e0 [ 105.736266][ T5770] slab_free_freelist_hook+0x130/0x1a0 [ 105.741710][ T5770] __kmem_cache_free+0xba/0x1e0 [ 105.746574][ T5770] l2cap_sock_destruct+0x97/0x280 [ 105.751603][ T5770] __sk_destruct+0x83/0x660 [ 105.756120][ T5770] l2cap_sock_cleanup_listen+0x1d9/0x520 [ 105.761758][ T5770] l2cap_sock_release+0x6a/0x1e0 [ 105.766700][ T5770] sock_close+0xbd/0x230 [ 105.770956][ T5770] __fput+0x234/0x970 [ 105.774963][ T5770] task_work_run+0x1d4/0x260 [ 105.779562][ T5770] exit_to_user_mode_loop+0xe6/0x110 [ 105.784855][ T5770] exit_to_user_mode_prepare+0xee/0x180 [ 105.790402][ T5770] syscall_exit_to_user_mode+0x1a/0x50 [ 105.795862][ T5770] do_syscall_64+0x61/0xb0 [ 105.800270][ T5770] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 105.806248][ T5770] [ 105.808561][ T5770] Last potentially related work creation: [ 105.814264][ T5770] kasan_save_stack+0x3e/0x60 [ 105.818960][ T5770] __kasan_record_aux_stack+0xaf/0xc0 [ 105.824327][ T5770] call_rcu+0x153/0x950 [ 105.828477][ T5770] netlink_release+0x1702/0x1ad0 [ 105.833403][ T5770] sock_close+0xbd/0x230 [ 105.837646][ T5770] __fput+0x234/0x970 [ 105.841612][ T5770] task_work_run+0x1d4/0x260 [ 105.846199][ T5770] do_exit+0x95a/0x2460 [ 105.850347][ T5770] do_group_exit+0x21b/0x2d0 [ 105.855627][ T5770] __x64_sys_exit_group+0x3f/0x40 [ 105.860644][ T5770] do_syscall_64+0x55/0xb0 [ 105.865054][ T5770] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 105.870942][ T5770] [ 105.873254][ T5770] The buggy address belongs to the object at ffff888023bda000 [ 105.873254][ T5770] which belongs to the cache kmalloc-2k of size 2048 [ 105.887295][ T5770] The buggy address is located 1152 bytes inside of [ 105.887295][ T5770] freed 2048-byte region [ffff888023bda000, ffff888023bda800) [ 105.901253][ T5770] [ 105.903567][ T5770] The buggy address belongs to the physical page: [ 105.909981][ T5770] page:ffffea00008ef600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x23bd8 [ 105.920124][ T5770] head:ffffea00008ef600 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 105.929051][ T5770] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 105.937061][ T5770] page_type: 0xffffffff() [ 105.941393][ T5770] raw: 00fff00000000840 ffff888017c42000 dead000000000100 dead000000000122 [ 105.949983][ T5770] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 105.958556][ T5770] page dumped because: kasan: bad access detected [ 105.964971][ T5770] page_owner tracks the page as allocated [ 105.970673][ T5770] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 49, tgid 49 (kworker/u4:3), ts 6495370976, free_ts 0 [ 105.990720][ T5770] post_alloc_hook+0x1c1/0x200 [ 105.995487][ T5770] get_page_from_freelist+0x1951/0x19e0 [ 106.001022][ T5770] __alloc_pages+0x1f0/0x460 [ 106.005694][ T5770] alloc_slab_page+0x5d/0x160 [ 106.010361][ T5770] new_slab+0x87/0x2d0 [ 106.014428][ T5770] ___slab_alloc+0xc5d/0x12f0 [ 106.019108][ T5770] __kmem_cache_alloc_node+0x19e/0x250 [ 106.024607][ T5770] __kmalloc+0xa4/0x230 [ 106.028772][ T5770] scsi_alloc_target+0x139/0xbd0 [ 106.033705][ T5770] __scsi_scan_target+0x16c/0x10a0 [ 106.038830][ T5770] scsi_scan_host_selected+0x372/0x690 [ 106.044281][ T5770] do_scan_async+0x11e/0x750 [ 106.048858][ T5770] async_run_entry_fn+0xa3/0x3e0 [ 106.053790][ T5770] process_scheduled_works+0xa5d/0x15d0 [ 106.059325][ T5770] worker_thread+0xa55/0xfc0 [ 106.063906][ T5770] kthread+0x2fa/0x390 [ 106.067964][ T5770] page_owner free stack trace missing [ 106.073320][ T5770] [ 106.075630][ T5770] Memory state around the buggy address: [ 106.081247][ T5770] ffff888023bda380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 106.089308][ T5770] ffff888023bda400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 106.097355][ T5770] >ffff888023bda480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 106.105399][ T5770] ^ [ 106.109456][ T5770] ffff888023bda500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 106.117518][ T5770] ffff888023bda580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 106.125586][ T5770] ================================================================== [ 106.377887][ T5770] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 106.385122][ T5770] CPU: 0 PID: 5770 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 106.392668][ T5770] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 106.402730][ T5770] Workqueue: hci0 hci_rx_work [ 106.407422][ T5770] Call Trace: [ 106.410702][ T5770] [ 106.413635][ T5770] dump_stack_lvl+0x18c/0x250 [ 106.418324][ T5770] ? show_regs_print_info+0x20/0x20 [ 106.423533][ T5770] ? load_image+0x420/0x420 [ 106.428047][ T5770] panic+0x2dc/0x730 [ 106.431963][ T5770] ? bpf_jit_dump+0xd0/0xd0 [ 106.436475][ T5770] ? l2cap_connect_cfm+0x6df/0x1070 [ 106.441677][ T5770] ? check_panic_on_warn+0x70/0xa0 [ 106.446798][ T5770] ? l2cap_connect_cfm+0x6df/0x1070 [ 106.451999][ T5770] check_panic_on_warn+0x84/0xa0 [ 106.456945][ T5770] ? l2cap_connect_cfm+0x6df/0x1070 [ 106.462146][ T5770] end_report+0x6f/0x130 [ 106.466401][ T5770] kasan_report+0x128/0x150 [ 106.470910][ T5770] ? l2cap_connect_cfm+0x6df/0x1070 [ 106.476112][ T5770] l2cap_connect_cfm+0x6df/0x1070 [ 106.481141][ T5770] ? l2cap_ertm_resend+0x1040/0x1040 [ 106.486430][ T5770] ? l2cap_ertm_resend+0x1040/0x1040 [ 106.491718][ T5770] hci_connect_cfm+0x8f/0x130 [ 106.496403][ T5770] le_conn_complete_evt+0xfdc/0x1540 [ 106.501693][ T5770] ? hci_event_packet+0x4cb/0x1270 [ 106.506819][ T5770] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 106.513068][ T5770] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 106.518707][ T5770] ? skb_pull_data+0xfb/0x200 [ 106.523395][ T5770] hci_le_conn_complete_evt+0x187/0x440 [ 106.528954][ T5770] ? hci_remote_host_features_evt+0x150/0x150 [ 106.535033][ T5770] hci_event_packet+0x7ba/0x1270 [ 106.539987][ T5770] ? bis_list+0x290/0x290 [ 106.544332][ T5770] ? lockdep_hardirqs_on+0x98/0x150 [ 106.549541][ T5770] ? hci_send_to_monitor+0xd7/0x4f0 [ 106.554747][ T5770] hci_rx_work+0x43a/0xd60 [ 106.559173][ T5770] ? process_scheduled_works+0x96f/0x15d0 [ 106.564899][ T5770] process_scheduled_works+0xa5d/0x15d0 [ 106.570436][ T5770] ? worker_attach_to_pool+0x380/0x380 [ 106.575912][ T5770] ? assign_work+0x3d2/0x5d0 [ 106.580529][ T5770] worker_thread+0xa55/0xfc0 [ 106.585122][ T5770] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 106.591010][ T5770] ? _raw_spin_unlock+0x40/0x40 [ 106.595866][ T5770] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 106.601783][ T5770] kthread+0x2fa/0x390 [ 106.605878][ T5770] ? pr_cont_work+0x560/0x560 [ 106.610553][ T5770] ? kthread_blkcg+0xd0/0xd0 [ 106.615140][ T5770] ret_from_fork+0x48/0x80 [ 106.619553][ T5770] ? kthread_blkcg+0xd0/0xd0 [ 106.624138][ T5770] ret_from_fork_asm+0x11/0x20 [ 106.628929][ T5770] [ 106.632214][ T5770] Kernel Offset: disabled [ 106.636529][ T5770] Rebooting in 86400 seconds..