last executing test programs: 4m7.063620794s ago: executing program 1 (id=8): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f00000003c0)=[@in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}], 0x10) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000280)=0x3, 0x4) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f00000000c0), 0x4) 4m6.113800553s ago: executing program 1 (id=11): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x40ead000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x66) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x9, 0x2) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 4m4.645340422s ago: executing program 1 (id=19): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) 4m4.233402616s ago: executing program 1 (id=21): syz_mount_image$udf(&(0x7f0000000000), &(0x7f0000000500)='./file2\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="00089aafc727346c3e0d8728525a2641b3b31621730c58dcf8e0ca2e6767a45a978776e9d2c689feab83a160d00a77ae5112cd4e7141cad333d7cbb69dc6b314609d3827059c11066ba0b4b95c12d2d9ff9c8896d9e247bd55f9ff578a14e0e9d0ca07693396b00d2ef44adb4858475a07d5e8fa3ef5b306fe8a5d1cd2d8e06e7f88226ece092c6aabf8870e140124d5a48670513e0c419c99b7c5105959e7a535f12694634cf272490e0000"], 0x81, 0x4ac, &(0x7f00000011c0)="$eJzs20tsG1UXwPFzPLbruPk+3Adpi6piCSRCS9skLmmrIKE8iEBqG0gaEBUPhdgJJk4cxSkkVUu7BHYsumTJlgUrxBZVYolYoCDUXemGjVeUHeiO52XXSewm8TT1/1e1dx7H7r33zMy914kFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIDL022NOrYdcCAAC00qWJ8Z4M4z8AAG3lMut/AACAdqJiyR+icnKurBft/YrEhfzC1ZXJkdH6L+tQUYmIZcebv4nevsyZl/vPnnPLjV+/3Y7I2MTlwfRwcX5xKVcq5bLpyYX8dDGba/gdtvr6WsftDkjPz13NzsyU0n2nMlWnV1L39+ztSg30vz8cd2MnR0ZHJwIx0dgj/+8PWW+GHxdLXhSVT374Ti+JSES23hebXDs7rcNuxHG7EZMjo3ZDCvmphWVzUiNOVKS6T+JuH7UgF1sSETH10vj2rNliYsmPojJ0uqxjImK5/XDC/mC4ofqEIWqWriLSLbsgZ4+xPWLJh6Jy53RK3nT61c5/XOR62JXDjos6939Ry/qW/Tww95N5bF54O/3GwkwxEKsR545qZnyocw+GPj600mP+bEqIJWP2HV/W8bArg5brEEvmRSX+9af2vELseelTA2ePPXs+OMM4tMn7mNhTzs3VyJgcc6YOGjF/HqHa2BYJteRPUXnwe8Le73Zyw08E2oRaUhCVf26UVWvWpVZgfe/Z7WvDna1/R2K4uLi6lJ/9eLnu+WRi8KPS8tLUdP3TlbWrFTyy2Tq2VqS5JVlSKyu+Lz4re69z1gD/q+z5tfn2un8tdNeUruD108h2w8+ZJuZRpk6qltwTlZkPDlfGGUk23TftwOR/VFRK5V/UzbST/2hlL5D/V/z+S2h16bFz+//K51ruXOLIlYPrHd+J/Js6mfy/KypDfx92PtOo5N+qiTVxXaLy3u2jTlwkbuKibnMq7ziTL+R6TOy/orL/ZzdW7NikE3vAj+01sSVR+fJOdexeJ/agH9tnYtdE5e5v9WOf9mMzJnbV5Otu2o1NmthjTmyXH3tquljIbtatJv99ovLOzdfVbfO6+Q/c/7dqSs9DOd94e7vynwocu+Xk9YqT/+gm+f9KVFb/Ouq22+5797LaZ//r59/Mlb+/XR3rTkb3+7G9jTYrbCb/+0Tl/qtrXpudtjm7foaC+X8mWl16/RpS/vcFjqWcesWb7It2VFq9NjdVKOSW2GCDDTa8jbCfTGgFM/6Pm1G931J3HuOM/52VPX/G9OBzf/wfqCk9IY3/+wPHBpxZSywqklieX4wdEkmUVq+dzM9PzeZmcwuZM/09fefP9GTOxeLu5M7farjvngQm/ydE5cZPv3rrmOr5X/35f7Km9ISU/wPBNlXNaxruirZk8t8pKv331rz15kbzf3f93/1cdendfyHl/2DgWMqpV2eTfQEAAAAAAAAAAAAAAAAAu0lSLXleVFbGX1L3O0SN/P5ftqb0hPT7X12BY9nt/16D+9WoqlONVh0AAAAAAAAAAKCVImLJN6LygpT1pjnQKXIxWOKJ9l8AAAD//16uQhc=") mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x1204001, &(0x7f0000020240)={[{@lowerdir={'lowerdir', 0x3d, '.'}, 0x3a}], [], 0x2f}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x80) getdents64(r0, &(0x7f0000000000)=""/39, 0x27) 4m3.557460676s ago: executing program 1 (id=25): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x64, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2, 0x0, 0x10}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x64}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x58, 0x0, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x2}, [@CTA_SYNPROXY={0x4}, @CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_SEQ_ADJ_ORIG={0x1c, 0xf, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x2}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x9738}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x7ff}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4004881}, 0x20008820) 4m2.765745928s ago: executing program 1 (id=31): unshare(0x6a040000) syz_usb_connect(0x5, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x6c, 0x4, 0x2b, 0x20, 0x1f71, 0x3306, 0x1b23, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0xfd, 0xe0, 0x0, [{{0x9, 0x4, 0xd1, 0x5, 0x0, 0xa0, 0xee, 0xd8, 0x2}}]}}]}}, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, &(0x7f0000000040)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108) 4m2.378228361s ago: executing program 32 (id=31): unshare(0x6a040000) syz_usb_connect(0x5, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x6c, 0x4, 0x2b, 0x20, 0x1f71, 0x3306, 0x1b23, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0xfd, 0xe0, 0x0, [{{0x9, 0x4, 0xd1, 0x5, 0x0, 0xa0, 0xee, 0xd8, 0x2}}]}}]}}, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, &(0x7f0000000040)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108) 2m32.00070634s ago: executing program 3 (id=757): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000640)='\xf0\x891\xb8R\xe6\x8d\x12\xe5\xe3+\xcd24\x01\x80\x1a\xc9A\x93\xb1@\xbf\x89K\xd0\x86\xd9\x86\x18\xc4:\xc3\xe0\xac\xed~\x97\a\xbe\xfb1d\xbe\xa1\xc1N\xd2p\xf0\xc6\xf3\x8eD\x1b\xc7q\x99?9\xf1\xe6\f\xa9\x90\xec:\x037\xe8\x0f\rX6\xf2\x88\x8d\r\xd2\xfc+\x19\x9a}\x9c\xd9\x1a\xef\xf1\x16d>ah\xa2\xa7\x02U\x06\xe1\xe1PY\x90\x17\xf0p\x01*!I\xd3$\xd00C\x88*NA\xc3\x95`\xb2\xf1\xb1\xed\x91\xe4\x87\xcf_9\x1eIpAfN\x99\xa9\v)\x98p\xea[\xc5&D\xe7\xf3\xba/\xcd\xdb\x9dz\xb2\xbf\xc6\xea?\x13(\x15\xc1\tm\xe7t,[\x14|bM\xfa\xeb\x91\xb0\xdfAR\xf3\xe2\xdf', &(0x7f00000007c0)='{\xe0e%m\"\x92\xb5\xcb\x00\x01\x0e!5\xd8\xf2\x92\x97\x86\xf9\xa8\xe7;\xdff3\x83\xb1a\xf2j\t\x7f??,\xd9\xe28\xae\xd6>\xbaN\x1d_N\xcbdIP2$\xbc\xc9\x89\xb5\n\x90-i%\xe2\x94\fH\xf1\xed\r\b\x1c\x81>\t\xc30-\xe2\xb3\xb00x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = eventfd2(0x9, 0x80000) io_submit(r0, 0x1, &(0x7f00000002c0)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r1, 0x0, 0x0, 0x0, 0x0, 0x3, r2}]) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000000040)=0x9, 0x4) 3.822286367s ago: executing program 7 (id=2303): r0 = syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)="180c4552", 0x4) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000208, 0x0, 0x0, 0x2, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000020000ffffffffff00", "2809e8dbe108598948224ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac00", "90be8b1c55080000000c547d03d8a0f4bd00", [0x0, 0x6]}}) 3.725748329s ago: executing program 2 (id=2304): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$int_in(r0, 0x5452, &(0x7f0000000280)=0x3a0af83a) shutdown(r0, 0x1) listen(r0, 0x20) shutdown(r0, 0x0) 3.644790297s ago: executing program 2 (id=2306): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x4c, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x4c}}, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)={0x5c, 0x9, 0x6, 0x801, 0x0, 0x0, {0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0xe1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x88}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e22}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) 3.368143227s ago: executing program 7 (id=2310): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000004, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) getsockopt$inet_tcp_int(r0, 0x6, 0x2, 0x0, &(0x7f00000002c0)) 3.021207075s ago: executing program 35 (id=2310): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000004, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) getsockopt$inet_tcp_int(r0, 0x6, 0x2, 0x0, &(0x7f00000002c0)) 2.733534105s ago: executing program 4 (id=2318): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014751c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a0c93d47018c12e7ba8188a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab188dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b4896c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e547f7ad33850d9feccd0111a2e3700845dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005202000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a12489c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af14915f29b719f54926fc32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86ae826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa520000afe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da357f9e93ce055019c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c672b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981fd9086e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2826b47ad8ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b478abc5b196dd5308cb20c4e2a0bd702651bb39f10523102dcd8ece692159028f314e0d6bfa400475c6699fdc40efe0948e3cef7419a7f113134e5ee20fd87c4521ccfbd32d6f147f743d30866bdd86ca8bf0c7bcc475f4ed53517aaa51f1c151d859a7f0b53abd332c84bdad313e82ac3777a6f7f649ff8a25f6dfe09cb29213896b49a825257bf143e9fa3bbd47009e66fe5705b3ef2b40a182e408c680727d64e00e1ce508f8fd64ac6c84ccc28fc333067de63b9bb5daaa12ce60ee3779ded79651be69d2a413cd948a873dd7ad7017b150828cf100d3df8537f22aff58343c9ee966fceb594bbe10b911427f76a25a219be2f85287b7f83d323a30991067ad1369792166062085ff20c5fb9f6e4f78dd09c7d2d6ca3c8a5d0d26ccbe576f44a1bc94194817"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000180)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x6, 0x9, 0x0, 0x10001}]}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e088641100050e72210283ac141440e0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) 2.627546893s ago: executing program 6 (id=2320): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0xb8) syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000740)='./bus\x00', 0x283016, 0x0, 0x11, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000a80)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@nfs_export_on}, {@uuid_off}]}) unlinkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0x200) 2.521439679s ago: executing program 4 (id=2321): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x3) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000080)={0x2, &(0x7f0000000100)=[{0x48, 0xff, 0x0, 0xffeffffe}, {0x6, 0x60, 0x0, 0x8}]}) write$ppp(r0, &(0x7f0000000300)="5af9", 0x2) 2.256325813s ago: executing program 6 (id=2322): r0 = syz_io_uring_setup(0x2f90, &(0x7f0000000180)={0x0, 0xc383, 0x3010, 0x2, 0x200004}, &(0x7f0000000100), &(0x7f0000000140)) r1 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) read$midi(r1, 0x0, 0x43) r2 = epoll_create(0xaf2) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f00000004c0)={0xe000200b}) 2.086420237s ago: executing program 4 (id=2324): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000380)={[{@noauto_da_alloc}]}, 0x1, 0x4bc, &(0x7f0000000a40)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x181242, 0x148) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x1) ioctl$FS_IOC_FSSETXATTR(r1, 0x40086602, &(0x7f0000000000)={0x20052f9, 0xfffffff8, 0x100802, 0x2, 0x8}) pwrite64(r0, 0x0, 0x0, 0xfecc) 1.79351968s ago: executing program 2 (id=2326): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000480), 0xc0041, 0x0) r1 = epoll_create(0x80f04) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000300)) ioctl$FS_IOC_GETFLAGS(r0, 0x5437, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x40801, 0x0) 1.696370381s ago: executing program 4 (id=2327): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, &(0x7f0000000000)={@remote, @multicast1, 0x4, "d30f388c52647612d91de4353d68b0fa00", 0x0, 0x0, 0x4000000, 0x8}, 0x3c) setsockopt$MRT_ADD_MFC(r0, 0x0, 0xcc, &(0x7f0000000280)={@broadcast, @multicast1, 0x0, "7ea97ddb2ac127ffa5b7216fe75ebaa2855a422a8bf8ec7caf003751804500", 0x0, 0x0, 0x4, 0xfffffffe}, 0x3c) setsockopt$MRT_ADD_MFC(r0, 0x0, 0xcc, &(0x7f0000000180)={@private=0xa010102, @multicast2, 0x0, "941621a61c5815f4678d8fd403f2f30229a88d74d71fd55708016d20fd419884", 0x0, 0x1}, 0x3c) setsockopt$MRT_FLUSH(r0, 0x0, 0xd4, &(0x7f00000001c0)=0x2, 0x4) 1.64366184s ago: executing program 2 (id=2328): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000100), 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) ioctl$TCSETSW2(r0, 0x402c542c, &(0x7f00000000c0)={0xfffffff8, 0x0, 0xfffbfffd, 0xffffffff, 0x47, "044191f19dd026d76d7fcb367800", 0x4, 0x200}) 1.227043739s ago: executing program 6 (id=2330): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ptrace(0x10, r0) ptrace$peeksig(0x4209, r0, &(0x7f0000000140)={0x0, 0x0, 0x4e}, &(0x7f0000000fc0)) 821.68384ms ago: executing program 0 (id=2332): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='dctcp', 0x5) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000a40)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2f}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0xefff}}}}}}}, 0x0) 799.52816ms ago: executing program 0 (id=2333): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x70}, 0x1, 0x0, 0x0, 0x4000080}, 0x20048004) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="480000001000ffff28bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000299605002800128009000100626f6e640000000018000280140008800800070005"], 0x48}, 0x1, 0x0, 0x0, 0x40060880}, 0x240400c0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000080}, 0x4008000) 689.708219ms ago: executing program 2 (id=2334): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0xfd, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000200)={0x9, 0x200, 0x5, 0xa1, r2}, 0x10) 551.371717ms ago: executing program 4 (id=2335): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(0xffffffffffffffff, &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='map_files\x00') fchdir(r1) sendmmsg$unix(r0, &(0x7f0000000d40)=[{{&(0x7f0000000080)=@abs={0x1, 0x30, 0x30}, 0x6e, 0x0}}], 0x1, 0x0) 460.713316ms ago: executing program 0 (id=2336): pipe(&(0x7f0000000040)) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000002340), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000022c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x6000}}, 0x0, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000002440)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 444.091903ms ago: executing program 4 (id=2337): syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000280)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_connect(0x1, 0x4a, &(0x7f0000000300)={{0x12, 0x1, 0x300, 0x87, 0x1e, 0xb5, 0x10, 0xbb4, 0xa1b, 0x6c7b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x38, 0x1, 0x0, 0x10, 0x20, 0x9, [{{0x9, 0x4, 0xa, 0x4, 0x3, 0x5e, 0x82, 0x2e, 0x0, [], [{{0x9, 0x5, 0x7, 0x2, 0x200, 0x4, 0x4, 0xfc, [@generic={0x4, 0xf, "3ff8"}]}}, {{0x9, 0x5, 0xb, 0x0, 0x400, 0x2, 0x7, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x9, 0x7}]}}, {{0x9, 0x5, 0x9, 0x0, 0x10, 0x40, 0xf, 0x4}}]}}]}}]}}, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000180)={'batadv0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000340)="600088a8", 0x5dc, 0x14008b00, &(0x7f0000000200)={0x11, 0x86dd, r1, 0x1, 0x97, 0x6, @multicast}, 0x14) 317.643756ms ago: executing program 0 (id=2338): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x24000000}, 0x404c850) r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000080)={{0x9, 0x0, 0x2000000, 0x80, 'syz0\x00', 0x1}, 0x3, 0x10, 0x2, 0x0, 0x0, 0x8, 'syz1\x00', 0x0}) 299.295397ms ago: executing program 0 (id=2339): write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000fdff00000000000000000000180900000020702500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0xe, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='io_uring_register\x00', r0}, 0x18) r1 = io_uring_setup(0x456, &(0x7f00000000c0)={0x0, 0x3, 0x1000, 0x1004003, 0x3c}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r1, 0x18, &(0x7f0000000000), 0x1) 282.818178ms ago: executing program 6 (id=2340): sigaltstack(&(0x7f0000000480)={&(0x7f0000004000)=""/4126, 0x80000001, 0x101e}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 212.726307ms ago: executing program 0 (id=2341): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="12010000000000408c0d220000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000740)={0x2c, &(0x7f0000000980)=ANY=[@ANYBLOB="00000001"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x40) ioctl$HIDIOCGREPORTINFO(r1, 0xc00c4809, &(0x7f0000000500)={0x3, 0x1, 0x401}) 29.644007ms ago: executing program 6 (id=2342): r0 = timerfd_create(0x0, 0x0) r1 = syz_io_uring_setup(0x58f7, &(0x7f0000000880)={0x0, 0x0, 0x10100, 0x0, 0x104a}, &(0x7f00000001c0)=0x0, &(0x7f0000000240)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r0, 0x0, &(0x7f0000002280)=""/4102, 0x1006, 0x1a}) timerfd_settime(r0, 0x3, &(0x7f0000000840)={{0x77359400}, {0x0, 0x3938700}}, 0x0) io_uring_enter(r1, 0x1f82, 0x0, 0x0, 0x0, 0x0) 0s ago: executing program 6 (id=2343): syz_io_uring_setup(0x499, &(0x7f00000004c0)={0x0, 0x3351, 0x8, 0xffffffff, 0x333}, &(0x7f0000000440)=0x0, &(0x7f0000000480)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r0, r1, &(0x7f00000002c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x4084c1, 0x23456}) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$char_usb(r2, &(0x7f0000000080)=""/139, 0x8b) kernel console output (not intermixed with test programs): er 1th superblock, ret: 0 [ 246.035477][T10324] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e4 [ 246.181460][T10338] ntfs3(loop6): Mark volume as dirty due to NTFS errors [ 246.237036][ T5868] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 246.253900][T10338] ntfs3(loop6): Failed to load $Extend (-22). [ 246.277521][T10338] ntfs3(loop6): Failed to initialize $Extend. [ 246.372269][ T30] audit: type=1800 audit(1761161491.983:45): pid=10338 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.1336" name="file1" dev="loop6" ino=30 res=0 errno=0 [ 246.417541][ T5868] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 246.433207][ T5868] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 246.447864][ T5868] usb 3-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 246.466676][ T5868] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 246.474688][ T5868] usb 3-1: Product: syz [ 246.486876][ T5868] usb 3-1: Manufacturer: syz [ 246.491510][ T5868] usb 3-1: SerialNumber: syz [ 246.545968][ T5868] usb 3-1: config 0 descriptor?? [ 246.560950][T10345] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 246.578760][T10345] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 246.821616][T10345] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 246.937037][T10345] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 247.366126][ T5868] dm9601: No valid MAC address in EEPROM, using 00:00:00:00:00:00 [ 247.595331][T10372] loop6: detected capacity change from 0 to 40427 [ 247.633130][T10372] F2FS-fs (loop6): invalid crc value [ 247.780837][ T5868] dm9601 3-1:0.0 (unnamed net_device) (uninitialized): Error reading chip ID [ 247.834972][ T5868] usb 3-1: USB disconnect, device number 12 [ 247.849033][T10372] F2FS-fs (loop6): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 247.850767][ T5836] udevd[5836]: failed to send result of seq 16467 to main daemon: Connection refused [ 247.889151][T10372] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 248.049813][ T8581] syz-executor: attempt to access beyond end of device [ 248.049813][ T8581] loop6: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 248.077140][ T8581] CPU: 1 UID: 0 PID: 8581 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 248.077165][ T8581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 248.077185][ T8581] Call Trace: [ 248.077192][ T8581] [ 248.077200][ T8581] dump_stack_lvl+0x189/0x250 [ 248.077233][ T8581] ? __pfx_dump_stack_lvl+0x10/0x10 [ 248.077257][ T8581] ? __pfx_queue_work_on+0x10/0x10 [ 248.077276][ T8581] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 248.077297][ T8581] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 248.077330][ T8581] f2fs_handle_critical_error+0x37c/0x540 [ 248.077362][ T8581] f2fs_write_end_io+0x886/0xb60 [ 248.077401][ T8581] __submit_merged_bio+0x27a/0x6a0 [ 248.077432][ T8581] __submit_merged_write_cond+0x255/0x530 [ 248.077470][ T8581] f2fs_write_data_pages+0x261d/0x3000 [ 248.077537][ T8581] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 248.077577][ T8581] ? is_bpf_text_address+0x292/0x2b0 [ 248.077633][ T8581] ? __mod_zone_page_state+0xd7/0x140 [ 248.077663][ T8581] ? folios_put_refs+0x58b/0x670 [ 248.077701][ T8581] ? __lock_acquire+0xab9/0xd20 [ 248.077731][ T8581] ? do_raw_spin_lock+0x121/0x290 [ 248.077768][ T8581] ? do_raw_spin_unlock+0x122/0x240 [ 248.077791][ T8581] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 248.077817][ T8581] do_writepages+0x32e/0x550 [ 248.077855][ T8581] ? do_raw_spin_unlock+0x122/0x240 [ 248.077885][ T8581] filemap_fdatawrite+0x199/0x240 [ 248.077911][ T8581] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 248.077993][ T8581] ? do_raw_spin_unlock+0x122/0x240 [ 248.078023][ T8581] f2fs_sync_dirty_inodes+0x31f/0x830 [ 248.078059][ T8581] f2fs_write_checkpoint+0x93e/0x2440 [ 248.078076][ T8581] ? __lock_acquire+0xab9/0xd20 [ 248.078127][ T8581] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 248.078205][ T8581] kill_f2fs_super+0x2cc/0x6d0 [ 248.078231][ T8581] ? __pfx_kill_f2fs_super+0x10/0x10 [ 248.078271][ T8581] ? shrinker_free+0x2ce/0x3e0 [ 248.078296][ T8581] deactivate_locked_super+0xbc/0x130 [ 248.078320][ T8581] cleanup_mnt+0x425/0x4c0 [ 248.078338][ T8581] ? lockdep_hardirqs_on+0x9c/0x150 [ 248.078362][ T8581] task_work_run+0x1d4/0x260 [ 248.078384][ T8581] ? __pfx_task_work_run+0x10/0x10 [ 248.078397][ T8581] ? __x64_sys_umount+0x122/0x160 [ 248.078423][ T8581] ? exit_to_user_mode_loop+0x40/0x130 [ 248.078452][ T8581] exit_to_user_mode_loop+0xe9/0x130 [ 248.078471][ T8581] do_syscall_64+0x2bd/0xfa0 [ 248.078489][ T8581] ? lockdep_hardirqs_on+0x9c/0x150 [ 248.078508][ T8581] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 248.078525][ T8581] ? clear_bhb_loop+0x60/0xb0 [ 248.078547][ T8581] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 248.078564][ T8581] RIP: 0033:0x7fe3d91902f7 [ 248.078581][ T8581] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 248.078595][ T8581] RSP: 002b:00007fff26058508 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 248.078615][ T8581] RAX: 0000000000000000 RBX: 00007fe3d9211d7d RCX: 00007fe3d91902f7 [ 248.078627][ T8581] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff260585c0 [ 248.078638][ T8581] RBP: 00007fff260585c0 R08: 0000000000000000 R09: 0000000000000000 [ 248.078649][ T8581] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff26059650 [ 248.078661][ T8581] R13: 00007fe3d9211d7d R14: 000000000003c8c1 R15: 00007fff26059690 [ 248.078697][ T8581] [ 248.078705][ T8581] F2FS-fs (loop6): Stopped filesystem due to reason: 3 [ 248.089563][T10395] loop7: detected capacity change from 0 to 2048 [ 248.120663][ T8581] CPU: 1 UID: 0 PID: 8581 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 248.120686][ T8581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 248.120696][ T8581] Call Trace: [ 248.120703][ T8581] [ 248.120711][ T8581] dump_stack_lvl+0x189/0x250 [ 248.120742][ T8581] ? __pfx_dump_stack_lvl+0x10/0x10 [ 248.120765][ T8581] ? __pfx_queue_work_on+0x10/0x10 [ 248.120784][ T8581] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 248.120804][ T8581] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 248.120836][ T8581] f2fs_handle_critical_error+0x37c/0x540 [ 248.120866][ T8581] f2fs_write_end_io+0x886/0xb60 [ 248.120907][ T8581] __submit_merged_bio+0x27a/0x6a0 [ 248.120937][ T8581] __submit_merged_write_cond+0x255/0x530 [ 248.120967][ T8581] f2fs_write_data_pages+0x261d/0x3000 [ 248.121046][ T8581] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 248.121086][ T8581] ? is_bpf_text_address+0x292/0x2b0 [ 248.121139][ T8581] ? __mod_zone_page_state+0xd7/0x140 [ 248.121169][ T8581] ? folios_put_refs+0x58b/0x670 [ 248.121204][ T8581] ? __lock_acquire+0xab9/0xd20 [ 248.121246][ T8581] ? do_raw_spin_lock+0x121/0x290 [ 248.121283][ T8581] ? do_raw_spin_unlock+0x122/0x240 [ 248.121311][ T8581] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 248.121335][ T8581] do_writepages+0x32e/0x550 [ 248.121372][ T8581] ? do_raw_spin_unlock+0x122/0x240 [ 248.121400][ T8581] filemap_fdatawrite+0x199/0x240 [ 248.121424][ T8581] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 248.121510][ T8581] ? do_raw_spin_unlock+0x122/0x240 [ 248.121537][ T8581] f2fs_sync_dirty_inodes+0x31f/0x830 [ 248.121571][ T8581] f2fs_write_checkpoint+0x93e/0x2440 [ 248.121588][ T8581] ? __lock_acquire+0xab9/0xd20 [ 248.121638][ T8581] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 248.121721][ T8581] kill_f2fs_super+0x2cc/0x6d0 [ 248.121745][ T8581] ? __pfx_kill_f2fs_super+0x10/0x10 [ 248.121783][ T8581] ? shrinker_free+0x2ce/0x3e0 [ 248.121807][ T8581] deactivate_locked_super+0xbc/0x130 [ 248.121829][ T8581] cleanup_mnt+0x425/0x4c0 [ 248.121847][ T8581] ? lockdep_hardirqs_on+0x9c/0x150 [ 248.121870][ T8581] task_work_run+0x1d4/0x260 [ 248.121890][ T8581] ? __pfx_task_work_run+0x10/0x10 [ 248.121903][ T8581] ? __x64_sys_umount+0x122/0x160 [ 248.121928][ T8581] ? exit_to_user_mode_loop+0x40/0x130 [ 248.121951][ T8581] exit_to_user_mode_loop+0xe9/0x130 [ 248.121970][ T8581] do_syscall_64+0x2bd/0xfa0 [ 248.121987][ T8581] ? lockdep_hardirqs_on+0x9c/0x150 [ 248.122005][ T8581] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 248.122021][ T8581] ? clear_bhb_loop+0x60/0xb0 [ 248.122042][ T8581] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 248.122058][ T8581] RIP: 0033:0x7fe3d91902f7 [ 248.122075][ T8581] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 248.122088][ T8581] RSP: 002b:00007fff26058508 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 248.122106][ T8581] RAX: 0000000000000000 RBX: 00007fe3d9211d7d RCX: 00007fe3d91902f7 [ 248.122118][ T8581] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff260585c0 [ 248.122127][ T8581] RBP: 00007fff260585c0 R08: 0000000000000000 R09: 0000000000000000 [ 248.122137][ T8581] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff26059650 [ 248.122148][ T8581] R13: 00007fe3d9211d7d R14: 000000000003c8c1 R15: 00007fff26059690 [ 248.122183][ T8581] [ 248.123319][ T8581] F2FS-fs (loop6): Stopped filesystem due to reason: 3 [ 248.154817][T10395] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 249.227069][T10422] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 249.358575][T10432] syzkaller1: entered promiscuous mode [ 249.364202][T10432] syzkaller1: entered allmulticast mode [ 249.719102][T10446] loop6: detected capacity change from 0 to 8 [ 249.794367][T10446] SQUASHFS error: xz decompression failed, data probably corrupt [ 249.814082][T10446] SQUASHFS error: Failed to read block 0x108: -5 [ 249.839972][T10446] SQUASHFS error: Unable to read metadata cache entry [106] [ 249.856681][T10446] SQUASHFS error: Unable to read inode 0x11f [ 249.903722][ T5918] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 250.068541][ T5918] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 250.077959][ T5918] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 250.085827][T10437] loop4: detected capacity change from 0 to 32768 [ 250.107939][ T5918] usb 3-1: config 0 descriptor?? [ 250.122999][T10437] [ 250.122999][T10437] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 250.122999][T10437] [ 250.125324][ T5918] cp210x 3-1:0.0: cp210x converter detected [ 250.155193][ T30] audit: type=1800 audit(1761161495.763:46): pid=10437 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1375" name="file1" dev="loop4" ino=4 res=0 errno=0 [ 250.196957][ T30] audit: type=1800 audit(1761161495.793:47): pid=10437 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1375" name="file1" dev="loop4" ino=4 res=0 errno=0 [ 250.200798][T10437] [ 250.200798][T10437] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 250.200798][T10437] [ 250.284119][T10437] [ 250.284119][T10437] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 250.284119][T10437] [ 250.320053][T10437] [ 250.320053][T10437] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 250.320053][T10437] [ 250.340941][T10437] [ 250.340941][T10437] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 250.340941][T10437] [ 250.405713][T10437] [ 250.405713][T10437] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 250.405713][T10437] [ 250.481817][ T5827] [ 250.481817][ T5827] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 250.481817][ T5827] [ 250.508575][ T5827] [ 250.508575][ T5827] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 250.508575][ T5827] [ 250.533010][ T5918] cp210x 3-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 250.576940][ T5918] usb 3-1: cp210x converter now attached to ttyUSB0 [ 250.814028][ T5918] usb 3-1: USB disconnect, device number 13 [ 250.831325][ T5918] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 250.832150][T10462] loop7: detected capacity change from 0 to 1024 [ 250.863022][ T5918] cp210x 3-1:0.0: device disconnected [ 250.904696][T10462] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 250.928249][T10464] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1388'. [ 250.949484][T10464] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1388'. [ 250.990403][T10446] loop6: detected capacity change from 0 to 32768 [ 251.027910][ T9373] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 251.046174][T10446] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 251.084044][T10446] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 251.134977][T10446] gfs2: fsid=syz:syz.0: journal 0 mapped with 3 extents in 0ms [ 251.158249][ T5903] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 251.166484][ T5903] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 251.314238][ T5903] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 147ms [ 251.332272][ T5903] gfs2: fsid=syz:syz.0: jid=0: Done [ 251.350010][T10446] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 251.483642][T10446] gfs2: fsid=syz:syz.0: found 1 quota changes [ 251.739851][T10477] loop7: detected capacity change from 0 to 32768 [ 251.765818][T10477] XFS (loop7): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 251.843963][T10477] XFS (loop7): Ending clean mount [ 251.857150][T10477] XFS (loop7): Quotacheck needed: Please wait. [ 251.950010][T10477] XFS (loop7): Quotacheck: Done. [ 252.038204][ T9373] XFS (loop7): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 252.677435][T10518] loop7: detected capacity change from 0 to 512 [ 252.683824][T10516] Bluetooth: MGMT ver 1.23 [ 252.727834][ T5903] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 252.804609][T10520] netlink: 104 bytes leftover after parsing attributes in process `syz.7.1407'. [ 252.924683][ T5903] usb 7-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 252.957348][ T5903] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.987381][ T5903] usb 7-1: config 0 descriptor?? [ 253.004443][ T5903] cp210x 7-1:0.0: cp210x converter detected [ 253.146990][ T797] usb 3-1: new full-speed USB device number 14 using dummy_hcd [ 253.330439][ T797] usb 3-1: config 0 has an invalid interface number: 128 but max is 0 [ 253.340824][ T797] usb 3-1: config 0 has no interface number 0 [ 253.351224][ T797] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 253.367926][ T797] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.387728][ T797] usb 3-1: Product: syz [ 253.391974][ T797] usb 3-1: Manufacturer: syz [ 253.405638][ T797] usb 3-1: SerialNumber: syz [ 253.410722][ T5903] cp210x 7-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 253.429005][ T797] usb 3-1: config 0 descriptor?? [ 253.441751][ T5903] usb 7-1: cp210x converter now attached to ttyUSB0 [ 253.644128][ T9] usb 7-1: USB disconnect, device number 7 [ 253.653972][ T9] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 253.663685][ T9] cp210x 7-1:0.0: device disconnected [ 253.849328][ T797] usb 3-1: Firmware: major: 0, minor: 0, hardware type: ATUSB (2) [ 253.866729][ T797] usb 3-1: Firmware version (0.0) predates our first public release. [ 253.885058][ T797] usb 3-1: Please update to version 0.2 or newer [ 253.892779][T10559] loop4: detected capacity change from 0 to 32768 [ 253.935555][T10559] ocfs2: Mounting device (7,4) on (node local, slot 0) with writeback data mode. [ 254.134448][ T797] usb 3-1: USB disconnect, device number 14 [ 254.230821][T10565] netlink: 43 bytes leftover after parsing attributes in process `syz.6.1427'. [ 254.263594][T10565] tipc: Started in network mode [ 254.277430][T10565] tipc: Node identity aaaaaaaaaa32, cluster identity 4711 [ 254.304541][T10565] tipc: Enabled bearer , priority 10 [ 254.311626][T10566] ªªªªªª: renamed from vlan0 (while UP) [ 254.345923][T10566] tipc: Disabling bearer [ 254.562756][ T5827] ocfs2: Unmounting device (7,4) on (node local) [ 255.015716][T10578] loop6: detected capacity change from 0 to 32768 [ 255.026555][T10578] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.1433 (10578) [ 255.043110][T10578] BTRFS info (device loop6): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 255.055358][T10578] BTRFS info (device loop6): using sha256 (sha256-lib) checksum algorithm [ 255.096476][T10578] BTRFS info (device loop6): rebuilding free space tree [ 255.107247][ T797] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 255.131982][T10578] BTRFS info (device loop6): disabling free space tree [ 255.139804][T10578] BTRFS info (device loop6): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 255.149540][T10578] BTRFS info (device loop6): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 255.165640][T10578] BTRFS info (device loop6): enabling ssd optimizations [ 255.172754][T10578] BTRFS info (device loop6): turning on sync discard [ 255.180237][T10578] BTRFS info (device loop6): force clearing of disk cache [ 255.187638][T10578] BTRFS info (device loop6): enabling auto defrag [ 255.194124][T10578] BTRFS info (device loop6): max_inline set to 0 [ 255.250791][ T8581] BTRFS info (device loop6): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 255.267300][ T797] usb 3-1: Using ep0 maxpacket: 16 [ 255.275880][ T797] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 255.302510][ T797] usb 3-1: config 0 has no interfaces? [ 255.331770][ T797] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 255.371512][ T797] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.378535][ T5918] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 255.379667][ T797] usb 3-1: Product: syz [ 255.391342][ T797] usb 3-1: Manufacturer: syz [ 255.396127][ T797] usb 3-1: SerialNumber: syz [ 255.424367][ T797] usb 3-1: config 0 descriptor?? [ 255.547034][ T5918] usb 5-1: Using ep0 maxpacket: 8 [ 255.572854][ T5918] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 255.581333][ T5918] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 255.591738][ T5918] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 255.602132][ T5918] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 255.616827][ T5918] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 255.631964][ T5918] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 255.641555][ T5918] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.662040][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.674072][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.710507][ T797] usb 3-1: USB disconnect, device number 15 [ 255.884195][ T5918] usb 5-1: usb_control_msg returned -32 [ 255.891685][ T5918] usbtmc 5-1:16.0: can't read capabilities [ 256.457050][ T52] Bluetooth: hci4: command tx timeout [ 256.698257][ T5918] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 256.861532][ T5918] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 256.861575][ T5918] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 256.868144][ T5918] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 256.868171][ T5918] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.868189][ T5918] usb 3-1: Product: syz [ 256.868202][ T5918] usb 3-1: Manufacturer: syz [ 256.868215][ T5918] usb 3-1: SerialNumber: syz [ 256.874215][ T5918] cdc_mbim 3-1:1.0: skipping garbage [ 257.087225][T10636] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 257.520388][T10656] loop7: detected capacity change from 0 to 40427 [ 257.530033][T10656] F2FS-fs (loop7): build fault injection rate: 771 [ 257.540111][T10656] F2FS-fs (loop7): invalid crc value [ 257.616031][T10656] F2FS-fs (loop7): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 257.628922][T10656] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 257.700816][ T9373] syz-executor: attempt to access beyond end of device [ 257.700816][ T9373] loop7: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 257.700850][T10636] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 257.715371][ T9373] CPU: 1 UID: 0 PID: 9373 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 257.715394][ T9373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 257.715412][ T9373] Call Trace: [ 257.715419][ T9373] [ 257.715426][ T9373] dump_stack_lvl+0x189/0x250 [ 257.715457][ T9373] ? __pfx_dump_stack_lvl+0x10/0x10 [ 257.715480][ T9373] ? __pfx_queue_work_on+0x10/0x10 [ 257.715499][ T9373] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 257.715518][ T9373] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 257.715549][ T9373] f2fs_handle_critical_error+0x37c/0x540 [ 257.715584][ T9373] f2fs_write_end_io+0x886/0xb60 [ 257.715621][ T9373] __submit_merged_bio+0x27a/0x6a0 [ 257.715651][ T9373] __submit_merged_write_cond+0x255/0x530 [ 257.715681][ T9373] f2fs_write_data_pages+0x261d/0x3000 [ 257.715744][ T9373] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 257.715824][ T9373] ? __kernel_text_address+0xd/0x40 [ 257.715863][ T9373] ? __lock_acquire+0xab9/0xd20 [ 257.715892][ T9373] ? do_raw_spin_lock+0x121/0x290 [ 257.715928][ T9373] ? do_raw_spin_unlock+0x122/0x240 [ 257.715950][ T9373] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 257.715975][ T9373] do_writepages+0x32e/0x550 [ 257.716012][ T9373] ? do_raw_spin_unlock+0x122/0x240 [ 257.716040][ T9373] filemap_fdatawrite+0x199/0x240 [ 257.716063][ T9373] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 257.716141][ T9373] ? do_raw_spin_unlock+0x122/0x240 [ 257.716170][ T9373] f2fs_sync_dirty_inodes+0x31f/0x830 [ 257.716203][ T9373] f2fs_write_checkpoint+0x93e/0x2440 [ 257.716218][ T9373] ? stack_depot_save_flags+0x40/0x860 [ 257.716274][ T9373] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 257.716337][ T9373] ? f2fs_stop_gc_thread+0x7f/0xb0 [ 257.716353][ T9373] ? kfree+0x19a/0x6d0 [ 257.716389][ T9373] kill_f2fs_super+0x2cc/0x6d0 [ 257.716418][ T9373] ? __pfx_kill_f2fs_super+0x10/0x10 [ 257.716455][ T9373] ? shrinker_free+0x2ce/0x3e0 [ 257.716480][ T9373] deactivate_locked_super+0xbc/0x130 [ 257.716503][ T9373] cleanup_mnt+0x425/0x4c0 [ 257.716520][ T9373] ? lockdep_hardirqs_on+0x9c/0x150 [ 257.716542][ T9373] task_work_run+0x1d4/0x260 [ 257.716562][ T9373] ? __pfx_task_work_run+0x10/0x10 [ 257.716576][ T9373] ? __x64_sys_umount+0x122/0x160 [ 257.716602][ T9373] ? exit_to_user_mode_loop+0x40/0x130 [ 257.716624][ T9373] exit_to_user_mode_loop+0xe9/0x130 [ 257.716642][ T9373] do_syscall_64+0x2bd/0xfa0 [ 257.716659][ T9373] ? lockdep_hardirqs_on+0x9c/0x150 [ 257.716677][ T9373] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.716693][ T9373] ? clear_bhb_loop+0x60/0xb0 [ 257.716714][ T9373] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.716730][ T9373] RIP: 0033:0x7fc9983902f7 [ 257.716746][ T9373] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 257.716760][ T9373] RSP: 002b:00007ffcbba1cf18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 257.716779][ T9373] RAX: 0000000000000000 RBX: 00007fc998411d7d RCX: 00007fc9983902f7 [ 257.716790][ T9373] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcbba1cfd0 [ 257.716800][ T9373] RBP: 00007ffcbba1cfd0 R08: 0000000000000000 R09: 0000000000000000 [ 257.716811][ T9373] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffcbba1e060 [ 257.716821][ T9373] R13: 00007fc998411d7d R14: 000000000003ee6e R15: 00007ffcbba1e0a0 [ 257.716855][ T9373] [ 257.718829][ T9373] F2FS-fs (loop7): Stopped filesystem due to reason: 3 [ 257.730377][ T5918] cdc_mbim 3-1:1.0: dwNtbInMaxSize=5 is too small. Using 2048 [ 257.758829][ T9373] CPU: 1 UID: 0 PID: 9373 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 257.758852][ T9373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 257.758862][ T9373] Call Trace: [ 257.758869][ T9373] [ 257.758876][ T9373] dump_stack_lvl+0x189/0x250 [ 257.758908][ T9373] ? __pfx_dump_stack_lvl+0x10/0x10 [ 257.758931][ T9373] ? __pfx_queue_work_on+0x10/0x10 [ 257.758949][ T9373] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 257.758969][ T9373] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 257.759000][ T9373] f2fs_handle_critical_error+0x37c/0x540 [ 257.759030][ T9373] f2fs_write_end_io+0x886/0xb60 [ 257.759067][ T9373] __submit_merged_bio+0x27a/0x6a0 [ 257.759097][ T9373] __submit_merged_write_cond+0x255/0x530 [ 257.759128][ T9373] f2fs_write_data_pages+0x261d/0x3000 [ 257.759192][ T9373] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 257.759271][ T9373] ? __kernel_text_address+0xd/0x40 [ 257.759311][ T9373] ? __lock_acquire+0xab9/0xd20 [ 257.759339][ T9373] ? do_raw_spin_lock+0x121/0x290 [ 257.759376][ T9373] ? do_raw_spin_unlock+0x122/0x240 [ 257.759407][ T9373] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 257.759432][ T9373] do_writepages+0x32e/0x550 [ 257.759469][ T9373] ? do_raw_spin_unlock+0x122/0x240 [ 257.759496][ T9373] filemap_fdatawrite+0x199/0x240 [ 257.759520][ T9373] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 257.759598][ T9373] ? do_raw_spin_unlock+0x122/0x240 [ 257.759626][ T9373] f2fs_sync_dirty_inodes+0x31f/0x830 [ 257.759660][ T9373] f2fs_write_checkpoint+0x93e/0x2440 [ 257.759675][ T9373] ? stack_depot_save_flags+0x40/0x860 [ 257.759732][ T9373] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 257.759796][ T9373] ? f2fs_stop_gc_thread+0x7f/0xb0 [ 257.759811][ T9373] ? kfree+0x19a/0x6d0 [ 257.759848][ T9373] kill_f2fs_super+0x2cc/0x6d0 [ 257.759872][ T9373] ? __pfx_kill_f2fs_super+0x10/0x10 [ 257.759909][ T9373] ? shrinker_free+0x2ce/0x3e0 [ 257.759933][ T9373] deactivate_locked_super+0xbc/0x130 [ 257.759955][ T9373] cleanup_mnt+0x425/0x4c0 [ 257.759974][ T9373] ? lockdep_hardirqs_on+0x9c/0x150 [ 257.759996][ T9373] task_work_run+0x1d4/0x260 [ 257.760016][ T9373] ? __pfx_task_work_run+0x10/0x10 [ 257.760029][ T9373] ? __x64_sys_umount+0x122/0x160 [ 257.760054][ T9373] ? exit_to_user_mode_loop+0x40/0x130 [ 257.760077][ T9373] exit_to_user_mode_loop+0xe9/0x130 [ 257.760095][ T9373] do_syscall_64+0x2bd/0xfa0 [ 257.760112][ T9373] ? lockdep_hardirqs_on+0x9c/0x150 [ 257.760130][ T9373] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.760146][ T9373] ? clear_bhb_loop+0x60/0xb0 [ 257.760167][ T9373] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.760183][ T9373] RIP: 0033:0x7fc9983902f7 [ 257.760198][ T9373] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 257.760212][ T9373] RSP: 002b:00007ffcbba1cf18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 257.760230][ T9373] RAX: 0000000000000000 RBX: 00007fc998411d7d RCX: 00007fc9983902f7 [ 257.760241][ T9373] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcbba1cfd0 [ 257.760269][ T9373] RBP: 00007ffcbba1cfd0 R08: 0000000000000000 R09: 0000000000000000 [ 257.760279][ T9373] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffcbba1e060 [ 257.760290][ T9373] R13: 00007fc998411d7d R14: 000000000003ee6e R15: 00007ffcbba1e0a0 [ 257.760324][ T9373] [ 257.760331][ T9373] F2FS-fs (loop7): Stopped filesystem due to reason: 3 [ 257.785149][ T5918] cdc_mbim 3-1:1.0: setting rx_max = 2048 [ 258.152083][T10679] loop6: detected capacity change from 0 to 32768 [ 258.174303][ T9] usb 5-1: USB disconnect, device number 14 [ 258.389111][T10679] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode. [ 258.407693][ T5918] cdc_mbim 3-1:1.0: setting tx_max = 184 [ 258.461846][ T5918] cdc_mbim 3-1:1.0: cdc-wdm1: USB WDM device [ 258.481170][ T5918] wwan wwan0: port wwan0mbim0 attached [ 258.499429][ T5918] cdc_mbim 3-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.2-1, CDC MBIM, 52:63:06:ff:2c:14 [ 258.533799][ T5918] usb 3-1: USB disconnect, device number 16 [ 258.542828][ T5918] cdc_mbim 3-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.2-1, CDC MBIM [ 258.569777][ T8581] ocfs2: Unmounting device (7,6) on (node local) [ 258.642298][ T5918] wwan wwan0: port wwan0mbim0 disconnected [ 258.706695][ T10] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 258.891346][ T10] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 258.901967][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 258.920011][ T10] usb 1-1: Product: syz [ 258.924202][ T10] usb 1-1: Manufacturer: syz [ 258.939066][ T10] usb 1-1: SerialNumber: syz [ 259.092963][T10705] loop2: detected capacity change from 0 to 64 [ 259.271331][T10707] loop2: detected capacity change from 0 to 4096 [ 259.300063][T10708] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 259.928718][T10713] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 259.975314][ T10] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 260.033562][ T10] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 260.076329][ T10] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 260.123202][ T10] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 260.193783][ T10] usb 1-1: USB disconnect, device number 14 [ 260.369850][T10719] sctp: [Deprecated]: syz.6.1487 (pid 10719) Use of struct sctp_assoc_value in delayed_ack socket option. [ 260.369850][T10719] Use struct sctp_sack_info instead [ 260.653848][T10726] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 260.661493][T10726] IPv6: NLM_F_CREATE should be set when creating new route [ 260.929610][T10700] loop7: detected capacity change from 0 to 262144 [ 260.939466][T10711] loop2: detected capacity change from 0 to 32768 [ 261.036831][T10700] F2FS-fs (loop7): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 261.057875][T10700] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 261.068283][T10711] XFS (loop2): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 261.119255][T10711] XFS (loop2): Ending clean mount [ 261.130316][T10711] XFS (loop2): Quotacheck needed: Please wait. [ 261.357126][T10711] XFS (loop2): Quotacheck: Done. [ 261.372259][T10731] loop4: detected capacity change from 0 to 32768 [ 261.407576][T10731] XFS (loop4): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 261.494939][ T5828] XFS (loop2): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 261.499745][T10731] XFS (loop4): Ending clean mount [ 261.521399][T10731] XFS (loop4): Quotacheck needed: Please wait. [ 261.633338][T10731] XFS (loop4): Quotacheck: Done. [ 261.918933][ T5827] XFS (loop4): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 263.133257][T10782] loop4: detected capacity change from 0 to 32768 [ 263.224907][T10782] XFS (loop4): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 263.477010][T10782] XFS (loop4): Ending clean mount [ 263.489172][T10782] XFS (loop4): Quotacheck needed: Please wait. [ 263.502532][T10791] loop2: detected capacity change from 0 to 32768 [ 263.569200][T10782] XFS (loop4): Quotacheck: Done. [ 263.596115][T10791] ocfs2: Slot 0 on device (7,2) was already allocated to this node! [ 263.651758][T10791] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 263.774668][ T30] audit: type=1800 audit(1761161509.383:48): pid=10791 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1512" name="file1" dev="loop2" ino=17058 res=0 errno=0 [ 263.800667][ T5827] XFS (loop4): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 263.820531][T10816] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 264.151574][T10826] loop6: detected capacity change from 0 to 2048 [ 264.194259][T10826] EXT4-fs: Ignoring removed mblk_io_submit option [ 264.222887][T10826] EXT4-fs: Ignoring removed i_version option [ 264.244400][ T5828] ocfs2: Unmounting device (7,2) on (node local) [ 264.292370][T10826] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 264.352053][T10833] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 264.383019][ T8581] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 264.517916][T10837] capability: warning: `syz.4.1529' uses 32-bit capabilities (legacy support in use) [ 264.543986][T10840] loop2: detected capacity change from 0 to 512 [ 264.638891][T10840] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 264.713114][T10847] loop6: detected capacity change from 0 to 4096 [ 264.721840][T10840] ext4 filesystem being mounted at /286/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 264.913262][ T5828] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 264.932570][T10853] loop7: detected capacity change from 0 to 2048 [ 264.953667][T10853] UDF-fs: error (device loop7): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 264.970108][T10853] UDF-fs: warning (device loop7): udf_load_vrs: No anchor found [ 264.982626][T10853] UDF-fs: Scanning with blocksize 512 failed [ 264.990761][T10855] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1534'. [ 265.015090][T10853] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 265.102735][ T30] audit: type=1326 audit(1761161510.713:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10856 comm="syz.6.1535" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe3d918efc9 code=0x0 [ 265.537360][T10878] netlink: 7 bytes leftover after parsing attributes in process `syz.4.1544'. [ 265.557972][T10860] loop2: detected capacity change from 0 to 32768 [ 265.590992][ T30] audit: type=1800 audit(1761161511.203:50): pid=10860 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1536" name="file1" dev="loop2" ino=4 res=0 errno=0 [ 265.776139][T10888] loop7: detected capacity change from 0 to 4096 [ 265.784206][T10888] ntfs3(loop7): Different NTFS sector size (4096) and media sector size (512). [ 265.817774][ T797] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 265.873711][T10888] ntfs3(loop7): ino=19, mi_enum_attr [ 265.879838][T10888] ntfs3(loop7): Mark volume as dirty due to NTFS errors [ 265.918363][T10888] ntfs3(loop7): failed to convert name for inode 20. [ 265.986993][ T797] usb 1-1: Using ep0 maxpacket: 16 [ 265.998046][ T797] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 266.017016][ T797] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 266.032564][T10894] loop6: detected capacity change from 0 to 2048 [ 266.037036][ T797] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 266.072980][ T797] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 266.091501][ T797] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.097050][ T10] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 266.117807][ T797] usb 1-1: config 0 descriptor?? [ 266.143842][T10894] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 266.270675][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 266.282409][ T10] usb 5-1: config index 0 descriptor too short (expected 16456, got 72) [ 266.301543][ T10] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 266.321043][ T10] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 266.348039][ T10] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 266.367102][ T10] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 266.390197][ T10] usb 5-1: config 0 has no interface number 0 [ 266.396325][ T10] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 266.439165][ T10] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 266.471231][ T10] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 266.491873][ T10] usb 5-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 266.523455][ T10] usb 5-1: config 0 interface 125 has no altsetting 0 [ 266.537419][ T10] usb 5-1: config 0 interface 125 has no altsetting 2 [ 266.557938][ T10] usb 5-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 266.558351][ T797] HID 045e:07da: Invalid code 65791 type 1 [ 266.567408][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 266.604812][ T797] input: HID 045e:07da as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:045E:07DA.0008/input/input22 [ 266.606101][ T10] usb 5-1: Product: syz [ 266.653611][ T10] usb 5-1: Manufacturer: syz [ 266.674234][ T10] usb 5-1: SerialNumber: syz [ 266.674591][ T797] microsoft 0003:045E:07DA.0008: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 266.719889][ T10] usb 5-1: config 0 descriptor?? [ 266.739546][ T10] usb 5-1: selecting invalid altsetting 2 [ 266.849458][ T797] usb 1-1: USB disconnect, device number 15 [ 266.905251][T10914] loop7: detected capacity change from 0 to 128 [ 266.933627][T10914] EXT4-fs (loop7): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 266.935479][T10899] loop2: detected capacity change from 0 to 32768 [ 266.959114][T10914] ext4 filesystem being mounted at /85/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 267.003041][T10899] XFS (loop2): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 267.058085][T10899] XFS (loop2): Ending clean mount [ 267.085710][ T9373] EXT4-fs (loop7): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 267.112238][ T30] audit: type=1800 audit(1761161512.713:51): pid=10899 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1553" name="file1" dev="loop2" ino=4422 res=0 errno=0 [ 267.180537][ T30] audit: type=1804 audit(1761161512.753:52): pid=10899 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.1553" name="/newroot/288/file1/file1" dev="loop2" ino=4422 res=1 errno=0 [ 267.214474][ T5828] XFS (loop2): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 267.279139][T10911] loop6: detected capacity change from 0 to 32768 [ 267.337975][T10911] XFS (loop6): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 267.402039][T10911] XFS (loop6): Ending clean mount [ 267.414621][T10911] XFS (loop6): Quotacheck needed: Please wait. [ 267.475884][T10911] XFS (loop6): Quotacheck: Done. [ 267.508945][ T30] audit: type=1800 audit(1761161513.123:53): pid=10911 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.1560" name="file0" dev="loop6" ino=4420 res=0 errno=0 [ 267.588269][ T8581] XFS (loop6): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 267.939118][ T797] usb 5-1: USB disconnect, device number 15 [ 268.107094][T10949] loop6: detected capacity change from 0 to 4096 [ 268.211692][T10939] loop2: detected capacity change from 0 to 32768 [ 268.222722][T10939] BTRFS: device fsid a6a605fc-d5f1-4e66-8595-3726e2b761d6 devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.1565 (10939) [ 268.260201][T10939] BTRFS info (device loop2): first mount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 268.272652][T10939] BTRFS info (device loop2): using blake2b (blake2b-256-generic) checksum algorithm [ 268.396043][T10939] BTRFS info (device loop2): enabling ssd optimizations [ 268.403252][T10939] BTRFS info (device loop2): turning on async discard [ 268.410904][T10939] BTRFS info (device loop2): enabling free space tree [ 268.438722][ T797] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 268.641886][ T797] usb 1-1: unable to get BOS descriptor or descriptor too short [ 268.654345][ T797] usb 1-1: config 3 has an invalid descriptor of length 0, skipping remainder of the config [ 268.687927][ T797] usb 1-1: string descriptor 0 read error: -22 [ 268.694239][ T797] usb 1-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=26.db [ 268.713965][ T797] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 268.818482][T10939] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_LZO (0x8) [ 268.837535][T10964] loop6: detected capacity change from 0 to 32768 [ 268.875022][T10964] ocfs2: Mounting device (7,6) on (node local, slot 0) with writeback data mode. [ 268.913920][ T797] usb 1-1: reset high-speed USB device number 16 using dummy_hcd [ 268.962405][ T5828] BTRFS info (device loop2): last unmount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 268.990413][T10976] loop4: detected capacity change from 0 to 32768 [ 269.036515][T10976] debugfs: 'B1DE653C5FFC4D88B33B244AAB9EB3E9' already exists in 'ocfs2' [ 269.138230][T10976] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 269.271904][ T5827] ocfs2: Unmounting device (7,4) on (node local) [ 269.358431][ T8581] ocfs2: Unmounting device (7,6) on (node local) [ 269.667053][ T797] usb 1-1: device descriptor read/64, error -71 [ 269.714352][T11002] loop6: detected capacity change from 0 to 16 [ 269.744763][T11005] loop2: detected capacity change from 0 to 128 [ 269.753703][T11005] EXT4-fs: Ignoring removed nobh option [ 269.794616][T11005] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 269.824694][T11005] ext4 filesystem being mounted at /294/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 269.937036][ T797] usb 1-1: reset high-speed USB device number 16 using dummy_hcd [ 269.948044][ T797] usb 1-1: device reset changed ep0 maxpacket size! [ 269.979252][ T5828] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 269.980560][ T797] usb 1-1: USB disconnect, device number 16 [ 270.124727][T11014] loop6: detected capacity change from 0 to 2048 [ 270.142244][T11019] bridge0: port 2(bridge_slave_1) entered disabled state [ 270.151154][T11019] bridge0: port 1(bridge_slave_0) entered disabled state [ 270.175033][ T797] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 270.192268][T11014] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 270.337101][ T797] usb 1-1: Using ep0 maxpacket: 16 [ 270.357999][T11026] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1596'. [ 270.385861][ T797] usb 1-1: unable to get BOS descriptor or descriptor too short [ 270.409307][ T797] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 270.422406][ T797] usb 1-1: can't read configurations, error -71 [ 270.667108][ T5903] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 270.723648][T11044] loop2: detected capacity change from 0 to 128 [ 270.806708][ T5868] kernel write not supported for file bpf-prog (pid: 5868 comm: kworker/1:3) [ 270.827010][ T5903] usb 7-1: Using ep0 maxpacket: 16 [ 270.835811][ T5903] usb 7-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 270.861397][ T5903] usb 7-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 270.882566][ T5903] usb 7-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 270.904356][ T5903] usb 7-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 270.920715][ T5903] usb 7-1: config 7 interface 0 has no altsetting 0 [ 270.950679][ T5903] usb 7-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 270.965017][ T5903] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.475215][ T5903] hid (null): invalid report_size 2013265920 [ 271.501148][ T5903] hid (null): report_id 0 is invalid [ 271.544812][ T5903] input: HID 0458:5010 as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:7.0/0003:0458:5010.0009/input/input23 [ 271.582475][T11073] loop4: detected capacity change from 0 to 1024 [ 271.582480][T11077] loop2: detected capacity change from 0 to 128 [ 271.604326][T11077] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 271.629087][ T5903] kye 0003:0458:5010.0009: input,hiddev0,hidraw0: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.6-1/input0 [ 271.645205][T11077] hpfs: filesystem error: improperly stopped [ 271.647266][T11073] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 271.651931][T11077] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 271.672747][T11077] hpfs: You really don't want any checks? You are crazy... [ 271.683633][T11077] hpfs: hpfs_map_sector(): read error [ 271.689356][T11077] hpfs: code page support is disabled [ 271.700178][T11077] hpfs: hpfs_map_4sectors(): unaligned read [ 271.706451][T11077] hpfs: hpfs_map_4sectors(): unaligned read [ 271.713185][T11077] hpfs: filesystem error: unable to find root dir [ 271.715271][T11073] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 271.740256][ T5903] usb 7-1: USB disconnect, device number 8 [ 271.939873][T11087] loop4: detected capacity change from 0 to 164 [ 271.948977][T11087] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 271.966055][T11087] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 272.008471][T11089] loop2: detected capacity change from 0 to 8 [ 272.283746][T11083] loop7: detected capacity change from 0 to 32768 [ 272.332258][T11083] XFS (loop7): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 272.438441][T11083] XFS (loop7): Ending clean mount [ 272.615160][ T9373] XFS (loop7): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 272.958394][T11120] binder: 11119:11120 ioctl c0306201 2000000003c0 returned -14 [ 273.391303][T11140] netlink: 224 bytes leftover after parsing attributes in process `syz.6.1645'. [ 273.413330][T11140] netlink: 48 bytes leftover after parsing attributes in process `syz.6.1645'. [ 273.474279][T11118] loop4: detected capacity change from 0 to 32768 [ 273.499992][T11118] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 273.517005][T11118] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 273.563063][T11118] gfs2: fsid=syz:syz.0: journal 0 mapped with 1 extents in 0ms [ 273.572901][ T5868] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 273.580781][ T5868] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 273.669125][ T5868] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 88ms [ 273.677510][ T5868] gfs2: fsid=syz:syz.0: jid=0: Done [ 273.682836][T11118] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 274.134269][T11146] loop6: detected capacity change from 0 to 32768 [ 274.237054][T11146] XFS (loop6): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 274.368105][T11146] XFS (loop6): Ending clean mount [ 274.567286][ T8581] XFS (loop6): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 275.086693][ T5868] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 275.157831][ T30] audit: type=1326 audit(1761161520.773:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11191 comm="syz.6.1664" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 275.211394][ T30] audit: type=1326 audit(1761161520.793:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11191 comm="syz.6.1664" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 275.264073][ T30] audit: type=1326 audit(1761161520.793:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11191 comm="syz.6.1664" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 275.286968][ T30] audit: type=1326 audit(1761161520.793:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11191 comm="syz.6.1664" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 275.329632][ T5868] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 275.345920][ T5868] usb 1-1: New USB device found, idVendor=057e, idProduct=200e, bcdDevice= 0.00 [ 275.358881][ T5868] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 275.368988][ T30] audit: type=1326 audit(1761161520.793:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11191 comm="syz.6.1664" exe="/root/syz-executor" sig=0 arch=c000003e syscall=188 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 275.394938][ T5868] usb 1-1: config 0 descriptor?? [ 275.397639][T11194] loop4: detected capacity change from 0 to 256 [ 275.401452][ T30] audit: type=1326 audit(1761161520.793:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11191 comm="syz.6.1664" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 275.435381][ T30] audit: type=1326 audit(1761161520.793:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11191 comm="syz.6.1664" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 275.462429][T11194] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x205ad3fc, utbl_chksum : 0xe619d30d) [ 275.463724][ T30] audit: type=1326 audit(1761161520.793:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11191 comm="syz.6.1664" exe="/root/syz-executor" sig=0 arch=c000003e syscall=189 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 275.596289][ T30] audit: type=1326 audit(1761161520.793:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11191 comm="syz.6.1664" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 275.637210][ T30] audit: type=1326 audit(1761161520.793:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11191 comm="syz.6.1664" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 275.856945][T11209] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 275.864173][ T5868] nintendo 0003:057E:200E.000A: hidraw0: USB HID v80.00 Device [HID 057e:200e] on usb-dummy_hcd.0-1/input0 [ 275.982327][ T5868] nintendo 0003:057E:200E.000A: Failed charging grip handshake [ 276.005141][ T5868] nintendo 0003:057E:200E.000A: Failed to initialize controller; ret=-110 [ 276.049869][T11221] loop4: detected capacity change from 0 to 164 [ 276.051230][ T5868] nintendo 0003:057E:200E.000A: probe - fail = -110 [ 276.074573][ T5868] nintendo 0003:057E:200E.000A: probe with driver nintendo failed with error -110 [ 276.105547][ T5868] usb 1-1: USB disconnect, device number 19 [ 276.200484][ T797] kernel write not supported for file /735/gid_map (pid: 797 comm: kworker/1:2) [ 276.292950][T11202] loop7: detected capacity change from 0 to 40427 [ 276.305562][T11230] netlink: 'syz.2.1681': attribute type 10 has an invalid length. [ 276.312433][T11202] F2FS-fs (loop7): invalid crc value [ 276.329771][T11230] dummy0: entered promiscuous mode [ 276.330727][T11230] team0: Port device dummy0 added [ 276.337291][T11230] netlink: 'syz.2.1681': attribute type 10 has an invalid length. [ 276.395459][T11202] F2FS-fs (loop7): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 276.405775][T11202] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 276.405986][T11230] team0: Port device dummy0 removed [ 276.421430][T11230] dummy0: left promiscuous mode [ 276.429982][T11230] dummy0: entered allmulticast mode [ 276.445267][T11230] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 276.445339][ T9373] syz-executor: attempt to access beyond end of device [ 276.445339][ T9373] loop7: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 276.469901][ T9373] CPU: 1 UID: 0 PID: 9373 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 276.469933][ T9373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 276.469943][ T9373] Call Trace: [ 276.469950][ T9373] [ 276.469958][ T9373] dump_stack_lvl+0x189/0x250 [ 276.469989][ T9373] ? __pfx_dump_stack_lvl+0x10/0x10 [ 276.470010][ T9373] ? __pfx_queue_work_on+0x10/0x10 [ 276.470029][ T9373] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 276.470048][ T9373] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 276.470081][ T9373] f2fs_handle_critical_error+0x37c/0x540 [ 276.470114][ T9373] f2fs_write_end_io+0x886/0xb60 [ 276.470153][ T9373] __submit_merged_bio+0x27a/0x6a0 [ 276.470183][ T9373] __submit_merged_write_cond+0x255/0x530 [ 276.470216][ T9373] f2fs_write_data_pages+0x261d/0x3000 [ 276.470284][ T9373] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 276.470363][ T9373] ? __mod_zone_page_state+0xd7/0x140 [ 276.470393][ T9373] ? folios_put_refs+0x58b/0x670 [ 276.470432][ T9373] ? __lock_acquire+0xab9/0xd20 [ 276.470462][ T9373] ? do_raw_spin_lock+0x121/0x290 [ 276.470500][ T9373] ? do_raw_spin_unlock+0x122/0x240 [ 276.470524][ T9373] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 276.470551][ T9373] do_writepages+0x32e/0x550 [ 276.470589][ T9373] ? do_raw_spin_unlock+0x122/0x240 [ 276.470618][ T9373] filemap_fdatawrite+0x199/0x240 [ 276.470644][ T9373] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 276.470727][ T9373] ? do_raw_spin_unlock+0x122/0x240 [ 276.470757][ T9373] f2fs_sync_dirty_inodes+0x31f/0x830 [ 276.470794][ T9373] f2fs_write_checkpoint+0x93e/0x2440 [ 276.470811][ T9373] ? __lock_acquire+0xab9/0xd20 [ 276.470865][ T9373] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 276.470959][ T9373] kill_f2fs_super+0x2cc/0x6d0 [ 276.470985][ T9373] ? __pfx_kill_f2fs_super+0x10/0x10 [ 276.471026][ T9373] ? shrinker_free+0x2ce/0x3e0 [ 276.471051][ T9373] deactivate_locked_super+0xbc/0x130 [ 276.471075][ T9373] cleanup_mnt+0x425/0x4c0 [ 276.471093][ T9373] ? lockdep_hardirqs_on+0x9c/0x150 [ 276.471115][ T9373] task_work_run+0x1d4/0x260 [ 276.471135][ T9373] ? __pfx_task_work_run+0x10/0x10 [ 276.471147][ T9373] ? __x64_sys_umount+0x122/0x160 [ 276.471171][ T9373] ? exit_to_user_mode_loop+0x40/0x130 [ 276.471194][ T9373] exit_to_user_mode_loop+0xe9/0x130 [ 276.471211][ T9373] do_syscall_64+0x2bd/0xfa0 [ 276.471227][ T9373] ? lockdep_hardirqs_on+0x9c/0x150 [ 276.471243][ T9373] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.471259][ T9373] ? clear_bhb_loop+0x60/0xb0 [ 276.471276][ T9373] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.471289][ T9373] RIP: 0033:0x7fc9983902f7 [ 276.471303][ T9373] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 276.471315][ T9373] RSP: 002b:00007ffcbba1cf18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 276.471331][ T9373] RAX: 0000000000000000 RBX: 00007fc998411d7d RCX: 00007fc9983902f7 [ 276.471342][ T9373] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcbba1cfd0 [ 276.471351][ T9373] RBP: 00007ffcbba1cfd0 R08: 0000000000000000 R09: 0000000000000000 [ 276.471361][ T9373] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffcbba1e060 [ 276.471370][ T9373] R13: 00007fc998411d7d R14: 00000000000437b8 R15: 00007ffcbba1e0a0 [ 276.471399][ T9373] [ 276.471406][ T9373] F2FS-fs (loop7): Stopped filesystem due to reason: 3 [ 278.054384][T11286] loop7: detected capacity change from 0 to 128 [ 278.088608][T11286] EXT4-fs (loop7): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 278.117068][T11286] ext4 filesystem being mounted at /117/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 278.274607][ T797] IPVS: starting estimator thread 0... [ 278.339467][ T9373] EXT4-fs (loop7): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 278.398209][T11292] IPVS: using max 31 ests per chain, 74400 per kthread [ 278.504372][T11300] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1707'. [ 278.653520][T11307] loop7: detected capacity change from 0 to 128 [ 278.685777][T11307] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 278.699857][T11307] hpfs: filesystem error: improperly stopped [ 278.706044][T11307] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 278.715875][T11307] hpfs: You really don't want any checks? You are crazy... [ 278.723780][T11307] hpfs: hpfs_map_sector(): read error [ 278.729242][T11307] hpfs: code page support is disabled [ 278.739695][T11307] hpfs: hpfs_map_4sectors(): unaligned read [ 278.745825][T11307] hpfs: hpfs_map_4sectors(): unaligned read [ 278.752010][T11307] hpfs: filesystem error: unable to find root dir [ 279.868058][ T5868] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 280.016189][T11356] loop4: detected capacity change from 0 to 1024 [ 280.049266][ T5868] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 280.061192][T11356] EXT4-fs: inline encryption not supported [ 280.067347][ T5868] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 280.086843][T11356] EXT4-fs: Ignoring removed nobh option [ 280.097115][ T5868] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 280.116684][T11356] EXT4-fs: Ignoring removed bh option [ 280.123185][ T5868] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 280.148355][ T5868] usb 1-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 280.158882][ T5868] usb 1-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 280.177792][ T5868] usb 1-1: Manufacturer: syz [ 280.188228][T11356] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 280.229122][ T5868] usb 1-1: config 0 descriptor?? [ 280.306140][ T5827] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 280.317207][T11351] loop7: detected capacity change from 0 to 32768 [ 280.373385][T11351] XFS (loop7): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 280.427040][T11351] XFS (loop7): Ending clean mount [ 280.439892][T11351] XFS (loop7): Quotacheck needed: Please wait. [ 280.496753][ T9] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 280.531954][T11351] XFS (loop7): Quotacheck: Done. [ 280.609591][ T9373] XFS (loop7): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 280.679081][ T9] usb 7-1: Using ep0 maxpacket: 8 [ 280.681273][ T5868] appleir 0003:05AC:8243.000B: unknown main item tag 0x0 [ 280.698328][ T5868] appleir 0003:05AC:8243.000B: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.0-1/input0 [ 280.702559][ T9] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 280.736149][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 280.744695][ T9] usb 7-1: Product: syz [ 280.749140][ T9] usb 7-1: Manufacturer: syz [ 280.753733][ T9] usb 7-1: SerialNumber: syz [ 280.789307][ T9] usb 7-1: config 0 descriptor?? [ 280.968736][ T5868] usb 1-1: USB disconnect, device number 20 [ 281.001716][ T9] usb 7-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 281.101934][T11388] netlink: 'syz.4.1743': attribute type 1 has an invalid length. [ 281.193222][T11388] bond1: entered promiscuous mode [ 281.202888][T11388] 8021q: adding VLAN 0 to HW filter on device bond1 [ 281.256579][T11390] 8021q: adding VLAN 0 to HW filter on device bond1 [ 281.277655][T11390] bond1: (slave gre1): The slave device specified does not support setting the MAC address [ 281.288202][T11390] bond1: (slave gre1): Setting fail_over_mac to active for active-backup mode [ 281.300249][T11390] bond1: (slave gre1): Opening slave failed [ 281.354509][T11385] loop7: detected capacity change from 0 to 32768 [ 281.389471][T11385] XFS (loop7): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 281.436575][T11385] XFS (loop7): Ending clean mount [ 281.448678][T11404] vlan2: entered allmulticast mode [ 281.454381][T11404] bridge0: port 4(vlan2) entered blocking state [ 281.469453][T11404] bridge0: port 4(vlan2) entered disabled state [ 281.481977][T11404] vlan2: entered promiscuous mode [ 281.565417][ T9373] XFS (loop7): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 281.662304][ T10] kernel write not supported for file /735/sched (pid: 10 comm: kworker/0:1) [ 281.825377][ T9] dvb_usb_rtl28xxu 7-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 281.857169][ T9] usb 7-1: USB disconnect, device number 9 [ 282.488672][T11441] loop7: detected capacity change from 0 to 1024 [ 282.497783][T11441] EXT4-fs: Ignoring removed bh option [ 282.531025][T11441] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-001000000000 r/w without journal. Quota mode: writeback. [ 282.535617][T11445] loop6: detected capacity change from 0 to 2048 [ 282.589165][T11445] UDF-fs: error (device loop6): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 282.609882][T11445] UDF-fs: warning (device loop6): udf_load_vrs: No anchor found [ 282.618719][T11445] UDF-fs: Scanning with blocksize 512 failed [ 282.637429][T11445] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 282.649654][ T9373] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-001000000000. [ 282.769828][T11455] loop7: detected capacity change from 0 to 2048 [ 282.844353][T11455] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 283.088933][ T9373] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 283.254519][T11481] loop6: detected capacity change from 0 to 512 [ 283.278274][T11481] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 283.352002][ T8581] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 283.526241][T11496] loop6: detected capacity change from 0 to 128 [ 283.548208][T11496] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 283.575149][T11496] ext4 filesystem being mounted at /178/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 283.625395][T11496] EXT4-fs error (device loop6): dx_make_map:1296: inode #2: block 20: comm syz.6.1784: bad entry in directory: inode out of bounds - offset=988, inode=128, rec_len=36, size=1024 fake=1 [ 283.645657][T11496] EXT4-fs error (device loop6) in do_split:2029: Corrupt filesystem [ 283.685110][ T8581] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 284.013468][T11521] vxcan1: tx address claim with different name [ 284.649487][T11528] loop7: detected capacity change from 0 to 32768 [ 284.682813][T11528] XFS (loop7): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 284.781849][T11528] XFS (loop7): Ending clean mount [ 284.812047][T11528] XFS (loop7): Quotacheck needed: Please wait. [ 284.921752][T11528] XFS (loop7): Quotacheck: Done. [ 284.983621][T11528] XFS (loop7): User initiated shutdown received. [ 284.994627][T11528] XFS (loop7): Metadata I/O Error (0x4) detected at xfs_fs_goingdown+0x71/0x150 (fs/xfs/xfs_fsops.c:472). Shutting down filesystem. [ 285.035836][T11528] XFS (loop7): Please unmount the filesystem and rectify the problem(s) [ 285.057858][T11564] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1807'. [ 285.101604][T11564] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1807'. [ 285.188306][ T9373] XFS (loop7): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 285.995733][T11613] loop4: detected capacity change from 0 to 512 [ 286.037423][T11613] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 286.092001][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 286.092018][ T30] audit: type=1800 audit(1761161531.703:67): pid=11613 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1828" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 286.217293][ T5827] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 286.463991][T11636] loop6: detected capacity change from 0 to 128 [ 286.510818][ T9] kernel read not supported for file /dsp (pid: 9 comm: kworker/0:0) [ 286.834847][T11657] loop7: detected capacity change from 0 to 2048 [ 286.847719][T11657] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 286.986704][ T9] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 287.146715][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 287.153654][ T9] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 287.162641][ T9] usb 3-1: config 0 has no interface number 0 [ 287.171507][ T9] usb 3-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 287.181997][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 287.192516][ T9] usb 3-1: Product: syz [ 287.197451][ T9] usb 3-1: Manufacturer: syz [ 287.202178][ T9] usb 3-1: SerialNumber: syz [ 287.211510][ T9] usb 3-1: config 0 descriptor?? [ 287.219122][ T9] hub 3-1:0.132: bad descriptor, ignoring hub [ 287.225346][ T9] hub 3-1:0.132: probe with driver hub failed with error -5 [ 287.238903][ T9] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.132/input/input25 [ 287.617876][ T5868] hid-generic 00A1:0009:0003.000C: unknown main item tag 0x0 [ 287.635589][ T5868] hid-generic 00A1:0009:0003.000C: unknown main item tag 0x0 [ 287.639384][T11654] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 287.643727][ T5868] hid-generic 00A1:0009:0003.000C: unknown main item tag 0x0 [ 287.666271][ T5868] hid-generic 00A1:0009:0003.000C: unknown main item tag 0x0 [ 287.674136][ T5868] hid-generic 00A1:0009:0003.000C: unknown main item tag 0x0 [ 287.681673][ T5868] hid-generic 00A1:0009:0003.000C: unknown main item tag 0x0 [ 287.685910][T11654] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 287.689357][ T5868] hid-generic 00A1:0009:0003.000C: unknown main item tag 0x0 [ 287.721161][ T5868] hid-generic 00A1:0009:0003.000C: unknown main item tag 0x0 [ 287.733225][ T5868] hid-generic 00A1:0009:0003.000C: unknown main item tag 0x0 [ 287.751954][ T5868] hid-generic 00A1:0009:0003.000C: unknown main item tag 0x0 [ 287.781870][ T5868] hid-generic 00A1:0009:0003.000C: hidraw0: HID v0.05 Device [syz1] on syz0 [ 287.877965][ T5868] usb 3-1: USB disconnect, device number 17 [ 288.134738][ T13] Bluetooth: hci5: Frame reassembly failed (-84) [ 288.149323][ T1167] Bluetooth: hci5: received HCILL_GO_TO_SLEEP_ACK in state 0 [ 288.167154][ T1167] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 288.229885][T11682] loop4: detected capacity change from 0 to 32768 [ 288.238807][T11682] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.1857 (11682) [ 288.254294][T11682] BTRFS info (device loop4): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 288.264731][T11682] BTRFS info (device loop4): using sha256 (sha256-lib) checksum algorithm [ 288.308664][T11682] BTRFS info (device loop4): enabling ssd optimizations [ 288.315836][T11682] BTRFS info (device loop4): turning on async discard [ 288.325376][T11682] BTRFS info (device loop4): enabling free space tree [ 288.372026][ T5827] BTRFS info (device loop4): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 288.953896][T11734] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1874'. [ 289.007333][T11734] veth0_macvtap: left promiscuous mode [ 289.244355][T11726] loop4: detected capacity change from 0 to 32768 [ 289.252295][T11726] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.1870 (11726) [ 289.291536][T11726] BTRFS info (device loop4): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 289.316722][T11726] BTRFS info (device loop4): using blake2b (blake2b-256-generic) checksum algorithm [ 289.346737][ T5868] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 289.457611][T11726] BTRFS info (device loop4): enabling ssd optimizations [ 289.485787][T11726] BTRFS info (device loop4): turning on async discard [ 289.492735][T11726] BTRFS info (device loop4): enabling free space tree [ 289.506738][T11726] BTRFS info (device loop4): use zstd compression, level 3 [ 289.574585][ T5868] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 289.598014][ T5868] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 289.637861][ T5868] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 289.677023][ T5868] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 289.686957][ T5868] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 289.702907][ T5868] usb 3-1: config 0 descriptor?? [ 289.740499][ T5827] BTRFS info (device loop4): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 289.792966][T11761] syzkaller1: entered promiscuous mode [ 289.806740][T11761] syzkaller1: entered allmulticast mode [ 289.923801][T11740] loop6: detected capacity change from 0 to 32768 [ 290.143106][ T52] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 290.147187][ T5148] Bluetooth: hci5: command 0x1003 tx timeout [ 290.228459][ T5868] plantronics 0003:047F:FFFF.000D: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 290.280504][T11768] loop4: detected capacity change from 0 to 512 [ 290.329017][T11768] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 290.355653][T11768] ext4 filesystem being mounted at /378/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 290.418794][T11768] EXT4-fs error (device loop4): ext4_do_update_inode:5632: inode #2: comm syz.4.1883: corrupted inode contents [ 290.516845][T11768] EXT4-fs error (device loop4): ext4_dirty_inode:6517: inode #2: comm syz.4.1883: mark_inode_dirty error [ 290.550963][T11768] EXT4-fs error (device loop4): ext4_do_update_inode:5632: inode #2: comm syz.4.1883: corrupted inode contents [ 290.558420][ T5918] usb 3-1: USB disconnect, device number 18 [ 290.613417][T11776] EXT4-fs error (device loop4): ext4_do_update_inode:5632: inode #2: comm syz.4.1883: corrupted inode contents [ 290.676881][T11776] EXT4-fs error (device loop4): ext4_dirty_inode:6517: inode #2: comm syz.4.1883: mark_inode_dirty error [ 290.711022][T11776] EXT4-fs error (device loop4): ext4_do_update_inode:5632: inode #2: comm syz.4.1883: corrupted inode contents [ 290.742752][T11776] EXT4-fs error (device loop4): __ext4_ext_dirty:206: inode #2: comm syz.4.1883: mark_inode_dirty error [ 290.785631][T11776] EXT4-fs error (device loop4): ext4_do_update_inode:5632: inode #2: comm syz.4.1883: corrupted inode contents [ 290.811503][T11776] EXT4-fs error (device loop4): ext4_dirty_inode:6517: inode #2: comm syz.4.1883: mark_inode_dirty error [ 290.849233][T11779] EXT4-fs error (device loop4): ext4_do_update_inode:5632: inode #2: comm syz.4.1883: corrupted inode contents [ 290.959064][T11786] netlink: 36 bytes leftover after parsing attributes in process `syz.7.1889'. [ 291.013764][ T5827] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 291.240549][T11792] netlink: 'syz.7.1902': attribute type 1 has an invalid length. [ 291.302419][T11792] bond1: entered promiscuous mode [ 291.309151][T11792] 8021q: adding VLAN 0 to HW filter on device bond1 [ 291.421138][T11798] 8021q: adding VLAN 0 to HW filter on device bond1 [ 291.428602][T11798] bond1: (slave gre1): The slave device specified does not support setting the MAC address [ 291.446703][T11798] bond1: (slave gre1): Setting fail_over_mac to active for active-backup mode [ 291.459404][T11798] bond1: (slave gre1): Opening slave failed [ 291.909699][T11814] loop6: detected capacity change from 0 to 4096 [ 291.925616][T11814] EXT4-fs (loop6): Test dummy encryption mode enabled [ 291.944077][T11814] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c018, mo2=0003] [ 291.988046][T11814] System zones: 0-5 [ 292.015462][T11814] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 292.143524][T11829] nullb0: [POWERTEC] p1 [ 292.423366][ T8581] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 292.570586][T11851] netlink: 'syz.7.1914': attribute type 29 has an invalid length. [ 292.595789][T11851] netlink: 'syz.7.1914': attribute type 29 has an invalid length. [ 292.625660][T11851] netlink: 500 bytes leftover after parsing attributes in process `syz.7.1914'. [ 292.650737][T11851] unsupported nla_type 58 [ 292.714337][ T30] audit: type=1800 audit(1761161538.323:68): pid=11859 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1917" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 293.036058][ T30] audit: type=1326 audit(1761161538.643:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.4.1926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f121b38efc9 code=0x7ffc0000 [ 293.110159][ T30] audit: type=1326 audit(1761161538.643:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.4.1926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f121b38efc9 code=0x7ffc0000 [ 293.199170][T11866] infiniband syz0: set active [ 293.205715][T11866] infiniband syz0: added bond_slave_0 [ 293.268541][ T30] audit: type=1326 audit(1761161538.683:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.4.1926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=433 compat=0 ip=0x7f121b38efc9 code=0x7ffc0000 [ 293.292007][ T30] audit: type=1326 audit(1761161538.683:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.4.1926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f121b38efc9 code=0x7ffc0000 [ 293.315113][ T30] audit: type=1326 audit(1761161538.683:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.4.1926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f121b38efc9 code=0x7ffc0000 [ 293.338782][ T30] audit: type=1326 audit(1761161538.703:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.4.1926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f121b38efc9 code=0x7ffc0000 [ 293.363989][ T30] audit: type=1326 audit(1761161538.703:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.4.1926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f121b38efc9 code=0x7ffc0000 [ 293.386868][ T30] audit: type=1326 audit(1761161538.703:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.4.1926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f121b38efc9 code=0x7ffc0000 [ 293.409769][ T30] audit: type=1326 audit(1761161538.713:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.4.1926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f121b38efc9 code=0x7ffc0000 [ 293.455311][T11866] RDS/IB: syz0: added [ 293.460287][T11866] smc: adding ib device syz0 with port count 1 [ 293.467159][T11866] smc: ib device syz0 port 1 has no pnetid [ 294.080276][T11910] netlink: 'syz.6.1940': attribute type 1 has an invalid length. [ 294.100279][T11910] netlink: 76 bytes leftover after parsing attributes in process `syz.6.1940'. [ 294.547096][ T5903] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 294.712049][ T5903] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 294.728716][ T5903] usb 7-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 294.754526][T11936] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1952'. [ 294.766101][ T5903] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 294.780922][ T5903] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 294.801255][ T5903] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 294.816464][ T5903] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 294.832688][ T5903] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 294.846668][ T5903] usb 7-1: Product: syz [ 294.850844][ T5903] usb 7-1: Manufacturer: syz [ 294.885975][ T5903] cdc_wdm 7-1:1.0: skipping garbage [ 294.892972][ T5903] cdc_wdm 7-1:1.0: skipping garbage [ 294.902764][ T5903] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 294.912573][ T5903] cdc_wdm 7-1:1.0: Unknown control protocol [ 294.927394][ T5868] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 294.936893][ T10] kernel read not supported for file /dsp (pid: 10 comm: kworker/0:1) [ 295.117540][ T5868] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 295.134077][ T5868] usb 5-1: config 0 interface 0 has no altsetting 0 [ 295.144317][ T5868] usb 5-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 295.153608][ T5868] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 295.161861][ T5868] usb 5-1: Product: syz [ 295.166278][ T5868] usb 5-1: Manufacturer: syz [ 295.171533][ T5868] usb 5-1: SerialNumber: syz [ 295.216448][ T5868] usb 5-1: config 0 descriptor?? [ 295.228795][ T5868] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 295.259779][ T5868] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 295.283545][ T5868] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 295.297072][ T0] NOHZ tick-stop error: local softirq work is pending, handler #242!!! [ 295.307177][ T5868] usb 5-1: media controller created [ 295.391451][ T5868] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 295.524165][ T5868] DVB: Unable to find symbol tda10046_attach() [ 295.530999][ T5868] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 295.539765][ T5868] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 296.370232][ T5868] dvb_usb_m920x 5-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 296.387010][ T5868] usb 5-1: USB disconnect, device number 16 [ 296.697141][ T5946] usb 3-1: new full-speed USB device number 19 using dummy_hcd [ 296.860215][ T10] usb 1-1: new full-speed USB device number 21 using dummy_hcd [ 296.878634][ T5946] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 296.889697][ T5946] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 296.900423][ T5946] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 296.909784][ T5946] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 296.931514][ T5946] usb 3-1: config 0 descriptor?? [ 296.962028][T11986] loop4: detected capacity change from 0 to 512 [ 296.993661][T11986] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 297.009899][T11986] ext4 filesystem being mounted at /396/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 297.041530][ T10] usb 1-1: config 0 has an invalid interface number: 128 but max is 0 [ 297.050839][ T10] usb 1-1: config 0 has no interface number 0 [ 297.061677][ T10] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 297.073980][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.082143][ T10] usb 1-1: Product: syz [ 297.087274][ T10] usb 1-1: Manufacturer: syz [ 297.091885][ T10] usb 1-1: SerialNumber: syz [ 297.101507][ T10] usb 1-1: config 0 descriptor?? [ 297.208292][ T5827] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 297.320406][ T9] usb 7-1: USB disconnect, device number 10 [ 297.367607][ T5946] hid_parser_main: 5 callbacks suppressed [ 297.367628][ T5946] koneplus 0003:1E7D:2D51.000E: unknown main item tag 0x0 [ 297.396722][ T5946] koneplus 0003:1E7D:2D51.000E: unknown main item tag 0x0 [ 297.411557][ T5946] koneplus 0003:1E7D:2D51.000E: unknown main item tag 0x0 [ 297.424199][ T5946] koneplus 0003:1E7D:2D51.000E: unknown main item tag 0x0 [ 297.431820][ T5946] koneplus 0003:1E7D:2D51.000E: unknown main item tag 0x0 [ 297.449140][ T5946] koneplus 0003:1E7D:2D51.000E: hidraw0: USB HID v0.00 Device [HID 1e7d:2d51] on usb-dummy_hcd.2-1/input0 [ 297.518865][ T10] usb 1-1: Firmware: major: 0, minor: 83, hardware type: ATUSB (1) [ 297.607822][T12006] netlink: 'syz.4.1982': attribute type 1 has an invalid length. [ 297.616229][T12006] netlink: 'syz.4.1982': attribute type 6 has an invalid length. [ 297.627815][T12006] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1982'. [ 297.734726][ T10] usb 1-1: failed to fetch extended address, random address set [ 297.759624][ T5946] usb 3-1: USB disconnect, device number 19 [ 297.870582][ T10] usb 1-1: USB disconnect, device number 21 [ 297.981752][T12025] loop7: detected capacity change from 0 to 4096 [ 298.147350][ T5918] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 298.189641][T12031] netlink: 14528 bytes leftover after parsing attributes in process `syz.6.1992'. [ 298.310437][ T5918] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 298.329851][ T5918] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 298.364147][ T5918] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 298.379194][ T5918] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 298.388477][ T5918] usb 5-1: SerialNumber: syz [ 298.527723][T12049] loop7: detected capacity change from 0 to 1024 [ 298.629292][ T5918] usb 5-1: 0:2 : does not exist [ 298.638342][ T3506] hfsplus: b-tree write err: -5, ino 4 [ 298.677364][ T5918] usb 5-1: USB disconnect, device number 17 [ 298.750238][T12058] ucma_write: process 383 (syz.7.2004) changed security contexts after opening file descriptor, this is not allowed. [ 299.351108][ T5946] kernel write not supported for file bpf-prog (pid: 5946 comm: kworker/1:7) [ 299.573901][T12074] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2011'. [ 299.598546][T12073] netlink: 428 bytes leftover after parsing attributes in process `syz.4.2012'. [ 299.626700][T12073] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2012'. [ 299.784895][T12082] loop4: detected capacity change from 0 to 64 [ 299.816483][T12082] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing [ 299.988144][T12086] loop4: detected capacity change from 0 to 512 [ 299.995245][T12086] EXT4-fs: Ignoring removed oldalloc option [ 300.084996][T12086] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 300.108380][ T5946] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 300.120893][T12086] ext4 filesystem being mounted at /409/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 300.189716][T12086] EXT4-fs error (device loop4): ext4_lookup:1787: inode #12: comm syz.4.2019: iget: bad i_size value: 2533274857506816 [ 300.230664][T12086] EXT4-fs (loop4): Remounting filesystem read-only [ 300.266669][ T5946] usb 3-1: Using ep0 maxpacket: 16 [ 300.279391][ T5946] usb 3-1: config index 0 descriptor too short (expected 65, got 36) [ 300.296763][ T5946] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 300.326739][ T5946] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 300.341858][ T5827] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 300.351173][ T5946] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 300.383653][ T5946] usb 3-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 300.418140][ T5946] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 300.449080][ T5946] usb 3-1: config 0 descriptor?? [ 300.472072][ T5946] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input26 [ 300.490473][T12093] loop7: detected capacity change from 0 to 32768 [ 300.503663][ T5183] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 300.507626][T12093] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop7 (7:7) scanned by syz.7.2021 (12093) [ 300.532930][ T5183] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 300.555421][ T5183] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 300.572904][T12093] BTRFS info (device loop7): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 300.589045][T12093] BTRFS info (device loop7): using sha256 (sha256-lib) checksum algorithm [ 300.597924][ T5183] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 300.670687][T12093] BTRFS info (device loop7): rebuilding free space tree [ 300.680746][T12084] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 300.701281][T12093] BTRFS info (device loop7): disabling free space tree [ 300.701935][ T5918] usb 3-1: USB disconnect, device number 20 [ 300.716819][T12093] BTRFS info (device loop7): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 300.746898][T12093] BTRFS info (device loop7): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 300.768661][T12093] BTRFS info (device loop7): enabling ssd optimizations [ 300.775631][T12093] BTRFS info (device loop7): turning on async discard [ 300.792828][T12093] BTRFS info (device loop7): force clearing of disk cache [ 300.806784][T12093] BTRFS info (device loop7): enabling auto defrag [ 300.823514][T12093] BTRFS info (device loop7): max_inline set to 4096 [ 301.013518][ T9373] BTRFS info (device loop7): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 301.182110][T12101] loop4: detected capacity change from 0 to 40427 [ 301.191539][T12104] loop6: detected capacity change from 0 to 40427 [ 301.201062][T12101] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 301.226704][T12101] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 301.243953][T12101] F2FS-fs (loop4): invalid crc value [ 301.247234][T12104] F2FS-fs (loop6): Wrong MAIN_AREA boundary, start(4096) end(12800) block(12288) [ 301.290508][T12104] F2FS-fs (loop6): Can't find valid F2FS filesystem in 1th superblock [ 301.343546][T12104] F2FS-fs (loop6): Image doesn't support compression [ 301.382265][T12104] F2FS-fs (loop6): build fault injection rate: 690 [ 301.389223][T12104] F2FS-fs (loop6): build fault injection type: 0x35f7 [ 301.408546][T12135] netlink: 277 bytes leftover after parsing attributes in process `syz.2.2033'. [ 301.419724][T12104] F2FS-fs (loop6): invalid crc value [ 301.445673][T12101] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 301.467889][T12101] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 301.474953][T12101] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 301.690395][T12104] F2FS-fs (loop6): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 301.739930][T12104] F2FS-fs (loop6): Start checkpoint disabled! [ 301.758532][T12104] F2FS-fs (loop6): f2fs_disable_checkpoint() finish, err:0 [ 301.793454][T12104] F2FS-fs (loop6): Try to recover 1th superblock, ret: 0 [ 301.821752][T12104] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e6 [ 301.853864][T12147] ALSA: mixer_oss: invalid OSS volume '' [ 301.920296][T12104] syz.6.2027: attempt to access beyond end of device [ 301.920296][T12104] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 301.970842][T12104] syz.6.2027: attempt to access beyond end of device [ 301.970842][T12104] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 302.108066][ T3506] kworker/u8:8: attempt to access beyond end of device [ 302.108066][ T3506] loop6: rw=2049, sector=45104, nr_sectors = 8 limit=40427 [ 302.147997][ T3506] CPU: 0 UID: 0 PID: 3506 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT(full) [ 302.148022][ T3506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 302.148034][ T3506] Workqueue: writeback wb_workfn (flush-7:6) [ 302.148060][ T3506] Call Trace: [ 302.148067][ T3506] [ 302.148075][ T3506] dump_stack_lvl+0x189/0x250 [ 302.148113][ T3506] ? __pfx_dump_stack_lvl+0x10/0x10 [ 302.148136][ T3506] ? __pfx_queue_work_on+0x10/0x10 [ 302.148155][ T3506] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 302.148175][ T3506] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 302.148205][ T3506] f2fs_handle_critical_error+0x37c/0x540 [ 302.148234][ T3506] f2fs_write_end_io+0x886/0xb60 [ 302.148271][ T3506] __submit_merged_bio+0x27a/0x6a0 [ 302.148302][ T3506] __submit_merged_write_cond+0x255/0x530 [ 302.148334][ T3506] f2fs_write_data_pages+0x261d/0x3000 [ 302.148398][ T3506] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 302.148478][ T3506] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 302.148524][ T3506] ? __lock_acquire+0xab9/0xd20 [ 302.148551][ T3506] ? __update_page_owner_handle+0x5a/0x570 [ 302.148590][ T3506] ? __lock_acquire+0xab9/0xd20 [ 302.148611][ T3506] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 302.148637][ T3506] do_writepages+0x32e/0x550 [ 302.148667][ T3506] ? reacquire_held_locks+0x127/0x1d0 [ 302.148687][ T3506] ? writeback_sb_inodes+0x384/0x1010 [ 302.148719][ T3506] __writeback_single_inode+0x145/0xff0 [ 302.148742][ T3506] ? do_raw_spin_unlock+0x122/0x240 [ 302.148771][ T3506] writeback_sb_inodes+0x6c7/0x1010 [ 302.148825][ T3506] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 302.148894][ T3506] ? rcu_is_watching+0x15/0xb0 [ 302.148931][ T3506] wb_writeback+0x43b/0xaf0 [ 302.148963][ T3506] ? queue_io+0x2e1/0x590 [ 302.148987][ T3506] ? __pfx_wb_writeback+0x10/0x10 [ 302.149019][ T3506] ? _raw_spin_unlock_irq+0x23/0x50 [ 302.149045][ T3506] wb_workfn+0x409/0xef0 [ 302.149082][ T3506] ? __pfx_wb_workfn+0x10/0x10 [ 302.149112][ T3506] ? __lock_acquire+0xab9/0xd20 [ 302.149145][ T3506] ? process_scheduled_works+0x9ef/0x17b0 [ 302.149172][ T3506] ? _raw_spin_unlock_irq+0x23/0x50 [ 302.149189][ T3506] ? process_scheduled_works+0x9ef/0x17b0 [ 302.149206][ T3506] ? process_scheduled_works+0x9ef/0x17b0 [ 302.149228][ T3506] process_scheduled_works+0xae1/0x17b0 [ 302.149285][ T3506] ? __pfx_process_scheduled_works+0x10/0x10 [ 302.149326][ T3506] worker_thread+0x8a0/0xda0 [ 302.149352][ T3506] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 302.149379][ T3506] ? __kthread_parkme+0x7b/0x200 [ 302.149412][ T3506] kthread+0x711/0x8a0 [ 302.149439][ T3506] ? __pfx_worker_thread+0x10/0x10 [ 302.149458][ T3506] ? __pfx_kthread+0x10/0x10 [ 302.149482][ T3506] ? _raw_spin_unlock_irq+0x23/0x50 [ 302.149499][ T3506] ? lockdep_hardirqs_on+0x9c/0x150 [ 302.149516][ T3506] ? __pfx_kthread+0x10/0x10 [ 302.149541][ T3506] ret_from_fork+0x4bc/0x870 [ 302.149565][ T3506] ? __pfx_ret_from_fork+0x10/0x10 [ 302.149594][ T3506] ? __switch_to_asm+0x39/0x70 [ 302.149608][ T3506] ? __switch_to_asm+0x33/0x70 [ 302.149621][ T3506] ? __pfx_kthread+0x10/0x10 [ 302.149645][ T3506] ret_from_fork_asm+0x1a/0x30 [ 302.149683][ T3506] [ 302.149930][ T3506] F2FS-fs (loop6): Stopped filesystem due to reason: 3 [ 302.258202][T12156] tap0: tun_chr_ioctl cmd 1074025675 [ 302.513218][T12156] tap0: persist enabled [ 302.519906][T12158] tap0: tun_chr_ioctl cmd 1074025675 [ 302.525616][T12158] tap0: persist disabled [ 302.616164][T12160] loop7: detected capacity change from 0 to 4096 [ 302.948461][T12178] loop7: detected capacity change from 0 to 512 [ 302.998976][T12178] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 303.016408][T12178] ext4 filesystem being mounted at /184/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 303.062037][T12178] EXT4-fs error (device loop7): ext4_do_update_inode:5632: inode #2: comm syz.7.2048: corrupted inode contents [ 303.128113][T12178] EXT4-fs error (device loop7): ext4_dirty_inode:6517: inode #2: comm syz.7.2048: mark_inode_dirty error [ 303.226336][T12178] EXT4-fs error (device loop7): ext4_do_update_inode:5632: inode #2: comm syz.7.2048: corrupted inode contents [ 303.346919][T12178] EXT4-fs error (device loop7): __ext4_ext_dirty:206: inode #2: comm syz.7.2048: mark_inode_dirty error [ 303.430388][T12192] EXT4-fs warning (device loop7): ext4_empty_dir:3089: inode #18: comm syz.7.2048: directory missing '.' [ 303.465127][T12199] loop4: detected capacity change from 0 to 2048 [ 303.497081][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 303.506478][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 303.528800][ T9373] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 303.565809][T12199] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 303.757972][ T5868] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 303.918894][ T5868] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 303.929363][ T5868] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 303.990249][ T5868] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 304.007335][ T5868] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 304.015774][ T5868] usb 1-1: Product: syz [ 304.020122][ T5868] usb 1-1: Manufacturer: syz [ 304.024814][ T5868] usb 1-1: SerialNumber: syz [ 304.055624][ T5868] usb 1-1: config 0 descriptor?? [ 304.428088][T12217] loop6: detected capacity change from 0 to 256 [ 304.464718][T12217] exfat: Deprecated parameter 'utf8' [ 304.482966][T12217] exfat: Deprecated parameter 'namecase' [ 304.514846][T12217] exFAT-fs (loop6): failed to load upcase table (idx : 0x00012153, chksum : 0xc3dffc2e, utbl_chksum : 0xe619d30d) [ 304.569817][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 304.569832][ T30] audit: type=1800 audit(1761161550.183:86): pid=12217 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.2062" name="file1" dev="loop6" ino=1048662 res=0 errno=0 [ 304.692400][ T5946] usb 1-1: USB disconnect, device number 22 [ 305.153344][T12228] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2066'. [ 305.167153][T12228] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2066'. [ 305.176527][T12228] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2066'. [ 305.185733][T12228] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2066'. [ 305.293992][T12233] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2069'. [ 305.304834][T12231] pim6reg: entered allmulticast mode [ 305.322402][T12231] pim6reg: left allmulticast mode [ 305.683527][T12253] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2077'. [ 305.693054][T12253] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2077'. [ 305.990437][ T5946] kernel read not supported for file /1002/coredump_filter (pid: 5946 comm: kworker/1:7) [ 306.000932][ T797] kernel write not supported for file /1002/coredump_filter (pid: 797 comm: kworker/1:2) [ 306.248676][ T30] audit: type=1326 audit(1761161551.863:87): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12280 comm="syz.6.2089" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 306.297951][ T30] audit: type=1326 audit(1761161551.863:88): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12280 comm="syz.6.2089" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 306.348870][ T30] audit: type=1326 audit(1761161551.893:89): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12280 comm="syz.6.2089" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 306.396946][ T30] audit: type=1326 audit(1761161551.893:90): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12280 comm="syz.6.2089" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 306.456113][ T30] audit: type=1326 audit(1761161551.893:91): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12280 comm="syz.6.2089" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 306.510699][ T30] audit: type=1326 audit(1761161551.893:92): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12280 comm="syz.6.2089" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 306.563842][ T30] audit: type=1326 audit(1761161551.893:93): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12280 comm="syz.6.2089" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 306.619994][ T30] audit: type=1326 audit(1761161551.893:94): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12280 comm="syz.6.2089" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 306.668075][ T30] audit: type=1326 audit(1761161551.893:95): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12280 comm="syz.6.2089" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe3d918efc9 code=0x7ffc0000 [ 307.177047][ T52] Bluetooth: hci5: Entering manufacturer mode failed (-110) [ 307.284196][T12229] sp0: Synchronizing with TNC [ 307.486379][T12309] loop6: detected capacity change from 0 to 4096 [ 307.494391][T12309] EXT4-fs: Ignoring removed nomblk_io_submit option [ 307.502669][T12309] EXT4-fs (loop6): Test dummy encryption mode enabled [ 307.511587][T12309] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c018, mo2=0003] [ 307.520723][T12309] System zones: 0-5 [ 307.561936][T12309] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 307.706314][ T8581] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 307.758485][ T5946] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 307.799120][ T5946] hid-generic 0000:0000:0000.000F: hidraw0: HID v0.00 Device [syz1] on syz0 [ 308.097259][ T5946] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 308.260005][ T5946] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 308.289100][ T5946] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 308.310510][ T5946] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 308.326401][ T5946] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 308.338505][ T5946] usb 7-1: SerialNumber: syz [ 308.528430][T12327] loop4: detected capacity change from 0 to 32768 [ 308.536539][T12327] BTRFS: device fsid a6a605fc-d5f1-4e66-8595-3726e2b761d6 devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.2108 (12327) [ 308.555654][T12327] BTRFS info (device loop4): first mount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 308.569699][ T5946] usb 7-1: 0:2 : does not exist [ 308.571155][T12327] BTRFS info (device loop4): using blake2b (blake2b-256-generic) checksum algorithm [ 308.589458][ T5946] usb 7-1: USB disconnect, device number 11 [ 308.681790][T12327] BTRFS info (device loop4): enabling ssd optimizations [ 308.702434][T12327] BTRFS info (device loop4): turning on async discard [ 308.715885][T12327] BTRFS info (device loop4): enabling free space tree [ 308.942384][ T5827] BTRFS info (device loop4): last unmount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 309.094657][T12369] loop7: detected capacity change from 0 to 128 [ 309.146538][T12369] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 309.169592][T12369] hpfs: filesystem error: improperly stopped [ 309.185304][T12369] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 309.195397][T12369] hpfs: You really don't want any checks? You are crazy... [ 309.213690][T12369] hpfs: hpfs_map_sector(): read error [ 309.229208][T12369] hpfs: code page support is disabled [ 309.235303][T12369] hpfs: hpfs_map_4sectors(): unaligned read [ 309.245075][T12369] hpfs: hpfs_map_4sectors(): unaligned read [ 309.251576][T12369] hpfs: filesystem error: unable to find root dir [ 309.260656][T12375] loop6: detected capacity change from 0 to 512 [ 309.280884][T12375] EXT4-fs: Ignoring removed orlov option [ 309.290291][T12375] EXT4-fs (loop6): mounting ext3 file system using the ext4 subsystem [ 309.367173][T12375] EXT4-fs error (device loop6): ext4_iget_extra_inode:5075: inode #15: comm syz.6.2125: corrupted in-inode xattr: e_value size too large [ 309.401618][T12375] EXT4-fs error (device loop6): ext4_orphan_get:1397: comm syz.6.2125: couldn't read orphan inode 15 (err -117) [ 309.424199][T12375] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 309.447353][T12375] EXT4-fs error (device loop6): ext4_check_dx_root:2203: inode #2: comm syz.6.2125: Corrupt dir, invalid name_len for '..', running e2fsck is recommended [ 309.498183][ T8581] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 309.587653][T12388] loop4: detected capacity change from 0 to 2048 [ 309.607132][T12391] loop6: detected capacity change from 0 to 128 [ 309.614179][T12391] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 309.629434][T12391] FAT-fs (loop6): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 309.643754][T12388] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 309.793639][ T3473] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 309.812500][ T3473] EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28 [ 309.828630][ T3473] EXT4-fs (loop4): This should not happen!! Data will be lost [ 309.828630][ T3473] [ 309.840929][ T3473] EXT4-fs (loop4): Total free blocks count 0 [ 309.847064][ T3473] EXT4-fs (loop4): Free/Dirty block details [ 309.852961][ T3473] EXT4-fs (loop4): free_blocks=2415919504 [ 309.858819][ T3473] EXT4-fs (loop4): dirty_blocks=16 [ 309.863948][ T3473] EXT4-fs (loop4): Block reservation details [ 309.869964][ T3473] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 309.880506][ T5827] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 310.000547][T12404] loop6: detected capacity change from 0 to 1024 [ 310.013457][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 310.013472][ T30] audit: type=1326 audit(1761161555.623:99): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12405 comm="syz.2.2136" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1158efc9 code=0x50000 [ 310.047843][ T30] audit: type=1326 audit(1761161555.623:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12405 comm="syz.2.2136" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1158efc9 code=0x50000 [ 310.075349][ T30] audit: type=1326 audit(1761161555.623:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12405 comm="syz.2.2136" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1158efc9 code=0x50000 [ 310.099489][ T30] audit: type=1326 audit(1761161555.623:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12405 comm="syz.2.2136" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1158efc9 code=0x50000 [ 310.122770][ T30] audit: type=1326 audit(1761161555.623:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12405 comm="syz.2.2136" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1158efc9 code=0x50000 [ 310.147084][ T30] audit: type=1326 audit(1761161555.623:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12405 comm="syz.2.2136" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1158efc9 code=0x50000 [ 310.176796][ T30] audit: type=1326 audit(1761161555.623:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12405 comm="syz.2.2136" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1158efc9 code=0x50000 [ 310.230769][ T30] audit: type=1326 audit(1761161555.623:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12405 comm="syz.2.2136" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1158efc9 code=0x50000 [ 310.264696][ T13] hfsplus: b-tree write err: -5, ino 8 [ 310.285365][ T30] audit: type=1326 audit(1761161555.623:107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12405 comm="syz.2.2136" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1158efc9 code=0x50000 [ 310.332947][ T30] audit: type=1326 audit(1761161555.623:108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12405 comm="syz.2.2136" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e1158efc9 code=0x50000 [ 310.410979][T12415] syzkaller1: entered promiscuous mode [ 310.432710][T12415] syzkaller1: entered allmulticast mode [ 310.960414][T12444] netlink: 112 bytes leftover after parsing attributes in process `syz.2.2153'. [ 311.406760][ T5918] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 311.414487][ T10] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 311.534417][T12458] loop4: detected capacity change from 0 to 32768 [ 311.544647][T12458] (syz.4.2159,12458,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 311.560890][T12458] (syz.4.2159,12458,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 311.581422][ T10] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 311.589560][T12458] JBD2: Ignoring recovery information on journal [ 311.592483][ T5918] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 311.611004][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 311.622492][ T5918] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 311.633714][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 311.644604][ T5918] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 311.646478][T12458] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 311.654762][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 311.654906][ T5918] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 311.692060][ T5918] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 311.701358][ T10] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 311.710573][ T10] usb 3-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 311.718800][ T5918] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.727003][ T10] usb 3-1: Manufacturer: syz [ 311.734101][ T10] usb 3-1: config 0 descriptor?? [ 311.742934][ T5918] usb 7-1: config 0 descriptor?? [ 311.814414][ T5827] ocfs2: Unmounting device (7,4) on (node local) [ 312.171885][ T10] appleir 0003:05AC:8243.0011: unknown main item tag 0x0 [ 312.182168][ T5918] plantronics 0003:047F:FFFF.0010: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 312.262684][ T10] appleir 0003:05AC:8243.0011: hiddev1,hidraw1: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 312.682587][T12476] loop7: detected capacity change from 0 to 1024 [ 312.876776][ T5868] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 313.038863][ T5868] usb 5-1: Using ep0 maxpacket: 32 [ 313.054762][ T5868] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 313.083549][ T5868] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 313.093168][ T5868] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 313.105603][ T5868] usb 5-1: Product: syz [ 313.110253][ T5868] usb 5-1: Manufacturer: syz [ 313.115685][ T5868] usb 5-1: SerialNumber: syz [ 313.123517][ T5868] usb 5-1: config 0 descriptor?? [ 313.130036][T12474] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 313.140444][ T5868] hub 5-1:0.0: bad descriptor, ignoring hub [ 313.146374][ T5868] hub 5-1:0.0: probe with driver hub failed with error -5 [ 313.457240][ T5868] usb 5-1: USB disconnect, device number 18 [ 313.503590][ T797] usb 3-1: USB disconnect, device number 21 [ 314.299058][T12511] loop4: detected capacity change from 0 to 47 [ 314.310193][ T5868] usb 7-1: USB disconnect, device number 12 [ 315.160809][T12531] batadv_slave_1: entered promiscuous mode [ 315.190913][T12530] batadv_slave_1: left promiscuous mode [ 315.389266][ T30] kauditd_printk_skb: 59 callbacks suppressed [ 315.389282][ T30] audit: type=1326 audit(1761161561.003:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12534 comm="syz.0.2191" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d7038efc9 code=0x7ffc0000 [ 315.457838][ T30] audit: type=1326 audit(1761161561.003:169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12534 comm="syz.0.2191" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d7038efc9 code=0x7ffc0000 [ 315.507092][ T30] audit: type=1326 audit(1761161561.003:170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12534 comm="syz.0.2191" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d7038efc9 code=0x7ffc0000 [ 315.593377][ T30] audit: type=1326 audit(1761161561.003:171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12534 comm="syz.0.2191" exe="/root/syz-executor" sig=0 arch=c000003e syscall=80 compat=0 ip=0x7f2d7038efc9 code=0x7ffc0000 [ 315.650700][ T30] audit: type=1326 audit(1761161561.003:172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12534 comm="syz.0.2191" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d7038efc9 code=0x7ffc0000 [ 315.696670][ T30] audit: type=1326 audit(1761161561.003:173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12534 comm="syz.0.2191" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d7038efc9 code=0x7ffc0000 [ 315.719780][ T5868] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 315.738150][ T30] audit: type=1326 audit(1761161561.003:174): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12534 comm="syz.0.2191" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d7038efc9 code=0x7ffc0000 [ 315.760832][ T30] audit: type=1326 audit(1761161561.003:175): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12534 comm="syz.0.2191" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d7038efc9 code=0x7ffc0000 [ 315.807324][ T30] audit: type=1326 audit(1761161561.003:176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12534 comm="syz.0.2191" exe="/root/syz-executor" sig=0 arch=c000003e syscall=2 compat=0 ip=0x7f2d7038efc9 code=0x7ffc0000 [ 315.847076][ T30] audit: type=1326 audit(1761161561.003:177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12534 comm="syz.0.2191" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d7038efc9 code=0x7ffc0000 [ 315.888576][ T5868] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 315.907982][ T5868] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 315.929900][ T5868] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 315.945658][ T5868] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 315.955773][ T5868] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 315.978936][ T5868] usb 5-1: config 0 descriptor?? [ 316.370879][T12552] loop6: detected capacity change from 0 to 32768 [ 316.399159][T12552] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode. [ 316.445395][ T5868] plantronics 0003:047F:FFFF.0012: reserved main item tag 0xd [ 316.462761][ T8581] ocfs2: Unmounting device (7,6) on (node local) [ 316.499326][ T5868] plantronics 0003:047F:FFFF.0012: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 317.103050][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.112488][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.336954][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 317.657001][ T52] Bluetooth: hci4: command 0x0405 tx timeout [ 317.910544][T12612] loop6: detected capacity change from 0 to 256 [ 317.945639][T12612] exFAT-fs (loop6): failed to load upcase table (idx : 0x0000fe7f, chksum : 0x09066d1f, utbl_chksum : 0xe619d30d) [ 318.043034][T12614] netlink: 'syz.2.2227': attribute type 12 has an invalid length. [ 318.079003][T12616] loop6: detected capacity change from 0 to 64 [ 318.578935][ T5946] usb 5-1: USB disconnect, device number 19 [ 318.670018][T12628] loop4: detected capacity change from 0 to 256 [ 318.725044][T12628] exFAT-fs (loop4): failed to load upcase table (idx : 0x00011f3f, chksum : 0x23ae2a4b, utbl_chksum : 0xe619d30d) [ 319.036554][T12638] loop6: detected capacity change from 0 to 512 [ 319.109649][T12638] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 319.132947][T12638] ext4 filesystem being mounted at /274/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 319.201397][ T8581] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 319.210998][T12647] fuse: Bad value for 'fd' [ 319.852838][T12672] loop6: detected capacity change from 0 to 128 [ 319.863532][T12672] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 319.900472][T12672] hpfs: filesystem error: improperly stopped [ 319.919783][T12672] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 319.945053][T12672] hpfs: You really don't want any checks? You are crazy... [ 319.958968][T12672] hpfs: hpfs_map_sector(): read error [ 319.964807][T12672] hpfs: code page support is disabled [ 319.971394][T12672] hpfs: hpfs_map_4sectors(): unaligned read [ 319.979049][T12672] hpfs: hpfs_map_4sectors(): unaligned read [ 319.985266][T12672] hpfs: filesystem error: unable to find root dir [ 320.003126][T12672] hpfs: hpfs_map_4sectors(): unaligned read [ 320.012583][T12672] hpfs: hpfs_map_sector(): read error [ 320.019358][T12672] hpfs: hpfs_map_4sectors(): unaligned read [ 321.016797][T12632] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 321.022993][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 321.330515][T12696] loop6: detected capacity change from 0 to 32768 [ 321.344446][T12696] XFS (loop6): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 321.370031][T12696] XFS (loop6): Torn write (CRC failure) detected at log block 0x30. Truncating head block from 0x51. [ 321.386957][T12696] XFS (loop6): Starting recovery (logdev: internal) [ 321.400575][T12696] XFS (loop6): Ending recovery (logdev: internal) [ 321.440082][ T8581] XFS (loop6): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 321.803608][T12632] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 321.812247][T12632] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 321.819623][T12632] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 321.825743][T12632] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 321.832786][T12632] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 321.839683][T12632] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 321.845640][T12632] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 321.863879][T12632] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 322.035928][T12714] loop7: detected capacity change from 0 to 256 [ 322.058211][T12714] exfat: Deprecated parameter 'namecase' [ 322.067412][T12714] exfat: Deprecated parameter 'namecase' [ 322.084433][T12714] exFAT-fs (loop7): failed to load upcase table (idx : 0x00010000, chksum : 0x36dfe6b4, utbl_chksum : 0xe619d30d) [ 322.126838][ T10] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 322.127007][ T5868] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 322.298581][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 322.307901][T12724] loop7: detected capacity change from 0 to 1024 [ 322.319840][ T10] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 322.326391][ T5868] usb 7-1: Using ep0 maxpacket: 32 [ 322.329785][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.344610][ T10] usb 3-1: Product: syz [ 322.357201][ T5868] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 322.373727][T12724] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 322.386040][ T10] usb 3-1: Manufacturer: syz [ 322.386721][ T5868] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 322.401043][ T5868] usb 7-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 322.410191][ T5868] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 322.410917][ T10] usb 3-1: SerialNumber: syz [ 322.420695][ T5868] usb 7-1: config 0 descriptor?? [ 322.444205][ T10] r8152-cfgselector 3-1: Unknown version 0x0000 [ 322.453334][ T10] r8152-cfgselector 3-1: config 0 descriptor?? [ 322.463756][T12724] EXT4-fs (loop7): shut down requested (2) [ 322.555326][ T9373] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 322.659527][T12738] loop7: detected capacity change from 0 to 128 [ 322.670962][T12738] FAT-fs (loop7): bogus sectors per cluster 0 [ 322.694794][T12738] FAT-fs (loop7): Can't find a valid FAT filesystem [ 322.828263][T12744] loop4: detected capacity change from 0 to 1024 [ 322.835749][T12744] EXT4-fs: inline encryption not supported [ 322.853749][ T5868] savu 0003:1E7D:2D5A.0013: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.6-1/input0 [ 322.866427][T12744] EXT4-fs: Ignoring removed i_version option [ 322.874152][T12744] EXT4-fs: Ignoring removed orlov option [ 322.893043][T12744] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 322.931124][T12744] EXT4-fs error (device loop4): mb_free_blocks:2017: group 0, inode 15: block 177:freeing already freed block (bit 11); block bitmap corrupt. [ 322.994393][ T5827] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 323.082353][ T5868] r8152-cfgselector 3-1: USB disconnect, device number 22 [ 323.096971][ T52] Bluetooth: hci1: command 0x0c1a tx timeout [ 323.181313][ T797] usb 7-1: USB disconnect, device number 13 [ 323.645541][ T52] Bluetooth: hci1: connection err: -111 [ 323.817158][ T52] Bluetooth: hci2: command 0x0c1a tx timeout [ 323.897564][ T52] Bluetooth: hci4: command 0x0405 tx timeout [ 323.897573][ T5148] Bluetooth: hci3: command 0x0c1a tx timeout [ 324.025015][T12761] netlink: 'syz.6.2285': attribute type 2 has an invalid length. [ 324.066920][T12761] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2285'. [ 324.096806][T12761] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 324.289141][T12769] loop7: detected capacity change from 0 to 8192 [ 324.333726][T12769] FAT-fs (loop7): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 324.547891][T12784] loop6: detected capacity change from 0 to 256 [ 324.667546][T12789] syzkaller1: entered promiscuous mode [ 324.676594][T12793] loop7: detected capacity change from 0 to 1024 [ 324.683310][T12789] syzkaller1: entered allmulticast mode [ 324.683877][T12793] EXT4-fs: inline encryption not supported [ 324.714101][T12793] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 324.804949][T12800] loop6: detected capacity change from 0 to 1024 [ 324.833551][T12800] EXT4-fs: Ignoring removed oldalloc option [ 324.854797][T12800] EXT4-fs: Ignoring removed bh option [ 324.918065][T12800] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 324.968252][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 324.968269][ T30] audit: type=1800 audit(1761161570.583:186): pid=12800 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.2302" name="file1" dev="loop6" ino=15 res=0 errno=0 [ 325.058533][ T9373] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 325.089360][T12800] EXT4-fs error (device loop6): ext4_mb_mark_diskspace_used:4193: comm syz.6.2302: Allocating blocks 497-513 which overlap fs metadata [ 325.160957][T12800] EXT4-fs (loop6): pa ffff8880599880e8: logic 336, phys. 481, len 2 [ 325.169172][T12800] EXT4-fs error (device loop6): ext4_mb_release_inode_pa:5444: group 0, free 0, pa_free 1 [ 325.214762][ T2864] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.279829][ T8581] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 325.473736][ T2864] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.906933][ T2864] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.982298][ T5148] Bluetooth: hci3: command 0x0c1a tx timeout [ 326.101152][ T2864] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.138414][ T52] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 326.150573][ T52] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 326.168861][ T52] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 326.183134][ T52] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 326.199646][ T52] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 326.562152][T12846] loop4: detected capacity change from 0 to 512 [ 326.625934][T12846] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 326.656965][ T2864] bridge_slave_1: left allmulticast mode [ 326.662733][ T2864] bridge_slave_1: left promiscuous mode [ 326.679601][ T2864] bridge0: port 2(bridge_slave_1) entered disabled state [ 326.709270][ T2864] bridge_slave_0: left allmulticast mode [ 326.723130][T12846] ext4 filesystem being mounted at /461/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 326.749596][ T2864] bridge_slave_0: left promiscuous mode [ 326.780947][ T2864] bridge0: port 1(bridge_slave_0) entered disabled state [ 326.915210][ T5827] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 327.389333][ T797] IPVS: starting estimator thread 0... [ 327.486991][T12865] IPVS: using max 29 ests per chain, 69600 per kthread [ 327.504828][ T30] audit: type=1326 audit(1761161573.113:187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12866 comm="syz.6.2330" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe3d918efc9 code=0x0 [ 327.685105][ T2864] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 327.701996][ T2864] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 327.720196][ T2864] bond0 (unregistering): Released all slaves [ 327.947084][ T2864] bond1 (unregistering): Released all slaves [ 328.049966][ T9] syz0: Port: 1 Link DOWN [ 328.057070][ T5148] Bluetooth: hci3: command 0x0c1a tx timeout [ 328.090577][ T2864] tipc: Left network mode [ 328.296832][ T5148] Bluetooth: hci4: command tx timeout [ 328.416950][ T5868] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 328.576024][T12837] chnl_net:caif_netlink_parms(): no params data found [ 328.603319][ T5868] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 328.618810][ T5868] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 328.631515][ T5868] usb 5-1: Product: syz [ 328.638350][T12900] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI [ 328.650258][T12900] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 328.658685][T12900] CPU: 1 UID: 0 PID: 12900 Comm: syz.6.2343 Not tainted syzkaller #0 PREEMPT(full) [ 328.668058][T12900] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 328.678114][T12900] RIP: 0010:io_uring_show_fdinfo+0x371/0x1840 [ 328.684171][T12900] Code: 0f 85 29 04 00 00 45 8b 36 44 89 f7 44 89 ee e8 a5 ec 94 00 45 39 ee 76 11 e8 db ea 94 00 45 89 fd 4c 8b 3c 24 e9 c9 03 00 00 <80> 3b 00 45 89 fd 0f 85 17 04 00 00 0f b6 2c 25 00 00 00 00 48 8b [ 328.703767][T12900] RSP: 0018:ffffc9001556f928 EFLAGS: 00010293 [ 328.709827][T12900] RAX: ffffffff812b42ab RBX: dffffc0000000000 RCX: 0000000000000002 [ 328.717785][T12900] RDX: ffff8880302a9e40 RSI: 00000000000007ff RDI: 0000000000000000 [ 328.725738][T12900] RBP: 0000000000000000 R08: ffff888027bc00ab R09: 1ffff11004f78015 [ 328.733688][T12900] R10: dffffc0000000000 R11: ffffed1004f78016 R12: 0000000000000008 [ 328.741903][T12900] R13: 00000000000007ff R14: 0000000000000000 R15: 0000000000000000 [ 328.749855][T12900] FS: 00007fe3d9fb76c0(0000) GS:ffff888126029000(0000) knlGS:0000000000000000 [ 328.758766][T12900] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 328.765330][T12900] CR2: 000000110c2f594c CR3: 000000005ad64000 CR4: 00000000003526f0 [ 328.773297][T12900] Call Trace: [ 328.776557][T12900] [ 328.779475][T12900] ? do_raw_spin_unlock+0x122/0x240 [ 328.784665][T12900] ? __pfx_io_uring_show_fdinfo+0x10/0x10 [ 328.790370][T12900] seq_show+0x5bc/0x730 [ 328.794508][T12900] seq_read_iter+0x4ef/0xe20 [ 328.799101][T12900] seq_read+0x369/0x480 [ 328.803241][T12900] ? __pfx_seq_read+0x10/0x10 [ 328.807901][T12900] ? rw_verify_area+0x2a6/0x4d0 [ 328.812735][T12900] ? __lock_acquire+0xab9/0xd20 [ 328.817565][T12900] ? __pfx_seq_read+0x10/0x10 [ 328.822224][T12900] vfs_read+0x200/0xa30 [ 328.826364][T12900] ? fdget_pos+0x247/0x320 [ 328.830763][T12900] ? __pfx___mutex_lock+0x10/0x10 [ 328.835770][T12900] ? __pfx_vfs_read+0x10/0x10 [ 328.840428][T12900] ? __fget_files+0x2a/0x420 [ 328.845001][T12900] ? __fget_files+0x3a0/0x420 [ 328.849660][T12900] ? __fget_files+0x2a/0x420 [ 328.854239][T12900] ksys_read+0x145/0x250 [ 328.858725][T12900] ? __pfx_ksys_read+0x10/0x10 [ 328.863472][T12900] ? do_syscall_64+0xbe/0xfa0 [ 328.868129][T12900] do_syscall_64+0xfa/0xfa0 [ 328.872615][T12900] ? lockdep_hardirqs_on+0x9c/0x150 [ 328.877800][T12900] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.884020][T12900] ? clear_bhb_loop+0x60/0xb0 [ 328.888681][T12900] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.894555][T12900] RIP: 0033:0x7fe3d918efc9 [ 328.898953][T12900] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 328.918540][T12900] RSP: 002b:00007fe3d9fb7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 328.926940][T12900] RAX: ffffffffffffffda RBX: 00007fe3d93e5fa0 RCX: 00007fe3d918efc9 [ 328.934891][T12900] RDX: 000000000000008b RSI: 0000200000000080 RDI: 0000000000000004 [ 328.942842][T12900] RBP: 00007fe3d9211f91 R08: 0000000000000000 R09: 0000000000000000 [ 328.950796][T12900] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 328.958746][T12900] R13: 00007fe3d93e6038 R14: 00007fe3d93e5fa0 R15: 00007fff26059278 [ 328.966709][T12900] [ 328.969708][T12900] Modules linked in: [ 328.975017][T12900] ---[ end trace 0000000000000000 ]--- [ 328.980968][ T5868] usb 5-1: Manufacturer: syz [ 328.985799][ T5868] usb 5-1: SerialNumber: syz [ 328.998517][ T5868] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 329.007454][T12900] RIP: 0010:io_uring_show_fdinfo+0x371/0x1840 [ 329.017430][T12900] Code: 0f 85 29 04 00 00 45 8b 36 44 89 f7 44 89 ee e8 a5 ec 94 00 45 39 ee 76 11 e8 db ea 94 00 45 89 fd 4c 8b 3c 24 e9 c9 03 00 00 <80> 3b 00 45 89 fd 0f 85 17 04 00 00 0f b6 2c 25 00 00 00 00 48 8b [ 329.037801][ T2864] hsr_slave_0: left promiscuous mode [ 329.038144][T12900] RSP: 0018:ffffc9001556f928 EFLAGS: 00010293 [ 329.049312][ T2864] hsr_slave_1: left promiscuous mode [ 329.049341][T12900] RAX: ffffffff812b42ab RBX: dffffc0000000000 RCX: 0000000000000002 [ 329.055288][ T2864] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 329.062950][T12900] RDX: ffff8880302a9e40 RSI: 00000000000007ff RDI: 0000000000000000 [ 329.071509][ T2864] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 329.079555][ T5903] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 329.094924][T12900] RBP: 0000000000000000 R08: ffff888027bc00ab R09: 1ffff11004f78015 [ 329.100968][ T2864] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 329.105517][T12900] R10: dffffc0000000000 R11: ffffed1004f78016 R12: 0000000000000008 [ 329.112587][ T2864] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 329.118783][T12900] R13: 00000000000007ff R14: 0000000000000000 R15: 0000000000000000 [ 329.126390][ T5946] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 329.133784][T12900] FS: 00007fe3d9fb76c0(0000) GS:ffff888125f29000(0000) knlGS:0000000000000000 [ 329.151757][T12900] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 329.158477][T12900] CR2: 00007f4e117b4198 CR3: 000000005ad64000 CR4: 00000000003526f0 [ 329.158800][ T2864] veth1_macvtap: left promiscuous mode [ 329.166459][T12900] Kernel panic - not syncing: Fatal exception [ 329.166718][T12900] Kernel Offset: disabled