last executing test programs: 1.808252386s ago: executing program 3 (id=165): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x2, 0x8) mknodat$null(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x2000, 0x103) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000340), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0), 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f0000000b40)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000002b80)={0x50, 0x0, r2, {0x7, 0x1f, 0x0, 0x10400, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4}}, 0x50) syz_fuse_handle_req(r1, &(0x7f0000002c00)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e48e435000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f2ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffff2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005a99e6a60000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007d7a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea21056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004b68d3810000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f3ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ebff00", 0x2000, &(0x7f0000004c00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000004cc0)={0x20, 0x0, 0x88, {0x0, 0x11}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000004d00)='./file0\x00', 0x101101, 0x0) writev(r3, 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r3, 0x4c06, r0) umount2(&(0x7f0000004dc0)='./file0\x00', 0x1) 1.715742408s ago: executing program 1 (id=167): pipe2(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RGETLOCK(r1, 0x0, 0xffffff6a) pipe2(&(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) tee(r0, r3, 0xfffffffffffffc01, 0x0) vmsplice(r2, &(0x7f0000000780)=[{&(0x7f00000007c0)="b0", 0x1}], 0x1, 0xa) 1.712898908s ago: executing program 2 (id=168): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x28080, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae03, 0x33) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xfffffffffffffe1f}, 0x0) process_vm_writev(0x0, &(0x7f00000032c0)=[{&(0x7f0000003340)=""/4096, 0x1000}, {&(0x7f0000004340)=""/48, 0x30}, {&(0x7f0000005480)=""/4107, 0x100b}, {0x0}], 0x4, &(0x7f0000004400)=[{&(0x7f00000043c0)}], 0x1, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0xa00008, &(0x7f0000000080)={[{@grpquota}, {@errors_remount}]}, 0x3, 0x7b5, &(0x7f0000000500)="$eJzs3c9rG9kdAPDvyJbtOGntQqFNT4ZCawiR69RNWig0pYdSaCDQnpMYWTGpZStYcoiNIQml0EsPLT0sbC45b3azt1z3x3X3sn/DHpaE7K4TNsseFi8jjRLZlhwltuQs/nxgrPdmnvTeV2/mzbNmkAI4tCbSP7mI4xH5NDmWrU8iWxGDEWcb5Z5urBfTJYnNzb99kdTLPNlYL0bLc1JHs8xPI+KDf0WcyO2st7q6tjBbLpeWs/xUbfHqVHV17eSVxdn50nxp6fT0zMypM785c3r/Yv3q47VjD//751++c/abf/7k3n8+TOJsHMu2tcaxXyZiIntP8ulbuMWf9ruyA5Z0VaabUvRTemgONI7yOB5jMbBLH/2hry0DAHrlRkRsAgCHTOL8DwCHTPNzgCcb68XmEo3rOTcP9IOJPnn0x4gYacTfvL7Z2DLYuGb3yUj9Oujok6R+jaQpiYjxfah/IiJu379wN12iR9chAdq5eSsiLo1PbB//0xFu+z0LL+tXXZSZ2JY3/kH/vJfOf367c/4XkcuO/5H63+3zn+E2x+6rePHxn3uwJZvfh0pbpPO/37fc2/a0Jf7M+ECW+0F9zpdPLl8pl9Kx7YcRMRn54TQ/vUsdk4+/fdxpW+v878v//eOttP708XmJ3IPB4a3PmZutze4l5laPbkX8bLBd/Mmz/k86zH/Pd1nHX3737zc7bUvjT+NtLjvj763NOxG/aNv/z++DSna9P3GqvjtMNXeKNt799I3RTvW39v/t+2lN68Xm/wL9kPb/6O7xjyet92tWX76Oj+6Mvd9p29b4L9xN698af/v9fyj5ez09lK27PlurLU9HDCV/3bn+1PPnNvPN8mn8kz9vf/zvtv+nw9ClLL35gtsaBx9+/varx99bafxzaf8nWRAv7P+XT9x7ujDQqf7u+n+mnprM1uwc/wZ3vG63DdzTmwcAAAAAAAAAAAAAAAAAAAAAAAAAXcpFxLFIcoVn6VyuUGj8hvePYzRXrlRrJy5XVpbmov5b2eORzzW/6nKs5ftQp7Pvw2/mT23L/zoifhQR/x8+Us8XipXy3EEHDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZox1+/z/12fBBtw4A6JmRg24AANB3zv8AcPh0OP8PtV99pKdtAQD6o37+TwYPuhkAQB/5/B8ADh/nfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHrs/Llz6bL59cZ6Mc3PXVtdWahcOzlXqi4UFleKhWJl+WphvlKZL5cKxcpixxe62XgoVypXZ2Jp5fpUrVStTVVX1y4uVlaWahevLM7Oly6W8n2LDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC6V11dW5gtl0vLErsnbrwWzbiVddueXzAfr0M4EntLDEdEr6poHSWOHMzgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPA98F0AAAD///BHHvM=") quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000cc0)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000d00)='./file1\x00') 1.6472014s ago: executing program 1 (id=170): syz_mount_image$ext4(&(0x7f0000002c40)='ext3\x00', &(0x7f0000002d80)='./file0\x00', 0x0, &(0x7f0000000140)={[{@noload}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x1}}, {@usrjquota}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x4}}, {@data_err_ignore}, {@usrjquota}]}, 0xff, 0x44d, &(0x7f0000002e40)="$eJzs3MtvG8UfAPDvrp30/Ut+UB4tLQQKouKRNOnzwKUIJA4gIcGhiFNI0qrUbaAJEq0qKBzKEVXijjgi8RdwggsCTkhc4Y4qVaiXFiQko13vpsa107hx6rb+fKRNZrzjzHx3d+zZGTsBDKyx7EcSsTkifouIkUb2vwXGGr+uXTk389eVczNJ1Otv/Jnk5a5eOTdTFi2ft6mRqdeL/Lo29V54O2K6Vps7XeQnFk++N7Fw5uzzx09OH5s7Nndq6tChfXt3Dh+Y2t+TOLO4rm7/aH7HtlfeuvjazJGL7/z0TdbezcX+5jh6ZaxxdNt6qteV9dmWpnRS7WND6EolIrLTNZT3/5GoxIalfSPx8qd9bRywpur1er3d+3PhfB24hyXR7xYA/VG+0Wf3v+V2m4Yed4TLhyPeP9iI/1qxNfZUIy3KDLXc3/bSWEQcOf/3l9kWazQPAQDQ7LvDEfFcu/FfGg82lftfsYYyGhH/j4j7IuL+iNgaEQ9E5GUfioiHu6y/dYXkxvFPeumWAluhbPz3QrG2tTT++6eex18YrRS5LXn8Q8nR47W5PcUx2R1D67L85DJ1fP/Sr5932tc8/su2rP5yLNiQXqq2TNDNTi9OrzLsJZc/idhebYk/l0S5jJNExLaI2N7VX75+h3H8ma93dCp18/iX0YN1pvpXEU83zv/5aIm/lHRcn5w8eGBq/8T6qM3tmSivihv9/MuF1zvVv6r4eyA7/xtbr//cUvyjyfqIhTNnT+TrtQvd13Hh98863tPc6vU/nLyZp4eLxz6cXlw8PRkxnLx64+NT159b5svyWfy7d7WLP81f48oj8UhEZBfxzoh4NCIeK9r+eEQ8ERG7lon/xxeffLf7+JeZle+hLP7Zm53/aD7/3ScqJ374tvv4S9n535endhePrOT1b6UNXM2xAwAAgLtFmn8GPknHl9JpOj7e+Az/1tiY1uYXFp89Ov/BqdnGZ+VHYygtZ7pGmuZDJ4u54TI/1ZLfW8wbf1HZkOfHZ+Zrs/0OHgbcpg79P/NHpd+tA9ac72vB4NL/YXDp/zC49H8YXPo/DK52/f/jPrQDuP28/8Pg0v9hcOn/MLj0fxhIHb8bn67qK/8S93wi0u6fVY07pPF3U6K64n9mcYuJdW139fuVCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoDf+DQAA//9X4u4v") mknod$loop(&(0x7f0000003380)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x6000, 0x1) 1.6291163s ago: executing program 3 (id=172): socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/locks\x00', 0x0, 0x0) read$hiddev(r0, &(0x7f0000000b00)=""/4092, 0xffc) 1.534786883s ago: executing program 3 (id=174): mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000001640)={0x2, {{0x2, 0x2, @multicast2}}, 0x1}, 0x90) 1.497712823s ago: executing program 3 (id=176): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r0, 0x107, 0x14, 0x0, &(0x7f0000000240)) 1.478457584s ago: executing program 2 (id=178): prlimit64(0x0, 0xe, 0x0, 0x0) unshare(0x20000400) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000540)='ns/pid_for_children\x00') ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) 1.424240725s ago: executing program 3 (id=179): setuid(0xee01) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) splice(r1, 0x0, r3, 0x0, 0x38f9, 0x0) fcntl$setstatus(r2, 0x4, 0x42c00) write(r0, &(0x7f00000002c0), 0xffffff4a) 1.416884415s ago: executing program 1 (id=181): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newsa={0x13c, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0x1234, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x4d2, 0x33}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa, 0x2}, [@algo_auth_trunc={0x4c, 0x14, {{'hmac(sha1)\x00'}, 0x0, 0xa0}}]}, 0x13c}}, 0x0) 1.413250515s ago: executing program 2 (id=182): mknod$loop(&(0x7f0000000000)='./file0\x00', 0x6000, 0x0) creat(&(0x7f0000000040)='./file0\x00', 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f00000001c0)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) setitimer(0x0, 0x0, 0x0) alarm(0x4) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) write$cgroup_pid(r0, &(0x7f0000000380), 0xffffffa0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x3, 0x200000c, 0x401d031, r0, 0x0) open(0x0, 0x80242, 0x0) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x1d8) openat$kvm(0xffffffffffffff9c, 0x0, 0x20a00, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000280)={'wlan0\x00'}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x4044090}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000140)={'\x00', 0x3f, 0x4a, 0x400404, 0x40000000, 0xfffffffffffeff01}) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x1018e58, &(0x7f00000003c0)={[{@sysvgroups}, {@noblock_validity}, {@data_err_ignore}, {@max_batch_time={'max_batch_time', 0x3d, 0x7}}, {@nodiscard}, {@stripe={'stripe', 0x3d, 0x4}}, {@noauto_da_alloc}]}, 0x6, 0x61f, &(0x7f0000001000)="$eJzs3c9rXNUeAPDvncmkSZv30j4ej9fyHi/wFi1I00wtVt3Y1oVdFCzYhYiLhiapodMfNCmYWGgKLhQURNyKdOM/4F66dyeCunMtVJGKikpH7syddDKZSdIkM9Pmfj5wM/ece2fO+c6dM/fce3PmBpBbY+mfQsT+iAfnk4jRpmUjUV84lq13/6ebF9IpiWr1lR+TSLK8xvpJ9rgnSwxFxJenIv5RXF3u3MLipclKte5WxJH5y9eOzC0sHp69PHlx+uL0lfLRZ48dn3iufKy8LXHuyR5Pn3n5P++//cYzM19VDidxIs6V3pqKlji2y1iMxYMsxOb8gYg4ns60eV+eNDsghFwrZp/HUkT8K0ajWEvVjcbse32tHNBV1WJEFcipRPuHnGr0AxrH9hs7Dj7X5V5J79w7WT8AWh3/QP3cSAzVjo1230+ajowGauc29m5D+WkZf9488HE6xYrzEL8ub52BbSink6XbEfHvdvEntbrtrUWaxl9YUY8kIiYiYjCr34tbqEPSNN+N8zBr2Wz8hYg4kT2m+ac2Wf5YS7rX8QOQT3dPZjvypTT1cP+X9j0a/Z9Y1f+pXxtq3XdtRr/3f537f439/VDtHHmhpR+W9lnOtn/JUmvGd++e/rBT+c39v3RKy2/0BXvh3u2IAy3xv5MGm/V/0viTNts/XeX8iY2V8dLXP5zutKzf8VfvRBxse/zzsFeazrVenxzOlpWPlY/MzFamJ+p/25bx+Revf9qp/H7Hn27/3R3ib9r+hdbnpe/JtQ2W8dnZO5c7LRtZN/7C94NJ/XhzMMt5c3J+/no5YjA5k61Sv5BVyz+6dl0a6zReI43/0P/bt/8Vn//bK19nuPGVuQHXXr10v9OyzWz/povJD6obrEMnafxT62//Ve0/zftgOXVrzTJ+ee3GfzstWyv+4S3GBgAAAAAAAHlTqF2DTQrjy/OFwvh4fbzsP2N3oXJ1bv6pmas3rkxFHKr9P2Sp0LjSPVpPJ2m6nP0/bCN9tCX9dETsi4iPisO19PiFq5WpfgcPAAAAAAAAAAAAAAAAAAAAj4k92fj/xn2qfy7Wx/8DOdHNG8wBjzftH/Kr1v5X3eIJyAP7f8gv7R/yS/uH/NL+Ib+0f8gv7R/yS/uH/NL+AQAAAGBH2ve/u98mEbH0/HBtSg1my4wIgp2t1O8KAH1T7HcFgL5ZvvSvsw+5s6H+/+/ZjwN2vzpAHyTtMmudg+rajf9u22cCAAAAAAAAAAAAAF1wcH/78f+JscGw4xn2B/m1hfH/fjoAnnB++h/yyzE+sN4o/qFOC4z/BwAAAAAAAAAAAICeGalNSWE8Gws8EoXC+HjE3yJib5SSmdnK9ERE/D0ivimWdqXpcr8rDQAAAAAAAAAAAAAAAAAAADvM3MLipclKZfp688wfq3J29kzjLqg9KOuFeMRnRdL7t2U4IpZzShGPWufuzezKPrZbeZ2BuYXF5LdqTRKxFI9PgFuKa5tn1v3qGOzqFxMAAAAAAAAAAAAAAAAAAORQ09jj9g580uMaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDvPbz/f/dm+h0jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPBk+isAAP//GjM9YA==") 1.21923227s ago: executing program 1 (id=183): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x3, 0x8, &(0x7f0000000a00)=@framed={{0x18, 0x6}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x8000000}}]}, &(0x7f0000000a40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 1.21301181s ago: executing program 1 (id=184): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000340)={@remote, 0x200000, 0x0, 0xff, 0x1, 0x0, 0xfffe}, 0x20) 1.204114411s ago: executing program 1 (id=185): r0 = syz_usb_connect(0x2, 0x62, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000fb5d7d086d04c308166b0102030109025000010000000009041f0000ff0100000a24010400050201020724070500000508240805040004960d2406010103020001000600060924030505030605810924030601030405050724"], 0x0) syz_usb_control_io(r0, &(0x7f0000000200)={0x2c, &(0x7f0000000000)={0x20, 0xf, 0x2, {0x2, 0x23}}, &(0x7f0000000040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x4001}}, &(0x7f0000000100)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, 0x0, 0x0}, 0x0) 947.820157ms ago: executing program 2 (id=192): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000380)=0x100000b3, 0x4) bind$inet(r0, &(0x7f00000003c0)={0x2, 0x4e20, @empty}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000400)=0x100000b3, 0x4) bind$inet(r1, &(0x7f0000000440)={0x2, 0x4e20, @empty}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000480)=0x100000b3, 0x4) bind$inet(r2, &(0x7f00000004c0)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r2, &(0x7f0000000500)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) 893.971528ms ago: executing program 2 (id=194): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) timer_create(0x0, &(0x7f0000000340)={0x0, 0x21, 0x800000000004}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f00000005c0)={0x10, 0x0, 0x0, 0x10000000000041}, 0xc) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000600)={{{@in6=@remote, @in=@private=0xa010100, 0x0, 0x0, 0x4e20, 0x0, 0x2}, {0x0, 0x0, 0x4, 0x100, 0x1, 0x0, 0x9c0, 0x3}, {0xffffbffffffffffc, 0x0, 0x0, 0x1}, 0x0, 0x0, 0x1, 0x0, 0x1}, {{@in=@empty, 0x4d3, 0x3c}, 0xa, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3505, 0x4, 0x0, 0x8, 0x83, 0x4000800, 0x6}}, 0xe8) connect$inet6(r2, &(0x7f0000000700)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) 892.908538ms ago: executing program 2 (id=195): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x62020600) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000080)=@raw={'raw\x00', 0x9, 0x3, 0x1e8, 0x0, 0xffffffff, 0xffffffff, 0xb8, 0xffffffff, 0xb8, 0xffffffff, 0xffffffff, 0x150, 0xffffffff, 0x3, 0x0, {[{{@ip={@loopback, @loopback, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0xb8, 0x0, 'pptp\x00'}}}, {{@ip={@empty, @empty}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x248) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_usb_connect(0x3, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000091c2f20c81403006c050102030109021b02010000000009040000018ea44300090585", @ANYRES64], 0x0) 855.935049ms ago: executing program 0 (id=196): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x8, &(0x7f0000000200)={[{@nodioread_nolock}, {@sb={'sb', 0x3d, 0x1}}]}, 0x4, 0x523, &(0x7f0000000240)="$eJzs3cFvG1kZAPBvnLhJs+mmC3sABGxZFgqq6iTubrTqhfYCQlUlRMWJQxsSN4pi11Hsiib0kB65V6ISJ+A/4MYBqScO3LjBjUs5IBWoQA0SB6MZT1I3sZNAnbiJfz9pMvPeTP29F/e953mR5wUwtC5ExGZEnImIOxExlecn+RbX2lt63csXDxe2XjxcSKLVuvX3JDuf5kXHv0m9k7/meER8/zsRP0r2xm2sb6zMV6uVtTw93aytTjfWNy4vF/Kc8tzs3MynVz4p962uH9R+/fzbyzd+8NvffOnZHza/+ZO0WJM/PZed66xHP7WrXozJjrzRiLhxFMEGZDT//8PJk7a2z0TEh1n7n4qR7N0EAE6zVmsqWlOdaQDgtEvv/ycjKZTyuYDJKBRKpfYc3vsxUajWG81LU/X79xYjm8M6H8XC3eVqZSafKzwfxSRNz2bHr9Ll19KPK1ci4r2IeDx2NjtfWqhXFwf5wQcAhtg7u8b/f421x/9OxUEVDgA4OuODLgAAcOyM/wAwfIz/ADB8/ofx37cDAeCUcP8PAMPH+A8Aw+fA8f/R8ZQDADgW37t5M91aW+3nX28/qfvyYqWxUqrdXygt1NdWS0v1+lK1UlpotQ56vWq9vjr78U6ysb5xu1a/f695e7k2v1S5XfEsAQAYvPc+ePqndNDfvHo226JjLQdjNZxuhUEXABiYkUEXABgY3+eB4XWIe3zTAHDKdVmity2fIEh6XfDE4q9wUl38vPl/GFZvMv9v7gBOtv9v/v9bfS8HcPyM4TC8Wq3Emv8AMGTM8QM9//6f6/mIkCf9LwsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcFJPZlhRK2Vrgm+nPQqkUcS4izkcxubtcrcxExLsR8cex4lianh10oQGAN1T4a5Kv/3Vx6qPJ3WfPJP8ey/YR8eOf3/rZg/lmc202zf/HTn7zSZp/trlWPjOICgAAna7tzcrG73K+77iRf/ni4cL2dpxFfH69vbhoGncr39pnRmM0249HMSIm/pnk6bb088pIH+JvPoqIz23XfzwedESYzOZA2iuf7o6fxj7X9/idv//d8Quv1beQnUv3xex38dnYVTjgQE+vt/vJvO2lTTxvf4W4kO27t//xrId6c2n/lzbXrT39X2Gn/xvZEz/J2vyFnfT+JXn+8e++uyezNdU+9yjiC6Pd4ic78ZPu/W/xo0PW8c9f/PKHvc61fhFxsWv9t1ekrmXd7HSztjrdWN+4vFybX6osVe6Vy3OzczOfXvmkPJ3NUbd//r5bjL9dvfRur/hp/Sd6xB/fv/7xtUPW/5f/ufPDr+wT/xtf7f7+v79P/HRM/Poh489PXOu5fHcaf7FH/Q94/+PSIeM/+8vG4iEvBQCOQWN9Y2W+Wq2sHXCQftY86BoHhz9I7+3fgmJkB7EZ0a8XzCYlIqLrNekn6rejykd1kAws+q/6/YKD7pmAo/aq0Q+6JAAAAAAAAAAAAAAAQC+N9Y2Vse7f1urbwaDrCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwOn13wAAAP//KHnENg==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x10b442, 0x79) r1 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./file2\x00', 0x42, 0xe) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000800)={0x0, r0, 0x9, 0x3, 0x4, 0x1000000000001}) 748.806022ms ago: executing program 0 (id=197): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8082, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000001340)={0x29}) ioctl$KVM_GET_CPUID2(r2, 0xc008ae91, &(0x7f0000000080)) 740.886591ms ago: executing program 0 (id=198): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x889, &(0x7f0000000180)={[{@debug}, {@nouser_xattr}, {@nodioread_nolock}, {@test_dummy_encryption}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x100}}, {@nodelalloc}, {@minixdf}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x40}}]}, 0x4, 0xbaf, &(0x7f00000025c0)="$eJzs3M1rXFUbAPDn3ny2zftO+vIi1k0jIi2o07SSYotgKxU3LgTdCg3ppIRMP0giNWkWE/0HRF0LbgS1KF3YdTcKbt1o3VpcCEVioyCikTsfSWxmkrSd5Ibk94Mz95w5d+Z5nrlM7j0wNwHsWgPZQxpxICLOJhGF+vNpRHRXe70Rldp+C/OzI7/Pz44ksbj42i9JJBFxd352pPFeSX27rz7ojYhvX0zif++sjjs5PTM+XC6XJurjI1MXLh+ZnJ55ZuzC8PnS+dLFo8efGzo2dHzwxFDbav3jx1M3fnv85Z8qf37617Vf3/84iVPRV59bWUe7DMTA0meyUmdEDLc7WE466vWsrDPpXOdF6SYnBQBAS+mKa7hHohAdsXzxVoivvss1OQAAAKAtFjsiFgEAAIAdLrH+BwAAgB2u8TuAu/OzI42W7y8Sttad0xHRX6t/od5qM51RqW57oysi9t5NYuVtrUntZQ9tICJu/3Dii6zFJt2HvJbKXEQ82uz4J9X6+6t3ca+uP42IwTbEH7hnvN3qf7q7df2n2hA/7/oB2J1unq6dyFaf/9Kl659ocv7rbHLuehB5n/8a138Lq67/luvvaHH99+oGY1z95MMrreay+p+/8dLnjZbFz7YPVdR9uDMX8Vhns/qTpfqTFvWf3WCMwt9XSq3m8q5/8aOIQ9G8/oZk7f9PdGR0rFwarD02jTH3zdBnreLnXX92/Pe2qH+94395gzHeOHPmequ59etPf+5OXq/2uuvPvDU8NTVxNKI7eWX188fqN7S30Nin8R5Z/YefWPv736z+LESl/jlka4G5+jYbv31PzBeuXf1yrfqztV+ex//cAx7/dzcY48mv3zvcam7l+jdrWfzbSW0tDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANaUT0RZIWl/ppWixG7IuI/8fetHxpcuqp0UtvXjyXzUX0R1c6OlYuDUZEoTZOsvHRan95fOye8bMRsT8iPijsqY6LI5fK5/IuHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCX7IqIvkrQYEWlELBTStFjMOysAAACg7frzTgAAAADYdNb/AAAAsPNZ/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDJ9h+8eSuJiMrJPdWW6a7PdeWaGbDZ0rwTAHLTkXcCQG46804AyM19rvFdLsAOlKwz39typqftuQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwfR06cPNWEhGVk3uqLdNdn+tq+oqDW5gdsJnSvBMActOx1mTn1uUBbD1fcdi9mq/xgd0kWWe+d3mfyr9nejYtJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC2n75qS9JiRKTVfpoWixH/iYj+6EpGx8qlwYj4b0R8X+jqycY9eScNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA201Oz4wPl8ulCR0dnXw7yfZIo9bJ+y8TAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5mJyeGR8ul0sTk3lnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAORtcnpmfLhcLk1soHP9fnZe0cm7RgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8vNPAAAA///5ZQ4Q") r0 = socket$igmp(0x2, 0x3, 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x9a) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000440), 0x0, &(0x7f0000000480)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}}) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="10000000", @ANYRES64=r1], 0x10) setsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) 645.877094ms ago: executing program 0 (id=199): mount(0x0, &(0x7f0000000540)='sys\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x0, 0x100000000, 0x0, 0x81, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f00000001c0)) mount(0x0, &(0x7f0000000380)='./proc\x00', &(0x7f00000003c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000440)='100', 0x3) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000980)={'sit0\x00', &(0x7f00000009c0)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0xd1, 0x0, 0x0, @loopback, @multicast1}}}}) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 581.271826ms ago: executing program 3 (id=201): mkdirat(0xffffffffffffff9c, 0x0, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) add_key(&(0x7f0000000500)='keyring\x00', &(0x7f0000000540)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) unshare(0x100000) r3 = openat(0xffffffffffffff9c, &(0x7f00000012c0)='.\x00', 0x0, 0x0) flistxattr(r3, 0x0, 0xfffffc86) mmap$IORING_OFF_SQ_RING(0x0, 0x5, 0x2, 0x2172, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000b40), 0x0, &(0x7f0000000b80), 0x0) 580.885515ms ago: executing program 0 (id=203): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = syz_clone(0xb2b60000, 0x0, 0xfffffffffffffcd1, 0x0, 0x0, 0x0) r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) open_tree(0xffffffffffffff9c, &(0x7f0000000a00)='\x00', 0x81101) syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0) 156.648796ms ago: executing program 4 (id=209): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events.local\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) unshare(0x20040600) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_udp_int(r1, 0x11, 0xa, &(0x7f0000000200)=0x4, 0x16) 143.964886ms ago: executing program 4 (id=210): r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_opts(r0, 0x0, 0x16, &(0x7f0000000000)=""/10, &(0x7f0000000040)=0xffffffd4) 127.332957ms ago: executing program 4 (id=211): bpf$PROG_LOAD(0x5, &(0x7f00000016c0)={0x10, 0x4, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 53.086278ms ago: executing program 4 (id=212): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000140)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000000)={0x0, {0x2, 0x4e23, @empty}, {0x2, 0xfffe, @dev={0xac, 0x14, 0x14, 0x20}}, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x107, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffffffffffc}) 52.935098ms ago: executing program 4 (id=213): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000022c0)=ANY=[@ANYBLOB="020300030d00000000000000000000000100090000000000030006006c0000000200000000000000000000000000000002000100000000000002060b00000000030005003c00000002004e23ac1414aa0000000000000000020013000300"], 0x68}, 0x1, 0x7}, 0x0) 45.119699ms ago: executing program 4 (id=214): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x80a, &(0x7f0000000100), 0x1, 0x7b5, &(0x7f0000000540)="$eJzs3c9rHNcdAPDvrH7ZslurUKjdi3VqDcYr21XtFgqV6aEUajC059pitRaqVlqjXRlL6BATAoEQkpgcEpJLzvnh3HINyTl/Qy4hBBsnkU0ccggbZn9IK620+mHtyrY+HxjpvZk3+953Z+fN253HbgAH1nD6JxNxIiJeTyKO1dcnEdFXTfVGjNXKPV5eyqVLEpXKf75LqmUeLS/lommf1JF65nhEfPZSxOlMa72lhcXp8UIhP1fPj5RnboyUFhbPTM2MT+Yn87MXzo2Onr/454sX9i7WH75YPHr/jX/+8aOxn1783d1XP09iLI7WtzXHsVeGY7j+nPSlT+Ea/9jryvZZst8NYFfSU7OndpbHiTgWPdUUAPA8S6//FQDggElc/wHggGl8DvBoeSnXWPb3E4nuenApIklq8Tfub9a29Nbv2R2q3gcdfJREb/2OaOzh/a7hiHj3k/99kC7RofuQABt54XZEXBsabu3/k5Y5Czt1dhtlhtfl9X/QPZ9eioi/bDT+y6yMf2Jl/LNqYINzdzeGI/qb863nf+behjv+fQ8qr4///lab25YG2jT+W5m0NtRTz/0qzZyMiKlCPu3bfh0Rp6Jv4PpUIX+uTR2nHv78cLNtzeO/7+/8//20/vT/aonMvd6BtftMjJfHnyTmZg9uR/y+d3Vu3+OW/v9Qday7/vin6660e+CTq8l//fXldzYrlsafxttYWuPvrMp7EX+IjeNvSNrOTxxJD//Z2t+N6/j4q7cGN6u/+finS1p/471AN6THf7B9/ENJ83zN0t7Wv3X8G7/++5P/VtONzuPWeLk8dy6iP/l36/rzq/s28o3yafy1SNfHn2n7+k/fCV7bZoy997/9cPfxr+jIFMs0/okdHf+dJ+4+nu7Zffzp8R+tpk7V12yn/yvk+2M7DXyS5w4AAAAAAAAAAAAAAAAAAAAAAAAAtisTEUcjyWRX0plMNlv7De/fxmCmUCyVT18vzs9ORPW3soeiL9P4qsvGdyw2vv90qLY9SfPn1+X/FBG/iYg3Bw5X89lcsTCxz7EDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQMORTX7/P/XNQJsdk95uNREA6IRDW5Z4mF+TrVQqlQ62BwDovK2v/63efq0DDQEAuqbN9f9wN9sBAHTPbt7/AwDPNtd/ADh4XP8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADosCuXL6dL5cflpVyan7i5MD9dvHlmIl+azs7M57K54tyN7GSxOFnIZ3PFma0er1As3hiN2flbI+V8qTxSWli8OlOcny1fnZoZn8xfzfd1JSoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2JnSwuL0eKGQn3suEq9ExNo1laejYU+eSOKpaMa+JL4+8+XxdmXubPEyHnsqonjGEvvdMwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8G34JAAD//7M8Jlw=") r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000012c0)='.\x00', 0x0, 0xe9) mount$bind(0x0, &(0x7f0000001940)='.\x00', 0x0, 0x21, 0x0) getdents(r0, 0xfffffffffffffffd, 0xffffff47) 0s ago: executing program 0 (id=215): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='fd/3\x00') r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000001c0)={0x6000000d}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000600)={0x2000000a}) epoll_wait(r1, &(0x7f0000000640)=[{}], 0x1, 0x0) 0s ago: executing program 0 (id=216): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1df) mount(0x0, &(0x7f0000002800)='./proc\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000002840)='myproc\x00', 0x1ff) mount(0x0, &(0x7f0000002880)='myproc\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000028c0)='myproc/iomem\x00', 0x0, 0x0) read(r0, &(0x7f0000002900), 0xfa0) syz_clone3(&(0x7f0000002940)={0x2140280, 0x0, 0x0, 0x0, {0x20080021}, 0x0, 0x0, 0x0, &(0x7f00000029c0)}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000002a00)='myproc\x00', 0x280, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002a40)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000002a80)='./config\x00', &(0x7f0000002ac0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002b00)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000002b40)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000002b80)='./config/usb_gadget/g1/functions/midi.usb0/id\x00', 0x1, 0x0) write(r1, &(0x7f0000002bc0)='Mid', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000002c00)='./config/usb_gadget/g1/functions/midi.usb0/in_ports\x00', 0x1, 0x0) write(r2, &(0x7f0000002c40)='2\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000002dc0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000002e00)='dummy_udc.0\n', 0xc) syz_open_procfs(0x0, &(0x7f0000002e40)='fd/3\x00') mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000002e80)={&(0x7f0000002ec0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x20}]}}, 0x0, 0x32, 0x0, 0x1}, 0x28) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002780)={0xffffffffffffffff, 0x0, 0x0, 0x55, 0x0, &(0x7f0000001600)=""/85, 0xb, 0x0, 0x0, 0xe5, 0x0, &(0x7f0000002680)="25c0aadfa3650b0b2cb2ec9fb8fced0f62132cc04041963e5379748db74d39f9588dc5bb72beaabea6f9549f7b6135a5abf795ef6b98bd89acd8845b255e11b555ff726902f3e99ca02cabf486738b6c57fd0af7eda7d80e3aa9c0eab23c8eaedd14d3ae0520bbbb58930679ebaa35d691f336113e60c753cb2e6dfa96a71a3651e6fe36828814841adb2cc32502a1f742a599d8944e44130e80ea815022b786417cda58ae91468597bc87cd369014173639cdd289055bd2b47daa749df01c5fc7e6173b29e65071ccccaebf1fc72c4d7ba46729c779f872ee2f3c2924d6cee87eb3769618", 0x5, 0x0, 0x8}, 0x50) r4 = socket$inet6(0xa, 0x3, 0xff) write$binfmt_script(r4, &(0x7f00000000c0), 0x28) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.130' (ED25519) to the list of known hosts. [ 23.204139][ T30] audit: type=1400 audit(1792308309.738:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.207511][ T277] cgroup: Unknown subsys name 'net' [ 23.226897][ T30] audit: type=1400 audit(1792308309.738:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.254529][ T30] audit: type=1400 audit(1792308309.778:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.254876][ T277] cgroup: Unknown subsys name 'devices' [ 23.409908][ T277] cgroup: Unknown subsys name 'hugetlb' [ 23.415532][ T277] cgroup: Unknown subsys name 'rlimit' [ 23.585075][ T30] audit: type=1400 audit(1792308310.118:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.608297][ T30] audit: type=1400 audit(1792308310.118:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.633150][ T30] audit: type=1400 audit(1792308310.118:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.653203][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.665333][ T30] audit: type=1400 audit(1792308310.198:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.690779][ T30] audit: type=1400 audit(1792308310.198:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.693255][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.716976][ T30] audit: type=1400 audit(1792308310.238:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.750684][ T30] audit: type=1400 audit(1792308310.238:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.957104][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.964413][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.971933][ T287] device bridge_slave_0 entered promiscuous mode [ 24.978795][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.985840][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.993391][ T286] device bridge_slave_0 entered promiscuous mode [ 25.000368][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.007411][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.014880][ T286] device bridge_slave_1 entered promiscuous mode [ 25.024521][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.031664][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.039086][ T287] device bridge_slave_1 entered promiscuous mode [ 25.080690][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.087756][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.095229][ T285] device bridge_slave_0 entered promiscuous mode [ 25.108717][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.115777][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.123256][ T285] device bridge_slave_1 entered promiscuous mode [ 25.144027][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.151132][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.158626][ T289] device bridge_slave_0 entered promiscuous mode [ 25.176528][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.183729][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.191265][ T288] device bridge_slave_0 entered promiscuous mode [ 25.197954][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.205019][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.212469][ T289] device bridge_slave_1 entered promiscuous mode [ 25.228012][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.235083][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.242709][ T288] device bridge_slave_1 entered promiscuous mode [ 25.406436][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.413527][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.421198][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.428370][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.440968][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.448082][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.455356][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.462420][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.481302][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.488578][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.495867][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.503100][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.515812][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.522899][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.530198][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.537237][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.551963][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.559040][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.566337][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.573404][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.620083][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.627277][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.635598][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.643021][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.650301][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.657496][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.664936][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.672225][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.679601][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.686800][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.694065][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.710748][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.718980][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.726382][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.733954][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.742430][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.749495][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.756826][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.765055][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.772089][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.779509][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.787661][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.794738][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.818450][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.826988][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.835285][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.842323][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.850350][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.858559][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.865595][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.873035][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.881183][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.889181][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.897046][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.907405][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.916118][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.924401][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.931465][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.947019][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.955260][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.962426][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.970011][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.978258][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.985296][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.004365][ T286] device veth0_vlan entered promiscuous mode [ 26.019134][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.027448][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.036069][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.044212][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.052526][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.060768][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.068743][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 26.076986][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.085245][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.092298][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.099651][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.107669][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.115799][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 26.124187][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.132408][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.139439][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.146842][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.154382][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.170980][ T285] device veth0_vlan entered promiscuous mode [ 26.177943][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.186538][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.195168][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.203369][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.211741][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.219305][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.237126][ T285] device veth1_macvtap entered promiscuous mode [ 26.248555][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.256865][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.265044][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.273432][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.282400][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.290448][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.298653][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.306769][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.325012][ T286] device veth1_macvtap entered promiscuous mode [ 26.333026][ T288] device veth0_vlan entered promiscuous mode [ 26.339476][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.347852][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.356382][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.364452][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.372674][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.380969][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.389275][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.396824][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.405468][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.414009][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.422459][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.430933][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.439248][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.447225][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.454839][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.476439][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.484854][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.493450][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.502624][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.516873][ T285] request_module fs-gadgetfs succeeded, but still no fs? [ 26.528460][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.536795][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.545911][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.554132][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.562913][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.571261][ T287] device veth0_vlan entered promiscuous mode [ 26.577452][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.585041][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.599338][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.607542][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.616746][ T288] device veth1_macvtap entered promiscuous mode [ 26.630035][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.644549][ T289] device veth0_vlan entered promiscuous mode [ 26.651837][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.660290][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.667830][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.676115][ T308] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.680976][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.701325][ T287] device veth1_macvtap entered promiscuous mode [ 26.714845][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.731260][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.739825][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.748456][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.764818][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.765703][ T308] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 26.799218][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.809642][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.821114][ T289] device veth1_macvtap entered promiscuous mode [ 26.841265][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.850162][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.859160][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.895477][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.910582][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.919664][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.928007][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.128319][ T334] FAULT_INJECTION: forcing a failure. [ 27.128319][ T334] name failslab, interval 1, probability 0, space 0, times 1 [ 27.147944][ T334] CPU: 1 PID: 334 Comm: syz.0.8 Not tainted syzkaller #0 [ 27.155017][ T334] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 27.165106][ T334] Call Trace: [ 27.168417][ T334] [ 27.171367][ T334] __dump_stack+0x21/0x30 [ 27.175734][ T334] dump_stack_lvl+0x110/0x170 [ 27.180439][ T334] ? show_regs_print_info+0x20/0x20 [ 27.185667][ T334] ? release_pages+0x1264/0x12c0 [ 27.190638][ T334] dump_stack+0x15/0x20 [ 27.194819][ T334] should_fail+0x3ab/0x500 [ 27.199265][ T334] __should_failslab+0xa4/0xe0 [ 27.204057][ T334] should_failslab+0x9/0x20 [ 27.208586][ T334] slab_pre_alloc_hook+0x39/0xd0 [ 27.213579][ T334] kmem_cache_alloc_trace+0x48/0x270 [ 27.218985][ T334] ? bdi_split_work_to_wbs+0x464/0xa30 [ 27.224501][ T334] bdi_split_work_to_wbs+0x464/0xa30 [ 27.229824][ T334] ? sync_inodes_sb+0x6e0/0x6e0 [ 27.234706][ T334] ? rwsem_write_trylock+0x136/0x300 [ 27.240020][ T334] ? iput+0x28b/0x7e0 [ 27.244041][ T334] sync_inodes_sb+0x1b0/0x6e0 [ 27.248751][ T334] ? downgrade_write+0x440/0x440 [ 27.253705][ T334] ? try_to_writeback_inodes_sb+0xc0/0xc0 [ 27.259436][ T334] ? down_read+0xab/0x100 [ 27.263782][ T334] ? __down_common+0x360/0x360 [ 27.268562][ T334] sync_inodes_one_sb+0x56/0x70 [ 27.273426][ T334] iterate_supers+0x127/0x1e0 [ 27.278115][ T334] ? ksys_sync+0x170/0x170 [ 27.282545][ T334] ksys_sync+0x9d/0x170 [ 27.286721][ T334] ? sync_filesystem+0x230/0x230 [ 27.291664][ T334] ? __kasan_check_write+0x14/0x20 [ 27.296781][ T334] ? switch_fpu_return+0x15d/0x2c0 [ 27.301909][ T334] __ia32_sys_sync+0xe/0x20 [ 27.306419][ T334] x64_sys_call+0x8a9/0x9a0 [ 27.310935][ T334] do_syscall_64+0x4c/0xa0 [ 27.315370][ T334] ? clear_bhb_loop+0x50/0xa0 [ 27.320159][ T334] ? clear_bhb_loop+0x50/0xa0 [ 27.324846][ T334] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 27.330748][ T334] RIP: 0033:0x7fddc3688559 [ 27.335194][ T334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.354918][ T334] RSP: 002b:00007fddc20e1028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 27.363367][ T334] RAX: ffffffffffffffda RBX: 00007fddc390ffa0 RCX: 00007fddc3688559 [ 27.371349][ T334] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.379329][ T334] RBP: 00007fddc390ffa0 R08: 0000000000000000 R09: 0000000000000000 [ 27.387325][ T334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.395301][ T334] R13: 00007fddc3910038 R14: 00007fddc390ffa0 R15: 00007ffddf663dd8 [ 27.403285][ T334] [ 27.541392][ T319] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 27.553549][ T319] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 27.586630][ T365] FAULT_INJECTION: forcing a failure. [ 27.586630][ T365] name failslab, interval 1, probability 0, space 0, times 0 [ 27.636302][ T365] CPU: 1 PID: 365 Comm: syz.3.22 Not tainted syzkaller #0 [ 27.643490][ T365] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 27.653570][ T365] Call Trace: [ 27.656866][ T365] [ 27.659817][ T365] __dump_stack+0x21/0x30 [ 27.664179][ T365] dump_stack_lvl+0x110/0x170 [ 27.668890][ T365] ? show_regs_print_info+0x20/0x20 [ 27.674126][ T365] dump_stack+0x15/0x20 [ 27.678306][ T365] should_fail+0x3ab/0x500 [ 27.682762][ T365] __should_failslab+0xa4/0xe0 [ 27.687574][ T365] should_failslab+0x9/0x20 [ 27.692098][ T365] slab_pre_alloc_hook+0x39/0xd0 [ 27.697055][ T365] ? security_inode_alloc+0x33/0x110 [ 27.702369][ T365] kmem_cache_alloc+0x44/0x260 [ 27.707164][ T365] security_inode_alloc+0x33/0x110 [ 27.712312][ T365] inode_init_always+0x72c/0x9b0 [ 27.717293][ T365] new_inode_pseudo+0x91/0x210 [ 27.722081][ T365] __sock_create+0x12c/0x7a0 [ 27.726689][ T365] sock_create_kern+0x3b/0x50 [ 27.731408][ T365] inet_ctl_sock_create+0x9f/0x1f0 [ 27.736560][ T365] ? inet_gro_complete+0x470/0x470 [ 27.741709][ T365] ? register_net_sysctl+0x21d/0x230 [ 27.747137][ T365] tcpv6_net_init+0x2b/0x30 [ 27.751705][ T365] ops_init+0x2c0/0x470 [ 27.755879][ T365] setup_net+0x331/0xa30 [ 27.760172][ T365] ? copy_net_ns+0x5c0/0x5c0 [ 27.764791][ T365] copy_net_ns+0x355/0x5c0 [ 27.769238][ T365] create_new_namespaces+0x3a8/0x660 [ 27.774551][ T365] unshare_nsproxy_namespaces+0x120/0x170 [ 27.780304][ T365] ksys_unshare+0x4d7/0x810 [ 27.784839][ T365] ? sighand_ctor+0x60/0x60 [ 27.789390][ T365] ? __kasan_check_write+0x14/0x20 [ 27.794529][ T365] ? switch_fpu_return+0x15d/0x2c0 [ 27.799678][ T365] __x64_sys_unshare+0x38/0x40 [ 27.804490][ T365] x64_sys_call+0x442/0x9a0 [ 27.809025][ T365] do_syscall_64+0x4c/0xa0 [ 27.813468][ T365] ? clear_bhb_loop+0x50/0xa0 [ 27.818194][ T365] ? clear_bhb_loop+0x50/0xa0 [ 27.822901][ T365] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 27.828935][ T365] RIP: 0033:0x7f9315f05559 [ 27.833526][ T365] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.853179][ T365] RSP: 002b:00007f931495e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 27.861647][ T365] RAX: ffffffffffffffda RBX: 00007f931618cfa0 RCX: 00007f9315f05559 [ 27.869674][ T365] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 27.877682][ T365] RBP: 00007f9315f9cab8 R08: 0000000000000000 R09: 0000000000000000 [ 27.885682][ T365] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.893691][ T365] R13: 00007f931618d038 R14: 00007f931618cfa0 R15: 00007ffd7ecf8d98 [ 27.901699][ T365] [ 27.916166][ T365] socket: no more sockets [ 28.070842][ T396] input: syz0 as /devices/virtual/input/input4 [ 28.234328][ T30] kauditd_printk_skb: 89 callbacks suppressed [ 28.234343][ T30] audit: type=1400 audit(1792308314.768:163): avc: denied { create } for pid=418 comm="syz.0.47" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 28.264269][ T30] audit: type=1400 audit(1792308314.808:164): avc: denied { write } for pid=418 comm="syz.0.47" name="file0" dev="tmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 28.286782][ T30] audit: type=1400 audit(1792308314.808:165): avc: denied { open } for pid=418 comm="syz.0.47" path="/15/file0" dev="tmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 28.326500][ T30] audit: type=1400 audit(1792308314.828:166): avc: denied { ioctl } for pid=418 comm="syz.0.47" path="/15/file0" dev="tmpfs" ino=99 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 28.383212][ T30] audit: type=1400 audit(1792308314.848:167): avc: denied { read write } for pid=422 comm="syz.3.49" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.412499][ T30] audit: type=1400 audit(1792308314.848:168): avc: denied { open } for pid=422 comm="syz.3.49" path="/dev/raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.471932][ T30] audit: type=1400 audit(1792308314.848:169): avc: denied { ioctl } for pid=422 comm="syz.3.49" path="/dev/raw-gadget" dev="devtmpfs" ino=254 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.514587][ T439] device-mapper: table: 253:0: multipath: unknown target type [ 28.522323][ T439] device-mapper: ioctl: error adding target to table [ 28.531331][ T30] audit: type=1400 audit(1792308314.848:170): avc: denied { unlink } for pid=285 comm="syz-executor" name="file0" dev="tmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 28.554067][ T30] audit: type=1400 audit(1792308314.918:171): avc: denied { create } for pid=428 comm="syz.1.52" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 28.574539][ T30] audit: type=1400 audit(1792308314.918:172): avc: denied { connect } for pid=428 comm="syz.1.52" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 28.617959][ T60] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 28.691863][ T457] netlink: 40 bytes leftover after parsing attributes in process `syz.0.64'. [ 28.847546][ T466] FAULT_INJECTION: forcing a failure. [ 28.847546][ T466] name failslab, interval 1, probability 0, space 0, times 0 [ 28.885064][ T466] CPU: 0 PID: 466 Comm: syz.0.68 Not tainted syzkaller #0 [ 28.892240][ T466] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 28.902326][ T466] Call Trace: [ 28.905622][ T466] [ 28.908582][ T466] __dump_stack+0x21/0x30 [ 28.912942][ T466] dump_stack_lvl+0x110/0x170 [ 28.917646][ T466] ? show_regs_print_info+0x20/0x20 [ 28.922872][ T466] dump_stack+0x15/0x20 [ 28.927047][ T466] should_fail+0x3ab/0x500 [ 28.931489][ T466] __should_failslab+0xa4/0xe0 [ 28.936295][ T466] should_failslab+0x9/0x20 [ 28.940826][ T466] slab_pre_alloc_hook+0x39/0xd0 [ 28.945786][ T466] ? security_inode_alloc+0x33/0x110 [ 28.951094][ T466] kmem_cache_alloc+0x44/0x260 [ 28.955877][ T466] security_inode_alloc+0x33/0x110 [ 28.961009][ T466] inode_init_always+0x72c/0x9b0 [ 28.965969][ T466] new_inode_pseudo+0x91/0x210 [ 28.970754][ T466] sock_create_lite+0x8b/0x4e0 [ 28.975548][ T466] __netlink_kernel_create+0x11c/0x910 [ 28.981063][ T466] ? netlink_set_err+0x3f0/0x3f0 [ 28.986038][ T466] ? memcpy+0x56/0x70 [ 28.990034][ T466] audit_net_init+0x106/0x230 [ 28.994733][ T466] ? kauditd_thread+0x880/0x880 [ 28.999591][ T466] ? audit_net_exit+0x90/0x90 [ 29.004277][ T466] ? audit_receive+0x2ac0/0x2ac0 [ 29.009232][ T466] ? audit_multicast_bind+0x40/0x40 [ 29.014442][ T466] ? __kmalloc+0x13d/0x2c0 [ 29.018876][ T466] ? ops_init+0x88/0x470 [ 29.023124][ T466] ops_init+0x2c0/0x470 [ 29.027298][ T466] setup_net+0x331/0xa30 [ 29.031548][ T466] ? copy_net_ns+0x5c0/0x5c0 [ 29.036163][ T466] copy_net_ns+0x355/0x5c0 [ 29.040616][ T466] create_new_namespaces+0x3a8/0x660 [ 29.045912][ T466] unshare_nsproxy_namespaces+0x120/0x170 [ 29.051635][ T466] ksys_unshare+0x4d7/0x810 [ 29.056153][ T466] ? sighand_ctor+0x60/0x60 [ 29.060690][ T466] ? __kasan_check_write+0x14/0x20 [ 29.065811][ T466] ? switch_fpu_return+0x15d/0x2c0 [ 29.070934][ T466] __x64_sys_unshare+0x38/0x40 [ 29.075722][ T466] x64_sys_call+0x442/0x9a0 [ 29.080258][ T466] do_syscall_64+0x4c/0xa0 [ 29.084689][ T466] ? clear_bhb_loop+0x50/0xa0 [ 29.089377][ T466] ? clear_bhb_loop+0x50/0xa0 [ 29.094070][ T466] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 29.099976][ T466] RIP: 0033:0x7fddc3688559 [ 29.104403][ T466] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.124016][ T466] RSP: 002b:00007fddc20e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 29.132438][ T466] RAX: ffffffffffffffda RBX: 00007fddc390ffa0 RCX: 00007fddc3688559 [ 29.140421][ T466] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 29.148399][ T466] RBP: 00007fddc371fab8 R08: 0000000000000000 R09: 0000000000000000 [ 29.156390][ T466] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 29.164372][ T466] R13: 00007fddc3910038 R14: 00007fddc390ffa0 R15: 00007ffddf663dd8 [ 29.172360][ T466] [ 29.198649][ T60] usb 4-1: not running at top speed; connect to a high speed hub [ 29.257560][ T476] netlink: 4 bytes leftover after parsing attributes in process `syz.2.73'. [ 29.337956][ T60] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 29.352687][ T60] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 29.363368][ T488] netlink: 4 bytes leftover after parsing attributes in process `syz.2.79'. [ 29.373046][ T60] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 6 [ 29.393950][ T490] netlink: 8 bytes leftover after parsing attributes in process `syz.2.80'. [ 29.402738][ T490] netlink: 8 bytes leftover after parsing attributes in process `syz.2.80'. [ 29.414129][ T490] netlink: 8 bytes leftover after parsing attributes in process `syz.2.80'. [ 29.558054][ T60] usb 4-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice= 1.00 [ 29.570194][ T60] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.578952][ T60] usb 4-1: Product: syz [ 29.583317][ T60] usb 4-1: Manufacturer: syz [ 29.587978][ T60] usb 4-1: SerialNumber: syz [ 29.758069][ T315] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 29.851269][ T60] usb 4-1: USB disconnect, device number 2 [ 30.007895][ T315] usb 3-1: Using ep0 maxpacket: 16 [ 30.127987][ T315] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 30.147912][ T315] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 30.167905][ T315] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 30.177614][ T315] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 30.197897][ T315] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 30.307999][ T315] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 30.317101][ T315] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 30.337916][ T315] usb 3-1: Manufacturer: syz [ 30.351108][ T315] usb 3-1: config 0 descriptor?? [ 30.572754][ T537] smpboot: CPU 1 is now offline [ 30.648913][ T546] netlink: 'syz.1.105': attribute type 3 has an invalid length. [ 30.919788][ T290] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 30.941553][ T290] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 30.972474][ T573] loop4: detected capacity change from 0 to 512 [ 31.011044][ T573] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 31.344016][ T594] loop4: detected capacity change from 0 to 512 [ 31.371367][ T599] loop3: detected capacity change from 0 to 256 [ 31.379736][ T594] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,,errors=continue. Quota mode: writeback. [ 31.399854][ T599] exFAT-fs (loop3): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x241b98d9, utbl_chksum : 0xe619d30d) [ 31.412095][ T594] ext4 filesystem being mounted at /10/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.450859][ T594] netlink: 16 bytes leftover after parsing attributes in process `syz.4.124'. [ 31.482496][ T602] loop3: detected capacity change from 0 to 1024 [ 31.507228][ T602] EXT4-fs (loop3): mounted filesystem without journal. Opts: discard,dioread_lock,barrier=0x0000000000000000,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000010,grpid,init_itable,. Quota mode: none. [ 31.604759][ T602] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2812: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 31.618921][ T617] loop4: detected capacity change from 0 to 512 [ 31.638546][ T617] EXT4-fs (loop4): Ignoring removed oldalloc option [ 31.664345][ T617] EXT4-fs (loop4): mounted filesystem without journal. Opts: oldalloc,grpquota,noinit_itable,,errors=continue. Quota mode: writeback. [ 31.689579][ T602] syz.3.127 (602) used greatest stack depth: 21928 bytes left [ 31.702599][ T625] loop0: detected capacity change from 0 to 2048 [ 31.709123][ T617] ext4 filesystem being mounted at /15/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.769349][ T625] EXT4-fs (loop0): mounted filesystem without journal. Opts: init_itable,,errors=continue. Quota mode: none. [ 31.782985][ T625] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 31.798114][ T625] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 10 with max blocks 23 with error 28 [ 31.810557][ T625] EXT4-fs (loop0): This should not happen!! Data will be lost [ 31.810557][ T625] [ 32.395100][ T631] EXT4-fs error (device loop4): ext4_xattr_inode_iget:401: comm syz.4.133: inode #327680: comm syz.4.133: iget: illegal inode # [ 32.409021][ T631] EXT4-fs error (device loop4): ext4_xattr_inode_iget:406: comm syz.4.133: error while reading EA inode 327680 err=-117 [ 32.425673][ T625] EXT4-fs (loop0): Total free blocks count 0 [ 32.432192][ T625] EXT4-fs (loop0): Free/Dirty block details [ 32.438245][ T625] EXT4-fs (loop0): free_blocks=2415919504 [ 32.444036][ T625] EXT4-fs (loop0): dirty_blocks=48 [ 32.449320][ T625] EXT4-fs (loop0): Block reservation details [ 32.459537][ T625] EXT4-fs (loop0): i_reserved_data_blocks=3 [ 32.465647][ T634] usb 3-1: USB disconnect, device number 2 [ 32.481541][ T637] Zero length message leads to an empty skb [ 32.488795][ T635] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 32 with error 28 [ 32.503460][ T635] EXT4-fs (loop0): This should not happen!! Data will be lost [ 32.503460][ T635] [ 32.556344][ T641] loop0: detected capacity change from 0 to 128 [ 32.578516][ T641] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 32.629855][ T641] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 32.645042][ T650] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 32.674225][ T324] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 32.835518][ T665] loop1: detected capacity change from 0 to 128 [ 32.862585][ T665] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 32.874387][ T665] ext4 filesystem being mounted at /21/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 32.920041][ T669] input: syz1 as /devices/virtual/input/input5 [ 33.087898][ T20] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 33.447946][ T20] usb 1-1: config 1 has an invalid descriptor of length 51, skipping remainder of the config [ 33.458502][ T20] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 22 [ 33.499238][ T30] kauditd_printk_skb: 51 callbacks suppressed [ 33.499248][ T30] audit: type=1400 audit(1792308320.038:223): avc: denied { setcurrent } for pid=681 comm="syz.3.158" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 33.550245][ T686] loop4: detected capacity change from 0 to 512 [ 33.558001][ T20] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 33.577718][ T30] audit: type=1401 audit(1792308320.068:224): op=security_bounded_transition seresult=denied oldcontext=root:sysadm_r:sysadm_t newcontext=system_u:object_r:hugetlbfs_t [ 33.595830][ T20] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 33.609223][ T686] EXT4-fs (loop4): Ignoring removed nobh option [ 33.619976][ T20] usb 1-1: SerialNumber: syz [ 33.628687][ T686] EXT4-fs (loop4): 1 truncate cleaned up [ 33.641493][ T30] audit: type=1400 audit(1792308320.138:225): avc: denied { setopt } for pid=683 comm="syz.3.159" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 33.664461][ T686] EXT4-fs (loop4): mounted filesystem without journal. Opts: noload,errors=remount-ro,nombcache,noload,nobh,debug_want_extra_isize=0x0000000000000008,. Quota mode: none. [ 33.681884][ T20] rndis_host: probe of 1-1:1.0 failed with error -22 [ 33.706110][ T30] audit: type=1400 audit(1792308320.208:226): avc: denied { write } for pid=688 comm="syz.3.161" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 33.757642][ T30] audit: type=1400 audit(1792308320.208:227): avc: denied { add_name } for pid=688 comm="syz.3.161" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 33.821131][ T30] audit: type=1400 audit(1792308320.208:228): avc: denied { associate } for pid=688 comm="syz.3.161" name="file1" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 33.883648][ T290] usb 1-1: USB disconnect, device number 2 [ 33.931528][ T706] loop2: detected capacity change from 0 to 2048 [ 33.941669][ T30] audit: type=1400 audit(1792308320.268:229): avc: denied { ioctl } for pid=685 comm="syz.4.160" path="/22/file0/file1" dev="loop4" ino=15 ioctlcmd=0x5829 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 33.989604][ T709] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 34.018583][ T709] EXT4-fs (loop1): 1 truncate cleaned up [ 34.042860][ T709] EXT4-fs (loop1): mounted filesystem without journal. Opts: noload,max_dir_size_kb=0x0000000000000001,usrjquota=,debug_want_extra_isize=0x0000000000000004,data_err=ignore,usrjquota=,,errors=continue. Quota mode: none. [ 34.067165][ T706] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpquota,errors=remount-ro,. Quota mode: writeback. [ 34.087928][ T30] audit: type=1400 audit(1792308320.358:230): avc: denied { create } for pid=697 comm="syz.3.165" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 34.166762][ T30] audit: type=1400 audit(1792308320.388:231): avc: denied { mounton } for pid=697 comm="syz.3.165" path="/36/file0" dev="tmpfs" ino=217 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 34.205479][ T734] syz.2.182 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 34.226238][ T30] audit: type=1400 audit(1792308320.388:232): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 34.358587][ T734] ======================================================= [ 34.358587][ T734] WARNING: The mand mount option has been deprecated and [ 34.358587][ T734] and is ignored by this kernel. Remove the mand [ 34.358587][ T734] option from the mount to silence this warning. [ 34.358587][ T734] ======================================================= [ 34.416903][ T734] EXT4-fs error (device loop2): ext4_map_blocks:632: inode #3: block 2: comm syz.2.182: lblock 2 mapped to illegal pblock 2 (length 1) [ 34.431032][ T734] EXT4-fs error (device loop2): ext4_map_blocks:632: inode #3: block 48: comm syz.2.182: lblock 0 mapped to illegal pblock 48 (length 1) [ 34.448297][ T734] EXT4-fs error (device loop2): ext4_acquire_dquot:6227: comm syz.2.182: Failed to acquire dquot type 0 [ 34.468854][ T734] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5904: Corrupt filesystem [ 34.480015][ T734] EXT4-fs error (device loop2): ext4_evict_inode:285: inode #11: comm syz.2.182: mark_inode_dirty error [ 34.491558][ T734] EXT4-fs warning (device loop2): ext4_evict_inode:288: couldn't mark inode dirty (err -117) [ 34.502118][ T734] EXT4-fs (loop2): 1 orphan inode deleted [ 34.508113][ T734] EXT4-fs (loop2): mounted filesystem without journal. Opts: sysvgroups,noblock_validity,data_err=ignore,max_batch_time=0x0000000000000007,nodiscard,stripe=0x0000000000000004,noauto_da_alloc,,errors=continue. Quota mode: none. [ 34.530476][ T324] EXT4-fs error (device loop2): ext4_map_blocks:632: inode #3: block 1: comm kworker/u4:4: lblock 1 mapped to illegal pblock 1 (length 1) [ 34.546234][ T324] EXT4-fs error (device loop2): ext4_release_dquot:6263: comm kworker/u4:4: Failed to release dquot type 0 [ 34.558310][ T734] EXT4-fs error (device loop2): __ext4_get_inode_loc:4365: comm syz.2.182: Invalid inode table block 1 in block_group 0 [ 34.587113][ T734] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5904: Corrupt filesystem [ 34.605091][ T734] EXT4-fs error (device loop2): ext4_quota_off:6533: inode #3: comm syz.2.182: mark_inode_dirty error [ 34.687913][ T290] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 34.762107][ T768] ip_tables: iptables: counters copy to user failed while replacing table [ 34.780008][ T768] ip_tables: iptables: counters copy to user failed while replacing table [ 34.790842][ T770] EXT4-fs (loop0): mounted filesystem without journal. Opts: nodioread_nolock,sb=0x0000000000000001,,errors=continue. Quota mode: writeback. [ 34.805441][ T770] ext4 filesystem being mounted at /47/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 34.890961][ T777] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 34.890961][ T777] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 34.890961][ T777] [ 34.913449][ T777] EXT4-fs (loop0): Test dummy encryption mode enabled [ 34.921587][ T777] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a0028098, mo2=0002] [ 34.929888][ T777] System zones: 0-5 [ 34.934098][ T777] EXT4-fs (loop0): mounted filesystem without journal. Opts: debug,nouser_xattr,nodioread_nolock,test_dummy_encryption,inode_readahead_blks=0x0000000000000100,nodelalloc,minixdf,debug_want_extra_isize=0x0000000000000040,,errors=continue. Quota mode: writeback. [ 35.057946][ T634] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 35.078057][ T290] usb 2-1: config 0 has an invalid interface number: 31 but max is 0 [ 35.187908][ T290] usb 2-1: config 0 has no interface number 0 [ 35.277119][ T797] EXT4-fs (loop4): Ignoring removed mblk_io_submit option [ 35.293745][ T797] EXT4-fs (loop4): Test dummy encryption mode enabled [ 35.309691][ T797] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,mblk_io_submit,nodioread_nolock,test_dummy_encryption,inode_readahead_blks=0x0000000000008000,nodelalloc,minixdf,debug_want_extra_isize=0x0000000000000040,,errors=continue. Quota mode: writeback. [ 35.368030][ T290] usb 2-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 35.377905][ T634] usb 3-1: Using ep0 maxpacket: 32 [ 35.396398][ T290] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.419879][ T290] usb 2-1: Product: syz [ 35.432299][ T290] usb 2-1: Manufacturer: syz [ 35.445083][ T290] usb 2-1: SerialNumber: syz [ 35.462586][ T290] usb 2-1: config 0 descriptor?? [ 35.498064][ T634] usb 3-1: config index 0 descriptor too short (expected 539, got 27) [ 35.518865][ T634] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 255, changing to 11 [ 35.549382][ T634] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 59391, setting to 1024 [ 35.602629][ T816] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 35.625984][ T816] EXT4-fs (loop4): re-mounted. Opts: (null). Quota mode: none. [ 35.649443][ T816] EXT4-fs error (device loop4): ext4_find_extent:929: inode #2: comm syz.4.214: pblk 1 bad header/extent: invalid magic - magic 2, entries 0, max 3(0), depth 0(4) [ 35.676453][ T822] ================================================================== [ 35.684551][ T822] BUG: KASAN: use-after-free in kobject_get+0x113/0x120 [ 35.691490][ T822] Read of size 1 at addr ffff88810f81a03c by task syz.0.216/822 [ 35.699108][ T822] [ 35.701423][ T822] CPU: 0 PID: 822 Comm: syz.0.216 Not tainted syzkaller #0 [ 35.708611][ T822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 35.718656][ T822] Call Trace: [ 35.721925][ T822] [ 35.724849][ T822] __dump_stack+0x21/0x30 [ 35.729179][ T822] dump_stack_lvl+0x110/0x170 [ 35.733863][ T822] ? show_regs_print_info+0x20/0x20 [ 35.739058][ T822] ? load_image+0x3f0/0x3f0 [ 35.743555][ T822] print_address_description+0x7f/0x2c0 [ 35.749107][ T822] ? kobject_get+0x113/0x120 [ 35.753695][ T822] kasan_report+0x10f/0x150 [ 35.758197][ T822] ? kobject_get+0x113/0x120 [ 35.762782][ T822] __asan_report_load1_noabort+0x14/0x20 [ 35.768407][ T822] kobject_get+0x113/0x120 [ 35.772814][ T822] device_add+0x2f0/0xe90 [ 35.777135][ T822] device_create+0x26c/0x300 [ 35.781721][ T822] ? root_device_unregister+0x80/0x80 [ 35.787097][ T822] create_function_device+0x60/0x70 [ 35.792298][ T822] f_midi_alloc_inst+0x1a8/0x380 [ 35.797229][ T822] usb_get_function_instance+0xe2/0x2f0 [ 35.802774][ T822] function_make+0x118/0x350 [ 35.807355][ T822] ? gadget_dev_desc_max_speed_store+0x240/0x240 [ 35.813677][ T822] ? wait_for_completion_killable_timeout+0x10/0x10 [ 35.820271][ T822] ? __kmalloc+0x13d/0x2c0 [ 35.824680][ T822] ? configfs_mkdir+0x444/0x9c0 [ 35.829521][ T822] configfs_mkdir+0x50a/0x9c0 [ 35.834195][ T822] vfs_mkdir+0x38b/0x590 [ 35.838436][ T822] do_mkdirat+0x174/0x4d0 [ 35.842762][ T822] __x64_sys_mkdirat+0x89/0xa0 [ 35.847519][ T822] x64_sys_call+0x37e/0x9a0 [ 35.852023][ T822] do_syscall_64+0x4c/0xa0 [ 35.856436][ T822] ? clear_bhb_loop+0x50/0xa0 [ 35.861109][ T822] ? clear_bhb_loop+0x50/0xa0 [ 35.865781][ T822] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 35.871674][ T822] RIP: 0033:0x7fddc3688559 [ 35.876087][ T822] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.895684][ T822] RSP: 002b:00007fddc20e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 35.904412][ T822] RAX: ffffffffffffffda RBX: 00007fddc390ffa0 RCX: 00007fddc3688559 [ 35.912426][ T822] RDX: 00000000000001ff RSI: 0000200000002b40 RDI: ffffffffffffff9c [ 35.920400][ T822] RBP: 00007fddc371fab8 R08: 0000000000000000 R09: 0000000000000000 [ 35.928372][ T822] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 35.936341][ T822] R13: 00007fddc3910038 R14: 00007fddc390ffa0 R15: 00007ffddf663dd8 [ 35.944314][ T822] [ 35.947328][ T822] [ 35.949645][ T822] Allocated by task 375: [ 35.953871][ T822] __kasan_kmalloc+0xd4/0x100 [ 35.958555][ T822] kmem_cache_alloc_trace+0x119/0x270 [ 35.963926][ T822] device_create+0x13a/0x300 [ 35.968525][ T822] gadgets_make+0x816/0xa70 [ 35.973025][ T822] configfs_mkdir+0x50a/0x9c0 [ 35.977695][ T822] vfs_mkdir+0x38b/0x590 [ 35.981935][ T822] do_mkdirat+0x174/0x4d0 [ 35.986254][ T822] __x64_sys_mkdirat+0x89/0xa0 [ 35.991009][ T822] x64_sys_call+0x37e/0x9a0 [ 35.995500][ T822] do_syscall_64+0x4c/0xa0 [ 35.999916][ T822] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 36.005802][ T822] [ 36.008119][ T822] Freed by task 375: [ 36.011996][ T822] kasan_set_track+0x4a/0x70 [ 36.016573][ T822] kasan_set_free_info+0x23/0x40 [ 36.021501][ T822] ____kasan_slab_free+0x125/0x160 [ 36.026605][ T822] __kasan_slab_free+0x11/0x20 [ 36.031362][ T822] slab_free_freelist_hook+0xc2/0x190 [ 36.036836][ T822] kfree+0xc4/0x270 [ 36.040646][ T822] device_create_release+0x15/0x20 [ 36.045829][ T822] device_release+0x96/0x1c0 [ 36.050411][ T822] kobject_put+0x18a/0x270 [ 36.054822][ T822] device_destroy+0xb4/0xf0 [ 36.059319][ T822] gadgets_drop+0xa0/0xd0 [ 36.063654][ T822] configfs_rmdir+0x871/0x960 [ 36.068327][ T822] vfs_rmdir+0x1ae/0x450 [ 36.072563][ T822] do_rmdir+0x261/0x6b0 [ 36.076718][ T822] __x64_sys_rmdir+0x49/0x50 [ 36.081304][ T822] x64_sys_call+0x25f/0x9a0 [ 36.085797][ T822] do_syscall_64+0x4c/0xa0 [ 36.090205][ T822] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 36.096089][ T822] [ 36.098398][ T822] The buggy address belongs to the object at ffff88810f81a000 [ 36.098398][ T822] which belongs to the cache kmalloc-1k of size 1024 [ 36.112452][ T822] The buggy address is located 60 bytes inside of [ 36.112452][ T822] 1024-byte region [ffff88810f81a000, ffff88810f81a400) [ 36.125719][ T822] The buggy address belongs to the page: [ 36.131354][ T822] page:ffffea00043e0600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f818 [ 36.141598][ T822] head:ffffea00043e0600 order:3 compound_mapcount:0 compound_pincount:0 [ 36.149910][ T822] flags: 0x4000000000010200(slab|head|zone=1) [ 36.155987][ T822] raw: 4000000000010200 ffffea00043cd600 0000000200000002 ffff888100043080 [ 36.164563][ T822] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 36.173133][ T822] page dumped because: kasan: bad access detected [ 36.179532][ T822] page_owner tracks the page as allocated [ 36.185232][ T822] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 101, ts 5163126812, free_ts 0 [ 36.203281][ T822] post_alloc_hook+0x192/0x1b0 [ 36.208042][ T822] prep_new_page+0x1c/0x110 [ 36.212537][ T822] get_page_from_freelist+0x2c3a/0x2cd0 [ 36.218085][ T822] __alloc_pages+0x1a2/0x460 [ 36.222669][ T822] new_slab+0xa0/0x4d0 [ 36.226741][ T822] ___slab_alloc+0x3ac/0x840 [ 36.231328][ T822] __slab_alloc+0x49/0x90 [ 36.235662][ T822] __kmalloc_track_caller+0x169/0x2c0 [ 36.241026][ T822] __alloc_skb+0x210/0x730 [ 36.245430][ T822] netlink_sendmsg+0x611/0xb80 [ 36.250184][ T822] ____sys_sendmsg+0x5be/0x8f0 [ 36.254942][ T822] ___sys_sendmsg+0x236/0x2e0 [ 36.259614][ T822] __x64_sys_sendmsg+0x201/0x2d0 [ 36.264560][ T822] x64_sys_call+0x4b/0x9a0 [ 36.268981][ T822] do_syscall_64+0x4c/0xa0 [ 36.273390][ T822] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 36.279283][ T822] page_owner free stack trace missing [ 36.284636][ T822] [ 36.286949][ T822] Memory state around the buggy address: [ 36.292562][ T822] ffff88810f819f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.300608][ T822] ffff88810f819f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.308658][ T822] >ffff88810f81a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.316719][ T822] ^ [ 36.322610][ T822] ffff88810f81a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.330671][ T822] ffff88810f81a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.338735][ T822] ================================================================== [ 36.346782][ T822] Disabling lock debugging due to kernel taint [ 36.375469][ T823] Need at least one configuration in g1. [ 36.387665][ T823] udc dummy_udc.0: failed to start g1: -22 [ 36.401702][ T290] usb 2-1: Found UVC 0.04 device syz (046d:08c3) [ 36.414775][ T290] usb 2-1: No valid video chain found. [ 36.437970][ T634] usb 3-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 36.453655][ T634] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.469435][ T634] usb 3-1: Product: syz [ 36.478016][ T634] usb 3-1: Manufacturer: syz [ 36.487244][ T634] usb 3-1: SerialNumber: syz [ 36.498784][ T634] usb 3-1: config 0 descriptor?? [ 36.527945][ T768] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 36.548302][ T634] hub 3-1:0.0: bad descriptor, ignoring hub [ 36.558274][ T634] hub: probe of 3-1:0.0 failed with error -5 [ 36.600078][ T315] usb 2-1: USB disconnect, device number 3 [ 36.636259][ T822] ------------[ cut here ]------------ [ 36.642909][ T822] refcount_t: addition on 0; use-after-free. [ 36.649206][ T822] WARNING: CPU: 0 PID: 822 at lib/refcount.c:25 refcount_warn_saturate+0x104/0x1a0 [ 36.659005][ T822] Modules linked in: [ 36.662953][ T822] CPU: 0 PID: 822 Comm: syz.0.216 Tainted: G B syzkaller #0 [ 36.671750][ T822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 36.682053][ T822] RIP: 0010:refcount_warn_saturate+0x104/0x1a0 [ 36.688330][ T822] Code: 04 01 48 c7 c7 a0 56 63 85 e8 78 4e 5b 02 0f 0b eb df e8 0f 7c 19 ff c6 05 8d d8 95 04 01 48 c7 c7 e0 55 63 85 e8 5c 4e 5b 02 <0f> 0b eb c3 e8 f3 7b 19 ff c6 05 72 d8 95 04 01 48 c7 c7 40 56 63 [ 36.708189][ T822] RSP: 0018:ffffc90000bff9f8 EFLAGS: 00010246 [ 36.714288][ T822] RAX: 8d759bb59b4ad900 RBX: 0000000000000002 RCX: 0000000000080000 [ 36.722464][ T822] RDX: ffffc9000173c000 RSI: 000000000007ffff RDI: 0000000000080000 [ 36.730526][ T822] RBP: ffffc90000bffa08 R08: ffff8881f7032eff R09: 1ffff1103ee065df [ 36.738631][ T822] R10: dffffc0000000000 R11: ffffed103ee065e0 R12: 1ffff11022f1e70e [ 36.746649][ T822] R13: dffffc0000000000 R14: 0000000000000002 R15: 0000000000000000 [ 36.756290][ T822] FS: 00007fddc20e16c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 36.765428][ T822] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.772141][ T822] CR2: 0000001b2ea10ff8 CR3: 000000012a087000 CR4: 00000000003506b0 [ 36.780232][ T822] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.788326][ T822] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.796339][ T822] Call Trace: [ 36.799944][ T822] [ 36.802924][ T822] kobject_get+0xfb/0x120 [ 36.807302][ T822] device_add+0x2f0/0xe90 [ 36.812079][ T822] device_create+0x26c/0x300 [ 36.817219][ T822] ? root_device_unregister+0x80/0x80 [ 36.822945][ T822] create_function_device+0x60/0x70 [ 36.828635][ T822] f_midi_alloc_inst+0x1a8/0x380 [ 36.833720][ T822] usb_get_function_instance+0xe2/0x2f0 [ 36.839635][ T822] function_make+0x118/0x350 [ 36.844598][ T822] ? gadget_dev_desc_max_speed_store+0x240/0x240 [ 36.851087][ T822] ? wait_for_completion_killable_timeout+0x10/0x10 [ 36.857765][ T822] ? __kmalloc+0x13d/0x2c0 [ 36.862322][ T822] ? configfs_mkdir+0x444/0x9c0 [ 36.867209][ T822] configfs_mkdir+0x50a/0x9c0 [ 36.872115][ T822] vfs_mkdir+0x38b/0x590 [ 36.876468][ T822] do_mkdirat+0x174/0x4d0 [ 36.881125][ T822] __x64_sys_mkdirat+0x89/0xa0 [ 36.886158][ T822] x64_sys_call+0x37e/0x9a0 [ 36.890858][ T822] do_syscall_64+0x4c/0xa0 [ 36.895454][ T822] ? clear_bhb_loop+0x50/0xa0 [ 36.900366][ T822] ? clear_bhb_loop+0x50/0xa0 [ 36.905085][ T822] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 36.911316][ T822] RIP: 0033:0x7fddc3688559 [ 36.915947][ T822] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.935839][ T822] RSP: 002b:00007fddc20e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 36.944392][ T822] RAX: ffffffffffffffda RBX: 00007fddc390ffa0 RCX: 00007fddc3688559 [ 36.952519][ T822] RDX: 00000000000001ff RSI: 0000200000002b40 RDI: ffffffffffffff9c [ 36.960753][ T822] RBP: 00007fddc371fab8 R08: 0000000000000000 R09: 0000000000000000 [ 36.968934][ T822] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 36.976939][ T822] R13: 00007fddc3910038 R14: 00007fddc390ffa0 R15: 00007ffddf663dd8 [ 36.985083][ T822] [ 36.988187][ T822] ---[ end trace 3bf4c0857c63700d ]--- [ 36.993665][ T822] ------------[ cut here ]------------ [ 36.999303][ T822] refcount_t: saturated; leaking memory. [ 37.005061][ T822] WARNING: CPU: 0 PID: 822 at lib/refcount.c:22 refcount_warn_saturate+0x158/0x1a0 [ 37.014576][ T822] Modules linked in: [ 37.018762][ T822] CPU: 0 PID: 822 Comm: syz.0.216 Tainted: G B W syzkaller #0 [ 37.027432][ T822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 37.037704][ T822] RIP: 0010:refcount_warn_saturate+0x158/0x1a0 [ 37.044003][ T822] Code: 04 01 48 c7 c7 80 55 63 85 e8 24 4e 5b 02 0f 0b eb 8b e8 bb 7b 19 ff c6 05 38 d8 95 04 01 48 c7 c7 80 55 63 85 e8 08 4e 5b 02 <0f> 0b e9 6c ff ff ff e8 9c 7b 19 ff c6 05 1d d8 95 04 01 48 c7 c7 [ 37.063801][ T822] RSP: 0018:ffffc90000bff8b8 EFLAGS: 00010246 [ 37.069978][ T822] RAX: 8d759bb59b4ad900 RBX: 0000000000000001 RCX: 0000000000080000 [ 37.078089][ T822] RDX: ffffc9000173c000 RSI: 000000000007ffff RDI: 0000000000080000 [ 37.086089][ T822] RBP: ffffc90000bff8c8 R08: ffff8881f7027493 R09: 1ffff1103ee04e92 [ 37.094250][ T822] R10: dffffc0000000000 R11: ffffed103ee04e93 R12: 00000000c0000000 [ 37.102309][ T822] R13: ffff8881178f3818 R14: 0000000000000001 R15: ffff88810f81a038 [ 37.110393][ T822] FS: 00007fddc20e16c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 37.122671][ T822] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.131843][ T822] CR2: 0000001b2ea10ff8 CR3: 000000012a087000 CR4: 00000000003506b0 [ 37.139968][ T822] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.148089][ T822] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 37.156100][ T822] Call Trace: [ 37.159776][ T822] [ 37.162728][ T822] kobject_add_internal+0xc44/0xde0 [ 37.168102][ T822] ? kobject_set_name_vargs+0x4c/0x110 [ 37.173595][ T822] kobject_add+0x165/0x230 [ 37.178175][ T822] ? kobject_init+0x1d0/0x1d0 [ 37.182874][ T822] ? get_device_parent+0x12e/0x410 [ 37.188111][ T822] device_add+0x398/0xe90 [ 37.192491][ T822] device_create+0x26c/0x300 [ 37.197104][ T822] ? root_device_unregister+0x80/0x80 [ 37.203243][ T822] create_function_device+0x60/0x70 [ 37.208599][ T822] f_midi_alloc_inst+0x1a8/0x380 [ 37.213593][ T822] usb_get_function_instance+0xe2/0x2f0 [ 37.219283][ T822] function_make+0x118/0x350 [ 37.223922][ T822] ? gadget_dev_desc_max_speed_store+0x240/0x240 [ 37.230456][ T822] ? wait_for_completion_killable_timeout+0x10/0x10 [ 37.237098][ T822] ? __kmalloc+0x13d/0x2c0 [ 37.241640][ T822] ? configfs_mkdir+0x444/0x9c0 [ 37.246507][ T822] configfs_mkdir+0x50a/0x9c0 [ 37.251328][ T822] vfs_mkdir+0x38b/0x590 [ 37.255597][ T822] do_mkdirat+0x174/0x4d0 [ 37.260041][ T822] __x64_sys_mkdirat+0x89/0xa0 [ 37.264869][ T822] x64_sys_call+0x37e/0x9a0 [ 37.272644][ T822] do_syscall_64+0x4c/0xa0 [ 37.281299][ T822] ? clear_bhb_loop+0x50/0xa0 [ 37.286026][ T822] ? clear_bhb_loop+0x50/0xa0 [ 37.290844][ T822] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 37.296780][ T822] RIP: 0033:0x7fddc3688559 [ 37.301331][ T822] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.322697][ T822] RSP: 002b:00007fddc20e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 37.331255][ T822] RAX: ffffffffffffffda RBX: 00007fddc390ffa0 RCX: 00007fddc3688559 [ 37.339366][ T822] RDX: 00000000000001ff RSI: 0000200000002b40 RDI: ffffffffffffff9c [ 37.347365][ T822] RBP: 00007fddc371fab8 R08: 0000000000000000 R09: 0000000000000000 [ 37.356482][ T822] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 37.364733][ T822] R13: 00007fddc3910038 R14: 00007fddc390ffa0 R15: 00007ffddf663dd8 [ 37.372859][ T822] [ 37.375903][ T822] ---[ end trace 3bf4c0857c63700e ]--- [ 37.382452][ T822] ------------[ cut here ]------------ [ 37.388116][ T822] refcount_t: underflow; use-after-free. [ 37.393864][ T822] WARNING: CPU: 0 PID: 822 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 37.403552][ T315] usb 3-1: USB disconnect, device number 3 [ 37.410321][ T822] Modules linked in: [ 37.417052][ T822] CPU: 0 PID: 822 Comm: syz.0.216 Tainted: G B W syzkaller #0 [ 37.425881][ T822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 37.436170][ T822] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 37.443883][ T822] Code: 04 01 48 c7 c7 e0 55 63 85 e8 5c 4e 5b 02 0f 0b eb c3 e8 f3 7b 19 ff c6 05 72 d8 95 04 01 48 c7 c7 40 56 63 85 e8 40 4e 5b 02 <0f> 0b eb a7 e8 d7 7b 19 ff c6 05 53 d8 95 04 01 48 c7 c7 80 55 63 [ 37.463701][ T822] RSP: 0018:ffffc90000bff880 EFLAGS: 00010246 [ 37.469922][ T822] RAX: 8d759bb59b4ad900 RBX: 0000000000000003 RCX: 0000000000080000 [ 37.479226][ T822] RDX: ffffc9000173c000 RSI: 000000000007ffff RDI: 0000000000080000 [ 37.487273][ T822] RBP: ffffc90000bff890 R08: ffff8881f7027493 R09: 1ffff1103ee04e92 [ 37.495491][ T822] R10: dffffc0000000000 R11: ffffed103ee04e93 R12: 00000000c0000000 [ 37.503642][ T822] R13: ffff88810f81a03c R14: 0000000000000003 R15: ffff88810f81a038 [ 37.512780][ T822] FS: 00007fddc20e16c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 37.521894][ T822] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.528615][ T822] CR2: 00007f20a0a962f8 CR3: 000000012a087000 CR4: 00000000003506b0 [ 37.536646][ T822] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.545589][ T822] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 37.553740][ T822] Call Trace: [ 37.557060][ T822] [ 37.560146][ T822] kobject_put+0x231/0x270 [ 37.564602][ T822] kobject_add_internal+0xb52/0xde0 [ 37.570704][ T822] kobject_add+0x165/0x230 [ 37.575173][ T822] ? kobject_init+0x1d0/0x1d0 [ 37.580003][ T822] ? get_device_parent+0x12e/0x410 [ 37.585167][ T822] device_add+0x398/0xe90 [ 37.589637][ T822] device_create+0x26c/0x300 [ 37.594251][ T822] ? root_device_unregister+0x80/0x80 [ 37.600802][ T822] create_function_device+0x60/0x70 [ 37.606056][ T822] f_midi_alloc_inst+0x1a8/0x380 [ 37.611349][ T822] usb_get_function_instance+0xe2/0x2f0 [ 37.617125][ T822] function_make+0x118/0x350 [ 37.621941][ T822] ? gadget_dev_desc_max_speed_store+0x240/0x240 [ 37.632056][ T822] ? wait_for_completion_killable_timeout+0x10/0x10 [ 37.647341][ T822] ? __kmalloc+0x13d/0x2c0 [ 37.654120][ T822] ? configfs_mkdir+0x444/0x9c0 [ 37.659378][ T822] configfs_mkdir+0x50a/0x9c0 [ 37.664124][ T822] vfs_mkdir+0x38b/0x590 [ 37.668566][ T822] do_mkdirat+0x174/0x4d0 [ 37.672988][ T822] __x64_sys_mkdirat+0x89/0xa0 [ 37.679240][ T822] x64_sys_call+0x37e/0x9a0 [ 37.683848][ T822] do_syscall_64+0x4c/0xa0 [ 37.688433][ T822] ? clear_bhb_loop+0x50/0xa0 [ 37.693156][ T822] ? clear_bhb_loop+0x50/0xa0 [ 37.697982][ T822] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 37.703915][ T822] RIP: 0033:0x7fddc3688559 [ 37.708467][ T822] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.728228][ T822] RSP: 002b:00007fddc20e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 37.736678][ T822] RAX: ffffffffffffffda RBX: 00007fddc390ffa0 RCX: 00007fddc3688559 [ 37.744795][ T822] RDX: 00000000000001ff RSI: 0000200000002b40 RDI: ffffffffffffff9c [ 37.752881][ T822] RBP: 00007fddc371fab8 R08: 0000000000000000 R09: 0000000000000000 [ 37.760961][ T822] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 37.769030][ T822] R13: 00007fddc3910038 R14: 00007fddc390ffa0 R15: 00007ffddf663dd8 [ 37.777042][ T822] [ 37.780172][ T822] ---[ end trace 3bf4c0857c63700f ]--- [ 37.785651][ T822] kobject_add_internal failed for f_midi (error: -2 parent: " w)