last executing test programs: 3m33.236698199s ago: executing program 0 (id=111): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r0, 0xffffffffffffffff}, &(0x7f0000000200), &(0x7f00000005c0)='%pi6 \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000800)={r1, 0xffffffffffffffff}, 0x4) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x10, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000ffff0b867b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0x22, 0x48000000, &(0x7f0000000300)="40f0538ef047b21fb60068305500", 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xaf) 3m33.08795098s ago: executing program 0 (id=113): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x8001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000000, 0x100010, r1, 0x6d303000) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_GET_XSAVE2(r2, 0x9000aecf, &(0x7f0000002000/0x2000)=nil) 3m32.471327657s ago: executing program 0 (id=116): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) 3m32.235229416s ago: executing program 0 (id=117): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000b80)='./file0\x00', 0x1008002, &(0x7f0000000d00)={[{@grpjquota}]}, 0x3, 0x5ee, &(0x7f0000000280)="$eJzs3c1vVFUbAPDnTj9oKXk7kDcqLqSJMZAoLS1gGuMCtoY0+BE3urDSgkiBhtZo0YSS4MbEuDHGxJUL8b9QIltWunLhxpUhIWpYmjjmztxbOu1Mv2jnEu7vlwxz7zlze86lfeace+acOwGU1lD6TyVif0TMJhGDyeJSXndkmUON193/+5Mz6SOJWu31P5NIsrT89Un2PJAd3BcRP/+UxL6u1eXOLVy9MDkzM30l2x+Zvzg7Mrdw9fD5i5Pnps9NXxp7cWz8+LHj46NHtnRe11qknbrx/oeDn0289d03/ySj3/82kcSJeCV74fLz2C5DMVT/P0lWZw2Mb3dhBenK/k5qtVotT0u6i60TG5f//noi4skYjK548MsbjE9fLbRywI6qJY33bqCMEvEPJZX3A/Jr+5XXwZVCeiVAJ9w72RgAWB3/3Y2xweirjw3svp/E8mGdJCK2NjLXbE9E3Lk9cePs7YkbsUPjcEBri9cj4qlW8Z/U478afVGtx3+lKf7TfsHp7DlNf22L5a8cKhb/0DmN+O9bM/6jTfy/kz5fa8Twu1ssv/pg873+pvjv3+opAQAAAAAAQGndOhkRL7T6/L+yNP8nWsz/GYiIE9tQ/tCK/dWf/1fubkMxQAv3Tka83HL+byWf/VvtWraEtRo9ydnzM9NHIuJ/EXEoenal+6NrlHH4831ft8sbyub/5Y+0/DvZXMCsHne7dzUfMzU5P/kQpwxk7l2PeLrl/N9kqf1PWrT/6TvD7AbL2PfczdPt8taPf2Cn1L6NONiy/X9w14pk7ftzjNT7AyN5r2C1Zz7+4od25W81/t1iAh5e2v7vXjv+q8ny+/XMbb6MowvdtXZ5W+3/9yZv1O8q1JulfTQ5P39lNKI3OdWVpjalj22+zvA4yuMhj5c0/g89u/b4X6v+f39ELK742clfzWuKc0/8O/B7u/ro/0Nx0vif2lT7v/mNsZvVH9uVv7H2/1i9rT+UpRj/g4av8jDtbU5vEY7drbI6XV8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeBxUImJPJJXhpe1KZXg4YiAi/h+7KzOX5+afP3v5g0tTaV79+/8r+Tf9Djb2k/z7/6vL9sdW7B+NiL0R8WVXf31/+MzlmamiTx4AAAAAAAAAAAAAAAAAAAAeEQNt1v+n/ugqunbAjusuugJAYVrE/y9F1APoPO0/lJf4h/IS/1Be4h/KS/xDea0d/2+Pd6wiQMdp/6G8xD8AAAAAADxW9h649WsSEYsv9dcfqd4sr6fQmgE7rVJ0BYDCuMUPlJepP1BervGBZJ38vrYHrXfkWmbPPMTBAAAAAAAAAAAAAFA6B/db/w9lZf0/lJf1/1Be+fr/AwXXA+g81/hArLOSv+X6/3WPAgAAAAAAAAAAAAC209zC1QuTMzPTV2y8+WhUo5MbtVrtWvpX8KjUZ/s3kmyGekcKzafCd/5Mezdygvlav4395OLekwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgGb/BQAA//8wviV5") syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) setxattr$trusted_overlay_origin(&(0x7f0000000180)='./file0\x00', &(0x7f0000000340), &(0x7f0000000380), 0x64, 0x1) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@index_on}]}) 3m31.936498447s ago: executing program 0 (id=120): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) io_setup(0x8, &(0x7f0000000540)=0x0) io_submit(r1, 0x1, &(0x7f0000000140)=[&(0x7f0000002f00)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}]) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r0, &(0x7f0000000000)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x40}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000000040)='\x00', 0x1}], 0x1}}], 0x1, 0x34000091) 3m30.993868432s ago: executing program 0 (id=128): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pnp/drivers/serial\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000480)='bind\x00', 0x1, 0x0) write(r1, &(0x7f00000004c0)='00:02\n', 0x6) 3m30.71376052s ago: executing program 32 (id=128): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pnp/drivers/serial\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000480)='bind\x00', 0x1, 0x0) write(r1, &(0x7f00000004c0)='00:02\n', 0x6) 1m50.833808578s ago: executing program 2 (id=1072): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000000041}, 0xc) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000480)={{{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in=@private=0xa010100, 0x0, 0x0, 0x4e20, 0x0, 0x2}, {0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x9c0, 0x3}, {0xffffbffffffffffc, 0x0, 0x0, 0x1}, 0x0, 0x0, 0x1, 0x0, 0x1}, {{@in=@empty, 0x4d3, 0x3c}, 0xa, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xffffffff, 0x4, 0x0, 0x0, 0x3, 0x4000000, 0x6}}, 0xe8) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) 1m50.816249991s ago: executing program 2 (id=1074): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000080)="2e9b3d0007e03dd65193dfb6c575963f86ddf0fd26d4eef23248000000f858dbb8a19052343f", 0x26}, {&(0x7f0000000280)="051a00000e80006558f2878f0200200000000020c2f56de640c9b908", 0x1c}], 0x2) 1m50.53380816s ago: executing program 2 (id=1079): syz_open_dev$vim2m(&(0x7f00000000c0), 0x0, 0x2) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) connect$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e23, 0x4, @empty, 0xfff}, 0x1c) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00', 0x8}}, 0x0, 0x0, 0x0, 0x4, 0x94}, &(0x7f00000001c0)=0x9c) 1m50.519926783s ago: executing program 2 (id=1081): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x84000, 0x0) 1m50.38903907s ago: executing program 2 (id=1083): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) 1m50.059991087s ago: executing program 2 (id=1089): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x8) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000802, 0xee00, 0x0) 1m49.715787969s ago: executing program 33 (id=1089): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x8) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000802, 0xee00, 0x0) 3.38993361s ago: executing program 5 (id=1984): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r3, 0x0, 0x39000, 0x0) vmsplice(r2, &(0x7f0000000180)=[{&(0x7f0000002280)="80", 0x1}], 0x1, 0x0) write$binfmt_elf64(r1, &(0x7f0000000100)=ANY=[], 0xfffffe3e) 3.154055048s ago: executing program 4 (id=1986): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000440)=0x83) ioctl$TCSETSW2(r0, 0x402c542c, &(0x7f0000000000)={0x1e57, 0x3, 0x7, 0xa, 0x5, "e9d30d0d00", 0x8001, 0x6}) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000080)=0xa) 3.005714169s ago: executing program 4 (id=1987): unshare(0x60400) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x1}}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000002340)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4509c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a900d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a3c0db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05fea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848022e8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828bf209d0000000000000000000000000001545f0ec539c3b58facd2f62dc3307a6c91d6b"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000380)=ANY=[@ANYRES32=r1, @ANYRES32=r1, @ANYBLOB="2f0000001220f50004"], 0x20) 2.991892382s ago: executing program 4 (id=1988): r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000002140)=0x20) ppoll(&(0x7f00000003c0)=[{r0, 0x20}], 0x1, 0x0, 0x0, 0x0) mmap$dsp(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x100000f, 0x11, r0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f00000000c0)=0x4000) 2.731893915s ago: executing program 3 (id=1991): r0 = epoll_create(0x103) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) recvmmsg(r1, &(0x7f0000001500)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000000)=@xdp, 0x80, &(0x7f00000011c0)=[{&(0x7f00000001c0)=""/4096, 0x1000}, {&(0x7f0000000080)=""/236, 0xec}], 0x2, &(0x7f0000001200)=""/97, 0x61}}, {{&(0x7f00000015c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000001480)=[{&(0x7f0000001300)=""/68, 0x44}, {&(0x7f0000001380)=""/197, 0xc5}], 0x2e3, &(0x7f00000014c0)=""/45, 0x38}}], 0x3, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000001280)={0x30000010}) 2.630092346s ago: executing program 3 (id=1992): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000200)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d7061746830") ioctl(r0, 0xc138fd09, &(0x7f0000000300)="0400000000000000000000009001000038010000010000000000000000000000000000000000000000000000000000006d70617468300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000580000006d756c74697061746800000000000000322071756575655f6d6f64652062696f203020312031") 2.521748689s ago: executing program 3 (id=1993): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000001c0)={0xffffffffffffffff}, 0x111, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0xffffffff, @loopback, 0xc}, {0xa, 0x4e1e, 0x800000d, @local}, r1, 0x800}}, 0x48) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x0, 0x7fff0000}]}) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 2.521529549s ago: executing program 3 (id=1994): socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)) r0 = socket(0x1, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295a5, 0x0, 0x0, {0xa, 0x68, 0x42, 0xc8, r1}, [@IFA_LOCAL={0x14, 0x2, @mcast1={0xff, 0x2}}, @IFA_FLAGS={0x8, 0x8, 0x706}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x0) 2.485531116s ago: executing program 5 (id=1995): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10, 0x92}, [@ldst={0x3, 0x0, 0xb, 0x0, 0x2, 0xfffffffffffffff0, 0xfffffffffffffffc}]}, &(0x7f0000003ff6)='GPL\x00', 0x8, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000d190000f10000000000000630000000000000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0xffffffbc, 0x10}, [@ldst={0x7, 0xff05, 0x0, 0x0, 0xa}]}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xff06, &(0x7f000000cf3d)=""/195}, 0x48) 2.46630529s ago: executing program 3 (id=1996): setns(0xc9, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bond0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x7}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x48000) 2.305836703s ago: executing program 5 (id=1997): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f0000000340)={r1, @in={{0x2, 0xce23, @broadcast}}}, &(0x7f0000000040)=0x84) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000100)={r2, 0x1}, &(0x7f0000000180)=0x8) 2.258827893s ago: executing program 5 (id=1999): mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./trace/trace_options\x00', 0x201, 0x8) write$P9_RREADDIR(r0, &(0x7f0000000340)={0xb, 0x29, 0x0, {0x401}}, 0xb) 2.12930703s ago: executing program 5 (id=2000): syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r0, &(0x7f00000002c0)=""/151, 0x97) ioctl$int_in(r0, 0x5421, &(0x7f0000000440)=0x85) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/84, 0x54}], 0x1) 2.033195789s ago: executing program 4 (id=2001): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x134) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x101002, 0x0) write(r0, &(0x7f0000000000)='7', 0x1) pselect6(0x20, 0x0, &(0x7f0000000200)={0x0, 0x100000001, 0x5, 0x3, 0x4, 0x10, 0x0, 0x9}, &(0x7f0000000240)={0x0, 0x8, 0x7, 0x9, 0x4, 0x2, 0x8, 0x1}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0x7]}, 0x8}) 1.88973723s ago: executing program 3 (id=2002): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000034709d405f0530c6acb60102030109021200fd000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000700)={0x2c, &(0x7f0000000400)={0x40, 0xd, 0x1, "1d"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000a80)={0x34, &(0x7f0000000940)={0x20, 0xd}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000e40)={0x40, 0x21, 0x1, 0xd}}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000300)={0x24, &(0x7f0000000100)={0x0, 0x30, 0x1, '*'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.735018921s ago: executing program 4 (id=2003): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r1) close_range(r0, 0xffffffffffffffff, 0x0) 857.992043ms ago: executing program 1 (id=2007): ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0xfffffffffffffffe, 0x6, 0xfffffffffffffffd, 0x80000000000000, 0x2, 0xfffffffffffffffd, 0x4002004c4, 0xffc, 0x0, 0x1, 0x51, 0x0, 0x3, 0x0, 0x0, 0xffffffffffffffff], 0xeeef0000, 0x2011c0}) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xffff, 0x14f600) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.stat\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d9600010000000000000000000000000000000000000000000000000400", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00040000170000000400", "f4bd00000080190000002c88f16b00", [0x100000000, 0x7ffffffffffffffe]}}) 661.830243ms ago: executing program 1 (id=2008): mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0) write(r0, &(0x7f0000000000)='7', 0x1) socket$can_bcm(0x1d, 0x2, 0x2) 415.519514ms ago: executing program 1 (id=2009): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) getsockopt$inet_mreqsrc(r0, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0xc) 378.083772ms ago: executing program 1 (id=2010): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x5, 0x4, 0x8, 0x100, 0x0, 0x0, 0x7, '\x00', 0x0, 0x0}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x9, 0x1, 0x8, 0x40, 0x42, 0x1}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x14, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020692500000000002022206b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000f00000085000000060000007a0af0ff0000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffffbfa300000000000007030000f0ffffffb704000000000000850000000200000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000340)='\x00'/14, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 289.89757ms ago: executing program 1 (id=2011): r0 = socket(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f00000002c0)={0x8400001e}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a00010000000000000000001c000000000000000000000014", @ANYRES8=0x0, @ANYRES32=r0], 0x30}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a00011100ffffffffffffff81"], 0x30}}, 0x0) 279.515752ms ago: executing program 1 (id=2012): syz_mount_image$reiserfs(&(0x7f0000000140), &(0x7f0000001140)='./file6\x00', 0x98, &(0x7f0000000280), 0x1, 0x10ef, &(0x7f0000001180)="$eJzs2DGLE0EYBuB3dg/kqshcvx5oYSHHHfEPXKGQxsLaLljZmUrJz/HnyFX2R3pTBOyVTQwJEhDJYuB4Hlh252Vmvp1yvgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDvLPlekosmqdusSVKSrrubLJJ02/zx17ZJydv3k9mrj+PXs8209FmT0q9aj+vN01rHdVxv6suL22d19unzh3avZEmX+9V8ev5mOehR+trtoDsCAADAw/DzaKMT1wcAAAD+ZrBGAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAA6vajSVKSrrubLJJ0p/0tAAAA4EglTd6NDuWbNsDOi3wblZRHu+RH6edc58uB9QAAAMC/KXv38ec5z5O9/DJnubrajH+/srxN2iTXf+xzv5pP18/lfFr+5wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgF/swLEAAAAAgDB/6zQ6NgAAAAAAAAAAAAAAAGCqAAAA//9TGNII") mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0/file1\x00', 0x1000000, 0x0, 0x0, 0x0, 0x0) setxattr$trusted_overlay_origin(&(0x7f0000000500)='./file0/file1\x00', &(0x7f0000000540), 0x0, 0x0, 0x1) unlinkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0x200) 23.759615ms ago: executing program 5 (id=2013): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) 0s ago: executing program 4 (id=2014): r0 = syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='nodots,dos1xfloppy,usefree,nodots,fmask=0000000000000010,flush,nfs=nostale_ro,dots,nodots,\x00'], 0x1, 0x159, &(0x7f00000004c0)="$eJzs27GKE0EcBvB/TKJRm9RisWBjFdQnUCSCuKAoKbRSiDaJBEyz2phH8QUFSZVuRPdI7nLJkRzs7ZH8fk0++GZgpsgOs7Af738dDSfTL5M38+g0GtF6GlksGtGNG9GM0iwAgEOySCn+pJTSrVnc/hUppXNDftayMACgMjuc/wDAgXH+A8Dxcf4DwPF59/7Dq2d53n+bZZ2I37NiUAzK37J/8TLvP8r+665mzYti0Fz2j8s+O9u3485J/2RjfzMePij7f93z1/lafzeG1W8fAAAAjkIvW9p4v+/1tvVlOvV+YO3+3op7rSvbBgCwh+n3H6NP4/Hnb3uFiMvMOojQjohrsAxBqDbU/WQCqrb609e9EgAAAAAAAAAAAAAAYJudvwfqXDx4kbZPr3uPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsO5vAAAA//9XS09N") syz_mount_image$msdos(&(0x7f00000000c0), &(0x7f00000003c0)='.\x00', 0x1b4a47c, &(0x7f0000000640)=ANY=[@ANYRES32=0x0, @ANYRES32=r0, @ANYRES32, @ANYRESHEX, @ANYRES16=r0, @ANYRES64, @ANYBLOB="3093e121f7523fece90a37d5a927c18dd10d3154456ac66e96749c346fd71173e12fcf6d1160b1a8ed194deb98dc67b07edd64d7e1afef339c828e956edf4068785cb0d7d4a24137cf9c2cac79060c0beb7d1ab2be0fac9a6d6028d2e9d895ec67dec6914528a112adced19a86ad8403eb4e04bc7d51afc6561063bbb696c825a82153efcf06941b3ae039ef7761b7a2bbddc32f3cc39f6ffb5d2a808f3e7ecd9039d8c7895b00ebbf6dc950788fbca296f89178e938440f8e57819e17eb79736882e9699d96b1959c119730542c4baf0af7acac79531d0c4623bb5055768b6228217225ea7782904746898b13fc6dab1c63a2c2d5a724a8bb745da18da54627d618842162c1367e4361737545a8628fb76106c1212ce6152ef12ebda119a33e28f17ba3fbf9eed69447ca88876cbabfce8b2aba2f668f5b91d00d5de2be7bf028b273ec31e63b4fbf87f6cbf1efb41a7e538e4f4a66962d7c7a0b2ff01e86df58b94f1a321aa1297c5a4cc42b656d9acb7a40490ede8099679fb86b4ee7a852aa68358dcea38ad3d2b3b794db5b3caec0228b39709eedd31a55aaf2b49146d0effdc3dfce3ec78e4bb2f65ceb9ca94a2e2fed7efc2b6bcd462955cf911ed5dbb62d6339d001bee46a4989d87cf0578d0f8913ed29d36c31e9b41678ec127f48d40003c0569b6102757c87f00adb7920ab2b78a82bfc115f831ab9abc72a93299c0e1971d17a2b3d376d66e6ddfe3dd86166507f87b6db73fe284aa52db7645601329b6087cab267eefc8bb846cad8ade3e61be692a066d0e6a3f0603d0405d58aa07c406950a69fff78a37cb9e2c9d420bb9394e483252739cabecc7418b142ec8c84e394b42c05c3f116409fc830fac08788bc2b93cb491696a8385d07cd1e19a9de182abeceb435e92d4eda2d2710cb06180c6271e5c1a26edf630ee16848993e3c3ef8804a87407b7e7cdb8d263238cec45424f7dfda3b1a8390e39820ac367c33aafc4edb3223578c108628e6fa84d7805208d796d91e4b83794fdea7fa49ed4c422aed72db2d46df97082b904dd80ed9cb4ab29b4cc1e345d76999971bb7a3bcf191634020eeda9c58c3b2a306921ef7830f672cc1da4905963b0a4aede35913fdf8dbd4e8ba22e39bfba342c6a302f7a03225d021f0e0e357200f7301ce560b065d1431ad16702e035caab022382d6251e88ef861145c1a3121ff099feda4dcf6561a026889ac3f0474d6a868a4f24ea60f7bc95bf7f2afb85a430658eb3b2b84b61a695f90e01f30a417c79caa44640e7eb9195f844346100c551d4fc23ef249f29ec1a5489839d153c3fce79b288d86a48eadc7024cab6f9b626c7eeb87e8f76ec6205c3487deaef65133ec2677c642887de743d1dcc2dbf72f7b9062b9654ff693aa688dd5e05ed48c8d681cd426bde017c08d31d83994284efb804a9beda7091240e7feb740307412e4c64aa422b91dfd31874a43aa2e76988e5933f557c884cd4b960a6321828692975a76f6473cd0650cbd9dd09acfad7aec17c7a6c34e3c9327469d77d1ee32992f1f2c47ff36026f74b4c8d01cf52eefd44d30519f33cc13cb30cf7a43f7305fd76b063d2363ac318e0090d3516cbbd82da99b3f53d570c2e2b85883abf68332f0ea3e0721bd251cea500281405d34aaed523c2684cd5e255919d828bf00f2d62a3d0b56d3d7cd18c5fa6f0764aeea0405e8731f0b223bd19471b8188c4b00cb5c2d057444148a390f36f2ddbf3bb6c46f4c96058ff00057311d2cff2a9c081f3f47967bc5c7c1dc554cd66c39ee403cd426a659131f3e2b9f0109af5414214e81344e0ff0129fe9ec7c01814823c995bf1b437e4f1f07f83055ded75331575d921231b448609f1aa76ae28edc70612e8de047c338712a43413a047c67a2fb3ec7c525a1720d01d8e0e92ae34f3b88c9b4e6c3e938919a4390628f6529dfa8d1f5666c28d4ae9bf8d5a579d5117e027a4cbbc5193a1c3f811a4822746e4c10fe9fd0ac93df86fb41e3d3993cdacb05f633be404a0d7fd256ca01c131859d08e5cd26809f786c5c57866d76f25ae000fc7517e2e74c29f1cf804fa6ae0bd985926daadbc1c61b9e042d8b6367d1e68e3e23476830f8fa2ff4999f17120d64537d601990fa130eaa19b6b660730f37f2256e028689c5b86582819ee5103d8cb23c246f4f34dfb7adebf2a14eb41eef768ecd6dbb37075ed8bf462104e0303f74fd81e69209c0d89cef3b0231a1b24b60d3edf5cb96043ef449823440c2edb1fcee97a9b56e811989ead072123d1090f1f7be126112497c2042bfdea16a14c34d6c90fe8be6a3558ecbcadba53a939f78bd2af5efcb96d697e78fdf099a57981099d4c3b10c560b814c3eb719bd441cc7fc1667776fe21b1a2288804a6b2a0c65341660053f800fef460b93d2dd27b38cdc32fd781fd34480278756e8b9ea8a3fd7687b55064bf95b80d01122f81ac7b1b33c08e92f9736dd80bd850f0f5d54197e28624e8aee1e171a449c21576f420f41d09c3f15c8723303338ede1f73020d1d637a59596092d02b7df0a649be2890b825978f5a571b88425cabbadbff56bbd2bcd3e1ff4c9197e7f639fec41ce603e34a18eb21fac02fcd0c68025c3eba6aa01a8470915ec51a499659a179b12deed0153e02c88dbf4429ecd922675132de722b0d225125e8650cbec160ea8dde590d87d37dda05aa4ebf21a9b2f96bebfc0a495cdea3258f732451716ee60bb9c69d7a1c87ea7e804ec2864234805f3f698f32289de4beecf3fa0cb3649aa6b2d6191ad9493dd01a5380a89af9fbbdcf8482429e254dce6e3d55cd012cf937ec058c922d9490228a7a75c8f28691452bc65184e89bc9b59278c05356c1e9db634b4c3d69ac5b0ac074e21b06cda6f57727dc67503cb78124c9ba71a98138ff73ff83344562a6835262517b239eb12244bafe6200595576f520b6cec0128cc18e94df1a2404dafa7b8631870d4b0b28706463fcdb12ff30a4dae6836cdb00080000d9a2a00d354ac4489be77b69de05646a12406473e2803bab37ca3a8e4057c8c1acdfe64529affda8ab2dc2a2912901dbdaf31add3db2a1998ac2524a6544cbbeea0015f2e3e219d9f65892345b9707a75e47308a0803076b1f3599804410513619a2224e51669d25b3d9ad1d795df41f6718a6bfec935fe61d5b4ed48c9b3506afac9e6215a64b56cc35d69c84914886da4f443aeb9ba4d7b92de2afcaae0d27dcb9fb587de4cfb501419ec1ecf6409761ac42a92d6bf9067f76eee3f459815459dadf700ffc024c511159626bc33f4b67ff894cada0dfd232639d1cb979d4f7f6064b2ff18c5376dd3bddcf70e0db0cbc4169aff2f81295cbcda865bb4d38b135003bf0db7264a80d74628c4e14a24d4453fbfa6ec81befc58c8dc52806961c90aacfbfcafd097d07e285158e96129b7d7fc1e692bb47e59fe42c86be772ce525f2df3cd7fee26fa6f2c4ae8820af6bd86f71a650a8fc636f50fa0be68986d8bc9c4af917c8483057f85700d177efc36127c5737439ccaae4753a97ab57b701a73a9580c497e11f07c60d47407898404f0b8b4187a51a6fa83ea3bca73d58e601f6d62eb86be9675dfc61620f09099de918c1e5d661d8cac1b4a638689ecc5ab23af6807a48be79af1a6fe9a0c4dd0496f8ff2c3e7e395719523d529a57c8cbde9594196e381a549b24e92f62e53f267bdfa214e5830513ca33fdc6abd42c274926eec5b9b26df5b1d19a4e5a33751419853cf372ff3b1f19b7f69b8cc21325828ab5a27ec12a6c6be92b3fe86cc1947e90032535c01dbf4bc8f511d71c2af2b5a2839be10d41786cac3037af2edc90e10005de6c7cd8c8f212ced643b901880e797cf39819200f2d7a52737ffb928798589a399ca3476cee2371e278d7a617cbc0ad3291f4c118d33366316be15a11738b0b36824064fd6e24a17e11c83a72fe54afe4b62d3280df32c0d7089cf67ca673613f223f0b66134c74878ca46fd11f965cbe337258f9e313da2edcd5fdeffc85d6ca8db1355b15d389d4068cefefc1e3e2dea21b22d07fb5120fd4827dd4b3dd6f0c1cdf773820f9b539065569f5e9bdeb6b8dd48cd01b30b3b9ed6b9fb48fa7dc87ceeff8f54cf0744b8c307319615ecb0d7b240cd663425d945cd00906e5b9bd63b89bcac0f4b28837fbfa299866f2b228e7341e517694f4a30c451512eb85e8e011911df0e050d125e63d559f1deae50745dc0a73eb6f0c04b725d8b0e2dfa7668442e9e0da2b83d07b6180a8152e6a35b61b642effaa6a57815d032dd643ed925884d4fdf0d115d5d75ea50999933a770ff1b10b4e172104ee61c2455987db88a053782b97a77af12f01f3f74d1d6224a14a047fda4c181e6b01de067d764d5e666e08d9be7bf5f936a3e3442f741d1619983c77e3bbedf97c4430ac96fe3cc8df98f15188ea9f796dd0e3e0e4bde70cf534a15d0e82d27ffbbafba15d8889451ec8cb0c4a63ef2d6907db89555385e11ec7ef2534ca29cc64df6dc5b3b92697ec11b826449c5db22f81b93868caf8e3df973edfa578b79c012ef8ef433a1eda720e22e30b2901e955dee0646c1efafdf997cd1163e08cf03e9d33f02bdffe0a89cf91acf2ac99796fa05018984ea13ce514460e159b49421c4356928031595dea599f000f0debe2c42e8d3bdd05207e74588ab36a6daaddc8ea2c7c4c5294c385886e58fc6309b94fd91b9b56a37b73a1c163a5a5ea1bfaecc1898c4fe857fec7e9b7f3a24c2f90f61119a9c72aa8df532787db0d25ac60db91b456d03baba0577d96ab9b8439ffc2b7b72e0146e3f2f61118d08449c2a816644c895345fd0a4c019bb4a983095e236a8c1a38b946bdb877c2ae202592cb0266f7d80e2c1d1292532204f9be9f2f5954ce2fa99697c9b20fe138db57ac3134ad556d16d8d615c356d05fd95ab1bef26b23e1ad2ea5abaffede3e14bfe2ee55f593700c49a6c9ecf28d1a01d72b1920b1b7944ef7ed7a2f96a6f5ee4f40f54978a735d155b259d7afd53ac19ed2443d45dcbc84335a419109ab159403b0f828d94079c0c5e5320f91496a043b92901a1e8a4966315ada9f8ffc5ac70868c0df278afe7bfe0affb68aa13ed029bb965b6d6a9ebaba1d0d1a2c17b69d0ca3b0edfa3fefedb5bc0064272577ac22fa84bf819a4eea0ab2ba920888e4c2bc89286184fc10b6dcce84466f3db078fe3af1a90a5b9aa7b66a9e5450807601c2a17460027109908618ac2cc1508029151fc96ee5ab264d2c4236aacfca06c0e6b71b748900652de55f7761a4606a237bd11902178e3a2afde4cc4964b3dfe1abdaad79ed0d80693674c4737a0b17c2e42ba390f98e776a4e758ed98ce8bdeb914b01707602b10fffca3992f1168e7ab3793ad47236351ff7a20ecd50b4edb63e95ed05d6093ead98bbc2dec9dda3ac4b902bd02e4d0eb528653ce3aa313cee066181d7612f40234c1c3aef14fc99b7d9196cd7dab2ff27c388ef67de7b351cf40d343059eeda90e45700c36febfde7a07fce384200618548cb76d8017c2053b332507045a914e39b93f927b33396ab82feb532870c4323c2305398867aac393339656bd4b39c5da5d676fa5a233c7c62f8cc9ab4417a658bf9e679d22bb801ab10d855897a75e4b3e523e87e4ea1e17f270830cee4185d62ea0afd170508453ab0f42d3b35292c4e0000000000000000", @ANYRESDEC=r0, @ANYRES8, @ANYRESHEX, @ANYRES64, @ANYRES16=r0, @ANYRESDEC=0x0, @ANYRES32, @ANYRES16], 0x5, 0x0, &(0x7f0000000000)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x202000, 0x0) renameat2(r1, &(0x7f0000000380)='./file0\x00', r1, &(0x7f0000000200)='./bus\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x21c0, 0x103) kernel console output (not intermixed with test programs): 9463] ? tomoyo_mount_permission+0x2b3/0x9d0 [ 218.653702][ T9463] ? kasan_set_track+0x5f/0x70 [ 218.658491][ T9463] ? kasan_set_track+0x4e/0x70 [ 218.663278][ T9463] ? kasan_save_free_info+0x28/0x40 [ 218.668512][ T9463] ? tomoyo_get_name+0x570/0x570 [ 218.673480][ T9463] ? user_path_at_empty+0x4c/0x60 [ 218.678568][ T9463] ? kasan_quarantine_put+0xd8/0x220 [ 218.683894][ T9463] ? lockdep_hardirqs_on+0x98/0x150 [ 218.689121][ T9463] security_sb_mount+0x87/0xc0 [ 218.693923][ T9463] path_mount+0xbc/0xfa0 [ 218.698201][ T9463] ? kmem_cache_free+0xf8/0x290 [ 218.703092][ T9463] __se_sys_mount+0x2e7/0x3d0 [ 218.707801][ T9463] ? __x64_sys_mount+0xc0/0xc0 [ 218.712594][ T9463] ? lockdep_hardirqs_on+0x98/0x150 [ 218.717821][ T9463] ? __x64_sys_mount+0x20/0xc0 [ 218.722609][ T9463] do_syscall_64+0x55/0xb0 [ 218.727063][ T9463] ? clear_bhb_loop+0x40/0x90 [ 218.731772][ T9463] ? clear_bhb_loop+0x40/0x90 [ 218.736479][ T9463] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 218.742400][ T9463] RIP: 0033:0x7fa4cb79e159 [ 218.746835][ T9463] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 218.766471][ T9463] RSP: 002b:00007fa4cc5f9028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 218.775018][ T9463] RAX: ffffffffffffffda RBX: 00007fa4cba25fa0 RCX: 00007fa4cb79e159 [ 218.783062][ T9463] RDX: 0000200000000040 RSI: 0000200000000080 RDI: 0000000000000000 [ 218.791066][ T9463] RBP: 00007fa4cb83506b R08: 0000000000000000 R09: 0000000000000000 [ 218.799072][ T9463] R10: 0000000002200892 R11: 0000000000000246 R12: 0000000000000000 [ 218.807077][ T9463] R13: 00007fa4cba26038 R14: 00007fa4cba25fa0 R15: 00007fff87966678 [ 218.815099][ T9463] [ 218.968815][ T8938] XFS (loop5): Unmounting Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a [ 219.018741][ T9444] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 219.641150][ T791] cdc_ncm 4-1:1.1: bind() failure [ 219.675240][ T791] usb 4-1: USB disconnect, device number 13 [ 219.733648][ T9495] loop5: detected capacity change from 0 to 128 [ 220.492013][ T9524] sock: sock_set_timeout: `syz.5.1245' (pid 9524) tries to set negative timeout [ 220.654992][ T9529] netlink: 'syz.3.1247': attribute type 3 has an invalid length. [ 220.680178][ T9533] loop5: detected capacity change from 0 to 128 [ 220.683719][ T9529] netlink: 'syz.3.1247': attribute type 7 has an invalid length. [ 220.710416][ T9533] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 220.713161][ T9529] netlink: 198368 bytes leftover after parsing attributes in process `syz.3.1247'. [ 220.737119][ T9533] hpfs: filesystem error: improperly stopped [ 220.747073][ T9533] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 220.765336][ T9533] hpfs: You really don't want any checks? You are crazy... [ 220.793508][ T9533] hpfs: Code page directory magic doesn't match (magic = 7b3184b5) [ 220.818596][ T9533] hpfs: code page support is disabled [ 220.835361][ T9533] hpfs: hpfs_map_4sectors(): unaligned read [ 220.846732][ T9533] hpfs: hpfs_map_4sectors(): unaligned read [ 220.861247][ T9533] hpfs: filesystem error: unable to find root dir [ 221.381451][ T9558] loop3: detected capacity change from 0 to 256 [ 221.636810][ T9544] loop5: detected capacity change from 0 to 40427 [ 221.663927][ T9544] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 221.696934][ T9544] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 221.726879][ T9544] F2FS-fs (loop5): invalid crc value [ 221.800767][ T9565] loop4: detected capacity change from 0 to 1024 [ 221.817790][ T9544] F2FS-fs (loop5): Found nat_bits in checkpoint [ 222.009194][ T9565] hfsplus: xattr searching failed [ 222.027455][ T9565] hfsplus: xattr searching failed [ 222.047319][ T9544] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 222.054691][ T9565] hfsplus: xattr searching failed [ 222.097768][ T9544] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 222.156976][ T9555] loop1: detected capacity change from 0 to 40427 [ 222.177183][ T9555] F2FS-fs (loop1): Insane cp_payload (553648128 >= 504) [ 222.211374][ T9555] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 222.255282][ T9555] F2FS-fs (loop1): invalid crc value [ 222.274500][ T9555] F2FS-fs (loop1): Ignore s_resuid=0, s_resgid=65535 w/o reserve_root [ 222.320356][ T9555] F2FS-fs (loop1): Found nat_bits in checkpoint [ 222.381948][ T28] audit: type=1804 audit(1790866758.129:43): pid=9544 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.1251" name="/newroot/40/file0/bus" dev="loop5" ino=10 res=1 errno=0 [ 222.548106][ T9555] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 222.556240][ T9555] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 222.601630][ T9555] syz.1.1255: attempt to access beyond end of device [ 222.601630][ T9555] loop1: rw=2049, sector=53248, nr_sectors = 8 limit=40427 [ 222.689274][ T28] audit: type=1800 audit(1790866758.479:44): pid=9595 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1255" name="file1" dev="loop1" ino=10 res=0 errno=0 [ 222.800772][ T5769] syz-executor: attempt to access beyond end of device [ 222.800772][ T5769] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 222.831827][ T5769] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 223.389398][ T9592] loop3: detected capacity change from 0 to 32768 [ 223.425011][ T9606] loop4: detected capacity change from 0 to 256 [ 223.514147][ T9592] XFS (loop3): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 223.639387][ T9592] XFS (loop3): Ending clean mount [ 223.772817][ T28] audit: type=1800 audit(1790866759.559:45): pid=9592 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1262" name="file1" dev="loop3" ino=4422 res=0 errno=0 [ 223.793353][ C1] vkms_vblank_simulate: vblank timer overrun [ 223.807904][ T5770] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 224.023107][ T5770] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 224.056548][ T5770] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 224.085833][ T5770] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 224.122917][ T5770] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 224.157734][ T5770] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 224.166019][ T5770] usb 6-1: Product: syz [ 224.183539][ T5770] usb 6-1: Manufacturer: syz [ 224.200946][ T9615] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 224.218623][ T5767] XFS (loop3): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 224.241720][ T5770] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 224.254192][ T5770] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 224.306334][ T9638] CIFS: Attempting to mount //127.0.0.1/share [ 224.363931][ T9640] syzkaller1: entered promiscuous mode [ 224.369841][ T9640] syzkaller1: entered allmulticast mode [ 224.548918][ T5758] usb 6-1: USB disconnect, device number 2 [ 224.574216][ T5758] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 224.604243][ T5758] garmin_gps 6-1:1.0: device disconnected [ 224.999319][ T27] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 225.137764][ T9638] CIFS: VFS: Error connecting to socket. Aborting operation. [ 225.145250][ T9638] CIFS: VFS: cifs_mount failed w/return code = -4 [ 225.199944][ T27] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 225.207478][ T9668] input: syz0 as /devices/virtual/input/input22 [ 225.246958][ T27] usb 4-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 225.277106][ T27] usb 4-1: New USB device strings: Mfr=1, Product=0, SerialNumber=0 [ 225.306460][ T27] usb 4-1: Manufacturer: syz [ 225.322822][ T27] usb 4-1: config 0 descriptor?? [ 225.344378][ T9672] loop1: detected capacity change from 0 to 256 [ 225.355669][ T27] usb 4-1: Found UVC 0.00 device (18ec:3288) [ 225.387824][ T27] usb 4-1: No valid video chain found. [ 225.396567][ T9672] exfat: Deprecated parameter 'utf8' [ 225.451021][ T9672] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xe3908169, utbl_chksum : 0xe619d30d) [ 225.660190][ T27] usb 4-1: USB disconnect, device number 14 [ 225.976876][ T9692] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1281'. [ 225.996523][ T9692] veth0_macvtap: left promiscuous mode [ 226.019149][ T9692] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1281'. [ 226.153784][ T9703] loop1: detected capacity change from 0 to 512 [ 226.160377][ T27] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 226.243738][ T9703] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 226.298380][ T9703] ext4 filesystem being mounted at /319/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 226.359474][ T27] usb 5-1: config 3 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 226.401510][ T27] usb 5-1: config 3 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 16896, setting to 1024 [ 226.446484][ T27] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 226.476182][ T27] usb 5-1: New USB device strings: Mfr=128, Product=0, SerialNumber=0 [ 226.496424][ T27] usb 5-1: Manufacturer: syz [ 226.521483][ T27] cdc_acm 5-1:3.0: skipping garbage [ 226.633934][ T5769] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 226.748368][ T27] cdc_acm 5-1:3.0: ttyACM0: USB ACM device [ 226.993167][ T9688] cdc_acm 5-1:3.1: urb 0 failed submission with -22 [ 227.050962][ T27] usb 5-1: USB disconnect, device number 21 [ 227.538650][ T9755] loop1: detected capacity change from 0 to 8192 [ 228.072809][ T9781] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1311'. [ 228.090361][ T9782] MTD: Couldn't look up './file0': -15 [ 228.174110][ T9786] loop3: detected capacity change from 0 to 1024 [ 228.301729][ T9789] hfsplus: found bad thread record in catalog [ 228.373956][ T11] hfsplus: found bad thread record in catalog [ 228.387262][ T11] hfsplus: b-tree write err: -5, ino 8 [ 228.400579][ T791] usb 2-1: new full-speed USB device number 14 using dummy_hcd [ 228.411193][ T9793] loop5: detected capacity change from 0 to 1764 [ 228.614401][ T791] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 228.631576][ T791] usb 2-1: config 0 has no interface number 0 [ 228.641117][ T791] usb 2-1: config 0 interface 41 has no altsetting 0 [ 228.645646][ T9799] syzkaller1: entered promiscuous mode [ 228.654011][ T9799] syzkaller1: entered allmulticast mode [ 228.658931][ T791] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 228.688189][ T791] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.696454][ T791] usb 2-1: Product: syz [ 228.705055][ T791] usb 2-1: Manufacturer: syz [ 228.719447][ T791] usb 2-1: SerialNumber: syz [ 228.730354][ T791] usb 2-1: config 0 descriptor?? [ 229.113977][ T9804] loop5: detected capacity change from 0 to 32768 [ 229.128782][ T9804] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz.5.1319 (9804) [ 229.153105][ T9804] BTRFS info (device loop5): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 229.163764][ T9804] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm [ 229.173221][ T9804] BTRFS info (device loop5): metadata ratio 220 [ 229.179968][ T9804] BTRFS info (device loop5): setting nodatasum [ 229.186548][ T9804] BTRFS info (device loop5): metadata ratio 4 [ 229.193823][ T9804] BTRFS info (device loop5): enabling ssd optimizations [ 229.201249][ T9804] BTRFS info (device loop5): allowing degraded mounts [ 229.209171][ T9804] BTRFS info (device loop5): using free space tree [ 229.270685][ T9804] BTRFS info (device loop5): auto enabling async discard [ 229.411238][ T8938] BTRFS info (device loop5): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 229.781389][ T791] CoreChips: probe of 2-1:0.41 failed with error -71 [ 229.805215][ T791] usb 2-1: USB disconnect, device number 14 [ 229.904986][ T9827] loop5: detected capacity change from 0 to 512 [ 229.943706][ T9827] EXT4-fs error (device loop5): ext4_orphan_get:1434: comm syz.5.1323: bad orphan inode 16 [ 229.958231][ T9827] ext4_test_bit(bit=15, block=18) = 1 [ 229.963788][ T9827] is_bad_inode(inode)=0 [ 229.970302][ T9827] NEXT_ORPHAN(inode)=83886080 [ 229.975114][ T9827] max_ino=32 [ 229.978485][ T9827] i_nlink=0 [ 230.009142][ T9827] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 230.026841][ T9827] ext4 filesystem being mounted at /58/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 230.041871][ T228] Quota error (device loop5): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 230.062020][ T228] EXT4-fs error (device loop5): ext4_release_dquot:6989: comm kworker/u4:6: Failed to release dquot type 1 [ 230.311893][ T8938] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 230.707828][ T5758] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 230.767856][ T5770] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 230.890036][ T5758] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 230.901212][ T5758] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 230.911481][ T5758] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 230.925099][ T5758] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 230.934388][ T5758] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.944054][ T5758] usb 4-1: config 0 descriptor?? [ 230.958911][ T5770] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 230.969375][ T5770] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 230.987028][ T5770] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 230.997255][ T5770] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 231.007436][ T5770] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 231.017181][ T5770] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 231.027219][ T5770] usb 2-1: config 1 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 231.042606][ T5770] usb 2-1: New USB device found, idVendor=06cd, idProduct=0107, bcdDevice= 1.00 [ 231.052179][ T5770] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 231.060295][ T5770] usb 2-1: Product: syz [ 231.064498][ T5770] usb 2-1: Manufacturer: syz [ 231.069371][ T5770] usb 2-1: SerialNumber: syz [ 231.077020][ T9841] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 231.084623][ T9841] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 231.092007][ T9841] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 231.102063][ T5770] keyspan 2-1:1.0: Keyspan 1 port adapter converter detected [ 231.110941][ T5770] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 84 [ 231.120520][ T5770] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 82 [ 231.128727][ T5770] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 2 [ 231.138166][ T5770] usb 2-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 231.321935][ T9843] loop5: detected capacity change from 0 to 512 [ 231.406660][ T5758] plantronics 0003:047F:FFFF.000E: No inputs registered, leaving [ 231.419390][ T9843] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a802c01c, mo2=0002] [ 231.437541][ T9843] System zones: 0-2, 18-18, 34-35 [ 231.457458][ T5758] plantronics 0003:047F:FFFF.000E: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 231.492738][ T9843] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 231.506468][ T23] usb 2-1: USB disconnect, device number 15 [ 231.522835][ T9843] ext4 filesystem being mounted at /60/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 231.536986][ T23] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 231.568629][ T23] keyspan 2-1:1.0: device disconnected [ 231.666029][ T8938] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 231.735903][ T9848] syzkaller1: entered promiscuous mode [ 231.743878][ T9848] syzkaller1: entered allmulticast mode [ 232.093333][ T9850] loop5: detected capacity change from 0 to 32768 [ 232.125983][ T9850] ocfs2: Slot 0 on device (7,5) was already allocated to this node! [ 232.151104][ T9850] JBD2: Ignoring recovery information on journal [ 232.286734][ T9850] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 232.485873][ T8938] ocfs2: Unmounting device (7,5) on (node local) [ 232.815178][ T9862] loop5: detected capacity change from 0 to 512 [ 232.822760][ T9862] EXT4-fs: Ignoring removed nobh option [ 232.841538][ T9862] EXT4-fs (loop5): Test dummy encryption mode enabled [ 232.853511][ T9862] EXT4-fs (loop5): Cannot turn on journaled quota: type 0: error -13 [ 232.864854][ T9862] EXT4-fs error (device loop5): ext4_clear_blocks:883: inode #13: comm syz.5.1336: attempt to clear invalid blocks 1 len 1 [ 232.890819][ T9862] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 232.914213][ T9862] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #13: comm syz.5.1336: invalid indirect mapped block 1819239214 (level 0) [ 232.928970][ T9862] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #13: comm syz.5.1336: invalid indirect mapped block 1819239214 (level 1) [ 232.953892][ T9862] EXT4-fs (loop5): 1 truncate cleaned up [ 232.960562][ T9865] binder: 9864:9865 ioctl 4018620d 0 returned -22 [ 232.963151][ T9862] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 233.031447][ T9862] EXT4-fs error (device loop5): htree_dirblock_to_tree:1112: inode #2: block 13: comm syz.5.1336: bad entry in directory: rec_len % 4 != 0 - offset=108, inode=4294901777, rec_len=65535, size=1024 fake=0 [ 233.064326][ T9862] EXT4-fs error (device loop5): htree_dirblock_to_tree:1112: inode #2: block 13: comm syz.5.1336: bad entry in directory: rec_len % 4 != 0 - offset=108, inode=4294901777, rec_len=65535, size=1024 fake=0 [ 233.124681][ T8938] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 233.196555][ T9871] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1340'. [ 233.397789][ T5770] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 233.494332][ T23] usb 4-1: USB disconnect, device number 15 [ 233.544253][ T9888] loop3: detected capacity change from 0 to 512 [ 233.580630][ T5770] usb 2-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 233.600539][ T5770] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.659625][ T5770] usb 2-1: config 0 descriptor?? [ 233.679658][ T5770] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 233.753819][ T9892] loop3: detected capacity change from 0 to 16 [ 233.765870][ T9892] erofs: (device loop3): mounted with root inode @ nid 36. [ 234.497296][ T5770] gspca_stv06xx: I2C: Read error writing address: -71 [ 234.568321][ T5770] usb 2-1: USB disconnect, device number 16 [ 235.044039][ T9901] loop5: detected capacity change from 0 to 40427 [ 235.079111][ T9901] F2FS-fs (loop5): invalid crc value [ 235.099346][ T9901] F2FS-fs (loop5): Found nat_bits in checkpoint [ 235.194802][ T9901] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 235.310298][ T9905] loop3: detected capacity change from 0 to 32768 [ 235.454601][ T8938] syz-executor: attempt to access beyond end of device [ 235.454601][ T8938] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 235.491683][ T8938] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 236.479071][ T9943] "syz.4.1372" (9943) uses obsolete ecb(arc4) skcipher [ 236.701317][ T9949] loop5: detected capacity change from 0 to 1024 [ 236.763046][ T9949] hfsplus: invalid length 32517 has been corrected to 255 [ 236.907005][ T12] hfsplus: b-tree write err: -5, ino 20 [ 236.912428][ T9935] loop1: detected capacity change from 0 to 40427 [ 236.939016][ T9935] F2FS-fs (loop1): Wrong segment_count / block_count (31 > 0) [ 236.946550][ T9935] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 237.002143][ T9935] F2FS-fs (loop1): invalid crc value [ 237.003917][ T9941] loop3: detected capacity change from 0 to 40427 [ 237.025320][ T9941] F2FS-fs (loop3): invalid crc value [ 237.059252][ T9951] loop4: detected capacity change from 0 to 1024 [ 237.068065][ T9941] F2FS-fs (loop3): Found nat_bits in checkpoint [ 237.075617][ T9935] F2FS-fs (loop1): Found nat_bits in checkpoint [ 237.249063][ T9959] netlink: 'syz.5.1377': attribute type 64 has an invalid length. [ 237.254783][ T9941] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 237.342590][ T9959] bridge0: port 2(bridge_slave_1) entered disabled state [ 237.351726][ T9959] bridge0: port 1(bridge_slave_0) entered disabled state [ 237.367917][ T9935] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 237.397929][ T9935] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 237.437869][ T9961] netlink: 'syz.5.1377': attribute type 64 has an invalid length. [ 237.486627][ T9935] syz.1.1368: attempt to access beyond end of device [ 237.486627][ T9935] loop1: rw=2049, sector=40960, nr_sectors = 8 limit=40427 [ 237.542397][ T9935] F2FS-fs (loop1): Remounting filesystem read-only [ 237.559395][ T5767] syz-executor: attempt to access beyond end of device [ 237.559395][ T5767] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 237.577121][ T9935] syz.1.1368: attempt to access beyond end of device [ 237.577121][ T9935] loop1: rw=2049, sector=40976, nr_sectors = 8 limit=40427 [ 237.607025][ T5767] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 237.620304][ T9935] F2FS-fs (loop1): Remounting filesystem read-only [ 238.232017][ T9972] kernel read not supported for file /! (pid: 9972 comm: syz.1.1381) [ 238.251861][ T28] audit: type=1800 audit(1790866774.039:46): pid=9972 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1381" name=217F dev="mqueue" ino=21497 res=0 errno=0 [ 238.307047][ T9968] loop5: detected capacity change from 0 to 32768 [ 238.333649][ T9968] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz.5.1382 (9968) [ 238.360244][ T9968] BTRFS info (device loop5): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 238.376594][ T9968] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm [ 238.386448][ T9968] BTRFS info (device loop5): setting nodatasum [ 238.400064][ T9968] BTRFS info (device loop5): enabling ssd optimizations [ 238.407183][ T9968] BTRFS info (device loop5): using spread ssd allocation scheme [ 238.422475][ T9968] BTRFS info (device loop5): setting incompat feature flag for COMPRESS_LZO (0x8) [ 238.437161][ T9968] BTRFS info (device loop5): use lzo compression, level 0 [ 238.445696][ T9968] BTRFS info (device loop5): turning on flush-on-commit [ 238.464577][ T9968] BTRFS info (device loop5): enabling auto defrag [ 238.510147][ T49] Bluetooth: hci4: Frame reassembly failed (-84) [ 238.520183][ T9968] BTRFS info (device loop5): max_inline at 4096 [ 238.526488][ T9968] BTRFS info (device loop5): using free space tree [ 238.597772][ T27] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 238.799692][ T27] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 238.821615][ T27] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 238.846741][ T27] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 238.871766][ T27] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 238.886326][ T27] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.912902][ T27] usb 5-1: config 0 descriptor?? [ 238.935330][ T8938] BTRFS info (device loop5): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 239.393269][ T27] plantronics 0003:047F:FFFF.000F: unknown main item tag 0x0 [ 239.417946][ T27] plantronics 0003:047F:FFFF.000F: unknown main item tag 0x0 [ 239.440919][ T27] plantronics 0003:047F:FFFF.000F: No inputs registered, leaving [ 239.472794][ T27] plantronics 0003:047F:FFFF.000F: hiddev0,hidraw0: USB HID v0.00 Joystick [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 239.607817][ T23] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 239.817793][ T23] usb 6-1: Using ep0 maxpacket: 32 [ 239.834660][ T23] usb 6-1: config 0 has an invalid interface number: 3 but max is 0 [ 239.842820][ T23] usb 6-1: config 0 has no interface number 0 [ 239.857784][ T23] usb 6-1: config 0 interface 3 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 239.869430][ T23] usb 6-1: config 0 interface 3 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 239.887804][ T23] usb 6-1: New USB device found, idVendor=5543, idProduct=0045, bcdDevice= 0.00 [ 239.896915][ T23] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 239.916187][ T23] usb 6-1: config 0 descriptor?? [ 240.007423][T10018] loop1: detected capacity change from 0 to 16 [ 240.028212][T10018] erofs: (device loop1): erofs_fc_fill_super: rootino(nid 36) is not a directory(i_mode 16300) [ 240.151411][T10018] loop1: detected capacity change from 0 to 8192 [ 240.224144][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.237405][T10018] FAT-fs (loop1): Filesystem has been set read-only [ 240.245124][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.254608][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.263444][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.283500][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.293948][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.302836][T10018] syz.1.1393: attempt to access beyond end of device [ 240.302836][T10018] loop1: rw=0, sector=15583, nr_sectors = 1 limit=8192 [ 240.320037][T10018] Buffer I/O error on dev loop1, logical block 15583, async page read [ 240.329149][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.350754][ T23] uclogic 0003:5543:0045.0010: interface is invalid, ignoring [ 240.359475][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.367430][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.387978][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.396316][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.408800][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.416749][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.425323][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.433936][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.442149][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.450933][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.459170][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.467242][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.475164][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.483098][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.491086][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.499037][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.506949][T10018] FAT-fs (loop1): error, invalid access to FAT (entry 0x00003c09) [ 240.508259][ T5778] Bluetooth: hci4: command 0x1003 tx timeout [ 240.514893][T10018] syz.1.1393: attempt to access beyond end of device [ 240.514893][T10018] loop1: rw=0, sector=15583, nr_sectors = 1 limit=8192 [ 240.523321][ T5780] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 240.535290][T10018] Buffer I/O error on dev loop1, logical block 15583, async page read [ 240.566584][ T28] audit: type=1800 audit(1790866776.349:47): pid=10018 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1393" name="file2" dev="loop1" ino=1048631 res=0 errno=0 [ 240.573409][ T5770] usb 6-1: USB disconnect, device number 3 [ 240.814040][T10026] FAULT_INJECTION: forcing a failure. [ 240.814040][T10026] name failslab, interval 1, probability 0, space 0, times 0 [ 240.828984][T10026] CPU: 1 PID: 10026 Comm: syz.3.1396 Not tainted syzkaller #0 [ 240.836500][T10026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 240.846682][T10026] Call Trace: [ 240.849991][T10026] [ 240.852956][T10026] dump_stack_lvl+0x18c/0x250 [ 240.857679][T10026] ? show_regs_print_info+0x20/0x20 [ 240.862924][T10026] ? load_image+0x420/0x420 [ 240.867466][T10026] ? __might_sleep+0xe0/0xe0 [ 240.872109][T10026] ? __lock_acquire+0x7d80/0x7d80 [ 240.877144][T10026] ? mtree_load+0x109/0x840 [ 240.881670][T10026] should_fail_ex+0x394/0x4c0 [ 240.886408][T10026] should_failslab+0x9/0x20 [ 240.890975][T10026] slab_pre_alloc_hook+0x59/0x300 [ 240.896044][T10026] ? can_vma_merge_before+0x6e/0x280 [ 240.901384][T10026] kmem_cache_alloc+0x5a/0x2c0 [ 240.906168][T10026] ? vm_area_dup+0x27/0x270 [ 240.910680][T10026] vm_area_dup+0x27/0x270 [ 240.915012][T10026] __split_vma+0x1a8/0xc20 [ 240.919443][T10026] ? mmap_write_unlock+0x160/0x160 [ 240.924609][T10026] ? split_vma+0x8f/0x110 [ 240.928961][T10026] mprotect_fixup+0xa3b/0xcd0 [ 240.933694][T10026] ? change_protection+0x31e0/0x31e0 [ 240.938994][T10026] ? apparmor_file_mprotect+0xfe/0x120 [ 240.944470][T10026] ? bpf_lsm_file_mprotect+0x9/0x10 [ 240.949780][T10026] do_mprotect_pkey+0x7c3/0xcc0 [ 240.954678][T10026] ? prot_none_test+0x10/0x10 [ 240.959390][T10026] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 240.965400][T10026] __x64_sys_mprotect+0x80/0x90 [ 240.970256][T10026] do_syscall_64+0x55/0xb0 [ 240.974683][T10026] ? clear_bhb_loop+0x40/0x90 [ 240.979376][T10026] ? clear_bhb_loop+0x40/0x90 [ 240.984074][T10026] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 240.989985][T10026] RIP: 0033:0x7f312ed9e159 [ 240.994420][T10026] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 241.014052][T10026] RSP: 002b:00007f312fbe1028 EFLAGS: 00000246 ORIG_RAX: 000000000000000a [ 241.022500][T10026] RAX: ffffffffffffffda RBX: 00007f312f025fa0 RCX: 00007f312ed9e159 [ 241.030507][T10026] RDX: 0000000000000000 RSI: 0000000000001000 RDI: 0000200000ffd000 [ 241.038489][T10026] RBP: 00007f312ee3506b R08: 0000000000000000 R09: 0000000000000000 [ 241.046468][T10026] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 241.054461][T10026] R13: 00007f312f026038 R14: 00007f312f025fa0 R15: 00007fff9ec67fb8 [ 241.062454][T10026] [ 241.376152][T10043] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1403'. [ 241.437785][ T27] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 241.512310][ T8] usb 5-1: USB disconnect, device number 22 [ 241.548537][T10049] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1405'. [ 241.642627][ T27] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 241.667862][ T27] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 241.690000][ T27] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 241.702175][ T27] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 241.719729][ T27] usb 2-1: Manufacturer: syz [ 241.738332][ T27] usb 2-1: config 0 descriptor?? [ 242.200109][T10072] FAULT_INJECTION: forcing a failure. [ 242.200109][T10072] name failslab, interval 1, probability 0, space 0, times 0 [ 242.214011][T10072] CPU: 0 PID: 10072 Comm: syz.4.1416 Not tainted syzkaller #0 [ 242.221526][T10072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 242.231621][T10072] Call Trace: [ 242.234970][T10072] [ 242.237928][T10072] dump_stack_lvl+0x18c/0x250 [ 242.242657][T10072] ? show_regs_print_info+0x20/0x20 [ 242.247905][T10072] ? load_image+0x420/0x420 [ 242.252450][T10072] ? __might_sleep+0xe0/0xe0 [ 242.257077][T10072] ? __lock_acquire+0x7d80/0x7d80 [ 242.262298][T10072] should_fail_ex+0x394/0x4c0 [ 242.267480][T10072] should_failslab+0x9/0x20 [ 242.272037][T10072] slab_pre_alloc_hook+0x59/0x300 [ 242.277091][T10072] ? __lock_acquire+0x7d80/0x7d80 [ 242.282129][T10072] ? security_prepare_creds+0x4b/0x130 [ 242.287649][T10072] ? security_prepare_creds+0x4b/0x130 [ 242.293132][T10072] __kmem_cache_alloc_node+0x53/0x250 [ 242.298532][T10072] ? security_prepare_creds+0x4b/0x130 [ 242.304031][T10072] __kmalloc+0xa7/0x240 [ 242.308215][T10072] security_prepare_creds+0x4b/0x130 [ 242.313532][T10072] prepare_creds+0x427/0x5d0 [ 242.318144][T10072] join_session_keyring+0x1b/0x440 [ 242.323268][T10072] lookup_user_key+0x4e6/0x1140 [ 242.328126][T10072] ? try_to_wake_up+0x6f5/0x10e0 [ 242.333099][T10072] ? lookup_user_key_possessed+0x40/0x40 [ 242.338738][T10072] ? search_process_keyrings_rcu+0x2b0/0x2b0 [ 242.344729][T10072] ? futex_wake_mark+0x150/0x150 [ 242.349706][T10072] keyctl_keyring_move+0x3d/0x110 [ 242.354749][T10072] __se_sys_keyctl+0x84a/0xb50 [ 242.359535][T10072] ? __x64_sys_keyctl+0xc0/0xc0 [ 242.364402][T10072] ? do_futex+0x35d/0x3e0 [ 242.368754][T10072] ? __ia32_sys_get_robust_list+0x110/0x110 [ 242.374667][T10072] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 242.380661][T10072] ? lock_chain_count+0x20/0x20 [ 242.385537][T10072] ? lockdep_hardirqs_on+0x98/0x150 [ 242.390745][T10072] ? __x64_sys_keyctl+0x20/0xc0 [ 242.395615][T10072] do_syscall_64+0x55/0xb0 [ 242.400041][T10072] ? clear_bhb_loop+0x40/0x90 [ 242.404739][T10072] ? clear_bhb_loop+0x40/0x90 [ 242.409428][T10072] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 242.415326][T10072] RIP: 0033:0x7ff1abf9e159 [ 242.420096][T10072] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 242.439720][T10072] RSP: 002b:00007ff1acd9d028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 242.448146][T10072] RAX: ffffffffffffffda RBX: 00007ff1ac225fa0 RCX: 00007ff1abf9e159 [ 242.456155][T10072] RDX: 0000000000000000 RSI: fffffffffffffffd RDI: 000000000000001e [ 242.464167][T10072] RBP: 00007ff1ac03506b R08: 0000000000000000 R09: 0000000000000000 [ 242.472148][T10072] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 242.480127][T10072] R13: 00007ff1ac226038 R14: 00007ff1ac225fa0 R15: 00007ffeca777398 [ 242.488116][T10072] [ 242.612441][T10075] loop3: detected capacity change from 0 to 256 [ 242.664610][T10075] exFAT-fs (loop3): failed to load upcase table (idx : 0x00011a39, chksum : 0xd4e5c97b, utbl_chksum : 0xe619d30d) [ 242.713757][ T27] input: syz Pen as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:256C:006D.0011/input/input23 [ 242.776009][ T28] audit: type=1804 audit(1790866778.559:48): pid=10075 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.1417" name="/newroot/395/file0/bus" dev="loop3" ino=1048656 res=1 errno=0 [ 242.826512][T10075] exFAT-fs (loop3): error, invalid size(size(0) > aligned(9223372036854777344) [ 242.826512][T10075] [ 242.867330][T10081] loop4: detected capacity change from 0 to 1024 [ 242.867757][T10075] exFAT-fs (loop3): Filesystem has been set read-only [ 242.912512][T10081] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 242.930776][ T27] input: syz Pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:256C:006D.0011/input/input24 [ 242.961293][T10081] ext4 filesystem being mounted at /257/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 242.981858][ T27] input: syz Touch Strip as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:256C:006D.0011/input/input25 [ 243.011561][ T27] input: syz Dial as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:256C:006D.0011/input/input26 [ 243.084098][ T27] uclogic 0003:256C:006D.0011: input,hidraw0: USB HID v0.00 Keypad [syz] on usb-dummy_hcd.1-1/input0 [ 243.120298][T10081] EXT4-fs error (device loop4): ext4_map_blocks:720: inode #15: comm syz.4.1419: lblock 0 mapped to illegal pblock 0 (length 4) [ 243.144855][ T27] usb 2-1: USB disconnect, device number 17 [ 243.232270][T10081] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 4 with error 117 [ 243.266257][T10081] EXT4-fs (loop4): This should not happen!! Data will be lost [ 243.266257][T10081] [ 243.388958][T10086] fido_id[10086]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 243.543770][ T11] EXT4-fs error (device loop4): ext4_map_blocks:720: inode #15: block 4: comm kworker/u4:0: lblock 4 mapped to illegal pblock 4 (length 2) [ 243.569212][ T11] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 4 with max blocks 2 with error 117 [ 243.591817][ T11] EXT4-fs (loop4): This should not happen!! Data will be lost [ 243.591817][ T11] [ 243.611387][ T11] EXT4-fs error (device loop4): ext4_map_blocks:720: inode #15: block 8: comm kworker/u4:0: lblock 8 mapped to illegal pblock 8 (length 8) [ 243.644918][ T11] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 243.660193][ T11] EXT4-fs (loop4): This should not happen!! Data will be lost [ 243.660193][ T11] [ 243.689389][ T6177] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 243.911696][T10105] loop8: detected capacity change from 0 to 7 [ 243.916091][T10108] loop1: detected capacity change from 0 to 64 [ 243.941750][T10105] Dev loop8: unable to read RDB block 7 [ 243.958629][T10105] loop8: unable to read partition table [ 243.964544][T10105] loop8: partition table beyond EOD, truncated [ 243.973637][T10105] loop_reread_partitions: partition scan of loop8 (þè¢Ñâ·û) failed (rc=-5) [ 244.163879][T10108] hfs: keylen 1794 too large [ 244.176419][T10108] hfs: keylen 1794 too large [ 244.227494][T10116] hfs: keylen 1794 too large [ 244.331968][ T228] hfs: keylen 1794 too large [ 244.835099][T10113] loop4: detected capacity change from 0 to 40427 [ 244.874950][T10113] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 244.923169][T10113] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 245.027252][T10113] F2FS-fs (loop4): Found nat_bits in checkpoint [ 245.321826][T10123] loop1: detected capacity change from 0 to 131072 [ 245.338859][T10113] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 245.356277][T10123] F2FS-fs (loop1): invalid crc value [ 245.382891][T10113] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 245.395308][T10123] F2FS-fs (loop1): Found nat_bits in checkpoint [ 245.462044][T10123] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 245.663107][T10145] loop5: detected capacity change from 0 to 2048 [ 245.710619][T10145] loop5: p2 p3 < > p4 < p5 > [ 245.717792][T10145] loop5: partition table partially beyond EOD, truncated [ 245.748649][T10145] loop5: p2 start 53543428 is beyond EOD, truncated [ 245.755502][T10145] loop5: p3 start 4284289 is beyond EOD, truncated [ 245.791065][T10145] loop5: p5 start 53543428 is beyond EOD, truncated [ 246.387210][T10157] CacheFiles: Failed to register: -95 [ 246.395834][T10155] syzkaller1: entered promiscuous mode [ 246.407457][T10155] syzkaller1: entered allmulticast mode [ 246.715921][T10162] loop5: detected capacity change from 0 to 2048 [ 246.789163][T10162] Alternate GPT is invalid, using primary GPT. [ 246.795742][T10162] loop5: p1 p2 p3 [ 246.827610][T10162] loop5: partition table partially beyond EOD, truncated [ 247.373386][T10175] loop3: detected capacity change from 0 to 256 [ 247.438770][T10177] loop4: detected capacity change from 0 to 512 [ 247.536077][T10177] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 247.587285][T10177] ext4 filesystem being mounted at /261/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 247.664420][T10186] loop1: detected capacity change from 0 to 512 [ 247.722830][ T6177] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 247.741270][T10186] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 247.759252][T10186] ext4 filesystem being mounted at /357/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 247.889291][T10192] loop4: detected capacity change from 0 to 2048 [ 247.945438][T10192] Alternate GPT is invalid, using primary GPT. [ 247.961104][T10192] loop4: p1 p2 p3 [ 247.964909][T10192] loop4: partition table partially beyond EOD, truncated [ 247.977255][ T5769] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 248.390623][T10207] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 248.420499][T10207] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 249.326945][T10226] set_capacity_and_notify: 1 callbacks suppressed [ 249.326960][T10226] loop4: detected capacity change from 0 to 40427 [ 249.347832][ T5758] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 249.357141][T10226] F2FS-fs (loop4): invalid crc value [ 249.374564][T10226] F2FS-fs (loop4): Found nat_bits in checkpoint [ 249.388544][T10230] loop5: detected capacity change from 0 to 40427 [ 249.421060][T10230] F2FS-fs (loop5): Wrong segment_count / block_count (31 > 0) [ 249.431049][T10230] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 249.440866][T10230] F2FS-fs (loop5): invalid crc value [ 249.450196][T10230] F2FS-fs (loop5): Found nat_bits in checkpoint [ 249.478542][ T6044] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 249.541565][T10226] F2FS-fs (loop4): Start checkpoint disabled! [ 249.558615][T10230] F2FS-fs (loop5): Try to recover 2th superblock, ret: 0 [ 249.565998][T10230] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 249.595954][ T5758] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 249.625557][ T5758] usb 4-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice= 1.00 [ 249.646564][ T5758] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 249.654785][T10226] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 249.673835][ T5758] metro_usb 4-1:1.0: Metrologic USB to Serial converter detected [ 249.687878][ T6044] usb 2-1: Using ep0 maxpacket: 8 [ 249.701743][ T6044] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 249.704914][ T5758] usb 4-1: Metrologic USB to Serial converter now attached to ttyUSB0 [ 249.715340][ T6044] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 249.733023][ T6044] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 249.754961][T10230] syz.5.1472: attempt to access beyond end of device [ 249.754961][T10230] loop5: rw=2049, sector=40960, nr_sectors = 8 limit=40427 [ 249.763432][ T6044] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 249.783973][T10226] syz.4.1470: attempt to access beyond end of device [ 249.783973][T10226] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 249.804172][T10230] F2FS-fs (loop5): Remounting filesystem read-only [ 249.820852][T10226] syz.4.1470: attempt to access beyond end of device [ 249.820852][T10226] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 249.833765][ T6044] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 249.839456][T10230] syz.5.1472: attempt to access beyond end of device [ 249.839456][T10230] loop5: rw=2049, sector=41000, nr_sectors = 8 limit=40427 [ 249.893343][ T6044] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 249.927809][ T6044] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 249.936703][T10230] F2FS-fs (loop5): Remounting filesystem read-only [ 249.976739][ T5758] usb 4-1: USB disconnect, device number 16 [ 249.998413][ T5758] metro-usb ttyUSB0: Metrologic USB to Serial converter now disconnected from ttyUSB0 [ 250.028911][ T5758] metro_usb 4-1:1.0: device disconnected [ 250.071708][ T42] kworker/u4:2: attempt to access beyond end of device [ 250.071708][ T42] loop4: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 250.088317][ T42] F2FS-fs (loop4): Stopped filesystem due to reason: 3 [ 250.102631][ T42] F2FS-fs (loop4): Stopped filesystem due to reason: 3 [ 250.174033][ T6044] usb 2-1: usb_control_msg returned -32 [ 250.183195][ T6044] usbtmc 2-1:16.0: can't read capabilities [ 250.534862][T10244] loop5: detected capacity change from 0 to 4096 [ 250.569608][T10244] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 250.579371][T10244] EXT4-fs (loop5): Test dummy encryption mode enabled [ 250.618986][T10244] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 250.858092][T10244] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 250.996885][ T8938] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 251.362489][T10270] loop3: detected capacity change from 0 to 164 [ 251.714044][T10282] bond0: option mode: unable to set because the bond device is up [ 251.932329][T10289] loop3: detected capacity change from 0 to 8192 [ 252.131573][T10297] sctp: [Deprecated]: syz.3.1500 (pid 10297) Use of int in max_burst socket option deprecated. [ 252.131573][T10297] Use struct sctp_assoc_value instead [ 252.218983][ T23] usb 2-1: USB disconnect, device number 18 [ 252.643973][T10303] loop1: detected capacity change from 0 to 32768 [ 252.712578][T10303] syz.1.1502: attempt to access beyond end of device [ 252.712578][T10303] loop14: rw=0, sector=8, nr_sectors = 8 limit=0 [ 252.726690][T10303] lbmIODone: I/O error in JFS log [ 252.741277][T10303] *** Log Format Error ! *** [ 252.747280][T10303] lmLogInit: exit(-22) [ 252.760844][T10303] lmLogOpen: exit(-22) [ 252.806447][T10303] jfs_dirty_inode called on read-only volume [ 252.825274][T10303] Is remount racy? [ 252.840653][T10316] jfs_dirty_inode called on read-only volume [ 252.865671][T10318] loop4: detected capacity change from 0 to 2048 [ 252.872589][T10316] Is remount racy? [ 252.908780][T10316] jfs_dirty_inode called on read-only volume [ 252.909921][T10318] UDF-fs: error (device loop4): udf_process_sequence: Primary Volume Descriptor not found! [ 252.935293][T10316] Is remount racy? [ 252.970745][T10318] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 252.977914][T10316] jfs_dirty_inode called on read-only volume [ 253.008128][T10316] Is remount racy? [ 253.505454][T10330] loop3: detected capacity change from 0 to 256 [ 253.568547][T10330] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0x8dc06734, utbl_chksum : 0xe619d30d) [ 253.737909][ T23] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 253.937791][ T23] usb 2-1: Using ep0 maxpacket: 16 [ 253.946312][ T23] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 253.976666][ T23] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 253.992988][ T23] usb 2-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 254.002995][ T23] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 254.019956][ T23] usb 2-1: config 0 descriptor?? [ 254.261970][T10360] loop4: detected capacity change from 0 to 164 [ 254.330232][T10360] Unsupported NM flag settings (240) [ 254.343072][T10362] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1530'. [ 254.432064][T10362] bond1: option mode: invalid value (69) [ 254.460077][T10362] bond1 (unregistering): Released all slaves [ 254.482517][ T23] hid (null): report_id 0 is invalid [ 254.517023][ T23] hid (null): report_id 4252247276 is invalid [ 254.540020][ T23] hid (null): unknown global tag 0xe [ 254.545365][ T23] hid (null): global environment stack underflow [ 254.576046][ T23] hid (null): usage index exceeded [ 254.612477][T10371] loop3: detected capacity change from 0 to 512 [ 254.650584][ T23] usb 2-1: string descriptor 0 read error: -71 [ 254.683213][T10371] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a802c01c, mo2=0002] [ 254.698178][T10371] System zones: 0-2, 18-18, 34-35 [ 254.703778][ T23] usb 2-1: Max retries (5) exceeded reading string descriptor 200 [ 254.731238][ T23] letsketch: probe of 0003:6161:4D15.0012 failed with error -32 [ 254.759003][T10371] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 254.782769][T10371] ext4 filesystem being mounted at /436/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 254.789841][ T23] usb 2-1: USB disconnect, device number 19 [ 254.848971][ T5767] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 255.092487][T10369] loop4: detected capacity change from 0 to 40427 [ 255.104663][T10380] loop5: detected capacity change from 0 to 2048 [ 255.128015][T10369] F2FS-fs (loop4): build fault injection attr: rate: 14, type: 0x7ffff [ 255.153807][T10369] F2FS-fs (loop4): build fault injection attr: rate: 0, type: 0xe4 [ 255.166120][T10369] F2FS-fs (loop4): invalid crc value [ 255.183853][T10369] F2FS-fs (loop4): Found nat_bits in checkpoint [ 255.199809][T10380] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000900 r/w without journal. Quota mode: none. [ 255.264887][T10369] F2FS-fs (loop4): inject page alloc in f2fs_grab_cache_page of f2fs_ra_meta_pages+0x665/0x970 [ 255.315221][T10369] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 255.318656][T10380] EXT4-fs error (device loop5): ext4_validate_block_bitmap:439: comm syz.5.1537: bg 0: block 240: padding at end of block bitmap is not set [ 255.388304][T10380] EXT4-fs error (device loop5) in ext4_setattr:5695: error 28 [ 255.429918][T10369] F2FS-fs (loop4): inject alloc nid in f2fs_alloc_nid of f2fs_get_dnode_of_data+0x885/0x1a80 [ 255.454507][ T8938] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000900. [ 255.466081][T10369] F2FS-fs (loop4): inject alloc nid in f2fs_alloc_nid of f2fs_new_inode+0x10d/0x1030 [ 255.596193][ T6177] syz-executor: attempt to access beyond end of device [ 255.596193][ T6177] loop4: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 255.636862][ T6177] F2FS-fs (loop4): Stopped filesystem due to reason: 3 [ 255.657570][ T6177] F2FS-fs (loop4): Stopped filesystem due to reason: 3 [ 255.696896][ T5770] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 255.874486][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.880985][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.895266][ T5770] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 255.909255][ T5770] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.925666][ T5770] usb 2-1: config 0 descriptor?? [ 255.944547][ T5770] cp210x 2-1:0.0: cp210x converter detected [ 255.947474][T10395] loop3: detected capacity change from 0 to 32768 [ 256.054092][T10395] XFS (loop3): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 256.142013][T10413] loop5: detected capacity change from 0 to 64 [ 256.204934][T10395] XFS (loop3): Torn write (CRC failure) detected at log block 0x30. Truncating head block from 0x51. [ 256.247214][T10395] XFS (loop3): Starting recovery (logdev: internal) [ 256.298471][T10395] XFS (loop3): Ending recovery (logdev: internal) [ 256.386356][ T28] audit: type=1800 audit(1790866792.169:49): pid=10395 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1542" name="file1" dev="loop3" ino=4422 res=0 errno=0 [ 256.427985][ T5770] cp210x 2-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 256.453371][ T5770] cp210x 2-1:0.0: GPIO initialisation failed: -524 [ 256.493067][ T5770] usb 2-1: cp210x converter now attached to ttyUSB0 [ 256.533693][ T5767] XFS (loop3): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 256.708549][ T5770] usb 2-1: USB disconnect, device number 20 [ 256.728567][ T5770] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 256.751313][T10419] size and base must be multiples of 4 kiB [ 256.752172][ T5770] cp210x 2-1:0.0: device disconnected [ 256.759657][T10419] CPU: 1 PID: 10419 Comm: syz.4.1550 Not tainted syzkaller #0 [ 256.770179][T10419] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 256.780347][T10419] Call Trace: [ 256.783658][T10419] [ 256.786619][T10419] dump_stack_lvl+0x18c/0x250 [ 256.791331][T10419] ? show_regs_print_info+0x20/0x20 [ 256.796561][T10419] ? load_image+0x420/0x420 [ 256.801099][T10419] ? __might_fault+0xaa/0x120 [ 256.805780][T10419] ? __might_fault+0xc6/0x120 [ 256.810466][T10419] mtrr_add+0xd0/0x100 [ 256.814561][T10419] mtrr_ioctl+0xc96/0x13a0 [ 256.818981][T10419] ? mtrr_close+0x200/0x200 [ 256.823521][T10419] ? __fget_files+0x28/0x460 [ 256.828149][T10419] ? mtrr_close+0x200/0x200 [ 256.832653][T10419] proc_reg_unlocked_ioctl+0x1d2/0x2c0 [ 256.838125][T10419] ? proc_reg_poll+0x290/0x290 [ 256.842922][T10419] __se_sys_ioctl+0xfd/0x170 [ 256.847538][T10419] do_syscall_64+0x55/0xb0 [ 256.851958][T10419] ? clear_bhb_loop+0x40/0x90 [ 256.856640][T10419] ? clear_bhb_loop+0x40/0x90 [ 256.861324][T10419] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 256.867218][T10419] RIP: 0033:0x7ff1abf9e159 [ 256.871632][T10419] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 256.891276][T10419] RSP: 002b:00007ff1acd9d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 256.899718][T10419] RAX: ffffffffffffffda RBX: 00007ff1ac225fa0 RCX: 00007ff1abf9e159 [ 256.907700][T10419] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000003 [ 256.915672][T10419] RBP: 00007ff1ac03506b R08: 0000000000000000 R09: 0000000000000000 [ 256.923638][T10419] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 256.931619][T10419] R13: 00007ff1ac226038 R14: 00007ff1ac225fa0 R15: 00007ffeca777398 [ 256.939613][T10419] [ 257.441857][T10437] loop1: detected capacity change from 0 to 128 [ 257.481416][T10437] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 257.572427][T10437] ext4 filesystem being mounted at /366/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 257.631162][T10421] IPVS: You probably need to specify IP address on multicast interface. [ 257.651437][T10421] IPVS: Error connecting to the multicast addr [ 257.864339][ T5769] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 258.164289][T10454] loop4: detected capacity change from 0 to 256 [ 258.268064][ T28] audit: type=1800 audit(1790866794.049:50): pid=10454 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1563" name="file2" dev="loop4" ino=1048660 res=0 errno=0 [ 258.692329][T10458] loop5: detected capacity change from 0 to 4096 [ 258.731508][T10450] loop3: detected capacity change from 0 to 131072 [ 258.759869][T10450] F2FS-fs (loop3): invalid crc value [ 258.804844][T10450] F2FS-fs (loop3): Found nat_bits in checkpoint [ 258.811335][T10458] ntfs3: loop5: Failed to load $AttrDef (-2) [ 258.866588][T10450] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 258.952937][T10468] loop4: detected capacity change from 0 to 64 [ 259.069125][ T28] audit: type=1800 audit(1790866794.849:51): pid=10468 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1567" name="file1" dev="loop4" ino=22 res=0 errno=0 [ 259.583699][T10483] netlink: 52 bytes leftover after parsing attributes in process `syz.5.1575'. [ 260.604684][T10522] loop1: detected capacity change from 0 to 2048 [ 260.687285][T10522] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000900 r/w without journal. Quota mode: none. [ 260.737149][T10530] loop3: detected capacity change from 0 to 4096 [ 260.755018][T10530] EXT4-fs: Ignoring removed nobh option [ 260.778014][T10530] EXT4-fs: Ignoring removed bh option [ 260.807570][T10530] EXT4-fs (loop3): Test dummy encryption mode enabled [ 260.819855][T10522] EXT4-fs error (device loop1): ext4_validate_block_bitmap:439: comm syz.1.1587: bg 0: block 240: padding at end of block bitmap is not set [ 260.877494][T10522] EXT4-fs error (device loop1) in ext4_setattr:5695: error 28 [ 260.915498][T10530] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 261.028446][ T5769] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000900. [ 261.091824][T10524] loop4: detected capacity change from 0 to 32768 [ 261.158867][ T28] audit: type=1800 audit(1790866796.949:52): pid=10524 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1588" name="file1" dev="loop4" ino=4 res=0 errno=0 [ 261.217045][ T28] audit: type=1800 audit(1790866796.969:53): pid=10524 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1588" name="file1" dev="loop4" ino=4 res=0 errno=0 [ 261.249017][ T28] audit: type=1800 audit(1790866796.979:54): pid=10524 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1588" name="file1" dev="loop4" ino=4 res=0 errno=0 [ 261.255298][ T5767] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 262.228094][T10555] loop4: detected capacity change from 0 to 32768 [ 262.253018][T10555] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop4 scanned by syz.4.1595 (10555) [ 262.297934][T10555] BTRFS info (device loop4): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 262.318058][T10555] BTRFS info (device loop4): using sha256 (sha256-avx2) checksum algorithm [ 262.333636][T10555] BTRFS info (device loop4): using free space tree [ 262.347786][ T5778] Bluetooth: hci0: command 0x0406 tx timeout [ 262.354068][ T5780] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 262.422686][T10555] BTRFS info (device loop4): enabling ssd optimizations [ 262.451015][T10555] BTRFS info (device loop4): auto enabling async discard [ 262.503186][T10593] loop1: detected capacity change from 0 to 2048 [ 262.588580][ T28] audit: type=1800 audit(1790866798.369:55): pid=10555 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1595" name="file1" dev="loop4" ino=260 res=0 errno=0 [ 262.594447][T10593] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 262.889889][ T6177] BTRFS info (device loop4): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 263.031051][ T5769] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 263.445071][T10598] loop5: detected capacity change from 0 to 131072 [ 263.483446][T10598] F2FS-fs (loop5): invalid crc value [ 263.532232][T10598] F2FS-fs (loop5): Found nat_bits in checkpoint [ 263.611320][T10598] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 263.767471][T10598] F2FS-fs (loop5): lookup inode (7) has corrupted xattr [ 263.779765][ T28] audit: type=1800 audit(1790866799.569:56): pid=10598 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1604" name="file1" dev="loop5" ino=7 res=0 errno=0 [ 263.908621][ T8] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 264.107897][ T8] usb 4-1: Using ep0 maxpacket: 8 [ 264.124687][ T8] usb 4-1: unable to get BOS descriptor or descriptor too short [ 264.143017][ T8] usb 4-1: config 140 has an invalid descriptor of length 0, skipping remainder of the config [ 264.162115][ T8] usb 4-1: config 140 has 1 interface, different from the descriptor's value: 2 [ 264.180407][ T8] usb 4-1: New USB device found, idVendor=1039, idProduct=2101, bcdDevice=25.81 [ 264.202308][ T8] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.227024][ T8] usb 4-1: Product: syz [ 264.238035][ T8] usb 4-1: Manufacturer: syz [ 264.242808][ T8] usb 4-1: SerialNumber: syz [ 264.488943][ T8] usb 4-1: [ueagle-atm] ADSL device founded vid (0X1039) pid (0X2101) Rev (0X2581): Eagle I [ 264.667842][ T27] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 264.706301][T10635] nbd5: detected capacity change from 0 to 127 [ 264.739025][T10638] block nbd5: NBD_DISCONNECT [ 264.756574][T10638] block nbd5: Disconnected due to user request. [ 264.769696][T10638] block nbd5: shutting down sockets [ 264.776220][ T97] I/O error, dev nbd5, sector 2 op 0x0:(READ) flags 0x0 phys_seg 3 prio class 2 [ 264.788270][ T97] Buffer I/O error on dev nbd5, logical block 1, async page read [ 264.796166][ T97] Buffer I/O error on dev nbd5, logical block 2, async page read [ 264.804218][ T97] Buffer I/O error on dev nbd5, logical block 3, async page read [ 264.832544][ C1] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 264.841733][ C1] Buffer I/O error on dev nbd5, logical block 0, async page read [ 264.856313][ T97] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 264.865519][ T97] Buffer I/O error on dev nbd5, logical block 0, async page read [ 264.873593][ T97] Buffer I/O error on dev nbd5, logical block 1, async page read [ 264.881499][ T97] Buffer I/O error on dev nbd5, logical block 2, async page read [ 264.889398][ T97] Buffer I/O error on dev nbd5, logical block 3, async page read [ 264.900564][ T97] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 264.910261][ T97] Buffer I/O error on dev nbd5, logical block 0, async page read [ 264.918248][ T97] Buffer I/O error on dev nbd5, logical block 1, async page read [ 264.926647][ T97] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 264.936317][ T97] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 264.945859][ T97] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 264.955426][ T97] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 264.964911][ T97] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 264.974781][ T27] usb 2-1: Using ep0 maxpacket: 16 [ 264.980149][ T5782] ldm_validate_partition_table(): Disk read failed. [ 264.987577][ T97] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 264.998824][ T27] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 265.006855][ T27] usb 2-1: config 0 has no interface number 0 [ 265.013308][ T27] usb 2-1: config 0 interface 1 altsetting 3 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 265.024842][ T27] usb 2-1: config 0 interface 1 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 265.025096][ T5782] Dev nbd5: unable to read RDB block 0 [ 265.034777][ T27] usb 2-1: config 0 interface 1 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 265.053123][ T27] usb 2-1: config 0 interface 1 has no altsetting 0 [ 265.059860][ T27] usb 2-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.00 [ 265.069161][ T27] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.080703][ T27] usb 2-1: config 0 descriptor?? [ 265.089125][ T5782] nbd5: unable to read partition table [ 265.098884][ T27] usbhid 2-1:0.1: fixing wrong optional hid class descriptors count [ 265.123107][ T5782] ldm_validate_partition_table(): Disk read failed. [ 265.159363][ T5782] Dev nbd5: unable to read RDB block 0 [ 265.182782][ T5782] nbd5: unable to read partition table [ 265.211217][ T8] usb 4-1: reset high-speed USB device number 17 using dummy_hcd [ 265.259312][T10637] loop4: detected capacity change from 0 to 32768 [ 265.292266][T10637] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop4 scanned by syz.4.1620 (10637) [ 265.337830][T10637] BTRFS info (device loop4): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 265.365189][T10637] BTRFS info (device loop4): using sha256 (sha256-avx2) checksum algorithm [ 265.382053][T10637] BTRFS info (device loop4): setting nodatacow, compression disabled [ 265.400579][T10637] BTRFS info (device loop4): setting datasum, datacow enabled [ 265.418194][ T8] usb 4-1: unable to get BOS descriptor or descriptor too short [ 265.421899][T10637] BTRFS info (device loop4): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 265.447732][ T8] usb 4-1: device firmware changed [ 265.461796][T10637] BTRFS info (device loop4): force zstd compression, level 3 [ 265.467973][ T8] usb 4-1: [ueagle-atm] pre-firmware device, uploading firmware [ 265.487399][ T8] usb 4-1: [ueagle-atm] loading firmware ueagle-atm/eagleI.fw [ 265.497976][T10637] BTRFS info (device loop4): turning on sync discard [ 265.504378][ T8] usb 4-1: USB disconnect, device number 17 [ 265.521375][T10637] BTRFS warning (device loop4): excessive commit interval 43283 [ 265.532225][ T27] elan 0003:04F3:074D.0013: failed to start in urb: -90 [ 265.542794][T10637] BTRFS info (device loop4): enabling ssd optimizations [ 265.551888][ T5770] usb 4-1: Direct firmware load for ueagle-atm/eagleI.fw failed with error -2 [ 265.562473][T10637] BTRFS info (device loop4): using spread ssd allocation scheme [ 265.571581][T10637] BTRFS info (device loop4): not using ssd optimizations [ 265.581047][ T5770] usb 4-1: Falling back to sysfs fallback for: ueagle-atm/eagleI.fw [ 265.597852][T10637] BTRFS info (device loop4): not using spread ssd allocation scheme [ 265.616261][T10637] BTRFS info (device loop4): using free space tree [ 265.697504][T10663] hsr0: entered promiscuous mode [ 265.704990][T10663] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1625'. [ 265.715155][T10663] hsr_slave_0: left promiscuous mode [ 265.741298][T10663] hsr_slave_1: left promiscuous mode [ 265.810093][ T28] audit: type=1800 audit(1790866801.589:57): pid=10637 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1620" name="file1" dev="loop4" ino=260 res=0 errno=0 [ 265.895129][T10663] hsr0 (unregistering): left promiscuous mode [ 265.921733][T10637] BTRFS info (device loop4): balance: start -sconvert=raid0,usage=0..1342177280 [ 265.924617][ T27] elan 0003:04F3:074D.0013: Get report error for parm 6: -71 [ 266.002839][ T27] elan 0003:04F3:074D.0013: hidraw0: USB HID v0.00 Joystick [HID 04f3:074d] on usb-dummy_hcd.1-1/input1 [ 266.030043][T10637] BTRFS info (device loop4): relocating block group 1048576 flags system [ 266.045509][ T27] elan 0003:04F3:074D.0013: Input device is not registered [ 266.080244][ T27] elan: probe of 0003:04F3:074D.0013 failed with error -119 [ 266.117771][ T27] usb 2-1: USB disconnect, device number 21 [ 266.127301][T10637] BTRFS info (device loop4): balance: canceled [ 266.178612][T10669] loop3: detected capacity change from 0 to 1024 [ 266.219601][T10667] fido_id[10667]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 266.256222][T10669] hfsplus: invalid length 32517 has been corrected to 255 [ 266.327864][ T28] audit: type=1800 audit(1790866802.109:58): pid=10669 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1626" name="file1" dev="loop3" ino=20 res=0 errno=0 [ 266.382766][ T6177] BTRFS info (device loop4): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 266.511618][ T42] hfsplus: b-tree write err: -5, ino 20 [ 266.729306][T10673] FAULT_INJECTION: forcing a failure. [ 266.729306][T10673] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 266.731253][T10676] loop1: detected capacity change from 0 to 512 [ 266.770138][T10673] CPU: 0 PID: 10673 Comm: syz.3.1629 Not tainted syzkaller #0 [ 266.777694][T10673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 266.779037][T10676] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 266.787758][T10673] Call Trace: [ 266.787776][T10673] [ 266.787787][T10673] dump_stack_lvl+0x18c/0x250 [ 266.787820][T10673] ? show_regs_print_info+0x20/0x20 [ 266.787844][T10673] ? load_image+0x420/0x420 [ 266.787868][T10673] ? __lock_acquire+0x7d80/0x7d80 [ 266.825313][T10673] should_fail_ex+0x394/0x4c0 [ 266.830032][T10673] prepare_alloc_pages+0x1e1/0x5b0 [ 266.835193][T10673] __alloc_pages+0x134/0x460 [ 266.839810][T10673] ? zone_statistics+0x170/0x170 [ 266.844789][T10673] ? alloc_pages+0x4e1/0x740 [ 266.849422][T10673] __get_free_pages+0xc/0x30 [ 266.854079][T10673] kasan_populate_vmalloc_pte+0x35/0x100 [ 266.859757][T10673] __apply_to_page_range+0x860/0xdd0 [ 266.865428][T10673] ? kasan_populate_vmalloc+0x70/0x70 [ 266.870831][T10673] ? apply_to_page_range+0x50/0x50 [ 266.875963][T10673] ? do_raw_spin_unlock+0x121/0x230 [ 266.881197][T10673] alloc_vmap_area+0x1d26/0x1e50 [ 266.886189][T10673] ? vm_map_ram+0xcf0/0xcf0 [ 266.890717][T10673] ? rcu_is_watching+0x15/0xb0 [ 266.895512][T10673] __get_vm_area_node+0x162/0x370 [ 266.900569][T10673] __vmalloc_node_range+0x36f/0x1320 [ 266.905885][T10673] ? dev_map_alloc+0x1f6/0x4c0 [ 266.910691][T10673] ? free_vm_area+0x50/0x50 [ 266.915230][T10673] ? rcu_is_watching+0x15/0xb0 [ 266.920022][T10673] ? bpf_map_area_alloc+0x5e/0x110 [ 266.925162][T10673] bpf_map_area_alloc+0xf1/0x110 [ 266.931092][T10673] ? dev_map_alloc+0x1f6/0x4c0 [ 266.936306][T10673] dev_map_alloc+0x1f6/0x4c0 [ 266.940905][T10673] map_create+0x877/0x12f0 [ 266.945334][T10673] __sys_bpf+0x651/0x890 [ 266.949590][T10673] ? bpf_link_show_fdinfo+0x560/0x560 [ 266.954980][T10673] ? lock_chain_count+0x20/0x20 [ 266.959841][T10673] __x64_sys_bpf+0x7c/0x90 [ 266.964256][T10673] do_syscall_64+0x55/0xb0 [ 266.968943][T10673] ? clear_bhb_loop+0x40/0x90 [ 266.973664][T10673] ? clear_bhb_loop+0x40/0x90 [ 266.978352][T10673] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 266.984256][T10673] RIP: 0033:0x7f312ed9e159 [ 266.988676][T10673] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 267.008286][T10673] RSP: 002b:00007f312fbe1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 267.016705][T10673] RAX: ffffffffffffffda RBX: 00007f312f025fa0 RCX: 00007f312ed9e159 [ 267.024679][T10673] RDX: 0000000000000048 RSI: 0000200000000540 RDI: 0000000000000000 [ 267.032650][T10673] RBP: 00007f312ee3506b R08: 0000000000000000 R09: 0000000000000000 [ 267.040627][T10673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 267.048600][T10673] R13: 00007f312f026038 R14: 00007f312f025fa0 R15: 00007fff9ec67fb8 [ 267.056591][T10673] [ 267.973135][T10698] loop3: detected capacity change from 0 to 8192 [ 268.005755][T10698] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 268.021359][T10698] REISERFS (device loop3): found reiserfs format "3.6" with non-standard journal [ 268.031511][T10698] REISERFS (device loop3): using ordered data mode [ 268.041429][T10698] reiserfs: using flush barriers [ 268.054813][T10698] REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 268.078635][T10698] REISERFS (device loop3): checking transaction log (loop3) [ 268.316445][T10698] REISERFS (device loop3): Using tea hash to sort names [ 268.342232][T10698] REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage. [ 268.687377][T10715] serio: Serial port ttynull [ 269.088086][T10736] input: syz0 as /devices/virtual/input/input28 [ 269.244673][T10738] loop4: detected capacity change from 0 to 512 [ 269.259523][T10738] EXT4-fs: Ignoring removed bh option [ 269.302811][T10738] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 269.326654][T10738] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 269.978044][ T23] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 270.021072][T10765] loop5: detected capacity change from 0 to 6 [ 270.058041][T10765] Dev loop5: unable to read RDB block 6 [ 270.079894][T10765] loop5: unable to read partition table [ 270.117533][T10765] loop5: partition table beyond EOD, truncated [ 270.135326][T10765] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 270.163325][T10769] loop3: detected capacity change from 0 to 256 [ 270.177968][ T23] usb 6-1: Using ep0 maxpacket: 8 [ 270.206205][ T23] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 270.242308][ T23] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 270.277776][ T23] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.313676][ T23] usb 6-1: config 0 descriptor?? [ 270.574925][ T23] iowarrior 6-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 270.812463][T10779] netlink: 'syz.3.1674': attribute type 11 has an invalid length. [ 270.848760][T10779] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1674'. [ 270.992035][T10785] sctp: [Deprecated]: syz.3.1677 (pid 10785) Use of int in max_burst socket option deprecated. [ 270.992035][T10785] Use struct sctp_assoc_value instead [ 271.297769][ T790] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 271.408565][ T5758] usb 6-1: USB disconnect, device number 4 [ 271.487810][ T790] usb 5-1: Using ep0 maxpacket: 16 [ 271.506247][ T790] usb 5-1: config index 0 descriptor too short (expected 16456, got 72) [ 271.526101][ T790] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 271.534446][ T790] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 271.558163][ T790] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 271.566393][ T790] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 271.587717][ T790] usb 5-1: config 0 has no interface number 0 [ 271.593885][ T790] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 271.617741][ T790] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 271.627610][ T790] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 271.648550][ T790] usb 5-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 271.667738][ T790] usb 5-1: config 0 interface 125 has no altsetting 0 [ 271.674559][ T790] usb 5-1: config 0 interface 125 has no altsetting 2 [ 271.695816][ T790] usb 5-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 271.705746][ T790] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.717881][ T790] usb 5-1: Product: syz [ 271.722088][ T790] usb 5-1: Manufacturer: syz [ 271.726802][ T790] usb 5-1: SerialNumber: syz [ 271.748731][ T790] usb 5-1: config 0 descriptor?? [ 271.756673][ T790] usb 5-1: selecting invalid altsetting 2 [ 271.997790][ T5758] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 272.193201][ T5758] usb 6-1: config index 0 descriptor too short (expected 45, got 36) [ 272.201482][ T5758] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 272.213744][ T5758] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 272.231338][ T5758] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 272.245890][ T5758] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 272.260120][ T5758] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.272107][ T5758] usb 6-1: config 0 descriptor?? [ 272.593469][ T790] parport0: fix this legacy no-device port driver! [ 272.730725][ T5758] plantronics 0003:047F:FFFF.0014: No inputs registered, leaving [ 272.758072][ T5758] plantronics 0003:047F:FFFF.0014: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 272.820862][ T5758] usb 5-1: USB disconnect, device number 23 [ 273.021439][ T23] usb 6-1: USB disconnect, device number 5 [ 273.400347][ T5758] IPVS: starting estimator thread 0... [ 273.507821][T10838] IPVS: using max 23 ests per chain, 55200 per kthread [ 273.641777][T10847] loop3: detected capacity change from 0 to 4096 [ 273.764283][T10853] loop5: detected capacity change from 0 to 4096 [ 273.844528][ T28] audit: type=1800 audit(1790866809.629:59): pid=10847 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1705" name="file1" dev="loop3" ino=33 res=0 errno=0 [ 274.557884][ T790] IPVS: starting estimator thread 0... [ 274.647816][T10869] IPVS: using max 22 ests per chain, 52800 per kthread [ 275.326598][T10894] loop5: detected capacity change from 0 to 2048 [ 275.362896][T10894] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 275.413595][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88802506c400: rx timeout, send abort [ 275.427013][ C0] vxcan1: j1939_xtp_rx_abort_one: 0xffff88802506c400: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 275.623528][T10894] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 276.068011][T10912] capability: warning: `syz.5.1731' uses deprecated v2 capabilities in a way that may be insecure [ 276.276692][T10904] loop3: detected capacity change from 0 to 40427 [ 276.311276][T10904] F2FS-fs (loop3): Insane cp_payload (553648128 >= 504) [ 276.343061][T10904] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 276.366146][T10904] F2FS-fs (loop3): invalid crc value [ 276.390608][T10904] F2FS-fs (loop3): Ignore s_resuid=0, s_resgid=65535 w/o reserve_root [ 276.448253][T10904] F2FS-fs (loop3): Found nat_bits in checkpoint [ 276.635044][T10904] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 276.658785][T10904] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 276.888468][T10938] device-mapper: ioctl: Invalid ioctl structure: name t, dev f802 [ 276.967074][ T5767] syz-executor: attempt to access beyond end of device [ 276.967074][ T5767] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 276.986551][ T5767] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 277.069767][T10946] loop5: detected capacity change from 0 to 8192 [ 277.107172][T10946] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 277.174740][T10946] REISERFS (device loop5): found reiserfs format "3.6" with non-standard journal [ 277.217996][T10946] REISERFS (device loop5): using ordered data mode [ 277.224591][T10946] reiserfs: using flush barriers [ 277.260090][T10946] REISERFS (device loop5): journal params: device loop5, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 277.333900][T10946] REISERFS (device loop5): checking transaction log (loop5) [ 277.627966][T10946] REISERFS (device loop5): Using tea hash to sort names [ 277.635529][T10946] REISERFS (device loop5): Created .reiserfs_priv - reserved for xattr storage. [ 277.767012][T10955] erspan0: entered promiscuous mode [ 277.972616][T10953] loop1: detected capacity change from 0 to 32768 [ 278.056846][T10953] XFS (loop1): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 278.188146][T10953] XFS (loop1): Ending clean mount [ 278.424516][ T5769] XFS (loop1): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 278.719484][T10990] nvme nvme0: failed to connect socket: -101 [ 279.001470][T10995] loop3: detected capacity change from 0 to 32768 [ 279.027110][T10995] XFS (loop3): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 279.055537][T10995] XFS (loop3): Ending clean mount [ 279.237376][ T5767] XFS (loop3): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 279.247475][T11009] loop5: detected capacity change from 0 to 256 [ 279.264587][T11009] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 279.362516][T11009] FAT-fs (loop5): Directory bread(block 64) failed [ 279.385554][T11009] FAT-fs (loop5): Directory bread(block 65) failed [ 279.396757][T11009] FAT-fs (loop5): Directory bread(block 66) failed [ 279.427761][T11009] FAT-fs (loop5): Directory bread(block 67) failed [ 279.434753][T11009] FAT-fs (loop5): Directory bread(block 68) failed [ 279.471270][T11009] FAT-fs (loop5): Directory bread(block 69) failed [ 279.488681][T11009] FAT-fs (loop5): Directory bread(block 70) failed [ 279.495280][T11009] FAT-fs (loop5): Directory bread(block 71) failed [ 279.546356][T11009] FAT-fs (loop5): Directory bread(block 72) failed [ 279.577824][T11009] FAT-fs (loop5): Directory bread(block 73) failed [ 280.132440][T11024] loop5: detected capacity change from 0 to 256 [ 280.156718][T11024] exfat: Unknown parameter '01777777777777777777777' [ 280.225598][ T5782] blk_print_req_error: 42 callbacks suppressed [ 280.225615][ T5782] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 280.439203][ T27] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 280.518377][T11039] syzkaller1: entered promiscuous mode [ 280.524079][T11039] syzkaller1: entered allmulticast mode [ 280.628545][T11046] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1781'. [ 280.639587][ T27] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 280.653836][ T27] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 280.670209][T11046] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1781'. [ 280.681487][ T27] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 280.691627][T11046] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1781'. [ 280.704776][ T27] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 280.725410][ T27] usb 5-1: config 0 descriptor?? [ 280.953112][ T27] usbhid 5-1:0.0: can't add hid device: -71 [ 280.966861][ T27] usbhid: probe of 5-1:0.0 failed with error -71 [ 280.982539][ T27] usb 5-1: USB disconnect, device number 24 [ 281.041840][T11059] loop3: detected capacity change from 0 to 256 [ 281.079970][T11059] exFAT-fs (loop3): failed to load upcase table (idx : 0x00011a39, chksum : 0xd7c18d7b, utbl_chksum : 0xe619d30d) [ 281.519179][T11071] mkiss: ax0: crc mode is auto. [ 281.547788][ T27] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 281.737787][ T27] usb 5-1: Using ep0 maxpacket: 16 [ 281.758283][ T27] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 281.770664][ T27] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 281.797806][ T27] usb 5-1: New USB device found, idVendor=04d8, idProduct=00df, bcdDevice= 0.40 [ 281.816110][ T27] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 281.843999][ T27] usb 5-1: config 0 descriptor?? [ 282.303201][ T27] mcp2200 0003:04D8:00DF.0015: item fetching failed at offset 0/1 [ 282.328446][ T27] mcp2200 0003:04D8:00DF.0015: can't parse reports [ 282.335157][ T27] mcp2200: probe of 0003:04D8:00DF.0015 failed with error -22 [ 282.476055][T11087] loop3: detected capacity change from 0 to 40427 [ 282.527962][T11087] F2FS-fs (loop3): Corrupted extension count (64 + 1 > 64) [ 282.537484][T11087] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 282.567495][T11087] F2FS-fs (loop3): Image doesn't support compression [ 282.577756][T11087] F2FS-fs (loop3): Image doesn't support compression [ 282.603303][ T5758] usb 5-1: USB disconnect, device number 25 [ 282.623568][T11087] F2FS-fs (loop3): invalid crc value [ 282.786623][T11095] loop5: detected capacity change from 0 to 32768 [ 282.799348][T11087] F2FS-fs (loop3): Start checkpoint disabled! [ 282.847294][T11087] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 282.854850][T11095] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 282.866696][T11087] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 282.931596][T11087] F2FS-fs (loop3): Inconsistent segment (8) type [1, 0] in SIT and SSA [ 282.956242][T11087] F2FS-fs (loop3): Stopped filesystem due to reason: 4 [ 283.122021][ T8938] ocfs2: Unmounting device (7,5) on (node local) [ 283.139872][T11101] loop1: detected capacity change from 0 to 2048 [ 283.216836][T11101] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 283.908141][T11127] loop4: detected capacity change from 0 to 1024 [ 283.936504][T11127] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-001000000000 r/w without journal. Quota mode: writeback. [ 284.115803][ T6177] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-001000000000. [ 284.315449][ T27] libceph: mon0 (1)127.0.0.1:20000 socket error on write [ 284.332432][T11146] ceph: No mds server is up or the cluster is laggy [ 284.343199][ T27] libceph: mon0 (1)127.0.0.1:20000 socket error on write [ 284.408164][T11151] syzkaller1: entered promiscuous mode [ 284.414970][T11151] syzkaller1: entered allmulticast mode [ 284.514161][T11153] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 284.710493][T11162] loop5: detected capacity change from 0 to 512 [ 284.744006][T11162] EXT4-fs error (device loop5): ext4_iget_extra_inode:4752: inode #15: comm syz.5.1831: corrupted in-inode xattr: bad e_name length [ 284.812687][T11162] EXT4-fs error (device loop5): ext4_orphan_get:1413: comm syz.5.1831: couldn't read orphan inode 15 (err -117) [ 284.853387][T11162] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 284.926936][ T790] libceph: mon0 (1)127.0.0.1:20000 socket error on write [ 284.939995][T11168] loop3: detected capacity change from 0 to 4096 [ 284.981811][ T8938] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 285.140443][ T3439] tipc: Subscription rejected, illegal request [ 285.215189][ T790] libceph: mon0 (1)127.0.0.1:20000 socket error on write [ 285.746002][T11172] ceph: No mds server is up or the cluster is laggy [ 285.756717][ T790] libceph: mon0 (1)127.0.0.1:20000 socket error on write [ 285.906254][T11201] loop4: detected capacity change from 0 to 2048 [ 285.934699][T11201] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 285.948140][ T6044] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 286.132933][ T6044] usb 2-1: Using ep0 maxpacket: 32 [ 286.141401][ T6044] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 286.154061][ T6044] usb 2-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 286.167464][ T6044] usb 2-1: config 0 interface 0 has no altsetting 0 [ 286.174621][ T6044] usb 2-1: New USB device found, idVendor=044e, idProduct=120b, bcdDevice= 0.00 [ 286.185005][ T6044] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 286.214811][ T6044] usb 2-1: config 0 descriptor?? [ 286.806753][T11209] syzkaller1: entered promiscuous mode [ 286.812582][T11209] syzkaller1: entered allmulticast mode [ 286.989459][T11212] loop4: detected capacity change from 0 to 256 [ 287.239975][ T6044] hid-alps 0003:044E:120B.0016: failed to read command (-71) [ 287.240102][ T6044] hid-alps 0003:044E:120B.0016: failed to change TP mode (-71) [ 287.253372][ T6044] hid-alps 0003:044E:120B.0016: hidraw0: USB HID v80.00 Joystick [HID 044e:120b] on usb-dummy_hcd.1-1/input0 [ 287.281127][ T6044] usb 2-1: USB disconnect, device number 22 [ 287.361769][T11217] fido_id[11217]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 287.704414][T11231] loop4: detected capacity change from 0 to 4096 [ 287.723340][T11231] ntfs: (device loop4): parse_options(): Option utf8 is no longer supported, using option nls=utf8. Please use option nls=utf8 in the future and make sure utf8 is compiled either as a module or into the kernel. [ 287.765320][T11231] ntfs: (device loop4): read_ntfs_boot_sector(): Hot-fix: Recovering invalid primary boot sector from backup copy. [ 287.768959][T11233] netdevsim netdevsim5: Direct firmware load for .® failed with error -2 [ 287.790441][T11233] netdevsim netdevsim5: Falling back to sysfs fallback for: .® [ 287.812697][T11231] ntfs: (device loop4): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 287.841008][T11231] ntfs: (device loop4): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x0, offset 0x0 because its location on disk could not be determined even after retrying (error code -5). [ 287.880159][T11231] ntfs: (device loop4): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 287.895366][T11231] ntfs: (device loop4): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x0, offset 0x200 because its location on disk could not be determined even after retrying (error code -5). [ 287.916039][T11231] ntfs: (device loop4): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 287.927493][T11231] ntfs: (device loop4): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x1, offset 0x0 because its location on disk could not be determined even after retrying (error code -5). [ 287.949189][T11231] ntfs: (device loop4): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 287.958873][T11231] ntfs: (device loop4): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x1, offset 0x200 because its location on disk could not be determined even after retrying (error code -5). [ 287.985560][T11231] ntfs: volume version 3.1. [ 288.118260][ T790] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 288.328119][ T790] usb 2-1: Using ep0 maxpacket: 8 [ 288.341868][ T790] usb 2-1: config index 0 descriptor too short (expected 292, got 36) [ 288.351419][ T790] usb 2-1: config 0 has an invalid interface number: 65 but max is -1 [ 288.365433][ T790] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 288.376270][ T790] usb 2-1: config 0 has no interface number 0 [ 288.388001][ T790] usb 2-1: config 0 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 288.400983][ T790] usb 2-1: config 0 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 288.426864][ T790] usb 2-1: config 0 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 288.447853][ T790] usb 2-1: config 0 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 288.460107][ T790] usb 2-1: config 0 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 288.473889][ T790] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=7c.eb [ 288.494649][T11243] loop4: detected capacity change from 0 to 4096 [ 288.496206][ T790] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 288.530961][T11243] ntfs3: loop4: ino=3, mi_enum_attr [ 288.532530][ T790] usb 2-1: config 0 descriptor?? [ 288.564904][T11236] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 288.591951][ T790] hub 2-1:0.65: bad descriptor, ignoring hub [ 288.607833][ T790] hub: probe of 2-1:0.65 failed with error -5 [ 288.654351][T11234] syz.5.1862 (11234) used greatest stack depth: 17896 bytes left [ 288.952921][T11251] loop4: detected capacity change from 0 to 512 [ 289.068899][T11251] EXT4-fs error (device loop4): ext4_orphan_get:1434: comm syz.4.1869: bad orphan inode 11862016 [ 289.105893][ T23] usb 2-1: USB disconnect, device number 23 [ 289.105965][ C0] xpad 2-1:0.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 289.121684][ C0] xpad 2-1:0.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 289.133130][T11251] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000d40000 r/w without journal. Quota mode: writeback. [ 289.175378][T11251] ext4 filesystem being mounted at /362/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 289.352308][ T6177] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000d40000. [ 290.104590][T11299] loop5: detected capacity change from 0 to 128 [ 290.124222][T11299] EXT4-fs (loop5): mounting ext2 file system using the ext4 subsystem [ 290.148794][T11299] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 290.182144][T11299] ext2 filesystem being mounted at /226/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 290.244819][T11299] EXT4-fs error (device loop5): ext4_append:79: inode #2: comm syz.5.1881: Logical block already allocated [ 290.275754][T11299] EXT4-fs (loop5): Remounting filesystem read-only [ 290.321749][ T8938] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 290.491401][T11303] loop4: detected capacity change from 0 to 32768 [ 291.128151][T11316] loop5: detected capacity change from 0 to 128 [ 291.578969][T11332] loop4: detected capacity change from 0 to 128 [ 291.597089][T11332] EXT4-fs (loop4): Test dummy encryption mode enabled [ 291.613806][T11332] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 291.630589][T11334] netlink: 'syz.5.1898': attribute type 6 has an invalid length. [ 291.642116][T11332] ext4 filesystem being mounted at /369/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 291.732767][T11337] loop5: detected capacity change from 0 to 4096 [ 291.760182][T11337] ntfs3: loop5: ino=3, mi_enum_attr [ 291.778829][ T6177] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 291.790774][ T27] usb 2-1: new full-speed USB device number 24 using dummy_hcd [ 291.979509][ T27] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 292.007696][ T27] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 292.030388][ T27] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 292.047292][ T27] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 292.070291][ T27] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.102080][ T27] usb 2-1: config 0 descriptor?? [ 292.548208][ T27] plantronics 0003:047F:FFFF.0017: No inputs registered, leaving [ 292.575416][ T27] plantronics 0003:047F:FFFF.0017: hiddev0,hidraw0: USB HID v0.00 Joystick [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 292.576299][T11355] loop5: detected capacity change from 0 to 128 [ 292.658983][T11355] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 292.693869][T11355] ext4 filesystem being mounted at /234/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 292.832627][ T8938] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 293.183944][T11367] loop5: detected capacity change from 0 to 256 [ 293.192681][T11367] FAT-fs (loop5): Unrecognized mount option "ÿÿÿÿÿÿÿÿ0xffffffffffffffffÿÿ" or missing value [ 293.422909][T11371] FAULT_INJECTION: forcing a failure. [ 293.422909][T11371] name failslab, interval 1, probability 0, space 0, times 0 [ 293.447700][T11371] CPU: 0 PID: 11371 Comm: syz.3.1910 Not tainted syzkaller #0 [ 293.455216][T11371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 293.465285][T11371] Call Trace: [ 293.468592][T11371] [ 293.471558][T11371] dump_stack_lvl+0x18c/0x250 [ 293.476293][T11371] ? show_regs_print_info+0x20/0x20 [ 293.481517][T11371] ? load_image+0x420/0x420 [ 293.486039][T11371] ? __might_sleep+0xe0/0xe0 [ 293.490646][T11371] ? __lock_acquire+0x7d80/0x7d80 [ 293.495683][T11371] should_fail_ex+0x394/0x4c0 [ 293.500377][T11371] should_failslab+0x9/0x20 [ 293.504893][T11371] slab_pre_alloc_hook+0x59/0x300 [ 293.509933][T11371] ? newseg+0x235/0xb10 [ 293.514095][T11371] __kmem_cache_alloc_node+0x53/0x250 [ 293.519486][T11371] ? newseg+0x235/0xb10 [ 293.523646][T11371] kmalloc_trace+0x2a/0xe0 [ 293.528078][T11371] newseg+0x235/0xb10 [ 293.532079][T11371] ? ksys_shmget+0x140/0x140 [ 293.536673][T11371] ? file_end_write+0x159/0x250 [ 293.541543][T11371] ipcget+0x1d1/0xe10 [ 293.545558][T11371] ? do_futex+0x2ff/0x3e0 [ 293.549902][T11371] ? __ia32_sys_get_robust_list+0x110/0x110 [ 293.555813][T11371] ? ipc_obtain_object_check+0x1a0/0x1a0 [ 293.561467][T11371] __x64_sys_shmget+0x141/0x180 [ 293.566320][T11371] ? lock_chain_count+0x20/0x20 [ 293.571613][T11371] ? shm_more_checks+0x80/0x80 [ 293.576385][T11371] ? lockdep_hardirqs_on+0x98/0x150 [ 293.581599][T11371] do_syscall_64+0x55/0xb0 [ 293.586028][T11371] ? clear_bhb_loop+0x40/0x90 [ 293.590713][T11371] ? clear_bhb_loop+0x40/0x90 [ 293.595426][T11371] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 293.601348][T11371] RIP: 0033:0x7f312ed9e159 [ 293.605774][T11371] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 293.625412][T11371] RSP: 002b:00007f312fbe1028 EFLAGS: 00000246 ORIG_RAX: 000000000000001d [ 293.633843][T11371] RAX: ffffffffffffffda RBX: 00007f312f025fa0 RCX: 00007f312ed9e159 [ 293.641824][T11371] RDX: 0000000000000800 RSI: 0000000000002000 RDI: 0000000000000000 [ 293.649802][T11371] RBP: 00007f312ee3506b R08: 0000000000000000 R09: 0000000000000000 [ 293.658722][T11371] R10: 0000200000fc2000 R11: 0000000000000246 R12: 0000000000000000 [ 293.666711][T11371] R13: 00007f312f026038 R14: 00007f312f025fa0 R15: 00007fff9ec67fb8 [ 293.674732][T11371] [ 293.698284][ T5778] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 293.711739][ T5778] Bluetooth: hci2: Injecting HCI hardware error event [ 293.724131][ T5773] Bluetooth: hci2: hardware error 0x00 [ 293.933489][T11373] loop5: detected capacity change from 0 to 32768 [ 293.959681][T11373] JBD2: Ignoring recovery information on journal [ 294.017980][T11373] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 294.224495][T11375] loop3: detected capacity change from 0 to 32768 [ 294.258348][ T8938] ocfs2: Unmounting device (7,5) on (node local) [ 294.367950][T11375] XFS (loop3): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 294.493978][T11375] XFS (loop3): Ending clean mount [ 294.593542][T11393] loop1: detected capacity change from 0 to 512 [ 294.648353][T11393] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 294.669046][T11393] ext4 filesystem being mounted at /454/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 294.688322][T11393] EXT4-fs warning (device loop1): verify_group_input:169: Last group not full [ 294.704464][T11283] usb 2-1: USB disconnect, device number 24 [ 294.743823][ T5769] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 294.949775][ T5767] XFS (loop3): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 295.387921][ T5778] Bluetooth: hci4: command 0xfc11 tx timeout [ 295.397550][ T5780] Bluetooth: hci4: Entering manufacturer mode failed (-110) [ 295.442278][T11413] netlink: 165 bytes leftover after parsing attributes in process `syz.5.1924'. [ 295.565357][T11419] loop3: detected capacity change from 0 to 128 [ 295.584152][T11419] EXT4-fs (loop3): mounting ext2 file system using the ext4 subsystem [ 295.622535][T11419] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 295.644865][T11419] ext2 filesystem being mounted at /520/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 295.706354][T11419] EXT4-fs error (device loop3): ext4_append:79: inode #2: comm syz.3.1926: Logical block already allocated [ 295.738551][T11419] EXT4-fs (loop3): Remounting filesystem read-only [ 295.788648][ T5773] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 295.788949][ T5767] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 296.394601][T11441] loop1: detected capacity change from 0 to 32768 [ 296.396423][T11436] loop3: detected capacity change from 0 to 40427 [ 296.413766][T11436] F2FS-fs (loop3): Wrong secs_per_zone / total_sections (262145, 24) [ 296.427905][T11283] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 296.430074][T11436] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 296.454466][T11436] F2FS-fs (loop3): invalid crc value [ 296.464797][T11436] F2FS-fs (loop3): invalid crc value [ 296.472763][T11441] JBD2: Ignoring recovery information on journal [ 296.480599][T11436] F2FS-fs (loop3): Failed to get valid F2FS checkpoint [ 296.498127][ T5921] usb 6-1: new full-speed USB device number 6 using dummy_hcd [ 296.592003][T11441] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 296.624270][T11283] usb 5-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 296.660055][T11283] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 296.671051][T11283] usb 5-1: Product: syz [ 296.675262][T11283] usb 5-1: Manufacturer: syz [ 296.681205][T11283] usb 5-1: SerialNumber: syz [ 296.720752][ T5921] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 296.746969][ T5921] usb 6-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 296.768417][ T5921] usb 6-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 296.776966][ T5921] usb 6-1: Product: syz [ 296.797717][ T5921] usb 6-1: Manufacturer: syz [ 296.802379][ T5921] usb 6-1: SerialNumber: syz [ 296.839891][ T5921] usb 6-1: config 0 descriptor?? [ 296.859231][ T5921] keyspan 6-1:0.0: Keyspan 4 port adapter converter detected [ 296.866915][ T5921] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 81 [ 296.917774][ T5921] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 88 [ 296.943384][ T5921] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 1 [ 296.943644][ T5769] ocfs2: Unmounting device (7,1) on (node local) [ 296.959639][ T5921] usb 6-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 296.982408][ T5921] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 2 [ 296.997417][ T5921] usb 6-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 297.008114][ T5921] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 4 [ 297.048272][ T5921] usb 6-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 297.078726][ T5921] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 6 [ 297.107016][ T5921] usb 6-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 297.310888][T11283] (unnamed net_device) (uninitialized): Assigned a random MAC address: a2:06:32:38:35:11 [ 297.362107][T11283] rtl8150 5-1:1.0: eth9: rtl8150 is detected [ 297.417822][T11283] usb 5-1: USB disconnect, device number 26 [ 297.443514][T11282] usb 6-1: USB disconnect, device number 6 [ 297.476009][T11282] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 297.514918][T11282] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 297.548052][T11282] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 297.590587][T11282] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 297.601803][T11282] keyspan 6-1:0.0: device disconnected [ 298.464443][T11472] loop3: detected capacity change from 0 to 40427 [ 298.496535][T11472] F2FS-fs (loop3): Invalid SB checksum offset: 0 [ 298.503343][T11472] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 298.513725][T11472] F2FS-fs (loop3): invalid crc value [ 298.617138][T11472] F2FS-fs (loop3): Try to recover 2th superblock, ret: 0 [ 298.633012][T11472] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 298.723506][ T28] kauditd_printk_skb: 12 callbacks suppressed [ 298.723520][ T28] audit: type=1800 audit(1790866834.509:60): pid=11472 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1945" name="file1" dev="loop3" ino=10 res=0 errno=0 [ 298.734432][T11472] syz.3.1945: attempt to access beyond end of device [ 298.734432][T11472] loop3: rw=34817, sector=77824, nr_sectors = 8 limit=40427 [ 298.830334][ T5767] syz-executor: attempt to access beyond end of device [ 298.830334][ T5767] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 298.872541][ T5767] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 299.191960][T11495] loop5: detected capacity change from 0 to 512 [ 299.235658][T11495] EXT4-fs error (device loop5): ext4_iget_extra_inode:4752: inode #15: comm syz.5.1955: corrupted in-inode xattr: invalid ea_ino [ 299.252739][T11501] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.1956'. [ 299.280261][T11495] EXT4-fs error (device loop5): ext4_orphan_get:1413: comm syz.5.1955: couldn't read orphan inode 15 (err -117) [ 299.312996][T11495] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 299.369398][T11505] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 299.454208][ T8938] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 299.495531][T11508] loop1: detected capacity change from 0 to 2048 [ 299.551625][T11508] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 299.565636][T11508] ext4 filesystem being mounted at /470/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 299.597239][ C0] vkms_vblank_simulate: vblank timer overrun [ 299.691170][ T5769] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 300.102506][T11506] loop3: detected capacity change from 0 to 32768 [ 300.169717][T11506] XFS (loop3): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4 [ 300.289823][T11506] XFS (loop3): Ending clean mount [ 300.309519][T11506] XFS (loop3): Quotacheck needed: Please wait. [ 300.345583][T11512] loop5: detected capacity change from 0 to 40427 [ 300.380892][T11512] F2FS-fs (loop5): build fault injection attr: rate: 0, type: 0x7 [ 300.414748][T11512] F2FS-fs (loop5): invalid crc value [ 300.467466][T11512] F2FS-fs (loop5): Found nat_bits in checkpoint [ 300.483796][T11506] XFS (loop3): Quotacheck: Done. [ 300.569762][T11512] F2FS-fs (loop5): Start checkpoint disabled! [ 300.583200][T11540] loop1: detected capacity change from 0 to 1024 [ 300.636024][T11512] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e6 [ 300.713003][T11512] syz.5.1960: attempt to access beyond end of device [ 300.713003][T11512] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 300.722953][T11540] syz.1.1969: attempt to access beyond end of device [ 300.722953][T11540] loop1: rw=0, sector=1024, nr_sectors = 4 limit=1024 [ 300.778593][T11540] buffer_io_error: 138 callbacks suppressed [ 300.778610][T11540] Buffer I/O error on dev loop1, logical block 256, async page read [ 300.804442][ T5767] XFS (loop3): Unmounting Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4 [ 300.838338][T11540] syz.1.1969: attempt to access beyond end of device [ 300.838338][T11540] loop1: rw=0, sector=1028, nr_sectors = 4 limit=1024 [ 300.868257][T11540] Buffer I/O error on dev loop1, logical block 257, async page read [ 300.920672][ T228] kworker/u4:6: attempt to access beyond end of device [ 300.920672][ T228] loop5: rw=1, sector=45096, nr_sectors = 8 limit=40427 [ 301.005252][ T228] kworker/u4:6: attempt to access beyond end of device [ 301.005252][ T228] loop5: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 301.060879][ T228] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 301.085802][ T228] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 301.358377][T11550] netlink: 'syz.3.1970': attribute type 1 has an invalid length. [ 301.527754][ T5921] usb 2-1: new full-speed USB device number 25 using dummy_hcd [ 301.534455][T11556] loop4: detected capacity change from 0 to 512 [ 301.599560][T11558] loop5: detected capacity change from 0 to 512 [ 301.600264][T11556] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 301.651380][T11558] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 301.669839][T11558] ext4 filesystem being mounted at /252/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 301.677444][T11556] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 18 vs 41 free clusters [ 301.720580][T11556] Quota error (device loop4): write_blk: dquota write failed [ 301.742888][ T5921] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 301.757815][ T5921] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 301.768970][T11556] Quota error (device loop4): qtree_write_dquot: Error -28 occurred while creating quota [ 301.778099][ T5921] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 301.797725][ T5921] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 301.810556][T11556] EXT4-fs error (device loop4): ext4_acquire_dquot:6953: comm syz.4.1977: Failed to acquire dquot type 0 [ 301.843765][T11556] EXT4-fs (loop4): 1 truncate cleaned up [ 301.851534][ T5921] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 301.853263][T11556] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 301.861082][ T5921] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 301.890444][ T8938] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 301.900191][ T5921] usb 2-1: Product: syz [ 301.900214][ T5921] usb 2-1: Manufacturer: syz [ 301.900230][ T5921] usb 2-1: SerialNumber: syz [ 301.910412][T11546] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 301.945940][ T5921] cdc_mbim 2-1:1.0: skipping garbage [ 302.000826][T11565] Quota error (device loop4): write_blk: dquota write failed [ 302.028606][T11565] Quota error (device loop4): qtree_write_dquot: Error -28 occurred while creating quota [ 302.059695][T11565] EXT4-fs error (device loop4): ext4_acquire_dquot:6953: comm syz.4.1977: Failed to acquire dquot type 0 [ 302.092475][T11568] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 302.156681][T11546] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 302.172873][T11546] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 302.220314][T11573] loop8: detected capacity change from 0 to 8 [ 302.230974][T11573] Dev loop8: unable to read RDB block 8 [ 302.236990][T11573] loop8: unable to read partition table [ 302.245113][T11573] loop8: partition table beyond EOD, truncated [ 302.255628][T11573] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 302.406570][ T6177] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 302.553722][T11580] loop4: detected capacity change from 0 to 1024 [ 302.791588][T11546] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 302.791727][T11546] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 302.792092][ T5921] cdc_mbim 2-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 302.792115][ T5921] cdc_mbim 2-1:1.0: setting rx_max = 2048 [ 302.993246][ T5921] cdc_mbim 2-1:1.0: setting tx_max = 184 [ 303.011282][ T5921] cdc_mbim 2-1:1.0: cdc-wdm0: USB WDM device [ 303.027006][ T5921] wwan wwan0: port wwan0mbim0 attached [ 303.053747][ T5921] cdc_mbim 2-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.1-1, CDC MBIM, b2:b7:65:cc:6f:0f [ 303.088378][ T5921] usb 2-1: USB disconnect, device number 25 [ 303.128664][ T5921] cdc_mbim 2-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.1-1, CDC MBIM [ 303.199801][ T5921] wwan wwan0: port wwan0mbim0 disconnected [ 303.303777][T11600] device-mapper: table: 248:3: multipath: priority group count mismatch (-EINVAL) [ 303.315991][T11600] device-mapper: ioctl: error adding target to table [ 303.931208][T11626] FAULT_INJECTION: forcing a failure. [ 303.931208][T11626] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 303.950006][T11626] CPU: 1 PID: 11626 Comm: syz.4.2001 Not tainted syzkaller #0 [ 303.957542][T11626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 303.967650][T11626] Call Trace: [ 303.970977][T11626] [ 303.973943][T11626] dump_stack_lvl+0x18c/0x250 [ 303.978677][T11626] ? show_regs_print_info+0x20/0x20 [ 303.983931][T11626] ? load_image+0x420/0x420 [ 303.988477][T11626] ? __might_fault+0xaa/0x120 [ 303.993194][T11626] ? __lock_acquire+0x7d80/0x7d80 [ 303.998279][T11626] ? __lock_acquire+0x7d80/0x7d80 [ 304.003345][T11626] should_fail_ex+0x394/0x4c0 [ 304.008095][T11626] set_fd_set+0x3a/0x90 [ 304.012309][T11626] core_sys_select+0x8c9/0xa80 [ 304.017116][T11626] ? poll_select_set_timeout+0x150/0x150 [ 304.022774][T11626] ? sigprocmask+0x190/0x190 [ 304.027390][T11626] __se_sys_pselect6+0x272/0x340 [ 304.032351][T11626] ? __x64_sys_pselect6+0xf0/0xf0 [ 304.037392][T11626] ? __x64_sys_pselect6+0x21/0xf0 [ 304.042448][T11626] do_syscall_64+0x55/0xb0 [ 304.046888][T11626] ? clear_bhb_loop+0x40/0x90 [ 304.051569][T11626] ? clear_bhb_loop+0x40/0x90 [ 304.056257][T11626] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 304.062165][T11626] RIP: 0033:0x7ff1abf9e159 [ 304.066587][T11626] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 304.086203][T11626] RSP: 002b:00007ff1acd9d028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 304.094637][T11626] RAX: ffffffffffffffda RBX: 00007ff1ac225fa0 RCX: 00007ff1abf9e159 [ 304.102622][T11626] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000000000000020 [ 304.110598][T11626] RBP: 00007ff1ac03506b R08: 0000200000000280 R09: 0000200000000300 [ 304.118583][T11626] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000000 [ 304.126649][T11626] R13: 00007ff1ac226038 R14: 00007ff1ac225fa0 R15: 00007ffeca777398 [ 304.134643][T11626] [ 304.187993][ T5921] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 304.387916][ T5921] usb 6-1: Using ep0 maxpacket: 32 [ 304.396875][ T5921] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 304.410193][ T5921] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 304.419501][ T5921] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 304.427763][ T5921] usb 6-1: Product: syz [ 304.431969][ T5921] usb 6-1: Manufacturer: syz [ 304.436568][ T5921] usb 6-1: SerialNumber: syz [ 304.443225][ T5921] usb 6-1: config 0 descriptor?? [ 304.453577][T11624] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 304.479690][T11349] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 304.583719][T11635] loop1: detected capacity change from 0 to 1024 [ 304.614342][T11635] EXT4-fs (loop1): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 304.627605][T11635] ext4 filesystem being mounted at /481/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 304.646670][T11635] EXT4-fs error (device loop1): ext4_map_blocks:720: inode #15: block 3: comm syz.1.2005: lblock 3 mapped to illegal pblock 3 (length 1) [ 304.671278][T11635] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 1 with error 117 [ 304.691611][T11349] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 304.701157][T11635] EXT4-fs (loop1): This should not happen!! Data will be lost [ 304.701157][T11635] [ 304.707950][T11349] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 304.721982][T11349] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 304.726664][T11641] EXT4-fs error (device loop1): ext4_free_blocks:6694: comm syz.1.2005: Freeing blocks not in datazone - block = 3, count = 1 [ 304.733476][T11349] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 304.764379][T11349] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 304.776126][T11635] EXT4-fs error (device loop1): ext4_map_blocks:720: inode #15: comm syz.1.2005: lblock 0 mapped to illegal pblock 0 (length 1) [ 304.779843][T11349] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 304.796165][T11635] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 304.799050][T11349] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 304.822390][T11349] usb 5-1: Product: syz [ 304.823267][T11635] EXT4-fs (loop1): This should not happen!! Data will be lost [ 304.823267][T11635] [ 304.827006][T11349] usb 5-1: Manufacturer: syz [ 304.862581][T11349] cdc_wdm 5-1:1.0: skipping garbage [ 304.868612][T11349] cdc_wdm 5-1:1.0: skipping garbage [ 304.882415][T11349] cdc_wdm 5-1:1.0: cdc-wdm1: USB WDM device [ 304.891095][T11349] cdc_wdm 5-1:1.0: Unknown control protocol [ 304.901067][ T5769] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 305.081745][T11283] usb 5-1: USB disconnect, device number 27 [ 305.087872][T11349] usb 6-1: USB disconnect, device number 7 [ 305.094888][T11647] loop5: detected capacity change from 0 to 7 [ 305.116335][T11647] Dev loop5: unable to read RDB block 7 [ 305.124849][T11647] loop5: unable to read partition table [ 305.133224][T11647] loop5: partition table beyond EOD, truncated [ 305.146187][T11647] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 305.223793][T11649] FAULT_INJECTION: forcing a failure. [ 305.223793][T11649] name failslab, interval 1, probability 0, space 0, times 0 [ 305.245854][T11649] CPU: 0 PID: 11649 Comm: syz.1.2008 Not tainted syzkaller #0 [ 305.253372][T11649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 305.263432][T11649] Call Trace: [ 305.266712][T11649] [ 305.269644][T11649] dump_stack_lvl+0x18c/0x250 [ 305.274321][T11649] ? show_regs_print_info+0x20/0x20 [ 305.279557][T11649] ? load_image+0x420/0x420 [ 305.284074][T11649] ? __might_sleep+0xe0/0xe0 [ 305.288684][T11649] ? __lock_acquire+0x7d80/0x7d80 [ 305.293722][T11649] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 305.299708][T11649] should_fail_ex+0x394/0x4c0 [ 305.304402][T11649] should_failslab+0x9/0x20 [ 305.309197][T11649] slab_pre_alloc_hook+0x59/0x300 [ 305.314236][T11649] kmem_cache_alloc_lru+0x4d/0x2b0 [ 305.319353][T11649] ? __d_alloc+0x31/0x710 [ 305.323676][T11649] __d_alloc+0x31/0x710 [ 305.327832][T11649] ? alloc_fd+0x590/0x640 [ 305.332156][T11649] d_alloc_pseudo+0x1d/0x70 [ 305.336756][T11649] alloc_file_pseudo+0xe4/0x210 [ 305.341614][T11649] ? fput+0x1a0/0x1a0 [ 305.345593][T11649] ? alloc_fd+0x590/0x640 [ 305.349924][T11649] sock_alloc_file+0xb7/0x280 [ 305.354611][T11649] __sys_socket+0x140/0x1b0 [ 305.359111][T11649] __x64_sys_socket+0x7a/0x90 [ 305.363867][T11649] do_syscall_64+0x55/0xb0 [ 305.368986][T11649] ? clear_bhb_loop+0x40/0x90 [ 305.373667][T11649] ? clear_bhb_loop+0x40/0x90 [ 305.378345][T11649] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 305.384239][T11649] RIP: 0033:0x7fa4cb79e159 [ 305.388652][T11649] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 305.408265][T11649] RSP: 002b:00007fa4cc5f9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 305.416693][T11649] RAX: ffffffffffffffda RBX: 00007fa4cba25fa0 RCX: 00007fa4cb79e159 [ 305.424668][T11649] RDX: 0000000000000002 RSI: 0000000000000002 RDI: 000000000000001d [ 305.432642][T11649] RBP: 00007fa4cb83506b R08: 0000000000000000 R09: 0000000000000000 [ 305.440612][T11649] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 305.448588][T11649] R13: 00007fa4cba26038 R14: 00007fa4cba25fa0 R15: 00007fff87966678 [ 305.456573][T11649] [ 305.600712][T11655] netlink: 'syz.1.2011': attribute type 3 has an invalid length. [ 305.680773][T11657] loop1: detected capacity change from 0 to 8192 [ 305.694200][T11657] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 305.718601][T11657] REISERFS (device loop1): found reiserfs format "3.6" with non-standard journal [ 305.728032][T11657] REISERFS (device loop1): using ordered data mode [ 305.734571][T11657] reiserfs: using flush barriers [ 305.741764][T11657] REISERFS (device loop1): journal params: device loop1, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 305.758496][T11657] REISERFS (device loop1): checking transaction log (loop1) [ 305.927008][T11657] REISERFS (device loop1): Using tea hash to sort names [ 305.940191][T11657] REISERFS (device loop1): Created .reiserfs_priv - reserved for xattr storage. [ 305.957515][T11661] FAULT_INJECTION: forcing a failure. [ 305.957515][T11661] name failslab, interval 1, probability 0, space 0, times 0 [ 305.971226][T11661] CPU: 0 PID: 11661 Comm: syz.5.2013 Not tainted syzkaller #0 [ 305.978724][T11661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 305.988782][T11661] Call Trace: [ 305.992060][T11661] [ 305.995002][T11661] dump_stack_lvl+0x18c/0x250 [ 305.999698][T11661] ? show_regs_print_info+0x20/0x20 [ 306.004898][T11661] ? load_image+0x420/0x420 [ 306.009407][T11661] ? __might_sleep+0xe0/0xe0 [ 306.014026][T11661] ? __lock_acquire+0x7d80/0x7d80 [ 306.019055][T11661] should_fail_ex+0x394/0x4c0 [ 306.023742][T11661] should_failslab+0x9/0x20 [ 306.028251][T11661] slab_pre_alloc_hook+0x59/0x300 [ 306.033287][T11661] ? lockdep_softirqs_off+0x440/0x440 [ 306.038667][T11661] kmem_cache_alloc+0x5a/0x2c0 [ 306.043437][T11661] ? security_inode_alloc+0x34/0x110 [ 306.048729][T11661] security_inode_alloc+0x34/0x110 [ 306.053941][T11661] inode_init_always+0x914/0xc90 [ 306.058883][T11661] new_inode_pseudo+0x95/0x1d0 [ 306.063648][T11661] __sock_create+0x12d/0x940 [ 306.068254][T11661] ? __might_fault+0xaa/0x120 [ 306.072934][T11661] ? __might_fault+0xc6/0x120 [ 306.077609][T11661] __sys_socketpair+0x1c1/0x550 [ 306.082471][T11661] __x64_sys_socketpair+0x9b/0xb0 [ 306.087503][T11661] do_syscall_64+0x55/0xb0 [ 306.091928][T11661] ? clear_bhb_loop+0x40/0x90 [ 306.096608][T11661] ? clear_bhb_loop+0x40/0x90 [ 306.101290][T11661] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 306.107190][T11661] RIP: 0033:0x7f05cd59e159 [ 306.111603][T11661] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 306.131221][T11661] RSP: 002b:00007f05ce4b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 [ 306.139698][T11661] RAX: ffffffffffffffda RBX: 00007f05cd825fa0 RCX: 00007f05cd59e159 [ 306.147688][T11661] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 306.156378][T11661] RBP: 00007f05cd63506b R08: 0000000000000000 R09: 0000000000000000 [ 306.164355][T11661] R10: 0000200000000200 R11: 0000000000000246 R12: 0000000000000000 [ 306.172333][T11661] R13: 00007f05cd826038 R14: 00007f05cd825fa0 R15: 00007ffc8f3806a8 [ 306.180317][T11661] [ 306.190670][T11661] socket: no more sockets [ 306.190670][T11662] loop4: detected capacity change from 0 to 128 [ 306.242731][T11657] [ 306.245107][T11657] ====================================================== [ 306.252139][T11657] WARNING: possible circular locking dependency detected [ 306.259181][T11657] syzkaller #0 Not tainted [ 306.263608][T11657] ------------------------------------------------------ [ 306.270642][T11657] syz.1.2012/11657 is trying to acquire lock: [ 306.276720][T11657] ffff88805ae3dfb0 (&type->i_mutex_dir_key#15/2){+.+.}-{3:3}, at: delete_one_xattr+0xfa/0x2d0 [ 306.287030][T11657] [ 306.287030][T11657] but task is already holding lock: [ 306.294388][T11657] ffff88805ae3d910 (&type->i_mutex_dir_key#15/3){+.+.}-{3:3}, at: reiserfs_for_each_xattr+0x89a/0xa30 [ 306.305444][T11657] [ 306.305444][T11657] which lock already depends on the new lock. [ 306.305444][T11657] [ 306.315852][T11657] [ 306.315852][T11657] the existing dependency chain (in reverse order) is: [ 306.324885][T11657] [ 306.324885][T11657] -> #2 (&type->i_mutex_dir_key#15/3){+.+.}-{3:3}: [ 306.333600][T11657] down_write_nested+0x9e/0x200 [ 306.338966][T11657] open_xa_dir+0x146/0x6f0 [ 306.344079][T11657] xattr_lookup+0x22/0x2a0 [ 306.349016][T11657] reiserfs_xattr_get+0x114/0x5a0 [ 306.354562][T11657] __vfs_getxattr+0x406/0x440 [ 306.359755][T11657] cap_inode_need_killpriv+0x45/0x60 [ 306.365560][T11657] security_inode_need_killpriv+0x62/0x90 [ 306.371797][T11657] __file_remove_privs+0x23f/0x600 [ 306.377525][T11657] __generic_file_write_iter+0x7c/0x230 [ 306.383597][T11657] generic_file_write_iter+0xaf/0x2e0 [ 306.389519][T11657] do_iter_write+0x747/0xc50 [ 306.394642][T11657] do_writev+0x27f/0x480 [ 306.399399][T11657] do_syscall_64+0x55/0xb0 [ 306.404333][T11657] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 306.410744][T11657] [ 306.410744][T11657] -> #1 (&sb->s_type->i_mutex_key#26){+.+.}-{3:3}: [ 306.419450][T11657] down_write+0x97/0x200 [ 306.424214][T11657] vfs_rename+0x6f4/0xe60 [ 306.429064][T11657] do_renameat2+0x8b0/0xc80 [ 306.434112][T11657] __x64_sys_renameat2+0xd2/0xe0 [ 306.439590][T11657] do_syscall_64+0x55/0xb0 [ 306.444529][T11657] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 306.450946][T11657] [ 306.450946][T11657] -> #0 (&type->i_mutex_dir_key#15/2){+.+.}-{3:3}: [ 306.459640][T11657] __lock_acquire+0x37ef/0x7d80 [ 306.465014][T11657] lock_acquire+0x19e/0x420 [ 306.470032][T11657] down_write_nested+0x9e/0x200 [ 306.475403][T11657] delete_one_xattr+0xfa/0x2d0 [ 306.480688][T11657] reiserfs_for_each_xattr+0x8a6/0xa30 [ 306.486668][T11657] reiserfs_delete_xattrs+0x20/0x90 [ 306.492383][T11657] reiserfs_evict_inode+0x24a/0x4c0 [ 306.498095][T11657] evict+0x4b7/0x8a0 [ 306.502508][T11657] vfs_rmdir+0x378/0x4b0 [ 306.507269][T11657] do_rmdir+0x29f/0x590 [ 306.511938][T11657] __x64_sys_unlinkat+0xc4/0xe0 [ 306.517314][T11657] do_syscall_64+0x55/0xb0 [ 306.522264][T11657] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 306.528677][T11657] [ 306.528677][T11657] other info that might help us debug this: [ 306.528677][T11657] [ 306.539026][T11657] Chain exists of: [ 306.539026][T11657] &type->i_mutex_dir_key#15/2 --> &sb->s_type->i_mutex_key#26 --> &type->i_mutex_dir_key#15/3 [ 306.539026][T11657] [ 306.555238][T11657] Possible unsafe locking scenario: [ 306.555238][T11657] [ 306.562676][T11657] CPU0 CPU1 [ 306.568030][T11657] ---- ---- [ 306.573382][T11657] lock(&type->i_mutex_dir_key#15/3); [ 306.578846][T11657] lock(&sb->s_type->i_mutex_key#26); [ 306.586844][T11657] lock(&type->i_mutex_dir_key#15/3); [ 306.594864][T11657] lock(&type->i_mutex_dir_key#15/2); [ 306.600338][T11657] [ 306.600338][T11657] *** DEADLOCK *** [ 306.600338][T11657] [ 306.608473][T11657] 3 locks held by syz.1.2012/11657: [ 306.613669][T11657] #0: ffff888021722418 (sb_writers#25){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 306.622916][T11657] #1: ffff88805ae3c530 (&type->i_mutex_dir_key#15/1){+.+.}-{3:3}, at: do_rmdir+0x1c6/0x590 [ 306.633034][T11657] #2: ffff88805ae3d910 (&type->i_mutex_dir_key#15/3){+.+.}-{3:3}, at: reiserfs_for_each_xattr+0x89a/0xa30 [ 306.644446][T11657] [ 306.644446][T11657] stack backtrace: [ 306.650327][T11657] CPU: 1 PID: 11657 Comm: syz.1.2012 Not tainted syzkaller #0 [ 306.657789][T11657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 306.667837][T11657] Call Trace: [ 306.671110][T11657] [ 306.674035][T11657] dump_stack_lvl+0x18c/0x250 [ 306.678718][T11657] ? load_image+0x420/0x420 [ 306.683606][T11657] ? show_regs_print_info+0x20/0x20 [ 306.688833][T11657] ? print_circular_bug+0x12b/0x1a0 [ 306.694048][T11657] check_noncircular+0x2fc/0x400 [ 306.699013][T11657] ? reiserfs_write_lock_nested+0x60/0xd0 [ 306.704763][T11657] ? look_up_lock_class+0x75/0x140 [ 306.709873][T11657] ? print_deadlock_bug+0x5d0/0x5d0 [ 306.715093][T11657] ? lockdep_lock+0xf5/0x230 [ 306.719685][T11657] ? _find_first_zero_bit+0xd6/0x100 [ 306.724966][T11657] __lock_acquire+0x37ef/0x7d80 [ 306.729833][T11657] ? verify_lock_unused+0x140/0x140 [ 306.735048][T11657] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 306.740675][T11657] ? verify_lock_unused+0x140/0x140 [ 306.745878][T11657] ? mutex_unlock+0x10/0x10 [ 306.750381][T11657] lock_acquire+0x19e/0x420 [ 306.754887][T11657] ? delete_one_xattr+0xfa/0x2d0 [ 306.759826][T11657] ? __might_sleep+0xe0/0xe0 [ 306.764414][T11657] ? read_lock_is_recursive+0x20/0x20 [ 306.770240][T11657] ? __might_sleep+0xe0/0xe0 [ 306.774850][T11657] ? read_lock_is_recursive+0x20/0x20 [ 306.780246][T11657] down_write_nested+0x9e/0x200 [ 306.785126][T11657] ? delete_one_xattr+0xfa/0x2d0 [ 306.790094][T11657] ? down_read_non_owner+0x310/0x310 [ 306.795392][T11657] ? down_write_nested+0x175/0x200 [ 306.800522][T11657] ? down_read_non_owner+0x310/0x310 [ 306.805810][T11657] delete_one_xattr+0xfa/0x2d0 [ 306.810606][T11657] reiserfs_for_each_xattr+0x8a6/0xa30 [ 306.816099][T11657] ? reiserfs_for_each_xattr+0xa30/0xa30 [ 306.821747][T11657] ? reiserfs_delete_xattrs+0x90/0x90 [ 306.827123][T11657] ? reiserfs_xattr_init+0x6a0/0x6a0 [ 306.832414][T11657] ? inode_wait_for_writeback+0x1e3/0x230 [ 306.838138][T11657] ? __rwlock_init+0x150/0x150 [ 306.842911][T11657] reiserfs_delete_xattrs+0x20/0x90 [ 306.848120][T11657] reiserfs_evict_inode+0x24a/0x4c0 [ 306.853344][T11657] ? evict+0x482/0x8a0 [ 306.857414][T11657] ? entry_points_to_object+0x260/0x260 [ 306.862981][T11657] ? do_raw_spin_lock+0x11f/0x2b0 [ 306.868016][T11657] ? do_raw_spin_unlock+0x121/0x230 [ 306.873214][T11657] ? entry_points_to_object+0x260/0x260 [ 306.878757][T11657] evict+0x4b7/0x8a0 [ 306.882658][T11657] ? __lock_acquire+0x7d80/0x7d80 [ 306.887683][T11657] ? proc_nr_inodes+0x230/0x230 [ 306.892531][T11657] ? do_raw_spin_unlock+0x121/0x230 [ 306.897731][T11657] ? _raw_spin_unlock+0x28/0x40 [ 306.902581][T11657] vfs_rmdir+0x378/0x4b0 [ 306.906824][T11657] do_rmdir+0x29f/0x590 [ 306.910973][T11657] ? __check_object_size+0x4fc/0xa40 [ 306.916283][T11657] ? d_delete_notify+0x150/0x150 [ 306.921228][T11657] ? getname_flags+0x20a/0x500 [ 306.925988][T11657] __x64_sys_unlinkat+0xc4/0xe0 [ 306.930846][T11657] do_syscall_64+0x55/0xb0 [ 306.935270][T11657] ? clear_bhb_loop+0x40/0x90 [ 306.939952][T11657] ? clear_bhb_loop+0x40/0x90 [ 306.944629][T11657] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 306.950532][T11657] RIP: 0033:0x7fa4cb79e159 [ 306.954993][T11657] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 306.974611][T11657] RSP: 002b:00007fa4cc5f9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 306.983025][T11657] RAX: ffffffffffffffda RBX: 00007fa4cba25fa0 RCX: 00007fa4cb79e159 [ 306.990992][T11657] RDX: 0000000000000200 RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 306.998965][T11657] RBP: 00007fa4cb83506b R08: 0000000000000000 R09: 0000000000000000 [ 307.006941][T11657] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 307.014905][T11657] R13: 00007fa4cba26038 R14: 00007fa4cba25fa0 R15: 00007fff87966678 [ 307.022880][T11657]