last executing test programs: 18.525790824s ago: executing program 3 (id=49): madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) capset(&(0x7f0000000140)={0x20080522}, &(0x7f0000000180)={0x200000, 0x200010}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r0 = io_uring_setup(0x3450, &(0x7f00000001c0)={0x0, 0x1539, 0x0, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000280)=[{&(0x7f00000002c0)=""/4095, 0x440000}], 0x100000000000011a) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000001300)=[{&(0x7f0000001340)=""/4096, 0x1000}], 0x0, 0x11a}, 0x20) 18.485171728s ago: executing program 3 (id=52): syz_mount_image$ext4(&(0x7f0000000b80)='ext4\x00', &(0x7f0000000bc0)='./file0\x00', 0x200000, &(0x7f0000000040)={[{@grpquota}]}, 0x1, 0xbaf, &(0x7f0000002f00)="$eJzs3M1rXOUaAPDnnEy+c5v0crn3tggGpCqK07QpFbpqXYsKunDZmExKyPTDJIIJXaR1ry5EXBSkf4Lg3m5cCS7qQutfUMQiRTdtFyNnPtKxk5mm6cwcE38/eHPe97wn8zxPTmfOe2BOA/jHms5+pBGHIuJsEjFZ359GxFC1NxKxWTvu/t3L81lLolJ5+7ckkoi4d/fyfOO1kvp2vD4YiYibryXx749a466ubyzPlcullfr46Nr5S0dX1zdeWTo/d650rnThxOyrJ2ZPzs52sdbbl9774pkf3nj+6vWPZ978/MB3SZyOifpccx3dMh3TW3+TZoWImOt2sJwM1OtprjMp5JgQAAAdpU1ruP/GZAzEw8XbZHz7Y67JAQAAAF1RGYioAAAAAPtc4v4fAAAA9rnG9wDu3b0832j5fiOhv+6ciYipWv2N55trM4XYrG5HYjAixn5Povmx1qT2a09tOov09felrEWPnkPuZPNKRPx/u/OfVOufqj7F3Vp/GhEzXYg//ch4L9V/ugvxn6z+4S5EBICIG2dqF7LW61+6tf6Jba5/hW2uXbuR9/W/sf6737L+e1j/QJv131s7jHH4wUs32801r//e/eTnhSx+tn2qop7AnSsRhwvb1Z9s1Z+0qf/sDmOMz9++1m4uqz+rt9H6XX/lesSR6mqutf6GpNP/T3R0calcmqn93Ob11092jt98/rOWxW/cC/RDdv7HYnfn/9IOY0z979dD7eYeX3/6y1DyTrU3VN/z4dza2sqxiKHk9db9xzvn0jim8RpZ/S8+1/n9v1392WfCZv3vkP3ruVLfZuOrj8QcP3L8q93X31tZ/Qu7PP+f7jDGl99ce7/dXN71AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALA3pBExEUla3OqnabEYMR4R/4mxtHxxde3lxYsfXFjI5iKmYjBdXCqXZiJisjZOsvGxav/h+Pgj49mIOBgRn02OVsfF+YvlhbyLBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYMt4RExEkhYjIo2IPybTtFjMOysAAACg66byTgAAAADoOff/AAAAsP+13P8X/jIa6WcuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7EsHn71xK4mIzVOj1ZYZqs8N5poZ0Gvpzg4b63UeQP8N5J0AkJtCU79SqVRyTAXoM/f4QPKY+ZG2M8NdzwUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAv68XDt24lUTE5qnRassM1ecGc80M6LU07wSA3Ax0mkweuwPYwwp5JwDkxj0+UFvZP6jUtM6PtP3N4aeOCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDeMVFtSVqMiLTaT9NiMeJfETEVg8niUrk0ExEHIuKnycHhbHws76QBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADoutX1jeW5crm0oqOj08XOaPQt1mj9zdzmmOH2Ux06OX8wAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQi9X1jeW5crm0spp3JgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDeVtc3lufK5dJKDzt51wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQH7+DAAA///6CAm5") lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7}) openat(0xffffffffffffff9c, 0x0, 0x1, 0x6) quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x1000000000000, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x3fd}) chown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 18.382391888s ago: executing program 3 (id=56): bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_mount_image$msdos(&(0x7f00000002c0), &(0x7f0000000900)='./file0\x00', 0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="646f73317866ec6f7070792c6e6f646f74732c00"], 0x1, 0x21f, &(0x7f0000000b00)="$eJzs3DtrW2cYB/BXvqmWsdFUaJe+uEu7iNZzh5biQqmgpa5KL1A4xnIrpEpGR4NUOmjOlM+QMYRkyRYw+QL+FMlmAsZLPOUEW4ovceLcFCnEv9+i5+iv5/A+6HAQr+DsfnX13/pmWtpMOmEqnwtTX4f+wyzLimEqPNEPn9/6bf/K2lw4I8a49Mn2n//fWL7bWfj19tKdfNgp/rW7t3J/58Odj3Yf/fJPLY21NDZbnZjE9Vark6w3qnGjltZLMf7UqCZpNdaaabV9Jt9stLa2ejFpbiwWttrVNI1Jsxfr1V7stGKn3YvJ30mtGUulUlwsBN5E5fpBlutnh/L9kGXZpBfEmB1kWdjz/V9aa7//8cM35fLqzzF+EMKDfrfSrQxeB/l335dXv4hHiidd+91uZfo4/3KQx1On7XYrs6EwzFfO5Yf9c+GzTwf5Yfbtj+Wn8vmw8danBwAAAACA91MpHju/v58bHp7N7xWO9vcHB6f+Hxjs31/bHvbPhI9nxjwMAAAA8Exp77960mhU2xcU0yGEF31m5MVMeM322eFk41vq84tcGGyijPDMWT6Eyc01F4bF/CtcP+9+sXD8Tii+XNf0qJdxc5QXySiKC24ay2O4MQEAACN38qN/0isBAAAAAAAAAAAAAAAAAACAy2scjxOb9IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABd5HAAA//9eWF7C") close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000f00)='./file0/file1\x00', 0x103841, 0x186) lseek(r0, 0x0, 0x1) 18.046510483s ago: executing program 3 (id=59): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, &(0x7f0000001c80)={0x1, [{0x3, 0x0, 0x80040005, 0x0}, {0x7, 0x0, 0x40, 0x0}, {0x2, 0x0, 0xfffffffe, 0x0}, {0x2, 0x0, 0x4751, 0x0}, {0x1, 0x18, 0x8, &(0x7f0000000380)="d7b2cb"}, {0x1, 0x0, 0x7, 0x0}, {0x1, 0x0, 0x2000009, 0x0}, {0x0, 0x0, 0x5, 0x0}, {0x2, 0x0, 0x3ff, 0x0}, {0x2, 0x0, 0x7fffffff, 0x0}, {0x3, 0x0, 0xe, 0x0}, {0x0, 0x0, 0x800000, 0x0}, {0x1, 0x0, 0xc, 0x0}, {0x4, 0x0, 0x7, 0x0}, {0x2, 0x0, 0x2e0, 0x0}, {0x2, 0x0, 0x40001, 0x0}]}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000010000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x40, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17.885659249s ago: executing program 3 (id=67): mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000540)='./mysys\x00', &(0x7f0000000580)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./mysys/bus/pci/devices/0000:00:05.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x4000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 17.828092945s ago: executing program 3 (id=68): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) r3 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$DM_DEV_STATUS(r3, 0xc138fd07, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28200, 0x0, 0x0, @by_uuid={0x0, '\x00', {'LVM-syz', 0x0, '3\x00'}}}) 17.722055216s ago: executing program 0 (id=72): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x7, &(0x7f0000000100)=0x4000200, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x6, 0x300, 0xfc}, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffd8f}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 17.548835543s ago: executing program 0 (id=76): socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x20000400) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x41, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09000000010000004200000040"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080), &(0x7f00000000c0), 0x3ff, r0}, 0x38) bpf$MAP_LOOKUP_BATCH(0x19, &(0x7f0000000100)={0x0, &(0x7f0000000140)=""/119, &(0x7f00000001c0), &(0x7f0000000200), 0x7, r0}, 0x38) 17.490419149s ago: executing program 0 (id=77): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/ipv4/conf/lo/forwarding\x00', 0x2, 0x0) r1 = memfd_create(&(0x7f0000000500)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x11, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) unshare(0x400) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000061180000000000007a0af8ff009a670018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000150802000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000100000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000340)=r3, 0x4) 15.572277855s ago: executing program 4 (id=117): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000040)={0x0, &(0x7f0000000080)=[@wrmsr={0x65, 0x20, {0x40000073, 0x7}}], 0x20}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237648, 0x6, 0x2, 0x80}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 15.501009252s ago: executing program 4 (id=118): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x33, &(0x7f0000000200)=0x7, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x22, &(0x7f0000000240)=0x1, 0x4) bind$inet6(r0, &(0x7f0000000340)={0xa, 0x4e20, 0x9, @loopback, 0x2000005}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000380)=[{{&(0x7f00000003c0)={0xa, 0x4e20, 0x2, @empty, 0xfffffffe}, 0x1c, &(0x7f0000000400)=[{&(0x7f0000000700)="fb", 0x1}], 0x1}}], 0x1, 0x20080058) write(r0, &(0x7f0000000740)="4c16", 0x2) 15.486184283s ago: executing program 4 (id=119): syz_mount_image$vfat(&(0x7f0000000480), &(0x7f00000004c0)='./file0\x00', 0x4000, &(0x7f0000000500)=ANY=[@ANYBLOB="73686f72746e616d653d77696e6e742c757466383d302c636865636b3d7374726963742c646973636172642c757466383d312c6e66732c73686f72746e616d653d77696e39352c73686f72746e616d653d6c6f7765722c756e695f786c6174653d302c0036b573262ed88dfec7618c03371693a5173bd0bf12d29c0180500a87e3789adea802a90933b243ca225dacfc27597d6e1ce3d9fdc12409748ba4fbde6f1d76e116fd437b79bbcea7fdc682fd0b90334eed137d03ce386950f5e50ff2516eb2b500a9b99e04f2a41864e44cb46101a23835877342485260d4510fa3240a2c9756d388e5861cdeaf4c88bca74fe3ce71eef72c"], 0xfd, 0x2b6, &(0x7f0000000600)="$eJzs3E9rE08YwPGnaZOmKW1y+PEDBfFBL3pZ2vgKgrQgBpTaiHoQpnajIWtSsjESEdubV19H8ehNsL6BXrx5Fy9FELz0IF3pbtYkZaV/NN22+X6g7HRnnszM7iY8u7Czde/N02rZtcqmKYm0SkJkTbZFcruljpHONuGXU9JrTa5O/vh84c79BzcLxeLcgup8YfFaXlWnL354/vLtpY/Nybvvpt+Py2bu4db3/JfN/zfPbe0shp9eb6rRpXq9aZYcW5crbtVSve3YxrW1UnPtRl992amvrLTV1JanMisN23XV1NpatdvarGuz0Vbz2FRqalmWTmVk2IweOqK0vrBgCgMZDOIwEbWz0SiY0cjK0vpxDAoAAJwsg8j/Rw6Q/z+puFpxtbZf/p8Q8v/B8fP/ncikEWdDcvcGoGAyne9vP/J/AAAAAAAAAAAAAAAAAAAAAABOg23Py3qelw234d+4iKRFJPw/7nFiMI5w/kdiHC7+sZ4X99IizutWqVUKtkF9oSwVccSWmaTIT/966AjK8zeKczPqy8mGs9qJ918SHA/jQ7no+NkgXnviV1ulpGR6+89LVv6Ljs/viU+KSKuUkiuXe+ItycqnR1IXR5b967ob/2pW9fqt4p7+J/x2AAAAAACcBZb+luu//w1Wk7QsDZcN2VMf7Ow+H5DsPs8HVDZS0o0fk/Nj8c0bAAAAAIBh4rZfVI3j2I3TWkh2JnLcvR/10KVE5IQcukMXrHRwrCOq0hLu8TxvdbfR33eaEJGYZvrtz1dU+NDqpJyUwxS+PgvGfpDGcfwaAQAAABikbtIf90gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABheB108LGx/lLXHerob7e998hhnCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMTvVwAAAP//G5URgQ==") mkdir(&(0x7f00000008c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000900)='.\x00', &(0x7f0000000940)='./bus\x00', &(0x7f0000000980), 0xc002, 0x0) chdir(&(0x7f00000009c0)='./bus\x00') mount(0x0, &(0x7f0000000100)='./sys\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x1, 0x0) 15.376501364s ago: executing program 4 (id=120): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18020000fdffffff0000000000000000850000002c00000095"], &(0x7f0000000300)='GPL\x00', 0x5, 0xbf, &(0x7f0000000340)=""/191}, 0x80) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000400)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000440)={r1, r2, 0x25, 0x0, @val=@iter={0x0}}, 0x20) bpf$BPF_LINK_CREATE(0x1c, 0x0, 0x0) syz_emit_ethernet(0x46, &(0x7f0000006400)={@local, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x10, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x2e}, @local, {[], @ni={0x8c, 0x0, 0x0, 0x8a8, 0x6a, 0xb4}}}}}}, 0x0) 15.259253396s ago: executing program 4 (id=125): mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001900)='./proc\x00', &(0x7f0000001940)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001980)='./proc/sys/net/ipv4/ping_group_range\x00', 0x2, 0x0) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, 0x0, 0x200000c0) write(r0, 0x0, 0x0) syz_usb_connect$cdc_ecm(0x4, 0x0, 0x0, 0x0) 15.238420429s ago: executing program 33 (id=125): mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001900)='./proc\x00', &(0x7f0000001940)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001980)='./proc/sys/net/ipv4/ping_group_range\x00', 0x2, 0x0) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, 0x0, 0x200000c0) write(r0, 0x0, 0x0) syz_usb_connect$cdc_ecm(0x4, 0x0, 0x0, 0x0) 15.235979289s ago: executing program 1 (id=128): unshare(0x22020600) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x17, 0x3, &(0x7f00000008c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000900)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = fsopen(&(0x7f0000000940)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000980)=ANY=[@ANYRES32=r2, @ANYRES32=r0, @ANYBLOB="1200000006"], 0x10) 15.198099653s ago: executing program 1 (id=130): syz_mount_image$vfat(&(0x7f0000000d40), &(0x7f0000000d80)='./file0\x00', 0x18000, &(0x7f0000000dc0)=ANY=[@ANYRES32=0x0, @ANYRES16, @ANYRES8, @ANYRES8=0x0, @ANYRES32=0x0, @ANYRES64, @ANYRESDEC=0x0], 0x4, 0x304, &(0x7f0000000e00)="$eJzs3M9PE2kYwPGnPyhtCZTDZje7yYZ3dy/rZQLVs9IYSIxNJEiNPxKTAabadGxJp8HUGJGTV+PNf8AD4ciNRPkHuHjTixdvXEw8yME4ptMZSssUpLSUH99PQubhfd5nOm9byDMNL1u3Xz7KZy0tq5clGFUSEBHZFhmWoHgC7jHoxBHZ7blcGPj64e+bd+5eT6XTE9NKTaZmLiaVUkMjbx8/jbnT1vtlc/j+1pfk583fN//c+jHzMGepnKUKxbLS1WzxU1mfNQ01n7PymlJTpqFbhsoVLKNUyxdr+axZXFioKL0wPxhfKBmWpfRCReWNiioXVblUUaEHeq6gNE1Tg3HBQTIr09N6qs3iuQ5fDLqkVErpIRGJ7clkVnpyQQAAoKea+/+gqE72/6v/bpQHbq0Nuf3/esSv/7/0sXauhv4/KiK+/b/3+L79v364/n9vR3RK2XZbZUfq/3EyjET2DAXqYTVZSulx9+fXsXxvddQJ6P8BAAAAAAAAAAAAAAAAAAAAADgNtm07Ydt2wjt6X/0iEnU2ltS+9ykNiciVHlwyOugIrz/OgPrGvfCQiPliMbOYqR3dCRsiYjqvf0K+O+8HVzX2dh6pqmF5Zy659UuLmZCTSWUlJ6YYMiaJPmmut+3Ja+mJMVXTWN8n8d31SUnIb/71Sd/6iPz/3656TRLyfk6KYsq8u2HOq382ptTVG+mm+pgzDwAAAACAs0BTO3zv3zWtVb5Wv3N/Pdr0+UCofn896nt/Hpa/wr1dOwAAAAAA54VVeZLXTdMo7QSDItI4EpPmOZ0Mwl06s7fCX63y/paheyvdJ/AevCEVdQc7/rQEDvG0tAiC0k7VSHU1qin1z7LP2vcLvI+NWs2RqXF35HXLOd0J/nj15lvnTnh5LXrAStsPQvu/AfqO57cPAAAAgONUb/q9kfHeXhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOfQcfx3tF6vEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgpfgYAAP//2a0C7Q==") r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x40000073, 0x0, 0x1001}]}) 15.02619176s ago: executing program 1 (id=131): r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000006c0)='.\x00', 0xa880, 0x97) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000740)='./proc\x00', &(0x7f0000000800)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d00, &(0x7f0000000880)="0000020000020000000002") close_range(r0, 0xffffffffffffffff, 0x0) 15.02592421s ago: executing program 1 (id=132): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x10, &(0x7f0000000100)={[{@dioread_lock}]}, 0x5, 0x7e5, &(0x7f00000018c0)="$eJzs3ctrW9kZAPDvyvKjTlK7UGjSlaHQGoLlOnWTFrpI6aIUGgi06yZCVkxq2QqWHGJjSEMpdFNoQxeFdpN12qa7btuZ7cy/MLMZhiEhM+OESZjF4OHqEcu25MgZWZqJfz+49jn3oXO++zj3yPdwHcCxNZX+yESciYg/JxETjflJRAzXUtmIi/X1nm1tFtIpie3tX32U1NZ5urVZiJZtYnw8TjQypyPijT9EnM3sL7eyvrGUL5WKq438bHX5xmxlfWPm+nJ+sbhYXDk/Nz9/7sIPL4z2LtZP3t44+egvP//evy9++vtvPfjTm0lcjJONZa1x9MpUTNX3SQynu3CXn/W6sAFLBl0BXkl6aQ7Vr/I4ExPZGOl+2+xRVgwAODK3I2IbADhmEvd/ADhmmn8HeLq1WUin7duD/XtEvz3+aUSM1eNvPt+sL8k2ntmN1Z6Djj9Ndj3vSCJisgflT0XEP/77m3+mUxzRc0iAdn53JyKuTk412/+d9ifZN2ahrvsBGd9vJg4YHDC1J6/9g/75X9r/+dFO/2/n+su86P9Em/7PaJtr91VMxe4RJ/uv/8zDHhTTUdr/+8nwzti2Zy3xN0wONXKnan2+4eTa9VIxbdu+HhHTMTya5ufaf3xteNn0k8+e7JrbEnFr/+/ju7+9n5af/t5ZI/Mwu6fJXchX872IPfX4TsS3s+3iT14c/6RD//dyl2X84sd//HunZWn8abzNaXf8Rz+qbPtexHejffxNyUHjE8/P1k6H2eZJ0cZ/3vvbeKfyW49/OqXl178LnOp9sG2kx3/84Pgnk9bxmpXDl/HWvYn/d1rWOf6m9uf/SPLrWrp5Kd3KV6urcxEjyS/3zz+3s20z31w/jX/6O+2v/4PO//Q74dUu488++vBfL42/OWNf/A1jXRZ2SGn8C4c6/m0T6VfhDovypQfPloY6ld/d8Z9PE0PTjTndtH8da5ovlUZa1nnlHQcAAAAAAAAAAAAAAAAAAAAAAAAAh5CpvaQ0yeRepDOZXC5q/8P7mzGeKZUr1bPXymsrC/WXmU7G8GhE1F51OdHyPtS5xvvwm/lze/I/iIhvRMRfR79Wy+cK5dLCoIMHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIYTHf7/f+qD0frv5wOtIQBwJMZeusaTYl8qAgD0zcvv/xExevT1AAD6p6v7PwDwWnH/B4DjZywz6BoAAP02FpEddB0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4rV2+dCmdtp9vbRbS/MLN9bWl8s2ZhWJlKbe8VsgVyqs3covl8mKpmCuUl1s2fafd55XK5RvzsbJ2a7ZarFRnK+sbV5bLayvVK9eX84vFK8XhvkUGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN2rrG8s5Uul4mojcX88YvecPiWGGhXq5SfPnOx3FP1IbE/U99SXpT49T4ztnfP+zLunD9rq7r7TWOILJwbZKgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8dXweAAD//9GqGUs=") syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x0, 0x3e, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000002c0)='./file0/file1\x00', 0x0, 0x0, 0x1, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000740)='./bus\x00', 0xa82086, 0x0, 0x31, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f00000003c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) unlinkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0x200) 14.863972367s ago: executing program 1 (id=133): socket(0x10, 0x3, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x8000002, 0x0, @mcast2}, 0x1b) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@random="492afaf4337b", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x18, 0x3a, 0xff, @local, @local, {[], @ndisc_na={0x88, 0x0, 0x0, 0xce, '\x00', @local}}}}}}, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000100)=ANY=[], 0x0) 13.416468654s ago: executing program 1 (id=136): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000080)='./debug\x00', 0x100) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) 13.313373235s ago: executing program 34 (id=136): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000080)='./debug\x00', 0x100) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) 13.030238373s ago: executing program 2 (id=141): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000040)={[0x47d, 0x80000000000000, 0x7, 0x9, 0x1000, 0x2, 0x1002, 0xfbfffffffffffffb, 0x8, 0x100000000080, 0x2, 0x6, 0x8bda, 0xfffffffffffffeff, 0x3fb, 0xfbd3], 0x25000, 0x216156}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 12.742606423s ago: executing program 2 (id=144): r0 = fsopen(&(0x7f00000197c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000019840)={0x1, &(0x7f0000019880)=[{0x6, 0x0, 0x1, 0x7fffffff}]}) r1 = fsmount(r0, 0x1, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000019980)='cgroup.freeze\x00', 0x275a, 0x0) ftruncate(r2, 0x8008976) 12.690214638s ago: executing program 2 (id=145): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x1, 0x9}, 0x0, [0x0, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x404, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x8, 0x1, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x216, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x20, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x2, 0x0, 0x0, 0x16d, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0xfffffffe, 0x400, 0x0, 0x200, 0x0, 0x2, 0x80000000, 0x3, 0x5, 0x10000000, 0x0, 0x548f, 0x0, 0x0, 0x9, 0x10000, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0xb, 0x3bb6, 0x2217, 0x0, 0x0, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x0, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x4, 0x0, 0x9fa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x921, 0x0, 0x0, 0x2, 0x0, 0x6, 0x0, 0x0, 0xbda6, 0x4, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x3, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x0, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x101, 0x80000000, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0x6, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7, 0x4]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x15) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000bc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x13a0, 0x11c0, 0xc8, 0x8, 0x11c0, 0x5803, 0x12d0, 0x2e8, 0x2e8, 0x12d0, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x142, 0x1198, 0x11c0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5df11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f35a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x1, 0x3}}, @common=@unspec=@cgroup1={{0x1030}, {0x4, 0x1, 0x0, 0x0, './cgroup.cpu/syz1\x00', 0x0, {0xfffffffffffffffc}}}]}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x400, 0xa66, 0x2}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x8000000, 'snmp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1400) ioctl$UI_DEV_CREATE(r0, 0x5501) 12.649740222s ago: executing program 2 (id=146): openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x4, &(0x7f0000000380)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3}, [@call={0x85, 0x0, 0x0, 0x41}]}, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_mount_image$msdos(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x2800080, &(0x7f0000000480)=ANY=[@ANYRES64=0x0, @ANYRESOCT, @ANYRESDEC=0x0, @ANYRES8=0x0], 0x1, 0x2ad, &(0x7f00000005c0)="$eJzs3U9LVF0cB/DjqPjgg+Lq4alNh1q1GdR1CyUUpIGinKCC4IrXGuY2I3NnMSMtbN0maNk7iJbtgugN+C7aSSCuXGXY9d8IQaSOkJ/PZn6c7/k7F85d3s1bb17UV/LyStIOpZmBUJoJobQzECZCKRxYDzffvnr3+sGjx3dmK5W5+zHOzy5OTccYx699fvLyw/Uv7X8ffhz/NBI2Jp5ubk1/3fhv48rm98XntTzW8thotmMSl5rNdrKUpXG5ltfLMd7L0iRPY62Rp62efCVrrq52Y9JYHhtdbaV5HpNGN9bTbmw3Y7vVjcmzpNaI5XI5jo0GTqP6fmd3N2ztFi56N/Sf53+5HbvU/wlhe71T7VSL3yKfX6jMTcafho9GbXc61cHDfKrIY28+HEb38+mT+cGr5UaR72W371ZOjB8Jy+d8dgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC6vcjw0cdS63elUB4u8/Ku8qOYXKnOT+x1686FwdahvxwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAU8m7a/Uky9JWf4qhPq51NsXwb/TZ+yPPZ/WRYy2DfzLPwDltTPG3Fxd9MwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAED/9X7EHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgMsq767VkyxLW2dVfPu/mPhYdNFnBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDT+hEAAP//yRtmJg==") syz_clone(0xa0302000, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r0, 0x0, 0x2100, 0x0, &(0x7f0000000480), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) 12.498458838s ago: executing program 2 (id=147): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x35451d7003101a08, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) ioctl$TUNSETGROUP(r0, 0x400454ce, 0xee01) setgroups(0x3, &(0x7f0000000280)=[0xee01, 0x0, 0x0]) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x103900, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'rose0\x00', 0x112}) 12.248493253s ago: executing program 2 (id=149): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ptrace(0x4206, r0) ptrace$setsig(0x4203, r0, 0x4, &(0x7f0000000000)={0x29, 0x8, 0x1}) ptrace(0x4208, r0) 12.235270384s ago: executing program 35 (id=149): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ptrace(0x4206, r0) ptrace$setsig(0x4203, r0, 0x4, &(0x7f0000000000)={0x29, 0x8, 0x1}) ptrace(0x4208, r0) 2.706752805s ago: executing program 36 (id=68): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) r3 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$DM_DEV_STATUS(r3, 0xc138fd07, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28200, 0x0, 0x0, @by_uuid={0x0, '\x00', {'LVM-syz', 0x0, '3\x00'}}}) 2.072418899s ago: executing program 7 (id=344): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./debug\x00', 0x1ea) mount(0x0, &(0x7f0000000680)='./debug\x00', &(0x7f00000006c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./debug/x86/pat_memtype_list\x00', 0x0, 0x104) preadv(r0, &(0x7f0000000140)=[{&(0x7f0000002900)=""/102, 0x66}, {&(0x7f0000000000)=""/236, 0xec}], 0x2, 0x3, 0x0) 2.010550235s ago: executing program 7 (id=345): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.891914197s ago: executing program 7 (id=351): r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x1, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b70200000000e6ccbfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe02000000850000001a000000b7000000100000009500000000000000455781a5fee65e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde43a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d1106fb0289ce67a66afd92c3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a060000009b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece6d311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da326018362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f707777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee23483508818b897e3b677d3d342640e328504ae2dbf8fe1d704765de74891f7c8dae85739c50409c62040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528d46362ea0d8d79c79ddca066da478c1b7d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5f001000000100008000000000ed6f6663677df37de0ec0d0f548b273940be5d1fe0aae14d1a76e0741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ce0000000000000000000000000000000064d3210f806a4877e73c19072e358da1cdbef27967e918e6f2bab4a78ce0103a91789340b00db45df429d650e2f6acfbf9bf2f1b23064f3e60a9ded23b652f110940813a14c97abc84ab3cf728efd94ba2895a0884e7f7c53bc60d1b9768a979929055be8565b8a15dffc8692476ff03963b626afbc18750629666d1f449f02271064768c0731aeccb2c342ae3fa9956354e847f086eee8cd78617ad6ae28f121b23c1128b78f521eea8c487ae31f9112db0e671dd47d95ea9653e51da8c99a996656149a65f8e88032ddf35717407"], &(0x7f0000001000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000001040), 0x0, 0x10, &(0x7f0000001080), 0xfffffffffffffe19}, 0x42) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000010c0)=r1, 0x4) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000001100)={0x2, 0x0, @remote}, 0x10) sendmmsg(r2, &(0x7f0000001140), 0x800001d, 0x0) 1.872756339s ago: executing program 7 (id=352): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) fstatfs(r0, &(0x7f0000000500)=""/167) 1.825382754s ago: executing program 7 (id=356): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x1, 0x70bd29, 0x25dfdc01, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xb}, {0xffff, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x240040e0}, 0x44894) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="d800000025"], 0xd8}, 0x1, 0x0, 0x0, 0x4004041}, 0x20004440) 1.56892023s ago: executing program 7 (id=364): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x224, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x50, 0x9, "", [{{0x9, 0x4, 0x0, 0xd, 0x1, 0x3, 0x1, 0x3, 0x4, {0x9, 0x21, 0x22, 0x77, 0x1, {0x22, 0x4bf}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x3, 0x8, 0xff}}}}}]}}]}}, &(0x7f0000000100)={0x1, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000140)={0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="200d350000003500801c95bb17341d191be31b7f92c99d951a045bfd463a"], 0x0}, 0x0) 1.425668305s ago: executing program 9 (id=370): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f0000000280)="0f71f200d2f1660f3880b703000f300f090f38037f0cbaf80c66b83448138966efbafc0ced260f01c866f30f09", 0x2d}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.321286266s ago: executing program 8 (id=375): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000140)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x180) mount$overlay(0x0, &(0x7f00000002c0)='./bus\x00', &(0x7f0000000300), 0x8, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './proc'}}]}) chdir(&(0x7f0000000380)='./bus\x00') mknodat$md(0xffffffffffffff9c, &(0x7f0000000400)='./md1\x00', 0x6180, 0x0) 1.262634222s ago: executing program 8 (id=376): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000000)=@bpf_lsm={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000100)='GPL\x00'}, 0x80) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000140)={r0}, 0x8) close(r1) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000180)={r0, 0x1f, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000200)={r1, 0x0, 0x0}, 0x10) 1.261136292s ago: executing program 9 (id=377): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b52710aeee835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5bc6d3fd0500000022eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe326c2ed0a432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xf, 0x4, 0x4, 0x12}, 0x50) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x8, 0x3032, 0xffffffffffffffff, 0x0) unshare(0x2c020400) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000140)=ANY=[@ANYRES32=r1, @ANYRES32=r0, @ANYBLOB='&'], 0x10) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000040)={@map=r1, 0x26, 0x0, 0xf51, &(0x7f0000001440)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) 1.209022477s ago: executing program 8 (id=379): syz_mount_image$ext4(&(0x7f0000000440)='ext4\x00', &(0x7f0000000480)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x840e, &(0x7f0000000580), 0x3, 0x42f, &(0x7f00000005c0)="$eJzs289rHFUcAPDvzCat/WViqT+aVo1WMfgjadJae/CiKHhQEPRQjzFJS+y2kSaCLUGjSD1Kwbt4FPwLPOlF1JPgVe9SKJJLq6eV2Z1Jdje7aZJustX9fGCS92be8t53Z97ue/N2AuhZw9mfJGJ/RPweEQO1bGOB4dq/W8uLU38vL04lUam89VdSLXdzeXGqKFq8bl+R6YtIP0viSIt65y9fOT9ZLs9cyvNjCxfeH5u/fOW52QuT52bOzVycOH365InxF05NPN+ROLO4bg59NHf08GvvXHtj6sy1d3/+Ninib4qjQ4bXO/hkpdLh6rrrQF066etiQ9iUUq2bRn+1/w9EKVZP3kC8+mlXGwdsq0qlUnmg/eGlCvA/lkS3WwB0R/FFn81/i22Hhh53hRsv1SZAWdy38q12pC/SvEx/0/y2k4Yj4szSP19lW2zPfQgAgAbfZ+OfZ1uN/9Kovy90b76GMhgR90XEwYg4FRGHIuL+iGrZByPioU3W37xIsnb8k17fUmAblI3/XszXthrHf8XoLwZLee5ANf7+5OxseeZ4/p6MRP/uLD++Th0/vPLbF+2O1Y//si2rvxgL5u243re78TXTkwuTdxJzvRufRAz1tYo/WVkJSCLicEQMbbGO2ae/Odru2O3jX0cH1pkqX0c8VTv/S9EUfyFZf31y7J4ozxwfK66KtX759eqb7eq/o/g7IDv/e1te/yvxDyb167Xzm6/j6h+ft53TbPX635W83bDvw8mFhUvjEbuS12uNrt8/0VRuYrV8Fv/Isdb9/2CsvhNHIiK7iB+OiEci4tG87Y9FxOMRcWyd+H96+Yn3th7/9srin97U+V9N7IrmPa0TpfM/ftdQ6eBm4s/O/8lqaiTfs5HPv420a2tXMwAAAPz3pBGxP5J0dCWdpqOjtd/wH4q9aXlufuGZs3MfXJyuPSMwGP1pcadroO5+6Hg+rS/yE035E/l94y9Le6r50am58nS3g4cet69N/8/8Wep264Bt53kt6F36P/Qu/R96l/4PvatF/9/TjXYAO6/V9//HXWgHsPOa+r9lP+gh5v/Qu/R/6F36P/Sk+T1x+4fkJSTWJCK9K5ohsU2Jbn8yAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMa/AQAA//9QOObV") r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x4040) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, &(0x7f00000001c0)={[{@quota}, {@noload}, {@init_itable}]}, 0x1, 0x4ec, &(0x7f0000000a40)="$eJzs3c9vG1kdAPDvTH44zWY3WVhpAQFbloWCqnUSdzeqeioXEKoqISpOHNo0caModhzlRyGhh/R/QKISJ/gTOCBxQOqJOze4IaRyQCpQgRokDkYzHqf5YbfR5ofb+PORpp43rzPf76s7702eFb8A+tbFiNiOiOGIuBMR48XxpNjiemvL/t7zZw/mdp49mEui2bz1zySvz47FnnMybxXXHImIH34v4m5yOO7a5tbSbK1WXS3Kk+v1lcm1za2/LtZnF6oL1eVKZWZ6ZurqlU8rJ9bWD+q/efrdxRs/+v3vvvLkj9vf/lmW1lhRt7cdJ6nV9KHdOJnBiLhxGsF6YKBoz3CvE+EzSSPicxHxYXb/N3udDQBwFprN8WiO7y0DAOddms+BJWm5mAsYizQtl1tzeO/FaFprrK1fvtfYWJ5vzZVNxFB6b7FWnSrmCidiKMnK0/n+i3LlQPlKRLwbET8vXcjL5blGbb6XDz4A0MfeOjD+/6fUGv8BgHNupNcJAABnzvgPAP3H+A8A/cf4DwD9x/gPAP3H+A8A/cf4DwB95Qc3b2Zbc6f4/uv5+5sbS437H89X15bK9Y258lxjdaW80Ggs5N/ZU3/V9WqNxsr0J0Vhe3Jtc+t2vbGxvH47/17v29WhU28RAPAq737w+M9JNlRfu5BvsWctB2M1nG9prxMAembgeKf75ADeYIO9TgDoGT/jAx2W6N2n/aA/drCi1PUUXQu85i590fw/9Cvz/9C/jjn/D7zBzP9D/2o2E2v+A0CfMccP/ez9/M+jfv6/z3BEPDqNnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODNMJZvSVou1gIfizQtlyPejoiJGEruLdaqUxHxTkT8qTRUysrTvU4aADim9O9Jsf7XpfGPxg7WDif/LUWx1NdPfnnrFz+dXV9fnc6O/2v3+Pqj4njlpYGKpQZLuwdKJ94WAKCT9jjdHsfbnj97MNfezjKfp99pLS6axd0ptlbNYAzmryP5g8Pov5Oi3JI9rwycQPzthxHxhU7tT/K5kYli5dOD8bPYb59p/HRf/DSva71m/xafP4FcoN88zvqf653uvzQu5q+d7/+RvIc6vnb/t3Oo/0t3+7+BLv3fxaPG+OQP3+9a9zDiS4Od4ie78ZMu8T86Yvy/fPmrH3ara/4q4lIU8ZPYF39vrMn1+srk2ubWx4v12YXqQnW5UpmZnpm6euXTymQ+Rz3Znqk+7B/XLr/zsvaPRuf2j3Rv/0h27BtHbP+v/3fnx197Sfxvfb3z+/9e9/j5mPjNI8afHf1tx+W72/HnO7e/OKf7+3/50NUudIzx5G9b80dMFQA4A2ubW0uztVp19Xzt3C0e+F6XfPbtDPUgsYhsZ7jnbbeT7WT/A07iOu+fYqq97pmA0/bipu91JgAAAAAAAAAAAAAAQDdn8QtPvW4jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA59f/AwAA//+ew88F") r1 = openat(0xffffffffffffff9c, &(0x7f0000001040)='./file1\x00', 0x42, 0x5) fallocate(r1, 0x8, 0x4000, 0x4000) 1.206932717s ago: executing program 9 (id=381): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x22401, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000140)="ea0d00b0000f229464670fc79c8100800000ba6100ecbaf80c66b8ecb1048566efbafc0c66b8106d7dd166eff0867dc5decb66b9800000c00f326635000100000f30ea0000e50066b8010000000f01d9", 0x50}], 0x1, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0xe55493bfbe236ced, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.113027487s ago: executing program 8 (id=383): r0 = syz_io_uring_setup(0xd3a, &(0x7f0000000080)={0x0, 0x2, 0x3010, 0x3, 0x3}, &(0x7f0000000000)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_modify_offsets$generic(r1, r2, 0x2c, 0x8) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000440)={0x2e, 0xa, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000400)=@any_dev={0x3, 0x127, 0x0, 0x0, 0x1000, 0x1d6, 0xffffffffffffffff, 0x0, 0xa}}}, 0x0) r4 = eventfd2(0x1, 0x0) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000200)=r4, 0x1) io_uring_enter(r0, 0x6516, 0x6d93, 0x8, 0x0, 0x0) 1.016416457s ago: executing program 8 (id=385): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x800, 0x0) close(0x4) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) 967.382552ms ago: executing program 6 (id=387): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x5, 0x0, 0x0}, 0x94) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000003000/0x1000)=nil) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000651000/0x400000)=nil) madvise(&(0x7f000042f000/0x800000)=nil, 0x80fd00, 0x15) 935.459685ms ago: executing program 6 (id=388): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000000)={{r0, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000480)='%-5lx \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x18, &(0x7f0000000640)=@framed={{}, [@printk={@lld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffffffd}, {0x85, 0x0, 0x0, 0x71}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x54}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0x10, 0x10, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000000080)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) 913.066857ms ago: executing program 6 (id=389): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2004c010}, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x482, 0x0) write$binfmt_aout(r0, &(0x7f0000000240)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000300)={0x0, 0x40000000, 0x0, 0x0, 0x6, "000000000600000000ff00"}) r1 = syz_open_pts(r0, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000340)) 911.783148ms ago: executing program 9 (id=390): r0 = fsopen(&(0x7f0000001ac0)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0xa) fchdir(r1) r2 = open(&(0x7f0000003000)='.\x00', 0x8000, 0x50) getdents(r2, &(0x7f0000003040)=""/184, 0xb8) 896.926879ms ago: executing program 9 (id=391): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x20008044}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/thread-self/fail-nth\x00', 0x2, 0x101) write(r0, &(0x7f0000000000)='3', 0x4e) syz_open_dev$usbmon(&(0x7f0000000100), 0x2, 0x80c00) 532.429606ms ago: executing program 9 (id=392): unshare(0x24060400) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000f80)='cpu.stat\x00', 0x275a, 0x0) syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000c00000/0x400000)=nil) r1 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000b510f210950b2a7773820102030109022400010000000009042200028953950009050a02ff0300fa000905820250"], 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) 532.045006ms ago: executing program 8 (id=393): r0 = syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c00020100e0000904000001020d0000052406000105240000800d240f0101010000000000000006241a0000150905811608003600000904010000020d00000904010102020d000009058202"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000001940)={0x44, 0x0, 0x0, 0x0, &(0x7f00000019c0)={0x20, 0x80, 0x1c, {0x10, 0x10, 0xc0000, 0x10, 0x4, 0x10, 0x2, 0x411, 0x2, 0x10, 0x5, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 115.192598ms ago: executing program 5 (id=397): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x12, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000010000000000000000000000711206000000000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000400)={r0, r2, 0x1d, 0x0, @void}, 0x10) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000440)={r3, r0, 0x4, r1}, 0x10) 104.745659ms ago: executing program 5 (id=398): r0 = socket(0x200000000000011, 0x2, 0xd) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000a40)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x6, 0xc, &(0x7f0000000b80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000c00)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000d00)={r3, r1, 0x25, 0x2, @val=@netfilter={0x0, 0x3, 0x2018}}, 0x20) syz_emit_ethernet(0x2a, &(0x7f0000000d40)={@multicast, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x4002, 0x5, 0x11, 0x0, @empty, @empty}, {0x4e24, 0x0, 0x8}}}}}, 0x0) 73.942273ms ago: executing program 5 (id=399): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0b000000080000000c0000000000008001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280), &(0x7f00000002c0), 0x5, r0}, 0x38) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x19, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}]}, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000640)={r2}, 0xc) 72.825762ms ago: executing program 6 (id=400): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0) 66.303903ms ago: executing program 5 (id=401): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) fspick(0xffffffffffffff9c, 0x0, 0x0) 54.190465ms ago: executing program 5 (id=402): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="1809000000ffffff00000000000000008510000002000000850000000f0000009500000000000000"], 0x0, 0xfffffdff, 0x0, 0x0, 0x727c45cd4283345, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) 1.4457ms ago: executing program 6 (id=403): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setuid(0xee01) sendmmsg$unix(r0, &(0x7f00000254c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x408a0}}, {{&(0x7f0000001580)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x40042}}], 0x2, 0x40) 1.11408ms ago: executing program 5 (id=404): syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f00000000c0)='./bus\x00', 0x1001a, &(0x7f0000000200)={[{@test_dummy_encryption}, {@nojournal_checksum}, {@nogrpid}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@dioread_nolock}, {@jqfmt_vfsv1}, {@test_dummy_encryption}, {@nodioread_nolock}]}, 0xff, 0x44f, &(0x7f0000000540)="$eJzs3MtvG8UfAPDvrp206eOX/Ep59AEECiLikTRpgR4QEggkLkhIcCjHkKRVqdugJki0qqAgxBVV4o44IvEXcIILAk5IiBt/AKpUoV5aOBmtvdvYjp3WqV0H/PlIG8/sjDPz9e7YsztxAhhak9mPJGJXRPweEeP1bHOFyfrDjWsXF/66dnEhiWr1zT+TWr3r1y4uFFWL5+3MM1NpRPppEgfatLty/sLp+Upl6VyeL+ePz5w6M39y6eTS2bljx44emX3+ublnNxvaQ42ZrE/X93+4fHDfa29ffn3h+OV3fvomKeJviaNHJl/coPDxarXHzQ3W7oZ0Uh5gR+hKKR97I7XxPx6lWDt44/HqJwPtHNBX1Wq1urNz8aUq8B+WxKB7AAxG8UGfXf8W212aemwJV1+qXwBlcd/It3pJOdK8zkjL9W0vTUbE8Ut/f5lt0Z/7EAAATb7L5j9Pt5v/pXFfQ73/5WtDExHx/4jYExH3RMTeiLg3olb3/oh4oMv2J1vy6+c/6ZVNBXabsvnfC/naVvP8r5j9xUQpz+2uxT+SnDhVWTqcvyZTMbIty89u0Mb3r/z6eaeyxvlftmXtF3PBvB9Xytuan7M4vzp/JzE3uvpxxP5yc/xjtZLk5kpAEhH7ImL/Jts49eTXBzuV3Tr+DfRgnan6VcQT9eN/KZqO/9oqaJaaWT3z3szK+Qtt1idntkdl6fBMcVas9/Mvn73Rqf07ir8HsuO/o+35fzP+iaRxvXalu9+/7Rblmz3/R5O3aunRfN8H86ur52YjRk83nBSlfP/c2q4iX9TP4p861H7874m1V+JARGQn8YP5wvLDed8fiYhHI+LQBjH++PJj724+/v7K4l/s6vivJUajdU/7ROn0D9/G9oZGJ7qJPzv+R2upqXxPh/e/3xozt9Ov7s9mAAAA+HdKI2JXJOn0zXSaTk/X/15+b+xIK8srq0+dWH7/7GL9OwITMZIWd7rGG+6HzuaX9UV+riV/JL9v/EVprJafXliuLA46eBhyOzuM/8wfpUH3Dug739eC4WX8w/Ay/mF4Gf8wvNqM/7FB9AO4+9p9/n80gH4Ad1/L+LfsB0PE9T8ML+MfhpfxD0NpZSxu/SV5CYl1iUi3RDf6mEjKW6IbfU1E/t9/1xcN+p0JAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgN/4JAAD//wUA5Iw=") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f000000af40)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f000000af80), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 0s ago: executing program 6 (id=405): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000006c0)={0x0, 'bridge0\x00', {0x101}, 0x2}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000900006440000008001b00000000000500100004"], 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newqdisc={0x54, 0x10, 0x1, 0x70bd25, 0x25dfdbfc, {0x6, 0x0, 0x8100, 0x0, {0x1, 0x10}, {0xfff1}, {0xe, 0x10}}, [@TCA_RATE={0x6, 0x5, {0xfc}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x400c800}, 0x0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 14.323399][ T28] kauditd_printk_skb: 48 callbacks suppressed [ 14.323412][ T28] audit: type=1400 audit(1793634065.776:59): avc: denied { transition } for pid=225 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.327419][ T28] audit: type=1400 audit(1793634065.776:60): avc: denied { noatsecure } for pid=225 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.330151][ T28] audit: type=1400 audit(1793634065.776:61): avc: denied { write } for pid=225 comm="sh" path="pipe:[8112]" dev="pipefs" ino=8112 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.333858][ T28] audit: type=1400 audit(1793634065.776:62): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.336547][ T28] audit: type=1400 audit(1793634065.776:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.59' (ED25519) to the list of known hosts. [ 21.104462][ T28] audit: type=1400 audit(1793634072.556:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.105529][ T279] cgroup: Unknown subsys name 'net' [ 21.127226][ T28] audit: type=1400 audit(1793634072.556:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.154493][ T28] audit: type=1400 audit(1793634072.586:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.154651][ T279] cgroup: Unknown subsys name 'devices' [ 21.302471][ T279] cgroup: Unknown subsys name 'hugetlb' [ 21.308079][ T279] cgroup: Unknown subsys name 'rlimit' [ 21.410129][ T28] audit: type=1400 audit(1793634072.856:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.433297][ T28] audit: type=1400 audit(1793634072.856:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.448360][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.458165][ T28] audit: type=1400 audit(1793634072.856:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.489655][ T28] audit: type=1400 audit(1793634072.916:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.490568][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.515090][ T28] audit: type=1400 audit(1793634072.916:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.549336][ T28] audit: type=1400 audit(1793634072.946:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.574862][ T28] audit: type=1400 audit(1793634072.946:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.304344][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.312014][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.319585][ T287] device bridge_slave_0 entered promiscuous mode [ 22.326695][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.333751][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.341206][ T287] device bridge_slave_1 entered promiscuous mode [ 22.375565][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.382683][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.390103][ T288] device bridge_slave_0 entered promiscuous mode [ 22.398155][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.405249][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.412698][ T288] device bridge_slave_1 entered promiscuous mode [ 22.483390][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.490523][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.497925][ T290] device bridge_slave_0 entered promiscuous mode [ 22.506809][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.513903][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.521368][ T290] device bridge_slave_1 entered promiscuous mode [ 22.552130][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.559177][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.566873][ T289] device bridge_slave_0 entered promiscuous mode [ 22.601874][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.608915][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.616394][ T289] device bridge_slave_1 entered promiscuous mode [ 22.659311][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.666435][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.673859][ T291] device bridge_slave_0 entered promiscuous mode [ 22.681021][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.688040][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.695619][ T291] device bridge_slave_1 entered promiscuous mode [ 22.719300][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.726354][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.733683][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.740702][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.792089][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.799132][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.806410][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.813440][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.866533][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.873904][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.881218][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.888411][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.897859][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.905280][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.934741][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.942355][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.950445][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.957471][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.966538][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.974784][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.981806][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.006330][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.014494][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.021521][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.028997][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.037609][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.044646][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.052006][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.084137][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.092702][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.100578][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.108160][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.116055][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.124010][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.132061][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.151819][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.159749][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.167991][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.175014][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.182442][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.190618][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.197653][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.206243][ T288] device veth0_vlan entered promiscuous mode [ 23.219250][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.227077][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.234534][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.243369][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.250462][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.258190][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.266327][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.273354][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.280800][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.296053][ T288] device veth1_macvtap entered promiscuous mode [ 23.303729][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.319243][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.327702][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.335931][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.344297][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.352447][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.360460][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.368018][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.384185][ T287] device veth0_vlan entered promiscuous mode [ 23.393985][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.402225][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.410439][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.418750][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.426879][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.435317][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.450511][ T287] device veth1_macvtap entered promiscuous mode [ 23.460587][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.468922][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.477072][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.485385][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.493679][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.509728][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.517423][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.533200][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.541765][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.550020][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.558448][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.567006][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.575308][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.583840][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.592316][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.600403][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.607459][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.614859][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.623244][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.631606][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.639857][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.648261][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.655350][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.662839][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.678266][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.686470][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.686777][ T288] request_module fs-gadgetfs succeeded, but still no fs? [ 23.703765][ T289] device veth0_vlan entered promiscuous mode [ 23.713904][ T290] device veth0_vlan entered promiscuous mode [ 23.720263][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.728554][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.736065][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.744108][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.752297][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.760371][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.768462][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.776574][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.786500][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.794165][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.815396][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.825510][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.833974][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.842479][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.852122][ T290] device veth1_macvtap entered promiscuous mode [ 23.867989][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.876096][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.884901][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.893546][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.901926][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.910191][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.918715][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.928400][ T289] device veth1_macvtap entered promiscuous mode [ 23.939210][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.947457][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.959361][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.967056][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.976109][ T291] device veth0_vlan entered promiscuous mode [ 24.001594][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.005263][ T322] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.010039][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.035991][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.057324][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.075765][ T291] device veth1_macvtap entered promiscuous mode [ 24.096503][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.105102][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.116735][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.138143][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.147323][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.156392][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.166582][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.298833][ T345] syz.4.13 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 24.397015][ T359] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=3835797286 (7671594572 ns) > initial count (4918772610 ns). Using initial count to start timer. [ 24.464690][ T355] loop3: detected capacity change from 0 to 40427 [ 24.472892][ T355] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 24.480646][ T355] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 24.480875][ T60] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 24.493901][ T355] F2FS-fs (loop3): invalid crc value [ 24.519283][ T355] F2FS-fs (loop3): Found nat_bits in checkpoint [ 24.542031][ T355] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 24.549210][ T355] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 24.680831][ T60] usb 3-1: Using ep0 maxpacket: 8 [ 24.687155][ T60] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 24.697785][ T60] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 24.706845][ T60] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 24.720117][ T60] usb 3-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 24.729385][ T60] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.737474][ T60] usb 3-1: Product: syz [ 24.741830][ T60] usb 3-1: Manufacturer: syz [ 24.746637][ T60] usb 3-1: SerialNumber: syz [ 24.760452][ T308] kworker/u4:3: attempt to access beyond end of device [ 24.760452][ T308] loop3: rw=1, sector=77824, nr_sectors = 4096 limit=40427 [ 24.783142][ T308] kworker/u4:3: attempt to access beyond end of device [ 24.783142][ T308] loop3: rw=1, sector=49152, nr_sectors = 4096 limit=40427 [ 24.824703][ T308] kworker/u4:3: attempt to access beyond end of device [ 24.824703][ T308] loop3: rw=1, sector=57344, nr_sectors = 12288 limit=40427 [ 24.843278][ T308] kworker/u4:3: attempt to access beyond end of device [ 24.843278][ T308] loop3: rw=1, sector=69632, nr_sectors = 8 limit=40427 [ 24.857016][ T308] kworker/u4:3: attempt to access beyond end of device [ 24.857016][ T308] loop3: rw=1, sector=69640, nr_sectors = 8 limit=40427 [ 24.870833][ T308] kworker/u4:3: attempt to access beyond end of device [ 24.870833][ T308] loop3: rw=1, sector=69648, nr_sectors = 8 limit=40427 [ 24.885022][ T308] kworker/u4:3: attempt to access beyond end of device [ 24.885022][ T308] loop3: rw=1, sector=69656, nr_sectors = 8 limit=40427 [ 24.899077][ T308] kworker/u4:3: attempt to access beyond end of device [ 24.899077][ T308] loop3: rw=1, sector=69664, nr_sectors = 8 limit=40427 [ 24.913323][ T308] kworker/u4:3: attempt to access beyond end of device [ 24.913323][ T308] loop3: rw=1, sector=69672, nr_sectors = 8 limit=40427 [ 24.927080][ T308] kworker/u4:3: attempt to access beyond end of device [ 24.927080][ T308] loop3: rw=1, sector=69680, nr_sectors = 8 limit=40427 [ 24.940825][ T40] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 25.122986][ T40] usb 5-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 25.134278][ T40] usb 5-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 25.148133][ T40] usb 5-1: Product: syz [ 25.154542][ T40] usb 5-1: Manufacturer: syz [ 25.165882][ T40] usb 5-1: Found UVC 1.00 device syz (225a:e1d4) [ 25.359929][ T60] usb 3-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 25.379750][ T40] usb 5-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 25.396748][ T60] usb 3-1: clock source 0 is not valid, cannot use [ 25.405836][ T40] uvcvideo 5-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 25.424103][ T40] uvcvideo 5-1:1.1: Failed to initialize the device (-5). [ 25.433954][ T40] usb 5-1: USB disconnect, device number 2 [ 25.632985][ T60] usb 3-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 25.664644][ T60] usb 3-1: USB disconnect, device number 2 [ 25.720885][ T380] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 25.920939][ T380] usb 2-1: Using ep0 maxpacket: 16 [ 25.927537][ T380] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 25.937830][ T380] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.948748][ T380] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 25.958496][ T380] usb 2-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 25.971343][ T380] usb 2-1: config 0 interface 0 has no altsetting 0 [ 25.977936][ T380] usb 2-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 25.986972][ T380] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.995736][ T380] usb 2-1: config 0 descriptor?? [ 26.139821][ T28] kauditd_printk_skb: 76 callbacks suppressed [ 26.139844][ T28] audit: type=1400 audit(1793634077.586:150): avc: denied { unmount } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 26.165947][ T301] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 26.194862][ T414] loop4: detected capacity change from 0 to 1024 [ 26.218363][ T414] EXT4-fs: Ignoring removed mblk_io_submit option [ 26.249547][ T28] audit: type=1400 audit(1793634077.696:151): avc: denied { mounton } for pid=418 comm="syz.2.38" path="/2/file0" dev="tmpfs" ino=28 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 26.273776][ T414] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 26.288320][ T28] audit: type=1400 audit(1793634077.736:152): avc: denied { setattr } for pid=413 comm="syz.4.36" name="file0" dev="loop4" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 26.331500][ T290] EXT4-fs (loop4): unmounting filesystem. [ 26.357499][ T28] audit: type=1400 audit(1793634077.776:153): avc: denied { write } for pid=413 comm="syz.4.36" name="file0" dev="loop4" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 26.371888][ T301] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.380804][ T28] audit: type=1400 audit(1793634077.776:154): avc: denied { open } for pid=413 comm="syz.4.36" path="/10/file0/file0/file0" dev="loop4" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 26.412904][ T301] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 26.417590][ T380] logitech-djreceiver 0003:046D:C53A.0001: hiddev96,hidraw0: USB HID vff.fc Device [HID 046d:c53a] on usb-dummy_hcd.1-1/input0 [ 26.435367][ T28] audit: type=1400 audit(1793634077.776:155): avc: denied { setopt } for pid=425 comm="syz.3.40" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 26.435829][ T301] usb 1-1: New USB device found, idVendor=08b7, idProduct=ec00, bcdDevice= 0.00 [ 26.455251][ T28] audit: type=1400 audit(1793634077.806:156): avc: denied { map } for pid=427 comm="syz.4.41" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=17571 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 26.494616][ T28] audit: type=1400 audit(1793634077.806:157): avc: denied { write } for pid=427 comm="syz.4.41" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=17571 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 26.504024][ T301] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 26.538800][ T301] usb 1-1: SerialNumber: syz [ 26.543500][ T424] loop2: detected capacity change from 0 to 40427 [ 26.553438][ T424] F2FS-fs (loop2): Invalid SB checksum offset: 0 [ 26.564718][ T424] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 26.583618][ T424] F2FS-fs (loop2): invalid crc value [ 26.597305][ T424] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 26.622759][ T424] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0 [ 26.629820][ T424] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 26.637680][ T309] usb 2-1: USB disconnect, device number 2 [ 26.662505][ T444] loop4: detected capacity change from 0 to 512 [ 26.668800][ T28] audit: type=1400 audit(1793634078.116:158): avc: denied { ioctl } for pid=423 comm="syz.2.39" path="/3/file1/file1" dev="loop2" ino=10 ioctlcmd=0xf501 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 26.692927][ T28] audit: type=1400 audit(1793634078.116:159): avc: denied { remove_name } for pid=423 comm="syz.2.39" name="file1" dev="loop2" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 26.765425][ T301] usb 1-1: 0:2 : does not exist [ 26.779058][ T301] usb 1-1: USB disconnect, device number 2 [ 27.050803][ T6] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 27.231862][ T6] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.242944][ T6] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.252943][ T6] usb 3-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 27.262225][ T6] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.274497][ T6] usb 3-1: config 0 descriptor?? [ 27.556520][ T464] loop3: detected capacity change from 0 to 4096 [ 27.599259][ T464] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 27.630322][ T288] EXT4-fs (loop3): unmounting filesystem. [ 27.660119][ T475] loop3: detected capacity change from 0 to 128 [ 27.669882][ T475] FAT-fs (loop3): Unrecognized mount option "dos1xfìoppy" or missing value [ 27.676702][ T479] FAULT_INJECTION: forcing a failure. [ 27.676702][ T479] name failslab, interval 1, probability 0, space 0, times 1 [ 27.691386][ T479] CPU: 1 PID: 479 Comm: syz.4.58 Not tainted syzkaller #0 [ 27.692787][ T6] hid-steam 0003:28DE:1142.0002: item fetching failed at offset 4/5 [ 27.698510][ T479] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 27.707669][ T6] hid-steam 0003:28DE:1142.0002: steam_probe:parse of hid interface failed [ 27.716524][ T479] Call Trace: [ 27.716534][ T479] [ 27.716542][ T479] __dump_stack+0x21/0x24 [ 27.716575][ T479] dump_stack_lvl+0x110/0x170 [ 27.725284][ T6] hid-steam: probe of 0003:28DE:1142.0002 failed with error -22 [ 27.728415][ T479] ? __cfi_dump_stack_lvl+0x8/0x8 [ 27.728442][ T479] dump_stack+0x15/0x24 [ 27.757030][ T479] should_fail_ex+0x3bf/0x510 [ 27.761707][ T479] ? __alloc_file+0x28/0x2a0 [ 27.766289][ T479] __should_failslab+0xac/0xf0 [ 27.771040][ T479] should_failslab+0x9/0x20 [ 27.775532][ T479] kmem_cache_alloc+0x3b/0x320 [ 27.780281][ T479] ? __cfi__raw_spin_lock+0x10/0x10 [ 27.785466][ T479] __alloc_file+0x28/0x2a0 [ 27.789876][ T479] alloc_empty_file+0x97/0x180 [ 27.794626][ T479] alloc_file+0x59/0x600 [ 27.798855][ T479] ? _raw_spin_unlock+0x4c/0x70 [ 27.803702][ T479] alloc_file_pseudo+0x180/0x200 [ 27.808630][ T479] ? __cfi_alloc_file_pseudo+0x10/0x10 [ 27.814073][ T479] ? alloc_fd+0x4c1/0x570 [ 27.818391][ T479] anon_inode_getfd+0xd6/0x1d0 [ 27.823145][ T479] btf_new_fd+0x605/0x7a0 [ 27.827462][ T479] bpf_btf_load+0x6f/0x90 [ 27.831774][ T479] __sys_bpf+0x5d5/0x850 [ 27.836000][ T479] ? bpf_link_show_fdinfo+0x330/0x330 [ 27.841359][ T479] ? tick_program_event+0xa3/0x120 [ 27.846469][ T479] ? handle_softirqs+0x541/0x5f0 [ 27.851398][ T479] __x64_sys_bpf+0x7c/0x90 [ 27.855799][ T479] x64_sys_call+0x488/0x9a0 [ 27.860289][ T479] do_syscall_64+0x4c/0xa0 [ 27.864690][ T479] ? clear_bhb_loop+0x30/0x80 [ 27.869354][ T479] ? clear_bhb_loop+0x30/0x80 [ 27.874022][ T479] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.879900][ T479] RIP: 0033:0x7fd29539fb19 [ 27.884320][ T479] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.903906][ T479] RSP: 002b:00007fd29635b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 27.912313][ T479] RAX: ffffffffffffffda RBX: 00007fd295625fa0 RCX: 00007fd29539fb19 [ 27.920273][ T479] RDX: 0000000000000028 RSI: 00002000000000c0 RDI: 0000000000000012 [ 27.928226][ T479] RBP: 00007fd295437af8 R08: 0000000000000000 R09: 0000000000000000 [ 27.936178][ T479] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.944144][ T479] R13: 00007fd295626038 R14: 00007fd295625fa0 R15: 00007ffe37d05ca8 [ 27.952111][ T479] [ 28.044310][ T380] usb 3-1: USB disconnect, device number 3 [ 28.058119][ T492] process 'syz.0.62' launched './file1' with NULL argv: empty string added [ 28.066996][ T493] Driver unsupported XDP return value 0 on prog (id 7) dev N/A, expect packet loss! [ 28.135407][ T499] loop0: detected capacity change from 0 to 512 [ 28.147849][ T499] ======================================================= [ 28.147849][ T499] WARNING: The mand mount option has been deprecated and [ 28.147849][ T499] and is ignored by this kernel. Remove the mand [ 28.147849][ T499] option from the mount to silence this warning. [ 28.147849][ T499] ======================================================= [ 28.212798][ T502] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 28.225369][ T502] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 28.227195][ T504] loop4: detected capacity change from 0 to 1024 [ 28.252720][ T502] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 28.297696][ T500] x86/PAT: syz.3.67:500 freeing invalid memtype [mem 0xfe004000-0xfe004fff] [ 28.301887][ T504] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 28.430818][ T515] loop1: detected capacity change from 0 to 1024 [ 28.431686][ T504] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 28.480082][ T515] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 28.497971][ T515] ext4 filesystem being mounted at /15/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 28.540000][ T515] EXT4-fs error (device loop1): ext4_map_blocks:747: inode #15: block 3: comm syz.1.75: lblock 3 mapped to illegal pblock 3 (length 3) [ 28.567020][ T290] EXT4-fs (loop4): unmounting filesystem. [ 28.579441][ T515] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 28.595540][ T524] loop0: detected capacity change from 0 to 1024 [ 28.596580][ T515] EXT4-fs (loop1): This should not happen!! Data will be lost [ 28.596580][ T515] [ 28.614546][ T524] EXT4-fs: Ignoring removed orlov option [ 28.654837][ T525] EXT4-fs error (device loop1): ext4_map_blocks:637: inode #15: block 3: comm syz.1.75: lblock 3 mapped to illegal pblock 3 (length 1) [ 28.682502][ T524] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 28.718329][ T480] EXT4-fs error (device loop1): ext4_map_blocks:747: inode #15: block 8: comm kworker/u4:4: lblock 8 mapped to illegal pblock 8 (length 8) [ 28.750817][ T480] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 28.758452][ T536] WARNING! power/level is deprecated; use power/control instead [ 28.770785][ T480] EXT4-fs (loop1): This should not happen!! Data will be lost [ 28.770785][ T480] [ 28.789242][ T287] EXT4-fs (loop1): unmounting filesystem. [ 28.796092][ T289] EXT4-fs warning (device loop0): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 28.850989][ T289] EXT4-fs warning (device loop0): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 28.865022][ T289] EXT4-fs warning (device loop0): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 28.883949][ T289] EXT4-fs warning (device loop0): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 28.906940][ T289] EXT4-fs warning (device loop0): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 28.926586][ T289] EXT4-fs warning (device loop0): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 28.945968][ T289] EXT4-fs warning (device loop0): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 28.961140][ T289] EXT4-fs warning (device loop0): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 28.974673][ T289] EXT4-fs warning (device loop0): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 28.995553][ T289] EXT4-fs warning (device loop0): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 29.140185][ T289] EXT4-fs (loop0): unmounting filesystem. [ 29.152491][ T531] Buffer I/O error on dev loop0, logical block 64, lost sync page write [ 29.298847][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 29.327938][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 29.346872][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 29.375660][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 29.389281][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 29.399751][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 29.409192][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 29.417634][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 29.426162][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 29.513052][ T568] syz.2.97 (568) used greatest stack depth: 21984 bytes left [ 29.535777][ T577] set_capacity_and_notify: 1 callbacks suppressed [ 29.535792][ T577] loop2: detected capacity change from 0 to 128 [ 29.588350][ T577] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a802c018, mo2=0002] [ 29.599293][ T577] System zones: 1-3, 19-19, 35-36 [ 29.621185][ T577] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 29.632788][ T577] ext4 filesystem being mounted at /16/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 29.643292][ T569] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.653816][ T569] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.663165][ T577] futex_wake_op: syz.2.100 tries to shift op by 144; fix this program [ 29.666935][ T569] device bridge_slave_0 entered promiscuous mode [ 29.681035][ T577] futex_wake_op: syz.2.100 tries to shift op by 144; fix this program [ 29.698017][ T577] EXT4-fs warning (device loop2): ext4_group_extend:1894: will only finish group (8193 blocks, 8129 new) [ 29.713010][ T569] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.720160][ T569] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.734651][ T577] EXT4-fs warning (device loop2): ext4_group_extend:1899: can't read last block, resize aborted [ 29.746830][ T569] device bridge_slave_1 entered promiscuous mode [ 29.771586][ T291] EXT4-fs (loop2): unmounting filesystem. [ 29.777159][ T588] loop4: detected capacity change from 0 to 1024 [ 29.786868][ T588] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 29.801233][ T590] overlayfs: failed to set xattr on upper [ 29.821458][ T588] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 29.834127][ T308] device bridge_slave_1 left promiscuous mode [ 29.840320][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.847906][ T308] device bridge_slave_0 left promiscuous mode [ 29.854138][ T308] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.862390][ T308] device veth1_macvtap left promiscuous mode [ 29.868428][ T308] device veth0_vlan left promiscuous mode [ 29.904597][ T290] EXT4-fs (loop4): unmounting filesystem. [ 30.077301][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 30.085037][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.094143][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.104741][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.113444][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.120481][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.128343][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 30.158965][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.169447][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.177657][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.184700][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.192686][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.200680][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.221446][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.230061][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.239270][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.247380][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.255245][ T569] device veth0_vlan entered promiscuous mode [ 30.270945][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.280524][ T569] device veth1_macvtap entered promiscuous mode [ 30.292330][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.304412][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.537540][ T633] loop4: detected capacity change from 0 to 128 [ 30.573195][ T633] incfs: ino conflict with backing FS 1 [ 30.593421][ T290] FAT-fs (loop4): error, invalid access to FAT (entry 0xffff0000) [ 30.608956][ T290] FAT-fs (loop4): Filesystem has been set read-only [ 30.622392][ T290] FAT-fs (loop4): error, corrupted directory (invalid entries) [ 30.637741][ T290] FAT-fs (loop4): error, corrupted directory (invalid entries) [ 30.822151][ T648] loop1: detected capacity change from 0 to 128 [ 30.940798][ T6] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 31.010941][ T654] loop1: detected capacity change from 0 to 2048 [ 31.051057][ T654] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 31.079467][ T650] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.120788][ T650] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.130795][ T6] usb 3-1: Using ep0 maxpacket: 32 [ 31.137038][ T6] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 31.141210][ T650] device bridge_slave_0 entered promiscuous mode [ 31.158092][ T6] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 31.178266][ T6] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 31.182598][ T650] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.210800][ T6] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.220968][ T650] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.228438][ T650] device bridge_slave_1 entered promiscuous mode [ 31.232135][ T6] usb 3-1: config 0 descriptor?? [ 31.385282][ T650] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.392364][ T650] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.399654][ T650] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.406728][ T650] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.502667][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 31.521194][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.551307][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.593102][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.601668][ T646] loop5: detected capacity change from 0 to 131072 [ 31.618403][ T646] F2FS-fs (loop5): Invalid segment/section count (458783, 24 x 150994945) [ 31.628964][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.636033][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.643762][ T6] savu 0003:1E7D:2D5A.0003: hiddev96,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 31.665281][ T646] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 31.691663][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.706451][ T646] F2FS-fs (loop5): invalid crc value [ 31.713400][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.720438][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.729608][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.745676][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 31.754397][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 31.762994][ T646] F2FS-fs (loop5): Found nat_bits in checkpoint [ 31.784118][ T308] device bridge_slave_1 left promiscuous mode [ 31.790266][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.816484][ T308] device bridge_slave_0 left promiscuous mode [ 31.832092][ T308] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.839603][ T646] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 31.859802][ T646] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e4 [ 31.868690][ T308] device veth1_macvtap left promiscuous mode [ 31.884914][ T308] device veth0_vlan left promiscuous mode [ 31.913303][ T301] usb 3-1: USB disconnect, device number 4 [ 32.137474][ T650] device veth0_vlan entered promiscuous mode [ 32.144307][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 32.156646][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.165043][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 32.173014][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.181225][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.188743][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.215231][ T650] device veth1_macvtap entered promiscuous mode [ 32.222240][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 32.230581][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.239229][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 32.268736][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 32.291525][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 32.299899][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 32.320187][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 32.383199][ T669] loop6: detected capacity change from 0 to 512 [ 32.410851][ T669] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 32.450656][ T669] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 32.472160][ T669] EXT4-fs (loop6): 1 truncate cleaned up [ 32.488072][ T669] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 32.497381][ T287] EXT4-fs (loop1): unmounting filesystem. [ 32.532896][ T650] EXT4-fs (loop6): unmounting filesystem. [ 32.546853][ T287] syz-executor (287) used greatest stack depth: 21920 bytes left [ 32.566394][ T28] kauditd_printk_skb: 90 callbacks suppressed [ 32.566407][ T28] audit: type=1400 audit(1793634084.016:250): avc: denied { mounton } for pid=675 comm="syz.6.135" path="/1/file0" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 32.706272][ T679] loop6: detected capacity change from 0 to 512 [ 32.774716][ T679] EXT4-fs error (device loop6): ext4_orphan_get:1405: inode #15: comm syz.6.138: iget: bad i_size value: 38620345925642 [ 32.822356][ T679] EXT4-fs error (device loop6): ext4_orphan_get:1410: comm syz.6.138: couldn't read orphan inode 15 (err -117) [ 32.864959][ T679] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 32.897212][ T28] audit: type=1400 audit(1793634084.346:251): avc: denied { setattr } for pid=678 comm="syz.6.138" name="file0" dev="loop6" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 32.914276][ T684] loop5: detected capacity change from 0 to 40427 [ 32.928136][ T679] Invalid argument reading file caps for ./file0 [ 32.928411][ T684] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 32.942667][ T684] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 32.951972][ T684] F2FS-fs (loop5): invalid crc value [ 32.957567][ T28] audit: type=1400 audit(1793634084.376:252): avc: denied { execute } for pid=678 comm="syz.6.138" name="file0" dev="loop6" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 32.984623][ T684] F2FS-fs (loop5): Found nat_bits in checkpoint [ 32.992161][ T480] EXT4-fs error (device loop6): ext4_validate_block_bitmap:429: comm kworker/u4:4: bg 0: block 5: invalid block bitmap [ 33.015819][ T28] audit: type=1400 audit(1793634084.376:253): avc: denied { execute_no_trans } for pid=678 comm="syz.6.138" path="/2/file0/file0" dev="loop6" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 33.039389][ T480] EXT4-fs (loop6): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28 [ 33.066210][ T480] EXT4-fs (loop6): This should not happen!! Data will be lost [ 33.066210][ T480] [ 33.080533][ T480] EXT4-fs (loop6): Total free blocks count 0 [ 33.086820][ T308] device bridge_slave_1 left promiscuous mode [ 33.093422][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.102402][ T684] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 33.109499][ T480] EXT4-fs (loop6): Free/Dirty block details [ 33.115781][ T684] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 33.123509][ T308] device bridge_slave_0 left promiscuous mode [ 33.123506][ T480] EXT4-fs (loop6): free_blocks=0 [ 33.123521][ T480] EXT4-fs (loop6): dirty_blocks=1 [ 33.140049][ T480] EXT4-fs (loop6): Block reservation details [ 33.146218][ T480] EXT4-fs (loop6): i_reserved_data_blocks=1 [ 33.151290][ T308] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.161816][ T650] EXT4-fs (loop6): unmounting filesystem. [ 33.168455][ T308] device veth1_macvtap left promiscuous mode [ 33.180832][ T308] device veth0_vlan left promiscuous mode [ 33.293619][ T28] audit: type=1400 audit(1793634084.746:254): avc: denied { mount } for pid=695 comm="syz.2.144" name="/" dev="ramfs" ino=19605 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 33.350831][ T28] audit: type=1400 audit(1793634084.786:255): avc: denied { read write } for pid=698 comm="syz.2.145" name="uinput" dev="devtmpfs" ino=262 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 33.384146][ T701] loop2: detected capacity change from 0 to 512 [ 33.404817][ T28] audit: type=1400 audit(1793634084.786:256): avc: denied { open } for pid=698 comm="syz.2.145" path="/dev/uinput" dev="devtmpfs" ino=262 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 33.432245][ T28] audit: type=1400 audit(1793634084.796:257): avc: denied { ioctl } for pid=698 comm="syz.2.145" path="/dev/uinput" dev="devtmpfs" ino=262 ioctlcmd=0x5564 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 33.497878][ T687] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.526655][ T694] F2FS-fs (loop6): invalid crc value [ 33.550297][ T687] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.572090][ T694] F2FS-fs (loop6): Found nat_bits in checkpoint [ 33.591170][ T687] device bridge_slave_0 entered promiscuous mode [ 33.598124][ T480] bio_check_eod: 63248 callbacks suppressed [ 33.598137][ T480] kworker/u4:4: attempt to access beyond end of device [ 33.598137][ T480] loop5: rw=1, sector=77824, nr_sectors = 4096 limit=40427 [ 33.630698][ T687] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.640722][ T480] kworker/u4:4: attempt to access beyond end of device [ 33.640722][ T480] loop5: rw=1, sector=49152, nr_sectors = 4096 limit=40427 [ 33.657973][ T687] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.665664][ T687] device bridge_slave_1 entered promiscuous mode [ 33.678736][ T694] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 33.679078][ T480] kworker/u4:4: attempt to access beyond end of device [ 33.679078][ T480] loop5: rw=1, sector=57344, nr_sectors = 2456 limit=40427 [ 33.783822][ T650] syz-executor: attempt to access beyond end of device [ 33.783822][ T650] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 33.962316][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 33.978060][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 33.991867][ T714] input: syz0 as /devices/virtual/input/input5 [ 34.001420][ T28] audit: type=1400 audit(1793634085.456:258): avc: denied { read } for pid=88 comm="acpid" name="event3" dev="devtmpfs" ino=652 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.025567][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 34.034257][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 34.042761][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.049825][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.051221][ T28] audit: type=1400 audit(1793634085.456:259): avc: denied { open } for pid=88 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=652 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.060202][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 34.101058][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 34.109256][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.116321][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.123856][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 34.132272][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 34.140321][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 34.177456][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 34.195702][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 34.204029][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 34.211700][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 34.219578][ T687] device veth0_vlan entered promiscuous mode [ 34.245692][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 34.259805][ T687] device veth1_macvtap entered promiscuous mode [ 34.272517][ T715] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.279550][ T715] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.287587][ T715] device bridge_slave_0 entered promiscuous mode [ 34.302440][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.316049][ T715] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.323222][ T715] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.330717][ T715] device bridge_slave_1 entered promiscuous mode [ 34.340710][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 34.405134][ T722] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 34.427316][ T722] ext4 filesystem being mounted at /10/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 34.463630][ T715] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.470706][ T715] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.478010][ T715] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.485069][ T715] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.511877][ T308] device bridge_slave_1 left promiscuous mode [ 34.518416][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.529602][ T308] device bridge_slave_0 left promiscuous mode [ 34.536361][ T308] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.537043][ T569] EXT4-fs (loop5): unmounting filesystem. [ 34.561799][ T308] device veth1_macvtap left promiscuous mode [ 34.567908][ T308] device veth0_vlan left promiscuous mode [ 34.789431][ T737] set_capacity_and_notify: 2 callbacks suppressed [ 34.789447][ T737] loop7: detected capacity change from 0 to 512 [ 34.833274][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.847127][ T737] EXT4-fs (loop7): Test dummy encryption mode enabled [ 34.857721][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.875935][ T737] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 34.891573][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 34.901034][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.916878][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 34.917389][ T737] EXT4-fs (loop7): 1 truncate cleaned up [ 34.925945][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 34.938938][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.945988][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.953402][ T737] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 34.961258][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 34.970843][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 34.979124][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.986183][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.004704][ T737] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 35.028010][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 35.037242][ T737] EXT4-fs (loop7): Online resizing not supported with sparse_super2 [ 35.051245][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 35.062438][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 35.070625][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 35.089465][ T687] EXT4-fs (loop7): unmounting filesystem. [ 35.119887][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 35.138011][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 35.162251][ T715] device veth0_vlan entered promiscuous mode [ 35.166838][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 35.179032][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 35.190441][ T715] device veth1_macvtap entered promiscuous mode [ 35.199282][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 35.207372][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 35.217391][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 35.227382][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 35.236079][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 35.250918][ T448] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 35.270855][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 35.279188][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 35.288415][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 35.296845][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 35.452493][ T448] usb 6-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 35.468891][ T448] usb 6-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 35.479048][ T448] usb 6-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 35.490007][ T448] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.521563][ T448] hub 6-1:4.0: USB hub found [ 35.546332][ T776] loop7: detected capacity change from 0 to 512 [ 35.568350][ T776] FAT-fs (loop7): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 35.706705][ T448] hub 6-1:4.0: 2 ports detected [ 35.712864][ T448] usb 6-1: selecting invalid altsetting 1 [ 35.718595][ T448] hub 6-1:4.0: Using single TT (err -22) [ 35.907045][ T448] hub 6-1:4.0: hub_hub_status failed (err = -71) [ 35.920215][ T448] hub 6-1:4.0: config failed, can't get hub status (err -71) [ 35.927680][ T790] loop7: detected capacity change from 0 to 512 [ 35.958073][ T790] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 35.968633][ T448] usb 6-1: USB disconnect, device number 2 [ 36.003395][ T790] EXT4-fs (loop7): 1 truncate cleaned up [ 36.009166][ T790] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 36.220960][ T687] EXT4-fs (loop7): unmounting filesystem. [ 36.520915][ T830] loop6: detected capacity change from 0 to 128 [ 36.547486][ T830] FAT-fs (loop6): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 36.566150][ T830] FAT-fs (loop6): error, clusters badly computed (2 != 1) [ 36.573504][ T830] FAT-fs (loop6): Filesystem has been set read-only [ 36.586278][ T650] FAT-fs (loop6): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 36.608420][ T832] 9pnet: p9_errstr2errno: server reported unknown error õ€ÿ0xffffffffffffffff [ 36.688997][ T838] loop5: detected capacity change from 0 to 256 [ 36.771227][ T840] loop6: detected capacity change from 0 to 8192 [ 36.790649][ T840] FAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 37.109777][ T868] ip_tables: iptables: counters copy to user failed while replacing table [ 37.154927][ T872] loop8: detected capacity change from 0 to 128 [ 37.207628][ T874] SELinux: failed to load policy [ 37.224643][ T872] syz.8.210: attempt to access beyond end of device [ 37.224643][ T872] loop8: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 37.239092][ T872] Buffer I/O error on dev loop8, logical block 128, lost async page write [ 37.355586][ T879] capability: warning: `syz.5.213' uses 32-bit capabilities (legacy support in use) [ 37.404623][ T892] x86/PAT: syz.5.218:892 freeing invalid memtype [mem 0xfe408000-0xfe408fff] [ 37.428366][ T892] x86/PAT: syz.5.218:892 freeing invalid memtype [mem 0xfe000000-0xfe407fff] [ 37.449731][ T896] loop5: detected capacity change from 0 to 256 [ 37.519158][ T904] mmap: syz.5.223 (904): VmData 29134848 exceed data ulimit 2. Update limits or use boot option ignore_rlimit_data. [ 37.635023][ T28] kauditd_printk_skb: 21 callbacks suppressed [ 37.635037][ T28] audit: type=1400 audit(1793634090.083:281): avc: denied { mount } for pid=909 comm="syz.5.225" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 37.664214][ T910] overlayfs: upper fs does not support tmpfile. [ 37.670588][ T28] audit: type=1400 audit(1793634090.113:282): avc: denied { remount } for pid=909 comm="syz.5.225" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 37.696438][ T28] audit: type=1400 audit(1793634090.113:283): avc: denied { mounton } for pid=909 comm="syz.5.225" path="/30/file0/file0" dev="bpf" ino=20590 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=dir permissive=1 [ 37.719463][ T28] audit: type=1400 audit(1793634090.123:284): avc: denied { unmount } for pid=569 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 37.739891][ T28] audit: type=1400 audit(1793634090.193:285): avc: denied { bind } for pid=911 comm="syz.5.226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 38.037133][ T28] audit: type=1400 audit(1793634090.483:286): avc: denied { search } for pid=927 comm="syz.5.232" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 38.059197][ T28] audit: type=1400 audit(1793634090.483:287): avc: denied { write } for pid=927 comm="syz.5.232" name="inject" dev="tracefs" ino=1581 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 38.210858][ T28] audit: type=1400 audit(1793634090.653:288): avc: denied { bind } for pid=939 comm="syz.8.237" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 38.246810][ T943] loop8: detected capacity change from 0 to 256 [ 38.272723][ T943] FAT-fs (loop8): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 38.354294][ T945] loop7: detected capacity change from 0 to 1024 [ 38.379046][ T28] audit: type=1400 audit(1793634090.823:289): avc: denied { map } for pid=946 comm="syz.5.240" path="socket:[20426]" dev="sockfs" ino=20426 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 38.402993][ T945] EXT4-fs: Ignoring removed mblk_io_submit option [ 38.409465][ T945] EXT4-fs: Ignoring removed orlov option [ 38.415977][ T943] FAT-fs (loop8): error, corrupted file size (i_pos 196, 16779264) [ 38.430860][ T943] FAT-fs (loop8): Filesystem has been set read-only [ 38.437522][ T943] FAT-fs (loop8): error, corrupted file size (i_pos 196, 16779008) [ 38.450850][ T943] FAT-fs (loop8): error, corrupted file size (i_pos 196, 16779008) [ 38.501135][ T945] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 38.511881][ T28] audit: type=1400 audit(1793634090.963:290): avc: denied { watch watch_reads } for pid=944 comm="syz.7.239" path="/24/file0/file0" dev="loop7" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 38.622033][ T687] EXT4-fs (loop7): unmounting filesystem. [ 38.753272][ T978] using random self ethernet address [ 38.758611][ T978] using random host ethernet address [ 38.815234][ T982] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 38.815329][ T980] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 38.830543][ T989] FAULT_INJECTION: forcing a failure. [ 38.830543][ T989] name failslab, interval 1, probability 0, space 0, times 0 [ 38.845891][ T989] CPU: 1 PID: 989 Comm: syz.5.255 Not tainted syzkaller #0 [ 38.853092][ T989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 38.863146][ T989] Call Trace: [ 38.866425][ T989] [ 38.869357][ T989] __dump_stack+0x21/0x24 [ 38.873690][ T989] dump_stack_lvl+0x110/0x170 [ 38.878370][ T989] ? __cfi_dump_stack_lvl+0x8/0x8 [ 38.883402][ T989] dump_stack+0x15/0x24 [ 38.887559][ T989] should_fail_ex+0x3bf/0x510 [ 38.892240][ T989] __should_failslab+0xac/0xf0 [ 38.896063][ T980] ext4 filesystem being mounted at /25/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 38.897005][ T989] should_failslab+0x9/0x20 [ 38.911791][ T989] __kmem_cache_alloc_node+0x3d/0x2d0 [ 38.917176][ T989] ? kvmalloc_node+0x28a/0x460 [ 38.921945][ T989] ? kvmalloc_node+0x28a/0x460 [ 38.926716][ T989] __kmalloc_node+0xa2/0x1e0 [ 38.931311][ T989] kvmalloc_node+0x28a/0x460 [ 38.935907][ T989] ? __cfi_kvmalloc_node+0x10/0x10 [ 38.941019][ T989] ? __cfi_io_rsrc_file_put+0x10/0x10 [ 38.946397][ T989] ? __cfi_io_rsrc_file_put+0x10/0x10 [ 38.951777][ T989] io_alloc_file_tables+0x38/0xd0 [ 38.956808][ T989] io_sqe_files_register+0x43a/0x8a0 [ 38.962105][ T989] ? __cfi_io_sqe_files_register+0x10/0x10 [ 38.967919][ T989] ? __kasan_check_read+0x11/0x20 [ 38.972948][ T989] __se_sys_io_uring_register+0x55d/0xcf0 [ 38.978675][ T989] ? __this_cpu_preempt_check+0x13/0x20 [ 38.984368][ T989] ? __x64_sys_io_uring_register+0xb0/0xb0 [ 38.990182][ T989] ? fpregs_restore_userregs+0x128/0x260 [ 38.995822][ T989] __x64_sys_io_uring_register+0x9b/0xb0 [ 39.001466][ T989] x64_sys_call+0x5f4/0x9a0 [ 39.005974][ T989] do_syscall_64+0x4c/0xa0 [ 39.010389][ T989] ? clear_bhb_loop+0x30/0x80 [ 39.015078][ T989] ? clear_bhb_loop+0x30/0x80 [ 39.019761][ T989] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 39.025657][ T989] RIP: 0033:0x7f048579fb19 [ 39.030158][ T989] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.049765][ T989] RSP: 002b:00007f048669f028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 39.058201][ T989] RAX: ffffffffffffffda RBX: 00007f0485a25fa0 RCX: 00007f048579fb19 [ 39.066183][ T989] RDX: 0000200000000240 RSI: 0000000000000002 RDI: 0000000000000003 [ 39.074163][ T989] RBP: 00007f0485837af8 R08: 0000000000000000 R09: 0000000000000000 [ 39.082135][ T989] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000000 [ 39.090111][ T989] R13: 00007f0485a26038 R14: 00007f0485a25fa0 R15: 00007ffc79224358 [ 39.098085][ T989] [ 39.101811][ T43] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 39.120568][ T650] EXT4-fs (loop6): unmounting filesystem. [ 39.173152][ T687] ------------[ cut here ]------------ [ 39.178828][ T687] WARNING: CPU: 0 PID: 687 at fs/overlayfs/util.c:489 ovl_dir_modified+0x189/0x1c0 [ 39.188191][ T687] Modules linked in: [ 39.192188][ T687] CPU: 0 PID: 687 Comm: syz-executor Not tainted syzkaller #0 [ 39.199648][ T687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 39.209811][ T687] RIP: 0010:ovl_dir_modified+0x189/0x1c0 [ 39.215566][ T687] Code: 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 be 78 a3 ff 49 ff 06 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 67 dc 5d ff <0f> 0b e9 17 ff ff ff e8 5b dc 5d ff 0f 0b e9 51 ff ff ff 44 89 e1 [ 39.235355][ T687] RSP: 0018:ffffc9000dbbfb60 EFLAGS: 00010293 [ 39.241500][ T687] RAX: ffffffff821395b9 RBX: 1ffff11022d14cb0 RCX: ffff888120069440 [ 39.249482][ T687] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 39.257560][ T687] RBP: ffffc9000dbbfb90 R08: ffff8881326bcf67 R09: 1ffff110264d79ec [ 39.265615][ T687] R10: dffffc0000000000 R11: ffffed10264d79ed R12: ffff8881168a6550 [ 39.273782][ T687] R13: 0000000000000000 R14: ffff8881326bcec0 R15: ffff8881168a6580 [ 39.281850][ T687] FS: 0000555572515500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 39.290876][ T687] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.297529][ T687] CR2: 00007f13ce1556c8 CR3: 0000000128bba000 CR4: 00000000003506b0 [ 39.305652][ T687] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 39.313715][ T687] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 39.321768][ T687] Call Trace: [ 39.325048][ T687] [ 39.327978][ T687] ovl_do_remove+0x6d3/0xa60 [ 39.332662][ T687] ? ovl_set_redirect+0x6b0/0x6b0 [ 39.337958][ T687] ? selinux_inode_rmdir+0x22/0x30 [ 39.343167][ T687] ovl_rmdir+0x1a/0x20 [ 39.347240][ T687] vfs_rmdir+0x381/0x4f0 [ 39.351750][ T687] incfs_kill_sb+0xfe/0x210 [ 39.356268][ T687] deactivate_locked_super+0xb5/0x120 [ 39.361749][ T687] deactivate_super+0xaf/0xe0 [ 39.366436][ T687] cleanup_mnt+0x45e/0x4e0 [ 39.370944][ T687] __cleanup_mnt+0x19/0x20 [ 39.375531][ T687] task_work_run+0x1e1/0x250 [ 39.380136][ T687] ? __cfi_task_work_run+0x10/0x10 [ 39.385345][ T687] ? __x64_sys_umount+0x12d/0x170 [ 39.390376][ T687] ? __cfi___x64_sys_umount+0x10/0x10 [ 39.395844][ T687] exit_to_user_mode_loop+0x9b/0xb0 [ 39.401062][ T687] exit_to_user_mode_prepare+0x87/0xd0 [ 39.406524][ T687] syscall_exit_to_user_mode+0x1a/0x30 [ 39.412012][ T687] do_syscall_64+0x58/0xa0 [ 39.416424][ T687] ? clear_bhb_loop+0x30/0x80 [ 39.421129][ T687] ? clear_bhb_loop+0x30/0x80 [ 39.425801][ T687] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 39.431814][ T687] RIP: 0033:0x7f7ccf3a0d57 [ 39.436228][ T687] Code: a2 c7 05 9c a9 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 39.455952][ T687] RSP: 002b:00007fffe8ec7a18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 39.464398][ T687] RAX: 0000000000000000 RBX: 00007f7ccf436f3b RCX: 00007f7ccf3a0d57 [ 39.472384][ T687] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffe8ec7ad0 [ 39.480358][ T687] RBP: 00007fffe8ec7ad0 R08: 00007fffe8ec8ad0 R09: 00000000ffffffff [ 39.488363][ T687] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffe8ec8b60 [ 39.496352][ T687] R13: 00007f7ccf436f3b R14: 00000000000098dd R15: 00007fffe8ec8ba0 [ 39.504354][ T687] [ 39.507363][ T687] ---[ end trace 0000000000000000 ]--- [ 39.516188][ T687] ------------[ cut here ]------------ [ 39.521690][ T687] WARNING: CPU: 0 PID: 687 at fs/overlayfs/util.c:489 ovl_dir_modified+0x189/0x1c0 [ 39.531101][ T687] Modules linked in: [ 39.535074][ T687] CPU: 0 PID: 687 Comm: syz-executor Tainted: G W syzkaller #0 [ 39.544260][ T687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 39.554423][ T687] RIP: 0010:ovl_dir_modified+0x189/0x1c0 [ 39.560080][ T687] Code: 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 be 78 a3 ff 49 ff 06 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 67 dc 5d ff <0f> 0b e9 17 ff ff ff e8 5b dc 5d ff 0f 0b e9 51 ff ff ff 44 89 e1 [ 39.579932][ T687] RSP: 0018:ffffc9000dbbfb60 EFLAGS: 00010293 [ 39.586253][ T687] RAX: ffffffff821395b9 RBX: 1ffff11022d14cb0 RCX: ffff888120069440 [ 39.594599][ T687] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 39.602669][ T687] RBP: ffffc9000dbbfb90 R08: ffff8881326bcf67 R09: 1ffff110264d79ec [ 39.610655][ T687] R10: dffffc0000000000 R11: ffffed10264d79ed R12: ffff8881168a6550 [ 39.618669][ T687] R13: 0000000000000000 R14: ffff8881326bcec0 R15: ffff8881168a6580 [ 39.626659][ T687] FS: 0000555572515500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 39.635689][ T687] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.642317][ T687] CR2: 00007f13ce1556c8 CR3: 0000000128bba000 CR4: 00000000003506b0 [ 39.650292][ T687] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 39.658295][ T687] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 39.666419][ T687] Call Trace: [ 39.669783][ T687] [ 39.672959][ T687] ovl_do_remove+0x6d3/0xa60 [ 39.677574][ T687] ? ovl_set_redirect+0x6b0/0x6b0 [ 39.682826][ T687] ? selinux_inode_rmdir+0x22/0x30 [ 39.687954][ T687] ovl_rmdir+0x1a/0x20 [ 39.692076][ T687] vfs_rmdir+0x381/0x4f0 [ 39.696323][ T687] incfs_kill_sb+0x18f/0x210 [ 39.700955][ T687] deactivate_locked_super+0xb5/0x120 [ 39.706333][ T687] deactivate_super+0xaf/0xe0 [ 39.711045][ T687] cleanup_mnt+0x45e/0x4e0 [ 39.715458][ T687] __cleanup_mnt+0x19/0x20 [ 39.719960][ T687] task_work_run+0x1e1/0x250 [ 39.724593][ T687] ? __cfi_task_work_run+0x10/0x10 [ 39.729717][ T687] ? __x64_sys_umount+0x12d/0x170 [ 39.734790][ T687] ? __cfi___x64_sys_umount+0x10/0x10 [ 39.740166][ T687] exit_to_user_mode_loop+0x9b/0xb0 [ 39.745400][ T687] exit_to_user_mode_prepare+0x87/0xd0 [ 39.751040][ T687] syscall_exit_to_user_mode+0x1a/0x30 [ 39.756511][ T687] do_syscall_64+0x58/0xa0 [ 39.761052][ T687] ? clear_bhb_loop+0x30/0x80 [ 39.765737][ T687] ? clear_bhb_loop+0x30/0x80 [ 39.770417][ T687] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 39.776344][ T687] RIP: 0033:0x7f7ccf3a0d57 [ 39.780773][ T687] Code: a2 c7 05 9c a9 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 39.800846][ T687] RSP: 002b:00007fffe8ec7a18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 39.809264][ T687] RAX: 0000000000000000 RBX: 00007f7ccf436f3b RCX: 00007f7ccf3a0d57 [ 39.817285][ T687] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffe8ec7ad0 [ 39.825276][ T687] RBP: 00007fffe8ec7ad0 R08: 00007fffe8ec8ad0 R09: 00000000ffffffff [ 39.833370][ T687] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffe8ec8b60 [ 39.841435][ T687] R13: 00007f7ccf436f3b R14: 00000000000098dd R15: 00007fffe8ec8ba0 [ 39.849410][ T687] [ 39.852458][ T687] ---[ end trace 0000000000000000 ]--- [ 39.911187][ T1007] set_capacity_and_notify: 3 callbacks suppressed [ 39.911205][ T1007] loop7: detected capacity change from 0 to 256 [ 39.927886][ T1013] netlink: 'syz.6.265': attribute type 12 has an invalid length. [ 39.947911][ T1007] exFAT-fs (loop7): failed to load upcase table (idx : 0x00010321, chksum : 0x3a8a43f6, utbl_chksum : 0xe619d30d) [ 40.092530][ T1030] loop7: detected capacity change from 0 to 1024 [ 40.099715][ T1030] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 40.111386][ T1030] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 40.120573][ T1030] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 40.129034][ T1030] System zones: 0-1, 3-36 [ 40.134552][ T1030] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 40.175247][ T1030] fscrypt (loop7, inode 18): Direct key flag not allowed with different contents and filenames modes [ 40.221063][ T687] EXT4-fs (loop7): unmounting filesystem. [ 40.340846][ T301] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 40.472507][ T1043] loop7: detected capacity change from 0 to 16 [ 40.501902][ T1043] erofs: (device loop7): mounted with root inode @ nid 36. [ 40.525068][ T46] erofs: (device loop7): z_erofs_lz4_decompress_mem: failed to decompress 4876 in[4096, 0] out[9000] [ 40.537518][ T301] usb 6-1: unable to get BOS descriptor or descriptor too short [ 40.556389][ T301] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 4 [ 40.579304][ T301] usb 6-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice= 0.40 [ 40.592628][ T1015] loop8: detected capacity change from 0 to 131072 [ 40.599253][ T301] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.610722][ T301] usb 6-1: Product: syz [ 40.615283][ T301] usb 6-1: Manufacturer: syz [ 40.619980][ T301] usb 6-1: SerialNumber: syz [ 40.624833][ T1015] F2FS-fs (loop8): invalid crc value [ 40.638263][ T1051] loop7: detected capacity change from 0 to 512 [ 40.649134][ T1015] F2FS-fs (loop8): Found nat_bits in checkpoint [ 40.662135][ T1051] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 40.685596][ T1051] EXT4-fs (loop7): 1 truncate cleaned up [ 40.697813][ T1051] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 40.730498][ T687] EXT4-fs (loop7): unmounting filesystem. [ 40.741203][ T1015] F2FS-fs (loop8): Mounted with checkpoint version = 48b305e5 [ 40.840238][ T301] snd-usb-audio: probe of 6-1:1.2 failed with error -2 [ 40.861602][ T301] usb 6-1: USB disconnect, device number 3 [ 40.877239][ T312] udevd[312]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.2/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 41.186339][ T1093] loop8: detected capacity change from 0 to 256 [ 41.205322][ T1073] loop6: detected capacity change from 0 to 40427 [ 41.215547][ T1073] F2FS-fs (loop6): heap/no_heap options were deprecated [ 41.230577][ T1093] exFAT-fs (loop8): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 41.234505][ T1073] F2FS-fs (loop6): invalid crc value [ 41.249214][ T1073] F2FS-fs (loop6): Found nat_bits in checkpoint [ 41.309076][ T1073] F2FS-fs (loop6): Start checkpoint disabled! [ 41.322040][ T1073] F2FS-fs (loop6): f2fs_disable_checkpoint() finish, err:0 [ 41.344748][ T1073] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e6 [ 41.430153][ T1073] F2FS-fs (loop6): ino:10, start:0, end:8192, need to trigger GC to reclaim enough free segment when checkpoint is enabled [ 41.458729][ T1105] netlink: 8 bytes leftover after parsing attributes in process `syz.8.301'. [ 41.502408][ T1105] Zero length message leads to an empty skb [ 41.535401][ T43] kworker/u4:2: attempt to access beyond end of device [ 41.535401][ T43] loop6: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 41.542982][ T1105] syz.8.301 (1105) used greatest stack depth: 21216 bytes left [ 41.772673][ T1117] capability: warning: `syz.8.306' uses deprecated v2 capabilities in a way that may be insecure [ 41.819815][ T1114] loop6: detected capacity change from 0 to 40427 [ 41.829324][ T1114] F2FS-fs (loop6): Small segment_count (9 < 1 * 24) [ 41.836219][ T1114] F2FS-fs (loop6): Can't find valid F2FS filesystem in 1th superblock [ 41.848720][ T1114] F2FS-fs (loop6): Found nat_bits in checkpoint [ 41.894728][ T1114] F2FS-fs (loop6): Try to recover 1th superblock, ret: 0 [ 41.902261][ T1114] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 42.036801][ T1139] loop6: detected capacity change from 0 to 2048 [ 42.073855][ T1139] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 42.101761][ T1139] ext4 filesystem being mounted at /39/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 42.139157][ T1139] overlayfs: failed to set xattr on upper [ 42.211752][ T650] EXT4-fs (loop6): unmounting filesystem. [ 42.493717][ T1170] ip_tables: iptables: counters copy to user failed while replacing table [ 42.659132][ T1176] kvm [1175]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0xc1) = 0xe50000000000 [ 42.681023][ T1176] kvm [1175]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0xc2) = 0xe50000000000 [ 42.704895][ T1176] kvm [1175]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0x11e) = 0xe500be702111 [ 42.742853][ T1176] kvm [1175]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0x186) = 0xe50000000000 [ 42.764739][ T1176] kvm [1175]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0x187) = 0xe50000000000 [ 42.864462][ T1186] loop7: detected capacity change from 0 to 1024 [ 42.900854][ T28] kauditd_printk_skb: 36 callbacks suppressed [ 42.900868][ T28] audit: type=1400 audit(1793634095.343:327): avc: denied { watch watch_reads } for pid=1190 comm="syz.6.333" path="/49/file1" dev="tmpfs" ino=285 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 42.941002][ T1186] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 43.071551][ T1196] F2FS-fs (loop6): invalid crc value [ 43.085144][ T1196] F2FS-fs (loop6): Found nat_bits in checkpoint [ 43.160304][ T28] audit: type=1400 audit(1793634095.603:328): avc: denied { read } for pid=1208 comm="syz.8.339" path="socket:[22102]" dev="sockfs" ino=22102 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 43.168498][ T1196] F2FS-fs (loop6): Start checkpoint disabled! [ 43.190465][ T1196] F2FS-fs (loop6): f2fs_disable_checkpoint() finish, err:0 [ 43.197896][ T1196] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e6 [ 43.232272][ T1196] incfs: ino conflict with backing FS 3 [ 43.239472][ T1196] syz.6.335: attempt to access beyond end of device [ 43.239472][ T1196] loop6: rw=524288, sector=45064, nr_sectors = 8 limit=40427 [ 43.261374][ T1196] syz.6.335: attempt to access beyond end of device [ 43.261374][ T1196] loop6: rw=0, sector=45064, nr_sectors = 8 limit=40427 [ 43.275226][ T1196] incfs: iterate_incfs_dir / -5 [ 43.457776][ T1216] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.464957][ T1216] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.482170][ T1216] device bridge_slave_0 entered promiscuous mode [ 43.497202][ T1216] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.504385][ T1216] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.512438][ T1216] device bridge_slave_1 entered promiscuous mode [ 43.588347][ T1216] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.595438][ T1216] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.602723][ T1216] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.609758][ T1216] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.658131][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.666682][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.675245][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.700016][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.714823][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.721922][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.731162][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.739525][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.746602][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.760989][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.774324][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.812835][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.835645][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.847289][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 43.874380][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 43.886691][ T1216] device veth0_vlan entered promiscuous mode [ 43.896952][ T687] EXT4-fs (loop7): unmounting filesystem. [ 43.928883][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.943721][ T1216] device veth1_macvtap entered promiscuous mode [ 43.964505][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 43.986317][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 44.017228][ T28] audit: type=1400 audit(1793634096.463:329): avc: denied { mount } for pid=1216 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 44.097356][ T1241] ip_tables: iptables: counters copy to user failed while replacing table [ 44.121627][ T480] device bridge_slave_1 left promiscuous mode [ 44.137186][ T480] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.145082][ T480] device bridge_slave_0 left promiscuous mode [ 44.171743][ T480] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.186323][ T480] device veth1_macvtap left promiscuous mode [ 44.192970][ T28] audit: type=1400 audit(1793634096.643:330): avc: denied { name_bind } for pid=1250 comm="syz.9.355" src=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 44.194154][ T480] device veth0_vlan left promiscuous mode [ 44.276237][ T1221] F2FS-fs (loop5): Zoned block device path is missing [ 44.284893][ T1221] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 44.293488][ T1221] F2FS-fs (loop5): invalid crc value [ 44.299150][ T1260] futex_wake_op: syz.9.358 tries to shift op by 144; fix this program [ 44.332908][ T1221] F2FS-fs (loop5): Found nat_bits in checkpoint [ 44.366054][ T1256] netlink: 12 bytes leftover after parsing attributes in process `syz.8.357'. [ 44.380994][ T1256] netlink: 12 bytes leftover after parsing attributes in process `syz.8.357'. [ 44.383058][ T1221] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 44.389962][ T1256] 8021q: VLANs not supported on ip_vti0 [ 44.397532][ T1221] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e4 [ 44.412156][ T1268] netlink: 180 bytes leftover after parsing attributes in process `syz.7.356'. [ 44.450377][ T28] audit: type=1400 audit(1793634096.893:331): avc: denied { block_suspend } for pid=1276 comm="syz.6.363" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 44.473027][ T28] audit: type=1400 audit(1793634096.893:332): avc: denied { append } for pid=1220 comm="syz.5.342" path="/59/file2/blkio.bfq.io_service_bytes" dev="loop5" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 44.518659][ T1281] FAT-fs (loop8): Unrecognized mount option "permit_diù&ctio" or missing value [ 44.530831][ T28] audit: type=1400 audit(1793634096.983:333): avc: denied { map } for pid=1220 comm="syz.5.342" path="/59/file2/blkio.bfq.io_service_bytes" dev="loop5" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 44.608760][ T1295] Line length is too long: Should be less than 4094 [ 44.675256][ T1299] binder: 1298:1299 ioctl c0306201 2000000004c0 returned -14 [ 44.696792][ T28] audit: type=1400 audit(1793634097.143:334): avc: denied { create } for pid=1300 comm="syz.8.375" name="md1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 44.717542][ T309] usb 8-1: new full-speed USB device number 2 using dummy_hcd [ 44.725642][ T28] audit: type=1400 audit(1793634097.163:335): avc: denied { unlink } for pid=715 comm="syz-executor" name="md1" dev="tmpfs" ino=337 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 44.807698][ T1309] EXT4-fs (loop8): encrypted files will use data=ordered instead of data journaling mode [ 44.821891][ T28] audit: type=1400 audit(1793634097.273:336): avc: denied { listen } for pid=1310 comm="syz.6.380" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 44.842799][ T1309] EXT4-fs (loop8): 1 truncate cleaned up [ 44.856892][ T1309] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 44.898001][ T715] EXT4-fs (loop8): unmounting filesystem. [ 44.930372][ T309] usb 8-1: config 1 interface 0 altsetting 13 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 44.943147][ T309] usb 8-1: config 1 interface 0 has no altsetting 0 [ 44.959322][ T1325] KVM: debugfs: duplicate directory 1325-4 [ 44.966336][ T309] usb 8-1: string descriptor 0 read error: -22 [ 44.973909][ T309] usb 8-1: New USB device found, idVendor=05ac, idProduct=0224, bcdDevice= 0.40 [ 44.984022][ T309] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.002988][ T1279] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 45.120290][ T1341] FAULT_INJECTION: forcing a failure. [ 45.120290][ T1341] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 45.133784][ T1341] CPU: 0 PID: 1341 Comm: syz.9.391 Tainted: G W syzkaller #0 [ 45.142558][ T1341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 45.152607][ T1341] Call Trace: [ 45.155872][ T1341] [ 45.158787][ T1341] __dump_stack+0x21/0x24 [ 45.163107][ T1341] dump_stack_lvl+0x110/0x170 [ 45.167768][ T1341] ? __cfi_dump_stack_lvl+0x8/0x8 [ 45.172782][ T1341] dump_stack+0x15/0x24 [ 45.176923][ T1341] should_fail_ex+0x3bf/0x510 [ 45.181614][ T1341] should_fail_alloc_page+0x61/0x90 [ 45.186819][ T1341] prepare_alloc_pages+0x131/0x570 [ 45.191926][ T1341] ? __alloc_pages_bulk+0x9d0/0x9d0 [ 45.197121][ T1341] __alloc_pages+0x15b/0x610 [ 45.201708][ T1341] ? __cfi___alloc_pages+0x10/0x10 [ 45.206810][ T1341] ? kasan_save_alloc_info+0x1f/0x30 [ 45.212078][ T1341] ? __kasan_kmalloc+0x95/0xb0 [ 45.216828][ T1341] ? mon_bin_open+0x192/0x590 [ 45.221490][ T1341] get_zeroed_page+0x19/0x40 [ 45.226082][ T1341] mon_bin_open+0x21e/0x590 [ 45.230572][ T1341] chrdev_open+0x593/0x600 [ 45.234974][ T1341] ? __cfi_chrdev_open+0x10/0x10 [ 45.239893][ T1341] ? fsnotify_perm+0x3e9/0x5b0 [ 45.244653][ T1341] do_dentry_open+0x885/0x11f0 [ 45.249422][ T1341] ? __cfi_chrdev_open+0x10/0x10 [ 45.254394][ T1341] vfs_open+0x73/0x80 [ 45.258464][ T1341] path_openat+0x2699/0x2f30 [ 45.263047][ T1341] ? slab_post_alloc_hook+0x4f/0x2d0 [ 45.268322][ T1341] ? kmem_cache_alloc+0x166/0x320 [ 45.273340][ T1341] ? getname_flags+0xba/0x510 [ 45.278016][ T1341] ? do_sys_openat2+0xeb/0x820 [ 45.282790][ T1341] ? do_filp_open+0x420/0x420 [ 45.287467][ T1341] do_filp_open+0x1ee/0x420 [ 45.291964][ T1341] ? __cfi_do_filp_open+0x10/0x10 [ 45.296980][ T1341] ? alloc_fd+0x4c1/0x570 [ 45.301302][ T1341] do_sys_openat2+0x15e/0x820 [ 45.305980][ T1341] ? do_sys_open+0xe0/0xe0 [ 45.310392][ T1341] ? do_user_addr_fault+0x9a5/0x1030 [ 45.315671][ T1341] __x64_sys_openat+0x136/0x160 [ 45.320517][ T1341] x64_sys_call+0x783/0x9a0 [ 45.325010][ T1341] do_syscall_64+0x4c/0xa0 [ 45.329412][ T1341] ? clear_bhb_loop+0x30/0x80 [ 45.334074][ T1341] ? clear_bhb_loop+0x30/0x80 [ 45.338736][ T1341] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 45.344616][ T1341] RIP: 0033:0x7f5736f6034e [ 45.349014][ T1341] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 45.368605][ T1341] RSP: 002b:00007f5737f57b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 45.377011][ T1341] RAX: ffffffffffffffda RBX: 00007f5737f586c0 RCX: 00007f5736f6034e [ 45.384973][ T1341] RDX: 0000000000080c00 RSI: 00007f5737f57c00 RDI: ffffffffffffff9c [ 45.392931][ T1341] RBP: 00007f5737f57c00 R08: 0000000000000000 R09: 0000000000000000 [ 45.400886][ T1341] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 45.408841][ T1341] R13: 00007f5737226038 R14: 00007f5737225fa0 R15: 00007ffd6bb7bc98 [ 45.416801][ T1341] [ 45.639542][ T309] apple 0003:05AC:0224.0004: unknown main item tag 0xe [ 45.646499][ T309] apple 0003:05AC:0224.0004: unexpected long global item [ 45.653814][ T309] apple 0003:05AC:0224.0004: parse failed [ 45.659566][ T309] apple: probe of 0003:05AC:0224.0004 failed with error -22 [ 45.710841][ T24] usb 9-1: new full-speed USB device number 2 using dummy_hcd [ 45.718406][ T380] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 45.809770][ T1348] overlayfs: failed to verify origin (newroot/63, ino=351, err=-116) [ 45.817937][ T1348] overlayfs: failed to verify upper root origin [ 45.855399][ T60] usb 8-1: USB disconnect, device number 2 [ 45.900812][ T380] usb 10-1: Using ep0 maxpacket: 16 [ 45.907176][ T380] usb 10-1: config 0 has an invalid interface number: 34 but max is 0 [ 45.915585][ T24] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 45.926060][ T380] usb 10-1: config 0 has no interface number 0 [ 45.940805][ T24] usb 9-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 45.950590][ T380] usb 10-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 45.961268][ T24] usb 9-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 45.974700][ T380] usb 10-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 45.986984][ T380] usb 10-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 45.993087][ T1368] set_capacity_and_notify: 4 callbacks suppressed [ 45.993103][ T1368] loop5: detected capacity change from 0 to 512 [ 45.996386][ T24] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 46.020837][ T1368] EXT4-fs (loop5): Test dummy encryption mode enabled [ 46.023849][ T380] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 46.034420][ T1373] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.042890][ T380] usb 10-1: Product: syz [ 46.043801][ T1368] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 46.057086][ T380] usb 10-1: Manufacturer: syz [ 46.058352][ T1373] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.062405][ T24] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 46.078630][ T380] usb 10-1: SerialNumber: syz [ 46.079062][ T1368] EXT4-fs warning (device loop5): ext4_expand_extra_isize_ea:2802: Unable to expand inode 11. Delete some EAs or run e2fsck. [ 46.083678][ T24] usb 9-1: Product: syz [ 46.083694][ T24] usb 9-1: Manufacturer: syz [ 46.083707][ T24] usb 9-1: SerialNumber: syz [ 46.110929][ T1368] EXT4-fs (loop5): 1 truncate cleaned up [ 46.111123][ T380] usb 10-1: config 0 descriptor?? [ 46.116871][ T1368] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 46.133390][ T1344] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 46.140661][ T1344] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 46.140670][ T1366] ================================================================== [ 46.141857][ T1368] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 46.147778][ T1366] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 [ 46.157180][ T1373] netlink: 'syz.6.405': attribute type 16 has an invalid length. [ 46.163079][ T1366] Read of size 4 at addr ffff8881315e9800 by task syz.6.400/1366 [ 46.163097][ T1366] [ 46.163103][ T1366] CPU: 0 PID: 1366 Comm: syz.6.400 Tainted: G W syzkaller #0 [ 46.163120][ T1366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 46.163129][ T1366] Call Trace: [ 46.163135][ T1366] [ 46.171427][ T1373] netlink: 'syz.6.405': attribute type 17 has an invalid length. [ 46.178950][ T1366] __dump_stack+0x21/0x24 [ 46.178976][ T1366] dump_stack_lvl+0x110/0x170 [ 46.199973][ T1373] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 46.207847][ T1366] ? __cfi_dump_stack_lvl+0x8/0x8 [ 46.207872][ T1366] ? _raw_spin_lock_bh+0x94/0xf0 [ 46.207888][ T1366] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 46.207912][ T1366] print_address_description+0x71/0x200 [ 46.242664][ T1373] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 46.242681][ T1366] print_report+0x4a/0x60 [ 46.261074][ T1373] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 46.265996][ T1366] kasan_report+0x122/0x150 [ 46.266025][ T1366] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 46.279715][ T1373] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.282007][ T1366] __asan_report_load4_noabort+0x14/0x20 [ 46.282032][ T1366] pppol2tp_sock_to_session+0x1a0/0x1b0 [ 46.282057][ T1366] pppol2tp_release+0x150/0x2b0 [ 46.287751][ T1373] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.294739][ T1366] sock_close+0xc9/0x220 [ 46.294758][ T1366] ? __cfi_sock_close+0x10/0x10 [ 46.294776][ T1366] __fput+0x1fd/0x8f0 [ 46.304802][ T1373] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.305928][ T1366] ____fput+0x15/0x20 [ 46.310804][ T1373] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.317934][ T1366] task_work_run+0x1e1/0x250 [ 46.335150][ T1373] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0.257: link becomes ready [ 46.337941][ T1366] ? __cfi_task_work_run+0x10/0x10 [ 46.337970][ T1366] ? free_nsproxy+0x21f/0x270 [ 46.342573][ T1344] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 46.349130][ T1366] do_exit+0xb0d/0x29f0 [ 46.356103][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 46.361400][ T1366] ? __cfi_do_exit+0x10/0x10 [ 46.361426][ T1366] ? xfd_validate_state+0x70/0x150 [ 46.361448][ T1366] ? __kasan_check_write+0x14/0x20 [ 46.361468][ T1366] __x64_sys_exit+0x40/0x40 [ 46.367684][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 46.371225][ T1366] x64_sys_call+0x67/0x9a0 [ 46.371249][ T1366] do_syscall_64+0x4c/0xa0 [ 46.371264][ T1366] ? clear_bhb_loop+0x30/0x80 [ 46.383019][ T1344] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 46.390261][ T1366] ? clear_bhb_loop+0x30/0x80 [ 46.405010][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 46.409476][ T1366] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 46.409503][ T1366] RIP: 0033:0x7f13cd39fb19 [ 46.427737][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 46.430826][ T1366] Code: Unable to access opcode bytes at 0x7f13cd39faef. [ 46.430837][ T1366] RSP: 002b:00007f13ce189ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 46.430855][ T1366] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f13cd39fb19 [ 46.430867][ T1366] RDX: 00007f13ce18a9c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 46.430878][ T1366] RBP: 00007f13cd437af8 R08: 0000000000000000 R09: 0000000000000058 [ 46.445469][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 46.450448][ T1366] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 46.450462][ T1366] R13: 00007f13cd626038 R14: 00007f13cd625fa0 R15: 00007fff38515438 [ 46.450479][ T1366] [ 46.450485][ T1366] [ 46.469502][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 46.475774][ T1366] Allocated by task 1364: [ 46.475785][ T1366] kasan_set_track+0x4b/0x70 [ 46.475807][ T1366] kasan_save_alloc_info+0x1f/0x30 [ 46.475821][ T1366] __kasan_kmalloc+0x95/0xb0 [ 46.475838][ T1366] __kmalloc+0xb4/0x1e0 [ 46.486320][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 46.492176][ T1366] l2tp_session_create+0x38/0xbd0 [ 46.492203][ T1366] pppol2tp_connect+0xbf5/0x1640 [ 46.492223][ T1366] __sys_connect+0x3da/0x460 [ 46.501066][ T480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 46.508118][ T1366] __x64_sys_connect+0x7a/0x90 [ 46.602713][ T1366] x64_sys_call+0x88d/0x9a0 [ 46.607211][ T1366] do_syscall_64+0x4c/0xa0 [ 46.611609][ T1366] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 46.617487][ T1366] [ 46.619794][ T1366] Freed by task 480: [ 46.623662][ T1366] kasan_set_track+0x4b/0x70 [ 46.628235][ T1366] kasan_save_free_info+0x2b/0x40 [ 46.633237][ T1366] ____kasan_slab_free+0x132/0x180 [ 46.638332][ T1366] __kasan_slab_free+0x11/0x20 [ 46.643075][ T1366] slab_free_freelist_hook+0xc2/0x190 [ 46.648428][ T1366] __kmem_cache_free+0xb7/0x1b0 [ 46.653260][ T1366] kfree+0x6f/0xf0 [ 46.656960][ T1366] l2tp_session_put+0xaf/0x1a0 [ 46.661707][ T1366] l2tp_session_delete+0x3df/0x4d0 [ 46.666804][ T1366] l2tp_tunnel_del_work+0x199/0x410 [ 46.671986][ T1366] process_one_work+0x717/0xc30 [ 46.676817][ T1366] worker_thread+0xa4d/0x11d0 [ 46.681474][ T1366] kthread+0x281/0x320 [ 46.685524][ T1366] ret_from_fork+0x1f/0x30 [ 46.689925][ T1366] [ 46.692232][ T1366] The buggy address belongs to the object at ffff8881315e9800 [ 46.692232][ T1366] which belongs to the cache kmalloc-512 of size 512 [ 46.706260][ T1366] The buggy address is located 0 bytes inside of [ 46.706260][ T1366] 512-byte region [ffff8881315e9800, ffff8881315e9a00) [ 46.719344][ T1366] [ 46.721651][ T1366] The buggy address belongs to the physical page: [ 46.728050][ T1366] page:ffffea0004c57a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1315e8 [ 46.738283][ T1366] head:ffffea0004c57a00 order:2 compound_mapcount:0 compound_pincount:0 [ 46.746598][ T1366] flags: 0x4000000000010200(slab|head|zone=1) [ 46.752670][ T1366] raw: 4000000000010200 0000000000000000 dead000000000001 ffff888100042f00 [ 46.761238][ T1366] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 46.769889][ T1366] page dumped because: kasan: bad access detected [ 46.776373][ T1366] page_owner tracks the page as allocated [ 46.782067][ T1366] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 288, tgid 288 (syz-executor), ts 22834977235, free_ts 0 [ 46.802376][ T1366] post_alloc_hook+0x1f5/0x210 [ 46.807142][ T1366] prep_new_page+0x1c/0x110 [ 46.811658][ T1366] get_page_from_freelist+0x2ca9/0x2d20 [ 46.817191][ T1366] __alloc_pages+0x1fa/0x610 [ 46.821767][ T1366] alloc_slab_page+0x6e/0xf0 [ 46.826347][ T1366] new_slab+0x98/0x3e0 [ 46.830406][ T1366] ___slab_alloc+0x70f/0xb70 [ 46.834984][ T1366] __slab_alloc+0x5e/0xa0 [ 46.839304][ T1366] __kmem_cache_alloc_node+0x204/0x2d0 [ 46.844839][ T1366] kmalloc_trace+0x29/0xb0 [ 46.849236][ T1366] ipv6_add_addr+0x411/0xe80 [ 46.853812][ T1366] add_addr+0x8a/0x290 [ 46.857868][ T1366] add_v4_addrs+0x659/0xb20 [ 46.862358][ T1366] addrconf_init_auto_addrs+0x8e5/0xbc0 [ 46.867893][ T1366] addrconf_notify+0x7fe/0xe30 [ 46.872641][ T1366] raw_notifier_call_chain+0xa1/0x110 [ 46.878001][ T1366] page_owner free stack trace missing [ 46.883351][ T1366] [ 46.885660][ T1366] Memory state around the buggy address: [ 46.891266][ T1366] ffff8881315e9700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.899305][ T1366] ffff8881315e9780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.907355][ T1366] >ffff8881315e9800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.915391][ T1366] ^ [ 46.919441][ T1366] ffff8881315e9880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.927477][ T1366] ffff8881315e9900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.935517][ T1366] ================================================================== [ 46.947434][ T1366] Disabling lock debugging due to kernel taint [ 46.953935][ T1366] ------------[ cut here ]------------ [ 46.955723][ T569] EXT4-fs (loop5): unmounting filesystem. [ 46.959411][ T1366] WARNING: CPU: 0 PID: 1366 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 46.975208][ T1366] Modules linked in: [ 46.979102][ T1366] CPU: 0 PID: 1366 Comm: syz.6.400 Tainted: G B W syzkaller #0 [ 46.987893][ T1366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 46.997969][ T1366] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 47.004380][ T1366] Code: 5d c3 e8 5c bf d4 fc be 02 00 00 00 eb 0a e8 50 bf d4 fc be 01 00 00 00 4c 89 f7 e8 e3 c2 cc fd e9 0f ff ff ff e8 39 bf d4 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 bf d4 fc 4c 89 f7 be 03 [ 47.024012][ T1366] RSP: 0018:ffffc90001997b90 EFLAGS: 00010293 [ 47.030092][ T1366] RAX: ffffffff849cb2e7 RBX: ffff888108e60000 RCX: ffff8881163be540 [ 47.038138][ T1366] RDX: 0000000000000000 RSI: 000000001af50000 RDI: 000000000c04eb7d [ 47.046140][ T1366] RBP: ffffc90001997bb0 R08: ffffffff87b777e7 R09: 1ffffffff0f6eefc [ 47.054158][ T1366] R10: dffffc0000000000 R11: fffffbfff0f6eefd R12: dffffc0000000000 [ 47.062161][ T1366] R13: dffffc0000000000 R14: 000000001af50000 R15: ffff8881315e9800 [ 47.070148][ T1366] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 47.079122][ T1366] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 47.085728][ T1366] CR2: 0000001b2f712ff8 CR3: 0000000114835000 CR4: 00000000003506b0 [ 47.093740][ T1366] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 47.101727][ T1366] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 47.109699][ T1366] Call Trace: [ 47.113046][ T1366] [ 47.116077][ T1366] pppol2tp_release+0x150/0x2b0 [ 47.120975][ T1366] sock_close+0xc9/0x220 [ 47.125231][ T1366] ? __cfi_sock_close+0x10/0x10 [ 47.130072][ T1366] __fput+0x1fd/0x8f0 [ 47.134112][ T1366] ____fput+0x15/0x20 [ 47.138100][ T1366] task_work_run+0x1e1/0x250 [ 47.142707][ T1366] ? __cfi_task_work_run+0x10/0x10 [ 47.147824][ T1366] ? free_nsproxy+0x21f/0x270 [ 47.152531][ T1366] do_exit+0xb0d/0x29f0 [ 47.156690][ T1366] ? __cfi_do_exit+0x10/0x10 [ 47.161306][ T1366] ? xfd_validate_state+0x70/0x150 [ 47.166420][ T1366] ? __kasan_check_write+0x14/0x20 [ 47.171553][ T1366] __x64_sys_exit+0x40/0x40 [ 47.176059][ T1366] x64_sys_call+0x67/0x9a0 [ 47.180476][ T1366] do_syscall_64+0x4c/0xa0 [ 47.184911][ T1366] ? clear_bhb_loop+0x30/0x80 [ 47.189590][ T1366] ? clear_bhb_loop+0x30/0x80 [ 47.194348][ T1366] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 47.200245][ T1366] RIP: 0033:0x7f13cd39fb19 [ 47.204675][ T1366] Code: Unable to access opcode bytes at 0x7f13cd39faef. [ 47.211704][ T1366] RSP: 002b:00007f13ce189ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 47.220110][ T1366] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f13cd39fb19 [ 47.228138][ T1366] RDX: 00007f13ce18a9c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 47.236125][ T1366] RBP: 00007f13cd437af8 R08: 0000000000000000 R09: 0000000000000058 [ 47.244128][ T1366] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 47.252114][ T1366] R13: 00007f13cd626038 R14: 00007f13cd625fa0 R15: 00007fff38515438 [ 47.260076][ T1366] [ 47.263112][ T1366] ---[ end trace 0000000000000000 ]--- [ 47.469363][ T380] asix 10-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 47.479605][ T380] asix: probe of 10-1:0.34 failed with error -71 [ 47.488698][ T380] usb 10-1: USB disconnect, device number 2 [ 47.553938][ T24] cdc_ncm 9-1:1.0: bind() failure [ 47.559813][ T24] cdc_ncm: probe of 9-1:1.1 failed with error -71 [ 47.566806][ T24] cdc_mbim: probe of 9-1:1.1 failed with error -71 [ 47.576400][ T24] usb 9-1: USB disconnect, device number 2