last executing test programs: 2.713593795s ago: executing program 0 (id=4854): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {0x1}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x0}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x58}}, 0x0) 2.524109723s ago: executing program 0 (id=4857): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="2c0000003a000b00000000000000000003000000c1fe0080130003000d28d8026a2c80"], 0x2c}}, 0x0) 2.480343157s ago: executing program 3 (id=4858): r0 = syz_open_dev$sndpcmp(&(0x7f0000000500), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r0, 0xc2604110, &(0x7f00000000c0)={0x8000, [[0x0, 0x5, 0xf, 0x9, 0x9, 0xfffffff5, 0x1, 0x8], [0x2b, 0x6, 0x4e8f, 0x200, 0x9, 0x4, 0x4, 0x9], [0x7ff, 0x0, 0x5, 0x1000, 0x0, 0x6, 0x2, 0xfffffff7]], '\x00', [{0x9, 0x7ff, 0x1, 0x1, 0x0, 0x1}, {0x475, 0xfaf, 0x1, 0x0, 0x0, 0x1}, {0x5, 0x293, 0x1, 0x0, 0x1}, {0x80, 0x200, 0x0, 0x0, 0x1, 0x1}, {0x5, 0x7f, 0x0, 0x1, 0x0, 0x1}, {0x8, 0xfffff001, 0x1, 0x0, 0x0, 0x1}, {0x4, 0x3, 0x1, 0x0, 0x1}, {0x8000, 0x3a8a3cb0, 0x0, 0x0, 0x1}, {0x3, 0x8001, 0x0, 0x0, 0x0, 0x1}, {0x80, 0x5d, 0x0, 0x0, 0x1, 0x1}, {0x1, 0x8, 0x0, 0x1, 0x1}, {0x3, 0x3, 0x0, 0x1, 0x1}], '\x00', 0x10}) 2.391699466s ago: executing program 0 (id=4861): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd3, 0x0, 0x0) 2.334392842s ago: executing program 3 (id=4862): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="b4050000000000007110b200000000000600000000000000950000000000000099b2c958e17222c54e17b242e3c6bacb4cc117ca"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd96, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd56, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000200)={r0, 0xffffffffffffffff, 0x2e, 0x0, @val=@netkit}, 0x1c) 2.14434087s ago: executing program 0 (id=4865): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x54, 0x2, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_SIZE={0x8, 0x17, 0x0}]}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'list:set\x00'}]}, 0x54}}, 0x0) 2.14420133s ago: executing program 3 (id=4866): rseq(&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0) fsopen(&(0x7f00000000c0)='sysfs\x00', 0x0) 2.115439853s ago: executing program 1 (id=4867): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x2, 0x0) ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000000)={0xe000003, 0x3ffffddc, &(0x7f0000000180), 0x9, 0x5000004}) 1.976356587s ago: executing program 0 (id=4869): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$inet(r0, &(0x7f0000002780)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1400000000000000100100000d"], 0x30}, 0x0) 1.886376736s ago: executing program 1 (id=4871): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e0000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000100b0000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xd, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000000)="c1188e19b95d02ff4284860151b0", 0x0, 0xa3d8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.869097207s ago: executing program 3 (id=4872): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020025797a31000000000900010073797a3000000000080005400000001c"], 0xe8}}, 0x0) 1.760359078s ago: executing program 0 (id=4873): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000840)=ANY=[@ANYBLOB="120100009e173610ef171e7206de01020301090212"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000b00)={0x84, &(0x7f0000000640)={0x0, 0x0, 0x4, "0b0f2d5e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.645467959s ago: executing program 3 (id=4875): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x5, &(0x7f0000000380)=ANY=[@ANYBLOB="180200000100000000000000000000008500000053000000850000000500000095"], &(0x7f0000000080)='GPL\x00', 0x4}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000340)="e00cbd73001a000000000000a9a8", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.609458373s ago: executing program 1 (id=4876): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001e00010000000000000000000700", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\n'], 0x28}}, 0x0) 1.452287158s ago: executing program 3 (id=4878): syz_mount_image$squashfs(&(0x7f0000000240), &(0x7f0000000280)='./file0\x00', 0x0, &(0x7f00000002c0)={[{}]}, 0x1, 0x232, &(0x7f0000000000)="$eJzKKC4sZmdgYPj7sSaZgUGAAQRYGEQYLjAwMrAwMDDIM4KFGD4yQeipUPomlGaDyl+B0r5Q8XYo/de8KiKKgYExU+meGdMB8RRFRgEGHpGvpx4wJDPwxzJYzvNecykoc8pVobdL94PUe4VWbmJgVE/hXzRnwwSnmbxgYxkjo5DNYT4gM4sDZBADA8PkPxH3HrBIMoggmSXK8U/sVMvyVWad9xlmdExLY2A0mMXBwMCgd0R3pp0BbzcT1MziyqrsxJyc1KLiAwyo5k9m3M+kyAhSd+bv1eAHjHYM3bEMjAxyG/zVFn/7I1W5cVN95PSqiJqp3U03l66PY9im//eKidT7iRlh/x8cEtSyyMv/ME9G6fvmhjkfauqemDh2NirP5W+9/Pfd+5ja4gQ1psfiXYVs/AluWjWfnJ3cLB/PTa9u31KsuCArzWXisakX/yYcX8vAMPnCE1t9BgaGDSDnulXOjbnrFi/ItUz9fN2bFwwHoz5PZGBkZGBgYmCYGbZzD7K/yhugkcHAzMDAoMIAUsTCkJaZk2rgwcDIwMzAws6ADGCqmRg4wKr0kvNzUtoZGMFJAKxtOQML3AzDxwys/CDlII7RYwZWuIyxRQPMyHYorQKlPaD0cij9GErLoyUbFrAJ/VCeRgMDAxtDReJ//iJDNgYGhorEkpIiQ4hYSUmREVzMSABuMxPU1rlMqJ47zsQwCkbBKBgFo2AUjIJRMApGwSgYBSMZAAIAAP//kpC1eQ==") syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006325a640402000207265970000010902240001000000000904000002214c6a0009050702000000da000905"], 0x0) 1.448884498s ago: executing program 1 (id=4879): r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) getsockopt$llc_int(r0, 0x10c, 0x5, &(0x7f0000000180), &(0x7f0000000000)=0x4) 1.33096461s ago: executing program 1 (id=4880): syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000100)='./bus\x00', 0x0, &(0x7f00000021c0)={[{@fat=@flush}, {@iocharset={'iocharset', 0x3d, 'maccroatian'}}, {@shortname_lower}, {@fat=@nfs}, {@rodir}, {@fat=@codepage={'codepage', 0x3d, '932'}}, {@iocharset={'iocharset', 0x3d, 'koi8-r'}}, {@fat=@tz_utc}, {@numtail}, {@rodir}, {@iocharset={'iocharset', 0x3d, 'cp932'}}, {@shortname_win95}]}, 0x1, 0x356, &(0x7f0000000200)="$eJzs3U9oI9UfAPBvdrJJu7C/9vCDRUEYvQladise9NSydGExF5Xgn4MY3K5KUxcaDHYPzdaLeBQ86smbBz142LMIinjz4NUVxD940OOCiyPJTJJpk3a7QnYtfj6H8O1732/ee5mhmU6b15dXYqMWcTmNiLm5SlRXzq/EzUosRhJD12JSbUobAHA83Myy+CPLHbGkMuMpAQAzNnj/f/V0qeXtLw/Lz7z7A8CxV/z8P39YztxBHVdmMiUAYMYm7v8/tKe7tvdX/dXSXwUAAMfVsy+8+NRqI+KZNJ2L2Hyn2+w248lx/+rleD3asR5nYyFuReQXCv2HyuDxwsXG2tk0TXvx82I0+xXdZsRmr9vMrxRWk0F9Pc7FQiwW9cXVRpZlyYXPGmvn0oGIuNYbjB+blW7zZJwqxv/+VKzHcqTx/4n6iIuNteW0eILm5rC+F7E7vm/Rn/9SLMS3r8SVaMel6NcOL2saazvn0vR81thT323W5y6NXoUD74AAAAAAAAAAAAAAAAAAAAAAAMA/spSOLI72v8nG+/csLU3pH+yPk9cX+wPt5vsDZfUssuz3tx5tvpvEnv2B9u/P021W48S9XToAAAAAAAAAAAAAAAAAAAD8a3S2a9Fqt9e3OttXN8pBb6uzfSIi+i1vfP3JF/MxmXOboFqMUepKi6arG60sGSZnyZ6cIkj6gw9bPr4+mnE5pz5axdRp1A/uardPP/jjB+OWB5LhM/81zkli+gKTfdMoB5v/y6d0Jy/UKFi+Tc6NLMsOKt95abIqKhHVOz9whwdZP/jqp9fue6xz5vFBy+dZ7uFHFp678f5Hv2602v2RY3AEa1udW9lGq/h6+sl2cJCUzp9K5EGlfCZUDyvfLYL5iP6hbCXf/fb8/e99c7TRs3LLm1Nyknw5n+7vquVBJR+03DU/bayTU07+GQRnPlxpXd/54ZejVpW+SdioAwAAAAAAAAAAAAAAAAAA7orSZ8ULxYd9Tx5W9cTTs58ZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANw94///Xwp2J1qOEvzZi8mu+vpWJ6J2r5cJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMB/3N8BAAD//zGNaeE=") creat(&(0x7f0000000000)='./file2\x00', 0x60) 892.335093ms ago: executing program 2 (id=4885): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_LABEL={0x8, 0xb, 0x1, 0x0, 0x3}]}}}]}, 0x3c}}, 0x0) 860.773806ms ago: executing program 2 (id=4886): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x16, 0xe, &(0x7f0000001480)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d55906000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd8000000000000080231c61ccd106cb937b450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9ccd5788029901e5a79d8b9990ace8f74087f25ad50c4608800"/686], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340)}, 0x42) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000080)="05804ab382844306d758e620b9dc", 0x0, 0x12c4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) 725.644239ms ago: executing program 2 (id=4887): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x8, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000000c0)={0x1c, 0x2, 0x0, "b43d70dde5dbbbe40f00f401bbe6c9000000c67f00", 0x49433553}) 560.340246ms ago: executing program 2 (id=4888): r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000140)={0x0, 0x2, 0x1, 0x1}) 406.213021ms ago: executing program 1 (id=4889): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000808000400", @ANYRES32=r0, @ANYBLOB="06001500030000000c001680080001"], 0x38}}, 0x10) 323.443369ms ago: executing program 2 (id=4890): r0 = syz_open_procfs(0x0, &(0x7f0000000300)='net/ip6_tables_targets\x00') preadv(r0, &(0x7f0000000000)=[{&(0x7f0000001f00)=""/83, 0x53}], 0x1, 0x37, 0x0) 0s ago: executing program 2 (id=4891): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) syz_mount_image$ext4(&(0x7f0000002180)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x1008802, &(0x7f0000000000)={[{@jqfmt_vfsv1}, {@abort}, {@discard}, {@max_batch_time={'max_batch_time', 0x3d, 0x3}}, {@data_ordered}, {@mblk_io_submit}, {@usrquota}, {@nodioread_nolock}, {@errors_remount}, {}, {@auto_da_alloc}]}, 0x9, 0x606, &(0x7f0000000600)="$eJzs3c1vVFUbAPDnTD9oKe/bQt68igtpYgwkSksLGGJcwNaQBj/ixo2VFoIUaGiNFk0oCW5MjBtjTFy5EP8LJbJlpW5cuHFlSIgaliaOudM7pdPeaenH9Fbm90uGnnvu3J5zpzxzzj1zzp0A2tZg9k8lYn9ETKeI/jS/uK8z8p2DC8978OeHZ7NHimr1td9TpDyv/vyU/+zLD+6JiB++T7GvY2W5M3PXLo5PTU1ezbeHZy9ND8/MXTt84dL4+cnzk5dHXxg9cfzY8RMjRzZ0XtcL8k7ffOe9/o/H3vz6y7/SyDe/jKU4GS/nT1x6HltlMAZrr0lauavvxFYXVqLOZdtpeQY7Vkf+9+uKiCeiPzqW/DX746NXSq0c0FLVFFEF2lRaR/xnvYVW1gXYTvV+QP3afvl1cKWUXgmwHe6fWhgAWBn/nQtjg9FTGxvY/SA1jPOkiNjYyFyjPRFx987YzXN3xm5Gi8bhgGLzNyLiyaL4T7X4H4ieGKjFf6Uh/rN+wZn8Z5b/6gZ7CsuHisU/bJ+F+O9ZNf6jSfy/tST+395EHfJLkeu9DfHf6+oDAAAAAAAA1un2qYh4vujz/8ri/J8omP/TFxEnt6D8wWXbKz//r9zbgmKAAvdPRbxUOP+3Uv/8faAjT/2nNh+gK527MDV5JCL+GxGHomtXtj2yShmHP9n3RbN9g/n8v/ojK/9uPhcwr8e9zl2Nx0yMD45v9ryBiPs3Ip4qnP+bFtv/VND+Z+8H049Yxr5nb51ptm/t+AdapfpVxMHC9v/hXSvS6vfnGK71B4brvYKVnv7g02+blb/R+HeLCdi8rP3fvXr8D6Sl9+uZWfXXzRdlHp3rrDY7YGP9/9nx7vR67a5C3Xne++Ozs1dHIrrT6Y4styF/dK1XAR4zPxVn1+OhHi9Z/B96ZvXxv6L+f29BsKc/GtcU1/3/775fm1VT/x/Kk8X/xLra//UnRm8NfNes/Edr/4/V2vpDeU7W/rfuFYF/j8/rYdrdmF8Qjp1Fu7a7vgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwOKhExJ5IlaHFdKUyNBTRFxH/i92VqSszs8+du/Lu5YlsX+37/yv1b/rtX9hOte//r2Tph9uj0bh9NCL2RsRnHb217aGzV6Ymyj55AAAAAAAAAAAAAAAAAAAA2CH6mqz/z/zWUXbtgJbrLLsCQGkK4v/HMuoBbD/tP7SvDcV/mt/6igDbTvsP7Uv8Q/sS/9C+xD+0L/EP7WrZOH4qqx4AAAAAAMAW2Xvg9s8pIuZf7K09Mt35vq5Sawa0WqXsCgClcYsfaF+m/kH7co0PrDXrt6fpQZuZLzx9dhMHAwAAAAAAAAAAAEDbObjf+n9oV9b/Q/uy/h/aV339/4GS6wFsP9f4QKyxkr9w/f+aRwEAAAAAAAAAAAAAW2mmuitiamry6szctYvjLUt0R0SLi9h04o2dUY2iRG+LfnO1Wr2e/S8o/QQfj0R9KvxOqc+yRH2t36MdVd57EgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0OifAAAA//8sxicA") kernel console output (not intermixed with test programs): usb 3-1: SerialNumber: syz [ 281.801174][T11951] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 281.869695][T11977] loop0: detected capacity change from 0 to 512 [ 281.940704][T11977] EXT4-fs error (device loop0): ext4_orphan_get:1399: inode #15: comm syz.0.2781: casefold flag without casefold feature [ 282.009883][T11982] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2782'. [ 282.019185][T11982] netlink: 312 bytes leftover after parsing attributes in process `syz.1.2782'. [ 282.028899][T11977] EXT4-fs error (device loop0): ext4_orphan_get:1404: comm syz.0.2781: couldn't read orphan inode 15 (err -117) [ 282.050539][ T23] usb 3-1: Quirk or no altest; falling back to MIDI 1.0 [ 282.058531][T11982] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2782'. [ 282.068538][ T23] usb 3-1: selecting invalid altsetting 0 [ 282.137045][T11977] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 282.252834][ T23] usb 3-1: USB disconnect, device number 12 [ 282.330458][ T5792] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 282.364102][T11032] udevd[11032]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:8.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 282.725657][T11999] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2790'. [ 283.155827][T12014] loop2: detected capacity change from 0 to 256 [ 283.221336][T12018] loop1: detected capacity change from 0 to 64 [ 283.629343][T12032] loop2: detected capacity change from 0 to 128 [ 283.721415][T12032] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 283.738656][T12032] hpfs: filesystem error: improperly stopped [ 283.760556][T12032] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 283.768675][T12032] hpfs: You really don't want any checks? You are crazy... [ 283.776724][T12032] hpfs: hpfs_map_sector(): read error [ 283.782148][T12032] hpfs: code page support is disabled [ 283.790114][T12032] hpfs: hpfs_map_4sectors(): unaligned read [ 283.796547][T12032] hpfs: hpfs_map_4sectors(): unaligned read [ 283.802554][T12032] hpfs: filesystem error: unable to find root dir [ 285.145624][T12056] loop1: detected capacity change from 0 to 32768 [ 285.191041][T12056] JBD2: Invalid start block of journal: 67108866 [ 285.235959][T12056] (syz.1.2818,12056,1):ocfs2_journal_init:973 ERROR: Linux journal layer error [ 285.244978][T12056] (syz.1.2818,12056,1):ocfs2_check_volume:2405 ERROR: Could not initialize journal! [ 285.313211][T12056] (syz.1.2818,12056,1):ocfs2_check_volume:2490 ERROR: status = -22 [ 285.342128][T12056] (syz.1.2818,12056,0):ocfs2_mount_volume:1822 ERROR: status = -22 [ 285.356628][T12056] (syz.1.2818,12056,0):ocfs2_fill_super:1178 ERROR: status = -22 [ 286.149365][T12101] loop1: detected capacity change from 0 to 4096 [ 286.192842][T12101] ntfs3: loop1: Different NTFS sector size (2048) and media sector size (512). [ 286.312064][T12101] ntfs3: loop1: Failed to initialize $Extend/$ObjId. [ 286.949423][T12132] kernel read not supported for file / œÏüÔ¢W)ëS“§Ç-ë (pid: 12132 comm: syz.1.2855) [ 286.967155][ T28] audit: type=1800 audit(1760694380.194:159): pid=12132 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2855" name=20019CCFFCD4A25729EB5393A7C72DEB dev="mqueue" ino=25548 res=0 errno=0 [ 287.150099][T12139] ieee802154 phy0 wpan0: encryption failed: -22 [ 287.713275][T12164] comedi comedi3: no devices specified [ 287.737057][T12163] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 287.744962][T12163] IPv6: NLM_F_CREATE should be set when creating new route [ 288.388050][T12186] __nla_validate_parse: 1 callbacks suppressed [ 288.388070][T12186] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2882'. [ 288.400501][T12188] loop1: detected capacity change from 0 to 256 [ 288.449945][T12186] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2882'. [ 288.494415][T12188] FAT-fs (loop1): Directory bread(block 64) failed [ 288.506177][T12188] FAT-fs (loop1): Directory bread(block 65) failed [ 288.516544][T12188] FAT-fs (loop1): Directory bread(block 66) failed [ 288.523169][T12188] FAT-fs (loop1): Directory bread(block 67) failed [ 288.607985][T12188] FAT-fs (loop1): Directory bread(block 68) failed [ 288.614598][T12188] FAT-fs (loop1): Directory bread(block 69) failed [ 288.649642][T12188] FAT-fs (loop1): Directory bread(block 70) failed [ 288.666339][T12188] FAT-fs (loop1): Directory bread(block 71) failed [ 288.686003][T12196] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 288.691017][T12188] FAT-fs (loop1): Directory bread(block 72) failed [ 288.716082][T12188] FAT-fs (loop1): Directory bread(block 73) failed [ 288.815978][T12200] netlink: 'syz.3.2889': attribute type 13 has an invalid length. [ 288.895507][T12204] IPv6: Can't replace route, no match found [ 289.593070][T12228] netlink: 'syz.2.2903': attribute type 1 has an invalid length. [ 289.800117][T12236] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2907'. [ 290.053822][T12240] loop2: detected capacity change from 0 to 4096 [ 290.090582][T12240] ntfs3: loop2: Different NTFS sector size (1024) and media sector size (512). [ 290.145562][T12218] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 290.632972][T12234] loop1: detected capacity change from 0 to 32768 [ 290.656350][T12256] xt_l2tp: missing protocol rule (udp|l2tpip) [ 290.695383][T12234] (syz.1.2906,12234,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 290.753627][T12234] (syz.1.2906,12234,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 290.824034][T12234] JBD2: Ignoring recovery information on journal [ 290.961391][T12234] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 291.259442][ T5789] ocfs2: Unmounting device (7,1) on (node local) [ 291.346552][ T5793] Bluetooth: hci0: command 0x0406 tx timeout [ 291.388182][T12282] netlink: 176 bytes leftover after parsing attributes in process `syz.3.2930'. [ 291.401970][T12278] loop0: detected capacity change from 0 to 512 [ 291.517948][T12278] EXT4-fs error (device loop0): ext4_xattr_inode_iget:440: inode #11: comm syz.0.2928: missing EA_INODE flag [ 291.661131][T12278] EXT4-fs error (device loop0): ext4_xattr_inode_iget:445: comm syz.0.2928: error while reading EA inode 11 err=-117 [ 291.700530][T12278] EXT4-fs (loop0): 1 orphan inode deleted [ 291.747868][T12278] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 292.044352][ T5792] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 292.166078][T12307] (unnamed net_device) (uninitialized): option xmit_hash_policy: invalid value (13) [ 292.695965][ T5856] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 292.759314][T12326] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2949'. [ 292.906155][ T5856] usb 2-1: Using ep0 maxpacket: 16 [ 292.916920][ T5856] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 292.936148][ T5856] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 292.959885][ T5856] usb 2-1: config 0 has no interface number 0 [ 292.980410][ T5856] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 293.002828][ T5856] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 293.023461][ T5856] usb 2-1: Product: syz [ 293.038533][ T5856] usb 2-1: Manufacturer: syz [ 293.043339][ T5856] usb 2-1: SerialNumber: syz [ 293.088998][ T5856] usb 2-1: config 0 descriptor?? [ 293.097717][ T5856] usb 2-1: Found UVC 0.00 device syz (046d:08f3) [ 293.104136][ T5856] usb 2-1: No valid video chain found. [ 293.337108][ T23] usb 2-1: USB disconnect, device number 18 [ 293.524158][T12346] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2959'. [ 293.570782][T12330] loop0: detected capacity change from 0 to 32768 [ 293.580798][T12330] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 scanned by syz.0.2951 (12330) [ 293.586165][ T9] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 293.607088][T12330] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 293.634238][T12330] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm [ 293.664432][T12330] BTRFS info (device loop0): force clearing of disk cache [ 293.697906][T12330] BTRFS info (device loop0): turning on sync discard [ 293.704735][T12330] BTRFS info (device loop0): max_inline at 0 [ 293.715987][T12330] BTRFS info (device loop0): setting nodatacow, compression disabled [ 293.734044][T12330] BTRFS info (device loop0): using free space tree [ 293.795925][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 293.805038][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 293.826003][ T9] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 293.843461][ T9] usb 3-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 293.880033][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 293.882365][T12330] BTRFS info (device loop0): enabling ssd optimizations [ 293.906118][ T9] usb 3-1: Product: syz [ 293.910445][ T9] usb 3-1: Manufacturer: syz [ 293.915078][ T9] usb 3-1: SerialNumber: syz [ 293.938476][ T9] usb 3-1: config 0 descriptor?? [ 293.947849][T12330] BTRFS info (device loop0): rebuilding free space tree [ 294.042658][T12330] BTRFS info (device loop0): checking UUID tree [ 294.207883][ T5792] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 294.455128][ T9] usb 3-1: USB disconnect, device number 13 [ 295.575560][T12414] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2984'. [ 295.627821][T12414] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2984'. [ 295.860721][T12427] netlink: 424 bytes leftover after parsing attributes in process `syz.1.2991'. [ 295.899950][T12427] netlink: 'syz.1.2991': attribute type 1 has an invalid length. [ 296.271582][T12442] loop1: detected capacity change from 0 to 1024 [ 296.344384][T12442] hfsplus: inconsistency in B*Tree (128,1,255,1,0) [ 296.360543][T12442] hfsplus: xattr searching failed [ 296.386443][T12442] syz.1.2999: attempt to access beyond end of device [ 296.386443][T12442] loop1: rw=0, sector=917504, nr_sectors = 2 limit=1024 [ 296.422581][T12442] Buffer I/O error on dev loop1, logical block 458752, async page read [ 296.471517][T12442] hfsplus: unable to mark blocks free: error -5 [ 296.496393][T12442] hfsplus: can't free extent [ 296.555277][T12451] netlink: 100 bytes leftover after parsing attributes in process `syz.2.3003'. [ 296.722833][T12455] (null): rxe_set_mtu: Set mtu to 1024 [ 297.279742][T12455] infiniband syz!: set active [ 297.293338][T12455] infiniband syz!: added team_slave_0 [ 297.649479][T12455] RDS/IB: syz!: added [ 297.684582][T12455] smc: adding ib device syz! with port count 1 [ 297.713055][T12455] smc: ib device syz! port 1 has pnetid [ 297.820706][T12465] loop0: detected capacity change from 0 to 32768 [ 297.924493][T12465] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 297.951206][T12494] loop1: detected capacity change from 0 to 1024 [ 298.002326][T12465] (syz.0.3010,12465,1):ocfs2_check_dir_entry:325 ERROR: bad entry in directory #65: rec_len is too small for name_len - offset=0, inode=65, rec_len=16, name_len=8 [ 298.040143][T12465] (syz.0.3010,12465,0):ocfs2_prepare_dir_for_insert:4312 ERROR: status = -2 [ 298.092464][T12465] (syz.0.3010,12465,0):ocfs2_mknod:298 ERROR: status = -2 [ 298.123518][T12465] (syz.0.3010,12465,0):ocfs2_mknod:502 ERROR: status = -2 [ 298.136206][T12465] (syz.0.3010,12465,1):ocfs2_create:676 ERROR: status = -2 [ 298.284157][T12500] loop1: detected capacity change from 0 to 128 [ 298.318172][T12500] EXT4-fs: Ignoring removed nomblk_io_submit option [ 298.324838][T12500] EXT4-fs: Ignoring removed nomblk_io_submit option [ 298.365982][T12500] EXT4-fs (loop1): Test dummy encryption mode enabled [ 298.367072][ T5792] ocfs2: Unmounting device (7,0) on (node local) [ 298.440135][T12500] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 298.534044][T12500] ext4 filesystem being mounted at /689/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 298.770116][ T5789] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 298.932950][T12514] loop0: detected capacity change from 0 to 4096 [ 299.271062][T12527] loop2: detected capacity change from 0 to 136 [ 299.388380][T12527] syz.2.3038: attempt to access beyond end of device [ 299.388380][T12527] loop2: rw=524288, sector=164, nr_sectors = 64 limit=136 [ 299.465673][T12527] syz.2.3038: attempt to access beyond end of device [ 299.465673][T12527] loop2: rw=524288, sector=228, nr_sectors = 128 limit=136 [ 299.513923][T12527] syz.2.3038: attempt to access beyond end of device [ 299.513923][T12527] loop2: rw=0, sector=164, nr_sectors = 8 limit=136 [ 299.538438][ T28] audit: type=1800 audit(1760694392.764:160): pid=12527 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3038" name="file0" dev="loop2" ino=1542 res=0 errno=0 [ 299.726010][ T786] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 299.768555][ T28] audit: type=1326 audit(1760694392.994:161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12536 comm="syz.1.3043" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e4d78efc9 code=0x7ffc0000 [ 299.824728][ T28] audit: type=1326 audit(1760694392.994:162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12536 comm="syz.1.3043" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e4d78efc9 code=0x7ffc0000 [ 299.912546][ T28] audit: type=1326 audit(1760694392.994:163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12536 comm="syz.1.3043" exe="/root/syz-executor" sig=0 arch=c000003e syscall=122 compat=0 ip=0x7f7e4d78efc9 code=0x7ffc0000 [ 299.938604][ T786] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 299.951636][ T28] audit: type=1326 audit(1760694392.994:164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12536 comm="syz.1.3043" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e4d78efc9 code=0x7ffc0000 [ 299.964999][ T786] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 300.025500][ T786] usb 1-1: config 220 has no interface number 2 [ 300.038783][ T28] audit: type=1326 audit(1760694392.994:165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12536 comm="syz.1.3043" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e4d78efc9 code=0x7ffc0000 [ 300.048310][ T786] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 300.124459][ T786] usb 1-1: config 220 interface 0 has no altsetting 0 [ 300.163309][ T786] usb 1-1: config 220 interface 76 has no altsetting 0 [ 300.178139][ T786] usb 1-1: config 220 interface 1 has no altsetting 0 [ 300.207393][ T786] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 300.227710][ T786] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 300.247593][ T786] usb 1-1: Product: syz [ 300.252032][T12547] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3048'. [ 300.261563][ T786] usb 1-1: Manufacturer: syz [ 300.266552][ T786] usb 1-1: SerialNumber: syz [ 300.494269][ T786] usb 1-1: selecting invalid altsetting 0 [ 300.510923][ T786] usb 1-1: Found UVC 7.01 device syz (8086:0b07) [ 300.540073][ T786] usb 1-1: No valid video chain found. [ 300.554119][T12555] netlink: 168 bytes leftover after parsing attributes in process `syz.3.3052'. [ 300.564318][ T786] usb 1-1: selecting invalid altsetting 0 [ 300.571263][ T786] usbtest: probe of 1-1:220.1 failed with error -22 [ 300.596176][ T786] usb 1-1: USB disconnect, device number 23 [ 300.995373][T12571] netlink: 'syz.2.3060': attribute type 32 has an invalid length. [ 301.036385][ T5960] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 301.260164][T12577] loop0: detected capacity change from 0 to 4096 [ 301.268769][ T5960] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 301.283568][ T5960] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 301.286071][T12577] ntfs3: loop0: Different NTFS sector size (2048) and media sector size (512). [ 301.308104][T12575] loop2: detected capacity change from 0 to 4096 [ 301.312713][ T5960] usb 2-1: Product: syz [ 301.343563][ T5960] usb 2-1: Manufacturer: syz [ 301.361730][ T5960] usb 2-1: SerialNumber: syz [ 301.370844][T12577] ntfs3: loop0: Mark volume as dirty due to NTFS errors [ 301.385735][T12577] ntfs3: loop0: Failed to load $Extend (-22). [ 301.400914][T12580] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 301.401950][ T5960] usb 2-1: config 0 descriptor?? [ 301.427796][T12577] ntfs3: loop0: Failed to initialize $Extend. [ 301.511977][T12575] NILFS error (device loop2): nilfs_dotdot: directory #12 missing '.' [ 301.551373][T12575] Remounting filesystem read-only [ 301.730218][ T5960] hso 2-1:0.0: Failed to find BULK IN ep [ 301.753176][ T5960] usb-storage 2-1:0.0: USB Mass Storage device detected [ 302.005744][ T5960] usb 2-1: USB disconnect, device number 19 [ 302.134011][T12597] loop0: detected capacity change from 0 to 8 [ 302.166977][T12597] MTD: Attempt to mount non-MTD device "/dev/loop0" [ 302.203391][ T5804] udevd[5804]: incorrect cramfs checksum on /dev/loop0 [ 302.238414][ T5794] udevd[5794]: incorrect cramfs checksum on /dev/loop0 [ 302.241441][T12597] cramfs: Error -5 while decompressing! [ 302.253337][T12597] cramfs: ffffffff96fdc348(26)->ffff888075ef6000(4096) [ 302.281664][T12597] cramfs: Error -3 while decompressing! [ 302.303408][T12597] cramfs: ffffffff96fdc362(26)->ffff888075ee5000(4096) [ 302.346207][T12597] cramfs: Error -3 while decompressing! [ 302.353504][T12597] cramfs: ffffffff96fdc37c(16)->ffff888057320000(4096) [ 302.372468][T12597] cramfs: Error -5 while decompressing! [ 302.381232][T12597] cramfs: ffffffff96fdc348(26)->ffff888075ef6000(4096) [ 302.388870][ T28] audit: type=1800 audit(1760694395.614:166): pid=12597 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.3072" name="file2" dev="loop0" ino=348 res=0 errno=0 [ 302.593806][T12611] netlink: 'syz.0.3078': attribute type 2 has an invalid length. [ 302.616765][T12611] netlink: 'syz.0.3078': attribute type 8 has an invalid length. [ 302.624581][T12611] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3078'. [ 303.373983][T12642] loop2: detected capacity change from 0 to 1024 [ 303.558894][ T1145] hfsplus: b-tree write err: -5, ino 4 [ 303.560011][T12648] (null): rxe_set_mtu: Set mtu to 1024 [ 303.606767][T12648] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 303.697927][ T28] audit: type=1326 audit(1760694396.924:167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12652 comm="syz.3.3100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f8278efc9 code=0x7ff00000 [ 303.777213][ T28] audit: type=1326 audit(1760694396.924:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12652 comm="syz.3.3100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f8278efc9 code=0x7ff00000 [ 303.803157][ T28] audit: type=1326 audit(1760694396.924:169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12652 comm="syz.3.3100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f8278efc9 code=0x7ff00000 [ 303.825539][ C0] vkms_vblank_simulate: vblank timer overrun [ 303.864789][T12656] netlink: 256 bytes leftover after parsing attributes in process `syz.1.3101'. [ 304.063433][T12666] netlink: 'syz.2.3106': attribute type 4 has an invalid length. [ 304.287833][T12674] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3109'. [ 304.323818][T12674] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3109'. [ 304.396089][T12674] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3109'. [ 304.971527][T12700] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3121'. [ 305.162024][T12707] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3126'. [ 305.853898][T12735] loop0: detected capacity change from 0 to 164 [ 306.636782][T12763] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3152'. [ 307.093264][T12781] netlink: 'syz.0.3163': attribute type 2 has an invalid length. [ 308.133709][T12791] loop1: detected capacity change from 0 to 32768 [ 308.191423][T12791] [ 308.191423][T12791] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 308.191423][T12791] [ 308.337456][T12791] ERROR: (device loop1): dbAlloc: the hint is outside the map [ 308.337456][T12791] [ 308.534967][ T8449] read_mapping_page failed! [ 308.585156][ T8449] ERROR: (device loop1): txCommit: [ 308.585156][ T8449] [ 308.612533][ T8449] jfs_write_inode: jfs_commit_inode failed! [ 308.629040][ T5789] [ 308.629040][ T5789] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 308.629040][ T5789] [ 308.651220][ T5789] [ 308.651220][ T5789] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 308.651220][ T5789] [ 308.766607][T12825] cgroup: noprefix used incorrectly [ 309.233746][T12840] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3191'. [ 309.261511][T12842] loop0: detected capacity change from 0 to 164 [ 309.347527][T12842] isofs: Unable to find the ".." directory for NFS. [ 310.019456][T12870] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 310.575650][T12890] loop1: detected capacity change from 0 to 1024 [ 310.604363][T12890] EXT4-fs: Ignoring removed nomblk_io_submit option [ 310.614745][T12890] EXT4-fs: Ignoring removed nomblk_io_submit option [ 310.637052][T12890] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 310.663718][T12890] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 310.738251][T12898] netlink: 2 bytes leftover after parsing attributes in process `syz.2.3217'. [ 310.762105][T12890] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 310.791443][T12900] comedi comedi3: pcl724: I/O port conflict (0x84f27,4) [ 310.964067][T12906] kernel read not supported for file /½ Iqî"ûIvÃQhþµ“3žJÇÈyûxÐîÃüv÷Lª=QÿW-™. Gaǹ”óW£ (pid: 12906 comm: syz.3.3222) [ 310.969652][ T5789] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 310.978706][ T28] kauditd_printk_skb: 75 callbacks suppressed [ 310.978720][ T28] audit: type=1800 audit(1760694404.204:245): pid=12906 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.3222" name=BD16204971EE22FB4976C3015168FEB51D9093339E8F064AC7C879FB78D0EEC3FC76F74CAA3D5118FF572D05992E1A09476115C7B9949DF357A3 dev="mqueue" ino=28834 res=0 errno=0 [ 311.136355][ T5960] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 311.341450][ T5960] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 311.371234][ T5960] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.413043][ T5960] usb 1-1: config 0 descriptor?? [ 311.443522][ T5960] cp210x 1-1:0.0: cp210x converter detected [ 311.663856][ T5960] usb 1-1: cp210x converter now attached to ttyUSB0 [ 311.843698][ T23] usb 1-1: USB disconnect, device number 24 [ 311.876525][ T23] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 311.885094][ T23] cp210x 1-1:0.0: device disconnected [ 312.054729][T12934] futex_wake_op: syz.2.3235 tries to shift op by -1; fix this program [ 312.140895][T12918] loop1: detected capacity change from 0 to 32768 [ 312.215987][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 312.252209][T12918] XFS (loop1): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 312.517303][T12918] XFS (loop1): Ending clean mount [ 312.662967][T12918] tmpfs: Bad value for 'mpol' [ 312.765256][ T5789] XFS (loop1): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 312.945614][T12966] xt_policy: too many policy elements [ 314.026528][T12977] loop1: detected capacity change from 0 to 32768 [ 314.041860][T12977] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by syz.1.3246 (12977) [ 314.085364][T12977] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 314.115395][T12977] BTRFS info (device loop1): using sha256 (sha256-avx2) checksum algorithm [ 314.145655][T12977] BTRFS info (device loop1): using free space tree [ 314.178001][T12996] syz.0.3260: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz0,mems_allowed=0-1 [ 314.216250][T12996] CPU: 0 PID: 12996 Comm: syz.0.3260 Not tainted syzkaller #0 [ 314.223817][T12996] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 314.233912][T12996] Call Trace: [ 314.237234][T12996] [ 314.240202][T12996] dump_stack_lvl+0x16c/0x230 [ 314.245026][T12996] ? show_regs_print_info+0x20/0x20 [ 314.250294][T12996] ? load_image+0x3b0/0x3b0 [ 314.254846][T12996] ? __rcu_read_unlock+0x7c/0xd0 [ 314.259831][T12996] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 314.266293][T12996] ? cpuset_print_current_mems_allowed+0x2e3/0x360 [ 314.272867][T12996] warn_alloc+0x210/0x300 [ 314.277303][T12996] ? stack_trace_save+0x9c/0xe0 [ 314.282192][T12996] ? zone_watermark_ok_safe+0x230/0x230 [ 314.287779][T12996] ? kasan_set_track+0x5f/0x70 [ 314.292567][T12996] ? kasan_set_track+0x4e/0x70 [ 314.297359][T12996] ? __kasan_kmalloc+0x8f/0xa0 [ 314.302153][T12996] ? xsk_init_queue+0xb0/0x110 [ 314.306941][T12996] ? xsk_setsockopt+0x43c/0x6f0 [ 314.311813][T12996] ? do_sock_setsockopt+0x175/0x1a0 [ 314.317042][T12996] ? __x64_sys_setsockopt+0x184/0x200 [ 314.322445][T12996] __vmalloc_node_range+0x126/0x1320 [ 314.327797][T12996] ? free_vm_area+0x50/0x50 [ 314.332344][T12996] vmalloc_user+0x74/0x80 [ 314.336691][T12996] ? xskq_create+0xbf/0x170 [ 314.341203][T12996] xskq_create+0xbf/0x170 [ 314.345547][T12996] xsk_init_queue+0xb0/0x110 [ 314.350154][T12996] xsk_setsockopt+0x43c/0x6f0 [ 314.354849][T12996] ? xsk_poll+0x670/0x670 [ 314.359198][T12996] ? __fget_files+0x28/0x4d0 [ 314.363804][T12996] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 314.369363][T12996] ? security_socket_setsockopt+0x7e/0xa0 [ 314.375087][T12996] ? xsk_poll+0x670/0x670 [ 314.379425][T12996] do_sock_setsockopt+0x175/0x1a0 [ 314.384472][T12996] ? __fdget+0x180/0x210 [ 314.388733][T12996] __x64_sys_setsockopt+0x184/0x200 [ 314.393964][T12996] do_syscall_64+0x55/0xb0 [ 314.398419][T12996] ? clear_bhb_loop+0x40/0x90 [ 314.403119][T12996] ? clear_bhb_loop+0x40/0x90 [ 314.407813][T12996] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 314.413723][T12996] RIP: 0033:0x7f8b8898efc9 [ 314.418153][T12996] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 314.437946][T12996] RSP: 002b:00007f8b8981c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 314.446378][T12996] RAX: ffffffffffffffda RBX: 00007f8b88be5fa0 RCX: 00007f8b8898efc9 [ 314.454363][T12996] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 314.462351][T12996] RBP: 00007f8b88a11f91 R08: 0000000000000004 R09: 0000000000000000 [ 314.470335][T12996] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 314.478323][T12996] R13: 00007f8b88be6038 R14: 00007f8b88be5fa0 R15: 00007fffdb04d668 [ 314.486326][T12996] [ 314.541370][T12996] Mem-Info: [ 314.551601][T12996] active_anon:10216 inactive_anon:0 isolated_anon:0 [ 314.551601][T12996] active_file:11338 inactive_file:40375 isolated_file:0 [ 314.551601][T12996] unevictable:768 dirty:333 writeback:0 [ 314.551601][T12996] slab_reclaimable:10597 slab_unreclaimable:95331 [ 314.551601][T12996] mapped:25026 shmem:5588 pagetables:605 [ 314.551601][T12996] sec_pagetables:0 bounce:0 [ 314.551601][T12996] kernel_misc_reclaimable:0 [ 314.551601][T12996] free:1346618 free_pcp:11084 free_cma:0 [ 314.567031][T13005] syz.2.3262[13005] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 314.629947][T12996] Node 0 active_anon:40664kB inactive_anon:0kB active_file:45240kB inactive_file:161304kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:100000kB dirty:1328kB writeback:0kB shmem:20816kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12236kB pagetables:2520kB sec_pagetables:0kB all_unreclaimable? no [ 314.678158][T13005] syz.2.3262[13005] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 314.683278][T12996] Node 1 active_anon:0kB inactive_anon:0kB active_file:112kB inactive_file:196kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:104kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 314.752890][T12977] BTRFS info (device loop1): enabling ssd optimizations [ 314.766496][T12996] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 314.793163][T12977] BTRFS info (device loop1): auto enabling async discard [ 314.815946][T12996] lowmem_reserve[]: 0 2525 2526 2526 2526 [ 314.847101][T12996] Node 0 DMA32 free:1476108kB boost:0kB min:34676kB low:43344kB high:52012kB reserved_highatomic:0KB active_anon:40816kB inactive_anon:0kB active_file:45240kB inactive_file:159984kB unevictable:1536kB writepending:1328kB present:3129332kB managed:2589604kB mlocked:0kB bounce:0kB free_pcp:20424kB local_pcp:2412kB free_cma:0kB [ 314.914976][T12996] lowmem_reserve[]: 0 0 1 1 1 [ 314.923378][T12996] Node 0 Normal free:16kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1320kB unevictable:0kB writepending:0kB present:1048576kB managed:1384kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 314.972606][T12996] lowmem_reserve[]: 0 0 0 0 0 [ 315.047478][ T5789] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 315.068657][T12996] Node 1 Normal free:3894004kB boost:0kB min:55208kB low:69008kB high:82808kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:112kB inactive_file:196kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:23968kB local_pcp:14688kB free_cma:0kB [ 315.109823][T12996] lowmem_reserve[]: 0 0 0 0 0 [ 315.114660][T12996] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 315.155625][T12996] Node 0 DMA32: 1026*4kB (UE) 267*8kB (UM) 204*16kB (UE) 294*32kB (UM) 283*64kB (UM) 65*128kB (UME) 39*256kB (UME) 30*512kB (UM) 24*1024kB (UME) 6*2048kB (UM) 334*4096kB (UM) = 1475616kB [ 315.305864][T12996] Node 0 Normal: 0*4kB 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16kB [ 315.339748][T12996] Node 1 Normal: 241*4kB (UME) 50*8kB (UE) 50*16kB (UE) 86*32kB (UE) 23*64kB (UME) 10*128kB (UME) 3*256kB (UME) 1*512kB (U) 2*1024kB (UE) 2*2048kB (UE) 947*4096kB (M) = 3894004kB [ 315.485826][T12996] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 315.495463][T12996] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 315.542091][T12996] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 315.561197][T12996] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 315.585819][T12996] 54339 total pagecache pages [ 315.590597][T12996] 0 pages in swap cache [ 315.604872][T12996] Free swap = 124472kB [ 315.629934][T12996] Total swap = 124996kB [ 315.634166][T12996] 2097051 pages RAM [ 315.670502][T12996] 0 pages HighMem/MovableOnly [ 315.675398][T12996] 416136 pages reserved [ 315.710278][T12996] 0 pages cma reserved [ 316.102600][T13048] 8021q: adding VLAN 0 to HW filter on device bond2 [ 316.116228][T13052] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 316.577166][T13068] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 316.584394][T13068] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 316.612569][T13068] vhci_hcd vhci_hcd.0: Device attached [ 316.629956][T13074] vhci_hcd vhci_hcd.0: pdev(1) rhport(1) sockfd(6) [ 316.636816][T13074] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 316.647133][T13074] vhci_hcd vhci_hcd.0: Device attached [ 316.661593][T13075] vhci_hcd: connection closed [ 316.662909][T13069] vhci_hcd: connection closed [ 316.670805][ T11] vhci_hcd: stop threads [ 316.720642][ T11] vhci_hcd: release socket [ 316.725184][ T11] vhci_hcd: disconnect device [ 316.765900][ T11] vhci_hcd: stop threads [ 316.770240][ T11] vhci_hcd: release socket [ 316.787289][ T11] vhci_hcd: disconnect device [ 316.805939][ T23] vhci_hcd: vhci_device speed not set [ 317.150203][T13093] loop2: detected capacity change from 0 to 128 [ 317.229933][T13097] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3298'. [ 317.306679][T13099] tmpfs: Bad value for 'mpol' [ 317.356870][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.363253][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.586072][ T5856] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 317.815889][ T5856] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 317.852154][ T5856] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 317.877706][ T5856] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 317.916070][ T5856] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.949962][T13101] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 317.983782][ T5856] usb 2-1: Quirk or no altest; falling back to MIDI 1.0 [ 318.384727][ T5874] usb 2-1: USB disconnect, device number 20 [ 318.859037][T13153] netlink: 'syz.0.3327': attribute type 10 has an invalid length. [ 318.877433][T13153] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3327'. [ 318.896003][T13153] ipvlan1: entered promiscuous mode [ 318.901291][T13153] ipvlan1: entered allmulticast mode [ 318.925620][T13153] veth0_vlan: entered allmulticast mode [ 318.943217][T13153] bridge0: port 3(ipvlan1) entered blocking state [ 318.963216][T13153] bridge0: port 3(ipvlan1) entered disabled state [ 318.971093][T13156] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3330'. [ 318.983089][T13153] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 318.984085][T13157] loop2: detected capacity change from 0 to 8 [ 319.219550][T13161] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3332'. [ 320.711209][T13221] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 320.717900][T13221] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 320.752193][T13221] vhci_hcd vhci_hcd.0: Device attached [ 320.782662][T13221] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(5) [ 320.789262][T13221] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 320.821506][T13221] vhci_hcd vhci_hcd.0: Device attached [ 320.839204][T13226] vhci_hcd: connection closed [ 320.841118][ T3453] vhci_hcd: stop threads [ 320.861449][T13222] vhci_hcd: connection closed [ 320.861912][ T3453] vhci_hcd: release socket [ 320.872597][T13229] loop2: detected capacity change from 0 to 2048 [ 320.891129][ T3453] vhci_hcd: disconnect device [ 320.898030][ T3453] vhci_hcd: stop threads [ 320.907443][ T3453] vhci_hcd: release socket [ 320.913123][T13229] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 320.923048][ T3453] vhci_hcd: disconnect device [ 320.966369][ T5855] vhci_hcd: vhci_device speed not set [ 320.994457][T13234] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 321.048070][T13229] NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157 [ 321.069876][T13229] NILFS error (device loop2): nilfs_bmap_last_key: broken bmap (inode number=16) [ 321.094082][T13229] Remounting filesystem read-only [ 321.105080][T13236] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3365'. [ 321.110199][T13229] NILFS (loop2): error -5 truncating bmap (ino=16) [ 321.115805][T13236] netlink: 540 bytes leftover after parsing attributes in process `syz.1.3365'. [ 321.200690][ T5795] NILFS (loop2): discard dirty page: offset=4096, ino=6 [ 321.222738][ T5795] NILFS (loop2): discard dirty block: blocknr=39, size=1024 [ 321.251319][ T5795] NILFS (loop2): discard dirty block: blocknr=18446744073709551615, size=1024 [ 321.261220][ T5795] NILFS (loop2): discard dirty block: blocknr=18446744073709551615, size=1024 [ 321.271247][ T5795] NILFS (loop2): discard dirty block: blocknr=18446744073709551615, size=1024 [ 321.280852][ T5795] NILFS (loop2): disposed unprocessed dirty file(s) when detaching log writer [ 321.978489][T13267] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3383'. [ 321.987558][T13267] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3383'. [ 322.015999][T13267] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3383'. [ 322.525986][T13291] netlink: 'syz.3.3393': attribute type 63 has an invalid length. [ 322.544550][T13291] netlink: 5 bytes leftover after parsing attributes in process `syz.3.3393'. [ 322.730384][T13297] (null): rxe_set_mtu: Set mtu to 1024 [ 322.783560][T13301] netlink: 'syz.2.3398': attribute type 10 has an invalid length. [ 322.804325][T13301] veth1_macvtap: left promiscuous mode [ 323.036222][ T5855] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 323.046529][T13297] infiniband syz1: set active [ 323.056734][T13297] infiniband syz1: added syz_tun [ 323.160032][T13297] RDS/IB: syz1: added [ 323.179347][T13297] smc: adding ib device syz1 with port count 1 [ 323.220837][T13297] smc: ib device syz1 port 1 has pnetid [ 323.242678][ T5855] usb 4-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 323.274431][ T5855] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 31, changing to 7 [ 323.321875][ T5855] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 323.361407][ T5855] usb 4-1: language id specifier not provided by device, defaulting to English [ 323.381743][ T5855] usb 4-1: New USB device found, idVendor=2013, idProduct=0251, bcdDevice=e8.6e [ 323.391941][ T5855] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 323.401485][ T5855] usb 4-1: Manufacturer: ‰ [ 323.410730][ T5855] usb 4-1: SerialNumber: syz [ 323.428638][ T5855] usb 4-1: config 0 descriptor?? [ 323.450087][ T5855] em28xx 4-1:0.0: New device ‰ @ 480 Mbps (2013:0251, interface 0, class 0) [ 323.461898][ T5855] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 323.586348][T13317] loop2: detected capacity change from 0 to 4096 [ 323.635220][T13317] ntfs3: loop2: Different NTFS sector size (4096) and media sector size (512). [ 323.738843][ T5855] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 323.748938][T13317] ntfs3: loop2: Failed to initialize $Extend/$Reparse. [ 323.779323][ T5855] em28xx 4-1:0.0: Config register raw data: 0xfffffffb [ 323.816246][ T5855] em28xx 4-1:0.0: AC97 chip type couldn't be determined [ 323.835854][ T5855] em28xx 4-1:0.0: No AC97 audio processor [ 323.895545][ T5855] usb 4-1: USB disconnect, device number 16 [ 323.925728][ T5855] em28xx 4-1:0.0: Disconnecting em28xx [ 323.951876][ T5855] em28xx 4-1:0.0: Freeing device [ 324.239331][T13331] libceph: resolve 'c' (ret=-3): failed [ 324.474047][T13339] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3415'. [ 324.484039][T13339] netlink: 9 bytes leftover after parsing attributes in process `syz.0.3415'. [ 324.498197][T13339] netlink: 9 bytes leftover after parsing attributes in process `syz.0.3415'. [ 324.511815][T13339] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 324.666097][ T5855] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 324.731592][T13343] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3417'. [ 324.884363][ T5855] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 324.907656][ T5855] usb 3-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=48.99 [ 324.922592][ T5855] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.931268][ T5855] usb 3-1: Product: syz [ 324.935556][ T5855] usb 3-1: Manufacturer: syz [ 324.953945][ T5855] usb 3-1: SerialNumber: syz [ 324.967838][ T5855] usb 3-1: config 0 descriptor?? [ 324.986968][ T5855] usb 3-1: Quirk or no altest; falling back to MIDI 1.0 [ 325.050303][T13349] libceph: resolve '. [ 325.050303][T13349] #)|.زf͹Dza×ïÅ2sˆoÖw¿úÕ?£'Ê%ÐKAq‰f»CÖê¨Âz¿e­Sb3L)Hyúo¤¶ÿÿÿÿÿÿÿ÷ǤÜYšM¤¨ìó¤h‡E$ [ 325.050303][T13349] ' (ret=-3): failed [ 325.139372][T13354] cifs: Unknown parameter '2í¡Qƒé [ 325.139372][T13354] @Ý"2a×ch}#úä`Ü[TäŒ&¬æ:ÅèÙ"‚Õëï1:ºÃÃÓ­'Ä4,Zz-#FÇ<æõ]%gCžÊ [ 325.139372][T13354] SÃÿ' [ 325.258568][ T5855] snd-usb-audio: probe of 3-1:0.0 failed with error -2 [ 325.334448][ T5794] udevd[5794]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 325.496060][ T5855] usb 3-1: USB disconnect, device number 14 [ 325.668608][T13370] Cannot find add_set index 2 as target [ 325.948029][T13380] netlink: 'syz.1.3434': attribute type 3 has an invalid length. [ 326.396017][ T5960] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 326.570587][T13404] loop1: detected capacity change from 0 to 256 [ 326.582412][T13404] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 326.628364][ T5960] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 326.650587][ T5960] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 326.684513][ T5960] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 326.706549][ T5960] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 326.720236][T13402] loop0: detected capacity change from 0 to 4096 [ 326.738372][T13386] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 326.749979][T13402] ntfs3: loop0: Different NTFS sector size (4096) and media sector size (512). [ 326.767955][ T5960] usb 4-1: Quirk or no altest; falling back to MIDI 1.0 [ 326.807018][T13402] ntfs3: loop0: Failed to initialize $Extend/$Reparse. [ 327.185397][ T5960] usb 4-1: USB disconnect, device number 17 [ 327.383331][T13394] loop2: detected capacity change from 0 to 32768 [ 327.473625][T13394] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 327.701027][ T5795] ocfs2: Unmounting device (7,2) on (node local) [ 327.784560][T13418] loop0: detected capacity change from 0 to 256 [ 327.943936][T13406] loop1: detected capacity change from 0 to 32768 [ 327.999616][T13406] [ 327.999616][T13406] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 327.999616][T13406] [ 328.060839][T13406] ERROR: (device loop1): ea_get: invalid ea.flag [ 328.060839][T13406] [ 328.117673][T13406] ERROR: (device loop1): remounting filesystem as read-only [ 328.236025][T13424] netlink: 'syz.3.3457': attribute type 64 has an invalid length. [ 328.271379][T13424] netlink: 9 bytes leftover after parsing attributes in process `syz.3.3457'. [ 328.397392][T13429] netlink: 'syz.0.3459': attribute type 62 has an invalid length. [ 328.765981][T13440] netlink: 11 bytes leftover after parsing attributes in process `syz.3.3464'. [ 329.020914][T13446] loop0: detected capacity change from 0 to 256 [ 329.172085][T13446] FAT-fs (loop0): Directory bread(block 64) failed [ 329.204346][T13446] FAT-fs (loop0): Directory bread(block 65) failed [ 329.216129][T13446] FAT-fs (loop0): Directory bread(block 66) failed [ 329.226448][T13446] FAT-fs (loop0): Directory bread(block 67) failed [ 329.233136][T13446] FAT-fs (loop0): Directory bread(block 68) failed [ 329.302431][T13446] FAT-fs (loop0): Directory bread(block 69) failed [ 329.336212][T13446] FAT-fs (loop0): Directory bread(block 70) failed [ 329.373753][T13446] FAT-fs (loop0): Directory bread(block 71) failed [ 329.403982][T13446] FAT-fs (loop0): Directory bread(block 72) failed [ 329.424848][T13446] FAT-fs (loop0): Directory bread(block 73) failed [ 329.640239][T13456] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3471'. [ 331.457753][T13506] loop0: detected capacity change from 0 to 4096 [ 331.487421][T13506] ntfs: (device loop0): parse_options(): Option utf8 is no longer supported, using option nls=utf8. Please use option nls=utf8 in the future and make sure utf8 is compiled either as a module or into the kernel. [ 331.616187][T13506] ntfs: volume version 3.1. [ 331.876096][T13516] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3501'. [ 332.087159][T13522] program syz.3.3504 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 332.399554][T13530] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3508'. [ 332.436185][T13530] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 332.445871][T13532] ieee802154 phy0 wpan0: encryption failed: -22 [ 332.635924][T13535] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3510'. [ 333.383196][T13550] netdevsim netdevsim2: Firmware load for './file0/../file0' refused, path contains '..' component [ 333.880063][T13564] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 335.759155][T13634] netlink: 'syz.0.3561': attribute type 8 has an invalid length. [ 336.319440][ T5960] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 336.409000][T13656] ieee802154 phy0 wpan0: encryption failed: -22 [ 336.521960][ T5960] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 336.552427][ T5960] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 336.582823][ T5960] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 336.611544][ T5960] usb 4-1: New USB device found, idVendor=07c9, idProduct=0012, bcdDevice=c2.f4 [ 336.636290][ T5960] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 336.654585][ T5960] usb 4-1: Product: syz [ 336.665934][ T5960] usb 4-1: Manufacturer: syz [ 336.674836][ T5960] usb 4-1: SerialNumber: syz [ 336.687082][ T5960] usb 4-1: config 0 descriptor?? [ 336.810272][T13640] loop1: detected capacity change from 0 to 40427 [ 336.838183][T13640] F2FS-fs (loop1): heap/no_heap options were deprecated [ 336.871942][T13640] F2FS-fs (loop1): invalid crc value [ 336.894090][T13640] F2FS-fs (loop1): Found nat_bits in checkpoint [ 336.965392][ T5855] usb 4-1: USB disconnect, device number 18 [ 336.978743][T13669] loop0: detected capacity change from 0 to 4096 [ 337.076097][T13675] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 337.092826][T13640] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 337.186419][T13669] NILFS error (device loop0): nilfs_check_page: size of directory #2 is not a multiple of chunk size [ 337.249548][T13669] Remounting filesystem read-only [ 337.666207][T13687] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3581'. [ 337.909851][T13696] loop1: detected capacity change from 0 to 128 [ 337.971379][T13696] VFS: Found a Xenix FS (block size = 1024) on device loop1 [ 338.085889][ T5789] sysv_free_block: flc_count > flc_size [ 338.091567][ T5789] sysv_free_block: flc_count > flc_size [ 338.155900][ T5789] sysv_free_block: flc_count > flc_size [ 338.161580][ T5789] sysv_free_block: flc_count > flc_size [ 338.199085][ T5789] sysv_free_block: flc_count > flc_size [ 338.205046][ T5789] sysv_free_block: flc_count > flc_size [ 338.220269][T13704] loop0: detected capacity change from 0 to 256 [ 338.236589][ T5789] sysv_free_block: flc_count > flc_size [ 338.242249][ T5789] sysv_free_block: flc_count > flc_size [ 338.281860][ T5789] sysv_free_block: flc_count > flc_size [ 338.310220][ T5789] sysv_free_block: flc_count > flc_size [ 338.336719][ T5789] sysv_free_inode: inode 0,1,2 or nonexistent inode [ 338.349735][T13704] FAT-fs (loop0): Directory bread(block 64) failed [ 338.385344][T13704] FAT-fs (loop0): Directory bread(block 65) failed [ 338.395957][T13704] FAT-fs (loop0): Directory bread(block 66) failed [ 338.402544][T13704] FAT-fs (loop0): Directory bread(block 67) failed [ 338.456229][T13704] FAT-fs (loop0): Directory bread(block 68) failed [ 338.472457][T13704] FAT-fs (loop0): Directory bread(block 69) failed [ 338.494841][T13704] FAT-fs (loop0): Directory bread(block 70) failed [ 338.517009][T13704] FAT-fs (loop0): Directory bread(block 71) failed [ 338.539466][T13704] FAT-fs (loop0): Directory bread(block 72) failed [ 338.559986][T13704] FAT-fs (loop0): Directory bread(block 73) failed [ 338.616922][T13717] netlink: 'syz.2.3596': attribute type 3 has an invalid length. [ 338.638297][T13717] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.3596'. [ 338.776148][ T786] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 338.975669][ T786] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 338.995447][ T786] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.023847][ T786] usb 2-1: Product: syz [ 339.035945][ T786] usb 2-1: Manufacturer: syz [ 339.057746][ T786] usb 2-1: SerialNumber: syz [ 339.083560][ T786] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 339.116399][ T23] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 339.284977][T13733] loop0: detected capacity change from 0 to 164 [ 339.297581][T13735] loop2: detected capacity change from 0 to 64 [ 339.444372][T13712] random: crng reseeded on system resumption [ 339.685212][T13741] (null): rxe_set_mtu: Set mtu to 1024 [ 339.702909][T13741] rdma_rxe: rxe_newlink: failed to add syz_tun [ 339.939721][T13748] gretap0: left promiscuous mode [ 339.997414][T13748] bridge0: port 1(bridge_slave_0) entered disabled state [ 340.024589][T13748] bridge0: port 2(bridge_slave_1) entered disabled state [ 340.064145][T13748] infiniband syz!: set active [ 340.075554][T13748] infiniband syz!: set active [ 340.114654][T13748] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 340.224057][ T23] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 340.244755][ T23] ath9k_htc: Failed to initialize the device [ 340.285067][ T23] usb 2-1: ath9k_htc: USB layer deinitialized [ 340.377097][ T5856] usb 2-1: USB disconnect, device number 21 [ 340.504640][T13761] netlink: 'syz.0.3616': attribute type 5 has an invalid length. [ 340.547453][T13763] netlink: 'syz.3.3618': attribute type 1 has an invalid length. [ 340.555274][T13763] netlink: 112860 bytes leftover after parsing attributes in process `syz.3.3618'. [ 340.575940][T13763] netlink: 'syz.3.3618': attribute type 1 has an invalid length. [ 341.674642][T13798] loop0: detected capacity change from 0 to 4096 [ 341.708214][T13798] ntfs3: loop0: Different NTFS sector size (2048) and media sector size (512). [ 341.793078][T13809] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3641'. [ 342.887967][T13850] ip6t_srh: unknown srh invflags 4449 [ 343.257480][T13866] netlink: 168 bytes leftover after parsing attributes in process `syz.0.3669'. [ 343.337656][T13868] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3670'. [ 343.653941][T13881] netlink: 'syz.3.3677': attribute type 32 has an invalid length. [ 344.818752][T13888] loop1: detected capacity change from 0 to 32768 [ 344.825926][ T786] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 344.849039][T13888] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by syz.1.3681 (13888) [ 344.921780][T13888] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 344.940169][T13888] BTRFS info (device loop1): using sha256 (sha256-avx2) checksum algorithm [ 344.943862][T13924] smb3: Unexpected value for 'rdma' [ 344.954832][T13888] BTRFS info (device loop1): using free space tree [ 345.052947][ T786] usb 1-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 345.103881][ T786] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 345.139831][T13888] BTRFS info (device loop1): enabling ssd optimizations [ 345.155883][ T786] usb 1-1: Product: syz [ 345.166204][ T786] usb 1-1: Manufacturer: syz [ 345.171357][T13888] BTRFS info (device loop1): auto enabling async discard [ 345.191695][ T786] usb 1-1: SerialNumber: syz [ 345.208739][ T786] usb 1-1: config 0 descriptor?? [ 345.245086][ T786] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 345.448488][ T5789] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 345.630015][T13954] loop2: detected capacity change from 0 to 256 [ 345.679050][ T5960] usb 1-1: USB disconnect, device number 25 [ 345.761086][T13954] FAT-fs (loop2): Directory bread(block 64) failed [ 345.785873][T13954] FAT-fs (loop2): Directory bread(block 65) failed [ 345.809474][T13954] FAT-fs (loop2): Directory bread(block 66) failed [ 345.835758][T13954] FAT-fs (loop2): Directory bread(block 67) failed [ 345.842669][T13954] FAT-fs (loop2): Directory bread(block 68) failed [ 345.894993][T13954] FAT-fs (loop2): Directory bread(block 69) failed [ 345.924869][T13954] FAT-fs (loop2): Directory bread(block 70) failed [ 345.940243][T13954] FAT-fs (loop2): Directory bread(block 71) failed [ 345.955139][T13954] FAT-fs (loop2): Directory bread(block 72) failed [ 345.972808][T13954] FAT-fs (loop2): Directory bread(block 73) failed [ 346.276651][T13966] netlink: 'syz.3.3711': attribute type 3 has an invalid length. [ 346.358356][ T28] audit: type=1400 audit(1760694439.584:246): apparmor="DENIED" operation="stack" class="file" info="label not found" error=-2 profile="unconfined" name=26260A3A0CCA7C2B08C9DFF78977F306B457CA93031D371D06D2E59E863E2FE54118A4EE43068DF6BA88E1B6DC3A2F2C91AE1C817D6B6014270B8BC51F73363852F4F12EE955F464599F0C485D pid=13967 comm="syz.0.3713" [ 346.397776][ T5960] usb 2-1: new full-speed USB device number 22 using dummy_hcd [ 346.456367][T13970] xt_hashlimit: size too large, truncated to 1048576 [ 346.463116][T13970] xt_hashlimit: max too large, truncated to 1048576 [ 346.639683][ T5960] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 346.675855][ T5960] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 346.715865][ T5960] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 346.725681][ T5960] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 346.769951][ T5960] usb 2-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 346.794496][ T5960] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 346.827117][ T5960] usb 2-1: config 0 descriptor?? [ 346.839307][ T5960] gspca_main: spca561-2.14.0 probing abcd:cdee [ 347.042776][ T5960] spca561: probe of 2-1:0.0 failed with error -22 [ 347.061167][ T5960] usb 2-1: Quirk or no altest; falling back to MIDI 1.0 [ 347.085878][ T5960] usb 2-1: MIDIStreaming interface descriptor not found [ 347.236531][ T5960] snd-usb-audio: probe of 2-1:0.0 failed with error -12 [ 347.249141][ T5804] udevd[5804]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 347.296240][ T5960] usb 2-1: USB disconnect, device number 22 [ 347.374249][T14000] netlink: 'syz.0.3728': attribute type 10 has an invalid length. [ 347.418087][T14000] veth1_macvtap: left promiscuous mode [ 348.006110][ T5874] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 348.153841][T14023] loop2: detected capacity change from 0 to 4096 [ 348.248309][ T5874] usb 2-1: config index 0 descriptor too short (expected 3133, got 61) [ 348.267280][ T5874] usb 2-1: config 0 has an invalid interface number: 156 but max is 1 [ 348.275519][ T5874] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 348.332353][ T5874] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 348.346099][T14023] ntfs: volume version 3.1. [ 348.351951][ T5874] usb 2-1: config 0 has no interface number 0 [ 348.368930][ T5874] usb 2-1: config 0 interface 156 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 348.408220][ T5874] usb 2-1: config 0 interface 156 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 348.455605][ T5874] usb 2-1: config 0 interface 156 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 348.503322][ T5874] usb 2-1: config 0 interface 156 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 348.522654][ T5874] usb 2-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 348.546862][ T5874] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 348.581591][ T5874] usb 2-1: config 0 descriptor?? [ 348.598388][ T5874] gspca_main: spca561-2.14.0 probing abcd:cdee [ 348.806273][ T5874] spca561: probe of 2-1:0.156 failed with error -22 [ 348.833797][ T5874] usb 2-1: Quirk or no altest; falling back to MIDI 1.0 [ 348.862952][ T5874] usb 2-1: MIDIStreaming interface descriptor not found [ 348.973014][ T5874] usb 2-1: USB disconnect, device number 23 [ 349.041492][ T5799] udevd[5799]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.156/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 349.282288][T14058] netlink: 'syz.2.3756': attribute type 62 has an invalid length. [ 349.425073][T14063] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3760'. [ 349.447226][T14063] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3760'. [ 349.468844][T14063] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3760'. [ 349.501173][T14063] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3760'. [ 349.532489][T14063] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3760'. [ 349.551203][T14067] loop2: detected capacity change from 0 to 1764 [ 349.563065][T14063] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3760'. [ 349.572615][T14063] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3760'. [ 349.606433][T14063] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3760'. [ 349.630095][T14063] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3760'. [ 349.662393][T14063] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3760'. [ 350.026832][T14079] loop1: detected capacity change from 0 to 4096 [ 350.061734][T14079] ntfs3: loop1: Different NTFS sector size (2048) and media sector size (512). [ 350.406719][T14091] vlan0: entered promiscuous mode [ 351.600458][T14140] xt_TCPMSS: Only works on TCP SYN packets [ 351.648928][T14142] netlink: 'syz.2.3794': attribute type 15 has an invalid length. [ 351.704002][T14145] netlink: 'syz.3.3797': attribute type 11 has an invalid length. [ 351.871449][T14152] loop2: detected capacity change from 0 to 256 [ 351.969079][T14152] FAT-fs (loop2): Directory bread(block 64) failed [ 351.975669][T14152] FAT-fs (loop2): Directory bread(block 65) failed [ 351.986270][T14152] FAT-fs (loop2): Directory bread(block 66) failed [ 352.001974][T14152] FAT-fs (loop2): Directory bread(block 67) failed [ 352.017093][T14152] FAT-fs (loop2): Directory bread(block 68) failed [ 352.036119][T14152] FAT-fs (loop2): Directory bread(block 69) failed [ 352.056921][T14152] FAT-fs (loop2): Directory bread(block 70) failed [ 352.073033][T14152] FAT-fs (loop2): Directory bread(block 71) failed [ 352.081341][T14152] FAT-fs (loop2): Directory bread(block 72) failed [ 352.092992][T14152] FAT-fs (loop2): Directory bread(block 73) failed [ 352.584366][T14146] loop1: detected capacity change from 0 to 32768 [ 352.636397][T14168] binder: BC_ACQUIRE_RESULT not supported [ 352.654123][T14168] binder: 14165:14168 ioctl c0306201 200000000040 returned -22 [ 352.655481][T14146] JFS: metapage_get_blocks failed [ 352.684396][T14146] ERROR: (device loop1): release_metapage: metapage_write_one() failed [ 352.684396][T14146] [ 352.705323][T14146] ERROR: (device loop1): remounting filesystem as read-only [ 352.842731][ T112] blkno = 8ed2c, nblocks = 1 [ 352.869621][ T112] ERROR: (device loop1): dbUpdatePMap: blocks are outside the map [ 352.869621][ T112] [ 353.034580][T14178] netlink: 'syz.3.3813': attribute type 10 has an invalid length. [ 353.050796][T14178] veth1_macvtap: left promiscuous mode [ 353.475486][T14190] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 353.796215][T14202] netlink: 'syz.1.3824': attribute type 10 has an invalid length. [ 353.851370][T14202] team0: Device ipvlan1 failed to register rx_handler [ 353.979859][ T28] audit: type=1326 audit(1760694447.204:247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14205 comm="syz.3.3826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f8278efc9 code=0x7ffc0000 [ 354.033098][ T28] audit: type=1326 audit(1760694447.204:248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14205 comm="syz.3.3826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f8278efc9 code=0x7ffc0000 [ 354.075875][ T28] audit: type=1326 audit(1760694447.234:249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14205 comm="syz.3.3826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=63 compat=0 ip=0x7f7f8278efc9 code=0x7ffc0000 [ 354.140526][ T28] audit: type=1326 audit(1760694447.234:250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14205 comm="syz.3.3826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f8278efc9 code=0x7ffc0000 [ 354.184290][T14214] netlink: 'syz.1.3827': attribute type 10 has an invalid length. [ 354.192372][ T28] audit: type=1326 audit(1760694447.234:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14205 comm="syz.3.3826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f8278efc9 code=0x7ffc0000 [ 354.245517][T14214] veth1_macvtap: left promiscuous mode [ 355.110215][T14245] usb usb8: usbfs: process 14245 (syz.0.3845) did not claim interface 0 before use [ 355.125887][T14246] netlink: 'syz.1.3846': attribute type 10 has an invalid length. [ 355.384897][T14256] __nla_validate_parse: 50 callbacks suppressed [ 355.384915][T14256] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3850'. [ 355.539986][T14263] netlink: 1572 bytes leftover after parsing attributes in process `syz.3.3855'. [ 355.816087][T14273] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3859'. [ 356.017295][T14280] loop0: detected capacity change from 0 to 1024 [ 356.056907][T14280] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 356.239727][ T5792] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 356.410917][ T5855] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 356.618661][ T5855] usb 4-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 356.647203][ T5855] usb 4-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 356.677028][ T5855] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 356.704707][ T5855] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 356.813649][T14310] netlink: 'syz.2.3875': attribute type 10 has an invalid length. [ 357.133658][T14320] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 357.161906][ T5793] Bluetooth: hci1: unexpected event for opcode 0x200c [ 357.174361][T14320] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 357.520214][T14335] syz.1.3889 uses old SIOCAX25GETINFO [ 357.665624][T14343] loop0: detected capacity change from 0 to 256 [ 357.764145][ T5855] stv0680 4-1:4.0: STV(e): camera ping failed!! [ 357.840325][T14348] loop2: detected capacity change from 0 to 256 [ 357.921982][T14348] FAT-fs (loop2): Directory bread(block 64) failed [ 357.945857][T14348] FAT-fs (loop2): Directory bread(block 65) failed [ 357.960906][ T5855] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 357.988385][T14348] FAT-fs (loop2): Directory bread(block 66) failed [ 357.994993][ T5855] stv0680 4-1:4.0: last error: 18, command = 0xd0 [ 358.007709][T14348] FAT-fs (loop2): Directory bread(block 67) failed [ 358.017473][ T5855] usb 4-1: USB disconnect, device number 19 [ 358.054534][T14348] FAT-fs (loop2): Directory bread(block 68) failed [ 358.087809][T14348] FAT-fs (loop2): Directory bread(block 69) failed [ 358.103001][T14348] FAT-fs (loop2): Directory bread(block 70) failed [ 358.110564][T14348] FAT-fs (loop2): Directory bread(block 71) failed [ 358.118670][T14348] FAT-fs (loop2): Directory bread(block 72) failed [ 358.125332][T14348] FAT-fs (loop2): Directory bread(block 73) failed [ 358.426023][ T5874] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 358.626796][ T5874] usb 1-1: Using ep0 maxpacket: 16 [ 358.641066][ T5874] usb 1-1: config 254 has an invalid interface number: 235 but max is 0 [ 358.651176][ T5874] usb 1-1: config 254 has no interface number 0 [ 358.674963][ T5874] usb 1-1: config 254 interface 235 altsetting 2 bulk endpoint 0x6 has invalid maxpacket 32 [ 358.720583][ T5874] usb 1-1: config 254 interface 235 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 358.746924][ T5874] usb 1-1: config 254 interface 235 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 358.765938][ T5874] usb 1-1: config 254 interface 235 has no altsetting 0 [ 358.787717][ T5874] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=2b.f1 [ 358.803255][ T5874] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=5 [ 358.816654][ T5874] usb 1-1: Product: syz [ 358.820878][ T5874] usb 1-1: Manufacturer: syz [ 358.827113][T14369] [U]  [ 358.847017][ T5874] usb 1-1: SerialNumber: syz [ 358.864629][T14354] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 358.881958][T14359] loop2: detected capacity change from 0 to 32768 [ 359.024636][T14359] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 359.025413][T14375] lo speed is unknown, defaulting to 1000 [ 359.072214][T14359] OCFS2: ERROR (device loop2): int ocfs2_validate_xattr_block(struct super_block *, struct buffer_head *): Extended attribute block #2304 has bad signature [ 359.093503][T14359] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 359.103962][T14375] lo speed is unknown, defaulting to 1000 [ 359.112153][T14359] OCFS2: File system is now read-only. [ 359.117356][T14354] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 359.117757][T14359] (syz.2.3900,14359,1):ocfs2_xattr_block_find:2831 ERROR: status = -30 [ 359.137829][T14375] lo speed is unknown, defaulting to 1000 [ 359.159045][T14375] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 359.159811][ T5874] usbtest 1-1:254.235: Linux gadget zero [ 359.186250][ T5874] usbtest 1-1:254.235: high-speed {control in/out bulk-in bulk-out} tests (+alt) [ 359.226548][T14375] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 359.255552][ T5795] ocfs2: Unmounting device (7,2) on (node local) [ 359.337252][T14375] lo speed is unknown, defaulting to 1000 [ 359.358318][T14375] lo speed is unknown, defaulting to 1000 [ 359.365249][ T5874] usb 1-1: USB disconnect, device number 26 [ 359.377563][T14375] lo speed is unknown, defaulting to 1000 [ 359.401307][T14375] lo speed is unknown, defaulting to 1000 [ 360.511398][T14416] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3927'. [ 360.540796][T14414] loop2: detected capacity change from 0 to 4096 [ 360.877722][T14424] overlayfs: conflicting options: userxattr,metacopy=on [ 361.327891][T14402] loop0: detected capacity change from 0 to 40427 [ 361.366053][T14402] F2FS-fs (loop0): heap/no_heap options were deprecated [ 361.393766][T14402] F2FS-fs (loop0): invalid crc value [ 361.434390][T14402] F2FS-fs (loop0): Found nat_bits in checkpoint [ 361.603591][T14402] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 361.936080][T14454] netlink: 129384 bytes leftover after parsing attributes in process `syz.3.3946'. [ 362.654847][T14476] loop0: detected capacity change from 0 to 64 [ 362.690192][T14476] MINIX-fs: mounting file system with errors, running fsck is recommended [ 362.884652][T14482] netlink: 'syz.2.3959': attribute type 32 has an invalid length. [ 363.172190][T14490] loop2: detected capacity change from 0 to 2048 [ 363.231542][T14490] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 363.301848][T14494] netlink: 'syz.0.3964': attribute type 10 has an invalid length. [ 363.336441][T14494] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 363.500337][T14496] loop1: detected capacity change from 0 to 512 [ 363.601436][T14496] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 363.697025][T14496] ext4 filesystem being mounted at /855/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 363.734706][T14496] EXT4-fs error (device loop1): ext4_do_update_inode:5230: inode #2: comm syz.1.3966: corrupted inode contents [ 363.759030][T14496] EXT4-fs error (device loop1): ext4_dirty_inode:6106: inode #2: comm syz.1.3966: mark_inode_dirty error [ 363.776777][T14496] EXT4-fs error (device loop1): ext4_do_update_inode:5230: inode #2: comm syz.1.3966: corrupted inode contents [ 363.794135][T14496] EXT4-fs error (device loop1): __ext4_ext_dirty:202: inode #2: comm syz.1.3966: mark_inode_dirty error [ 363.882626][T14501] loop0: detected capacity change from 0 to 8192 [ 363.893991][ T5789] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 365.489118][T14566] netlink: 'syz.0.3998': attribute type 21 has an invalid length. [ 365.522620][T14566] netlink: 'syz.0.3998': attribute type 15 has an invalid length. [ 365.542911][T14566] netlink: 156 bytes leftover after parsing attributes in process `syz.0.3998'. [ 365.562308][T14566] IPv6: NLM_F_CREATE should be specified when creating new route [ 365.582290][T14566] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 365.589740][T14566] IPv6: NLM_F_CREATE should be set when creating new route [ 365.597105][T14566] IPv6: NLM_F_CREATE should be set when creating new route [ 365.604391][T14566] IPv6: NLM_F_CREATE should be set when creating new route [ 366.171317][T14589] netlink: 'syz.0.4010': attribute type 11 has an invalid length. [ 366.720046][T14611] netlink: 72 bytes leftover after parsing attributes in process `syz.1.4022'. [ 366.745886][T14611] netlink: 72 bytes leftover after parsing attributes in process `syz.1.4022'. [ 366.812264][T14615] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4023'. [ 367.288661][T14629] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.4030'. [ 367.401928][T14631] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4029'. [ 367.431111][T14631] netlink: 'syz.1.4029': attribute type 8 has an invalid length. [ 367.457784][T14631] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check. [ 367.626510][T14636] netlink: 'syz.3.4033': attribute type 13 has an invalid length. [ 367.665409][T14636] gretap0: refused to change device tx_queue_len [ 367.682117][T14636] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 368.006477][T14647] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4038'. [ 368.065894][ T23] usb 2-1: new full-speed USB device number 24 using dummy_hcd [ 368.305840][ T23] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 368.325819][ T23] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 368.355309][ T23] usb 2-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 368.371197][ T23] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.395895][ T23] usb 2-1: Product: syz [ 368.400221][ T23] usb 2-1: Manufacturer: syz [ 368.415492][ T23] usb 2-1: SerialNumber: syz [ 368.442578][ T23] usb 2-1: config 0 descriptor?? [ 368.477153][ T23] hub 2-1:0.0: bad descriptor, ignoring hub [ 368.493379][ T23] hub: probe of 2-1:0.0 failed with error -5 [ 368.517856][ T23] input: syz syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input22 [ 369.969573][ T23] usb 2-1: USB disconnect, device number 24 [ 370.583603][T14712] ip6gre2: entered allmulticast mode [ 371.280661][T14732] netlink: 'syz.1.4080': attribute type 15 has an invalid length. [ 371.356310][T14736] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4081'. [ 371.365306][T14736] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4081'. [ 372.041635][T14760] ipip0: entered allmulticast mode [ 372.120782][T14768] netlink: 666 bytes leftover after parsing attributes in process `syz.3.4097'. [ 372.523441][T14782] loop0: detected capacity change from 0 to 16 [ 372.547204][T14783] netlink: 'syz.1.4104': attribute type 1 has an invalid length. [ 372.580560][T14782] erofs: (device loop0): z_erofs_load_lz4_config: too large lz4 pclusterblks 16832 [ 372.585965][T14783] netlink: 'syz.1.4104': attribute type 2 has an invalid length. [ 373.388699][T14772] loop2: detected capacity change from 0 to 40427 [ 373.426947][T14772] F2FS-fs (loop2): invalid crc value [ 373.478994][T14772] F2FS-fs (loop2): Found nat_bits in checkpoint [ 373.672124][T14772] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 373.820368][T14825] 9pnet_fd: p9_fd_create_unix (14825): problem connecting socket: ./file0: -111 [ 374.446601][ T5874] usb 4-1: new full-speed USB device number 20 using dummy_hcd [ 374.475296][T14845] xt_CT: You must specify a L4 protocol and not use inversions on it [ 374.668842][ T5874] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 374.677563][T14854] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 374.689139][ T5874] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 374.689190][ T5874] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 374.691915][ T5874] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 374.691947][ T5874] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 374.691969][ T5874] usb 4-1: Product: syz [ 374.691985][ T5874] usb 4-1: Manufacturer: syz [ 374.692001][ T5874] usb 4-1: SerialNumber: syz [ 374.727558][ T5874] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 374.727618][ T5874] cdc_ncm 4-1:1.0: bind() failure [ 374.986331][ T5874] usb 4-1: USB disconnect, device number 20 [ 375.000502][T14862] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4140'. [ 375.027475][T14863] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4139'. [ 375.141356][T14868] netlink: 'syz.0.4143': attribute type 21 has an invalid length. [ 375.155393][T14868] netlink: 128 bytes leftover after parsing attributes in process `syz.0.4143'. [ 375.186192][T14868] netlink: 'syz.0.4143': attribute type 4 has an invalid length. [ 375.546735][T14882] exFAT-fs (nullb0): mounting with "discard" option, but the device does not support discard [ 375.579434][T14882] exFAT-fs (nullb0): invalid boot record signature [ 375.603682][T14882] exFAT-fs (nullb0): failed to read boot sector [ 375.637465][T14882] exFAT-fs (nullb0): failed to recognize exfat type [ 376.569895][T14916] loop1: detected capacity change from 0 to 4096 [ 376.608354][T14916] ntfs3: loop1: Different NTFS sector size (1024) and media sector size (512). [ 376.777211][T14918] loop0: detected capacity change from 0 to 4096 [ 376.810418][T14918] ntfs: (device loop0): parse_options(): Option utf8 is no longer supported, using option nls=utf8. Please use option nls=utf8 in the future and make sure utf8 is compiled either as a module or into the kernel. [ 377.039921][T14918] ntfs: (device loop0): parse_options(): NLS character set cp9251 not found. Using previous one macturkish. [ 377.105046][T14918] ntfs: volume version 3.1. [ 377.151884][T14918] ntfs: (device loop0): ntfs_index_lookup(): Corrupt index. Aborting lookup. [ 377.190038][T14918] ntfs: (device loop0): ntfs_mark_quotas_out_of_date(): Lookup of quota defaults entry failed. [ 377.230846][T14918] ntfs: (device loop0): load_system_files(): Failed to mark quotas out of date. Mounting read-only. Run chkdsk. [ 377.425917][T14941] netlink: 'syz.3.4178': attribute type 3 has an invalid length. [ 377.454171][T14941] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4178'. [ 378.324104][T14969] IPv6: NLM_F_CREATE should be specified when creating new route [ 378.356713][T14969] netlink: 1 bytes leftover after parsing attributes in process `syz.1.4200'. [ 378.702405][T14977] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4195'. [ 378.791861][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.801784][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.081242][T14962] loop0: detected capacity change from 0 to 32768 [ 379.085480][T14966] loop2: detected capacity change from 0 to 40427 [ 379.127612][T14966] F2FS-fs (loop2): heap/no_heap options were deprecated [ 379.165845][T14966] F2FS-fs (loop2): invalid crc value [ 379.187141][T14962] ERROR: (device loop0): xtSearch: XT_GETPAGE: xtree page corrupt [ 379.187141][T14962] [ 379.190854][T14966] F2FS-fs (loop2): Found nat_bits in checkpoint [ 379.235900][T14962] xtLookup: xtSearch returned -5 [ 379.248338][T14962] add_index: get/read_metapage failed! [ 379.256643][T14962] ERROR: (device loop0): xtSearch: XT_GETPAGE: xtree page corrupt [ 379.256643][T14962] [ 379.295120][T14962] xtLookup: xtSearch returned -5 [ 379.309039][T14962] free_index: error reading directory table [ 379.327436][T14962] ERROR: (device loop0): xtSearch: XT_GETPAGE: xtree page corrupt [ 379.327436][T14962] [ 379.352211][T14962] xtLookup: xtSearch returned -5 [ 379.385878][T14962] free_index: error reading directory table [ 379.399446][T14962] ERROR: (device loop0): xtSearch: XT_GETPAGE: xtree page corrupt [ 379.399446][T14962] [ 379.432384][T14962] xtLookup: xtSearch returned -5 [ 379.444539][T14962] free_index: error reading directory table [ 379.471156][T14962] ERROR: (device loop0): xtSearch: XT_GETPAGE: xtree page corrupt [ 379.471156][T14962] [ 379.493898][T14962] xtLookup: xtSearch returned -5 [ 379.497133][T14966] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 379.512073][T14962] free_index: error reading directory table [ 379.528362][T14962] ERROR: (device loop0): xtSearch: XT_GETPAGE: xtree page corrupt [ 379.528362][T14962] [ 379.568451][T14962] xtLookup: xtSearch returned -5 [ 379.584406][T14962] free_index: error reading directory table [ 379.601277][ T28] audit: type=1800 audit(1760694472.814:252): pid=14962 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.4188" name="bus" dev="loop0" ino=7 res=0 errno=0 [ 379.643219][T14998] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4205'. [ 381.077893][T15042] Unsupported ieee802154 address type: 0 [ 381.169747][T15047] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 381.221460][ T28] audit: type=1326 audit(1760694474.444:253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15048 comm="syz.3.4228" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7f8278efc9 code=0x0 [ 381.576573][T15063] MTD: Couldn't look up '/dev/sg0': -15 [ 382.325381][T15091] loop2: detected capacity change from 0 to 128 [ 382.358912][T15091] VFS: Found a Xenix FS (block size = 1024) on device loop2 [ 382.434818][T15096] netlink: 'syz.1.4252': attribute type 1 has an invalid length. [ 382.500576][ T5795] sysv_free_block: flc_count > flc_size [ 382.542810][ T5795] sysv_free_block: flc_count > flc_size [ 382.565360][ T5795] sysv_free_block: flc_count > flc_size [ 382.580835][ T5795] sysv_free_block: flc_count > flc_size [ 382.596111][ T5795] sysv_free_block: flc_count > flc_size [ 382.612308][T15101] IPv6: NLM_F_CREATE should be specified when creating new route [ 382.622071][ T5795] sysv_free_block: flc_count > flc_size [ 382.633788][ T5795] sysv_free_block: flc_count > flc_size [ 382.646004][ T5795] sysv_free_block: flc_count > flc_size [ 382.658283][ T5795] sysv_free_block: flc_count > flc_size [ 382.667734][ T5795] sysv_free_block: flc_count > flc_size [ 382.675365][ T5795] sysv_free_inode: inode 0,1,2 or nonexistent inode [ 382.771412][T15105] comedi comedi1: s526: I/O port conflict (0x7,64) [ 382.780878][T15107] netlink: 128 bytes leftover after parsing attributes in process `syz.1.4256'. [ 382.812087][T15107] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4256'. [ 383.474957][T15131] netlink: 5064 bytes leftover after parsing attributes in process `syz.3.4269'. [ 383.550334][T15134] loop0: detected capacity change from 0 to 128 [ 383.635257][ T5794] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 384.455990][ T23] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 384.669328][ T23] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 384.691050][ T23] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 384.721855][ T23] usb 2-1: config 220 has no interface number 2 [ 384.735985][ T23] usb 2-1: config 220 interface 1 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 384.755965][ T23] usb 2-1: config 220 interface 1 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 384.790347][ T23] usb 2-1: config 220 interface 0 has no altsetting 0 [ 384.805906][ T23] usb 2-1: config 220 interface 76 has no altsetting 0 [ 384.820262][ T23] usb 2-1: config 220 interface 1 has no altsetting 0 [ 384.844955][ T23] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 384.864952][ T23] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 384.883529][ T23] usb 2-1: Product: syz [ 384.893840][T15173] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4290'. [ 384.895940][ T23] usb 2-1: Manufacturer: syz [ 384.915820][ T23] usb 2-1: SerialNumber: syz [ 384.943199][T15157] loop0: detected capacity change from 0 to 32768 [ 385.282945][ T23] usb 2-1: selecting invalid altsetting 0 [ 385.300190][ T23] usb 2-1: Found UVC 7.01 device syz (8086:0b07) [ 385.328952][ T23] usb 2-1: No valid video chain found. [ 385.378802][ T23] usb 2-1: selecting invalid altsetting 0 [ 385.405085][ T23] usbtest: probe of 2-1:220.1 failed with error -22 [ 385.446030][ T23] usb 2-1: USB disconnect, device number 25 [ 385.739817][T15193] loop0: detected capacity change from 0 to 64 [ 386.134193][T15206] sctp: [Deprecated]: syz.3.4307 (pid 15206) Use of int in maxseg socket option. [ 386.134193][T15206] Use struct sctp_assoc_value instead [ 386.191927][T15207] netlink: 104 bytes leftover after parsing attributes in process `syz.2.4306'. [ 386.322203][T15212] netlink: 'syz.1.4309': attribute type 4 has an invalid length. [ 386.580227][T15221] xt_HMARK: spi-set and port-set can't be combined [ 386.609377][T15223] xt_l2tp: v2 sid > 0xffff: 4294901760 [ 387.545872][T15261] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4333'. [ 388.075065][T15279] loop0: detected capacity change from 0 to 2048 [ 388.106824][T15279] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 388.129669][T15279] NILFS (loop0): mounting unchecked fs [ 388.135207][T15279] NILFS (loop0): recovery required for readonly filesystem [ 388.176611][T15279] NILFS (loop0): write access will be enabled during recovery [ 388.215127][T15279] NILFS (loop0): norecovery option specified, skipping roll-forward recovery [ 388.249910][T15285] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4346'. [ 388.250092][ T5794] udevd[5794]: incorrect nilfs2 checksum on /dev/loop0 [ 388.331575][T15279] NILFS (loop0): couldn't remount because the filesystem is in an incomplete recovery state [ 388.416736][ T5794] udevd[5794]: incorrect nilfs2 checksum on /dev/loop0 [ 389.125937][ T786] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 389.307922][ T786] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 389.329311][ T786] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 389.332653][ T786] usb 3-1: New USB device found, idVendor=133e, idProduct=0815, bcdDevice=7e.66 [ 389.332684][ T786] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.332718][ T786] usb 3-1: Product: syz [ 389.332733][ T786] usb 3-1: Manufacturer: syz [ 389.332749][ T786] usb 3-1: SerialNumber: syz [ 389.335451][ T786] usb 3-1: config 0 descriptor?? [ 389.340489][ T786] snd-usb-audio: probe of 3-1:0.0 failed with error -90 [ 389.636523][ T786] usb 3-1: USB disconnect, device number 15 [ 389.871532][T15335] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4369'. [ 390.493074][T15355] loop2: detected capacity change from 0 to 64 [ 391.008080][ T5842] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 391.058381][T15377] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4391'. [ 391.216301][ T5842] usb 2-1: Using ep0 maxpacket: 8 [ 391.243380][ T5842] usb 2-1: config 0 has an invalid interface number: 56 but max is 0 [ 391.259578][ T5842] usb 2-1: config 0 has no interface number 0 [ 391.280752][ T5842] usb 2-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=c7.76 [ 391.294603][ T5842] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 391.315881][ T5842] usb 2-1: Product: syz [ 391.345767][ T5842] usb 2-1: Manufacturer: syz [ 391.354051][ T5842] usb 2-1: SerialNumber: syz [ 391.370422][ T5842] usb 2-1: config 0 descriptor?? [ 391.604744][ T5842] peak_usb 2-1:0.56: PEAK-System PCAN-USB X6 v134 fw v24.0.0 (2 channels) [ 391.806734][ T5842] peak_usb 2-1:0.56 can0: unable to request usb[type=2 value=5] err=-71 [ 391.837473][ T5842] peak_usb 2-1:0.56: unable to tell PCAN-USB X6 driver is loaded (err -71) [ 391.932101][ T5842] peak_usb: probe of 2-1:0.56 failed with error -71 [ 391.977534][ T5842] usb 2-1: USB disconnect, device number 26 [ 392.110559][T15410] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4407'. [ 392.697792][T15425] xt_CT: No such helper "netbios-ns" [ 394.189511][T15482] netlink: 'syz.1.4443': attribute type 49 has an invalid length. [ 395.175932][ T5960] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 395.257624][T15523] veth3: entered allmulticast mode [ 395.367169][ T5960] usb 4-1: too many configurations: 37, using maximum allowed: 8 [ 395.466437][ T5960] usb 4-1: string descriptor 0 read error: -71 [ 395.472863][ T5960] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 395.497725][ T5960] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.535985][ T5960] usb 4-1: can't set config #1, error -71 [ 395.551809][ T5960] usb 4-1: USB disconnect, device number 21 [ 395.986611][T15551] netlink: 184 bytes leftover after parsing attributes in process `syz.0.4477'. [ 396.255956][T15563] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4483'. [ 396.283348][T15562] netlink: 'syz.1.4482': attribute type 75 has an invalid length. [ 396.626244][T15574] comedi comedi1: fl512: a I/O base address must be specified [ 397.325800][T15605] syz.2.4502: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz2,mems_allowed=0-1 [ 397.365954][T15605] CPU: 1 PID: 15605 Comm: syz.2.4502 Not tainted syzkaller #0 [ 397.373525][T15605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 397.383616][T15605] Call Trace: [ 397.386938][T15605] [ 397.389903][T15605] dump_stack_lvl+0x16c/0x230 [ 397.394626][T15605] ? show_regs_print_info+0x20/0x20 [ 397.399877][T15605] ? load_image+0x3b0/0x3b0 [ 397.404423][T15605] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 397.410876][T15605] ? cpuset_print_current_mems_allowed+0x2e3/0x360 [ 397.417427][T15605] warn_alloc+0x210/0x300 [ 397.421817][T15605] ? stack_trace_save+0x9c/0xe0 [ 397.426713][T15605] ? zone_watermark_ok_safe+0x230/0x230 [ 397.432335][T15605] ? kasan_set_track+0x5f/0x70 [ 397.437141][T15605] ? kasan_set_track+0x4e/0x70 [ 397.441951][T15605] ? __kasan_kmalloc+0x8f/0xa0 [ 397.446754][T15605] ? xsk_init_queue+0xb0/0x110 [ 397.451568][T15605] ? xsk_setsockopt+0x43c/0x6f0 [ 397.456462][T15605] ? do_sock_setsockopt+0x175/0x1a0 [ 397.461706][T15605] ? __x64_sys_setsockopt+0x184/0x200 [ 397.467136][T15605] __vmalloc_node_range+0x126/0x1320 [ 397.472494][T15605] ? free_vm_area+0x50/0x50 [ 397.477048][T15605] vmalloc_user+0x74/0x80 [ 397.481417][T15605] ? xskq_create+0xbf/0x170 [ 397.485964][T15605] xskq_create+0xbf/0x170 [ 397.490352][T15605] xsk_init_queue+0xb0/0x110 [ 397.494983][T15605] xsk_setsockopt+0x43c/0x6f0 [ 397.499719][T15605] ? xsk_poll+0x670/0x670 [ 397.504097][T15605] ? __fget_files+0x28/0x4d0 [ 397.508732][T15605] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 397.514325][T15605] ? security_socket_setsockopt+0x7e/0xa0 [ 397.520090][T15605] ? xsk_poll+0x670/0x670 [ 397.524456][T15605] do_sock_setsockopt+0x175/0x1a0 [ 397.529525][T15605] ? __fdget+0x180/0x210 [ 397.533814][T15605] __x64_sys_setsockopt+0x184/0x200 [ 397.539092][T15605] do_syscall_64+0x55/0xb0 [ 397.543560][T15605] ? clear_bhb_loop+0x40/0x90 [ 397.548279][T15605] ? clear_bhb_loop+0x40/0x90 [ 397.552995][T15605] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 397.558931][T15605] RIP: 0033:0x7ffa36f8efc9 [ 397.563383][T15605] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 397.583031][T15605] RSP: 002b:00007ffa37df1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 397.591495][T15605] RAX: ffffffffffffffda RBX: 00007ffa371e5fa0 RCX: 00007ffa36f8efc9 [ 397.599513][T15605] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 397.607537][T15605] RBP: 00007ffa37011f91 R08: 0000000000000004 R09: 0000000000000000 [ 397.615552][T15605] R10: 0000200000000500 R11: 0000000000000246 R12: 0000000000000000 [ 397.623643][T15605] R13: 00007ffa371e6038 R14: 00007ffa371e5fa0 R15: 00007ffcc8f23ef8 [ 397.631697][T15605] [ 397.689674][T15605] Mem-Info: [ 397.692965][T15605] active_anon:7262 inactive_anon:0 isolated_anon:0 [ 397.692965][T15605] active_file:11338 inactive_file:40515 isolated_file:0 [ 397.692965][T15605] unevictable:768 dirty:294 writeback:0 [ 397.692965][T15605] slab_reclaimable:10733 slab_unreclaimable:98074 [ 397.692965][T15605] mapped:25026 shmem:2667 pagetables:621 [ 397.692965][T15605] sec_pagetables:0 bounce:0 [ 397.692965][T15605] kernel_misc_reclaimable:0 [ 397.692965][T15605] free:1345343 free_pcp:11158 free_cma:0 [ 397.784385][T15605] Node 0 active_anon:31448kB inactive_anon:0kB active_file:45240kB inactive_file:161864kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:100000kB dirty:1176kB writeback:0kB shmem:11532kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11532kB pagetables:2484kB sec_pagetables:0kB all_unreclaimable? no [ 397.879056][T15605] Node 1 active_anon:0kB inactive_anon:0kB active_file:112kB inactive_file:196kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:104kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 397.953116][T15605] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 398.026266][T15605] lowmem_reserve[]: 0 2525 2526 2526 2526 [ 398.045892][T15605] Node 0 DMA32 free:1462656kB boost:0kB min:34676kB low:43344kB high:52012kB reserved_highatomic:0KB active_anon:37700kB inactive_anon:0kB active_file:45240kB inactive_file:160544kB unevictable:1536kB writepending:1176kB present:3129332kB managed:2589604kB mlocked:0kB bounce:0kB free_pcp:22012kB local_pcp:3152kB free_cma:0kB [ 398.114453][T15605] lowmem_reserve[]: 0 0 1 1 1 [ 398.124597][T15605] Node 0 Normal free:16kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1320kB unevictable:0kB writepending:0kB present:1048576kB managed:1384kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 398.183421][T15605] lowmem_reserve[]: 0 0 0 0 0 [ 398.194289][T15605] Node 1 Normal free:3894772kB boost:0kB min:55208kB low:69008kB high:82808kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:112kB inactive_file:196kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:23232kB local_pcp:14176kB free_cma:0kB [ 398.233554][T15600] loop1: detected capacity change from 0 to 32768 [ 398.297172][T15600] JBD2: Ignoring recovery information on journal [ 398.308395][T15605] lowmem_reserve[]: 0 0 0 0 0 [ 398.313580][T15605] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 398.365859][T15605] Node 0 DMA32: 5*4kB (ME) 320*8kB (UME) 386*16kB (UME) 344*32kB (UME) 290*64kB (UME) 60*128kB (UME) 35*256kB (UME) 29*512kB (UME) 23*1024kB (UM) 1*2048kB (M) 333*4096kB (UM) = 1459380kB [ 398.439679][T15605] Node 0 Normal: 0*4kB 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16kB [ 398.449797][T15600] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 398.497640][T15605] Node 1 Normal: 241*4kB (UME) 50*8kB (UE) 50*16kB (UE) 106*32kB (UE) 25*64kB (UME) 10*128kB (UME) 3*256kB (UME) 1*512kB (U) 2*1024kB (UE) 2*2048kB (UE) 947*4096kB (M) = 3894772kB [ 398.571126][T15605] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 398.601864][T15605] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 398.631278][T15605] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 398.631345][T15600] OCFS2: ERROR (device loop1): int ocfs2_xattr_find_entry(struct inode *, int, const char *, struct ocfs2_xattr_search *): corrupted xattr entries [ 398.647870][T15600] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 398.656843][T15605] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 398.666481][T15600] OCFS2: File system is now read-only. [ 398.692177][T15632] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode [ 398.693351][T15605] 57074 total pagecache pages [ 398.711653][T15605] 0 pages in swap cache [ 398.720532][T15605] Free swap = 124472kB [ 398.730321][T15600] (syz.1.4500,15600,0):ocfs2_calc_xattr_init:638 ERROR: status = -117 [ 398.736774][T15605] Total swap = 124996kB [ 398.746741][T15605] 2097051 pages RAM [ 398.759120][T15605] 0 pages HighMem/MovableOnly [ 398.764094][T15600] (syz.1.4500,15600,0):ocfs2_mknod:334 ERROR: status = -117 [ 398.769260][T15605] 416136 pages reserved [ 398.783531][T15600] (syz.1.4500,15600,0):ocfs2_mknod:502 ERROR: status = -117 [ 398.785846][T15605] 0 pages cma reserved [ 398.793440][ T5960] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 398.834322][T15600] (syz.1.4500,15600,0):ocfs2_create:676 ERROR: status = -117 [ 398.898082][T15600] syz.1.4500 (15600) used greatest stack depth: 17712 bytes left [ 398.927185][ T5789] ocfs2: Unmounting device (7,1) on (node local) [ 399.015639][ T5960] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 399.032662][ T5960] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.065827][ T5960] usb 4-1: Product: syz [ 399.070070][ T5960] usb 4-1: Manufacturer: syz [ 399.091253][ T5960] usb 4-1: SerialNumber: syz [ 399.131206][ T5960] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 399.164273][T15642] netlink: 'syz.0.4521': attribute type 8 has an invalid length. [ 399.166016][ T5855] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 399.441310][T15648] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4524'. [ 399.758168][ T5960] usb 4-1: USB disconnect, device number 22 [ 400.077311][T15673] netlink: 830 bytes leftover after parsing attributes in process `syz.0.4535'. [ 400.223271][T15678] loop1: detected capacity change from 0 to 128 [ 400.237880][T15678] FAT-fs (loop1): Invalid FSINFO signature: 0x41615200, 0x61417272 (sector = 1) [ 400.334988][ T11] FAT-fs (loop1): Invalid FSINFO signature: 0x41615200, 0x61417272 (sector = 1) [ 400.487329][T15683] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 400.506317][ T9] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 400.540923][ T5855] usb 4-1: Service connection timeout for: 256 [ 400.552817][ T5855] ath9k_htc 4-1:1.0: ath9k_htc: Unable to initialize HTC services [ 400.561168][ T3483] bridge0: port 1(bridge_slave_0) entered blocking state [ 400.569906][ T3483] bridge0: port 1(bridge_slave_0) entered forwarding state [ 400.596841][ T5855] ath9k_htc: Failed to initialize the device [ 400.633537][ T5960] usb 4-1: ath9k_htc: USB layer deinitialized [ 400.714322][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 400.731651][ T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 400.754160][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 400.779356][T15691] program syz.2.4543 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 400.803170][ T9] usb 1-1: New USB device found, idVendor=8086, idProduct=0b5b, bcdDevice=e1.c5 [ 400.812889][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 400.840156][ T9] usb 1-1: Product: syz [ 400.844382][ T9] usb 1-1: Manufacturer: syz [ 400.855604][ T9] usb 1-1: SerialNumber: syz [ 400.878206][ T9] usb 1-1: config 0 descriptor?? [ 400.996798][T15696] netlink: 'syz.2.4547': attribute type 3 has an invalid length. [ 401.017636][T15696] netlink: 'syz.2.4547': attribute type 3 has an invalid length. [ 401.035852][T15696] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4547'. [ 401.054842][T15697] loop1: detected capacity change from 0 to 1024 [ 401.110164][ T9] usb 1-1: Found UVC 34.00 device syz (8086:0b5b) [ 401.144753][ T9] usb 1-1: No valid video chain found. [ 401.171962][ T9] usb 1-1: USB disconnect, device number 27 [ 401.268971][ T3453] hfsplus: b-tree write err: -5, ino 4 [ 401.810955][T15719] loop2: detected capacity change from 0 to 128 [ 401.870794][T15719] FAT-fs (loop2): Invalid FSINFO signature: 0x41615200, 0x61417272 (sector = 1) [ 402.015847][ T28] audit: type=1326 audit(1760694495.234:254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15725 comm="syz.1.4561" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e4d78efc9 code=0x7ffc0000 [ 402.085326][ T11] FAT-fs (loop2): Invalid FSINFO signature: 0x41615200, 0x61417272 (sector = 1) [ 402.085938][ T28] audit: type=1326 audit(1760694495.234:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15725 comm="syz.1.4561" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e4d78efc9 code=0x7ffc0000 [ 402.207875][ T28] audit: type=1326 audit(1760694495.254:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15725 comm="syz.1.4561" exe="/root/syz-executor" sig=0 arch=c000003e syscall=250 compat=0 ip=0x7f7e4d78efc9 code=0x7ffc0000 [ 402.305122][ T28] audit: type=1326 audit(1760694495.254:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15725 comm="syz.1.4561" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e4d78efc9 code=0x7ffc0000 [ 402.338038][T15737] netlink: 'syz.0.4566': attribute type 3 has an invalid length. [ 402.379688][T15737] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.4566'. [ 402.609250][T15748] [U] vÔ3¸Âfù¾"SçÁ/Éê4:ÃXTz“W¡t‘’lWµ«= [ 402.627488][T15748] [U] J"—e:ÀÆ" [ 402.997720][T15765] loop2: detected capacity change from 0 to 512 [ 402.998763][T15765] EXT4-fs: Ignoring removed i_version option [ 402.998789][T15765] EXT4-fs: Ignoring removed mblk_io_submit option [ 403.013136][T15765] EXT4-fs error (device loop2): ext4_orphan_get:1399: comm syz.2.4581: inode #13: comm syz.2.4581: iget: illegal inode # [ 403.014509][T15765] EXT4-fs error (device loop2): ext4_orphan_get:1404: comm syz.2.4581: couldn't read orphan inode 13 (err -117) [ 403.019280][T15765] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 403.070068][ T5795] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 403.081313][ T9] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 403.260264][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 403.270622][ T9] usb 4-1: New USB device found, idVendor=0eef, idProduct=0001, bcdDevice= 0.00 [ 403.270651][ T9] usb 4-1: New USB device strings: Mfr=0, Product=3, SerialNumber=0 [ 403.270671][ T9] usb 4-1: Product: syz [ 403.273429][ T9] usb 4-1: config 0 descriptor?? [ 403.302681][T15772] netlink: 9 bytes leftover after parsing attributes in process `syz.0.4583'. [ 403.355071][T15772] 0·: renamed from hsr0 (while UP) [ 403.366955][T15772] 0·: entered allmulticast mode [ 403.366977][T15772] hsr_slave_0: entered allmulticast mode [ 403.366992][T15772] hsr_slave_1: entered allmulticast mode [ 403.367579][T15772] A link change request failed with some changes committed already. Interface 70· may have been left with an inconsistent configuration, please check. [ 403.490364][ T9] input: syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input24 [ 403.750882][ T9] usb 4-1: USB disconnect, device number 23 [ 404.135666][T15796] loop0: detected capacity change from 0 to 8 [ 404.153089][T15796] MTD: Attempt to mount non-MTD device "/dev/loop0" [ 404.199075][ T5794] udevd[5794]: incorrect cramfs checksum on /dev/loop0 [ 404.238228][T15796] cramfs: Error -3 while decompressing! [ 404.253456][T15796] cramfs: ffffffff96fe0348(26)->ffff8880566fe000(4096) [ 404.261482][T15796] cramfs: Error -3 while decompressing! [ 404.271770][T15796] cramfs: ffffffff96fe0362(26)->ffff8880577dd000(4096) [ 404.279118][T15796] cramfs: Error -3 while decompressing! [ 404.284968][T15796] cramfs: ffffffff96fe037c(16)->ffff8880764ce000(4096) [ 404.313414][T15796] cramfs: Error -3 while decompressing! [ 404.335801][T15796] cramfs: ffffffff96fe0348(26)->ffff8880566fe000(4096) [ 404.460226][T15806] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 404.838152][T15820] netlink: 'syz.1.4607': attribute type 10 has an invalid length. [ 404.916997][T15820] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 406.384926][T15878] netlink: 'syz.3.4635': attribute type 29 has an invalid length. [ 406.399878][T15878] netlink: 'syz.3.4635': attribute type 29 has an invalid length. [ 406.894273][T15897] xt_CT: You must specify a L4 protocol and not use inversions on it [ 407.168527][T15903] ipt_rpfilter: unknown options [ 407.303278][T15881] loop0: detected capacity change from 0 to 32768 [ 407.369102][T15911] (unnamed net_device) (uninitialized): option lacp_active: invalid value (40) [ 407.422606][T15881] jfs: Unrecognized mount option "ÿÿ18446744073709551615ÿ01777777777777777777777±ñV?Œù³ßCp~'~8pٻ젌|ž^½Ö(cŸoö—ÈêM ) Ç0177777777777777777777718446744073709551615ÿÿÿÿÿÿÿÿÿÿ" or missing value [ 407.876236][T15927] netlink: 'syz.2.4659': attribute type 3 has an invalid length. [ 408.070059][T15933] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4661'. [ 408.302154][T15943] netlink: 'syz.2.4667': attribute type 10 has an invalid length. [ 408.341015][T15943] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4667'. [ 408.409014][T15947] Cannot find add_set index 2 as target [ 408.429852][T15943] team0: Port device geneve0 added [ 408.609665][T15954] netlink: 'syz.3.4672': attribute type 10 has an invalid length. [ 408.625806][T15954] netlink: 55 bytes leftover after parsing attributes in process `syz.3.4672'. [ 409.426076][ T5842] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 409.469357][T15991] dlm: plock device version mismatch: kernel (1.2.0), user (1.8192.0) [ 409.540812][T15993] netlink: 68 bytes leftover after parsing attributes in process `syz.2.4692'. [ 409.627881][ T5842] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 409.645215][T15997] netlink: 'syz.3.4695': attribute type 1 has an invalid length. [ 409.659488][T15997] netlink: 'syz.3.4695': attribute type 2 has an invalid length. [ 409.662755][ T5842] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 409.680561][T15997] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4695'. [ 409.703807][ T5842] usb 2-1: config 1 interface 1 has no altsetting 1 [ 409.738527][ T5842] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 409.766365][ T5842] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.788304][ T5842] usb 2-1: Product: syz [ 409.792615][ T5842] usb 2-1: Manufacturer: syz [ 409.827453][ T5842] usb 2-1: SerialNumber: syz [ 409.850893][ T5842] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found [ 409.865831][ T5842] cdc_ncm 2-1:1.0: bind() failure [ 409.880489][ T5842] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 409.892792][ T5842] cdc_ncm 2-1:1.1: bind() failure [ 410.007506][T16009] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4701'. [ 410.152232][ T786] usb 2-1: USB disconnect, device number 27 [ 410.228471][ T5842] IPVS: starting estimator thread 0... [ 410.326258][T16019] IPVS: using max 20 ests per chain, 48000 per kthread [ 410.644974][T16034] netlink: 176 bytes leftover after parsing attributes in process `syz.2.4710'. [ 410.779692][T16032] loop0: detected capacity change from 0 to 4096 [ 411.593713][T16061] netlink: 'syz.3.4723': attribute type 10 has an invalid length. [ 411.614226][T16061] bridge0: port 3(team0) entered blocking state [ 411.633814][T16061] bridge0: port 3(team0) entered disabled state [ 411.634006][T16061] team0: entered allmulticast mode [ 411.634024][T16061] team_slave_0: entered allmulticast mode [ 411.634041][T16061] team_slave_1: entered allmulticast mode [ 411.634055][T16061] macvlan1: entered allmulticast mode [ 411.634068][T16061] veth1_vlan: entered allmulticast mode [ 411.644189][T16061] team0: entered promiscuous mode [ 411.644212][T16061] team_slave_0: entered promiscuous mode [ 411.644796][T16061] team_slave_1: entered promiscuous mode [ 411.644980][T16061] macvlan1: entered promiscuous mode [ 412.464676][T16095] Zero length message leads to an empty skb [ 412.950619][T16104] loop0: detected capacity change from 0 to 64 [ 413.207388][T16112] netlink: 256 bytes leftover after parsing attributes in process `syz.0.4749'. [ 413.216688][ T9] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 413.429898][ T9] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 413.445772][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.463686][ T9] usb 4-1: Product: syz [ 413.473295][ T9] usb 4-1: Manufacturer: syz [ 413.485915][ T9] usb 4-1: SerialNumber: syz [ 413.507305][ T9] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 413.544972][ T5960] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 413.861742][ T28] audit: type=1326 audit(1760694507.084:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16137 comm="syz.1.4763" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e4d78efc9 code=0x7ffc0000 [ 413.861914][ T28] audit: type=1326 audit(1760694507.084:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16137 comm="syz.1.4763" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e4d78efc9 code=0x7ffc0000 [ 413.867575][ T28] audit: type=1326 audit(1760694507.094:260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16137 comm="syz.1.4763" exe="/root/syz-executor" sig=0 arch=c000003e syscall=448 compat=0 ip=0x7f7e4d78efc9 code=0x7ffc0000 [ 413.867833][ T28] audit: type=1326 audit(1760694507.094:261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16137 comm="syz.1.4763" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e4d78efc9 code=0x7ffc0000 [ 413.868166][ T28] audit: type=1326 audit(1760694507.094:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16137 comm="syz.1.4763" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e4d78efc9 code=0x7ffc0000 [ 414.097060][ T9] usb 4-1: USB disconnect, device number 24 [ 414.621369][ T5960] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 414.621554][ T5960] ath9k_htc: Failed to initialize the device [ 414.636433][ T9] usb 4-1: ath9k_htc: USB layer deinitialized [ 414.884607][T16173] ceph: No source [ 415.305684][T16191] loop2: detected capacity change from 0 to 256 [ 415.318570][T16186] loop1: detected capacity change from 0 to 1764 [ 415.352531][T16191] FAT-fs (loop2): Directory bread(block 64) failed [ 415.420063][T16191] FAT-fs (loop2): Directory bread(block 65) failed [ 415.437369][T16191] FAT-fs (loop2): Directory bread(block 66) failed [ 415.443971][T16191] FAT-fs (loop2): Directory bread(block 67) failed [ 415.473477][T16191] FAT-fs (loop2): Directory bread(block 68) failed [ 415.521366][T16191] FAT-fs (loop2): Directory bread(block 69) failed [ 415.536447][T16195] loop0: detected capacity change from 0 to 512 [ 415.565974][T16191] FAT-fs (loop2): Directory bread(block 70) failed [ 415.566063][T16197] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4792'. [ 415.594043][T16191] FAT-fs (loop2): Directory bread(block 71) failed [ 415.611165][T16191] FAT-fs (loop2): Directory bread(block 72) failed [ 415.621535][T16191] FAT-fs (loop2): Directory bread(block 73) failed [ 415.665951][T16195] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 415.726484][T16195] ext4 filesystem being mounted at /1136/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 415.820872][T16195] Quota error (device loop0): find_tree_dqentry: Cycle in quota tree detected: block 2 index 0 [ 415.855604][T16195] Quota error (device loop0): qtree_read_dquot: Can't read quota structure for id 64512 [ 415.876069][T16195] EXT4-fs error (device loop0): ext4_acquire_dquot:6940: comm syz.0.4790: Failed to acquire dquot type 0 [ 415.995657][T16208] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4795'. [ 416.058214][ T5792] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 416.155529][T16210] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4797'. [ 417.282106][T16253] tmpfs: Group quota inode hardlimit too large. [ 417.384255][T16256] netlink: 148 bytes leftover after parsing attributes in process `syz.2.4819'. [ 417.425799][T16256] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 417.696000][T16263] netlink: 'syz.2.4822': attribute type 10 has an invalid length. [ 417.718078][T16263] bridge0: port 3(team0) entered blocking state [ 417.724706][T16265] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4823'. [ 417.746066][T16263] bridge0: port 3(team0) entered disabled state [ 417.755605][T16263] team0: entered allmulticast mode [ 417.771174][T16263] team_slave_0: entered allmulticast mode [ 417.779787][T16261] loop1: detected capacity change from 0 to 4096 [ 417.786244][T16263] team_slave_1: entered allmulticast mode [ 417.786270][T16263] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 417.786354][T16263] geneve0: entered allmulticast mode [ 417.792095][T16263] team0: entered promiscuous mode [ 417.822135][T16261] ntfs3: loop1: Different NTFS sector size (1024) and media sector size (512). [ 417.845882][T16263] team_slave_0: entered promiscuous mode [ 417.862553][T16263] team_slave_1: entered promiscuous mode [ 417.883690][T16263] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 417.903999][T16263] geneve0: entered promiscuous mode [ 417.917554][T16263] bridge0: port 3(team0) entered blocking state [ 417.924036][T16263] bridge0: port 3(team0) entered forwarding state [ 418.118740][T16270] mac80211_hwsim hwsim6 : renamed from wlan0 [ 418.495162][T16283] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 418.545103][T16283] overlayfs: missing 'lowerdir' [ 418.752192][T16293] netlink: 'syz.0.4836': attribute type 10 has an invalid length. [ 418.780622][T16293] bridge0: port 3(team0) entered blocking state [ 418.808404][T16293] bridge0: port 3(team0) entered disabled state [ 418.814967][T16293] team0: entered allmulticast mode [ 418.874572][T16293] team_slave_0: entered allmulticast mode [ 418.894990][T16293] team_slave_1: entered allmulticast mode [ 418.927994][T16293] team0: entered promiscuous mode [ 418.933104][T16293] team_slave_0: entered promiscuous mode [ 418.986088][T16293] team_slave_1: entered promiscuous mode [ 419.013364][T16293] bridge0: port 3(team0) entered blocking state [ 419.019824][T16293] bridge0: port 3(team0) entered forwarding state [ 419.332316][T16313] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.4847'. [ 419.626075][T16327] netlink: 'syz.1.4853': attribute type 10 has an invalid length. [ 419.647103][T16327] bridge0: port 3(team0) entered blocking state [ 419.653614][T16327] bridge0: port 3(team0) entered disabled state [ 419.674216][T16327] team0: entered allmulticast mode [ 419.679902][T16327] team_slave_0: entered allmulticast mode [ 419.696049][T16327] team_slave_1: entered allmulticast mode [ 419.706057][T16327] mac80211_hwsim hwsim3 wlan1: entered allmulticast mode [ 419.738000][T16327] team0: entered promiscuous mode [ 419.766156][T16327] team_slave_0: entered promiscuous mode [ 419.782343][T16327] team_slave_1: entered promiscuous mode [ 419.803748][T16327] mac80211_hwsim hwsim3 wlan1: entered promiscuous mode [ 419.826118][T16327] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 419.853163][T16327] bridge0: port 3(team0) entered blocking state [ 419.859695][T16327] bridge0: port 3(team0) entered forwarding state [ 420.574277][T16365] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4872'. [ 420.869379][T16375] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4877'. [ 420.955850][ T23] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 421.044904][T16381] loop1: detected capacity change from 0 to 256 [ 421.144646][T16381] FAT-fs (loop1): Directory bread(block 64) failed [ 421.153721][ T23] usb 1-1: Using ep0 maxpacket: 16 [ 421.159145][T16381] FAT-fs (loop1): Directory bread(block 65) failed [ 421.172895][T16381] FAT-fs (loop1): Directory bread(block 66) failed [ 421.174557][ T23] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 421.179606][T16381] FAT-fs (loop1): Directory bread(block 67) failed [ 421.202514][ T23] usb 1-1: config 0 has no interfaces? [ 421.205376][T16381] FAT-fs (loop1): Directory bread(block 68) failed [ 421.214777][ T5960] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 421.218722][ T23] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 421.227745][T16381] FAT-fs (loop1): Directory bread(block 69) failed [ 421.238345][ T23] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 421.250180][T16381] FAT-fs (loop1): Directory bread(block 70) failed [ 421.256783][ T23] usb 1-1: Product: syz [ 421.256802][ T23] usb 1-1: Manufacturer: syz [ 421.256818][ T23] usb 1-1: SerialNumber: syz [ 421.276647][ T23] r8152-cfgselector 1-1: config 0 descriptor?? [ 421.316078][T16381] FAT-fs (loop1): Directory bread(block 71) failed [ 421.322859][T16381] FAT-fs (loop1): Directory bread(block 72) failed [ 421.356360][T16381] FAT-fs (loop1): Directory bread(block 73) failed [ 421.421402][ T5960] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 421.455814][ T5960] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 421.500957][ T5960] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 33119, setting to 1024 [ 421.515989][ T23] usbip-host 1-1: 1-1 is not in match_busid table... skip! [ 421.542635][ T5960] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 421.567946][ T5960] usb 4-1: New USB device found, idVendor=2040, idProduct=2000, bcdDevice=65.72 [ 421.578809][ T5960] usb 4-1: New USB device strings: Mfr=151, Product=0, SerialNumber=0 [ 421.587173][ T5960] usb 4-1: Manufacturer: syz [ 421.605133][ T5960] usb 4-1: config 0 descriptor?? [ 421.611659][T16377] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 421.628420][ T5960] smsusb:smsusb_probe: board id=9, interface number 0 [ 421.637617][ T5960] smsusb:siano_media_device_register: media controller created [ 421.664006][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.671337][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.678636][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.685934][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.693228][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.700653][ C0] vkms_vblank_simulate: vblank timer overrun [ 421.709452][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.716999][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.724293][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.731591][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.738866][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.746140][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.753409][ C0] vkms_vblank_simulate: vblank timer overrun [ 421.760210][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.767519][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.775397][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.782699][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.789994][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.794039][ T5842] usb 1-1: USB disconnect, device number 28 [ 421.797242][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.799371][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.817917][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.825225][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.832519][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.839797][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.847068][ C0] vkms_vblank_simulate: vblank timer overrun [ 421.853492][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.860787][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.868091][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.875361][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.882630][ C0] vkms_vblank_simulate: vblank timer overrun [ 421.889318][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.896573][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.903800][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.911028][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.918256][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.925500][ C0] vkms_vblank_simulate: vblank timer overrun [ 421.931879][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.939186][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.946488][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.953814][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.961097][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.968351][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.975648][ C0] vkms_vblank_simulate: vblank timer overrun [ 421.984561][ T5960] smsmdtv:smscore_sendrequest_and_wait: sendrequest returned error -22 [ 421.993513][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.993576][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.993628][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 421.993681][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.023029][ T5960] smsmdtv:smscore_set_device_mode: mode detect failed -22 [ 422.030459][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.037757][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.045035][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.052314][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.059595][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.066888][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.074185][ C0] vkms_vblank_simulate: vblank timer overrun [ 422.081023][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.088317][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.095606][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.102884][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.110157][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.117458][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.124725][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.131988][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.139312][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.146546][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.153820][ C0] vkms_vblank_simulate: vblank timer overrun [ 422.160375][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.167692][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.174977][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.182252][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.189541][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.196805][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.204070][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.211352][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.218625][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.225940][ C0] vkms_vblank_simulate: vblank timer overrun [ 422.233507][ T5960] smsmdtv:smscore_start_device: set device mode failed , rc -22 [ 422.242101][ T5960] smsusb:smsusb_init_device: smscore_start_device(...) failed [ 422.279541][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.286865][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.294167][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.294420][T16401] netlink: 'syz.1.4889': attribute type 1 has an invalid length. [ 422.301422][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.301835][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 422.324101][ C0] vkms_vblank_simulate: vblank timer overrun [ 422.333418][ T5960] ------------[ cut here ]------------ [ 422.339038][ T5960] ODEBUG: free active (active state 0) object: ffff88823bd5e688 object type: work_struct hint: do_submit_urb+0x0/0x360 [ 422.351822][ T9] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN [ 422.363618][ T9] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 422.372081][ T9] CPU: 0 PID: 9 Comm: kworker/0:1 Not tainted syzkaller #0 [ 422.379308][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 422.389394][ T9] Workqueue: do_submit_urb (wg-crypt-wg0) [ 422.395235][ T9] RIP: 0010:process_scheduled_works+0x5aa/0x15b0 [ 422.401582][ T9] Code: 89 ac 24 10 01 00 00 44 89 e8 c1 e8 05 83 e0 0f 89 03 48 8b 44 24 38 48 8d 58 08 48 89 d8 48 c1 e8 03 48 89 84 24 80 00 00 00 <42> 80 3c 20 00 74 08 48 89 df e8 d7 21 85 00 48 89 5c 24 48 4c 8b [ 422.421219][ T9] RSP: 0018:ffffc900000e7bc0 EFLAGS: 00010002 [ 422.427294][ T9] RAX: 0000000000000001 RBX: 0000000000000008 RCX: 0000001fffffffc0 [ 422.435275][ T9] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 00000000ffffffff [ 422.443339][ T9] RBP: ffffc900000e7da8 R08: ffffffff9717577b R09: 1ffffffff2e2eaef [ 422.451327][ T9] R10: dffffc0000000000 R11: fffffbfff2e2eaf0 R12: dffffc0000000000 [ 422.459312][ T9] R13: 0000001fffffffc0 R14: ffff88823bd5e690 R15: ffff888019672918 [ 422.467306][ T9] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 422.476240][ T9] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 422.482824][ T9] CR2: 0000001b2ed19ff8 CR3: 00000000624c9000 CR4: 00000000003506f0 [ 422.490905][ T9] Call Trace: [ 422.494196][ T9] [ 422.497143][ T9] ? assign_work+0x400/0x400 [ 422.501765][ T9] ? assign_work+0x39e/0x400 [ 422.506375][ T9] worker_thread+0xa55/0xfc0 [ 422.510971][ T9] ? _raw_spin_unlock_irqrestore+0xae/0x110 [ 422.516865][ T9] ? _raw_spin_unlock+0x40/0x40 [ 422.521745][ T9] ? _raw_spin_unlock_irqrestore+0x86/0x110 [ 422.527655][ T9] kthread+0x2fa/0x390 [ 422.531736][ T9] ? pr_cont_work+0x560/0x560 [ 422.536425][ T9] ? kthread_blkcg+0xd0/0xd0 [ 422.541021][ T9] ret_from_fork+0x48/0x80 [ 422.545443][ T9] ? kthread_blkcg+0xd0/0xd0 [ 422.550041][ T9] ret_from_fork_asm+0x11/0x20 [ 422.554825][ T9] [ 422.557859][ T9] Modules linked in: [ 422.561766][ T9] ---[ end trace 0000000000000000 ]--- [ 422.567235][ T9] RIP: 0010:process_scheduled_works+0x5aa/0x15b0 [ 422.573588][ T9] Code: 89 ac 24 10 01 00 00 44 89 e8 c1 e8 05 83 e0 0f 89 03 48 8b 44 24 38 48 8d 58 08 48 89 d8 48 c1 e8 03 48 89 84 24 80 00 00 00 <42> 80 3c 20 00 74 08 48 89 df e8 d7 21 85 00 48 89 5c 24 48 4c 8b [ 422.593201][ T9] RSP: 0018:ffffc900000e7bc0 EFLAGS: 00010002 [ 422.599279][ T9] RAX: 0000000000000001 RBX: 0000000000000008 RCX: 0000001fffffffc0 [ 422.607271][ T9] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 00000000ffffffff [ 422.615280][ T9] RBP: ffffc900000e7da8 R08: ffffffff9717577b R09: 1ffffffff2e2eaef [ 422.623260][ T9] R10: dffffc0000000000 R11: fffffbfff2e2eaf0 R12: dffffc0000000000 [ 422.631241][ T9] R13: 0000001fffffffc0 R14: ffff88823bd5e690 R15: ffff888019672918 [ 422.639244][ T9] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 422.648199][ T9] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 422.654876][ T9] CR2: 0000001b2ed19ff8 CR3: 00000000624c9000 CR4: 00000000003506f0 [ 422.662855][ T9] Kernel panic - not syncing: Fatal exception [ 422.669301][ T9] Kernel Offset: disabled [ 422.673633][ T9] Rebooting in 86400 seconds..