last executing test programs: 10.111143303s ago: executing program 4 (id=131): r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x40042, 0x1) close(r0) bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="0a000000040000000600000080"], 0x48) fsopen(0x0, 0x1) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) mount$9p_fd(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440), 0x14c98, &(0x7f0000000240)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) 10.096553003s ago: executing program 4 (id=132): socketpair$unix(0x1, 0x2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001ac0)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000001b00)='./proc\x00', &(0x7f0000001b40)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001b80)='./proc/sys/net/ipv4/conf/all/proxy_arp\x00', 0x1, 0x0) write(r0, &(0x7f0000001bc0)='1', 0x1) write$FUSE_LSEEK(r0, &(0x7f0000003e00)={0x18, 0x0, 0x0, {0x6a68473d}}, 0x18) 10.052214424s ago: executing program 4 (id=133): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x8082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000019600)={'nr0\x00', 0x2}) readv(r0, &(0x7f0000019640)=[{&(0x7f0000019680)=""/84, 0x54}], 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000019700)={0x0, 0x0, &(0x7f0000019740)={&(0x7f0000019780)=@newlink={0x28, 0x10, 0x1, 0x70bd28, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x48815, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) 9.872069599s ago: executing program 4 (id=137): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x210000, &(0x7f0000000180)={[{@nobarrier}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x10}}, {@bh}, {@init_itable}]}, 0xfc, 0x56f, &(0x7f00000005c0)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000b40)='./file1\x00', 0x143042, 0x58) r1 = openat(0xffffffffffffff9c, &(0x7f0000000b80)='./file1\x00', 0x42, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r1, 0x0) syz_clone(0x20800000, 0x0, 0x0, 0x0, 0x0, 0x0) copy_file_range(r0, 0x0, r0, &(0x7f0000000bc0)=0xae8, 0x863, 0x0) 9.765541041s ago: executing program 4 (id=138): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001400b59500000000000000000a000000", @ANYRES32=r1, @ANYBLOB="14000200fe8000000000000000000000000000aa080009003f0c0000140001"], 0x48}}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYRES8], 0x68}, 0x1, 0x0, 0x0, 0x88d1}, 0x10) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 9.060176489s ago: executing program 4 (id=145): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x204031, 0xffffffffffffffff, 0xffffd000) ptrace(0x10, r0) ptrace$peeksig(0x420e, r0, 0x0, 0x0) 9.056666949s ago: executing program 32 (id=145): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x204031, 0xffffffffffffffff, 0xffffd000) ptrace(0x10, r0) ptrace$peeksig(0x420e, r0, 0x0, 0x0) 3.586385402s ago: executing program 3 (id=218): mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0xfffffff7) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x12) listen(r1, 0x787) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000040), 0x400, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 2.584012787s ago: executing program 3 (id=233): r0 = syz_create_resource$futex(&(0x7f0000000040)=0x1) futex(r0, 0x9, 0x1, 0x0, r0, 0x2) r1 = syz_create_resource$futex(&(0x7f0000000080)=0x2) futex(r0, 0x3, 0x0, &(0x7f00000000c0), r1, 0x0) r2 = syz_create_resource$futex(&(0x7f0000000200)=0x2) futex(r1, 0xc, 0x1, 0x0, r2, 0x2) 1.520919763s ago: executing program 3 (id=253): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}, 0x3}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="a6", 0x1, 0x840, 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000fff000/0x1000)=nil, 0x3000, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x253f4c600745cb57, 0x0, 0x0, 0xfffffffffffffef6}, &(0x7f0000000100)=0x35) 1.491892843s ago: executing program 5 (id=254): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) unshare(0x22020600) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000340)) 1.481982244s ago: executing program 3 (id=255): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x40, &(0x7f0000000040)=0xfffffffa, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x28040041, &(0x7f0000000200)={0x2, 0x24e23, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000005c0)="17", 0x1}], 0x1}, 0x48c0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000640)={&(0x7f00000eb000/0x14000)=nil, 0x14000, 0x0, 0x0, 0x0, &(0x7f0000000680)=""/84, 0x54, 0x0, 0x0}, &(0x7f0000000700)=0x40) 1.456287804s ago: executing program 0 (id=256): r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000640)={0xa, 0x4e25, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}, 0x6}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000680)=0x7f5, 0x4) sendmmsg$inet6(r0, &(0x7f00000006c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x400c844) write(r0, &(0x7f0000000700)='+', 0x1) recvfrom(r0, &(0x7f0000000740)=""/146, 0x92, 0x2021, 0x0, 0x4d) 1.410040195s ago: executing program 5 (id=257): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing\x00', 0x158) mount(0x0, &(0x7f0000006f80)='./tracing\x00', &(0x7f0000006fc0)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000007000)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000007040)='/sys/kernel/fscaps', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000007080)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000070c0)='.\x00', &(0x7f0000007100), 0x40, &(0x7f0000007140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 1.376423086s ago: executing program 0 (id=258): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x3, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='team_slave_0\x00', 0x10) sendto$inet6(r0, 0x0, 0x0, 0x800, 0x0, 0x0) 1.369684826s ago: executing program 3 (id=259): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='./file1\x00', 0x0, &(0x7f00000002c0)={[{@quota}, {@noload}, {@init_itable}]}, 0x1, 0x4ec, &(0x7f0000001840)="$eJzs3c9vG1kdAPDvTH44zWY3WVhpAQFbloWCqnUSdzeqeioXEKoqISpOHNo0caModhzlRyGhh/R/QKISJ/gTOCBxQOqJOze4IaRyQCpQgRokDkYzHqf5YbfR5ofb+PORpp43rzPf76s7702eFb8A+tbFiNiOiOGIuBMR48XxpNjiemvL/t7zZw/mdp49mEui2bz1zySvz47FnnMybxXXHImIH34v4m5yOO7a5tbSbK1WXS3Kk+v1lcm1za2/LtZnF6oL1eVKZWZ6ZurqlU8rJ9bWD+q/efrdxRs/+v3vvvLkj9vf/lmW1lhRt7cdJ6nV9KHdOJnBiLhxGsF6YKBoz3CvE+EzSSPicxHxYXb/N3udDQBwFprN8WiO7y0DAOddms+BJWm5mAsYizQtl1tzeO/FaFprrK1fvtfYWJ5vzZVNxFB6b7FWnSrmCidiKMnK0/n+i3LlQPlKRLwbET8vXcjL5blGbb6XDz4A0MfeOjD+/6fUGv8BgHNupNcJAABnzvgPAP3H+A8A/cf4DwD9x/gPAP3H+A8A/cf4DwB95Qc3b2Zbc6f4/uv5+5sbS437H89X15bK9Y258lxjdaW80Ggs5N/ZU3/V9WqNxsr0J0Vhe3Jtc+t2vbGxvH47/17v29WhU28RAPAq737w+M9JNlRfu5BvsWctB2M1nG9prxMAembgeKf75ADeYIO9TgDoGT/jAx2W6N2n/aA/drCi1PUUXQu85i590fw/9Cvz/9C/jjn/D7zBzP9D/2o2E2v+A0CfMccP/ez9/M+jfv6/z3BEPDqNnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODNMJZvSVou1gIfizQtlyPejoiJGEruLdaqUxHxTkT8qTRUysrTvU4aADim9O9Jsf7XpfGPxg7WDif/LUWx1NdPfnnrFz+dXV9fnc6O/2v3+Pqj4njlpYGKpQZLuwdKJ94WAKCT9jjdHsfbnj97MNfezjKfp99pLS6axd0ptlbNYAzmryP5g8Pov5Oi3JI9rwycQPzthxHxhU7tT/K5kYli5dOD8bPYb59p/HRf/DSva71m/xafP4FcoN88zvqf653uvzQu5q+d7/+RvIc6vnb/t3Oo/0t3+7+BLv3fxaPG+OQP3+9a9zDiS4Od4ie78ZMu8T86Yvy/fPmrH3ara/4q4lIU8ZPYF39vrMn1+srk2ubWx4v12YXqQnW5UpmZnpm6euXTymQ+Rz3Znqk+7B/XLr/zsvaPRuf2j3Rv/0h27BtHbP+v/3fnx197Sfxvfb3z+/9e9/j5mPjNI8afHf1tx+W72/HnO7e/OKf7+3/50NUudIzx5G9b80dMFQA4A2ubW0uztVp19Xzt3C0e+F6XfPbtDPUgsYhsZ7jnbbeT7WT/A07iOu+fYqq97pmA0/bipu91JgAAAAAAAAAAAAAAQDdn8QtPvW4jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA59f/AwAA//+ew88F") r0 = openat(0xffffffffffffff9c, &(0x7f0000001d40)='./file1\x00', 0x101042, 0x15) pwrite64(r0, &(0x7f0000001d80)='2', 0xfdef, 0xc00) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001e00)='./file1\x00', 0x0, 0x20) ioctl$EXT4_IOC_GET_ES_CACHE(r1, 0xc020660b, &(0x7f0000001e40)={0x0, 0xfffffffffffffffa, 0x5, 0x3}) 1.352531917s ago: executing program 0 (id=261): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$SIOCGSTAMP(r0, 0x8906, 0x0) read(r0, &(0x7f00000001c0)=""/133, 0x85) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) ioctl$sock_SIOCGIFCONF(r0, 0x8912, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) 984.230886ms ago: executing program 3 (id=265): syz_emit_ethernet(0x7a, &(0x7f0000000100)={@broadcast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f4a300", 0x44, 0x3a, 0x1, @remote, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x6, {0xc, 0x6, "f6cd53", 0x200, 0x33, 0xff, @dev={0xfe, 0x80, '\x00', 0x35}, @local, [@routing={0x2f}], "13d888beda0a7f154c4d990d"}}}}}}}, 0x0) r0 = openat2(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x6903, 0x142, 0xc}, 0x18) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8983, &(0x7f00000000c0)={0x6, 'team_slave_0\x00', {0x9}, 0xfffa}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200243, 0x8) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, 0x0, 0x0) syz_usb_connect(0x1, 0x36, &(0x7f00000003c0)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f0700000000000905830300e4"], 0x0) 944.145817ms ago: executing program 0 (id=266): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) r1 = openat$selinux_policy(0xffffff9c, &(0x7f00000002c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x12, r1, 0x0) io_setup(0x5, &(0x7f00000000c0)=0x0) io_submit(r2, 0x2, &(0x7f0000000040)=[0x0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x5, 0x9, r0, 0x0, 0x0, 0xb800000000000, 0x0, 0x1, r1}]) write$selinux_load(r0, &(0x7f0000000000)=ANY=[], 0x2000) 867.964628ms ago: executing program 0 (id=268): connect$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = epoll_create1(0x0) r1 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) close(r1) userfaultfd(0x80801) mount$9p_fd(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000180), 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r0]) 642.226334ms ago: executing program 2 (id=272): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a0000000400000008000000ec00000002"], 0x50) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000140), 0xa283, r0}, 0x38) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000500)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x19, &(0x7f0000000540)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2, r0}, 0xc) 547.134836ms ago: executing program 5 (id=273): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newqdisc={0x3c, 0x24, 0xd0f, 0x3, 0x0, {0x60, 0x0, 0x0, r1, {0x0, 0x3}, {0xffff, 0xffff}, {0x4}}, [@TCA_RATE={0x6, 0x5, {0x1, 0x4}}, @qdisc_kind_options=@q_codel={{0xa}, {0x4}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1d4}, 0x8840) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x0) 530.503407ms ago: executing program 5 (id=274): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000003400)=@base={0xf, 0x4, 0x4, 0x16, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000003480)={0xe, 0x4, &(0x7f0000003540)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002e00000095"], &(0x7f0000003580)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000035c0)=ANY=[@ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000003600)={{r2}, &(0x7f0000003640), &(0x7f0000003680)=r1}, 0x20) sendmsg$inet(r0, &(0x7f00000036c0)={0x0, 0x6000, &(0x7f0000003700)=[{&(0x7f0000003740)='U', 0xa00120}], 0x1}, 0x3) 443.103039ms ago: executing program 5 (id=276): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x1, 0xa}}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x32}, 0x0, @in=@empty}}, 0xe8) r1 = socket$key(0xf, 0x3, 0x2) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4f}}, {{@in6=@mcast2, 0x404d3, 0x2b}, 0x0, @in=@empty}}, 0xe4) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x2, 0xd, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @private1}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @mcast1}}, @sadb_x_policy={0x2, 0x12, 0x2, 0x2, 0x0, 0x0, 0x0, {0x6, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, @in6=@private1, @in6=@private1}}, @sadb_lifetime={0x4, 0x4}]}, 0xc0}}, 0x0) 431.936199ms ago: executing program 2 (id=277): bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x9, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @cgroup_sock}, 0x94) syz_clone(0x42080, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mremap(&(0x7f00000ca000/0x3000)=nil, 0x3000, 0x3000, 0x3, &(0x7f0000ffd000/0x3000)=nil) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) madvise(&(0x7f000042f000/0x800000)=nil, 0x80fd00, 0x15) 379.229171ms ago: executing program 5 (id=278): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@uname={'uname', 0x3d, '&'}}]}}) 370.275321ms ago: executing program 2 (id=279): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40010) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000700)=@newsa={0x138, 0x10, 0x401, 0x0, 0x0, {{@in=@local, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {@in=@local, 0x4d2, 0x32}, @in=@remote, {0x7fffffffffffffff, 0x7fefffffffffffff, 0x7fffffffffffffff, 0x7fffffffffffffff}, {}, {0x0, 0xd5b}, 0x0, 0x34ff, 0x2, 0x4, 0x10}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}}, 0x0) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, 0x0) syz_emit_ethernet(0x30, &(0x7f0000000840)={@local, @remote, @void, {@ipv4={0x800, @esp={{0x5, 0x4, 0x0, 0x0, 0x22, 0x0, 0x0, 0x40, 0x32, 0x0, @remote, @local}, {0x4d2, 0x1}}}}}, 0x0) 333.902832ms ago: executing program 2 (id=280): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002, 0x2004}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x22008041, &(0x7f0000000200)={0xa, 0x2, 0x2, @loopback, 0xfffffffd}, 0x20) sendto$inet6(r1, &(0x7f0000000080)="44f9b108", 0x4, 0x1, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x406f413, 0x0) 331.725032ms ago: executing program 1 (id=281): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) wait4(r0, 0x0, 0x40000000, 0x0) ptrace$poke(0x5, r0, &(0x7f0000000040), 0x6) 307.023152ms ago: executing program 1 (id=282): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000880)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f00000008c0)=[{{&(0x7f0000000900)=@nfc_llcp, 0x0, &(0x7f0000000980)=[{&(0x7f0000000a00)=""/180}, {&(0x7f0000000ac0)=""/122}, {&(0x7f0000000b40)=""/165}, {&(0x7f0000000c80)=""/142}, {&(0x7f0000000d40)=""/70}, {&(0x7f0000000dc0)=""/179}], 0x0, &(0x7f0000000e80)=""/70, 0x11}}], 0x40000000000029d, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f0000000f00)=0x2, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000f40)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 301.186552ms ago: executing program 2 (id=283): syz_mount_image$ext4(&(0x7f0000000500)='ext4\x00', &(0x7f00000006c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x10040, &(0x7f0000000100)={[{@journal_ioprio={'journal_ioprio', 0x3d, 0x4}}, {@quota}]}, 0xfd, 0x269, &(0x7f0000000a00)="$eJzs3U9oHFUcB/Df7B/jJotEvQjiHxARDYR4E7zEi0JAQhARVIiIeJJEiAnesp68eNCzSkDwEkpvTXssvYReWgo9pW0O6aXQhh4aemgPW3Znt2ySDW33b9n5fGCYmbz35r0J832zLMxsAJk1GRGzEZGPiKmIKEZE0lrh7XSZbOxulLYXI6rVL+4m9XrpfqrZbiIiKhHxUUShWba29c3e/Z3P3vtjtfju/1tflwZ1fq3293Y/P/h3/vczcx+uXb56ez6J2Sg3ylrPo5eSNn8rJBGv9KOz50RSGPYIeBoLv56+Vsv9qxHxTj3/xcg1IvvnygsXivHBPye1/evOldcHOVag96rVYu0eWKkCmZOLiHIkuemISLdzuenp9DP89fx47qfllV+mflxeXfph2DMV0CvlSHY/PTd2duJI/m/l0/wDo6scsfvlwuaN2vZBftijAfqm9dv2N9JVLf9T362/H/IPmSP/kF3yD9kl/zACOsyu/EN2dZP/F/s0JmAw3P9hhBWbG5W2xfIP2SX/MKL+a/fU6WHyD9nVmn8AIFuqY8N+AhkYlmHPPwAAAAAAAAAAAAAAAAAAwHEbpe3F5jKoPi/+HbH/SUQU2vWfr/8ecfNt4+P3klq1x5K0WVe+favLA3TpVM+evi511Oqlm73qvzOX3uzPcX87vHviP2d9KaJSqzxTKBy//pLG9de5l59QXvy+yw6e0dG3An781WD7P+rh5nD7n9uJOF+bf2bazT+5eK2+bj//lFtfsdyhnx90eQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG5lEAAAD//4oibec=") syz_mount_image$vfat(&(0x7f0000000b00), &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x181d011, 0x0, 0x40, 0x0, &(0x7f0000000140)) openat(0xffffffffffffff9c, &(0x7f00000061c0)='./bus\x00', 0x40, 0x0) syz_mount_image$vfat(&(0x7f00000007c0), &(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x824851, 0x0, 0x1, 0x0, &(0x7f0000000d40)) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) creat(&(0x7f00000009c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x44) 240.598504ms ago: executing program 1 (id=284): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000005c0)={r1, r0, 0x15, 0x0, @val=@kprobe_multi=@addrs={0x0, 0x0, 0x0, 0x0, 0xffffffff}}, 0x30) r2 = socket$inet6(0xa, 0x3, 0x8000000003c) getsockopt$inet6_int(r2, 0x3a, 0x3c, 0x0, 0x0) 229.775504ms ago: executing program 1 (id=285): r0 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@dev, 0x800, 0x0, 0x2000000000903, 0x1}, 0x20) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f00000001c0)=ANY=[], 0xb8) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x7fff, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x380000, @loopback}, 0x1c) sendmmsg(r0, &(0x7f000000d6c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=ANY=[], 0xc}}], 0x1, 0x4040004) 218.953175ms ago: executing program 1 (id=286): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0) 217.760864ms ago: executing program 2 (id=287): r0 = socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./proc\x00', &(0x7f00000002c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000380)='3', 0x1}], 0x1, 0x800, 0x0) listen(r0, 0x0) 109.19µs ago: executing program 0 (id=288): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a0000000400000008000000ec00000002"], 0x50) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000140), 0xa283, r0}, 0x38) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000500)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x19, &(0x7f0000000540)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2, r0}, 0xc) 0s ago: executing program 1 (id=289): socket$unix(0x1, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_queues(r0, r1, &(0x7f0000000540)={0x0, 0xb4a7, 0x0, 0xfffffffe, 0x20000}, 0x0, 0x1, &(0x7f00000003c0)={0x2e, 0x4c, 0x0, r0, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x4000, 0xdbd, 0x0, 0x0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0xf, 0xffffffffffffff57, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, 0x94) kernel console output (not intermixed with test programs): [ 12.755211][ T28] audit: type=1400 audit(1792423039.667:62): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.757696][ T28] audit: type=1400 audit(1792423039.667:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.179' (ED25519) to the list of known hosts. [ 19.551461][ T28] audit: type=1400 audit(1792423046.477:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 19.552531][ T279] cgroup: Unknown subsys name 'net' [ 19.574093][ T28] audit: type=1400 audit(1792423046.477:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.601428][ T28] audit: type=1400 audit(1792423046.507:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.601572][ T279] cgroup: Unknown subsys name 'devices' [ 19.750124][ T279] cgroup: Unknown subsys name 'hugetlb' [ 19.755713][ T279] cgroup: Unknown subsys name 'rlimit' [ 19.857974][ T28] audit: type=1400 audit(1792423046.777:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.880073][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 19.881629][ T28] audit: type=1400 audit(1792423046.777:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 19.914800][ T28] audit: type=1400 audit(1792423046.777:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 19.918305][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.938271][ T28] audit: type=1400 audit(1792423046.817:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.972294][ T28] audit: type=1400 audit(1792423046.817:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.997942][ T28] audit: type=1400 audit(1792423046.847:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.023513][ T28] audit: type=1400 audit(1792423046.847:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.749536][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.756597][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.764211][ T287] device bridge_slave_0 entered promiscuous mode [ 20.772281][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.779358][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.786620][ T287] device bridge_slave_1 entered promiscuous mode [ 20.821233][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.828276][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.835699][ T289] device bridge_slave_0 entered promiscuous mode [ 20.847284][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.854437][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.861807][ T289] device bridge_slave_1 entered promiscuous mode [ 20.882955][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.890154][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.897568][ T288] device bridge_slave_0 entered promiscuous mode [ 20.907312][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.914372][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.922308][ T288] device bridge_slave_1 entered promiscuous mode [ 20.953096][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.960230][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.967610][ T291] device bridge_slave_0 entered promiscuous mode [ 20.974552][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.981621][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.989398][ T291] device bridge_slave_1 entered promiscuous mode [ 21.087259][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.094379][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.101799][ T290] device bridge_slave_0 entered promiscuous mode [ 21.111412][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.118437][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.125918][ T290] device bridge_slave_1 entered promiscuous mode [ 21.236910][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.243973][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.251277][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.258291][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.275625][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.282688][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.289981][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.296991][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.311626][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.318681][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.325940][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.332979][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.342181][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.349217][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.356470][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.363510][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.396877][ T41] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.404260][ T41] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.411743][ T41] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.419236][ T41] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.426369][ T41] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.433714][ T41] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.441487][ T41] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.448823][ T41] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.456378][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.463857][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.471234][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 21.479534][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.487612][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.494631][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.502094][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 21.531957][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 21.540260][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.548341][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.555370][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.562826][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.571034][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.581249][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.590938][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.610142][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.617550][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.626014][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.633072][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.641099][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.649367][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.656393][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.663757][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.690270][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.699202][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.707844][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.716210][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.723262][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.730675][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.739163][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.746186][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.753611][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.761697][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.769899][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.776919][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.784395][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.792655][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.799693][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.807035][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.815040][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.825231][ T287] device veth0_vlan entered promiscuous mode [ 21.849215][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.857155][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.865337][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 21.873828][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.882313][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.889363][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.896782][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.905269][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.913637][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 21.921969][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.930225][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.937248][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.944633][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.952811][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.960775][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.968815][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.976692][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.985167][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.993565][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.001119][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.016422][ T288] device veth0_vlan entered promiscuous mode [ 22.023049][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.031013][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.039557][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.047570][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.055599][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.063758][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.071977][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.079500][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.088220][ T290] device veth0_vlan entered promiscuous mode [ 22.098864][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.106775][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.115539][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.123064][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.133378][ T287] device veth1_macvtap entered promiscuous mode [ 22.144009][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.152248][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.160386][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.170265][ T290] device veth1_macvtap entered promiscuous mode [ 22.177449][ T288] device veth1_macvtap entered promiscuous mode [ 22.190444][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.199171][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.207273][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.214969][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.223306][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.231563][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.239264][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.247456][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.258826][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.267052][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.279463][ T289] device veth0_vlan entered promiscuous mode [ 22.289936][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.298234][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.307234][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.315128][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.323131][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.331449][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.339881][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.347352][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.364830][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.373155][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.381500][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.390053][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.401261][ T291] device veth0_vlan entered promiscuous mode [ 22.409011][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.416890][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.426200][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 22.437260][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.447401][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.454900][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.463249][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.474312][ T289] device veth1_macvtap entered promiscuous mode [ 22.481133][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.489284][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.497298][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.506679][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.514939][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.533739][ T311] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1'. [ 22.550316][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.564782][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.569296][ T316] input: syz1 as /devices/virtual/input/input4 [ 22.577024][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.587702][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.596367][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.604829][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.620035][ T291] device veth1_macvtap entered promiscuous mode [ 22.629182][ T322] process 'syz.4.8' launched './file0' with NULL argv: empty string added [ 22.650647][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.658367][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.666789][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.691704][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.706768][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.715754][ T333] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10'. [ 22.748130][ T339] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 22.797332][ T347] netlink: 20 bytes leftover after parsing attributes in process `syz.4.15'. [ 22.928588][ T60] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 23.030294][ T360] loop2: detected capacity change from 0 to 256 [ 23.068645][ T351] loop3: detected capacity change from 0 to 40427 [ 23.075704][ T351] ======================================================= [ 23.075704][ T351] WARNING: The mand mount option has been deprecated and [ 23.075704][ T351] and is ignored by this kernel. Remove the mand [ 23.075704][ T351] option from the mount to silence this warning. [ 23.075704][ T351] ======================================================= [ 23.129172][ T351] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 23.136936][ T351] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 23.148005][ T60] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 23.156353][ T351] F2FS-fs (loop3): invalid crc value [ 23.162414][ T364] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 23.182855][ T60] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 23.202610][ T60] usb 1-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 23.203434][ T351] F2FS-fs (loop3): Found nat_bits in checkpoint [ 23.227266][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 23.241359][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 23.244326][ T60] usb 1-1: config 0 interface 0 has no altsetting 0 [ 23.256094][ T60] usb 1-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 23.259814][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 23.273002][ T60] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.286598][ T376] loop2: detected capacity change from 0 to 512 [ 23.294385][ T60] usb 1-1: config 0 descriptor?? [ 23.307383][ T376] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 23.316577][ T376] ext4 filesystem being mounted at /4/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 23.317295][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 23.331741][ T376] EXT4-fs (loop2): shut down requested (0) [ 23.347143][ T376] EXT4-fs warning (device loop2): ext4_dirblock_csum_verify:406: inode #2: comm syz.2.26: No space for directory leaf checksum. Please run e2fsck -D. [ 23.364442][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 23.376035][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 23.385641][ T351] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 23.388938][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 23.398893][ T351] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 23.408653][ T291] EXT4-fs (loop2): unmounting filesystem. [ 23.431980][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 23.458816][ T383] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 23.553652][ T391] input: syz0 as /devices/virtual/input/input5 [ 23.568375][ T388] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 23.579342][ T388] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 23.669677][ T397] user requested TSC rate below hardware speed [ 23.679857][ T397] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 23.716601][ T60] input: HID 17ef:6047 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:17EF:6047.0001/input/input6 [ 23.776533][ T418] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 23.797304][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 23.811288][ T60] lenovo 0003:17EF:6047.0001: input,hiddev96,hidraw0: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.0-1/input0 [ 23.827715][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 23.847199][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 23.864192][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 23.872962][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 23.883779][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 23.892955][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 23.902493][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 23.915810][ T425] Illegal XDP return value 4294967282 on prog (id 5) dev syz_tun, expect packet loss! [ 23.961948][ T19] usb 1-1: USB disconnect, device number 2 [ 24.026665][ T429] loop1: detected capacity change from 0 to 1024 [ 24.033786][ T429] EXT4-fs: Ignoring removed bh option [ 24.060289][ T429] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 24.357234][ T422] loop3: detected capacity change from 0 to 131072 [ 24.374099][ T422] F2FS-fs (loop3): Invalid segment/section count (458783, 24 x 150994945) [ 24.384148][ T422] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 24.399017][ T422] F2FS-fs (loop3): invalid crc value [ 24.435418][ T422] F2FS-fs (loop3): Found nat_bits in checkpoint [ 24.494438][ T422] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 24.502096][ T422] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 24.573359][ T28] kauditd_printk_skb: 173 callbacks suppressed [ 24.573376][ T28] audit: type=1400 audit(1792423051.497:247): avc: denied { append } for pid=420 comm="syz.3.38" path="/4/file1/memory.current" dev="loop3" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 24.613509][ T28] audit: type=1400 audit(1792423051.537:248): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 24.684079][ T28] audit: type=1400 audit(1792423051.537:249): avc: denied { write } for pid=454 comm="syz.4.58" laddr=172.20.20.170 lport=256 faddr=172.20.20.170 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.956673][ T468] netlink: 27 bytes leftover after parsing attributes in process `syz.2.48'. [ 25.013839][ T28] audit: type=1400 audit(1792423051.937:250): avc: denied { create } for pid=472 comm="syz.2.50" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.057616][ T28] audit: type=1400 audit(1792423051.937:251): avc: denied { write } for pid=472 comm="syz.2.50" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.078362][ T28] audit: type=1400 audit(1792423051.937:252): avc: denied { read } for pid=472 comm="syz.2.50" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.099648][ T28] audit: type=1400 audit(1792423051.977:253): avc: denied { write } for pid=475 comm="syz.2.51" name="raw6" dev="proc" ino=4026532679 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 25.122029][ T28] audit: type=1400 audit(1792423051.977:254): avc: denied { unmount } for pid=291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 25.149514][ T288] EXT4-fs (loop1): unmounting filesystem. [ 25.184737][ T28] audit: type=1400 audit(1792423052.107:255): avc: denied { mount } for pid=485 comm="syz.2.56" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 25.215669][ T28] audit: type=1400 audit(1792423052.107:256): avc: denied { unmount } for pid=291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 25.251316][ T492] loop2: detected capacity change from 0 to 512 [ 25.271097][ T490] syz.3.60 (490) used greatest stack depth: 21160 bytes left [ 25.288633][ T492] EXT4-fs (loop2): warning: mounting fs with errors, running e2fsck is recommended [ 25.307311][ T492] EXT4-fs (loop2): Errors on filesystem, clearing orphan list. [ 25.318727][ T492] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 25.334513][ T484] loop1: detected capacity change from 0 to 40427 [ 25.343767][ T484] F2FS-fs (loop1): Invalid log blocks per segment (1) [ 25.350655][ T484] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 25.359087][ T484] F2FS-fs (loop1): fault_type options not supported [ 25.365763][ T484] F2FS-fs (loop1): fault_injection options not supported [ 25.373142][ T484] F2FS-fs (loop1): Image doesn't support compression [ 25.381498][ T484] F2FS-fs (loop1): invalid crc value [ 25.439698][ T484] F2FS-fs (loop1): Found nat_bits in checkpoint [ 25.495981][ T291] EXT4-fs (loop2): unmounting filesystem. [ 25.509802][ T508] loop0: detected capacity change from 0 to 256 [ 25.529623][ T508] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 25.548737][ T484] F2FS-fs (loop1): Start checkpoint disabled! [ 25.559521][ T484] F2FS-fs (loop1): f2fs_disable_checkpoint() finish, err:0 [ 25.581004][ T484] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 25.588719][ T484] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 25.621220][ T518] loop3: detected capacity change from 0 to 1024 [ 25.675659][ T516] FAT-fs (loop0): error, invalid FAT chain (i_pos 196, last_block 8200) [ 25.690311][ T308] kworker/u4:3: attempt to access beyond end of device [ 25.690311][ T308] loop1: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 25.692273][ T518] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 25.704409][ T516] FAT-fs (loop0): Filesystem has been set read-only [ 25.727749][ T510] loop2: detected capacity change from 0 to 40427 [ 25.787845][ T510] F2FS-fs (loop2): Corrupted extension count (33554469 + 1 > 64) [ 25.817239][ T510] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 25.831047][ T510] F2FS-fs (loop2): invalid crc value [ 25.880315][ T289] EXT4-fs (loop3): unmounting filesystem. [ 25.897558][ T510] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 25.967137][ T510] F2FS-fs (loop2): Try to recover 2th superblock, ret: -30 [ 25.976148][ T510] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 26.008698][ T510] F2FS-fs (loop2): f2fs_check_nid_range: out-of-range nid=470000, run fsck to fix. [ 26.079049][ T541] EXT4-fs (loop0): warning: mounting fs with errors, running e2fsck is recommended [ 26.095444][ T526] F2FS-fs (loop4): invalid crc value [ 26.109854][ T541] EXT4-fs (loop0): Errors on filesystem, clearing orphan list. [ 26.117443][ T541] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 26.135974][ T526] F2FS-fs (loop4): Found nat_bits in checkpoint [ 26.199864][ T526] F2FS-fs (loop4): Start checkpoint disabled! [ 26.206637][ T526] F2FS-fs (loop4): f2fs_disable_checkpoint() finish, err:0 [ 26.214178][ T526] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 26.322753][ T287] EXT4-fs (loop0): unmounting filesystem. [ 26.342764][ T557] syz.4.73: attempt to access beyond end of device [ 26.342764][ T557] loop4: rw=2049, sector=77824, nr_sectors = 4096 limit=40427 [ 26.393127][ T557] syz.4.73: attempt to access beyond end of device [ 26.393127][ T557] loop4: rw=2049, sector=49152, nr_sectors = 4096 limit=40427 [ 26.450389][ T557] syz.4.73: attempt to access beyond end of device [ 26.450389][ T557] loop4: rw=2049, sector=73728, nr_sectors = 4096 limit=40427 [ 26.526206][ T572] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 26.535339][ T572] ext4 filesystem being mounted at /18/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 26.537685][ T557] syz.4.73: attempt to access beyond end of device [ 26.537685][ T557] loop4: rw=2049, sector=81920, nr_sectors = 4096 limit=40427 [ 26.574964][ T288] EXT4-fs error (device loop1): ext4_lookup:1858: inode #12: comm syz-executor: iget: bad i_size value: 2533274857506816 [ 26.595452][ T557] syz.4.73: attempt to access beyond end of device [ 26.595452][ T557] loop4: rw=2049, sector=86016, nr_sectors = 8 limit=40427 [ 26.625552][ T557] syz.4.73: attempt to access beyond end of device [ 26.625552][ T557] loop4: rw=2049, sector=86024, nr_sectors = 8 limit=40427 [ 26.651906][ T288] EXT4-fs error (device loop1): ext4_lookup:1858: inode #12: comm syz-executor: iget: bad i_size value: 2533274857506816 [ 26.665428][ T557] syz.4.73: attempt to access beyond end of device [ 26.665428][ T557] loop4: rw=2049, sector=86032, nr_sectors = 8 limit=40427 [ 26.679803][ T557] syz.4.73: attempt to access beyond end of device [ 26.679803][ T557] loop4: rw=2049, sector=86040, nr_sectors = 8 limit=40427 [ 26.694896][ T557] syz.4.73: attempt to access beyond end of device [ 26.694896][ T557] loop4: rw=2049, sector=86048, nr_sectors = 8 limit=40427 [ 26.728070][ T576] syz.1.85 (576) used greatest stack depth: 21152 bytes left [ 26.812936][ T288] EXT4-fs (loop1): unmounting filesystem. [ 26.972236][ T598] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 27.071819][ T291] EXT4-fs (loop2): unmounting filesystem. [ 27.135542][ T609] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.142636][ T609] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.150601][ T609] device bridge_slave_0 entered promiscuous mode [ 27.160185][ T609] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.167222][ T609] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.183636][ T609] device bridge_slave_1 entered promiscuous mode [ 27.237372][ T623] 9pnet: p9_errstr2errno: server reported unknown error õ€ÿ00000000000000000003 [ 27.268249][ T609] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.275329][ T609] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.282623][ T609] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.289675][ T609] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.303115][ T613] F2FS-fs (loop3): invalid crc value [ 27.327268][ T613] F2FS-fs (loop3): Found nat_bits in checkpoint [ 27.358710][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.376144][ T380] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.407880][ T380] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.450133][ T613] F2FS-fs (loop3): Start checkpoint disabled! [ 27.456722][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.465120][ T613] F2FS-fs (loop3): f2fs_disable_checkpoint() finish, err:0 [ 27.468389][ T380] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.479381][ T380] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.482788][ T613] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 27.499030][ T619] F2FS-fs (loop2): invalid crc value [ 27.507768][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.516647][ T619] F2FS-fs (loop2): Found nat_bits in checkpoint [ 27.528816][ T380] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.535853][ T380] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.576111][ T385] device bridge_slave_1 left promiscuous mode [ 27.584662][ T385] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.586868][ T619] F2FS-fs (loop2): Start checkpoint disabled! [ 27.598302][ T619] F2FS-fs (loop2): f2fs_disable_checkpoint() finish, err:0 [ 27.606308][ T385] device bridge_slave_0 left promiscuous mode [ 27.612474][ T619] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 27.626710][ T385] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.651155][ T385] device veth1_macvtap left promiscuous mode [ 27.663706][ T385] device veth0_vlan left promiscuous mode [ 27.723830][ T640] erofs: (device loop3): mounted with root inode @ nid 36. [ 27.872452][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 27.881685][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.899852][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 27.918151][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.943046][ T609] device veth0_vlan entered promiscuous mode [ 27.958496][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.968304][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.989103][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 28.002779][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.027464][ T609] device veth1_macvtap entered promiscuous mode [ 28.042778][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.054659][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.065261][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 28.074004][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.083006][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 28.104310][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 28.131255][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.148874][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.167537][ T567] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.265720][ T649] set_capacity_and_notify: 7 callbacks suppressed [ 28.265737][ T649] loop3: detected capacity change from 0 to 40427 [ 28.288789][ T661] netlink: 104 bytes leftover after parsing attributes in process `syz.1.119'. [ 28.313921][ T649] F2FS-fs (loop3): invalid crc value [ 28.349454][ T649] F2FS-fs (loop3): Found nat_bits in checkpoint [ 28.434383][ T664] loop1: detected capacity change from 0 to 8192 [ 28.446625][ T649] F2FS-fs (loop3): Start checkpoint disabled! [ 28.458547][ T649] F2FS-fs (loop3): f2fs_disable_checkpoint() finish, err:0 [ 28.482825][ T670] loop4: detected capacity change from 0 to 2048 [ 28.488966][ T664] loop1: p1 p2 < > p4 < p5 > [ 28.489942][ T649] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 28.501424][ T664] loop1: p1 start 16777216 is beyond EOD, truncated [ 28.503169][ T670] EXT4-fs: Ignoring removed i_version option [ 28.511078][ T664] loop1: p5 start 16777216 is beyond EOD, truncated [ 28.548808][ T103] loop1: p1 p2 < > p4 < p5 > [ 28.553956][ T103] loop1: p1 start 16777216 is beyond EOD, truncated [ 28.565431][ T103] loop1: p5 start 16777216 is beyond EOD, truncated [ 28.575220][ T670] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 28.580687][ T679] loop0: detected capacity change from 0 to 2048 [ 28.590766][ T670] ext4 filesystem being mounted at /32/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 28.639803][ T290] EXT4-fs (loop4): unmounting filesystem. [ 28.651524][ T679] loop0: p1 < p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 p18 p19 p20 p21 p22 p23 p24 p25 p26 p27 p28 p29 p30 p31 p32 p33 p34 p35 p36 p37 p38 p39 p40 p41 p42 p43 p44 p45 p46 p47 p48 p49 p50 p51 p52 p53 p54 p55 p56 p57 p58 p59 p60 p61 p62 p63 p64 p65 p66 p67 p68 p69 p70 p71 p72 p73 p74 p75 p76 p77 p78 p79 p80 p81 p82 p83 p84 p85 p86 p87 p88 p89 p90 p91 p92 p93 p94 p95 p96 p97 p98 p99 p100 p101 p102 p103 p104 p105 p106 p107 p108 p109 p110 p111 p112 p113 p114 p115 p116 p117 p118 p119 p120 p121 p122 p123 p124 p125 p126 p127 p128 p129 p130 p131 p132 p133 p134 p135 p136 p137 p138 p139 p140 p141 p142 p143 p144 p145 p146 p147 p148 p149 p150 p151 p152 p153 p154 p155 p156 p157 p158 p159 p160 p161 p162 p163 p164 p165 p166 p167 p168 p169 p170 p171 p172 p173 p174 p175 p176 p177 p178 p179 p180 p181 p182 p183 p184 p185 p186 p187 p188 p189 p190 p191 p192 p193 p194 p195 p196 p197 p198 p199 p200 p201 p202 p203 p204 p205 p206 p207 p208 p209 p210 p211 p212 p213 p214 p215 p216 [ 28.652054][ T679] loop0: p2 size 853248 extends beyond EOD, [ 28.713994][ T687] loop3: detected capacity change from 0 to 4096 [ 28.754900][ T326] udevd[326]: inotify_add_watch(7, /dev/loop1p4, 10) failed: No such file or directory [ 28.755802][ T325] udevd[325]: inotify_add_watch(7, /dev/loop1p2, 10) failed: No such file or directory [ 28.786197][ T679] truncated [ 28.790538][ T679] loop0: p5 size 853248 extends beyond EOD, truncated [ 28.813444][ T679] loop0: p6 size 853248 extends beyond EOD, truncated [ 28.834719][ T679] loop0: p7 size 853248 extends beyond EOD, truncated [ 28.840715][ T687] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 28.842915][ T679] loop0: p8 size 853248 extends beyond EOD, truncated [ 28.859134][ T679] loop0: p9 size 853248 extends beyond EOD, truncated [ 28.868245][ T679] loop0: p10 size 853248 extends beyond EOD, truncated [ 28.888045][ T679] loop0: p11 size 853248 extends beyond EOD, truncated [ 28.889623][ T289] EXT4-fs (loop3): unmounting filesystem. [ 28.896598][ T679] loop0: p12 size 853248 extends beyond EOD, truncated [ 28.910993][ T679] loop0: p13 size 853248 extends beyond EOD, truncated [ 28.915578][ T704] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 28.933212][ T679] loop0: p14 size 853248 extends beyond EOD, truncated [ 28.947376][ T679] loop0: p15 size 853248 extends beyond EOD, truncated [ 28.957185][ T679] loop0: p16 size 853248 extends beyond EOD, truncated [ 28.964736][ T679] loop0: p17 size 853248 extends beyond EOD, truncated [ 28.972156][ T679] loop0: p18 size 853248 extends beyond EOD, truncated [ 28.979869][ T679] loop0: p19 size 853248 extends beyond EOD, truncated [ 28.987305][ T679] loop0: p20 size 853248 extends beyond EOD, truncated [ 28.994939][ T679] loop0: p21 size 853248 extends beyond EOD, truncated [ 29.002702][ T679] loop0: p22 size 853248 extends beyond EOD, truncated [ 29.010070][ T679] loop0: p23 size 853248 extends beyond EOD, truncated [ 29.017364][ T679] loop0: p24 size 853248 extends beyond EOD, truncated [ 29.024677][ T679] loop0: p25 size 853248 extends beyond EOD, truncated [ 29.032334][ T679] loop0: p26 size 853248 extends beyond EOD, truncated [ 29.040122][ T679] loop0: p27 size 853248 extends beyond EOD, truncated [ 29.045513][ T710] loop4: detected capacity change from 0 to 1024 [ 29.047619][ T679] loop0: p28 size 853248 extends beyond EOD, truncated [ 29.063090][ T710] EXT4-fs: Ignoring removed bh option [ 29.063761][ T679] loop0: p29 size 853248 extends beyond EOD, truncated [ 29.076818][ T679] loop0: p30 size 853248 extends beyond EOD, truncated [ 29.084433][ T679] loop0: p31 size 853248 extends beyond EOD, truncated [ 29.087115][ T710] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 29.092737][ T679] loop0: p32 size 853248 extends beyond EOD, truncated [ 29.107591][ T679] loop0: p33 size 853248 extends beyond EOD, truncated [ 29.115742][ T679] loop0: p34 size 853248 extends beyond EOD, truncated [ 29.122028][ T709] EXT4-fs warning (device loop4): ext4_expand_extra_isize_ea:2802: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 29.123838][ T679] loop0: p35 size 853248 extends beyond EOD, truncated [ 29.143516][ T290] EXT4-fs error (device loop4): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /37/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 29.144115][ T679] loop0: p36 size 853248 extends beyond EOD, truncated [ 29.166467][ T290] EXT4-fs (loop4): Remounting filesystem read-only [ 29.173741][ T679] loop0: p37 size 853248 extends beyond EOD, truncated [ 29.180364][ T290] EXT4-fs error (device loop4): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /37/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 29.187127][ T679] loop0: p38 size 853248 extends beyond EOD, truncated [ 29.208913][ T290] EXT4-fs (loop4): Remounting filesystem read-only [ 29.216120][ T679] loop0: p39 size 853248 extends beyond EOD, truncated [ 29.222227][ T290] EXT4-fs error (device loop4): empty_inline_dir:1903: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 29.229847][ T679] loop0: p40 size 853248 extends beyond EOD, truncated [ 29.249471][ T290] EXT4-fs (loop4): Remounting filesystem read-only [ 29.256546][ T679] loop0: p41 size 853248 extends beyond EOD, truncated [ 29.262960][ T290] EXT4-fs warning (device loop4): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 29.274471][ T679] loop0: p42 size 853248 extends beyond EOD, truncated [ 29.291081][ T290] EXT4-fs error (device loop4): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /37/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 29.291290][ T679] loop0: p43 size 853248 extends beyond EOD, truncated [ 29.313627][ T290] EXT4-fs (loop4): Remounting filesystem read-only [ 29.321192][ T679] loop0: p44 size 853248 extends beyond EOD, truncated [ 29.327310][ T290] EXT4-fs error (device loop4): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /37/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 29.334386][ T679] loop0: p45 size 853248 extends beyond EOD, [ 29.355847][ T290] EXT4-fs (loop4): Remounting filesystem read-only [ 29.356115][ T679] truncated [ 29.362109][ T290] EXT4-fs error (device loop4): empty_inline_dir:1903: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 29.369447][ T679] loop0: p46 size 853248 extends beyond EOD, [ 29.371896][ T290] EXT4-fs (loop4): Remounting filesystem read-only [ 29.391395][ T679] truncated [ 29.397367][ T290] EXT4-fs warning (device loop4): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 29.419377][ T679] loop0: p47 size 853248 extends beyond EOD, truncated [ 29.422340][ T290] EXT4-fs error (device loop4): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /37/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 29.443216][ T679] loop0: p48 size 853248 extends beyond EOD, truncated [ 29.457096][ T290] EXT4-fs (loop4): Remounting filesystem read-only [ 29.459380][ T679] loop0: p49 size 853248 extends beyond EOD, truncated [ 29.464393][ T290] EXT4-fs error (device loop4): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /37/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 29.477830][ T679] loop0: p50 size 853248 extends beyond EOD, [ 29.492955][ T290] EXT4-fs (loop4): Remounting filesystem read-only [ 29.498333][ T679] truncated [ 29.500520][ T290] EXT4-fs error (device loop4): empty_inline_dir:1903: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 29.511648][ T679] loop0: p51 size 853248 extends beyond EOD, [ 29.528925][ T290] EXT4-fs (loop4): Remounting filesystem read-only [ 29.541519][ T290] EXT4-fs warning (device loop4): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 29.542147][ T679] truncated [ 29.555824][ T290] EXT4-fs error (device loop4): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /37/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 29.581394][ T290] EXT4-fs warning (device loop4): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 29.581640][ T679] loop0: p52 size 853248 extends beyond EOD, truncated [ 29.596093][ T290] EXT4-fs warning (device loop4): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 29.604079][ T679] loop0: p53 size 853248 extends beyond EOD, truncated [ 29.625711][ T679] loop0: p54 size 853248 extends beyond EOD, truncated [ 29.633524][ T679] loop0: p55 size 853248 extends beyond EOD, truncated [ 29.637125][ T290] EXT4-fs warning (device loop4): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 29.643878][ T679] loop0: p56 size 853248 extends beyond EOD, truncated [ 29.655620][ T290] EXT4-fs warning (device loop4): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 29.662500][ T679] loop0: p57 size 853248 extends beyond EOD, truncated [ 29.676746][ T290] EXT4-fs warning (device loop4): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 29.683895][ T679] loop0: p58 size 853248 extends beyond EOD, [ 29.697965][ T290] EXT4-fs warning (device loop4): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 29.718276][ T679] truncated [ 29.743311][ T679] loop0: p59 size 853248 extends beyond EOD, truncated [ 29.752500][ T722] loop1: detected capacity change from 0 to 512 [ 29.765792][ T679] loop0: p60 size 853248 extends beyond EOD, truncated [ 29.773309][ T679] loop0: p61 size 853248 extends beyond EOD, truncated [ 29.782650][ T722] EXT4-fs (loop1): Test dummy encryption mode enabled [ 29.798937][ T679] loop0: p62 size 853248 extends beyond EOD, truncated [ 29.822929][ T679] loop0: p63 size 853248 extends beyond EOD, truncated [ 29.831485][ T722] EXT4-fs error (device loop1): ext4_orphan_get:1405: inode #15: comm syz.1.141: inode has both inline data and extents flags [ 29.846392][ T727] loop2: detected capacity change from 0 to 1024 [ 29.853423][ T679] loop0: p64 size 853248 extends beyond EOD, truncated [ 29.860661][ T722] EXT4-fs error (device loop1): ext4_orphan_get:1410: comm syz.1.141: couldn't read orphan inode 15 (err -117) [ 29.873204][ T722] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 29.873527][ T679] loop0: p65 size 853248 extends beyond EOD, [ 29.909534][ T722] EXT4-fs (loop1): shut down requested (0) [ 29.921850][ T727] EXT4-fs (loop2): warning: mounting unchecked fs, running e2fsck is recommended [ 29.936929][ T679] truncated [ 29.941433][ T727] EXT4-fs (loop2): Errors on filesystem, clearing orphan list. [ 29.949988][ T727] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 29.950065][ T679] loop0: p66 size 853248 extends beyond EOD, truncated [ 29.967614][ T28] kauditd_printk_skb: 55 callbacks suppressed [ 29.967626][ T28] audit: type=1400 audit(1792423062.888:312): avc: denied { setattr } for pid=721 comm="syz.1.141" path="/6/file1" dev="loop1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 29.978837][ T727] EXT4-fs (loop2): shut down requested (0) [ 29.998598][ T28] audit: type=1400 audit(1792423062.908:313): avc: denied { watch } for pid=737 comm="syz.3.148" path="/27/file0" dev="tmpfs" ino=166 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 30.002793][ T679] loop0: p67 size 853248 extends beyond EOD, [ 30.008342][ T609] EXT4-fs (loop1): unmounting filesystem. [ 30.030812][ T679] truncated [ 30.058489][ T679] loop0: p68 size 853248 extends beyond EOD, truncated [ 30.070521][ T745] loop1: detected capacity change from 0 to 256 [ 30.075259][ T679] loop0: p69 size 853248 extends beyond EOD, truncated [ 30.086295][ T291] EXT4-fs (loop2): unmounting filesystem. [ 30.117669][ T736] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.128692][ T679] loop0: p70 size 853248 extends beyond EOD, truncated [ 30.135595][ T754] loop1: detected capacity change from 0 to 1024 [ 30.144836][ T28] audit: type=1400 audit(1792423063.058:314): avc: denied { create } for pid=749 comm="syz.3.153" name="#7" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 30.159565][ T736] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.179400][ T679] loop0: p71 size 853248 extends beyond EOD, truncated [ 30.183717][ T754] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 30.186658][ T736] device bridge_slave_0 entered promiscuous mode [ 30.206629][ T754] ext4 filesystem being mounted at /8/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 30.213050][ T736] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.224027][ T736] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.226833][ T679] loop0: p72 size 853248 extends beyond EOD, [ 30.233164][ T736] device bridge_slave_1 entered promiscuous mode [ 30.236828][ T679] truncated [ 30.239531][ T28] audit: type=1400 audit(1792423063.058:315): avc: denied { link } for pid=749 comm="syz.3.153" name="#7" dev="tmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 30.270196][ T754] EXT4-fs error (device loop1): ext4_map_blocks:747: inode #15: block 3: comm syz.1.154: lblock 3 mapped to illegal pblock 3 (length 3) [ 30.270612][ T28] audit: type=1400 audit(1792423063.058:316): avc: denied { rename } for pid=749 comm="syz.3.153" name="#8" dev="tmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 30.284550][ T679] loop0: p73 size 853248 extends beyond EOD, [ 30.306330][ T28] audit: type=1400 audit(1792423063.068:317): avc: denied { bind } for pid=755 comm="syz.3.155" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 30.306356][ T28] audit: type=1400 audit(1792423063.068:318): avc: denied { listen } for pid=755 comm="syz.3.155" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 30.306372][ T28] audit: type=1400 audit(1792423063.068:319): avc: denied { read } for pid=755 comm="syz.3.155" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 30.372784][ T679] truncated [ 30.388954][ T679] loop0: p74 size 853248 extends beyond EOD, truncated [ 30.396402][ T679] loop0: p75 size 853248 extends beyond EOD, truncated [ 30.398540][ T754] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 30.414232][ T679] loop0: p76 size 853248 extends beyond EOD, truncated [ 30.427744][ T679] loop0: p77 size 853248 extends beyond EOD, truncated [ 30.435629][ T754] EXT4-fs (loop1): This should not happen!! Data will be lost [ 30.435629][ T754] [ 30.442728][ T679] loop0: p78 size 853248 extends beyond EOD, truncated [ 30.452481][ T762] F2FS-fs (loop2): Wrong segment_count / block_count (64 > 16384) [ 30.458739][ T765] EXT4-fs error (device loop1): ext4_map_blocks:637: inode #15: block 3: comm syz.1.154: lblock 3 mapped to illegal pblock 3 (length 1) [ 30.474227][ T762] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 30.487319][ T679] loop0: p79 size 853248 extends beyond EOD, truncated [ 30.496881][ T679] loop0: p80 size 853248 extends beyond EOD, truncated [ 30.507314][ T385] EXT4-fs error (device loop1): ext4_map_blocks:747: inode #15: block 8: comm kworker/u4:5: lblock 8 mapped to illegal pblock 8 (length 8) [ 30.519085][ T679] loop0: p81 size 853248 extends beyond EOD, truncated [ 30.522149][ T385] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 30.539141][ T736] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.547768][ T736] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.555076][ T736] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.562126][ T736] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.567342][ T385] EXT4-fs (loop1): This should not happen!! Data will be lost [ 30.567342][ T385] [ 30.570236][ T679] loop0: p82 size 853248 extends beyond EOD, truncated [ 30.581005][ T762] F2FS-fs (loop2): Found nat_bits in checkpoint [ 30.587634][ T679] loop0: p83 size 853248 extends beyond EOD, truncated [ 30.600945][ T679] loop0: p84 size 853248 extends beyond EOD, truncated [ 30.608242][ T679] loop0: p85 size 853248 extends beyond EOD, truncated [ 30.611892][ T609] EXT4-fs (loop1): unmounting filesystem. [ 30.616406][ T679] loop0: p86 size 853248 extends beyond EOD, truncated [ 30.631525][ T679] loop0: p87 size 853248 extends beyond EOD, truncated [ 30.650691][ T773] erofs: (device loop1): mounted with root inode @ nid 36. [ 30.652098][ T679] loop0: p88 size 853248 extends beyond EOD, truncated [ 30.676106][ T568] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.692269][ T568] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.695373][ T679] loop0: p89 size 853248 extends beyond EOD, [ 30.700144][ T762] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 30.700277][ T679] truncated [ 30.706216][ T762] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 30.724928][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 30.725516][ T679] loop0: p90 size 853248 extends beyond EOD, truncated [ 30.738952][ T568] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.739942][ T679] loop0: p91 size 853248 extends beyond EOD, truncated [ 30.754942][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.763836][ T679] loop0: p92 size 853248 extends beyond EOD, truncated [ 30.770322][ T380] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.772631][ T679] loop0: p93 size 853248 extends beyond EOD, truncated [ 30.777737][ T380] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.785234][ T679] loop0: p94 size 853248 extends beyond EOD, truncated [ 30.799625][ T679] loop0: p95 size 853248 extends beyond EOD, truncated [ 30.809112][ T679] loop0: p96 size 853248 extends beyond EOD, truncated [ 30.819343][ T679] loop0: p97 size 853248 extends beyond EOD, truncated [ 30.826525][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.827287][ T679] loop0: p98 size 853248 extends beyond EOD, [ 30.835728][ T380] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.846948][ T679] truncated [ 30.848850][ T380] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.861750][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.870364][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.873710][ T679] loop0: p99 size 853248 extends beyond EOD, truncated [ 30.878643][ T291] bio_check_eod: 4062 callbacks suppressed [ 30.878654][ T291] syz-executor: attempt to access beyond end of device [ 30.878654][ T291] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 30.885801][ T679] loop0: p100 size 853248 extends beyond EOD, truncated [ 30.918421][ T679] loop0: p101 size 853248 extends beyond EOD, truncated [ 30.927526][ T679] loop0: p102 size 853248 extends beyond EOD, truncated [ 30.938690][ T779] Zero length message leads to an empty skb [ 30.946117][ T679] loop0: p103 size 853248 extends beyond EOD, truncated [ 30.958264][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.969224][ T679] loop0: p104 size 853248 extends beyond EOD, truncated [ 30.979435][ T736] device veth0_vlan entered promiscuous mode [ 30.992931][ T679] loop0: p105 size 853248 extends beyond EOD, truncated [ 31.000134][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 31.016319][ T736] device veth1_macvtap entered promiscuous mode [ 31.023211][ T679] loop0: p106 size 853248 extends beyond EOD, truncated [ 31.032999][ T567] device bridge_slave_1 left promiscuous mode [ 31.039689][ T567] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.057096][ T679] loop0: p107 size 853248 extends beyond EOD, truncated [ 31.064655][ T567] device bridge_slave_0 left promiscuous mode [ 31.070942][ T567] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.077935][ T679] loop0: p108 size 853248 extends beyond EOD, truncated [ 31.085691][ T679] loop0: p109 size 853248 extends beyond EOD, truncated [ 31.092831][ T567] device veth1_macvtap left promiscuous mode [ 31.093393][ T679] loop0: p110 size 853248 extends beyond EOD, truncated [ 31.099210][ T567] device veth0_vlan left promiscuous mode [ 31.106279][ T679] loop0: p111 size 853248 extends beyond EOD, truncated [ 31.118909][ T679] loop0: p112 size 853248 extends beyond EOD, truncated [ 31.126260][ T679] loop0: p113 size 853248 extends beyond EOD, truncated [ 31.136399][ T679] loop0: p114 size 853248 extends beyond EOD, truncated [ 31.143761][ T679] loop0: p115 size 853248 extends beyond EOD, truncated [ 31.151297][ T679] loop0: p116 size 853248 extends beyond EOD, truncated [ 31.159791][ T679] loop0: p117 size 853248 extends beyond EOD, truncated [ 31.179000][ T679] loop0: p118 size 853248 extends beyond EOD, truncated [ 31.190977][ T679] loop0: p119 size 853248 extends beyond EOD, truncated [ 31.198849][ T679] loop0: p120 size 853248 extends beyond EOD, truncated [ 31.230968][ T679] loop0: p121 size 853248 extends beyond EOD, truncated [ 31.242300][ T679] loop0: p122 size 853248 extends beyond EOD, truncated [ 31.250420][ T679] loop0: p123 size 853248 extends beyond EOD, truncated [ 31.257926][ T679] loop0: p124 size 853248 extends beyond EOD, truncated [ 31.265998][ T679] loop0: p125 size 853248 extends beyond EOD, truncated [ 31.273345][ T679] loop0: p126 size 853248 extends beyond EOD, truncated [ 31.281746][ T679] loop0: p127 size 853248 extends beyond EOD, truncated [ 31.289168][ T679] loop0: p128 size 853248 extends beyond EOD, truncated [ 31.296565][ T679] loop0: p129 size 853248 extends beyond EOD, truncated [ 31.304051][ T679] loop0: p130 size 853248 extends beyond EOD, truncated [ 31.311475][ T679] loop0: p131 size 853248 extends beyond EOD, truncated [ 31.311500][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 31.319341][ T679] loop0: p132 size 853248 extends beyond EOD, truncated [ 31.326802][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 31.334051][ T679] loop0: p133 size 853248 extends beyond EOD, truncated [ 31.341078][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 31.348347][ T679] loop0: p134 size 853248 extends beyond EOD, truncated [ 31.372394][ T679] loop0: p135 size 853248 extends beyond EOD, truncated [ 31.380356][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.380585][ T679] loop0: p136 size 853248 extends beyond EOD, truncated [ 31.388867][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.396067][ T679] loop0: p137 size 853248 extends beyond EOD, truncated [ 31.404694][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.411862][ T679] loop0: p138 size 853248 extends beyond EOD, truncated [ 31.426280][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.426681][ T679] loop0: p139 size 853248 extends beyond EOD, truncated [ 31.442722][ T679] loop0: p140 size 853248 extends beyond EOD, truncated [ 31.451686][ T679] loop0: p141 size 853248 extends beyond EOD, truncated [ 31.460279][ T679] loop0: p142 size 853248 extends beyond EOD, truncated [ 31.474520][ T679] loop0: p143 size 853248 extends beyond EOD, truncated [ 31.485260][ T679] loop0: p144 size 853248 extends beyond EOD, truncated [ 31.495215][ T808] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 31.504258][ T679] loop0: p145 size 853248 extends beyond EOD, truncated [ 31.511398][ T808] ext4 filesystem being mounted at /41/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.522325][ T679] loop0: p146 size 853248 extends beyond EOD, truncated [ 31.528627][ T39] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 31.543504][ T679] loop0: p147 size 853248 extends beyond EOD, truncated [ 31.552338][ T808] EXT4-fs error (device loop3): ext4_map_blocks:747: inode #15: comm syz.3.172: lblock 0 mapped to illegal pblock 0 (length 1) [ 31.567487][ T28] audit: type=1400 audit(1792423064.498:320): avc: denied { create } for pid=815 comm="syz.2.174" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 31.599863][ T679] loop0: p148 size 853248 extends beyond EOD, truncated [ 31.607163][ T812] F2FS-fs (loop5): Invalid log blocks per segment (4278190089) [ 31.611532][ T679] loop0: p149 size 853248 extends beyond EOD, truncated [ 31.622074][ T808] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 31.632082][ T812] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 31.634817][ T679] loop0: p150 size 853248 extends beyond EOD, [ 31.642552][ T808] EXT4-fs (loop3): This should not happen!! Data will be lost [ 31.642552][ T808] [ 31.643301][ T679] truncated [ 31.662264][ T679] loop0: p151 size 853248 extends beyond EOD, truncated [ 31.665732][ T289] EXT4-fs (loop3): unmounting filesystem. [ 31.669885][ T679] loop0: p152 size 853248 extends beyond EOD, truncated [ 31.676071][ T812] F2FS-fs (loop5): invalid crc value [ 31.682592][ T679] loop0: p153 size 853248 extends beyond EOD, truncated [ 31.695303][ T679] loop0: p154 size 853248 extends beyond EOD, truncated [ 31.713280][ T679] loop0: p155 size 853248 extends beyond EOD, truncated [ 31.728818][ T679] loop0: p156 size 853248 extends beyond EOD, truncated [ 31.729980][ T812] F2FS-fs (loop5): Found nat_bits in checkpoint [ 31.743276][ T679] loop0: p157 size 853248 extends beyond EOD, truncated [ 31.743991][ T39] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 31.761468][ T679] loop0: p158 size 853248 extends beyond EOD, truncated [ 31.764484][ T39] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 31.781568][ T679] loop0: p159 size 853248 extends beyond EOD, truncated [ 31.790279][ T39] usb 2-1: config 0 interface 0 has no altsetting 0 [ 31.797234][ T679] loop0: p160 size 853248 extends beyond EOD, truncated [ 31.807825][ T39] usb 2-1: New USB device found, idVendor=044f, idProduct=b65a, bcdDevice= 0.00 [ 31.814741][ T812] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 31.818172][ T39] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.824203][ T679] loop0: p161 size 853248 extends beyond EOD, truncated [ 31.839692][ T812] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 31.847069][ T39] usb 2-1: config 0 descriptor?? [ 31.847445][ T679] loop0: p162 size 853248 extends beyond EOD, truncated [ 31.852992][ T828] EXT4-fs (loop2): warning: mounting unchecked fs, running e2fsck is recommended [ 31.869966][ T679] loop0: p163 size 853248 extends beyond EOD, truncated [ 31.881537][ T828] EXT4-fs (loop2): Errors on filesystem, clearing orphan list. [ 31.890026][ T679] loop0: p164 size 853248 extends beyond EOD, truncated [ 31.897828][ T679] loop0: p165 size 853248 extends beyond EOD, truncated [ 31.899064][ T828] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 31.905625][ T679] loop0: p166 size 853248 extends beyond EOD, truncated [ 31.921330][ T679] loop0: p167 size 853248 extends beyond EOD, truncated [ 31.928878][ T736] syz-executor: attempt to access beyond end of device [ 31.928878][ T736] loop5: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 31.929168][ T679] loop0: p168 size 853248 extends beyond EOD, truncated [ 31.950888][ T679] loop0: p169 size 853248 extends beyond EOD, truncated [ 31.958311][ T679] loop0: p170 size 853248 extends beyond EOD, truncated [ 31.966544][ T679] loop0: p171 size 853248 extends beyond EOD, truncated [ 31.973998][ T679] loop0: p172 size 853248 extends beyond EOD, truncated [ 31.981454][ T679] loop0: p173 size 853248 extends beyond EOD, truncated [ 31.989432][ T679] loop0: p174 size 853248 extends beyond EOD, truncated [ 31.996842][ T679] loop0: p175 size 853248 extends beyond EOD, truncated [ 32.004435][ T679] loop0: p176 size 853248 extends beyond EOD, truncated [ 32.011861][ T679] loop0: p177 size 853248 extends beyond EOD, truncated [ 32.019803][ T679] loop0: p178 size 853248 extends beyond EOD, truncated [ 32.026819][ T28] audit: type=1400 audit(1792423064.948:321): avc: denied { write } for pid=827 comm="syz.2.178" name="bus" dev="loop2" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 32.050065][ T679] loop0: p179 size 853248 extends beyond EOD, truncated [ 32.057577][ T679] loop0: p180 size 853248 extends beyond EOD, truncated [ 32.070565][ T679] loop0: p181 size 853248 extends beyond EOD, truncated [ 32.079079][ T291] EXT4-fs (loop2): unmounting filesystem. [ 32.079328][ T679] loop0: p182 size 853248 extends beyond EOD, truncated [ 32.092597][ T679] loop0: p183 size 853248 extends beyond EOD, truncated [ 32.100184][ T679] loop0: p184 size 853248 extends beyond EOD, truncated [ 32.122235][ T679] loop0: p185 size 853248 extends beyond EOD, truncated [ 32.130169][ T679] loop0: p186 size 853248 extends beyond EOD, truncated [ 32.139569][ T679] loop0: p187 size 853248 extends beyond EOD, truncated [ 32.146963][ T679] loop0: p188 size 853248 extends beyond EOD, truncated [ 32.155251][ T679] loop0: p189 size 853248 extends beyond EOD, truncated [ 32.164587][ T679] loop0: p190 size 853248 extends beyond EOD, truncated [ 32.172167][ T679] loop0: p191 size 853248 extends beyond EOD, truncated [ 32.180115][ T679] loop0: p192 size 853248 extends beyond EOD, truncated [ 32.187435][ T679] loop0: p193 size 853248 extends beyond EOD, truncated [ 32.194808][ T679] loop0: p194 size 853248 extends beyond EOD, truncated [ 32.202878][ T679] loop0: p195 size 853248 extends beyond EOD, truncated [ 32.210508][ T679] loop0: p196 size 853248 extends beyond EOD, truncated [ 32.217812][ T679] loop0: p197 size 853248 extends beyond EOD, truncated [ 32.226167][ T679] loop0: p198 size 853248 extends beyond EOD, truncated [ 32.233870][ T679] loop0: p199 size 853248 extends beyond EOD, truncated [ 32.241930][ T679] loop0: p200 size 853248 extends beyond EOD, truncated [ 32.249594][ T679] loop0: p201 size 853248 extends beyond EOD, truncated [ 32.251075][ T846] device syzkaller1 entered promiscuous mode [ 32.257093][ T679] loop0: p202 size 853248 extends beyond EOD, truncated [ 32.273195][ T679] loop0: p203 size 853248 extends beyond EOD, truncated [ 32.280058][ T39] thrustmaster 0003:044F:B65A.0002: unbalanced collection at end of report description [ 32.286560][ T679] loop0: p204 size 853248 extends beyond EOD, truncated [ 32.293393][ T39] thrustmaster 0003:044F:B65A.0002: parse failed [ 32.297476][ T679] loop0: p205 size 853248 extends beyond EOD, truncated [ 32.304119][ T39] thrustmaster: probe of 0003:044F:B65A.0002 failed with error -22 [ 32.310680][ T679] loop0: p206 size 853248 extends beyond EOD, truncated [ 32.328095][ T679] loop0: p207 size 853248 extends beyond EOD, truncated [ 32.335617][ T679] loop0: p208 size 853248 extends beyond EOD, truncated [ 32.343186][ T679] loop0: p209 size 853248 extends beyond EOD, truncated [ 32.350677][ T679] loop0: p210 size 853248 extends beyond EOD, truncated [ 32.356473][ T852] FAULT_INJECTION: forcing a failure. [ 32.356473][ T852] name failslab, interval 1, probability 0, space 0, times 1 [ 32.358221][ T679] loop0: p211 size 853248 extends beyond EOD, truncated [ 32.373204][ T852] CPU: 0 PID: 852 Comm: syz.3.187 Not tainted syzkaller #0 [ 32.378030][ T679] loop0: p212 size 853248 extends beyond EOD, [ 32.384684][ T852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.384713][ T852] Call Trace: [ 32.384719][ T852] [ 32.384726][ T852] __dump_stack+0x21/0x24 [ 32.391308][ T679] truncated [ 32.400921][ T852] dump_stack_lvl+0x110/0x170 [ 32.400956][ T852] ? __cfi_dump_stack_lvl+0x8/0x8 [ 32.400981][ T852] dump_stack+0x15/0x24 [ 32.401005][ T852] should_fail_ex+0x3bf/0x510 [ 32.401023][ T852] __should_failslab+0xac/0xf0 [ 32.405071][ T679] loop0: p213 size 853248 extends beyond EOD, [ 32.407219][ T852] should_failslab+0x9/0x20 [ 32.407242][ T852] __kmem_cache_alloc_node+0x3d/0x2d0 [ 32.411758][ T679] truncated [ 32.414629][ T852] ? selinux_bpf_map_alloc+0x51/0x140 [ 32.420610][ T679] loop0: p214 size 853248 extends beyond EOD, [ 32.424303][ T852] ? selinux_bpf_map_alloc+0x51/0x140 [ 32.428486][ T679] truncated [ 32.433110][ T852] kmalloc_trace+0x29/0xb0 [ 32.433128][ T852] selinux_bpf_map_alloc+0x51/0x140 [ 32.433150][ T852] security_bpf_map_alloc+0x73/0xa0 [ 32.433166][ T852] map_create+0x888/0xcf0 [ 32.433181][ T852] __sys_bpf+0x34e/0x850 [ 32.433196][ T852] ? bpf_link_show_fdinfo+0x330/0x330 [ 32.433215][ T852] ? fpregs_restore_userregs+0x128/0x260 [ 32.433233][ T852] __x64_sys_bpf+0x7c/0x90 [ 32.438917][ T679] loop0: p215 size 853248 extends beyond EOD, [ 32.444108][ T852] x64_sys_call+0x488/0x9a0 [ 32.448672][ T679] truncated [ 32.453952][ T852] do_syscall_64+0x4c/0xa0 [ 32.453972][ T852] ? clear_bhb_loop+0x30/0x80 [ 32.457519][ T679] loop0: p216 size 853248 extends beyond EOD, [ 32.462404][ T852] ? clear_bhb_loop+0x30/0x80 [ 32.462427][ T852] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.462445][ T852] RIP: 0033:0x7f393619e559 [ 32.469007][ T679] truncated [ 32.473917][ T852] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.473934][ T852] RSP: 002b:00007f3936fd4028 EFLAGS: 00000246 [ 32.477471][ T679] loop0: p217 size 853248 extends beyond EOD, [ 32.481411][ T852] ORIG_RAX: 0000000000000141 [ 32.481420][ T852] RAX: ffffffffffffffda RBX: 00007f3936425fa0 RCX: 00007f393619e559 [ 32.481431][ T852] RDX: 0000000000000050 RSI: 0000200000001080 RDI: 0100000000000000 [ 32.481442][ T852] RBP: 00007f3936235ad8 R08: 0000000000000000 R09: 0000000000000000 [ 32.481453][ T852] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 32.481463][ T852] R13: 00007f3936426038 R14: 00007f3936425fa0 R15: 00007ffce1ba8f98 [ 32.481477][ T852] [ 32.574490][ T19] usb 2-1: USB disconnect, device number 2 [ 32.583682][ T679] truncated [ 32.652249][ T679] loop0: p218 size 853248 extends beyond EOD, truncated [ 32.660502][ T679] loop0: p219 size 853248 extends beyond EOD, truncated [ 32.667900][ T679] loop0: p220 size 853248 extends beyond EOD, truncated [ 32.675416][ T679] loop0: p221 size 853248 extends beyond EOD, truncated [ 32.683026][ T679] loop0: p222 size 853248 extends beyond EOD, truncated [ 32.690486][ T679] loop0: p223 size 853248 extends beyond EOD, truncated [ 32.697940][ T679] loop0: p224 size 853248 extends beyond EOD, truncated [ 32.705364][ T679] loop0: p225 size 853248 extends beyond EOD, truncated [ 32.713107][ T679] loop0: p226 size 853248 extends beyond EOD, truncated [ 32.720964][ T679] loop0: p227 size 853248 extends beyond EOD, truncated [ 32.728396][ T679] loop0: p228 size 853248 extends beyond EOD, truncated [ 32.736075][ T679] loop0: p229 size 853248 extends beyond EOD, truncated [ 32.743906][ T679] loop0: p230 size 853248 extends beyond EOD, truncated [ 32.752186][ T679] loop0: p231 size 853248 extends beyond EOD, truncated [ 32.759881][ T679] loop0: p232 size 853248 extends beyond EOD, truncated [ 32.767411][ T679] loop0: p233 size 853248 extends beyond EOD, truncated [ 32.771158][ T859] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 32.775186][ T679] loop0: p234 size 853248 extends beyond EOD, truncated [ 32.790477][ T679] loop0: p235 size 853248 extends beyond EOD, truncated [ 32.797961][ T679] loop0: p236 size 853248 extends beyond EOD, truncated [ 32.810401][ T679] loop0: p237 size 853248 extends beyond EOD, truncated [ 32.818263][ T679] loop0: p238 size 853248 extends beyond EOD, truncated [ 32.818925][ T289] EXT4-fs (loop3): unmounting filesystem. [ 32.826025][ T679] loop0: p239 size 853248 extends beyond EOD, truncated [ 32.838923][ T679] loop0: p240 size 853248 extends beyond EOD, truncated [ 32.846904][ T679] loop0: p241 size 853248 extends beyond EOD, truncated [ 32.854600][ T679] loop0: p242 size 853248 extends beyond EOD, truncated [ 32.855001][ T863] af_packet: packet size is too long (65369 > 2016) [ 32.862228][ T679] loop0: p243 size 853248 extends beyond EOD, truncated [ 32.876099][ T679] loop0: p244 size 853248 extends beyond EOD, truncated [ 32.884247][ T679] loop0: p245 size 853248 extends beyond EOD, truncated [ 32.891671][ T679] loop0: p246 size 853248 extends beyond EOD, truncated [ 32.899148][ T679] loop0: p247 size 853248 extends beyond EOD, truncated [ 32.906480][ T679] loop0: p248 size 853248 extends beyond EOD, truncated [ 32.913993][ T679] loop0: p249 size 853248 extends beyond EOD, truncated [ 32.921719][ T679] loop0: p250 size 853248 extends beyond EOD, truncated [ 32.929292][ T679] loop0: p251 size 853248 extends beyond EOD, truncated [ 32.936607][ T679] loop0: p252 size 853248 extends beyond EOD, truncated [ 32.944421][ T679] loop0: p253 size 853248 extends beyond EOD, truncated [ 32.952002][ T679] loop0: p254 size 853248 extends beyond EOD, truncated [ 32.955491][ T868] binder: 867:868 ioctl c0306201 200000000140 returned -14 [ 32.959848][ T679] loop0: p255 size 853248 extends beyond EOD, truncated [ 32.971282][ T868] binder: 867:868 ioctl c0306201 200000000240 returned -14 [ 33.057802][ T103] loop0: p1 < p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 p18 p19 p20 p21 p22 p23 p24 p25 p26 p27 p28 p29 p30 p31 p32 p33 p34 p35 p36 p37 p38 p39 p40 p41 p42 p43 p44 p45 p46 p47 p48 p49 p50 p51 p52 p53 p54 p55 p56 p57 p58 p59 p60 p61 p62 p63 p64 p65 p66 p67 p68 p69 p70 p71 p72 p73 p74 p75 p76 p77 p78 p79 p80 p81 p82 p83 p84 p85 p86 p87 p88 p89 p90 p91 p92 p93 p94 p95 p96 p97 p98 p99 p100 p101 p102 p103 p104 p105 p106 p107 p108 p109 p110 p111 p112 p113 p114 p115 p116 p117 p118 p119 p120 p121 p122 p123 p124 p125 p126 p127 p128 p129 p130 p131 p132 p133 p134 p135 p136 p137 p138 p139 p140 p141 p142 p143 p144 p145 p146 p147 p148 p149 p150 p151 p152 p153 p154 p155 p156 p157 p158 p159 p160 p161 p162 p163 p164 p165 p166 p167 p168 p169 p170 p171 p172 p173 p174 p175 p176 p177 p178 p179 p180 p181 p182 p183 p184 p185 p186 p187 p188 p189 p190 p191 p192 p193 p194 p195 p196 p197 p198 p199 p200 p201 p202 p203 p204 p205 p206 p207 p208 p209 p210 p211 p212 p213 p214 p215 p216 [ 33.058196][ T103] loop0: p2 size 853248 extends beyond EOD, truncated [ 33.165191][ T103] loop0: p5 size 853248 extends beyond EOD, truncated [ 33.172560][ T103] loop0: p6 size 853248 extends beyond EOD, truncated [ 33.179745][ T103] loop0: p7 size 853248 extends beyond EOD, truncated [ 33.186991][ T103] loop0: p8 size 853248 extends beyond EOD, truncated [ 33.194359][ T103] loop0: p9 size 853248 extends beyond EOD, truncated [ 33.201672][ T103] loop0: p10 size 853248 extends beyond EOD, truncated [ 33.209481][ T103] loop0: p11 size 853248 extends beyond EOD, truncated [ 33.220908][ T103] loop0: p12 size 853248 extends beyond EOD, truncated [ 33.229982][ T103] loop0: p13 size 853248 extends beyond EOD, truncated [ 33.239937][ T103] loop0: p14 size 853248 extends beyond EOD, truncated [ 33.252542][ T103] loop0: p15 size 853248 extends beyond EOD, truncated [ 33.259496][ T39] usb 3-1: new low-speed USB device number 2 using dummy_hcd [ 33.269511][ T103] loop0: p16 size 853248 extends beyond EOD, truncated [ 33.269992][ T874] set_capacity_and_notify: 6 callbacks suppressed [ 33.270003][ T874] loop5: detected capacity change from 0 to 40427 [ 33.278285][ T881] loop1: detected capacity change from 0 to 1024 [ 33.284108][ T874] F2FS-fs (loop5): invalid crc value [ 33.289995][ T103] loop0: p17 size 853248 extends beyond EOD, [ 33.296797][ T881] EXT4-fs: Ignoring removed nobh option [ 33.301081][ T103] truncated [ 33.308144][ T874] F2FS-fs (loop5): Found nat_bits in checkpoint [ 33.313153][ T103] loop0: p18 size 853248 extends beyond EOD, [ 33.316145][ T881] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 33.322034][ T103] truncated [ 33.322438][ T103] loop0: p19 size 853248 extends beyond EOD, truncated [ 33.350011][ T103] loop0: p20 size 853248 extends beyond EOD, truncated [ 33.355694][ T874] F2FS-fs (loop5): Start checkpoint disabled! [ 33.357270][ T103] loop0: p21 size 853248 extends beyond EOD, truncated [ 33.364199][ T874] F2FS-fs (loop5): f2fs_disable_checkpoint() finish, err:0 [ 33.370414][ T103] loop0: p22 size 853248 extends beyond EOD, truncated [ 33.378422][ T881] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 33.384535][ T103] loop0: p23 size 853248 extends beyond EOD, truncated [ 33.399959][ T874] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e6 [ 33.400356][ T103] loop0: p24 size 853248 extends beyond EOD, truncated [ 33.427823][ T103] loop0: p25 size 853248 extends beyond EOD, truncated [ 33.435245][ T103] loop0: p26 size 853248 extends beyond EOD, truncated [ 33.437497][ T874] syz.5.196: attempt to access beyond end of device [ 33.437497][ T874] loop5: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 33.442598][ T103] loop0: p27 size 853248 extends beyond EOD, truncated [ 33.464433][ T39] usb 3-1: config 1 interface 0 altsetting 15 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 33.464807][ T874] syz.5.196: attempt to access beyond end of device [ 33.464807][ T874] loop5: rw=2049, sector=77824, nr_sectors = 8 limit=40427 [ 33.475407][ T103] loop0: p28 size 853248 extends beyond EOD, truncated [ 33.475849][ T103] loop0: p29 size 853248 extends beyond EOD, [ 33.495975][ T39] usb 3-1: config 1 interface 0 has no altsetting 0 [ 33.508718][ T103] truncated [ 33.512512][ T103] loop0: p30 size 853248 extends beyond EOD, truncated [ 33.520213][ T103] loop0: p31 size 853248 extends beyond EOD, truncated [ 33.527206][ T567] kworker/u4:7: attempt to access beyond end of device [ 33.527206][ T567] loop5: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 33.527671][ T39] usb 3-1: string descriptor 0 read error: -22 [ 33.547541][ T103] loop0: p32 size 853248 extends beyond EOD, truncated [ 33.554847][ T103] loop0: p33 size 853248 extends beyond EOD, truncated [ 33.555106][ T609] EXT4-fs (loop1): unmounting filesystem. [ 33.561784][ T39] usb 3-1: New USB device found, idVendor=04b4, idProduct=ed81, bcdDevice= 0.40 [ 33.561807][ T39] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.562675][ T870] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 33.599832][ T103] loop0: p34 size 853248 extends beyond EOD, truncated [ 33.609529][ T103] loop0: p35 size 853248 extends beyond EOD, truncated [ 33.619030][ T103] loop0: p36 size 853248 extends beyond EOD, truncated [ 33.626382][ T103] loop0: p37 size 853248 extends beyond EOD, truncated [ 33.633779][ T103] loop0: p38 size 853248 extends beyond EOD, truncated [ 33.641448][ T103] loop0: p39 size 853248 extends beyond EOD, truncated [ 33.648930][ T103] loop0: p40 size 853248 extends beyond EOD, truncated [ 33.657705][ T103] loop0: p41 size 853248 extends beyond EOD, truncated [ 33.665054][ T103] loop0: p42 size 853248 extends beyond EOD, truncated [ 33.673275][ T103] loop0: p43 size 853248 extends beyond EOD, truncated [ 33.680667][ T103] loop0: p44 size 853248 extends beyond EOD, truncated [ 33.688011][ T103] loop0: p45 size 853248 extends beyond EOD, truncated [ 33.695639][ T103] loop0: p46 size 853248 extends beyond EOD, truncated [ 33.704545][ T103] loop0: p47 size 853248 extends beyond EOD, truncated [ 33.712527][ T103] loop0: p48 size 853248 extends beyond EOD, truncated [ 33.720086][ T103] loop0: p49 size 853248 extends beyond EOD, truncated [ 33.727441][ T103] loop0: p50 size 853248 extends beyond EOD, truncated [ 33.734943][ T103] loop0: p51 size 853248 extends beyond EOD, truncated [ 33.742338][ T103] loop0: p52 size 853248 extends beyond EOD, truncated [ 33.749992][ T103] loop0: p53 size 853248 extends beyond EOD, truncated [ 33.757383][ T103] loop0: p54 size 853248 extends beyond EOD, truncated [ 33.765055][ T103] loop0: p55 size 853248 extends beyond EOD, truncated [ 33.772564][ T103] loop0: p56 size 853248 extends beyond EOD, truncated [ 33.780055][ T103] loop0: p57 size 853248 extends beyond EOD, truncated [ 33.787397][ T103] loop0: p58 size 853248 extends beyond EOD, truncated [ 33.810142][ T103] loop0: p59 size 853248 extends beyond EOD, truncated [ 33.823925][ T103] loop0: p60 size 853248 extends beyond EOD, truncated [ 33.837869][ T895] FAULT_INJECTION: forcing a failure. [ 33.837869][ T895] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 33.842992][ T103] loop0: p61 size 853248 extends beyond EOD, truncated [ 33.860706][ T103] loop0: p62 size 853248 extends beyond EOD, truncated [ 33.867962][ T895] CPU: 0 PID: 895 Comm: syz.5.203 Not tainted syzkaller #0 [ 33.868766][ T103] loop0: p63 size 853248 extends beyond EOD, [ 33.875170][ T895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.875190][ T895] Call Trace: [ 33.875196][ T895] [ 33.881345][ T103] truncated [ 33.891278][ T895] __dump_stack+0x21/0x24 [ 33.891314][ T895] dump_stack_lvl+0x110/0x170 [ 33.895489][ T103] loop0: p64 size 853248 extends beyond EOD, [ 33.897498][ T895] ? __cfi_dump_stack_lvl+0x8/0x8 [ 33.900810][ T103] truncated [ 33.904909][ T895] ? exc_page_fault+0x5e/0xb0 [ 33.904938][ T895] dump_stack+0x15/0x24 [ 33.910406][ T103] loop0: p65 size 853248 extends beyond EOD, [ 33.915641][ T895] should_fail_ex+0x3bf/0x510 [ 33.923541][ T103] truncated [ 33.923747][ T895] should_fail+0xb/0x10 [ 33.929026][ T103] loop0: p66 size 853248 extends beyond EOD, [ 33.932534][ T895] should_fail_usercopy+0x1a/0x20 [ 33.938693][ T103] truncated [ 33.943236][ T895] strncpy_from_user+0x24/0x2c0 [ 33.946795][ T103] loop0: p67 size 853248 extends beyond EOD, [ 33.950468][ T895] ? bpf_xdp_frags_increase_tail+0x1e2/0x360 [ 33.950489][ T895] strncpy_from_user_nofault+0x73/0x150 [ 33.950509][ T895] bpf_probe_read_user_str+0x2a/0x70 [ 33.956785][ T103] truncated [ 33.961547][ T895] ? 0xffffffffa0000958 [ 33.961563][ T895] bpf_prog_06f22831d6c68d16+0x3d/0x3f [ 33.965653][ T103] loop0: p68 size 853248 extends beyond EOD, [ 33.969488][ T895] bpf_dispatcher_xdp_func+0x25/0x30 [ 33.969516][ T895] bpf_test_run+0x415/0x940 [ 33.969539][ T895] ? dst_hold+0xc0/0xc0 [ 33.969559][ T895] bpf_prog_test_run_xdp+0x72c/0xf80 [ 33.969579][ T895] ? __cfi_bpf_prog_test_run_xdp+0x10/0x10 [ 33.969599][ T895] ? __kasan_check_write+0x14/0x20 [ 33.969618][ T895] ? __cfi_bpf_prog_test_run_xdp+0x10/0x10 [ 33.982543][ T103] truncated [ 33.987158][ T895] bpf_prog_test_run+0x3b4/0x5c0 [ 33.987192][ T895] ? bpf_prog_query+0x270/0x270 [ 33.993531][ T103] loop0: p69 size 853248 extends beyond EOD, [ 33.995551][ T895] ? selinux_bpf+0xce/0xf0 [ 34.000031][ T103] truncated [ 34.005223][ T895] ? security_bpf+0x93/0xb0 [ 34.005257][ T895] __sys_bpf+0x5ee/0x850 [ 34.012163][ T103] loop0: p70 size 853248 extends beyond EOD, [ 34.016577][ T895] ? bpf_link_show_fdinfo+0x330/0x330 [ 34.025805][ T103] truncated [ 34.030466][ T895] ? fpregs_restore_userregs+0x128/0x260 [ 34.030496][ T895] __x64_sys_bpf+0x7c/0x90 [ 34.037009][ T103] loop0: p71 size 853248 extends beyond EOD, [ 34.041372][ T895] x64_sys_call+0x488/0x9a0 [ 34.041398][ T895] do_syscall_64+0x4c/0xa0 [ 34.047441][ T103] truncated [ 34.050272][ T895] ? clear_bhb_loop+0x30/0x80 [ 34.050296][ T895] ? clear_bhb_loop+0x30/0x80 [ 34.055858][ T103] loop0: p72 size 853248 extends beyond EOD, [ 34.060035][ T895] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.060060][ T895] RIP: 0033:0x7f1af3b9e559 [ 34.060076][ T895] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.066443][ T103] truncated [ 34.070516][ T895] RSP: 002b:00007f1af25f7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 34.070534][ T895] RAX: ffffffffffffffda RBX: 00007f1af3e25fa0 RCX: 00007f1af3b9e559 [ 34.070547][ T895] RDX: 0000000000000050 RSI: 0000200000000900 RDI: 000000000000000a [ 34.070558][ T895] RBP: 00007f1af3c35ad8 R08: 0000000000000000 R09: 0000000000000000 [ 34.070569][ T895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 34.070580][ T895] R13: 00007f1af3e26038 R14: 00007f1af3e25fa0 R15: 00007fff56fbb918 [ 34.070595][ T895] [ 34.077531][ T899] loop3: detected capacity change from 0 to 1024 [ 34.079402][ T103] loop0: p73 size 853248 extends beyond EOD, [ 34.120998][ T893] loop1: detected capacity change from 0 to 40427 [ 34.123131][ T103] truncated [ 34.125920][ T893] F2FS-fs (loop1): Invalid SB checksum offset: 0 [ 34.131112][ T103] loop0: p74 size 853248 extends beyond EOD, [ 34.134697][ T893] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 34.141114][ T103] truncated [ 34.147236][ T893] F2FS-fs (loop1): invalid crc value [ 34.151828][ T103] loop0: p75 size 853248 extends beyond EOD, [ 34.183603][ T893] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 34.190691][ T103] truncated [ 34.217076][ T893] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 34.223191][ T103] loop0: p76 size 853248 extends beyond EOD, [ 34.225730][ T893] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 34.239730][ T39] cypress 0003:04B4:ED81.0003: unknown main item tag 0x5 [ 34.266871][ T103] truncated [ 34.290099][ T39] cypress 0003:04B4:ED81.0003: unknown main item tag 0x0 [ 34.296138][ T103] loop0: p77 size 853248 extends beyond EOD, [ 34.298153][ T899] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 34.304487][ T103] truncated [ 34.310432][ T39] cypress 0003:04B4:ED81.0003: unknown main item tag 0x1 [ 34.319427][ T103] loop0: p78 size 853248 extends beyond EOD, [ 34.325237][ T906] syz.1.202: attempt to access beyond end of device [ 34.325237][ T906] loop1: rw=524288, sector=45064, nr_sectors = 8 limit=40427 [ 34.328041][ T103] truncated [ 34.346425][ T39] cypress 0003:04B4:ED81.0003: unknown global tag 0xc [ 34.350645][ T103] loop0: p79 size 853248 extends beyond EOD, [ 34.353097][ T567] kworker/u4:7: attempt to access beyond end of device [ 34.353097][ T567] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 34.360268][ T103] truncated [ 34.368404][ T906] syz.1.202: attempt to access beyond end of device [ 34.368404][ T906] loop1: rw=0, sector=45064, nr_sectors = 8 limit=40427 [ 34.380402][ T103] loop0: p80 size 853248 extends beyond EOD, [ 34.383255][ T39] cypress 0003:04B4:ED81.0003: item 0 0 1 12 parsing failed [ 34.389930][ T103] truncated [ 34.390313][ T103] loop0: p81 size 853248 extends beyond EOD, [ 34.397494][ T39] cypress 0003:04B4:ED81.0003: parse failed [ 34.428472][ T103] truncated [ 34.432550][ T39] cypress: probe of 0003:04B4:ED81.0003 failed with error -22 [ 34.440567][ T103] loop0: p82 size 853248 extends beyond EOD, [ 34.445989][ T39] usb 3-1: USB disconnect, device number 2 [ 34.449018][ T103] truncated [ 34.449445][ T103] loop0: p83 size 853248 extends beyond EOD, [ 34.455079][ T893] VFS:Filesystem freeze failed [ 34.458200][ T103] truncated [ 34.494999][ T103] loop0: p84 size 853248 extends beyond EOD, truncated [ 34.502473][ T103] loop0: p85 size 853248 extends beyond EOD, truncated [ 34.509929][ T103] loop0: p86 size 853248 extends beyond EOD, truncated [ 34.517209][ T103] loop0: p87 size 853248 extends beyond EOD, truncated [ 34.531086][ T289] EXT4-fs (loop3): unmounting filesystem. [ 34.538137][ T103] loop0: p88 size 853248 extends beyond EOD, truncated [ 34.559765][ T103] loop0: p89 size 853248 extends beyond EOD, truncated [ 34.567147][ T103] loop0: p90 size 853248 extends beyond EOD, truncated [ 34.574996][ T103] loop0: p91 size 853248 extends beyond EOD, truncated [ 34.582462][ T103] loop0: p92 size 853248 extends beyond EOD, truncated [ 34.589791][ T103] loop0: p93 size 853248 extends beyond EOD, truncated [ 34.596964][ T103] loop0: p94 size 853248 extends beyond EOD, truncated [ 34.604320][ T103] loop0: p95 size 853248 extends beyond EOD, truncated [ 34.611562][ T103] loop0: p96 size 853248 extends beyond EOD, truncated [ 34.618888][ T103] loop0: p97 size 853248 extends beyond EOD, truncated [ 34.626074][ T103] loop0: p98 size 853248 extends beyond EOD, truncated [ 34.633397][ T103] loop0: p99 size 853248 extends beyond EOD, truncated [ 34.640621][ T103] loop0: p100 size 853248 extends beyond EOD, truncated [ 34.647897][ T103] loop0: p101 size 853248 extends beyond EOD, truncated [ 34.655276][ T103] loop0: p102 size 853248 extends beyond EOD, truncated [ 34.662690][ T103] loop0: p103 size 853248 extends beyond EOD, truncated [ 34.670007][ T103] loop0: p104 size 853248 extends beyond EOD, truncated [ 34.677270][ T103] loop0: p105 size 853248 extends beyond EOD, truncated [ 34.684700][ T103] loop0: p106 size 853248 extends beyond EOD, truncated [ 34.692224][ T103] loop0: p107 size 853248 extends beyond EOD, truncated [ 34.699591][ T103] loop0: p108 size 853248 extends beyond EOD, truncated [ 34.706833][ T103] loop0: p109 size 853248 extends beyond EOD, truncated [ 34.714191][ T103] loop0: p110 size 853248 extends beyond EOD, truncated [ 34.721569][ T103] loop0: p111 size 853248 extends beyond EOD, truncated [ 34.728926][ T103] loop0: p112 size 853248 extends beyond EOD, truncated [ 34.736765][ T103] loop0: p113 size 853248 extends beyond EOD, truncated [ 34.755363][ T103] loop0: p114 size 853248 extends beyond EOD, truncated [ 34.770546][ T103] loop0: p115 size 853248 extends beyond EOD, truncated [ 34.783172][ T103] loop0: p116 size 853248 extends beyond EOD, truncated [ 34.790712][ T914] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 34.790861][ T103] loop0: p117 size 853248 extends beyond EOD, truncated [ 34.806860][ T103] loop0: p118 size 853248 extends beyond EOD, truncated [ 34.820647][ T103] loop0: p119 size 853248 extends beyond EOD, truncated [ 34.828291][ T103] loop0: p120 size 853248 extends beyond EOD, truncated [ 34.838979][ T103] loop0: p121 size 853248 extends beyond EOD, truncated [ 34.848166][ T103] loop0: p122 size 853248 extends beyond EOD, truncated [ 34.855809][ T103] loop0: p123 size 853248 extends beyond EOD, truncated [ 34.868109][ T103] loop0: p124 size 853248 extends beyond EOD, truncated [ 34.875658][ T103] loop0: p125 size 853248 extends beyond EOD, truncated [ 34.883171][ T103] loop0: p126 size 853248 extends beyond EOD, truncated [ 34.890625][ T103] loop0: p127 size 853248 extends beyond EOD, truncated [ 34.898106][ T103] loop0: p128 size 853248 extends beyond EOD, truncated [ 34.905883][ T103] loop0: p129 size 853248 extends beyond EOD, truncated [ 34.914029][ T912] loop3: detected capacity change from 0 to 40427 [ 34.914558][ T103] loop0: p130 size 853248 extends beyond EOD, truncated [ 34.928067][ T103] loop0: p131 size 853248 extends beyond EOD, truncated [ 34.928665][ T912] F2FS-fs (loop3): Invalid Fs Meta Ino: node(0) meta(2) root(0) [ 34.935477][ T103] loop0: p132 size 853248 extends beyond EOD, truncated [ 34.949709][ T912] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 34.958349][ T103] loop0: p133 size 853248 extends beyond EOD, truncated [ 34.965735][ T912] F2FS-fs (loop3): invalid crc value [ 34.971687][ T103] loop0: p134 size 853248 extends beyond EOD, truncated [ 34.978766][ T28] kauditd_printk_skb: 19 callbacks suppressed [ 34.978778][ T28] audit: type=1400 audit(1792423067.898:341): avc: denied { bind } for pid=926 comm="syz.1.215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 35.004939][ T103] loop0: p135 size 853248 extends beyond EOD, truncated [ 35.012336][ T103] loop0: p136 size 853248 extends beyond EOD, truncated [ 35.019558][ T28] audit: type=1400 audit(1792423067.898:342): avc: denied { name_bind } for pid=926 comm="syz.1.215" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 35.040647][ T103] loop0: p137 size 853248 extends beyond EOD, truncated [ 35.048692][ T912] F2FS-fs (loop3): Found nat_bits in checkpoint [ 35.065408][ T103] loop0: p138 size 853248 extends beyond EOD, truncated [ 35.078698][ T103] loop0: p139 size 853248 extends beyond EOD, truncated [ 35.085242][ T28] audit: type=1400 audit(1792423067.898:343): avc: denied { node_bind } for pid=926 comm="syz.1.215" saddr=::ffff:0.0.0.0 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 35.094871][ T103] loop0: p140 size 853248 extends beyond EOD, truncated [ 35.118820][ T103] loop0: p141 size 853248 extends beyond EOD, truncated [ 35.122978][ T28] audit: type=1400 audit(1792423067.898:344): avc: denied { read } for pid=926 comm="syz.1.215" path="socket:[19003]" dev="sockfs" ino=19003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 35.126791][ T103] loop0: p142 size 853248 extends beyond EOD, truncated [ 35.156760][ T103] loop0: p143 size 853248 extends beyond EOD, truncated [ 35.165522][ T912] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 35.172669][ T912] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 35.180889][ T103] loop0: p144 size 853248 extends beyond EOD, truncated [ 35.188876][ T103] loop0: p145 size 853248 extends beyond EOD, truncated [ 35.196406][ T103] loop0: p146 size 853248 extends beyond EOD, truncated [ 35.202335][ T929] loop1: detected capacity change from 0 to 40427 [ 35.204064][ T103] loop0: p147 size 853248 extends beyond EOD, truncated [ 35.216943][ T929] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 35.217344][ T103] loop0: p148 size 853248 extends beyond EOD, truncated [ 35.229694][ T929] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 35.232559][ T103] loop0: p149 size 853248 extends beyond EOD, truncated [ 35.241305][ T912] syz.3.207: attempt to access beyond end of device [ 35.241305][ T912] loop3: rw=524288, sector=45064, nr_sectors = 8 limit=40427 [ 35.248101][ T929] F2FS-fs (loop1): invalid crc value [ 35.261446][ T912] syz.3.207: attempt to access beyond end of device [ 35.261446][ T912] loop3: rw=0, sector=45064, nr_sectors = 8 limit=40427 [ 35.266510][ T103] loop0: p150 size 853248 extends beyond EOD, truncated [ 35.287309][ T103] loop0: p151 size 853248 extends beyond EOD, truncated [ 35.295025][ T103] loop0: p152 size 853248 extends beyond EOD, truncated [ 35.296058][ T929] F2FS-fs (loop1): Found nat_bits in checkpoint [ 35.302650][ T103] loop0: p153 size 853248 extends beyond EOD, truncated [ 35.332964][ T103] loop0: p154 size 853248 extends beyond EOD, truncated [ 35.343701][ T929] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 35.350915][ T103] loop0: p155 size 853248 extends beyond EOD, truncated [ 35.357974][ T929] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 35.365947][ T103] loop0: p156 size 853248 extends beyond EOD, truncated [ 35.379089][ T103] loop0: p157 size 853248 extends beyond EOD, truncated [ 35.393001][ T103] loop0: p158 size 853248 extends beyond EOD, truncated [ 35.408003][ T103] loop0: p159 size 853248 extends beyond EOD, truncated [ 35.415489][ T103] loop0: p160 size 853248 extends beyond EOD, truncated [ 35.424536][ T103] loop0: p161 size 853248 extends beyond EOD, truncated [ 35.439011][ T103] loop0: p162 size 853248 extends beyond EOD, truncated [ 35.448644][ T103] loop0: p163 size 853248 extends beyond EOD, truncated [ 35.458772][ T103] loop0: p164 size 853248 extends beyond EOD, truncated [ 35.474293][ T103] loop0: p165 size 853248 extends beyond EOD, truncated [ 35.484028][ T103] loop0: p166 size 853248 extends beyond EOD, truncated [ 35.491491][ T103] loop0: p167 size 853248 extends beyond EOD, truncated [ 35.498703][ T28] audit: type=1400 audit(1792423068.418:345): avc: denied { rename } for pid=928 comm="syz.1.216" name="file0" dev="loop1" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 35.521881][ T28] audit: type=1400 audit(1792423068.418:346): avc: denied { unlink } for pid=928 comm="syz.1.216" name="file1" dev="loop1" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 35.545328][ T103] loop0: p168 size 853248 extends beyond EOD, truncated [ 35.552958][ T28] audit: type=1400 audit(1792423068.418:347): avc: denied { rename } for pid=928 comm="syz.1.216" name="file1" dev="loop1" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 35.574754][ T103] loop0: p169 size 853248 extends beyond EOD, truncated [ 35.584304][ T28] audit: type=1400 audit(1792423068.418:348): avc: denied { unlink } for pid=928 comm="syz.1.216" name="file0" dev="loop1" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 35.584426][ T103] loop0: p170 size 853248 extends beyond EOD, truncated [ 35.617056][ T28] audit: type=1400 audit(1792423068.538:349): avc: denied { write } for pid=952 comm="syz.5.223" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 35.636648][ T103] loop0: p171 size 853248 extends beyond EOD, truncated [ 35.644239][ T103] loop0: p172 size 853248 extends beyond EOD, truncated [ 35.651821][ T103] loop0: p173 size 853248 extends beyond EOD, truncated [ 35.659365][ T103] loop0: p174 size 853248 extends beyond EOD, truncated [ 35.666782][ T103] loop0: p175 size 853248 extends beyond EOD, truncated [ 35.674357][ T103] loop0: p176 size 853248 extends beyond EOD, truncated [ 35.681898][ T103] loop0: p177 size 853248 extends beyond EOD, truncated [ 35.689396][ T103] loop0: p178 size 853248 extends beyond EOD, truncated [ 35.696812][ T103] loop0: p179 size 853248 extends beyond EOD, truncated [ 35.709272][ T103] loop0: p180 size 853248 extends beyond EOD, truncated [ 35.724988][ T103] loop0: p181 size 853248 extends beyond EOD, truncated [ 35.737098][ T957] loop5: detected capacity change from 0 to 256 [ 35.746099][ T957] exFAT-fs (loop5): failed to load upcase table (idx : 0x00012153, chksum : 0xc3dffc2e, utbl_chksum : 0xe619d30d) [ 35.748307][ T103] loop0: p182 size 853248 extends beyond EOD, [ 35.762441][ T28] audit: type=1400 audit(1792423068.688:350): avc: denied { write } for pid=956 comm="syz.5.225" name="/" dev="loop5" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 35.773395][ T103] truncated [ 35.807592][ T103] loop0: p183 size 853248 extends beyond EOD, truncated [ 35.815613][ T103] loop0: p184 size 853248 extends beyond EOD, truncated [ 35.823320][ T103] loop0: p185 size 853248 extends beyond EOD, truncated [ 35.831433][ T103] loop0: p186 size 853248 extends beyond EOD, truncated [ 35.839027][ T103] loop0: p187 size 853248 extends beyond EOD, truncated [ 35.847534][ T103] loop0: p188 size 853248 extends beyond EOD, truncated [ 35.859093][ T103] loop0: p189 size 853248 extends beyond EOD, truncated [ 35.867960][ T103] loop0: p190 size 853248 extends beyond EOD, truncated [ 35.875333][ T103] loop0: p191 size 853248 extends beyond EOD, truncated [ 35.886828][ T103] loop0: p192 size 853248 extends beyond EOD, truncated [ 35.894235][ T103] loop0: p193 size 853248 extends beyond EOD, truncated [ 35.901880][ T103] loop0: p194 size 853248 extends beyond EOD, truncated [ 35.909615][ T103] loop0: p195 size 853248 extends beyond EOD, truncated [ 35.917125][ T103] loop0: p196 size 853248 extends beyond EOD, truncated [ 35.924686][ T103] loop0: p197 size 853248 extends beyond EOD, truncated [ 35.932133][ T103] loop0: p198 size 853248 extends beyond EOD, truncated [ 35.940262][ T103] loop0: p199 size 853248 extends beyond EOD, truncated [ 35.947691][ T103] loop0: p200 size 853248 extends beyond EOD, truncated [ 35.955108][ T103] loop0: p201 size 853248 extends beyond EOD, truncated [ 35.962808][ T103] loop0: p202 size 853248 extends beyond EOD, truncated [ 35.970339][ T103] loop0: p203 size 853248 extends beyond EOD, truncated [ 35.977881][ T103] loop0: p204 size 853248 extends beyond EOD, truncated [ 35.985317][ T103] loop0: p205 size 853248 extends beyond EOD, truncated [ 35.993292][ T103] loop0: p206 size 853248 extends beyond EOD, truncated [ 36.000796][ T103] loop0: p207 size 853248 extends beyond EOD, truncated [ 36.008220][ T103] loop0: p208 size 853248 extends beyond EOD, truncated [ 36.015592][ T103] loop0: p209 size 853248 extends beyond EOD, truncated [ 36.022991][ T103] loop0: p210 size 853248 extends beyond EOD, truncated [ 36.030381][ T103] loop0: p211 size 853248 extends beyond EOD, truncated [ 36.037799][ T103] loop0: p212 size 853248 extends beyond EOD, truncated [ 36.045622][ T103] loop0: p213 size 853248 extends beyond EOD, truncated [ 36.053076][ T103] loop0: p214 size 853248 extends beyond EOD, truncated [ 36.060466][ T103] loop0: p215 size 853248 extends beyond EOD, truncated [ 36.067910][ T103] loop0: p216 size 853248 extends beyond EOD, truncated [ 36.075333][ T103] loop0: p217 size 853248 extends beyond EOD, truncated [ 36.082795][ T103] loop0: p218 size 853248 extends beyond EOD, truncated [ 36.090190][ T103] loop0: p219 size 853248 extends beyond EOD, truncated [ 36.097643][ T103] loop0: p220 size 853248 extends beyond EOD, truncated [ 36.105071][ T103] loop0: p221 size 853248 extends beyond EOD, truncated [ 36.112545][ T103] loop0: p222 size 853248 extends beyond EOD, truncated [ 36.119967][ T103] loop0: p223 size 853248 extends beyond EOD, truncated [ 36.127365][ T103] loop0: p224 size 853248 extends beyond EOD, truncated [ 36.137095][ T103] loop0: p225 size 853248 extends beyond EOD, truncated [ 36.144580][ T103] loop0: p226 size 853248 extends beyond EOD, truncated [ 36.152050][ T103] loop0: p227 size 853248 extends beyond EOD, truncated [ 36.159571][ T103] loop0: p228 size 853248 extends beyond EOD, truncated [ 36.166952][ T103] loop0: p229 size 853248 extends beyond EOD, truncated [ 36.175405][ T103] loop0: p230 size 853248 extends beyond EOD, truncated [ 36.182915][ T103] loop0: p231 size 853248 extends beyond EOD, truncated [ 36.190504][ T103] loop0: p232 size 853248 extends beyond EOD, truncated [ 36.197928][ T103] loop0: p233 size 853248 extends beyond EOD, truncated [ 36.205813][ T103] loop0: p234 size 853248 extends beyond EOD, truncated [ 36.213489][ T103] loop0: p235 size 853248 extends beyond EOD, truncated [ 36.220856][ T103] loop0: p236 size 853248 extends beyond EOD, truncated [ 36.228140][ T103] loop0: p237 size 853248 extends beyond EOD, truncated [ 36.235488][ T103] loop0: p238 size 853248 extends beyond EOD, truncated [ 36.242837][ T103] loop0: p239 size 853248 extends beyond EOD, truncated [ 36.250482][ T103] loop0: p240 size 853248 extends beyond EOD, truncated [ 36.257911][ T103] loop0: p241 size 853248 extends beyond EOD, truncated [ 36.265504][ T103] loop0: p242 size 853248 extends beyond EOD, truncated [ 36.272958][ T103] loop0: p243 size 853248 extends beyond EOD, truncated [ 36.280533][ T103] loop0: p244 size 853248 extends beyond EOD, truncated [ 36.287912][ T103] loop0: p245 size 853248 extends beyond EOD, truncated [ 36.295275][ T103] loop0: p246 size 853248 extends beyond EOD, truncated [ 36.302702][ T103] loop0: p247 size 853248 extends beyond EOD, truncated [ 36.310244][ T103] loop0: p248 size 853248 extends beyond EOD, truncated [ 36.317654][ T103] loop0: p249 size 853248 extends beyond EOD, truncated [ 36.325651][ T103] loop0: p250 size 853248 extends beyond EOD, truncated [ 36.333238][ T103] loop0: p251 size 853248 extends beyond EOD, truncated [ 36.340832][ T103] loop0: p252 size 853248 extends beyond EOD, truncated [ 36.347236][ T985] BEET mode doesn't support inner IPv4 fragments [ 36.348279][ T103] loop0: p253 size 853248 extends beyond EOD, truncated [ 36.363298][ T103] loop0: p254 size 853248 extends beyond EOD, truncated [ 36.370908][ T103] loop0: p255 size 853248 extends beyond EOD, truncated [ 36.398602][ T991] binder: 990:991 ioctl c0306201 0 returned -14 [ 36.414133][ T988] SELinux: failed to load policy [ 36.420393][ T991] binder: 990:991 ioctl c0306201 2000000001c0 returned -14 [ 36.501592][ T326] udevd[326]: inotify_add_watch(7, /dev/loop0p5, 10) failed: No such file or directory [ 36.502196][ T325] udevd[325]: inotify_add_watch(7, /dev/loop0p1, 10) failed: No such file or directory [ 36.522337][ T317] udevd[317]: inotify_add_watch(7, /dev/loop0p2, 10) failed: No such file or directory [ 36.533219][ T688] udevd[688]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 36.568478][ T1005] udevd[1005]: inotify_add_watch(7, /dev/loop0p11, 10) failed: No such file or directory [ 36.576064][ T1002] udevd[1002]: inotify_add_watch(7, /dev/loop0p8, 10) failed: No such file or directory [ 36.581663][ T1001] udevd[1001]: inotify_add_watch(7, /dev/loop0p7, 10) failed: No such file or directory [ 36.588493][ T1000] udevd[1000]: inotify_add_watch(7, /dev/loop0p6, 10) failed: No such file or directory [ 36.601912][ T1003] udevd[1003]: inotify_add_watch(7, /dev/loop0p9, 10) failed: No such file or directory [ 36.614395][ T1004] udevd[1004]: inotify_add_watch(7, /dev/loop0p10, 10) failed: No such file or directory [ 36.791354][ T1014] loop2: detected capacity change from 0 to 2048 [ 36.861827][ T1018] loop5: detected capacity change from 0 to 512 [ 36.880492][ T1018] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 36.919430][ T1014] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 36.935756][ T1014] ext4 filesystem being mounted at /41/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 36.991650][ T1014] fs-verity: sha512 using implementation "sha512-avx2" [ 37.034787][ T291] EXT4-fs (loop2): unmounting filesystem. [ 37.106249][ T1036] FAULT_INJECTION: forcing a failure. [ 37.106249][ T1036] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 37.146544][ T1036] CPU: 1 PID: 1036 Comm: syz.2.250 Not tainted syzkaller #0 [ 37.153968][ T1036] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 37.164043][ T1036] Call Trace: [ 37.167351][ T1036] [ 37.170450][ T1036] __dump_stack+0x21/0x24 [ 37.174821][ T1036] dump_stack_lvl+0x110/0x170 [ 37.179536][ T1036] ? __cfi_dump_stack_lvl+0x8/0x8 [ 37.184588][ T1036] ? vsnprintf+0x14e/0x1990 [ 37.189127][ T1036] ? memcpy+0x56/0x70 [ 37.193138][ T1036] dump_stack+0x15/0x24 [ 37.197329][ T1036] should_fail_ex+0x3bf/0x510 [ 37.202029][ T1036] should_fail+0xb/0x10 [ 37.206187][ T1036] should_fail_usercopy+0x1a/0x20 [ 37.211203][ T1036] _copy_to_user+0x1e/0x90 [ 37.215609][ T1036] bpf_verifier_vlog+0x179/0x390 [ 37.220539][ T1036] __btf_verifier_log+0xdf/0x130 [ 37.225560][ T1036] ? kasan_save_alloc_info+0x1f/0x30 [ 37.230832][ T1036] ? __kasan_kmalloc+0x95/0xb0 [ 37.235674][ T1036] ? btf_check_sec_info+0x350/0x350 [ 37.240875][ T1036] ? btf_parse_hdr+0x1ee/0x800 [ 37.245641][ T1036] ? memcpy+0x56/0x70 [ 37.249611][ T1036] btf_parse_hdr+0x486/0x800 [ 37.254192][ T1036] btf_new_fd+0x398/0x7a0 [ 37.258512][ T1036] bpf_btf_load+0x6f/0x90 [ 37.262829][ T1036] __sys_bpf+0x5d5/0x850 [ 37.267061][ T1036] ? bpf_link_show_fdinfo+0x330/0x330 [ 37.272421][ T1036] ? fpregs_restore_userregs+0x128/0x260 [ 37.278041][ T1036] __x64_sys_bpf+0x7c/0x90 [ 37.282445][ T1036] x64_sys_call+0x488/0x9a0 [ 37.286941][ T1036] do_syscall_64+0x4c/0xa0 [ 37.291339][ T1036] ? clear_bhb_loop+0x30/0x80 [ 37.296004][ T1036] ? clear_bhb_loop+0x30/0x80 [ 37.300672][ T1036] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 37.306551][ T1036] RIP: 0033:0x7f4bbd19e559 [ 37.310951][ T1036] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.330557][ T1036] RSP: 002b:00007f4bbdfae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 37.338966][ T1036] RAX: ffffffffffffffda RBX: 00007f4bbd425fa0 RCX: 00007f4bbd19e559 [ 37.346929][ T1036] RDX: 0000000000000028 RSI: 0000200000000000 RDI: 0000000000000012 [ 37.354896][ T1036] RBP: 00007f4bbd235ad8 R08: 0000000000000000 R09: 0000000000000000 [ 37.362856][ T1036] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 37.370821][ T1036] R13: 00007f4bbd426038 R14: 00007f4bbd425fa0 R15: 00007ffd52875ee8 [ 37.378795][ T1036] [ 37.546852][ T1050] loop3: detected capacity change from 0 to 512 [ 37.580308][ T1050] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 37.617699][ T1050] ext4 filesystem being mounted at /61/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 37.663386][ T1060] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 37.673021][ T1050] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 96 vs 65376 free clusters [ 37.688760][ T1060] ext4 filesystem being mounted at /36/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 37.700244][ T1050] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 1 with max blocks 33 with error 28 [ 37.713578][ T1050] EXT4-fs (loop3): This should not happen!! Data will be lost [ 37.713578][ T1050] [ 37.724305][ T1050] EXT4-fs (loop3): Total free blocks count 0 [ 37.732768][ T1050] EXT4-fs (loop3): Free/Dirty block details [ 37.744790][ T1050] EXT4-fs (loop3): free_blocks=65280 [ 37.750619][ T1050] EXT4-fs (loop3): dirty_blocks=33 [ 37.750748][ T1066] capability: warning: `syz.2.263' uses 32-bit capabilities (legacy support in use) [ 37.755883][ T1050] EXT4-fs (loop3): Block reservation details [ 37.787817][ T1050] EXT4-fs (loop3): i_reserved_data_blocks=33 [ 37.795101][ T609] EXT4-fs (loop1): unmounting filesystem. [ 37.886002][ T1050] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 2 with max blocks 2 with error 28 [ 37.971883][ T1069] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 37.979956][ T1069] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 37.988952][ T1069] F2FS-fs (loop1): invalid crc value [ 38.019778][ T1074] SELinux: failed to load policy [ 38.021378][ T1069] F2FS-fs (loop1): Found nat_bits in checkpoint [ 38.037385][ T1076] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 38.048858][ T1076] ext4 filesystem being mounted at /45/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 38.076563][ T1069] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 38.078872][ T291] EXT4-fs (loop2): unmounting filesystem. [ 38.084222][ T1069] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 38.191441][ T1091] bio_check_eod: 3 callbacks suppressed [ 38.191460][ T1091] syz.1.264: attempt to access beyond end of device [ 38.191460][ T1091] loop1: rw=2049, sector=53248, nr_sectors = 2152 limit=40427 [ 38.221781][ T1091] syz.1.264: attempt to access beyond end of device [ 38.221781][ T1091] loop1: rw=2049, sector=55400, nr_sectors = 1944 limit=40427 [ 38.238550][ T39] usb 4-1: new low-speed USB device number 2 using dummy_hcd [ 38.238936][ T1077] f2fs_ckpt-7:1: attempt to access beyond end of device [ 38.238936][ T1077] loop1: rw=2049, sector=40960, nr_sectors = 8 limit=40427 [ 38.268648][ T1091] syz.1.264: attempt to access beyond end of device [ 38.268648][ T1091] loop1: rw=2049, sector=49152, nr_sectors = 760 limit=40427 [ 38.419782][ T39] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 38.438239][ T39] usb 4-1: config 179 has no interface number 0 [ 38.444790][ T39] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 10 [ 38.466430][ T39] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 38.477011][ T39] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 38.492707][ T39] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 58368, setting to 8 [ 38.513441][ T39] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 38.538784][ T39] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 38.551395][ T39] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.564275][ T1072] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 38.582335][ T39] xpad 4-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 38.595267][ T39] xpad: probe of 4-1:179.65 failed with error -5 [ 38.612228][ T1121] set_capacity_and_notify: 3 callbacks suppressed [ 38.612240][ T1121] loop2: detected capacity change from 0 to 128 [ 38.629147][ T1121] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 38.638722][ T1121] ext4 filesystem being mounted at /53/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 38.691106][ T291] EXT4-fs (loop2): unmounting filesystem. [ 38.709962][ T1132] FAULT_INJECTION: forcing a failure. [ 38.709962][ T1132] name failslab, interval 1, probability 0, space 0, times 0 [ 38.722630][ T1132] CPU: 1 PID: 1132 Comm: syz.2.287 Not tainted syzkaller #0 [ 38.729921][ T1132] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 38.739972][ T1132] Call Trace: [ 38.743236][ T1132] [ 38.746149][ T1132] __dump_stack+0x21/0x24 [ 38.750492][ T1132] dump_stack_lvl+0x110/0x170 [ 38.755157][ T1132] ? __cfi_dump_stack_lvl+0x8/0x8 [ 38.760189][ T1132] dump_stack+0x15/0x24 [ 38.764338][ T1132] should_fail_ex+0x3bf/0x510 [ 38.768999][ T1132] ? inet_bind2_bucket_create+0x35/0x350 [ 38.774629][ T1132] __should_failslab+0xac/0xf0 [ 38.779399][ T1132] should_failslab+0x9/0x20 [ 38.783900][ T1132] kmem_cache_alloc+0x3b/0x320 [ 38.788650][ T1132] ? kmem_cache_alloc+0x166/0x320 [ 38.793682][ T1132] ? inet_bind_bucket_create+0x2f/0x290 [ 38.799229][ T1132] inet_bind2_bucket_create+0x35/0x350 [ 38.804683][ T1132] inet_csk_get_port+0x10b9/0x16f0 [ 38.809819][ T1132] ? __cfi_inet_csk_get_port+0x10/0x10 [ 38.815265][ T1132] inet_csk_listen_start+0x130/0x330 [ 38.820549][ T1132] inet_listen+0x2e9/0x6e0 [ 38.824955][ T1132] ? __cfi_inet_listen+0x10/0x10 [ 38.829881][ T1132] ? __fget_files+0x2d1/0x330 [ 38.834546][ T1132] ? security_socket_listen+0x8a/0xb0 [ 38.839906][ T1132] __x64_sys_listen+0x210/0x290 [ 38.844757][ T1132] x64_sys_call+0x1fd/0x9a0 [ 38.849246][ T1132] do_syscall_64+0x4c/0xa0 [ 38.853646][ T1132] ? clear_bhb_loop+0x30/0x80 [ 38.858320][ T1132] ? clear_bhb_loop+0x30/0x80 [ 38.862996][ T1132] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 38.868873][ T1132] RIP: 0033:0x7f4bbd19e559 [ 38.873275][ T1132] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.892963][ T1132] RSP: 002b:00007f4bbdfae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000032 [ 38.901409][ T1132] RAX: ffffffffffffffda RBX: 00007f4bbd425fa0 RCX: 00007f4bbd19e559 [ 38.909396][ T1132] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 38.917377][ T1132] RBP: 00007f4bbd235ad8 R08: 0000000000000000 R09: 0000000000000000 [ 38.925368][ T1132] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 38.933362][ T1132] R13: 00007f4bbd426038 R14: 00007f4bbd425fa0 R15: 00007ffd52875ee8 [ 38.941361][ T1132] [ 38.959714][ T805] usb 4-1: USB disconnect, device number 2 [ 38.972957][ T1130] ================================================================== [ 38.981052][ T1130] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 [ 38.989139][ T1130] Read of size 4 at addr ffff88810fc2ac00 by task syz.1.286/1130 [ 38.996868][ T1130] [ 38.999203][ T1130] CPU: 1 PID: 1130 Comm: syz.1.286 Not tainted syzkaller #0 [ 39.006491][ T1130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 39.016546][ T1130] Call Trace: [ 39.019824][ T1130] [ 39.022751][ T1130] __dump_stack+0x21/0x24 [ 39.027093][ T1130] dump_stack_lvl+0x110/0x170 [ 39.031787][ T1130] ? __cfi_dump_stack_lvl+0x8/0x8 [ 39.036826][ T1130] ? _raw_spin_lock_bh+0x94/0xf0 [ 39.041763][ T1130] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 39.047494][ T1130] print_address_description+0x71/0x200 [ 39.053055][ T1130] print_report+0x4a/0x60 [ 39.057564][ T1130] kasan_report+0x122/0x150 [ 39.062071][ T1130] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 39.067894][ T1130] __asan_report_load4_noabort+0x14/0x20 [ 39.073551][ T1130] pppol2tp_sock_to_session+0x1a0/0x1b0 [ 39.079131][ T1130] pppol2tp_release+0x150/0x2b0 [ 39.084006][ T1130] sock_close+0xc9/0x220 [ 39.088266][ T1130] ? __cfi_sock_close+0x10/0x10 [ 39.093139][ T1130] __fput+0x1fd/0x8f0 [ 39.097143][ T1130] ____fput+0x15/0x20 [ 39.101147][ T1130] task_work_run+0x1e1/0x250 [ 39.105758][ T1130] ? __cfi_task_work_run+0x10/0x10 [ 39.110887][ T1130] ? free_nsproxy+0x21f/0x270 [ 39.115583][ T1130] do_exit+0xb0d/0x29f0 [ 39.119746][ T1130] ? __cfi_do_exit+0x10/0x10 [ 39.124339][ T1130] ? xfd_validate_state+0x70/0x150 [ 39.129455][ T1130] ? __kasan_check_write+0x14/0x20 [ 39.134572][ T1130] __x64_sys_exit+0x40/0x40 [ 39.139079][ T1130] x64_sys_call+0x67/0x9a0 [ 39.143518][ T1130] do_syscall_64+0x4c/0xa0 [ 39.147953][ T1130] ? clear_bhb_loop+0x30/0x80 [ 39.152642][ T1130] ? clear_bhb_loop+0x30/0x80 [ 39.157331][ T1130] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 39.163241][ T1130] RIP: 0033:0x7f739ef9e559 [ 39.167645][ T1130] Code: Unable to access opcode bytes at 0x7f739ef9e52f. [ 39.174650][ T1130] RSP: 002b:00007f739fe85ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 39.183047][ T1130] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f739ef9e559 [ 39.191009][ T1130] RDX: 00007f739fe869c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 39.198962][ T1130] RBP: 00007f739f035ad8 R08: 0000000000000000 R09: 0000000000000058 [ 39.206922][ T1130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 39.215236][ T1130] R13: 00007f739f226038 R14: 00007f739f225fa0 R15: 00007ffc72fb49d8 [ 39.223551][ T1130] [ 39.226564][ T1130] [ 39.229047][ T1130] Allocated by task 1129: [ 39.233382][ T1130] kasan_set_track+0x4b/0x70 [ 39.237975][ T1130] kasan_save_alloc_info+0x1f/0x30 [ 39.243178][ T1130] __kasan_kmalloc+0x95/0xb0 [ 39.248018][ T1130] __kmalloc+0xb4/0x1e0 [ 39.252159][ T1130] l2tp_session_create+0x38/0xbd0 [ 39.257174][ T1130] pppol2tp_connect+0xbf5/0x1640 [ 39.262105][ T1130] __sys_connect+0x3da/0x460 [ 39.266855][ T1130] __x64_sys_connect+0x7a/0x90 [ 39.271714][ T1130] x64_sys_call+0x88d/0x9a0 [ 39.276295][ T1130] do_syscall_64+0x4c/0xa0 [ 39.280815][ T1130] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 39.286816][ T1130] [ 39.289162][ T1130] Freed by task 385: [ 39.293062][ T1130] kasan_set_track+0x4b/0x70 [ 39.297661][ T1130] kasan_save_free_info+0x2b/0x40 [ 39.302770][ T1130] ____kasan_slab_free+0x132/0x180 [ 39.307975][ T1130] __kasan_slab_free+0x11/0x20 [ 39.312743][ T1130] slab_free_freelist_hook+0xc2/0x190 [ 39.318123][ T1130] __kmem_cache_free+0xb7/0x1b0 [ 39.323048][ T1130] kfree+0x6f/0xf0 [ 39.326863][ T1130] l2tp_session_put+0xaf/0x1a0 [ 39.331614][ T1130] l2tp_session_delete+0x3df/0x4d0 [ 39.336715][ T1130] l2tp_tunnel_del_work+0x199/0x410 [ 39.341995][ T1130] process_one_work+0x717/0xc30 [ 39.346834][ T1130] worker_thread+0xa4d/0x11d0 [ 39.351512][ T1130] kthread+0x281/0x320 [ 39.355683][ T1130] ret_from_fork+0x1f/0x30 [ 39.360267][ T1130] [ 39.362574][ T1130] The buggy address belongs to the object at ffff88810fc2ac00 [ 39.362574][ T1130] which belongs to the cache kmalloc-512 of size 512 [ 39.376696][ T1130] The buggy address is located 0 bytes inside of [ 39.376696][ T1130] 512-byte region [ffff88810fc2ac00, ffff88810fc2ae00) [ 39.389951][ T1130] [ 39.392271][ T1130] The buggy address belongs to the physical page: [ 39.398752][ T1130] page:ffffea00043f0a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fc28 [ 39.409759][ T1130] head:ffffea00043f0a00 order:2 compound_mapcount:0 compound_pincount:0 [ 39.418328][ T1130] flags: 0x4000000000010200(slab|head|zone=1) [ 39.424403][ T1130] raw: 4000000000010200 ffffea0004c70600 dead000000000002 ffff888100042f00 [ 39.433495][ T1130] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 39.442231][ T1130] page dumped because: kasan: bad access detected [ 39.448936][ T1130] page_owner tracks the page as allocated [ 39.454634][ T1130] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 92, tgid 92 (klogd), ts 3536311954, free_ts 0 [ 39.474679][ T1130] post_alloc_hook+0x1f5/0x210 [ 39.479431][ T1130] prep_new_page+0x1c/0x110 [ 39.483921][ T1130] get_page_from_freelist+0x2ca9/0x2d20 [ 39.489449][ T1130] __alloc_pages+0x1fa/0x610 [ 39.494028][ T1130] alloc_slab_page+0x6e/0xf0 [ 39.498598][ T1130] new_slab+0x98/0x3e0 [ 39.502653][ T1130] ___slab_alloc+0x70f/0xb70 [ 39.507228][ T1130] __slab_alloc+0x5e/0xa0 [ 39.511544][ T1130] __kmem_cache_alloc_node+0x204/0x2d0 [ 39.516990][ T1130] __kmalloc_node_track_caller+0xa1/0x1e0 [ 39.522688][ T1130] __alloc_skb+0x226/0x4a0 [ 39.527084][ T1130] alloc_skb_with_frags+0xa8/0x620 [ 39.532177][ T1130] sock_alloc_send_pskb+0x87f/0x9a0 [ 39.537351][ T1130] unix_dgram_sendmsg+0x5c1/0x1710 [ 39.542441][ T1130] __sys_sendto+0x4ac/0x660 [ 39.546929][ T1130] __x64_sys_sendto+0xe5/0x100 [ 39.551685][ T1130] page_owner free stack trace missing [ 39.557031][ T1130] [ 39.559337][ T1130] Memory state around the buggy address: [ 39.564943][ T1130] ffff88810fc2ab00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.572981][ T1130] ffff88810fc2ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.581019][ T1130] >ffff88810fc2ac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.589054][ T1130] ^ [ 39.593095][ T1130] ffff88810fc2ac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.601131][ T1130] ffff88810fc2ad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.609171][ T1130] ================================================================== [ 39.622757][ T1130] Disabling lock debugging due to kernel taint [ 39.629188][ T1130] ------------[ cut here ]------------ [ 39.634684][ T1130] WARNING: CPU: 1 PID: 1130 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 39.644931][ T1130] Modules linked in: [ 39.648865][ T1130] CPU: 1 PID: 1130 Comm: syz.1.286 Tainted: G B syzkaller #0 [ 39.657629][ T1130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 39.667705][ T1130] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 39.674071][ T1130] Code: 5d c3 e8 1c e1 d4 fc be 02 00 00 00 eb 0a e8 10 e1 d4 fc be 01 00 00 00 4c 89 f7 e8 63 fb cc fd e9 0f ff ff ff e8 f9 e0 d4 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 e8 e0 d4 fc 4c 89 f7 be 03 [ 39.693690][ T1130] RSP: 0018:ffffc90010147b90 EFLAGS: 00010293 [ 39.699792][ T1130] RAX: ffffffff849c8d47 RBX: ffff8881145e6000 RCX: ffff888114621440 [ 39.707761][ T1130] RDX: 0000000000000000 RSI: 0000000018350840 RDI: 000000000c04eb7d [ 39.715750][ T1130] RBP: ffffc90010147bb0 R08: ffffffff87b777e7 R09: 1ffffffff0f6eefc [ 39.723755][ T1130] R10: dffffc0000000000 R11: fffffbfff0f6eefd R12: dffffc0000000000 [ 39.731754][ T1130] R13: dffffc0000000000 R14: 0000000018350840 R15: ffff88810fc2ac00 [ 39.739741][ T1130] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 39.748676][ T1130] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.755257][ T1130] CR2: 00007f6150cf7d58 CR3: 000000013014d000 CR4: 00000000003506a0 [ 39.763279][ T1130] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 39.771265][ T1130] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 39.779243][ T1130] Call Trace: [ 39.782514][ T1130] [ 39.785429][ T1130] pppol2tp_release+0x150/0x2b0 [ 39.790298][ T1130] sock_close+0xc9/0x220 [ 39.794532][ T1130] ? __cfi_sock_close+0x10/0x10 [ 39.799401][ T1130] __fput+0x1fd/0x8f0 [ 39.803378][ T1130] ____fput+0x15/0x20 [ 39.807350][ T1130] task_work_run+0x1e1/0x250 [ 39.811974][ T1130] ? __cfi_task_work_run+0x10/0x10 [ 39.817079][ T1130] ? free_nsproxy+0x21f/0x270 [ 39.821775][ T1130] do_exit+0xb0d/0x29f0 [ 39.825935][ T1130] ? __cfi_do_exit+0x10/0x10 [ 39.830687][ T1130] ? xfd_validate_state+0x70/0x150 [ 39.835798][ T1130] ? __kasan_check_write+0x14/0x20 [ 39.840925][ T1130] __x64_sys_exit+0x40/0x40 [ 39.845451][ T1130] x64_sys_call+0x67/0x9a0 [ 39.849878][ T1130] do_syscall_64+0x4c/0xa0 [ 39.854402][ T1130] ? clear_bhb_loop+0x30/0x80 [ 39.859929][ T1130] ? clear_bhb_loop+0x30/0x80 [ 39.864611][ T1130] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 39.870512][ T1130] RIP: 0033:0x7f739ef9e559 [ 39.874940][ T1130] Code: Unable to access opcode bytes at 0x7f739ef9e52f. [ 39.882147][ T1130] RSP: 002b:00007f739fe85ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 39.890569][ T1130] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f739ef9e559 [ 39.898556][ T1130] RDX: 00007f739fe869c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 39.906519][ T1130] RBP: 00007f739f035ad8 R08: 0000000000000000 R09: 0000000000000058 [ 39.914502][ T1130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 39.922498][ T1130] R13: 00007f739f226038 R14: 00007f739f225fa0 R15: 00007ffc72fb49d8 [ 39.930515][ T1130] [ 39.933527][ T1130] ---[ end trace 0000000000000000 ]---