last executing test programs: 10m14.498894636s ago: executing program 0 (id=73): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200040c0}, 0x20000090) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280"], 0x44}}, 0x0) 10m14.32449595s ago: executing program 0 (id=74): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/3\x00') pread64(r0, &(0x7f0000001480)=""/265, 0x109, 0x6) 10m14.266294371s ago: executing program 0 (id=75): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) listen(r0, 0x80) sendmmsg$inet_sctp(r0, &(0x7f0000000080)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="20000000000000008400000002"], 0x20}], 0x1, 0x0) 10m13.801984941s ago: executing program 0 (id=77): syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000a00)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="616c6c6f775f7574696d653d30303030303030303030303030303030303030303030312c73686f72746e616d653d77696e39352c73686f72746e616d653d77696e6e742c696f636861727365743d64656661756c742c756e695f786c6174653d302c6e6f6e756d7461696c3d302c757466383d302c666c7573682c726f6469722c726f6469722c73686f72746e616d653d77696e6e742c73686f72746e616d653d6c6f7765722c636865636b3d7374726963742c756e695f786c6174653d302c757466383d302c73686f72746e616d653d6d697865642c756e695f786c6174653d312c73686f72746e616d653d77696e6e742c001762a07a915c8f6c3378b924fc250bdae45cd22bb33f29d72cf1c8410df88b83b9710b49374a748455718cc4af5f3ced9aa10632d595e9c8c3a89f41b650b9ebd4886ae65bf02b7c8ea4e76ef2cc241ac9f89f2753df98db0ba9558c753363f296424ec60e703fac2db7e9f31283852e115cf6acb8d77b3e5d68", @ANYBLOB="11ad0fa62a2978807a8e8dfa67c8067d98e603c58e7741eff6101f7dba3e990d3c0c48189cbc7d818e4f857a223c76a4e2cd58dd6af9d8e4a08a2b86421350c1a17d139ce9557b4349553f9bbebef80fbded8430b9772d31c61c03266f36811894ab79fec8ccbacca6f8a63a2ef607314056f14f2c1dc27d3e32385c9af9182d068d101ffbb44cfcb71f7af9565659eef91f11f9f7d5c25012450485453b96da2fa7", @ANYBLOB="b13c376fdd66a7d639c02532bf04ce21f7d86f67914cd24c1a16c85d000e56c7368c5baa847b8d1390c871ca73979c130e2e8dba52cb6e29e7ef9ce8e7f092a32dd4dff5839727b3f591e388d041527960a1e20a1e133b12dfc18f1f732ea8614d5847cd54edc1c0aa5422ef3bb9508fdbebcc135de98954f1d9fbffbb190a49b16c1275d4830b8a85acf0b55c1e19533fb1ae4ca8f80bdefda060e3e6837a10fc794ecf34ec4b7a7c76402285c415d76a33d64d218596c8126c7b35076511e52e235fb9be2d0a381962e129748855c39c84436bd553b25d7f0ae7e35b54eebdb608625a42b589438a35d78997"], 0xff, 0x2c1, &(0x7f0000000a40)="$eJzs3bFra1UcB/DfTdMkT5FEcBLBCzo4PV7f6pIifVDMpGRQBy22BUmCkEKhVYydXF0cXV0Ewc1/wsX/QHAV3CxYuHKTe03SpiFB06rv81l6eu755vzOyS0lQ8794KVB7zCN44tPf45GI4lKO9pxmUQrKlH6POa0vwwA4L/sMsvit2xinVwSEY3NlQUAbNDa//+/33hJAMCGvf3Ou2/udjp7b6VpI54Mvjjt5p/s858RDyJi9zg+in4cxaNoxlVE9pdJ+0mWZaNqmmvFq4PRaTdPDt7/sXj93V8bMc7vRDNa4675/H5nbyedmMmP8jqeKeZv5/nH0YwXFsy/39l7vCAf3Vq89spM/Q+jGT99GB9HPw7HRUzyUYn4bCdN38i++v2T9/Ly8nwyOu3Wx+Omsq27f3cAAAAAAAAAAAAAAAAAAAAAAPi/elicnVOP8fk9eVdx/s7WVf7LdqSl1vz5PJN8Ur7QtfOBRll8XZ7P8yhN06wYOM1X48VqVO9n1QAAAAAAAAAAAAAAAAAAAPDvcnJ23jvo94+G/0ijPA2g/Fr/qvGLaz3tmTEvx/J4fTpXpWgumSu2yjFJxNLC8kWsvPY/imMPVt2oasz2PH9bzd9+t/Jb8M3ta38wf2l72f78jUatmObsvFfeXb2DZPEe1qPsaZQ3yQ+zY2qx6qS3XcrWuP2GJ7WFl5prb0Lt2XFjtGRMJMsKe/2Xyc6d9w6e6x8Nk+urqI13dWF8u2gU8ZtjGqvfz/lfyg2J0zoAAAAAAAAAAAAAAAAAAGCjpl/6neuePK7/Ymm0ktU3WxsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3JXp8//XaIyK8AqDazE8ueclAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8BT4MwAA//9YnFw0") mkdir(&(0x7f0000001a80)='./file0\x00', 0x1cb) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) 10m12.825990753s ago: executing program 0 (id=80): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400400142603600e122f001600060005", 0x2f}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0xc040) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c00000002010102000000000000000003000001140018800800034000000755080001400000000904"], 0x2c}}, 0x24000881) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x68}, 0x1, 0x0, 0x0, 0x4800}, 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001d008104e00f80ecdb4cb9f207c804a00d000000880802fb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) 10m12.383142562s ago: executing program 0 (id=85): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_NODE_RECVQ_DEPTH(r0, 0x10f, 0x83, 0x0, &(0x7f0000000080)) 10m11.887010473s ago: executing program 32 (id=85): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_NODE_RECVQ_DEPTH(r0, 0x10f, 0x83, 0x0, &(0x7f0000000080)) 12.058033285s ago: executing program 1 (id=3033): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x187) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)) chdir(&(0x7f00000003c0)='./bus\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r0, 0x402, 0x80000020) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) ptrace(0x10, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) setsockopt$inet6_opts(r4, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x18) connect$inet6(r4, &(0x7f0000000240)={0xa, 0x6e23, 0x2, @mcast1, 0x9}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000001840), 0x3b, 0x0) 11.457184898s ago: executing program 4 (id=3035): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x3e, 0x2, 0x457f1c9146f8f874, "464905e100000000000000007f00", 0x41495043}) 10.325700833s ago: executing program 4 (id=3039): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000100)={0x5, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r3, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) gettid() timer_create(0x7, 0x0, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = accept(r2, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) 9.290007925s ago: executing program 4 (id=3041): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0, 0x28) socket$nl_xfrm(0x10, 0x3, 0x6) fchown(r0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) 9.130385479s ago: executing program 4 (id=3042): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000480), 0x400034f, 0x2, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) r3 = dup(r2) write$UHID_INPUT(r3, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./bus\x00', 0x20081e, &(0x7f00000001c0), 0x1, 0x4ef, &(0x7f0000000940)="$eJzs3U1vW1kZAODXzpeTyUwywywAAVOGgYKqOonbRlUXUFYIoUqILkFqQ+JGUew4ip3ShC7S/4BEJVaw5Aew7oo9GwQ7NmWBxEcEaiqxMLrXN6mb2k1oEjuKn0e6uvfcY/s9J849x36d+AQwsC5FxE5EjEbE/YiYys7nsi1ut7bkdi92Hy/u7T5ezEWzefefubQ+ORdt90m8lz1mISJ+9L2In+bejFvf2l5dqFTKG63i+Eyjuj5T39q+ulJdWC4vl9dKpfm5+dmb126UTq2vn1RHs6MvP//Dzrd+njRrMjvT3o/T1Or6yEGcxHBE/OAsgvXBUNaf0X43hHeSj4iPIuLT9PqfiqH02QQALrJmcyqaU+1lAOCiy6c5sFy+mOUCJiOfLxZbObyPYyJfqdUbVx7UNteWWrmy6RjJP1iplGezXOF0jOSS8lx6/KpcOlS+FhEfRsQvxsbTcnGxVlnq5wsfABhg7x2a//8z1pr/AYALrtDvBgAAPWf+B4DBY/4HgMFj/geAwWP+B4DBY/4HgMFj/geAgfLDO3eSrbmXff/10sOtzdXaw6tL5fpqsbq5WFysbawXl2u15fQ7e6pHPV6lVlufux6bj6a/vV5vzNS3tu9Va5trjXvp93rfK4/0pFcAwNt8+MmzP+ciYufWeLpF21oO5mq42PL9bgDQN0P9bgDQN1b7gsF1gvf40gNwQXRYovc1hYgYP3yy2Ww2z65JwBm7/AX5fxhUbfl/fwUMA0b+HwaX/D8MrmYzd9w1/+O4NwQAzjc5fqDL5/8fZfvfZh8O/GTp8C2enmWrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4HzbX/+3mK0FPhn5fLEY8X5ETMdI7sFKpTwbER9ExJ/GRsaS8lyf2wwAnFT+b7ls/a/LU59NHq4dzb0cS/cR8bNf3f3lo4VGY+OPyfl/HZxvPM3Ol/rRfgDgKPvzdLpveyP/Yvfx4v7Wy/b8/bsRUWjF39sdjb2D+MMxnO4LMRIRE//OZeWWXFvu4iR2nkTE5zv1PxeTaQ6ktfLp4fhJ7Pd7Gj//Wvx8WtfaJz+Lz51CW2DQPEvGn9udrr98XEr3na//QjpCnVw2/iUPtbiXjoGv4u+Pf0Ndxr9Lx41x/fffbx2Nv1n3JOKLwxH7sffaxp/9+Lku8T87Zvy/fOkrn3ara/464nJ0jt8ea6ZRXZ+pb21fXakuLJeXy2ul0vzc/OzNazdKM2mOeqb7bPCPW1c+6FaX9H+iS/zCEf3/+jH7/5v/3v/xV98S/5tf6xQ/Hx+/JX4yJ37jmPEXJn5X6FaXxF/q0v+jnv8rx4z//K/bbywbDgD0T31re3WhUilv9PJg/4VET4M6uAAHyW/NOWhGx4Pv9CrWaPxf92o23ylWtxHjNLJuwHlwcNFHxMt+NwYAAAAAAAAAAAAAAOioF/+x1O8+AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcHH9LwAA//89fM7W") r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0xc41, 0x20) truncate(&(0x7f0000000900)='./file1\x00', 0x3000000) r5 = open(&(0x7f00000000c0)='./file1\x00', 0x66842, 0x21) pwritev2(r5, &(0x7f0000000240)=[{}], 0x1, 0x2000, 0x0, 0x3) ioprio_set$uid(0x3, 0x0, 0x0) syz_open_dev$vim2m(&(0x7f00000001c0), 0x3, 0x2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, 0x0) 8.722589558s ago: executing program 1 (id=3043): syz_mount_image$reiserfs(&(0x7f0000000100), &(0x7f0000000580)='./file1\x00', 0x8488, &(0x7f00000005c0), 0xfe, 0x1101, &(0x7f0000001640)="$eJzs2T+LE0EYB+Df7MZ/VWSvXwQtLOS4I36BKxTSWtuIXOVVl0rx4/hx9AqxP67X4sB+ZU02UQkEkqgcPA8s8+7LO7vvlDMTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6I2SryU5qJJmyFVJStK2F9OrJO2Qv/+xrlLy4nQ6e3Y+eT5LUv8sL/eGkpKkOX54t5k0k+a4eXpw8ujT7O27N6/Ozk7PlzVtLq/3v5Sy6AcAAAD4Xbezz//5/wAAAMAmeztIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANhSN17FzRBUSUrSthfTqyTtmnm3/lF/AAAAwO5Kqrwcr8vPjwFWnuTLuCzz/fi99PFRPqyZv1G1fc8AAABww3V3FsGv9+vl9mo//jij5da5zz3IKIeH8/fFkG8nSZ3k6I+PX16/fz08pav/9loAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOAHO3AsAAAAACDM3zqNjg0AAAAAAAAAAAAAAAAAAGCvAAAA///e69c/") ftruncate(0xffffffffffffffff, 0x8008976) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, 0xffffffffffffffff, 0x0) syz_mount_image$udf(&(0x7f0000000f00), &(0x7f00000000c0)='./file0\x00', 0xa00004, &(0x7f0000000140)=ANY=[@ANYBLOB='adinicb,nostrict,utf8,uid=', @ANYRESDEC=0x0, @ANYBLOB="2c6e6f7672732c6769643d6660726765742c6d6f64653d303030303030303030303030303030303030303020caa41f0d9182cfcc3031302c696f636861727365743d69736f383835392d31342c6164696e6963622c696f636861727365743d6d61636379ff076c6c69632c6c617374626c6f636b3d30303030303030303030303030303030303030372c6769643d666f726765742c706172746974696f6e3d30303030303030303030303030303036353533362c00"], 0x1, 0xc5b, &(0x7f0000001bc0)="$eJzs3U9sHNd9B/DfGy3FldxWTJwqThoHm7ZIZcVy9S+mYhXuqqbZBpBlIRRzC8CVSKkLUyRBUo1spC3TSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9HCRlD0wBYBAhQINpjZt+KSIm1ZJCVK/nxs6rs7897MezPrGZnYNy8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIjfe/nCyVNpixUH7qV2sfsNAgD23KWxr5w8vdX9HwB4bF3Z7v//AQAAAAAAAAAAAACA/SJFEU9GirlLa2miet9Vv9geuHV7fGR062qHUlXzQFW+/KmfOn3m7BefHz7Xy4vtmfepv9s+Ha+OXbnQeGn25tz81MLC1GRjfKZ9bXZy6p63sNP6mx2vDkDj5mu3Jq9fX2icfu7MhtW3h94bfOLo0PnhZ0483Ss7PjI6OrZepN5fvnbfDenaboTHwSjiRKR49rs/Sa3eAx12eCzqD/bcb3ao6sTxqhPjI6NVR6bbrZnFcuXl3oEoIhp9lZq9Y7T1uYjawAPtw/aaEUtl88sGHy+7NzbXmm9dnZ5qXG7NL7YX27Mzl1O3tWV/GlHEuRSxHBGrg3dvbiCKqEWKbx9ZS1fzUz+q4/CFamDw9u14yE/+KNvZGIhYLh6Bc7aPDUYRr0SKn759LK7l60x1rfl8xCtlfj/izTJfjEjlB+NsxLtbfI54NNWiiL8oz//5tTRZXQ9615WLX218eeb6bF/Z3nXlQ94f7rpSPKT7w6FN+WDs82tTPYpoVVf8tXT/f9kBAAAAAAAAAAAAAAAAYLcdiiI+FSle/vc/qsYVRzUu/cj54d8f+uX+MeNPfcB2yrLPRcRScW9jcg/mgYGX0+WUHvJY4o+yehTxx3n83zcfdmMAAAAAAAAAAAAAAAAAAAA+0or4caTBeOdYWo7+OcXbMzcaV1pXp7uzwvbm/u3Nmd7pdDqN1M1mzomcSzmXc67kXM0ZRa6fs5lzIudSzuWcKzlXc8aBXD9nM+dEzqWcyzlXcq7mjFqun7OZcyLnUs7lnCs5V3PGPpm7FwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgcVJEET+PFN/6+lqKFBHNiIno5srgw24dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFAaTEV8L1I0/qB5Z1ktIlL1b9ex8o+z0TxY5sejOVzmi9G8kLNVZa35zYfQfnZmIBXxo0gxWH/rzgnP53+g++7OxyDe/Mb6u0/Xunmgt3LovcEnjh45Pzz62ae2e522asDxi+2ZW7cb4yOjo2N9i2t57x/vWzaU91vsTteJiIXX33itNT09NX//L8qPwH1W753JHez9Qb5ItUemqV7sxouo7YtmPJy+b1B/GBcn9lx5/383Uvz2O//Ru+F37//1+KXuuzt3+PjZn6zf/1/YvKF7vP/XNtfL9//yTrDV/f/JvmUv5L+NDNQi6os35waORtQXXn/jRPtm68bUjamZsydPfml4+EtnTg4cjKhfb09P9b3alcMFAAAAAAAAAAAAAAAA8OCkIn43UrR+tJYaEXG7Gq81dH74mRNPH4gD1XirDeO2Xx27cqHx0uzNufmphYWpycb4TPva7OTUve6uXg33Gh8Z3ZPOfKBDe9z+Q/WXZuden2/f+MPFLdcfrl+4urA437q29eo4FEVEs3/J8arB4yOjVaOn262ZqurlLQfTf3gDqYj/jBTXzjbS5/KyPP5/8wj/DeP/lzZvaBfH/3/28Pr4v4/1FS33mVIRP4sUv/WXT8XnqnYejruOWS73t5Hi+LnP5HJxsCzXa0P3uQLdkYFl2f+NFP/4841le+Mhn1wve+pDHdxHQHn+j0SK7/35d+LX87KNz3/Y+vwf3ryhPXr+wyf6lh3e8LyCHXedfP5PRIoXn3wrfqNa8v/v+/yP3hMbjnULrz+fY4/O/6/2LRvK+/3N3eo8AAAAAAAAAADAI2wgFfF3keIHo7X0fF52L9//m9y8oT36/tcn+5ZN5u//pdj9WU86nc6flvvwzUIAAAAAHicDqYgfR4obi2/dGUO9cfx33/jP31kf/zmSNq2tfs/3K9VzA3bz93/9hvJ+J3bebQAAAAAAAAAAAAAAAAAAANhXUiri+Tyf+kQ1nn9y2/nUVyLFy//9bC6XjpblevPAD1V/1i/Nzpy4MD09W4/F1tXpqcbYXOvaVFn3E5Fi7W8+k+sW1fzqvfnmu3O8r8/FPh8pRv++V7Y7F3tvbvLufOD1TifiVFn2Y5Hiv/5hY9k8NXWeO7ra7umy7F9Hiq/989Zlj66XPVOW/U6k+OHXGr2yh8uyveejfnK97HPXZos9OCsAAAAAAAAAAAAAAAAAAAB81AykIv4sUvzPzeU7Y/nz/P8DfW8rb36jb77/TW5X8/wPVfP/b/f6fub/r54rsLTdXgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4PGUoog3IsXcpbW0Mli+76pfbM/cuj0+Mrp1tUOpqnmgKl/+1E+dPnP2i88Pn+vl+9ffbZ+KV8euXGi8NHtzbn5qYWFqsjE+0742Ozl1z1vYaf3NjlcHoHHztVuT168vNE4/d2bD6ttD7w0+cXTo/PAzJ57ulR0fGR0d6ytTG7jvvd8lbbP8YBTxV5Hi2e/+JP1gMKKInR+LD/js7LVDVSeOV50YHxmtOjLdbs0slisv9w5EEdHoq9TsHaMHcC52pBmxVDa/bPDxsntjc6351tXpqcbl1vxie7E9O3M5dVtb9qcRRZxLEcsRsTp49+YGoojXIsW3j6ylfxmMONA7Dl+4NPaVk6e3b0exh328B2U7GwMRy8UjcM72scEo4p8ixU/fPhb/OhhRi+5PfD7ilTK/H/FmdM93Kj8YZyPe3eJzxKOpFkX8X3n+z6+ltwfL60HvunLxq40vz1yf7Svbu6488veHB2mfX5vqUcQPqyv+Wvo3/10DAAAAAAAAAAAAAAAA7CNF/FqkeOGdY6kaH3xnTHF75kbjSuvqdHdYX2/sX2/MdKfT6TRSN5s5J3Iu5VzOuZJzNWcUuX7OZpn1Tmciv1/KuZxzJedqzmrwb3Q6jQO5fs6JnEs5l3Ou5FzNGbW8/5zNnBM5l3Iu51zJuZoz9snYPQAAAAAAAAAAAAAAAAAA4PFSVP+k+NbX11JnsDu/9ER0c8V8oI+9XwQAAP//Bt7zGQ==") mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) 7.958304445s ago: executing program 2 (id=3045): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180200000008000000000000000000008500000041000000850000002a00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000006c0)={r1, 0x0, 0xc, 0x0, &(0x7f0000000440)="d1fd5b41a5ae09dfdf77a439", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9, 0x8}, 0x50) 7.749970779s ago: executing program 2 (id=3046): syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) 7.531201384s ago: executing program 2 (id=3048): openat$vimc2(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xb, &(0x7f0000000140)=0x7fc, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xfd}}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000000040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b57000000860f5878c37ffe36e1165814d435be5b317c6c8189587d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988ab013f40afe403041323110f62055394412158e7a3adb148d641aa40d4ab077fe34232aa8b31851466d0998a61d7da0c86d700000010"], 0x10b8}, 0xff4c) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCFLSH(r3, 0x4b63, 0x3) 7.529181315s ago: executing program 1 (id=3049): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0x0, 0x0, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000ac0)={r4, 0xd0}, &(0x7f0000000b00)=0x8) r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r5, 0x0, 0x0) write$FUSE_DIRENTPLUS(r5, 0x0, 0xb0) r6 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10) setsockopt$SO_BINDTODEVICE_wg(r6, 0x1, 0x19, &(0x7f0000000080)='wg1\x00', 0x4) r7 = io_uring_setup(0x4c7d, &(0x7f0000000000)={0x0, 0x14af, 0x1, 0x1, 0xfffffffe}) io_uring_register$IORING_REGISTER_BUFFERS2(r7, 0xf, &(0x7f00000004c0)={0x300, 0x0, 0x0, &(0x7f0000000480)=[{0x0}], 0xffffffffffffffff}, 0x20) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000007c0)='./file2\x00', 0x0, &(0x7f0000000780)={[{@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x8}}]}, 0x3, 0x546, &(0x7f0000000180)="$eJzs3dFrZFcZAPDv3mR2s7upmaoPtWAttrKpupOkcdvgQ1UQfSqoFZ+ENSaTEDLJLMmk3YTFpvgqCCJa8EWffBH8AwTpi+8iFOq7qChSs/qg0PbKnbnTTWZnkhRncpfk94Oz9557Zu73ncnOybkzN/cGcGE9GRHTETEWEc9ExFSxPS1K7HdK/rh7B3eX8pJElr30dhJJsa27r8vF8lrxtImI+MZXI76bPBh3e3dvfbHRqG8V9ZnWRvJOlu3dWNtYXK2v1jfn5+eeW3h+4ebC7FD6WY2IF77815/88JdfeeG3n33lT7f+Pv29PK3/Ztmr0dOPYep0vdJ+LbrGI2JrFMFKMt7uYcfNknMBAOB4+Xz/wxHxyfb8fyrG2rM5AAAA4DzJvjAZ7yQRGQAAAHBupRExGUlaK873nSzOWL0WER+Nq2mjud36zEpzZ3M5b4uoRiVdWWvUZ2Oife5ANSpJXp8rzrHt1p/tqc9HxKMR8eOpK+16banZWC77ww8AAAC4IK71HP//eypNa7Wicb/k5AAAAIDhqZadAAAAADByjv8BAADg/Ktmfe7Q9aB09JkAAAAAI/C1F1/MS9a9//Xyy7s7682XbyzXt9drGztLtaXm1u3aarO52r5m38ZJ+2s0m7c/F5s7d2Za9e3WzPbu3q2N5s5m69bakVtgAwAAAGfo0U+88cckIvY/f6VdcpeKtkpENnb4weNlZAiMygc6p+cvo8sDOHuHf79fKTEP4OyZ0sPFVSk7AaB0J/0B0MCTd34//FwAAIDRuP6xwd//v71SamrAiBXf/yenugAIcK6MlZ0AUJrO93/vZR1lZwOcpcpxMwAHBXDupcP5/v+EUwkTAwoAAJRssl2StFYcB0xGmtZqEY+0bwtYSVbWGvXZiPhQRLw1Vbmc1+faz0zM5gEAAAAAAAAAAAAAAAAAAAAAAADglLIsiQwAAAA41yLSv3XvzHV96unJ3s8HLiX/mWovI+KVn7300zuLrdbWXL79n+9vb71ebH+2jE8wAAAAgF7d4/TucTwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADNO9g7tL97Isyw7uLp1l3H98KSKqRfyidFrGY6K9nIhKRFz9VxLjh56XRMTYEOLvvxYRj/WLn+RpRbXI4kj8SxFpRFwZVvz4gPGjE//aEOLDRfZGPv58sd/7L40n28v+77/xovy/Bo9/6fvj39iA8e+RQTutHK0+/uavZwbGfy3i8fH+4083fpLvr0/8p07Zx+98c29vUFv2i4jr/ca/5GismdbG7Znt3b0baxuLq/XV+ub8/NxzC88v3FyYnVlZa9SLf/vG+NHHf/Pe/dq7D/T/6jHjb7v/A17/p0/Z/3ffvHPwkc5qz08mKvHzLJt+qv/P/7F88en+8fP/E58qfg/k7flrmL7+rb7xn/jVH54YlFve/+UB/Z/o6f/lnv5Pn7L/z3z9+38+5UMBgDOwvbu3vtho1LesHF6J6kORxsO7ks87S08jiSTylbeONC2Wn1hn5dXiPbbY6L7bhrTn3xUHR6NMvqTxCAAAGJ37k/7elqSchAAAAAAAAAAAAAAAAAAAAOACOvEyYIOa0oi4v+XbPzjmamS9MffL6SoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwLH+FwAA//8tudaU") sendto$inet(r6, &(0x7f0000000040)="e5", 0xffffffe4, 0x0, 0x0, 0x0) 6.413527729s ago: executing program 2 (id=3051): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x187) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)) chdir(&(0x7f00000003c0)='./bus\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r0, 0x402, 0x80000020) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) ptrace(0x10, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) setsockopt$inet6_opts(r4, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x18) connect$inet6(r4, &(0x7f0000000240)={0xa, 0x6e23, 0x2, @mcast1, 0x9}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000001840), 0x3b, 0x0) 5.727797804s ago: executing program 1 (id=3052): mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x187) mount$overlay(0x0, 0x0, &(0x7f0000000440), 0x8, &(0x7f0000000080)) chdir(&(0x7f00000003c0)='./bus\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r0, 0x402, 0x80000020) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6(0xa, 0x802, 0x0) sendmsg$can_j1939(r0, 0x0, 0xe330984c9d8178f2) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x4e24, @private=0xa010101}]}, &(0x7f0000000440)=0x10) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r4, 0x84, 0x79, &(0x7f0000000100)={r5, 0x1, 0x5}, 0x8) 4.55178081s ago: executing program 3 (id=3054): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180200000008000000000000000000008500000041000000850000002a00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000006c0)={r1, 0x0, 0xc, 0x0, &(0x7f0000000440)="d1fd5b41a5ae09dfdf77a439", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9, 0x8}, 0x50) 4.310010806s ago: executing program 3 (id=3055): getpriority(0x1, 0x0) ioctl$XFS_IOC_GETBMAP(0xffffffffffffffff, 0xc0205826, &(0x7f0000000040)={0x8000000000000001, 0x2, 0x7, 0x3, 0x10001}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) dup(0xffffffffffffffff) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x40000) pread64(0xffffffffffffffff, &(0x7f0000000180)=""/43, 0xfd8a, 0x3c) 3.284733978s ago: executing program 3 (id=3056): syz_mount_image$ext4(&(0x7f0000000100)='ext3\x00', &(0x7f0000000040)='./file0\x00', 0x1000081, &(0x7f00000000c0), 0x6, 0x595, &(0x7f0000000840)="$eJzs3U9sHFcZAPBvJnZ2nTgkhR4KAhpKIaCq69hpo4pLywUJqgqkwqmH1LI3VuR1NvKuS20sYZ84cEWiEie4cOHEoRIHpJ4QV25w41IOSBGKQDUSQlPN7Gyyu911NvGfrePfTxrtm5m387038r4388a7L4BT63JE7ETE2Yh4OyIuRlJsT8olXusseb6P7m0v7d3bXkoiy97811R5hO2lbv6u8xHxs+5K5cH2nmS0NrdWFxuN+nq5PtdeuzPX2tx68dba4kp9pX57YeH6/PWrr1x7eeHQ6vrs2u/vfufW6z/64x++9OFfdr75k7zMr5b78rr1ZE2yLDt4wFe752U6ZstNaUTkZ+71gx/9U+FMWZ+zky4IjyX/e/xsRDxXpu+rTq5MAMDRyrKLkV3sXe9Io7P0SgbyAAAnU37PPxtJWivv/2cjTWu1Ygyv+nScSxvNVvuFm82N20l3iG86vXmrUb9ajBVGVGI6ydfnI+JSsXTWFwbWr0XEUxHxi8pMsV5bajaWJ3LFAwCcH+j//1PJ+//KOG/1hAAATjI9OQCcPp/s/6cnUg4A4Pi4/weA06en/x/ryT8AcPJVB777P1SWHEtZAIDjMXT8/60LD9LPJAM/8QUAnHSe/wPAqfKDN97Il2wvS4rfv15+Z3NjtfnOi8v11mptbWOpttRcv1NbaTZXit/sWRtyiN3elUazeWf+pdh4d65db7XnWptbN9aaG7fbN4rf9b5R98UCAJi8p5794G9JROx8a6ZYojuXw8P/IQA44dKImUmXAZiMM5MuADAxUx7/wallPB542D/3Dr1GmImI90ZnMLAAn25XPj9i/H/w2qD/ecD/D2F2bGDCyo/11KTLARy/g43/Gz2Ak2z/jt+TAXiSZVliPn8AOGXGuIMfPkTw08O/FgEm47Ge/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMApN1ssSVor5wKfjTSt1SIuRMSlmE5u3mrUr0bEZyLir5XpSr4+P+lCAwAHlP4zKef/unLx+dnBvWeT/1aK14j48a/e/OW7i+3u1IH3t7ffK7a31xeGBqgcfR0AgB5Tgxu6/XTx2nMj/9G97aXucpwFvPvtzuSiedy9e9tLD+YjnioLX41827l/J32VSUZOTPxodnYj4pnB+qf3918qZz4djJ/HvnBk8aOo4Wxf/P7LqLTY13nNz8XnZsaMdwhlhifFB3n789qwz18al4vX8vM31d+YVuPnn2xcH0O3/dvLOu3fXk/8/Pjfv1At2pph7d/lcWO89Kfvjty3eyb7wlREN/ZeT/vTUS1Sw+I/P2b8v3/xy8+NOlnZryOuxH7xO6m59tqdudbm1u++9/6fV+or9dsLC9fnr1995drLC3PFGPVcd6S61NM57Nc03t2NODcifvUh9f/amPX/zf/efusr+8T/xleHxU/j6X3i533i12N9rPiL594fOX13Hn95RP2n+uKf7Xtfvu2FwYON+IP88B9by2MVFAA4Fq3NrdXFRqO+Pk4ija3Vxe7V1Njv6kvMPNa7xkzEkR15eGK67yRUjyrW+RG7fvvIB5yOYz0/h5bYfYTMlckU9Uw0urccD81c5ts5SNAsO0CZL5eJdJ88E2qQgGPz4EM/6ZIAAAAAAAAAAAAAAACjtH5Y/uTfIX8pqvfLcJOuIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE+ujwMAAP//IhjD+Q==") prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x88}, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000100)={0x5, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r4) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r5, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r7 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)) r8 = accept(r4, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) recvfrom(r6, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x4) 3.229308849s ago: executing program 2 (id=3057): syz_mount_image$reiserfs(&(0x7f0000000100), &(0x7f0000000580)='./file1\x00', 0x8488, &(0x7f00000005c0), 0xfe, 0x1101, &(0x7f0000001640)="$eJzs2T+LE0EYB+Df7MZ/VWSvXwQtLOS4I36BKxTSWtuIXOVVl0rx4/hx9AqxP67X4sB+ZU02UQkEkqgcPA8s8+7LO7vvlDMTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6I2SryU5qJJmyFVJStK2F9OrJO2Qv/+xrlLy4nQ6e3Y+eT5LUv8sL/eGkpKkOX54t5k0k+a4eXpw8ujT7O27N6/Ozk7PlzVtLq/3v5Sy6AcAAAD4Xbezz//5/wAAAMAmeztIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANhSN17FzRBUSUrSthfTqyTtmnm3/lF/AAAAwO5Kqrwcr8vPjwFWnuTLuCzz/fi99PFRPqyZv1G1fc8AAABww3V3FsGv9+vl9mo//jij5da5zz3IKIeH8/fFkG8nSZ3k6I+PX16/fz08pav/9loAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOAHO3AsAAAAACDM3zqNjg0AAAAAAAAAAAAAAAAAAGCvAAAA///e69c/") ftruncate(0xffffffffffffffff, 0x8008976) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, 0xffffffffffffffff, 0x0) syz_mount_image$udf(&(0x7f0000000f00), &(0x7f00000000c0)='./file0\x00', 0xa00004, &(0x7f0000000140)=ANY=[@ANYBLOB='adinicb,nostrict,utf8,uid=', @ANYRESDEC=0x0, @ANYBLOB="2c6e6f7672732c6769643d6660726765742c6d6f64653d303030303030303030303030303030303030303020caa41f0d9182cfcc3031302c696f636861727365743d69736f383835392d31342c6164696e6963622c696f636861727365743d6d61636379ff076c6c69632c6c617374626c6f636b3d30303030303030303030303030303030303030372c6769643d666f726765742c706172746974696f6e3d30303030303030303030303030303036353533362c00"], 0x1, 0xc5b, &(0x7f0000001bc0)="$eJzs3U9sHNd9B/DfGy3FldxWTJwqThoHm7ZIZcVy9S+mYhXuqqbZBpBlIRRzC8CVSKkLUyRBUo1spC3TSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9HCRlD0wBYBAhQINpjZt+KSIm1ZJCVK/nxs6rs7897MezPrGZnYNy8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIjfe/nCyVNpixUH7qV2sfsNAgD23KWxr5w8vdX9HwB4bF3Z7v//AQAAAAAAAAAAAACA/SJFEU9GirlLa2miet9Vv9geuHV7fGR062qHUlXzQFW+/KmfOn3m7BefHz7Xy4vtmfepv9s+Ha+OXbnQeGn25tz81MLC1GRjfKZ9bXZy6p63sNP6mx2vDkDj5mu3Jq9fX2icfu7MhtW3h94bfOLo0PnhZ0483Ss7PjI6OrZepN5fvnbfDenaboTHwSjiRKR49rs/Sa3eAx12eCzqD/bcb3ao6sTxqhPjI6NVR6bbrZnFcuXl3oEoIhp9lZq9Y7T1uYjawAPtw/aaEUtl88sGHy+7NzbXmm9dnZ5qXG7NL7YX27Mzl1O3tWV/GlHEuRSxHBGrg3dvbiCKqEWKbx9ZS1fzUz+q4/CFamDw9u14yE/+KNvZGIhYLh6Bc7aPDUYRr0SKn759LK7l60x1rfl8xCtlfj/izTJfjEjlB+NsxLtbfI54NNWiiL8oz//5tTRZXQ9615WLX218eeb6bF/Z3nXlQ94f7rpSPKT7w6FN+WDs82tTPYpoVVf8tXT/f9kBAAAAAAAAAAAAAAAAYLcdiiI+FSle/vc/qsYVRzUu/cj54d8f+uX+MeNPfcB2yrLPRcRScW9jcg/mgYGX0+WUHvJY4o+yehTxx3n83zcfdmMAAAAAAAAAAAAAAAAAAAA+0or4caTBeOdYWo7+OcXbMzcaV1pXp7uzwvbm/u3Nmd7pdDqN1M1mzomcSzmXc67kXM0ZRa6fs5lzIudSzuWcKzlXc8aBXD9nM+dEzqWcyzlXcq7mjFqun7OZcyLnUs7lnCs5V3PGPpm7FwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgcVJEET+PFN/6+lqKFBHNiIno5srgw24dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFAaTEV8L1I0/qB5Z1ktIlL1b9ex8o+z0TxY5sejOVzmi9G8kLNVZa35zYfQfnZmIBXxo0gxWH/rzgnP53+g++7OxyDe/Mb6u0/Xunmgt3LovcEnjh45Pzz62ae2e522asDxi+2ZW7cb4yOjo2N9i2t57x/vWzaU91vsTteJiIXX33itNT09NX//L8qPwH1W753JHez9Qb5ItUemqV7sxouo7YtmPJy+b1B/GBcn9lx5/383Uvz2O//Ru+F37//1+KXuuzt3+PjZn6zf/1/YvKF7vP/XNtfL9//yTrDV/f/JvmUv5L+NDNQi6os35waORtQXXn/jRPtm68bUjamZsydPfml4+EtnTg4cjKhfb09P9b3alcMFAAAAAAAAAAAAAAAA8OCkIn43UrR+tJYaEXG7Gq81dH74mRNPH4gD1XirDeO2Xx27cqHx0uzNufmphYWpycb4TPva7OTUve6uXg33Gh8Z3ZPOfKBDe9z+Q/WXZuden2/f+MPFLdcfrl+4urA437q29eo4FEVEs3/J8arB4yOjVaOn262ZqurlLQfTf3gDqYj/jBTXzjbS5/KyPP5/8wj/DeP/lzZvaBfH/3/28Pr4v4/1FS33mVIRP4sUv/WXT8XnqnYejruOWS73t5Hi+LnP5HJxsCzXa0P3uQLdkYFl2f+NFP/4841le+Mhn1wve+pDHdxHQHn+j0SK7/35d+LX87KNz3/Y+vwf3ryhPXr+wyf6lh3e8LyCHXedfP5PRIoXn3wrfqNa8v/v+/yP3hMbjnULrz+fY4/O/6/2LRvK+/3N3eo8AAAAAAAAAADAI2wgFfF3keIHo7X0fF52L9//m9y8oT36/tcn+5ZN5u//pdj9WU86nc6flvvwzUIAAAAAHicDqYgfR4obi2/dGUO9cfx33/jP31kf/zmSNq2tfs/3K9VzA3bz93/9hvJ+J3bebQAAAAAAAAAAAAAAAAAAANhXUiri+Tyf+kQ1nn9y2/nUVyLFy//9bC6XjpblevPAD1V/1i/Nzpy4MD09W4/F1tXpqcbYXOvaVFn3E5Fi7W8+k+sW1fzqvfnmu3O8r8/FPh8pRv++V7Y7F3tvbvLufOD1TifiVFn2Y5Hiv/5hY9k8NXWeO7ra7umy7F9Hiq/989Zlj66XPVOW/U6k+OHXGr2yh8uyveejfnK97HPXZos9OCsAAAAAAAAAAAAAAAAAAAB81AykIv4sUvzPzeU7Y/nz/P8DfW8rb36jb77/TW5X8/wPVfP/b/f6fub/r54rsLTdXgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4PGUoog3IsXcpbW0Mli+76pfbM/cuj0+Mrp1tUOpqnmgKl/+1E+dPnP2i88Pn+vl+9ffbZ+KV8euXGi8NHtzbn5qYWFqsjE+0742Ozl1z1vYaf3NjlcHoHHztVuT168vNE4/d2bD6ttD7w0+cXTo/PAzJ57ulR0fGR0d6ytTG7jvvd8lbbP8YBTxV5Hi2e/+JP1gMKKInR+LD/js7LVDVSeOV50YHxmtOjLdbs0slisv9w5EEdHoq9TsHaMHcC52pBmxVDa/bPDxsntjc6351tXpqcbl1vxie7E9O3M5dVtb9qcRRZxLEcsRsTp49+YGoojXIsW3j6ylfxmMONA7Dl+4NPaVk6e3b0exh328B2U7GwMRy8UjcM72scEo4p8ixU/fPhb/OhhRi+5PfD7ilTK/H/FmdM93Kj8YZyPe3eJzxKOpFkX8X3n+z6+ltwfL60HvunLxq40vz1yf7Svbu6488veHB2mfX5vqUcQPqyv+Wvo3/10DAAAAAAAAAAAAAAAA7CNF/FqkeOGdY6kaH3xnTHF75kbjSuvqdHdYX2/sX2/MdKfT6TRSN5s5J3Iu5VzOuZJzNWcUuX7OZpn1Tmciv1/KuZxzJedqzmrwb3Q6jQO5fs6JnEs5l3Ou5FzNGbW8/5zNnBM5l3Iu51zJuZoz9snYPQAAAAAAAAAAAAAAAAAA4PFSVP+k+NbX11JnsDu/9ER0c8V8oI+9XwQAAP//Bt7zGQ==") mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) 2.26140567s ago: executing program 1 (id=3058): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000040), 0x40000000e, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000000)={0x3e, 0x2, 0x457f1c9146f8f874, "464905e100000000000000007f00", 0x41495043}) 2.203404081s ago: executing program 3 (id=3059): openat$vimc2(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xb, &(0x7f0000000140)=0x7fc, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xfd}}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000000040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b57000000860f5878c37ffe36e1165814d435be5b317c6c8189587d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988ab013f40afe403041323110f62055394412158e7a3adb148d641aa40d4ab077fe34232aa8b31851466d0998a61d7da0c86d700000010"], 0x10b8}, 0xff4c) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCFLSH(r3, 0x4b63, 0x3) 1.255238133s ago: executing program 1 (id=3060): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x2000c16, &(0x7f0000000280)={[{@usrquota}, {@nodelalloc}]}, 0xff, 0x25e, &(0x7f0000000e80)="$eJzs3U1IHGcYB/BnZndr1aXY9lIo/YBSSiuIvRV6sZcWhCJSSqEtWErppUULVulNe8olh+QYkuApFwm5xeQYvEguCYGcTOLBXAKJ5BDJIQnZsDsr+JVo3HUnZH4/WOfDd97nHWb+74g4GEBh9UXEUESUIqI/IioRkWxu8HH26WtuznUvjUXUaj/cTxrtsu3MxnG9ETEbEV9FxGKaxF/liOmFX1YfLn/32dGpyqdnFn7u7uhJNq2trny/fnrkyPnhL6evXr87ksRQVLecV/slu+wrJxHvHEaxV0RSznsE7Mfof+du1HP/bkR80sh/JdLILt6xyTcWK/HFqecde/zetfc7OVag/Wq1Sv0ZOFsDCieNiGok6UBEZOtpOjCQ/Qx/s9ST/j0x+W//nxNT43/kPVMB7VKNWPn2YteF3m35v1PK8g+8prJfSq38ODp/q76yXsp7QEBHfJAt6s///t9mPg/5h8KRfygu+Yfikn8oLvmH4pJ/KC75h4J42vxjv0275B+KS/6huA6c/xNPDm9QQEdszj8AUCy1rgO9Ndzel5CBXOQ9/wAAAAAAAAAAAAAAAAAAADvNdS+NbXza02N5zxaXT0asfZM13Vm/1Ph/xBFvNr72PEi29Jjsq8KL/fpRix206GzOb1+/dTvf+lc+zLf+zHjE7P8RMVgu77z/kub9d3Bv7/H9yu8tFnhJybbtr3/qbP3tHs/nW394OeJSff4Z3G3+SeO9xnL3+adav34t1v/nUYsdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0DHPAgAA///B2nXP") r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x101042, 0x45) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000140)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x101042, 0x65) pwrite64(r1, &(0x7f0000000000)='2', 0x1, 0x4fed0) r2 = socket(0x840000000002, 0x3, 0x100) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r2, &(0x7f0000005240), 0x4000095, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x129042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) timerfd_create(0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x8a141, 0x59) ioctl$EXT4_IOC_MIGRATE(r4, 0x6609) 1.091984746s ago: executing program 3 (id=3061): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setparam(r0, &(0x7f00000006c0)=0x4) socket$nl_route(0x10, 0x3, 0x0) io_uring_setup(0x4a86, 0x0) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0xffffffff}, 0x10) r4 = socket(0x1e, 0x4, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f00000001c0)=@req3={0x897d, 0x100000, 0x8, 0x8000, 0x3, 0x0, 0x1}, 0x1c) sendmmsg(r3, &(0x7f0000003240), 0x4000000000000e4, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r5, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000000080)={0x50, 0x0, r6, {0x7, 0x29, 0x9, 0xffffffff90adedc4, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x10}}, 0x50) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x18) syz_fuse_handle_req(r5, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getdents64(r7, &(0x7f0000000100)=""/134, 0x86) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r5, 0x80047210, 0x0) 1.034767927s ago: executing program 2 (id=3062): socket$inet6_mptcp(0xa, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = syz_open_dev$evdev(0x0, 0x1, 0x80) fcntl$setstatus(r4, 0x4, 0x2c00) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @local}], 0x10) setsockopt(r3, 0x84, 0x81, &(0x7f0000000280)="5a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f0000000080), 0x1) sendmsg$inet_sctp(r3, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000000)='M', 0x1}], 0x1}, 0x1) 992.218339ms ago: executing program 4 (id=3063): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180200000008000000000000000000008500000041000000850000002a00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000006c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000440)="d1fd5b41a5ae09dfdf77a4392cd8", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9, 0x8}, 0x50) 109.185878ms ago: executing program 3 (id=3064): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x187) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)) chdir(&(0x7f00000003c0)='./bus\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r0, 0x402, 0x80000020) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) ptrace(0x10, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r5, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) sendmsg$can_j1939(r0, &(0x7f0000000380)={&(0x7f0000000180)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x1}, 0xff}, 0x18, &(0x7f0000000340)={&(0x7f0000000280)="e2f9f47938d473cb857b1be39978cc1db64371b2f834b236828acb6e15ba29fef2c717736797952b6052a4f1312dfc62cef0f249be1b45d8b63ce71e093a7b7d36a062c6bc3eccecf4c9c163f97da659b0", 0x51}, 0x1, 0x0, 0x0, 0x800}, 0xe330984c9d8178f2) setsockopt$inet6_opts(r5, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x18) connect$inet6(r5, &(0x7f0000000240)={0xa, 0x6e23, 0x2, @mcast1, 0x9}, 0x1c) sendmmsg$inet6(r5, &(0x7f0000001840), 0x3b, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./file1\x00', 0x14927e, 0xa0) 0s ago: executing program 4 (id=3065): getpriority(0x1, 0x0) ioctl$XFS_IOC_GETBMAP(0xffffffffffffffff, 0xc0205826, &(0x7f0000000040)={0x8000000000000001, 0x2, 0x7, 0x3, 0x10001}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) dup(0xffffffffffffffff) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x40000) pread64(0xffffffffffffffff, &(0x7f0000000180)=""/43, 0xfd8a, 0x3c) kernel console output (not intermixed with test programs): T5787] [ 527.214311][ T789] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 527.250881][ T5787] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 527.266677][ T5787] Bluetooth: hci3: failed to register connection device [ 527.383882][T13756] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 527.648953][ T789] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 527.677214][ T789] usb 2-1: can't read configurations, error -61 [ 527.713227][T14212] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 527.865120][ T789] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 528.084258][ T789] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 528.487427][ T789] usb 2-1: can't read configurations, error -61 [ 528.494634][ T789] usb usb2-port1: attempt power cycle [ 529.438593][T14237] 9pnet_fd: Insufficient options for proto=fd [ 529.466436][T14213] Bluetooth: hci3: command tx timeout [ 529.835280][T14242] overlayfs: missing 'lowerdir' [ 530.064311][T14246] loop3: detected capacity change from 0 to 164 [ 530.075912][T14213] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 530.089812][T14213] CPU: 0 PID: 14213 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 530.097515][T14213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 530.107604][T14213] Workqueue: hci3 hci_rx_work [ 530.112326][T14213] Call Trace: [ 530.115629][T14213] [ 530.118581][T14213] dump_stack_lvl+0x18c/0x250 [ 530.123293][T14213] ? show_regs_print_info+0x20/0x20 [ 530.128521][T14213] ? load_image+0x420/0x420 [ 530.133063][T14213] sysfs_create_dir_ns+0x26e/0x2a0 [ 530.138290][T14213] ? __lock_acquire+0x7d80/0x7d80 [ 530.143339][T14213] ? sysfs_warn_dup+0xa0/0xa0 [ 530.148048][T14213] ? do_raw_spin_unlock+0x121/0x230 [ 530.153328][T14213] kobject_add_internal+0x617/0xc90 [ 530.158574][T14213] kobject_add+0x164/0x240 [ 530.163022][T14213] ? preempt_schedule_thunk+0x1a/0x30 [ 530.168443][T14213] ? kobject_init+0x1d0/0x1d0 [ 530.173159][T14213] ? get_device_parent+0x366/0x390 [ 530.178307][T14213] device_add+0x3fa/0xc40 [ 530.182667][T14213] hci_conn_add_sysfs+0xd5/0x1e0 [ 530.187639][T14213] le_conn_complete_evt+0xe9f/0x1480 [ 530.192965][T14213] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 530.199245][T14213] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 530.204911][T14213] ? mutex_unlock+0x10/0x10 [ 530.209449][T14213] ? skb_pull_data+0xf0/0x1f0 [ 530.214176][T14213] hci_le_conn_complete_evt+0x187/0x440 [ 530.219776][T14213] ? hci_remote_host_features_evt+0x150/0x150 [ 530.225897][T14213] hci_event_packet+0x7b4/0x1280 [ 530.230878][T14213] ? __lock_acquire+0x7d80/0x7d80 [ 530.235945][T14213] ? lock_chain_count+0x20/0x20 [ 530.241010][T14213] ? bis_list+0x290/0x290 [ 530.245389][T14213] ? lockdep_hardirqs_on+0x98/0x150 [ 530.250623][T14213] ? hci_send_to_monitor+0xd7/0x4f0 [ 530.255857][T14213] hci_rx_work+0x43a/0xd60 [ 530.260314][T14213] ? process_scheduled_works+0x975/0x1600 [ 530.266079][T14213] process_scheduled_works+0xa60/0x1600 [ 530.271680][T14213] ? worker_attach_to_pool+0x370/0x370 [ 530.277219][T14213] ? assign_work+0x3cc/0x5d0 [ 530.281860][T14213] worker_thread+0xa5e/0xfe0 [ 530.286499][T14213] ? _raw_spin_unlock_irqrestore+0xc0/0x120 [ 530.292429][T14213] ? _raw_spin_unlock+0x40/0x40 [ 530.297315][T14213] ? __kthread_parkme+0x71/0x1c0 [ 530.302289][T14213] kthread+0x2fa/0x390 [ 530.306387][T14213] ? pr_cont_work+0x550/0x550 [ 530.311101][T14213] ? kthread_blkcg+0xd0/0xd0 [ 530.315800][T14213] ret_from_fork+0x48/0x80 [ 530.320246][T14213] ? kthread_blkcg+0xd0/0xd0 [ 530.324859][T14213] ret_from_fork_asm+0x11/0x20 [ 530.329665][T14213] [ 530.921920][T14213] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 530.948349][T14213] Bluetooth: hci3: failed to register connection device [ 531.883247][T14273] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 532.478691][T14276] overlayfs: missing 'lowerdir' [ 533.035294][ T5780] Bluetooth: hci3: command tx timeout [ 533.589668][T14281] tipc: Enabling of bearer rejected, failed to enable media [ 534.110037][T14293] loop3: detected capacity change from 0 to 256 [ 534.118878][T14293] exfat: Deprecated parameter 'utf8' [ 534.146967][T14293] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0x1a9973fb, utbl_chksum : 0xe619d30d) [ 534.534551][T14300] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 534.783669][T14303] loop1: detected capacity change from 0 to 164 [ 535.963989][T14309] overlayfs: missing 'lowerdir' [ 537.532416][T14322] loop3: detected capacity change from 0 to 512 [ 537.637568][T14322] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 537.650492][T14322] ext4 filesystem being mounted at /58/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 537.882469][T13469] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 538.035898][T14331] loop3: detected capacity change from 0 to 8 [ 538.133298][T14331] SQUASHFS error: zlib decompression failed, data probably corrupt [ 538.157112][T14331] SQUASHFS error: Failed to read block 0x4e8: -5 [ 538.168935][ T27] audit: type=1800 audit(1782961584.363:5): pid=14331 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2537" name="file1" dev="loop3" ino=5 res=0 errno=0 [ 538.336264][T14334] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 538.352246][T14337] loop3: detected capacity change from 0 to 1024 [ 538.394131][T14337] hfsplus: Filesystem was not cleanly unmounted, running fsck.hfsplus is recommended. mounting read-only. [ 538.724098][T14340] loop3: detected capacity change from 0 to 512 [ 538.827013][T14340] EXT4-fs error (device loop3): ext4_orphan_get:1404: inode #15: comm syz.3.2539: iget: bad i_size value: 38620345925642 [ 538.882484][T14340] EXT4-fs error (device loop3): ext4_orphan_get:1409: comm syz.3.2539: couldn't read orphan inode 15 (err -117) [ 538.942098][T14340] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 539.845600][T13469] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 540.323621][T14353] loop1: detected capacity change from 0 to 164 [ 540.333697][ T5780] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 540.343463][ T5780] CPU: 1 PID: 5780 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 540.351049][ T5780] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 540.361141][ T5780] Workqueue: hci4 hci_rx_work [ 540.365861][ T5780] Call Trace: [ 540.369163][ T5780] [ 540.372124][ T5780] dump_stack_lvl+0x18c/0x250 [ 540.376850][ T5780] ? show_regs_print_info+0x20/0x20 [ 540.382084][ T5780] ? load_image+0x420/0x420 [ 540.386624][ T5780] sysfs_create_dir_ns+0x26e/0x2a0 [ 540.391779][ T5780] ? __lock_acquire+0x7d80/0x7d80 [ 540.396840][ T5780] ? sysfs_warn_dup+0xa0/0xa0 [ 540.401561][ T5780] ? do_raw_spin_unlock+0x121/0x230 [ 540.406796][ T5780] kobject_add_internal+0x617/0xc90 [ 540.412022][ T5780] kobject_add+0x164/0x240 [ 540.416464][ T5780] ? kobject_init+0x1d0/0x1d0 [ 540.421157][ T5780] ? get_device_parent+0x366/0x390 [ 540.426285][ T5780] device_add+0x3fa/0xc40 [ 540.430629][ T5780] hci_conn_add_sysfs+0xd5/0x1e0 [ 540.435596][ T5780] le_conn_complete_evt+0xe9f/0x1480 [ 540.440902][ T5780] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 540.447158][ T5780] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 540.452852][ T5780] ? mutex_unlock+0x10/0x10 [ 540.457366][ T5780] ? skb_pull_data+0xf0/0x1f0 [ 540.462054][ T5780] hci_le_conn_complete_evt+0x187/0x440 [ 540.467703][ T5780] ? hci_remote_host_features_evt+0x150/0x150 [ 540.473792][ T5780] hci_event_packet+0x7b4/0x1280 [ 540.478756][ T5780] ? __lock_acquire+0x7d80/0x7d80 [ 540.483793][ T5780] ? lock_chain_count+0x20/0x20 [ 540.488649][ T5780] ? bis_list+0x290/0x290 [ 540.493028][ T5780] ? lockdep_hardirqs_on+0x98/0x150 [ 540.498238][ T5780] ? hci_send_to_monitor+0xd7/0x4f0 [ 540.503449][ T5780] hci_rx_work+0x43a/0xd60 [ 540.507893][ T5780] ? process_scheduled_works+0x975/0x1600 [ 540.513625][ T5780] process_scheduled_works+0xa60/0x1600 [ 540.519200][ T5780] ? worker_attach_to_pool+0x370/0x370 [ 540.524674][ T5780] ? assign_work+0x3cc/0x5d0 [ 540.529280][ T5780] worker_thread+0xa5e/0xfe0 [ 540.533899][ T5780] kthread+0x2fa/0x390 [ 540.537968][ T5780] ? pr_cont_work+0x550/0x550 [ 540.542651][ T5780] ? kthread_blkcg+0xd0/0xd0 [ 540.547243][ T5780] ret_from_fork+0x48/0x80 [ 540.551668][ T5780] ? kthread_blkcg+0xd0/0xd0 [ 540.556263][ T5780] ret_from_fork_asm+0x11/0x20 [ 540.561045][ T5780] [ 540.573103][ T5780] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 540.587326][ T5780] Bluetooth: hci4: failed to register connection device [ 541.335019][T13756] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 541.495551][T14364] overlayfs: missing 'lowerdir' [ 542.638246][ T5780] Bluetooth: hci4: command tx timeout [ 543.259903][T14377] loop3: detected capacity change from 0 to 512 [ 543.330996][T14377] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 543.339647][T14377] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 543.350665][T14377] System zones: 0-1, 15-15, 18-18, 34-34 [ 543.356841][T14377] EXT4-fs (loop3): orphan cleanup on readonly fs [ 543.363304][T14377] Quota error (device loop3): v2_read_header: Failed header read: expected=8 got=0 [ 543.372762][T14377] EXT4-fs warning (device loop3): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 543.387400][T14377] EXT4-fs (loop3): Cannot turn on quotas: error -22 [ 543.404750][T14377] EXT4-fs (loop3): 1 truncate cleaned up [ 543.411701][T14377] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 543.758180][T13469] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 543.790623][T14362] loop2: detected capacity change from 0 to 40427 [ 543.869572][T14362] F2FS-fs (loop2): invalid crc value [ 543.959617][T14362] F2FS-fs (loop2): Found nat_bits in checkpoint [ 545.203853][T14362] F2FS-fs (loop2): Start checkpoint disabled! [ 545.358041][T14393] loop1: detected capacity change from 0 to 164 [ 545.372719][ T5780] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 545.382343][ T5780] CPU: 1 PID: 5780 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 545.389926][ T5780] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 545.400016][ T5780] Workqueue: hci4 hci_rx_work [ 545.404727][ T5780] Call Trace: [ 545.408039][ T5780] [ 545.410991][ T5780] dump_stack_lvl+0x18c/0x250 [ 545.415713][ T5780] ? show_regs_print_info+0x20/0x20 [ 545.420940][ T5780] ? load_image+0x420/0x420 [ 545.425468][ T5780] sysfs_create_dir_ns+0x26e/0x2a0 [ 545.430585][ T5780] ? __lock_acquire+0x7d80/0x7d80 [ 545.435617][ T5780] ? sysfs_warn_dup+0xa0/0xa0 [ 545.440303][ T5780] ? do_raw_spin_unlock+0x121/0x230 [ 545.445513][ T5780] kobject_add_internal+0x617/0xc90 [ 545.450723][ T5780] kobject_add+0x164/0x240 [ 545.455153][ T5780] ? kobject_init+0x1d0/0x1d0 [ 545.459841][ T5780] ? get_device_parent+0x366/0x390 [ 545.464966][ T5780] device_add+0x3fa/0xc40 [ 545.469340][ T5780] hci_conn_add_sysfs+0xd5/0x1e0 [ 545.474290][ T5780] le_conn_complete_evt+0xe9f/0x1480 [ 545.479589][ T5780] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 545.485837][ T5780] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 545.491485][ T5780] ? mutex_unlock+0x10/0x10 [ 545.495996][ T5780] ? skb_pull_data+0xf0/0x1f0 [ 545.500686][ T5780] hci_le_conn_complete_evt+0x187/0x440 [ 545.506285][ T5780] ? hci_remote_host_features_evt+0x150/0x150 [ 545.512363][ T5780] hci_event_packet+0x7b4/0x1280 [ 545.517310][ T5780] ? __lock_acquire+0x7d80/0x7d80 [ 545.522364][ T5780] ? lock_chain_count+0x20/0x20 [ 545.527216][ T5780] ? bis_list+0x290/0x290 [ 545.531553][ T5780] ? lockdep_hardirqs_on+0x98/0x150 [ 545.536759][ T5780] ? hci_send_to_monitor+0xd7/0x4f0 [ 545.541965][ T5780] hci_rx_work+0x43a/0xd60 [ 545.546393][ T5780] ? process_scheduled_works+0x975/0x1600 [ 545.552127][ T5780] process_scheduled_works+0xa60/0x1600 [ 545.557700][ T5780] ? worker_attach_to_pool+0x370/0x370 [ 545.563169][ T5780] ? assign_work+0x3cc/0x5d0 [ 545.567769][ T5780] worker_thread+0xa5e/0xfe0 [ 545.572385][ T5780] kthread+0x2fa/0x390 [ 545.576455][ T5780] ? pr_cont_work+0x550/0x550 [ 545.581140][ T5780] ? kthread_blkcg+0xd0/0xd0 [ 545.585729][ T5780] ret_from_fork+0x48/0x80 [ 545.590179][ T5780] ? kthread_blkcg+0xd0/0xd0 [ 545.594787][ T5780] ret_from_fork_asm+0x11/0x20 [ 545.599579][ T5780] [ 545.605010][ T5780] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 545.619134][ T5780] Bluetooth: hci4: failed to register connection device [ 545.711605][T13753] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 545.769830][T14213] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 545.780972][T14213] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 545.790300][T14213] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 545.804107][T14213] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 545.820888][T14213] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 545.836320][T14213] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 545.919930][T14399] Bluetooth: MGMT ver 1.22 [ 546.274642][T14401] loop3: detected capacity change from 0 to 32768 [ 546.331825][T14401] XFS (loop3): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 546.503216][T14401] XFS (loop3): Ending clean mount [ 546.530855][T14401] XFS (loop3): Quotacheck needed: Please wait. [ 546.666892][T14417] loop1: detected capacity change from 0 to 512 [ 546.678359][T14401] XFS (loop3): Quotacheck: Done. [ 546.757570][T14417] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 546.765955][T14417] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 546.774047][T14417] System zones: 0-1, 15-15, 18-18, 34-34 [ 546.780170][T14417] EXT4-fs (loop1): orphan cleanup on readonly fs [ 546.786720][T14417] Quota error (device loop1): v2_read_header: Failed header read: expected=8 got=0 [ 546.796213][T14417] EXT4-fs warning (device loop1): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 546.810822][T14417] EXT4-fs (loop1): Cannot turn on quotas: error -22 [ 546.818137][T14417] EXT4-fs (loop1): 1 truncate cleaned up [ 546.826427][T14417] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 547.650851][T13594] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 547.667545][ T5780] Bluetooth: hci4: command tx timeout [ 547.710584][T13469] XFS (loop3): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 547.906135][ T5780] Bluetooth: hci2: command tx timeout [ 548.625908][T14433] loop2: detected capacity change from 0 to 164 [ 548.655943][ T5780] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 548.670623][ T5780] CPU: 0 PID: 5780 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 548.678231][ T5780] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 548.680489][T13756] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 548.688287][ T5780] Workqueue: hci0 hci_rx_work [ 548.688350][ T5780] Call Trace: [ 548.688358][ T5780] [ 548.688368][ T5780] dump_stack_lvl+0x18c/0x250 [ 548.713469][ T5780] ? show_regs_print_info+0x20/0x20 [ 548.718715][ T5780] ? load_image+0x420/0x420 [ 548.723291][ T5780] sysfs_create_dir_ns+0x26e/0x2a0 [ 548.728440][ T5780] ? __lock_acquire+0x7d80/0x7d80 [ 548.733498][ T5780] ? sysfs_warn_dup+0xa0/0xa0 [ 548.738303][ T5780] ? do_raw_spin_unlock+0x121/0x230 [ 548.743553][ T5780] kobject_add_internal+0x617/0xc90 [ 548.748808][ T5780] kobject_add+0x164/0x240 [ 548.753296][ T5780] ? kobject_init+0x1d0/0x1d0 [ 548.758035][ T5780] ? get_device_parent+0x366/0x390 [ 548.763192][ T5780] device_add+0x3fa/0xc40 [ 548.767567][ T5780] hci_conn_add_sysfs+0xd5/0x1e0 [ 548.772556][ T5780] le_conn_complete_evt+0xe9f/0x1480 [ 548.777896][ T5780] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 548.784184][ T5780] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 548.789859][ T5780] ? mutex_unlock+0x10/0x10 [ 548.794399][ T5780] ? skb_pull_data+0xf0/0x1f0 [ 548.799118][ T5780] hci_le_conn_complete_evt+0x187/0x440 [ 548.804714][ T5780] ? hci_remote_host_features_evt+0x150/0x150 [ 548.810834][ T5780] hci_event_packet+0x7b4/0x1280 [ 548.815830][ T5780] ? __lock_acquire+0x7d80/0x7d80 [ 548.820899][ T5780] ? lock_chain_count+0x20/0x20 [ 548.825799][ T5780] ? bis_list+0x290/0x290 [ 548.830182][ T5780] ? lockdep_hardirqs_on+0x98/0x150 [ 548.835432][ T5780] ? hci_send_to_monitor+0xd7/0x4f0 [ 548.840688][ T5780] hci_rx_work+0x43a/0xd60 [ 548.845162][ T5780] ? process_scheduled_works+0x975/0x1600 [ 548.850924][ T5780] process_scheduled_works+0xa60/0x1600 [ 548.856552][ T5780] ? worker_attach_to_pool+0x370/0x370 [ 548.862077][ T5780] ? assign_work+0x3cc/0x5d0 [ 548.866725][ T5780] worker_thread+0xa5e/0xfe0 [ 548.871387][ T5780] kthread+0x2fa/0x390 [ 548.875499][ T5780] ? pr_cont_work+0x550/0x550 [ 548.880227][ T5780] ? kthread_blkcg+0xd0/0xd0 [ 548.884860][ T5780] ret_from_fork+0x48/0x80 [ 548.889314][ T5780] ? kthread_blkcg+0xd0/0xd0 [ 548.893940][ T5780] ret_from_fork_asm+0x11/0x20 [ 548.898774][ T5780] [ 548.925044][ T5780] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 548.939293][ T5780] Bluetooth: hci0: failed to register connection device [ 549.233490][T14396] chnl_net:caif_netlink_parms(): no params data found [ 549.349278][T14449] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2572'. [ 549.526976][T14453] loop3: detected capacity change from 0 to 164 [ 549.546844][T14213] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 549.556628][T14213] CPU: 0 PID: 14213 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 549.564294][T14213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 549.574380][T14213] Workqueue: hci3 hci_rx_work [ 549.579088][T14213] Call Trace: [ 549.582356][T14213] [ 549.585299][T14213] dump_stack_lvl+0x18c/0x250 [ 549.590022][T14213] ? show_regs_print_info+0x20/0x20 [ 549.595251][T14213] ? load_image+0x420/0x420 [ 549.599801][T14213] sysfs_create_dir_ns+0x26e/0x2a0 [ 549.604956][T14213] ? __lock_acquire+0x7d80/0x7d80 [ 549.610011][T14213] ? sysfs_warn_dup+0xa0/0xa0 [ 549.614685][T14213] ? do_raw_spin_unlock+0x121/0x230 [ 549.619901][T14213] kobject_add_internal+0x617/0xc90 [ 549.625130][T14213] kobject_add+0x164/0x240 [ 549.629552][T14213] ? kobject_init+0x1d0/0x1d0 [ 549.634230][T14213] ? get_device_parent+0x366/0x390 [ 549.639337][T14213] device_add+0x3fa/0xc40 [ 549.643679][T14213] hci_conn_add_sysfs+0xd5/0x1e0 [ 549.648616][T14213] le_conn_complete_evt+0xe9f/0x1480 [ 549.653929][T14213] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 549.660277][T14213] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 549.665761][ T5836] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 549.665957][T14213] ? mutex_unlock+0x10/0x10 [ 549.677975][T14213] ? skb_pull_data+0xf0/0x1f0 [ 549.682690][T14213] hci_le_conn_complete_evt+0x187/0x440 [ 549.688281][T14213] ? hci_remote_host_features_evt+0x150/0x150 [ 549.694391][T14213] hci_event_packet+0x7b4/0x1280 [ 549.699373][T14213] ? __lock_acquire+0x7d80/0x7d80 [ 549.704432][T14213] ? lock_chain_count+0x20/0x20 [ 549.709314][T14213] ? bis_list+0x290/0x290 [ 549.713688][T14213] ? lockdep_hardirqs_on+0x98/0x150 [ 549.718964][T14213] ? hci_send_to_monitor+0xd7/0x4f0 [ 549.724205][T14213] hci_rx_work+0x43a/0xd60 [ 549.728672][T14213] ? process_scheduled_works+0x975/0x1600 [ 549.734434][T14213] process_scheduled_works+0xa60/0x1600 [ 549.740049][T14213] ? worker_attach_to_pool+0x370/0x370 [ 549.745602][T14213] ? assign_work+0x3cc/0x5d0 [ 549.750231][T14213] worker_thread+0xa5e/0xfe0 [ 549.754866][T14213] ? _raw_spin_unlock_irqrestore+0xc0/0x120 [ 549.760804][T14213] ? _raw_spin_unlock+0x40/0x40 [ 549.765729][T14213] ? __kthread_parkme+0x71/0x1c0 [ 549.770715][T14213] kthread+0x2fa/0x390 [ 549.774818][T14213] ? pr_cont_work+0x550/0x550 [ 549.779534][T14213] ? kthread_blkcg+0xd0/0xd0 [ 549.784159][T14213] ret_from_fork+0x48/0x80 [ 549.788611][T14213] ? kthread_blkcg+0xd0/0xd0 [ 549.793236][T14213] ret_from_fork_asm+0x11/0x20 [ 549.798055][T14213] [ 549.806125][T14213] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 549.820316][T14213] Bluetooth: hci3: failed to register connection device [ 549.829415][T13753] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 549.844979][ T59] hsr_slave_0: left promiscuous mode [ 549.867200][ T59] hsr_slave_1: left promiscuous mode [ 549.885179][ T5836] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 549.901323][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 549.911189][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 549.917812][ T5836] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 549.973627][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 549.985319][ T5780] Bluetooth: hci2: command tx timeout [ 549.995029][ T5836] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 550.003321][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 550.030326][ T5836] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 550.053172][ T59] bridge_slave_1: left allmulticast mode [ 550.061577][ T5836] usb 3-1: config 0 descriptor?? [ 550.088287][ T59] bridge_slave_1: left promiscuous mode [ 550.111922][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 550.141871][ T59] bridge_slave_0: left allmulticast mode [ 550.162220][ T59] bridge_slave_0: left promiscuous mode [ 550.169372][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 550.238478][ T59] veth1_macvtap: left promiscuous mode [ 550.244090][ T59] veth0_macvtap: left promiscuous mode [ 550.259018][ T59] veth1_vlan: left allmulticast mode [ 550.264542][ T59] veth1_vlan: left promiscuous mode [ 550.274534][ T59] veth0_vlan: left promiscuous mode [ 550.288130][ T5836] usb 3-1: USB disconnect, device number 2 [ 550.796270][ T59] bond0 (unregistering): (slave macvlan0): Releasing backup interface [ 551.035488][ T5780] Bluetooth: hci0: command tx timeout [ 551.910597][T14213] Bluetooth: hci3: command tx timeout [ 552.069270][T14213] Bluetooth: hci2: command tx timeout [ 552.110909][ T59] team0 (unregistering): Port device team_slave_1 removed [ 552.169174][ T59] team0 (unregistering): Port device team_slave_0 removed [ 552.403710][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 552.605175][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 553.153657][ T59] bond0 (unregistering): Released all slaves [ 553.296805][T14471] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2581'. [ 553.442385][T14396] bridge0: port 1(bridge_slave_0) entered blocking state [ 553.507761][T14396] bridge0: port 1(bridge_slave_0) entered disabled state [ 553.572506][T14396] bridge_slave_0: entered allmulticast mode [ 553.648835][T14396] bridge_slave_0: entered promiscuous mode [ 553.690900][T14396] bridge0: port 2(bridge_slave_1) entered blocking state [ 553.705137][T14396] bridge0: port 2(bridge_slave_1) entered disabled state [ 553.715491][T14396] bridge_slave_1: entered allmulticast mode [ 553.723169][T14396] bridge_slave_1: entered promiscuous mode [ 553.761424][T14396] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 553.779456][T14396] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 553.919573][T14396] team0: Port device team_slave_0 added [ 554.155307][T14213] Bluetooth: hci2: command tx timeout [ 554.331757][T14396] team0: Port device team_slave_1 added [ 554.554643][ T8] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 554.704378][T14396] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 554.800940][ T8] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 554.921126][ T8] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 554.942077][T14396] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 555.040287][ T8] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 555.110503][ T8] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 555.188491][T14396] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 555.273657][ T8] usb 3-1: config 0 descriptor?? [ 555.383374][T14396] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 555.408880][T14396] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 555.437703][T14396] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 555.462416][ T59] IPVS: stop unused estimator thread 0... [ 555.628747][T14396] hsr_slave_0: entered promiscuous mode [ 555.644477][T14396] hsr_slave_1: entered promiscuous mode [ 555.778619][T11884] usb 3-1: USB disconnect, device number 3 [ 555.912972][T14503] overlayfs: missing 'lowerdir' [ 557.036357][T14510] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2592'. [ 557.325089][ T59] tipc: Disabling bearer [ 557.333756][ T59] tipc: Left network mode [ 557.519755][ T59] tipc: Left network mode [ 559.115501][T14533] block nbd1: Device being setup by another task [ 559.365042][T11884] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 559.556695][T11884] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 559.611885][T11884] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 559.638885][T11884] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 559.666007][T11884] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 559.679020][T11884] usb 4-1: config 0 descriptor?? [ 559.848540][T14530] block nbd1: shutting down sockets [ 559.853858][T14213] block nbd1: Receive control failed (result -32) [ 559.903410][T11884] usb 4-1: USB disconnect, device number 6 [ 560.115072][T14396] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 560.143598][T14551] netlink: 'syz.2.2601': attribute type 4 has an invalid length. [ 560.189911][T14396] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 560.386067][T14396] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 560.421148][T14396] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 560.709932][T14557] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2603'. [ 562.120195][T14396] 8021q: adding VLAN 0 to HW filter on device bond0 [ 562.209458][T14586] netlink: 'syz.1.2609': attribute type 4 has an invalid length. [ 562.390774][T14396] 8021q: adding VLAN 0 to HW filter on device team0 [ 562.424386][T14593] loop1: detected capacity change from 0 to 16 [ 562.443123][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 562.450357][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 562.475000][ T173] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 562.522341][T14593] erofs: (device loop1): mounted with root inode @ nid 36. [ 562.618125][ T6253] bridge0: port 2(bridge_slave_1) entered blocking state [ 562.625463][ T6253] bridge0: port 2(bridge_slave_1) entered forwarding state [ 562.695216][ T173] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 562.712071][ T173] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 562.746512][ T173] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 562.758320][ T173] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 562.782193][ T173] usb 4-1: config 0 descriptor?? [ 562.845887][ T59] hsr_slave_0: left promiscuous mode [ 562.857730][ T59] hsr_slave_1: left promiscuous mode [ 562.874349][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 562.892232][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 562.907320][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 562.927735][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 562.944484][ T59] bridge_slave_0: left allmulticast mode [ 562.957570][ T59] bridge_slave_0: left promiscuous mode [ 562.966947][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 562.982799][ T59] hsr_slave_0: left promiscuous mode [ 562.995950][ T59] hsr_slave_1: left promiscuous mode [ 563.006058][ T173] usb 4-1: USB disconnect, device number 7 [ 563.012105][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 563.027799][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 563.053864][ T59] bridge_slave_1: left allmulticast mode [ 563.074916][ T59] bridge_slave_1: left promiscuous mode [ 563.080760][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 563.093026][ T59] bridge_slave_0: left allmulticast mode [ 563.099261][ T59] bridge_slave_0: left promiscuous mode [ 563.109356][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 563.162762][ T59] veth1_vlan: left promiscuous mode [ 563.168974][ T59] veth0_vlan: left promiscuous mode [ 563.188609][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.318579][T14602] loop2: detected capacity change from 0 to 512 [ 563.350445][T14602] EXT4-fs error (device loop2): ext4_orphan_get:1404: inode #15: comm syz.2.2614: iget: bad i_size value: 38620345925642 [ 563.376699][T14602] EXT4-fs error (device loop2): ext4_orphan_get:1409: comm syz.2.2614: couldn't read orphan inode 15 (err -117) [ 563.396541][T14602] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 564.742198][T13750] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 564.949280][ T59] team0 (unregistering): Port device virt_wifi0 removed [ 565.074678][T14617] loop2: detected capacity change from 0 to 512 [ 565.124975][T14617] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 565.140586][T14617] EXT4-fs (loop2): ea_inode feature is not supported for Hurd [ 565.279214][T14620] loop1: detected capacity change from 0 to 512 [ 565.438107][T14620] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 565.451272][T14620] ext4 filesystem being mounted at /65/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 565.520268][ T27] audit: type=1800 audit(1782961611.713:6): pid=14620 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2618" name="file1" dev="loop1" ino=15 res=0 errno=0 [ 566.145665][ T59] team0 (unregistering): Port device team_slave_1 removed [ 566.242082][ T59] team0 (unregistering): Port device team_slave_0 removed [ 566.341571][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 566.441461][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 567.003453][T13594] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 567.350389][ T59] bond0 (unregistering): Released all slaves [ 567.424981][ T8] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 567.609420][ T8] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 567.632889][ T8] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 567.651277][ T8] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 567.660635][ T8] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 567.678914][ T8] usb 3-1: config 0 descriptor?? [ 567.941964][ T8] usb 3-1: USB disconnect, device number 4 [ 568.092907][T14636] loop1: detected capacity change from 0 to 512 [ 568.125352][T14636] EXT4-fs error (device loop1): ext4_orphan_get:1404: inode #15: comm syz.1.2624: iget: bad i_size value: 38620345925642 [ 568.132543][ T59] team0 (unregistering): Port device team_slave_1 removed [ 568.147207][T14636] EXT4-fs error (device loop1): ext4_orphan_get:1409: comm syz.1.2624: couldn't read orphan inode 15 (err -117) [ 568.186030][T14636] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 568.238448][ T59] team0 (unregistering): Port device team_slave_0 removed [ 568.298679][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 568.412366][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 569.816985][T13594] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 569.944375][T14645] loop1: detected capacity change from 0 to 512 [ 569.953229][T14645] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 569.976548][T14645] EXT4-fs (loop1): ea_inode feature is not supported for Hurd [ 570.272206][ T59] bond0 (unregistering): Released all slaves [ 570.566420][T14396] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 570.861530][T14657] loop3: detected capacity change from 0 to 512 [ 571.128684][T14657] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 571.141803][T14657] ext4 filesystem being mounted at /88/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 571.317556][ T27] audit: type=1800 audit(1782961617.513:7): pid=14657 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2628" name="file1" dev="loop3" ino=15 res=0 errno=0 [ 572.410119][T14396] veth0_vlan: entered promiscuous mode [ 572.425028][ T789] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 572.452182][T14396] veth1_vlan: entered promiscuous mode [ 572.503246][T14396] veth0_macvtap: entered promiscuous mode [ 572.519076][T14396] veth1_macvtap: entered promiscuous mode [ 572.570254][T14396] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 572.587992][T14396] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 572.604998][T14396] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 572.617506][T14396] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 572.628407][T14396] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 572.637447][ T789] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 572.638965][T14396] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 572.670289][T14396] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 572.677780][T13469] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 572.680834][T14396] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 572.690218][ T789] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 572.708230][T14396] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 572.724652][ T789] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 572.738346][ T789] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 572.742503][T14396] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 572.762181][T14396] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 572.773621][T14396] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 572.797528][ T789] usb 2-1: config 0 descriptor?? [ 572.801120][T14396] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 572.839230][T14396] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 572.903964][T14396] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 572.914645][T14396] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 572.924280][T14396] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 572.943362][T14396] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 573.522045][ T8] usb 2-1: USB disconnect, device number 5 [ 573.838002][ T6260] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 573.881630][ T6260] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 574.030235][T14694] overlayfs: missing 'lowerdir' [ 574.041699][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 574.072903][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 575.031051][T14709] loop2: detected capacity change from 0 to 512 [ 575.590944][T14709] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 575.691995][T14709] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 575.802873][T14709] System zones: 0-1, 15-15, 18-18, 34-34 [ 575.858806][T14709] EXT4-fs (loop2): orphan cleanup on readonly fs [ 575.919894][T14709] Quota error (device loop2): v2_read_header: Failed header read: expected=8 got=0 [ 575.930191][T14709] EXT4-fs warning (device loop2): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 575.950492][T14709] EXT4-fs (loop2): Cannot turn on quotas: error -22 [ 575.958134][T14709] EXT4-fs (loop2): 1 truncate cleaned up [ 575.970217][T14709] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 577.944560][T13750] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 578.209952][T14728] loop4: detected capacity change from 0 to 32768 [ 578.263941][T14728] XFS (loop4): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 578.492497][T14728] XFS (loop4): Ending clean mount [ 578.519566][T14728] XFS (loop4): Quotacheck needed: Please wait. [ 578.659215][T14749] loop2: detected capacity change from 0 to 164 [ 578.715387][T14213] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 578.741589][T14213] CPU: 0 PID: 14213 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 578.749297][T14213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 578.759372][T14213] Workqueue: hci0 hci_rx_work [ 578.764064][T14213] Call Trace: [ 578.767345][T14213] [ 578.770311][T14213] dump_stack_lvl+0x18c/0x250 [ 578.775009][T14213] ? show_regs_print_info+0x20/0x20 [ 578.780213][T14213] ? load_image+0x420/0x420 [ 578.784731][T14213] sysfs_create_dir_ns+0x26e/0x2a0 [ 578.789841][T14213] ? __lock_acquire+0x7d80/0x7d80 [ 578.794870][T14213] ? sysfs_warn_dup+0xa0/0xa0 [ 578.799571][T14213] ? do_raw_spin_unlock+0x121/0x230 [ 578.804786][T14213] kobject_add_internal+0x617/0xc90 [ 578.810009][T14213] kobject_add+0x164/0x240 [ 578.814441][T14213] ? kobject_init+0x1d0/0x1d0 [ 578.819126][T14213] ? get_device_parent+0x366/0x390 [ 578.824244][T14213] device_add+0x3fa/0xc40 [ 578.828583][T14213] hci_conn_add_sysfs+0xd5/0x1e0 [ 578.833557][T14213] le_conn_complete_evt+0xe9f/0x1480 [ 578.838854][T14213] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 578.845105][T14213] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 578.850745][T14213] ? mutex_unlock+0x10/0x10 [ 578.855253][T14213] ? skb_pull_data+0xf0/0x1f0 [ 578.859939][T14213] hci_le_conn_complete_evt+0x187/0x440 [ 578.865495][T14213] ? hci_remote_host_features_evt+0x150/0x150 [ 578.871579][T14213] hci_event_packet+0x7b4/0x1280 [ 578.876532][T14213] ? __lock_acquire+0x7d80/0x7d80 [ 578.881564][T14213] ? lock_chain_count+0x20/0x20 [ 578.886419][T14213] ? bis_list+0x290/0x290 [ 578.890756][T14213] ? lockdep_hardirqs_on+0x98/0x150 [ 578.895963][T14213] ? hci_send_to_monitor+0xd7/0x4f0 [ 578.901167][T14213] hci_rx_work+0x43a/0xd60 [ 578.905597][T14213] ? process_scheduled_works+0x975/0x1600 [ 578.911343][T14213] process_scheduled_works+0xa60/0x1600 [ 578.916946][T14213] ? worker_attach_to_pool+0x370/0x370 [ 578.922425][T14213] ? assign_work+0x3cc/0x5d0 [ 578.927021][T14213] worker_thread+0xa5e/0xfe0 [ 578.931624][T14213] ? _raw_spin_unlock_irqrestore+0xc0/0x120 [ 578.937531][T14213] ? _raw_spin_unlock+0x40/0x40 [ 578.942386][T14213] ? __kthread_parkme+0x71/0x1c0 [ 578.947338][T14213] kthread+0x2fa/0x390 [ 578.951413][T14213] ? pr_cont_work+0x550/0x550 [ 578.956094][T14213] ? kthread_blkcg+0xd0/0xd0 [ 578.960684][T14213] ret_from_fork+0x48/0x80 [ 578.965133][T14213] ? kthread_blkcg+0xd0/0xd0 [ 578.969727][T14213] ret_from_fork_asm+0x11/0x20 [ 578.974509][T14213] [ 579.053157][T13756] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 579.124904][T14213] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 579.144713][T14213] Bluetooth: hci0: failed to register connection device [ 579.224417][T14728] XFS (loop4): Quotacheck: Done. [ 579.734959][T14396] XFS (loop4): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 581.114930][T14772] loop3: detected capacity change from 0 to 512 [ 582.486298][ T5780] Bluetooth: hci0: command tx timeout [ 582.769307][T14772] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 582.777491][T14772] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 582.785675][T14772] System zones: 0-1, 15-15, 18-18, 34-34 [ 582.791692][T14772] EXT4-fs (loop3): orphan cleanup on readonly fs [ 582.798165][T14772] Quota error (device loop3): v2_read_header: Failed header read: expected=8 got=0 [ 582.807686][T14772] EXT4-fs warning (device loop3): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 582.822335][T14772] EXT4-fs (loop3): Cannot turn on quotas: error -22 [ 582.833041][T14772] EXT4-fs (loop3): 1 truncate cleaned up [ 582.840046][T14772] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 583.128822][T13469] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 585.555855][T14806] overlayfs: missing 'lowerdir' [ 588.421832][T14842] overlayfs: missing 'lowerdir' [ 588.430026][T14823] loop1: detected capacity change from 0 to 32768 [ 588.777064][T14823] XFS (loop1): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 589.457333][T14823] XFS (loop1): Ending clean mount [ 589.913685][T13594] XFS (loop1): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 589.964485][T14870] overlayfs: missing 'lowerdir' [ 591.778955][T14896] loop2: detected capacity change from 0 to 512 [ 591.803000][T14896] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 591.817347][T14896] EXT4-fs (loop2): ea_inode feature is not supported for Hurd [ 592.441288][T14908] overlayfs: missing 'lowerdir' [ 594.564198][T14930] loop1: detected capacity change from 0 to 512 [ 594.821854][T14930] EXT4-fs error (device loop1): ext4_orphan_get:1404: inode #15: comm syz.1.2700: iget: bad i_size value: 38620345925642 [ 594.850749][T14930] EXT4-fs error (device loop1): ext4_orphan_get:1409: comm syz.1.2700: couldn't read orphan inode 15 (err -117) [ 595.064855][T14930] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 595.723620][T14941] loop2: detected capacity change from 0 to 512 [ 595.839067][T14941] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 595.847199][T14941] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 595.855430][T14941] System zones: 0-1, 15-15, 18-18, 34-34 [ 595.861479][T14941] EXT4-fs (loop2): orphan cleanup on readonly fs [ 595.868086][T14941] Quota error (device loop2): v2_read_header: Failed header read: expected=8 got=0 [ 595.881502][T14941] EXT4-fs warning (device loop2): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 595.898739][T14946] loop3: detected capacity change from 0 to 512 [ 595.911352][T14941] EXT4-fs (loop2): Cannot turn on quotas: error -22 [ 595.955630][T14946] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 595.964723][T14946] EXT4-fs (loop3): ea_inode feature is not supported for Hurd [ 596.119655][T13594] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 596.135598][T14941] EXT4-fs (loop2): 1 truncate cleaned up [ 596.189851][T14941] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 596.268517][T14951] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 597.523084][T14969] overlayfs: missing 'lowerdir' [ 598.987490][T13750] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 599.088383][T14982] loop3: detected capacity change from 0 to 512 [ 599.113372][T14982] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 599.162389][T14982] EXT4-fs (loop3): ea_inode feature is not supported for Hurd [ 599.701602][T14989] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 600.750030][T14995] netlink: 'syz.4.2717': attribute type 1 has an invalid length. [ 600.815727][T14995] netlink: 'syz.4.2717': attribute type 10 has an invalid length. [ 600.823753][T14995] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2717'. [ 600.894370][T14995] dummy0: entered promiscuous mode [ 601.111232][ T5787] Bluetooth: hci3: command 0x0406 tx timeout [ 601.946372][T15009] overlayfs: missing 'lowerdir' [ 602.976560][T15006] loop4: detected capacity change from 0 to 32768 [ 603.010534][T15006] (syz.4.2721,15006,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 603.246610][T15006] (syz.4.2721,15006,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 603.280323][T15022] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 603.431317][T15006] JBD2: Ignoring recovery information on journal [ 603.634994][T15006] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 604.027457][T14396] ocfs2: Unmounting device (7,4) on (node local) [ 604.059153][T15035] loop3: detected capacity change from 0 to 1024 [ 604.104365][T15035] EXT4-fs: Ignoring removed nomblk_io_submit option [ 604.132682][T15035] EXT4-fs: Ignoring removed nomblk_io_submit option [ 604.186068][T15035] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 604.205086][T15035] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 604.255833][T15041] overlayfs: missing 'lowerdir' [ 604.262626][T15035] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 604.521682][T13469] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 606.162358][T15040] loop2: detected capacity change from 0 to 40427 [ 606.215179][T15040] F2FS-fs (loop2): invalid crc value [ 606.228617][T14213] Bluetooth: hci4: command 0x0406 tx timeout [ 606.242539][T15040] F2FS-fs (loop2): Found nat_bits in checkpoint [ 606.513542][T15069] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 606.613734][T15040] F2FS-fs (loop2): Start checkpoint disabled! [ 606.640623][T15040] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 606.764695][T15040] syz.2.2736: attempt to access beyond end of device [ 606.764695][T15040] loop2: rw=10241, sector=45096, nr_sectors = 8 limit=40427 [ 606.824087][T15040] syz.2.2736: attempt to access beyond end of device [ 606.824087][T15040] loop2: rw=2049, sector=77824, nr_sectors = 128 limit=40427 [ 606.872236][T15040] syz.2.2736: attempt to access beyond end of device [ 606.872236][T15040] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 606.924490][T15063] loop4: detected capacity change from 0 to 32768 [ 606.998607][T15063] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop4 scanned by syz.4.2742 (15063) [ 607.183669][T15063] BTRFS info (device loop4): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 607.198844][T15063] BTRFS info (device loop4): using sha256 (sha256-avx2) checksum algorithm [ 607.221244][ T49] kworker/u4:3: attempt to access beyond end of device [ 607.221244][ T49] loop2: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 607.245176][ T49] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 607.255823][T15063] BTRFS info (device loop4): force clearing of disk cache [ 607.263062][T15063] BTRFS info (device loop4): enabling ssd optimizations [ 607.278196][ T49] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 607.385235][T15063] BTRFS info (device loop4): using spread ssd allocation scheme [ 607.392949][T15063] BTRFS info (device loop4): metadata ratio 0 [ 607.434941][T15063] BTRFS info (device loop4): using free space tree [ 607.805578][T15094] overlayfs: missing 'lowerdir' [ 608.199508][T15063] BTRFS info (device loop4): auto enabling async discard [ 608.366126][T15063] BTRFS info (device loop4): rebuilding free space tree [ 608.421540][T15099] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2749'. [ 608.432487][T15099] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2749'. [ 608.768883][T14396] BTRFS info (device loop4): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 609.966026][T15116] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 610.770797][T15125] loop2: detected capacity change from 0 to 8192 [ 610.795283][T15125] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 610.796679][T15128] overlayfs: missing 'lowerdir' [ 610.809431][T15125] REISERFS (device loop2): found reiserfs format "3.5" with non-standard journal [ 610.826349][T15125] REISERFS (device loop2): using ordered data mode [ 610.850312][T15125] reiserfs: using flush barriers [ 610.861238][T15125] REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 610.878631][T15125] REISERFS (device loop2): checking transaction log (loop2) [ 611.238539][T15125] REISERFS (device loop2): Using r5 hash to sort names [ 611.767139][T15125] REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage. [ 612.083462][T15125] REISERFS warning (device loop2): vs-13060 reiserfs_update_sd_size: stat data of object [2 2 0x0 SD] (nlink == 1) not found (pos 0) [ 612.129663][T15125] REISERFS warning (device loop2): vs-13060 reiserfs_update_sd_size: stat data of object [2 2 0x0 SD] (nlink == 1) not found (pos 0) [ 612.146040][T15125] REISERFS warning (device loop2): vs-13060 reiserfs_update_sd_size: stat data of object [2 2 0x0 SD] (nlink == 1) not found (pos 0) [ 612.166739][T15125] REISERFS warning (device loop2): vs-13060 reiserfs_update_sd_size: stat data of object [2 2 0x0 SD] (nlink == 1) not found (pos 0) [ 612.254948][T15125] REISERFS warning (device loop2): vs-13060 reiserfs_update_sd_size: stat data of object [2 2 0x0 SD] (nlink == 1) not found (pos 0) [ 612.677389][T15145] REISERFS error (device loop2): vs-7000 search_by_entry_key: search_by_key returned item position == 0 [ 612.871688][T15145] REISERFS (device loop2): Remounting filesystem read-only [ 612.902057][T15145] REISERFS error (device loop2): zam-7001 reiserfs_find_entry: io error [ 613.333779][T15154] loop4: detected capacity change from 0 to 512 [ 613.434685][T15154] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 613.443068][T15154] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 613.451596][T15154] System zones: 0-1, 15-15, 18-18, 34-34 [ 613.458934][T15154] EXT4-fs (loop4): orphan cleanup on readonly fs [ 613.465902][T15154] Quota error (device loop4): v2_read_header: Failed header read: expected=8 got=0 [ 613.475713][T15154] EXT4-fs warning (device loop4): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 613.491062][T15154] EXT4-fs (loop4): Cannot turn on quotas: error -22 [ 613.533836][T15154] EXT4-fs (loop4): 1 truncate cleaned up [ 613.545054][T15154] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 613.982027][T14396] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 614.363803][T15166] loop2: detected capacity change from 0 to 512 [ 614.420889][T15168] loop4: detected capacity change from 0 to 512 [ 614.449834][T15168] EXT4-fs error (device loop4): ext4_orphan_get:1404: inode #15: comm syz.4.2768: iget: bad i_size value: 38620345925642 [ 614.449853][T15166] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 614.449871][T15166] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 614.479294][T15166] System zones: 0-1, 15-15, 18-18, 34-34 [ 614.485485][T15167] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 614.494726][T15166] EXT4-fs (loop2): orphan cleanup on readonly fs [ 614.503184][T15166] Quota error (device loop2): v2_read_header: Failed header read: expected=8 got=0 [ 614.513554][T15166] EXT4-fs warning (device loop2): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 614.528579][T15166] EXT4-fs (loop2): Cannot turn on quotas: error -22 [ 614.536039][T15166] EXT4-fs (loop2): 1 truncate cleaned up [ 614.541407][T15168] EXT4-fs error (device loop4): ext4_orphan_get:1409: comm syz.4.2768: couldn't read orphan inode 15 (err -117) [ 614.542910][T15166] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 614.594222][T15168] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 615.507456][T14396] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 615.523431][T13750] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 617.073127][T15196] loop3: detected capacity change from 0 to 512 [ 617.293994][T15196] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 617.302267][T15196] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 617.310946][T15196] System zones: 0-1, 15-15, 18-18, 34-34 [ 617.318330][T15196] EXT4-fs (loop3): orphan cleanup on readonly fs [ 617.325380][T15196] Quota error (device loop3): v2_read_header: Failed header read: expected=8 got=0 [ 617.335148][T15196] EXT4-fs warning (device loop3): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 617.350132][T15196] EXT4-fs (loop3): Cannot turn on quotas: error -22 [ 617.359545][T15196] EXT4-fs (loop3): 1 truncate cleaned up [ 617.371169][T15196] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 617.689119][T13469] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 618.011572][T15204] loop3: detected capacity change from 0 to 512 [ 618.066713][T15204] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 618.076880][T15204] EXT4-fs (loop3): ea_inode feature is not supported for Hurd [ 618.116368][T15193] loop1: detected capacity change from 0 to 32768 [ 618.226953][T15193] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop1 scanned by syz.1.2775 (15193) [ 618.365006][T15193] BTRFS info (device loop1): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 618.379819][T15193] BTRFS info (device loop1): using blake2b (blake2b-256-generic) checksum algorithm [ 618.390879][T15193] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 618.404954][T15193] BTRFS info (device loop1): use zstd compression, level 3 [ 618.412277][T15193] BTRFS info (device loop1): using free space tree [ 618.982036][T15193] BTRFS info (device loop1): enabling ssd optimizations [ 619.024961][T15193] BTRFS info (device loop1): auto enabling async discard [ 619.094047][T15194] loop2: detected capacity change from 0 to 40427 [ 619.178618][T15194] F2FS-fs (loop2): invalid crc value [ 619.189898][T15224] loop3: detected capacity change from 0 to 512 [ 619.220314][T15194] F2FS-fs (loop2): Found nat_bits in checkpoint [ 619.230946][T15224] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 619.246486][T15224] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 619.260305][T15224] System zones: 0-1, 15-15, 18-18, 34-34 [ 619.266446][T15224] EXT4-fs (loop3): orphan cleanup on readonly fs [ 619.272942][T15224] Quota error (device loop3): v2_read_header: Failed header read: expected=8 got=0 [ 619.282572][T15224] EXT4-fs warning (device loop3): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 619.297581][T15224] EXT4-fs (loop3): Cannot turn on quotas: error -22 [ 619.382618][T15224] EXT4-fs (loop3): 1 truncate cleaned up [ 619.417892][T15224] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 619.434142][T15194] F2FS-fs (loop2): Start checkpoint disabled! [ 619.477727][T15194] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 619.549627][T15194] syz.2.2776: attempt to access beyond end of device [ 619.549627][T15194] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 619.618155][T15194] syz.2.2776: attempt to access beyond end of device [ 619.618155][T15194] loop2: rw=2049, sector=77824, nr_sectors = 128 limit=40427 [ 619.634363][T15194] syz.2.2776: attempt to access beyond end of device [ 619.634363][T15194] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 619.729945][T15230] overlayfs: missing 'lowerdir' [ 619.926258][ T59] kworker/u4:4: attempt to access beyond end of device [ 619.926258][ T59] loop2: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 619.984348][T13469] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 619.993750][ T59] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 620.113499][ T59] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 620.358086][T13594] BTRFS info (device loop1): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 621.600448][T14213] Bluetooth: hci0: command 0x0406 tx timeout [ 621.704734][T15246] overlayfs: missing 'lowerdir' [ 623.199063][T15266] loop4: detected capacity change from 0 to 512 [ 623.276099][T15268] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 624.146002][T15266] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 624.159144][T15266] ext4 filesystem being mounted at /35/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 624.236202][ T27] audit: type=1800 audit(1782961670.433:8): pid=15266 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2789" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 624.644029][T15277] loop2: detected capacity change from 0 to 512 [ 624.651175][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.722112][T15277] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 624.825269][T15277] ext4 filesystem being mounted at /71/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 624.907325][T15277] EXT4-fs error (device loop2): ext4_lookup:1858: inode #16: comm syz.2.2793: iget: bad extended attribute block 65536 [ 625.972913][T15287] overlayfs: missing 'lowerdir' [ 626.197570][T13750] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 626.200452][T14396] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 628.197736][T15315] netlink: 'syz.4.2805': attribute type 29 has an invalid length. [ 628.243420][T15315] netlink: 'syz.4.2805': attribute type 29 has an invalid length. [ 628.269326][T15317] netlink: 'syz.4.2805': attribute type 29 has an invalid length. [ 628.280444][T15315] netlink: 'syz.4.2805': attribute type 29 has an invalid length. [ 628.451437][T15301] loop3: detected capacity change from 0 to 32768 [ 628.483856][T15323] overlayfs: missing 'lowerdir' [ 629.012555][T15332] loop1: detected capacity change from 0 to 512 [ 629.039822][T15333] loop4: detected capacity change from 0 to 512 [ 629.125764][T15334] loop2: detected capacity change from 0 to 164 [ 629.389470][ T5787] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 629.399399][ T5787] CPU: 1 PID: 5787 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 629.406977][ T5787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 629.417061][ T5787] Workqueue: hci0 hci_rx_work [ 629.421772][ T5787] Call Trace: [ 629.425066][ T5787] [ 629.428017][ T5787] dump_stack_lvl+0x18c/0x250 [ 629.432731][ T5787] ? show_regs_print_info+0x20/0x20 [ 629.437958][ T5787] ? load_image+0x420/0x420 [ 629.442502][ T5787] sysfs_create_dir_ns+0x26e/0x2a0 [ 629.447635][ T5787] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 629.453302][ T5787] ? sysfs_warn_dup+0xa0/0xa0 [ 629.458012][ T5787] ? kobject_add_internal+0x602/0xc90 [ 629.463423][ T5787] kobject_add_internal+0x617/0xc90 [ 629.468661][ T5787] kobject_add+0x164/0x240 [ 629.473101][ T5787] ? preempt_schedule_thunk+0x1a/0x30 [ 629.478502][ T5787] ? kobject_init+0x1d0/0x1d0 [ 629.483211][ T5787] ? get_device_parent+0x366/0x390 [ 629.488357][ T5787] device_add+0x3fa/0xc40 [ 629.492773][ T5787] hci_conn_add_sysfs+0xd5/0x1e0 [ 629.497839][ T5787] le_conn_complete_evt+0xe9f/0x1480 [ 629.503164][ T5787] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 629.509414][ T5787] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 629.515068][ T5787] hci_le_conn_complete_evt+0x187/0x440 [ 629.520628][ T5787] ? hci_remote_host_features_evt+0x150/0x150 [ 629.526709][ T5787] hci_event_packet+0x7b4/0x1280 [ 629.531658][ T5787] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 629.537301][ T5787] ? bis_list+0x290/0x290 [ 629.541637][ T5787] ? kcov_remote_start+0x1b5/0x7e0 [ 629.546753][ T5787] ? hci_send_to_monitor+0xd7/0x4f0 [ 629.551962][ T5787] hci_rx_work+0x43a/0xd60 [ 629.556400][ T5787] ? process_scheduled_works+0x975/0x1600 [ 629.562129][ T5787] process_scheduled_works+0xa60/0x1600 [ 629.567714][ T5787] ? worker_attach_to_pool+0x370/0x370 [ 629.573273][ T5787] ? assign_work+0x3cc/0x5d0 [ 629.577869][ T5787] worker_thread+0xa5e/0xfe0 [ 629.582487][ T5787] kthread+0x2fa/0x390 [ 629.586556][ T5787] ? pr_cont_work+0x550/0x550 [ 629.591232][ T5787] ? kthread_blkcg+0xd0/0xd0 [ 629.595822][ T5787] ret_from_fork+0x48/0x80 [ 629.600238][ T5787] ? kthread_blkcg+0xd0/0xd0 [ 629.604836][ T5787] ret_from_fork_asm+0x11/0x20 [ 629.609656][ T5787] [ 629.645573][ T5787] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 629.659809][ T5787] Bluetooth: hci0: failed to register connection device [ 629.669986][T15332] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 629.695134][T15333] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 629.703136][T15333] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 629.711345][T15333] System zones: 0-1, 15-15, 18-18, 34-34 [ 629.717434][T15333] EXT4-fs (loop4): orphan cleanup on readonly fs [ 629.723896][T15333] Quota error (device loop4): v2_read_header: Failed header read: expected=8 got=0 [ 629.727925][T15332] EXT4-fs (loop1): ea_inode feature is not supported for Hurd [ 629.733316][T15333] EXT4-fs warning (device loop4): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 629.767815][T15333] EXT4-fs (loop4): Cannot turn on quotas: error -22 [ 629.822236][T15333] EXT4-fs (loop4): 1 truncate cleaned up [ 629.829491][T15333] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 630.850132][T15344] loop2: detected capacity change from 0 to 256 [ 630.858511][T15344] exfat: Deprecated parameter 'utf8' [ 630.859632][T15346] overlayfs: missing 'lowerdir' [ 631.065846][T15344] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x1a9973fb, utbl_chksum : 0xe619d30d) [ 631.733140][T14396] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 631.753070][T14213] Bluetooth: hci0: command 0x0406 tx timeout [ 632.598111][T15369] loop4: detected capacity change from 0 to 8192 [ 632.617506][T15369] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 632.690250][T15369] REISERFS (device loop4): found reiserfs format "3.5" with non-standard journal [ 632.691316][T15377] overlayfs: missing 'lowerdir' [ 632.719683][T15374] loop1: detected capacity change from 0 to 512 [ 632.750779][T15369] REISERFS (device loop4): using ordered data mode [ 632.769122][T15378] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2824'. [ 632.805440][T15369] reiserfs: using flush barriers [ 632.825210][T15374] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 632.838642][T15369] REISERFS (device loop4): journal params: device loop4, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 632.880046][T15374] EXT4-fs (loop1): ea_inode feature is not supported for Hurd [ 632.908676][T15369] REISERFS (device loop4): checking transaction log (loop4) [ 632.917537][T15369] REISERFS (device loop4): Using r5 hash to sort names [ 632.925030][T15369] REISERFS (device loop4): Created .reiserfs_priv - reserved for xattr storage. [ 633.067740][T15369] REISERFS warning (device loop4): vs-13060 reiserfs_update_sd_size: stat data of object [2 2 0x0 SD] (nlink == 1) not found (pos 0) [ 633.120464][T15369] REISERFS warning (device loop4): vs-13060 reiserfs_update_sd_size: stat data of object [2 2 0x0 SD] (nlink == 1) not found (pos 0) [ 633.166803][T15369] REISERFS warning (device loop4): vs-13060 reiserfs_update_sd_size: stat data of object [2 2 0x0 SD] (nlink == 1) not found (pos 0) [ 633.180711][T15381] REISERFS error (device loop4): vs-7000 search_by_entry_key: search_by_key returned item position == 0 [ 633.192062][T15381] REISERFS (device loop4): Remounting filesystem read-only [ 633.199638][T15381] REISERFS error (device loop4): zam-7001 reiserfs_find_entry: io error [ 634.132531][T15393] loop2: detected capacity change from 0 to 256 [ 634.140028][T15393] exfat: Deprecated parameter 'utf8' [ 634.171219][T15393] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x1a9973fb, utbl_chksum : 0xe619d30d) [ 634.459608][T15406] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2834'. [ 635.512719][T15415] overlayfs: missing 'lowerdir' [ 635.623731][T15419] loop1: detected capacity change from 0 to 164 [ 635.701347][T14213] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 635.713383][T14213] CPU: 1 PID: 14213 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 635.721064][T14213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 635.731229][T14213] Workqueue: hci4 hci_rx_work [ 635.735939][T14213] Call Trace: [ 635.739227][T14213] [ 635.742168][T14213] dump_stack_lvl+0x18c/0x250 [ 635.746880][T14213] ? show_regs_print_info+0x20/0x20 [ 635.752109][T14213] ? load_image+0x420/0x420 [ 635.756647][T14213] sysfs_create_dir_ns+0x26e/0x2a0 [ 635.761778][T14213] ? __lock_acquire+0x7d80/0x7d80 [ 635.766825][T14213] ? sysfs_warn_dup+0xa0/0xa0 [ 635.771700][T14213] ? do_raw_spin_unlock+0x121/0x230 [ 635.776953][T14213] kobject_add_internal+0x617/0xc90 [ 635.782208][T14213] kobject_add+0x164/0x240 [ 635.786677][T14213] ? preempt_schedule_thunk+0x1a/0x30 [ 635.792086][T14213] ? kobject_init+0x1d0/0x1d0 [ 635.796793][T14213] ? get_device_parent+0x366/0x390 [ 635.801947][T14213] device_add+0x3fa/0xc40 [ 635.806314][T14213] hci_conn_add_sysfs+0xd5/0x1e0 [ 635.811287][T14213] le_conn_complete_evt+0xe9f/0x1480 [ 635.816609][T14213] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 635.822877][T14213] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 635.828541][T14213] ? mutex_unlock+0x10/0x10 [ 635.833151][T14213] ? skb_pull_data+0xf0/0x1f0 [ 635.837862][T14213] hci_le_conn_complete_evt+0x187/0x440 [ 635.843541][T14213] ? hci_remote_host_features_evt+0x150/0x150 [ 635.849651][T14213] hci_event_packet+0x7b4/0x1280 [ 635.854620][T14213] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 635.860292][T14213] ? bis_list+0x290/0x290 [ 635.864649][T14213] ? kcov_remote_start+0x1b5/0x7e0 [ 635.869795][T14213] ? hci_send_to_monitor+0xd7/0x4f0 [ 635.875044][T14213] hci_rx_work+0x43a/0xd60 [ 635.879500][T14213] ? process_scheduled_works+0x975/0x1600 [ 635.885248][T14213] process_scheduled_works+0xa60/0x1600 [ 635.890850][T14213] ? worker_attach_to_pool+0x370/0x370 [ 635.896335][T14213] ? assign_work+0x3cc/0x5d0 [ 635.900958][T14213] worker_thread+0xa5e/0xfe0 [ 635.905579][T14213] ? _raw_spin_unlock_irqrestore+0xc0/0x120 [ 635.911514][T14213] ? _raw_spin_unlock+0x40/0x40 [ 635.916390][T14213] ? __kthread_parkme+0x71/0x1c0 [ 635.921359][T14213] kthread+0x2fa/0x390 [ 635.925443][T14213] ? pr_cont_work+0x550/0x550 [ 635.930293][T14213] ? kthread_blkcg+0xd0/0xd0 [ 635.934948][T14213] ret_from_fork+0x48/0x80 [ 635.939411][T14213] ? kthread_blkcg+0xd0/0xd0 [ 635.944037][T14213] ret_from_fork_asm+0x11/0x20 [ 635.948862][T14213] [ 635.968536][T14213] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 635.984542][T14213] Bluetooth: hci4: failed to register connection device [ 636.491461][T15425] loop2: detected capacity change from 0 to 8192 [ 636.510836][T15425] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 636.541358][T15425] REISERFS (device loop2): found reiserfs format "3.5" with non-standard journal [ 636.551298][T15425] REISERFS (device loop2): using ordered data mode [ 636.558643][T15425] reiserfs: using flush barriers [ 636.606523][T15432] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2843'. [ 636.624917][T15425] REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 636.655753][T15425] REISERFS (device loop2): checking transaction log (loop2) [ 636.682783][T15425] REISERFS (device loop2): Using r5 hash to sort names [ 636.700499][T15425] REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage. [ 636.799835][T15425] REISERFS warning (device loop2): vs-13060 reiserfs_update_sd_size: stat data of object [2 2 0x0 SD] (nlink == 1) not found (pos 0) [ 636.915466][T15425] REISERFS warning (device loop2): vs-13060 reiserfs_update_sd_size: stat data of object [2 2 0x0 SD] (nlink == 1) not found (pos 0) [ 636.989425][T15439] REISERFS error (device loop2): vs-7000 search_by_entry_key: search_by_key returned item position == 0 [ 637.033926][T15439] REISERFS (device loop2): Remounting filesystem read-only [ 637.041874][T15439] REISERFS error (device loop2): zam-7001 reiserfs_find_entry: io error [ 637.085246][T15442] block nbd4: Device being setup by another task [ 637.670781][ T5787] block nbd4: Receive control failed (result -32) [ 637.717052][T13756] block nbd4: shutting down sockets [ 638.076494][ T5787] Bluetooth: hci4: command 0x0406 tx timeout [ 638.698588][T15456] overlayfs: missing 'lowerdir' [ 639.378460][T15467] loop4: detected capacity change from 0 to 164 [ 639.422331][ T5787] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 639.433689][ T5787] CPU: 1 PID: 5787 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 639.441290][ T5787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 639.451363][ T5787] Workqueue: hci2 hci_rx_work [ 639.456165][ T5787] Call Trace: [ 639.459458][ T5787] [ 639.462402][ T5787] dump_stack_lvl+0x18c/0x250 [ 639.467122][ T5787] ? show_regs_print_info+0x20/0x20 [ 639.472355][ T5787] ? load_image+0x420/0x420 [ 639.476992][ T5787] sysfs_create_dir_ns+0x26e/0x2a0 [ 639.482132][ T5787] ? __lock_acquire+0x7d80/0x7d80 [ 639.487185][ T5787] ? sysfs_warn_dup+0xa0/0xa0 [ 639.491986][ T5787] ? do_raw_spin_unlock+0x121/0x230 [ 639.497234][ T5787] kobject_add_internal+0x617/0xc90 [ 639.502579][ T5787] kobject_add+0x164/0x240 [ 639.507037][ T5787] ? kobject_init+0x1d0/0x1d0 [ 639.511758][ T5787] ? get_device_parent+0x366/0x390 [ 639.516909][ T5787] device_add+0x3fa/0xc40 [ 639.521270][ T5787] hci_conn_add_sysfs+0xd5/0x1e0 [ 639.526251][ T5787] le_conn_complete_evt+0xe9f/0x1480 [ 639.531582][ T5787] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 639.537870][ T5787] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 639.543550][ T5787] ? mutex_unlock+0x10/0x10 [ 639.548096][ T5787] ? skb_pull_data+0xf0/0x1f0 [ 639.552836][ T5787] hci_le_conn_complete_evt+0x187/0x440 [ 639.558427][ T5787] ? hci_remote_host_features_evt+0x150/0x150 [ 639.564543][ T5787] hci_event_packet+0x7b4/0x1280 [ 639.569567][ T5787] ? __lock_acquire+0x7d80/0x7d80 [ 639.574642][ T5787] ? lock_chain_count+0x20/0x20 [ 639.579541][ T5787] ? bis_list+0x290/0x290 [ 639.583913][ T5787] ? lockdep_hardirqs_on+0x98/0x150 [ 639.589170][ T5787] ? hci_send_to_monitor+0xd7/0x4f0 [ 639.594518][ T5787] hci_rx_work+0x43a/0xd60 [ 639.599181][ T5787] ? process_scheduled_works+0x975/0x1600 [ 639.604960][ T5787] process_scheduled_works+0xa60/0x1600 [ 639.610586][ T5787] ? worker_attach_to_pool+0x370/0x370 [ 639.616095][ T5787] ? assign_work+0x3cc/0x5d0 [ 639.620731][ T5787] worker_thread+0xa5e/0xfe0 [ 639.625374][ T5787] kthread+0x2fa/0x390 [ 639.629479][ T5787] ? pr_cont_work+0x550/0x550 [ 639.634202][ T5787] ? kthread_blkcg+0xd0/0xd0 [ 639.638827][ T5787] ret_from_fork+0x48/0x80 [ 639.643275][ T5787] ? kthread_blkcg+0xd0/0xd0 [ 639.647899][ T5787] ret_from_fork_asm+0x11/0x20 [ 639.652725][ T5787] [ 639.663847][ T5787] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 639.673749][T13753] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 639.690028][ T5787] Bluetooth: hci2: failed to register connection device [ 639.747830][T14213] block nbd2: Receive control failed (result -32) [ 639.820305][T13756] block nbd2: shutting down sockets [ 640.017927][T15481] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2854'. [ 641.495630][T15507] overlayfs: missing 'lowerdir' [ 641.600652][T15503] loop4: detected capacity change from 0 to 4096 [ 641.649240][T15509] pim6reg: entered allmulticast mode [ 641.656763][T15503] ntfs3: loop4: Different NTFS sector size (4096) and media sector size (512). [ 641.938062][T15509] loop2: detected capacity change from 0 to 164 [ 641.965213][T14213] Bluetooth: hci2: command tx timeout [ 642.041951][T15509] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2867'. [ 642.052610][T15509] pim6reg: left allmulticast mode [ 642.319951][T15503] ntfs3: loop4: ino=3, ntfs_set_state failed, -22. [ 642.334478][T15503] ntfs3: loop4: Failed to initialize $Extend/$Reparse. [ 642.398043][T15520] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2869'. [ 642.505056][T15503] ntfs3: loop4: ino=1e, "file1" encrypted i/o not supported [ 642.540919][ T27] audit: type=1800 audit(1782961688.733:9): pid=15503 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2863" name="file1" dev="loop4" ino=30 res=0 errno=0 [ 642.745113][T15503] ntfs3: loop4: ino=1e, "file1" failed to parse mft record [ 642.752882][T15503] ntfs3: loop4: ino=1e, "file1" attr_set_size [ 643.784491][T15537] loop1: detected capacity change from 0 to 512 [ 643.802962][ T11] ntfs3: loop4: ino=3, ntfs3_write_inode failed, -22. [ 643.849344][T14396] ntfs3: loop4: ino=3, ntfs_set_state failed, -22. [ 643.860529][T14396] ntfs3: loop4: Mark volume as dirty due to NTFS errors [ 643.877019][T15540] overlayfs: missing 'lowerdir' [ 643.884573][T14396] ntfs3: loop4: ino=3, ntfs_set_state failed, -22. [ 643.888376][T15541] loop3: detected capacity change from 0 to 128 [ 643.901175][T15537] EXT4-fs error (device loop1): ext4_orphan_get:1404: inode #15: comm syz.1.2875: iget: bad i_size value: 38620345925642 [ 643.943380][T15537] EXT4-fs error (device loop1): ext4_orphan_get:1409: comm syz.1.2875: couldn't read orphan inode 15 (err -117) [ 643.980880][T15537] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 644.055720][T15541] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[13469] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[15541] [ 644.480401][T13594] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 644.637679][T15550] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2881'. [ 644.659449][T15552] loop4: detected capacity change from 0 to 512 [ 644.674185][T15552] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 644.697266][T15552] EXT4-fs (loop4): ea_inode feature is not supported for Hurd [ 644.894934][T13753] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 646.378069][T15577] loop1: detected capacity change from 0 to 164 [ 646.961963][T14213] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 646.972662][T14213] CPU: 1 PID: 14213 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 646.980342][T14213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 646.990426][T14213] Workqueue: hci4 hci_rx_work [ 646.995150][T14213] Call Trace: [ 646.998441][T14213] [ 647.001389][T14213] dump_stack_lvl+0x18c/0x250 [ 647.006101][T14213] ? show_regs_print_info+0x20/0x20 [ 647.011324][T14213] ? load_image+0x420/0x420 [ 647.015865][T14213] sysfs_create_dir_ns+0x26e/0x2a0 [ 647.021002][T14213] ? __lock_acquire+0x7d80/0x7d80 [ 647.026052][T14213] ? sysfs_warn_dup+0xa0/0xa0 [ 647.030750][T14213] ? preempt_schedule_thunk+0x1a/0x30 [ 647.036156][T14213] kobject_add_internal+0x617/0xc90 [ 647.041390][T14213] kobject_add+0x164/0x240 [ 647.045842][T14213] ? kobject_init+0x1d0/0x1d0 [ 647.050556][T14213] ? get_device_parent+0x366/0x390 [ 647.055722][T14213] device_add+0x3fa/0xc40 [ 647.060080][T14213] hci_conn_add_sysfs+0xd5/0x1e0 [ 647.065061][T14213] le_conn_complete_evt+0xe9f/0x1480 [ 647.070409][T14213] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 647.076698][T14213] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 647.082373][T14213] ? mutex_unlock+0x10/0x10 [ 647.086905][T14213] ? skb_pull_data+0xf0/0x1f0 [ 647.091615][T14213] hci_le_conn_complete_evt+0x187/0x440 [ 647.097198][T14213] ? hci_remote_host_features_evt+0x150/0x150 [ 647.103304][T14213] hci_event_packet+0x7b4/0x1280 [ 647.108287][T14213] ? __lock_acquire+0x7d80/0x7d80 [ 647.113343][T14213] ? lock_chain_count+0x20/0x20 [ 647.118223][T14213] ? bis_list+0x290/0x290 [ 647.122587][T14213] ? lockdep_hardirqs_on+0x98/0x150 [ 647.128353][T14213] ? hci_send_to_monitor+0xd7/0x4f0 [ 647.133597][T14213] hci_rx_work+0x43a/0xd60 [ 647.138060][T14213] ? process_scheduled_works+0x975/0x1600 [ 647.143833][T14213] process_scheduled_works+0xa60/0x1600 [ 647.149440][T14213] ? worker_attach_to_pool+0x370/0x370 [ 647.154933][T14213] ? assign_work+0x3cc/0x5d0 [ 647.159553][T14213] worker_thread+0xa5e/0xfe0 [ 647.164176][T14213] ? _raw_spin_unlock_irqrestore+0xc0/0x120 [ 647.170107][T14213] ? _raw_spin_unlock+0x40/0x40 [ 647.174988][T14213] ? __kthread_parkme+0x71/0x1c0 [ 647.179960][T14213] kthread+0x2fa/0x390 [ 647.184054][T14213] ? pr_cont_work+0x550/0x550 [ 647.188761][T14213] ? kthread_blkcg+0xd0/0xd0 [ 647.193370][T14213] ret_from_fork+0x48/0x80 [ 647.197818][T14213] ? kthread_blkcg+0xd0/0xd0 [ 647.202443][T14213] ret_from_fork_asm+0x11/0x20 [ 647.207323][T14213] [ 647.271531][T14213] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 647.286460][T14213] Bluetooth: hci4: failed to register connection device [ 647.301427][T13756] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 647.463617][T15585] loop4: detected capacity change from 0 to 512 [ 647.515836][T15585] EXT4-fs error (device loop4): ext4_orphan_get:1404: inode #15: comm syz.4.2890: iget: bad i_size value: 38620345925642 [ 647.565587][T15585] EXT4-fs error (device loop4): ext4_orphan_get:1409: comm syz.4.2890: couldn't read orphan inode 15 (err -117) [ 647.600157][T15585] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 647.778464][T15594] loop1: detected capacity change from 0 to 512 [ 647.907411][T15594] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 647.957373][T15594] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 647.972433][T14396] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 647.975964][T15594] System zones: 0-1, 15-15, 18-18, 34-34 [ 648.013924][T15594] EXT4-fs (loop1): orphan cleanup on readonly fs [ 648.033416][T15594] Quota error (device loop1): v2_read_header: Failed header read: expected=8 got=0 [ 648.059919][T15594] EXT4-fs warning (device loop1): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 648.101787][T15594] EXT4-fs (loop1): Cannot turn on quotas: error -22 [ 648.134025][T15594] EXT4-fs (loop1): 1 truncate cleaned up [ 648.146304][T15594] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 649.123222][T13594] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 649.168286][T15607] loop4: detected capacity change from 0 to 256 [ 649.175674][T15607] exfat: Deprecated parameter 'utf8' [ 649.195816][T15607] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x1a9973fb, utbl_chksum : 0xe619d30d) [ 649.354953][T14213] Bluetooth: hci4: command 0x0406 tx timeout [ 651.364618][T15629] loop3: detected capacity change from 0 to 164 [ 651.390900][T14213] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 651.400923][T14213] CPU: 0 PID: 14213 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 651.408590][T14213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 651.418666][T14213] Workqueue: hci3 hci_rx_work [ 651.423373][T14213] Call Trace: [ 651.426668][T14213] [ 651.429617][T14213] dump_stack_lvl+0x18c/0x250 [ 651.434326][T14213] ? show_regs_print_info+0x20/0x20 [ 651.439560][T14213] ? load_image+0x420/0x420 [ 651.444096][T14213] sysfs_create_dir_ns+0x26e/0x2a0 [ 651.449222][T14213] ? __lock_acquire+0x7d80/0x7d80 [ 651.454266][T14213] ? sysfs_warn_dup+0xa0/0xa0 [ 651.458966][T14213] ? do_raw_spin_unlock+0x121/0x230 [ 651.464202][T14213] kobject_add_internal+0x617/0xc90 [ 651.469431][T14213] kobject_add+0x164/0x240 [ 651.473876][T14213] ? preempt_schedule_thunk+0x1a/0x30 [ 651.479248][T14213] ? kobject_init+0x1d0/0x1d0 [ 651.483922][T14213] ? get_device_parent+0x366/0x390 [ 651.489035][T14213] device_add+0x3fa/0xc40 [ 651.493358][T14213] hci_conn_add_sysfs+0xd5/0x1e0 [ 651.498295][T14213] le_conn_complete_evt+0xe9f/0x1480 [ 651.503602][T14213] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 651.509961][T14213] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 651.515733][T14213] ? lockdep_hardirqs_on+0x98/0x150 [ 651.520949][T14213] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 651.526591][T14213] ? hci_remote_host_features_evt+0x150/0x150 [ 651.532667][T14213] hci_le_conn_complete_evt+0x187/0x440 [ 651.538220][T14213] ? hci_remote_host_features_evt+0x150/0x150 [ 651.544293][T14213] hci_event_packet+0x7b4/0x1280 [ 651.549251][T14213] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 651.554901][T14213] ? bis_list+0x290/0x290 [ 651.559243][T14213] ? kcov_remote_start+0x1b5/0x7e0 [ 651.564360][T14213] ? hci_send_to_monitor+0xd7/0x4f0 [ 651.569569][T14213] hci_rx_work+0x43a/0xd60 [ 651.574002][T14213] ? process_scheduled_works+0x975/0x1600 [ 651.579746][T14213] process_scheduled_works+0xa60/0x1600 [ 651.585322][T14213] ? worker_attach_to_pool+0x370/0x370 [ 651.590791][T14213] ? assign_work+0x3cc/0x5d0 [ 651.595393][T14213] worker_thread+0xa5e/0xfe0 [ 651.599997][T14213] ? _raw_spin_unlock_irqrestore+0xc0/0x120 [ 651.605905][T14213] ? _raw_spin_unlock+0x40/0x40 [ 651.610765][T14213] ? __kthread_parkme+0x71/0x1c0 [ 651.615842][T14213] kthread+0x2fa/0x390 [ 651.619913][T14213] ? pr_cont_work+0x550/0x550 [ 651.624604][T14213] ? kthread_blkcg+0xd0/0xd0 [ 651.629195][T14213] ret_from_fork+0x48/0x80 [ 651.633615][T14213] ? kthread_blkcg+0xd0/0xd0 [ 651.638230][T14213] ret_from_fork_asm+0x11/0x20 [ 651.643103][T14213] [ 651.647682][T14213] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 651.670025][T14213] Bluetooth: hci3: failed to register connection device [ 651.851980][T15634] loop2: detected capacity change from 0 to 512 [ 651.909758][T15637] loop4: detected capacity change from 0 to 512 [ 652.002451][T15637] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 652.025143][T15634] EXT4-fs error (device loop2): ext4_orphan_get:1404: inode #15: comm syz.2.2904: iget: bad i_size value: 38620345925642 [ 652.035787][T15637] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 652.045975][T15637] System zones: 0-1, 15-15, 18-18, 34-34 [ 652.052029][T15637] EXT4-fs (loop4): orphan cleanup on readonly fs [ 652.070831][T15637] Quota error (device loop4): v2_read_header: Failed header read: expected=8 got=0 [ 652.202977][ T23] IPVS: starting estimator thread 0... [ 652.209396][T15637] EXT4-fs warning (device loop4): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 652.226178][T15637] EXT4-fs (loop4): Cannot turn on quotas: error -22 [ 652.252176][T15637] EXT4-fs (loop4): 1 truncate cleaned up [ 652.325189][T15645] IPVS: using max 16 ests per chain, 38400 per kthread [ 652.362840][T15634] EXT4-fs error (device loop2): ext4_orphan_get:1409: comm syz.2.2904: couldn't read orphan inode 15 (err -117) [ 652.430093][T15637] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 652.779499][T15647] loop1: detected capacity change from 0 to 256 [ 652.787221][T15647] exfat: Deprecated parameter 'utf8' [ 652.831279][T15647] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x1a9973fb, utbl_chksum : 0xe619d30d) [ 652.966103][T15634] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 653.263560][T15649] loop3: detected capacity change from 0 to 512 [ 653.284220][T13750] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 653.316788][T14396] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 653.351426][T15649] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 653.364979][T15649] ext4 filesystem being mounted at /165/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 653.536084][T13469] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 653.550240][ T27] audit: type=1800 audit(1782961699.613:10): pid=15649 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2908" name="file1" dev="loop3" ino=15 res=0 errno=0 [ 653.745156][ T5787] Bluetooth: hci3: command 0x0406 tx timeout [ 654.086647][T15662] loop3: detected capacity change from 0 to 4096 [ 654.118987][T15662] ntfs3: loop3: Different NTFS sector size (4096) and media sector size (512). [ 654.440773][T15662] ntfs3: loop3: ino=3, ntfs_set_state failed, -22. [ 654.459257][T15662] ntfs3: loop3: Failed to initialize $Extend/$Reparse. [ 654.482775][T15662] ntfs3: loop3: ino=1e, "file1" encrypted i/o not supported [ 654.490432][ T27] audit: type=1800 audit(1782961700.693:11): pid=15662 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2912" name="file1" dev="loop3" ino=30 res=0 errno=0 [ 654.530403][T15662] ntfs3: loop3: ino=1e, "file1" failed to parse mft record [ 654.537952][T15662] ntfs3: loop3: ino=1e, "file1" attr_set_size [ 654.586033][ T6263] ntfs3: loop3: ino=3, ntfs3_write_inode failed, -22. [ 654.594936][T13469] ntfs3: loop3: ino=3, ntfs_set_state failed, -22. [ 654.601953][T13469] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 654.617943][T13469] ntfs3: loop3: ino=3, ntfs_set_state failed, -22. [ 654.837230][ T5787] Bluetooth: Unknown LE signaling command 0xb7 [ 654.843877][ T5787] Bluetooth: Wrong link type (-22) [ 654.964374][T15672] loop1: detected capacity change from 0 to 164 [ 654.980435][ T5787] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 654.990143][ T5787] CPU: 1 PID: 5787 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 654.997732][ T5787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 655.007822][ T5787] Workqueue: hci4 hci_rx_work [ 655.012540][ T5787] Call Trace: [ 655.015842][ T5787] [ 655.018787][ T5787] dump_stack_lvl+0x18c/0x250 [ 655.023506][ T5787] ? show_regs_print_info+0x20/0x20 [ 655.028730][ T5787] ? load_image+0x420/0x420 [ 655.033268][ T5787] sysfs_create_dir_ns+0x26e/0x2a0 [ 655.038428][ T5787] ? __lock_acquire+0x7d80/0x7d80 [ 655.043514][ T5787] ? sysfs_warn_dup+0xa0/0xa0 [ 655.048213][ T5787] ? do_raw_spin_unlock+0x121/0x230 [ 655.053442][ T5787] kobject_add_internal+0x617/0xc90 [ 655.058684][ T5787] kobject_add+0x164/0x240 [ 655.063134][ T5787] ? preempt_schedule_thunk+0x1a/0x30 [ 655.068560][ T5787] ? kobject_init+0x1d0/0x1d0 [ 655.073289][ T5787] ? get_device_parent+0x366/0x390 [ 655.078436][ T5787] device_add+0x3fa/0xc40 [ 655.082799][ T5787] hci_conn_add_sysfs+0xd5/0x1e0 [ 655.087777][ T5787] le_conn_complete_evt+0xe9f/0x1480 [ 655.093102][ T5787] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 655.099396][ T5787] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 655.105077][ T5787] ? mutex_unlock+0x10/0x10 [ 655.109611][ T5787] ? skb_pull_data+0xf0/0x1f0 [ 655.114316][ T5787] hci_le_conn_complete_evt+0x187/0x440 [ 655.119905][ T5787] ? hci_remote_host_features_evt+0x150/0x150 [ 655.126014][ T5787] hci_event_packet+0x7b4/0x1280 [ 655.130995][ T5787] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 655.136660][ T5787] ? bis_list+0x290/0x290 [ 655.141020][ T5787] ? hci_rx_work+0x131/0xd60 [ 655.145644][ T5787] ? hci_rx_work+0x225/0xd60 [ 655.150273][ T5787] ? kasan_check_range+0x89/0x290 [ 655.155367][ T5787] hci_rx_work+0x43a/0xd60 [ 655.159820][ T5787] ? process_scheduled_works+0x975/0x1600 [ 655.165574][ T5787] process_scheduled_works+0xa60/0x1600 [ 655.171176][ T5787] ? worker_attach_to_pool+0x370/0x370 [ 655.176668][ T5787] ? assign_work+0x3cc/0x5d0 [ 655.181302][ T5787] worker_thread+0xa5e/0xfe0 [ 655.185945][ T5787] kthread+0x2fa/0x390 [ 655.190035][ T5787] ? pr_cont_work+0x550/0x550 [ 655.194842][ T5787] ? kthread_blkcg+0xd0/0xd0 [ 655.199588][ T5787] ret_from_fork+0x48/0x80 [ 655.204470][ T5787] ? kthread_blkcg+0xd0/0xd0 [ 655.209090][ T5787] ret_from_fork_asm+0x11/0x20 [ 655.213894][ T5787] [ 655.244514][ T5787] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 655.258950][ T5787] Bluetooth: hci4: failed to register connection device [ 655.329379][T14513] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 655.911168][T15679] loop1: detected capacity change from 0 to 256 [ 655.919101][T15679] exfat: Deprecated parameter 'utf8' [ 655.992416][T15679] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x1a9973fb, utbl_chksum : 0xe619d30d) [ 656.361448][T15674] loop2: detected capacity change from 0 to 40427 [ 656.400574][T15674] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 656.432565][T15674] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 656.551068][T15686] loop3: detected capacity change from 0 to 512 [ 656.636917][T15686] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 656.649656][T15686] ext4 filesystem being mounted at /168/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 656.682301][T15674] F2FS-fs (loop2): Found nat_bits in checkpoint [ 656.697935][ T27] audit: type=1800 audit(1782961702.903:12): pid=15686 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2920" name="file1" dev="loop3" ino=15 res=0 errno=0 [ 656.892032][T13469] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 657.091121][T15674] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 657.139387][T15674] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 657.345330][T14213] Bluetooth: hci4: command 0x0406 tx timeout [ 657.400531][ T27] audit: type=1804 audit(1782961703.603:13): pid=15700 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.2916" name="/newroot/103/file0/bus" dev="loop2" ino=10 res=1 errno=0 [ 658.503726][T15711] overlayfs: missing 'lowerdir' [ 659.730895][T15722] loop4: detected capacity change from 0 to 256 [ 659.738388][T15722] exfat: Deprecated parameter 'utf8' [ 659.753555][T15722] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x1a9973fb, utbl_chksum : 0xe619d30d) [ 661.203110][T15717] loop1: detected capacity change from 0 to 32768 [ 661.254707][T15717] XFS (loop1): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 661.272250][T15742] loop2: detected capacity change from 0 to 128 [ 661.333018][T15742] EXT4-fs (loop2): Test dummy encryption mode enabled [ 661.474044][T15742] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 661.512870][T15742] ext4 filesystem being mounted at /105/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 661.826486][T15717] XFS (loop1): Ending clean mount [ 662.310716][T13594] XFS (loop1): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 663.409543][T15758] loop3: detected capacity change from 0 to 164 [ 663.427681][T14213] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 663.437276][T14213] CPU: 1 PID: 14213 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 663.444929][T14213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 663.455009][T14213] Workqueue: hci3 hci_rx_work [ 663.459725][T14213] Call Trace: [ 663.463015][T14213] [ 663.465964][T14213] dump_stack_lvl+0x18c/0x250 [ 663.470673][T14213] ? show_regs_print_info+0x20/0x20 [ 663.475890][T14213] ? load_image+0x420/0x420 [ 663.480423][T14213] sysfs_create_dir_ns+0x26e/0x2a0 [ 663.485553][T14213] ? __lock_acquire+0x7d80/0x7d80 [ 663.490595][T14213] ? sysfs_warn_dup+0xa0/0xa0 [ 663.495293][T14213] ? do_raw_spin_unlock+0x121/0x230 [ 663.500519][T14213] kobject_add_internal+0x617/0xc90 [ 663.505755][T14213] kobject_add+0x164/0x240 [ 663.510200][T14213] ? preempt_schedule_thunk+0x1a/0x30 [ 663.515598][T14213] ? kobject_init+0x1d0/0x1d0 [ 663.520303][T14213] ? get_device_parent+0x366/0x390 [ 663.525448][T14213] device_add+0x3fa/0xc40 [ 663.529805][T14213] hci_conn_add_sysfs+0xd5/0x1e0 [ 663.534813][T14213] le_conn_complete_evt+0xe9f/0x1480 [ 663.540126][T14213] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 663.546402][T14213] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 663.552071][T14213] ? lockdep_hardirqs_on+0x98/0x150 [ 663.557300][T14213] ? skb_pull_data+0xf0/0x1f0 [ 663.562009][T14213] hci_le_conn_complete_evt+0x187/0x440 [ 663.567604][T14213] ? hci_remote_host_features_evt+0x150/0x150 [ 663.573800][T14213] hci_event_packet+0x7b4/0x1280 [ 663.578770][T14213] ? bis_list+0x290/0x290 [ 663.583126][T14213] ? kasan_check_range+0x89/0x290 [ 663.588177][T14213] ? hci_send_to_monitor+0xd7/0x4f0 [ 663.593404][T14213] hci_rx_work+0x43a/0xd60 [ 663.597849][T14213] ? process_scheduled_works+0x975/0x1600 [ 663.603593][T14213] process_scheduled_works+0xa60/0x1600 [ 663.609195][T14213] ? worker_attach_to_pool+0x370/0x370 [ 663.614693][T14213] ? assign_work+0x3cc/0x5d0 [ 663.619319][T14213] worker_thread+0xa5e/0xfe0 [ 663.623925][T14213] ? _raw_spin_unlock_irqrestore+0xc0/0x120 [ 663.629834][T14213] ? _raw_spin_unlock+0x40/0x40 [ 663.634690][T14213] ? __kthread_parkme+0x71/0x1c0 [ 663.639632][T14213] kthread+0x2fa/0x390 [ 663.643701][T14213] ? pr_cont_work+0x550/0x550 [ 663.648382][T14213] ? kthread_blkcg+0xd0/0xd0 [ 663.652978][T14213] ret_from_fork+0x48/0x80 [ 663.657416][T14213] ? kthread_blkcg+0xd0/0xd0 [ 663.662026][T14213] ret_from_fork_asm+0x11/0x20 [ 663.666930][T14213] [ 663.673773][T14213] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 663.694896][T14213] Bluetooth: hci3: failed to register connection device [ 663.931927][T13750] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 665.745173][T14213] Bluetooth: hci3: command 0x0406 tx timeout [ 666.262932][T15793] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 666.631508][T15807] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2950'. [ 666.777831][T15788] loop3: detected capacity change from 0 to 32768 [ 666.890282][T15788] XFS (loop3): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 667.091175][T15788] XFS (loop3): Ending clean mount [ 667.187645][T15788] XFS (loop3): WARNING: Reset corrupted AGFL on AG 0. 1 blocks leaked. Please unmount and run xfs_repair. [ 668.728140][T13469] XFS (loop3): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 668.849630][T15844] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2959'. [ 668.941382][T15845] Invalid ELF header type: 3 != 1 [ 669.902891][T15854] loop2: detected capacity change from 0 to 512 [ 669.954073][T15853] loop1: detected capacity change from 0 to 512 [ 670.003071][T15854] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 670.016609][T15854] ext4 filesystem being mounted at /113/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 670.076333][ T27] audit: type=1800 audit(1782961716.253:14): pid=15854 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2962" name="file1" dev="loop2" ino=15 res=0 errno=0 [ 670.104194][T15853] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 670.409103][T15853] EXT4-fs error (device loop1): ext4_orphan_get:1430: comm syz.1.2963: bad orphan inode 131083 [ 671.636247][T15853] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 671.717338][T13750] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 671.768635][ T27] audit: type=1800 audit(1782961717.973:15): pid=15853 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2963" name="file1" dev="loop1" ino=15 res=0 errno=0 [ 672.249127][T15872] loop4: detected capacity change from 0 to 512 [ 672.388791][T15872] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 672.397012][T15872] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 672.405527][T15872] System zones: 0-1, 15-15, 18-18, 34-34 [ 672.412712][T15872] EXT4-fs (loop4): orphan cleanup on readonly fs [ 672.419618][T15872] Quota error (device loop4): v2_read_header: Failed header read: expected=8 got=0 [ 672.429332][T15872] EXT4-fs warning (device loop4): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 672.444026][T15872] EXT4-fs (loop4): Cannot turn on quotas: error -22 [ 672.461789][T15872] EXT4-fs (loop4): 1 truncate cleaned up [ 672.475151][T15872] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 672.911264][T14396] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 672.980888][T13594] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 673.284110][T15877] loop2: detected capacity change from 0 to 8192 [ 673.413077][T15877] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 673.455496][T15877] REISERFS (device loop2): found reiserfs format "3.5" with non-standard journal [ 673.484635][T15891] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2971'. [ 673.499475][T15877] REISERFS (device loop2): using ordered data mode [ 673.506316][ T5780] Bluetooth: hci2: command 0x0406 tx timeout [ 673.509736][T15877] reiserfs: using flush barriers [ 673.554405][T15877] REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 673.610583][T15877] REISERFS (device loop2): checking transaction log (loop2) [ 673.646641][T15893] loop4: detected capacity change from 0 to 164 [ 673.682421][T14213] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 673.693022][T14213] CPU: 1 PID: 14213 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 673.700702][T14213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 673.710786][T14213] Workqueue: hci2 hci_rx_work [ 673.715497][T14213] Call Trace: [ 673.718789][T14213] [ 673.721735][T14213] dump_stack_lvl+0x18c/0x250 [ 673.726447][T14213] ? show_regs_print_info+0x20/0x20 [ 673.731670][T14213] ? load_image+0x420/0x420 [ 673.736206][T14213] sysfs_create_dir_ns+0x26e/0x2a0 [ 673.741351][T14213] ? __lock_acquire+0x7d80/0x7d80 [ 673.746407][T14213] ? sysfs_warn_dup+0xa0/0xa0 [ 673.751107][T14213] ? do_raw_spin_unlock+0x121/0x230 [ 673.756334][T14213] kobject_add_internal+0x617/0xc90 [ 673.761569][T14213] kobject_add+0x164/0x240 [ 673.766012][T14213] ? preempt_schedule_thunk+0x1a/0x30 [ 673.771411][T14213] ? kobject_init+0x1d0/0x1d0 [ 673.776120][T14213] ? get_device_parent+0x366/0x390 [ 673.781264][T14213] device_add+0x3fa/0xc40 [ 673.785618][T14213] hci_conn_add_sysfs+0xd5/0x1e0 [ 673.790583][T14213] le_conn_complete_evt+0xe9f/0x1480 [ 673.795901][T14213] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 673.802173][T14213] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 673.807860][T14213] hci_le_conn_complete_evt+0x187/0x440 [ 673.813436][T14213] ? hci_remote_host_features_evt+0x150/0x150 [ 673.819536][T14213] hci_event_packet+0x7b4/0x1280 [ 673.824506][T14213] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 673.830169][T14213] ? bis_list+0x290/0x290 [ 673.834530][T14213] ? kcov_remote_start+0x1b5/0x7e0 [ 673.839664][T14213] ? hci_send_to_monitor+0xd7/0x4f0 [ 673.844884][T14213] hci_rx_work+0x43a/0xd60 [ 673.849332][T14213] ? process_scheduled_works+0x975/0x1600 [ 673.855079][T14213] process_scheduled_works+0xa60/0x1600 [ 673.860675][T14213] ? worker_attach_to_pool+0x370/0x370 [ 673.866165][T14213] ? assign_work+0x3cc/0x5d0 [ 673.870785][T14213] worker_thread+0xa5e/0xfe0 [ 673.875403][T14213] ? _raw_spin_unlock_irqrestore+0xc0/0x120 [ 673.881331][T14213] ? _raw_spin_unlock+0x40/0x40 [ 673.886205][T14213] ? __kthread_parkme+0x71/0x1c0 [ 673.891176][T14213] kthread+0x2fa/0x390 [ 673.895265][T14213] ? pr_cont_work+0x550/0x550 [ 673.899967][T14213] ? kthread_blkcg+0xd0/0xd0 [ 673.904576][T14213] ret_from_fork+0x48/0x80 [ 673.909012][T14213] ? kthread_blkcg+0xd0/0xd0 [ 673.913623][T14213] ret_from_fork_asm+0x11/0x20 [ 673.918426][T14213] [ 673.951991][T14213] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 673.966323][T14213] Bluetooth: hci2: failed to register connection device [ 673.984457][T15877] REISERFS (device loop2): Using r5 hash to sort names [ 674.001853][T15877] REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage. [ 674.016239][T13756] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 674.730200][T15899] loop4: detected capacity change from 0 to 4096 [ 674.746478][T15899] ntfs3: loop4: Different NTFS sector size (4096) and media sector size (512). [ 674.774727][T15905] loop2: detected capacity change from 0 to 512 [ 674.917115][T15905] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 675.051203][T15905] ext4 filesystem being mounted at /116/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 675.117141][ T27] audit: type=1800 audit(1782961721.283:16): pid=15905 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2974" name="file1" dev="loop2" ino=15 res=0 errno=0 [ 676.434885][T14213] Bluetooth: hci2: command 0x0406 tx timeout [ 676.466298][T15899] ntfs3: loop4: ino=3, ntfs_set_state failed, -22. [ 676.540987][T15914] loop1: detected capacity change from 0 to 512 [ 676.825657][T13750] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 676.844048][T15899] ntfs3: loop4: Failed to initialize $Extend/$Reparse. [ 676.865071][T15914] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 676.874360][T15914] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 676.884872][T15914] System zones: 0-1, 15-15, 18-18, 34-34 [ 676.890890][T15914] EXT4-fs (loop1): orphan cleanup on readonly fs [ 676.897556][T15914] Quota error (device loop1): v2_read_header: Failed header read: expected=8 got=0 [ 676.907017][T15914] EXT4-fs warning (device loop1): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 676.921625][T15914] EXT4-fs (loop1): Cannot turn on quotas: error -22 [ 676.940426][T15914] EXT4-fs (loop1): 1 truncate cleaned up [ 676.947450][T15914] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 676.958274][T15899] ntfs3: loop4: ino=1e, "file1" encrypted i/o not supported [ 677.022457][ T27] audit: type=1800 audit(1782961723.223:17): pid=15899 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2973" name="file1" dev="loop4" ino=30 res=0 errno=0 [ 677.090339][T15899] ntfs3: loop4: ino=1e, "file1" failed to parse mft record [ 677.108620][T15899] ntfs3: loop4: ino=1e, "file1" attr_set_size [ 677.245863][T13594] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 677.378116][T15924] loop2: detected capacity change from 0 to 256 [ 677.386097][T15924] exfat: Deprecated parameter 'utf8' [ 677.396086][ T3448] ntfs3: loop4: ino=3, ntfs3_write_inode failed, -22. [ 677.423406][T14396] ntfs3: loop4: ino=3, ntfs_set_state failed, -22. [ 677.423539][T15924] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x1a9973fb, utbl_chksum : 0xe619d30d) [ 677.494501][T14396] ntfs3: loop4: Mark volume as dirty due to NTFS errors [ 677.513674][T14396] ntfs3: loop4: ino=3, ntfs_set_state failed, -22. [ 677.716189][T15930] loop1: detected capacity change from 0 to 8192 [ 677.736766][T15930] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 677.858908][T15930] REISERFS (device loop1): found reiserfs format "3.5" with non-standard journal [ 677.870911][T15930] REISERFS (device loop1): using ordered data mode [ 677.877647][T15930] reiserfs: using flush barriers [ 677.884384][T15930] REISERFS (device loop1): journal params: device loop1, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 677.902029][T15930] REISERFS (device loop1): checking transaction log (loop1) [ 677.920223][T15930] REISERFS (device loop1): Using r5 hash to sort names [ 677.997028][T15935] loop4: detected capacity change from 0 to 164 [ 678.561002][T14213] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 678.574868][T14213] CPU: 0 PID: 14213 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 678.582578][T14213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 678.592664][T14213] Workqueue: hci2 hci_rx_work [ 678.597389][T14213] Call Trace: [ 678.600699][T14213] [ 678.603656][T14213] dump_stack_lvl+0x18c/0x250 [ 678.608375][T14213] ? show_regs_print_info+0x20/0x20 [ 678.613618][T14213] ? load_image+0x420/0x420 [ 678.618175][T14213] sysfs_create_dir_ns+0x26e/0x2a0 [ 678.623317][T14213] ? __lock_acquire+0x7d80/0x7d80 [ 678.628351][T14213] ? sysfs_warn_dup+0xa0/0xa0 [ 678.633033][T14213] ? do_raw_spin_unlock+0x121/0x230 [ 678.638253][T14213] kobject_add_internal+0x617/0xc90 [ 678.643467][T14213] kobject_add+0x164/0x240 [ 678.647892][T14213] ? kobject_init+0x1d0/0x1d0 [ 678.652578][T14213] ? get_device_parent+0x366/0x390 [ 678.657697][T14213] device_add+0x3fa/0xc40 [ 678.662036][T14213] hci_conn_add_sysfs+0xd5/0x1e0 [ 678.666983][T14213] le_conn_complete_evt+0xe9f/0x1480 [ 678.672282][T14213] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 678.678530][T14213] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 678.684174][T14213] ? mutex_unlock+0x10/0x10 [ 678.688678][T14213] ? skb_pull_data+0xf0/0x1f0 [ 678.693358][T14213] hci_le_conn_complete_evt+0x187/0x440 [ 678.698914][T14213] ? hci_remote_host_features_evt+0x150/0x150 [ 678.705000][T14213] hci_event_packet+0x7b4/0x1280 [ 678.709965][T14213] ? __lock_acquire+0x7d80/0x7d80 [ 678.715011][T14213] ? lock_chain_count+0x20/0x20 [ 678.719869][T14213] ? bis_list+0x290/0x290 [ 678.724211][T14213] ? lockdep_hardirqs_on+0x98/0x150 [ 678.729420][T14213] ? hci_send_to_monitor+0xd7/0x4f0 [ 678.734622][T14213] hci_rx_work+0x43a/0xd60 [ 678.739051][T14213] ? process_scheduled_works+0x975/0x1600 [ 678.744775][T14213] process_scheduled_works+0xa60/0x1600 [ 678.750350][T14213] ? worker_attach_to_pool+0x370/0x370 [ 678.755813][T14213] ? assign_work+0x3cc/0x5d0 [ 678.760411][T14213] worker_thread+0xa5e/0xfe0 [ 678.765010][T14213] ? _raw_spin_unlock_irqrestore+0xc0/0x120 [ 678.770909][T14213] ? _raw_spin_unlock+0x40/0x40 [ 678.775761][T14213] ? __kthread_parkme+0x71/0x1c0 [ 678.780703][T14213] kthread+0x2fa/0x390 [ 678.784770][T14213] ? pr_cont_work+0x550/0x550 [ 678.789455][T14213] ? kthread_blkcg+0xd0/0xd0 [ 678.794049][T14213] ret_from_fork+0x48/0x80 [ 678.798468][T14213] ? kthread_blkcg+0xd0/0xd0 [ 678.803057][T14213] ret_from_fork_asm+0x11/0x20 [ 678.807837][T14213] [ 678.821587][T14213] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 678.835735][T14213] Bluetooth: hci2: failed to register connection device [ 678.845034][T15930] REISERFS (device loop1): Created .reiserfs_priv - reserved for xattr storage. [ 678.865508][T13753] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 679.133557][T15928] loop3: detected capacity change from 0 to 40427 [ 679.204982][T15928] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 679.270735][T15928] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 679.663845][T15928] F2FS-fs (loop3): Found nat_bits in checkpoint [ 679.827772][T15950] loop1: detected capacity change from 0 to 512 [ 679.927557][T15928] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 679.958850][T15950] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 680.051217][T15928] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 680.078774][T15950] ext4 filesystem being mounted at /175/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 680.204870][ T27] audit: type=1804 audit(1782961726.403:18): pid=15928 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.2981" name="/newroot/182/file0/bus" dev="loop3" ino=10 res=1 errno=0 [ 680.341500][T15963] loop4: detected capacity change from 0 to 512 [ 681.188632][T14213] Bluetooth: hci2: command 0x0406 tx timeout [ 681.797286][T15963] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 681.805319][T15963] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 681.813396][T15963] System zones: 0-1, 15-15, 18-18, 34-34 [ 681.819460][T15963] EXT4-fs (loop4): orphan cleanup on readonly fs [ 681.825978][T15963] Quota error (device loop4): v2_read_header: Failed header read: expected=8 got=0 [ 681.835399][T15963] EXT4-fs warning (device loop4): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 681.849990][T15963] EXT4-fs (loop4): Cannot turn on quotas: error -22 [ 681.892552][T15963] EXT4-fs (loop4): 1 truncate cleaned up [ 681.899657][T15963] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 681.974774][ T27] audit: type=1800 audit(1782961728.173:19): pid=15950 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2986" name="file1" dev="loop1" ino=15 res=0 errno=0 [ 682.184019][T14396] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 682.571809][T15972] loop4: detected capacity change from 0 to 256 [ 682.579270][T15972] exfat: Deprecated parameter 'utf8' [ 682.639073][T15972] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x1a9973fb, utbl_chksum : 0xe619d30d) [ 683.789478][T15988] loop4: detected capacity change from 0 to 512 [ 683.808690][T15988] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 683.844911][T15988] EXT4-fs (loop4): ea_inode feature is not supported for Hurd [ 683.899306][T13756] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 684.726256][T15990] loop2: detected capacity change from 0 to 40427 [ 684.746577][T15990] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 684.768725][T15990] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 684.818372][T15990] F2FS-fs (loop2): Found nat_bits in checkpoint [ 685.065847][T15990] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 685.098823][T15990] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 685.315159][T16005] loop3: detected capacity change from 0 to 512 [ 685.653401][T16005] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 685.661645][T16005] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 685.670160][T16005] System zones: 0-1, 15-15, 18-18, 34-34 [ 685.678259][T16005] EXT4-fs (loop3): orphan cleanup on readonly fs [ 685.685360][T16005] Quota error (device loop3): v2_read_header: Failed header read: expected=8 got=0 [ 685.694972][T16005] EXT4-fs warning (device loop3): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 685.709675][T16005] EXT4-fs (loop3): Cannot turn on quotas: error -22 [ 685.734485][T16005] EXT4-fs (loop3): 1 truncate cleaned up [ 685.746633][T16005] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 686.049000][T13469] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 686.070738][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.641104][T16014] overlayfs: missing 'lowerdir' [ 687.320819][T16020] loop2: detected capacity change from 0 to 256 [ 687.328365][T16020] exfat: Deprecated parameter 'utf8' [ 687.384082][T16020] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x1a9973fb, utbl_chksum : 0xe619d30d) [ 687.682023][T13594] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 688.914484][ T42] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 689.235122][ T42] usb 4-1: Using ep0 maxpacket: 32 [ 689.339103][ T42] usb 4-1: config index 0 descriptor too short (expected 13339, got 27) [ 689.507084][ T42] usb 4-1: config 108 has an invalid descriptor of length 32, skipping remainder of the config [ 689.721044][ T42] usb 4-1: config 108 has 0 interfaces, different from the descriptor's value: 32 [ 689.938176][ T42] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 690.074726][ T42] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 690.176690][ T42] usb 4-1: Product: syz [ 691.425259][ T42] usb 4-1: Manufacturer: syz [ 691.429974][ T42] usb 4-1: SerialNumber: syz [ 691.685430][T16044] loop4: detected capacity change from 0 to 512 [ 691.700730][ T42] usb 4-1: USB disconnect, device number 8 [ 691.722533][T16044] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 691.744950][T16044] EXT4-fs (loop4): ea_inode feature is not supported for Hurd [ 692.251421][T14181] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 692.788099][T16056] loop2: detected capacity change from 0 to 512 [ 692.917717][T16056] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 692.939567][T16056] ext4 filesystem being mounted at /127/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 693.073873][ T27] audit: type=1800 audit(1782961739.273:20): pid=16056 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3014" name="file1" dev="loop2" ino=15 res=0 errno=0 [ 694.250197][T16077] overlayfs: missing 'lowerdir' [ 694.416881][T16075] loop3: detected capacity change from 0 to 8192 [ 694.454290][T16075] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 694.514596][T16075] REISERFS (device loop3): found reiserfs format "3.5" with non-standard journal [ 694.555056][T16075] REISERFS (device loop3): using ordered data mode [ 694.561624][T16075] reiserfs: using flush barriers [ 694.574916][T16075] REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 694.596685][T16075] REISERFS (device loop3): checking transaction log (loop3) [ 694.636747][T16075] REISERFS (device loop3): Using r5 hash to sort names [ 694.662964][T16075] REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage. [ 694.693664][T16080] loop4: detected capacity change from 0 to 4096 [ 694.837112][T16080] ntfs3: loop4: Different NTFS sector size (4096) and media sector size (512). [ 695.135140][T16080] ntfs3: loop4: ino=3, ntfs_set_state failed, -22. [ 695.166594][T16080] ntfs3: loop4: Failed to initialize $Extend/$Reparse. [ 695.376609][ T11] ntfs3: loop4: ino=3, ntfs3_write_inode failed, -22. [ 695.383613][T14396] ntfs3: loop4: ino=3, ntfs_set_state failed, -22. [ 695.420889][T14396] ntfs3: loop4: Mark volume as dirty due to NTFS errors [ 695.445561][T14396] ntfs3: loop4: ino=3, ntfs_set_state failed, -22. [ 695.480391][ T6263] ntfs3: loop4: ino=3, ntfs3_write_inode failed, -22. [ 697.818711][T16108] loop3: detected capacity change from 0 to 512 [ 697.879577][T16108] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 697.938396][T16108] EXT4-fs (loop3): ea_inode feature is not supported for Hurd [ 698.252210][T16110] loop4: detected capacity change from 0 to 8192 [ 698.272167][T16114] overlayfs: missing 'lowerdir' [ 698.296412][T16110] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 698.352317][T16110] REISERFS (device loop4): found reiserfs format "3.5" with non-standard journal [ 698.395577][T16110] REISERFS (device loop4): using ordered data mode [ 698.402138][T16110] reiserfs: using flush barriers [ 698.495107][T16110] REISERFS (device loop4): journal params: device loop4, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 698.545471][T16110] REISERFS (device loop4): checking transaction log (loop4) [ 698.586449][T16110] REISERFS (device loop4): Using r5 hash to sort names [ 698.593719][T16110] REISERFS (device loop4): Created .reiserfs_priv - reserved for xattr storage. [ 698.643251][T13750] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 701.631855][T16152] loop4: detected capacity change from 0 to 512 [ 701.881150][T16152] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 702.095898][T16152] ext4 filesystem being mounted at /90/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 702.124627][T16154] loop1: detected capacity change from 0 to 8192 [ 702.167382][ T27] audit: type=1800 audit(1782961748.373:21): pid=16152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.3042" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 702.225770][T16154] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 702.239965][T16154] REISERFS (device loop1): found reiserfs format "3.5" with non-standard journal [ 702.253085][T16154] REISERFS (device loop1): using ordered data mode [ 702.259869][T16154] reiserfs: using flush barriers [ 702.285303][T16154] REISERFS (device loop1): journal params: device loop1, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 702.305702][T16154] REISERFS (device loop1): checking transaction log (loop1) [ 702.373636][T16154] REISERFS (device loop1): Using r5 hash to sort names [ 702.398469][T16154] REISERFS (device loop1): Created .reiserfs_priv - reserved for xattr storage. [ 704.089607][T16185] loop1: detected capacity change from 0 to 512 [ 704.137548][T16185] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 704.145726][T16185] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 704.154570][T16185] System zones: 0-1, 15-15, 18-18, 34-34 [ 704.161897][T16185] EXT4-fs (loop1): orphan cleanup on readonly fs [ 704.168841][T16185] Quota error (device loop1): v2_read_header: Failed header read: expected=8 got=0 [ 704.178603][T16185] EXT4-fs warning (device loop1): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 704.193305][T16185] EXT4-fs (loop1): Cannot turn on quotas: error -22 [ 704.222024][T16185] EXT4-fs (loop1): 1 truncate cleaned up [ 704.233890][T16185] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 704.463041][T16189] overlayfs: missing 'lowerdir' [ 704.544623][T13594] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 707.074282][T16208] loop3: detected capacity change from 0 to 512 [ 707.096502][T16208] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 707.127529][T16208] EXT4-fs (loop3): ea_inode feature is not supported for Hurd [ 708.108846][T16210] loop2: detected capacity change from 0 to 8192 [ 708.182629][T16210] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 708.268432][T16210] REISERFS (device loop2): found reiserfs format "3.5" with non-standard journal [ 708.331225][T16210] REISERFS (device loop2): using ordered data mode [ 708.750318][T16210] reiserfs: using flush barriers [ 708.863293][T16210] REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 708.890998][T16210] REISERFS (device loop2): checking transaction log (loop2) [ 708.909460][T16210] REISERFS (device loop2): Using r5 hash to sort names [ 708.987270][T16210] REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage. [ 709.253697][T16225] loop1: detected capacity change from 0 to 128 [ 709.307831][T14396] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 709.328599][T16225] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 709.664209][T16225] ext4 filesystem being mounted at /192/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 710.248328][T16238] overlayfs: missing 'lowerdir' [ 710.518946][T16239] [ 710.521328][T16239] ====================================================== [ 710.528366][T16239] WARNING: possible circular locking dependency detected [ 710.535412][T16239] syzkaller #0 Not tainted [ 710.539831][T16239] ------------------------------------------------------ [ 710.546861][T16239] syz.1.3060/16239 is trying to acquire lock: [ 710.552930][T16239] ffff88807d1ec608 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x2b4/0xe70 [ 710.561931][T16239] [ 710.561931][T16239] but task is already holding lock: [ 710.569308][T16239] ffff88807d1eec58 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_ext_migrate+0x313/0x1060 [ 710.579566][T16239] [ 710.579566][T16239] which lock already depends on the new lock. [ 710.579566][T16239] [ 710.589985][T16239] [ 710.589985][T16239] the existing dependency chain (in reverse order) is: [ 710.599008][T16239] [ 710.599008][T16239] -> #1 (&sbi->s_writepages_rwsem){++++}-{0:0}: [ 710.607454][T16239] percpu_down_read+0x44/0x1a0 [ 710.612763][T16239] ext4_writepages+0x1a4/0x350 [ 710.618064][T16239] do_writepages+0x351/0x590 [ 710.623225][T16239] __writeback_single_inode+0x14e/0xee0 [ 710.629338][T16239] writeback_single_inode+0x21f/0x760 [ 710.635248][T16239] write_inode_now+0x183/0x210 [ 710.640546][T16239] iput+0x58f/0x900 [ 710.644885][T16239] ext4_xattr_block_set+0x2228/0x2fe0 [ 710.650797][T16239] ext4_expand_extra_isize_ea+0x128f/0x1e70 [ 710.657235][T16239] __ext4_expand_extra_isize+0x306/0x400 [ 710.663411][T16239] __ext4_mark_inode_dirty+0x458/0x6d0 [ 710.669421][T16239] ext4_evict_inode+0x7dd/0xe70 [ 710.674911][T16239] evict+0x4b7/0x8a0 [ 710.679349][T16239] ext4_orphan_cleanup+0xc33/0x1470 [ 710.685078][T16239] ext4_fill_super+0x5fb5/0x6870 [ 710.690548][T16239] get_tree_bdev+0x3e5/0x520 [ 710.695680][T16239] vfs_get_tree+0x8c/0x280 [ 710.700629][T16239] do_new_mount+0x24a/0xa40 [ 710.705663][T16239] __se_sys_mount+0x2e7/0x3d0 [ 710.710877][T16239] do_syscall_64+0x55/0xb0 [ 710.715834][T16239] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 710.722275][T16239] [ 710.722275][T16239] -> #0 (sb_internal){.+.+}-{0:0}: [ 710.729602][T16239] __lock_acquire+0x37ef/0x7d80 [ 710.734988][T16239] lock_acquire+0x19e/0x420 [ 710.740022][T16239] percpu_down_read+0x44/0x1a0 [ 710.745330][T16239] ext4_evict_inode+0x2b4/0xe70 [ 710.750716][T16239] evict+0x4b7/0x8a0 [ 710.755141][T16239] ext4_ext_migrate+0xcd4/0x1060 [ 710.760610][T16239] ext4_ioctl+0x1ede/0x3b70 [ 710.765651][T16239] __se_sys_ioctl+0xfd/0x170 [ 710.770784][T16239] do_syscall_64+0x55/0xb0 [ 710.775738][T16239] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 710.782434][T16239] [ 710.782434][T16239] other info that might help us debug this: [ 710.782434][T16239] [ 710.792670][T16239] Possible unsafe locking scenario: [ 710.792670][T16239] [ 710.800126][T16239] CPU0 CPU1 [ 710.805492][T16239] ---- ---- [ 710.810859][T16239] lock(&sbi->s_writepages_rwsem); [ 710.816098][T16239] lock(sb_internal); [ 710.822697][T16239] lock(&sbi->s_writepages_rwsem); [ 710.830431][T16239] rlock(sb_internal); [ 710.834595][T16239] [ 710.834595][T16239] *** DEADLOCK *** [ 710.834595][T16239] [ 710.842740][T16239] 3 locks held by syz.1.3060/16239: [ 710.847944][T16239] #0: ffff88807d1ec418 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write_file+0x63/0x200 [ 710.857648][T16239] #1: ffff88807717ac10 (&sb->s_type->i_mutex_key#9){++++}-{3:3}, at: ext4_ioctl+0x1ed6/0x3b70 [ 710.868034][T16239] #2: ffff88807d1eec58 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_ext_migrate+0x313/0x1060 [ 710.878683][T16239] [ 710.878683][T16239] stack backtrace: [ 710.884574][T16239] CPU: 1 PID: 16239 Comm: syz.1.3060 Not tainted syzkaller #0 [ 710.892041][T16239] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 710.902104][T16239] Call Trace: [ 710.905395][T16239] [ 710.908339][T16239] dump_stack_lvl+0x18c/0x250 [ 710.913037][T16239] ? load_image+0x420/0x420 [ 710.917550][T16239] ? show_regs_print_info+0x20/0x20 [ 710.922765][T16239] ? print_circular_bug+0x12b/0x1a0 [ 710.927975][T16239] check_noncircular+0x2fc/0x400 [ 710.932928][T16239] ? print_deadlock_bug+0x5d0/0x5d0 [ 710.938135][T16239] ? lockdep_lock+0xf5/0x230 [ 710.942739][T16239] ? _find_first_zero_bit+0xd6/0x100 [ 710.948088][T16239] __lock_acquire+0x37ef/0x7d80 [ 710.952965][T16239] ? verify_lock_unused+0x140/0x140 [ 710.958189][T16239] ? truncate_inode_pages_range+0x3d7/0xea0 [ 710.964129][T16239] ? asan.module_dtor+0x20/0x20 [ 710.969006][T16239] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 710.974664][T16239] ? mapping_evict_folio+0x530/0x530 [ 710.979966][T16239] lock_acquire+0x19e/0x420 [ 710.984485][T16239] ? ext4_evict_inode+0x2b4/0xe70 [ 710.989528][T16239] ? preempt_schedule+0xc0/0xd0 [ 710.994390][T16239] ? __might_sleep+0xe0/0xe0 [ 710.999011][T16239] ? read_lock_is_recursive+0x20/0x20 [ 711.004418][T16239] ? do_raw_spin_lock+0x11f/0x2b0 [ 711.009468][T16239] ? dquot_initialize+0x20/0x20 [ 711.014339][T16239] ? __rwlock_init+0x150/0x150 [ 711.019121][T16239] percpu_down_read+0x44/0x1a0 [ 711.023905][T16239] ? ext4_evict_inode+0x2b4/0xe70 [ 711.028952][T16239] ext4_evict_inode+0x2b4/0xe70 [ 711.033830][T16239] ? evict+0x482/0x8a0 [ 711.037912][T16239] ? sb_clear_inode_writeback+0x330/0x330 [ 711.043649][T16239] ? do_raw_spin_lock+0x11f/0x2b0 [ 711.048703][T16239] ? ext4_inode_is_fast_symlink+0x390/0x390 [ 711.054622][T16239] ? do_raw_spin_unlock+0x121/0x230 [ 711.059850][T16239] ? ext4_inode_is_fast_symlink+0x390/0x390 [ 711.065760][T16239] evict+0x4b7/0x8a0 [ 711.069671][T16239] ? __lock_acquire+0x7d80/0x7d80 [ 711.074716][T16239] ? proc_nr_inodes+0x230/0x230 [ 711.079583][T16239] ? do_raw_spin_unlock+0x121/0x230 [ 711.084801][T16239] ? _raw_spin_unlock+0x28/0x40 [ 711.089850][T16239] ext4_ext_migrate+0xcd4/0x1060 [ 711.094809][T16239] ? mb_regenerate_buddy+0x510/0x510 [ 711.100114][T16239] ? down_read_killable+0x340/0x340 [ 711.105355][T16239] ? sb_start_write+0x110/0x1c0 [ 711.110236][T16239] ? mnt_want_write_file+0x16a/0x200 [ 711.115550][T16239] ext4_ioctl+0x1ede/0x3b70 [ 711.120066][T16239] ? ext4_fileattr_set+0x16e0/0x16e0 [ 711.125380][T16239] ? mark_lock+0x94/0x320 [ 711.129726][T16239] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 711.135726][T16239] ? do_vfs_ioctl+0x156c/0x1cc0 [ 711.140597][T16239] ? __ia32_compat_sys_ioctl+0x8a0/0x8a0 [ 711.146252][T16239] ? tomoyo_path_number_perm+0x217/0x5e0 [ 711.151955][T16239] ? __lock_acquire+0x7d80/0x7d80 [ 711.156995][T16239] ? slab_free_freelist_hook+0x130/0x1a0 [ 711.162642][T16239] ? tomoyo_path_number_perm+0x4b7/0x5e0 [ 711.168284][T16239] ? __kmem_cache_free+0xba/0x1f0 [ 711.173330][T16239] ? tomoyo_path_number_perm+0x56b/0x5e0 [ 711.178987][T16239] ? tomoyo_path_number_perm+0x217/0x5e0 [ 711.184653][T16239] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 711.190159][T16239] ? __fget_files+0x28/0x460 [ 711.194789][T16239] ? bpf_lsm_file_ioctl+0x9/0x10 [ 711.199772][T16239] ? security_file_ioctl+0x80/0xa0 [ 711.204910][T16239] ? ext4_fileattr_set+0x16e0/0x16e0 [ 711.210205][T16239] __se_sys_ioctl+0xfd/0x170 [ 711.214816][T16239] do_syscall_64+0x55/0xb0 [ 711.219247][T16239] ? clear_bhb_loop+0x40/0x90 [ 711.223932][T16239] ? clear_bhb_loop+0x40/0x90 [ 711.228626][T16239] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 711.234563][T16239] RIP: 0033:0x7efcfab9de59 [ 711.238992][T16239] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 711.258706][T16239] RSP: 002b:00007efcfba3d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 711.267203][T16239] RAX: ffffffffffffffda RBX: 00007efcfae26090 RCX: 00007efcfab9de59 [ 711.275191][T16239] RDX: 0000000000000000 RSI: 0000000000006609 RDI: 0000000000000009 [ 711.283175][T16239] RBP: 00007efcfac33e6f R08: 0000000000000000 R09: 0000000000000000 [ 711.291156][T16239] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 711.299143][T16239] R13: 00007efcfae26128 R14: 00007efcfae26090 R15: 00007ffca8543948 [ 711.307133][T16239] [ 711.536918][T13594] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.