last executing test programs: 5m56.351797318s ago: executing program 32 (id=117): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/dynamic_events\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='e:my_read_msr2 msr/read_msr', 0x1b) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./tracing/events/eprobes/my_read_msr2/enable\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1', 0x1) 5m50.833241263s ago: executing program 33 (id=145): r0 = getpgrp(0x0) r1 = syz_pidfd_open(r0, 0x0) r2 = epoll_create(0x1) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000180)) r3 = gettid() kcmp$KCMP_EPOLL_TFD(r0, r3, 0x7, r1, &(0x7f0000000040)={r2, r1}) 4m30.261375308s ago: executing program 2 (id=662): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@mcast2, 0x300, 0x0, 0x2, 0x9, 0x0, 0x4}, 0x20) r1 = socket$inet6(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', 0x0, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000080)={@dev={0xfe, 0x80, '\x00', 0xe}, 0x300, 0x0, 0x2, 0x9, 0x0, 0x4}, 0x20) 4m29.638648136s ago: executing program 2 (id=667): r0 = gettid() r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x8000) read(r1, &(0x7f0000000200)=""/209, 0xd1) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000180)={0x335, @tick=0xe, 0x42, {}, 0x2}) tkill(r0, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f0000000040)={0x6, 0x2, 0x1, 'queue0\x00', 0x8}) 4m29.145593079s ago: executing program 2 (id=669): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870fd00090582020002"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120127528e855067728d000000000010231207"], 0x0) syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x900) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000000)=ANY=[@ANYBLOB="a200004ef3b11f948ef66b0ee0b3d41b1b"]) syz_usb_connect(0x0, 0x0, 0x0, 0x0) 4m26.878174994s ago: executing program 2 (id=680): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000002240)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="73686f72746e616d653d77696e6e742c666c7573682c646d61736b3d30303030303030303030303030303030303137373737372c73686f72746e616d653d77696e39352c636865636b3d7374726963742c73686f72746e616d653d6d697865642c6e6f6e756d7461696c3d302c757466383d312c73686f72746e616d653d77696e6e742c756e695f786c6174653d312c756e695f786c6174653d312c726f6469722c696f636861727365743d757466382c666d61736b3d30303030303030303030303030303030303030303030342c646d61736b3d30303030303030303030303030303030303030303030372c757466383d312c726f6469722c73686f72746e616d653d77696e39352c726f6469722c00743ccfec81d6c7d05b0f2a54ddce151ec4cbbaacb9552647fd950fedfdc024b3953e7669bc9d4f66e3beaecb80fe73633280b1d3e82023d4f5c7f5a4989406c0f0d0cf537f132dc1e63d84a17532cb78ae7a368bc0029207b9b166705972f4e8dad041e6be170bf43057b456d43f100c53b471aa6c8e3751", @ANYRESHEX], 0x0, 0x2c2, &(0x7f00000006c0)="$eJzs3T+LI2UYAPBndpNJ7iySwkoEB7SwOm6vtckiOThMpaRQC128O5AkCHew4CkGK1sbSz+BINj5JWwEP4DgB7DzioNXJpkh2btJsoHLrX9+vyL77Lzv877POzPZPyzz7sevziZ3i7j/9Ze/R7ebxdEgBvE4i34cRS2llGJl8G0AAP9mj1OKP9PSJVMG5UsWEd3DlgYAHMje3/9/OnhJAMCBvff+B++cjkbDd4uiG7dn35yPy9/sy4/L9tP78WlM417cjF48Wf4toP5poXy9nVKat4pSP96Yzc/HZebso1+q8U/riU6iF/1FdDH/zmh4Uiyt5c/LOq5X8w/K+W9FL15umP/OaHirIT/Gebz5+lr9N6IXv34Sn8U07i6KWOV/dVIUb6fv/vriw7K8Mj+bn487i34r6fjFXRUAAAAAAAAAAAAAAAAAAAAAAP7rblR753RisX9Peajaf+f4SflJO4pa/+L+PMv8rB7oqf2B5im+T6nTihgNbxZFkaqOq/xWvNKK1tWsGgAAAAAAAAAAAAAAAAAAAP5ZHn7+aHI2nd570BD8dj1iQ9OGoN4NoH6sf0fW8aamwdqR1+LR5KyzecC1pqMq3DJpHNd9soity4lWux65v9dJ2D+4tqnmH37cd8Du7j7tbefn+QT13TU5y6KxTyfqI936mv683iePS86Vb2pKu2+/tSBvbOrtvfb8pUUw39Insm2FvfXH8sxVR7KnV5EvzmpjenttN47me6P5Wmx6pzwjW7yt8+f3xQcAAAAAAAAAAAAAAAAAALhg9dDvM03XdqQepc7BygIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAF2r1///3COZV8iU65/Hg4RUvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP+BvwMAAP//QSRWPA==") mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x103090, 0x0) mount$bind(&(0x7f0000001900)='.\x00', &(0x7f0000000380)='./file0/file0\x00', 0x0, 0x2a05004, 0x0) mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x24000, 0x0) 4m26.434988595s ago: executing program 2 (id=683): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10, 0x0) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x400a8, &(0x7f0000000380)=ANY=[], 0x5, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x22000, 0x0, 0x0, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./bus\x00', 0x1000000, 0x0, 0xf, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@xino_auto}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) 4m25.868511511s ago: executing program 2 (id=687): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') fchdir(r1) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) syz_open_procfs(r0, &(0x7f0000001500)='pagemap\x00') 4m25.268614318s ago: executing program 34 (id=687): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') fchdir(r1) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) syz_open_procfs(r0, &(0x7f0000001500)='pagemap\x00') 3m3.616787983s ago: executing program 3 (id=1313): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x200}) readv(r0, &(0x7f00000006c0)=[{&(0x7f0000000000)=""/236, 0xec}], 0x1) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000906000/0x400000)=nil) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000400)={&(0x7f000092b000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x1000}) 3m2.562721521s ago: executing program 3 (id=1320): timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x2}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x1000003, 0x204031, 0xffffffffffffffff, 0x97170000) clock_nanosleep(0x2, 0x0, &(0x7f0000002080)={0x77359400}, &(0x7f0000000040)) 3m2.035084296s ago: executing program 3 (id=1326): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/target/core/rd_mcp_0/dev0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0/dev0/statistics/scsi_lu/lun\x00', 0x0, 0x0) read(r0, &(0x7f0000000200)=""/4096, 0x1000) 3m1.649806753s ago: executing program 3 (id=1330): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) chdir(&(0x7f0000000200)='./file0/file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) mount(0x0, &(0x7f00000000c0)='./file0/../file0\x00', &(0x7f0000000000)='sysfs\x00', 0x1214040, 0x0) 3m1.50677184s ago: executing program 3 (id=1332): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000c80)={0x2, 0x4e21, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0xa, &(0x7f0000000100)=0xffffffff, 0x4) sendto$inet(r0, &(0x7f0000000340)='\x00', 0x1, 0x4c001, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000040)=""/7, 0x7, 0xc9108062, 0x0, 0x0) 3m1.114413368s ago: executing program 3 (id=1333): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000380)='./file1\x00', 0x1000040, &(0x7f0000000480)={[{@noblock_validity}, {@oldalloc}, {@orlov}, {@quota}]}, 0x1, 0x59c, &(0x7f0000001840)="$eJzs3U9oHGUbAPBnZrNN/+T70g++Dz6lh6JChdJN0j9aPbVXsVDoQfCiYbMNJZtsySbahIDpvYg9iEov9aYHj4oHD+LFo1cvimeh2KDQ9KArm51N03S3bmI2W7O/H0z2fWdm93nfmX3e7AwzTAB962j9TxrxVERcTCKGNywbiGzh0cZ6qytLxfsrS8UkarVLvySRRMS9laVic/0kez0UEcsR8f+I+CYfcTxd/8h9zUJ1YXFqvFwuzWb1kbnpqyPVhcUTV6bHJ0uTpZlTL7505uzpM2MnxzY2935tYy2/tb7e+PHmuze+e+X2zU8/O7JcfH88iXMxlC3b2I+d1Ngm+Ti3af7pbgTroaTXDWBbclme11PpfzEcuSzrW6ltHBwGd6V5QBfVBiNq6zYUgT6QSHroU83fAfXj3+a0m78/7pxvHIDU466uLBXfiWb8gca5idi/dmxy8NfkoSOT+vHm4d1sKHvS8vWIGB0YePT7n2Tfv+0b3YkG0lVfn2/sqEf3f7o+/kSL8Weoee70b2qOf6vZ+LfaIn6uzfh3scMYv7/+00dt418fjKdbxk/W4yct4qcR8WaH8W+99uXZdstqH0cci9bxm5LHnx8euXylXBpt/G0Z46tjR15u3/+Ig23iN87Z7l9ryMb+78valHbY/y++/fyZ5cfEf/7Zx+//Vtv/QES812H8/9z75NV2y+5cT+7WfwVsdf8nkY/bHcZ/4dzRH7Kis4YAAAAAAAAAALCD0rVr2ZK0sF5O00KhcQ/vf+NgWq5U545frszPTDSueTsc+bR5pdVwo57U62PZ9bjN+slN9VO5LGDuwFq9UKyUJ3rcdwAAAAAAAAAAAAAAAAAAAHhSHNp0//9vubX7/zc/rhrYq9o/8hvY6+Q/9K+H8z/pWTuA3ef/P/StmvyH/iX/oX/Jf+hf8h/6l/yH/iX/oX/JfwAAAAAAAAAAAAAAAAAAAAAAAAAA6IqLFy7Up9r9laVivT4xsDA/VXnrxESpOlWYni8WipXZq4XJSmWyXCoUK9N/9XlJpXJ1NGbmr43MlapzI9WFxTemK/MzzWeKlvJd7xEAAAAAAAAAAAAAAAAAAAD88wytTUlaiMg36mlaKET8KyIOJ5FcvlIujUbEvyPi+1x+sF4f63WjAQAAAAAAAAAAAAAAAAAAYI+pLixOjZfLpdnuFQayUF0M0XlhYCsrR8Tyzjaj/olbflc+24A93nR7o5B7Mr6HT36hh4MSAAAAAAAAAAAAAAAAAAD0qQc3/Xb6jj+62yAAAAAAAAAAAAAAAAAAAADoS+nPSUTUp2PDzw1tXrovWc2tvUbE27cufXBtfG5udqw+/+76/LkPs/kne9F+oFPNPE0jop7HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAPVhcWp8XK5NLvNwmAH6/S6jwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADb8WcAAAD//y4WzlE=") mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000100)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r0, &(0x7f0000000400)=""/4096, 0x1000) 3m0.725680286s ago: executing program 35 (id=1333): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000380)='./file1\x00', 0x1000040, &(0x7f0000000480)={[{@noblock_validity}, {@oldalloc}, {@orlov}, {@quota}]}, 0x1, 0x59c, &(0x7f0000001840)="$eJzs3U9oHGUbAPBnZrNN/+T70g++Dz6lh6JChdJN0j9aPbVXsVDoQfCiYbMNJZtsySbahIDpvYg9iEov9aYHj4oHD+LFo1cvimeh2KDQ9KArm51N03S3bmI2W7O/H0z2fWdm93nfmX3e7AwzTAB962j9TxrxVERcTCKGNywbiGzh0cZ6qytLxfsrS8UkarVLvySRRMS9laVic/0kez0UEcsR8f+I+CYfcTxd/8h9zUJ1YXFqvFwuzWb1kbnpqyPVhcUTV6bHJ0uTpZlTL7505uzpM2MnxzY2935tYy2/tb7e+PHmuze+e+X2zU8/O7JcfH88iXMxlC3b2I+d1Ngm+Ti3af7pbgTroaTXDWBbclme11PpfzEcuSzrW6ltHBwGd6V5QBfVBiNq6zYUgT6QSHroU83fAfXj3+a0m78/7pxvHIDU466uLBXfiWb8gca5idi/dmxy8NfkoSOT+vHm4d1sKHvS8vWIGB0YePT7n2Tfv+0b3YkG0lVfn2/sqEf3f7o+/kSL8Weoee70b2qOf6vZ+LfaIn6uzfh3scMYv7/+00dt418fjKdbxk/W4yct4qcR8WaH8W+99uXZdstqH0cci9bxm5LHnx8euXylXBpt/G0Z46tjR15u3/+Ig23iN87Z7l9ryMb+78valHbY/y++/fyZ5cfEf/7Zx+//Vtv/QES812H8/9z75NV2y+5cT+7WfwVsdf8nkY/bHcZ/4dzRH7Kis4YAAAAAAAAAALCD0rVr2ZK0sF5O00KhcQ/vf+NgWq5U545frszPTDSueTsc+bR5pdVwo57U62PZ9bjN+slN9VO5LGDuwFq9UKyUJ3rcdwAAAAAAAAAAAAAAAAAAAHhSHNp0//9vubX7/zc/rhrYq9o/8hvY6+Q/9K+H8z/pWTuA3ef/P/StmvyH/iX/oX/Jf+hf8h/6l/yH/iX/oX/JfwAAAAAAAAAAAAAAAAAAAAAAAAAA6IqLFy7Up9r9laVivT4xsDA/VXnrxESpOlWYni8WipXZq4XJSmWyXCoUK9N/9XlJpXJ1NGbmr43MlapzI9WFxTemK/MzzWeKlvJd7xEAAAAAAAAAAAAAAAAAAAD88wytTUlaiMg36mlaKET8KyIOJ5FcvlIujUbEvyPi+1x+sF4f63WjAQAAAAAAAAAAAAAAAAAAYI+pLixOjZfLpdnuFQayUF0M0XlhYCsrR8Tyzjaj/olbflc+24A93nR7o5B7Mr6HT36hh4MSAAAAAAAAAAAAAAAAAAD0qQc3/Xb6jj+62yAAAAAAAAAAAAAAAAAAAADoS+nPSUTUp2PDzw1tXrovWc2tvUbE27cufXBtfG5udqw+/+76/LkPs/kne9F+oFPNPE0jop7HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAPVhcWp8XK5NLvNwmAH6/S6jwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADb8WcAAAD//y4WzlE=") mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000100)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r0, &(0x7f0000000400)=""/4096, 0x1000) 2m39.46123656s ago: executing program 8 (id=1456): pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) fcntl$setpipe(r0, 0x407, 0x0) write$FUSE_INIT(r0, &(0x7f0000000200)={0x50, 0xfffffffffffffff5, 0x0, {0x7, 0x28, 0x2, 0xffffffff82048008, 0x0, 0x40, 0x8, 0x0, 0x0, 0x0, 0x104, 0x8}}, 0x50) vmsplice(r0, &(0x7f0000000140)=[{&(0x7f0000000100)="eb", 0x20000101}], 0x1, 0x0) fcntl$setpipe(r0, 0x407, 0x2000000) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, 0x0) 2m38.876182306s ago: executing program 8 (id=1461): setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000040)=@ccm_128={{0x303}, "552ca447e1a000a0", "e72de55b2c11ae99a05828ab9f9de8ae", "c5846bfd", "c5eee3d1c909cfe1"}, 0x28) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xde, &(0x7f0000000040)=0xf2f, 0x4) r0 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xc3b3, 0x800, 0x1, 0x2082, 0x0, 0x0}, &(0x7f0000000180)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000040)=@IORING_OP_READV=@pass_iovec={0x1, 0xb, 0x4004, @fd_index=0x9, 0xf8, 0x0, 0x0, 0x11, 0x1}) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) 2m38.502481273s ago: executing program 8 (id=1466): ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x89a2, 0x0) syz_emit_ethernet(0x5ee, 0x0, 0x0) fsopen(0x0, 0x0) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000400)='./file2\x00', 0x8, &(0x7f0000000000)=ANY=[], 0x5, 0x1e2, &(0x7f0000000080)="$eJzslb+qE0EUxr+ZTXaTW1nbWHjBa+Fmd6+CzYVrY2Uh+CdYCAaTSHRDJNnCBCT4BPZ2Fj6GEFsfQqIgCqKN2gkj82d3h7gbzRKJ4PnBzn4zczhzZga+AUEQ/y3v3n5fim9HHxoAmtiHZ8Y/OpkEt+LfNL48fnXlcvvp7RevvaW3km2l/0MI8Zv15bqLSw6Skvl9878Onukb4DhrdBsMvtF3wHHT6B4Ybhl939IjGe/7/UHc8++O4q4UQX9QRyhVJJtDe/0agM9PGLqmL4QQzJqfTGcPOnHcG28qxHxdzAl7pPhkFp+y+hrAkVWffV8+dLWBdX4hOEKjD8FwzeiL8NKzCWQTWvs/WcvzO2v376LiiaTiPYB8pF85zx8IVy61MrX3y0iRAFj1u/93hAMl0hvdeT1bF6htLaHwgF1vp0S8PNb3l5U61/3N8hyXTLkb5jEnn/mneM5wxvInbSXP1GPRSoYPW5Pp7Nxg2LnnmqDgfBBciFrKiHRbbIEqf1P5016ev1kW6zIXjzpJMg51m/Uj3RY5Llf+x3FwGnXZl26qyqznMV/V26lh5uPqL9WBU1o8SkslCIL465wCU56sfDkV5jXJJoSIru64ToIgCIIgCIIgCIIgqvMzAAD//7paW3I=") mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000280)='./file2\x00', 0x0, 0x840040, 0x0) 2m37.901762491s ago: executing program 8 (id=1474): syz_mount_image$udf(&(0x7f0000000c40), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='noadinicb,nostrict,mode=00000000000000000000004,uid=forget,noadinicb,umask=00000000000000040002000,lastblock=00000000000000000013,undelete,partition=00000000000000000005,\x00'], 0x47, 0xc11, &(0x7f0000000d00)="$eJzs3V1oXOl5B/DnnSOtRto00WYTb9Jm04GUxCi18VdsBZcgZxW1AccbIit0r6LRh51h5ZGR5MabtkFtSQu9Cd2b0psimi4t5KJX3V5WabaQUAol5CK9KAiaLHvRC10ECi0bhXPmHWlky7ayXlvS7u+3zP7PnHnO+P0YnzkCvzoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAER89nOXTp1OB90KAOBxujL5pVNnff8DwLvKVT//AwAAAAAAAAAAAADAYZeiiGORYujVzTRdPe+oX261b92eGp/Y+7DBFClqUVT15aN++szZc586f2G0m/c//u324Xh+8uqlxnOLN24uzS8vz881ptqt2cW5+X2/w8Mef6eRagAaN168NXft2nLjzMmzu16+Pfz6wJPHhi9eOHF+tFs7NT4xMdlT09f/lv/0u9xrhccTUUQzUrw5/EZqRkQtHn4sHvDZedQGq06MVJ2YGp+oOrLQarZXyhdTLVfVIho9B411x+gxzMVDGYtYLZtfNnik7N7kzeZSc2ZhvvHF5tJKa6W12E61TmvL/jSiFqMpYi0iNgbufrv+KOKjkeLlU5tpJiKK7jh8sloY/OD21B5BH/ehbGejP2KtdgTm7BAbiCKuRIqfvXY8Zssxy4/4eMQXynw14pUyPxORyg/GuYif7vE54mjqiyL+PVIsps00V50PuueVy19ufL59bbGntnteOfLfD4/TIT831aOImeqMv5ne+sUOAAAAAAAAAAAAAAAAAG+3wSji25HiT579vWpdcVTr0t93cfQ9L/x275rxZx7wPmXtyYhYre1vTW5/XjqcauV/j6Bj7Es9ivhGXv/3RwfdGAAAAAAAAAAAAAAAAAAAgHe1Il6IFF85cTytRe89xVvt642rzZmFzl1hu/f+7d4zfWtra6uROjmWczrnas61nOs5N3JGLR+fcyzndM7VnGs513Nu5IwiH59zLOd0ztWcaznXc27kjL58fM6xnNM5V3Ou5VzPuZEzDsm9ewEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3klqUcTPI8W3vraZIkXEWMR0dHJ94KBbBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACU6qmIk5Fi/YV69XytFnE1In6+tbXVfUTEZpkP66D7CgAAAAAAAAAAAAAAAAAAAIdWKuJjkeLp/9tMjYi4Pfz6wJPHhi9eOHF+tIgiUlnSW//85NVLjecWb9xcml9enp9rTLVbs4tz8/v94+qXW+1bt6fGJx5JZx5o8BG3f7D+3OLNl5Za17+6sufrQ/VLM8srS83ZvV+OwahFTPfuGakaPDU+UTV6odVsV4em2j0aWIsY229nAAAAAAAAAAAAAAAAAAAAODSGUhGfixQ/+a9zqbtuvK+z5v9XOs+K7dpX/mDndwEs3JFdvb8/YD/bab8NHakW3jemxicmJnt29/XfXVq2KaUinokUn3j5Q9V6+BRDe66NL+veW9bdOJfrhn+trFvdVVUfmRqfaFxZbJ+4tLCwONtcac4szDcmbzZn9/2LAwAAAAAAAAAAAAAAAAAAAOA+hlIRP4oU//P3/5G6953P6//7Os961v//VrWEvlJPu3Nbtbb/vdXa/s72+y6ODn302XvtfxTr/8s2pVTENyPF2R99qLqffnf9//QdtWXdn0WKN579SK6rPVHWNbvd6bzjtdbC/Kmy9q8jxa+/2a2NqvZ6rn16p/Z0WTsYKf5yc3ftV3PtB3Zqz5S1xyPF9/5779oP7tSeLWt/Ein+6e8a3dqhsvb3c+2xndqTs4sLcw8a1nL+vxMp/vbK76Run+85/z2//2H1jtx215zff/vtmv/hnn2reV7/NM9/8wHzfz5SfKf+kVzXGfuZ/PpT1f935v8TkeI//2137bVc+/6d2tP77dZBK+f/25Hiu3/14+0+5/nPI7szQ73z/6t9u3P7U3JA8/9Uz77h3K7ZX3Is3o2WX/r6i82FhfklGzZs2NjeOOgzE49D+f3/55Hi/48VqXsdk7//39N5tnP997/f2Pn+v3hHbjug7//39+y7mK9a+vsi6is3bvY/E1FffunrJ1o3mtfnr8+3z5w+9elPnz996vT5/ie6F3c7W/seu3eCcv5/ECl++A8/3P45Zvf1397X/0N35LYDmv+ne/u067pm30PxrlTO/99Eiqc+++Ptnzfvd/3f/fn/+Md25/bfvwOa/w/07BvO7Wr9kmMBAAAAAAAAAABwlAylIv4iUvzuH/9m6q4h2s+//5u7I7cd0L//Otazb+4xrWvY9yADABwi5fXfByPFP299f3st9+7rv/iNbm3v9d+9HIb7/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwFGXoog/jBRDr26m9YHyeUf9cqt96/bU+MTehw2mSFGLoqovH/XTZ86e+9T5C6PdvP/xb7cPx/OTVy81nlu8cXNpfnl5fq4x1W7NLs7N7/sdHvb4O41UA9C48eKtuWvXlhtnTp7d9fLt4dcHnjw2fPHCifOj3dqp8YmJyZ6avv63/KffJd1j/xNRxPcjxZvDb6TvDkTU4uHH4gGfnUdtsOrESNWJqfGJqiMLrWZ7pXwx1XJVLaLRc9BYd4wew1w8lLGI1bL5ZYNHyu5N3mwuNWcW5htfbC6ttFZai+1U67S27E8jajGaItYiYmPg7rfrjyK+GSlePrWZ/mUgouiOwyevTH7p1NkHt6f2CPq4D2U7G/0Ra7UjMGeH2EAU8Y+R4mevHY/vDUT0RecRH4/4QpmvRrxS5mciUvnBOBfx0z0+RxxNfVHEuUixmDbTawPl+aB7Xrn85cbn29cWe2q755Uj//3wOB3yc1M9ivhBdcbfTP/q7zUAAAAAAAAAAAAAAADAIVLEWqT4yonjqVofvL2muNW+3rjanFnoLOvrrv3rrpne2traaqROjuWczrmacy3nes6NnFHLx+ccyzmdczXnWs71nBs5o8jH5xzLOZ1zNedazvWcGzmjLx+fcyzndM7VnGs513Nu5IxDsnYPAAAAAAAAAAAAAAAAAAB4Z6lFUd3F/Vtf20xbA537S09HJ9fdD/Qd7xcBAAD//0kCdPc=") r0 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) mount(&(0x7f0000000440)=@loop={'/dev/loop', 0x0}, &(0x7f0000000200)='./bus\x00', 0x0, 0x1000, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9567, 0x3, 0x0, 0x0, 0x1f, 0x5, "ef35af413bb901527fe4d0ce5d29c3ee5e5c3676345a41499db7aac63a01000000000000004faa2ae2c084a0ea0000000000007700000c00002000", "036c47c67808200400000000000000335263bdbcef549ba197fce47ddfdd753abd950100002a00ffffffffffffffff00000000e8f20000000200", "b7326736181c208220fffff2ff00000000000000000e00", [0x4, 0x100]}) write$binfmt_elf32(r0, &(0x7f0000001940)={{0x7f, 0x45, 0x4c, 0x46, 0x3, 0xff, 0xf, 0x3, 0x6987, 0x2, 0x6, 0x81, 0x1e9, 0x38, 0x39e, 0x81, 0x1, 0x20, 0x1, 0x7, 0x37, 0x7}, [{0x7, 0x0, 0x7ff, 0x20, 0x1, 0x6, 0x7, 0xc8c3}], "", ['\x00', '\x00', '\x00', '\x00']}, 0x458) 2m37.026977472s ago: executing program 8 (id=1482): epoll_create(0x402) epoll_create1(0x80000) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x60442, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/drivers\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) clock_adjtime(0xffffffd3, &(0x7f0000000000)={0x10000, 0x6, 0xc, 0x1000000, 0x7, 0xe, 0x5, 0x1, 0x8000009654, 0x1, 0x7fffffff, 0x0, 0x10, 0xb, 0xffff, 0x200cc0, 0x1, 0x5, 0x0, 0xfffffffffffffffc, 0x0, 0x809, 0x0, 0x5, 0x6, 0x9}) 2m36.229287078s ago: executing program 8 (id=1489): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000b80)='./file0\x00', 0x0, &(0x7f00000000c0), 0x3, 0x618, &(0x7f0000000300)="$eJzs3c1rHGUYAPBndpNt0hSzDaLWgw2ItKBNmrSVIB7aq5RQP/CiB2OTfti0DU1EU4WmUC+CeBERPHmw/hdarMee9OTBiycpBJV6E1zZ3Zl87W4+tsluyf5+sO7M+87kfcb02Zl5930nAXSswfJ/chEHImImiehPFpbquiKtHKxu9+Dvj8+WX0mUSq//ORBJWpZtn6TvfenOPRHx849JDORr252dv35pYnp66lq6Pjx3eWZ4dv76kYuXJ85PnZ+6Mvri6NiJ4yfGRo42dVw3aov+OX3rvQ/6Px1/69uv/01GvvttPImT8Uq64crj2C6DMVj5f5LUVvWNbXdjbZJP/52USqVSVpZ01W7X2+K42Jzs99cdEU9Gf+Rj+ZfXH5+82tbggB1VSqqf3UAnSprK/97tDwRosew6ILu3X3sfnGvLVQnQCounqh0AtfnfVe0bjJ5K38DeB0ms7NZJIqK5nrnV9kXEvbvjt87dHb8VO9QPB9S3cDMinqqX/0kl/4vRE8VK/udW5X/5uuBM+l4uf63J9td2Fct/aJ1q/vesm//RIP/fKb/fqObwu0213rNy5ULvqvz3jREAAAAAAABs1Z1TEfHC0vf/heXv33JL43+izvifvog4uQ3tD65Zr/3+P3d/G5oB6lg8FfFy3fG/uWz0bzG/YgprMSI5d3F66mhEPBYRh6N7T3l9ZJ02jnw28FWjusF0/F/2Krd/Lx0LmMZxv2vP6n0mJ+YmHuKQgdTizcg/XXf8b7J0/k/qnP/Lnwwzm2xj4LnbZxrVbZz/wE4pfRNxqO75f/mpFcn6z+cYrlwPDGdXBbWe+ejz7xu132z+13nEBLBFizcj9q6f/8Vk5fN6ZrfexrH5rlKjumav/wvJG5WnChXiQqXsw4m5uWsjEYXkdL5cWki3rZSPbj1m2I2yfMjypZz/h59dzv98nf6/etf/vRGxsOZnJ3+tnlOceeK/vt8bxeP6H9qnnP+TWzr/b31h9Hbxh0btD8ZPmzj/H6+c6w+nJfr/oOrLLE0L3avK66RjV72qlgcMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALtALiL2RZIbWlrO5YaGIvoi4vHYm5u+Ojv3/Lmr71+ZLNdFFKM7l/2l3/7qepL9/f/iivXRNevHImJ/RHyR762sD529Oj3Z7oMHAAAAAAAAAAAAAAAAAACAR0Rfg/n/ZX/k2x0dsOO62h0A0DZ18v+XdsQBtJ7zP3Qu+Q+dS/5D55L/0LnkP3Su9fP/7bGWBQK0nPM/dC75DwAAAAAAu8r+g3d+TSJi4aXeyquskNZ1tzUyYKfl2h0A0DYe8QOdy9Af6Fzu8YFkg/qehjtttOd6Zs4+xM4AAAAAAAAAAAAA0HEOHTD/HzpVc/P/PTUAdgPz/6FzZfP/D7Y5DqD13OMDscFM/rrz/zfcawU3GgAAAAAAAAAAAADw0Gbnr1+amJ6eumbhzSb2ykY1tz345hZKpdKNcviPSjzbv5CkI9Rb0mg2FL71R1rYzAFmc/0295NrPyv2tOgzCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWO3/AAAA//+GpyIE") syz_mount_image$exfat(0x0, &(0x7f0000000540)='./bus\x00', 0x38c180a, 0x0, 0x0, 0x0, &(0x7f0000000240)) chdir(&(0x7f00000003c0)='./bus\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4842, 0x1ff) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x6200, 0x0) sendfile(r0, r1, 0x0, 0x20fffe82) 2m35.609114137s ago: executing program 36 (id=1489): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000b80)='./file0\x00', 0x0, &(0x7f00000000c0), 0x3, 0x618, &(0x7f0000000300)="$eJzs3c1rHGUYAPBndpNt0hSzDaLWgw2ItKBNmrSVIB7aq5RQP/CiB2OTfti0DU1EU4WmUC+CeBERPHmw/hdarMee9OTBiycpBJV6E1zZ3Zl87W4+tsluyf5+sO7M+87kfcb02Zl5930nAXSswfJ/chEHImImiehPFpbquiKtHKxu9+Dvj8+WX0mUSq//ORBJWpZtn6TvfenOPRHx849JDORr252dv35pYnp66lq6Pjx3eWZ4dv76kYuXJ85PnZ+6Mvri6NiJ4yfGRo42dVw3aov+OX3rvQ/6Px1/69uv/01GvvttPImT8Uq64crj2C6DMVj5f5LUVvWNbXdjbZJP/52USqVSVpZ01W7X2+K42Jzs99cdEU9Gf+Rj+ZfXH5+82tbggB1VSqqf3UAnSprK/97tDwRosew6ILu3X3sfnGvLVQnQCounqh0AtfnfVe0bjJ5K38DeB0ms7NZJIqK5nrnV9kXEvbvjt87dHb8VO9QPB9S3cDMinqqX/0kl/4vRE8VK/udW5X/5uuBM+l4uf63J9td2Fct/aJ1q/vesm//RIP/fKb/fqObwu0213rNy5ULvqvz3jREAAAAAAABs1Z1TEfHC0vf/heXv33JL43+izvifvog4uQ3tD65Zr/3+P3d/G5oB6lg8FfFy3fG/uWz0bzG/YgprMSI5d3F66mhEPBYRh6N7T3l9ZJ02jnw28FWjusF0/F/2Krd/Lx0LmMZxv2vP6n0mJ+YmHuKQgdTizcg/XXf8b7J0/k/qnP/Lnwwzm2xj4LnbZxrVbZz/wE4pfRNxqO75f/mpFcn6z+cYrlwPDGdXBbWe+ejz7xu132z+13nEBLBFizcj9q6f/8Vk5fN6ZrfexrH5rlKjumav/wvJG5WnChXiQqXsw4m5uWsjEYXkdL5cWki3rZSPbj1m2I2yfMjypZz/h59dzv98nf6/etf/vRGxsOZnJ3+tnlOceeK/vt8bxeP6H9qnnP+TWzr/b31h9Hbxh0btD8ZPmzj/H6+c6w+nJfr/oOrLLE0L3avK66RjV72qlgcMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALtALiL2RZIbWlrO5YaGIvoi4vHYm5u+Ojv3/Lmr71+ZLNdFFKM7l/2l3/7qepL9/f/iivXRNevHImJ/RHyR762sD529Oj3Z7oMHAAAAAAAAAAAAAAAAAACAR0Rfg/n/ZX/k2x0dsOO62h0A0DZ18v+XdsQBtJ7zP3Qu+Q+dS/5D55L/0LnkP3Su9fP/7bGWBQK0nPM/dC75DwAAAAAAu8r+g3d+TSJi4aXeyquskNZ1tzUyYKfl2h0A0DYe8QOdy9Af6Fzu8YFkg/qehjtttOd6Zs4+xM4AAAAAAAAAAAAA0HEOHTD/HzpVc/P/PTUAdgPz/6FzZfP/D7Y5DqD13OMDscFM/rrz/zfcawU3GgAAAAAAAAAAAADw0Gbnr1+amJ6eumbhzSb2ykY1tz345hZKpdKNcviPSjzbv5CkI9Rb0mg2FL71R1rYzAFmc/0295NrPyv2tOgzCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWO3/AAAA//+GpyIE") syz_mount_image$exfat(0x0, &(0x7f0000000540)='./bus\x00', 0x38c180a, 0x0, 0x0, 0x0, &(0x7f0000000240)) chdir(&(0x7f00000003c0)='./bus\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4842, 0x1ff) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x6200, 0x0) sendfile(r0, r1, 0x0, 0x20fffe82) 2m21.361355505s ago: executing program 6 (id=1575): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000100"], 0x4a) 2m20.215004309s ago: executing program 6 (id=1572): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @local}], 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x1) r1 = dup(r0) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f00000007c0)=@sack_info={0x0, 0x1, 0x3}, 0xc) write(r1, &(0x7f0000000080)="16", 0x1) 2m19.180732557s ago: executing program 6 (id=1581): r0 = syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b510f210950b2a7773820102030109022400010000000009042200028953950009050a02ff0300fa000905820250"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000240)={0x60, 0x1}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000440)={0x34, &(0x7f00000001c0)={0x0, 0xf, 0x2, '0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000900000008000300", @ANYRES32=r2, @ANYBLOB="05003901"], 0x44}}, 0x0) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, 0x0, 0x40000) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0xfff, 0xc, 0x4) 23.209038127s ago: executing program 38 (id=2403): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000900000008000300", @ANYRES32=r2, @ANYBLOB="05003901"], 0x44}}, 0x0) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, 0x0, 0x40000) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0xfff, 0xc, 0x4) 4.478577403s ago: executing program 0 (id=2690): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000008c0)={0x2c, &(0x7f0000000680)={0x20, 0xc, 0x3, "a5add5"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000300)={0x34, &(0x7f0000000a80)=ANY=[@ANYBLOB="001745000000cfcf7cacea32fa5b"], 0x0, 0x0, 0x0, 0x0, 0x0}) 3.425322522s ago: executing program 4 (id=2697): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x6}]}, 0x1c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @log={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOG_GROUP={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xd0}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, &(0x7f0000000700)={0x2, 0x1234, @loopback}, 0x10) 2.944020274s ago: executing program 4 (id=2700): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r0, &(0x7f0000002600)=""/4113, 0x1011) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x11000a4, 0x0) 2.514947283s ago: executing program 1 (id=2706): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x8b101a, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) umount2(&(0x7f00000002c0)='./file0/../file0\x00', 0xa) 2.298203834s ago: executing program 1 (id=2708): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000100002020207b1af8ff00000000bf86a26db800000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa1000000"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000100000000000000000000850000007500000095"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180200000800000000000000000000001801000000646c2500000000002020207b1af8ff00000000bfa10000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000002d"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) 2.228663327s ago: executing program 5 (id=2709): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x80000001}, 0x8) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f0000000580)={0xa, 0x4e23, 0x1, @loopback}, 0xfdc2, &(0x7f00000006c0)=[{&(0x7f0000001680)='\t', 0x1}], 0x1}}], 0x1, 0x8020) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f00000000c0)={0x0, 0x5, 0xfffb}, 0x8) 2.203517828s ago: executing program 4 (id=2710): syz_io_uring_setup(0xbd9, &(0x7f0000000640)={0x0, 0xe826, 0x800, 0x1, 0x3c3}, 0x0, 0x0, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_LBT_MODE(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="04"], 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000cc0), r0) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000012c0), r0) sendmsg$NLBL_MGMT_C_VERSION(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="030f000000000000000008000000150001"], 0x2c}}, 0x0) 2.108450322s ago: executing program 0 (id=2712): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000000)) r1 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x6) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x0, 0x1, 0x800, 0x2, 0x0, 0x9}, 0x0, &(0x7f0000000240)={0x1f, 0x8000003, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x3) 2.090450454s ago: executing program 1 (id=2713): socket$kcm(0x10, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x26e1, 0x0) socketpair(0xa, 0x1, 0x0, &(0x7f0000000000)) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0010000000ba8000001201", 0x2e}], 0x1}, 0x18002) 1.589356306s ago: executing program 1 (id=2715): r0 = epoll_create1(0x80000) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x0, 0x0) r2 = dup3(r1, r0, 0x0) readv(r2, &(0x7f0000000640)=[{0x0}, {&(0x7f0000000240)=""/78, 0x4e}], 0x2) 1.406620725s ago: executing program 9 (id=2716): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff070000000000000000000085000000ae00000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffff"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001100)={0x3, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000b000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x8}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="1900000004000000080000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 1.405360705s ago: executing program 4 (id=2717): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x11, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000000000000850000007b00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r2) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000700)={r1}, 0xc) 1.30203136s ago: executing program 9 (id=2718): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x8b101a, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) umount2(&(0x7f00000002c0)='./file0/../file0\x00', 0xa) 1.249267382s ago: executing program 5 (id=2719): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000240)={0x2, &(0x7f0000000280)=[{0x20, 0x4, 0x9, 0xfffff038}, {0x6, 0xba, 0x2, 0xffff}]}, 0x10) r1 = socket$inet6(0xa, 0x2, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x4098884, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x4000080, 0x0, 0x0) 1.129392708s ago: executing program 9 (id=2720): r0 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) setresuid(0xee01, 0xee01, 0x0) fchdir(r1) openat(0xffffffffffffff9c, &(0x7f00000056c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xc4042, 0x68) 1.055891601s ago: executing program 5 (id=2721): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x5, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xe8f}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048040) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.017914573s ago: executing program 0 (id=2722): r0 = socket$nl_rdma(0x10, 0x3, 0x14) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r3, 0x0, 0x400000008000f28, 0x0) splice(r2, 0x0, r1, 0x0, 0x100, 0x3) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="00010000031401"], 0x100}, 0x1, 0x0, 0x0, 0x4040024}, 0x0) 927.442617ms ago: executing program 4 (id=2723): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000016c0)=@newsa={0x138, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x794, 0x4e23, 0x7, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d6, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x3, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc, 0x40}, 0x70bd2a, 0x3504, 0x2, 0x1, 0xfe, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@dev={0xac, 0x14, 0x14, 0x42}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in=@rand_addr=0x64010102, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0xf, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x4000004) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2, 0x9, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 827.047772ms ago: executing program 9 (id=2724): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x124) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x80) fsetxattr$system_posix_acl(r1, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000001400)=ANY=[@ANYBLOB="02000000010005000000000002000000", @ANYRES32=r0, @ANYBLOB="0400060000000000100004000000000020"], 0x2c, 0x1) symlink(&(0x7f0000000080)='.\x00', &(0x7f0000000240)='./file0\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xee01, 0xee00, 0x1000) setxattr$system_posix_acl(&(0x7f0000000080)='./file0\x00', &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="020000000100020062b2d8ab0400000000000000100006000000000020"], 0x24, 0x3) 710.581957ms ago: executing program 5 (id=2725): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000080)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448dd, &(0x7f0000000100)={0x1, 0x6, '\x00', 0x8a}) 710.450007ms ago: executing program 9 (id=2726): setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)=':', 0x1, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 613.249082ms ago: executing program 1 (id=2727): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffd, 0x6, 0xb, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="800400001900", 0x0, 0xffffffff, 0x10012, 0xfffbffff, 0x0}) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) write$tun(r1, &(0x7f0000000400)=ANY=[], 0xa2) read$FUSE(r1, &(0x7f0000002140)={0x2020}, 0x2020) 588.688143ms ago: executing program 0 (id=2728): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x170bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe5, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0xfffd}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001300)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_fw={{0x7}, {0x8, 0x2, [@TCA_FW_POLICE={0x4}]}}, @TCA_RATE={0x6, 0x5, {0x1}}]}, 0x3c}}, 0x0) 468.654598ms ago: executing program 9 (id=2729): socket$key(0xf, 0x3, 0x2) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f00000005c0)={0x0, 0x4731, 0x400, 0x3, 0x279, 0x0, r0}, &(0x7f0000000100)=0x0, &(0x7f00000001c0)=0x0, &(0x7f0000000000)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x1, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x10000004, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x4, 0xb0d, 0x0, 0x0, 0x1000, 0x80000001, 0x0, 0x0, 0x103}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_queues(r0, r6, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2, 0x20000, 0x0, r1}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8b15, 0x1, 0x0, 0x8000004, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x0, 0xfffffffd, 0x68, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2fdf, 0x800, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x40006253, 0x4000, 0x0, 0xfffffffb}}], 0x1, &(0x7f00000003c0)={0x2e, 0x4c, 0x0, r0, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r5, '\x00', {0x0, 0xdb9, 0x0, 0x0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, 0x94) 329.579244ms ago: executing program 5 (id=2730): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x6, 0x10, &(0x7f0000000e40)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000300000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b704000008000000850000001c00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000100)={r3, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0xfc0, &(0x7f0000000240)=ANY=[], 0x0) 294.617946ms ago: executing program 0 (id=2731): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000240)={0x2, &(0x7f0000000280)=[{0x20, 0x4, 0x9, 0xfffff038}, {0x6, 0xba, 0x2, 0xffff}]}, 0x10) r1 = socket$inet6(0xa, 0x2, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x4098884, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x4000080, 0x0, 0x0) 234.769619ms ago: executing program 1 (id=2732): clock_nanosleep(0x2, 0xfffffdfc, &(0x7f0000000600)={0x77359400}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)=0x0) timer_settime(r0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) timer_create(0x7, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) timer_settime(r1, 0x0, &(0x7f0000000340)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 51.628838ms ago: executing program 4 (id=2733): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket(0x2c, 0x803, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x7151, 0x0) 50.461538ms ago: executing program 5 (id=2734): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) setuid(0xee00) r0 = syz_io_uring_setup(0x4b6, &(0x7f0000000100)={0x0, 0x0, 0x400, 0x0, 0x20e}, &(0x7f00000001c0), &(0x7f0000000000), &(0x7f0000000000)) setrlimit(0x40000000000008, &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000040)=[{0x0}, {0x0}], 0x2) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000540)=[{0x0}, {&(0x7f0000000340), 0xa002a0}], &(0x7f00000005c0), 0x2}, 0x20) 0s ago: executing program 0 (id=2735): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="c4000000190001000000000010000000ff01000000000000000000000000000164010102000000000000000000000000000000004e2100000a00008006000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000b8c9043d000000000000000000000000000000000000000008000000000000000000000000000000fbffffffffffffff000000000000000002d60000000000000000000000000000030000000000000000000000b86b6e0000010001000000000c0015005d0735000010"], 0xc4}, 0x1, 0x0, 0x0, 0x4008011}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd25, 0x25dfdbff, {{@in=@local, @in6=@loopback, 0x0, 0x0, 0x4, 0x0, 0xa, 0x0, 0x20, 0x87}, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000, 0xfffffffffffffffb}, {0x0, 0x1000, 0x200000000000000, 0x10000000000000}, 0x800, 0x6e6bb0, 0x0, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x800}, 0x8008010) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000c40)=ANY=[@ANYBLOB="d40000001b001d0328bd7000fcdbdf25ffffffff000000000000000000000000fe8000000000000000000000000000264e2000014e2404000200000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="08000000000000000100010000000000f4ffffffffffffff04000000000000000200000000000000ba410000000091ad07000000000000000000008000000000ffffff7f0000000003000000000000000400000000000000080000000000000003000000b86b6e"], 0xd4}}, 0x0) kernel console output (not intermixed with test programs): cted capacity change from 0 to 1024 [ 296.621227][ T27] audit: type=1326 audit(1789542674.266:1274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9595 comm="syz.7.1504" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fdff2d9e159 code=0x0 [ 296.646660][ T4626] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 296.902235][ T4626] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 296.904441][ T9569] chnl_net:caif_netlink_parms(): no params data found [ 296.920960][ T4626] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 296.931956][ T4626] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 296.965707][ T4626] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 296.985180][ T4626] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 297.013988][ T9607] loop6: detected capacity change from 0 to 16 [ 297.016679][ T4626] usb 6-1: config 0 descriptor?? [ 297.054685][ T9607] erofs: (device loop6): mounted with root inode @ nid 36. [ 297.099085][ T9607] erofs: (device loop6): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 297.152197][ T9607] erofs: (device loop6): z_erofs_do_map_blocks: invalid logical cluster 0 at nid 89 [ 297.180073][ T9607] erofs: (device loop6): z_erofs_readahead: readahead error at page 0 @ nid 89 [ 297.204255][ T9607] syz.6.1506: attempt to access beyond end of device [ 297.204255][ T9607] loop6: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 297.263931][ T9607] erofs: (device loop6): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 297.273514][ T9607] erofs: (device loop6): z_erofs_pcluster_readmore: readmore error at page 3 @ nid 89 [ 297.293948][ T9607] erofs: (device loop6): z_erofs_do_map_blocks: invalid logical cluster 0 at nid 89 [ 297.312380][ T9607] erofs: (device loop6): z_erofs_read_folio: failed to read, err [-117] [ 297.321661][ T27] audit: type=1800 audit(1789542674.966:1275): pid=9607 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1506" name="file2" dev="loop6" ino=89 res=0 errno=0 [ 297.374931][ T9614] "syz.4.1507" (9614) uses obsolete ecb(arc4) skcipher [ 297.476130][ T4626] plantronics 0003:047F:FFFF.0012: unknown main item tag 0xd [ 297.510942][ T4626] plantronics 0003:047F:FFFF.0012: No inputs registered, leaving [ 297.529089][ T9569] bridge0: port 1(bridge_slave_0) entered blocking state [ 297.559550][ T9569] bridge0: port 1(bridge_slave_0) entered disabled state [ 297.592498][ T4626] plantronics 0003:047F:FFFF.0012: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 297.613240][ T9569] device bridge_slave_0 entered promiscuous mode [ 297.703698][ T9618] FAULT_INJECTION: forcing a failure. [ 297.703698][ T9618] name failslab, interval 1, probability 0, space 0, times 0 [ 297.815853][ T9618] CPU: 0 PID: 9618 Comm: syz.7.1508 Not tainted syzkaller #0 [ 297.823332][ T9618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 297.833436][ T9618] Call Trace: [ 297.836862][ T9618] [ 297.839872][ T9618] dump_stack_lvl+0x188/0x24e [ 297.844611][ T9618] ? show_regs_print_info+0x12/0x12 [ 297.849864][ T9618] ? load_image+0x410/0x410 [ 297.854430][ T9618] ? __might_sleep+0xd0/0xd0 [ 297.859076][ T9618] ? __lock_acquire+0x7c40/0x7c40 [ 297.864426][ T9618] should_fail_ex+0x390/0x4c0 [ 297.869338][ T9618] should_failslab+0x5/0x20 [ 297.873900][ T9618] slab_pre_alloc_hook+0x59/0x300 [ 297.878974][ T9618] ? call_usermodehelper_setup+0x8a/0x260 [ 297.884743][ T9618] __kmem_cache_alloc_node+0x4f/0x270 [ 297.890178][ T9618] ? call_usermodehelper_setup+0x8a/0x260 [ 297.895961][ T9618] kmalloc_trace+0x26/0xe0 [ 297.900426][ T9618] call_usermodehelper_setup+0x8a/0x260 [ 297.906027][ T9618] ? __request_module+0xa00/0xa00 [ 297.911108][ T9618] __request_module+0x406/0xa00 [ 297.916022][ T9618] ? copy_regset_to_user+0x1f0/0x1f0 [ 297.921378][ T9618] ? __lock_acquire+0x7c40/0x7c40 [ 297.926450][ T9618] ? __virt_addr_valid+0x188/0x540 [ 297.931616][ T9618] ? __might_fault+0xa6/0x120 [ 297.936351][ T9618] get_fs_type+0x17c/0x480 [ 297.940819][ T9618] __se_sys_fsopen+0x86/0x2c0 [ 297.945537][ T9618] do_syscall_64+0x4c/0xa0 [ 297.949989][ T9618] ? clear_bhb_loop+0x60/0xb0 [ 297.954792][ T9618] ? clear_bhb_loop+0x60/0xb0 [ 297.959511][ T9618] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 297.965534][ T9618] RIP: 0033:0x7fdff2d9e159 [ 297.969997][ T9618] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 297.989750][ T9618] RSP: 002b:00007fdff3bf6028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 297.998188][ T9618] RAX: ffffffffffffffda RBX: 00007fdff3025fa0 RCX: 00007fdff2d9e159 [ 298.006174][ T9618] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000000c0 [ 298.014155][ T9618] RBP: 00007fdff2e3506b R08: 0000000000000000 R09: 0000000000000000 [ 298.022134][ T9618] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 298.030155][ T9618] R13: 00007fdff3026038 R14: 00007fdff3025fa0 R15: 00007ffe24999548 [ 298.038156][ T9618] [ 298.059790][ T4288] Bluetooth: hci2: command 0x0409 tx timeout [ 298.135704][ T4618] usb 6-1: USB disconnect, device number 13 [ 298.193198][ T9569] bridge0: port 2(bridge_slave_1) entered blocking state [ 298.216238][ T9569] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.224653][ T9569] device bridge_slave_1 entered promiscuous mode [ 298.424946][ T4667] device hsr_slave_0 left promiscuous mode [ 298.470057][ T4667] device hsr_slave_1 left promiscuous mode [ 298.485872][ T4667] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 298.493788][ T4667] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 298.502703][ T4667] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 298.525562][ T4667] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 298.533754][ T4667] device bridge_slave_1 left promiscuous mode [ 298.559444][ T4667] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.569067][ T4667] device bridge_slave_0 left promiscuous mode [ 298.578514][ T4667] bridge0: port 1(bridge_slave_0) entered disabled state [ 298.622054][ T4667] device veth1_macvtap left promiscuous mode [ 298.628292][ T4667] device veth0_macvtap left promiscuous mode [ 298.634585][ T4667] device veth1_vlan left promiscuous mode [ 298.641080][ T4667] device veth0_vlan left promiscuous mode [ 298.863551][ T4365] hid-generic 0000:0000:0001.0013: unknown main item tag 0x0 [ 298.874458][ T4365] hid-generic 0000:0000:0001.0013: unknown main item tag 0x0 [ 298.882144][ T4365] hid-generic 0000:0000:0001.0013: unknown main item tag 0x0 [ 298.889944][ T4365] hid-generic 0000:0000:0001.0013: unknown main item tag 0x0 [ 298.897972][ T4365] hid-generic 0000:0000:0001.0013: unknown main item tag 0x0 [ 298.905810][ T4365] hid-generic 0000:0000:0001.0013: unknown main item tag 0x0 [ 298.913424][ T4365] hid-generic 0000:0000:0001.0013: unknown main item tag 0x0 [ 298.935868][ T4365] hid-generic 0000:0000:0001.0013: unknown main item tag 0x0 [ 298.964832][ T4365] hid-generic 0000:0000:0001.0013: hidraw0: HID v0.10 Device [syz0] on syz1 [ 299.080110][ T9645] loop5: detected capacity change from 0 to 4096 [ 299.118512][ T9645] ntfs3: loop5: Different NTFS' sector size (2048) and media sector size (512) [ 299.143570][ T9645] ntfs3: loop5: Mark volume as dirty due to NTFS errors [ 299.169569][ T9645] ntfs3: loop5: try to read out of volume at offset 0x1ff000 [ 299.192773][ T9645] ntfs3: loop5: Failed to load $MFT. [ 300.095626][ T4288] Bluetooth: hci2: command 0x041b tx timeout [ 300.553634][ T4667] team0 (unregistering): Port device team_slave_1 removed [ 300.690609][ T4667] team0 (unregistering): Port device team_slave_0 removed [ 300.852040][ T4667] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 300.960568][ T4667] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 301.135966][ T4624] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 301.394118][ T4624] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 301.411524][ T4624] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 301.436786][ T4624] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 301.446909][ T4624] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 301.467364][ T4624] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 301.490750][ T4624] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 301.509982][ T4624] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 301.523561][ T4624] usb 6-1: Product: syz [ 301.528124][ T4624] usb 6-1: Manufacturer: syz [ 301.546533][ T4624] cdc_wdm 6-1:1.0: skipping garbage [ 301.552015][ T4624] cdc_wdm 6-1:1.0: skipping garbage [ 301.586629][ T4624] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 301.596440][ T4624] cdc_wdm 6-1:1.0: Unknown control protocol [ 301.789015][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 301.789166][ T4365] usb 6-1: USB disconnect, device number 14 [ 301.795978][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 301.796001][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 301.842231][ T4667] bond0 (unregistering): Released all slaves [ 302.017161][ T9569] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 302.051234][ T9569] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 302.175796][ T4288] Bluetooth: hci2: command 0x040f tx timeout [ 302.224034][ T9569] team0: Port device team_slave_0 added [ 302.265256][ T9685] loop6: detected capacity change from 0 to 1024 [ 302.284007][ T9569] team0: Port device team_slave_1 added [ 302.380936][ T9569] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 302.406765][ T9569] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 302.483051][ T9569] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 302.511525][ T9569] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 302.525503][ T9569] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 302.590913][ T9569] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 303.032763][ T9569] device hsr_slave_0 entered promiscuous mode [ 303.204285][ T9569] device hsr_slave_1 entered promiscuous mode [ 303.840801][ T9715] bridge0: port 3(erspan0) entered blocking state [ 303.857819][ T9715] bridge0: port 3(erspan0) entered disabled state [ 303.868217][ T9715] device erspan0 entered promiscuous mode [ 303.915249][ T9715] bridge0: port 3(erspan0) entered blocking state [ 303.922522][ T9715] bridge0: port 3(erspan0) entered forwarding state [ 303.974575][ T9569] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 304.081110][ T9569] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 304.115417][ T9718] device erspan0 left promiscuous mode [ 304.139304][ T9718] bridge0: port 3(erspan0) entered disabled state [ 304.198745][ T9569] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 304.233217][ T9569] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 304.255743][ T4288] Bluetooth: hci2: command 0x0419 tx timeout [ 304.361653][ T9725] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1543'. [ 304.514455][ T9569] 8021q: adding VLAN 0 to HW filter on device bond0 [ 304.652540][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 304.673310][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 304.709020][ T9569] 8021q: adding VLAN 0 to HW filter on device team0 [ 304.722494][ T9742] overlayfs: failed to clone lowerpath [ 304.746797][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 304.772602][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 304.782448][ T4671] bridge0: port 1(bridge_slave_0) entered blocking state [ 304.789665][ T4671] bridge0: port 1(bridge_slave_0) entered forwarding state [ 304.806950][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 304.822154][ T4626] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 304.855301][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 304.895236][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 304.931643][ T4708] bridge0: port 2(bridge_slave_1) entered blocking state [ 304.939068][ T4708] bridge0: port 2(bridge_slave_1) entered forwarding state [ 304.947666][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 304.970980][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 304.983527][ T9720] loop6: detected capacity change from 0 to 32768 [ 304.990793][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 305.011560][ T9720] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz.6.1539 (9720) [ 305.028788][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 305.036552][ T4626] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 305.060875][ T4626] usb 8-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 305.088195][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 305.091200][ T4626] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.119779][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 305.132395][ T9720] BTRFS info (device loop6): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 305.140058][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 305.150781][ T4626] usb 8-1: config 0 descriptor?? [ 305.156123][ T9720] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm [ 305.179820][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 305.189007][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 305.221395][ T9569] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 305.235434][ T9720] BTRFS info (device loop6): setting nodatasum [ 305.252975][ T9720] BTRFS info (device loop6): enabling auto defrag [ 305.263495][ T9569] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 305.265568][ T9720] BTRFS info (device loop6): disabling tree log [ 305.303018][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 305.305804][ T9720] BTRFS info (device loop6): using free space tree [ 305.313178][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 305.359239][ T4626] usbhid 8-1:0.0: can't add hid device: -71 [ 305.376177][ T4626] usbhid: probe of 8-1:0.0 failed with error -71 [ 305.396828][ T4626] usb 8-1: USB disconnect, device number 5 [ 305.672114][ T9720] BTRFS info (device loop6): enabling ssd optimizations [ 305.925646][ T126] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 306.127272][ T4889] BTRFS info (device loop6): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 306.145035][ T126] usb 8-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 306.185085][ T126] usb 8-1: config 0 interface 0 has no altsetting 0 [ 306.204763][ T126] usb 8-1: New USB device found, idVendor=044e, idProduct=120b, bcdDevice= 0.00 [ 306.260620][ T126] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 306.290066][ T126] usb 8-1: config 0 descriptor?? [ 306.498707][ T4480] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 10 /dev/loop6 scanned by udevd (4480) [ 306.834044][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 306.845790][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 306.933398][ T9569] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 307.112210][ T126] hid-alps 0003:044E:120B.0014: failed to read command (-71) [ 307.130198][ T126] hid-alps 0003:044E:120B.0014: failed U1_DEV_CTRL_1 (-71) [ 307.173718][ T126] hid-alps 0003:044E:120B.0014: hidraw0: USB HID v0.00 Keyboard [HID 044e:120b] on usb-dummy_hcd.7-1/input0 [ 307.258658][ T126] usb 8-1: USB disconnect, device number 6 [ 307.671881][ T9804] fido_id[9804]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.7/usb8/report_descriptor': No such file or directory [ 308.211493][ T9825] jffs2: notice: (9825) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 308.253112][ T4330] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 308.273063][ T4330] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 308.322761][ T9569] device veth0_vlan entered promiscuous mode [ 308.349394][ T4330] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 308.363039][ T4330] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 308.410999][ T9569] device veth1_vlan entered promiscuous mode [ 308.430972][ T4330] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 308.441658][ T4330] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 308.473231][ T4330] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 308.533868][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 308.558007][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 308.587809][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 308.630763][ T9569] device veth0_macvtap entered promiscuous mode [ 308.670109][ T9569] device veth1_macvtap entered promiscuous mode [ 308.774278][ T9569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 308.804060][ T9569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 308.845426][ T9569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 308.897964][ T9569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 308.962524][ T9569] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 309.006272][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 309.023512][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 309.048513][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 309.074573][ T4289] Bluetooth: hci3: command 0x0406 tx timeout [ 309.095030][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 309.158476][ T9569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 309.182880][ T9569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 309.193128][ T9569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 309.211356][ T9569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 309.235069][ T9569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 309.271139][ T9569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 309.332580][ T9569] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 309.370482][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 309.391817][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 309.428226][ T9569] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.457070][ T9569] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.480215][ T9569] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.510440][ T9569] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.799704][ T9868] Invalid ELF header magic: != ELF [ 309.826880][ T4667] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 309.834754][ T4667] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 309.883471][ T4667] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 309.991308][ T4330] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 310.018007][ T4330] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 310.036744][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 310.643554][ T9893] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1576'. [ 311.342290][ T9909] loop9: detected capacity change from 0 to 512 [ 311.449756][ T9909] EXT4-fs error (device loop9): ext4_xattr_inode_iget:401: inode #2: comm syz.9.1580: missing EA_INODE flag [ 311.492582][ T9909] EXT4-fs error (device loop9): ext4_xattr_inode_iget:406: comm syz.9.1580: error while reading EA inode 2 err=-117 [ 311.508378][ T9909] EXT4-fs (loop9): 1 orphan inode deleted [ 311.514320][ T9909] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: writeback. [ 311.675867][ T4352] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 311.838116][ T9569] EXT4-fs (loop9): unmounting filesystem. [ 311.905678][ T4352] usb 7-1: Using ep0 maxpacket: 16 [ 311.913856][ T4352] usb 7-1: config 0 has an invalid interface number: 34 but max is 0 [ 311.938607][ T4352] usb 7-1: config 0 has no interface number 0 [ 311.944795][ T4352] usb 7-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 312.007761][ T4352] usb 7-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 312.049220][ T4352] usb 7-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 312.075152][ T4352] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 312.122796][ T4352] usb 7-1: Product: syz [ 312.129419][ T4352] usb 7-1: Manufacturer: syz [ 312.134094][ T4352] usb 7-1: SerialNumber: syz [ 312.199131][ T4352] usb 7-1: config 0 descriptor?? [ 312.219681][ T9911] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 312.234040][ T9911] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 312.471370][ T9911] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 312.501363][ T9911] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 312.726767][ T4352] asix 7-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 312.748065][ T4352] asix: probe of 7-1:0.34 failed with error -61 [ 313.340889][ T9976] overlayfs: failed to clone upperpath [ 314.022527][ T9996] loop9: detected capacity change from 0 to 2048 [ 314.134669][ T9996] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 314.152700][ T9996] ext4 filesystem being mounted at /8/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 314.267875][ T9996] fs-verity: sha512 using implementation "sha512-avx2" [ 314.457851][ T4621] usb 7-1: USB disconnect, device number 12 [ 314.515972][ T9569] EXT4-fs (loop9): unmounting filesystem. [ 314.570860][ T9983] loop5: detected capacity change from 0 to 32768 [ 314.613910][T10013] loop6: detected capacity change from 0 to 1024 [ 314.701238][ T9983] XFS (loop5): Mounting V5 Filesystem [ 314.744077][T10013] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 314.837924][T10013] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 314.903412][ T9983] XFS (loop5): Ending clean mount [ 314.972652][ T9983] XFS (loop5): Quotacheck needed: Please wait. [ 314.999192][T10013] EXT4-fs error (device loop6): ext4_ext_check_inode:520: inode #13: comm syz.6.1609: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 315.159136][T10013] overlayfs: failed to look up (file0) for ino (-117) [ 315.172856][T10035] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1611'. [ 315.189150][ T9983] XFS (loop5): Quotacheck: Done. [ 315.195765][T10035] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1611'. [ 315.246513][T10035] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1611'. [ 315.306980][T10035] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1611'. [ 315.398266][ T4889] EXT4-fs error (device loop6): ext4_ext_check_inode:520: inode #13: comm syz-executor: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 315.505196][ T4889] EXT4-fs error (device loop6): ext4_ext_check_inode:520: inode #13: comm syz-executor: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 315.542510][T10040] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1613'. [ 315.612423][ T4791] XFS (loop5): Unmounting Filesystem [ 315.732429][ T5429] EXT4-fs (loop6): unmounting filesystem. [ 316.730551][T10065] input: syz0 as /devices/virtual/input/input13 [ 316.775351][T10066] xt_bpf: check failed: parse error [ 317.165695][T10081] netlink: 'syz.9.1627': attribute type 1 has an invalid length. [ 317.219085][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.225590][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.327278][T10083] loop5: detected capacity change from 0 to 256 [ 317.602856][ T4288] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 317.621147][ T4288] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 317.630917][ T4288] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 317.641255][ T4288] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 317.650600][ T4285] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 317.658473][ T4285] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 318.291514][T10092] chnl_net:caif_netlink_parms(): no params data found [ 318.507076][T10092] bridge0: port 1(bridge_slave_0) entered blocking state [ 318.514260][T10092] bridge0: port 1(bridge_slave_0) entered disabled state [ 318.599669][T10092] device bridge_slave_0 entered promiscuous mode [ 318.622930][T10132] netlink: 'syz.4.1639': attribute type 1 has an invalid length. [ 318.633067][T10130] loop9: detected capacity change from 0 to 2048 [ 318.652778][T10092] bridge0: port 2(bridge_slave_1) entered blocking state [ 318.660796][T10092] bridge0: port 2(bridge_slave_1) entered disabled state [ 318.669953][T10092] device bridge_slave_1 entered promiscuous mode [ 318.767143][T10130] UDF-fs: error (device loop9): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 318.819103][T10092] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 318.832832][T10130] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 318.868574][T10092] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 319.038204][T10092] team0: Port device team_slave_0 added [ 319.106279][T10092] team0: Port device team_slave_1 added [ 319.183866][T10092] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 319.225712][T10092] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 319.311028][T10092] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 319.325075][T10092] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 319.332239][T10092] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 319.384113][T10092] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 319.403607][T10151] netlink: 12 bytes leftover after parsing attributes in process `syz.9.1648'. [ 319.602118][T10092] device hsr_slave_0 entered promiscuous mode [ 319.623236][T10092] device hsr_slave_1 entered promiscuous mode [ 319.636607][T10092] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 319.644334][T10092] Cannot create hsr debugfs directory [ 319.695727][ T4285] Bluetooth: hci1: command 0x0409 tx timeout [ 319.725611][ T1172] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 319.853523][T10168] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1652'. [ 319.942315][ T1172] usb 8-1: Using ep0 maxpacket: 8 [ 319.950068][ T1172] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 319.981865][ T1172] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 320.002222][ T1172] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 320.049045][ T1172] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 320.080320][ T1172] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 320.099949][ T1172] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 320.352777][ T1172] usb 8-1: GET_CAPABILITIES returned 0 [ 320.358834][ T1172] usbtmc 8-1:16.0: can't read capabilities [ 320.425742][ T4351] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 320.592013][ C0] usbtmc 8-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 320.602482][ C0] usbtmc 8-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 320.611914][ C0] usbtmc 8-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 320.660761][ T4351] usb 10-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 320.684299][ T4351] usb 10-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 320.699162][ T4351] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 320.709154][ T4351] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 320.721130][ T4351] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 320.741402][ T126] usb 8-1: USB disconnect, device number 7 [ 320.769468][ T4351] usb 10-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 320.795584][ T4351] usb 10-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 320.814208][ T4351] usb 10-1: Product: syz [ 320.824404][ T4351] usb 10-1: Manufacturer: syz [ 320.867965][ T4351] cdc_wdm 10-1:1.0: skipping garbage [ 320.873346][ T4351] cdc_wdm 10-1:1.0: skipping garbage [ 320.875091][T10175] loop5: detected capacity change from 0 to 40427 [ 320.912431][ T4351] cdc_wdm 10-1:1.0: cdc-wdm0: USB WDM device [ 320.924541][T10175] F2FS-fs (loop5): invalid crc value [ 320.942408][ T4351] cdc_wdm 10-1:1.0: Unknown control protocol [ 320.953773][T10175] F2FS-fs (loop5): Found nat_bits in checkpoint [ 321.086224][ C1] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 321.093022][ C1] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 321.105627][ C1] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 321.112552][ C1] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 321.127917][ C1] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 321.134683][ C1] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 321.148862][ T1172] usb 10-1: USB disconnect, device number 2 [ 321.160279][ C1] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 321.167220][ C1] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 321.173422][ C1] cdc_wdm 10-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 321.184880][T10175] F2FS-fs (loop5): Start checkpoint disabled! [ 321.283218][T10175] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e6 [ 321.609168][T10203] syz.5.1663: attempt to access beyond end of device [ 321.609168][T10203] loop5: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 321.777531][ T4285] Bluetooth: hci1: command 0x041b tx timeout [ 321.873483][T10204] process '/newroot/438/file0' started with executable stack [ 322.316348][T10221] overlayfs: failed to clone upperpath [ 322.352600][ T9] kworker/u4:0: attempt to access beyond end of device [ 322.352600][ T9] loop5: rw=2049, sector=40960, nr_sectors = 8 limit=40427 [ 322.483627][T10227] netlink: 28 bytes leftover after parsing attributes in process `syz.9.1669'. [ 322.675861][T10092] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 322.737047][T10092] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 322.766957][T10092] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 322.815122][T10092] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 323.119655][T10092] 8021q: adding VLAN 0 to HW filter on device bond0 [ 323.173404][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 323.220457][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 323.253883][T10092] 8021q: adding VLAN 0 to HW filter on device team0 [ 323.277789][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 323.307206][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 323.327922][ T4708] bridge0: port 1(bridge_slave_0) entered blocking state [ 323.335269][ T4708] bridge0: port 1(bridge_slave_0) entered forwarding state [ 323.397009][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 323.431621][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 323.457240][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 323.481605][ T4708] bridge0: port 2(bridge_slave_1) entered blocking state [ 323.488941][ T4708] bridge0: port 2(bridge_slave_1) entered forwarding state [ 323.542724][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 323.582175][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 323.626717][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 323.674816][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 323.703183][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 323.736425][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 323.754949][T10092] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 323.795729][T10092] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 323.839112][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 323.855583][ T4285] Bluetooth: hci1: command 0x040f tx timeout [ 323.912964][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 323.932893][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 323.947414][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 323.966539][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 323.997102][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 324.339521][T10264] device ipvlan2 entered promiscuous mode [ 324.463129][T10264] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 324.526461][T10264] team0: Device ipvlan2 failed to register rx_handler [ 324.564322][T10254] loop9: detected capacity change from 0 to 40427 [ 324.666919][T10254] F2FS-fs (loop9): invalid crc value [ 324.713247][T10254] F2FS-fs (loop9): Found nat_bits in checkpoint [ 324.918304][T10254] F2FS-fs (loop9): Mounted with checkpoint version = 48b305e5 [ 325.339087][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 325.369219][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 325.393650][T10092] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 325.499467][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 325.536679][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 325.651950][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 325.666844][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 325.716816][T10092] device veth0_vlan entered promiscuous mode [ 325.748962][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 325.790460][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 325.831965][T10092] device veth1_vlan entered promiscuous mode [ 325.917272][T10092] device veth0_macvtap entered promiscuous mode [ 325.935732][ T4285] Bluetooth: hci1: command 0x0419 tx timeout [ 325.947711][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 325.986010][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 326.033651][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 326.045623][ T4626] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 326.091451][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 326.120537][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 326.138791][T10092] device veth1_macvtap entered promiscuous mode [ 326.206448][T10092] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 326.245540][ T4626] usb 8-1: Using ep0 maxpacket: 16 [ 326.267685][ T4626] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 326.285595][T10092] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 326.313682][ T4626] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 326.334145][T10092] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 326.370696][T10092] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 326.370930][ T4626] usb 8-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 326.391090][T10092] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 326.416037][T10092] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 326.435537][ T4626] usb 8-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 326.455085][T10092] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 326.475677][ T4626] usb 8-1: Manufacturer: syz [ 326.506669][T10092] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 326.534603][T10092] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 326.552660][ T4626] usb 8-1: config 0 descriptor?? [ 326.622660][T10092] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 326.705204][T10092] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 326.770429][T10092] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 326.855745][T10092] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 326.931530][T10092] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 326.994111][T10092] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 327.013024][ T4626] input: syz as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/0003:041E:3100.0015/input/input14 [ 327.095809][T10092] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 327.176516][T10092] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 327.203888][ T4626] creative-sb0540 0003:041E:3100.0015: input,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.7-1/input0 [ 327.236684][T10297] loop9: detected capacity change from 0 to 131072 [ 327.273070][T10297] F2FS-fs (loop9): Wrong NAT boundary, start(2560) end(3584) blocks(12321792) [ 327.282265][T10297] F2FS-fs (loop9): Can't find valid F2FS filesystem in 2th superblock [ 327.291602][T10092] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 327.340857][T10297] F2FS-fs (loop9): Found nat_bits in checkpoint [ 327.348126][T10092] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 327.400614][T10092] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 327.426354][T10297] F2FS-fs (loop9): Try to recover 2th superblock, ret: 0 [ 327.434039][T10297] F2FS-fs (loop9): Mounted with checkpoint version = 48b305e5 [ 327.491627][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 327.497763][ T4352] usb 8-1: USB disconnect, device number 8 [ 327.517812][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 327.543901][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 327.569075][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 327.596874][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 327.639989][T10314] device ipvlan2 entered promiscuous mode [ 327.695981][T10314] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 327.725872][T10314] team0: Device ipvlan2 failed to register rx_handler [ 327.746989][T10309] fido_id[10309]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.7/usb8/report_descriptor': No such file or directory [ 328.218159][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 328.241729][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 328.316084][ T4652] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 328.394965][ T4652] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 328.421976][ T4652] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 328.467463][ T4703] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 328.776175][T10340] 9pnet: p9_errstr2errno: server reported unknown error 00000000000000000004ÿÿ [ 330.656116][ T4351] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 330.739524][T10405] loop5: detected capacity change from 0 to 512 [ 330.862692][T10405] EXT4-fs error (device loop5): ext4_orphan_get:1409: inode #15: comm syz.5.1711: inode has both inline data and extents flags [ 330.883663][ T4351] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 330.918128][ T4351] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 330.980984][T10405] EXT4-fs error (device loop5): ext4_orphan_get:1414: comm syz.5.1711: couldn't read orphan inode 15 (err -117) [ 331.003638][T10405] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 331.003657][ T4351] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 331.089209][ T4351] usb 10-1: Product: syz [ 331.093582][ T4351] usb 10-1: Manufacturer: syz [ 331.132631][ T4351] usb 10-1: SerialNumber: syz [ 331.313990][ T4791] EXT4-fs (loop5): unmounting filesystem. [ 331.547357][T10422] netlink: 40 bytes leftover after parsing attributes in process `syz.7.1715'. [ 331.810213][T10422] device hsr_slave_1 left promiscuous mode [ 331.876751][T10434] netlink: 'syz.5.1718': attribute type 1 has an invalid length. [ 331.908399][T10434] netlink: 'syz.5.1718': attribute type 2 has an invalid length. [ 331.934401][T10434] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1718'. [ 332.201667][ T4351] cdc_ncm 10-1:1.0: bind() failure [ 332.222927][ T4351] cdc_ncm 10-1:1.1: CDC Union missing and no IAD found [ 332.250404][ T4351] cdc_ncm 10-1:1.1: bind() failure [ 332.475892][ T4351] usb 10-1: USB disconnect, device number 3 [ 332.525522][ T4352] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 332.707362][ T4352] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 332.735989][ T4352] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 332.769503][ T4352] usb 6-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 332.812397][ T4352] usb 6-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 332.821239][ T4352] usb 6-1: Manufacturer: syz [ 332.828006][ T4352] usb 6-1: config 0 descriptor?? [ 332.984506][ T4351] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 333.185732][ T4351] usb 2-1: Using ep0 maxpacket: 8 [ 333.198511][ T4351] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 333.228032][ T4351] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 333.262055][ T4351] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 333.290164][ T4351] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 333.336149][ T4351] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 333.352336][ T4351] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 333.381423][ T4351] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 333.621167][ T4351] usb 2-1: usb_control_msg returned -32 [ 333.627812][ T4351] usbtmc 2-1:16.0: can't read capabilities [ 333.852403][ T4352] uclogic 0003:256C:006D.0016: v1 frame probing failed: -71 [ 333.869799][ T4352] uclogic 0003:256C:006D.0016: failed probing parameters: -71 [ 333.904151][ T4352] uclogic: probe of 0003:256C:006D.0016 failed with error -71 [ 333.964533][ T4352] usb 6-1: USB disconnect, device number 15 [ 334.379500][T10509] usbtmc 2-1:16.0: CHECK_CLEAR_STATUS returned 0 [ 334.587804][ T4352] usb 2-1: USB disconnect, device number 2 [ 335.437814][T10516] loop5: detected capacity change from 0 to 131072 [ 335.460825][T10516] F2FS-fs (loop5): Invalid log sectorsize (67108873) [ 335.467817][T10516] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 335.480490][T10516] F2FS-fs (loop5): invalid crc value [ 335.512779][T10516] F2FS-fs (loop5): Found nat_bits in checkpoint [ 335.631047][T10516] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 335.638378][T10516] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e4 [ 335.665094][ T27] audit: type=1800 audit(1789542713.306:1276): pid=10516 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1742" name="file1" dev="loop5" ino=7 res=0 errno=0 [ 337.091826][T10561] loop7: detected capacity change from 0 to 2048 [ 337.141498][T10561] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 337.271062][T10563] loop5: detected capacity change from 0 to 4096 [ 337.414197][T10563] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 337.540772][T10549] loop1: detected capacity change from 0 to 32768 [ 337.741307][T10549] XFS (loop1): Mounting V5 Filesystem [ 337.898328][T10549] XFS (loop1): Ending clean mount [ 337.935838][T10549] XFS (loop1): Quotacheck needed: Please wait. [ 338.182569][T10549] XFS (loop1): Quotacheck: Done. [ 338.211864][T10549] jffs2: notice: (10549) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 338.303881][ T4791] EXT4-fs (loop5): unmounting filesystem. [ 338.593564][T10595] input: syz1 as /devices/virtual/input/input15 [ 338.814958][T10092] XFS (loop1): Unmounting Filesystem [ 339.997264][T10631] netlink: 20 bytes leftover after parsing attributes in process `syz.9.1777'. [ 340.220163][T10634] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 340.584680][T10642] Bluetooth: hci0: service_discovery: expected 4 bytes, got 7 bytes [ 340.911998][ T27] audit: type=1326 audit(1789542718.556:1277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.4.1785" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff69e99e159 code=0x7fc00000 [ 340.985601][ T27] audit: type=1326 audit(1789542718.586:1278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.4.1785" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=324 compat=0 ip=0x7ff69e99e159 code=0x7fc00000 [ 341.145597][ T27] audit: type=1326 audit(1789542718.586:1279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.4.1785" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff69e99e159 code=0x7fc00000 [ 341.242232][T10666] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1790'. [ 341.256758][ T27] audit: type=1326 audit(1789542718.586:1280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.4.1785" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff69e99e159 code=0x7fc00000 [ 341.310610][T10666] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1790'. [ 341.333331][ T27] audit: type=1326 audit(1789542718.586:1281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.4.1785" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff69e99e159 code=0x7fc00000 [ 341.429957][ T27] audit: type=1326 audit(1789542718.586:1282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.4.1785" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff69e99e159 code=0x7fc00000 [ 341.463168][ T27] audit: type=1326 audit(1789542718.586:1283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10646 comm="syz.4.1785" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff69e99e159 code=0x7fc00000 [ 342.129794][T10698] loop5: detected capacity change from 0 to 512 [ 342.240567][T10698] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 342.720082][ T4791] EXT4-fs (loop5): unmounting filesystem. [ 343.375852][ T5516] usb 6-1: new full-speed USB device number 16 using dummy_hcd [ 343.577435][ T5516] usb 6-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 343.615552][ T5516] usb 6-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 343.647560][ T5516] usb 6-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 343.684949][ T5516] usb 6-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 343.709605][ T5516] usb 6-1: Product: syz [ 343.725522][ T5516] usb 6-1: Manufacturer: syz [ 343.801836][ T5516] hub 6-1:4.0: USB hub found [ 343.909606][T10753] vhci_hcd vhci_hcd.0: Expecting SOCK_STREAM - found 3 [ 343.996332][ T5516] hub 6-1:4.0: config failed, hub has too many ports! (err -19) [ 344.355844][ T4626] usb 6-1: USB disconnect, device number 16 [ 344.435531][ T5516] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 344.637632][ T5516] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 344.663931][ T5516] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 344.713764][ T5516] usb 8-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 344.783004][ T5516] usb 8-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 344.813931][ T5516] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 345.096820][ T4351] libceph: connect (1)[c::]:6789 error -101 [ 345.106691][ T4351] libceph: mon0 (1)[c::]:6789 connect error [ 345.173920][ T4351] libceph: connect (1)[c::]:6789 error -101 [ 345.199329][ T4351] libceph: mon0 (1)[c::]:6789 connect error [ 345.263330][ T4351] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 345.491532][ T5516] cxacru 8-1:1.0: send of cm 0x84 failed (-71) [ 345.511498][ T5516] ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -71 [ 345.538926][ T5516] cxacru 8-1:1.0: send of cm 0x88 failed (-71) [ 345.550566][ T4365] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 345.554237][ T5516] ATM dev 0: poll status: error -71 [ 345.558180][ T4365] libceph: connect (1)[c::]:6789 error -101 [ 345.566607][ T5516] ATM dev 0: polling disabled, set adsl_state to 'start' or 'poll' to resume [ 345.588974][ T4365] libceph: mon0 (1)[c::]:6789 connect error [ 345.592960][ T5516] ATM dev 0: usbatm_submit_urb: urb 0xffff888027a31c00 submission failed (-8)! [ 345.642365][ T5516] usb 8-1: USB disconnect, device number 9 [ 345.804805][T10790] ceph: No mds server is up or the cluster is laggy [ 345.804805][T10787] ceph: No mds server is up or the cluster is laggy [ 346.115931][ T126] libceph: connect (1)[c::]:6789 error -101 [ 346.133606][ T126] libceph: mon0 (1)[c::]:6789 connect error [ 346.170458][ T126] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 347.996378][T10876] 9p: Unknown uid 00000000004294967295 [ 348.992752][T10855] loop7: detected capacity change from 0 to 65536 [ 349.129764][T10855] XFS (loop7): Mounting V5 Filesystem [ 349.306076][T10855] XFS (loop7): Ending clean mount [ 349.352588][T10855] XFS (loop7): Quotacheck needed: Please wait. [ 349.572353][T10855] XFS (loop7): Quotacheck: Done. [ 350.176907][ T6959] XFS (loop7): Unmounting Filesystem [ 350.734122][T10962] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 352.405765][ T4623] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 352.625045][ T1172] hid-generic 0000:0000:0000.0017: unknown main item tag 0x0 [ 352.654579][ T1172] hid-generic 0000:0000:0000.0017: hidraw0: HID v0.00 Device [syz1] on syz0 [ 352.664895][ T4623] usb 6-1: Using ep0 maxpacket: 8 [ 352.672069][ T4623] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 352.716857][ T4623] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 352.755810][ T4623] usb 6-1: New USB device found, idVendor=0d46, idProduct=2011, bcdDevice= 1.00 [ 352.792085][ T4623] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 352.831930][ T4623] kobil_sct 6-1:1.0: KOBIL USB smart card terminal converter detected [ 352.875812][ T4623] usb 6-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 353.624952][ T126] usb 6-1: USB disconnect, device number 17 [ 353.651347][ T126] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 353.701859][ T126] kobil_sct 6-1:1.0: device disconnected [ 353.773334][T11023] loop7: detected capacity change from 0 to 32768 [ 353.875233][T11023] XFS (loop7): Mounting V5 Filesystem [ 353.987153][T11023] XFS (loop7): Ending clean mount [ 354.013571][T11023] XFS (loop7): Quotacheck needed: Please wait. [ 354.178516][T11023] XFS (loop7): Quotacheck: Done. [ 354.236833][T11023] jffs2: notice: (11023) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 354.591633][ T6959] XFS (loop7): Unmounting Filesystem [ 355.534263][T11089] loop7: detected capacity change from 0 to 512 [ 355.636159][T11089] EXT4-fs (loop7): revision level too high, forcing read-only mode [ 355.656059][T11089] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 355.689508][T11089] System zones: 0-1, 15-15, 18-18, 34-34 [ 355.738103][T11089] EXT4-fs (loop7): orphan cleanup on readonly fs [ 355.744611][T11089] __quota_error: 3 callbacks suppressed [ 355.744627][T11089] Quota error (device loop7): v2_read_header: Failed header read: expected=8 got=0 [ 355.765823][T11089] EXT4-fs warning (device loop7): ext4_enable_quotas:7093: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 355.876292][T11089] EXT4-fs (loop7): Cannot turn on quotas: error -22 [ 355.935379][T11089] EXT4-fs error (device loop7): ext4_orphan_get:1435: comm syz.7.1897: bad orphan inode 16 [ 356.000526][T11089] ext4_test_bit(bit=15, block=18) = 1 [ 356.046063][T11089] is_bad_inode(inode)=0 [ 356.050856][T11089] NEXT_ORPHAN(inode)=0 [ 356.061004][T11089] max_ino=32 [ 356.076588][T11089] i_nlink=2 [ 356.087720][T11089] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 356.315885][ T6959] EXT4-fs (loop7): unmounting filesystem. [ 356.911507][T11124] tipc: Started in network mode [ 356.935666][T11124] tipc: Node identity 7f000001, cluster identity 4711 [ 356.974219][T11124] tipc: New replicast peer: 127.0.0.1 [ 356.989227][T11124] tipc: Enabled bearer , priority 10 [ 357.015285][T11131] tipc: Disabling bearer [ 357.107840][T11124] tipc: New replicast peer: 127.0.0.1 [ 357.113603][T11124] tipc: Enabled bearer , priority 10 [ 357.489013][T11146] loop5: detected capacity change from 0 to 512 [ 357.588032][ T4490] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 358.229942][ T4626] tipc: Node number set to 2130706433 [ 358.368766][ T27] audit: type=1326 audit(1789542736.016:1284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11168 comm="syz.4.1924" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff69e99e159 code=0x0 [ 358.958470][T11192] FAULT_INJECTION: forcing a failure. [ 358.958470][T11192] name failslab, interval 1, probability 0, space 0, times 0 [ 359.003960][T11192] CPU: 0 PID: 11192 Comm: syz.1.1931 Not tainted syzkaller #0 [ 359.011505][T11192] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 359.021604][T11192] Call Trace: [ 359.024921][T11192] [ 359.027882][T11192] dump_stack_lvl+0x188/0x24e [ 359.032770][T11192] ? show_regs_print_info+0x12/0x12 [ 359.038021][T11192] ? load_image+0x410/0x410 [ 359.042600][T11192] ? __might_sleep+0xd0/0xd0 [ 359.047425][T11192] ? __lock_acquire+0x7c40/0x7c40 [ 359.052567][T11192] ? __se_sys_memfd_create+0xee/0x340 [ 359.058031][T11192] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 359.064220][T11192] should_fail_ex+0x390/0x4c0 [ 359.069012][T11192] should_failslab+0x5/0x20 [ 359.073593][T11192] slab_pre_alloc_hook+0x59/0x300 [ 359.078964][T11192] kmem_cache_alloc_lru+0x49/0x2e0 [ 359.084117][T11192] ? shmem_alloc_inode+0x24/0x40 [ 359.089182][T11192] shmem_alloc_inode+0x24/0x40 [ 359.094163][T11192] ? shmem_match+0x160/0x160 [ 359.098795][T11192] new_inode_pseudo+0x5f/0x1c0 [ 359.103682][T11192] new_inode+0x25/0x1d0 [ 359.107986][T11192] shmem_get_inode+0x327/0xbc0 [ 359.112805][T11192] ? _raw_spin_unlock+0x24/0x40 [ 359.117722][T11192] __shmem_file_setup+0x10b/0x290 [ 359.122795][T11192] ? shmem_file_setup+0x13/0x30 [ 359.127699][T11192] __se_sys_memfd_create+0x1e1/0x340 [ 359.133038][T11192] do_syscall_64+0x4c/0xa0 [ 359.137594][T11192] ? clear_bhb_loop+0x60/0xb0 [ 359.142327][T11192] ? clear_bhb_loop+0x60/0xb0 [ 359.147047][T11192] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 359.152991][T11192] RIP: 0033:0x7fe72279e159 [ 359.157444][T11192] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 359.177181][T11192] RSP: 002b:00007fe7235e7e08 EFLAGS: 00000202 ORIG_RAX: 000000000000013f [ 359.185737][T11192] RAX: ffffffffffffffda RBX: 00000000000011ff RCX: 00007fe72279e159 [ 359.193745][T11192] RDX: 00007fe7235e7ee0 RSI: 0000000000000000 RDI: 00007fe72283524b [ 359.201755][T11192] RBP: 0000200000002480 R08: 00000000ffffffff R09: 0000000000000000 [ 359.209778][T11192] R10: 0000000000000001 R11: 0000000000000202 R12: 0000200000001240 [ 359.217786][T11192] R13: 00007fe7235e7ee0 R14: 00007fe7235e7ea0 R15: 0000200000000b40 [ 359.225816][T11192] [ 359.484244][T11207] overlayfs: failed to clone upperpath [ 360.100811][T11230] loop1: detected capacity change from 0 to 1024 [ 360.126746][T11230] EXT4-fs: Ignoring removed nomblk_io_submit option [ 360.254986][T11230] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 360.611472][T11249] netlink: 762 bytes leftover after parsing attributes in process `syz.7.1946'. [ 360.685647][T11249] bridge: RTM_DELNEIGH with unconfigured vlan 289 on bridge0 [ 361.342743][T10092] EXT4-fs (loop1): unmounting filesystem. [ 361.860731][T11284] fuse: Bad value for 'fd' [ 362.423425][T11307] netlink: 'syz.7.1968': attribute type 10 has an invalid length. [ 362.465876][T11307] netlink: 55 bytes leftover after parsing attributes in process `syz.7.1968'. [ 362.920808][T11322] loop5: detected capacity change from 0 to 256 [ 363.145730][ T4623] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 363.338156][ T4623] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 363.376804][ T4623] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 363.409777][ T4623] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 363.450987][ T4623] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 363.513396][ T4623] usb 2-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= 1.00 [ 363.563381][ T4623] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.593787][ T4623] usb 2-1: Product: syz [ 363.609827][ T4623] usb 2-1: Manufacturer: syz [ 363.645849][ T4623] usb 2-1: SerialNumber: syz [ 363.677083][ T4623] usbserial_generic 2-1:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 363.715799][ T4623] usbserial_generic 2-1:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 363.746363][ T4623] usbserial_generic 2-1:1.0: generic converter detected [ 363.769734][T11341] loop5: detected capacity change from 0 to 512 [ 363.786701][ T4623] usb 2-1: generic converter now attached to ttyUSB0 [ 363.797725][T11320] loop7: detected capacity change from 0 to 32768 [ 363.824998][T11341] EXT4-fs: Ignoring removed i_version option [ 363.893685][T11341] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 363.940037][T11320] XFS (loop7): Mounting V5 Filesystem [ 363.955653][T11341] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 363.977547][ T4623] usb 2-1: USB disconnect, device number 3 [ 363.997070][ T4623] generic ttyUSB0: generic converter now disconnected from ttyUSB0 [ 364.022996][ T4623] usbserial_generic 2-1:1.0: device disconnected [ 364.057627][T11320] XFS (loop7): Ending clean mount [ 364.080221][T11341] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 364.107891][T11341] ext4 filesystem being mounted at /336/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 364.348418][ T6959] XFS (loop7): Unmounting Filesystem [ 364.378481][ T4791] EXT4-fs (loop5): unmounting filesystem. [ 364.676115][T11372] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1985'. [ 364.718371][T11372] device hsr_slave_0 left promiscuous mode [ 364.809711][T11372] device hsr_slave_1 left promiscuous mode [ 365.453788][T11394] loop5: detected capacity change from 0 to 512 [ 365.501910][T11396] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 365.507982][T11394] EXT4-fs: Ignoring removed nobh option [ 365.518810][T11396] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 365.525734][T11396] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 365.532531][T11396] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 365.541601][T11396] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 365.548467][T11396] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 365.555339][T11396] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 365.562366][T11396] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 365.569227][T11396] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 365.576088][T11396] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 365.731601][T11394] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 365.768375][T11394] ext4 filesystem being mounted at /338/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 366.094943][T11394] EXT4-fs error (device loop5): ext4_do_update_inode:5279: inode #2: comm syz.5.1994: corrupted inode contents [ 366.226632][T11394] EXT4-fs error (device loop5): ext4_dirty_inode:6166: inode #2: comm syz.5.1994: mark_inode_dirty error [ 366.279520][T11394] EXT4-fs error (device loop5): ext4_do_update_inode:5279: inode #2: comm syz.5.1994: corrupted inode contents [ 366.331733][T11394] EXT4-fs error (device loop5): __ext4_ext_dirty:202: inode #2: comm syz.5.1994: mark_inode_dirty error [ 366.770317][T11414] 9pnet_fd: Insufficient options for proto=fd [ 367.096602][ T4791] EXT4-fs (loop5): unmounting filesystem. [ 367.301743][T11431] loop5: detected capacity change from 0 to 512 [ 367.330035][T11430] device hsr0 entered promiscuous mode [ 367.371154][T11430] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2004'. [ 367.411314][T11431] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 367.435669][T11431] ext4 filesystem being mounted at /339/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 367.552999][T11431] EXT4-fs error (device loop5): ext4_do_update_inode:5279: inode #2: comm syz.5.2003: corrupted inode contents [ 367.590476][T11431] EXT4-fs (loop5): Remounting filesystem read-only [ 367.655631][T11431] EXT4-fs error (device loop5): ext4_dirty_inode:6166: inode #2: comm syz.5.2003: mark_inode_dirty error [ 367.688112][T11431] EXT4-fs (loop5): Remounting filesystem read-only [ 367.757114][T11431] EXT4-fs error (device loop5): ext4_do_update_inode:5279: inode #2: comm syz.5.2003: corrupted inode contents [ 367.811229][T11431] EXT4-fs (loop5): Remounting filesystem read-only [ 367.823681][ T27] audit: type=1807 audit(1789542745.466:1285): action=measure res=1 [ 367.848519][T11444] EXT4-fs error (device loop5): ext4_do_update_inode:5279: inode #2: comm syz.5.2003: corrupted inode contents [ 367.862111][ T27] audit: type=1807 audit(1789542745.516:1286): UNKNOWN= res=0 [ 367.862772][T11447] ima: policy update failed [ 367.877219][ T27] audit: type=1802 audit(1789542745.516:1287): pid=11447 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=update_policy cause=invalid-policy comm="syz.1.2008" res=0 errno=0 [ 367.906926][T11444] EXT4-fs (loop5): Remounting filesystem read-only [ 367.913677][T11444] EXT4-fs error (device loop5): ext4_dirty_inode:6166: inode #2: comm syz.5.2003: mark_inode_dirty error [ 367.946305][ T27] audit: type=1802 audit(1789542745.556:1288): pid=11447 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.1.2008" res=0 errno=0 [ 368.008391][T11444] EXT4-fs (loop5): Remounting filesystem read-only [ 368.021370][T11444] EXT4-fs error (device loop5): ext4_do_update_inode:5279: inode #2: comm syz.5.2003: corrupted inode contents [ 368.058561][T11444] EXT4-fs (loop5): Remounting filesystem read-only [ 368.065269][T11444] EXT4-fs error (device loop5): __ext4_ext_dirty:202: inode #2: comm syz.5.2003: mark_inode_dirty error [ 368.126960][T11444] EXT4-fs (loop5): Remounting filesystem read-only [ 368.133654][T11444] EXT4-fs error (device loop5): ext4_do_update_inode:5279: inode #2: comm syz.5.2003: corrupted inode contents [ 368.180210][T11444] EXT4-fs (loop5): Remounting filesystem read-only [ 368.204290][T11444] EXT4-fs error (device loop5): ext4_dirty_inode:6166: inode #2: comm syz.5.2003: mark_inode_dirty error [ 368.252617][T11444] EXT4-fs (loop5): Remounting filesystem read-only [ 368.316264][T11431] EXT4-fs error (device loop5): ext4_do_update_inode:5279: inode #2: comm syz.5.2003: corrupted inode contents [ 368.338014][ T1172] usb 8-1: new full-speed USB device number 10 using dummy_hcd [ 368.560461][ T1172] usb 8-1: New USB device found, idVendor=0582, idProduct=003b, bcdDevice= 0.40 [ 368.595907][ T1172] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.624852][ T1172] usb 8-1: Product: syz [ 368.645125][ T1172] usb 8-1: Manufacturer: syz [ 368.655243][ T1172] usb 8-1: SerialNumber: syz [ 369.159414][T11486] loop5: detected capacity change from 0 to 128 [ 369.503076][ T1172] usb 8-1: MIDIStreaming interface descriptor not found [ 369.722658][ T4319] usb 8-1: USB disconnect, device number 10 [ 369.925934][T11499] FAULT_INJECTION: forcing a failure. [ 369.925934][T11499] name failslab, interval 1, probability 0, space 0, times 0 [ 369.981655][T11499] CPU: 0 PID: 11499 Comm: syz.1.2025 Not tainted syzkaller #0 [ 369.989372][T11499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 369.999604][T11499] Call Trace: [ 370.003195][T11499] [ 370.006165][T11499] dump_stack_lvl+0x188/0x24e [ 370.010901][T11499] ? show_regs_print_info+0x12/0x12 [ 370.016143][T11499] ? load_image+0x410/0x410 [ 370.020695][T11499] ? __might_sleep+0xd0/0xd0 [ 370.025327][T11499] ? __lock_acquire+0x7c40/0x7c40 [ 370.030488][T11499] should_fail_ex+0x390/0x4c0 [ 370.035223][T11499] should_failslab+0x5/0x20 [ 370.039755][T11499] slab_pre_alloc_hook+0x59/0x300 [ 370.044804][T11499] kmem_cache_alloc+0x56/0x2f0 [ 370.049578][T11499] ? sk_prot_alloc+0x57/0x210 [ 370.054347][T11499] sk_prot_alloc+0x57/0x210 [ 370.058861][T11499] ? sk_alloc+0x20/0x330 [ 370.063125][T11499] sk_alloc+0x36/0x330 [ 370.067212][T11499] __vsock_create+0x3a/0x970 [ 370.071887][T11499] vsock_create+0x12e/0x3b0 [ 370.076424][T11499] __sock_create+0x49a/0x940 [ 370.081139][T11499] __sys_socket+0xc4/0x190 [ 370.085605][T11499] __x64_sys_socket+0x76/0x80 [ 370.090327][T11499] do_syscall_64+0x4c/0xa0 [ 370.094847][T11499] ? clear_bhb_loop+0x60/0xb0 [ 370.099537][T11499] ? clear_bhb_loop+0x60/0xb0 [ 370.104238][T11499] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 370.110242][T11499] RIP: 0033:0x7fe72279e159 [ 370.114671][T11499] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 370.134395][T11499] RSP: 002b:00007fe7235e8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 370.142830][T11499] RAX: ffffffffffffffda RBX: 00007fe722a25fa0 RCX: 00007fe72279e159 [ 370.150824][T11499] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000028 [ 370.158807][T11499] RBP: 00007fe72283506b R08: 0000000000000000 R09: 0000000000000000 [ 370.166784][T11499] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 370.174768][T11499] R13: 00007fe722a26038 R14: 00007fe722a25fa0 R15: 00007ffe0d204ba8 [ 370.182784][T11499] [ 370.574459][T11515] netlink: 204 bytes leftover after parsing attributes in process `syz.7.2029'. [ 370.628638][T11515] netlink: 232 bytes leftover after parsing attributes in process `syz.7.2029'. [ 371.205625][ T1172] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 371.405660][ T1172] usb 8-1: Using ep0 maxpacket: 8 [ 371.413191][ T1172] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 371.452919][ T1172] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 371.532230][ T1172] usb 8-1: New USB device found, idVendor=0d46, idProduct=2011, bcdDevice= 1.00 [ 371.562552][ T1172] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 371.582226][T11544] loop1: detected capacity change from 0 to 512 [ 371.607815][ T1172] kobil_sct 8-1:1.0: KOBIL USB smart card terminal converter detected [ 371.635167][T11544] EXT4-fs: Ignoring removed i_version option [ 371.644353][ T1172] usb 8-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 371.682193][T11544] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 371.802313][T11544] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 371.831999][T11544] ext4 filesystem being mounted at /67/file7 supports timestamps until 2038-01-19 (0x7fffffff) [ 371.957680][T11531] loop5: detected capacity change from 0 to 32768 [ 371.996658][T11531] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 scanned by syz.5.2035 (11531) [ 372.058845][T10092] EXT4-fs (loop1): unmounting filesystem. [ 372.109329][T11531] BTRFS info (device loop5): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 372.134034][T11531] BTRFS info (device loop5): using sha256 (sha256-avx2) checksum algorithm [ 372.177523][T11531] BTRFS info (device loop5): setting nodatasum [ 372.193118][T11531] BTRFS info (device loop5): use zlib compression, level 3 [ 372.245181][T11531] BTRFS info (device loop5): force clearing of disk cache [ 372.275688][T11531] BTRFS info (device loop5): using free space tree [ 372.433525][ T4319] usb 8-1: USB disconnect, device number 11 [ 372.460063][ T4319] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 372.474358][ T4319] kobil_sct 8-1:1.0: device disconnected [ 372.596912][T11531] BTRFS info (device loop5): enabling ssd optimizations [ 372.606931][T11531] BTRFS info (device loop5): rebuilding free space tree [ 373.332345][ T27] audit: type=1800 audit(1789542750.976:1289): pid=11605 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2035" name="file1" dev="loop5" ino=258 res=0 errno=0 [ 373.697299][ T4791] BTRFS info (device loop5): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 374.106551][ T4319] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 374.316219][ T4319] usb 2-1: not running at top speed; connect to a high speed hub [ 374.337645][ T4319] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 374.359733][ T4319] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 374.389800][ T4319] usb 2-1: New USB device found, idVendor=0000, idProduct=d970, bcdDevice= 1.00 [ 374.431874][ T4319] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 374.438512][ T5517] hid-generic 0000:0000:0000.0018: unknown main item tag 0x0 [ 374.457534][ T5517] hid-generic 0000:0000:0000.0018: hidraw0: HID v0.00 Device [syz1] on syz0 [ 374.483373][ T4319] usb 2-1: Found UVC 1.00 device (0000:d970) [ 374.684086][ T4319] usb 2-1: Failed to query (GET_INFO) UVC control 15 on unit 1: -32 (exp. 1). [ 374.716879][ T4319] usb 2-1: No streaming interface found for terminal 2. [ 374.944157][ T5512] usb 2-1: USB disconnect, device number 4 [ 374.966237][T11649] loop5: detected capacity change from 0 to 512 [ 376.255690][ T4319] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 376.388150][T11685] loop5: detected capacity change from 0 to 512 [ 376.418551][T11685] EXT4-fs: inline encryption not supported [ 376.450166][T11685] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 376.472423][ T4319] usb 8-1: config 220 has an invalid interface number: 76 but max is 2 [ 376.500005][ T4319] usb 8-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 376.518122][T11685] EXT4-fs (loop5): 1 truncate cleaned up [ 376.523864][T11685] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 376.553276][ T4319] usb 8-1: config 220 has no interface number 2 [ 376.572612][ T4319] usb 8-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 376.642860][ T4319] usb 8-1: config 220 interface 0 has no altsetting 0 [ 376.675622][ T4319] usb 8-1: config 220 interface 76 has no altsetting 0 [ 376.685880][ T4319] usb 8-1: config 220 interface 1 has no altsetting 0 [ 376.712228][ T4319] usb 8-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 376.742135][ T4319] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 376.774832][ T4319] usb 8-1: Product: syz [ 376.789691][ T4319] usb 8-1: Manufacturer: syz [ 376.804597][ T4319] usb 8-1: SerialNumber: syz [ 376.918599][ T4791] EXT4-fs (loop5): unmounting filesystem. [ 377.417889][T11718] tls_set_device_offload_rx: netdev not found [ 377.766494][ T4319] usb 8-1: selecting invalid altsetting 0 [ 377.775356][ T4319] usb 8-1: Found UVC 7.01 device syz (8086:0b07) [ 377.854628][ T4319] usb 8-1: No valid video chain found. [ 377.936337][ T4319] usb 8-1: selecting invalid altsetting 0 [ 377.955660][ T4319] usbtest: probe of 8-1:220.1 failed with error -22 [ 377.991817][ T4319] usb 8-1: USB disconnect, device number 12 [ 378.175940][ T4289] Bluetooth: hci2: command 0x0406 tx timeout [ 378.665985][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.672413][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.470100][T11778] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 379.583584][T11781] device-mapper: ioctl: unable to find target [ 379.602777][T11778] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 379.739817][T11778] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 379.833656][T11778] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 379.896869][T11778] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 379.938671][T11778] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 379.961923][T11778] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 379.977609][T11778] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 380.004177][T11778] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 380.424603][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 380.678723][ T4365] usb 6-1: new full-speed USB device number 18 using dummy_hcd [ 380.874286][ T4365] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 380.909157][ T4365] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 380.945883][ T4365] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 381.005552][ T4365] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 381.062572][ T4365] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 381.115534][ T4365] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.123665][ T4365] usb 6-1: Product: syz [ 381.141009][ T4365] usb 6-1: Manufacturer: syz [ 381.155779][ T4365] usb 6-1: SerialNumber: syz [ 381.171284][T11813] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 381.395837][T11813] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 381.403154][T11813] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 381.500589][T11846] netlink: 4 bytes leftover after parsing attributes in process `syz.9.2120'. [ 381.753997][T11855] net_ratelimit: 3320 callbacks suppressed [ 381.754013][T11855] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 382.071378][T11813] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 382.092747][T11813] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 382.321606][ T4365] cdc_ncm 6-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 382.338378][ T4365] cdc_ncm 6-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 382.357723][ T4365] cdc_ncm 6-1:1.0: setting rx_max = 2048 [ 382.522090][ T4365] cdc_ncm 6-1:1.0: setting tx_max = 88 [ 382.555730][ T4365] cdc_ncm 6-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.5-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 382.645819][ T4365] usb 6-1: USB disconnect, device number 18 [ 382.676698][ T4365] cdc_ncm 6-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.5-1, CDC NCM (NO ZLP) [ 383.204168][T11872] loop7: detected capacity change from 0 to 32768 [ 383.228894][ T27] audit: type=1326 audit(1789542760.876:1290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11889 comm="syz.9.2134" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fdda9d9e159 code=0x0 [ 383.264714][T11872] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop7 scanned by syz.7.2127 (11872) [ 383.331660][T11872] BTRFS info (device loop7): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 383.383693][T11872] BTRFS info (device loop7): using sha256 (sha256-avx2) checksum algorithm [ 383.423284][T11872] BTRFS info (device loop7): setting nodatasum [ 383.451187][T11872] BTRFS info (device loop7): use zlib compression, level 3 [ 383.485978][T11872] BTRFS info (device loop7): force clearing of disk cache [ 383.516762][T11872] BTRFS info (device loop7): using free space tree [ 383.630506][T11908] loop5: detected capacity change from 0 to 256 [ 383.650238][T11908] FAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 383.891325][T11872] BTRFS info (device loop7): enabling ssd optimizations [ 383.905122][T11872] BTRFS info (device loop7): rebuilding free space tree [ 384.239154][T11925] loop5: detected capacity change from 0 to 512 [ 384.257891][ T27] audit: type=1800 audit(1789542761.906:1291): pid=11872 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.2127" name="file1" dev="loop7" ino=258 res=0 errno=0 [ 384.330457][T11923] overlayfs: failed to clone upperpath [ 384.452869][ T6959] BTRFS info (device loop7): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 384.604341][ T4480] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 12 /dev/loop7 scanned by udevd (4480) [ 384.882909][T11939] loop5: detected capacity change from 0 to 4096 [ 385.392642][T11939] ntfs3: loop5: Mark volume as dirty due to NTFS errors [ 385.432948][T11939] ntfs3: loop5: Failed to load $Extend. [ 385.815874][T11965] FAULT_INJECTION: forcing a failure. [ 385.815874][T11965] name failslab, interval 1, probability 0, space 0, times 0 [ 385.945622][T11965] CPU: 1 PID: 11965 Comm: syz.5.2150 Not tainted syzkaller #0 [ 385.953547][T11965] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 385.963824][T11965] Call Trace: [ 385.967147][T11965] [ 385.970126][T11965] dump_stack_lvl+0x188/0x24e [ 385.974855][T11965] ? show_regs_print_info+0x12/0x12 [ 385.980110][T11965] ? load_image+0x410/0x410 [ 385.984759][T11965] ? __might_sleep+0xd0/0xd0 [ 385.989399][T11965] ? __lock_acquire+0x7c40/0x7c40 [ 385.994481][T11965] ? __lock_acquire+0x138a/0x7c40 [ 385.999569][T11965] should_fail_ex+0x390/0x4c0 [ 386.004331][T11965] should_failslab+0x5/0x20 [ 386.008907][T11965] slab_pre_alloc_hook+0x59/0x300 [ 386.014772][T11965] kmem_cache_alloc+0x56/0x2f0 [ 386.019768][T11965] ? fcntl_setlk+0xa5/0x10e0 [ 386.024619][T11965] fcntl_setlk+0xa5/0x10e0 [ 386.029104][T11965] ? __might_fault+0xa6/0x120 [ 386.034001][T11965] ? __lock_acquire+0x7c40/0x7c40 [ 386.039093][T11965] ? vfs_lock_file+0xd0/0xd0 [ 386.043833][T11965] ? __might_fault+0xa6/0x120 [ 386.048565][T11965] ? __might_fault+0xc2/0x120 [ 386.053290][T11965] ? __might_fault+0xa6/0x120 [ 386.058635][T11965] do_fcntl+0x543/0x1280 [ 386.063034][T11965] ? __ia32_sys_get_robust_list+0x100/0x100 [ 386.069043][T11965] ? kill_fasync+0x4b0/0x4b0 [ 386.074136][T11965] ? __fget_files+0x28/0x460 [ 386.078800][T11965] ? __fget_files+0x3fc/0x460 [ 386.083541][T11965] ? tomoyo_file_fcntl+0x74/0x210 [ 386.088697][T11965] ? bpf_lsm_file_fcntl+0x5/0x10 [ 386.093772][T11965] ? security_file_fcntl+0x7c/0xa0 [ 386.099167][T11965] __se_sys_fcntl+0xc9/0x190 [ 386.104239][T11965] do_syscall_64+0x4c/0xa0 [ 386.108963][T11965] ? clear_bhb_loop+0x60/0xb0 [ 386.113989][T11965] ? clear_bhb_loop+0x60/0xb0 [ 386.119150][T11965] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 386.125116][T11965] RIP: 0033:0x7f52e319e159 [ 386.129614][T11965] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 386.149884][T11965] RSP: 002b:00007f52e4061028 EFLAGS: 00000246 ORIG_RAX: 0000000000000048 [ 386.158440][T11965] RAX: ffffffffffffffda RBX: 00007f52e3425fa0 RCX: 00007f52e319e159 [ 386.166845][T11965] RDX: 0000200000004240 RSI: 0000000000000006 RDI: 0000000000000003 [ 386.174860][T11965] RBP: 00007f52e323506b R08: 0000000000000000 R09: 0000000000000000 [ 386.183244][T11965] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 386.191273][T11965] R13: 00007f52e3426038 R14: 00007f52e3425fa0 R15: 00007ffc36216548 [ 386.199492][T11965] [ 387.028021][T11970] loop1: detected capacity change from 0 to 131072 [ 387.047859][T11970] F2FS-fs (loop1): invalid crc value [ 387.155061][T11970] F2FS-fs (loop1): Found nat_bits in checkpoint [ 387.211119][T11970] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 387.786714][T11998] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2160'. [ 388.846905][ T12] rcu_tasks_wait_gp: rcu_tasks grace period 41 is 1038 jiffies old. [ 389.800036][T12045] overlayfs: failed to create directory ./file0/work (errno: 17); mounting read-only [ 389.838610][T12045] overlayfs: fs on '.' does not support file handles, falling back to index=off,nfs_export=off. [ 392.182995][T12121] loop7: detected capacity change from 0 to 512 [ 392.422471][T12121] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 392.435797][T12121] ext4 filesystem being mounted at /274/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 392.926069][ T6959] EXT4-fs (loop7): unmounting filesystem. [ 393.728604][T12170] loop7: detected capacity change from 0 to 512 [ 393.733839][T12173] netlink: 'syz.9.2215': attribute type 15 has an invalid length. [ 393.752922][T12170] EXT4-fs: inline encryption not supported [ 393.764650][T12173] netdevsim netdevsim9 netdevsim0: set [0, 0] type 1 family 0 port 2816 - 0 [ 393.772474][T12170] EXT4-fs: Ignoring removed i_version option [ 393.773902][T12173] netdevsim netdevsim9 netdevsim1: set [0, 0] type 1 family 0 port 2816 - 0 [ 393.788799][T12173] netdevsim netdevsim9 netdevsim2: set [0, 0] type 1 family 0 port 2816 - 0 [ 393.797699][T12173] netdevsim netdevsim9 netdevsim3: set [0, 0] type 1 family 0 port 2816 - 0 [ 393.812715][T12170] EXT4-fs (loop7): external journal device major/minor numbers have changed [ 393.885078][T12173] netlink: 'syz.9.2215': attribute type 15 has an invalid length. [ 393.953902][T12177] PM: suspend entry (s2idle) [ 393.975747][T12177] PM: Unsupported test mode for suspend to idle, please choose none/freezer/devices/platform. [ 394.009128][T12177] PM: suspend exit [ 394.258131][T12170] EXT4-fs (loop7): failed to open journal device unknown-block(11,127) -6 [ 394.533156][T12188] loop1: detected capacity change from 0 to 8192 [ 394.620043][T12188] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 394.849825][T12188] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 1050) [ 394.859707][T12188] FAT-fs (loop1): Filesystem has been set read-only [ 394.868758][T12188] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 1050) [ 394.878684][T12188] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 1050) [ 395.015737][T12202] input: syz0 as /devices/virtual/input/input16 [ 395.356374][T10092] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 1050) [ 395.730554][T12224] loop1: detected capacity change from 0 to 256 [ 395.752166][T12224] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 396.020311][T12231] 9pnet_fd: Insufficient options for proto=fd [ 396.079283][T12233] input: syz1 as /devices/virtual/input/input17 [ 396.554564][T12252] overlayfs: failed to clone upperpath [ 396.635528][T12254] i2c i2c-0: new_device: Instantiated device anx7411 at 0x2c [ 396.862983][T12263] "syz.1.2242" (12263) uses obsolete ecb(arc4) skcipher [ 397.453940][T12281] loop7: detected capacity change from 0 to 256 [ 397.530320][T12281] exFAT-fs (loop7): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x32e3664b, utbl_chksum : 0xe619d30d) [ 397.864785][ T27] audit: type=1326 audit(1789542775.506:1292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12293 comm="syz.5.2257" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f52e319e159 code=0x0 [ 397.888726][ C0] vkms_vblank_simulate: vblank timer overrun [ 398.005579][ T6264] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 398.197337][ T6264] usb 8-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 398.217992][ T6264] usb 8-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 398.251187][ T6264] usb 8-1: config 220 interface 0 has no altsetting 0 [ 398.270407][ T6264] usb 8-1: New USB device found, idVendor=8086, idProduct=0b03, bcdDevice=6c.b9 [ 398.270945][T12309] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 398.300868][ T6264] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 398.309868][ T6264] usb 8-1: Product: syz [ 398.314216][ T6264] usb 8-1: Manufacturer: syz [ 398.342306][ T6264] usb 8-1: SerialNumber: syz [ 398.594038][T12317] netlink: 3568 bytes leftover after parsing attributes in process `syz.4.2265'. [ 398.618056][T12289] loop7: detected capacity change from 0 to 2048 [ 398.664188][T12289] UDF-fs: warning (device loop7): udf_load_vrs: No anchor found [ 398.673274][T12289] UDF-fs: Scanning with blocksize 512 failed [ 398.725878][T12289] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 398.814851][ T6264] usb 8-1: USB disconnect, device number 13 [ 398.888767][T12319] loop1: detected capacity change from 0 to 512 [ 398.964503][T12319] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 398.989426][T12319] ext4 filesystem being mounted at /114/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 399.050615][T12319] EXT4-fs (loop1): shut down requested (2) [ 399.060923][T12319] EXT4-fs warning (device loop1): ext4_dirblock_csum_verify:406: inode #2: comm syz.1.2266: No space for directory leaf checksum. Please run e2fsck -D. [ 399.110389][T10092] EXT4-fs (loop1): unmounting filesystem. [ 399.373902][T12334] loop1: detected capacity change from 0 to 1024 [ 399.517365][T12334] Invalid argument reading file caps for ./file0 [ 399.793791][T12342] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 400.898669][T12377] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 401.195132][T12387] tipc: Started in network mode [ 401.205200][T12387] tipc: Node identity ac1414aa, cluster identity 4711 [ 401.236177][T12387] tipc: New replicast peer: 172.20.20.187 [ 401.279142][T12387] tipc: Enabled bearer , priority 10 [ 402.355971][ T6264] tipc: Node number set to 2886997162 [ 402.360769][T12435] capability: warning: `syz.4.2304' uses 32-bit capabilities (legacy support in use) [ 403.074078][T12453] device veth0_macvtap left promiscuous mode [ 403.205021][T12457] fuse: Bad value for 'fd' [ 403.309885][ T4285] Bluetooth: hci5: command 0x1003 tx timeout [ 403.317011][ T4289] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 403.965674][ T4623] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 404.150232][ T4623] usb 8-1: Using ep0 maxpacket: 16 [ 404.162257][ T4623] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 404.191187][ T4623] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 404.216310][ T4623] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 404.235515][ T4623] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 404.253981][ T4623] usb 8-1: Product: syz [ 404.261176][ T4623] usb 8-1: Manufacturer: syz [ 404.275562][ T4623] usb 8-1: SerialNumber: syz [ 404.502379][ T4623] usb 8-1: 0:2 : does not exist [ 404.512231][ T4623] usb 8-1: 5:0: failed to get current value for ch 0 (-22) [ 404.553096][ T4623] usb 8-1: USB disconnect, device number 14 [ 404.776760][ T4480] udevd[4480]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 404.988566][T12512] loop1: detected capacity change from 0 to 128 [ 405.061278][T12516] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 405.121730][T12516] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 405.166450][T12516] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 405.189059][T12516] device bridge_slave_0 left promiscuous mode [ 405.213624][T12516] bridge0: port 1(bridge_slave_0) entered disabled state [ 405.293386][T12516] device bridge_slave_1 left promiscuous mode [ 405.345028][T12516] bridge0: port 2(bridge_slave_1) entered disabled state [ 405.419753][T12516] bond0: (slave bond_slave_0): Releasing backup interface [ 405.465860][T12527] loop1: detected capacity change from 0 to 1024 [ 405.479838][T12516] bond0: (slave bond_slave_1): Releasing backup interface [ 405.513689][T12527] EXT4-fs: Ignoring removed orlov option [ 405.569164][T12527] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 405.838116][T12516] team0: Port device team_slave_0 removed [ 405.887781][T12516] team0: Port device team_slave_1 removed [ 405.894439][T12516] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 405.924779][T12516] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 405.963734][T12516] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 405.990926][T12516] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 405.992005][T10092] EXT4-fs (loop1): unmounting filesystem. [ 406.077355][T12518] team0: Port device xfrm0 added [ 406.383289][T12558] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2349'. [ 406.653170][T12568] Mass Storage Function, version: 2009/09/11 [ 406.705596][T12568] LUN: removable file: (no medium) [ 406.740284][ T27] audit: type=1800 audit(1789542784.356:1293): pid=12571 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2352" name="file" dev="configfs" ino=59668 res=0 errno=0 [ 406.742662][T12568] mass_storage.0/lun.0: unable to open backing file: 0x0000000000010001 [ 406.857221][T12574] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2353'. [ 407.043483][T12580] bridge0: port 3(vlan2) entered blocking state [ 407.060654][T12580] bridge0: port 3(vlan2) entered disabled state [ 407.097977][T12580] device vlan2 entered promiscuous mode [ 407.124221][T12580] device geneve0 entered promiscuous mode [ 407.176340][T12580] bridge0: port 3(vlan2) entered blocking state [ 407.182751][T12580] bridge0: port 3(vlan2) entered forwarding state [ 407.269691][T12590] loop7: detected capacity change from 0 to 64 [ 407.318550][T12590] hfs: unable to parse mount options [ 407.476681][T12593] bridge0: port 3(veth0) entered blocking state [ 407.490760][T12593] bridge0: port 3(veth0) entered disabled state [ 407.512248][T12593] device veth0 entered promiscuous mode [ 408.130104][T12621] bridge0: port 1(bridge_slave_0) entered blocking state [ 408.138025][T12621] bridge0: port 1(bridge_slave_0) entered listening state [ 408.187338][T12621] device bridge0 entered promiscuous mode [ 408.221951][T12626] loop1: detected capacity change from 0 to 128 [ 408.239607][T12626] EXT4-fs: Ignoring removed nomblk_io_submit option [ 408.258942][T12626] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 408.278750][T12626] ext4 filesystem being mounted at /137/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 408.305848][ T6264] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 408.476041][T10092] EXT4-fs (loop1): unmounting filesystem. [ 408.487616][ T6264] usb 8-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 408.530153][ T6264] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 408.586678][ T6264] usb 8-1: config 0 descriptor?? [ 408.618152][ T6264] cp210x 8-1:0.0: cp210x converter detected [ 408.745688][T12640] loop1: detected capacity change from 0 to 512 [ 408.777021][T12640] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 408.845060][T12640] EXT4-fs (loop1): 1 truncate cleaned up [ 408.859302][T12640] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 408.919494][T12640] EXT4-fs (loop1): shut down requested (1) [ 408.976167][ T4689] wlan1: Trigger new scan to find an IBSS to join [ 409.037682][ T6264] cp210x 8-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 409.059845][ T6264] usb 8-1: cp210x converter now attached to ttyUSB0 [ 409.107604][T10092] EXT4-fs (loop1): unmounting filesystem. [ 409.264762][ T6264] usb 8-1: USB disconnect, device number 15 [ 409.294405][ T6264] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 409.347024][ T6264] cp210x 8-1:0.0: device disconnected [ 409.909126][T12673] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2386'. [ 410.239898][T12673] bond0: (slave bond_slave_1): Releasing backup interface [ 410.378019][T12688] overlayfs: failed to clone upperpath [ 410.867168][T12705] loop1: detected capacity change from 0 to 512 [ 411.049494][T12700] loop7: detected capacity change from 0 to 65536 [ 411.129098][T12705] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 411.174591][T12700] XFS (loop7): Mounting V5 Filesystem [ 411.183026][T12705] ext4 filesystem being mounted at /144/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 411.290669][T12700] XFS (loop7): Ending clean mount [ 411.301816][T12700] XFS (loop7): Quotacheck needed: Please wait. [ 411.349755][T12705] overlayfs: conflicting lowerdir path [ 411.452158][T12700] XFS (loop7): Quotacheck: Done. [ 411.533963][T10092] EXT4-fs (loop1): unmounting filesystem. [ 412.884416][T12764] 9pnet: p9_errstr2errno: server reported unknown error ÿÿ [ 413.630799][T12781] loop1: detected capacity change from 0 to 512 [ 413.716576][T12781] EXT4-fs (loop1): Test dummy encryption mode enabled [ 413.797612][T12781] EXT4-fs error (device loop1): ext4_orphan_get:1409: inode #11: comm syz.1.2418: casefold flag without casefold feature [ 413.884697][T12781] EXT4-fs error (device loop1): ext4_orphan_get:1414: comm syz.1.2418: couldn't read orphan inode 11 (err -117) [ 413.942072][ T4667] wlan1: Trigger new scan to find an IBSS to join [ 413.959405][T12781] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 413.999173][ T27] audit: type=1800 audit(1789542791.646:1294): pid=12781 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2418" name="file1" dev="loop1" ino=15 res=0 errno=0 [ 414.092136][T10092] EXT4-fs (loop1): unmounting filesystem. [ 414.451783][T12812] 9pnet_fd: Insufficient options for proto=fd [ 414.743870][T12820] FAULT_INJECTION: forcing a failure. [ 414.743870][T12820] name failslab, interval 1, probability 0, space 0, times 0 [ 414.775879][T12820] CPU: 0 PID: 12820 Comm: syz.1.2428 Not tainted syzkaller #0 [ 414.783740][T12820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 414.793930][T12820] Call Trace: [ 414.797248][T12820] [ 414.800220][T12820] dump_stack_lvl+0x188/0x24e [ 414.804949][T12820] ? show_regs_print_info+0x12/0x12 [ 414.810205][T12820] ? load_image+0x410/0x410 [ 414.814760][T12820] ? __might_sleep+0xd0/0xd0 [ 414.819398][T12820] ? __lock_acquire+0x7c40/0x7c40 [ 414.824575][T12820] should_fail_ex+0x390/0x4c0 [ 414.829414][T12820] should_failslab+0x5/0x20 [ 414.834053][T12820] slab_pre_alloc_hook+0x59/0x300 [ 414.840095][T12820] kmem_cache_alloc_node+0x5a/0x310 [ 414.845343][T12820] ? __alloc_skb+0xf9/0x7d0 [ 414.849907][T12820] __alloc_skb+0xf9/0x7d0 [ 414.854287][T12820] tcp_stream_alloc_skb+0x3e/0x330 [ 414.859481][T12820] tcp_connect+0x15e9/0x4a50 [ 414.864228][T12820] ? tcp_fastopen_defer_connect+0xde/0x360 [ 414.870109][T12820] tcp_v6_connect+0x119c/0x18f0 [ 414.875193][T12820] ? tcp_v6_pre_connect+0xf0/0xf0 [ 414.880290][T12820] ? do_syscall_64+0x4c/0xa0 [ 414.884942][T12820] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 414.891269][T12820] __inet_stream_connect+0x242/0xe10 [ 414.896618][T12820] ? inet_dgram_connect+0x340/0x340 [ 414.901838][T12820] tcp_sendmsg_fastopen+0x38f/0x600 [ 414.907057][T12820] tcp_sendmsg_locked+0x356b/0x39e0 [ 414.912273][T12820] ? __might_sleep+0xd0/0xd0 [ 414.917033][T12820] ? __might_sleep+0xd0/0xd0 [ 414.921659][T12820] ? mark_lock+0x94/0x320 [ 414.926029][T12820] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 414.932243][T12820] ? lock_chain_count+0x20/0x20 [ 414.937745][T12820] ? tcp_sendmsg+0x1d/0x40 [ 414.942415][T12820] ? tcp_set_state+0x520/0x520 [ 414.947395][T12820] tcp_sendmsg+0x2b/0x40 [ 414.951766][T12820] __sys_sendto+0x497/0x650 [ 414.956284][T12820] ? __ia32_sys_getpeername+0x80/0x80 [ 414.961701][T12820] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 414.967726][T12820] ? lock_chain_count+0x20/0x20 [ 414.972633][T12820] __x64_sys_sendto+0xda/0xf0 [ 414.977437][T12820] do_syscall_64+0x4c/0xa0 [ 414.981884][T12820] ? clear_bhb_loop+0x60/0xb0 [ 414.986573][T12820] ? clear_bhb_loop+0x60/0xb0 [ 414.991441][T12820] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 414.997354][T12820] RIP: 0033:0x7fe72279e159 [ 415.001787][T12820] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 415.021857][T12820] RSP: 002b:00007fe7235e8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 415.030294][T12820] RAX: ffffffffffffffda RBX: 00007fe722a25fa0 RCX: 00007fe72279e159 [ 415.038589][T12820] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 415.046829][T12820] RBP: 00007fe72283506b R08: 00002000000001c0 R09: 000000000000001c [ 415.054896][T12820] R10: 0000000024000010 R11: 0000000000000246 R12: 0000000000000000 [ 415.062885][T12820] R13: 00007fe722a26038 R14: 00007fe722a25fa0 R15: 00007ffe0d204ba8 [ 415.070900][T12820] [ 415.128912][ T4708] wlan1: Creating new IBSS network, BSSID 82:e9:2f:79:21:5b [ 415.395109][T12832] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2431'. [ 416.122674][T12847] fuse: Bad value for 'fd' [ 416.951279][T12874] netlink: 'syz.9.2449': attribute type 4 has an invalid length. [ 416.977170][T12874] netlink: 'syz.9.2449': attribute type 4 has an invalid length. [ 418.766305][T12463] Bluetooth: hci1: link tx timeout [ 418.772770][T12463] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 418.787770][T12463] Bluetooth: hci1: link tx timeout [ 418.792991][T12463] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 420.815728][T12463] Bluetooth: hci1: command 0x0406 tx timeout [ 423.457060][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 424.571295][T13093] fuse: Bad value for 'fd' [ 424.688482][T13096] loop1: detected capacity change from 0 to 128 [ 424.703268][T13096] EXT4-fs: Ignoring removed i_version option [ 424.746085][T13096] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 424.755376][T13096] ext4 filesystem being mounted at /178/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 424.832567][T10092] EXT4-fs (loop1): unmounting filesystem. [ 424.913254][T13033] Set syz1 is full, maxelem 65536 reached [ 425.283237][T13113] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2521'. [ 426.070419][T13141] loop1: detected capacity change from 0 to 40427 [ 426.100373][T13141] F2FS-fs (loop1): invalid crc value [ 426.116167][T13141] F2FS-fs (loop1): Found nat_bits in checkpoint [ 426.172762][T13141] F2FS-fs (loop1): Start checkpoint disabled! [ 426.201815][T13141] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 426.240248][T13141] syz.1.2529: attempt to access beyond end of device [ 426.240248][T13141] loop1: rw=2049, sector=77824, nr_sectors = 136 limit=40427 [ 426.295575][T13141] syz.1.2529: attempt to access beyond end of device [ 426.295575][T13141] loop1: rw=0, sector=77952, nr_sectors = 8 limit=40427 [ 426.585646][ T4330] kworker/u4:7: attempt to access beyond end of device [ 426.585646][ T4330] loop1: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 427.852288][T13175] fuse: Bad value for 'fd' [ 427.881260][ T4288] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 427.898276][ T4288] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 427.908369][ T4288] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 427.922175][ T4288] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 427.934821][ T4288] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 427.946393][ T4288] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 428.473103][T13190] binder: 13189:13190 ioctl c0306201 2000000003c0 returned -14 [ 428.922573][T13174] chnl_net:caif_netlink_parms(): no params data found [ 428.934014][T13202] overlayfs: failed to clone upperpath [ 428.960264][T13203] loop1: detected capacity change from 0 to 256 [ 429.198837][T13174] bridge0: port 1(bridge_slave_0) entered blocking state [ 429.206645][T13174] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.215031][T13174] device bridge_slave_0 entered promiscuous mode [ 429.224362][T13174] bridge0: port 2(bridge_slave_1) entered blocking state [ 429.232721][T13174] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.242549][T13174] device bridge_slave_1 entered promiscuous mode [ 429.353185][T13174] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 429.388660][T13174] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 429.553014][T13174] team0: Port device team_slave_0 added [ 429.578009][T13174] team0: Port device team_slave_1 added [ 429.677318][T13174] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 429.691193][T13174] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 429.773339][T13174] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 429.815577][T13174] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 429.822679][T13174] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 429.919157][T13174] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 430.015796][ T4288] Bluetooth: hci3: command 0x0409 tx timeout [ 430.037464][T13174] device hsr_slave_0 entered promiscuous mode [ 430.054594][T13215] loop1: detected capacity change from 0 to 32768 [ 430.071407][T13174] device hsr_slave_1 entered promiscuous mode [ 430.091272][T13174] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 430.101864][T13174] Cannot create hsr debugfs directory [ 430.102402][T13215] JBD2: Ignoring recovery information on journal [ 430.272754][T13237] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2564'. [ 430.291653][T13215] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 430.418793][T13215] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 430.449611][T13215] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 430.702199][T10092] ocfs2: Unmounting device (7,1) on (node local) [ 432.095583][ T4288] Bluetooth: hci3: command 0x041b tx timeout [ 432.559994][T13174] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 432.599116][T13174] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 432.622354][T13174] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 432.647188][T13174] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 432.836101][T13174] 8021q: adding VLAN 0 to HW filter on device bond0 [ 432.889842][ T4703] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 432.916310][ T4703] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 432.941041][T13174] 8021q: adding VLAN 0 to HW filter on device team0 [ 432.971680][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 432.982357][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 433.024660][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 433.031887][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 433.057147][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 433.088256][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 433.147719][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 433.177842][ T78] bridge0: port 2(bridge_slave_1) entered blocking state [ 433.185138][ T78] bridge0: port 2(bridge_slave_1) entered forwarding state [ 433.249326][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 433.291642][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 433.321374][ T4689] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 433.380606][ T4689] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 433.430044][ T4689] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 433.521274][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 433.536611][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 433.573428][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 433.601337][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 433.641050][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 433.720233][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 433.750664][T13174] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 433.968000][T13319] netlink: 'syz.9.2586': attribute type 8 has an invalid length. [ 434.037112][T13324] loop1: detected capacity change from 0 to 16 [ 434.091862][T13324] erofs: (device loop1): mounted with root inode @ nid 36. [ 434.176434][ T4288] Bluetooth: hci3: command 0x040f tx timeout [ 434.213951][ T27] audit: type=1800 audit(1789542811.856:1295): pid=13324 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2588" name="file1" dev="overlay" ino=86 res=0 errno=0 [ 434.703426][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 434.742370][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 434.781529][T13174] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 434.801042][T13344] overlayfs: failed to clone lowerpath [ 434.811126][T13344] overlayfs: failed to clone upperpath [ 434.882947][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 434.902419][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 435.013075][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 435.030270][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 435.059249][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 435.088584][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 435.127579][T13174] device veth0_vlan entered promiscuous mode [ 435.174919][T13174] device veth1_vlan entered promiscuous mode [ 435.297579][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 435.316775][ T4708] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 435.374230][T13174] device veth0_macvtap entered promiscuous mode [ 435.411141][T13174] device veth1_macvtap entered promiscuous mode [ 435.518050][T13174] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 435.562803][T13174] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 435.628542][T13174] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 435.664204][T13174] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 435.695831][T13174] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 435.729940][T13174] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 435.747552][T13367] MPTCP: kernel_bind error, err=-98 [ 435.771511][T13174] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 435.819673][ T4706] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 435.843551][ T4706] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 435.891641][ T4706] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 435.913361][ T4706] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 435.934463][T13174] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 435.967409][T13174] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 436.009728][T13174] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 436.050976][T13174] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 436.100687][T13174] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 436.135447][T13174] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 436.157608][T13174] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 436.168407][T13174] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 436.196729][T13174] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 436.257384][ T4288] Bluetooth: hci3: command 0x0419 tx timeout [ 436.268989][ T4667] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 436.300399][ T4667] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 436.353366][T13174] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 436.401212][T13174] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 436.453878][T13174] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 436.485527][T13174] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 436.758987][ T4689] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 436.786167][ T4689] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 436.831533][ T4667] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 436.870392][ T4689] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 436.880449][ T4689] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 436.904412][ T4706] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 437.642432][T13406] loop0: detected capacity change from 0 to 32768 [ 437.967430][T13431] loop1: detected capacity change from 0 to 256 [ 437.999404][T13431] exfat: Deprecated parameter 'utf8' [ 438.019586][T13431] exfat: Deprecated parameter 'namecase' [ 438.025339][T13431] exfat: Deprecated parameter 'namecase' [ 438.082720][T13431] exfat: Deprecated parameter 'namecase' [ 438.092418][T13406] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 438.196598][T13431] exFAT-fs (loop1): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 438.380601][T13431] netlink: 104 bytes leftover after parsing attributes in process `syz.1.2615'. [ 438.606688][T13174] ocfs2: Unmounting device (7,0) on (node local) [ 438.818476][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 438.825846][ C0] bridge0: topology change detected, propagating [ 438.835726][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 439.274827][T13457] overlayfs: failed to resolve './file0': -2 [ 439.356523][T13472] netlink: 'syz.9.2629': attribute type 1 has an invalid length. [ 439.423464][T13472] 8021q: adding VLAN 0 to HW filter on device bond1 [ 439.517361][T13477] 8021q: adding VLAN 0 to HW filter on device bond1 [ 439.543624][T13477] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 439.601288][T13477] bond1: (slave wireguard0): Error -95 calling set_mac_address [ 440.099472][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.105937][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.109735][T13528] loop0: detected capacity change from 0 to 16 [ 441.167391][T13528] erofs: (device loop0): mounted with root inode @ nid 36. [ 441.593137][T13543] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2650'. [ 441.618779][T13544] loop1: detected capacity change from 0 to 128 [ 441.628128][T13543] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2650'. [ 441.664789][T13544] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 441.704444][T13544] ext4 filesystem being mounted at /212/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 441.972179][T10092] EXT4-fs (loop1): unmounting filesystem. [ 444.060804][ T27] audit: type=1326 audit(1789542821.702:1296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13628 comm="syz.9.2676" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdda9d9e159 code=0x7ffc0000 [ 444.101559][ T27] audit: type=1326 audit(1789542821.702:1297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13628 comm="syz.9.2676" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdda9d9e159 code=0x7ffc0000 [ 444.127336][ T27] audit: type=1326 audit(1789542821.732:1298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13628 comm="syz.9.2676" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=22 compat=0 ip=0x7fdda9d9e159 code=0x7ffc0000 [ 444.213063][ T27] audit: type=1326 audit(1789542821.732:1299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13628 comm="syz.9.2676" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdda9d9e159 code=0x7ffc0000 [ 444.319731][ T27] audit: type=1326 audit(1789542821.732:1300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13628 comm="syz.9.2676" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdda9d9e159 code=0x7ffc0000 [ 444.435591][ T27] audit: type=1326 audit(1789542821.732:1301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13628 comm="syz.9.2676" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=206 compat=0 ip=0x7fdda9d9e159 code=0x7ffc0000 [ 444.496008][ T27] audit: type=1326 audit(1789542821.732:1302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13628 comm="syz.9.2676" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdda9d9e159 code=0x7ffc0000 [ 444.549393][ T27] audit: type=1326 audit(1789542821.732:1303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13628 comm="syz.9.2676" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdda9d9e159 code=0x7ffc0000 [ 444.602356][ T27] audit: type=1326 audit(1789542821.732:1304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13628 comm="syz.9.2676" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=208 compat=0 ip=0x7fdda9d9e159 code=0x7ffc0000 [ 444.637419][ T27] audit: type=1326 audit(1789542821.812:1305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13628 comm="syz.9.2676" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdda9d9e159 code=0x7ffc0000 [ 444.724489][T13619] overlayfs: failed to clone upperpath [ 444.815830][T11951] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 444.954481][T13652] netlink: 'syz.5.2681': attribute type 1 has an invalid length. [ 444.972700][T13652] netlink: 'syz.5.2681': attribute type 2 has an invalid length. [ 445.008584][T11951] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x1 has invalid maxpacket 64 [ 445.020315][T11951] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x81 has invalid maxpacket 64 [ 445.053385][T11951] usb 2-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice= 1.00 [ 445.103686][T11951] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 445.129230][T11951] usb 2-1: Product: syz [ 445.153547][ T78] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 445.164333][T11951] usb 2-1: Manufacturer: syz [ 445.388304][T13642] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 445.406398][T13642] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 445.438347][T11951] dvb_ttusb_budget: ttusb_init_controller: error [ 445.468066][T11951] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 445.799305][T11951] DVB: Unable to find symbol cx22700_attach() [ 445.980123][T11951] DVB: Unable to find symbol tda10046_attach() [ 445.988318][T11951] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 446.020645][T11951] usb 2-1: USB disconnect, device number 5 [ 446.275582][ T4352] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 446.469686][ T4352] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 446.489227][ T4352] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 446.529741][ T4352] usb 1-1: Product: syz [ 446.534005][ T4352] usb 1-1: Manufacturer: syz [ 446.555740][ T4352] usb 1-1: SerialNumber: syz [ 446.572574][ T4352] usb 1-1: config 0 descriptor?? [ 446.694694][T13710] loop1: detected capacity change from 0 to 1024 [ 447.024433][ T4352] usb 1-1: Firmware: major: 165, minor: 173, hardware type: UNKNOWN (213) [ 447.145095][T13718] FAULT_INJECTION: forcing a failure. [ 447.145095][T13718] name failslab, interval 1, probability 0, space 0, times 0 [ 447.165050][T13718] CPU: 1 PID: 13718 Comm: syz.1.2698 Not tainted syzkaller #0 [ 447.172588][T13718] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 447.182832][T13718] Call Trace: [ 447.186212][T13718] [ 447.189173][T13718] dump_stack_lvl+0x188/0x24e [ 447.193892][T13718] ? show_regs_print_info+0x12/0x12 [ 447.199127][T13718] ? load_image+0x410/0x410 [ 447.203682][T13718] ? __might_sleep+0xd0/0xd0 [ 447.208326][T13718] ? __lock_acquire+0x7c40/0x7c40 [ 447.213417][T13718] should_fail_ex+0x390/0x4c0 [ 447.218124][T13718] should_failslab+0x5/0x20 [ 447.218149][T13718] slab_pre_alloc_hook+0x59/0x300 [ 447.218172][T13718] ? __rwlock_init+0x140/0x140 [ 447.218190][T13718] ? key_user_lookup+0x1b8/0x450 [ 447.218276][T13718] kmem_cache_alloc+0x56/0x2f0 [ 447.242299][T13718] ? key_alloc+0x302/0x1030 [ 447.246824][T13718] key_alloc+0x302/0x1030 [ 447.251187][T13718] key_create_or_update+0x89b/0xa40 [ 447.256394][T13718] ? security_key_permission+0x7c/0xa0 [ 447.261880][T13718] ? key_type_put+0x20/0x20 [ 447.266393][T13718] ? lookup_user_key_possessed+0x40/0x40 [ 447.272069][T13718] ? _copy_from_user+0x10b/0x170 [ 447.277177][T13718] __se_sys_add_key+0x34b/0x410 [ 447.282044][T13718] ? __x64_sys_add_key+0xc0/0xc0 [ 447.287000][T13718] ? lockdep_hardirqs_on+0x94/0x140 [ 447.292210][T13718] ? __x64_sys_add_key+0x1c/0xc0 [ 447.297163][T13718] do_syscall_64+0x4c/0xa0 [ 447.301588][T13718] ? clear_bhb_loop+0x60/0xb0 [ 447.306279][T13718] ? clear_bhb_loop+0x60/0xb0 [ 447.310966][T13718] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 447.316874][T13718] RIP: 0033:0x7fe72279e159 [ 447.321296][T13718] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 447.341081][T13718] RSP: 002b:00007fe7235e8028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 447.349503][T13718] RAX: ffffffffffffffda RBX: 00007fe722a25fa0 RCX: 00007fe72279e159 [ 447.357655][T13718] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000200000000140 [ 447.365724][T13718] RBP: 00007fe72283506b R08: fffffffffffffffe R09: 0000000000000000 [ 447.373700][T13718] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 447.381687][T13718] R13: 00007fe722a26038 R14: 00007fe722a25fa0 R15: 00007ffe0d204ba8 [ 447.389689][T13718] [ 447.457013][ T4352] usb 1-1: no permanent extended address found, random address set [ 447.464987][ T4352] usb 1-1: atusb_probe: initialization failed, error = -524 [ 447.527606][ T4352] atusb: probe of 1-1:0.0 failed with error -524 [ 447.673951][T11951] usb 1-1: USB disconnect, device number 2 [ 447.825355][T13730] overlayfs: failed to clone lowerpath [ 448.401889][T13756] netlink: 'syz.1.2713': attribute type 10 has an invalid length. [ 448.503311][T13756] team0: Device ipvlan1 failed to register rx_handler [ 448.518728][T13753] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 449.438575][T13788] netlink: 'syz.5.2721': attribute type 21 has an invalid length. [ 449.455945][T13788] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2721'. [ 449.494774][T13788] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 449.503926][T13788] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 449.512733][T13788] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 449.521522][T13788] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 449.589672][T13788] netlink: 'syz.5.2721': attribute type 21 has an invalid length. [ 449.604617][T13788] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2721'. [ 449.675383][T13797] netlink: 240 bytes leftover after parsing attributes in process `syz.0.2722'. [ 449.835795][T13803] Bluetooth: hci0: service_discovery: too big uuid_count value 10000 [ 450.466430][T13830] ------------[ cut here ]------------ [ 450.474040][T13830] WARNING: CPU: 0 PID: 13830 at mm/hugetlb.c:6630 follow_hugetlb_page+0x2763/0x2880 [ 450.484161][T13830] Modules linked in: [ 450.488441][T13830] CPU: 0 PID: 13830 Comm: syz.5.2734 Not tainted syzkaller #0 [ 450.495996][T13830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 450.506135][T13830] RIP: 0010:follow_hugetlb_page+0x2763/0x2880 [ 450.512280][T13830] Code: 00 48 89 44 24 28 4c 0f 44 f1 31 ff 89 de e8 54 31 b3 ff 4c 89 f3 e9 c2 fd ff ff 48 bb 00 00 00 00 f4 ff ff ff e8 dd 2d b3 ff <0f> 0b eb ae 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c f8 fe ff ff 4c [ 450.532239][T13830] RSP: 0018:ffffc900035af4b0 EFLAGS: 00010283 [ 450.538463][T13830] RAX: ffffffff81cf0503 RBX: fffffff400000000 RCX: 0000000000080000 [ 450.546626][T13830] RDX: ffffc90003c59000 RSI: 0000000000000612 RDI: 0000000000000613 [ 450.554771][T13830] RBP: 0000200000000340 R08: ffff888072885a00 R09: 0000000000000002 [ 450.562855][T13830] R10: 0200000000000000 R11: 0000000000000002 R12: ffff888022a48000 [ 450.570945][T13830] R13: dffffc0000000000 R14: ffff88805d619240 R15: ffffffff96c6c4f8 [ 450.579022][T13830] FS: 00007f52e40616c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 450.585499][ T4288] Bluetooth: hci0: command 0x0c1a tx timeout [ 450.588028][T13830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 450.600777][T13830] CR2: 0000001b2f61fff8 CR3: 0000000053a9a000 CR4: 00000000003506f0 [ 450.608951][T13830] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 450.617019][T13830] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 450.625043][T13830] Call Trace: [ 450.628418][T13830] [ 450.631421][T13830] __get_user_pages+0x547/0xec0 [ 450.636398][T13830] ? populate_vma_page_range+0x2b0/0x2b0 [ 450.642115][T13830] __gup_longterm_locked+0x24d/0x1b20 [ 450.647619][T13830] ? get_user_pages+0xd0/0xd0 [ 450.652357][T13830] ? read_lock_is_recursive+0x10/0x10 [ 450.657835][T13830] ? kvmalloc_node+0x6c/0x180 [ 450.662575][T13830] ? kvmalloc_node+0x6c/0x180 [ 450.667348][T13830] ? trace_kmalloc+0x22/0xa0 [ 450.671983][T13830] ? __kmalloc_node+0x153/0x240 [ 450.677133][T13830] ? pin_user_pages+0x3a/0xc0 [ 450.681868][T13830] io_pin_pages+0x120/0x460 [ 450.686556][T13830] io_sqe_buffer_register+0x15d/0x17b0 [ 450.692072][T13830] ? __might_fault+0xa6/0x120 [ 450.696840][T13830] ? __lock_acquire+0x7c40/0x7c40 [ 450.701920][T13830] ? verify_lock_unused+0x140/0x140 [ 450.707301][T13830] ? io_copy_iov+0x1f0/0x1f0 [ 450.711935][T13830] ? __might_fault+0xc2/0x120 [ 450.716704][T13830] ? __might_fault+0xa6/0x120 [ 450.721437][T13830] __io_register_rsrc_update+0x80a/0x1930 [ 450.727258][T13830] ? futex_unqueue+0xc7/0xf0 [ 450.731926][T13830] ? io_register_files_update+0x190/0x190 [ 450.737771][T13830] ? __lock_acquire+0x7c40/0x7c40 [ 450.742858][T13830] ? trace_contention_end+0x5f/0x170 [ 450.748271][T13830] ? __might_fault+0xa6/0x120 [ 450.753003][T13830] ? __might_fault+0xc2/0x120 [ 450.757795][T13830] ? __might_fault+0xa6/0x120 [ 450.762576][T13830] io_register_rsrc_update+0x1aa/0x1c0 [ 450.768188][T13830] ? __io_register_rsrc_update+0x1930/0x1930 [ 450.774243][T13830] ? io_run_task_work+0x267/0x310 [ 450.779451][T13830] __se_sys_io_uring_register+0x74e/0xeb0 [ 450.785243][T13830] ? __x64_sys_io_uring_register+0xa0/0xa0 [ 450.791184][T13830] ? lockdep_hardirqs_on+0x94/0x140 [ 450.796491][T13830] do_syscall_64+0x4c/0xa0 [ 450.800964][T13830] ? clear_bhb_loop+0x60/0xb0 [ 450.805746][T13830] ? clear_bhb_loop+0x60/0xb0 [ 450.810499][T13830] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 450.816508][T13830] RIP: 0033:0x7f52e319e159 [ 450.820968][T13830] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 450.840695][T13830] RSP: 002b:00007f52e4061028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 450.849212][T13830] RAX: ffffffffffffffda RBX: 00007f52e3425fa0 RCX: 00007f52e319e159 [ 450.857473][T13830] RDX: 0000200000000600 RSI: 0000000000000010 RDI: 0000000000000003 [ 450.865533][T13830] RBP: 00007f52e323506b R08: 0000000000000000 R09: 0000000000000000 [ 450.873652][T13830] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000000 [ 450.881740][T13830] R13: 00007f52e3426038 R14: 00007f52e3425fa0 R15: 00007ffc36216548 [ 450.889909][T13830] [ 450.893058][T13830] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 450.900365][T13830] CPU: 0 PID: 13830 Comm: syz.5.2734 Not tainted syzkaller #0 [ 450.907855][T13830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 450.917948][T13830] Call Trace: [ 450.921297][T13830] [ 450.924273][T13830] dump_stack_lvl+0x188/0x24e [ 450.929002][T13830] ? memcpy+0x3c/0x60 [ 450.933023][T13830] ? show_regs_print_info+0x12/0x12 [ 450.938313][T13830] ? load_image+0x410/0x410 [ 450.942879][T13830] panic+0x2d3/0x710 [ 450.946849][T13830] ? bpf_jit_dump+0xd0/0xd0 [ 450.951410][T13830] __warn+0x2f8/0x4f0 [ 450.955451][T13830] ? follow_hugetlb_page+0x2763/0x2880 [ 450.960931][T13830] ? follow_hugetlb_page+0x2763/0x2880 [ 450.966413][T13830] report_bug+0x2ba/0x4f0 [ 450.970777][T13830] ? follow_hugetlb_page+0x2763/0x2880 [ 450.976251][T13830] handle_bug+0x3a/0x70 [ 450.980505][T13830] exc_invalid_op+0x16/0x40 [ 450.985016][T13830] asm_exc_invalid_op+0x16/0x20 [ 450.989888][T13830] RIP: 0010:follow_hugetlb_page+0x2763/0x2880 [ 450.996076][T13830] Code: 00 48 89 44 24 28 4c 0f 44 f1 31 ff 89 de e8 54 31 b3 ff 4c 89 f3 e9 c2 fd ff ff 48 bb 00 00 00 00 f4 ff ff ff e8 dd 2d b3 ff <0f> 0b eb ae 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c f8 fe ff ff 4c [ 451.015959][T13830] RSP: 0018:ffffc900035af4b0 EFLAGS: 00010283 [ 451.022039][T13830] RAX: ffffffff81cf0503 RBX: fffffff400000000 RCX: 0000000000080000 [ 451.030017][T13830] RDX: ffffc90003c59000 RSI: 0000000000000612 RDI: 0000000000000613 [ 451.037996][T13830] RBP: 0000200000000340 R08: ffff888072885a00 R09: 0000000000000002 [ 451.046091][T13830] R10: 0200000000000000 R11: 0000000000000002 R12: ffff888022a48000 [ 451.054178][T13830] R13: dffffc0000000000 R14: ffff88805d619240 R15: ffffffff96c6c4f8 [ 451.062163][T13830] ? follow_hugetlb_page+0x2763/0x2880 [ 451.067665][T13830] __get_user_pages+0x547/0xec0 [ 451.072636][T13830] ? populate_vma_page_range+0x2b0/0x2b0 [ 451.078289][T13830] __gup_longterm_locked+0x24d/0x1b20 [ 451.083682][T13830] ? get_user_pages+0xd0/0xd0 [ 451.088389][T13830] ? read_lock_is_recursive+0x10/0x10 [ 451.093789][T13830] ? kvmalloc_node+0x6c/0x180 [ 451.098492][T13830] ? kvmalloc_node+0x6c/0x180 [ 451.103185][T13830] ? trace_kmalloc+0x22/0xa0 [ 451.107788][T13830] ? __kmalloc_node+0x153/0x240 [ 451.112658][T13830] ? pin_user_pages+0x3a/0xc0 [ 451.117381][T13830] io_pin_pages+0x120/0x460 [ 451.121909][T13830] io_sqe_buffer_register+0x15d/0x17b0 [ 451.127379][T13830] ? __might_fault+0xa6/0x120 [ 451.132065][T13830] ? __lock_acquire+0x7c40/0x7c40 [ 451.137117][T13830] ? verify_lock_unused+0x140/0x140 [ 451.142325][T13830] ? io_copy_iov+0x1f0/0x1f0 [ 451.146920][T13830] ? __might_fault+0xc2/0x120 [ 451.151602][T13830] ? __might_fault+0xa6/0x120 [ 451.156290][T13830] __io_register_rsrc_update+0x80a/0x1930 [ 451.162040][T13830] ? futex_unqueue+0xc7/0xf0 [ 451.166746][T13830] ? io_register_files_update+0x190/0x190 [ 451.172544][T13830] ? __lock_acquire+0x7c40/0x7c40 [ 451.177609][T13830] ? trace_contention_end+0x5f/0x170 [ 451.182903][T13830] ? __might_fault+0xa6/0x120 [ 451.187589][T13830] ? __might_fault+0xc2/0x120 [ 451.192292][T13830] ? __might_fault+0xa6/0x120 [ 451.196979][T13830] io_register_rsrc_update+0x1aa/0x1c0 [ 451.202564][T13830] ? __io_register_rsrc_update+0x1930/0x1930 [ 451.208616][T13830] ? io_run_task_work+0x267/0x310 [ 451.213670][T13830] __se_sys_io_uring_register+0x74e/0xeb0 [ 451.219432][T13830] ? __x64_sys_io_uring_register+0xa0/0xa0 [ 451.225253][T13830] ? lockdep_hardirqs_on+0x94/0x140 [ 451.230550][T13830] do_syscall_64+0x4c/0xa0 [ 451.235063][T13830] ? clear_bhb_loop+0x60/0xb0 [ 451.239744][T13830] ? clear_bhb_loop+0x60/0xb0 [ 451.244427][T13830] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 451.250333][T13830] RIP: 0033:0x7f52e319e159 [ 451.254755][T13830] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 451.274468][T13830] RSP: 002b:00007f52e4061028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 451.282927][T13830] RAX: ffffffffffffffda RBX: 00007f52e3425fa0 RCX: 00007f52e319e159 [ 451.290943][T13830] RDX: 0000200000000600 RSI: 0000000000000010 RDI: 0000000000000003 [ 451.298922][T13830] RBP: 00007f52e323506b R08: 0000000000000000 R09: 0000000000000000 [ 451.306902][T13830] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000000 [ 451.314877][T13830] R13: 00007f52e3426038 R14: 00007f52e3425fa0 R15: 00007ffc36216548 [ 451.322866][T13830] [ 451.326133][T13830] Kernel Offset: disabled [ 451.331158][T13830] Rebooting in 86400 seconds..