last executing test programs: 17.915337327s ago: executing program 2 (id=467): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/sys/vm/drop_caches\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='2', 0x1) 17.867155688s ago: executing program 2 (id=470): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r1, &(0x7f0000000440), &(0x7f0000000040)=@udp=r0}, 0x20) recvmmsg(r0, &(0x7f0000000400)=[{{0x0, 0x0, 0x0}, 0xb}], 0x1, 0x40012021, 0x0) 17.836872839s ago: executing program 2 (id=471): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xa000000}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000340)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) 17.79505268s ago: executing program 2 (id=472): syz_mount_image$exfat(&(0x7f0000002bc0), &(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x210c04, &(0x7f0000000080)={[{@errors_continue}, {@dmask={'dmask', 0x3d, 0x4}}, {@allow_utime={'allow_utime', 0x3d, 0x5}}, {@errors_continue}, {@iocharset={'iocharset', 0x3d, 'cp865'}}, {@dmask={'dmask', 0x3d, 0xb0}}, {@fmask={'fmask', 0x3d, 0x5}}, {@iocharset={'iocharset', 0x3d, 'koi8-r'}}, {@keep_last_dots}, {@gid={'gid', 0x3d, 0xee00}}]}, 0x1, 0x1530, &(0x7f0000006800)="$eJzs3AucTtX6OPDnWWvtMSS9TXIZ1lrP5k0uiyTJJUkuSZIkSW4JSZIjCYkht6QhCcllSC5DSC4Tk8b9fr8kJMmZJMktt2T9PxPzV6fO/5zzO538/mee7+fzfmY9s95n7WfPM+9+995z+bbL0BqNalZtQETwb8FLHxIAIBYABgLAdQAQAEDZuLJxGfPZJSb8exthf6xHkq92Bexq4v5nbdz/rI37n7Vx/7M27n/Wxv3P2rj/WRv3n7GsbPP0/NfzI+s++P5/Vsbv//9F0kuO/WptyRu7AsT8sync////4b+Ry/3/rxX8M0/i/mdt3P+sKvZqF8D+F+DXf1aQ7e/OcP+zNu4/Y1nZL+8Fx8LVvx/9Zz8g8p/8GYjvdemrfPX38+/uP2OMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wx9ic4669QAJA5vtp1McYYY4wxxhhj7I/js13tChhjjDHGGGOMMfafhyBAgoIAYiAbxEJ2yAECICZz/nqIgxsgN9wIeSAv5IP8EA8FoCBoMGCBIIRCUBiicBMUgZuhKBSD4lACHJSEUnALlIZboQzcBmXhdigHd0B5qAAVoRLcCZXhLqgCd0NVuAeqQXWoATXhXqgF90FtuB/qwANQFx6EevAQ1IeHoQE8Ag3hUWgEj0FjeByaQFNoBs2hxf8o/yXoAS9DT+gFCdAb+sAr0Bf6QX8YAAPhVRgEr8FgeB0SYQgMhTdgGLwJw+EtGAEjYRS8DaPhHRgDY2EcjIckmAAT4V2YBO/BZJgCU2EaJMN0mAHvw0yYBbPhA5gDH8JcmAfzYQGkwEewEBZBKnwMi+ETSIMlsBSWwXJYASthFayGNbAW1sF62AAbYRNshi2wFbbBdtgBO+FT2AWfwW7YA3vhc9gHX/yL+Wf+Jr8rAgIKFKhQYQzGYCzGYg7MgTkxJ+bCXBjBCMZhHObG3JgH82A+zIfxGI8FsSAaNEhIWAgLYRSjWASLYFEsisWxODp0WApLYWm8FctgGSyLZbEclsPyWAErYCWshJWxMlbBKlgVq2I1rIY1sAbei/dib6yNtbEO1sG6WDfz9hQ2wAbYEBtiI2yEjbExNsEm2AybYQtsgS2xJbbCVtgG22BbbIvtsB22x/bYATtgR+yInbATdsbO2AW7YFfsht3SX8oG+DK+jL2wmuiNfbAP9sXEbP1xAA7AV3EQvoav4euYiENwKL6Bb+CbOBxP44iLI3EUjsLK4h0cg2ORxHhMwiSciBNxEk7CyTgFp+A0TMbpOANn4EychbPwA5yDH+KHOA/n4QJMwRRciIswFVNxMZ7BNFyCS3EZLscVuBxX4WpchWtxHa7FDbgBN+Em3IJbcBtuwx24Az9FBYCf4R7cg4m4D/fhftyPB/AAHsSDmI7peAgP4WE8jEfwCB7Fo3gMj+MJPI6n8BSexjN4Fs/ieTyPF/CF+K8bflpsTSKIDEooESNiRKyIFTlEDpFT5BS5RC4RERERJ+JEbpFb5BF5RD6RT8SLeFFQFBRGGEEizDhSiKiIiiKiiCgqioriorhwwolSopQoLUqLMqKMKCtuF+XEHaK8qCBau0qikqgs2rgq4m5RVVQV1UR1UUPUFDVFLVFL1Ba1RR1RR9QVdUU98ZCoL3pjf3xEZHSmkRiCjcVQbCKaCnn5CNVSDMdWorVoI54SI3EEthMtXXvxrOggxmBH8RcxFp8XncV47CJeFF1FN9FdvCR6iFaup+glJmNv0UdMw76in+gvBoiZWF18gHOy1xCvi0QxRAwVb4gF+KYYLt4SI8RIMUq8LUaLd8QYMVaME+NFkpggJop3xSTxnpgspoipYppIFtPFDPG+mClmidniAzFHfCjminlivlggUsRHYqFYJFLFx2Kx+ESkiSViqVgmlosVYqVYJVaLNWKtWCfWiw1io9gkNostYqvYJraLHWKn+FTsEp+J3WKP2Cs+F/vEF2K/+FIcEF+Jg+KvIl18LQ6Jb8Rh8a04Ir4TR8X34pg4Lk6Ik+KU+EGcFmfEWXFOnBc/igviJ3FReAESpZBSKhnIGJlNxsrsMoe8RuaUQebxX8bJG2RueaPMI/PKfDK/jJcFZEGppZFWkgxlIVlYRuVNsoi8WRaVxWRxWUI6WVKWkrfI0vJWWUbeJsvK22U5eYcsLyvIirKSvFNWlndJiFzaRjVZXdaQNeW9MgHuk7Xl/bKOfEDWlQ/KevIhWV8+LBvIR2RD+ahsJB+TjeXjsolsKpvJ5rKFfEK2lE/KVrK1bCOfkm3l07KdfEa2l8/KDtJf/hZ5XnaWL8gu8kXZVXaT3eVP8qL0sqfsJaE3yD7yFdlX9pP95QA5UL4qB8nX5GD5ukyUQ+RQ+YYcJt+Uw+VbcoQcKUfJt+Vo+Y4cI8fKcXK8TJIT5ET5rpwk35OT5RQ5VU6TyXK67H95pdlS/sP8d38nf/DPW98kN8stcqvcJrfLHXKn/FTukrvkbrlb7pV75T65T+6X++UBeUAelAdlukyXh+QheVgelkfkEXlUHpXH5HF5Tp6Up+QP8rQ8I8/Ic/K8PC8vXP4agEIllFRKBSpGZVOxKrvKoa5ROdW1Kpe6TkXU9SpO3aByqxtVHpVX5VP5VbwqoAoqrYyyilSoCqnCKqpuwsvfMKq4KqGcKqlKqVv+lXxVRN2siqpiv8rPrC/h79TXQrVQLVVL1Uq1Um1UG9VWtVXtVDvVXrVXHVQH1VF1VJ1UJ9VZdVZdVBfVVXVV3VV31UP1UD1VT5WgElQf9Yrqq/qp/mqAGqheFRn7MFgNVokqUQ1VQ9UwNUwNV8PVCDVCjVKj1Gg1Wo1RY9Q4NU4lqSQ1UU1UUk1Sk9VkNVVNVckqWc1QM9RMNVPNVrPVHDVHzVVz1Xw1X6WoFLVQLVSpKlUtVotVmlqilqhlaplaoVaoVWqVWqPWqHVqndqgNqg0tVltVlvVVrVdbVc71U61S+1Su9VutVftVfvUPrVf7VcH1AF1UB1U6SpdHVKH1GF1WB1RR9RRdVQdU8fUCXVCnVKn1Gl1Wp1VZ9V5dV5dUBfURXUx47QvEIEIVKCCmCAmiA1igxxBjiBnkDPIFeQKIkEkiAvigtzBjUGeIG+QL8gfxAcFgoKBDkxgA3G56dHgpqBIcHNQNCgWFA9KBC4oGZQKbglKB7cGZYLbgrLB7UG54I6gfFAhqBhUCu4MKgd3BVWCu4OqwT1BtaB6UCOoGdwb1AruC2oH9wd1ggeCusGDQb3goaB+8HDQIHgkaBg8GjQKHgsaB48HTYKmQbOgedDiD13f+9N5n3Q9dS+doHvrPvoV3Vf30/31AD1Qv6oH6df0YP26TtRD9FD9hh6m39TD9Vt6hB6pR+m39Wj9jh6jx+pxerxO0hP0RP2unqTf05P1FD1VT9PJerqeod/XM/UsPVt/oOfoD/VcPU/P1wt0iv5IL9SLdKr+WC/Wn+g0vUQv1cv0cr1Cr9Sr9Gq9Rq/V6/R6vUFv1Jv0Zr1Fb9Xb9Ha9Q+/Un+pd+jO9W+/Re/Xnep/+Qu/XX+oD+it9UP9Vp+uv9SH9jT6sv9VH9Hf6qP5eH9PHdRl9Up/SP+jT+ow+q8/p8/pHfUH/pC9qn3Fyn/H2bpRRJsbEmFgTa3KYHCanyWlymVwmYiImzsSZ3Ca3yWPymHwmn4k38aagKWgykCFTyBQyURM1RUwRU9QUNcVNceOMM6VMKVPalDZlTBlT1pQ15Uw5U96UNxVNRXOnudPcZe4yd5u7zT3mHlPdVDc1TU1Ty9QytU1tU8fUMXVNXVPP1DP1TX3TwDQwDU1D08g0Mo1NY9PENDHNTDPTwrQwLU1L08q0Mm1MG9PWtDXtTDvT3rQ3HUwH09F0NJ1MJ9PZdDZdTBfT1XQ13U1308P0MD1NT5NgEkwf08f0NX1Nf9PfDDQDzSAzyAw2g02iSTRDzVAzzAwzw81wM8KMNKMyTlTNO2aMGWvGmfEmySSZiWaimWQmmclmsplqpppkk2xmmBlmpplpZpvZZo6ZY+aauWa+mW9STIpZaBaaVJNqFpvFJs2kmaVmqVlulpuVZqVZbVabtWatWQ/rzUaz0Ww2m81Ws9VsN9vNTrPT7DK7zG6z2+w1e80+s8/sN/vNAXPAHDQHTbpJN4fMIXPYHDZHzBFz1Bw1x8wxc8KcMKfMKXPanDZnzVlz3uS9/H7pTazNbnPYa2xOe63NZa+zfxvns/ltvC1gC1pt89i8v4qNtbaoLWaL2xLW2ZK2lL3lN3F5W8FWtJXsnbayvctW+U1cy95na9v7bR37gK1p7/1VXNc+aOvZx2x9RADb1Da0zW0j+5htbB+3TWxT28w2t23t07adfca2t8/aDva538QL7SK72q6xa+06u9vusWftOXvYfmvP2x9tT9vLDrSv2kH2NTvYvm4T7ZDfxKPs23a0fceOsWPtODv+N/FUO80m2+l2hn3fzrSzfhOn2I/sHJtq59p5dr5d8HOcUVOq/dgutp/YNBvAUrvMLrcr7Eq76v/WusxusBvtJrvLfma32m12u91hd2aeCNs9dq/93O6zX9hD9ht7wH5lD9ojNt1+/XOcsX9H7Hf2qP3eHrPH7Ql70p6yP6jM7Ix9P2l/shett0BIQJIUBRRD2SiWslMOuoZy0rWUi66jCF1PcXQD5aYbKQ/lpXyUn+KpABUkTYYsEYVUiApTlG6izPKKUwlyVJJK0S1Umm6lMnQblaXbqRzdQeWpAlWkSnQnVaa7qArdTVXpHqpG1akG1aR7qRbdR7XpfqpDD1BdepDq0UNUnx6mBvQINaRHqRE9Ro3pcWpCTakZNacW9AS1pCepFbWmNvQUtaWnqR09Q+3pWepAz1FH+gt1ouepM71AXehF6krdqDu9RD3oZepJvSiBelMfeoX6Uj/qTwNoIL1Kg+g1GkyvUyINoaH0Bg2jN2k4vUUjaCSNordpNL1DY2gsjaPxlEQTaCK9S5PoPZpMU2gqTaNkmk4z6H2aSbNoNn1Ac+hDmkvzaD4toBT6iBbSIkqlj2kxfUJptISW0jJaTitoJa2i1bSG1tI6Wk8baCNtos20hbbSNtpOO2gnfUq76DPaTXtoL31O++gL2k9f0gH6ig7SXymdvqZD9A0dpm/pCH3ne9H3dIyO0wk6SafoBzpNZ+gsnaPz9CNdoJ/oInmCEEMRylCFQRgTZgtjw+xhjvCaMGd4bZgrvC6MhNeHceENYe7wxjBPmDfMF+YP48MCYcFQhya0IYVhWCgsHEbDm8Ii4c1h0bBYWDwsEbqwZFgqvCUsHd4alglvC8uGt4flwjvC8mGF8LEHKoV3hpXDu8Iq4d1h1fCesFpYPawR1gzvDWuF94W1w/vDOuEDYZnwwbBe+FBYP3w4bBA+EjYMHw0bhY+FjcPHwyZh07BZ2DxsET4RtgyfDFuFrcM24TVh2/DpsF34TNg+fDbsED738/yDizLnn/rNfELYO+wTvhK+Enp/v5wfXRBNiX4UXRhdFE2NfhxdHP0kmhZdEl0aXRZdHl0RXRldFV0dXRNdG10XXR/dEN0Y3RT1vmY2cOiEk065wMW4bC7WZXc53DUup7vW5XLXuYi73sW5G1xud6PL4/K6fC6/i3cFXEGnnXHWkQtdIVfYRd1Nroi72RV1xVxxV8I5V9KVcs1dC9fCtXRPulautWvjnnJPuafd0+4Z94x71nVwz7mO7i+uk3vedXYvuBfci66r6+a6u5dcDzch16XXZILr4/q4vq6v6+/6u4FuoBvkBrnBbrBLdIluqBvqhrlhbrgb7ka4EW6UG+VGu9FujBvjxrlxLskluYluopvkJrnJbrKb6qa6ZJfsZrgZbqab6SrPurSVuW6um+/muxSX4ha6jHPGVLfYLXZpLs0tdUvdcrfcrXQr3Wq32q11a916t95tdBvdZrfZbXVb3Xa33e10O90ut8vt9tddWtTtc/vdfnfAHXAH3V9duvvaHXLfuMPuW3fEfeeOuu/dMXfcnXAn3Sn3gzvtzriz7pw77350F9xP7qLzLikyITIx8m5kUuS9yOTIlMjUyLRIcmR6ZEbk/cjMyKzI7MgHkTmRDyNzI/Mi8yMLIimRjyILI4siqZGPI4sjn0TSIksiSyPLIssjKyLeF9ga+kK+sI/6m3wRf7Mv6ov54r6Ed76kL+Vv8aUv1Z3m/e2+nL/Dl/cVfEX/uG/im/pmvrlv4Z/wLf2TvpVv7dv4p3xb/7Rv55/x7f2zvoN/znf0f/Gd/PO+s3/Bd/Ev+q6+m+/uX/I9/Mu+p+/lE3xv38e/4vv6fr6/H+AH+lf9IP+aH+xf94l+iB/q3/DD/Jt+uH/Lj/Aj/aiYt/3ozEtkGO+T/AQ/0b/rJ/n3/GQ/xU/103yyn+5n+Pf9TD/Lz/Yf+Dn+Qz/Xz/Pz/QKf4j/yC/0in+o/9ov9Jz7NL8m8aexX+lV+tV/j1/p1fr3f4Df6TX6z3+K3+m1+u9/hd/pP/S7/md/t9/i9/nO/z3/h9/sv/YGLmX+B9rU/5L/xh/23/oj/zh/13/tj/rg/4U/6U/4Hf9qf8Wf9OX/e/+gv+J/8Rf6bNcYYY4yxf8qEK0Px65lLt/N7/06O+MWT+wDAtdvyp/9yPuOMcn2eS+N+Ij424+Ozvbo8kvmoVi0hIeHyc9MkBIXnAWT+JCjDz796cDleAm3gaWgPraH079bfT3Q7T/9g/ejtADl+kZNRUGZ8Zf0vATDhd9Z/4qlRC8uFZ+P+H+vPAyha+EpOdrgSL4E2P99faQ1l/k79eVv+g/qzf5UE0OoXOTnhSnyl/lLwJDwH7X/1TMYYY4wxxhhj7JJ+omKnzOvPzN/4/L3r83h1JScbXIn/0fU5Y4wxxhhjjDHGrr7nu3V/5on27Vt3+tcHVf5HWf/0oDH8p1bmwe8OvAfI/IwCgH9zQYCMgfwz92LLn7KtxMsvnb+dWn7OB/C/o5V/xOAqH5gYY4wxxhhjf7grJ/2//ry6WgUxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGNZ0J/x78Su9j4yxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjV9v/CQAA//9F2vrQ") syz_open_procfs(0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) 17.636994854s ago: executing program 2 (id=479): r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0xb, @local, 0x4}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000040)=[{&(0x7f00000002c0)="580000001400192340834b80040d8c560a117436c3790000000000363318d0d77b00000058000b4824ca145fca014c9f3f5a6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100", 0x58}], 0x1) 17.558356905s ago: executing program 2 (id=482): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@dev}, 0x14) syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @empty, @val={@val={0x88a8, 0x0, 0x0, 0x2}}, {@ipv6={0x86dd, @generic={0x0, 0x6, '\x00', 0x0, 0x1, 0x1, @private2, @remote}}}}, 0x0) 17.497847807s ago: executing program 32 (id=482): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@dev}, 0x14) syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @empty, @val={@val={0x88a8, 0x0, 0x0, 0x2}}, {@ipv6={0x86dd, @generic={0x0, 0x6, '\x00', 0x0, 0x1, 0x1, @private2, @remote}}}}, 0x0) 12.327113169s ago: executing program 3 (id=618): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@bridge_newneigh={0x28, 0x1c, 0x1, 0x70b529, 0x25dfdbfe, {0x7, 0x0, 0x0, r2, 0x80, 0x5e, 0x6}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000894}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x100000, {0x0, 0x0, 0x74, r2, {0x2, 0x10}, {0x5, 0x10}, {0xd, 0x3}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x10}, 0xc4) 12.103252224s ago: executing program 3 (id=621): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0x2c, 0x80000000, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5f431bcc}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffee4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x27, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x2000002, 0xe, 0xf0, &(0x7f0000000200)="df12c9f7b9a60000000000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 11.985258197s ago: executing program 3 (id=622): r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x200000c0}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newtfilter={0x70, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xb, 0x4}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x40, 0x2, [@TCA_BASIC_EMATCHES={0x3c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_META={0x2c, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x5, 0xe, 0x1}, {0x5, 0x40}}}, @TCA_EM_META_RVALUE={0x4}, @TCA_EM_META_RVALUE={0x5, 0x3, [@TCF_META_TYPE_VAR="c0"]}, @TCA_EM_META_LVALUE={0x8, 0x2, [@TCF_META_TYPE_INT=0xa]}]}}]}]}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x24049094}, 0x0) 11.985011227s ago: executing program 3 (id=623): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x200c080, 0x0) mount$bind(&(0x7f0000000300)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x185093, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r0, &(0x7f0000000000)='./file0\x00', 0x8000, &(0x7f0000001dc0)={0x9, 0x4, 0x100000}, 0x20) 11.936529608s ago: executing program 3 (id=626): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000780)={0x3, &(0x7f0000000600)=[{0x3d}, {0x2}, {0x6}]}) 11.810222161s ago: executing program 3 (id=627): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x141002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, &(0x7f0000003900)={0x1, [{0x3, 0x8, 0x0, &(0x7f00000002c0)="be"}, {0x3, 0x0, 0x9, 0x0}, {0x0, 0x0, 0x7, 0x0}, {0x2, 0x0, 0x7fffffff, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x2, 0x0, 0xfffffffd, 0x0}, {0x0, 0x0, 0x80007, 0x0}, {0x2, 0x0, 0x5, 0x0}, {0x2, 0x0, 0x2, 0x0}, {0x0, 0x0, 0x1, 0x0}, {0x2, 0x0, 0x7, 0x0}, {0x2, 0x0, 0x4, 0x0}, {0x0, 0x0, 0xa4, 0x0}, {0x1, 0x0, 0x2000100, 0x0}, {0x2, 0x0, 0x6, 0x0}, {0x1, 0x0, 0xa9c, 0x0}]}) 11.726877683s ago: executing program 33 (id=627): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x141002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, &(0x7f0000003900)={0x1, [{0x3, 0x8, 0x0, &(0x7f00000002c0)="be"}, {0x3, 0x0, 0x9, 0x0}, {0x0, 0x0, 0x7, 0x0}, {0x2, 0x0, 0x7fffffff, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x2, 0x0, 0xfffffffd, 0x0}, {0x0, 0x0, 0x80007, 0x0}, {0x2, 0x0, 0x5, 0x0}, {0x2, 0x0, 0x2, 0x0}, {0x0, 0x0, 0x1, 0x0}, {0x2, 0x0, 0x7, 0x0}, {0x2, 0x0, 0x4, 0x0}, {0x0, 0x0, 0xa4, 0x0}, {0x1, 0x0, 0x2000100, 0x0}, {0x2, 0x0, 0x6, 0x0}, {0x1, 0x0, 0xa9c, 0x0}]}) 10.392673475s ago: executing program 6 (id=628): mknodat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x1, 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x4) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3300057, 0x0, 0x11, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000480)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@uuid_off}]}) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x1000) 10.341829756s ago: executing program 6 (id=655): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000200), 0x1, 0x4bc, &(0x7f0000000a40)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x80342, 0xcc) pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xfecc) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x8441, 0x1ac) fallocate(r1, 0x8, 0x4000, 0x8000) 10.076615572s ago: executing program 6 (id=667): syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000000)='./file1\x00', 0x1000488, &(0x7f0000000040)=ANY=[], 0x1, 0x251, &(0x7f0000000880)="$eJzs2k1rXFUYB/Dnpi+pqelEfKMF8aALdXNpsnbRIC2IAUUboQrSW3OjQ64zIXcIjIidlW79CK7FpTtBunSTjZ/AhbtssuxCvDKdUTthaqONidrfbzMPnPPnmZdnDmdxd1/+4qON9TpfL3oxk2UxcykGcTuLhZiJ3wzipReuff/MW9feeW15ZeXymyldWb66uJRSOvfsd+9+8vVzt3pn3/7m3LezsbPw3u7e0k87T+2c3/3l6oftOrXr1On2UpFudLu94kZVprV2vZGn9EZVFnWZ2p263JpYX6+6m5v9VHTW5uc2t8q6TkWnnzbKfup1U2+rn4oPinYn5Xme5ueCB7H61e2mib3m1PVomuaRL+PsrZj/MVqRPZayxy9lT17Pnh5k5/eapnXcb5V/hN//4XbXoX4movp8e3V7dfQ6Wl9ej3ZUUcbFaMXPMRyTsVF95dWVyxfTHQvxWXVznL+5vXpiMr8YrViYnl8c5dNkfjbmIk5FjPNL0YonpueXpubPxIvP39U/j1b88H50o4q1GGb/yH+6mNIrr6/sy1+4sw8A4P8mT7+ben/L83utj/J/4X647351Mi6cPN7PTkTd/3ijqKpy64GL0xFxvz2z466H1vQAxbDfUfVS7CtO3Hck/l4xG3++J5sc7CxiMJyDf8XXcvrQ/3oHLB4dNz5Y6liOI47Y5DkJAAAAAAAAAADAf8VRPYELAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwL78GAAD//0cVwgU=") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') truncate(&(0x7f0000000480)='./file1\x00', 0x4000000000006) 9.930363696s ago: executing program 6 (id=671): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000180)='./file0\x00', 0x2008002, &(0x7f00000000c0)={[{@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x1000}}, {@nobh}, {@quota}]}, 0x1, 0x560, &(0x7f0000000440)="$eJzs3c9vI1cdAPDvTH42u212oQeogF2gsKDV2htvu6p6abmAUFWpouLEYRsSbxTWXi+xU5oQifRvAAkkTvAncEDigNQTB24ckTgAohyQCkSgDRIHoxlPEjdxWLN2bDb+fKTZ+fFm5vuevTPv+dmZF8DEuhoRuxExGxFvRcRisT0ppni1M2X7PdzbWdnf21lJot1+829Jnp5ti65jMheKc85HxNe+EvHN5GTc5tb2veVarbpRrJdb9Qfl5tb2jfX68lp1rXq/Urm9dPvmS7derAytrFfqP/vgy+uvff2Xv/jk+7/Z/eJ3s2xdLNK6yzFMnaLPHMbJTEfEa2cRbAymivnsmPPB40kj4iMR8Zn8+l+Mqfx/JwBwnrXbi9Fe7F4HAM67NO8DS9JSRKRp0Qgodfrwno2FtNZotq7fbWzeX+30lV2KmfTueq168/Lc776d7zyTZOtLeVqenq9Xjq3fiojLEfGDuafy9dJKo7Y6niYPAEy8C931f0T8cy5NS6W+Du3xrR4A8MSYH3cGAICRU/8DwORR/wPA5Omj/i++7N8987wAAKPh8z8ATB71PwBMHvU/AEyUN15/PZva+8Xzr1ff3tq813j7xmq1ea9U31wprTQ2HpTWGo21/Jk99Uedr9ZoPFh6ITbfKbeqzVa5ubV9p97YvN+6kz/X+051ZiSlAgD+m8tX3vttEhG7Lz+VT9E1loO6Gs63dIh7AU+WqUEO1kCAJ5rRvmBy9VWF542EX595XoDx6Pkw7/meix/2o/8hiN8Zwf+Vax/vv//fGM9wvujZh8n1eP3/rww9H8DoPXb//x+Gmw9g9Nrt5PiY/7OHSd3eGOWoxADAWRrgJ3zt7w2rEQKM1aMG8x7K9/8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwzlyMiG9FkpbyscDT7N+0VIp4OiIuxUxyd71WvRkRz8SViJiZy9aXxp1pAGBA6V+SYvyva4vPXzyeOpv8ay6fR8R3fvzmD99ZbrU2lrLtfz/cPncwfFjl6LgBxhUEAPr3p352yuvvSjHv+iD/cG9n5WA6wzye8MGXDgcfXdnf28mnTsp0tNvtdsR83pZY+EcS08Ux8xHxXERMDSH+7rsR8bFe5U/yvpFLxcin3fGjiP30SOOnH4qf5mmdefbyfXQIeYFJ8152/3m11/WXxtV83vv6n8/vUIPL73/zEQf3vv2u+NNFpKke8bNr/mq/MV741VdPbGwvdtLejXhuulf85DB+ckr85/uM//tPfOr7r5yS1v5JxLXoHb87VrlVf1Bubm3fWK8vr1XXqvcrldtLt2++dOvFSjnvoy4f9FSf9NeXrz9zWt6y8i+cEr/zzl84Vv7Zw2M/12f5f/rvt77x6aPVuePxv/DZ3u//s/m89+uf1Ymf7zP+8sLPTx2+O4u/ekr5H/X+X+8z/vt/3l7tc1cAYASaW9v3lmu16sZAC9mn0GGc58RClsX+dj5oLg4W9I+RLxy9LEkkMexyZY2xfnaeOatX9cwXpg/bisM44VRnYaE45YiLkw6pFIMtxKVi4eGogo7nfgSMztFFP+6cAAAAAAAAAAAAAAAApxnF3zCNu4wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcX/8JAAD//7a0vsc=") sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x2, 0xd, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}]}, 0x40}}, 0x0) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f0000000f00)='.\x00', 0x1a8a439, &(0x7f000001dcc0)=ANY=[], 0xd, 0x0, &(0x7f0000000000)) 9.826202058s ago: executing program 6 (id=673): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000010340)=ANY=[@ANYBLOB="0b000000080000000c0000000000008001"], 0x48) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000500)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x19, &(0x7f0000000540)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000001}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2}, 0xc) 9.75076932s ago: executing program 34 (id=673): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000010340)=ANY=[@ANYBLOB="0b000000080000000c0000000000008001"], 0x48) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000500)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x19, &(0x7f0000000540)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000001}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2}, 0xc) 5.468697481s ago: executing program 7 (id=758): bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000080000001801000020646c2500000000002020207b1a"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x48, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="1809000000ffffff00000000000000008510000002000000850000000f0000009500000000000000"], 0x0, 0xfffffdfe, 0x0, 0x0, 0x727c45cd4283345, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffe55, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r0, 0x0, 0x0}, 0x10) 5.400534453s ago: executing program 7 (id=759): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r0, &(0x7f0000000480)={0x2, 0x22, @multicast1}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffffffffffffa}, {}, 0x3, 0x0, 0x1}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x39}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe, 0xfffffffe}}, 0xe8) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x1c) 5.252023166s ago: executing program 7 (id=761): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x1, &(0x7f0000000600)=0x0) io_submit(r1, 0x4a, &(0x7f00000008c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x7fff, r0, &(0x7f0000000140)="bf", 0xfd62, 0x0, 0x0, 0x2}]) 4.985560972s ago: executing program 7 (id=763): syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000000)='./file1\x00', 0x1000488, &(0x7f0000000040)=ANY=[], 0x1, 0x251, &(0x7f0000000880)="$eJzs2k1rXFUYB/Dnpi+pqelEfKMF8aALdXNpsnbRIC2IAUUboQrSW3OjQ64zIXcIjIidlW79CK7FpTtBunSTjZ/AhbtssuxCvDKdUTthaqONidrfbzMPnPPnmZdnDmdxd1/+4qON9TpfL3oxk2UxcykGcTuLhZiJ3wzipReuff/MW9feeW15ZeXymyldWb66uJRSOvfsd+9+8vVzt3pn3/7m3LezsbPw3u7e0k87T+2c3/3l6oftOrXr1On2UpFudLu94kZVprV2vZGn9EZVFnWZ2p263JpYX6+6m5v9VHTW5uc2t8q6TkWnnzbKfup1U2+rn4oPinYn5Xme5ueCB7H61e2mib3m1PVomuaRL+PsrZj/MVqRPZayxy9lT17Pnh5k5/eapnXcb5V/hN//4XbXoX4movp8e3V7dfQ6Wl9ej3ZUUcbFaMXPMRyTsVF95dWVyxfTHQvxWXVznL+5vXpiMr8YrViYnl8c5dNkfjbmIk5FjPNL0YonpueXpubPxIvP39U/j1b88H50o4q1GGb/yH+6mNIrr6/sy1+4sw8A4P8mT7+ben/L83utj/J/4X647351Mi6cPN7PTkTd/3ijqKpy64GL0xFxvz2z466H1vQAxbDfUfVS7CtO3Hck/l4xG3++J5sc7CxiMJyDf8XXcvrQ/3oHLB4dNz5Y6liOI47Y5DkJAAAAAAAAAADAf8VRPYELAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwL78GAAD//0cVwgU=") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') stat(&(0x7f0000000040)='./file1\x00', &(0x7f0000000100)) 4.924687434s ago: executing program 7 (id=764): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./binfmt\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./binfmt\x00', &(0x7f0000000100)='binfmt_misc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./binfmt/status\x00', 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') read$FUSE(r0, 0x0, 0x0) 4.639691081s ago: executing program 7 (id=767): openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) mount$9p_fd(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x8, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r1, 0xffffffffffffffff, 0x0) 4.605478531s ago: executing program 35 (id=767): openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) mount$9p_fd(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x8, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r1, 0xffffffffffffffff, 0x0) 3.586310915s ago: executing program 0 (id=800): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0xc03, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f00000000c0)={0x190003, 0x0, {[0x9, 0xfffffffffffff7a6, 0xa, 0x8d0, 0xa, 0x10000005, 0x7, 0x4000000000000005]}}) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000000)) 3.435093039s ago: executing program 0 (id=802): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000140)={0x1, 0x0, [{0x48f, 0x0, 0x8}]}) 3.190016645s ago: executing program 0 (id=806): getpid() syz_clone(0x32000000, &(0x7f0000000280)="b73882ceed38bdb35ed3d19fefc3854b6e7cae6e9a12d90eb4221413673c606143e9f514893be746b76f94172eb9fa4ab8e2a2bb29fcae96671a9dd8fe0eaad7db65282fbc41dda1b00a4de66c3d65c3e804e9913e93", 0x56, &(0x7f0000000380), 0x0, &(0x7f0000000400)) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xa, 0x5, 0x4, 0x8}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f00000008c0)="7a7fa22c2aff88df53ef2a2d280f", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.161743396s ago: executing program 0 (id=808): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005938d74010973077339600000001090212000100001e000904"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000080)={0x44, &(0x7f0000000480)=ANY=[@ANYBLOB="000a06"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 1.130305273s ago: executing program 4 (id=859): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_delroute={0x24, 0x18, 0x901, 0x0, 0x25dfdbff, {0x2, 0x18, 0x0, 0x0, 0xff, 0x0, 0x0, 0x8, 0x2000000}, [@RTA_DST={0x8, 0x1, @dev}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={'lo\x00', {0x2, 0x4e22, @empty}}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000001040)={'lo\x00', {0x2, 0x4e1e, @dev={0xac, 0x14, 0x14, 0x30}}}) 1.130161993s ago: executing program 4 (id=860): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0xa, 0x5, 0x1000, 0xffffffffffffffff, 0x2}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000002300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000400)={r1}, 0xc) 1.122986273s ago: executing program 4 (id=861): syz_mount_image$ext4(&(0x7f0000000400)='ext4\x00', &(0x7f0000000340)='./file0\x00', 0x21c91c, &(0x7f0000000440)={[{@dioread_nolock}, {@noblock_validity}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10000}}, {@resgid}, {@norecovery}, {@abort}, {@auto_da_alloc}, {@nouid32}, {@resgid, 0x32}]}, 0x1, 0x519, &(0x7f00000014c0)="$eJzs3V1PZGcdAPD/GZgtLCA0elGbtDZuDRDdAcRuiRe1Jkavmqj1viIMhDAwBIZ2IVVp/AAmxlgTr3rljYkfwMTsRzAmTey9UeNLdFcvNtHdMefMy7LsmQV2ZxgKv19yOM95znP4P/+ZzDPnLWcCuLReiohrEXG/Xq9PR8R4s77QnOKgMaXt7tx+dymdkqjX3/xnEpE06tJmU4f+50hzs6GI+PY3Ir6XPBp3Z29/fbFSKW83l2dqG1szO3v719c2FlfLq+XN+fm5GwuvLryyMNuVPEcj4rWv/eVnP/7l11/77Rfe+eNbf5v6QdKsj3iQR7c1Ui9mr0XLYERs9yJYnwxmGQIA8HHQ2s//bERMx3gMZHtzAAAAwEVS/8po/C+JqJ/I0MmaAQAAAOdKIbsHNimUmvcBjMYL75dKjXt4PxVXC5XqTu3zK9XdzeXGvbITUSysrFXKs817hSeimKTLc1m5vRwRdw8vl+cj4tmI+On4cLZcWqpWlvt98gMAAAAuiZEjx///ebTJf/vRLwAAAKDLJvrdAQAAAKDnHP8DAADAxef4HwAAAC60b77xRjrVW79/vfz23u569e3ry+Wd9dLG7lJpqbq9VVqtVlezZ/ZtHPf/KtXq1pdic/fmTK3897FGXXV3s/bW2kM/gQ0AAACcoWc/c+ujJCIOvjycTakr/e4UcCYGT9P4z73rB3D2BvrdAaBvTvX9D1woxX53AOi75Jj1Qx98P3/F73rRGwAAoBcmP33ro6Gc6/8Dx54bOCicUReBHnH+Dy4v1//h8jrt9X/7C3BxFGMgHMjD5dZ+BOjww/UjzXnHh3ec+Pp/vf5EHQMAALpmNJuSQikiOw8wGoVCqRQxlh0TFJOVtUp5NiI+ERF/GC8+ky7PZVsmkRx30zAAAAAAAAAAAAAAAAAAAAAAAAAAkKnXk6ifwsKpWgMAAADnQUThr0n2NP+IyfGXR4+eH7iS3B3P5hHxzi/efP/mYq22PZfW/6tdX/t5s/6L/TiDAQAAABzVOk7P5sP97g0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF82d2+8utaazjPuPr0bERF78wRjK5kNRjIir/05i8NB2SUQMdCH+wXsR8Vxe/CTtVkw0e5EXf7jP8Ue6EB8us1vp+PN63uevEC9l8/zP341shHp6nce/Qnv8G8iJn9aNtUuP9/yHv57pGP+9iOcH88efVvwkxh6Of9AYf66dMMfvfmd/v9O6+gcRk7nfP0m7TVqaqW1szezs7V9f21hcLa+WN+fn524svLrwysLszMpapdz8mxvjJy/85v7j8r/aIf5EO//88fflE+Z/78Obtz/ZKBbbmycP4k9dy3//n+sQv9B81z/XLKfrJ1vlg0b5sBd/9fsXW+XXc/JfPpr/dBx5//Pznzph/tPf+tGfTtgUADgDO3v764uVSnn7Uhee6tVId4vORRZPVbjSqyzS1/U8JJhX+OGTbp7u/nZYNdB51bkqDB3TJuKZvo5MAABAtz16DAwAAAAAAAAAAAAAAAAAAACctR4/aexeWigeiXmQ/e3G0/MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALrn/wEAAP//osjMqw==") mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000023c0)='./file0\x00', 0x0, 0x195a420, &(0x7f0000000340)={[{@gid}, {}]}) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') pread64(r0, &(0x7f0000002280)=""/4096, 0x1000, 0xd33) 1.086073094s ago: executing program 4 (id=862): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = socket(0x28, 0x801, 0x0) connect$vsock_stream(r0, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) ppoll(&(0x7f0000000040)=[{r0, 0x2}, {r0, 0x1}], 0x2, 0x0, 0x0, 0x0) 998.914477ms ago: executing program 4 (id=863): syz_mount_image$ext4(&(0x7f0000000440)='ext4\x00', &(0x7f0000000480)='./file0\x00', 0x2000000, &(0x7f0000000200), 0x1, 0x459, &(0x7f0000001080)="$eJzs3E+IVHUcAPDve/tHXddmjWgrAqVEi3DVHatToB06dPEgCP0RWnL8g6Mb7kZpQlkgQkR0kAQhtmN0yEOHIoLoEkEdOhREklAdwrBCOnTbmH1v1lHfoI2Ob1w/H3g7v/ebN+/7+/GWx+8L730DuGWtjIhNEdEXEWMRUcn703yL17Ktcdzh6qndjS2J2dmtfyWRREStemp381xJ/rk0/9niiLh9UxKP918ed+rgob0T9XrtQL6/bnrfC+umDh5au2ffxK7artr+6sZHxsc3Plx99PrN9fTo6zE+vmngozUrj337+Vs/NMY7nH/XOo/rKWnTubkbwUo00NJOCq43veed429/VvYYAIAbL83X/v1z6/9K9EW2eDtz+tnzlXh1qOzxAQAAANdudrYv/wQAAAAWrkTuDwAAAAtc8zmAWvXU7uZ2o549WPpgxLnNETGSxW++X5x92z/3/nDk75YOdCH+fWe6cNL/YerJcuN/t63c+Ms/LDf+zE/lxn9udbnxf/ul3PirVpQb//hkxBebswIIl9//0rmaB02DEbEor2mw5KrO3nfFI1Z8eeH+d/iy+186f/9rnOlaXsQ6NnP2aFH/6BMR545E3NNfFD+Zj5/kNR06tfb7I9uL+pefi5h9P2J1FMePlvjt60Os27mnXluf/S2OX33l6UpR/5avsvkPtYk/kh/X11InohMnhrZ/sqygf9tYFv+B+4uv/10t878tr80x0kH8lXfXtxT1r34zi7+jzfxbr//yDuI2zfwx9WtR/8cbr+GkAEDH0rm1TZKOzbfTdGwsW+/dEUNpfXJq+qGdky/u35GtgUZiIG0utbL1yEDS2N+Qr02a++OX7FfzNcSxypK5/bHnJ+s7yp48AAAALHDDET8/88ano0svyf9/r2T5PwAAAHDTaPuoaiP/v3fmvZON9j+FT0cCAAAAvaI+29nvGvn/+aN/fh3yfwAAAFiwLs7/r1yrCgAAALj5NPP/4Tb1/5a11O5bn9cf/qYysGjnnsWxoezBAwAAAFelkf+nPz51Zurgob0T9XrtgEaJjYieGEbWGMz/RUoexmO9MYz5RtJj4+l2o6QbEwAA0DUXFv1ljwQAAADonvRsEhGNbU1l1fCdKz4Ybf12MPl3rjrgYES8dHLruy9PTE8f2NDo/3u+f/pE3j9e1hwAAADgVrf4onYzT2/m8QAAAAAAAAAAAAAAQO+7EeXEy54jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA189/AQAA//+dwY51") syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(0x0, 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0xa) open(&(0x7f0000000140)='./file1\x00', 0x109cc2, 0x5c) 993.164187ms ago: executing program 4 (id=865): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000401e04012800000000000109022400010000000009040100010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e20, @loopback}}, 0x0, 0x0, 0x44, 0x0, "84f4ba9d18d04959917303b5758777b29cf7bbe1e7b68fe581abb22e3a33da2ae9bc6534624e6b6adc4e6eb25906892d8f0aa71dce32959c5860a717c10d9bb959c1cd7a5a11441fe6acb1029bbb4b01"}, 0xd8) recvmsg(0xffffffffffffffff, 0x0, 0x700) syz_usb_control_io(r0, &(0x7f0000000600)={0x2c, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) 789.192631ms ago: executing program 8 (id=870): sendmsg$key(0xffffffffffffffff, &(0x7f00000014c0)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="021800000b000000000000000000000003000500000000000200008d040000010000000700000000000000000000002002000000000000000000000000000000030006000000000002000000ffff"], 0x58}}, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="58bc0d25", @ANYRES16, @ANYBLOB="080029bd7000fddbdf2508000000440003800800030003000000080003000b00000008000300165d0000080003000000000008000100001000000800030000000000080002"], 0x58}, 0x1, 0x0, 0x0, 0x4008010}, 0x10) r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r1, @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f30000007000200293a00000500060000000000080001000000000018002580140004004d2906d0880fc8acc30fe2020f9849675000028004000500a1085e7df341b9dc3d8008a2fe5bdaad140004009c7e472c916020fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af0800010000000000080001000000000060001a803f0003"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) 659.461455ms ago: executing program 8 (id=872): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x8c66) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000080)={0x7, 0x0, 0x1, r2, 0x1}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x27800000000, 0x0, 0x4, r2, 0x11}) 581.202176ms ago: executing program 1 (id=873): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0xfffffff9, 0x3, 0x16, "006247f0cb6b4fca210200"}) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000080)=0x16) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000180)=0x8) 573.417977ms ago: executing program 8 (id=875): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000200)={r0, 0xffffffffffffffff}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000008000000850000004900000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={r2, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000680)="76389e6a65585578f830e9000000", 0x0, 0x10001, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 522.886138ms ago: executing program 5 (id=879): unshare(0x2040400) r0 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x1) fstat(r1, &(0x7f00000002c0)) 497.018008ms ago: executing program 5 (id=880): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0xf, &(0x7f0000000540)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x107a655, 0x0, 0x0, 0x0, 0x10}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000200)={r1, r2}, 0xc) 448.57497ms ago: executing program 5 (id=881): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000220000000400000002"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1, 0xffffffffffffffff}, &(0x7f0000000200), &(0x7f0000000140)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r2}, &(0x7f0000000040)=0x2, &(0x7f0000000240)=r0}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, &(0x7f0000000040)}, 0x20) 432.21237ms ago: executing program 8 (id=882): r0 = syz_open_procfs(0x0, &(0x7f0000000100)='task\x00') fchdir(r0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x800000, 0x0) r1 = syz_clone(0x20100000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs$userns(r1, &(0x7f0000000040)) 419.36188ms ago: executing program 5 (id=883): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x1, {0x42}}, 0x10) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x2, {{0x42}, 0x4}}, 0x10) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000140)={0x42, 0x1}, 0x10) 376.085671ms ago: executing program 8 (id=884): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x1ff) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0xfffffffffffffffd, 0x58) 366.958601ms ago: executing program 5 (id=885): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000) syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x400a8, 0x0, 0x5, 0x0, 0x0) 359.201102ms ago: executing program 1 (id=886): r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0xb, &(0x7f0000000200)=0x8, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486dd601b8b97004d88c19e9ace5ffb2e9fc603dd282100000002ff02000000000000000000000000000104004e20004db0"], 0x0) 352.313262ms ago: executing program 8 (id=887): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000027c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000002800)={'wg1\x00', 0x0}) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, &(0x7f0000002900)={0x0, 0x0, &(0x7f00000028c0)={&(0x7f0000002840)={0x34, r2, 0x5, 0x70bd25, 0x25dfdbfc, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}]}, 0x34}}, 0x40000) 256.916354ms ago: executing program 5 (id=888): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1e000000000000000100000007"], 0x50) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r0, 0x0, &(0x7f0000001700)=""/53}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 247.451824ms ago: executing program 1 (id=889): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="12000000040000000400000001"], 0x50) r1 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r1, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000580)={r0, &(0x7f0000000480), &(0x7f0000000540)=@tcp=r1}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000000)={r0, &(0x7f0000000080)="06d0"}, 0x20) 244.144184ms ago: executing program 1 (id=890): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000003, 0x2000006, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8983, &(0x7f0000000000)={0x6, 'macvlan0\x00', {0x2}, 0xdd3c}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000240)={0x0, 'bridge_slave_1\x00', {0x4}, 0x3ff8}) 223.979545ms ago: executing program 1 (id=891): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/module/firmware_class/parameters/path\x00', 0x101002, 0x0) sendfile(r0, r0, 0x0, 0x1) 217.682695ms ago: executing program 1 (id=892): io_uring_setup(0x7fc0, &(0x7f0000000000)={0x0, 0x3, 0x40}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r0, 0xc138fd06, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000032") 79.994238ms ago: executing program 0 (id=893): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./bus\x00', 0x1001a, &(0x7f0000000180)={[{@usrquota}, {@discard}, {@inlinecrypt}, {@user_xattr}, {@resgid}, {@nojournal_checksum}]}, 0x1, 0x430, &(0x7f0000000c40)="$eJzs20tvG0UcAPD/bh6lLxJKeTQtECiIiEfSpAV64AICiQsSEhzKMSRpFeI2qAkSrSIICHFFlbgjjkh8Ak5wQcAJiSsfAFWqUC4tnIzW3k1sx3k4deM2/v2kbWd2x5n5e2fs2R1vAF1rOPsniTgUEX9FxEA1W19guPrfrZWlqX9XlqaSKJff/SeplLu5sjRVFC1edzDPjKQR6ZdJHG9S78KVq3OTpdLM5Tw/tnjxo7GFK1dfnL04eWHmwsylibNnz5wef+XliZfaEmfWpptDn86fOPbW+9fenjp37YPffkiK+BviaJPhzQ4+Uy63ubrOOlyTTno72BBa0hMR2enqq4z/geiJtZM3EG9+seWLgXtWuVwuH9z48HIZ2MOS6HQLgM4ovuiz699i26Wpx13hxmvVC6As7lv5Vj3SG2lepq/h+radhiPi3PJ/32Zb3Jn7EAAAdX7K5j8vNJv/pfFwTbn787WhwYh4ICKORMSDEXE0Ih6KqJR9JCIebbH+xkWS9fOf9PqOAtumbP73ar62VT//K2Z/MdiT5w5X4u9Lzs+WZk7l78lI9O3L8uOb1PHzG39+vdGx2vlftmX1F3PBvB3Xe/fVv2Z6cnHydmKudePziKHeZvEnqysBSUQci4ihHdYx+9z3JzY6tnX8m2jDOlP5u4hnq+d/ORriLySbr0+O3RelmVNjRa9Y7/c/vnpno/pvK/42yM7/gab9fzX+waR2vXahtb+/b4vjO+3//cl7lXR/vu+TycXFy+MR/XP1naKyf2J9viifxT9ysvn4PxJr78TxiMg68WMR8XhEPJG3/cmIeCoiTm4S46+vP/3hzuO/s7L4p1s6/2uJ/mjc0zzRM/fLj3WVDrYSf3b+z1RSI/me7Xz+baddrfdmAAAAuDelEXEoknR0NZ2mo6PV38sfjQNpaX5h8fnz8x9fmq4+IzAYfWlxp2ug5n7oeH5ZX+QnGvKn8/vG3/Tsr+RHp+ZL050OHrrcwQ3Gf+Zvv++Hvc/zWtC9jH/oXsY/dC/jH7pXk/G/vxPtAHZfs+//zzrQDmD3NYx/y37QRVz/Q/cy/qF7Gf/QlRb2x9YPyUtIrEtEelc0Y88n+qMztXf6kwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKA9/g8AAP//uYzj2A==") seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0xb, 0x4, 0x7fff0000}]}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x200) 0s ago: executing program 0 (id=894): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x40801, 0x0) r1 = epoll_create(0x8) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0x90000001}) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.336320][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.344612][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.352549][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.360590][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.368505][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.375972][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.383696][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.391550][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.401865][ T292] device veth0_vlan entered promiscuous mode [ 25.408488][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.416674][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.430845][ T287] device veth1_macvtap entered promiscuous mode [ 25.448907][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.456676][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.464430][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.472069][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.480353][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.488671][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.496753][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.504967][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.513106][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.521271][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.529645][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.538781][ T290] device veth1_macvtap entered promiscuous mode [ 25.547690][ T292] device veth1_macvtap entered promiscuous mode [ 25.557009][ T288] device veth1_macvtap entered promiscuous mode [ 25.568122][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.575963][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.584085][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.592035][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.600505][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.621794][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.630240][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.638798][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.647202][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.655834][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.664473][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.672958][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.686644][ T294] device veth0_vlan entered promiscuous mode [ 25.699681][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.707824][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.715469][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.723158][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.731724][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.740396][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.748907][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.757362][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.765728][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.774249][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.782793][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.802339][ T294] device veth1_macvtap entered promiscuous mode [ 25.809475][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 25.820778][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.859393][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.868199][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.876734][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.885322][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.902082][ T313] netlink: 'syz.0.6': attribute type 3 has an invalid length. [ 25.918422][ T313] netlink: 72 bytes leftover after parsing attributes in process `syz.0.6'. [ 26.035334][ T336] serio: Serial port ttyS3 [ 26.122597][ T349] loop2: detected capacity change from 0 to 16 [ 26.159365][ T355] loop1: detected capacity change from 0 to 1024 [ 26.183362][ T349] erofs: (device loop2): mounted with root inode @ nid 36. [ 26.225150][ T355] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 26.321246][ T288] EXT4-fs (loop1): unmounting filesystem. [ 26.478345][ T384] loop2: detected capacity change from 0 to 4096 [ 26.498697][ T361] loop3: detected capacity change from 0 to 40427 [ 26.501664][ T384] EXT4-fs: Ignoring removed mblk_io_submit option [ 26.505886][ T361] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 26.519857][ T361] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 26.528701][ T361] F2FS-fs (loop3): invalid crc value [ 26.555167][ T384] EXT4-fs (loop2): Test dummy encryption mode enabled [ 26.569061][ T361] F2FS-fs (loop3): Found nat_bits in checkpoint [ 26.590128][ T384] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 26.636996][ T361] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 26.641192][ T384] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 26.645084][ T361] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 26.701620][ T361] syz.3.23: attempt to access beyond end of device [ 26.701620][ T361] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 26.703143][ T374] loop0: detected capacity change from 0 to 40427 [ 26.723034][ T294] EXT4-fs (loop2): unmounting filesystem. [ 26.728514][ T374] ======================================================= [ 26.728514][ T374] WARNING: The mand mount option has been deprecated and [ 26.728514][ T374] and is ignored by this kernel. Remove the mand [ 26.728514][ T374] option from the mount to silence this warning. [ 26.728514][ T374] ======================================================= [ 26.779966][ T374] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 26.794212][ T361] syz.3.23: attempt to access beyond end of device [ 26.794212][ T361] loop3: rw=0, sector=45096, nr_sectors = 8 limit=40427 [ 26.798576][ T374] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 26.810512][ T399] binder: 398:399 ioctl c0306201 200000000640 returned -22 [ 26.848890][ T374] F2FS-fs (loop0): invalid crc value [ 26.855571][ T374] F2FS-fs (loop0): Found nat_bits in checkpoint [ 26.866408][ T361] syz.3.23 (361) used greatest stack depth: 22176 bytes left [ 26.876984][ T292] syz-executor: attempt to access beyond end of device [ 26.876984][ T292] loop3: rw=2049, sector=40960, nr_sectors = 8 limit=40427 [ 26.900023][ T374] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 26.907605][ T374] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 26.997042][ T408] netlink: 8 bytes leftover after parsing attributes in process `syz.4.39'. [ 27.026338][ T412] xt_hashlimit: size too large, truncated to 1048576 [ 27.075676][ T414] xt_connbytes: Forcing CT accounting to be enabled [ 27.195148][ T422] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 27.723445][ T449] capability: warning: `syz.2.53' uses deprecated v2 capabilities in a way that may be insecure [ 27.752833][ T451] netlink: 24 bytes leftover after parsing attributes in process `syz.2.54'. [ 27.855366][ T28] kauditd_printk_skb: 85 callbacks suppressed [ 27.855384][ T28] audit: type=1400 audit(1791201178.310:159): avc: denied { create } for pid=455 comm="syz.3.56" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 27.883222][ T458] loop1: detected capacity change from 0 to 4096 [ 27.891674][ T457] netlink: 4 bytes leftover after parsing attributes in process `syz.3.56'. [ 27.906719][ T458] EXT4-fs: Ignoring removed mblk_io_submit option [ 27.911015][ T457] netlink: 16 bytes leftover after parsing attributes in process `syz.3.56'. [ 27.937655][ T458] EXT4-fs (loop1): Test dummy encryption mode enabled [ 27.938180][ T28] audit: type=1400 audit(1791201178.340:160): avc: denied { write } for pid=455 comm="syz.3.56" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 27.961440][ T458] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 28.012560][ T28] audit: type=1400 audit(1791201434.468:161): avc: denied { read write } for pid=465 comm="syz.0.60" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.051011][ T288] EXT4-fs (loop1): unmounting filesystem. [ 28.066364][ T28] audit: type=1400 audit(1791201434.468:162): avc: denied { open } for pid=465 comm="syz.0.60" path="/dev/raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.109850][ T28] audit: type=1400 audit(1791201434.468:163): avc: denied { ioctl } for pid=465 comm="syz.0.60" path="/dev/raw-gadget" dev="devtmpfs" ino=258 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.162905][ T28] audit: type=1400 audit(1791201434.618:164): avc: denied { setopt } for pid=467 comm="syz.4.61" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 28.205526][ T28] audit: type=1400 audit(1791201434.648:165): avc: denied { mmap_zero } for pid=470 comm="syz.1.62" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 28.230204][ T28] audit: type=1400 audit(1791201434.668:166): avc: denied { nlmsg_read } for pid=473 comm="syz.2.73" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 28.265263][ T28] audit: type=1400 audit(1791201434.728:167): avc: denied { read } for pid=481 comm="syz.2.66" name="event0" dev="devtmpfs" ino=260 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 28.278194][ T19] usb 1-1: new low-speed USB device number 2 using dummy_hcd [ 28.306327][ T28] audit: type=1400 audit(1791201434.728:168): avc: denied { open } for pid=481 comm="syz.2.66" path="/dev/input/event0" dev="devtmpfs" ino=260 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 28.490147][ T19] usb 1-1: config 1 has an invalid descriptor of length 53, skipping remainder of the config [ 28.500462][ T19] usb 1-1: config 1 interface 0 altsetting 18 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 28.513705][ T19] usb 1-1: config 1 interface 0 has no altsetting 0 [ 28.525085][ T19] usb 1-1: string descriptor 0 read error: -22 [ 28.531391][ T19] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 28.540647][ T19] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.550691][ T19] usb 1-1: bad CDC descriptors [ 28.764011][ T309] usb 1-1: USB disconnect, device number 2 [ 28.979029][ T501] loop2: detected capacity change from 0 to 512 [ 28.988627][ T501] EXT4-fs (loop2): Test dummy encryption mode enabled [ 28.995513][ T501] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 29.008703][ T501] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 29.020102][ T501] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 211 vs 220 free clusters [ 29.034746][ T501] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2802: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 29.047897][ T501] EXT4-fs (loop2): 1 truncate cleaned up [ 29.053729][ T501] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 29.142134][ T294] EXT4-fs (loop2): unmounting filesystem. [ 29.234691][ T520] netlink: 32 bytes leftover after parsing attributes in process `syz.3.80'. [ 29.244713][ T520] device bridge_slave_0 left promiscuous mode [ 29.252023][ T520] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.264311][ T520] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 29.305229][ T524] loop0: detected capacity change from 0 to 256 [ 29.336328][ T524] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d) [ 29.454867][ T533] input: syz0 as /devices/virtual/input/input4 [ 29.504567][ T535] loop4: detected capacity change from 0 to 2048 [ 29.532294][ T546] TCP: tcp_parse_options: Illegal window scaling value 248 > 14 received [ 29.550218][ T535] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 29.557930][ T546] syz.0.91 (546) used greatest stack depth: 21408 bytes left [ 29.569249][ T43] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 29.587224][ T43] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 29.603914][ T43] EXT4-fs (loop4): This should not happen!! Data will be lost [ 29.603914][ T43] [ 29.614532][ T43] EXT4-fs (loop4): Total free blocks count 0 [ 29.622480][ T43] EXT4-fs (loop4): Free/Dirty block details [ 29.628765][ T43] EXT4-fs (loop4): free_blocks=4096 [ 29.634302][ T43] EXT4-fs (loop4): dirty_blocks=32 [ 29.641069][ T43] EXT4-fs (loop4): Block reservation details [ 29.647102][ T43] EXT4-fs (loop4): i_reserved_data_blocks=2 [ 29.656514][ T10] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 65537 with max blocks 1 with error 28 [ 29.693793][ T564] netlink: 'syz.0.101': attribute type 32 has an invalid length. [ 29.702836][ T566] netlink: 12 bytes leftover after parsing attributes in process `syz.4.93'. [ 29.741513][ T580] loop1: detected capacity change from 0 to 512 [ 29.762455][ T582] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 29.780998][ T580] EXT4-fs error (device loop1): ext4_orphan_get:1405: inode #15: comm syz.1.105: casefold flag without casefold feature [ 29.794849][ T580] EXT4-fs error (device loop1): ext4_orphan_get:1410: comm syz.1.105: couldn't read orphan inode 15 (err -117) [ 29.807643][ T582] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 29.821877][ T582] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 29.836708][ T580] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 29.848678][ T582] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 29.866732][ T582] EXT4-fs (loop0): This should not happen!! Data will be lost [ 29.866732][ T582] [ 29.877361][ T582] EXT4-fs (loop0): Total free blocks count 0 [ 29.883909][ T582] EXT4-fs (loop0): Free/Dirty block details [ 29.889998][ T582] EXT4-fs (loop0): free_blocks=20480 [ 29.895372][ T582] EXT4-fs (loop0): dirty_blocks=16 [ 29.900798][ T582] EXT4-fs (loop0): Block reservation details [ 29.906941][ T582] EXT4-fs (loop0): i_reserved_data_blocks=1 [ 29.913098][ T588] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 4 with max blocks 1 with error 28 [ 30.044793][ T606] netlink: 'syz.0.117': attribute type 12 has an invalid length. [ 30.053772][ T606] netlink: 24 bytes leftover after parsing attributes in process `syz.0.117'. [ 30.128679][ T309] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 30.321565][ T309] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 30.339094][ T309] usb 2-1: New USB device found, idVendor=046d, idProduct=c281, bcdDevice= 1.00 [ 30.358217][ T309] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.434100][ T615] F2FS-fs (loop4): Small segment_count (9 < 1 * 24) [ 30.440952][ T615] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 30.460427][ T615] F2FS-fs (loop4): Found nat_bits in checkpoint [ 30.522539][ T615] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 30.538517][ T615] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 30.578885][ T290] syz-executor: attempt to access beyond end of device [ 30.578885][ T290] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 30.587892][ T631] F2FS-fs (loop3): Corrupted extension count (64 + 1 > 64) [ 30.617887][ T631] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 30.624885][ T633] F2FS-fs (loop2): invalid crc value [ 30.645510][ T631] F2FS-fs (loop3): heap/no_heap options were deprecated [ 30.659477][ T631] F2FS-fs (loop3): invalid crc value [ 30.665604][ T633] F2FS-fs (loop2): Found nat_bits in checkpoint [ 30.672642][ T643] capability: warning: `syz.0.135' uses 32-bit capabilities (legacy support in use) [ 30.692109][ T631] F2FS-fs (loop3): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 30.750711][ T631] F2FS-fs (loop3): Try to recover 1th superblock, ret: -30 [ 30.758098][ T633] F2FS-fs (loop2): Start checkpoint disabled! [ 30.766107][ T631] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 30.774101][ T633] F2FS-fs (loop2): f2fs_disable_checkpoint() finish, err:0 [ 30.794514][ T633] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 30.994908][ T43] kworker/u4:2: attempt to access beyond end of device [ 30.994908][ T43] loop2: rw=1, sector=77824, nr_sectors = 8 limit=40427 [ 31.021026][ T43] kworker/u4:2: attempt to access beyond end of device [ 31.021026][ T43] loop2: rw=1, sector=77832, nr_sectors = 4088 limit=40427 [ 31.037756][ T43] kworker/u4:2: attempt to access beyond end of device [ 31.037756][ T43] loop2: rw=1, sector=49152, nr_sectors = 8 limit=40427 [ 31.064307][ T43] kworker/u4:2: attempt to access beyond end of device [ 31.064307][ T43] loop2: rw=1, sector=49160, nr_sectors = 4088 limit=40427 [ 31.081353][ T43] kworker/u4:2: attempt to access beyond end of device [ 31.081353][ T43] loop2: rw=1, sector=57344, nr_sectors = 8 limit=40427 [ 31.109686][ T43] kworker/u4:2: attempt to access beyond end of device [ 31.109686][ T43] loop2: rw=1, sector=57352, nr_sectors = 4064 limit=40427 [ 31.123885][ T670] device veth1_macvtap left promiscuous mode [ 31.179982][ T670] ipvlan1: renamed from macsec0 [ 31.222425][ T680] tap0: tun_chr_ioctl cmd 1074025677 [ 31.227829][ T680] tap0: linktype set to 769 [ 31.520531][ T708] set_capacity_and_notify: 5 callbacks suppressed [ 31.520544][ T708] loop4: detected capacity change from 0 to 512 [ 31.533855][ T708] EXT4-fs: Ignoring removed i_version option [ 31.540170][ T708] EXT4-fs: Ignoring removed oldalloc option [ 31.548061][ T708] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 31.564566][ T290] EXT4-fs (loop4): unmounting filesystem. [ 31.599076][ T715] netlink: 12 bytes leftover after parsing attributes in process `syz.4.165'. [ 31.627380][ T719] ip6_tunnel: non-ECT from fe88:0000:0000:0000:0000:0000:0000:0101 with DS=0x5 [ 31.732258][ T740] loop4: detected capacity change from 0 to 16 [ 31.742086][ T740] erofs: (device loop4): mounted with root inode @ nid 36. [ 31.751653][ T740] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop4 ino=46 [ 31.761262][ T740] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop4 ino=46 [ 31.770478][ T740] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop4 ino=46 [ 31.779634][ T740] overlayfs: failed to get redirect (-117) [ 31.978293][ T302] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 32.159315][ T302] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 32.170267][ T302] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 32.180050][ T302] usb 1-1: New USB device found, idVendor=1d34, idProduct=000a, bcdDevice= 0.00 [ 32.189137][ T302] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.198356][ T302] usb 1-1: config 0 descriptor?? [ 32.323979][ T749] netlink: 44 bytes leftover after parsing attributes in process `syz.3.180'. [ 32.333003][ T749] netlink: 'syz.3.180': attribute type 1 has an invalid length. [ 32.364056][ T753] loop3: detected capacity change from 0 to 512 [ 32.380696][ T753] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 32.389860][ T753] ext4 filesystem being mounted at /27/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 32.403371][ T753] EXT4-fs error (device loop3): ext4_acquire_dquot:6828: comm syz.3.182: Failed to acquire dquot type 0 [ 32.420675][ T292] EXT4-fs (loop3): unmounting filesystem. [ 32.477808][ T765] overlayfs: empty lowerdir [ 32.607430][ T302] hid-led 0003:1D34:000A.0001: unknown main item tag 0x0 [ 32.614715][ T302] hid-led 0003:1D34:000A.0001: unknown main item tag 0x0 [ 32.622045][ T302] hid-led 0003:1D34:000A.0001: item fetching failed at offset 2/3 [ 32.638539][ T302] hid-led: probe of 0003:1D34:000A.0001 failed with error -22 [ 32.747026][ T302] usb 2-1: USB disconnect, device number 2 [ 32.759160][ T288] EXT4-fs (loop1): unmounting filesystem. [ 32.841241][ T309] usb 1-1: USB disconnect, device number 3 [ 32.910032][ T797] netlink: 12 bytes leftover after parsing attributes in process `syz.4.202'. [ 32.953527][ T803] loop4: detected capacity change from 0 to 512 [ 32.968356][ T803] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 32.997036][ T803] EXT4-fs (loop4): failed to open journal device unknown-block(0,0) -6 [ 33.032817][ T28] kauditd_printk_skb: 74 callbacks suppressed [ 33.032833][ T28] audit: type=1400 audit(1791201439.498:241): avc: denied { setopt } for pid=802 comm="syz.4.205" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 33.107198][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 33.140784][ T28] audit: type=1400 audit(1791201439.608:242): avc: denied { map } for pid=819 comm="syz.2.212" path="socket:[18455]" dev="sockfs" ino=18455 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 33.164742][ T28] audit: type=1400 audit(1791201439.608:243): avc: denied { read write } for pid=819 comm="syz.2.212" path="socket:[18455]" dev="sockfs" ino=18455 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 33.242047][ T28] audit: type=1400 audit(1791201439.708:244): avc: denied { create } for pid=831 comm="syz.2.218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 33.263227][ T28] audit: type=1400 audit(1791201439.708:245): avc: denied { setopt } for pid=831 comm="syz.2.218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 33.283692][ T28] audit: type=1400 audit(1791201439.728:246): avc: denied { write } for pid=831 comm="syz.2.218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 33.290884][ T834] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 33.304650][ T28] audit: type=1400 audit(1791201439.728:247): avc: denied { read } for pid=831 comm="syz.2.218" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 33.312326][ T836] loop1: detected capacity change from 0 to 256 [ 33.330478][ T28] audit: type=1400 audit(1791201439.748:248): avc: denied { unlink } for pid=833 comm="syz.2.220" name="#1" dev="tmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 33.375134][ T836] exFAT-fs (loop1): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 33.394287][ T28] audit: type=1400 audit(1791201439.858:249): avc: denied { write } for pid=835 comm="syz.1.219" name="file2" dev="loop1" ino=1048646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 33.417413][ T28] audit: type=1400 audit(1791201439.878:250): avc: denied { open } for pid=835 comm="syz.1.219" name="file2" dev="loop1" ino=1048646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 33.439905][ T37] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 33.467563][ T851] loop1: detected capacity change from 0 to 512 [ 33.473132][ T853] Illegal XDP return value 4294967282 on prog (id 25) dev N/A, expect packet loss! [ 33.512850][ T851] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 33.524309][ T851] ext4 filesystem being mounted at /32/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 33.562231][ T288] EXT4-fs (loop1): unmounting filesystem. [ 33.629590][ T37] usb 5-1: unable to get BOS descriptor or descriptor too short [ 33.642260][ T37] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 33.659469][ T37] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 33.697134][ T37] usb 5-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 33.716517][ T37] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.724819][ T37] usb 5-1: Product: syz [ 33.734727][ T37] usb 5-1: Manufacturer: syz [ 33.745299][ T37] usb 5-1: SerialNumber: syz [ 33.870941][ T914] loop0: detected capacity change from 0 to 128 [ 33.902939][ T918] syzkaller1: tun_chr_ioctl cmd 1074025675 [ 33.908960][ T918] syzkaller1: persist disabled [ 33.913261][ T914] EXT4-fs (loop0): Test dummy encryption mode enabled [ 33.925648][ T914] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 33.934957][ T914] ext4 filesystem being mounted at /51/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 33.949046][ T914] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 33.971938][ T37] usb 5-1: selecting invalid altsetting 1 [ 33.977944][ T37] usb 5-1: unit 3 not found! [ 33.983297][ T287] EXT4-fs (loop0): unmounting filesystem. [ 33.985979][ T37] usb 5-1: unit 6 not found! [ 34.013989][ T485] wiimote 0005:057E:0330.0002: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 34.027664][ T485] wiimote 0005:057E:0330.0002: New device registered [ 34.185730][ T37] snd-usb-audio: probe of 5-1:1.0 failed with error -22 [ 34.202109][ T941] udevd[941]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 34.288196][ T302] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 34.331595][ T948] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 34.339463][ T948] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 34.347261][ T948] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 34.355115][ T948] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 34.362924][ T948] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 34.370750][ T948] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 34.378556][ T948] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 34.386252][ T37] usb 5-1: USB disconnect, device number 2 [ 34.386355][ T948] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 34.400081][ T948] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 34.407870][ T948] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 34.479413][ T302] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 34.506412][ T302] usb 2-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 34.535417][ T936] loop3: detected capacity change from 0 to 131072 [ 34.546870][ T302] usb 2-1: config 0 interface 0 has no altsetting 0 [ 34.554551][ T302] usb 2-1: New USB device found, idVendor=046d, idProduct=c50c, bcdDevice= 0.00 [ 34.559380][ T936] F2FS-fs (loop3): invalid crc value [ 34.564428][ T302] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.588091][ T302] usb 2-1: config 0 descriptor?? [ 34.595671][ T932] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 34.608571][ T936] F2FS-fs (loop3): Found nat_bits in checkpoint [ 34.642946][ T936] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 34.809704][ T965] tap0: tun_chr_ioctl cmd 2147767507 [ 34.815575][ T932] wiimote 0005:057E:0330.0002: Event data for report 34 was too short (31 vs 2) [ 34.825946][ T931] wiimote 0005:057E:0330.0002: Device removed [ 34.827528][ T302] usbhid 2-1:0.0: can't add hid device: -71 [ 34.838097][ T302] usbhid: probe of 2-1:0.0 failed with error -71 [ 34.846924][ T302] usb 2-1: USB disconnect, device number 3 [ 34.884175][ T969] netlink: 76 bytes leftover after parsing attributes in process `syz.3.273'. [ 34.919327][ T975] loop3: detected capacity change from 0 to 256 [ 34.921133][ T977] netlink: 12 bytes leftover after parsing attributes in process `syz.4.277'. [ 35.098219][ T485] wiimote 0005:057E:0330.0002: detected device: Nintendo Wii Remote Plus (Gen 2) [ 35.111946][ T485] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.0002/input/input7 [ 35.124528][ T485] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.0002/input/input8 [ 35.139639][ T485] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.0002/input/input6 [ 35.491557][ T986] loop0: detected capacity change from 0 to 256 [ 35.503583][ T986] exFAT-fs (loop0): failed to load upcase table (idx : 0x00011f3e, chksum : 0x0ed7c45e, utbl_chksum : 0xe619d30d) [ 35.576006][ T992] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 35.589289][ T992] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 35.598424][ T992] FAT-fs (loop0): Filesystem has been set read-only [ 35.605423][ T992] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 35.614906][ T992] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 35.625581][ T992] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 35.634674][ T992] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 35.643843][ T992] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 35.652939][ T992] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 35.662081][ T992] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 35.671106][ T992] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 35.680004][ T992] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 35.867926][ T1015] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0xda218cab, utbl_chksum : 0xe619d30d) [ 35.880781][ T1017] device erspan0 entered promiscuous mode [ 35.930111][ T6] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 35.947213][ T1023] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x205ad3fc, utbl_chksum : 0xe619d30d) [ 36.119332][ T6] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.138258][ T6] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.149153][ T6] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 36.162650][ T6] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2c2e, bcdDevice= 0.00 [ 36.173368][ T6] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.183222][ T6] usb 3-1: config 0 descriptor?? [ 36.346752][ T1043] F2FS-fs (loop3): invalid crc value [ 36.369182][ T1043] F2FS-fs (loop3): Found nat_bits in checkpoint [ 36.433914][ T1043] F2FS-fs (loop3): Start checkpoint disabled! [ 36.443943][ T1043] F2FS-fs (loop3): f2fs_disable_checkpoint() finish, err:0 [ 36.458554][ T1043] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 36.511579][ T1047] EXT4-fs: Ignoring removed nobh option [ 36.531904][ T1047] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 36.542783][ T1047] ext4 filesystem being mounted at /64/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 36.604404][ T221] bio_check_eod: 1 callbacks suppressed [ 36.604424][ T221] kworker/u4:3: attempt to access beyond end of device [ 36.604424][ T221] loop3: rw=1, sector=77824, nr_sectors = 8 limit=40427 [ 36.606004][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.616549][ T221] kworker/u4:3: attempt to access beyond end of device [ 36.616549][ T221] loop3: rw=1, sector=77832, nr_sectors = 2376 limit=40427 [ 36.624715][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.636189][ T221] kworker/u4:3: attempt to access beyond end of device [ 36.636189][ T221] loop3: rw=1, sector=80208, nr_sectors = 1712 limit=40427 [ 36.645581][ T287] EXT4-fs (loop0): unmounting filesystem. [ 36.652288][ T221] kworker/u4:3: attempt to access beyond end of device [ 36.652288][ T221] loop3: rw=1, sector=49152, nr_sectors = 8 limit=40427 [ 36.665674][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.681880][ T221] kworker/u4:3: attempt to access beyond end of device [ 36.681880][ T221] loop3: rw=1, sector=49160, nr_sectors = 4088 limit=40427 [ 36.684886][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.693212][ T221] kworker/u4:3: attempt to access beyond end of device [ 36.693212][ T221] loop3: rw=1, sector=57344, nr_sectors = 8 limit=40427 [ 36.705526][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.722734][ T221] kworker/u4:3: attempt to access beyond end of device [ 36.722734][ T221] loop3: rw=1, sector=57352, nr_sectors = 4064 limit=40427 [ 36.726081][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.734432][ T221] kworker/u4:3: attempt to access beyond end of device [ 36.734432][ T221] loop3: rw=2049, sector=40960, nr_sectors = 24 limit=40427 [ 36.746725][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.773997][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.780767][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.790304][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.797090][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.803925][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.811366][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.818489][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.825268][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.832598][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.845471][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.852652][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.859727][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.867901][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.874994][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.882054][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.889329][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.896073][ T6] lua 0003:1E7D:2C2E.0003: unknown main item tag 0x0 [ 36.904784][ T6] lua 0003:1E7D:2C2E.0003: hidraw1: USB HID v0.00 Device [HID 1e7d:2c2e] on usb-dummy_hcd.2-1/input0 [ 36.921641][ T6] usb 3-1: USB disconnect, device number 2 [ 36.955384][ T1064] fido_id[1064]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 37.029056][ T1070] netlink: 36 bytes leftover after parsing attributes in process `syz.0.317'. [ 37.139661][ T1079] MTRR 1 not used [ 37.274506][ T1098] netlink: 8 bytes leftover after parsing attributes in process `syz.3.332'. [ 37.283439][ T1098] netlink: 16 bytes leftover after parsing attributes in process `syz.3.332'. [ 37.459062][ T1139] netlink: 4 bytes leftover after parsing attributes in process `syz.0.351'. [ 37.468519][ T1139] device bridge_slave_1 left promiscuous mode [ 37.477141][ T1139] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.485614][ T1139] device bridge_slave_0 left promiscuous mode [ 37.492040][ T1139] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.618287][ T24] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 37.630677][ T1163] set_capacity_and_notify: 5 callbacks suppressed [ 37.630695][ T1163] loop0: detected capacity change from 0 to 256 [ 37.641376][ T1165] loop2: detected capacity change from 0 to 2048 [ 37.671461][ T1165] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 37.680320][ T1165] ext4 filesystem being mounted at /64/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 37.693494][ T1165] fs-verity (loop2, inode 13): Unknown hash algorithm number: 31 [ 37.706368][ T294] EXT4-fs (loop2): unmounting filesystem. [ 37.829250][ T24] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 37.843725][ T24] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 37.858265][ T1005] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 37.870941][ T24] usb 4-1: New USB device found, idVendor=0cf2, idProduct=6250, bcdDevice= 0.00 [ 37.888180][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.904806][ T24] usb 4-1: Product: syz [ 37.913368][ T24] usb 4-1: Manufacturer: syz [ 37.922311][ T24] usb 4-1: SerialNumber: syz [ 37.939653][ T24] usb-storage 4-1:1.0: USB Mass Storage device detected [ 37.997171][ T1178] loop2: detected capacity change from 0 to 40427 [ 38.010476][ T1178] F2FS-fs (loop2): invalid crc value [ 38.026361][ T1178] F2FS-fs (loop2): Found nat_bits in checkpoint [ 39.258128][ C0] sched: RT throttling activated [ 39.269275][ T1005] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.271705][ T1178] F2FS-fs (loop2): Start checkpoint disabled! [ 39.280300][ T1005] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 39.286735][ T1178] F2FS-fs (loop2): f2fs_disable_checkpoint() finish, err:0 [ 39.296374][ T1005] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 39.303589][ T1178] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 39.323148][ T1005] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2c2e, bcdDevice= 0.00 [ 39.334929][ T1005] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.344297][ T1005] usb 5-1: config 0 descriptor?? [ 39.405349][ T28] kauditd_printk_skb: 42 callbacks suppressed [ 39.405360][ T28] audit: type=1400 audit(1791201445.868:293): avc: denied { shutdown } for pid=1188 comm="syz.2.369" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 39.628218][ T24] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 39.755944][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.762729][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.769618][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.776354][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.783361][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.790826][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.798368][ T37] usb 4-1: USB disconnect, device number 2 [ 39.800086][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.813369][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.820289][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.827008][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.834115][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.841321][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.841405][ T24] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 39.848609][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.865230][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.872180][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.872185][ T24] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 39.888200][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.894923][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.898212][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 39.908208][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.911190][ T24] usb 1-1: SerialNumber: syz [ 39.916913][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.928883][ T24] cdc_ether 1-1:1.0: skipping garbage [ 39.934381][ T24] usb 1-1: bad CDC descriptors [ 39.938207][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.945877][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.955075][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.967565][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.974677][ T1005] lua 0003:1E7D:2C2E.0004: unknown main item tag 0x0 [ 39.988343][ T1005] lua 0003:1E7D:2C2E.0004: hidraw1: USB HID v0.00 Device [HID 1e7d:2c2e] on usb-dummy_hcd.4-1/input0 [ 40.013047][ T1005] usb 5-1: USB disconnect, device number 3 [ 40.042797][ T1195] fido_id[1195]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 40.146505][ T37] usb 1-1: USB disconnect, device number 4 [ 40.277231][ T28] audit: type=1400 audit(1791201446.738:294): avc: denied { create } for pid=1204 comm="syz.2.377" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 40.297700][ T28] audit: type=1400 audit(1791201446.748:295): avc: denied { setopt } for pid=1204 comm="syz.2.377" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 40.320988][ T28] audit: type=1400 audit(1791201446.748:296): avc: denied { bind } for pid=1204 comm="syz.2.377" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 40.429432][ T1214] loop2: detected capacity change from 0 to 512 [ 40.444834][ T1214] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 40.453111][ T1214] System zones: 1-12 [ 40.458626][ T1214] EXT4-fs error (device loop2): ext4_xattr_inode_iget:401: inode #12: comm syz.2.381: missing EA_INODE flag [ 40.470550][ T1214] EXT4-fs error (device loop2): ext4_xattr_inode_iget:406: comm syz.2.381: error while reading EA inode 12 err=-117 [ 40.483059][ T1214] EXT4-fs (loop2): 1 orphan inode deleted [ 40.488975][ T1214] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 40.519116][ T294] EXT4-fs (loop2): unmounting filesystem. [ 40.539158][ T28] audit: type=1400 audit(1791201447.008:297): avc: denied { getopt } for pid=1216 comm="syz.2.382" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 40.618767][ T1225] loop4: detected capacity change from 0 to 128 [ 40.649100][ T1225] FAT-fs (loop4): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 42.303275][ T741] FAT-fs (loop4): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 42.328619][ T1221] loop2: detected capacity change from 0 to 40427 [ 42.337266][ T1221] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 42.345421][ T1221] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 42.354849][ T1221] F2FS-fs (loop2): invalid crc value [ 42.385275][ T1221] F2FS-fs (loop2): Found nat_bits in checkpoint [ 42.432133][ T28] audit: type=1400 audit(1791201448.898:298): avc: denied { name_bind } for pid=1241 comm="syz.0.393" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 42.453329][ T1221] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 42.464211][ T1221] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 42.496707][ T1251] loop0: detected capacity change from 0 to 256 [ 42.523244][ T1251] exfat: Deprecated parameter 'utf8' [ 42.536737][ T1251] exfat: Deprecated parameter 'namecase' [ 42.548191][ T1251] exfat: Deprecated parameter 'utf8' [ 42.562473][ T1251] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xb89b369d, utbl_chksum : 0xe619d30d) [ 42.562582][ T1255] syz.3.398 (1255): drop_caches: 2 [ 42.624713][ T1251] exFAT-fs (loop0): hint_cluster is invalid (1) [ 42.644939][ T1251] exFAT-fs (loop0): error, invalid access to exfat cache (entry 0x00000000) [ 42.665689][ T1251] exFAT-fs (loop0): error, failed to bmap (inode : ffff88813b16ae30 iblock : 9, err : -5) [ 42.687767][ T1251] syz.0.396: attempt to access beyond end of device [ 42.687767][ T1251] loop0: rw=2049, sector=34359738488, nr_sectors = 8 limit=256 [ 42.690510][ T28] audit: type=1400 audit(1791201449.148:299): avc: denied { rename } for pid=1250 comm="syz.0.396" name="file0" dev="loop0" ino=1048668 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 42.751504][ T1259] kvm [1258]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x1d9) = 0x2 [ 43.004387][ T1279] netlink: 72 bytes leftover after parsing attributes in process `syz.3.408'. [ 43.027499][ T1279] netlink: 12 bytes leftover after parsing attributes in process `syz.3.408'. [ 43.055424][ T1279] netlink: 20 bytes leftover after parsing attributes in process `syz.3.408'. [ 43.079623][ T1279] netlink: 20 bytes leftover after parsing attributes in process `syz.3.408'. [ 43.136443][ T28] audit: type=1400 audit(1791201449.598:300): avc: denied { search } for pid=1280 comm="syz.3.409" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 43.189203][ T1285] syz.3.411 (1285): /proc/1284/oom_adj is deprecated, please use /proc/1284/oom_score_adj instead. [ 43.303162][ T1295] kvm [1294]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x1d9) = 0x2 [ 43.381351][ T309] logitech-hidpp-device 0005:046D:B012.0005: Device not connected [ 43.408419][ T28] audit: type=1400 audit(1791201449.878:301): avc: denied { accept } for pid=1307 comm="syz.3.421" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 43.693629][ T1338] loop3: detected capacity change from 0 to 512 [ 43.760733][ T1339] syz.4.434 (1339): drop_caches: 2 [ 43.814752][ T1347] loop4: detected capacity change from 0 to 512 [ 43.883796][ T28] audit: type=1400 audit(1791201450.348:302): avc: denied { setopt } for pid=1357 comm="syz.2.442" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 44.122630][ T1371] syz.0.449 (1371): drop_caches: 2 [ 44.234872][ T1364] loop4: detected capacity change from 0 to 40427 [ 44.242496][ T1364] F2FS-fs (loop4): invalid crc value [ 44.270300][ T1364] F2FS-fs (loop4): Found nat_bits in checkpoint [ 44.302888][ T1399] loop0: detected capacity change from 0 to 512 [ 44.336828][ T1364] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 44.404671][ T1399] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 44.422787][ T1399] ext4 filesystem being mounted at /106/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 44.438586][ T1408] netlink: 8 bytes leftover after parsing attributes in process `syz.3.463'. [ 44.459930][ T1411] loop1: detected capacity change from 0 to 256 [ 44.488404][ T28] kauditd_printk_skb: 5 callbacks suppressed [ 44.488453][ T28] audit: type=1400 audit(1791201450.948:308): avc: denied { connect } for pid=1412 comm="syz.3.465" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 44.496616][ T287] EXT4-fs (loop0): unmounting filesystem. [ 44.514201][ T28] audit: type=1400 audit(1791201450.948:309): avc: denied { write } for pid=1412 comm="syz.3.465" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 44.537484][ T1411] logitech-hidpp-device 0005:046D:B012.0006: received hid++ report of bad size (4096) [ 44.570640][ T485] logitech-hidpp-device 0005:046D:B012.0006: Device not connected [ 44.581389][ T1417] syz.2.467 (1417): drop_caches: 2 [ 44.632034][ T1419] loop1: detected capacity change from 0 to 4096 [ 44.642138][ T1426] netlink: 104 bytes leftover after parsing attributes in process `syz.0.477'. [ 44.655179][ T1429] loop2: detected capacity change from 0 to 256 [ 44.667927][ T1419] EXT4-fs (loop1): Test dummy encryption mode enabled [ 44.676719][ T28] audit: type=1400 audit(1791201451.138:310): avc: denied { create } for pid=1430 comm="syz.4.473" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 44.702580][ T1429] exFAT-fs (loop2): failed to load upcase table (idx : 0x0001fe89, chksum : 0xc232f927, utbl_chksum : 0xe619d30d) [ 44.712266][ T28] audit: type=1400 audit(1791201451.168:311): avc: denied { setopt } for pid=1430 comm="syz.4.473" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 44.717834][ T1419] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 44.749280][ T28] audit: type=1400 audit(1791201451.218:312): avc: denied { read write } for pid=1437 comm="syz.0.476" name="fuse" dev="devtmpfs" ino=93 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 44.752442][ T1436] netlink: 16 bytes leftover after parsing attributes in process `syz.4.475'. [ 44.776574][ T28] audit: type=1400 audit(1791201451.218:313): avc: denied { open } for pid=1437 comm="syz.0.476" path="/dev/fuse" dev="devtmpfs" ino=93 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 44.804826][ T28] audit: type=1400 audit(1791201451.258:314): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 44.853608][ T288] EXT4-fs (loop1): unmounting filesystem. [ 44.887177][ T485] kernel write not supported for file /input/event2 (pid: 485 comm: kworker/0:3) [ 44.941457][ T1448] loop0: detected capacity change from 0 to 256 [ 44.956970][ T1448] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d) [ 45.003260][ T1455] loop0: detected capacity change from 0 to 512 [ 45.012516][ T1457] loop1: detected capacity change from 0 to 256 [ 45.026661][ T1455] FAT-fs (loop0): Unrecognized mount option "erzors=continue" or missing value [ 45.176702][ T28] audit: type=1400 audit(1791201451.638:315): avc: denied { mounton } for pid=1466 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 45.292286][ T1466] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.318260][ T1466] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.336097][ T1466] device bridge_slave_0 entered promiscuous mode [ 45.345867][ T1466] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.353301][ T1466] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.361932][ T1466] device bridge_slave_1 entered promiscuous mode [ 45.374358][ T28] audit: type=1400 audit(1791201451.838:316): avc: denied { read } for pid=1480 comm="syz.1.498" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 45.413463][ T28] audit: type=1400 audit(1791201451.878:317): avc: denied { mounton } for pid=1483 comm="syz.3.499" path="/115/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 45.497242][ T1466] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.504461][ T1466] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.511778][ T1466] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.518846][ T1466] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.565477][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 45.584727][ T741] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.598851][ T741] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.617197][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 45.627281][ T741] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.634383][ T741] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.643595][ T43] device bridge_slave_1 left promiscuous mode [ 45.653170][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.665347][ T43] device bridge_slave_0 left promiscuous mode [ 45.676067][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.688952][ T43] device veth1_macvtap left promiscuous mode [ 45.698378][ T43] device veth0_vlan left promiscuous mode [ 45.852417][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 45.863991][ T741] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.871093][ T741] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.904123][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 45.919268][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 45.936825][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 45.965385][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 45.995111][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 46.011495][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 46.031884][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 46.056926][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 46.086626][ T1466] device veth0_vlan entered promiscuous mode [ 46.103879][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 46.128882][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 46.144620][ T1512] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 46.152882][ T1466] device veth1_macvtap entered promiscuous mode [ 46.165965][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 46.166466][ T1512] ext4 filesystem being mounted at /115/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 46.182201][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 46.202848][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 46.210978][ T287] EXT4-fs (loop0): unmounting filesystem. [ 46.219948][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 46.230663][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 46.252028][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 46.270725][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 46.324064][ T1524] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 46.341067][ T1524] overlayfs: overlapping lowerdir path [ 46.362770][ T1528] process 'syz.5.516' launched '/dev/fd/3' with NULL argv: empty string added [ 46.665464][ T1568] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0x4ec6003b, utbl_chksum : 0xe619d30d) [ 46.705904][ T1569] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 46.726754][ T1569] ext4 filesystem being mounted at /60/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 46.768618][ T1577] EXT4-fs: Ignoring removed nobh option [ 46.776332][ T1577] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 46.814162][ T941] udevd[941]: symlink '../../loop1' '/dev/disk/by-label/syzkaller.tmp-b7:1' failed: Read-only file system [ 46.814214][ T1577] EXT4-fs (loop4): 1 truncate cleaned up [ 46.830680][ T1569] EXT4-fs: Remounting file system with no journal so ignoring journalled data option [ 46.840818][ T1577] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 46.864581][ T736] udevd[736]: symlink '../../loop3' '/dev/disk/by-diskseq/157.tmp-b7:3' failed: Read-only file system [ 46.889549][ T1585] FAT-fs (loop3): Directory bread(block 64) failed [ 46.899125][ T1577] EXT4-fs warning (device loop4): verify_group_input:151: Cannot add at group 4227069 (only 1 groups) [ 46.911923][ T1569] EXT4-fs: Cannot change journaled quota options when quota turned on [ 46.928267][ T1585] FAT-fs (loop3): Directory bread(block 65) failed [ 46.932741][ T941] udevd[941]: symlink '../../loop3' '/dev/disk/by-diskseq/157.tmp-b7:3' failed: Read-only file system [ 46.937077][ T1585] FAT-fs (loop3): Directory bread(block 66) failed [ 46.967321][ T288] EXT4-fs (loop1): unmounting filesystem. [ 46.974064][ T290] EXT4-fs (loop4): unmounting filesystem. [ 46.982270][ T1585] FAT-fs (loop3): Directory bread(block 67) failed [ 46.996599][ T1585] FAT-fs (loop3): Directory bread(block 68) failed [ 46.996699][ T941] udevd[941]: symlink '../../loop1' '/dev/disk/by-label/syzkaller.tmp-b7:4' failed: Read-only file system [ 47.011919][ T1585] FAT-fs (loop3): Directory bread(block 69) failed [ 47.031224][ T1585] FAT-fs (loop3): Directory bread(block 70) failed [ 47.062773][ T1585] FAT-fs (loop3): Directory bread(block 71) failed [ 47.074575][ T941] udevd[941]: symlink '../../loop1' '/dev/disk/by-diskseq/160.tmp-b7:1' failed: Read-only file system [ 47.081362][ T1585] FAT-fs (loop3): Directory bread(block 72) failed [ 47.109468][ T941] udevd[941]: symlink '../../loop1' '/dev/disk/by-label/SYZKALLER.tmp-b7:1' failed: Read-only file system [ 47.128196][ T1585] FAT-fs (loop3): Directory bread(block 73) failed [ 47.154790][ T941] udevd[941]: symlink '../../loop1' '/dev/disk/by-uuid/1DC8-5927.tmp-b7:1' failed: Read-only file system [ 47.193221][ T941] udevd[941]: symlink '../../loop1' '/dev/disk/by-diskseq/160.tmp-b7:1' failed: Read-only file system [ 47.321670][ T941] udevd[941]: symlink '../../loop1' '/dev/disk/by-diskseq/160.tmp-b7:1' failed: Read-only file system [ 47.353602][ T736] udevd[736]: symlink '../../loop3' '/dev/disk/by-diskseq/157.tmp-b7:3' failed: Read-only file system [ 47.573391][ T1625] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 47.597664][ T1530] F2FS-fs (loop5): Test dummy encryption mode enabled [ 47.613640][ T1530] F2FS-fs (loop5): invalid crc value [ 47.686684][ T1530] F2FS-fs (loop5): Found nat_bits in checkpoint [ 47.717535][ T1648] netlink: 12 bytes leftover after parsing attributes in process `syz.3.570'. [ 47.760620][ T1530] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 47.789262][ T1658] Zero length message leads to an empty skb [ 48.288204][ T309] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 48.479289][ T309] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 48.504584][ T309] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 48.524884][ T309] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 48.542445][ T309] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 48.551888][ T309] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 48.558737][ T1705] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 48.561346][ T309] usb 5-1: config 0 descriptor?? [ 48.598296][ T1705] ext4 filesystem being mounted at /5/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 48.618844][ T1711] device-mapper: ioctl: ioctl interface mismatch: kernel(4.47.0), user(0.0.0), cmd(3) [ 48.646792][ T1705] fscrypt (loop5, inode 12): Unsupported encryption modes (contents 0, filenames 0) [ 48.711439][ T1466] EXT4-fs (loop5): unmounting filesystem. [ 48.773619][ T1721] set_capacity_and_notify: 11 callbacks suppressed [ 48.773657][ T1721] loop5: detected capacity change from 0 to 16 [ 48.828354][ T1721] erofs: (device loop5): mounted with root inode @ nid 36. [ 48.933636][ T1678] loop3: detected capacity change from 0 to 131072 [ 48.949007][ T1678] F2FS-fs (loop3): invalid crc value [ 48.981633][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.996088][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.996774][ T1678] F2FS-fs (loop3): Found nat_bits in checkpoint [ 49.028861][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.036302][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.058282][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.065747][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.088463][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.091191][ T1678] F2FS-fs (loop3): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. [ 49.095890][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.138186][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.145641][ T1678] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 49.153217][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.168201][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.175627][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.198451][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.205887][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.228197][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.238158][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.245595][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.278205][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.285651][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.308439][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.315865][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.338206][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.348188][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.355604][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.378723][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.390923][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.408185][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.428264][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.435712][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.458172][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.465602][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.488173][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.495604][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.518188][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.525628][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.548176][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.555615][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.578260][ T309] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 49.585901][ T309] plantronics 0003:047F:FFFF.0007: No inputs registered, leaving [ 49.589544][ T1739] FAULT_INJECTION: forcing a failure. [ 49.589544][ T1739] name failslab, interval 1, probability 0, space 0, times 1 [ 49.610617][ T309] plantronics 0003:047F:FFFF.0007: hiddev96,hidraw0: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 49.624685][ T1739] CPU: 0 PID: 1739 Comm: syz.3.607 Not tainted syzkaller #0 [ 49.632012][ T1739] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 49.642129][ T1739] Call Trace: [ 49.645433][ T1739] [ 49.648386][ T1739] __dump_stack+0x21/0x24 [ 49.650784][ T309] usb 5-1: USB disconnect, device number 4 [ 49.652777][ T1739] dump_stack_lvl+0x110/0x170 [ 49.663270][ T1739] ? __cfi_dump_stack_lvl+0x8/0x8 [ 49.668375][ T1739] ? stack_trace_save+0xa6/0xf0 [ 49.673286][ T1739] ? __stack_depot_save+0x36/0x490 [ 49.678450][ T1739] dump_stack+0x15/0x24 [ 49.682642][ T1739] should_fail_ex+0x3bf/0x510 [ 49.686255][ T1740] fido_id[1740]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 49.687422][ T1739] __should_failslab+0xac/0xf0 [ 49.706344][ T1739] should_failslab+0x9/0x20 [ 49.710886][ T1739] slab_pre_alloc_hook+0x30/0x1d0 [ 49.715955][ T1739] kmem_cache_alloc_lru+0x49/0x280 [ 49.721140][ T1739] ? __d_alloc+0x34/0x6d0 [ 49.725506][ T1739] __d_alloc+0x34/0x6d0 [ 49.729694][ T1739] d_alloc_pseudo+0x1d/0x70 [ 49.734226][ T1739] alloc_file_pseudo+0xe0/0x200 [ 49.739107][ T1739] ? __cfi_alloc_file_pseudo+0x10/0x10 [ 49.744598][ T1739] ? _raw_spin_unlock+0x4c/0x70 [ 49.749485][ T1739] anon_inode_getfile+0xa6/0x180 [ 49.751652][ T1715] loop1: detected capacity change from 0 to 131072 [ 49.754485][ T1739] do_epoll_create+0x26d/0x350 [ 49.765763][ T1739] __x64_sys_epoll_create1+0x37/0x40 [ 49.771079][ T1739] x64_sys_call+0x346/0x9a0 [ 49.775614][ T1739] do_syscall_64+0x4c/0xa0 [ 49.779278][ T1715] F2FS-fs (loop1): Test dummy encryption mode enabled [ 49.780055][ T1739] ? clear_bhb_loop+0x30/0x80 [ 49.791488][ T1739] ? clear_bhb_loop+0x30/0x80 [ 49.796198][ T1739] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 49.802126][ T1739] RIP: 0033:0x7fbfdfb9e199 [ 49.806570][ T1739] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 49.809434][ T1715] F2FS-fs (loop1): invalid crc value [ 49.826197][ T1739] RSP: 002b:00007fbfe0a5c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000123 [ 49.826226][ T1739] RAX: ffffffffffffffda RBX: 00007fbfdfe25fa0 RCX: 00007fbfdfb9e199 [ 49.826242][ T1739] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000080000 [ 49.855912][ T1739] RBP: 00007fbfdfc350b8 R08: 0000000000000000 R09: 0000000000000000 [ 49.863914][ T1739] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 49.871914][ T1739] R13: 00007fbfdfe26038 R14: 00007fbfdfe25fa0 R15: 00007fff38aff398 [ 49.879917][ T1739] [ 49.909003][ T1715] F2FS-fs (loop1): Found nat_bits in checkpoint [ 49.991973][ T1715] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 50.022409][ T1757] loop0: detected capacity change from 0 to 1024 [ 50.028242][ T28] kauditd_printk_skb: 14 callbacks suppressed [ 50.028259][ T28] audit: type=1400 audit(1791201456.488:332): avc: denied { create } for pid=1758 comm="syz.3.614" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 50.045672][ T1728] loop5: detected capacity change from 0 to 131072 [ 50.063494][ T1757] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 50.094958][ T1728] F2FS-fs (loop5): Invalid segment/section count (458783, 24 x 150994945) [ 50.096712][ T1715] fscrypt: AES-256-XTS using blk-crypto-fallback [ 50.105310][ T1728] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 50.110698][ T28] audit: type=1400 audit(1791201456.528:333): avc: denied { ioctl } for pid=1758 comm="syz.3.614" path="socket:[22650]" dev="sockfs" ino=22650 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 50.149734][ T1728] F2FS-fs (loop5): invalid crc value [ 50.150984][ T1757] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 50.179579][ T1769] netlink: 4 bytes leftover after parsing attributes in process `syz.3.618'. [ 50.209987][ T1769] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.229413][ T1728] F2FS-fs (loop5): Found nat_bits in checkpoint [ 50.240213][ T1769] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.317009][ T287] EXT4-fs (loop0): unmounting filesystem. [ 50.333893][ T1763] loop4: detected capacity change from 0 to 40427 [ 50.348263][ T1728] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 50.355340][ T1728] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e4 [ 50.369325][ T1763] F2FS-fs (loop4): invalid crc value [ 50.417590][ T1763] F2FS-fs (loop4): Found nat_bits in checkpoint [ 50.464055][ T28] audit: type=1400 audit(1791201456.928:334): avc: denied { mount } for pid=1784 comm="syz.3.623" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 50.509499][ T28] audit: type=1400 audit(1791201456.968:335): avc: denied { ioctl } for pid=1727 comm="syz.5.604" path="/10/file1/bus" dev="loop5" ino=10 ioctlcmd=0xf50d scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 50.542564][ T28] audit: type=1400 audit(1791201456.978:336): avc: denied { unmount } for pid=292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 50.579138][ T1763] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 50.827601][ T1795] netlink: 4 bytes leftover after parsing attributes in process `syz.1.630'. [ 50.851417][ T290] syz-executor: attempt to access beyond end of device [ 50.851417][ T290] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 50.928670][ T1788] loop0: detected capacity change from 0 to 40427 [ 50.946653][ T1788] F2FS-fs (loop0): Corrupted extension count (64 + 1 > 64) [ 50.978237][ T1788] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 50.998324][ T1788] F2FS-fs (loop0): Image doesn't support compression [ 51.005066][ T1788] F2FS-fs (loop0): Image doesn't support compression [ 51.045882][ T1788] F2FS-fs (loop0): invalid crc value [ 51.068935][ T1788] F2FS-fs (loop0): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 51.078326][ T1796] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.119120][ T1796] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.125300][ T1811] syz.4.635 uses obsolete (PF_INET,SOCK_PACKET) [ 51.133956][ T1788] F2FS-fs (loop0): Start checkpoint disabled! [ 51.139779][ T1796] device bridge_slave_0 entered promiscuous mode [ 51.150469][ T1788] F2FS-fs (loop0): f2fs_disable_checkpoint() finish, err:0 [ 51.166111][ T1796] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.173528][ T1788] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 51.175286][ T1796] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.188171][ T1788] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 51.238410][ T1796] device bridge_slave_1 entered promiscuous mode [ 51.283057][ T1819] loop1: detected capacity change from 0 to 512 [ 51.324642][ T221] device veth0_vlan left promiscuous mode [ 51.341264][ T1819] EXT4-fs (loop1): 1 orphan inode deleted [ 51.355031][ T1819] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 51.364068][ T8] Quota error (device loop1): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 51.364114][ T8] EXT4-fs error (device loop1): ext4_release_dquot:6864: comm kworker/u4:0: Failed to release dquot type 1 [ 51.435912][ T1812] loop5: detected capacity change from 0 to 40427 [ 51.442555][ T1819] ext4 filesystem being mounted at /83/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 51.499108][ T288] EXT4-fs (loop1): unmounting filesystem. [ 51.520401][ T1830] binder: 1829:1830 ioctl c0306201 0 returned -14 [ 51.596185][ T1837] Invalid argument reading file caps for ./file0 [ 51.630575][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 51.638786][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 51.663158][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 51.677000][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 51.686520][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.693614][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.701794][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 51.715847][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 51.729482][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.736598][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.770057][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 51.773770][ T1842] loop0: detected capacity change from 0 to 512 [ 51.778095][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 51.793782][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 51.820161][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 51.840105][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 51.852685][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 51.874598][ T1847] netlink: 8 bytes leftover after parsing attributes in process `syz.0.649'. [ 51.882435][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 51.895134][ T1796] device veth0_vlan entered promiscuous mode [ 51.920098][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 51.943061][ T1796] device veth1_macvtap entered promiscuous mode [ 51.968470][ T1849] FAT-fs (loop0): error, fat_get_cluster: detected the cluster chain loop (i_pos 1) [ 51.980408][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 51.988331][ T1849] FAT-fs (loop0): Filesystem has been set read-only [ 51.995941][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 52.012079][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 52.028544][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 52.096275][ T1856] FAT-fs (loop4): Directory bread(block 64) failed [ 52.113476][ T1849] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 52.119437][ T1856] FAT-fs (loop4): Directory bread(block 65) failed [ 52.126146][ T1849] EXT4-fs (loop0): 1 truncate cleaned up [ 52.136273][ T1849] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 52.152865][ T1849] EXT4-fs warning (device loop0): ext4_group_add:1743: No reserved GDT blocks, can't resize [ 52.158712][ T1856] FAT-fs (loop4): Directory bread(block 66) failed [ 52.186052][ T1856] FAT-fs (loop4): Directory bread(block 67) failed [ 52.192930][ T1856] FAT-fs (loop4): Directory bread(block 68) failed [ 52.194965][ T287] EXT4-fs (loop0): unmounting filesystem. [ 52.199528][ T1856] FAT-fs (loop4): Directory bread(block 69) failed [ 52.199578][ T1856] FAT-fs (loop4): Directory bread(block 70) failed [ 52.199596][ T1856] FAT-fs (loop4): Directory bread(block 71) failed [ 52.199629][ T1856] FAT-fs (loop4): Directory bread(block 72) failed [ 52.231933][ T1856] FAT-fs (loop4): Directory bread(block 73) failed [ 52.260949][ T1863] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 52.286695][ T1863] ext4 filesystem being mounted at /1/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 52.301577][ T28] audit: type=1400 audit(1791201458.768:337): avc: denied { create } for pid=1855 comm="syz.4.653" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 52.360585][ T28] audit: type=1400 audit(1791201458.828:338): avc: denied { read } for pid=1879 comm="syz.5.665" lport=7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 52.402162][ T1796] EXT4-fs (loop6): unmounting filesystem. [ 52.407966][ T28] audit: type=1326 audit(1791201458.868:339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1886 comm="syz.5.666" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f057739e199 code=0x7ffc0000 [ 52.432696][ T28] audit: type=1326 audit(1791201458.868:340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1886 comm="syz.5.666" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f057739e199 code=0x7ffc0000 [ 52.469603][ T1882] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 52.508749][ T1894] incfs: ino conflict with backing FS 1 [ 52.534906][ T288] EXT4-fs (loop1): unmounting filesystem. [ 52.970248][ T1909] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.983946][ T1909] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.999265][ T1909] device bridge_slave_0 entered promiscuous mode [ 53.015392][ T1909] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.027942][ T1909] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.042097][ T1909] device bridge_slave_1 entered promiscuous mode [ 53.109803][ T8] device bridge_slave_1 left promiscuous mode [ 53.118505][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.138407][ T8] device bridge_slave_0 left promiscuous mode [ 53.152341][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.169463][ T8] device veth1_macvtap left promiscuous mode [ 53.182096][ T8] device veth0_vlan left promiscuous mode [ 53.233936][ T1918] F2FS-fs (loop1): invalid crc value [ 53.257288][ T1918] F2FS-fs (loop1): Found nat_bits in checkpoint [ 53.262065][ T1884] F2FS-fs (loop4): Invalid segment/section count (458783, 24 x 150994945) [ 53.290133][ T1884] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 53.301496][ T1928] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 53.321185][ T1928] ext4 filesystem being mounted at /150/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 53.332455][ T1884] F2FS-fs (loop4): invalid crc value [ 53.335055][ T1918] F2FS-fs (loop1): Start checkpoint disabled! [ 53.344821][ T1928] EXT4-fs error (device loop0): ext4_map_blocks:747: inode #15: comm syz.0.683: lblock 0 mapped to illegal pblock 0 (length 1) [ 53.351574][ T1918] F2FS-fs (loop1): f2fs_disable_checkpoint() finish, err:0 [ 53.366371][ T1918] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 53.368376][ T1928] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 53.413766][ T1928] EXT4-fs (loop0): This should not happen!! Data will be lost [ 53.413766][ T1928] [ 53.424098][ T1918] F2FS-fs (loop1): ino:10, start:0, end:2048, need to trigger GC to reclaim enough free segment when checkpoint is enabled [ 53.426917][ T1884] F2FS-fs (loop4): Found nat_bits in checkpoint [ 53.467739][ T221] EXT4-fs error (device loop0): ext4_map_blocks:747: inode #15: block 4: comm kworker/u4:3: lblock 4 mapped to illegal pblock 4 (length 2) [ 53.479005][ T1909] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.489016][ T1909] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.490567][ T221] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 4 with max blocks 2 with error 117 [ 53.496446][ T1909] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.508846][ T221] EXT4-fs (loop0): This should not happen!! Data will be lost [ 53.508846][ T221] [ 53.515689][ T1909] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.525812][ T221] EXT4-fs error (device loop0): ext4_map_blocks:747: inode #15: block 8: comm kworker/u4:3: lblock 8 mapped to illegal pblock 8 (length 8) [ 53.546877][ T1918] F2FS-fs (loop1): ino:10, start:7, end:8199, need to trigger GC to reclaim enough free segment when checkpoint is enabled [ 53.568521][ T1884] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 53.579967][ T741] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.580254][ T1884] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 53.594923][ T741] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.603647][ T221] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 53.616386][ T221] EXT4-fs (loop0): This should not happen!! Data will be lost [ 53.616386][ T221] [ 53.616593][ T43] kworker/u4:2: attempt to access beyond end of device [ 53.616593][ T43] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 53.641211][ T287] EXT4-fs (loop0): unmounting filesystem. [ 53.657035][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 53.677687][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 53.685717][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 53.697328][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 53.706735][ T741] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.713814][ T741] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.731340][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 53.754475][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 53.778674][ T741] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.785741][ T741] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.819973][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 53.839135][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 53.868269][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 53.885625][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 53.914166][ T1909] device veth0_vlan entered promiscuous mode [ 53.928705][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 53.939339][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 53.957910][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 53.974838][ T1949] set_capacity_and_notify: 9 callbacks suppressed [ 53.974859][ T1949] loop1: detected capacity change from 0 to 2048 [ 53.978087][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 54.024075][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 54.038848][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 54.049078][ T1949] loop1: p1 < > p4 [ 54.049096][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 54.061435][ T1949] loop1: p4 size 722688 extends beyond EOD, truncated [ 54.077033][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 54.096257][ T1909] device veth1_macvtap entered promiscuous mode [ 54.110900][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 54.130580][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 54.148807][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 54.169651][ T941] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 54.190642][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 54.215685][ T1942] loop0: detected capacity change from 0 to 40427 [ 54.223022][ T741] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 54.309499][ T1959] loop0: detected capacity change from 0 to 2048 [ 54.338821][ T1959] loop0: p3 < > p4 < > [ 54.343052][ T1959] loop0: partition table partially beyond EOD, truncated [ 54.366666][ T1959] loop0: p3 start 4284289 is beyond EOD, truncated [ 54.385126][ T102] loop0: p3 < > p4 < > [ 54.389677][ T102] loop0: partition table partially beyond EOD, truncated [ 54.418386][ T102] loop0: p3 start 4284289 is beyond EOD, truncated [ 54.549708][ T1909] ------------[ cut here ]------------ [ 54.555460][ T1909] WARNING: CPU: 0 PID: 1909 at fs/overlayfs/util.c:489 ovl_dir_modified+0x189/0x1c0 [ 54.565086][ T1909] Modules linked in: [ 54.569141][ T1909] CPU: 0 PID: 1909 Comm: syz-executor Not tainted syzkaller #0 [ 54.573139][ T941] udevd[941]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 54.576704][ T1909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 54.576717][ T1909] RIP: 0010:ovl_dir_modified+0x189/0x1c0 [ 54.594449][ T941] udevd[941]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 54.596882][ T1909] Code: 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 5e 7a a3 ff 49 ff 06 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 27 ef 5d ff <0f> 0b e9 17 ff ff ff e8 1b ef 5d ff 0f 0b e9 51 ff ff ff 44 89 e1 [ 54.632350][ T1909] RSP: 0018:ffffc9000fc3fb60 EFLAGS: 00010293 [ 54.638550][ T1909] RAX: ffffffff82137f19 RBX: 1ffff110223742b0 RCX: ffff888112f2d100 [ 54.646974][ T1909] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 54.655220][ T1909] RBP: ffffc9000fc3fb90 R08: ffff888132291e07 R09: 1ffff110264523c0 [ 54.663426][ T1909] R10: dffffc0000000000 R11: ffffed10264523c1 R12: ffff888111ba1550 [ 54.671573][ T1909] R13: 0000000000000000 R14: ffff888132291d60 R15: ffff888111ba1580 [ 54.679717][ T1909] FS: 00005555603b4500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 54.688883][ T1909] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 54.695656][ T1909] CR2: 00005555603df988 CR3: 0000000128dad000 CR4: 00000000003506b0 [ 54.703833][ T1909] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 54.712072][ T1909] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 54.720286][ T1909] Call Trace: [ 54.724023][ T1909] [ 54.727379][ T1909] ovl_do_remove+0x6d3/0xa60 [ 54.732184][ T1909] ? ovl_set_redirect+0x6b0/0x6b0 [ 54.737462][ T1909] ? selinux_inode_rmdir+0x22/0x30 [ 54.742827][ T1909] ovl_rmdir+0x1a/0x20 [ 54.746922][ T1909] vfs_rmdir+0x381/0x4f0 [ 54.751493][ T1909] incfs_kill_sb+0xfe/0x210 [ 54.756025][ T1909] deactivate_locked_super+0xb5/0x120 [ 54.761655][ T1909] deactivate_super+0xaf/0xe0 [ 54.766585][ T1909] cleanup_mnt+0x45e/0x4e0 [ 54.771269][ T1909] __cleanup_mnt+0x19/0x20 [ 54.775712][ T1909] task_work_run+0x1e1/0x250 [ 54.780802][ T1909] ? __cfi_task_work_run+0x10/0x10 [ 54.786263][ T1909] ? __x64_sys_umount+0x12d/0x170 [ 54.791664][ T1909] ? __cfi___x64_sys_umount+0x10/0x10 [ 54.797330][ T1909] exit_to_user_mode_loop+0x9b/0xb0 [ 54.802757][ T1909] exit_to_user_mode_prepare+0x87/0xd0 [ 54.808569][ T1909] syscall_exit_to_user_mode+0x1a/0x30 [ 54.814342][ T1909] do_syscall_64+0x58/0xa0 [ 54.819117][ T1909] ? clear_bhb_loop+0x30/0x80 [ 54.824095][ T1909] ? clear_bhb_loop+0x30/0x80 [ 54.828796][ T1909] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 54.834935][ T1909] RIP: 0033:0x7f489b59f3d7 [ 54.839457][ T1909] Code: a2 c7 05 1c 53 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 54.859282][ T1909] RSP: 002b:00007ffcdde6f748 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 54.867965][ T1909] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f489b59f3d7 [ 54.876241][ T1909] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcdde6f800 [ 54.884521][ T1909] RBP: 00007ffcdde6f800 R08: 00007ffcdde70800 R09: 00000000ffffffff [ 54.892712][ T1909] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcdde70890 [ 54.900706][ T1909] R13: 00007f489b6344fb R14: 000000000000d4f9 R15: 00007ffcdde708d0 [ 54.908893][ T1909] [ 54.912115][ T1909] ---[ end trace 0000000000000000 ]--- [ 54.921527][ T1909] ------------[ cut here ]------------ [ 54.927112][ T1909] WARNING: CPU: 1 PID: 1909 at fs/overlayfs/util.c:489 ovl_dir_modified+0x189/0x1c0 [ 54.936616][ T1909] Modules linked in: [ 54.940526][ T1909] CPU: 1 PID: 1909 Comm: syz-executor Tainted: G W syzkaller #0 [ 54.949744][ T1909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 54.959933][ T1909] RIP: 0010:ovl_dir_modified+0x189/0x1c0 [ 54.963605][ T1997] netlink: 'syz.4.712': attribute type 12 has an invalid length. [ 54.965697][ T1909] Code: 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 5e 7a a3 ff 49 ff 06 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 27 ef 5d ff <0f> 0b e9 17 ff ff ff e8 1b ef 5d ff 0f 0b e9 51 ff ff ff 44 89 e1 [ 54.973611][ T1997] netlink: 'syz.4.712': attribute type 29 has an invalid length. [ 54.993141][ T1909] RSP: 0018:ffffc9000fc3fb60 EFLAGS: 00010293 [ 55.001046][ T1997] netlink: 252 bytes leftover after parsing attributes in process `syz.4.712'. [ 55.006983][ T1909] RAX: ffffffff82137f19 RBX: 1ffff110223742b0 RCX: ffff888112f2d100 [ 55.024650][ T1909] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 55.032977][ T1909] RBP: ffffc9000fc3fb90 R08: ffff888132291e07 R09: 1ffff110264523c0 [ 55.040980][ T1909] R10: dffffc0000000000 R11: ffffed10264523c1 R12: ffff888111ba1550 [ 55.049045][ T1909] R13: 0000000000000000 R14: ffff888132291d60 R15: ffff888111ba1580 [ 55.057068][ T1909] FS: 00005555603b4500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 55.066065][ T1909] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 55.072707][ T1909] CR2: 0000200000f36030 CR3: 0000000128dad000 CR4: 00000000003506a0 [ 55.080500][ T28] kauditd_printk_skb: 18 callbacks suppressed [ 55.080515][ T28] audit: type=1400 audit(1791201461.534:359): avc: denied { bind } for pid=2003 comm="syz.4.716" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 55.080712][ T1909] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 55.114886][ T1909] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 55.116116][ T2005] input: syz1 as /devices/virtual/input/input11 [ 55.123007][ T1909] Call Trace: [ 55.123019][ T1909] [ 55.123026][ T1909] ovl_do_remove+0x6d3/0xa60 [ 55.140135][ T1909] ? ovl_set_redirect+0x6b0/0x6b0 [ 55.145197][ T1909] ? selinux_inode_rmdir+0x22/0x30 [ 55.150320][ T1909] ovl_rmdir+0x1a/0x20 [ 55.154408][ T1909] vfs_rmdir+0x381/0x4f0 [ 55.158666][ T1909] incfs_kill_sb+0x18f/0x210 [ 55.163283][ T1909] deactivate_locked_super+0xb5/0x120 [ 55.168681][ T1909] deactivate_super+0xaf/0xe0 [ 55.173382][ T1909] cleanup_mnt+0x45e/0x4e0 [ 55.177815][ T1909] __cleanup_mnt+0x19/0x20 [ 55.182239][ T1909] task_work_run+0x1e1/0x250 [ 55.186905][ T1909] ? __cfi_task_work_run+0x10/0x10 [ 55.192038][ T1909] ? __x64_sys_umount+0x12d/0x170 [ 55.197093][ T1909] ? __cfi___x64_sys_umount+0x10/0x10 [ 55.202498][ T1909] exit_to_user_mode_loop+0x9b/0xb0 [ 55.207717][ T1909] exit_to_user_mode_prepare+0x87/0xd0 [ 55.213185][ T1909] syscall_exit_to_user_mode+0x1a/0x30 [ 55.218658][ T1909] do_syscall_64+0x58/0xa0 [ 55.223087][ T1909] ? clear_bhb_loop+0x30/0x80 [ 55.227786][ T1909] ? clear_bhb_loop+0x30/0x80 [ 55.232471][ T1909] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 55.238402][ T1909] RIP: 0033:0x7f489b59f3d7 [ 55.242837][ T1909] Code: a2 c7 05 1c 53 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 55.262477][ T1909] RSP: 002b:00007ffcdde6f748 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 55.270973][ T1909] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f489b59f3d7 [ 55.278974][ T1909] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcdde6f800 [ 55.286989][ T1909] RBP: 00007ffcdde6f800 R08: 00007ffcdde70800 R09: 00000000ffffffff [ 55.294993][ T1909] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcdde70890 [ 55.302989][ T1909] R13: 00007f489b6344fb R14: 000000000000d4f9 R15: 00007ffcdde708d0 [ 55.310997][ T1909] [ 55.314039][ T1909] ---[ end trace 0000000000000000 ]--- [ 55.333508][ T2011] loop7: detected capacity change from 0 to 512 [ 55.333896][ T28] audit: type=1400 audit(1791201461.782:360): avc: denied { write } for pid=2010 comm="syz.7.706" name="ip6_mr_vif" dev="proc" ino=4026532552 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 55.403514][ T2011] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 55.420867][ T2011] ext4 filesystem being mounted at /2/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 55.487965][ T1909] EXT4-fs (loop7): unmounting filesystem. [ 55.514137][ T2031] loop1: detected capacity change from 0 to 256 [ 55.624148][ T2023] loop0: detected capacity change from 0 to 40427 [ 55.634057][ T2023] F2FS-fs (loop0): Wrong segment_count / block_count (64 > 16384) [ 55.642098][ T2023] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 55.650519][ T1005] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 55.659331][ T2023] F2FS-fs (loop0): Found nat_bits in checkpoint [ 55.702490][ T2023] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 55.710415][ T2023] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 55.728661][ T28] audit: type=1400 audit(1791201462.178:361): avc: denied { write } for pid=2051 comm="syz.1.734" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 55.849614][ T1005] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 55.880993][ T1005] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 55.898780][ T1005] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.913347][ T2066] loop5: detected capacity change from 0 to 2048 [ 55.930005][ T1005] usb 5-1: Product: syz [ 55.934214][ T1005] usb 5-1: Manufacturer: syz [ 55.937320][ T2072] loop7: detected capacity change from 0 to 256 [ 55.947087][ T1005] usb 5-1: SerialNumber: syz [ 55.963625][ T2072] exFAT-fs (loop7): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 55.977342][ T1005] cdc_ncm 5-1:1.0: skipping garbage [ 55.982726][ T2066] EXT4-fs (loop5): couldn't mount as ext2 due to feature incompatibilities [ 55.982777][ T2072] exFAT-fs (loop7): Medium has reported failures. Some data may be lost. [ 56.003344][ T2075] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8192 sclass=netlink_route_socket pid=2075 comm=syz.0.744 [ 56.018277][ T2072] exFAT-fs (loop7): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 56.030574][ T2075] netlink: 12 bytes leftover after parsing attributes in process `syz.0.744'. [ 56.055953][ T28] audit: type=1400 audit(1791201462.506:362): avc: denied { append } for pid=2071 comm="syz.7.745" path="/7/bus/memory.events.local" dev="loop7" ino=1048754 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 56.080946][ T28] audit: type=1400 audit(1791201462.506:363): avc: denied { map } for pid=2071 comm="syz.7.745" path="/7/bus/memory.events.local" dev="loop7" ino=1048754 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 56.114897][ T2077] net_ratelimit: 45 callbacks suppressed [ 56.114916][ T2077] sock: sock_set_timeout: `syz.7.746' (pid 2077) tries to set negative timeout [ 56.146856][ T2081] loop7: detected capacity change from 0 to 128 [ 56.157036][ T2081] FAT-fs (loop7): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 56.293129][ T2083] FAULT_INJECTION: forcing a failure. [ 56.293129][ T2083] name failslab, interval 1, probability 0, space 0, times 0 [ 56.306270][ T2083] CPU: 0 PID: 2083 Comm: syz.7.749 Tainted: G W syzkaller #0 [ 56.315080][ T2083] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 56.325161][ T2083] Call Trace: [ 56.328464][ T2083] [ 56.331414][ T2083] __dump_stack+0x21/0x24 [ 56.335781][ T2083] dump_stack_lvl+0x110/0x170 [ 56.340494][ T2083] ? __cfi_dump_stack_lvl+0x8/0x8 [ 56.345549][ T2083] ? mas_state_walk+0x7ab/0xa80 [ 56.350432][ T2083] ? do_mas_munmap+0x2b0/0x2b0 [ 56.355244][ T2083] dump_stack+0x15/0x24 [ 56.359443][ T2083] should_fail_ex+0x3bf/0x510 [ 56.364156][ T2083] ? vm_area_alloc+0x24/0x1a0 [ 56.368852][ T2083] __should_failslab+0xac/0xf0 [ 56.373640][ T2083] should_failslab+0x9/0x20 [ 56.378153][ T2083] kmem_cache_alloc+0x3b/0x320 [ 56.382935][ T2083] vm_area_alloc+0x24/0x1a0 [ 56.387454][ T2083] mmap_region+0xfab/0x2130 [ 56.391970][ T2083] ? __cfi_mmap_region+0x10/0x10 [ 56.396915][ T2083] ? __kasan_check_read+0x11/0x20 [ 56.401952][ T2083] ? cap_mmap_addr+0x165/0x2e0 [ 56.406726][ T2083] ? __cfi_arch_get_unmapped_area_topdown+0x10/0x10 [ 56.413317][ T2083] ? get_unmapped_area+0x30c/0x370 [ 56.418434][ T2083] do_mmap+0x858/0xdd0 [ 56.422511][ T2083] ? __cfi_do_mmap+0x10/0x10 [ 56.427101][ T2083] ? do_futex+0x2e2/0x430 [ 56.431433][ T2083] vm_mmap_pgoff+0x206/0x3f0 [ 56.436022][ T2083] ? __cfi_vm_mmap_pgoff+0x10/0x10 [ 56.441152][ T2083] ? xfd_validate_state+0x70/0x150 [ 56.446267][ T2083] ksys_mmap_pgoff+0xf6/0x1d0 [ 56.450948][ T2083] ? __kasan_check_write+0x14/0x20 [ 56.456062][ T2083] __x64_sys_mmap+0xfa/0x110 [ 56.460653][ T2083] x64_sys_call+0x8fd/0x9a0 [ 56.465160][ T2083] do_syscall_64+0x4c/0xa0 [ 56.469584][ T2083] ? clear_bhb_loop+0x30/0x80 [ 56.474261][ T2083] ? clear_bhb_loop+0x30/0x80 [ 56.478940][ T2083] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 56.484834][ T2083] RIP: 0033:0x7f489b59e199 [ 56.489269][ T2083] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 56.508967][ T2083] RSP: 002b:00007f489c392028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 56.517407][ T2083] RAX: ffffffffffffffda RBX: 00007f489b825fa0 RCX: 00007f489b59e199 [ 56.525404][ T2083] RDX: 000000000200000b RSI: 0000000000200000 RDI: 0000200000000000 [ 56.533475][ T2083] RBP: 00007f489b6350b8 R08: ffffffffffffffff R09: 0000000042795000 [ 56.541451][ T2083] R10: 0000000000204031 R11: 0000000000000246 R12: 0000000000000000 [ 56.549426][ T2083] R13: 00007f489b826038 R14: 00007f489b825fa0 R15: 00007ffcdde704d8 [ 56.557406][ T2083] [ 56.607215][ T2089] loop7: detected capacity change from 0 to 256 [ 56.614405][ T2089] exFAT-fs (loop7): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 56.639624][ T2089] exFAT-fs (loop7): Medium has reported failures. Some data may be lost. [ 56.649846][ T2089] exFAT-fs (loop7): failed to load upcase table (idx : 0x0000ff98, chksum : 0x84a6b859, utbl_chksum : 0xe619d30d) [ 56.725651][ T28] audit: type=1400 audit(1791201463.171:364): avc: denied { map } for pid=2095 comm="syz.7.754" path="/dev/ashmem" dev="devtmpfs" ino=269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 56.826706][ T2057] F2FS-fs (loop1): Test dummy encryption mode enabled [ 56.850418][ T2057] F2FS-fs (loop1): invalid crc value [ 56.897719][ T2057] F2FS-fs (loop1): Found nat_bits in checkpoint [ 56.991982][ T2057] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 57.018676][ T2109] syz.7.758[2109] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 57.018839][ T2109] syz.7.758[2109] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 57.040304][ T2098] F2FS-fs (loop5): invalid crc value [ 57.080468][ T2098] F2FS-fs (loop5): Found nat_bits in checkpoint [ 57.129756][ T2098] F2FS-fs (loop5): Start checkpoint disabled! [ 57.136321][ T2098] F2FS-fs (loop5): f2fs_disable_checkpoint() finish, err:0 [ 57.143777][ T2098] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e6 [ 57.183031][ T1005] cdc_ncm 5-1:1.0: bind() failure [ 57.202772][ T1005] cdc_ncm: probe of 5-1:1.1 failed with error -71 [ 57.224393][ T1005] cdc_mbim: probe of 5-1:1.1 failed with error -71 [ 57.241275][ T1005] usb 5-1: USB disconnect, device number 5 [ 57.275514][ T2098] F2FS-fs (loop5): ino:10, start:0, end:2048, need to trigger GC to reclaim enough free segment when checkpoint is enabled [ 57.347355][ T2098] F2FS-fs (loop5): ino:10, start:7, end:8199, need to trigger GC to reclaim enough free segment when checkpoint is enabled [ 57.390782][ T43] kworker/u4:2: attempt to access beyond end of device [ 57.390782][ T43] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 57.512942][ T2120] incfs: ino conflict with backing FS 1 [ 57.518604][ T2121] netlink: 60 bytes leftover after parsing attributes in process `syz.1.760'. [ 57.537931][ T2121] netlink: 60 bytes leftover after parsing attributes in process `syz.1.760'. [ 57.600988][ T2127] FAULT_INJECTION: forcing a failure. [ 57.600988][ T2127] name failslab, interval 1, probability 0, space 0, times 0 [ 57.614383][ T2127] CPU: 0 PID: 2127 Comm: syz.0.766 Tainted: G W syzkaller #0 [ 57.623158][ T2127] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 57.633225][ T2127] Call Trace: [ 57.636511][ T2127] [ 57.639442][ T2127] __dump_stack+0x21/0x24 [ 57.643788][ T2127] dump_stack_lvl+0x110/0x170 [ 57.648472][ T2127] ? __cfi_dump_stack_lvl+0x8/0x8 [ 57.653586][ T2127] ? do_futex+0x2e2/0x430 [ 57.657915][ T2127] ? __cfi_do_futex+0x10/0x10 [ 57.662591][ T2127] dump_stack+0x15/0x24 [ 57.666764][ T2127] should_fail_ex+0x3bf/0x510 [ 57.671456][ T2127] __should_failslab+0xac/0xf0 [ 57.676232][ T2127] should_failslab+0x9/0x20 [ 57.680737][ T2127] __kmem_cache_alloc_node+0x3d/0x2d0 [ 57.686111][ T2127] ? do_eventfd+0x80/0x2e0 [ 57.690526][ T2127] ? do_eventfd+0x80/0x2e0 [ 57.694943][ T2127] kmalloc_trace+0x29/0xb0 [ 57.699367][ T2127] do_eventfd+0x80/0x2e0 [ 57.703609][ T2127] __x64_sys_eventfd2+0x5a/0x70 [ 57.708458][ T2127] x64_sys_call+0x2f2/0x9a0 [ 57.712963][ T2127] do_syscall_64+0x4c/0xa0 [ 57.717397][ T2127] ? clear_bhb_loop+0x30/0x80 [ 57.722079][ T2127] ? clear_bhb_loop+0x30/0x80 [ 57.726762][ T2127] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 57.732656][ T2127] RIP: 0033:0x7f8f3e39e199 [ 57.737083][ T2127] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 57.756684][ T2127] RSP: 002b:00007f8f3f184028 EFLAGS: 00000246 ORIG_RAX: 0000000000000122 [ 57.765187][ T2127] RAX: ffffffffffffffda RBX: 00007f8f3e625fa0 RCX: 00007f8f3e39e199 [ 57.773161][ T2127] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000000000000003e [ 57.781152][ T2127] RBP: 00007f8f3e4350b8 R08: 0000000000000000 R09: 0000000000000000 [ 57.789134][ T2127] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 57.797105][ T2127] R13: 00007f8f3e626038 R14: 00007f8f3e625fa0 R15: 00007ffcfa7b9a48 [ 57.805084][ T2127] [ 57.888776][ T2136] exFAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 57.914829][ T2136] exFAT-fs (loop0): Medium has reported failures. Some data may be lost. [ 57.931201][ T2136] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 58.011377][ T28] audit: type=1400 audit(1791201464.441:365): avc: denied { mounton } for pid=2135 comm="syz.0.770" path="/163/bus/file0/bus" dev="loop0" ino=1048772 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 58.111400][ T2140] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.119200][ T2144] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 58.129498][ T2140] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.137296][ T2140] device bridge_slave_0 entered promiscuous mode [ 58.138830][ T28] audit: type=1400 audit(1791201464.570:366): avc: denied { watch } for pid=2142 comm="syz.5.773" path="/32/file1" dev="loop5" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 58.166493][ T2144] EXT4-fs error (device loop5): ext4_readdir:263: inode #2: block 16: comm syz.5.773: path /32/file1: bad entry in directory: inode out of bounds - offset=0, inode=1538, rec_len=12, size=1024 fake=1 [ 58.191970][ T2140] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.199520][ T2140] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.207351][ T2140] device bridge_slave_1 entered promiscuous mode [ 58.214482][ T1466] EXT4-fs (loop5): unmounting filesystem. [ 58.329413][ T2140] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.336513][ T2140] bridge0: port 2(bridge_slave_1) entered forwarding state [ 58.343856][ T2140] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.350922][ T2140] bridge0: port 1(bridge_slave_0) entered forwarding state [ 58.358369][ T28] audit: type=1400 audit(1791201464.769:367): avc: denied { bind } for pid=2164 comm="syz.1.780" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 58.409065][ T28] audit: type=1400 audit(1791201464.838:368): avc: denied { execmod } for pid=2171 comm="syz.5.783" path="/35/blkio.bfq.io_service_bytes_recursive" dev="tmpfs" ino=210 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 58.452516][ T741] device bridge_slave_1 left promiscuous mode [ 58.471641][ T741] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.497897][ T741] device bridge_slave_0 left promiscuous mode [ 58.516796][ T741] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.525696][ T741] device veth1_macvtap left promiscuous mode [ 58.531834][ T741] device veth0_vlan left promiscuous mode [ 58.556981][ T2184] device-mapper: ioctl: unable to find target [ 58.653817][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 58.665364][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.673934][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.675195][ T2197] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d) [ 58.726404][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 58.754802][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 58.763186][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.770242][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 58.777813][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 58.795770][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 58.819666][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.826783][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 58.862106][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 58.881921][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 58.900463][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 58.918992][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 58.954080][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 58.982417][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 59.003600][ T2140] device veth0_vlan entered promiscuous mode [ 59.012620][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 59.021372][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 59.039228][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 59.047531][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 59.059384][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 59.072136][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 59.089715][ T2207] set_capacity_and_notify: 7 callbacks suppressed [ 59.089733][ T2207] loop4: detected capacity change from 0 to 40427 [ 59.091403][ T2140] device veth1_macvtap entered promiscuous mode [ 59.105110][ T2207] F2FS-fs (loop4): Corrupted extension count (64 + 1 > 64) [ 59.114889][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 59.130013][ T2207] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 59.134172][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 59.140409][ T2207] F2FS-fs (loop4): Image doesn't support compression [ 59.147084][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 59.155178][ T2207] F2FS-fs (loop4): Image doesn't support compression [ 59.171131][ T1510] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 59.173763][ T2207] F2FS-fs (loop4): invalid crc value [ 59.185389][ T2207] F2FS-fs (loop4): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 59.196189][ T1510] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 59.220353][ T2207] F2FS-fs (loop4): Start checkpoint disabled! [ 59.263566][ T2207] F2FS-fs (loop4): f2fs_disable_checkpoint() finish, err:0 [ 59.291715][ T2207] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 59.311670][ T2207] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 59.384632][ T2244] loop1: detected capacity change from 0 to 512 [ 59.424571][ T2244] FAT-fs (loop1): Directory bread(block 199916) failed [ 59.449904][ T2244] FAT-fs (loop1): Directory bread(block 199917) failed [ 59.459081][ T2244] FAT-fs (loop1): Directory bread(block 199918) failed [ 59.466102][ T2244] FAT-fs (loop1): Directory bread(block 199919) failed [ 59.473326][ T2244] FAT-fs (loop1): Directory bread(block 199920) failed [ 59.490338][ T2244] FAT-fs (loop1): Directory bread(block 199921) failed [ 59.497732][ T2244] FAT-fs (loop1): Directory bread(block 199922) failed [ 59.504975][ T2244] FAT-fs (loop1): Directory bread(block 199923) failed [ 59.524852][ T2244] FAT-fs (loop1): Directory bread(block 199916) failed [ 59.542815][ T2244] FAT-fs (loop1): Directory bread(block 199917) failed [ 59.544764][ T2257] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 59.647371][ T2263] loop5: detected capacity change from 0 to 512 [ 59.656050][ T2265] loop1: detected capacity change from 0 to 256 [ 59.679894][ T2265] exfat: Deprecated parameter 'utf8' [ 59.685727][ T2265] exfat: Deprecated parameter 'namecase' [ 59.697302][ T2265] exfat: Deprecated parameter 'utf8' [ 59.703726][ T2263] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 59.717126][ T2265] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xb89b369d, utbl_chksum : 0xe619d30d) [ 59.729418][ T2263] ext4 filesystem being mounted at /57/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 59.766637][ T1466] EXT4-fs (loop5): unmounting filesystem. [ 59.836894][ T37] kernel write not supported for file /rfkill (pid: 37 comm: kworker/1:1) [ 60.047232][ T2291] loop1: detected capacity change from 0 to 2048 [ 60.111133][ T2291] loop1: p1 < > p3 [ 60.115903][ T2291] loop1: p3 size 134217728 extends beyond EOD, truncated [ 60.117674][ T2302] mmap: syz.4.832 (2302) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 60.212227][ T941] udevd[941]: inotify_add_watch(7, /dev/loop1p3, 10) failed: No such file or directory [ 60.214105][ T2314] binder: 2313:2314 ioctl 40046205 0 returned -22 [ 60.528870][ T2339] loop8: detected capacity change from 0 to 40427 [ 60.536077][ T2339] F2FS-fs (loop8): Corrupted extension count (64 + 1 > 64) [ 60.543545][ T2339] F2FS-fs (loop8): Can't find valid F2FS filesystem in 1th superblock [ 60.551840][ T2339] F2FS-fs (loop8): Image doesn't support compression [ 60.558887][ T2339] F2FS-fs (loop8): Image doesn't support compression [ 60.566177][ T2339] F2FS-fs (loop8): invalid crc value [ 60.572291][ T2339] F2FS-fs (loop8): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 60.594275][ T485] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 60.595731][ T2339] F2FS-fs (loop8): Start checkpoint disabled! [ 60.609050][ T2339] F2FS-fs (loop8): f2fs_disable_checkpoint() finish, err:0 [ 60.616674][ T2339] F2FS-fs (loop8): Try to recover 1th superblock, ret: 0 [ 60.623720][ T2339] F2FS-fs (loop8): Mounted with checkpoint version = 48b305e6 [ 60.636504][ T2339] F2FS-fs (loop8): f2fs_enable_checkpoint() starts, meta: 0, node: 0, data: 0 [ 60.684342][ T2339] F2FS-fs (loop8): sync_inode_sb done, dirty_data: 0, 0, skipped write: 0, 0, retry: 3 [ 60.694673][ T2342] F2FS-fs (loop8): Inconsistent error blkaddr:5633, sit bitmap:0 [ 60.694694][ T2339] F2FS-fs (loop8): f2fs_enable_checkpoint() finishes, writeback:48, sync:0 [ 60.702484][ T2342] CPU: 1 PID: 2342 Comm: syz.8.854 Tainted: G W syzkaller #0 [ 60.719835][ T2342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 60.729903][ T2342] Call Trace: [ 60.733198][ T2342] [ 60.736148][ T2342] __dump_stack+0x21/0x24 [ 60.740509][ T2342] dump_stack_lvl+0x110/0x170 [ 60.745200][ T2342] ? __cfi_dump_stack_lvl+0x8/0x8 [ 60.750237][ T2342] ? f2fs_lookup_read_extent_cache_block+0x22d/0x420 [ 60.756916][ T2342] dump_stack+0x15/0x24 [ 60.761082][ T2342] __f2fs_is_valid_blkaddr+0xd2e/0x15a0 [ 60.766645][ T2342] f2fs_is_valid_blkaddr+0x23/0x30 [ 60.772108][ T2342] f2fs_get_read_data_page+0x4ef/0x850 [ 60.777573][ T2342] ? __cfi_f2fs_get_read_data_page+0x10/0x10 [ 60.783572][ T2342] f2fs_find_data_page+0x198/0x3a0 [ 60.788691][ T2342] f2fs_readdir+0x4a2/0x990 [ 60.793209][ T2342] ? __cfi_f2fs_readdir+0x10/0x10 [ 60.798242][ T2342] ? cap_capable+0x1a6/0x230 [ 60.802832][ T2342] ? down_read_killable+0xbc/0x110 [ 60.807945][ T2342] ? __cfi_down_read_killable+0x10/0x10 [ 60.813504][ T2342] ? security_file_permission+0x94/0xb0 [ 60.819064][ T2342] iterate_dir+0x26d/0x610 [ 60.823484][ T2342] ? __cfi_f2fs_readdir+0x10/0x10 [ 60.828518][ T2342] __se_sys_getdents+0xf2/0x250 [ 60.833375][ T2342] ? __x64_sys_getdents+0x90/0x90 [ 60.838428][ T2342] ? xfd_validate_state+0x70/0x150 [ 60.843551][ T2342] ? __cfi_filldir+0x10/0x10 [ 60.848141][ T2342] ? fpregs_restore_userregs+0x128/0x260 [ 60.853775][ T2342] __x64_sys_getdents+0x7b/0x90 [ 60.858628][ T2342] x64_sys_call+0x212/0x9a0 [ 60.863134][ T2342] do_syscall_64+0x4c/0xa0 [ 60.867558][ T2342] ? clear_bhb_loop+0x30/0x80 [ 60.872251][ T2342] ? clear_bhb_loop+0x30/0x80 [ 60.876929][ T2342] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 60.882843][ T2342] RIP: 0033:0x7fdc9f59e199 [ 60.887268][ T2342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 60.906891][ T2342] RSP: 002b:00007fdca0391028 EFLAGS: 00000246 ORIG_RAX: 000000000000004e [ 60.915306][ T2342] RAX: ffffffffffffffda RBX: 00007fdc9f826090 RCX: 00007fdc9f59e199 [ 60.923282][ T2342] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 60.931248][ T2342] RBP: 00007fdc9f6350b8 R08: 0000000000000000 R09: 0000000000000000 [ 60.939217][ T2342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 60.947192][ T2342] R13: 00007fdc9f826128 R14: 00007fdc9f826090 R15: 00007fffdc39ab58 [ 60.955167][ T2342] [ 60.988887][ T485] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 61.002462][ T485] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 61.024673][ T485] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 61.043804][ T485] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 61.060549][ T485] usb 6-1: SerialNumber: syz [ 61.257500][ T2346] loop8: detected capacity change from 0 to 40427 [ 61.265050][ T2346] F2FS-fs (loop8): Invalid SB checksum offset: 0 [ 61.271537][ T2346] F2FS-fs (loop8): Can't find valid F2FS filesystem in 2th superblock [ 61.274623][ T485] usb 6-1: 0:2 : does not exist [ 61.280756][ T2346] F2FS-fs (loop8): invalid crc value [ 61.308901][ T485] usb 6-1: unit 2 not found! [ 61.319739][ T2346] F2FS-fs (loop8): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 61.326683][ T485] usb 6-1: USB disconnect, device number 2 [ 61.393378][ T2346] F2FS-fs (loop8): Try to recover 2th superblock, ret: 0 [ 61.400515][ T28] kauditd_printk_skb: 8 callbacks suppressed [ 61.400533][ T28] audit: type=1400 audit(1791201467.807:377): avc: denied { connect } for pid=2362 comm="syz.4.862" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 61.431564][ T2346] F2FS-fs (loop8): Mounted with checkpoint version = 48b305e5 [ 61.458848][ T2140] syz-executor: attempt to access beyond end of device [ 61.458848][ T2140] loop8: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 61.571007][ T941] udevd[941]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 61.571912][ T2369] loop8: detected capacity change from 0 to 512 [ 61.686623][ T2344] loop1: detected capacity change from 0 to 131072 [ 61.688571][ T2379] netlink: 'syz.8.870': attribute type 12 has an invalid length. [ 61.696866][ T2344] F2FS-fs (loop1): Test dummy encryption mode enabled [ 61.702489][ T2379] netlink: 'syz.8.870': attribute type 29 has an invalid length. [ 61.708585][ T2344] F2FS-fs (loop1): invalid crc value [ 61.716359][ T2379] netlink: 148 bytes leftover after parsing attributes in process `syz.8.870'. [ 61.730390][ T2379] netlink: 'syz.8.870': attribute type 3 has an invalid length. [ 61.731079][ T2344] F2FS-fs (loop1): Found nat_bits in checkpoint [ 61.738246][ T2379] netlink: 'syz.8.870': attribute type 2 has an invalid length. [ 61.752376][ T2379] netlink: 35 bytes leftover after parsing attributes in process `syz.8.870'. [ 61.762031][ T485] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 61.787688][ T2344] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 61.805972][ T2344] F2FS-fs (loop1): Start checkpoint disabled! [ 61.813482][ T2344] F2FS-fs (loop1): f2fs_disable_checkpoint() finish, err:0 [ 61.820946][ T2344] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 61.854884][ T221] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 61.954577][ T485] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 61.968441][ T485] usb 5-1: config 0 has no interface number 0 [ 61.975229][ T485] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 61.986563][ T485] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 62.003638][ T485] usb 5-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 62.015070][ T485] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 62.027616][ T485] usb 5-1: config 0 descriptor?? [ 62.055979][ T28] audit: type=1400 audit(1791201468.462:378): avc: denied { mounton } for pid=2405 comm="syz.8.882" path="/proc/33/task" dev="proc" ino=25461 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 62.108864][ T2411] incfs: iterate_incfs_dir / -22 [ 62.121396][ T2140] ------------[ cut here ]------------ [ 62.126968][ T2140] WARNING: CPU: 0 PID: 2140 at fs/inode.c:335 drop_nlink+0xc5/0x110 [ 62.133858][ T28] audit: type=1400 audit(1791201468.531:379): avc: denied { remount } for pid=2414 comm="syz.5.885" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 62.135045][ T2140] Modules linked in: [ 62.155431][ T28] audit: type=1400 audit(1791201468.531:380): avc: denied { read } for pid=2414 comm="syz.5.885" name="/" dev="configfs" ino=14861 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 62.158758][ T2140] CPU: 0 PID: 2140 Comm: syz-executor Tainted: G W syzkaller #0 [ 62.180855][ T28] audit: type=1400 audit(1791201468.531:381): avc: denied { open } for pid=2414 comm="syz.5.885" path="/81/config" dev="configfs" ino=14861 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 62.189850][ T2140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 62.189863][ T2140] RIP: 0010:drop_nlink+0xc5/0x110 [ 62.228184][ T2140] Code: 1b 48 8d bb b8 04 00 00 be 08 00 00 00 e8 03 aa f0 ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 2b 1c ab ff <0f> 0b eb 86 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5e ff ff ff 4c [ 62.248106][ T2140] RSP: 0018:ffffc90009427c60 EFLAGS: 00010293 [ 62.250457][ T28] audit: type=1400 audit(1791201468.531:382): avc: denied { search } for pid=2414 comm="syz.5.885" name="/" dev="configfs" ino=14861 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 62.254433][ T2140] RAX: ffffffff81c65215 RBX: ffff888133e24bd8 RCX: ffff888117d81440 [ 62.284464][ T2140] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 62.292491][ T2140] RBP: ffffc90009427c88 R08: 0000000000000003 R09: 0000000000000004 [ 62.300573][ T2140] R10: dffffc0000000000 R11: fffff52001284f7c R12: dffffc0000000000 [ 62.308580][ T2140] R13: 1ffff110267c4984 R14: ffff888133e24c20 R15: 0000000000000000 [ 62.316588][ T2140] FS: 000055556b1d3500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 62.325517][ T2140] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 62.332121][ T2140] CR2: 0000001b2fb23ffc CR3: 000000012e92d000 CR4: 00000000003506b0 [ 62.340136][ T2140] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 62.348163][ T2140] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 62.350973][ T2425] loop0: detected capacity change from 0 to 512 [ 62.356219][ T2140] Call Trace: [ 62.356229][ T2140] [ 62.356235][ T2140] shmem_rmdir+0x5b/0x90 [ 62.356268][ T2140] vfs_rmdir+0x381/0x4f0 [ 62.356291][ T2140] incfs_kill_sb+0xfe/0x210 [ 62.356314][ T2140] deactivate_locked_super+0xb5/0x120 [ 62.356336][ T2140] deactivate_super+0xaf/0xe0 [ 62.380432][ T2425] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 62.381885][ T2140] cleanup_mnt+0x45e/0x4e0 [ 62.392840][ T2425] EXT4-fs (loop0): 1 truncate cleaned up [ 62.402144][ T2140] __cleanup_mnt+0x19/0x20 [ 62.406766][ T2425] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 62.412081][ T2140] task_work_run+0x1e1/0x250 [ 62.430015][ T2140] ? __cfi_task_work_run+0x10/0x10 [ 62.435164][ T2140] ? __x64_sys_umount+0x12d/0x170 [ 62.437891][ T28] audit: type=1400 audit(1791201468.839:383): avc: denied { rmdir } for pid=2424 comm="syz.0.893" name=06 dev="loop0" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 62.440263][ T2140] ? __cfi___x64_sys_umount+0x10/0x10 [ 62.466873][ T2140] exit_to_user_mode_loop+0x9b/0xb0 [ 62.472212][ T2140] exit_to_user_mode_prepare+0x87/0xd0 [ 62.477818][ T2140] syscall_exit_to_user_mode+0x1a/0x30 [ 62.483307][ T2140] do_syscall_64+0x58/0xa0 [ 62.487757][ T2140] ? clear_bhb_loop+0x30/0x80 [ 62.492810][ T2140] ? clear_bhb_loop+0x30/0x80 [ 62.497517][ T2140] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 62.503424][ T2140] RIP: 0033:0x7fdc9f59f3d7 [ 62.507875][ T2140] Code: a2 c7 05 1c 53 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 62.527511][ T2140] RSP: 002b:00007fffdc399dc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 62.535932][ T2140] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fdc9f59f3d7 [ 62.543938][ T2140] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffdc399e80 [ 62.551953][ T2140] RBP: 00007fffdc399e80 R08: 00007fffdc39ae80 R09: 00000000ffffffff [ 62.559977][ T2140] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffdc39af10 [ 62.567999][ T2140] R13: 00007fdc9f6344fb R14: 000000000000f257 R15: 00007fffdc39af50 [ 62.575981][ T2140] [ 62.579040][ T2140] ---[ end trace 0000000000000000 ]--- [ 62.586010][ T2140] ================================================================== [ 62.594128][ T2140] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 [ 62.600403][ T2140] Write of size 4 at addr 0000000000000170 by task syz-executor/2140 [ 62.608520][ T2140]