last executing test programs: 12m46.730219138s ago: executing program 0 (id=1363): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x10) r2 = socket$kcm(0x1e, 0x4, 0x0) sendmsg$kcm(r2, &(0x7f00000001c0)={&(0x7f00000000c0)=@tipc=@name={0x1e, 0x2, 0x3, {{0x41}, 0x5}}, 0x80, 0x0, 0x0, &(0x7f0000000900)=ANY=[], 0x1458}, 0x48800) 12m46.560191384s ago: executing program 0 (id=1368): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020700000000000002030207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000100850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r0}, 0x18) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000480), 0xc0d00) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f0000000180)={0x80, 0x2b, 0x5, 0x0, 0x7fffffff, 0x105}) 12m46.473751283s ago: executing program 0 (id=1372): creat(&(0x7f00000002c0)='./file0\x00', 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) socketpair$nbd(0x1, 0x1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1000) fcntl$notify(r2, 0x402, 0x80000004) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000080)='./file0/file0\x00', 0x500, &(0x7f00000009c0)={[{@errors_remount}, {@discard}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x5e}}, {@journal_checksum}, {@bsdgroups}, {@jqfmt_vfsv1}, {@abort}, {@data_err_ignore}]}, 0x1, 0x476, &(0x7f0000000540)="$eJzs3M1vFOUfAPDvzLblx2v7Q3wBUavE2PjS0oLKwYtGEw8YTfSAN2tbCKFQQ2sihEg1Bi8mhkTP6tHEv8CbF6OeTLzq3ZAQ5QJ6qpnZmbK7dLctLLuF/XySZZ9n5pl9nm9nnp1n5pklgJ41nP2TRGyLiN8jYrCarS8wXH27duXc1D9Xzk0lsbT05l9JXu7qlXNTZdFyu61FZiSNSD9JikrqzZ85e2JydnbmdJEfWzj53tj8mbPPHD85eWzm2MypiUOHDh4Yf/65iWfbEmcW19U9H87t3f3q2xdfmzpy8d2fv8vau61YXxtHg00N72s2nAX+91JueWFafXt83RFsbNtr0klfFxvCulQiIttd/Xn/H4xKXN95g/HKx11tHHBbZeemFie2xSXgLpZEt1sAdEd5os+uf8tXh4YeG8LlF6sXQFnc14pXdU1feameXxttv031D0fEkcV/v8pe0fo+BABAW3w29eXheHql8V8a99WU21HMoQxFxP8jYmdE3BMRuyLi3oi87P0R8cDqVaa1mcapoRvHP+mlmw5uDbLx3wvF3Fb9+G+5mUOVIrc9j78/OXp8dmZ/8TcZif5NWX68RR0/vPzb583W1Y7/sldWfzkWLNpxqa/hBt305MJkPihtg8sfRezpWyn+ZHkmIImI3RGxZ30fvaNMHH/y273NCq0efwttmGda+ibiier+X4yG+EtJ6/nJsf/F7Mz+sfKouNEvv154o1n9txR/G2T7f0v98d9YZCipna+dX38dF/74tOk1zc0e/wPJW/m2A8WyDyYXFk6PRwwkh/N83fKJ69uW+bJ8Fv/IvpX7/85imyz+ByMiO4gfioiHI+KRou2PRsRjEbGvRfw/vdR8XX38m7d1Y/9PN3z/bc7XLB//Dft//YnKiR+/X7n2r99Z2/4/mKdGiiX5998q1trAW/zzAQAAwB0hzZ+BT9LR5XSajo5Wn+HfFVvS2bn5haeOzr1/arr6rPxQ9Kflna7Bmvuh48li8YnV/ERxr7hcf6C4b/xFZXOeH52am53ucuzQ67Y26f+ZPyvdbh1w2600jzYx0IWGAB3X2P/T+uz51zvZGKCjmj5Hs6Wz7QA6b5Xn6NJOtQPoPP9fC/Sulfr/+Ya8uQC4Ozn/Q+/S/6F36f/Qu/R/6Emr/Ui+cou//Ze44xLJ2gpH2v2mboxEf0S05QMHNkQ4RaLb30wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADt8V8AAAD//5qI6jE=") 12m46.150028935s ago: executing program 0 (id=1380): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x0, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$SG_IO(r0, 0x2285, &(0x7f00000000c0)={0x53, 0xfffffffe, 0x6, 0x2, @scatter={0x0, 0x40000, 0x0}, &(0x7f0000000080)="0000501effd4", 0x0, 0x800004, 0x10030, 0x1, 0x0}) 12m46.010334549s ago: executing program 0 (id=1383): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="07000000040000000001000001"], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000bb00551a000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x18) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='//sys\x00\x00\x00\x00\x00\x00\x80\x004\x00\x00s/\x92ync_\x93\x96\xff\x92\xaf\x00Se\xf44.\x00'/49}, 0x30) mount$bpf(0x200000000000, &(0x7f0000000200)='./file0\x00', 0x0, 0x206002, 0x0) 12m45.929984336s ago: executing program 0 (id=1385): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x3, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r2}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r2, 0x0, &(0x7f0000000000)=""/48}, 0x20) 12m30.856793214s ago: executing program 32 (id=1385): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x3, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r2}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r2, 0x0, &(0x7f0000000000)=""/48}, 0x20) 9m21.346522033s ago: executing program 4 (id=3182): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100000000001c000000000000ea04850000007b00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='kmem_cache_free\x00', r0}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000780)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) clock_adjtime(0x0, 0x0) 9m21.307464527s ago: executing program 4 (id=3183): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x22000406, &(0x7f00000004c0)={[{@dioread_lock}, {@noblock_validity}, {@abort}, {@dioread_lock}, {@stripe={'stripe', 0x3d, 0x1f5}}, {@grpjquota, 0x2e}, {@barrier}, {@nolazytime}, {@jqfmt_vfsv1}, {@grpid}], [], 0x2c}, 0x84, 0x4aa, &(0x7f0000000740)="$eJzs3MtvG0UYAPBvN4++m7SURx9QQ0FEFJImLdADh4JA6gUJCQ7lGNJQlaYtaoJEq4oGhMoR8RcARyQkTlw4gYQQcAJxhTtCqlAvLRxQ0Nq7ybqxU8d5GOrfT7IzszvrmW93xx7vZB1A16pkT0nE1oj4NSIGatn6ApXan5vXL0/8df3yRBJzcy//mVTL3bh+eaIoWmy3Jc8MpRHp+0nsbVDv9MVLZ8anpiYv5PmRmbNvjkxfvPTE6bPjpyZPTZ4bO3r0yOHRp58ae3JV4sziurHnnfP7dh9/9aMXJ+bitR8+z9q7NV9fjqNmcMV1VqISc7mFpf3V50dW/Or/LdtK6aS3gw1hWXoiIjtcfdX+PxA9sXDwBuKF9+Yz33aogcCayT6bdixa2pP/Tec/v4A7UaKPQ5cqPvGz77/FYz3HH5127dnsebIa/838UVvTG2n2XXaw9o29p8n2x1ZY/9aIODH798fZIxpehwAAWF1fZ+OfxxuN/9K4p1Ruez6HMhgRByNiZ0TcFRG7IuLuiGrZeyPivmXWX7klv3j88/OmtgJrUTb+eyaf26of/6V5iWQ+t60af1/y+umpyUP5PhmKvg1ZfnSJOr55/pcPm62rlMZ/2SOrvxgL5u34o3dD/TYnx2fGVxBynWvvRuzpbRR/Mj8TkO2B3RGxp43Xz/bZ6cc+25elt29ZvP728S9hFeaZ5j6NeLR2/GfjlvgLSa2mZvOTIxtjavLQSHFWLPbjT1dfKuf7Sum6+De2FtPGdoNtIDv+mxue/3n8RTco5munl1/H1d8+aPqdZvHxT+LEbLlE7fxPS0uy878/eaWa7s+XvT0+M3NhNKI/X1C3fGxh2yJflM/iHzrQuP/vjPjnk3y7vRGRncT3R8QDEbE/b/uDEfFQRBxYIv7vn3v4jaX3UJvn/yrI4j+51PGPGEzK8/VtJHrOfPdVs/pbe/87Uk0N5Utaef9rtYEr2XcAAADwf5FW56CTdLhIly5O7YrN6dT56ZmDlXjr3MnaXPVg9KXFla6B0vXQ0fzacJEfuyV/OCJ2VP/TaFM1PzxxfmpbJwMHqvfq1PX/SNPh4dq635v90wtw51jWPFr57sAvvlz9xgDryv2a0L30f+he+j90L/0fulej/n8l4mYHmgKsM5//0L30f+he+j90L/0futLiW+KLn1tp507/hcTO4yvafM0TcwNr8sqzy9+qZ40ijfKPdjRNJBHRXhWRLl2mv4XaO5ZIb1vmWJu7ZRmJ/XliQ0S0utWVddurnX1fAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWC3/BgAA//+NJdz0") r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000cc0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed07449e000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20085}, 0x2) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f00000003c0)='sched_switch\x00', r0}, 0x18) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000000)="b870df48e377158c4e92aea2", 0xc}], 0x1) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) getdents(r1, 0x0, 0x54) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x105042, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) 9m20.718268685s ago: executing program 4 (id=3188): r0 = signalfd(0xffffffffffffffff, &(0x7f0000000140), 0x8) r1 = syz_io_uring_setup(0x38a9, &(0x7f0000000300)={0x0, 0x0, 0x10100, 0x0, 0xfffffffe}, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x3, r0}) io_uring_enter(r1, 0x44fd, 0x3, 0x1, 0x0, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d000000"], &(0x7f0000000100)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r4}, 0x10) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) rt_sigsuspend(&(0x7f0000000040)={[0xfffffffffffbfefd]}, 0x8) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xd) rt_sigsuspend(&(0x7f0000000400), 0x8) 9m19.710184015s ago: executing program 4 (id=3202): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000240)={[{@usrquota}, {@grpjquota}, {@nombcache}]}, 0x1, 0x4c0, &(0x7f0000000600)="$eJzs3c1rXOUaAPBnZpo0SdPbj3u5tL1wW+iF3g+aTy5N7r2bu1IXBbHgRqHGZBprJpmQmdQmdJHqrgsXoiiIC/f+BW7syiKIa92LC6lojaCCMHLOzLTJJBMHTTM25/eD07znY+Z53w7Py3veOWdOAJl1JvknFzEYEZ9ExJH66uYDztT/rN+7MZ0suajVLn2dS49L1pcP1w9tvu5QRKxFRF9EPPVYxPO5rXErK6tzU6VScamxPlydXxyurKyevzo/NVucLS6MTlyYnJwYGR+b3LW23nr1xVsX33+i973vX7l757UPP0iqNdjYl7Rj1wJtUG96TxzbsO1ARPzvYQTrgkKjPf3drgi/SvL5/TEizqb5fyQK6acJZEGtVqv9VDvYbvdaDdi38ukYOJcfioh6OZ8fGqqP4f8UA/lSuVL915Xy8sJMfax8NHryV66WiiNRSM8VjkZPLlkfTcsP1sda1scj0jHw64X+dH1oulya2duuDmhxqCX/vyvU8x/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+QyY9efFistSa97/PXFtZnitfOz9TrMwNzS9PD02XlxaHZsvl2fSenflfer9Subw4+u9Yvj5cLVaqw5WV1cvz5eWF6uX0vv7LxZ49aRXQiWOnb3+Wi4i1//SnS6K3sU+uwv5Wq+Wi2/cgA91R6HYHBHSNqT/ILuf4QOtP9LaOC/ravXDxwXwh8GjJd7sCQNecO+n7P8gq8/+QXeb/IbuM8YFtHtG3yU7z/8Cjyfw/ZNdgm+d/Hd7w7K6RiPhDRHxa6DnYfNYXsB/kv8w1xv/njvxtsHVvb+6H9CuC3oh46e1Lb16fqlaXRpPt39zfXn2rsX1swwvbnjAA3dLM02YeAwDZtX7vxnRz2cu4X/2/fhHC1vgHGnOTfel3lAPruU3XKuR26dqFtZsRcWK7+LnG887rJzID64Ut8Y83/ubqb5HW90D63PS9iX9yQ/y/boh/6jf/r0A23E76n5Ht8i+f5nTcz7/N/c/gLl070b7/y9/v/wpt+r/THcZ44Z2Xv2gb/2bEqW3jN+P1pbFa4yd1O9dh/LvPPv3ndvtq79bfZ7v4TUmprzq/OFxZWT2f/o7cbHFhdOLC5OTEyPjY5HA6Rz3cnKne6r8nPr6zU/sH2sTfqf3Jtn902P4f//LRM2d2iP/3s9t//sd3iN8fEf/sMP63Y58/125fEn+mTfvzO8RPto13GL/yxuMHOzwUANgDlZXVualSqbikoKDQlcLN30c1Wgrd7pmAh62ykpyaJ0nf7ZoAAAAAAAAAAAAAndqLy4m73UYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP3g5wAAAP//WvrVLg==") r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mount(&(0x7f00000004c0)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1c0000000, 0x8005, 0x0, 0x0, 0x15, 0x0, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x200]}) write$UHID_INPUT(r0, &(0x7f0000001300)={0x8, {"c4078fc526d0827f35ca2e5d0fb4af3632cc2a89483b984b10eac14dbbf95a0046142f2a9d0c89d94602d5c1c5cc2e0437b58840d93b60f512ecd60289bda32ac0d5c352f75f4ed7a27509cb80ef0dd802ac23a6bbc60e777dee50300fbae53033029cb6ab34ad0a49362211f64599a39aec5dd2a2fa93be45634d94f7a9ef13e6da594e89753e5c595c4b6746c089d6f720f9c7b6bfc225a3270143985cc4761583fee0525c5edcd4d1ccb74c668b9be2f05b449d04482291950ee8de18baab835a28eb7d47acb890133e868e54332183372348a1d43988f275738c5917d3c3d9368cb49d49e7f0b4725a4532e5857f2d0316ac77d01ec74a0ec7b394025c137832d6afce59839a8ef892f0d6fe0975c42a80e7795de75699c951f0d1ff14833abd28aa509e2a19b22f6e545b3e7bb2f9df565cf04ad3c2e394643ead2f72934189886e9f0933686ab4cce4da0f8fd0ddc3b0cb4a56027048a6cd2434b23bf116b281873af2de39342dd00d25f0b9d2b27f551e49deb19068d2ce5826a071a5c29676198132ed6f8f03b60551e192efea827ae6eb8107108ee7e2036ae0502a154a89c73e1dba5e2af833ef6e22821d6352b346c8d35b5527fe45b5c76383d4c7aafc2cc7b745aa790f6bd54b7d9f2494e88e4ed5b891815d3cbcdaf3edd0512903744ee2da32abdcf5606b9fde682ff566d97a6ac3af7d0578fda7acfdbe45d5b3a517416612019db5d137e095130451495cb11b9b820d4c515d71ba501be79e627084de9bcea955cc614918ccd39786117dd8d37d709858bda73c033e6ec494f0bb8f45ab77fea7310315e9731200b5471aa20c9f49d6cda9e54dc17e3054d76d89d79bccd5373a7704ddd9e4e96dbd413cc9c3d33dee23f67a8b0780f1ffe6e1aaf32ad3b8f8923e93932455a4a95b4ad64f54e228005c660640c2f50c52c4aed572463a59aa8697b263f377b952d739f1458e4d95384d7a2842a95453b62000095f7a76dda58c4a0f3bfa60071ec1257d9f275a758a0ec6a3627f3b9085feed3718c31315eadea9a4029b7cc4c87223ca2a0ea5ffd5d3de39f8c864557db2f4462bd7c9a0834fd2304a0d3799a13530f7431b8a88a497ac9eaf4f9b40965f7935d9f8c75313208bd7ebc5ee729f1fc1aa12581723c01fc858bb61ec8fadce13c51a22ba6e250ab302da2289be9bc7aa9c325f6472c10c6fe4981746878b328cf7e9fb8f3ad8ce5f9abb4bcaf4f57e5855023583236f018b67d6dcee67242be6eb8c68edecf01e924ad6ca8333eadf3d3e9a3efe969c8df77d41c296e9e632e4b97659884b93b4284be04f52c5ea1675791fc848aaa15153bce7152e68d00559c02b376c86ca651e884d3263260536751f523d2c0645775aa236db6c06c9b4383efed114ca058ec4ccf444122a7b0879d42299cb24a3d2c0ac0ee3eba7d913fcea0948c8032ace06cda81b4b81b9d0663b0ffe331ec7819488f7ae910c604b325dbffa603502b30282e92defbfd57eedc80a928a48b14fdd65cbd996409ba393108ded8ac3ffb67f34f799c91b8513a78d30ded138749d085aafd7e1ce934e6dc1de9871651076dea6c52d2a4ad8d48f3d12847e9c87292bd1550c67b29257efdc339d032c783b62d580a2af85ee35a8bebf0ad98644adc5cf4e143948c7da9bcc8345b5fc3ecd900c66b5d5979e2e4d86c515a25e183d99750c5f80a69d579f4d15eb9e7fe418563096cbff9b2511422383fe745ba9c0e0aa90ce24630de7e0684926f62499840bedc78c801561148b8893e1fa15266c94058ee95065ef29ddeb1a5df276aa3b84239f859d3d7f1304417956dd0051a4f64977fc6e01a1b9d9c5b585dcd8aa1291cf8258b5afce85c8d185196feb43c856640224be75bec3b5058c1ea775275af3e000489d5fb2bf6ebe1e33ed6096ddf078fd5bef47ce7a5ad365f97e558746ce5368e6718203c446b0dd682115fcbc148ef6606ec1a952096836dad792bd12001797447f06d1540202344ac1c44c41931d366d315d5301fac3e07978fe90f8b0a0f1d7d2d5107277cd2be8b77709adb22824ad3c60c92a253682554f7b2c78d855c1d6537525f5aca282980f0d8170802c0c843323c70cfccf8b71ea64793b0bb67513010e424a267ba647bc92b190014cb05e75664845cd02e11b2c8ec94fb77554e0af3a7b65a2fdb4620794c7fef86c39cdee6d43d8d33078e5dca7666f2d447cda23743816d82c03e28b225005b5c8abef5e7e6406c3c6a39ae4757908954aa9144f397d3797d89f58434a47e70602c4ecf07773aeaa7706e637172e9dab989348dca81735b569d2981846d71bcec601f9f3d1cd352205ab3e9e23c9fe3ffebbe6204440971b14fbc02388e19b77ccf12d841aa9656490efbf0dc07bcc768ab70088b771fb8f2ba2b1b1ed9c99535f78d2a566247d3356669d4dc8eee75477564ff71534586837bb01f2d6a458492d622889e6cd14d1df3f86c48749e44500cfbc09215870cabcd964f72f113f0a59caae5cc8e9dd16aac05c44fb5f429d680186f5139596cc9317847944cb63c5c3d4d5874c911bb2b8e853e2ecad1e2e8e373869147e85fb572eed408667461abe12a03d305c197f2253f90625a65bf37c552b05c092f08f56a89daf0be10e0d2434f9793e625b23b13592ceee86cc0ba58861296f8a77f023cee3e788bc25e62295024a7e61f1fb6beeae71c35969eb511eb6a9c1569606a71f1b29e1ec1f634123795bde07f69da832a2364ae3d57b78158e8d37da172483c4dc20a49e6b4473e6a7485731cbcef424200739336becbb45e955a92b6a2e11bf87b34a8503754ad7c410a1673ec19e119393b0e9a570e071e12f5b3ad017062a014b11c9dc027c6d01195d235333aa3552638827c1dffc309d836c3a61ab419278d44ea8126ac1153ee6bf3ebacd4fe867ffa6bda3b9869a284aac423ebd3550f761635d2d4b3b126b5b30207b5487c81951bac272fc8fd113af807a8294266a108bb8b6a7a7a3dbca924d0660f27072d42c795b98836104e334f5a30558d7133d2696ec7e38447376ce6d485da86809aa8a4df8e96963fcb87682943a1eff4d7ad1c1c80e3196407d350dc81a5daa410490a3e981690c5572b3d9169ecf3d0076ed7d31e9d73f64050500e6848f2a6afbf44e414a04d7bbc34f608de735a18d3d67de550231eeb539ba23de4d70d94f5dab7c49c4023130f70851398352bc5f351c754b6071610ef6fcd8c09f6006c538c1c6dd3f67b97df6b88a59b37ed55ce73f00217b2057cfd503a7ea6eb712dfdf40c236fd89c0110c531b18a6f28850da3ea3ff06d11caf230e17c1141dfdbb157faa47a32e1af81c8cb4a0ea372eecc04963f9cdcbc73d2ddc995e912c5482af0bebfa530fa92ad0de27e3d3f30af4eb19f7dd205c57378c30c61056be412bf62ad3b41b0c707ddc8b4df244b4d7564a31f19412a77c043ae8d39b135c72f854a0781dbb8b86c1463dc8fd57710548f10f71b1f6a59e06cfb11635395004cfcf6473493d8f60a18e759078d6a75d0e5183b073286c99d90641b1518952244fff00c04740534fa55efb11b9e5f58ff4783e979bac0525aa8cd60f48d62b855f957fff4ac6d986f09c2ed6f0e52225e3e5dc603221b34e61c54eea5627a8a3f66320736b0e366640247e2e12187f7699922ac5c6ac47618521aeba5ad945041be48a27486fe742fede7e49e7d81a48fe0726498649209c1b117ab007d4956d814f487125d8c9fb65c09a16fb09d2becc56fdb4fd651525e710901de2b122dc71f392d69b96a7f78081387204cd8b0e398c59870100571fdbd80cacc847cb7df0a704f36491a17990b4bb63552f39c782840c5620c45f665153934328efc8e4d9746a6b0a3458aa813ac4551b8e116442f66551f2828202d66ffbbded203fb008989f7c99dd8c69515088d6eb7088a09f21c1c9ce79d694ccda6bc42c168f3794841c281805b95b985e65ecae17132bfb4c12b1e822063e8cf59d145b7f108c20d7341eaa36f96f11b025dcd18bc835e05d4175759cfdeca0fb475d7c82f2ced3450e738ac9dd78598e73e73eac96a4393859d688bad1f639fbb73fe848dfe080c0cd0388ee039d93d49cd36386aaf254c1506aec453098d169678484b21bb19e0d1934b1872626323a2ca8c3d43973b7af9791dd6cb3571a8e98fa8722ca4723b936a12b2f1a4f3c688cad970075b73d3a0bfdc02f58dfa76c4d19f48284bc768d7007aa306e89372f7b77161cf9bcd0f26b478b668c8f36b100d4abd9cf3d5a6dca1a6cfff2ffde62bcee02a2f795fa398a338e415a90a43a2324ea48e281f43f99de85590098da0aa3691b9e1bd728a4f6cd1ebea3c02b4a749b26fe1ce3fb5fc05cee7882a7cd018615eb02dc1edea387a84617cfd3755361776524b01835e11d89b6c8eca34b9b0d00437112e74712dcaa208fee88052f9ebbbe6931f539b937a49d6140c19267d2a7250b6dc2c65c20ff253b3c6463e1bef3fb0b29a0557534bb7923ac71bd5097799c0429b544c8d3e0e0f8e8ab48e0f5868208d9555842d7df01c4afb23599d880d2a16ac84e4902bdea4bcb3661b61894822c6df70786ab30d68a2bbea041824922c640511373416d6cc055559ac74c5d2839f86bb062c907de325d0c106f2404a236e809c9b3f4cb1ac31ecdd7eb0e8535cd20e83dfe2defc430bbea445f9d7954240f64050195b9a2e5c051ec6e4dcb58e482f44c920f0002776824faef9f902938625ed960b0b2de707a5917c9be73352ab3e4b77e202186d2802124fe294de8edc44f3af6abec028d5db97db6603a17d3a8a66c633af5afdaeb87e66a1c4cd2d1952c424b6a20c7a3a0ccb72f7b2d2735988d9afb7acb351faa4d1588bd8f7fc3410afe97eba957770f4d6d05ae14fc8fd2fdfa523c5da9be71413abcc8333318ac128db1185f99d2bae8aeedd9c1c9b282ea881c4d8babeee85e0afd897c1b2d1ec2b857f097760623fd2708c607fb3e78df5e2da7f2f592e78790c76f103162adaf1b47f3a673928a789ba96aab266c7e0bc3ff5520fb35135b366499a585ab855d2249fcee1f1d106256927891fbd8e086f276083fe9116ef78167e564e852a052e7b8da9a678e079fd6fbc44b69f975bdcba37b1db2d16f59bcd4b7c0162dc0ad1e42b1af63e063255b48221396cb6eb98ed4d43046022637c321207cd832abd04a623159b3539a16d25a06434beeb4908c02a859984a4b6dce3d4566300353773122a3c1e205f320a1760023b42fdc76ec1c20a272441a5ae87a05f2850e761a10d6fd5ced98467671d878869d640ee6cbc555b5c1da944d4f8095fecc36754847a91c73c7e7534b40c8f1848845cd7438ec136abb2378e14ebf82630b25f3bda8320d88ebdd3e2f67854df1190bb705f1f227f46a2244c012732a3d4d9035cc55c6bc406bc76b74114ff91cd2f3a28de4cd79d2784adbb0a4d9db9b583c2af4fa33e374ff3f6609bfcec50e9ee0bd51b5b0bfb8cdc49a180ffbff668252023f70c06f96e1d09f4744ca59ed8e3615feac4b3175e01ecba884f8c17737a63074ba238e7715065412a511ed78605b27f763596233d11c78940672ea2f7cae4d8ef13db586c912a362378cb17a91e3e80bf5514429946326171ecac4e810787e176c9708232fcffd981149b41dc52eb5e27e4accac37d9202de18e254a573291503136e51d5961a74b7dcbaebc3365c40f44c1755192723568d4fe587048ca4fcc0c24966ae1cb70e5e6fcd37ef2", 0x1000}}, 0x1006) 9m18.44582122s ago: executing program 4 (id=3211): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c) r1 = socket(0x9, 0x80000, 0x7fffffff) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, 0x0, &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r4, 0x0, 0x1, 0x0) newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x1000) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f0000000c40)=ANY=[@ANYRES32=0x0], 0x9) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x23, @loopback, 0x23}, 0x1c) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r6 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r6, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000009c0)=0xc43, 0x4) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r1) sendmmsg$inet6(r0, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000003640)=[{&(0x7f0000002440)="4137a29b582bd471798f15f967e7f8118e1abf61ebd7d146a12a42f6ffd2340daaa8dcf6da818cc0efac75e8c35a", 0x2e}], 0x1}}], 0x1, 0x4000001) shutdown(r0, 0x1) 9m18.066202357s ago: executing program 4 (id=3216): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x1b, &(0x7f0000000500)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@printk={@lli, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x101}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 9m17.837070829s ago: executing program 33 (id=3216): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x1b, &(0x7f0000000500)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@printk={@lli, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x101}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 7m38.839777438s ago: executing program 3 (id=3786): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 7m38.354254716s ago: executing program 3 (id=3789): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x8004, &(0x7f0000000080)={[{@discard}, {@bh}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x1, 0x7b9, &(0x7f00000007c0)="$eJzs3d9rHNUeAPDvbJLmR3tvcuFy7+1b4EJvoHRzU2Or4EPFBxEsFPTZNmy2oWaTLdlNaULAFhF8EVR8EPSlz/6ob776A3zS/8IHaamaFis+SGR2Z5M02c2vJtloPh+YzDkzsznnO+fMzNmdYTeAQ2sw/ZOLOB4RbycR/dnyJCK6aqnOiHP17R4uLvRERCGJpaWXfkpq2zxYXCjEqtekjmaZ/0TEV29EnMytL7cyNz85VioVZ7L8cHXq6nBlbv7UlamxieJEcfrMyOjo6bNPnj2ze7H+8t38sbvvPP+/T8/99vq/b7/1dRLn4li2bnUcu2UwBrN90pXuwkc8t9uFtVnS7gqwI+mh2VE/yuN49EdHLdVC737WDADYK69FxBIAcMgkrv8AcMg0Pgd4sLhQaEzt/URif917NiJ66vE/zKb6ms7snl1P7T5o34PkkTsjSUQM7EL5gxHx4eevnOjI8mk93EsD9sONmxFxaWBw/fk/WffMwnb9f6OVS9212eCaxYft+gPt9EU6/nmq2fgvtzz+iSbjn+76sfuvxy1/8+M/d+dxy9hIOv57pv5s25rx3/JDawMdWe5vtTFfV3L5SqmYntv+HhFD0dWd5kdqmzYfuQ3d//1+q/Kz8d/H6fTzu69+lJafzle2yN3p7H70NeNj1c5vHjfwzL2b0Zcl18SfLLd/0mL8e2GLZbzw9JsftFqXxp/G25jWx7+3lm5FnGja/ittmWz4fOJwrTsMNzpFE599/35fq/JXt386peWn892PtLl7N6PWAZJkZR/U1yzHP5Csfl6zsv0yvr3V/2WrdZvH37T/jx1JXq6lj2TLro9VqzMjEUeSF9cvP73y2ka+sX0a/9B/mx//9WKb9//0PeGlLcbfeffHT3Ye/95K4x/fuP+vaf+ebPHKks0Stx9OdrQqf2vtP1pLDWVL0vbfLK6t1GtnvRkAAAAAAAAAAAAAAAAAAAAAAAAAti8XEcciyeWX07lcPl//De9/Rl+uVK5UT14uz06PR+23sgeiK9f4qsv+Vd+HOpJ9H34jf3pN/omI+EdEvNfdW8vnC+XSeLuDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM0Ra//5/6obvdtQMA9kxPuysAAOw7138AOHy2d/3v3bN6AAD7x/t/ADh8tnz9v7S39QAA9o/3/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOyxC+fPp9PSr4sLhTQ/fm1udrJ87dR4sTKZn5ot5Avlmav5iXJ5olTMF8pTLf/RjfqsVC5fHY3p2evD1WKlOlyZm784VZ6drl68MjU2UbxY7Nq3yAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABg6ypz85NjpVJx5i+RuLES2C7/5962xtV3MHbvqkRnHIhqHOhEdxyIauwwsfos0duGMxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAn8MfAQAA//94WBdi") r0 = openat(0xffffffffffffff9c, &(0x7f0000000d80)='./file1\x00', 0x40282, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0) pwrite64(r1, 0x0, 0x0, 0x4fed0) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000300)=ANY=[@ANYBLOB="00601020400000001ea5315aa7f835df05"]) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611) 7m37.860774904s ago: executing program 3 (id=3792): bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0x1, 0x58}, 0x10) r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x1b0, 0x10000) ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000100)=""/4096) r1 = syz_open_dev$usbfs(&(0x7f0000001100), 0x3, 0x100) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000001180)=@usbdevfs_driver={0x0, 0x6, &(0x7f0000001140)="b73d"}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000011c0), 0x200040, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r2, 0xc0189374, &(0x7f0000001200)={{0x1, 0x1, 0x18, r0, {0xf}}, './file0\x00'}) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000001240)={0x1}, 0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000001280)={0xa, 0x840a, 0x8, 0x3ff, 0x0}, &(0x7f00000012c0)=0x10) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x6d, &(0x7f0000001300)={r4, 0x8e, "58f0e9b6f27dec9b8fd2b8768181353e8f36126cac8a717ab61a7f5cff84d7a990f8f624b99e0cbe607345ccb3e6161e668a807dd4de378d767816d58a4ff3596bb1fa4666c80b0026ceb582e23573e395babf5f29b6e8c0d1188a1992cec95a6a8f3c7dbddc401a69042e70511ba488479c9d08c88acd3cafb315fb76a07c780bdb95fbbadae6ebd90d5d34bf6f"}, &(0x7f00000013c0)=0x96) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r3, 0x3) ioctl$USBDEVFS_FREE_STREAMS(r3, 0x8008551d, &(0x7f0000001400)={0xd888, 0x11, [{0x9, 0x1}, {0x1, 0x1}, {0xa, 0x1}, {0x2}, {0x6}, {0x9, 0x1}, {0x8}, {}, {0x3}, {0x6}, {0x8}, {0x3, 0x1}, {0xc, 0x1}, {0x7}, {0xa, 0x1}, {0x7}, {0x8}]}) close(r2) r5 = syz_open_dev$sg(&(0x7f0000001440), 0x9, 0x80000) ioctl$SG_GET_TIMEOUT(r5, 0x2202, 0x0) getdents(r3, &(0x7f0000001480)=""/120, 0x78) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1000003, 0x810, r2, 0xf1e41000) fstat(r2, &(0x7f0000001500)) syz_emit_ethernet(0x9b, &(0x7f0000001580)={@multicast, @empty, @void, {@ipv4={0x800, @tipc={{0x17, 0x4, 0x3, 0xf, 0x8d, 0x66, 0x0, 0x7, 0x6, 0x0, @multicast2, @rand_addr=0x64010101, {[@ssrr={0x89, 0xb, 0xc6, [@remote, @broadcast]}, @cipso={0x86, 0x17, 0x3, [{0x7, 0x11, "a3db667ea9a491533c44233fca0d06"}]}, @timestamp_prespec={0x44, 0x24, 0x24, 0x3, 0x5, [{@multicast1, 0x7fff}, {@loopback}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@dev={0xac, 0x14, 0x14, 0x1f}, 0x4125}]}]}}, @payload_mcast={{{{{{0x31, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x2, 0xdb0, 0x0, 0x3, 0xc, 0x5, 0x1, 0x9, 0x9, 0x1, 0x4e22, 0xfff}, 0x2, 0x4}, 0x2}, 0x1}}, [0x0, 0x0, 0x0, 0x0, 0x0]}}}}}, &(0x7f0000001640)={0x0, 0x3, [0x856, 0xa84, 0x7cf, 0x6f8]}) getsockopt$SO_COOKIE(0xffffffffffffffff, 0x1, 0x39, &(0x7f0000001680), &(0x7f00000016c0)=0x8) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000001700)={0x43, 0x1, 0x1}, 0x10) ioctl$DRM_IOCTL_MODE_GETPLANE(r3, 0xc02064b6, &(0x7f0000001780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000001740)=[0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, &(0x7f00000017c0)={r6, 0x5, 0xbd7, 0x9, 0x2, [], [0x8000, 0x1, 0x1ff, 0x6], [0x1, 0x0, 0x6, 0x6], [0x80000000, 0x17ff00000000000, 0x3, 0xfffffffffffff24f]}) r7 = openat$rtc(0xffffffffffffff9c, &(0x7f0000001840), 0x10400, 0x0) r8 = fcntl$dupfd(r5, 0x0, r5) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r8, 0xc0189375, &(0x7f0000001880)={{0x1, 0x1, 0x18, r7}, './file0\x00'}) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r8, 0x810c5701, &(0x7f00000018c0)) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f0000001a00)={{0x1, 0x1, 0x18, r2, {0x1}}, './file0\x00'}) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r9, 0x84, 0x79, &(0x7f0000001a40)={0x0, 0x6, 0xff}, 0x8) ioctl$sock_x25_SIOCADDRT(r9, 0x890b, &(0x7f0000001a80)={@remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x2}, 0x1, 'ip_vti0\x00'}) 7m36.854227674s ago: executing program 3 (id=3797): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) unshare(0x2a020400) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) io_setup(0x4, &(0x7f00000014c0)=0x0) r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='mounts\x00') io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0xfffe, r1, 0x0}]) pipe2(0x0, 0x80000) pipe2(0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000000), 0x2, 0x101102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000200)={0x50, 0x0, 0x0, {0x7, 0x29, 0x20200, 0x0, 0x0, 0xffff}}, 0x50) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='//sys\x00\x00\x00\x00\x00\x00\x80\x004\x00\x00s/\x92ync_\x93\x96\xff\x92\xaf\x00Se\xf44.\x00'/49}, 0x30) mount$bpf(0x200000000000, &(0x7f0000000200)='./file0\x00', 0x0, 0x206002, 0x0) (fail_nth: 3) 7m35.290269868s ago: executing program 3 (id=3804): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) unshare(0x2a020400) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) io_setup(0x4, &(0x7f00000014c0)=0x0) r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='mounts\x00') io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0xfffe, r1, 0x0}]) pipe2(0x0, 0x80000) pipe2(0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000000), 0x2, 0x101102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000200)={0x50, 0x0, 0x0, {0x7, 0x29, 0x20200, 0x0, 0x0, 0xffff}}, 0x50) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='//sys\x00\x00\x00\x00\x00\x00\x80\x004\x00\x00s/\x92ync_\x93\x96\xff\x92\xaf\x00Se\xf44.\x00'/49}, 0x30) mount$bpf(0x200000000000, &(0x7f0000000200)='./file0\x00', 0x0, 0x206002, 0x0) 7m33.385669976s ago: executing program 3 (id=3810): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x8004, &(0x7f0000000080)={[{@discard}, {@bh}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x1, 0x7b9, &(0x7f00000007c0)="$eJzs3d9rHNUeAPDvbJLmR3tvcuFy7+1b4EJvoHRzU2Or4EPFBxEsFPTZNmy2oWaTLdlNaULAFhF8EVR8EPSlz/6ob776A3zS/8IHaamaFis+SGR2Z5M02c2vJtloPh+YzDkzsznnO+fMzNmdYTeAQ2sw/ZOLOB4RbycR/dnyJCK6aqnOiHP17R4uLvRERCGJpaWXfkpq2zxYXCjEqtekjmaZ/0TEV29EnMytL7cyNz85VioVZ7L8cHXq6nBlbv7UlamxieJEcfrMyOjo6bNPnj2ze7H+8t38sbvvPP+/T8/99vq/b7/1dRLn4li2bnUcu2UwBrN90pXuwkc8t9uFtVnS7gqwI+mh2VE/yuN49EdHLdVC737WDADYK69FxBIAcMgkrv8AcMg0Pgd4sLhQaEzt/URif917NiJ66vE/zKb6ms7snl1P7T5o34PkkTsjSUQM7EL5gxHx4eevnOjI8mk93EsD9sONmxFxaWBw/fk/WffMwnb9f6OVS9212eCaxYft+gPt9EU6/nmq2fgvtzz+iSbjn+76sfuvxy1/8+M/d+dxy9hIOv57pv5s25rx3/JDawMdWe5vtTFfV3L5SqmYntv+HhFD0dWd5kdqmzYfuQ3d//1+q/Kz8d/H6fTzu69+lJafzle2yN3p7H70NeNj1c5vHjfwzL2b0Zcl18SfLLd/0mL8e2GLZbzw9JsftFqXxp/G25jWx7+3lm5FnGja/ittmWz4fOJwrTsMNzpFE599/35fq/JXt386peWn892PtLl7N6PWAZJkZR/U1yzHP5Csfl6zsv0yvr3V/2WrdZvH37T/jx1JXq6lj2TLro9VqzMjEUeSF9cvP73y2ka+sX0a/9B/mx//9WKb9//0PeGlLcbfeffHT3Ye/95K4x/fuP+vaf+ebPHKks0Stx9OdrQqf2vtP1pLDWVL0vbfLK6t1GtnvRkAAAAAAAAAAAAAAAAAAAAAAAAAti8XEcciyeWX07lcPl//De9/Rl+uVK5UT14uz06PR+23sgeiK9f4qsv+Vd+HOpJ9H34jf3pN/omI+EdEvNfdW8vnC+XSeLuDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM0Ra//5/6obvdtQMA9kxPuysAAOw7138AOHy2d/3v3bN6AAD7x/t/ADh8tnz9v7S39QAA9o/3/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOyxC+fPp9PSr4sLhTQ/fm1udrJ87dR4sTKZn5ot5Avlmav5iXJ5olTMF8pTLf/RjfqsVC5fHY3p2evD1WKlOlyZm784VZ6drl68MjU2UbxY7Nq3yAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABg6ypz85NjpVJx5i+RuLES2C7/5962xtV3MHbvqkRnHIhqHOhEdxyIauwwsfos0duGMxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAn8MfAQAA//94WBdi") r0 = openat(0xffffffffffffff9c, &(0x7f0000000d80)='./file1\x00', 0x40282, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0) pwrite64(r1, &(0x7f0000000000), 0x0, 0x4fed0) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000300)=ANY=[@ANYBLOB="00601020400000001ea5315aa7f835df05"]) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611) 7m17.901682154s ago: executing program 34 (id=3810): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x8004, &(0x7f0000000080)={[{@discard}, {@bh}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x1, 0x7b9, &(0x7f00000007c0)="$eJzs3d9rHNUeAPDvbJLmR3tvcuFy7+1b4EJvoHRzU2Or4EPFBxEsFPTZNmy2oWaTLdlNaULAFhF8EVR8EPSlz/6ob776A3zS/8IHaamaFis+SGR2Z5M02c2vJtloPh+YzDkzsznnO+fMzNmdYTeAQ2sw/ZOLOB4RbycR/dnyJCK6aqnOiHP17R4uLvRERCGJpaWXfkpq2zxYXCjEqtekjmaZ/0TEV29EnMytL7cyNz85VioVZ7L8cHXq6nBlbv7UlamxieJEcfrMyOjo6bNPnj2ze7H+8t38sbvvPP+/T8/99vq/b7/1dRLn4li2bnUcu2UwBrN90pXuwkc8t9uFtVnS7gqwI+mh2VE/yuN49EdHLdVC737WDADYK69FxBIAcMgkrv8AcMg0Pgd4sLhQaEzt/URif917NiJ66vE/zKb6ms7snl1P7T5o34PkkTsjSUQM7EL5gxHx4eevnOjI8mk93EsD9sONmxFxaWBw/fk/WffMwnb9f6OVS9212eCaxYft+gPt9EU6/nmq2fgvtzz+iSbjn+76sfuvxy1/8+M/d+dxy9hIOv57pv5s25rx3/JDawMdWe5vtTFfV3L5SqmYntv+HhFD0dWd5kdqmzYfuQ3d//1+q/Kz8d/H6fTzu69+lJafzle2yN3p7H70NeNj1c5vHjfwzL2b0Zcl18SfLLd/0mL8e2GLZbzw9JsftFqXxp/G25jWx7+3lm5FnGja/ittmWz4fOJwrTsMNzpFE599/35fq/JXt386peWn892PtLl7N6PWAZJkZR/U1yzHP5Csfl6zsv0yvr3V/2WrdZvH37T/jx1JXq6lj2TLro9VqzMjEUeSF9cvP73y2ka+sX0a/9B/mx//9WKb9//0PeGlLcbfeffHT3Ye/95K4x/fuP+vaf+ebPHKks0Stx9OdrQqf2vtP1pLDWVL0vbfLK6t1GtnvRkAAAAAAAAAAAAAAAAAAAAAAAAAti8XEcciyeWX07lcPl//De9/Rl+uVK5UT14uz06PR+23sgeiK9f4qsv+Vd+HOpJ9H34jf3pN/omI+EdEvNfdW8vnC+XSeLuDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM0Ra//5/6obvdtQMA9kxPuysAAOw7138AOHy2d/3v3bN6AAD7x/t/ADh8tnz9v7S39QAA9o/3/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOyxC+fPp9PSr4sLhTQ/fm1udrJ87dR4sTKZn5ot5Avlmav5iXJ5olTMF8pTLf/RjfqsVC5fHY3p2evD1WKlOlyZm784VZ6drl68MjU2UbxY7Nq3yAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABg6ypz85NjpVJx5i+RuLES2C7/5962xtV3MHbvqkRnHIhqHOhEdxyIauwwsfos0duGMxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAn8MfAQAA//94WBdi") r0 = openat(0xffffffffffffff9c, &(0x7f0000000d80)='./file1\x00', 0x40282, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0) pwrite64(r1, &(0x7f0000000000), 0x0, 0x4fed0) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000300)=ANY=[@ANYBLOB="00601020400000001ea5315aa7f835df05"]) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611) 22.038461268s ago: executing program 2 (id=5184): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2}, 0x94) r0 = syz_open_dev$usbmon(&(0x7f0000000300), 0x7, 0x0) read$usbmon(r0, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000000), 0x205, 0x44680) 21.173190173s ago: executing program 2 (id=5192): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610413000000000095000000"], &(0x7f00000002c0)='GPL\x00', 0x2, 0xb3, &(0x7f000000cf3d)=""/179, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000100001000000f5ffffffffffffff000a14000000060a0000000000000000000002"], 0x3c}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f00000000c0)='nfs\x00', 0x0, &(0x7f0000000000)='\x06\x00\x00\x00\x04\xb0\xfe\x98\x9a!s\x91]\xab\xc9\xa2IV\xb6-\xd9z\x81\x91\x8aP}I\xc6\x0e\xd9\v\xda\xbfS\x16 \x04\r\xcd\xdb:\xd4\xaf\r\x11\xa0\xd7\xd7\xb6\x9bz\x99\xaf\xfd\x87fN\xad\x90U\xb4A\xdf\xabB\xbba\x7f\xb8\x96\x1a\xe7\xc1\xab\x16\x02\x000x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000100)=@IORING_OP_SHUTDOWN) io_uring_enter(r1, 0x2dbe, 0x0, 0x0, 0x0, 0x0) 19.094983797s ago: executing program 6 (id=5205): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000080), 0x12) r1 = syz_io_uring_setup(0xc4f, &(0x7f0000000440)={0x0, 0xfffffffc, 0x10100, 0x7fe}, &(0x7f0000000400)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000100)=@IORING_OP_SHUTDOWN) io_uring_enter(r1, 0x2dbe, 0x0, 0x0, 0x0, 0x0) (fail_nth: 1) 18.818495335s ago: executing program 2 (id=5207): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) fstatfs(0xffffffffffffffff, 0x0) io_setup(0x81, &(0x7f0000001440)=0x0) r1 = syz_io_uring_setup(0x2afc, &(0x7f0000000380)={0x0, 0x0, 0x13090, 0x1, 0x800002}, &(0x7f0000000400), &(0x7f00000005c0)) io_submit(r0, 0x1, &(0x7f00000008c0)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) io_uring_enter(r1, 0x4da3, 0xd93, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f00000003c0)={0x0, 0xfff, 0x3}) write$cgroup_pid(r2, &(0x7f0000000080), 0x12) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0xb540f1e41053034d}) r5 = syz_io_uring_setup(0xc4f, &(0x7f0000000440)={0x0, 0xfffffffc, 0x10100, 0x7fe}, &(0x7f0000000400)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000100)=@IORING_OP_SHUTDOWN) io_uring_enter(r5, 0x2dbe, 0x0, 0x0, 0x0, 0x0) 18.77067474s ago: executing program 6 (id=5208): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000020b30100000000000700000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) syz_mount_image$msdos(&(0x7f00000000c0), &(0x7f0000000100)='.\x00', 0x1a484bc, &(0x7f0000000200)=ANY=[@ANYRES8, @ANYBLOB="eea73c3ca047349ab66dff07b1e2bdc61875c6ccebea30ba1b8977c632dd4bd75d3cfd10cce0c88ccff0ff447cd9caded4abf65767e9dbbd7b5841a8ce3eae5cb5abfd7d4fb44c7151dec2b7b8f9cf870af04f1cc951b195c7fd36ffdbd0622cdc14395f095fb0d31f384214d59a0105d577557215473973f3b70178f49f07562f4d21cad59fafb7fbaf76061c56fdd2093329e2ece7cf96435bca11a90ba7f31e69c4b73ba3d172906ffc90f5de134a696a731d20a9cf70009a31f83d4b774b0d99de69f14de9e655b84b646166d979b9cdbde38324510998bba500000000007cf791c3e2fc9c72f920a64e0000000000000000000000b5ff5bb6b1fa869800651587af", @ANYRES8, @ANYRESDEC, @ANYRESOCT, @ANYRES16, @ANYRESHEX, @ANYRESHEX, @ANYRESDEC], 0x1, 0x0, &(0x7f0000000480)) syz_mount_image$msdos(&(0x7f0000000940), &(0x7f0000001cc0)='.\x00', 0x1a4a438, &(0x7f00000008c0)=ANY=[], 0xb, 0x0, &(0x7f0000000000)) bpf$ENABLE_STATS(0x20, 0x0, 0x0) open(0x0, 0xa37e, 0x100) mount(&(0x7f0000000100), &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0)='9p\x00', 0x0, &(0x7f0000000300)='trans=rdma,') 18.516196245s ago: executing program 2 (id=5210): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610413000000000095000000"], &(0x7f00000002c0)='GPL\x00', 0x2, 0xb3, &(0x7f000000cf3d)=""/179, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000100001000000f5ffffffffffffff000a14000000060a0000000000000000000002"], 0x3c}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f00000000c0)='nfs\x00', 0x0, &(0x7f0000000000)='\x06\x00\x00\x00\x04\xb0\xfe\x98\x9a!s\x91]\xab\xc9\xa2IV\xb6-\xd9z\x81\x91\x8aP}I\xc6\x0e\xd9\v\xda\xbfS\x16 \x04\r\xcd\xdb:\xd4\xaf\r\x11\xa0\xd7\xd7\xb6\x9bz\x99\xaf\xfd\x87fN\xad\x90U\xb4A\xdf\xabB\xbba\x7f\xb8\x96\x1a\xe7\xc1\xab\x16\x02\x000x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x7fff}}]}, 0x38}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x3}, {0x10}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) 3.028959451s ago: executing program 5 (id=5245): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0xa, 0x2) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$kcm(0x21, 0x2, 0xa) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) fanotify_init(0x20, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1000, 0x4}, 0x0, &(0x7f0000000180)={0x3ff, 0x0, 0x100, 0x2}, &(0x7f0000000300)={0x0, 0x3938700}, 0x0) 1.996043553s ago: executing program 5 (id=5246): sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bind$tipc(0xffffffffffffffff, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_mount_image$hfsplus(&(0x7f00000000c0), &(0x7f0000000980)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x3200004, &(0x7f0000000140)={[{@nls={'nls', 0x3d, 'macinuit'}}, {}, {@umask={'umask', 0x3d, 0x1000}}, {@uid}, {@nodecompose}, {@force}]}, 0x3, 0x6b9, &(0x7f0000000a00)="$eJzs3U1sHGcZB/D/bJx1Nkip26ZtQEi1GqmCRiR2ViVBQmpACOUQoQguvVqJ01jZpJXtorRCZAMUJE6cUA8cilA49IQQQionRDkjIXHh5BuHSNw45AAYzezsem1vHDuOvab9/aTJvLPv1zOP52N37GgDfGpdfD2Huyly8dSl2+X2yr12Z+Ve+2a/nGQySSOZ6K1StJLi4+RCeks+W75YD1c8bJ5X739UTLz/Ybu3NVEvVfvGVv02GdmymxwZbBxKMt0r/nvbw24ar1qqca6sjfeYikHcZcJO9hMH47a6SXetsvHI7ts/b4ED607vvrnJVHI0vbtr+T4g9dXh0VeG8dvy2tTdvzgAAABgr4z8LD/sqQd5kNs5tj/hAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwCdD0fvOwKJeGv3ydIr+9/83h75TvznmcHfpvWvV6ttPjTsQAAAAAAAAANiVFx/kQW7nWH97tah+5/9StXG8+vczeTtLmc9iTud25rKc5SxmNsnU0EDN23PLy4uzwz2rPxJY+nnKnqurq3fqnmdH9jy7Pq7uxkBH/aXBpkYAAAAAAAAA8Kn1g1xc+/0/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcBEVyqLeqluP98lQaE0mOJGkW04PmzbEG+wT8cdwBAAAAwN5r1etjxX97hdWi+sz/fPW5/0jezq0sZyHL6WQ+V6tnAb1P/Y2/dtudlXvtm+WyeeCv/XNHcVQjpvfsYfTMM1WL5wY9Luab+U5OZTqXs5iFfDdzWc58pvONqjSXIlP104uplXut9GPdHO+FdVuXN8b24lC5jO9EFUkr17JQxXY6V5r90Bt1uxNDs/2+mWyY8W6ZneK12jZzdLVel3v0s3p9MExVe354kJGZOvdlNp4ezvvm3O/wONk402wag2dQx9dmKTc3zvRYOT9ar8tc/3hvc77DR2nrM9H9abnVP/qe3zrnyRf/9qfL1xu3bly/tnTq4BxGj2njMdEeysQL28pEp8xEdxeZOLKb+J+cZp2N3lV0Z1fLl6q+x7KQb+XNXM18zmUmszmfmXwlZ9PO2aG8Prd1XqtzrbGzc+3kF+pCeU/6ydC9ad9MPqyizOvTQ3kdvtJNVXXDr6xl6ZltZKloZnSW/j4ylInP1YVyjh8O3XHGb5CJxtq1uR/ds1tn4pf/WU2y1Ll1Y/H63FvbnO/lel2etu+tvzb/6ons0M7Vu1seL8+UP6z0bhvDR0dZ92y/bt2RM1vVHR/Urb/PNZupzude3aPO1HKk5++OGqlX98LIWdpV3YmhunXvcvJmOoN3IQAcYEdfOdps3W/9pfVB60et661LR74+eX7y880c/vPEHw79pvHrxleLV/JBvp9j444UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+CZbeeffGXKczv3gAC2k84QHvjqzqp6L3SvNg7PtWhcP7O+mhnTSe3OqI+m2SLbo3x5HMVpID8DOd62RiH+aazIiqS4NXWkljEE+SGwfkC+6AvXBm+eZbZ5beefdLCzfn3ph/Y/7W2fPnXjvX/vLsnTPXFjrzM71/xx0lsBfW3gaMOxIAAAAAAAAAAABgu3bz3wn+cWl7jUdMW3THsK8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA/6eLr+dwN0VmZ07PlNsr99qdcumX11pOJGkkKb6XFB8nF9JbMjU0XPGweV69/9EvXn7/w/baWBP99o0N/X73r9XVHe5Ft14yneRQvX60yW2Nd2VovO4OA+spBntYJuxkP3Ewbv8LAAD///zfBvQ=") llistxattr(&(0x7f0000000080)='./file1\x00', 0x0, 0x0) 1.879812105s ago: executing program 1 (id=5247): socket$pppoe(0x18, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1d1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() ptrace$pokeuser(0x6, r0, 0x6, 0x6) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="180000002e00010026bdf000fcdbdf1b04000000040010"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) close(0x3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_KEY(r5, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x40) close_range(r4, 0xffffffffffffffff, 0x0) 894.216162ms ago: executing program 1 (id=5248): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000006800), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000380)=r0, 0x12) sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) write$UHID_SET_REPORT_REPLY(0xffffffffffffffff, 0x0, 0xc) statx(0xffffffffffffff9c, 0x0, 0x100, 0x4, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r3, &(0x7f0000000140)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0xef7, 0x30, 0x30, 0x0, @in6={0x1b, 0x4e20, 0x7, @empty, 0xbff}, @ib={0x1b, 0xf, 0xffa, {"50916300000000000000000700"}, 0x8000000000000001, 0x8, 0x3}}}, 0x118) 0s ago: executing program 1 (id=5249): bind$bt_l2cap(0xffffffffffffffff, &(0x7f00000001c0)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x9, 0x2}, 0xe) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) openat$kvm(0xffffffffffffff9c, 0x0, 0x525d00, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r1, 0x4004ae99, 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000380)=ANY=[]) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @loopback}, 0x10) sendto(r0, &(0x7f00000002c0)='%', 0x300000, 0x0, 0x0, 0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) write$eventfd(r5, 0x0, 0x300) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000840)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, &(0x7f00000008c0)=[{0x10, 0x29, 0x7f}], 0x10}, 0x40080) kernel console output (not intermixed with test programs): Stopped filesystem due to reason: 3 [ 836.097679][T19735] loop6: detected capacity change from 0 to 65536 [ 836.120943][T19735] XFS (loop6): Mounting V5 Filesystem d6f69dbd-8c5d-46be-b88e-92c0ae88ceb2 [ 836.149485][T19735] XFS (loop6): Ending clean mount [ 836.380445][T16412] XFS (loop6): Unmounting Filesystem d6f69dbd-8c5d-46be-b88e-92c0ae88ceb2 [ 836.664493][T19755] loop6: detected capacity change from 0 to 1024 [ 836.672735][T19755] EXT4-fs (loop6): ext4_check_descriptors: Checksum for group 0 failed (62631!=20869) [ 836.682584][T19755] EXT4-fs (loop6): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 836.696771][T19755] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 836.740448][T19759] loop5: detected capacity change from 0 to 256 [ 836.747535][T19759] exfat: Deprecated parameter 'utf8' [ 836.759044][T19759] exfat: Deprecated parameter 'namecase' [ 836.778516][T19759] exfat: Deprecated parameter 'utf8' [ 836.793128][T16412] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 836.840496][T19759] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 836.958800][T19763] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 836.967744][T19763] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 836.993376][T19759] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 837.002203][T19759] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 837.993134][ T5859] IPVS: starting estimator thread 0... [ 838.118972][T19775] IPVS: using max 35 ests per chain, 84000 per kthread [ 838.734611][T19783] FAULT_INJECTION: forcing a failure. [ 838.734611][T19783] name failslab, interval 1, probability 0, space 0, times 0 [ 838.751060][T19783] CPU: 1 PID: 19783 Comm: syz.5.4826 Not tainted syzkaller #0 [ 838.758542][T19783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 838.768598][T19783] Call Trace: [ 838.771886][T19783] [ 838.774826][T19783] dump_stack_lvl+0x16c/0x230 [ 838.779522][T19783] ? show_regs_print_info+0x20/0x20 [ 838.784751][T19783] ? load_image+0x3b0/0x3b0 [ 838.789275][T19783] ? __might_sleep+0xe0/0xe0 [ 838.793881][T19783] ? __lock_acquire+0x7c80/0x7c80 [ 838.798926][T19783] should_fail_ex+0x39d/0x4d0 [ 838.803630][T19783] should_failslab+0x9/0x20 [ 838.808171][T19783] slab_pre_alloc_hook+0x59/0x310 [ 838.813237][T19783] ? snd_pcm_oss_change_params_locked+0x1ff/0x3d30 [ 838.819764][T19783] __kmem_cache_alloc_node+0x53/0x260 [ 838.825157][T19783] ? snd_pcm_oss_change_params_locked+0x1ff/0x3d30 [ 838.831680][T19783] kmalloc_trace+0x2a/0xe0 [ 838.836117][T19783] snd_pcm_oss_change_params_locked+0x1ff/0x3d30 [ 838.842455][T19783] ? __mutex_trylock_common+0x153/0x250 [ 838.847996][T19783] ? trace_raw_output_contention_end+0xd0/0xd0 [ 838.854146][T19783] ? trace_contention_end+0x39/0xe0 [ 838.859347][T19783] ? __mutex_lock+0x304/0xcc0 [ 838.864041][T19783] ? aa_file_perm+0x3e8/0xec0 [ 838.868734][T19783] ? snd_pcm_oss_read2+0x3d0/0x3d0 [ 838.873870][T19783] ? snd_pcm_oss_read+0x1f7/0x8c0 [ 838.878943][T19783] ? mutex_lock_nested+0x20/0x20 [ 838.883886][T19783] ? __asan_memset+0x22/0x40 [ 838.888466][T19783] ? __fsnotify_parent+0x651/0x720 [ 838.893564][T19783] snd_pcm_oss_read+0x268/0x8c0 [ 838.898404][T19783] ? snd_pcm_oss_unregister_minor+0x220/0x220 [ 838.904459][T19783] vfs_read+0x27e/0x920 [ 838.908609][T19783] ? kernel_read+0x1e0/0x1e0 [ 838.913184][T19783] ? __fget_files+0x28/0x4d0 [ 838.917758][T19783] ? __fget_files+0x44a/0x4d0 [ 838.922423][T19783] ? __fdget_pos+0x1d8/0x330 [ 838.926993][T19783] ? ksys_read+0x75/0x250 [ 838.931306][T19783] ksys_read+0x147/0x250 [ 838.935532][T19783] ? vfs_write+0x940/0x940 [ 838.939945][T19783] ? lockdep_hardirqs_on+0x98/0x150 [ 838.945134][T19783] do_syscall_64+0x55/0xb0 [ 838.949537][T19783] ? clear_bhb_loop+0x40/0x90 [ 838.954275][T19783] ? clear_bhb_loop+0x40/0x90 [ 838.958945][T19783] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 838.964824][T19783] RIP: 0033:0x7f0ec1d8efc9 [ 838.969233][T19783] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 838.988841][T19783] RSP: 002b:00007f0ec2cfc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 838.997261][T19783] RAX: ffffffffffffffda RBX: 00007f0ec1fe6090 RCX: 00007f0ec1d8efc9 [ 839.005226][T19783] RDX: 000000000000004f RSI: 0000200000000300 RDI: 0000000000000006 [ 839.013200][T19783] RBP: 00007f0ec2cfc090 R08: 0000000000000000 R09: 0000000000000000 [ 839.021159][T19783] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 839.029143][T19783] R13: 00007f0ec1fe6128 R14: 00007f0ec1fe6090 R15: 00007ffeedcb0978 [ 839.037108][T19783] [ 839.058556][T19785] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4827'. [ 839.082586][T19785] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4827'. [ 839.093579][T19785] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4827'. [ 839.104088][T19785] netlink: 112 bytes leftover after parsing attributes in process `syz.1.4827'. [ 842.398416][T19820] loop6: detected capacity change from 0 to 16 [ 842.423924][T19820] erofs: DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 842.440799][T19820] erofs: DAX unsupported by block device. Turning off DAX. [ 842.530954][T19822] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 842.539862][T19822] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 846.525100][T19844] netlink: 156 bytes leftover after parsing attributes in process `syz.1.4842'. [ 847.316376][T19844] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4842'. [ 847.371820][T19849] loop6: detected capacity change from 0 to 256 [ 847.379803][T19849] exfat: Deprecated parameter 'utf8' [ 847.388666][T19849] exfat: Deprecated parameter 'namecase' [ 847.443971][T19849] exfat: Deprecated parameter 'utf8' [ 847.458303][T19849] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 847.541724][T19853] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 847.550434][T19853] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 848.085169][T19849] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 848.094090][T19849] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 852.139315][T19889] FAULT_INJECTION: forcing a failure. [ 852.139315][T19889] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 852.176006][T19889] CPU: 1 PID: 19889 Comm: syz.6.4854 Not tainted syzkaller #0 [ 852.183531][T19889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 852.193607][T19889] Call Trace: [ 852.196902][T19889] [ 852.199840][T19889] dump_stack_lvl+0x16c/0x230 [ 852.204539][T19889] ? show_regs_print_info+0x20/0x20 [ 852.209843][T19889] ? load_image+0x3b0/0x3b0 [ 852.214361][T19889] ? __might_fault+0xaa/0x120 [ 852.219061][T19889] ? __lock_acquire+0x7c80/0x7c80 [ 852.224120][T19889] should_fail_ex+0x39d/0x4d0 [ 852.228829][T19889] _copy_from_iter+0x1d3/0x1290 [ 852.233707][T19889] ? rcu_is_watching+0x15/0xb0 [ 852.238490][T19889] ? __alloc_pages+0x271/0x460 [ 852.243282][T19889] ? copyout_mc+0x70/0x70 [ 852.247645][T19889] ? tun_get_user+0x637/0x3bf0 [ 852.252436][T19889] ? page_copy_sane+0x4e/0x270 [ 852.257224][T19889] copy_page_from_iter+0x7b/0x100 [ 852.262285][T19889] tun_get_user+0x1b35/0x3bf0 [ 852.266992][T19889] ? tun_get_user+0x637/0x3bf0 [ 852.271770][T19889] ? aa_file_perm+0x3e8/0xec0 [ 852.276469][T19889] ? rcu_read_unlock+0xa0/0xa0 [ 852.281269][T19889] ? tun_get+0x1c/0x2e0 [ 852.285440][T19889] ? __lock_acquire+0x7c80/0x7c80 [ 852.290488][T19889] ? tun_get+0x1c/0x2e0 [ 852.294663][T19889] tun_chr_write_iter+0x119/0x200 [ 852.299725][T19889] vfs_write+0x43b/0x940 [ 852.303989][T19889] ? file_end_write+0x250/0x250 [ 852.308856][T19889] ? __fget_files+0x44a/0x4d0 [ 852.313558][T19889] ? __fdget_pos+0x1d8/0x330 [ 852.318172][T19889] ? ksys_write+0x75/0x250 [ 852.322623][T19889] ksys_write+0x147/0x250 [ 852.326971][T19889] ? __ia32_sys_read+0x90/0x90 [ 852.331754][T19889] ? lockdep_hardirqs_on+0x98/0x150 [ 852.336977][T19889] do_syscall_64+0x55/0xb0 [ 852.341404][T19889] ? clear_bhb_loop+0x40/0x90 [ 852.346103][T19889] ? clear_bhb_loop+0x40/0x90 [ 852.350795][T19889] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 852.356697][T19889] RIP: 0033:0x7fd34618da7f [ 852.361124][T19889] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 852.380762][T19889] RSP: 002b:00007fd3443f6000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 852.389377][T19889] RAX: ffffffffffffffda RBX: 00007fd3463e5fa0 RCX: 00007fd34618da7f [ 852.397360][T19889] RDX: 0000000000000076 RSI: 0000200000000080 RDI: 00000000000000c8 [ 852.405348][T19889] RBP: 00007fd3443f6090 R08: 0000000000000000 R09: 0000000000000000 [ 852.413338][T19889] R10: 0000000000000076 R11: 0000000000000293 R12: 0000000000000001 [ 852.421329][T19889] R13: 00007fd3463e6038 R14: 00007fd3463e5fa0 R15: 00007ffe5c320478 [ 852.429339][T19889] [ 854.412094][T19915] loop5: detected capacity change from 0 to 256 [ 854.424650][T19915] exfat: Deprecated parameter 'utf8' [ 854.430197][T19915] exfat: Deprecated parameter 'namecase' [ 854.436035][T19915] exfat: Deprecated parameter 'utf8' [ 854.505280][T19915] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 855.532340][T19915] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 855.541102][T19915] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 859.030893][T19962] damon-dbgfs: DAMON debugfs interface is deprecated, so users should move to DAMON_SYSFS. If you cannot, please report your usecase to damon@lists.linux.dev and linux-mm@kvack.org. [ 860.028453][T19972] Bluetooth: MGMT ver 1.22 [ 860.582452][T19987] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4878'. [ 860.591531][T19987] netlink: 440 bytes leftover after parsing attributes in process `syz.5.4878'. [ 862.651327][T20004] loop6: detected capacity change from 0 to 32768 [ 862.658812][T20004] jfs: Unrecognized mount option "0x0000000000000000" or missing value [ 862.791287][ T28] kauditd_printk_skb: 27 callbacks suppressed [ 862.791303][ T28] audit: type=1326 audit(1118.847:5622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20003 comm="syz.6.4887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd34618efc9 code=0x7ffc0000 [ 862.829093][ T28] audit: type=1326 audit(1118.847:5623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20003 comm="syz.6.4887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=97 compat=0 ip=0x7fd34618efc9 code=0x7ffc0000 [ 862.854658][ T28] audit: type=1326 audit(1118.847:5624): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20003 comm="syz.6.4887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd34618efc9 code=0x7ffc0000 [ 862.878020][ T28] audit: type=1326 audit(1118.847:5625): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20003 comm="syz.6.4887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd34618efc9 code=0x7ffc0000 [ 862.900353][ T28] audit: type=1326 audit(1118.847:5626): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20003 comm="syz.6.4887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7fd346190e5c code=0x7ffc0000 [ 862.943746][ T28] audit: type=1326 audit(1118.847:5627): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20003 comm="syz.6.4887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd34618efc9 code=0x7ffc0000 [ 863.001361][ T28] audit: type=1326 audit(1118.847:5628): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20003 comm="syz.6.4887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd34618efc9 code=0x7ffc0000 [ 863.033096][ T28] audit: type=1326 audit(1118.847:5629): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20003 comm="syz.6.4887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fd34618efc9 code=0x7ffc0000 [ 863.055708][ T28] audit: type=1326 audit(1118.847:5630): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20003 comm="syz.6.4887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd34618efc9 code=0x7ffc0000 [ 863.077603][ C0] vkms_vblank_simulate: vblank timer overrun [ 863.084834][ T28] audit: type=1326 audit(1118.847:5631): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20003 comm="syz.6.4887" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fd34618efc9 code=0x7ffc0000 [ 863.363615][T20012] loop5: detected capacity change from 0 to 2048 [ 863.403887][T20012] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 863.577333][T20025] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 863.899462][ T5859] usb 2-1: new low-speed USB device number 26 using dummy_hcd [ 864.089810][ T5859] usb 2-1: Invalid ep0 maxpacket: 64 [ 864.194052][T20039] FAULT_INJECTION: forcing a failure. [ 864.194052][T20039] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 864.230204][T20039] CPU: 0 PID: 20039 Comm: syz.5.4899 Not tainted syzkaller #0 [ 864.237727][T20039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 864.247803][T20039] Call Trace: [ 864.251098][T20039] [ 864.254035][T20039] dump_stack_lvl+0x16c/0x230 [ 864.258745][T20039] ? show_regs_print_info+0x20/0x20 [ 864.263961][T20039] ? load_image+0x3b0/0x3b0 [ 864.268485][T20039] ? __might_fault+0xaa/0x120 [ 864.273174][T20039] ? __lock_acquire+0x7c80/0x7c80 [ 864.278243][T20039] should_fail_ex+0x39d/0x4d0 [ 864.282944][T20039] _copy_from_iter+0x1d3/0x1290 [ 864.287831][T20039] ? slab_post_alloc_hook+0x8a/0x4d0 [ 864.293137][T20039] ? __virt_addr_valid+0x18c/0x540 [ 864.297993][ T5859] usb 2-1: new low-speed USB device number 27 using dummy_hcd [ 864.298251][T20039] ? __lock_acquire+0x7c80/0x7c80 [ 864.310731][T20039] ? rcu_is_watching+0x15/0xb0 [ 864.315517][T20039] ? copyout_mc+0x70/0x70 [ 864.319867][T20039] ? __virt_addr_valid+0x18c/0x540 [ 864.325001][T20039] ? __virt_addr_valid+0x18c/0x540 [ 864.330128][T20039] ? __virt_addr_valid+0x469/0x540 [ 864.335255][T20039] ? __check_object_size+0x506/0xa30 [ 864.340561][T20039] netlink_sendmsg+0x75c/0xbe0 [ 864.345352][T20039] ? netlink_getsockopt+0x580/0x580 [ 864.350572][T20039] ? aa_sock_msg_perm+0x94/0x150 [ 864.355526][T20039] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 864.360832][T20039] ? security_socket_sendmsg+0x80/0xa0 [ 864.366301][T20039] ? netlink_getsockopt+0x580/0x580 [ 864.371520][T20039] ____sys_sendmsg+0x5bf/0x950 [ 864.376309][T20039] ? __asan_memset+0x22/0x40 [ 864.380914][T20039] ? __sys_sendmsg_sock+0x30/0x30 [ 864.385950][T20039] ? __import_iovec+0x5f2/0x860 [ 864.390827][T20039] ? import_iovec+0x73/0xa0 [ 864.395354][T20039] ___sys_sendmsg+0x220/0x290 [ 864.400055][T20039] ? __sys_sendmsg+0x270/0x270 [ 864.404944][T20039] ? __lock_acquire+0x7c80/0x7c80 [ 864.410016][T20039] __se_sys_sendmsg+0x1a5/0x270 [ 864.414886][T20039] ? __x64_sys_sendmsg+0x80/0x80 [ 864.419854][T20039] ? lockdep_hardirqs_on+0x98/0x150 [ 864.425081][T20039] do_syscall_64+0x55/0xb0 [ 864.429509][T20039] ? clear_bhb_loop+0x40/0x90 [ 864.434193][T20039] ? clear_bhb_loop+0x40/0x90 [ 864.438879][T20039] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 864.444783][T20039] RIP: 0033:0x7f0ec1d8efc9 [ 864.449205][T20039] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 864.468825][T20039] RSP: 002b:00007f0ec2d1d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 864.477261][T20039] RAX: ffffffffffffffda RBX: 00007f0ec1fe5fa0 RCX: 00007f0ec1d8efc9 [ 864.485250][T20039] RDX: 0000000000000000 RSI: 0000200000001200 RDI: 0000000000000003 [ 864.493241][T20039] RBP: 00007f0ec2d1d090 R08: 0000000000000000 R09: 0000000000000000 [ 864.501228][T20039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 864.509219][T20039] R13: 00007f0ec1fe6038 R14: 00007f0ec1fe5fa0 R15: 00007ffeedcb0978 [ 864.517221][T20039] [ 864.520368][ C0] vkms_vblank_simulate: vblank timer overrun [ 864.529057][ T5859] usb 2-1: Invalid ep0 maxpacket: 64 [ 864.530510][ T5859] usb usb2-port1: attempt power cycle [ 864.941779][ T5859] usb 2-1: new low-speed USB device number 28 using dummy_hcd [ 865.002037][ T5859] usb 2-1: Invalid ep0 maxpacket: 64 [ 865.220427][ T5859] usb 2-1: new low-speed USB device number 29 using dummy_hcd [ 865.263331][ T5859] usb 2-1: Invalid ep0 maxpacket: 64 [ 865.269046][ T5859] usb usb2-port1: unable to enumerate USB device [ 865.390527][ T5796] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 865.579740][ T5796] usb 3-1: Using ep0 maxpacket: 8 [ 865.608085][ T5796] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 865.618754][ T5796] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 865.639040][ T5796] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 865.660438][ T5796] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 865.689121][ T5796] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 865.725963][ T5796] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 865.744825][ T5796] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 865.794286][T20061] loop6: detected capacity change from 0 to 256 [ 865.801532][T20061] exfat: Deprecated parameter 'utf8' [ 865.806954][T20061] exfat: Deprecated parameter 'namecase' [ 865.813289][T20061] exfat: Deprecated parameter 'utf8' [ 865.828348][T20061] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 865.878341][T20061] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 865.887496][T20061] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 866.061628][ T5796] usb 3-1: GET_CAPABILITIES returned 0 [ 866.067184][ T5796] usbtmc 3-1:16.0: can't read capabilities [ 866.335478][ T5796] usb 3-1: USB disconnect, device number 41 [ 866.487101][T20069] loop6: detected capacity change from 0 to 256 [ 866.494400][T20069] exfat: Deprecated parameter 'utf8' [ 866.500255][T20069] exfat: Deprecated parameter 'namecase' [ 866.506143][T20069] exfat: Deprecated parameter 'utf8' [ 866.517919][T20069] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 866.607727][T20069] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 866.616821][T20069] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 867.502303][T20082] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 868.792454][T20097] loop6: detected capacity change from 0 to 256 [ 868.805368][T20097] exfat: Deprecated parameter 'utf8' [ 868.819115][T20097] exfat: Deprecated parameter 'namecase' [ 868.835137][T20097] exfat: Deprecated parameter 'utf8' [ 868.852409][T20097] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 868.928926][T20097] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 868.937565][T20097] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 869.796844][T20099] loop5: detected capacity change from 0 to 32768 [ 869.856504][T20119] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4924'. [ 869.869877][T20119] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4924'. [ 869.879305][T20119] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4924'. [ 869.888373][T20119] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4924'. [ 869.985979][T20099] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 870.072888][T20121] netlink: 201392 bytes leftover after parsing attributes in process `syz.1.4922'. [ 870.379953][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.380052][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.562096][T14401] ocfs2: Unmounting device (7,5) on (node local) [ 871.246781][T20136] FAULT_INJECTION: forcing a failure. [ 871.246781][T20136] name failslab, interval 1, probability 0, space 0, times 0 [ 871.259728][T20136] CPU: 0 PID: 20136 Comm: syz.2.4928 Not tainted syzkaller #0 [ 871.267209][T20136] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 871.277277][T20136] Call Trace: [ 871.280565][T20136] [ 871.283510][T20136] dump_stack_lvl+0x16c/0x230 [ 871.288215][T20136] ? show_regs_print_info+0x20/0x20 [ 871.293436][T20136] ? load_image+0x3b0/0x3b0 [ 871.297960][T20136] ? __might_sleep+0xe0/0xe0 [ 871.302572][T20136] ? __lock_acquire+0x7c80/0x7c80 [ 871.307623][T20136] should_fail_ex+0x39d/0x4d0 [ 871.312331][T20136] should_failslab+0x9/0x20 [ 871.316849][T20136] slab_pre_alloc_hook+0x59/0x310 [ 871.321898][T20136] ? __get_vm_area_node+0x125/0x370 [ 871.327123][T20136] __kmem_cache_alloc_node+0x53/0x260 [ 871.332528][T20136] ? __get_vm_area_node+0x125/0x370 [ 871.333351][T20138] loop5: detected capacity change from 0 to 16 [ 871.337734][T20136] kmalloc_node_trace+0x26/0xe0 [ 871.337765][T20136] __get_vm_area_node+0x125/0x370 [ 871.337791][T20136] __vmalloc_node_range+0x36e/0x1320 [ 871.345413][T20138] erofs: DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 871.348771][T20136] ? netlink_sendmsg+0x5f3/0xbe0 [ 871.371822][T20136] ? netlink_insert+0x106a/0x1370 [ 871.376884][T20136] ? netlink_insert+0x2b3/0x1370 [ 871.381840][T20136] ? netlink_data_ready+0x10/0x10 [ 871.386864][T20136] ? free_vm_area+0x50/0x50 [ 871.391368][T20136] ? netlink_sendmsg+0x5f3/0xbe0 [ 871.396297][T20136] vmalloc+0x79/0x90 [ 871.400184][T20136] ? netlink_sendmsg+0x5f3/0xbe0 [ 871.405112][T20136] netlink_sendmsg+0x5f3/0xbe0 [ 871.409958][T20136] ? netlink_getsockopt+0x580/0x580 [ 871.415146][T20136] ? aa_sock_msg_perm+0x94/0x150 [ 871.420075][T20136] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 871.425351][T20136] ? security_socket_sendmsg+0x80/0xa0 [ 871.430799][T20136] ? netlink_getsockopt+0x580/0x580 [ 871.435986][T20136] ____sys_sendmsg+0x5bf/0x950 [ 871.440750][T20136] ? __asan_memset+0x22/0x40 [ 871.445328][T20136] ? __sys_sendmsg_sock+0x30/0x30 [ 871.450341][T20136] ? __import_iovec+0x5f2/0x860 [ 871.455188][T20136] ? import_iovec+0x73/0xa0 [ 871.459687][T20136] ___sys_sendmsg+0x220/0x290 [ 871.464357][T20136] ? __sys_sendmsg+0x270/0x270 [ 871.469127][T20136] ? __lock_acquire+0x7c80/0x7c80 [ 871.474158][T20136] __se_sys_sendmsg+0x1a5/0x270 [ 871.479005][T20136] ? __x64_sys_sendmsg+0x80/0x80 [ 871.483946][T20136] ? lockdep_hardirqs_on+0x98/0x150 [ 871.489136][T20136] do_syscall_64+0x55/0xb0 [ 871.493544][T20136] ? clear_bhb_loop+0x40/0x90 [ 871.498208][T20136] ? clear_bhb_loop+0x40/0x90 [ 871.502871][T20136] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 871.508752][T20136] RIP: 0033:0x7fa41f98efc9 [ 871.513156][T20136] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 871.532755][T20136] RSP: 002b:00007fa4208f4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 871.541158][T20136] RAX: ffffffffffffffda RBX: 00007fa41fbe6090 RCX: 00007fa41f98efc9 [ 871.549119][T20136] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007 [ 871.557074][T20136] RBP: 00007fa4208f4090 R08: 0000000000000000 R09: 0000000000000000 [ 871.565034][T20136] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 871.572995][T20136] R13: 00007fa41fbe6128 R14: 00007fa41fbe6090 R15: 00007ffe1a96eb38 [ 871.580969][T20136] [ 871.584088][ C0] vkms_vblank_simulate: vblank timer overrun [ 871.590236][T20138] erofs: DAX unsupported by block device. Turning off DAX. [ 871.597569][T20136] warn_alloc: 3 callbacks suppressed [ 871.597581][T20136] syz.2.4928: vmalloc error: size 213312, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz2,mems_allowed=0-1 [ 871.617748][T20136] CPU: 1 PID: 20136 Comm: syz.2.4928 Not tainted syzkaller #0 [ 871.625206][T20136] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 871.635336][T20136] Call Trace: [ 871.638606][T20136] [ 871.641529][T20136] dump_stack_lvl+0x16c/0x230 [ 871.646204][T20136] ? show_regs_print_info+0x20/0x20 [ 871.651480][T20136] ? load_image+0x3b0/0x3b0 [ 871.655973][T20136] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 871.662380][T20136] ? cpuset_print_current_mems_allowed+0x2e3/0x360 [ 871.668877][T20136] warn_alloc+0x210/0x300 [ 871.673210][T20136] ? __get_vm_area_node+0x125/0x370 [ 871.678400][T20136] ? zone_watermark_ok_safe+0x230/0x230 [ 871.683943][T20136] ? rcu_is_watching+0x15/0xb0 [ 871.688706][T20136] ? __get_vm_area_node+0x356/0x370 [ 871.693898][T20136] __vmalloc_node_range+0x393/0x1320 [ 871.699180][T20136] ? netlink_insert+0x106a/0x1370 [ 871.704202][T20136] ? netlink_insert+0x2b3/0x1370 [ 871.709131][T20136] ? netlink_data_ready+0x10/0x10 [ 871.714146][T20136] ? free_vm_area+0x50/0x50 [ 871.718641][T20136] ? netlink_sendmsg+0x5f3/0xbe0 [ 871.723570][T20136] vmalloc+0x79/0x90 [ 871.727629][T20136] ? netlink_sendmsg+0x5f3/0xbe0 [ 871.732557][T20136] netlink_sendmsg+0x5f3/0xbe0 [ 871.737318][T20136] ? netlink_getsockopt+0x580/0x580 [ 871.742521][T20136] ? aa_sock_msg_perm+0x94/0x150 [ 871.747447][T20136] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 871.752719][T20136] ? security_socket_sendmsg+0x80/0xa0 [ 871.758163][T20136] ? netlink_getsockopt+0x580/0x580 [ 871.763350][T20136] ____sys_sendmsg+0x5bf/0x950 [ 871.768111][T20136] ? __asan_memset+0x22/0x40 [ 871.772696][T20136] ? __sys_sendmsg_sock+0x30/0x30 [ 871.777712][T20136] ? __import_iovec+0x5f2/0x860 [ 871.782561][T20136] ? import_iovec+0x73/0xa0 [ 871.787062][T20136] ___sys_sendmsg+0x220/0x290 [ 871.791736][T20136] ? __sys_sendmsg+0x270/0x270 [ 871.796504][T20136] ? __lock_acquire+0x7c80/0x7c80 [ 871.801533][T20136] __se_sys_sendmsg+0x1a5/0x270 [ 871.806375][T20136] ? __x64_sys_sendmsg+0x80/0x80 [ 871.811315][T20136] ? lockdep_hardirqs_on+0x98/0x150 [ 871.816500][T20136] do_syscall_64+0x55/0xb0 [ 871.820912][T20136] ? clear_bhb_loop+0x40/0x90 [ 871.825577][T20136] ? clear_bhb_loop+0x40/0x90 [ 871.830241][T20136] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 871.836125][T20136] RIP: 0033:0x7fa41f98efc9 [ 871.840534][T20136] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 871.860131][T20136] RSP: 002b:00007fa4208f4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 871.868533][T20136] RAX: ffffffffffffffda RBX: 00007fa41fbe6090 RCX: 00007fa41f98efc9 [ 871.876493][T20136] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007 [ 871.884454][T20136] RBP: 00007fa4208f4090 R08: 0000000000000000 R09: 0000000000000000 [ 871.892417][T20136] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 871.900374][T20136] R13: 00007fa41fbe6128 R14: 00007fa41fbe6090 R15: 00007ffe1a96eb38 [ 871.908344][T20136] [ 871.912174][T20136] Mem-Info: [ 871.915448][T20136] active_anon:10163 inactive_anon:0 isolated_anon:0 [ 871.915448][T20136] active_file:7419 inactive_file:50618 isolated_file:0 [ 871.915448][T20136] unevictable:768 dirty:364 writeback:0 [ 871.915448][T20136] slab_reclaimable:11906 slab_unreclaimable:97316 [ 871.915448][T20136] mapped:30879 shmem:7152 pagetables:500 [ 871.915448][T20136] sec_pagetables:0 bounce:0 [ 871.915448][T20136] kernel_misc_reclaimable:0 [ 871.915448][T20136] free:1311596 free_pcp:6326 free_cma:0 [ 871.917333][T20139] netlink: 201392 bytes leftover after parsing attributes in process `syz.6.4929'. [ 871.960573][ C0] vkms_vblank_simulate: vblank timer overrun [ 871.960922][T20136] Node 0 active_anon:40652kB inactive_anon:0kB active_file:29676kB inactive_file:202272kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:123516kB dirty:1452kB writeback:0kB shmem:27072kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11048kB pagetables:2000kB sec_pagetables:0kB all_unreclaimable? no [ 872.008451][ C0] vkms_vblank_simulate: vblank timer overrun [ 872.015385][T20136] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 872.045569][ C0] vkms_vblank_simulate: vblank timer overrun [ 872.052014][T20136] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 872.079086][ C0] vkms_vblank_simulate: vblank timer overrun [ 872.086044][T20136] lowmem_reserve[]: 0 2525 2526 2526 2526 [ 872.092177][T20136] Node 0 DMA32 free:1316952kB boost:0kB min:34676kB low:43344kB high:52012kB reserved_highatomic:0KB active_anon:40604kB inactive_anon:0kB active_file:29676kB inactive_file:200952kB unevictable:1536kB writepending:1452kB present:3129332kB managed:2589600kB mlocked:0kB bounce:0kB free_pcp:18404kB local_pcp:9108kB free_cma:0kB [ 872.123022][T20136] lowmem_reserve[]: 0 0 1 1 1 [ 872.127758][T20136] Node 0 Normal free:16kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1320kB unevictable:0kB writepending:0kB present:1048576kB managed:1384kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 872.155083][T20136] lowmem_reserve[]: 0 0 0 0 0 [ 872.159855][T20136] Node 1 Normal free:3913800kB boost:0kB min:55208kB low:69008kB high:82808kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:6464kB local_pcp:0kB free_cma:0kB [ 872.189252][T20136] lowmem_reserve[]: 0 0 0 0 0 [ 872.193999][T20136] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 872.207124][T20136] Node 0 DMA32: 1444*4kB (UME) 529*8kB (UME) 182*16kB (UE) 653*32kB (UME) 1011*64kB (UME) 615*128kB (UME) 394*256kB (UME) 287*512kB (UM) 187*1024kB (UME) 24*2048kB (UM) 159*4096kB (UM) = 1316952kB [ 872.226974][T20136] Node 0 Normal: 0*4kB 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16kB [ 872.239658][T20136] Node 1 Normal: 248*4kB (UME) 59*8kB (UME) 47*16kB (UME) 257*32kB (UME) 100*64kB (UME) 21*128kB (UME) 6*256kB (UME) 1*512kB (E) 1*1024kB (E) 2*2048kB (UE) 949*4096kB (M) = 3913800kB [ 872.258124][T20136] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 872.267751][T20136] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 872.277070][T20136] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 872.287007][T20136] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 872.293764][T20144] loop6: detected capacity change from 0 to 256 [ 872.296328][T20136] 62206 total pagecache pages [ 872.307245][T20136] 0 pages in swap cache [ 872.311477][T20136] Free swap = 124444kB [ 872.315640][T20136] Total swap = 124996kB [ 872.319865][T20136] 2097051 pages RAM [ 872.323678][T20136] 0 pages HighMem/MovableOnly [ 872.324058][T20144] exfat: Deprecated parameter 'utf8' [ 872.328350][T20136] 416137 pages reserved [ 872.328359][T20136] 0 pages cma reserved [ 872.352016][T20144] exfat: Deprecated parameter 'namecase' [ 872.357901][T20144] exfat: Deprecated parameter 'utf8' [ 872.404555][T20144] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 872.488966][ T5800] Bluetooth: hci1: command 0x0406 tx timeout [ 872.595058][T20144] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 872.603813][T20144] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 873.447612][T20138] loop5: detected capacity change from 0 to 40427 [ 873.479004][T20138] F2FS-fs (loop5): Wrong NAT boundary, start(2560) end(3456110080) blocks(1024) [ 873.505457][T20138] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 873.540893][T20138] F2FS-fs (loop5): invalid crc value [ 873.562906][T20138] F2FS-fs (loop5): Found nat_bits in checkpoint [ 873.672971][T20138] F2FS-fs (loop5): Try to recover 2th superblock, ret: 0 [ 873.691160][T20138] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 873.801911][T14401] syz-executor: attempt to access beyond end of device [ 873.801911][T14401] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 873.854376][T14401] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 874.474951][T20181] loop5: detected capacity change from 0 to 256 [ 874.496663][T20181] exfat: Deprecated parameter 'utf8' [ 874.509807][T20181] exfat: Deprecated parameter 'namecase' [ 874.515699][T20181] exfat: Deprecated parameter 'utf8' [ 874.521379][T20180] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 874.530082][T20180] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 874.570469][T20181] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 874.585186][T20184] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4945'. [ 874.757385][T20181] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 874.766304][T20181] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 875.751912][T20197] pimreg: entered allmulticast mode [ 875.793478][T20197] pimreg: left allmulticast mode [ 876.017182][T20204] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 876.037203][T20204] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 876.058978][T20191] loop6: detected capacity change from 0 to 32768 [ 876.135155][T20191] JBD2: Ignoring recovery information on journal [ 876.199287][T20191] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode. [ 876.365373][T16412] ocfs2: Unmounting device (7,6) on (node local) [ 876.429029][T18482] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 876.526995][T20202] loop5: detected capacity change from 0 to 32768 [ 876.538448][T20202] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz.5.4949 (20202) [ 876.561817][T20202] BTRFS info (device loop5): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 876.585572][T20202] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm [ 876.599018][T20202] BTRFS info (device loop5): setting nodatacow, compression disabled [ 876.608927][T20202] BTRFS info (device loop5): turning on flush-on-commit [ 876.619053][T20202] BTRFS info (device loop5): enabling auto defrag [ 876.631468][T18482] usb 3-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 876.648981][T20202] BTRFS info (device loop5): trying to use backup root at mount time [ 876.657151][T18482] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 876.665660][T20202] BTRFS info (device loop5): turning on async discard [ 876.672578][T18482] usb 3-1: Product: syz [ 876.676844][T20202] BTRFS info (device loop5): using free space tree [ 876.691120][T18482] usb 3-1: Manufacturer: syz [ 876.695758][T18482] usb 3-1: SerialNumber: syz [ 876.721699][T18482] usb 3-1: config 0 descriptor?? [ 876.757744][T10740] BTRFS warning (device loop5): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 876.804335][T20202] BTRFS error (device loop5): failed to load root extent [ 876.819410][T20202] BTRFS warning (device loop5): try to load backup roots slot 1 [ 876.830406][T10740] BTRFS warning (device loop5): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 876.903027][T20202] BTRFS warning (device loop5): couldn't read tree root [ 876.923797][T20202] BTRFS warning (device loop5): try to load backup roots slot 2 [ 876.940437][T18482] usb 3-1: f81604_read: reg: 105 failed: -EREMOTEIO [ 876.947528][T10740] BTRFS error (device loop5): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 876.961221][T18482] f81604 3-1:0.0: Setting termination of CH#0 failed: -EREMOTEIO [ 876.970336][T20202] BTRFS warning (device loop5): couldn't read tree root [ 876.977457][T18482] f81604: probe of 3-1:0.0 failed with error -121 [ 876.986540][T20202] BTRFS warning (device loop5): try to load backup roots slot 3 [ 877.022854][T20202] BTRFS info (device loop5): enabling ssd optimizations [ 877.031230][T20202] BTRFS info (device loop5): rebuilding free space tree [ 877.058966][T20202] BTRFS info (device loop5): checking UUID tree [ 877.212821][T14401] BTRFS info (device loop5): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 877.702562][ T28] kauditd_printk_skb: 52 callbacks suppressed [ 877.702577][ T28] audit: type=1326 audit(1133.757:5684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20231 comm="syz.1.4955" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f719ad8efc9 code=0x7ffc0000 [ 877.770137][ T28] audit: type=1326 audit(1133.757:5685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20231 comm="syz.1.4955" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f719ad8efc9 code=0x7ffc0000 [ 877.820048][ T28] audit: type=1326 audit(1133.787:5686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20231 comm="syz.1.4955" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f719ad8efc9 code=0x7ffc0000 [ 877.864635][ T28] audit: type=1326 audit(1133.787:5687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20231 comm="syz.1.4955" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f719ad8efc9 code=0x7ffc0000 [ 877.908972][ T28] audit: type=1326 audit(1133.797:5688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20231 comm="syz.1.4955" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f719ad8efc9 code=0x7ffc0000 [ 877.958917][ T28] audit: type=1326 audit(1133.807:5689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20231 comm="syz.1.4955" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f719ad8efc9 code=0x7ffc0000 [ 878.025115][ T28] audit: type=1326 audit(1133.807:5690): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20231 comm="syz.1.4955" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f719ad8efc9 code=0x7ffc0000 [ 878.098113][ T28] audit: type=1326 audit(1133.807:5691): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20231 comm="syz.1.4955" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f719ad8efc9 code=0x7ffc0000 [ 878.139536][ T28] audit: type=1326 audit(1133.807:5692): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20231 comm="syz.1.4955" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f719ad8efc9 code=0x7ffc0000 [ 878.182016][ T28] audit: type=1326 audit(1133.807:5693): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20231 comm="syz.1.4955" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f719ad8efc9 code=0x7ffc0000 [ 878.304679][T20235] loop5: detected capacity change from 0 to 32768 [ 878.337554][T20235] BTRFS: device fsid e417788f-7a09-42b2-9266-8ddc5d5d35d2 devid 1 transid 8 /dev/loop5 scanned by syz.5.4954 (20235) [ 878.352060][T20243] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 878.360806][T20243] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 878.396648][T20237] loop6: detected capacity change from 0 to 32768 [ 878.422810][T20235] BTRFS info (device loop5): first mount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 878.436705][T20235] BTRFS info (device loop5): using xxhash64 (xxhash64-generic) checksum algorithm [ 878.481202][T20235] BTRFS info (device loop5): force zlib compression, level 3 [ 878.491972][T20235] BTRFS info (device loop5): force clearing of disk cache [ 878.500790][T20235] BTRFS info (device loop5): setting nodatasum [ 878.500942][T20237] ERROR: (device loop6): diWrite: ixpxd invalid [ 878.500942][T20237] [ 878.507211][T20235] BTRFS info (device loop5): allowing degraded mounts [ 878.523216][T20235] BTRFS info (device loop5): enabling disk space caching [ 878.531813][T20235] BTRFS info (device loop5): disk space caching is enabled [ 878.548748][T20237] ERROR: (device loop6): remounting filesystem as read-only [ 878.558808][T20237] ERROR: (device loop6): txCommit: [ 878.558808][T20237] [ 878.602358][T20235] BTRFS info (device loop5): enabling ssd optimizations [ 878.619535][T20235] BTRFS info (device loop5): auto enabling async discard [ 878.638337][T20235] BTRFS info (device loop5): rebuilding free space tree [ 878.690347][T20235] BTRFS info (device loop5): disabling free space tree [ 878.713148][T20235] BTRFS info (device loop5): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 878.753383][T20235] BTRFS info (device loop5): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 879.095271][T14401] BTRFS info (device loop5): last unmount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 879.444392][T20270] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 879.453718][T20270] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 880.009095][T20278] loop5: detected capacity change from 0 to 256 [ 880.079087][T20278] exfat: Deprecated parameter 'utf8' [ 880.087942][T20278] exfat: Deprecated parameter 'namecase' [ 880.096187][T20278] exfat: Deprecated parameter 'utf8' [ 880.104264][ T5859] usb 3-1: USB disconnect, device number 42 [ 880.145438][T20278] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 880.219058][T20278] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 880.227678][T20278] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 881.257811][T20297] fuse: Bad value for 'fd' [ 882.302295][T20288] loop6: detected capacity change from 0 to 32768 [ 882.370307][T20305] netlink: 324 bytes leftover after parsing attributes in process `syz.2.4970'. [ 882.379704][T20305] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4970'. [ 883.129153][T20288] JBD2: Ignoring recovery information on journal [ 883.235172][T20288] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode. [ 883.311969][T20288] (syz.6.4964,20288,1):ocfs2_read_blocks_sync:112 ERROR: status = -12 [ 883.395328][T20288] (syz.6.4964,20288,1):ocfs2_group_add:495 ERROR: Can't read the group descriptor # 262144 from the device. [ 883.989122][ T5859] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 884.074654][T16412] ocfs2: Unmounting device (7,6) on (node local) [ 884.099856][T20324] loop5: detected capacity change from 0 to 512 [ 884.126950][T20324] EXT4-fs (loop5): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 884.146887][T20324] EXT4-fs (loop5): ext4_check_descriptors: Block bitmap for group 1 overlaps superblock [ 884.167021][T20324] EXT4-fs (loop5): ext4_check_descriptors: Block bitmap for group 1 not in group (block 0)! [ 884.198087][T20324] EXT4-fs (loop5): group descriptors corrupted! [ 884.219025][ T5859] usb 3-1: Using ep0 maxpacket: 32 [ 884.225991][ T5859] usb 3-1: config 0 has an invalid interface number: 126 but max is 0 [ 884.246034][ T5859] usb 3-1: config 0 has no interface number 0 [ 884.262732][ T5859] usb 3-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 884.288957][ T5859] usb 3-1: config 0 interface 126 altsetting 16 endpoint 0x82 has invalid wMaxPacketSize 0 [ 884.309496][ T5859] usb 3-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 0 [ 884.333740][ T5859] usb 3-1: config 0 interface 126 has no altsetting 0 [ 884.351147][ T5859] usb 3-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 884.360698][ T5859] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 884.372517][ T5859] usb 3-1: Product: syz [ 884.419150][T20328] fuse: Bad value for 'fd' [ 884.563286][ T5859] usb 3-1: Manufacturer: syz [ 884.568489][ T5859] usb 3-1: SerialNumber: syz [ 884.576722][ T5859] usb 3-1: config 0 descriptor?? [ 884.582455][T20318] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 885.184159][T20318] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 885.240141][T20318] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 885.381344][ T5859] ir_usb 3-1:0.126: IR Dongle converter detected [ 885.651667][ T5859] usb 3-1: IR Dongle converter now attached to ttyUSB0 [ 885.687182][T20330] loop5: detected capacity change from 0 to 32768 [ 885.705224][T20330] XFS (loop5): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 885.734961][T20330] XFS (loop5): Ending clean mount [ 885.833113][T20330] XFS (loop5): Quotacheck needed: Please wait. [ 886.008661][ T5859] usb 3-1: USB disconnect, device number 43 [ 886.173920][ T5859] ir-usb ttyUSB0: IR Dongle converter now disconnected from ttyUSB0 [ 886.281007][ T5859] ir_usb 3-1:0.126: device disconnected [ 886.298698][T20330] XFS (loop5): Quotacheck: Done. [ 886.379811][T20330] XFS (loop5): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 886.505814][T20351] loop6: detected capacity change from 0 to 16 [ 886.513820][T20351] erofs: DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 886.524453][T20351] erofs: DAX unsupported by block device. Turning off DAX. [ 886.666823][T20349] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 886.675521][T20349] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 886.861332][T20330] tun1: tun_chr_ioctl cmd 1074025675 [ 886.875335][T20330] tun1: persist enabled [ 886.893118][T20330] tun1: tun_chr_ioctl cmd 1074025675 [ 886.909006][T20330] tun1: persist enabled [ 887.425147][T20351] loop6: detected capacity change from 0 to 40427 [ 887.707091][T20351] F2FS-fs (loop6): Wrong NAT boundary, start(2560) end(3456110080) blocks(1024) [ 887.719033][T20351] F2FS-fs (loop6): Can't find valid F2FS filesystem in 2th superblock [ 887.766097][T20351] F2FS-fs (loop6): invalid crc value [ 887.792982][T20351] F2FS-fs (loop6): Found nat_bits in checkpoint [ 887.954208][T20351] F2FS-fs (loop6): Try to recover 2th superblock, ret: 0 [ 887.969145][T20351] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 888.095645][T20367] fuse: Bad value for 'fd' [ 888.119343][T16412] syz-executor: attempt to access beyond end of device [ 888.119343][T16412] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 888.160528][T16412] F2FS-fs (loop6): Stopped filesystem due to reason: 3 [ 888.381322][T20369] loop5: detected capacity change from 0 to 8192 [ 888.406048][T20369] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 888.477396][T20369] REISERFS (device loop5): found reiserfs format "3.5" with non-standard journal [ 888.711474][T20369] REISERFS (device loop5): using ordered data mode [ 888.800832][T20369] reiserfs: using flush barriers [ 888.968209][T20369] REISERFS (device loop5): journal params: device loop5, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 889.068764][T20369] REISERFS (device loop5): checking transaction log (loop5) [ 889.085416][T20369] REISERFS (device loop5): Using r5 hash to sort names [ 889.094765][T20369] REISERFS (device loop5): Created .reiserfs_priv - reserved for xattr storage. [ 889.125965][ T28] kauditd_printk_skb: 16 callbacks suppressed [ 889.125980][ T28] audit: type=1804 audit(1145.177:5710): pid=20369 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.4991" name="/newroot/423/file1/file0" dev="loop5" ino=2 res=1 errno=0 [ 889.851960][T20385] loop5: detected capacity change from 0 to 512 [ 889.983579][T20385] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 890.196886][T20385] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 890.224968][T20385] mkiss: ax0: crc mode is auto. [ 890.349701][T20394] netlink: 112 bytes leftover after parsing attributes in process `syz.2.4995'. [ 890.473109][T14401] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 890.649089][T20403] loop6: detected capacity change from 0 to 256 [ 890.666410][T20403] exfat: Deprecated parameter 'utf8' [ 890.675849][T20403] exfat: Deprecated parameter 'namecase' [ 890.685982][T20403] exfat: Deprecated parameter 'utf8' [ 890.725037][T20403] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 890.726603][T20405] loop5: detected capacity change from 0 to 16 [ 890.751204][T20405] erofs: DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 890.763046][T20405] erofs: DAX unsupported by block device. Turning off DAX. [ 891.445441][T20403] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 891.454430][T20403] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 892.169015][ T28] audit: type=1326 audit(1148.147:5711): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20414 comm="syz.2.5001" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa41f98efc9 code=0x0 [ 897.486359][T20445] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 897.486411][T20445] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 899.278034][T20468] loop6: detected capacity change from 0 to 1024 [ 899.312229][T20468] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 900.877796][T20477] loop5: detected capacity change from 0 to 512 [ 900.946176][T20477] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 901.004434][T20477] EXT4-fs (loop5): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 901.102689][T14401] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 901.696050][T20484] loop5: detected capacity change from 0 to 32768 [ 901.709086][T20484] BTRFS: device fsid e417788f-7a09-42b2-9266-8ddc5d5d35d2 devid 1 transid 8 /dev/loop5 scanned by syz.5.5018 (20484) [ 901.733154][T20484] BTRFS info (device loop5): first mount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 901.745717][T20484] BTRFS info (device loop5): using xxhash64 (xxhash64-generic) checksum algorithm [ 901.759388][T20484] BTRFS info (device loop5): force zlib compression, level 3 [ 901.766897][T20484] BTRFS info (device loop5): force clearing of disk cache [ 901.775037][T20484] BTRFS info (device loop5): setting nodatasum [ 901.783178][T20484] BTRFS info (device loop5): allowing degraded mounts [ 901.790304][T20484] BTRFS info (device loop5): enabling disk space caching [ 901.797441][T20484] BTRFS info (device loop5): disk space caching is enabled [ 901.830558][T20484] BTRFS info (device loop5): enabling ssd optimizations [ 901.837580][T20484] BTRFS info (device loop5): auto enabling async discard [ 901.847827][T20484] BTRFS info (device loop5): rebuilding free space tree [ 901.862823][T20484] BTRFS info (device loop5): disabling free space tree [ 901.870024][T20484] BTRFS info (device loop5): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 901.881742][T20484] BTRFS info (device loop5): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 902.014780][T14401] BTRFS info (device loop5): last unmount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 903.617072][ T28] audit: type=1800 audit(1159.527:5712): pid=20472 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.5014" name="bus" dev="loop6" ino=18 res=0 errno=0 [ 904.546679][T16412] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 904.859490][T20533] loop5: detected capacity change from 0 to 256 [ 904.908726][T20533] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0xf4419509, utbl_chksum : 0xe619d30d) [ 904.993067][T20528] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 904.993083][T20528] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 905.199213][ T5796] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 905.379484][ T5796] usb 6-1: Using ep0 maxpacket: 32 [ 905.388371][ T5796] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 905.489218][ T5796] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 905.489248][ T5796] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 905.489268][ T5796] usb 6-1: Product: syz [ 905.489281][ T5796] usb 6-1: Manufacturer: syz [ 905.489295][ T5796] usb 6-1: SerialNumber: syz [ 905.497337][ T5796] usb 6-1: config 0 descriptor?? [ 905.499288][T20533] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 905.864447][T18482] usb 6-1: USB disconnect, device number 30 [ 906.622670][T20544] loop6: detected capacity change from 0 to 32768 [ 906.978628][T20550] netlink: 'syz.6.5030': attribute type 1 has an invalid length. [ 906.986518][T20550] netlink: 161700 bytes leftover after parsing attributes in process `syz.6.5030'. [ 909.263527][ T28] audit: type=1800 audit(1163.507:5713): pid=20551 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.5030" name="file1" dev="loop6" ino=4 res=0 errno=0 [ 911.083859][T20560] 9pnet_fd: Insufficient options for proto=fd [ 911.207526][T20566] vlan2: entered promiscuous mode [ 911.213006][T20566] vlan2: entered allmulticast mode [ 911.543388][T20577] loop6: detected capacity change from 0 to 16 [ 911.543857][T20577] erofs: DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 911.548526][T20577] erofs: DAX unsupported by block device. Turning off DAX. [ 911.971044][ T5796] usb 6-1: new full-speed USB device number 31 using dummy_hcd [ 912.147679][T20577] loop6: detected capacity change from 0 to 40427 [ 912.166070][T20577] F2FS-fs (loop6): Wrong NAT boundary, start(2560) end(3456110080) blocks(1024) [ 912.189233][ T5796] usb 6-1: config 7 has an invalid interface number: 74 but max is 0 [ 912.207635][T20577] F2FS-fs (loop6): Can't find valid F2FS filesystem in 2th superblock [ 912.217310][ T5796] usb 6-1: config 7 has no interface number 0 [ 912.237507][T20577] F2FS-fs (loop6): invalid crc value [ 912.246267][ T5796] usb 6-1: config 7 interface 74 has no altsetting 0 [ 912.255636][T20577] F2FS-fs (loop6): Found nat_bits in checkpoint [ 912.267972][ T5796] usb 6-1: New USB device found, idVendor=3568, idProduct=2d59, bcdDevice=ad.48 [ 912.278988][ T5796] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 912.286995][ T5796] usb 6-1: Product: syz [ 912.296653][ T5796] usb 6-1: Manufacturer: syz [ 912.302340][ T5796] usb 6-1: SerialNumber: syz [ 912.318639][T20577] F2FS-fs (loop6): Try to recover 2th superblock, ret: 0 [ 912.327346][T20577] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 912.393456][T16412] syz-executor: attempt to access beyond end of device [ 912.393456][T16412] loop6: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 912.410015][T16412] F2FS-fs (loop6): Stopped filesystem due to reason: 3 [ 912.417246][T16412] F2FS-fs (loop6): Stopped filesystem due to reason: 3 [ 912.534054][ T5796] usb 6-1: USB disconnect, device number 31 [ 912.825552][T20600] loop6: detected capacity change from 0 to 16 [ 912.837511][T20600] erofs: DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 912.848621][T20600] erofs: DAX unsupported by block device. Turning off DAX. [ 913.802688][T20609] loop5: detected capacity change from 0 to 4096 [ 913.823521][T20609] ntfs3: loop5: Different NTFS sector size (4096) and media sector size (512). [ 913.866985][T20609] ntfs3: loop5: Failed to initialize $Extend/$Reparse. [ 913.892750][T20609] FAULT_INJECTION: forcing a failure. [ 913.892750][T20609] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 913.917867][T20609] CPU: 1 PID: 20609 Comm: syz.5.5049 Not tainted syzkaller #0 [ 913.925382][T20609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 913.935458][T20609] Call Trace: [ 913.938750][T20609] [ 913.941700][T20609] dump_stack_lvl+0x16c/0x230 [ 913.946400][T20609] ? show_regs_print_info+0x20/0x20 [ 913.951628][T20609] ? load_image+0x3b0/0x3b0 [ 913.956160][T20609] ? __might_fault+0xaa/0x120 [ 913.960858][T20609] ? __lock_acquire+0x7c80/0x7c80 [ 913.965911][T20609] should_fail_ex+0x39d/0x4d0 [ 913.970620][T20609] _copy_from_user+0x2f/0xe0 [ 913.975240][T20609] __se_sys_mount+0x179/0x3c0 [ 913.979953][T20609] ? __x64_sys_mount+0xc0/0xc0 [ 913.984747][T20609] ? lockdep_hardirqs_on+0x98/0x150 [ 913.989966][T20609] ? __x64_sys_mount+0x20/0xc0 [ 913.994754][T20609] do_syscall_64+0x55/0xb0 [ 913.999198][T20609] ? clear_bhb_loop+0x40/0x90 [ 914.003895][T20609] ? clear_bhb_loop+0x40/0x90 [ 914.008602][T20609] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 914.014515][T20609] RIP: 0033:0x7f0ec1d8efc9 [ 914.018936][T20609] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 914.038550][T20609] RSP: 002b:00007f0ec2d1d038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 914.046960][T20609] RAX: ffffffffffffffda RBX: 00007f0ec1fe5fa0 RCX: 00007f0ec1d8efc9 [ 914.054928][T20609] RDX: 0000200000000340 RSI: 00002000000000c0 RDI: 0000000000000000 [ 914.062896][T20609] RBP: 00007f0ec2d1d090 R08: 0000200000000240 R09: 0000000000000000 [ 914.070862][T20609] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 914.078828][T20609] R13: 00007f0ec1fe6038 R14: 00007f0ec1fe5fa0 R15: 00007ffeedcb0978 [ 914.086807][T20609] [ 914.147120][T14401] ntfs3: loop5: ino=1a, ntfs_sync_fs failed, -22. [ 914.190491][T20600] loop6: detected capacity change from 0 to 40427 [ 914.193193][T20600] F2FS-fs (loop6): Wrong NAT boundary, start(2560) end(3456110080) blocks(1024) [ 914.193221][T20600] F2FS-fs (loop6): Can't find valid F2FS filesystem in 2th superblock [ 914.199088][T20600] F2FS-fs (loop6): invalid crc value [ 914.206267][T20600] F2FS-fs (loop6): Found nat_bits in checkpoint [ 914.305559][T20600] F2FS-fs (loop6): Try to recover 2th superblock, ret: 0 [ 914.305584][T20600] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 914.324604][T20624] loop5: detected capacity change from 0 to 16 [ 914.353593][T20624] erofs: DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 914.355403][T20624] erofs: DAX unsupported by block device. Turning off DAX. [ 914.485614][T16412] syz-executor: attempt to access beyond end of device [ 914.485614][T16412] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 914.486508][T16412] F2FS-fs (loop6): Stopped filesystem due to reason: 3 [ 915.061135][T20624] loop5: detected capacity change from 0 to 40427 [ 915.071398][T20624] F2FS-fs (loop5): Wrong NAT boundary, start(2560) end(3456110080) blocks(1024) [ 915.077210][T20631] overlayfs: failed to resolve './file0/../file0': -2 [ 915.082893][T20624] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 915.103278][T20624] F2FS-fs (loop5): invalid crc value [ 915.121079][T20624] F2FS-fs (loop5): Found nat_bits in checkpoint [ 915.318723][T20624] F2FS-fs (loop5): Try to recover 2th superblock, ret: 0 [ 915.338440][T20624] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 915.420034][T14401] syz-executor: attempt to access beyond end of device [ 915.420034][T14401] loop5: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 915.477702][T14401] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 915.546307][T14401] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 916.759900][T20646] loop6: detected capacity change from 0 to 32768 [ 916.807768][T20646] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode. [ 917.175881][T20662] OCFS2: ERROR (device loop6): int ocfs2_validate_dx_root(struct super_block *, struct buffer_head *): Dir Index Root # 28549323745621536 has bad signature  [ 917.193685][T20662] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 917.203673][T20662] OCFS2: File system is now read-only. [ 917.209409][T20662] (syz.6.5060,20662,1):ocfs2_find_entry_dx:1029 ERROR: status = -30 [ 917.517794][T20657] loop5: detected capacity change from 0 to 32768 [ 917.608163][T16412] ocfs2: Unmounting device (7,6) on (node local) [ 918.030197][T20670] loop5: detected capacity change from 0 to 16 [ 918.030709][T20670] erofs: DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 918.035110][T20670] erofs: DAX unsupported by block device. Turning off DAX. [ 920.241040][T20670] loop5: detected capacity change from 0 to 40427 [ 920.268981][T20670] F2FS-fs (loop5): Wrong NAT boundary, start(2560) end(3456110080) blocks(1024) [ 920.289115][T20670] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 920.444442][T20670] F2FS-fs (loop5): invalid crc value [ 920.462381][T20670] F2FS-fs (loop5): Found nat_bits in checkpoint [ 920.542230][T20697] FAULT_INJECTION: forcing a failure. [ 920.542230][T20697] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 920.555451][T20697] CPU: 1 PID: 20697 Comm: syz.6.5070 Not tainted syzkaller #0 [ 920.562922][T20697] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 920.572983][T20697] Call Trace: [ 920.576271][T20697] [ 920.579220][T20697] dump_stack_lvl+0x16c/0x230 [ 920.583999][T20697] ? show_regs_print_info+0x20/0x20 [ 920.589263][T20697] ? load_image+0x3b0/0x3b0 [ 920.593780][T20697] ? kasan_check_range+0x73/0x290 [ 920.598905][T20697] should_fail_ex+0x39d/0x4d0 [ 920.603607][T20697] _copy_from_user+0x2f/0xe0 [ 920.608202][T20697] ip_tunnel_siocdevprivate+0xa7/0x1c0 [ 920.613674][T20697] ? rcu_is_watching+0x15/0xb0 [ 920.618454][T20697] ? ip_tunnel_update+0xb10/0xb10 [ 920.623487][T20697] ? trace_contention_end+0x39/0xe0 [ 920.628705][T20697] ? full_name_hash+0x92/0xe0 [ 920.633398][T20697] dev_ifsioc+0xae6/0xe20 [ 920.637734][T20697] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 920.643376][T20697] ? dev_ioctl+0x1170/0x1170 [ 920.647975][T20697] ? dev_load+0x162/0x1f0 [ 920.652313][T20697] dev_ioctl+0x87a/0x1170 [ 920.656656][T20697] sock_ioctl+0x726/0x7a0 [ 920.660993][T20697] ? sock_poll+0x3d0/0x3d0 [ 920.665465][T20697] ? bpf_lsm_file_ioctl+0x9/0x10 [ 920.670416][T20697] ? security_file_ioctl+0x80/0xa0 [ 920.675535][T20697] ? sock_poll+0x3d0/0x3d0 [ 920.679963][T20697] __se_sys_ioctl+0xfd/0x170 [ 920.684575][T20697] do_syscall_64+0x55/0xb0 [ 920.688997][T20697] ? clear_bhb_loop+0x40/0x90 [ 920.693681][T20697] ? clear_bhb_loop+0x40/0x90 [ 920.698373][T20697] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 920.704279][T20697] RIP: 0033:0x7fd34618efc9 [ 920.708701][T20697] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 920.728321][T20697] RSP: 002b:00007fd3443b4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 920.736746][T20697] RAX: ffffffffffffffda RBX: 00007fd3463e6180 RCX: 00007fd34618efc9 [ 920.744725][T20697] RDX: 0000200000000180 RSI: 00000000000089f8 RDI: 0000000000000005 [ 920.752700][T20697] RBP: 00007fd3443b4090 R08: 0000000000000000 R09: 0000000000000000 [ 920.760677][T20697] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 920.768652][T20697] R13: 00007fd3463e6218 R14: 00007fd3463e6180 R15: 00007ffe5c320478 [ 920.776644][T20697] [ 921.392444][T20710] loop5: detected capacity change from 0 to 4096 [ 921.411008][T20710] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 921.435334][ T5800] Bluetooth: hci3: ISO packet for unknown connection handle 0 [ 921.512796][T14401] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 922.096688][T20722] loop5: detected capacity change from 0 to 1024 [ 922.126221][T20722] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 922.433662][T20729] syz.1.5079 (20729) used obsolete PPPIOCDETACH ioctl [ 922.778963][ T5859] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 923.536288][T20736] FAULT_INJECTION: forcing a failure. [ 923.536288][T20736] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 923.554228][T20736] CPU: 0 PID: 20736 Comm: syz.6.5082 Not tainted syzkaller #0 [ 923.561728][T20736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 923.571795][T20736] Call Trace: [ 923.575084][T20736] [ 923.578021][T20736] dump_stack_lvl+0x16c/0x230 [ 923.582721][T20736] ? show_regs_print_info+0x20/0x20 [ 923.587949][T20736] ? load_image+0x3b0/0x3b0 [ 923.592476][T20736] ? __might_fault+0xaa/0x120 [ 923.597176][T20736] ? __lock_acquire+0x7c80/0x7c80 [ 923.602226][T20736] should_fail_ex+0x39d/0x4d0 [ 923.606927][T20736] _copy_from_iter+0x1d3/0x1290 [ 923.610803][ T5859] usb 6-1: config 220 has an invalid interface number: 76 but max is 2 [ 923.611777][T20736] ? slab_post_alloc_hook+0x8a/0x4d0 [ 923.625306][T20736] ? __virt_addr_valid+0x18c/0x540 [ 923.630438][T20736] ? __lock_acquire+0x7c80/0x7c80 [ 923.635478][T20736] ? rcu_is_watching+0x15/0xb0 [ 923.638923][ T5859] usb 6-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 923.640240][T20736] ? copyout_mc+0x70/0x70 [ 923.653415][T20736] ? __virt_addr_valid+0x18c/0x540 [ 923.658537][T20736] ? __virt_addr_valid+0x18c/0x540 [ 923.658909][ T5859] usb 6-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 923.663648][T20736] ? __virt_addr_valid+0x469/0x540 [ 923.663674][T20736] ? __check_object_size+0x506/0xa30 [ 923.663700][T20736] netlink_sendmsg+0x75c/0xbe0 [ 923.689061][T20736] ? netlink_getsockopt+0x580/0x580 [ 923.694296][T20736] ? aa_sock_msg_perm+0x94/0x150 [ 923.698941][ T5859] usb 6-1: config 220 has no interface number 2 [ 923.699233][T20736] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 923.705512][ T5859] usb 6-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 923.710739][T20736] ? security_socket_sendmsg+0x80/0xa0 [ 923.710767][T20736] ? netlink_getsockopt+0x580/0x580 [ 923.710787][T20736] ____sys_sendmsg+0x5bf/0x950 [ 923.710815][T20736] ? __asan_memset+0x22/0x40 [ 923.710834][T20736] ? __sys_sendmsg_sock+0x30/0x30 [ 923.748948][T20736] ? __import_iovec+0x5f2/0x860 [ 923.753832][T20736] ? import_iovec+0x73/0xa0 [ 923.754447][ T5859] usb 6-1: config 220 interface 0 has no altsetting 0 [ 923.758337][T20736] ___sys_sendmsg+0x220/0x290 [ 923.769789][T20736] ? __sys_sendmsg+0x270/0x270 [ 923.774591][T20736] ? __lock_acquire+0x7c80/0x7c80 [ 923.775474][ T5859] usb 6-1: config 220 interface 76 has no altsetting 0 [ 923.779634][T20736] __se_sys_sendmsg+0x1a5/0x270 [ 923.779666][T20736] ? __x64_sys_sendmsg+0x80/0x80 [ 923.779698][T20736] ? lockdep_hardirqs_on+0x98/0x150 [ 923.796697][ T5859] usb 6-1: config 220 interface 1 has no altsetting 0 [ 923.801481][T20736] do_syscall_64+0x55/0xb0 [ 923.801510][T20736] ? clear_bhb_loop+0x40/0x90 [ 923.801528][T20736] ? clear_bhb_loop+0x40/0x90 [ 923.801545][T20736] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 923.801572][T20736] RIP: 0033:0x7fd34618efc9 [ 923.821454][ T5859] usb 6-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 923.822046][T20736] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 923.827927][ T5859] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 923.832324][T20736] RSP: 002b:00007fd3443f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 923.832346][T20736] RAX: ffffffffffffffda RBX: 00007fd3463e5fa0 RCX: 00007fd34618efc9 [ 923.832357][T20736] RDX: 0000000000044000 RSI: 0000200000000540 RDI: 0000000000000003 [ 923.832367][T20736] RBP: 00007fd3443f6090 R08: 0000000000000000 R09: 0000000000000000 [ 923.832377][T20736] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 923.832386][T20736] R13: 00007fd3463e6038 R14: 00007fd3463e5fa0 R15: 00007ffe5c320478 [ 923.832412][T20736] [ 923.862088][ T5859] usb 6-1: Product: syz [ 923.869073][ C0] vkms_vblank_simulate: vblank timer overrun [ 923.920690][T20725] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5078'. [ 923.963115][ T5859] usb 6-1: Manufacturer: syz [ 923.994545][ T5859] usb 6-1: SerialNumber: syz [ 924.043635][T20740] loop6: detected capacity change from 0 to 16 [ 924.055615][T20740] erofs: DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 924.064697][T20740] erofs: DAX unsupported by block device. Turning off DAX. [ 924.262975][ T28] audit: type=1800 audit(1180.318:5714): pid=20728 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.5077" name="bus" dev="loop5" ino=18 res=0 errno=0 [ 924.791221][T20740] loop6: detected capacity change from 0 to 40427 [ 924.805855][T20740] F2FS-fs (loop6): Wrong NAT boundary, start(2560) end(3456110080) blocks(1024) [ 924.817932][T20740] F2FS-fs (loop6): Can't find valid F2FS filesystem in 2th superblock [ 924.832107][T20740] F2FS-fs (loop6): invalid crc value [ 924.844992][T20740] F2FS-fs (loop6): Found nat_bits in checkpoint [ 924.903210][T20740] F2FS-fs (loop6): Try to recover 2th superblock, ret: 0 [ 924.911506][T20740] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 924.957030][T16412] syz-executor: attempt to access beyond end of device [ 924.957030][T16412] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 924.972085][T16412] F2FS-fs (loop6): Stopped filesystem due to reason: 3 [ 925.373935][T20752] fuse: Bad value for 'fd' [ 925.475313][T20754] syz.6.5088 (20754): /proc/20753/oom_adj is deprecated, please use /proc/20753/oom_score_adj instead. [ 925.556230][T20754] loop6: detected capacity change from 0 to 256 [ 925.568741][T20754] exfat: Unknown parameter '0xffffffffffffffff' [ 925.964216][T14401] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 926.082355][T20759] netlink: 'syz.1.5090': attribute type 10 has an invalid length. [ 926.092433][ T5859] usb 6-1: Found UVC 7.01 device syz (8086:0b07) [ 926.098874][ T5859] usb 6-1: No valid video chain found. [ 926.104388][ T5859] usb 6-1: selecting invalid altsetting 0 [ 926.147945][ T5859] usb 6-1: selecting invalid altsetting 0 [ 926.213007][ T5859] usbtest: probe of 6-1:220.1 failed with error -22 [ 926.481656][ T5859] usb 6-1: USB disconnect, device number 32 [ 926.565614][T20759] team0 (unregistering): Port device team_slave_0 removed [ 926.587673][T20759] team0 (unregistering): Port device team_slave_1 removed [ 926.597381][T20770] loop5: detected capacity change from 0 to 256 [ 926.621418][T20770] exfat: Deprecated parameter 'utf8' [ 926.626827][T20770] exfat: Deprecated parameter 'namecase' [ 926.646345][T20770] exfat: Deprecated parameter 'utf8' [ 926.664988][T20770] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 926.889583][T20770] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 926.898240][T20770] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 927.056888][T20774] netlink: 'syz.1.5094': attribute type 1 has an invalid length. [ 927.071614][T20775] netlink: 'syz.1.5094': attribute type 1 has an invalid length. [ 927.295343][T20762] loop6: detected capacity change from 0 to 32768 [ 927.435096][T20762] ocfs2: Mounting device (7,6) on (node local, slot 0) with writeback data mode. [ 927.578930][ T28] audit: type=1800 audit(1183.628:5715): pid=20762 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.5091" name="file1" dev="loop6" ino=17058 res=0 errno=0 [ 928.028115][T20790] fuse: Bad value for 'fd' [ 928.113327][T16412] ocfs2: Unmounting device (7,6) on (node local) [ 928.602802][T20806] FAULT_INJECTION: forcing a failure. [ 928.602802][T20806] name failslab, interval 1, probability 0, space 0, times 0 [ 928.637919][T20806] CPU: 0 PID: 20806 Comm: syz.5.5102 Not tainted syzkaller #0 [ 928.646043][T20806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 928.656118][T20806] Call Trace: [ 928.659408][T20806] [ 928.662352][T20806] dump_stack_lvl+0x16c/0x230 [ 928.667051][T20806] ? show_regs_print_info+0x20/0x20 [ 928.672272][T20806] ? load_image+0x3b0/0x3b0 [ 928.676803][T20806] ? __might_sleep+0xe0/0xe0 [ 928.681407][T20806] ? __lock_acquire+0x7c80/0x7c80 [ 928.686439][T20806] should_fail_ex+0x39d/0x4d0 [ 928.691127][T20806] should_failslab+0x9/0x20 [ 928.695633][T20806] slab_pre_alloc_hook+0x59/0x310 [ 928.700659][T20806] ? __lock_acquire+0x7c80/0x7c80 [ 928.705676][T20806] kmem_cache_alloc+0x5a/0x2e0 [ 928.710433][T20806] ? security_file_alloc+0x34/0x120 [ 928.715634][T20806] security_file_alloc+0x34/0x120 [ 928.720655][T20806] init_file+0x94/0x1f0 [ 928.724807][T20806] alloc_empty_file+0xb7/0x1d0 [ 928.729572][T20806] path_openat+0x100/0x3190 [ 928.734077][T20806] ? kasan_set_track+0x4e/0x70 [ 928.738835][T20806] ? __kasan_slab_alloc+0x6c/0x80 [ 928.743856][T20806] ? do_sys_openat2+0xcb/0x1c0 [ 928.748608][T20806] ? __x64_sys_openat+0x139/0x160 [ 928.753630][T20806] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 928.759686][T20806] ? verify_lock_unused+0x140/0x140 [ 928.764882][T20806] ? do_filp_open+0x3d0/0x3d0 [ 928.769557][T20806] ? __virt_addr_valid+0x18c/0x540 [ 928.774669][T20806] do_filp_open+0x1c5/0x3d0 [ 928.779168][T20806] ? vfs_tmpfile+0x490/0x490 [ 928.783769][T20806] ? _raw_spin_unlock+0x28/0x40 [ 928.788609][T20806] ? alloc_fd+0x58f/0x630 [ 928.792933][T20806] do_sys_openat2+0x12c/0x1c0 [ 928.797619][T20806] ? do_sys_open+0xe0/0xe0 [ 928.802044][T20806] ? lockdep_hardirqs_on_prepare+0x400/0x760 [ 928.808044][T20806] ? lock_chain_count+0x20/0x20 [ 928.812900][T20806] ? lock_chain_count+0x20/0x20 [ 928.817753][T20806] __x64_sys_openat+0x139/0x160 [ 928.822609][T20806] do_syscall_64+0x55/0xb0 [ 928.827030][T20806] ? clear_bhb_loop+0x40/0x90 [ 928.831710][T20806] ? clear_bhb_loop+0x40/0x90 [ 928.836380][T20806] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 928.842267][T20806] RIP: 0033:0x7f0ec1d8d810 [ 928.846713][T20806] Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 69 95 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 bc 95 02 00 8b 44 [ 928.866574][T20806] RSP: 002b:00007f0ec2d1cb70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 928.874993][T20806] RAX: ffffffffffffffda RBX: 0000000000101301 RCX: 00007f0ec1d8d810 [ 928.882955][T20806] RDX: 0000000000101301 RSI: 00007f0ec2d1cc10 RDI: 00000000ffffff9c [ 928.890922][T20806] RBP: 00007f0ec2d1cc10 R08: 0000000000000000 R09: 0000000000000000 [ 928.898895][T20806] R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd [ 928.906867][T20806] R13: 00007f0ec1fe6038 R14: 00007f0ec1fe5fa0 R15: 00007ffeedcb0978 [ 928.914856][T20806] [ 928.926054][T20810] comedi comedi0: Minor 47 could not be opened [ 929.026777][T20818] serio: Serial port ttyS3 [ 929.037517][T20819] FAULT_INJECTION: forcing a failure. [ 929.037517][T20819] name failslab, interval 1, probability 0, space 0, times 0 [ 929.050676][T20819] CPU: 0 PID: 20819 Comm: syz.6.5106 Not tainted syzkaller #0 [ 929.058160][T20819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 929.068220][T20819] Call Trace: [ 929.071489][T20819] [ 929.074410][T20819] dump_stack_lvl+0x16c/0x230 [ 929.079081][T20819] ? show_regs_print_info+0x20/0x20 [ 929.084264][T20819] ? load_image+0x3b0/0x3b0 [ 929.088759][T20819] ? __might_sleep+0xe0/0xe0 [ 929.093336][T20819] ? __lock_acquire+0x7c80/0x7c80 [ 929.098340][T20819] ? prepend_path+0x4b/0x960 [ 929.102914][T20819] should_fail_ex+0x39d/0x4d0 [ 929.107580][T20819] should_failslab+0x9/0x20 [ 929.112092][T20819] slab_pre_alloc_hook+0x59/0x310 [ 929.117148][T20819] ? __asan_memcpy+0x40/0x70 [ 929.121745][T20819] ? tomoyo_encode+0x28b/0x540 [ 929.126508][T20819] ? tomoyo_encode+0x28b/0x540 [ 929.131256][T20819] __kmem_cache_alloc_node+0x53/0x260 [ 929.136612][T20819] ? prepend_path+0x4b/0x960 [ 929.141218][T20819] ? tomoyo_encode+0x28b/0x540 [ 929.145970][T20819] __kmalloc+0xa4/0x240 [ 929.150113][T20819] tomoyo_encode+0x28b/0x540 [ 929.154687][T20819] tomoyo_realpath_from_path+0x592/0x5d0 [ 929.160323][T20819] tomoyo_path_number_perm+0x1ea/0x590 [ 929.165771][T20819] ? tomoyo_path_number_perm+0x1ba/0x590 [ 929.171397][T20819] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 929.176850][T20819] ? ksys_write+0x1c1/0x250 [ 929.181354][T20819] ? __fget_files+0x28/0x4d0 [ 929.185932][T20819] security_file_ioctl+0x70/0xa0 [ 929.190863][T20819] __se_sys_ioctl+0x48/0x170 [ 929.195437][T20819] do_syscall_64+0x55/0xb0 [ 929.199839][T20819] ? clear_bhb_loop+0x40/0x90 [ 929.204498][T20819] ? clear_bhb_loop+0x40/0x90 [ 929.209161][T20819] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 929.215077][T20819] RIP: 0033:0x7fd34618efc9 [ 929.219485][T20819] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 929.239259][T20819] RSP: 002b:00007fd3443f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 929.247687][T20819] RAX: ffffffffffffffda RBX: 00007fd3463e5fa0 RCX: 00007fd34618efc9 [ 929.255643][T20819] RDX: 0000200000000300 RSI: 00000000c01864ba RDI: 0000000000000003 [ 929.263601][T20819] RBP: 00007fd3443f6090 R08: 0000000000000000 R09: 0000000000000000 [ 929.271558][T20819] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 929.279514][T20819] R13: 00007fd3463e6038 R14: 00007fd3463e5fa0 R15: 00007ffe5c320478 [ 929.287478][T20819] [ 929.292035][T20814] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 929.379216][T20819] ERROR: Out of memory at tomoyo_realpath_from_path. [ 929.909811][T20827] snd_dummy snd_dummy.0: control 0:8:0:syz0:0 is already present [ 930.029298][T20831] loop5: detected capacity change from 0 to 4096 [ 930.137830][T20831] ntfs: (device loop5): parse_options(): NLS character set maccentHuro not found. Using previous one cp857. [ 930.149921][T20831] ntfs: (device loop5): parse_options(): Invalid mft_zone_multiplier. Using default value, i.e. 1. [ 930.636395][T20831] ntfs: volume version 3.1. [ 930.882247][T20831] ntfs: (device loop5): ntfs_index_lookup(): Corrupt index. Aborting lookup. [ 930.893840][T20836] loop6: detected capacity change from 0 to 16 [ 930.901196][T20831] ntfs: (device loop5): ntfs_mark_quotas_out_of_date(): Lookup of quota defaults entry failed. [ 930.905216][T20836] erofs: DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 930.926149][T20836] erofs: DAX unsupported by block device. Turning off DAX. [ 930.936196][T20831] ntfs: (device loop5): load_system_files(): Failed to mark quotas out of date. Mounting read-only. Run chkdsk. [ 930.953480][T20831] ntfs: (device loop5): ntfs_lookup_inode_by_name(): Corrupt directory. Aborting lookup. [ 930.964183][T20831] ntfs: (device loop5): load_and_init_usnjrnl(): Failed to find inode number for $UsnJrnl. [ 930.974547][T20831] ntfs: (device loop5): load_system_files(): Failed to load $UsnJrnl. Will not be able to remount read-write. Run chkdsk. [ 931.262809][T20843] loop5: detected capacity change from 0 to 4096 [ 931.277125][T20843] ntfs3: loop5: Different NTFS sector size (2048) and media sector size (512). [ 931.286351][T20843] ntfs3: loop5: RAW NTFS volume: Filesystem size 0.00 Gb > volume size 0.00 Gb. Mount in read-only. [ 931.299047][T20843] ntfs3: loop5: It is recommened to use chkdsk. [ 931.323336][T20843] ntfs3: loop5: failed to read volume at offset 0x201800 [ 931.330717][T20843] ntfs3: loop5: failed to read volume at offset 0x201800 [ 931.337819][T20843] ntfs3: loop5: failed to read volume at offset 0x201800 [ 931.358956][T20843] ntfs3: loop5: failed to read volume at offset 0x201800 [ 931.369061][T20843] ntfs3: loop5: failed to read volume at offset 0x202800 [ 931.386941][T20843] ntfs3: loop5: failed to read volume at offset 0x203800 [ 931.397030][T20843] ntfs3: loop5: failed to read volume at offset 0x205800 [ 931.502652][T20843] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 931.521392][T20843] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 931.546619][T20836] loop6: detected capacity change from 0 to 40427 [ 931.573977][T20836] F2FS-fs (loop6): Wrong NAT boundary, start(2560) end(3456110080) blocks(1024) [ 931.618909][T20836] F2FS-fs (loop6): Can't find valid F2FS filesystem in 2th superblock [ 931.640696][T20836] F2FS-fs (loop6): invalid crc value [ 931.689428][T20836] F2FS-fs (loop6): Found nat_bits in checkpoint [ 931.774333][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.781390][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.802472][T20836] F2FS-fs (loop6): Try to recover 2th superblock, ret: 0 [ 931.822281][T20836] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 931.939817][T16412] syz-executor: attempt to access beyond end of device [ 931.939817][T16412] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 931.991304][T16412] F2FS-fs (loop6): Stopped filesystem due to reason: 3 [ 932.528323][T20851] Invalid ELF header magic: != ELF [ 932.867635][ T5800] Bluetooth: hci3: unexpected event 0x14 length: 12 > 6 [ 932.974622][T20869] tipc: Failed to remove unknown binding: 66,1,1/0:2928875110/2928875112 [ 932.998371][T20869] loop5: detected capacity change from 0 to 512 [ 933.006153][T20869] EXT4-fs (loop5): couldn't mount as ext3 due to feature incompatibilities [ 933.551175][T20878] loop6: detected capacity change from 0 to 256 [ 933.558546][T20878] exfat: Deprecated parameter 'utf8' [ 933.564375][T20878] exfat: Deprecated parameter 'namecase' [ 933.572490][T20878] exfat: Deprecated parameter 'utf8' [ 933.592736][T20878] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0x11bbdf60, utbl_chksum : 0xe619d30d) [ 933.703870][T20878] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 933.712669][T20878] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 934.837740][T20891] loop5: detected capacity change from 0 to 16 [ 934.845858][T20891] erofs: DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 934.857179][T20891] erofs: DAX unsupported by block device. Turning off DAX. [ 935.186171][T20893] loop6: detected capacity change from 0 to 32768 [ 935.244285][T20893] loop6: p9 p11 p16 [ 935.302655][T20891] loop5: detected capacity change from 0 to 40427 [ 935.312652][T20891] F2FS-fs (loop5): Wrong NAT boundary, start(2560) end(3456110080) blocks(1024) [ 935.322212][T20891] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 935.338787][T20891] F2FS-fs (loop5): invalid crc value [ 935.354234][T20891] F2FS-fs (loop5): Found nat_bits in checkpoint [ 935.413914][T20899] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5129'. [ 935.431571][T20891] F2FS-fs (loop5): Try to recover 2th superblock, ret: 0 [ 935.449271][T20891] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 935.584466][T14401] syz-executor: attempt to access beyond end of device [ 935.584466][T14401] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 935.633727][T14401] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 936.954487][T20922] loop6: detected capacity change from 0 to 256 [ 936.990072][T20922] exfat: Deprecated parameter 'namecase' [ 936.995780][T20922] exfat: Deprecated parameter 'utf8' [ 937.031517][T20922] exFAT-fs (loop6): failed to read boot sector [ 937.037720][T20922] exFAT-fs (loop6): failed to recognize exfat type [ 937.106340][T20918] loop6: detected capacity change from 0 to 16 [ 937.133823][T20918] cramfs: Unknown parameter '9' [ 937.356745][T20933] loop6: detected capacity change from 0 to 16 [ 937.379759][T20933] erofs: DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 937.404312][T20933] erofs: DAX unsupported by block device. Turning off DAX. [ 937.581653][T20936] tipc: Failed to remove unknown binding: 66,1,1/0:1996223303/1996223305 [ 937.595248][T20936] loop6: detected capacity change from 0 to 512 [ 937.648987][T20936] EXT4-fs (loop6): couldn't mount as ext3 due to feature incompatibilities [ 937.820044][T20944] FAULT_INJECTION: forcing a failure. [ 937.820044][T20944] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 937.850814][T20944] CPU: 0 PID: 20944 Comm: syz.5.5142 Not tainted syzkaller #0 [ 937.858334][T20944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 937.868411][T20944] Call Trace: [ 937.871712][T20944] [ 937.874748][T20944] dump_stack_lvl+0x16c/0x230 [ 937.879462][T20944] ? show_regs_print_info+0x20/0x20 [ 937.884688][T20944] ? load_image+0x3b0/0x3b0 [ 937.889213][T20944] ? __lock_acquire+0x7c80/0x7c80 [ 937.894259][T20944] ? __stack_depot_save+0x1f/0x630 [ 937.899392][T20944] should_fail_ex+0x39d/0x4d0 [ 937.904101][T20944] prepare_alloc_pages+0x1e2/0x5f0 [ 937.909241][T20944] __alloc_pages+0x127/0x460 [ 937.913855][T20944] ? zone_statistics+0x170/0x170 [ 937.918817][T20944] ? alloc_pages+0x4dc/0x740 [ 937.923438][T20944] __get_free_pages+0xc/0x30 [ 937.928050][T20944] kasan_populate_vmalloc_pte+0x35/0x100 [ 937.933706][T20944] __apply_to_page_range+0x878/0xdb0 [ 937.939026][T20944] ? kasan_populate_vmalloc+0x70/0x70 [ 937.944430][T20944] ? apply_to_page_range+0x50/0x50 [ 937.949580][T20944] ? do_raw_spin_unlock+0x121/0x230 [ 937.954803][T20944] alloc_vmap_area+0x1b4a/0x1c70 [ 937.959766][T20944] ? vm_map_ram+0xcb0/0xcb0 [ 937.964267][T20944] ? rcu_is_watching+0x15/0xb0 [ 937.969029][T20944] __get_vm_area_node+0x162/0x370 [ 937.974048][T20944] __vmalloc_node_range+0x36e/0x1320 [ 937.979326][T20944] ? copy_process+0x549/0x3d70 [ 937.984094][T20944] ? free_vm_area+0x50/0x50 [ 937.988584][T20944] ? arch_dup_task_struct+0x57/0xd0 [ 937.993774][T20944] ? __asan_memcpy+0x40/0x70 [ 937.998354][T20944] dup_task_struct+0x3d0/0x7c0 [ 938.003106][T20944] ? copy_process+0x549/0x3d70 [ 938.007854][T20944] ? lockdep_hardirqs_on+0x98/0x150 [ 938.013042][T20944] copy_process+0x549/0x3d70 [ 938.017619][T20944] ? __might_fault+0xaa/0x120 [ 938.022300][T20944] ? get_pid_task+0x20/0x1e0 [ 938.026885][T20944] ? __pidfd_prepare+0x140/0x140 [ 938.031820][T20944] kernel_clone+0x21b/0x840 [ 938.036313][T20944] ? ksys_write+0x1c1/0x250 [ 938.040806][T20944] ? create_io_thread+0x140/0x140 [ 938.045830][T20944] __x64_sys_clone+0x18c/0x1e0 [ 938.050580][T20944] ? __fget_files+0x44a/0x4d0 [ 938.055247][T20944] ? __ia32_sys_vfork+0x100/0x100 [ 938.060268][T20944] ? lock_chain_count+0x20/0x20 [ 938.065115][T20944] ? lockdep_hardirqs_on+0x98/0x150 [ 938.070303][T20944] do_syscall_64+0x55/0xb0 [ 938.074723][T20944] ? clear_bhb_loop+0x40/0x90 [ 938.079408][T20944] ? clear_bhb_loop+0x40/0x90 [ 938.084085][T20944] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 938.089979][T20944] RIP: 0033:0x7f0ec1d8efc9 [ 938.094390][T20944] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 938.113991][T20944] RSP: 002b:00007f0ec2d1cfe8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 938.122456][T20944] RAX: ffffffffffffffda RBX: 00007f0ec1fe5fa0 RCX: 00007f0ec1d8efc9 [ 938.130456][T20944] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000011 [ 938.138442][T20944] RBP: 00007f0ec2d1d090 R08: 0000000000000000 R09: 0000000000000000 [ 938.146424][T20944] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000001 [ 938.154392][T20944] R13: 00007f0ec1fe6038 R14: 00007f0ec1fe5fa0 R15: 00007ffeedcb0978 [ 938.162373][T20944] [ 938.247519][T20944] syz.5.5142: vmalloc error: size 32768, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz5,mems_allowed=0-1 [ 938.273334][T20944] CPU: 1 PID: 20944 Comm: syz.5.5142 Not tainted syzkaller #0 [ 938.281193][T20944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 938.291265][T20944] Call Trace: [ 938.294556][T20944] [ 938.297584][T20944] dump_stack_lvl+0x16c/0x230 [ 938.302290][T20944] ? show_regs_print_info+0x20/0x20 [ 938.307505][T20944] ? load_image+0x3b0/0x3b0 [ 938.312030][T20944] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 938.318461][T20944] ? cpuset_print_current_mems_allowed+0x2e3/0x360 [ 938.324981][T20944] warn_alloc+0x210/0x300 [ 938.329333][T20944] ? slab_free_freelist_hook+0x130/0x1b0 [ 938.334988][T20944] ? zone_watermark_ok_safe+0x230/0x230 [ 938.340551][T20944] ? __get_vm_area_node+0x17b/0x370 [ 938.345775][T20944] ? __get_vm_area_node+0x17b/0x370 [ 938.350995][T20944] __vmalloc_node_range+0x393/0x1320 [ 938.356318][T20944] ? free_vm_area+0x50/0x50 [ 938.360836][T20944] ? arch_dup_task_struct+0x57/0xd0 [ 938.366051][T20944] ? __asan_memcpy+0x40/0x70 [ 938.370659][T20944] dup_task_struct+0x3d0/0x7c0 [ 938.375435][T20944] ? copy_process+0x549/0x3d70 [ 938.380211][T20944] ? lockdep_hardirqs_on+0x98/0x150 [ 938.385424][T20944] copy_process+0x549/0x3d70 [ 938.390037][T20944] ? __might_fault+0xaa/0x120 [ 938.394744][T20944] ? get_pid_task+0x20/0x1e0 [ 938.399353][T20944] ? __pidfd_prepare+0x140/0x140 [ 938.404309][T20944] kernel_clone+0x21b/0x840 [ 938.408817][T20944] ? ksys_write+0x1c1/0x250 [ 938.413333][T20944] ? create_io_thread+0x140/0x140 [ 938.418387][T20944] __x64_sys_clone+0x18c/0x1e0 [ 938.423163][T20944] ? __fget_files+0x44a/0x4d0 [ 938.427853][T20944] ? __ia32_sys_vfork+0x100/0x100 [ 938.432902][T20944] ? lock_chain_count+0x20/0x20 [ 938.437776][T20944] ? lockdep_hardirqs_on+0x98/0x150 [ 938.442990][T20944] do_syscall_64+0x55/0xb0 [ 938.447420][T20944] ? clear_bhb_loop+0x40/0x90 [ 938.452114][T20944] ? clear_bhb_loop+0x40/0x90 [ 938.456803][T20944] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 938.462708][T20944] RIP: 0033:0x7f0ec1d8efc9 [ 938.467138][T20944] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 938.486761][T20944] RSP: 002b:00007f0ec2d1cfe8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 938.495197][T20944] RAX: ffffffffffffffda RBX: 00007f0ec1fe5fa0 RCX: 00007f0ec1d8efc9 [ 938.503191][T20944] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000011 [ 938.511177][T20944] RBP: 00007f0ec2d1d090 R08: 0000000000000000 R09: 0000000000000000 [ 938.519163][T20944] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000001 [ 938.527145][T20944] R13: 00007f0ec1fe6038 R14: 00007f0ec1fe5fa0 R15: 00007ffeedcb0978 [ 938.535142][T20944] [ 938.538247][ C1] vkms_vblank_simulate: vblank timer overrun [ 938.553481][T20944] Mem-Info: [ 938.592906][T20944] active_anon:23096 inactive_anon:0 isolated_anon:0 [ 938.592906][T20944] active_file:7419 inactive_file:50695 isolated_file:0 [ 938.592906][T20944] unevictable:768 dirty:205 writeback:0 [ 938.592906][T20944] slab_reclaimable:12127 slab_unreclaimable:96724 [ 938.592906][T20944] mapped:35310 shmem:19740 pagetables:549 [ 938.592906][T20944] sec_pagetables:0 bounce:0 [ 938.592906][T20944] kernel_misc_reclaimable:0 [ 938.592906][T20944] free:1300371 free_pcp:2482 free_cma:0 [ 938.638214][ C1] vkms_vblank_simulate: vblank timer overrun [ 938.732440][T20944] Node 0 active_anon:100884kB inactive_anon:0kB active_file:29676kB inactive_file:202580kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:150340kB dirty:820kB writeback:0kB shmem:87024kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11152kB pagetables:2196kB sec_pagetables:0kB all_unreclaimable? no [ 938.766882][T20944] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 938.804120][T20944] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 938.842060][T20944] lowmem_reserve[]: 0 2525 2526 2526 2526 [ 939.034629][T20944] Node 0 DMA32 free:1261976kB boost:0kB min:34676kB low:43344kB high:52012kB reserved_highatomic:0KB active_anon:101036kB inactive_anon:0kB active_file:29676kB inactive_file:201260kB unevictable:1536kB writepending:820kB present:3129332kB managed:2589600kB mlocked:0kB bounce:0kB free_pcp:4396kB local_pcp:2708kB free_cma:0kB [ 939.065280][ C1] vkms_vblank_simulate: vblank timer overrun [ 939.323344][T20944] lowmem_reserve[]: 0 0 1 1 1 [ 939.343572][T20944] Node 0 Normal free:16kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1320kB unevictable:0kB writepending:0kB present:1048576kB managed:1384kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 939.456291][T20944] lowmem_reserve[]: 0 0 0 0 0 [ 939.462145][T20944] Node 1 Normal free:3913800kB boost:0kB min:55208kB low:69008kB high:82808kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:6464kB local_pcp:6464kB free_cma:0kB [ 939.491682][T20944] lowmem_reserve[]: 0 0 0 0 0 [ 939.496424][T20944] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 939.509136][T20944] Node 0 DMA32: 567*4kB (UE) 619*8kB (UME) 182*16kB (UE) 495*32kB (UE) 714*64kB (UME) 542*128kB (UE) 368*256kB (UME) 283*512kB (U) 185*1024kB (UME) 21*2048kB (UM) 158*4096kB (UM) = 1259764kB [ 939.528141][T20944] Node 0 Normal: 0*4kB 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16kB [ 939.540164][T20944] Node 1 Normal: 248*4kB (UME) 59*8kB (UME) 47*16kB (UME) 257*32kB (UME) 100*64kB (UME) 21*128kB (UME) 6*256kB (UME) 1*512kB (E) 1*1024kB (E) 2*2048kB (UE) 949*4096kB (M) = 3913800kB [ 939.576597][T20955] netlink: 13 bytes leftover after parsing attributes in process `syz.6.5145'. [ 939.589073][T20944] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 939.598657][T20944] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 939.649018][T20944] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 939.658611][T20944] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 939.689174][T20944] 78035 total pagecache pages [ 939.697242][T20944] 0 pages in swap cache [ 939.707599][T20944] Free swap = 124444kB [ 939.724293][T20944] Total swap = 124996kB [ 939.728484][T20944] 2097051 pages RAM [ 939.742597][T20944] 0 pages HighMem/MovableOnly [ 939.747308][T20944] 416137 pages reserved [ 939.778853][T20944] 0 pages cma reserved [ 939.921055][T20964] loop5: detected capacity change from 0 to 16 [ 939.948518][T20964] erofs: DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 939.980548][T20964] erofs: DAX unsupported by block device. Turning off DAX. [ 940.035852][T20966] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5150'. [ 940.087039][T20967] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5150'. [ 940.285845][T20973] tipc: Failed to remove unknown binding: 66,1,1/0:428620401/428620403 [ 941.274908][T20991] 9pnet_fd: Insufficient options for proto=fd [ 941.440421][ T28] audit: type=1326 audit(1197.348:5716): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20982 comm="syz.2.5156" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 941.638942][ T5859] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 941.648935][ T28] audit: type=1326 audit(1197.348:5717): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20982 comm="syz.2.5156" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 941.719146][ T28] audit: type=1326 audit(1197.348:5718): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20982 comm="syz.2.5156" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 941.783415][ T28] audit: type=1326 audit(1197.348:5719): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20982 comm="syz.2.5156" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 941.818258][ T28] audit: type=1326 audit(1197.348:5720): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20982 comm="syz.2.5156" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 941.840259][ T5859] usb 6-1: Using ep0 maxpacket: 32 [ 941.850749][ T5859] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 941.866538][ T5859] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 941.885891][ T5859] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 941.892035][ T28] audit: type=1326 audit(1197.348:5721): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20982 comm="syz.2.5156" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 941.918877][ T5859] usb 6-1: Product: syz [ 941.923109][ T5859] usb 6-1: Manufacturer: syz [ 941.960378][ T5859] usb 6-1: SerialNumber: syz [ 941.965258][ T28] audit: type=1326 audit(1197.348:5722): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20982 comm="syz.2.5156" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 941.967198][ T5859] usb 6-1: config 0 descriptor?? [ 942.040099][T20981] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 942.058474][ T5859] hub 6-1:0.0: bad descriptor, ignoring hub [ 942.063502][ T28] audit: type=1326 audit(1197.348:5723): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20982 comm="syz.2.5156" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 942.064719][ T5859] hub: probe of 6-1:0.0 failed with error -5 [ 942.104284][ T28] audit: type=1326 audit(1197.348:5724): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20982 comm="syz.2.5156" exe="/root/syz-executor" sig=0 arch=c000003e syscall=271 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 942.126199][ C1] vkms_vblank_simulate: vblank timer overrun [ 942.164406][ T28] audit: type=1326 audit(1197.348:5725): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20982 comm="syz.2.5156" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 943.036567][T20981] loop5: detected capacity change from 0 to 40427 [ 943.064762][T20981] F2FS-fs (loop5): invalid crc value [ 943.085809][T20981] F2FS-fs (loop5): Found nat_bits in checkpoint [ 943.162211][T20981] F2FS-fs (loop5): Start checkpoint disabled! [ 943.192234][T20981] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e6 [ 943.329193][ T6958] usb 6-1: USB disconnect, device number 33 [ 943.346712][T21027] loop6: detected capacity change from 0 to 256 [ 943.756204][T21040] loop6: detected capacity change from 0 to 128 [ 943.924928][T21040] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 944.311999][T10732] kworker/u4:23: attempt to access beyond end of device [ 944.311999][T10732] loop5: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 944.330979][T10732] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 944.341674][T10732] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 944.371296][T16412] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 944.546460][T21046] loop5: detected capacity change from 0 to 16 [ 944.553301][T21046] erofs: DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 944.562002][T21046] erofs: DAX unsupported by block device. Turning off DAX. [ 944.811857][T21046] loop5: detected capacity change from 0 to 40427 [ 944.819546][T21046] F2FS-fs (loop5): Wrong NAT boundary, start(2560) end(3456110080) blocks(1024) [ 944.828620][T21046] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 944.838144][T21046] F2FS-fs (loop5): invalid crc value [ 944.847306][T21046] F2FS-fs (loop5): Found nat_bits in checkpoint [ 944.878486][T21046] F2FS-fs (loop5): Try to recover 2th superblock, ret: 0 [ 944.885625][T21046] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 944.924343][T14401] syz-executor: attempt to access beyond end of device [ 944.924343][T14401] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 944.938416][T14401] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 954.782364][T21058] loop6: detected capacity change from 0 to 1024 [ 954.888238][ T28] kauditd_printk_skb: 90 callbacks suppressed [ 954.888252][ T28] audit: type=1326 audit(1210.938:5816): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21064 comm="syz.2.5177" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 954.918782][ T28] audit: type=1326 audit(1210.938:5817): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21064 comm="syz.2.5177" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 954.952878][ T28] audit: type=1326 audit(1210.948:5818): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21064 comm="syz.2.5177" exe="/root/syz-executor" sig=0 arch=c000003e syscall=323 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 954.976585][ T28] audit: type=1326 audit(1210.948:5819): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21064 comm="syz.2.5177" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 954.998853][ T28] audit: type=1326 audit(1210.948:5820): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21064 comm="syz.2.5177" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 955.020739][ C1] vkms_vblank_simulate: vblank timer overrun [ 955.033449][ T28] audit: type=1326 audit(1210.948:5821): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21064 comm="syz.2.5177" exe="/root/syz-executor" sig=0 arch=c000003e syscall=206 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 955.059037][ T28] audit: type=1326 audit(1210.948:5822): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21064 comm="syz.2.5177" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 955.113904][ T28] audit: type=1326 audit(1210.948:5823): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21064 comm="syz.2.5177" exe="/root/syz-executor" sig=0 arch=c000003e syscall=209 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 955.171117][T18483] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 955.209029][ T28] audit: type=1326 audit(1210.948:5824): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21064 comm="syz.2.5177" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 955.278277][ T28] audit: type=1326 audit(1210.948:5825): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21064 comm="syz.2.5177" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa41f98efc9 code=0x7ffc0000 [ 955.472718][T18483] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 955.551355][T18483] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 955.616029][T18483] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 955.690746][T18483] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 955.814925][T18483] usb 6-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 955.878407][T18483] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 955.897031][T18483] usb 6-1: Product: syz [ 955.907161][T18483] usb 6-1: Manufacturer: syz [ 955.922227][T18483] usb 6-1: SerialNumber: syz [ 955.937416][T18483] usb 6-1: config 0 descriptor?? [ 956.427561][T21075] vlan2: entered allmulticast mode [ 956.492295][T18483] adutux 6-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 957.725586][T21091] xt_bpf: check failed: parse error [ 958.002412][T21109] loop6: detected capacity change from 0 to 128 [ 958.025819][T21109] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 958.044933][T21109] hpfs: filesystem error: improperly stopped [ 958.052349][T21109] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 958.063637][T21109] hpfs: You really don't want any checks? You are crazy... [ 958.072719][T21109] hpfs: hpfs_map_sector(): read error [ 958.078276][T21109] hpfs: code page support is disabled [ 958.091245][T21109] hpfs: hpfs_map_4sectors(): unaligned read [ 958.099867][T21109] hpfs: hpfs_map_4sectors(): unaligned read [ 958.105875][T21109] hpfs: filesystem error: unable to find root dir [ 958.650474][T18483] usb 6-1: USB disconnect, device number 34 [ 959.269647][T21125] gfs2: not a GFS2 filesystem [ 959.288734][T21125] loop5: detected capacity change from 0 to 2048 [ 959.324295][T21125] EXT4-fs: Ignoring removed nobh option [ 959.351915][T21125] EXT4-fs error (device loop5): ext4_ext_check_inode:520: inode #2: comm syz.5.5195: pblk 0 bad header/extent: too large eh_depth - magic f30a, entries 1, max 4(4), depth 25349(25349) [ 959.381657][T21125] EXT4-fs (loop5): Remounting filesystem read-only [ 959.388268][T21125] EXT4-fs (loop5): get root inode failed [ 959.395220][T21125] EXT4-fs (loop5): mount failed [ 959.857497][T21138] loop6: detected capacity change from 0 to 4096 [ 960.056465][T21140] netlink: 'syz.1.5201': attribute type 1 has an invalid length. [ 960.276160][T21147] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5203'. [ 960.304289][T21145] gretap1: entered promiscuous mode [ 960.577647][T21153] cgroup: fork rejected by pids controller in /syz6 [ 960.932499][T21158] netlink: 'syz.1.5206': attribute type 4 has an invalid length. [ 960.946559][T21158] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.5206'. [ 960.975673][T21160] program syz.2.5207 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 960.996747][T21160] cgroup: fork rejected by pids controller in /syz2 [ 962.006288][T10732] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 962.180753][T20129] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 962.195706][T20129] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 962.214737][T20129] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 962.228664][T20129] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 962.242494][T20129] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 962.254517][T10732] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 962.270935][T20129] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 962.359186][T10732] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 962.594493][T10732] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 962.664074][ T5800] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 962.691476][ T5800] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 962.702586][ T5800] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 962.722540][ T5800] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 962.736115][ T5800] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 962.744543][ T5800] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 963.377589][T10732] tipc: Left network mode [ 963.442621][T21169] chnl_net:caif_netlink_parms(): no params data found [ 963.653517][T21181] loop5: detected capacity change from 0 to 40427 [ 963.695892][T21181] F2FS-fs (loop5): invalid crc value [ 963.756568][T21181] F2FS-fs (loop5): Found nat_bits in checkpoint [ 963.815354][T21181] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 963.827150][T21169] bridge0: port 1(bridge_slave_0) entered blocking state [ 963.841868][ T28] kauditd_printk_skb: 67 callbacks suppressed [ 963.841883][ T28] audit: type=1800 audit(1219.898:5893): pid=21181 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.5214" name="file1" dev="loop5" ino=10 res=0 errno=0 [ 963.851691][T21169] bridge0: port 1(bridge_slave_0) entered disabled state [ 963.887448][T21169] bridge_slave_0: entered allmulticast mode [ 963.900369][T21169] bridge_slave_0: entered promiscuous mode [ 963.915325][ T28] audit: type=1800 audit(1219.968:5894): pid=21181 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.5214" name="file1" dev="loop5" ino=10 res=0 errno=0 [ 963.959292][ T28] audit: type=1800 audit(1220.018:5895): pid=21181 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.5214" name="file1" dev="loop5" ino=10 res=0 errno=0 [ 964.005266][T21169] bridge0: port 2(bridge_slave_1) entered blocking state [ 964.012737][T21169] bridge0: port 2(bridge_slave_1) entered disabled state [ 964.030668][T21169] bridge_slave_1: entered allmulticast mode [ 964.042045][T21197] syz.5.5214: attempt to access beyond end of device [ 964.042045][T21197] loop5: rw=0, sector=77824, nr_sectors = 8 limit=40427 [ 964.051184][T21169] bridge_slave_1: entered promiscuous mode [ 964.070916][T21181] syz.5.5214: attempt to access beyond end of device [ 964.070916][T21181] loop5: rw=2049, sector=77832, nr_sectors = 2568 limit=40427 [ 964.165493][T21169] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 964.219209][T21169] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 964.238701][T14401] syz-executor: attempt to access beyond end of device [ 964.238701][T14401] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 964.254276][T14401] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 964.304658][T21177] chnl_net:caif_netlink_parms(): no params data found [ 964.333400][ T5800] Bluetooth: hci0: command tx timeout [ 964.378152][T21169] team0: Port device team_slave_0 added [ 964.387359][T21169] team0: Port device team_slave_1 added [ 964.398344][T21200] netlink: 148 bytes leftover after parsing attributes in process `syz.1.5217'. [ 964.554363][T21169] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 964.561965][T21169] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 964.588253][T21169] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 964.601898][T21169] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 964.609113][T21169] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 964.642343][T21169] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 964.815928][ T5800] Bluetooth: hci1: command tx timeout [ 964.918341][T21169] hsr_slave_0: entered promiscuous mode [ 964.925083][T21169] hsr_slave_1: entered promiscuous mode [ 964.932268][T21169] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 964.947407][T21169] Cannot create hsr debugfs directory [ 964.972691][T21177] bridge0: port 1(bridge_slave_0) entered blocking state [ 964.989034][T21177] bridge0: port 1(bridge_slave_0) entered disabled state [ 964.996394][T21177] bridge_slave_0: entered allmulticast mode [ 965.004053][T21177] bridge_slave_0: entered promiscuous mode [ 965.155039][T21177] bridge0: port 2(bridge_slave_1) entered blocking state [ 965.178432][T21177] bridge0: port 2(bridge_slave_1) entered disabled state [ 965.201618][T21177] bridge_slave_1: entered allmulticast mode [ 965.219283][T21177] bridge_slave_1: entered promiscuous mode [ 965.351015][T21177] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 965.402138][T21177] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 965.678358][T21210] loop5: detected capacity change from 0 to 40427 [ 965.686545][T21210] F2FS-fs (loop5): Wrong NAT boundary, start(2560) end(3456110080) blocks(1024) [ 965.706686][T21210] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 965.726933][T21210] F2FS-fs (loop5): invalid crc value [ 965.735583][T21210] F2FS-fs (loop5): Found nat_bits in checkpoint [ 965.813971][T21210] F2FS-fs (loop5): Try to recover 2th superblock, ret: 0 [ 965.824865][T21210] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 965.941912][T14401] syz-executor: attempt to access beyond end of device [ 965.941912][T14401] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 965.957199][T14401] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 966.096624][T21177] team0: Port device team_slave_0 added [ 966.122445][T21177] team0: Port device team_slave_1 added [ 966.132718][T10732] hsr_slave_0: left promiscuous mode [ 966.139511][T10732] hsr_slave_1: left promiscuous mode [ 966.146334][T10732] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 966.154041][T10732] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 966.162261][T10732] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 966.176888][T10732] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 966.187347][T10732] bridge_slave_1: left allmulticast mode [ 966.197309][T10732] bridge_slave_1: left promiscuous mode [ 966.205316][T10732] bridge0: port 2(bridge_slave_1) entered disabled state [ 966.224577][T10732] bridge_slave_0: left allmulticast mode [ 966.233779][T10732] bridge_slave_0: left promiscuous mode [ 966.243626][T10732] bridge0: port 1(bridge_slave_0) entered disabled state [ 966.304133][T10732] veth1_macvtap: left promiscuous mode [ 966.311740][T10732] veth0_macvtap: left promiscuous mode [ 966.317441][T10732] veth1_vlan: left promiscuous mode [ 966.322883][T10732] veth0_vlan: left promiscuous mode [ 966.369035][ T6958] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 966.409302][ T5800] Bluetooth: hci0: command tx timeout [ 966.585111][ T6958] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 966.619218][ T6958] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 966.631270][ T6958] usb 2-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 966.673072][ T6958] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 966.685425][ T6958] usb 2-1: config 0 descriptor?? [ 966.948909][T21226] loop5: detected capacity change from 0 to 164 [ 967.023846][T21226] rock: corrupted directory entry. extent=28, offset=0, size=16777216 [ 967.040601][ T5800] Bluetooth: hci1: command tx timeout [ 967.895015][T10732] team0 (unregistering): Port device team_slave_1 removed [ 967.931144][T21218] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 967.942956][T21218] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 968.005032][T10732] team0 (unregistering): Port device team_slave_0 removed [ 968.082043][T10732] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 968.154466][T10732] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 968.477303][ T6958] hid-led: probe of 0003:27B8:01ED.001A failed with error -32 [ 968.490136][ T5800] Bluetooth: hci0: command tx timeout [ 968.577131][T18483] usb 2-1: USB disconnect, device number 30 [ 969.081412][T10732] bond0 (unregistering): Released all slaves [ 969.149304][ T5800] Bluetooth: hci1: command tx timeout [ 969.416015][T21177] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 969.424247][T21177] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 969.450346][T21177] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 969.470747][T21177] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 969.477877][T21177] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 969.504443][T21177] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 969.619768][T21177] hsr_slave_0: entered promiscuous mode [ 969.636568][T21177] hsr_slave_1: entered promiscuous mode [ 969.666538][T21177] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 969.674628][T21177] Cannot create hsr debugfs directory [ 969.964692][ T5800] Bluetooth: hci4: unexpected event for opcode 0x2012 [ 970.023298][T21169] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 970.170199][T21169] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 970.261724][T21169] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 970.357593][T21169] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 970.500857][T10732] tipc: Left network mode [ 970.569194][ T5800] Bluetooth: hci0: command tx timeout [ 970.754905][T21258] loop5: detected capacity change from 0 to 64 [ 970.769305][T21258] hfs: unable to locate alternate MDB [ 970.775208][T21258] hfs: continuing without an alternate MDB [ 970.788069][T21258] hfs: found bad thread record in catalog [ 970.798476][T21258] hfs: get root inode failed [ 971.127377][T21169] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 971.193783][T21169] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 971.222639][ T5800] Bluetooth: hci1: command tx timeout [ 971.226178][T21169] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 971.445668][T21169] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 971.939417][T21177] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 971.964619][T21177] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 972.014912][T21177] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 972.083183][T21177] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 972.889654][T10732] hsr_slave_0: left promiscuous mode [ 972.895687][T10732] hsr_slave_1: left promiscuous mode [ 972.906483][T10732] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 972.915852][T10732] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 972.924662][T10732] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 972.932181][T10732] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 972.940676][T10732] bridge_slave_1: left allmulticast mode [ 972.946588][T10732] bridge_slave_1: left promiscuous mode [ 972.952504][T10732] bridge0: port 2(bridge_slave_1) entered disabled state [ 972.962949][T10732] bridge0: port 1(bridge_slave_0) entered disabled state [ 973.015998][T10732] veth1_macvtap: left promiscuous mode [ 973.028072][T10732] veth0_macvtap: left promiscuous mode [ 973.033873][T10732] veth1_vlan: left promiscuous mode [ 973.039427][T10732] veth0_vlan: left promiscuous mode [ 973.266080][T10732] bond1 (unregistering): Released all slaves [ 974.600718][ T5800] Bluetooth: hci3: unexpected event for opcode 0x0c23 [ 974.637212][T10732] team0 (unregistering): Port device team_slave_1 removed [ 974.711912][T10732] team0 (unregistering): Port device team_slave_0 removed [ 974.778048][T10732] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 974.854014][T10732] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 975.583245][T21303] loop5: detected capacity change from 0 to 32768 [ 975.591932][T21303] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz.5.5242 (21303) [ 975.648305][T21303] BTRFS info (device loop5): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 975.658588][T21303] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm [ 975.667360][T21303] BTRFS info (device loop5): setting nodatacow, compression disabled [ 975.675851][T21303] BTRFS info (device loop5): enabling auto defrag [ 975.682410][T21303] BTRFS info (device loop5): max_inline at 0 [ 975.688429][T21303] BTRFS info (device loop5): using free space tree [ 975.793362][T10732] bond0 (unregistering): Released all slaves [ 975.815667][T21303] BTRFS info (device loop5): auto enabling async discard [ 975.874448][T14401] BTRFS info (device loop5): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 976.174694][T21169] 8021q: adding VLAN 0 to HW filter on device bond0 [ 976.336357][T21169] 8021q: adding VLAN 0 to HW filter on device team0 [ 976.357536][T10779] bridge0: port 1(bridge_slave_0) entered blocking state [ 976.364765][T10779] bridge0: port 1(bridge_slave_0) entered forwarding state [ 976.408501][T10723] bridge0: port 2(bridge_slave_1) entered blocking state [ 976.415688][T10723] bridge0: port 2(bridge_slave_1) entered forwarding state [ 976.448479][T21177] 8021q: adding VLAN 0 to HW filter on device bond0 [ 976.564630][T21177] 8021q: adding VLAN 0 to HW filter on device team0 [ 976.578647][T10779] bridge0: port 1(bridge_slave_0) entered blocking state [ 976.585957][T10779] bridge0: port 1(bridge_slave_0) entered forwarding state [ 976.616582][T20066] bridge0: port 2(bridge_slave_1) entered blocking state [ 976.623753][T20066] bridge0: port 2(bridge_slave_1) entered forwarding state [ 976.756014][T10732] IPVS: stop unused estimator thread 0... [ 977.942071][T21169] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 978.807223][T21339] loop5: detected capacity change from 0 to 1024 [ 979.018415][T21177] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 979.770154][T21339] hfsplus: invalid length 256 has been corrected to 255 [ 979.782021][T21339] ================================================================== [ 979.790118][T21339] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x5bd/0x1240 [ 979.797856][T21339] Read of size 2 at addr ffff88802cdfca18 by task syz.5.5246/21339 [ 979.805760][T21339] [ 979.808091][T21339] CPU: 1 PID: 21339 Comm: syz.5.5246 Not tainted syzkaller #0 [ 979.815571][T21339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 979.825640][T21339] Call Trace: [ 979.828930][T21339] [ 979.831869][T21339] dump_stack_lvl+0x16c/0x230 [ 979.836558][T21339] ? __lock_acquire+0x7c80/0x7c80 [ 979.841587][T21339] ? show_regs_print_info+0x20/0x20 [ 979.846814][T21339] ? load_image+0x3b0/0x3b0 [ 979.851595][T21339] ? _raw_spin_lock_irqsave+0xb4/0xf0 [ 979.856984][T21339] ? __virt_addr_valid+0x18c/0x540 [ 979.862118][T21339] ? __virt_addr_valid+0x469/0x540 [ 979.867253][T21339] print_report+0xac/0x220 [ 979.870044][T21177] veth0_vlan: entered promiscuous mode [ 979.871670][T21339] ? hfsplus_uni2asc+0x5bd/0x1240 [ 979.871697][T21339] kasan_report+0x117/0x150 [ 979.871718][T21339] ? hfsplus_uni2asc+0x5bd/0x1240 [ 979.891701][T21339] hfsplus_uni2asc+0x5bd/0x1240 [ 979.896572][T21339] ? hfsplus_bnode_read+0x1c2/0x6f0 [ 979.901794][T21339] hfsplus_listxattr+0x58f/0xb80 [ 979.903791][T21177] veth1_vlan: entered promiscuous mode [ 979.906738][T21339] ? hfsplus_getxattr+0x160/0x160 [ 979.917245][T21339] ? kasan_save_free_info+0x2e/0x50 [ 979.922567][T21339] ? slab_free_freelist_hook+0x130/0x1b0 [ 979.928199][T21339] ? user_path_at_empty+0x4c/0x60 [ 979.933222][T21339] ? kmem_cache_free+0xf8/0x280 [ 979.938061][T21339] ? bpf_lsm_inode_listxattr+0x9/0x10 [ 979.943436][T21339] ? hfsplus_getxattr+0x160/0x160 [ 979.948486][T21339] listxattr+0x107/0x280 [ 979.952718][T21339] path_listxattr+0xdd/0x1b0 [ 979.957299][T21339] ? path_getxattr+0x400/0x400 [ 979.962066][T21339] ? lockdep_hardirqs_on+0x98/0x150 [ 979.967282][T21339] do_syscall_64+0x55/0xb0 [ 979.971721][T21339] ? clear_bhb_loop+0x40/0x90 [ 979.976412][T21339] ? clear_bhb_loop+0x40/0x90 [ 979.981102][T21339] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 979.987003][T21339] RIP: 0033:0x7f0ec1d8efc9 [ 979.991433][T21339] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 980.011058][T21339] RSP: 002b:00007f0ec2cfc038 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 [ 980.019492][T21339] RAX: ffffffffffffffda RBX: 00007f0ec1fe6090 RCX: 00007f0ec1d8efc9 [ 980.027487][T21339] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000080 [ 980.035484][T21339] RBP: 00007f0ec1e11f91 R08: 0000000000000000 R09: 0000000000000000 [ 980.043480][T21339] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 980.048033][T21177] veth0_macvtap: entered promiscuous mode [ 980.051448][T21339] R13: 00007f0ec1fe6128 R14: 00007f0ec1fe6090 R15: 00007ffeedcb0978 [ 980.051471][T21339] [ 980.051478][T21339] [ 980.051495][T21339] Allocated by task 21339: [ 980.051503][T21339] kasan_set_track+0x4e/0x70 [ 980.079527][T21339] __kasan_kmalloc+0x8f/0xa0 [ 980.084115][T21339] __kmalloc+0xb4/0x240 [ 980.088265][T21339] hfsplus_find_init+0x89/0x1d0 [ 980.093109][T21339] hfsplus_listxattr+0x390/0xb80 [ 980.098043][T21339] listxattr+0x107/0x280 [ 980.102277][T21339] path_listxattr+0xdd/0x1b0 [ 980.106856][T21339] do_syscall_64+0x55/0xb0 [ 980.111259][T21339] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 980.117138][T21339] [ 980.119449][T21339] Last potentially related work creation: [ 980.125141][T21339] kasan_save_stack+0x3e/0x60 [ 980.129803][T21339] __kasan_record_aux_stack+0xaf/0xc0 [ 980.135168][T21339] call_rcu+0x158/0x930 [ 980.139321][T21339] sctp_association_free+0x6a1/0x7f0 [ 980.144596][T21339] sctp_do_sm+0x3e64/0x59a0 [ 980.149086][T21339] sctp_primitive_ABORT+0x98/0xc0 [ 980.154094][T21339] sctp_close+0x2d7/0x900 [ 980.158413][T21339] inet_release+0x13d/0x180 [ 980.162902][T21339] sock_close+0xbd/0x230 [ 980.167124][T21339] __fput+0x234/0x970 [ 980.171095][T21339] task_work_run+0x1ce/0x250 [ 980.175674][T21339] exit_to_user_mode_loop+0xe6/0x110 [ 980.180945][T21339] exit_to_user_mode_prepare+0xf6/0x180 [ 980.186476][T21339] syscall_exit_to_user_mode+0x1a/0x50 [ 980.191920][T21339] do_syscall_64+0x61/0xb0 [ 980.196334][T21339] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 980.202211][T21339] [ 980.204540][T21339] Second to last potentially related work creation: [ 980.211103][T21339] kasan_save_stack+0x3e/0x60 [ 980.215772][T21339] __kasan_record_aux_stack+0xaf/0xc0 [ 980.221130][T21339] kvfree_call_rcu+0xee/0x780 [ 980.225795][T21339] neigh_flush_dev+0x177/0xa80 [ 980.230545][T21339] __neigh_ifdown+0x3d/0x460 [ 980.235119][T21339] neigh_ifdown+0x1f/0x30 [ 980.239453][T21339] rt6_disable_ip+0x730/0x7a0 [ 980.244114][T21339] addrconf_ifdown+0x15e/0x1880 [ 980.248952][T21339] addrconf_notify+0x6c6/0x1010 [ 980.253790][T21339] notifier_call_chain+0x197/0x390 [ 980.258885][T21339] dev_close_many+0x297/0x400 [ 980.263545][T21339] unregister_netdevice_many_notify+0x4c1/0x1810 [ 980.269861][T21339] macvlan_device_event+0x7d6/0x860 [ 980.275045][T21339] notifier_call_chain+0x197/0x390 [ 980.280144][T21339] unregister_netdevice_many_notify+0xf36/0x1810 [ 980.286459][T21339] rtnl_dellink+0x43c/0x730 [ 980.290952][T21339] rtnetlink_rcv_msg+0x7c7/0xf10 [ 980.295871][T21339] netlink_rcv_skb+0x216/0x480 [ 980.300619][T21339] netlink_unicast+0x751/0x8d0 [ 980.305369][T21339] netlink_sendmsg+0x8c1/0xbe0 [ 980.310132][T21339] ____sys_sendmsg+0x5bf/0x950 [ 980.314902][T21339] ___sys_sendmsg+0x220/0x290 [ 980.319586][T21339] __se_sys_sendmsg+0x1a5/0x270 [ 980.324438][T21339] do_syscall_64+0x55/0xb0 [ 980.328843][T21339] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 980.334728][T21339] [ 980.337037][T21339] The buggy address belongs to the object at ffff88802cdfc800 [ 980.337037][T21339] which belongs to the cache kmalloc-1k of size 1024 [ 980.351077][T21339] The buggy address is located 0 bytes to the right of [ 980.351077][T21339] allocated 536-byte region [ffff88802cdfc800, ffff88802cdfca18) [ 980.365553][T21339] [ 980.367861][T21339] The buggy address belongs to the physical page: [ 980.374263][T21339] page:ffffea0000b37e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2cdf8 [ 980.384403][T21339] head:ffffea0000b37e00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 980.393319][T21339] anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 980.401714][T21339] page_type: 0xffffffff() [ 980.406025][T21339] raw: 00fff00000000840 ffff888017841dc0 0000000000000000 dead000000000001 [ 980.414590][T21339] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 980.423155][T21339] page dumped because: kasan: bad access detected [ 980.429562][T21339] page_owner tracks the page as allocated [ 980.435259][T21339] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x152820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 3416, tgid 3416 (kworker/u4:6), ts 139881749394, free_ts 134892009110 [ 980.456083][T21339] post_alloc_hook+0x1cd/0x210 [ 980.462509][T21339] get_page_from_freelist+0x195c/0x19f0 [ 980.468049][T21339] __alloc_pages+0x1e3/0x460 [ 980.472627][T21339] alloc_slab_page+0x5d/0x170 [ 980.477304][T21339] new_slab+0x87/0x2e0 [ 980.481375][T21339] ___slab_alloc+0xc6d/0x1300 [ 980.486049][T21339] __kmem_cache_alloc_node+0x1a2/0x260 [ 980.491527][T21339] __kmalloc+0xa4/0x240 [ 980.495682][T21339] ieee802_11_parse_elems_full+0xb9/0x2080 [ 980.501495][T21339] ieee80211_inform_bss+0x107/0x1060 [ 980.506776][T21339] rdev_inform_bss+0x106/0x410 [ 980.511538][T21339] cfg80211_inform_bss_frame_data+0xb33/0x12b0 [ 980.517686][T21339] ieee80211_bss_info_update+0x70b/0x930 [ 980.523309][T21339] ieee80211_ibss_rx_queued_mgmt+0x17c9/0x2ac0 [ 980.529456][T21339] ieee80211_iface_work+0x717/0xc70 [ 980.534651][T21339] cfg80211_wiphy_work+0x225/0x260 [ 980.539754][T21339] page last free stack trace: [ 980.544410][T21339] free_unref_page_prepare+0x7ce/0x8e0 [ 980.549861][T21339] free_unref_page+0x32/0x2e0 [ 980.554524][T21339] __unfreeze_partials+0x1cf/0x210 [ 980.559626][T21339] put_cpu_partial+0x17c/0x250 [ 980.564381][T21339] __slab_free+0x31d/0x410 [ 980.568790][T21339] qlist_free_all+0x75/0xe0 [ 980.573288][T21339] kasan_quarantine_reduce+0x143/0x160 [ 980.578752][T21339] __kasan_slab_alloc+0x22/0x80 [ 980.583601][T21339] slab_post_alloc_hook+0x6e/0x4d0 [ 980.588706][T21339] __kmem_cache_alloc_node+0x13e/0x260 [ 980.594157][T21339] __kmalloc+0xa4/0x240 [ 980.598302][T21339] tomoyo_encode+0x28b/0x540 [ 980.602882][T21339] tomoyo_path_perm+0x2b1/0x4b0 [ 980.607718][T21339] tomoyo_path_symlink+0xa4/0xe0 [ 980.612636][T21339] security_path_symlink+0xe0/0x130 [ 980.617819][T21339] do_symlinkat+0x108/0x3f0 [ 980.622308][T21339] [ 980.624617][T21339] Memory state around the buggy address: [ 980.630228][T21339] ffff88802cdfc900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 980.638282][T21339] ffff88802cdfc980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 980.646330][T21339] >ffff88802cdfca00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 980.654371][T21339] ^ [ 980.659202][T21339] ffff88802cdfca80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 980.667251][T21339] ffff88802cdfcb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 980.675290][T21339] ================================================================== [ 980.697885][T21177] veth1_macvtap: entered promiscuous mode [ 980.714045][T21339] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 980.721271][T21339] CPU: 0 PID: 21339 Comm: syz.5.5246 Not tainted syzkaller #0 [ 980.721423][T21177] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 980.721439][T21177] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 980.721448][T21177] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 980.721458][T21177] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 980.722930][T21177] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 980.725566][T21177] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 980.725580][T21177] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 980.725589][T21177] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 980.725598][T21177] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 980.727256][T21177] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 980.745239][T21177] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 980.745271][T21177] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 980.745294][T21177] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 980.745316][T21177] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 980.858364][T21339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 980.869116][T21339] Call Trace: [ 980.872392][T21339] [ 980.875322][T21339] dump_stack_lvl+0x16c/0x230 [ 980.879996][T21339] ? show_regs_print_info+0x20/0x20 [ 980.885189][T21339] ? load_image+0x3b0/0x3b0 [ 980.889688][T21339] panic+0x2c0/0x710 [ 980.893572][T21339] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 980.899713][T21339] ? bpf_jit_dump+0xd0/0xd0 [ 980.904203][T21339] ? _raw_spin_unlock_irqrestore+0xfa/0x110 [ 980.910079][T21339] ? _raw_spin_unlock+0x40/0x40 [ 980.914917][T21339] ? hfsplus_uni2asc+0x5bd/0x1240 [ 980.919946][T21339] check_panic_on_warn+0x84/0xa0 [ 980.924898][T21339] ? hfsplus_uni2asc+0x5bd/0x1240 [ 980.929924][T21339] end_report+0x6f/0x140 [ 980.934162][T21339] kasan_report+0x128/0x150 [ 980.938657][T21339] ? hfsplus_uni2asc+0x5bd/0x1240 [ 980.943675][T21339] hfsplus_uni2asc+0x5bd/0x1240 [ 980.948519][T21339] ? hfsplus_bnode_read+0x1c2/0x6f0 [ 980.953729][T21339] hfsplus_listxattr+0x58f/0xb80 [ 980.958670][T21339] ? hfsplus_getxattr+0x160/0x160 [ 980.963690][T21339] ? kasan_save_free_info+0x2e/0x50 [ 980.968901][T21339] ? slab_free_freelist_hook+0x130/0x1b0 [ 980.974527][T21339] ? user_path_at_empty+0x4c/0x60 [ 980.979551][T21339] ? kmem_cache_free+0xf8/0x280 [ 980.984388][T21339] ? bpf_lsm_inode_listxattr+0x9/0x10 [ 980.989745][T21339] ? hfsplus_getxattr+0x160/0x160 [ 980.994755][T21339] listxattr+0x107/0x280 [ 980.998990][T21339] path_listxattr+0xdd/0x1b0 [ 981.003565][T21339] ? path_getxattr+0x400/0x400 [ 981.008335][T21339] ? lockdep_hardirqs_on+0x98/0x150 [ 981.013541][T21339] do_syscall_64+0x55/0xb0 [ 981.017957][T21339] ? clear_bhb_loop+0x40/0x90 [ 981.022639][T21339] ? clear_bhb_loop+0x40/0x90 [ 981.027316][T21339] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 981.033203][T21339] RIP: 0033:0x7f0ec1d8efc9 [ 981.037616][T21339] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 981.057228][T21339] RSP: 002b:00007f0ec2cfc038 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 [ 981.065637][T21339] RAX: ffffffffffffffda RBX: 00007f0ec1fe6090 RCX: 00007f0ec1d8efc9 [ 981.073599][T21339] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000080 [ 981.081570][T21339] RBP: 00007f0ec1e11f91 R08: 0000000000000000 R09: 0000000000000000 [ 981.089539][T21339] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 981.097505][T21339] R13: 00007f0ec1fe6128 R14: 00007f0ec1fe6090 R15: 00007ffeedcb0978 [ 981.105468][T21339] [ 981.108728][T21339] Kernel Offset: disabled [ 981.113034][T21339] Rebooting in 86400 seconds..