last executing test programs: 11.019855259s ago: executing program 1 (id=236): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x2b5b09b, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) umount2(&(0x7f00000001c0)='./file0/../file0\x00', 0x8) 10.9548185s ago: executing program 1 (id=238): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) shutdown(r0, 0x1) recvfrom(r0, &(0x7f0000000480)=""/110, 0x168f6f3d, 0x734, 0x0, 0xfffffffffffffecb) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) 10.901774861s ago: executing program 1 (id=239): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40e41, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c88a807"], 0xffe) 10.838958033s ago: executing program 1 (id=240): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x404, &(0x7f0000000100)={[{@nodioread_nolock}, {@barrier}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x68}}, {@errors_remount}, {@nombcache}, {@quota}, {@bh}]}, 0x3, 0x42f, &(0x7f0000000940)="$eJzs289rHFUcAPDvzCat/WViqT+aVo1WMfgjadJae/CiKHhQEPRQjzFJS+y2kSaCLUGjSD1Kwbt4FPwLPOlF1JPgVe9SKJJLq6eV2Z1Jdje7aZJustX9fGCS92be8t53Z97ue/N2AuhZw9mfJGJ/RPweEQO1bGOB4dq/W8uLU38vL04lUam89VdSLXdzeXGqKFq8bl+R6YtIP0viSIt65y9fOT9ZLs9cyvNjCxfeH5u/fOW52QuT52bOzVycOH365InxF05NPN+ROLO4bg59NHf08GvvXHtj6sy1d3/+Ninib4qjQ4bXO/hkpdLh6rrrQF066etiQ9iUUq2bRn+1/w9EKVZP3kC8+mlXGwdsq0qlUnmg/eGlCvA/lkS3WwB0R/FFn81/i22Hhh53hRsv1SZAWdy38q12pC/SvEx/0/y2k4Yj4szSP19lW2zPfQgAgAbfZ+OfZ1uN/9Kovy90b76GMhgR90XEwYg4FRGHIuL+iGrZByPioU3W37xIsnb8k17fUmAblI3/XszXthrHf8XoLwZLee5ANf7+5OxseeZ4/p6MRP/uLD++Th0/vPLbF+2O1Y//si2rvxgL5u243re78TXTkwuTdxJzvRufRAz1tYo/WVkJSCLicEQMbbGO2ae/Odru2O3jX0cH1pkqX0c8VTv/S9EUfyFZf31y7J4ozxwfK66KtX759eqb7eq/o/g7IDv/e1te/yvxDyb167Xzm6/j6h+ft53TbPX635W83bDvw8mFhUvjEbuS12uNrt8/0VRuYrV8Fv/Isdb9/2CsvhNHIiK7iB+OiEci4tG87Y9FxOMRcWyd+H96+Yn3th7/9srin97U+V9N7IrmPa0TpfM/ftdQ6eBm4s/O/8lqaiTfs5HPv420a2tXMwAAAPz3pBGxP5J0dCWdpqOjtd/wH4q9aXlufuGZs3MfXJyuPSMwGP1pcadroO5+6Hg+rS/yE035E/l94y9Le6r50am58nS3g4cet69N/8/8Wep264Bt53kt6F36P/Qu/R96l/4PvatF/9/TjXYAO6/V9//HXWgHsPOa+r9lP+gh5v/Qu/R/6F36P/Sk+T1x+4fkJSTWJCK9K5ohsU2Jbn8yAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMa/AQAA//9QOObV") r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000000)='./file0\x00', 0x420003c0) mount$incfs(&(0x7f0000000300)='./file0\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) chdir(&(0x7f0000000400)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x40, 0x0) 10.51965539s ago: executing program 2 (id=241): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close(r1) r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x12, r2, 0x108000) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x32, 0xffffffffffffffff, 0x0) 10.512955091s ago: executing program 1 (id=242): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) listen(r0, 0x5) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000240)=0x1) sendto$inet6(r1, 0x0, 0x0, 0x20040014, &(0x7f0000000280)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) 9.994020033s ago: executing program 2 (id=244): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000001300)=ANY=[@ANYBLOB='\b\x00\b\x00\a'], 0xfce) 9.928199235s ago: executing program 2 (id=245): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x82, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x184) r1 = openat$incfs(r0, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r1, 0x80106725, &(0x7f00000000c0)) 9.828249957s ago: executing program 2 (id=246): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000a40), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_SET(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f00000001c0)={0x20, r0, 0x1, 0x70bd25, 0x25dfdbfa, {}, [@ETHTOOL_A_PAUSE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x41}, 0x40488fc) fstat(0xffffffffffffffff, 0x0) fchown(0xffffffffffffffff, 0x0, 0x0) 9.828071867s ago: executing program 2 (id=247): bind$inet6(0xffffffffffffffff, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r0, 0x5202) syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) socket(0x11, 0x3, 0x0) 9.321476239s ago: executing program 1 (id=250): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x204010, &(0x7f0000000d40)=ANY=[@ANYBLOB="73686f72746e616d653d77696e39352c73686f72746e616d653d77696e6e742c756e695f786c6174653d302c756e695f786c6174653d312c757466383d312c757466383d312c646973636172642c757466383d302c756e695f786c6174653d302c666c7573682c73686f72746e616d653d6d697865642c73686f72746e616d653d6c6f7765722c646f733178666c6f7070792c73686f72746e616d653d77696e6e742c73686f72746e616d653d6c6f7765722c757466382c0014697a7960fb374b723f64760e7ac0bdecc465d6bdb5f172325940329787434c6c9f891d2e309efaf1d4e529e1ba0f697fedffb095592bc19d5a8f8141ee9bf46262f3a2b1452bf206c0e2ae8a465e6e1be6eeb5d588035a24458d476fc1f9a234cdc4ba352a4185614c"], 0x2, 0x2bc, &(0x7f0000000980)="$eJzs3U9rY1UUAPDz0uQ1QxftwpUIvsUs3Fims3VhBqkgdqVk4R/QwZmBoQkDDQRGxTArP4ELF34Pd+4FN34DwYVLdw5SuPLeS5NMkkmmHdMO5ffb9HLuOe/em3fbFMK7+fKN/vG9R4MHT779I9rtLBqd6MTTLPaiEWfSWAAA18LTlOLvC72/NxubmhMAsFkz7/+t56RsL4be3fS0AIAN+viTTz+8c3R0+FFRtCP63w+7WdQ/6/47D+Jh9OJ+3IrdOJ1+FpBS3X7/g6PDaBalvbjZHw27ZWX/i98mqXlU9QexG3vL6w+K2kz9aNis/vPIsoiHnXIit2M3XluoL/sPby+pj24eb7XHiyzH34/d+P2reBS9uFd9pjEd/7s8ivfSD/9881mZXNZno2F3u8qbSluXfW8AAAAAAAAAAAAAAAAAAAAAALi+9ouJvbjZL0P1+TvdrdOqf/+Z/up8nUbVX9dnEXnVmDsfaJTip7PzdW4VRZGyOn9yvs+NZrzejOaVLRwAAAAAAAAAAAAAAAAAAABeIYPHXx/f7fXun/wvjfFD/pPH+i96nc5M5M1Ynbx9rrFia5xeznU+5+DXz/uTSLmIi0x+2CoiVs25tRC5Uc5n/ZX/TSmlLIt4udvUepGx1jR2VueUL/AvP+68fXw3W/cats9u3M+zXXmcDB7P3dPIVg96+kwknWv75Sty8vGOeaHr7LzkL9E7f9aDjSPZmlW0ZiKtcSOet/3a59rPl/c3CAAAAAAAAAAAAAAAAAAAqE0f+l3S+WRlaWNjkwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACASzb9/v9pIxYic41R/FUVL89JKY0mkTxOBle9RgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK6//wIAAP//qWdtxQ==") r0 = creat(&(0x7f0000000080)='./bus\x00', 0x27) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={r0, 0xc9, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, 0x0, 0x0, 0xff96, 0x0, 0x0, 0x0, 0x2, 0x8, 0x0, 0xffffffffffffffff}}, 0x10) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x4000, 0x2000}]) 9.321352239s ago: executing program 32 (id=250): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x204010, &(0x7f0000000d40)=ANY=[@ANYBLOB="73686f72746e616d653d77696e39352c73686f72746e616d653d77696e6e742c756e695f786c6174653d302c756e695f786c6174653d312c757466383d312c757466383d312c646973636172642c757466383d302c756e695f786c6174653d302c666c7573682c73686f72746e616d653d6d697865642c73686f72746e616d653d6c6f7765722c646f733178666c6f7070792c73686f72746e616d653d77696e6e742c73686f72746e616d653d6c6f7765722c757466382c0014697a7960fb374b723f64760e7ac0bdecc465d6bdb5f172325940329787434c6c9f891d2e309efaf1d4e529e1ba0f697fedffb095592bc19d5a8f8141ee9bf46262f3a2b1452bf206c0e2ae8a465e6e1be6eeb5d588035a24458d476fc1f9a234cdc4ba352a4185614c"], 0x2, 0x2bc, &(0x7f0000000980)="$eJzs3U9rY1UUAPDz0uQ1QxftwpUIvsUs3Fims3VhBqkgdqVk4R/QwZmBoQkDDQRGxTArP4ELF34Pd+4FN34DwYVLdw5SuPLeS5NMkkmmHdMO5ffb9HLuOe/em3fbFMK7+fKN/vG9R4MHT779I9rtLBqd6MTTLPaiEWfSWAAA18LTlOLvC72/NxubmhMAsFkz7/+t56RsL4be3fS0AIAN+viTTz+8c3R0+FFRtCP63w+7WdQ/6/47D+Jh9OJ+3IrdOJ1+FpBS3X7/g6PDaBalvbjZHw27ZWX/i98mqXlU9QexG3vL6w+K2kz9aNis/vPIsoiHnXIit2M3XluoL/sPby+pj24eb7XHiyzH34/d+P2reBS9uFd9pjEd/7s8ivfSD/9881mZXNZno2F3u8qbSluXfW8AAAAAAAAAAAAAAAAAAAAAALi+9ouJvbjZL0P1+TvdrdOqf/+Z/up8nUbVX9dnEXnVmDsfaJTip7PzdW4VRZGyOn9yvs+NZrzejOaVLRwAAAAAAAAAAAAAAAAAAABeIYPHXx/f7fXun/wvjfFD/pPH+i96nc5M5M1Ynbx9rrFia5xeznU+5+DXz/uTSLmIi0x+2CoiVs25tRC5Uc5n/ZX/TSmlLIt4udvUepGx1jR2VueUL/AvP+68fXw3W/cats9u3M+zXXmcDB7P3dPIVg96+kwknWv75Sty8vGOeaHr7LzkL9E7f9aDjSPZmlW0ZiKtcSOet/3a59rPl/c3CAAAAAAAAAAAAAAAAAAAqE0f+l3S+WRlaWNjkwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACASzb9/v9pIxYic41R/FUVL89JKY0mkTxOBle9RgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK6//wIAAP//qWdtxQ==") r0 = creat(&(0x7f0000000080)='./bus\x00', 0x27) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={r0, 0xc9, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, 0x0, 0x0, 0xff96, 0x0, 0x0, 0x0, 0x2, 0x8, 0x0, 0xffffffffffffffff}}, 0x10) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x4000, 0x2000}]) 9.235318681s ago: executing program 2 (id=254): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x4) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000080)=0x33) 7.657427519s ago: executing program 5 (id=260): bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x10001, 0x9, 0x1}, 0x48) unshare(0x22020600) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x4, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f00000001c0)=@attr_other={0x0, 0x1, 0x2, &(0x7f0000000180)=0x6}) 7.60013095s ago: executing program 5 (id=284): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) openat$ptmx(0xffffffffffffff9c, 0x0, 0x82000, 0x0) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000000041}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@remote, @in=@local, 0x0, 0x0, 0x4e20, 0x0, 0x2}, {0xfffffffffffffffd, 0x1, 0x1, 0x0, 0x0, 0xb}, {0x1ff, 0xffffffffe, 0x4053e5, 0x20}, 0x6, 0x80001, 0x1, 0x0, 0x1, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x4d4, 0x32}, 0xa, @in=@local, 0x3502, 0x1, 0x0, 0x0, 0x6, 0xffbffffd}}, 0xe8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}, 0x9df}, 0x1c) 7.519063802s ago: executing program 5 (id=286): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @rand_addr, 0xfffffe7d}, 0x1c) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="540000001200010000000000000000000a0300004e234e2200000100ffff00"/56, @ANYRES32=0x0, @ANYBLOB="120000000300000008000000000000000800030011"], 0x54}}, 0x20004010) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x54, 0x12, 0x1, 0x0, 0x0, {0xa, 0x3, 0x0, 0x0, {0x4e23, 0x4e22, [0x10000, 0xffff], [0x0, 0xffffffff], 0x0, [0x5, 0x800003]}, 0x8, 0xfffffff7}, [@INET_DIAG_REQ_BYTECODE={0x8, 0x3, "11000000"}]}, 0x54}}, 0x20004010) 7.518929762s ago: executing program 5 (id=287): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280), 0x88ce359bdb00143c, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000002c0)=0x4) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000100)=0x2) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000080)=0xfe) 3.267356053s ago: executing program 4 (id=346): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) bind$packet(r1, &(0x7f0000000180)={0x11, 0x2, r2, 0x1, 0x7e, 0x6, @multicast}, 0x14) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x100, {0x0, 0x0, 0x0, r2, {0xe, 0x1}}}, 0x24}}, 0x4) read$FUSE(r1, &(0x7f0000000e80)={0x2020}, 0x2020) 3.177116585s ago: executing program 0 (id=349): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x20) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x40800, 0x0) lseek(r0, 0x101, 0x2) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) getdents64(r0, &(0x7f00000000c0)=""/79, 0x4f) 3.154190096s ago: executing program 0 (id=350): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000240)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x10452, &(0x7f00000002c0)={[{@rodir}, {@numtail}, {@fat=@nfs_stale_rw}, {@utf8}, {@fat=@nfs}, {@shortname_winnt}, {@numtail}, {@rodir}, {@shortname_lower}, {@fat=@codepage={'codepage', 0x3d, '1251'}}, {@iocharset={'iocharset', 0x3d, 'maccroatian'}}, {@shortname_win95}, {@shortname_win95}, {@utf8no}, {@shortname_mixed}, {@uni_xlate}]}, 0x3, 0x27b, &(0x7f0000000640)="$eJzs3cFqK1UYAOB/mqRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE/gEPo8b8QV8AC93d7u43LmkM0nTyyQlvWlT7v2+TQ//+f85/5kZ2tWc/vBB//jw5Ozo4tf/otFIYm0nduIyiXasxdjvUerfJ+VxAOCRu8yyeJrl6nno/GZGbUZlde3emwMA7sX03/9V9wIAPIyvv/n2i939/b2v0rQR0f9j0Eki/5nP7x7FT9GLbmxFK55HZBP5+LPP9/eimo6046P+cNAZVfa//7u4/u7/EVf129GKdnn9dpqbqh8OOrV4p1h/pxfdL/+KVrxXXv9JSX101uPjD6f634xW/PNjnEQvDovexvW/bafpp9mfz375bhQd1SfDQac+ySuyKw/6YAAAAAAAAAAAAAAAAAAAAAAAeKNtphPtm+fvjA/+nzM/53yg4dT5PFtpmmZJnn9dX433q1Fd5d4BAAAAAAAAAAAAAAAAAADgsTg7//n4oNfrni51MP6sv2QqXtyM1CPi7mttLFoVlaK1XhKx2Fq1qF9V3p5cWXAXzVE/3dOkGst7BMkk0pye2oh8rVGkmQ+mIq+9eiOuBuO36/ggue3hNspekiUMspLXrzKzav3VSLPYQUlyc87q6+/eqeesNWMqiYja5GbOv05tuffw4X4HAQAAAAAAAAAAAAAAAAAAueuPfksmL1bQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACswPX//19gMCyKZ+VkldGgGkVkxVsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLfAyAAD//0MUZ+o=") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000f00)='.\x00', 0x184a438, &(0x7f0000000080)=ANY=[@ANYRES32, @ANYRES32], 0x9, 0x0, &(0x7f0000000180)) write$UHID_INPUT(r0, &(0x7f0000010140)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964dee674356af492b8377a759d8ccf1accb9a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a7986cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4ccec6ac8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7ebef3a1ea64078cf1e8a9d433af32c53090c972ffedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25afd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e5706000", 0x1000}}, 0x1006) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x824851, 0x0, 0x0, 0x0, &(0x7f0000000d40)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0) 3.123805536s ago: executing program 4 (id=351): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x6, 0x0, 0x7fff0000}]}) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0x8) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000000000)={0x0, r2}) close_range(r0, 0xffffffffffffffff, 0x0) 3.096479047s ago: executing program 0 (id=352): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000406a053b030000000000010902220001010080320904000001030000000921110100012217000705810340"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022170000000600ff0901a10185020901150026ff00750895098102c0"], 0x0}, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000200), 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) close_range(r1, r1, 0x0) 3.095679337s ago: executing program 4 (id=353): ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x40000091}]}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]}) 3.003497749s ago: executing program 4 (id=354): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000100)='./bus\x00', 0x410c84, &(0x7f0000000340), 0x1, 0x77f, &(0x7f0000000600)="$eJzs3c9rHFUcAPDvbJKmTauJIPjjFBA0ULoxNbYKHioeRLBQ0LPtstmGmk22ZDelCQEtIngRVDwIeunZH/Xm1R9X/S88iKVqWqx4kMhsZtpts5smbZKt7ucD07w3b7bvfffNvHm7M8wG0LNG038KEY9FxAdJxHC2PomIgWaqP+LY2nbXV5bL6ZLE6uprvyfNba6tLJej5TWp/Vnm0Yj4/t2Ig4X19dYXl2ZK1Wplfi3bFxFnx+uLS4fOzJamK9OVuSMTk5OHjz579Mj2xfrnT0sHLn/48lNfHfv7nUcuvf9DEsfiQFbWGsd2GY3R7D0ZSN/CW7y03ZV1WdLtBnBXCtnB1x/pGDAcfc0UAPB/9lZErAIAPSZx/geAHpN/D3BtZbmcL939RmJ3XXkxIvauxZ9f31wr6c+u2e1tXgcdupbccmUkiYiRbah/NCI+++aNL9Ildug6JEA7b1+IiFMjo+vH/2TdPQtb9fQGZXuyv6O3rTf+we75Np3/PNdu/le4Mf+JNvOfwTbH7t244/G/bxsq2UA6/3uh5d626y3xZ0b6stwDzTnfQHL6TLWSjm0PRsRYDAym+YkN6hi7+s/VTmWt878/Pnrz87T+9O/NLQq/9g/e+pqpUqN0LzG3unIh4vH+dvEnN/o/6TD/PbHJOl55/r1PO5Wl8afx5sv6+CO7O2lnrF6MeLJt/9+8oy1NjTdmO9yfON7cHcbznaKNr3/+ZKhT/a39ny5p/flngd2Q9v/QxvGPJK33a9bXjv2t+PHi8Hedyu4cf/v9f0/yejOdzyPOlxqN+YmIPcmr69cfvvnaPJ9vn8Y/9kT743+j/T/9THhqk/H3X/7tyw3j39/d/p/aUv+3S6SDdIeimVL10vWZvk71b67/J5upsWzNZsa/Ti29PXEv7x0AAAAAAAAAAAAAAAAAAAAAAAAAbFYhIg5EUijeSBcKxeLab3g/HEOFaq3eOHi6tjA3Fc3fyh6JgUL+qMvhluehTmTPw8/zh2/LPxMRD0XEx4P7kvw5ilNdjh0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcvs7/P5/6pfBbrcOANgxe7vdAABg1zn/A0Dvcf4HgN7j/A8Avcf5HwB6j/M/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO+zE8ePpsvrXynI5zU+dW1yYqZ07NFWpzxRnF8rFcm3+bHG6VpuuVorl2uyd/r9qrXZ2MuYWzo83KvXGeH1x6eRsbWGucfLMbGm6crIysCtRAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDW1BeXZkrVamVe4i4Sq/dHM7qf6Mt2p/ulPbuaSO6PZmxzossDEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMB/xL8BAAD//7KsH7I=") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0) umount2(0x0, 0x9) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.current\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0), 0x208e24b) mount$overlay(0x0, &(0x7f0000000580)='./file0\x00', &(0x7f0000000b80), 0x4000, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@nfs_export_on}]}) 2.990029669s ago: executing program 3 (id=355): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r0, r0) setpgid(0x0, r0) tkill(r0, 0x7) wait4(r0, 0x0, 0x0, 0x0) getpgid(r0) 2.96310106s ago: executing program 3 (id=356): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000200)={0x3, 0x0, 0x2000000}) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x11, &(0x7f0000000180), 0x49, 0x60c, &(0x7f00000001c0)="$eJzs3c9vFGUfAPDvTH/Svrwt5M2reJAmxkCitLSAIcZEiFdC8MfNU6WFIIUSWqNFEkuCF43x4sHEkwfxv1ASrx68evDiyZA0xnAQg7JmtrNl2+2W7XZ/tN3PJxn6zAw7z3fKfnmeffaZmQA61kj2RxpxICKuJRFDZfu6I985svz37v9x83y2JFEovPl7Ejc/ShbLj5XkPwfzF/8zFMlPacT+rsp65xZuXJ6cmZm+nq+PzV+5Nja3cOPIpSuTF6cvTl+deGni5InjJ06OH93S+e0tK5+5/e77Q5+cffubrx4m49/+cjaJU/Eojy07r7Wv7dtSzdnvbCQKyx6Ub89+rye3eOzt4s+h0vvksWTtBratC/n7sScinoqh6Cr71xyKj19va3BAUxWSKLVRQMdJ6sr//sYHArRYqR9Q+my/3ufgSmmTeyVAKyydXh4AWM79nogo5X/38thg9BfHBgbuJ6vGeZKI2NrI3LKsjh9/OHs7W6LKOBzQHIu3SqPca9v/pJibw9FfXBu4n67K/7Rsyba/UWf9I2vW5T+0zuKtiHg6b/97o+78f6fO+uU/AAAAAAAANM7d0xHx4nrz/9KV+T+968z/GYyIUw2o/8nf/6X38kLSgOqAMkunI16pmP/7d/ns4OGu/Hv+vcX5AD3phUsz00cj4r8RcTh6+rL18dWHXTVB+Mhn+7+sVn/5/L9syeovzQXMD3Wve82FuFOT85ONOXvobEu3Ip4pzv89mG9ZPf8na/+Tivb/09eyBL9WYx37n79zrtq+J+c/0CyFryMOrXv9z+PudrLx/TnGiv2BsVKvoNKzH37+XbX65T+0T9b+D2yc/31J+f165jZ3/N6IOLbQXai2v97+f2/yVlfp+JkPJufnr49H9CZnKrdPbC5m2K1K+VDKlyz/Dz+38fjfSv+/LA/3RMRijXX+/9Hgr9X2af+hfbL8n9q4/R9e3f5vttAfE3eGv89vMVbhXE3t//Fim34432L8D8pV3o+j1gRtS7gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsMOlEfGfSNLRlXKajo5GDEbE/2IgnZmdm3/hwux7V6eyfauf/z+0vJ6Unv8/XLY+sWb9WETsi4gvuvYU10fPz85MtfvkAQAAAAAAAAAAAAAAAAAAYJsYLF7zX+hbe/1/5reudkcHNF13/lO+Q+fprvuVhb6GBgK0XP35D+x0ted/T1PjAFqvev4/eFgoamk4QAvp/0PnqjP/fV0Au4D2HzpVjWN6/c2OA2iHmtv/pebGAQAAAAAANMS+g3d/TiJi8eU9xSXTm+8z2R92t7TdAQBtYw4vdK7u2XZHALSLz/hAslL6a92L/avP/k+aExAAAAAAAAAAAAAAUOHQAdf/Q6dKIzZ4hLe5/bCbbXD9/3rJ73YBsItUf/RHLW1/oocAO5jP+MCT2nHX/wMAAAAAAAAAAADANtB/4/LkzMz09bmFnVd4dXuEsbnC4uS2CKOhhUfNOXJPRGyPE2x1oXQLjjaG0eb/lwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgBX/BgAA///kYDBi") setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000440)=[{0x30, 0x1, 0x81, 0xfffff024}, {0x6}]}, 0x10) sendmmsg$inet6(r1, &(0x7f0000001600)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x8a0e, @loopback={0x0, 0x7ffffffe}, 0x10000}, 0x1c, 0x0}}], 0x1, 0x24040000) 2.835834493s ago: executing program 4 (id=357): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x2, 0x0, @ioapic={0x8000000, 0xe, 0x3, 0xfffffffe, 0x0, [{0x2, 0x4, 0x7, '\x00', 0x8}, {0x9, 0x8, 0x40, '\x00', 0xb}, {0xff, 0x7f, 0x9, '\x00', 0x67}, {0x0, 0x5, 0xd4, '\x00', 0xf}, {0x7, 0x10, 0xc, '\x00', 0x5}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7b}, {0x3, 0x4, 0xc}, {0x7f, 0xd, 0x5, '\x00', 0xb}, {0xd7, 0xd, 0x8, '\x00', 0x6}, {0x0, 0x28, 0x5, '\x00', 0xdc}, {0xff, 0x1, 0xfe, '\x00', 0x1}, {0xfe, 0x7, 0x26}, {0xcf, 0x3, 0x1, '\x00', 0x6}, {0xf, 0xee, 0x7, '\x00', 0x3}, {0x39, 0x2, 0x2, '\x00', 0xb}, {0xc7, 0x6, 0x2, '\x00', 0x8}, {0x5, 0x9, 0x5, '\x00', 0xc}, {0x7, 0xc1, 0x7, '\x00', 0xc2}, {0x0, 0x80, 0xe, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x6, 0x3, '\x00', 0x10}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x5, 0x4, '\x00', 0x23}]}}) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000200)={0x8, 0xdc}) 2.795384494s ago: executing program 3 (id=358): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x2000050, &(0x7f00000000c0)={[{@errors_remount}, {@nodiscard}, {@lazytime}, {@init_itable}, {@jqfmt_vfsv0}, {@resgid}, {@mblk_io_submit}, {@barrier}, {@quota}]}, 0x10, 0x4e7, &(0x7f0000000900)="$eJzs3d9rHFsdAPDvTLK3TZtrctWH6wXvvXgradHuJo1tgw+1gtingrW+15hsQsgmG7KbtglFUnxXEFHBJ598EfwDBOmfIEJB36WKIprqQx/UlZ3M1jbuZlO63ZHk84HpnPmx8/2ehj0zZ+awE8CJ9WFEXI+IkYi4EBET+fo0n260t9/a3+/p3lg83XuwkESrdfuvSSTZugcLnWMl+fxsROxGxOmI+PqNiG8l/xu3sb2zOl+rVTfz5UpzbaPS2N65uLI2v1xdrq7Pzs5cmbs6d3lueiD1nIyIa1/54w+/97OvXvvV5+/9/s6fz3+7ndZ4vv3FevTVpT6H71rK/i86RiNi8+iH+L82ks9LPbZ/d2SIyQAA0Ff7Gv/jEfGZ7Pp/Ikayq1MAAADgOHn2pfH4ZxLRAgAAAI6tNBsDm6TlfCzAeKRpubw/hveTcSat1RvNzy3Vt9YX98fKTkYpXVqpVafzscKTUUrayzP5GNvO8qUDy7MR8U5E/GBiLFsuL9Rri0Xf/AAAAIAT4uyB/v8/JrL+/6mi8wIAAAAGbLLoBAAAAIA3Tv8fAAAAjj/9fwAAADjWvnbzZntqdd5/vXh3e2u1fvfiYrWxWl7bWigv1Dc3ysv1+nL2m31r/Y5Xq9c3vhDrW/crzWqjWWls79xZq2+tN++svPQKbAAAAGCI3vng0e+SiNj94lg2tb1VdFLAUCR9tmcvCXmSL/xhCAkBQzNSdAJAYUaLTgAoTKnoBIDC9bsP0HPwzq8HnwsAAPBmTH2q9/N/9wbgeEuLTgAAGDrP/+HkKr08AvBycZkARflYn+2v//y/1XqlhAAAgIEbz6YkLefPAscjTcvliLez1wKUkqWVWnU67x/8dqJ0qr08k30y6TtmGAAAAAAAAAAAAAAAAAAAAAAAAADY12ol0QIAAACOtYj0T0n2a/4RUxPnxg/eH3greTaRzSPi3k9u/+j+fLO5OdNe/7fn65s/ztdfKuIOBgAAAHBQp5/e6ccDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwCA93Xuw0JmGGfcvX46Iya7xPzidzU5HKSLO/D2J0Rc+l0TEyADi7z6MiHe7xU/aacVk7GfRLf5YgfHTiDg7gPhwkj1qtz/Xu33/0vgwm3f//o3m0+vq3f6l0Wn/Rnq0P28fMcZ7j39R6Rn/YcR7o93bn078pEf8j44Y/5vf2Nnpta3104ipruef5KVYlebaRqWxvXNxZW1+ubpcXZ+dnbkyd3Xu8tx0ZWmlVs3/7Rrj+5/+5b8Pq/+ZHvEn+9T/3BHr/6/H9/c+sV8sdYt//qPu5993e8RP83PfZ/Nye/tUp7y7X37R+z//zfuH1X+xR/2f//27nGjbMc8fsf4Xbn3nyRF3BQCGoLG9szpfq1U3X6swqOO8YiGNAoIqvKHCqaPuHFF0qiehcFirkQyvgQIAAAbmvxf9RWcCAAAAAAAAAAAAAAAAAAAAJ9cwfk7sYMzdYqoKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCo/wQAAP//W+nW4w==") newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000005280)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) setuid(r0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x3b}, @in6=@remote, 0x0, 0x0, 0x0, 0xc9c, 0xa, 0x10, 0x30, 0x0, 0x0, 0xee01}, {0x0, 0x7f, 0x7, 0x3, 0xfffffffffffffffc, 0xfffffffffffffffd, 0x5, 0xffffffffffffffff}, {0xffffffff, 0x0, 0x0, 0x5}, 0x0, 0x0, 0x1, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x84811}, 0x80) syz_emit_ethernet(0x4a, 0x0, 0x0) 2.719360076s ago: executing program 4 (id=359): r0 = socket$inet6(0xa, 0x3, 0xff) setrlimit(0x4, &(0x7f00000000c0)={0x2005, 0x80000000000002}) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty, 0x4754}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000000)=0x659f, 0x4) write$binfmt_script(r0, &(0x7f00000000c0), 0x28) recvmmsg(r0, &(0x7f000000e080)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x40002000, 0x0) 2.719202346s ago: executing program 33 (id=359): r0 = socket$inet6(0xa, 0x3, 0xff) setrlimit(0x4, &(0x7f00000000c0)={0x2005, 0x80000000000002}) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty, 0x4754}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000000)=0x659f, 0x4) write$binfmt_script(r0, &(0x7f00000000c0), 0x28) recvmmsg(r0, &(0x7f000000e080)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x40002000, 0x0) 2.488254571s ago: executing program 3 (id=360): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x2084ce, &(0x7f0000000100), 0x3, 0x454, &(0x7f0000000280)="$eJzs3M2PU1UbAPDn3k6HlxdwRsQPPtRRNE78mGEAlYULNZq4wMREF7qczBSCFMYwYyKEKBiDK2NM3BuX/guudGOMKxO3ujckxLABXNXc9l6mLW1hSkuV/n7JhXPuPZdznp572nPvaQlgbM1kfyQRWyPi94iYamRbC8w0/rp6+ezStctnl5Ko1d7+K6mXu3L57FJRtDhvS56ZTSPSz5LY3aHe1dNnji9Wq5VTeX5+7cQH86unzzx37MTi0crRysn9hw4dPLDw4gv7nx9InFmbruz6eGXPzjfe++rNw1+0xN8Wx4DM9Dr4ZK024OpGa1tTOpkYYUPYkFJEZN1Vro//qSjFeudNxeufjrRxwFDVarXalu6Hz9WAu1gSrXlDHsZF8UGf3f8WW/sk4OXhTT9G7tIrjRugLO6r+dY4MhFpXqbcdn87SDMR8e65v7/JthjOcwgAgBY/ZPOfZzvN/9J4oKncPfna0HRE3BsR2yPivojYERH3R9TLPhgRD22w/vZFkhvnP+nFvgK7Rdn876V8bat1/lfM/mK6lOe21eMvJ0eOVSv78tdkNsqbsvxCjzp+fO23L7sda57/ZVtWfzEXzNtxcWJT6znLi2uLtxNzs0vnI3ZNdIo/ub4SkETEzojY1Wcdx57+bk+3YzePv4cBrDPVvo14qtH/56It/kLSe31y/n9RreybL66KG/3y64W3utV/W/EPQNb//+94/V+PfzppXq9d3XgdF/74vOs9Tb/X/2TyTj09me/7aHFt7dRCxGRyuNHo5v37188t8kX5LP7ZvZ3H//ZYfyV2R0R2ET8cEY9ExKN52x+LiMcjYm+P+H9+9Yn3+49/uLL4lzfU/+uJyWjf0zlROv7T9y2VTt8Q/7Xe/X+wnprN99zK+9+ttKu/qxkAAAD+e9KI2BpJOnc9naZzc43vy++ISKsrq2vPHFn58ORy4zcC01FOiyddU03PQxfy2/pG/nxENL5aUBw/kD83/rq0uZ6fW1qpLo86eBhzW7qM/8yfpVG3Dhg6v9eC8WX8w/gy/mF8Gf8wvjqM/82jaAdw53X6/P9kBO0A7ry28W/ZD8aI+38YX13H/938P/8AdT7/YSytbo6b/0i+Z6L4l/o8/a5NRPlf0YzbT9SSjp0b6agbVjmVuuqGlhjt+xIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMCg/BMAAP//YzDfZQ==") mknod$loop(&(0x7f00000009c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2, 0x1) mkdir(&(0x7f0000000040)='proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='proc_mnt\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='proc_mnt/self/cwd\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000000), 0x1000) 2.285438146s ago: executing program 3 (id=361): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000040)={0x0, &(0x7f0000000280)=[@rdmsr={0x66, 0x18, {0xc0010140}}], 0x18}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f00000002c0)={0x1, 0x0, [{0xd, 0x1, 0x0, 0x9, 0x400, 0x8, 0x5}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2.050988382s ago: executing program 3 (id=362): r0 = socket(0x28, 0x801, 0x0) connect$vsock_stream(r0, &(0x7f0000000880)={0x28, 0x0, 0x0, @local}, 0x10) shutdown(r0, 0x1) r1 = epoll_create(0x628) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140)={0x1016}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000180)={0x40000000}) 2.050869702s ago: executing program 34 (id=362): r0 = socket(0x28, 0x801, 0x0) connect$vsock_stream(r0, &(0x7f0000000880)={0x28, 0x0, 0x0, @local}, 0x10) shutdown(r0, 0x1) r1 = epoll_create(0x628) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140)={0x1016}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000180)={0x40000000}) 935.773638ms ago: executing program 6 (id=374): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x8c66) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000140)={0x4, 0x1, 0x8, r2, 0x11}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000240)={0x27800000003, 0x0, 0x1, r2, 0x1}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x27800000000, 0x0, 0x1, r2, 0x5}) 897.497889ms ago: executing program 6 (id=375): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x3, 0xc, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) execve(0x0, 0x0, &(0x7f0000000040)={[&(0x7f0000000000)='\v\x00\x00\x00']}) sendmmsg$unix(r0, &(0x7f0000007b80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2404c054}}], 0x1, 0x2000c080) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x33, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x584}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 868.90237ms ago: executing program 6 (id=376): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaa"], 0x0) syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000002240)='./file0\x00', 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="73686f72746e616d653d77696e6e742c666c7573682c646d61736b3d30303030303030303030303030303030303137373737372c73686f72746e616d653d77696e39352c636865636b3d7374726963742c73686f72746e616d653d6d697865642c6e6f6e756d7461696c3d302c757466383d312c73686f72746e616d653d77696e6e742c756e695f786c6174653d312c756e695f786c6174653d312c726f6469722c696f636861727365743d757466382c666d61736b3d30303030303030303030303030303030303030303030342c646d61736b3d30303030303030303030303030303030303030303030372c757466383d312c726f6469722c73686f72746e616d653d77696e39352c726f6469722c00743ccfec81d6c7d05b0f2a54ddce151ec4cbbaacb9552647fd950fedfdc024b3953e7669bc9d4f66e3beaecb80fe73633280b1d3e82023d4f5c7f5a4989406c0f0d0cf537f132dc1e63d84a17532cb78ae7a368bc0029207b9b166705972f4e8dad041e6be170bf43057b456d43f100c53b471aa6c8e3751", @ANYRES16], 0x1, 0x2cc, &(0x7f00000006c0)="$eJzs3T2LY1UYAOD3zmRusmuRKaxE8IIWVsvOtjYZJAuLqZQUaqGDuwuSBGEXBlzFYGVrY+kvEAQ7/4SN4A8Q/AEWglssHLnJveY63iQT2Oz48TxF5sw95z3nPfdjPhjyzvsvziZ3i7j/+ac/R6+XxcEgBvE4i+M4iFpKKcXK4MsAAP7NHqcUv6alS4YMypcsInr7TQ0A2JOdv/9/t/eUAIA9e+vtd944HY2GbxZFL27Pvjgfl7/Zlx+X/af348OYxr24Gf14svxbQP3TQvl6O6U07xSl43hlNj8fl5Gz936o5j+tFzqJfhwvWn+NvzManhRLjfh5mcf1av1Buf6t6MfzLevfGQ1vtcTHOI9XX27kfyP68eMH8VFM4+4iiVX8ZydF8Xr66vdP3i3TK+Oz+fm4uxi3kg6f3VUBAAAAAAAAAAAAAAAAAAAAAOC/7kZVO6cbi/o95aGq/s7hk/KToyhqzfo+3bo+UFZPdKE+0DzF1yl1OxGj4c2iKFI1cFXfpxMvdKJzNbsGAAAAAAAAAAAAAAAAAACAf5aHHz+anE2n9x60NH66HrGma02jrgZQv61/S9Thuq5B48hL8Why1l0/YaProGpuWDQO6zFZxMbtROeonvl4p5Owe+Paupy/+fbikd9SSpsm7G1f9GjT+Xk6jfrumpxl0TqmG/WRXn1Nv2+OyeOSa+XrutL226/RyFu7+jvvPX9u0ZhvGBPZpsRe+2V55qoj2cVd5Iuz2hp+1KjG0X5vtF+LdU9KrX7AIls81vnT/QIEAAAAAAAAAAAAAAAAAAD8afWm3791XdsSepC6e0sLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ6p1f//36Exr4IvMTiPBw+veIsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8D/wRAAD//2VsV+s=") write(0xffffffffffffffff, &(0x7f0000000000)="ea", 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) 848.658ms ago: executing program 0 (id=377): mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000300)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x185093, 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) 827.46742ms ago: executing program 0 (id=378): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4000800) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r0, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x1a, &(0x7f0000000240)={0x1, 'veth0_to_team\x00'}, 0x18) syz_emit_ethernet(0xc2, &(0x7f0000000500)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3e}, @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x25, 0x4, 0x0, 0x0, 0x4000, 0x1, 0xffff, 0x0, 0x1, 0x7, @empty, @rand_addr=0x64010100, {[@cipso={0x86, 0x78, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "02270e000042eb"}, {0x2, 0x12, "01008548c8ee4a000000000000000000"}, {0x0, 0x9, "00de6c83d50800"}, {0x2, 0x7, "cfa11cab1a"}, {0x0, 0x10, "8475be675de6a70a8525dc91e5c6"}, {0x6, 0xa, "0000000000800000"}, {0x5, 0x11, "73bc23f9ffffffa30900a301c84600"}, {0x1, 0xe, "01ed733a3d63f08339aeaae4"}]}, @cipso={0x86, 0x6, 0x20}]}}}}}}}, 0x0) 724.927433ms ago: executing program 0 (id=379): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x202, 0x1000, @empty}, 0x1c) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r1, &(0x7f0000000240)={0xa, 0x2, 0x1000, @empty}, 0x1c) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e1f, 0x8, @remote, 0x2}, 0x1c) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, "fbddf0", 0x8, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @mcast2, {[], @echo_reply={0x81, 0x0, 0x0, 0x2, 0x4}}}}}}, 0x0) 724.805653ms ago: executing program 35 (id=379): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x202, 0x1000, @empty}, 0x1c) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r1, &(0x7f0000000240)={0xa, 0x2, 0x1000, @empty}, 0x1c) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e1f, 0x8, @remote, 0x2}, 0x1c) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, "fbddf0", 0x8, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @mcast2, {[], @echo_reply={0x81, 0x0, 0x0, 0x2, 0x4}}}}}}, 0x0) 670.166164ms ago: executing program 6 (id=380): syz_mount_image$ext4(&(0x7f0000000280)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x8004, &(0x7f0000000140)={[{@errors_remount}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x4}}, {@noquota}]}, 0x1, 0x7d2, &(0x7f0000002140)="$eJzs3c9rG1ceAPDvyHb8I961F5bdzc2wkDWEyOusN9mFPWTpoRQaCLTnJkZWTGrZCpYcYmPahFLopdCWHgLtJef+SG+99gf01P4JvfVQEtLWCU3pobiMNLIdW3L8W2n9+cBY782M/N5X7+nNk2YYBXBoDaV/chHHIuKNJGIgW59ERFct1Rlxtr7fw6XFnogoJLG8/Nz3SW2fB0uLhVjznNTRznrmbxHx2asRJ3Iby63ML0yNl0rF2Sw/Up2+MlKZXzh5eXp8sjhZnDk9OjZ26sy/z5xuWfWXtxvrj18t9N998+l/fHj251f+evv1z5M4G/3ZtrVx7JWhGMpek670JXzEU3tdWJsl7a4AO5K+NTvq7/I4FgPRUUu10HuQNQMA9ks6iV4GAA6ZxPEfAA6ZxvcAD5YWC42lvd9IHKx7/4+Innr8D7OlvqUzO2fXUzsP2vcgeeTMSBIRg3tQ/lBEvPvxC8c7snxaD+fSgINw/UZEXBwc2jj+734U+udmG5e7m64+bMcfaKdP0vnPf5rN/3Ir859oMv/prs9d/rLb8ofW5Te+/3N3dlvGZtL53//q17atm/+tXLQ22JHl/lCb83Ully6XiunY9seIGI6u7jQ/Wtu1+Zg5fP+X+63Kz+Z/76fLD2+9+F5afvq4ukfuTue6oXJivNr5xW4Dz9y7EX1Zcl38yUr7Jy3mv+e3WMYz/33tnVbb0vjTeBvLxvj31/KtiONN23+1LZNNr08cqXWHkUanaOKjb272tSp/bfunS1p++rhut5t7E+1G925ErQMkyeprUN+yEv9gsvZ6zcr2y/jy1sCnrbY9Pv6m/X/8SPJ8LX0kW3dtvFqdHY04kjy7cf2p1ec28o390/iH/978/V8vtnn/Tz8TXtxi/J13v/tg5/HvrzT+ic37/7r278lWr655XOL2w6mOVuVvrf3HaqnhbE3a/o+Layv12llvBgAAAAAAAAAAAAAAAAAAAAAAAIDty73UG/2R5PLZPU77I5fL5yOORsSfoy9XKleqJy6V52YmovZb2YPRlWvc6nJgzf1QR7P74Tfyp9bl/xURf4qIt7t7a/l8oVyaaHfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJA5WvvN/42//5/6trvdtQMA9k1PuysAABw4x38AOHy2d/zv3bd6AAAHx+d/ADh8tnz8v7i/9QAADo7P/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOyz8+fOpcvyT0uLhTQ/cXV+bqp89eREsTKVn54r5Avl2Sv5yXJ5slTMF8rTLf/R9fpDqVy+MhYzc9dGqsVKdaQyv3Bhujw3U71weXp8snih2HVgkQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA1lXmF6bGS6Xi7O8icX01sD3+z71tjatvp0/viYhdlN7bclNnPAHN/YQnumNLO3+91311bxJrR4neNoxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL8NvwYAAP//7V8WgQ==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0xf6) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0x8004587d, &(0x7f0000000080)={@desc={0x1, 0x0, @desc2}}) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r1, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) 544.918967ms ago: executing program 7 (id=381): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000980)={'syz1\x00', {0x0, 0xcf0d}, 0x0, [0x80000000, 0x3, 0x3fc, 0x8, 0xfffffffd, 0x0, 0x4000004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x40, 0x0, 0x4f5b1, 0xffffffff, 0x10000000, 0x9, 0x20000000, 0x4020, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0xe20, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x4, 0x0, 0x1], [0x3, 0x0, 0xffffffff, 0x2, 0x0, 0x0, 0x0, 0xedc0, 0x0, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0000000, 0x0, 0x0, 0x0, 0x4, 0x3, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffff8, 0x2, 0x0, 0x2000079, 0x400, 0x4, 0xed, 0x10000, 0x40000, 0x7, 0xc0800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4771, 0x0, 0x0, 0x3], [0x0, 0x7f, 0x8001, 0x5, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffffffff, 0x0, 0xfffffffb, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x6, 0x0, 0x0, 0x0, 0x2000000, 0x200000, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x84dc, 0x80000000, 0x0, 0xf, 0x0, 0x8, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffc, 0x4, 0x0, 0x1000000, 0x0, 0x0, 0x10001], [0x2, 0x0, 0x6, 0x40000, 0x0, 0x0, 0xfffffffe, 0x8, 0x0, 0x0, 0x0, 0x3, 0xfffffffc, 0x100004, 0x800, 0x800000, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffc, 0xfd2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x10, 0x5, 0xfffffffd, 0x0, 0x0, 0x0, 0x8001, 0x80, 0x0, 0x0, 0xffffffff, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ec5, 0x0, 0x8000000, 0x4, 0x0, 0x0, 0x0, 0xffffe]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x5) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) write$uinput_user_dev(r0, &(0x7f0000000e00)={'syz1\x00', {0x8, 0x2, 0x5, 0x5}, 0x6, [0xff, 0x8228, 0x400, 0xbd4, 0x2e09800, 0x100, 0x3, 0x40007, 0x3, 0xd, 0x100, 0x1, 0x4, 0x5, 0x2, 0xb78a, 0x5a, 0x150, 0x4, 0x1, 0x4, 0x9, 0x3, 0x7, 0x6, 0x7f, 0x8af4, 0x3, 0x2, 0x6, 0x4, 0x33a2, 0x200, 0xffff7b22, 0x4, 0xe0, 0x7, 0x3, 0xff, 0x800, 0x7f, 0xffffff81, 0x7f, 0x5, 0x0, 0x7, 0x823e, 0x9, 0x67, 0x9, 0x10, 0xb, 0x2, 0xef, 0x5, 0x6, 0xb8e, 0x627, 0x6, 0x0, 0x9, 0x1, 0x10000004, 0x9], [0x3, 0x0, 0x1, 0x80000001, 0xffffffff, 0xff, 0x1, 0x3, 0x7, 0x9, 0xd502, 0x80000001, 0x4439, 0xffff, 0x3, 0x7, 0x7, 0x8, 0x4, 0x4, 0x1, 0x6, 0x0, 0x9, 0x1, 0x7, 0x7, 0x7, 0x0, 0xae, 0xa8d, 0x4605, 0xfffffffe, 0x7fff, 0x5, 0xffffffff, 0x3, 0x3, 0x7ff, 0x8, 0x10000, 0x4, 0xfffffe00, 0x7f, 0x106, 0x3, 0x8, 0xf0, 0x5, 0x86, 0x400, 0x7, 0x3, 0x8, 0x1000, 0x8, 0x4, 0x81, 0x8, 0x403, 0x3, 0x9a, 0x10, 0x7], [0x2, 0xfffffffe, 0x800006, 0x6, 0xb0fa, 0x4, 0x7ef, 0xc, 0x5, 0xb79a, 0x2, 0x5, 0x2, 0x34000, 0x0, 0x0, 0x6, 0x1, 0xa8, 0x1, 0x1, 0x5, 0x4, 0x7, 0xfa, 0x5a17, 0x42d, 0x3, 0xe7, 0x3, 0x85e, 0x8, 0x2, 0x800002, 0x7fffffff, 0x800, 0x1, 0xa, 0x4, 0xf, 0x6, 0x10000000, 0x40, 0x8, 0x6, 0x4ea, 0x6, 0x100, 0x1, 0x7d, 0xf7, 0xfc, 0x8, 0x0, 0x5, 0x6, 0x6, 0x5455, 0x2, 0x1001, 0x2, 0x400, 0xffffff7f, 0x5], [0x5, 0x3, 0x408, 0x2, 0x5043, 0x9, 0x2c, 0x3d, 0x400, 0xe, 0x3, 0x0, 0x8, 0x44a4e339, 0x499, 0x4, 0x2, 0x40, 0x9, 0x9, 0x9, 0x3, 0xe, 0xfffffff8, 0x4, 0x3, 0x10, 0x9, 0x9e92, 0x0, 0x9, 0x1000, 0x2, 0xc845, 0x5, 0x6, 0x6, 0x3, 0x800, 0x1d, 0x6b66fc9f, 0x5, 0x0, 0xfffffff7, 0x0, 0x945, 0xb7, 0x4, 0xffff, 0x9, 0x4, 0x80000000, 0xf2be, 0x7, 0x3, 0x0, 0x81, 0x1, 0x6, 0x3, 0x6, 0x2, 0x2, 0xfe]}, 0x45c) 451.05465ms ago: executing program 7 (id=382): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x0, &(0x7f0000000040)={[{@grpquota}, {@quota}, {@discard}, {@nobarrier}, {@jqfmt_vfsold}]}, 0xff, 0x501, &(0x7f0000000e80)="$eJzs3c9vY0cdAPCvndhxsmmTlh4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRe37OehN7E20SO8Sfj/T0Zt54/Z2J982sv1l7AhhbtyPiICKKEfF+RMxl13PZEe90juRxnx0+Wj06fLSai3b7vX/k0vbkWvT8mcSt7DlLEfGD70T8OHc6bnNvf3OlVqvuZPWFVn17obm3f2+jvrJeXa9uVSrLS8uLb91/s3JpY32lXsxKX/709wff+GnSrdnsSu84LlNn6IXjOInJiPjeVQQbgYlsPMVRd4Rnko+IFyPi1fT+n4uJ9NUEAG6ydnsu2nO9dQDgpos0B5bLl7NcwGzk8+VyJ4f3Uszka41m6+7Dxu7WWidXNh+F/MONWnUxyxXORyGX1JfS8uN65UT9fkS8EBE/n5pO6+XVRm1thP/uAYBxduvE+v/vqc76DwDccKVRdwAAGDrrPwCMH+s/AIwf6z8AjJ/O+j896m4AAEPk/T8AjB/rPwCMle+/+25ytI+y779e+2Bvd7Pxwb21anOzXN9dLa82drbL643GevqdPfWznq/WaGwvvRG7H85/c7vZWmju7T+oN3a3Wg/S7/V+UC2kjzoYwsgAgEFeeOWTP+WSFfnt6fSInr0cCiPtGXDV8qPuADAyE6PuADAydvuC8XWB9/jSA3BD9Nmi9wmlfh8Q6m4gAvxfuvMF+X8YVz35f/8LGMaM/D+ML/l/GF/tdu68e/7HeR8IAFxvcvzAgN//v5idf5P9cuBHaycf8fFV9goAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACut+7+v+VsL/DZyOfL5YjnImI+CrmHG7XqYkQ8HxF/nCpMJfWlEfcZALio/F9z2f5fd+Zen32i6eVbx8ViRPzkl+/94sOVVmvnDxHF3D+nutdbH2fXK8PvPQBwtu46nZ573sh/dvhotXsMsz9/+3ZElDrxjw6LcXQcfzIm03MpChEx869cVu/I9eQuLuLgo4j4fL/x52I2zYF0dj49GT+J/dxQ4+efiJ9P2zrn5GfxuUvoC4ybT5L5551+918+bqfn/vd/KZ2hLi6b/5KnWj1K58DH8bvz38SA+e/2eWO88bvvdkrTp9s+ivjiZEQ39lHP/NONnxsQ//Vzxv/zl15+dVBb+1cRd6J//N5YC6369kJzb//eRn1lvbpe3apUlpeWF9+6/2ZlIc1RLwxeDf7+9t3nB7Ul458ZEL90xvi/es7x//q/7//wK0+J//XX+sXPx0tPiZ+siV87Z/yVmd+WBrUl8dcGjP+s1//uOeN/+pf9U9uGAwCj09zb31yp1ao7Cte5UMxeruvSn0GF0hX3MPkZXI+Rni58a1ixitG/6Wev9f1L0m4/U6xBM8ZlZN2A6+D4po+I/4y6MwAAAAAAAAAAAAAAQF/D+MTSqMcIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAzfW/AAAA//+Y9srv") r0 = creat(&(0x7f0000000e40)='./bus\x00', 0x19) fallocate(r0, 0x0, 0x0, 0x2000402) setresuid(0x0, 0xee00, 0x0) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) write$binfmt_aout(r0, &(0x7f0000000340)=ANY=[], 0x20) 396.391921ms ago: executing program 6 (id=383): openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000008c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x1000}}) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000280)={0x50, 0x0, r1, {0x7, 0x2b, 0x0, 0xa0031718561a00d8, 0xffff, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}}, 0x50) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000080)={0x28, 0x4, 0x0, {0x1, 0x7}}, 0x28) 335.262972ms ago: executing program 6 (id=384): r0 = syz_usb_connect$uac3(0x5, 0xa0, &(0x7f0000002440)=ANY=[@ANYBLOB="12011003000000403512100040000102030109028e000301002040080b0201012130c60904000000010130000a2401042a00ff0f0000132403050001020602028000000700100002000f24090202000000", @ANYRES16], &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f00000005c0)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="200604000000e971ec7b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000002240)={0x84, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000280)={0x1c, &(0x7f0000000140)={0x0, 0x17}, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) 231.478565ms ago: executing program 7 (id=385): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000040)={0x0, &(0x7f0000000280)=[@rdmsr={0x66, 0x18, {0xc0010140}}], 0x18}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f00000010c0)={0x1, 0x0, [{0x80000001, 0x0, 0x7, 0x6, 0x2, 0xfffffffe, 0x10000}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 87.060268ms ago: executing program 7 (id=386): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x8004745a, 0x0) 86.925318ms ago: executing program 7 (id=387): mkdir(&(0x7f0000000140)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000280)='./config/usb_gadget/g1/functions/mass_storage.0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/mass_storage.0/lun.0/cdrom\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)="c521c1a58e", 0x5) 0s ago: executing program 7 (id=388): fcntl$lock(0xffffffffffffffff, 0x6, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x8031, 0xffffffffffffffff, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x40000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x5, 0x8031, 0xffffffffffffffff, 0x6ea61000) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000240)={0xe, 0x20}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.111' (ED25519) to the list of known hosts. [ 21.581734][ T30] audit: type=1400 audit(1786437766.078:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.582886][ T277] cgroup: Unknown subsys name 'net' [ 21.604948][ T30] audit: type=1400 audit(1786437766.078:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.632233][ T30] audit: type=1400 audit(1786437766.098:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.632381][ T277] cgroup: Unknown subsys name 'devices' [ 21.743892][ T277] cgroup: Unknown subsys name 'hugetlb' [ 21.749529][ T277] cgroup: Unknown subsys name 'rlimit' [ 21.885852][ T30] audit: type=1400 audit(1786437766.378:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.909209][ T30] audit: type=1400 audit(1786437766.378:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.930869][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.934206][ T30] audit: type=1400 audit(1786437766.378:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.966491][ T30] audit: type=1400 audit(1786437766.438:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.971106][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.991991][ T30] audit: type=1400 audit(1786437766.438:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.026430][ T30] audit: type=1400 audit(1786437766.458:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.051911][ T30] audit: type=1400 audit(1786437766.458:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.438213][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.445333][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.452914][ T285] device bridge_slave_0 entered promiscuous mode [ 22.460010][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.467106][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.474532][ T285] device bridge_slave_1 entered promiscuous mode [ 22.566003][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.573081][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.580477][ T286] device bridge_slave_0 entered promiscuous mode [ 22.602986][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.610045][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.617519][ T286] device bridge_slave_1 entered promiscuous mode [ 22.662768][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.669835][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.677373][ T287] device bridge_slave_0 entered promiscuous mode [ 22.686006][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.693463][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.700771][ T287] device bridge_slave_1 entered promiscuous mode [ 22.744109][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.751151][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.758617][ T288] device bridge_slave_0 entered promiscuous mode [ 22.765708][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.772871][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.780310][ T288] device bridge_slave_1 entered promiscuous mode [ 22.819320][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.826661][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.833986][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.841003][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.867461][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.875618][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.883029][ T289] device bridge_slave_0 entered promiscuous mode [ 22.889975][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.897094][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.904577][ T289] device bridge_slave_1 entered promiscuous mode [ 22.969580][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.976663][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.983978][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.991019][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.015496][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.022577][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.029834][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.036968][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.056440][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.063516][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.070781][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.078796][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.111878][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.120289][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.129338][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.136612][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.143928][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.151698][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.158878][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.166709][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.174814][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.182344][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.215074][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.222752][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.230287][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.238561][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.246720][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.255444][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.262486][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.278437][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.295023][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.302631][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.311486][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.320039][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.327087][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.334662][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.343216][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.350236][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.357711][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.365928][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.372972][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.400525][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.408891][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.415963][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.423527][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.432474][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.439503][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.446895][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.455081][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.463161][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.471063][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.479107][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.488599][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.495864][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.503276][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.511387][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.518427][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.526241][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.542227][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.550255][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.558605][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.566910][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.575368][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.583995][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.592415][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.600359][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.608396][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.616963][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.627511][ T286] device veth0_vlan entered promiscuous mode [ 23.638475][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.646422][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.654655][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.662281][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.671915][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.679868][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.694019][ T286] device veth1_macvtap entered promiscuous mode [ 23.702362][ T285] device veth0_vlan entered promiscuous mode [ 23.709496][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.717184][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.725017][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.733577][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.742132][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.751858][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.760257][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.776668][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.785280][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.793955][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.802362][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.810706][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.819199][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.831935][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.840313][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.848865][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.857009][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.865167][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.872951][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.883842][ T287] device veth0_vlan entered promiscuous mode [ 23.893447][ T288] device veth0_vlan entered promiscuous mode [ 23.902885][ T285] device veth1_macvtap entered promiscuous mode [ 23.917297][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.917708][ T286] request_module fs-gadgetfs succeeded, but still no fs? [ 23.925584][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.940338][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.949173][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.957455][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.965674][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.973702][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.987272][ T287] device veth1_macvtap entered promiscuous mode [ 23.994183][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.002439][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.010641][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.019306][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.027940][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.037179][ T289] device veth0_vlan entered promiscuous mode [ 24.048167][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.055705][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.063361][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.072467][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.080819][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.090292][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.104899][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.113646][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.130351][ T289] device veth1_macvtap entered promiscuous mode [ 24.148353][ T288] device veth1_macvtap entered promiscuous mode [ 24.157808][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.166223][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.175319][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.183072][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.192166][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.200289][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.208723][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.217591][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.229214][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.237762][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.273510][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.283628][ T317] loop1: detected capacity change from 0 to 512 [ 24.292620][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.301111][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.309722][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.318378][ T307] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 24.318550][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.335144][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.349753][ T317] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.362381][ T317] ext4 filesystem being mounted at /0/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 24.400118][ T327] device batadv_slave_0 entered promiscuous mode [ 24.407851][ T326] device batadv_slave_0 left promiscuous mode [ 24.434046][ T317] EXT4-fs error (device loop1): ext4_get_first_dir_block:3619: inode #12: comm syz.1.2: directory missing '..' [ 24.435268][ T332] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.455005][ T330] loop2: detected capacity change from 0 to 2048 [ 24.493705][ T330] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 24.505430][ T330] ext4 filesystem being mounted at /2/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 24.541595][ T305] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 24.712071][ T307] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 196, using maximum allowed: 30 [ 24.731643][ T307] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.751616][ T307] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 24.771724][ T307] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 196 [ 24.801603][ T307] usb 4-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.00 [ 24.821603][ T307] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.841847][ T307] usb 4-1: config 0 descriptor?? [ 24.901661][ T305] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.931662][ T305] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 24.941674][ T305] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 24.971681][ T305] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 24.980747][ T305] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.981661][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 24.993466][ T351] loop1: detected capacity change from 0 to 40427 [ 25.001178][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 25.010262][ T305] usb 1-1: config 0 descriptor?? [ 25.073826][ T351] F2FS-fs (loop1): invalid crc value [ 25.086085][ T351] F2FS-fs (loop1): Found nat_bits in checkpoint [ 25.156420][ T351] F2FS-fs (loop1): Start checkpoint disabled! [ 25.177077][ T351] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 25.292319][ T344] loop2: detected capacity change from 0 to 131072 [ 25.300263][ T360] loop4: detected capacity change from 0 to 40427 [ 25.308484][ T344] F2FS-fs (loop2): invalid crc value [ 25.315967][ T307] holtek_kbd 0003:04D9:A055.0001: hidraw0: USB HID v10.00 Device [HID 04d9:a055] on usb-dummy_hcd.3-1/input0 [ 25.329356][ T360] F2FS-fs (loop4): invalid crc value [ 25.348206][ T360] F2FS-fs (loop4): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 25.353813][ T344] F2FS-fs (loop2): Found nat_bits in checkpoint [ 25.393002][ T360] F2FS-fs (loop4): Start checkpoint disabled! [ 25.403788][ T360] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 25.421703][ T344] F2FS-fs (loop2): Cannot turn on quotas: -2 on 2 [ 25.446966][ T344] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4 [ 25.479470][ T8] attempt to access beyond end of device [ 25.479470][ T8] loop1: rw=1, want=81920, limit=40427 [ 25.498623][ T306] attempt to access beyond end of device [ 25.498623][ T306] loop4: rw=2049, want=40976, limit=40427 [ 25.507961][ T8] attempt to access beyond end of device [ 25.507961][ T8] loop1: rw=1, want=53248, limit=40427 [ 25.515006][ T305] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 25.541776][ T305] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 25.549318][ T305] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 25.552499][ T307] usb 4-1: USB disconnect, device number 2 [ 25.557138][ T305] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 25.571476][ T305] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 25.582599][ T305] plantronics 0003:047F:FFFF.0002: No inputs registered, leaving [ 25.588797][ T8] attempt to access beyond end of device [ 25.588797][ T8] loop1: rw=1, want=77824, limit=40427 [ 25.594546][ T305] plantronics 0003:047F:FFFF.0002: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 25.611297][ T8] attempt to access beyond end of device [ 25.611297][ T8] loop1: rw=1, want=85816, limit=40427 [ 25.642299][ T8] attempt to access beyond end of device [ 25.642299][ T8] loop1: rw=2049, want=40984, limit=40427 [ 25.852031][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 25.863607][ T305] usb 1-1: USB disconnect, device number 2 [ 25.873985][ T376] loop1: detected capacity change from 0 to 1024 [ 25.935104][ T374] loop4: detected capacity change from 0 to 40427 [ 25.943175][ T376] EXT4-fs (loop1): Ignoring removed oldalloc option [ 25.950266][ T376] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 25.973051][ T376] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,bsddf,sysvgroups,norecovery,dioread_nolock,noinit_itable,oldalloc,sysvgroups,norecovery,,errors=continue. Quota mode: none. [ 25.982331][ T374] F2FS-fs (loop4): fault_injection options not supported [ 26.001014][ T374] F2FS-fs (loop4): fault_type options not supported [ 26.008683][ T374] F2FS-fs (loop4): invalid crc value [ 26.030489][ T374] F2FS-fs (loop4): Found nat_bits in checkpoint [ 26.073043][ T374] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 26.116439][ T374] attempt to access beyond end of device [ 26.116439][ T374] loop4: rw=2049, want=45104, limit=40427 [ 26.137817][ T289] attempt to access beyond end of device [ 26.137817][ T289] loop4: rw=2049, want=45112, limit=40427 [ 26.232797][ T394] input: syz1 as /devices/virtual/input/input4 [ 26.361708][ T313] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 26.447659][ T417] loop1: detected capacity change from 0 to 512 [ 26.457221][ T419] loop0: detected capacity change from 0 to 256 [ 26.504315][ T417] EXT4-fs (loop1): Ignoring removed nobh option [ 26.523387][ T417] EXT4-fs (loop1): mounted filesystem without journal. Opts: max_dir_size_kb=0x0000000000001000,nobh,quota,,errors=continue. Quota mode: writeback. [ 26.561673][ T417] ext4 filesystem being mounted at /11/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 26.564843][ T425] loop0: detected capacity change from 0 to 2048 [ 26.586987][ T417] EXT4-fs error (device loop1): ext4_do_update_inode:5260: inode #2: comm syz.1.37: corrupted inode contents [ 26.600392][ T417] EXT4-fs error (device loop1): ext4_dirty_inode:6108: inode #2: comm syz.1.37: mark_inode_dirty error [ 26.621026][ T417] EXT4-fs error (device loop1): ext4_do_update_inode:5260: inode #2: comm syz.1.37: corrupted inode contents [ 26.642178][ T417] EXT4-fs error (device loop1): __ext4_ext_dirty:183: inode #2: comm syz.1.37: mark_inode_dirty error [ 26.642700][ T425] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 26.670935][ T30] kauditd_printk_skb: 86 callbacks suppressed [ 26.670948][ T30] audit: type=1400 audit(1786437771.158:160): avc: denied { setattr } for pid=416 comm="syz.1.37" path="/11/file0/file1" dev="loop1" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 26.721684][ T313] usb 4-1: New USB device found, idVendor=0925, idProduct=8888, bcdDevice= 0.00 [ 26.733349][ T313] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.747006][ T313] usb 4-1: config 0 descriptor?? [ 26.852800][ T434] EXT4-fs (loop1): Test dummy encryption mode enabled [ 26.882077][ T434] EXT4-fs (loop1): Test dummy encryption mode enabled [ 26.889703][ T434] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 26.914419][ T434] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 26.924746][ T315] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 26.946840][ T434] EXT4-fs warning (device loop1): ext4_expand_extra_isize_ea:2809: Unable to expand inode 11. Delete some EAs or run e2fsck. [ 26.965788][ T315] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 27.002221][ T434] EXT4-fs (loop1): 1 truncate cleaned up [ 27.007932][ T434] EXT4-fs (loop1): mounted filesystem without journal. Opts: test_dummy_encryption,nojournal_checksum,inlinecrypt,debug_want_extra_isize=0x0000000000000080,nogrpid,jqfmt=vfsv1,test_dummy_encryption,nodioread_nolock,,errors=continue. Quota mode: none. [ 27.032593][ T315] EXT4-fs (loop0): This should not happen!! Data will be lost [ 27.032593][ T315] [ 27.047841][ T315] EXT4-fs (loop0): Total free blocks count 0 [ 27.054515][ T315] EXT4-fs (loop0): Free/Dirty block details [ 27.068968][ T315] EXT4-fs (loop0): free_blocks=4096 [ 27.074404][ T315] EXT4-fs (loop0): dirty_blocks=32 [ 27.082817][ T315] EXT4-fs (loop0): Block reservation details [ 27.089080][ T315] EXT4-fs (loop0): i_reserved_data_blocks=2 [ 27.098960][ T30] audit: type=1400 audit(1786437771.588:161): avc: denied { append } for pid=433 comm="syz.1.42" name="file2" dev="loop1" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 27.101515][ T315] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 65537 with max blocks 1 with error 28 [ 27.122414][ T434] EXT4-fs (loop1): Online defrag not supported for encrypted files [ 27.161521][ T315] EXT4-fs (loop0): This should not happen!! Data will be lost [ 27.161521][ T315] [ 27.253184][ T313] smartjoyplus 0003:0925:8888.0003: hidraw0: USB HID vef.fd Device [HID 0925:8888] on usb-dummy_hcd.3-1/input0 [ 27.267454][ T313] smartjoyplus 0003:0925:8888.0003: Force feedback for SmartJoy PLUS PS2/USB adapter [ 27.336600][ T318] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 27.345913][ T453] EXT4-fs (loop1): mounted filesystem without journal. Opts: journal_ioprio=0x0000000000000002,usrquota,minixdf,nombcache,,errors=continue. Quota mode: writeback. [ 27.372887][ T453] ext4 filesystem being mounted at /14/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 27.399865][ T453] EXT4-fs (loop1): shut down requested (1) [ 27.409264][ T30] audit: type=1400 audit(1786437771.898:162): avc: denied { name_bind } for pid=462 comm="syz.0.51" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 27.434969][ T30] audit: type=1400 audit(1786437771.898:163): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 27.468684][ T307] usb 4-1: USB disconnect, device number 3 [ 27.477172][ T30] audit: type=1400 audit(1786437771.898:164): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.500290][ T30] audit: type=1400 audit(1786437771.898:165): avc: denied { write } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.509964][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 27.533174][ T30] audit: type=1400 audit(1786437771.898:166): avc: denied { add_name } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.571346][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 27.580072][ T30] audit: type=1400 audit(1786437771.898:167): avc: denied { create } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 27.601385][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 27.615888][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 27.627126][ T30] audit: type=1400 audit(1786437771.898:168): avc: denied { append open } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 27.629209][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 27.650568][ T30] audit: type=1400 audit(1786437771.898:169): avc: denied { getattr } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 27.659843][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 27.689982][ T318] usb 3-1: Using ep0 maxpacket: 32 [ 27.690544][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 27.707626][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 27.760656][ T475] ======================================================= [ 27.760656][ T475] WARNING: The mand mount option has been deprecated and [ 27.760656][ T475] and is ignored by this kernel. Remove the mand [ 27.760656][ T475] option from the mount to silence this warning. [ 27.760656][ T475] ======================================================= [ 27.816622][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 27.831703][ T318] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 231, changing to 7 [ 27.832859][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 27.860756][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 27.870280][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 27.879049][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 27.887672][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 27.896182][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 27.904800][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 27.996377][ C1] blk_update_request: I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 28.007912][ C1] Buffer I/O error on dev loop8, logical block 0, async page read [ 28.016266][ T318] usb 3-1: New USB device found, idVendor=2a39, idProduct=3f8c, bcdDevice= 0.40 [ 28.025923][ C1] blk_update_request: I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 28.025961][ C1] Buffer I/O error on dev loop8, logical block 0, async page read [ 28.026009][ T485] loop8: unable to read partition table [ 28.026103][ T485] loop_reread_partitions: partition scan of loop8 (úùƒå¡™‰ü¾CêjÌ–ã¢P=à ) failed (rc=-5) [ 28.061031][ T318] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.082224][ C1] blk_update_request: I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 28.096608][ C1] Buffer I/O error on dev loop8, logical block 0, async page read [ 28.108218][ C0] blk_update_request: I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 28.120669][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 28.132203][ T318] usb 3-1: Product: syz [ 28.135083][ C0] blk_update_request: I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 28.145223][ T318] usb 3-1: Manufacturer: syz [ 28.153330][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 28.165276][ T318] usb 3-1: SerialNumber: syz [ 28.172604][ C0] blk_update_request: I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 28.183656][ C0] Buffer I/O error on dev loop8, logical block 0, async page read [ 28.191977][ C1] blk_update_request: I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 28.203054][ C1] Buffer I/O error on dev loop8, logical block 0, async page read [ 28.307978][ T487] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 28.318047][ T487] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 28.327557][ T487] F2FS-fs (loop3): invalid crc value [ 28.338608][ T487] F2FS-fs (loop3): Found nat_bits in checkpoint [ 28.380255][ T487] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 28.389109][ T487] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 28.415289][ T447] usb usb8: usbfs: interface 0 claimed by hub while 'syz.2.47' sets config #0 [ 28.461626][ T487] attempt to access beyond end of device [ 28.461626][ T487] loop3: rw=2049, want=45104, limit=40427 [ 28.532470][ T487] attempt to access beyond end of device [ 28.532470][ T487] loop3: rw=0, want=45104, limit=40427 [ 28.567850][ T492] syz.4.64 (492) used greatest stack depth: 21224 bytes left [ 28.573283][ T318] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 28.583967][ T507] TCP: TCP_TX_DELAY enabled [ 28.620072][ T318] usb 3-1: USB disconnect, device number 2 [ 28.702182][ T510] exFAT-fs (loop1): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x28ba01bf, utbl_chksum : 0xe619d30d) [ 28.741945][ T512] EXT4-fs (loop4): Quota format mount options ignored when QUOTA feature is enabled [ 28.764006][ T512] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 28.799165][ T512] EXT4-fs (loop4): mounted filesystem without journal. Opts: dioread_nolock,barrier=0x000000000000000d,minixdf,stripe=0x0000000000000b74,resuid=0x0000000000000000,jqfmt=vfsv1,grpjquota=,i_version,,errors=continue. Quota mode: writeback. [ 28.845308][ T518] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 28.846026][ T512] ext4 filesystem being mounted at /20/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 28.877282][ T520] ------------[ cut here ]------------ [ 28.887140][ T518] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a802e12c, mo2=0002] [ 28.895698][ T518] System zones: 1-12 [ 28.900147][ T518] EXT4-fs (loop1): orphan cleanup on readonly fs [ 28.907527][ T520] trace type BPF program uses run-time allocation [ 28.911775][ T518] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.72: bg 0: block 361: padding at end of block bitmap is not set [ 28.914076][ T520] WARNING: CPU: 1 PID: 520 at kernel/bpf/verifier.c:11731 check_map_prog_compatibility+0x6cc/0x870 [ 28.939937][ T520] Modules linked in: [ 28.944826][ T520] CPU: 1 PID: 520 Comm: syz.3.69 Not tainted syzkaller #0 [ 28.952741][ T520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.963591][ T520] RIP: 0010:check_map_prog_compatibility+0x6cc/0x870 [ 28.970650][ T520] Code: ee ff 48 c7 c6 60 52 48 85 4c 8b 65 d0 e9 f9 fc ff ff e8 c7 27 ee ff c6 05 28 9c 6a 05 01 48 c7 c7 c0 4e 48 85 e8 14 0f 2f 03 <0f> 0b e9 83 fb ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a7 f9 ff [ 28.992274][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 29.001610][ T520] RSP: 0018:ffffc90000d87450 EFLAGS: 00010246 [ 29.014149][ T520] RAX: 539e2d4f0dc0bc00 RBX: 0000000000000001 RCX: 0000000000080000 [ 29.022906][ T520] RDX: ffffc90002f72000 RSI: 00000000000039cb RDI: 00000000000039cc [ 29.033528][ T520] RBP: ffffc90000d87490 R08: 0000000000000003 R09: 0000000000000004 [ 29.043183][ T520] R10: dffffc0000000000 R11: fffff520001b0dec R12: ffff88810be50000 [ 29.052994][ T520] R13: 0000000000000011 R14: dffffc0000000000 R15: ffff888118373800 [ 29.058694][ T518] EXT4-fs (loop1): Remounting filesystem read-only [ 29.062674][ T520] FS: 00007fa7a60f26c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 29.079189][ T520] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.085352][ T518] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 29.086490][ T520] CR2: 0000001b2ee1eff8 CR3: 0000000130d58000 CR4: 00000000003506a0 [ 29.118065][ T518] EXT4-fs (loop1): Remounting filesystem read-only [ 29.128184][ T520] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.141360][ T518] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.72: invalid indirect mapped block 12 (level 1) [ 29.147550][ T520] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 29.159373][ T518] EXT4-fs (loop1): Remounting filesystem read-only [ 29.169580][ T518] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.72: invalid indirect mapped block 2 (level 2) [ 29.171166][ T520] Call Trace: [ 29.189021][ T520] [ 29.189918][ T518] EXT4-fs (loop1): Remounting filesystem read-only [ 29.196437][ T520] resolve_pseudo_ldimm64+0x617/0x10f0 [ 29.201665][ T528] EXT4-fs (loop0): Ignoring removed bh option [ 29.206484][ T520] ? check_attach_btf_id+0xd80/0xd80 [ 29.215032][ T518] EXT4-fs (loop1): 1 truncate cleaned up [ 29.222031][ T520] ? __mark_reg_known+0x1b0/0x1b0 [ 29.227196][ T528] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 29.231943][ T520] ? security_capable+0x87/0xb0 [ 29.250113][ T520] bpf_check+0x2d02/0xf750 [ 29.255397][ T530] exFAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 29.268409][ T518] EXT4-fs (loop1): mounted filesystem without journal. Opts: noload,acl,inode_readahead_blks=0x0000000000000040,errors=remount-ro,init_itable. Quota mode: none. [ 29.269328][ T520] ? is_bpf_text_address+0x177/0x190 [ 29.292258][ T526] FAT-fs (loop4): Directory bread(block 524322) failed [ 29.301072][ T526] FAT-fs (loop4): Directory bread(block 524323) failed [ 29.320029][ T530] exFAT-fs (loop2): Medium has reported failures. Some data may be lost. [ 29.336244][ T528] EXT4-fs (loop0): mounted filesystem without journal. Opts: nobarrier,dioread_lock,dioread_nolock,resgid=0x0000000000000000,debug_want_extra_isize=0x0000000000000080,lazytime,journal_ioprio=0x0000000000000005,stripe=0x0000000000000011,bh,init_itable,,errors=continue. Quota mode: none. [ 29.337990][ T526] FAT-fs (loop4): Directory bread(block 524324) failed [ 29.366777][ T518] EXT4-fs error (device loop1): ext4_map_blocks:632: inode #2: block 5: comm syz.1.72: lblock 0 mapped to illegal pblock 5 (length 1) [ 29.373515][ T520] ? is_bpf_text_address+0x177/0x190 [ 29.391362][ T526] FAT-fs (loop4): Directory bread(block 524325) failed [ 29.406063][ T526] FAT-fs (loop4): Directory bread(block 524326) failed [ 29.413094][ T530] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 29.413937][ T518] EXT4-fs warning (device loop1): dx_probe:823: inode #2: lblock 0: comm syz.1.72: error -117 reading directory block [ 29.440962][ T526] FAT-fs (loop4): Directory bread(block 524327) failed [ 29.448076][ T526] FAT-fs (loop4): Directory bread(block 524328) failed [ 29.458295][ T526] FAT-fs (loop4): Directory bread(block 524329) failed [ 29.465980][ T520] ? bpf_get_btf_vmlinux+0x60/0x60 [ 29.471410][ T520] ? unwind_get_return_address+0x4d/0x90 [ 29.478122][ T520] ? stack_trace_save+0xf0/0xf0 [ 29.483697][ T520] ? arch_stack_walk+0xee/0x140 [ 29.489664][ T520] ? stack_trace_save+0xa6/0xf0 [ 29.495588][ T520] ? __stack_depot_save+0x34/0x480 [ 29.502126][ T520] ? __kasan_slab_alloc+0x69/0xe0 [ 29.508655][ T520] ? __kasan_kmalloc+0xe6/0x100 [ 29.514905][ T520] ? __kasan_kmalloc+0xd4/0x100 [ 29.521997][ T520] ? kmem_cache_alloc_trace+0x119/0x270 [ 29.528112][ T520] ? selinux_bpf_prog_alloc+0x51/0x140 [ 29.532222][ T526] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 29.534288][ T520] ? security_bpf_prog_alloc+0x62/0x90 [ 29.555574][ T520] ? bpf_prog_load+0x9d4/0x1620 [ 29.562110][ T520] ? __sys_bpf+0x51d/0x7d0 [ 29.566739][ T520] ? __x64_sys_bpf+0x7c/0x90 [ 29.574182][ T520] ? x64_sys_call+0x4b9/0x9a0 [ 29.579660][ T520] ? do_syscall_64+0x4c/0xa0 [ 29.584568][ T520] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 29.598064][ T520] ? check_stack_object+0x81/0x150 [ 29.605204][ T520] ? memset+0x35/0x40 [ 29.611297][ T520] ? bpf_obj_name_cpy+0x193/0x1e0 [ 29.617743][ T520] bpf_prog_load+0x10c5/0x1620 [ 29.626455][ T520] ? __anon_inode_getfd+0x35c/0x3d0 [ 29.644378][ T520] ? map_freeze+0x370/0x370 [ 29.653190][ T520] ? selinux_bpf+0xc7/0xf0 [ 29.661106][ T520] ? security_bpf+0x82/0xa0 [ 29.666253][ T520] __sys_bpf+0x51d/0x7d0 [ 29.669296][ T536] user requested TSC rate below hardware speed [ 29.672383][ T520] ? bpf_link_show_fdinfo+0x330/0x330 [ 29.694922][ T520] ? __kasan_check_write+0x14/0x20 [ 29.703838][ T520] ? switch_fpu_return+0x15d/0x2c0 [ 29.750360][ T520] __x64_sys_bpf+0x7c/0x90 [ 29.769290][ T520] x64_sys_call+0x4b9/0x9a0 [ 29.785373][ T520] do_syscall_64+0x4c/0xa0 [ 29.790098][ T520] ? clear_bhb_loop+0x50/0xa0 [ 29.795424][ T520] ? clear_bhb_loop+0x50/0xa0 [ 29.801703][ T520] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 29.808699][ T520] RIP: 0033:0x7fa7a76990d9 [ 29.815096][ T520] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.835976][ T520] RSP: 002b:00007fa7a60f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 29.845013][ T520] RAX: ffffffffffffffda RBX: 00007fa7a7920fa0 RCX: 00007fa7a76990d9 [ 29.854315][ T520] RDX: 0000000000000094 RSI: 0000200000000400 RDI: 0000000000000005 [ 29.864073][ T520] RBP: 00007fa7a7730024 R08: 0000000000000000 R09: 0000000000000000 [ 29.872774][ T520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 29.881238][ T520] R13: 00007fa7a7921038 R14: 00007fa7a7920fa0 R15: 00007ffd09c611a8 [ 29.895611][ T520] [ 29.898676][ T520] ---[ end trace d1393dd1a81edeee ]--- [ 30.118950][ T547] set_capacity_and_notify: 10 callbacks suppressed [ 30.118966][ T547] loop4: detected capacity change from 0 to 131072 [ 30.141622][ T547] F2FS-fs (loop4): Wrong CP boundary, start(512) end(1536) blocks(0) [ 30.156496][ T547] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 30.161604][ T318] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 30.174939][ T547] F2FS-fs (loop4): invalid crc value [ 30.182694][ T547] F2FS-fs (loop4): Found nat_bits in checkpoint [ 30.218665][ T547] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 30.225972][ T547] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 30.227551][ T564] loop3: detected capacity change from 0 to 40427 [ 30.265964][ T564] F2FS-fs (loop3): invalid crc value [ 30.278221][ T564] F2FS-fs (loop3): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 30.318044][ T564] F2FS-fs (loop3): Start checkpoint disabled! [ 30.324902][ T564] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 30.411909][ T318] usb 3-1: Using ep0 maxpacket: 16 [ 30.531659][ T318] usb 3-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.543628][ T578] loop3: detected capacity change from 0 to 16 [ 30.553274][ T318] usb 3-1: config 0 interface 0 has no altsetting 0 [ 30.560330][ T318] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 30.590600][ T318] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.599436][ T318] usb 3-1: config 0 descriptor?? [ 30.616784][ T578] erofs: (device loop3): mounted with root inode @ nid 36. [ 30.680953][ T590] loop4: detected capacity change from 0 to 512 [ 30.710015][ T574] loop0: detected capacity change from 0 to 40427 [ 30.743416][ T574] F2FS-fs (loop0): Invalid SB checksum offset: 0 [ 30.750207][ T574] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock [ 30.760358][ T574] F2FS-fs (loop0): invalid crc value [ 30.770933][ T574] F2FS-fs (loop0): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 30.827443][ T590] EXT4-fs (loop4): mounted filesystem without journal. Opts: errors=remount-ro,grpquota,. Quota mode: writeback. [ 30.840548][ T605] loop1: detected capacity change from 0 to 512 [ 30.856768][ T607] Illegal XDP return value 4294967282, expect packet loss! [ 30.862579][ T590] ext4 filesystem being mounted at /28/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 30.902554][ T605] EXT4-fs error (device loop1): ext4_orphan_get:1406: inode #15: comm syz.1.101: inode has both inline data and extents flags [ 30.916741][ T574] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0 [ 30.921801][ T605] EXT4-fs error (device loop1): ext4_orphan_get:1411: comm syz.1.101: couldn't read orphan inode 15 (err -117) [ 30.925647][ T574] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 30.937272][ T605] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 30.974850][ T590] EXT4-fs error (device loop4): ext4_get_first_dir_block:3597: inode #12: comm syz.4.98: Directory hole found for htree leaf block 0 [ 31.016224][ T590] EXT4-fs (loop4): Remounting filesystem read-only [ 31.071505][ T610] loop3: detected capacity change from 0 to 40427 [ 31.081315][ T610] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 31.090066][ T610] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 31.091364][ T318] hid-generic 0003:04D8:00DD.0004: hidraw0: USB HID v0.01 Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 31.112238][ T610] F2FS-fs (loop3): invalid crc value [ 31.117940][ T285] handle_bad_sector: 3 callbacks suppressed [ 31.117958][ T285] attempt to access beyond end of device [ 31.117958][ T285] loop0: rw=2049, want=45104, limit=40427 [ 31.151927][ T610] F2FS-fs (loop3): Found nat_bits in checkpoint [ 31.237871][ T610] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 31.249671][ T610] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 31.271029][ T632] loop5: detected capacity change from 0 to 7 [ 31.321588][ T632] loop5: detected capacity change from 7 to 0 [ 31.501018][ T316] usb 3-1: USB disconnect, device number 3 [ 31.554265][ T661] input: syz0 as /devices/virtual/input/input5 [ 31.564162][ T662] syz.1.121 uses obsolete (PF_INET,SOCK_PACKET) [ 31.582001][ T664] loop0: detected capacity change from 0 to 128 [ 31.725742][ T671] EXT4-fs error (device loop0): ext4_orphan_get:1406: inode #15: comm syz.0.127: iget: bad i_size value: 38620345925642 [ 31.739292][ T671] EXT4-fs error (device loop0): ext4_orphan_get:1411: comm syz.0.127: couldn't read orphan inode 15 (err -117) [ 31.755231][ T671] EXT4-fs (loop0): mounted filesystem without journal. Opts: quota,delalloc,acl,journal_dev=0x0000000000000011,usrjquota=,bsdgroups,,errors=continue. Quota mode: writeback. [ 31.902386][ T315] EXT4-fs error (device loop0): ext4_validate_block_bitmap:429: comm kworker/u4:4: bg 0: block 5: invalid block bitmap [ 31.919145][ T315] EXT4-fs (loop0): Delayed block allocation failed for inode 18 at logical offset 36 with max blocks 2048 with error 28 [ 31.931874][ T315] EXT4-fs (loop0): This should not happen!! Data will be lost [ 31.931874][ T315] [ 31.944010][ T315] EXT4-fs (loop0): Total free blocks count 0 [ 31.955210][ T315] EXT4-fs (loop0): Free/Dirty block details [ 31.962257][ T315] EXT4-fs (loop0): free_blocks=0 [ 31.967639][ T315] EXT4-fs (loop0): dirty_blocks=16000 [ 31.974128][ T315] EXT4-fs (loop0): Block reservation details [ 31.980405][ T315] EXT4-fs (loop0): i_reserved_data_blocks=16000 [ 32.017262][ T315] EXT4-fs (loop0): Delayed block allocation failed for inode 18 at logical offset 2088 with max blocks 2048 with error 28 [ 32.045410][ T315] EXT4-fs (loop0): This should not happen!! Data will be lost [ 32.045410][ T315] [ 32.097608][ T30] kauditd_printk_skb: 71 callbacks suppressed [ 32.097621][ T30] audit: type=1400 audit(1786437776.588:241): avc: denied { watch watch_reads } for pid=682 comm="syz.3.133" path="/proc/34/task/35" dev="proc" ino=17141 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 32.141688][ T30] audit: type=1400 audit(1786437776.628:242): avc: denied { remount } for pid=685 comm="syz.4.134" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 32.287322][ T699] xt_hashlimit: size too large, truncated to 1048576 [ 32.293806][ T701] xt_hashlimit: size too large, truncated to 1048576 [ 32.370293][ T709] netlink: 8 bytes leftover after parsing attributes in process `syz.2.142'. [ 32.489217][ T30] audit: type=1400 audit(1786437776.978:243): avc: denied { load_policy } for pid=703 comm="syz.1.141" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 32.525438][ T705] SELinux: failed to load policy [ 32.746822][ T30] audit: type=1400 audit(1786437777.238:244): avc: denied { create } for pid=728 comm="syz.1.150" name="#9" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 32.831891][ T30] audit: type=1400 audit(1786437777.238:245): avc: denied { link } for pid=728 comm="syz.1.150" name="#9" dev="tmpfs" ino=271 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 32.876460][ T30] audit: type=1400 audit(1786437777.238:246): avc: denied { rename } for pid=728 comm="syz.1.150" name="#a" dev="tmpfs" ino=271 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 32.902451][ T731] EXT4-fs (loop1): Ignoring removed nobh option [ 32.914112][ T731] EXT4-fs (loop1): Test dummy encryption mode enabled [ 32.937303][ T731] EXT4-fs (loop1): Mount option "noacl" will be removed by 3.5 [ 32.937303][ T731] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 32.937303][ T731] [ 32.970641][ T30] audit: type=1400 audit(1786437777.318:247): avc: denied { write } for pid=732 comm="syz.2.152" name="tcp6" dev="proc" ino=4026532609 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 33.009162][ T731] EXT4-fs (loop1): Ignoring removed oldalloc option [ 33.022706][ T741] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d) [ 33.034028][ T30] audit: type=1400 audit(1786437777.488:248): avc: denied { block_suspend } for pid=736 comm="syz.2.154" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 33.041638][ T731] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 33.041638][ T731] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 33.041638][ T731] [ 33.075614][ T30] audit: type=1400 audit(1786437777.498:249): avc: denied { getopt } for pid=740 comm="syz.4.156" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 33.105021][ T739] SELinux: failed to load policy [ 33.117256][ T30] audit: type=1400 audit(1786437777.588:250): avc: denied { mounton } for pid=740 comm="syz.4.156" path="/37/file0/file0" dev="loop4" ino=1048599 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 33.157476][ T747] netlink: 12 bytes leftover after parsing attributes in process `syz.4.157'. [ 33.172309][ T731] EXT4-fs (loop1): mounted filesystem without journal. Opts: nobh,test_dummy_encryption=v1,inlinecrypt,journal_dev=0x0000000000000006,noacl,nombcache,minixdf,nodioread_nolock,errors=remount-ro,oldalloc,nolazytime,nouser_xattr,. Quota mode: writeback. [ 33.251675][ T731] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 33.285022][ T752] EXT4-fs (loop2): Test dummy encryption mode enabled [ 33.298233][ T752] EXT4-fs (loop2): Mount option "noacl" will be removed by 3.5 [ 33.298233][ T752] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 33.298233][ T752] [ 33.364420][ T758] kvm [756]: vcpu0, guest rIP: 0x540a3 Hyper-V unhandled rdmsr: 0x40000005 [ 33.380682][ T752] EXT4-fs (loop2): warning: maximal mount count reached, running e2fsck is recommended [ 33.393831][ T752] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,data_err=ignore,nodioread_nolock,test_dummy_encryption,noacl,journal_ioprio=0x0000000000000001,minixdf,debug_want_extra_isize=0x0000000000000040,,errors=continue. Quota mode: writeback. [ 33.510975][ T778] smpboot: CPU 1 is now offline [ 33.898637][ T820] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 33.959937][ T820] ext4 filesystem being mounted at /25/file7 supports timestamps until 2038-01-19 (0x7fffffff) [ 33.985113][ T820] EXT4-fs error (device loop3): ext4_read_inode_bitmap:140: comm syz.3.188: Invalid inode bitmap blk 349451772 in block_group 0 [ 34.004103][ T828] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d) [ 34.296211][ T845] erofs: (device loop0): mounted with root inode @ nid 36. [ 34.314128][ T845] attempt to access beyond end of device [ 34.314128][ T845] loop0: rw=524288, want=1342177528, limit=16 [ 34.326926][ T845] attempt to access beyond end of device [ 34.326926][ T845] loop0: rw=0, want=1342177280, limit=16 [ 34.340058][ T845] attempt to access beyond end of device [ 34.340058][ T845] loop0: rw=0, want=1342177280, limit=16 [ 34.352783][ T845] attempt to access beyond end of device [ 34.352783][ T845] loop0: rw=0, want=1342177280, limit=16 [ 34.382250][ T844] attempt to access beyond end of device [ 34.382250][ T844] loop0: rw=0, want=1342177280, limit=16 [ 34.408136][ T845] attempt to access beyond end of device [ 34.408136][ T845] loop0: rw=0, want=1342177280, limit=16 [ 34.434616][ T844] attempt to access beyond end of device [ 34.434616][ T844] loop0: rw=0, want=1342177280, limit=16 [ 34.459815][ T844] attempt to access beyond end of device [ 34.459815][ T844] loop0: rw=0, want=1342177280, limit=16 [ 34.490351][ T844] attempt to access beyond end of device [ 34.490351][ T844] loop0: rw=0, want=1342177280, limit=16 [ 34.538983][ T847] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 34.585991][ T847] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 34.635929][ T847] F2FS-fs (loop4): invalid crc value [ 35.032658][ T847] F2FS-fs (loop4): Found nat_bits in checkpoint [ 35.179203][ T847] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 35.200072][ T882] set_capacity_and_notify: 8 callbacks suppressed [ 35.200082][ T882] loop0: detected capacity change from 0 to 512 [ 35.247108][ T847] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 35.260119][ T885] loop1: detected capacity change from 0 to 512 [ 35.317787][ T885] EXT4-fs (loop1): Ignoring removed bh option [ 35.343150][ T882] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 35.380363][ T885] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpquota,nogrpid,bh,,errors=continue. Quota mode: writeback. [ 35.433152][ T882] EXT4-fs (loop0): 1 truncate cleaned up [ 35.440764][ T882] EXT4-fs (loop0): mounted filesystem without journal. Opts: nogrpid,barrier,debug_want_extra_isize=0x0000000000000068,nodiscard,nombcache,quota,nojournal_checksum,,errors=continue. Quota mode: writeback. [ 35.465300][ T885] ext4 filesystem being mounted at /57/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 35.601501][ T896] loop1: detected capacity change from 0 to 256 [ 35.805026][ T910] loop4: detected capacity change from 0 to 512 [ 35.849325][ T913] loop1: detected capacity change from 0 to 1024 [ 35.879702][ T915] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 35.926214][ T910] EXT4-fs error (device loop4): ext4_orphan_get:1406: inode #15: comm syz.4.225: inode has both inline data and extents flags [ 35.942233][ T913] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 35.971784][ T915] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 35.981829][ T913] ext4 filesystem being mounted at /61/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 36.001811][ T910] EXT4-fs error (device loop4): ext4_orphan_get:1411: comm syz.4.225: couldn't read orphan inode 15 (err -117) [ 36.055170][ T913] EXT4-fs error (device loop1): ext4_readdir:263: inode #2: block 16: comm syz.1.227: path /61/file1: bad entry in directory: rec_len is smaller than minimal - offset=876, inode=0, rec_len=0, size=1024 fake=0 [ 36.081709][ T910] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 36.197645][ T925] loop4: detected capacity change from 0 to 128 [ 36.311575][ T316] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 36.493024][ T877] loop2: detected capacity change from 0 to 131072 [ 36.537442][ T877] F2FS-fs (loop2): Test dummy encryption mode enabled [ 36.563156][ T877] F2FS-fs (loop2): invalid crc value [ 36.581654][ T316] usb 1-1: Using ep0 maxpacket: 32 [ 36.604982][ T948] loop1: detected capacity change from 0 to 512 [ 36.616747][ T877] F2FS-fs (loop2): Found nat_bits in checkpoint [ 36.626983][ T886] loop3: detected capacity change from 0 to 131072 [ 36.657033][ T886] F2FS-fs (loop3): Test dummy encryption mode enabled [ 36.666972][ T948] EXT4-fs (loop1): Ignoring removed bh option [ 36.684825][ T948] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 36.701655][ T316] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.713289][ T6] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 36.723118][ T877] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 36.731445][ T886] F2FS-fs (loop3): invalid crc value [ 36.738153][ T948] EXT4-fs (loop1): 1 truncate cleaned up [ 36.745246][ T316] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.769937][ T886] F2FS-fs (loop3): Found nat_bits in checkpoint [ 36.776986][ T948] EXT4-fs (loop1): mounted filesystem without journal. Opts: nodioread_nolock,barrier,debug_want_extra_isize=0x0000000000000068,errors=remount-ro,nombcache,quota,bh,. Quota mode: writeback. [ 36.804088][ T316] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 36.822016][ T877] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 36.837022][ T316] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.855696][ T886] F2FS-fs (loop3): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 36.878312][ T316] usb 1-1: config 0 descriptor?? [ 36.901516][ T287] EXT4-fs error (device loop1): ext4_readdir:263: inode #11: block 54: comm syz-executor: path /68/file0/lost+found: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 36.938075][ T886] F2FS-fs (loop3): Cannot turn on quotas: -2 on 0 [ 36.945736][ T316] hub 1-1:0.0: USB hub found [ 36.955574][ T886] F2FS-fs (loop3): Start checkpoint disabled! [ 36.963045][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 36.970253][ T886] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 36.978274][ T287] EXT4-fs error (device loop1): ext4_empty_dir:3177: inode #11: block 54: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=5120, inode=0, rec_len=0, size=1024 fake=0 [ 37.043610][ T8] F2FS-fs (loop3): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 37.055600][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 37.071776][ T287] EXT4-fs error (device loop1): ext4_readdir:263: inode #11: block 54: comm syz-executor: path /68/file0/lost+found: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 37.093784][ T6] usb 5-1: config 220 has an invalid interface number: 76 but max is 2 [ 37.121105][ T6] usb 5-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 37.132237][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 37.151756][ T316] hub 1-1:0.0: 1 port detected [ 37.158442][ T6] usb 5-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 37.179863][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 37.200308][ T287] EXT4-fs error (device loop1): ext4_empty_dir:3177: inode #11: block 54: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=5120, inode=0, rec_len=0, size=1024 fake=0 [ 37.230473][ T6] usb 5-1: config 220 has no interface number 2 [ 37.260598][ T6] usb 5-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 37.284701][ T6] usb 5-1: config 220 interface 0 has no altsetting 0 [ 37.295323][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 37.305314][ T6] usb 5-1: config 220 interface 76 has no altsetting 0 [ 37.326111][ T287] EXT4-fs error (device loop1): ext4_readdir:263: inode #11: block 54: comm syz-executor: path /68/file0/lost+found: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 37.356912][ T6] usb 5-1: config 220 interface 1 has no altsetting 0 [ 37.376859][ T30] kauditd_printk_skb: 41 callbacks suppressed [ 37.376868][ T30] audit: type=1400 audit(1786437781.868:292): avc: denied { write } for pid=956 comm="syz.2.241" name="001" dev="devtmpfs" ino=175 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 37.447692][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 37.461887][ T287] EXT4-fs error (device loop1): ext4_empty_dir:3177: inode #11: block 54: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=5120, inode=0, rec_len=0, size=1024 fake=0 [ 37.503212][ T30] audit: type=1400 audit(1786437781.908:293): avc: denied { map } for pid=956 comm="syz.2.241" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=175 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 37.541685][ T6] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 37.562283][ T6] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.570560][ T6] usb 5-1: Product: syz [ 37.578774][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 37.595957][ T287] EXT4-fs error (device loop1): ext4_readdir:263: inode #11: block 54: comm syz-executor: path /68/file0/lost+found: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 37.628663][ T6] usb 5-1: Manufacturer: syz [ 37.634652][ T316] hub 1-1:0.0: hub_hub_status failed (err = -71) [ 37.642846][ T30] audit: type=1400 audit(1786437782.048:294): avc: denied { ioctl } for pid=964 comm="syz.2.246" path="socket:[19431]" dev="sockfs" ino=19431 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 37.676481][ T316] hub 1-1:0.0: config failed, can't get hub status (err -71) [ 37.684288][ T6] usb 5-1: SerialNumber: syz [ 37.715734][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 37.726116][ T974] loop3: detected capacity change from 0 to 512 [ 37.733793][ T287] EXT4-fs error (device loop1): ext4_empty_dir:3177: inode #11: block 54: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=5120, inode=0, rec_len=0, size=1024 fake=0 [ 37.760625][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 37.768653][ T287] EXT4-fs error (device loop1): ext4_readdir:263: inode #11: block 54: comm syz-executor: path /68/file0/lost+found: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 37.794013][ T974] EXT4-fs (loop3): Ignoring removed mblk_io_submit option [ 37.806645][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 37.814717][ T316] usbhid 1-1:0.0: can't add hid device: -71 [ 37.822918][ T316] usbhid: probe of 1-1:0.0 failed with error -71 [ 37.832167][ T287] EXT4-fs error (device loop1): ext4_empty_dir:3177: inode #11: block 54: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=5120, inode=0, rec_len=0, size=1024 fake=0 [ 37.854867][ T974] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 37.872128][ T974] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=885ec129, mo2=0006] [ 37.880801][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 37.891071][ T974] EXT4-fs error (device loop3): ext4_read_inode_bitmap:140: comm syz.3.249: Invalid inode bitmap blk 4 in block_group 0 [ 37.906522][ T316] usb 1-1: USB disconnect, device number 3 [ 37.944340][ T974] EXT4-fs (loop3): Remounting filesystem read-only [ 37.950984][ T974] EXT4-fs (loop3): mounted filesystem without journal. Opts: debug,norecovery,mblk_io_submit,quota,nobarrier,grpquota,nombcache,barrier=0x000000000000000c,dioread_nolock,noblock_validity,data_err=ignore,errors=remount-ro,. Quota mode: writeback. [ 38.002802][ T30] audit: type=1400 audit(1786437782.498:295): avc: denied { remount } for pid=973 comm="syz.3.249" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 38.049449][ T974] EXT4-fs (loop3): old and new quota format mixing [ 38.071755][ T6] usb 5-1: Found UVC 7.01 device syz (8086:0b07) [ 38.086468][ T6] usb 5-1: No valid video chain found. [ 38.113653][ T6] usb 5-1: selecting invalid altsetting 0 [ 38.157850][ T30] audit: type=1400 audit(1786437782.648:296): avc: denied { connect } for pid=979 comm="syz.3.252" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 38.186059][ T10] tipc: Subscription rejected, illegal request [ 38.214122][ T984] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 38.261616][ T315] Bluetooth: hci0: Frame reassembly failed (-84) [ 38.276303][ T6] usb 5-1: USB disconnect, device number 2 [ 38.291697][ T30] audit: type=1400 audit(1786437782.678:297): avc: denied { write } for pid=979 comm="syz.3.252" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 38.348407][ T306] device bridge_slave_1 left promiscuous mode [ 38.365223][ T306] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.374412][ T30] audit: type=1400 audit(1786437782.688:298): avc: denied { read } for pid=979 comm="syz.3.252" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 38.395074][ T306] device bridge_slave_0 left promiscuous mode [ 38.402794][ T306] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.414962][ T306] device veth1_macvtap left promiscuous mode [ 38.421828][ T30] audit: type=1400 audit(1786437782.748:299): avc: denied { mounton } for pid=989 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 38.443958][ T306] device veth0_vlan left promiscuous mode [ 38.505994][ T1000] EXT4-fs (loop4): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000000,nodioread_nolock,lazytime,barrier,auto_da_alloc,nodioread_nolock,,errors=continue. Quota mode: none. [ 38.535084][ T1000] ext4 filesystem being mounted at /53/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 38.558131][ T1000] EXT4-fs (loop4): shut down requested (2) [ 38.625605][ T989] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.639744][ T1009] EXT4-fs (loop0): Test dummy encryption mode enabled [ 38.648952][ T989] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.658228][ T1009] EXT4-fs (loop0): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue. Quota mode: none. [ 38.672895][ T989] device bridge_slave_0 entered promiscuous mode [ 38.682140][ T989] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.689941][ T1011] 9pnet: p9_fd_create_unix (1011): problem connecting socket: ./file0: -5 [ 38.699919][ T1009] ext4 filesystem being mounted at /58/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 38.713555][ T989] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.754866][ T989] device bridge_slave_1 entered promiscuous mode [ 38.762854][ T30] audit: type=1400 audit(1786437783.258:300): avc: denied { create } for pid=1008 comm="syz.0.262" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 38.785048][ T1009] EXT4-fs (loop0): re-mounted. Opts: . Quota mode: none. [ 38.845932][ T1009] EXT4-fs (loop0): Remounting file system with no journal so ignoring journalled data option [ 38.866940][ T30] audit: type=1400 audit(1786437783.278:301): avc: denied { write } for pid=1008 comm="syz.0.262" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 38.903139][ T1019] EXT4-fs (loop4): Quota format mount options ignored when QUOTA feature is enabled [ 38.919425][ T1009] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 38.945472][ T1019] EXT4-fs (loop4): mounted filesystem without journal. Opts: lazytime,quota,quota,stripe=0x0000000000000007,jqfmt=vfsold,,errors=continue. Quota mode: writeback. [ 38.965088][ T1009] EXT4-fs (loop0): re-mounted. Opts: dioread_nolock,noinit_itable,user_xattr,grpjquota=,data=writeback,noblock_validity,minixdf,min_batch_time=0x0000000000000008,. Quota mode: none. [ 38.987247][ T989] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.994332][ T989] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.001801][ T989] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.008925][ T989] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.034390][ T1019] ext4 filesystem being mounted at /58/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 39.081721][ T1023] exFAT-fs (loop3): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 39.155225][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.185133][ T1029] APIC base relocation is unsupported by KVM [ 39.185344][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.235714][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.262437][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 39.280969][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.288165][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.341023][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 39.384209][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.391475][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.422331][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.444216][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.459123][ T1049] netlink: 16 bytes leftover after parsing attributes in process `syz.3.279'. [ 39.472021][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.493944][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.516276][ T1051] erofs: (device loop3): mounted with root inode @ nid 36. [ 39.527210][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.545304][ T1051] process 'syz.3.280' launched './file2' with NULL argv: empty string added [ 39.555029][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.563956][ T989] device veth0_vlan entered promiscuous mode [ 39.572682][ T48] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[9000] [ 39.595077][ T1051] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[4096] [ 39.620139][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 39.640141][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.656694][ T989] device veth1_macvtap entered promiscuous mode [ 39.674540][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 39.697915][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 39.708166][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.727986][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 39.738117][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.905236][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 39.922955][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 39.948290][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 39.970631][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 39.999673][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 40.024692][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 40.041838][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 40.060631][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 40.207753][ T1076] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 40.253124][ T6] Bluetooth: hci0: command 0x1003 tx timeout [ 40.271649][ T1070] Bluetooth: hci0: sending frame failed (-49) [ 40.278729][ T1076] ext4 filesystem being mounted at /47/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 40.432218][ T1064] set_capacity_and_notify: 6 callbacks suppressed [ 40.432230][ T1064] loop0: detected capacity change from 0 to 131072 [ 40.451993][ T1064] F2FS-fs (loop0): Test dummy encryption mode enabled [ 40.466598][ T1064] F2FS-fs (loop0): invalid crc value [ 40.475351][ T1064] F2FS-fs (loop0): Found nat_bits in checkpoint [ 40.522836][ T1064] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 40.661602][ T6] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 40.772881][ T1093] kvm: MONITOR instruction emulated as NOP! [ 40.901619][ T6] usb 4-1: Using ep0 maxpacket: 16 [ 41.021761][ T6] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 41.030960][ T6] usb 4-1: config 0 has no interface number 0 [ 41.037267][ T6] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 41.047775][ T6] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 41.141651][ T316] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 41.211719][ T6] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 41.233107][ T6] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.251066][ T1102] loop4: detected capacity change from 0 to 1024 [ 41.258380][ T6] usb 4-1: Product: syz [ 41.263456][ T6] usb 4-1: Manufacturer: syz [ 41.276864][ T6] usb 4-1: SerialNumber: syz [ 41.284728][ T6] usb 4-1: config 0 descriptor?? [ 41.301640][ T1086] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 41.324550][ T1106] loop4: detected capacity change from 0 to 512 [ 41.332680][ T1086] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 41.353243][ T1106] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 41.366111][ T1106] ext4 filesystem being mounted at /69/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 41.387420][ T1106] netlink: 20 bytes leftover after parsing attributes in process `syz.4.301'. [ 41.473044][ T1116] netlink: 27 bytes leftover after parsing attributes in process `syz.4.305'. [ 41.501663][ T316] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 41.525935][ T316] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.547079][ T316] usb 1-1: config 0 descriptor?? [ 41.566846][ T1086] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 41.604702][ T1086] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 41.614774][ T1124] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 41.646144][ T1126] 9pnet: p9_errstr2errno: server reported unknown error @cD†üB€|˜ÿÿÿÿÜ [ 41.736681][ T1132] loop4: detected capacity change from 0 to 1024 [ 41.766685][ T1132] EXT4-fs (loop4): orphan cleanup on readonly fs [ 41.773712][ T1132] EXT4-fs warning (device loop4): ext4_enable_quotas:6479: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [ 41.790858][ T1132] EXT4-fs (loop4): Cannot turn on quotas: error -117 [ 41.799375][ T1132] EXT4-fs error (device loop4): ext4_free_blocks:6231: comm syz.4.313: Freeing blocks not in datazone - block = 0, count = 4096 [ 41.813450][ T1132] EXT4-fs (loop4): 1 orphan inode deleted [ 41.819869][ T1132] EXT4-fs (loop4): mounted filesystem without journal. Opts: norecovery,noblock_validity,nogrpid,block_validity,resgid=0x0000000000000000,i_version,abort,noinit_itable,,errors=continue. Quota mode: writeback. [ 41.851680][ T6] asix 4-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 41.916881][ T1135] loop4: detected capacity change from 0 to 256 [ 42.145726][ T1139] loop4: detected capacity change from 0 to 128 [ 42.162510][ T1139] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 42.178376][ T1139] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 42.203858][ T1139] TCP: tcp_parse_options: Illegal window scaling value 215 > 14 received [ 42.291720][ T6] asix 4-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 42.311668][ T6] asix: probe of 4-1:0.34 failed with error -71 [ 42.332632][ T6] usb 4-1: USB disconnect, device number 4 [ 42.355406][ T972] Bluetooth: hci0: command 0x1001 tx timeout [ 42.365877][ T1070] Bluetooth: hci0: sending frame failed (-49) [ 42.407566][ T1153] loop4: detected capacity change from 0 to 1024 [ 42.422167][ T1153] EXT4-fs (loop4): Ignoring removed nomblk_io_submit option [ 42.431155][ T1153] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 42.453043][ T1153] EXT4-fs (loop4): mounted filesystem without journal. Opts: minixdf,bsddf,barrier=0x000000000000000c,commit=0x0000000000000005,debug_want_extra_isize=0x0000000000000080,dioread_nolock,jqfmt=vfsv0,noblock_validity,nomblk_io_submit,,errors=continue. Quota mode: none. [ 42.565186][ T1158] loop7: detected capacity change from 0 to 16384 [ 42.797037][ T1164] loop3: detected capacity change from 0 to 128 [ 42.815079][ T1164] EXT4-fs (loop3): mounted filesystem without journal. Opts: usrquota,nodelalloc,,errors=continue. Quota mode: writeback. [ 42.832756][ T1164] ext4 filesystem being mounted at /49/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 42.911709][ T316] usb 1-1: Cannot set autoneg [ 42.924809][ T316] MOSCHIP usb-ethernet driver: probe of 1-1:0.0 failed with error -71 [ 42.953303][ T1171] loop4: detected capacity change from 0 to 512 [ 42.974670][ T316] usb 1-1: USB disconnect, device number 4 [ 42.988459][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 42.988469][ T30] audit: type=1400 audit(1786437787.478:314): avc: denied { setopt } for pid=1172 comm="syz.3.330" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 43.025379][ T1171] EXT4-fs warning (device loop4): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 43.061289][ T1171] EXT4-fs warning (device loop4): dx_probe:881: Enable large directory feature to access it [ 43.074446][ T1171] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.329: Corrupt directory, running e2fsck is recommended [ 43.090870][ T1171] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -117 [ 43.099993][ T1171] EXT4-fs error (device loop4): ext4_iget_extra_inode:4604: inode #15: comm syz.4.329: corrupted in-inode xattr [ 43.114001][ T1171] EXT4-fs error (device loop4): ext4_orphan_get:1411: comm syz.4.329: couldn't read orphan inode 15 (err -117) [ 43.129356][ T1171] EXT4-fs (loop4): mounted filesystem without journal. Opts: dioread_lock,noblock_validity,auto_da_alloc=0x0000000000000003,jqfmt=vfsold,nolazytime,grpjquota=.dax,resuid=0x0000000000000000,lazytime,grpid,,,errors=continue. Quota mode: writeback. [ 43.170990][ T1171] EXT4-fs warning (device loop4): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 43.184946][ T1171] EXT4-fs warning (device loop4): dx_probe:881: Enable large directory feature to access it [ 43.198630][ T1171] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.329: Corrupt directory, running e2fsck is recommended [ 43.218996][ T1171] EXT4-fs warning (device loop4): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 43.232518][ T1171] EXT4-fs warning (device loop4): dx_probe:881: Enable large directory feature to access it [ 43.244097][ T1171] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.329: Corrupt directory, running e2fsck is recommended [ 43.259570][ T1171] EXT4-fs warning (device loop4): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 43.271757][ T1171] EXT4-fs warning (device loop4): dx_probe:881: Enable large directory feature to access it [ 43.282592][ T1171] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.329: Corrupt directory, running e2fsck is recommended [ 43.300180][ T1171] EXT4-fs warning (device loop4): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 43.316380][ T1171] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 3: comm syz.4.329: path /95/file0: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=4294967295, rec_len=17, size=1024 fake=0 [ 43.339356][ T1171] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 22: comm syz.4.329: path /95/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 43.361814][ T1171] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 8: comm syz.4.329: path /95/file0: bad entry in directory: inode out of bounds - offset=0, inode=16810477, rec_len=1024, size=1024 fake=0 [ 43.469874][ T1182] EXT4-fs (loop0): orphan cleanup on readonly fs [ 43.506111][ T1182] EXT4-fs error (device loop0): ext4_ext_check_inode:501: inode #4: comm syz.0.334: pblk 0 bad header/extent: too large eh_depth - magic f30a, entries 1, max 4(4), depth 2048(2048) [ 43.552575][ T1189] EXT4-fs error (device loop4): ext4_orphan_get:1406: inode #15: comm syz.4.336: inode has both inline data and extents flags [ 43.568215][ T1182] EXT4-fs error (device loop0): ext4_quota_enable:6438: comm syz.0.334: Bad quota inode: 4, type: 1 [ 43.579858][ T1189] EXT4-fs error (device loop4): ext4_orphan_get:1411: comm syz.4.336: couldn't read orphan inode 15 (err -117) [ 43.592535][ T1182] EXT4-fs warning (device loop0): ext4_enable_quotas:6479: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 43.609949][ T1189] EXT4-fs (loop4): mounted filesystem without journal. Opts: user_xattr,,errors=continue. Quota mode: writeback. [ 43.624579][ T1182] EXT4-fs (loop0): Cannot turn on quotas: error -117 [ 43.650231][ T1182] EXT4-fs (loop0): mounted filesystem without journal. Opts: quota,noblock_validity,journal_dev=0x0000000000000003,journal_dev=0x000000000000000b,barrier=0x0000000000000081,minixdf,inode_readahead_blks=0x0000000000000040,,errors=continue. Quota mode: writeback. [ 43.729098][ T30] audit: type=1400 audit(1786437788.218:315): avc: denied { create } for pid=1191 comm="syz.4.337" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 43.773941][ T1194] netlink: 36 bytes leftover after parsing attributes in process `syz.0.338'. [ 43.819676][ T30] audit: type=1400 audit(1786437788.258:316): avc: denied { connect } for pid=1191 comm="syz.4.337" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 43.844551][ T1196] FAT-fs (loop4): Invalid FSINFO signature: 0x41615231, 0x61417272 (sector = 1) [ 43.879257][ T1196] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 43.926561][ T30] audit: type=1400 audit(1786437788.258:317): avc: denied { write } for pid=1191 comm="syz.4.337" laddr=fe80::c4c8:10ff:fe5b:9e96 lport=1 faddr=ff02::1 fport=20004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 43.981240][ T306] FAT-fs (loop4): Invalid FSINFO signature: 0x41615231, 0x61417272 (sector = 1) [ 44.026426][ T30] audit: type=1400 audit(1786437788.268:318): avc: denied { setopt } for pid=1191 comm="syz.4.337" laddr=fe80::c4c8:10ff:fe5b:9e96 lport=1 faddr=ff02::1 fport=20004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 44.111774][ T1211] binder: 1209:1211 ioctl 4018620d 0 returned -22 [ 44.155083][ T1214] netlink: 4 bytes leftover after parsing attributes in process `syz.4.346'. [ 44.195698][ T30] audit: type=1400 audit(1786437788.268:319): avc: denied { read } for pid=1191 comm="syz.4.337" laddr=fe80::c4c8:10ff:fe5b:9e96 lport=1 faddr=ff02::1 fport=20004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 44.353874][ T30] audit: type=1400 audit(1786437788.848:320): avc: denied { write } for pid=1230 comm="syz.4.353" name="ptype" dev="proc" ino=4026532654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 44.379423][ T1231] kvm [1230]: vcpu0, guest rIP: 0xfff0 Hyper-V unhandled rdmsr: 0x40000065 [ 44.413227][ T972] Bluetooth: hci0: command 0x1009 tx timeout [ 44.465106][ T1243] binder: 1241:1243 ioctl c018620c 200000000200 returned -22 [ 44.473489][ T1237] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 44.513154][ T1243] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (62631!=20869) [ 44.533118][ T1237] overlayfs: failed to set xattr on upper [ 44.539067][ T1243] jbd2_journal_init_inode: Cannot locate journal superblock [ 44.546931][ T1237] overlayfs: ...falling back to index=off,metacopy=off. [ 44.554215][ T1237] overlayfs: NFS export requires "index=on", falling back to nfs_export=off. [ 44.564770][ T1243] EXT4-fs (loop3): Could not load journal inode [ 44.629506][ T1243] syz.3.356 (1243) used greatest stack depth: 21120 bytes left [ 44.651695][ T20] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 44.682910][ T1246] EXT4-fs (loop3): Quota format mount options ignored when QUOTA feature is enabled [ 44.713231][ T1246] EXT4-fs (loop3): Ignoring removed mblk_io_submit option [ 44.749109][ T1246] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 44 vs 41 free clusters [ 44.780670][ T1248] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.788969][ T1246] EXT4-fs (loop3): Remounting filesystem read-only [ 44.796535][ T1248] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.804770][ T1248] device bridge_slave_0 entered promiscuous mode [ 44.813343][ T1246] EXT4-fs (loop3): 1 orphan inode deleted [ 44.821216][ T1248] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.828519][ T1246] EXT4-fs (loop3): mounted filesystem without journal. Opts: errors=remount-ro,nodiscard,lazytime,init_itable,jqfmt=vfsv0,resgid=0x0000000000000000,mblk_io_submit,barrier,quota,. Quota mode: writeback. [ 44.849097][ T1248] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.857684][ T1248] device bridge_slave_1 entered promiscuous mode [ 44.874356][ T1246] ext4 filesystem being mounted at /58/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 44.928553][ T1248] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.936433][ T1248] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.944095][ T1248] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.951913][ T1248] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.970440][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.998847][ T315] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.008451][ T1255] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 45.023643][ T315] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.031808][ T20] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 45.045836][ T1255] EXT4-fs (loop3): 1 truncate cleaned up [ 45.054235][ T8] device bridge_slave_1 left promiscuous mode [ 45.060984][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.068652][ T20] usb 1-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 45.078461][ T1255] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 45.090244][ T20] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 45.106949][ T8] device bridge_slave_0 left promiscuous mode [ 45.118436][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.132418][ T8] device veth1_macvtap left promiscuous mode [ 45.140070][ T8] device veth0_vlan left promiscuous mode [ 45.191684][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 45.201341][ T994] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.210046][ T994] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.220113][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 45.229140][ T994] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.236934][ T994] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.244738][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 45.253166][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 45.268470][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 45.280815][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 45.289796][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 45.300089][ T1248] device veth0_vlan entered promiscuous mode [ 45.309588][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 45.330005][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 45.349465][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 45.368133][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 45.388661][ T1248] device veth1_macvtap entered promiscuous mode [ 45.400706][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 45.413296][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 45.423307][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 45.445052][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 45.455174][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 45.508949][ T1258] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.520306][ T1261] set_capacity_and_notify: 8 callbacks suppressed [ 45.520317][ T1261] loop6: detected capacity change from 0 to 4096 [ 45.534071][ T1258] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.541525][ T1258] device bridge_slave_0 entered promiscuous mode [ 45.559184][ T1258] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.566796][ T1258] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.576040][ T1261] EXT4-fs (loop6): Unrecognized mount option "euid=00000000000000000000" or missing value [ 45.587111][ T20] wacom 0003:056A:033B.0005: Unknown device_type for 'HID 056a:033b'. Assuming pen. [ 45.601856][ T1258] device bridge_slave_1 entered promiscuous mode [ 45.619247][ T20] wacom 0003:056A:033B.0005: hidraw0: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.0-1/input0 [ 45.642187][ T20] input: Wacom Intuos S 2 Pen as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/0003:056A:033B.0005/input/input6 [ 45.708361][ T1258] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.718757][ T1258] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.726647][ T1258] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.733987][ T1258] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.860818][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 45.876302][ T315] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.905722][ T315] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.940368][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 45.958324][ T315] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.966105][ T315] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.994918][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 46.007624][ T315] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.015213][ T315] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.051052][ T6] usb 1-1: USB disconnect, device number 5 [ 46.058101][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 46.073173][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 46.093757][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 46.105627][ T1258] device veth0_vlan entered promiscuous mode [ 46.112694][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 46.120851][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 46.128792][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 46.138919][ T8] device bridge_slave_1 left promiscuous mode [ 46.145938][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.153459][ T8] device bridge_slave_0 left promiscuous mode [ 46.159562][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.167761][ T8] device veth1_macvtap left promiscuous mode [ 46.174138][ T8] device veth0_vlan left promiscuous mode [ 46.228923][ T1258] device veth1_macvtap entered promiscuous mode [ 46.248768][ T1280] loop6: detected capacity change from 0 to 128 [ 46.256688][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 46.271938][ T1280] FAT-fs (loop6): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 46.291317][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 46.302124][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 46.323524][ T1280] FAT-fs (loop6): error, fat_get_cluster: invalid cluster chain (i_pos 1) [ 46.351766][ T1280] FAT-fs (loop6): Filesystem has been set read-only [ 46.362650][ T1280] FAT-fs (loop6): error, fat_get_cluster: invalid cluster chain (i_pos 1) [ 46.381671][ T1280] FAT-fs (loop6): error, fat_get_cluster: invalid cluster chain (i_pos 1) [ 46.407312][ T1284] loop7: detected capacity change from 0 to 1024 [ 46.414573][ T1280] FAT-fs (loop6): error, fat_get_cluster: invalid cluster chain (i_pos 1) [ 46.440816][ T1248] FAT-fs (loop6): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 46.452141][ T1284] EXT4-fs (loop7): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 46.495871][ T1284] ext4 filesystem being mounted at /1/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 46.546928][ T1284] EXT4-fs error (device loop7): ext4_map_blocks:742: inode #15: block 3: comm syz.7.372: lblock 3 mapped to illegal pblock 3 (length 1) [ 46.575065][ T1297] loop6: detected capacity change from 0 to 256 [ 46.604713][ T1284] EXT4-fs (loop7): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 1 with error 117 [ 46.618785][ T1297] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 46.645874][ T1284] EXT4-fs (loop7): This should not happen!! Data will be lost [ 46.645874][ T1284] [ 46.662027][ T1297] FAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 46.674764][ T1298] EXT4-fs error (device loop7): ext4_map_blocks:742: inode #15: comm syz.7.372: lblock 0 mapped to illegal pblock 0 (length 1) [ 46.726762][ T1284] EXT4-fs error (device loop7): ext4_map_blocks:632: inode #15: comm syz.7.372: lblock 0 mapped to illegal pblock 0 (length 1) [ 46.773224][ T1298] EXT4-fs (loop7): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 46.789238][ T1303] loop6: detected capacity change from 0 to 2048 [ 46.815434][ T1298] EXT4-fs (loop7): This should not happen!! Data will be lost [ 46.815434][ T1298] [ 46.838628][ T1301] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.847737][ T1303] EXT4-fs (loop6): mounted filesystem without journal. Opts: errors=remount-ro,max_dir_size_kb=0x0000000000000004,noquota,. Quota mode: none. [ 46.868630][ T1301] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.877534][ T1301] device bridge_slave_0 entered promiscuous mode [ 46.894269][ T1303] EXT4-fs (loop6): shut down requested (1) [ 46.913198][ T1301] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.920542][ T1301] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.934091][ T1310] input: syz1 as /devices/virtual/input/input9 [ 46.974668][ T1301] device bridge_slave_1 entered promiscuous mode [ 46.984460][ T1313] loop7: detected capacity change from 0 to 512 [ 47.038000][ T1313] EXT4-fs (loop7): Quota format mount options ignored when QUOTA feature is enabled [ 47.057845][ T8] device bridge_slave_1 left promiscuous mode [ 47.069408][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.096567][ T8] device bridge_slave_0 left promiscuous mode [ 47.104576][ T1313] EXT4-fs (loop7): mounted filesystem without journal. Opts: grpquota,quota,discard,nobarrier,jqfmt=vfsold,,errors=continue. Quota mode: writeback. [ 47.119779][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.127588][ T8] device veth1_macvtap left promiscuous mode [ 47.133911][ T1313] ext4 filesystem being mounted at /3/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 47.144297][ T8] device veth0_vlan left promiscuous mode [ 47.236757][ T1301] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.243836][ T1301] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.251079][ T1301] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.258307][ T1301] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.297658][ T30] audit: type=1400 audit(1786437791.788:321): avc: denied { ioctl } for pid=1323 comm="syz.7.386" path="socket:[21937]" dev="sockfs" ino=21937 ioctlcmd=0x745a scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 47.346961][ T1327] Mass Storage Function, version: 2009/09/11 [ 47.353710][ T1327] LUN: removable file: (no medium) [ 47.361178][ T994] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.371968][ T994] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.380730][ T30] audit: type=1400 audit(1786437791.838:322): avc: denied { write } for pid=1326 comm="syz.7.387" name="usb_gadget" dev="configfs" ino=13715 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 47.404616][ T6] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 47.436486][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 47.452148][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 47.474024][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 47.482382][ T30] audit: type=1400 audit(1786437791.838:323): avc: denied { add_name } for pid=1326 comm="syz.7.387" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 47.506155][ T1325] ================================================================== [ 47.514220][ T1325] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 [ 47.522283][ T1325] Read of size 4 at addr ffff8881280de800 by task syz.7.386/1325 [ 47.530175][ T1325] [ 47.532489][ T1325] CPU: 0 PID: 1325 Comm: syz.7.386 Tainted: G W syzkaller #0 [ 47.541260][ T1325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 47.551484][ T1325] Call Trace: [ 47.554797][ T1325] [ 47.557716][ T1325] __dump_stack+0x21/0x30 [ 47.562027][ T1325] dump_stack_lvl+0x110/0x170 [ 47.566712][ T1325] ? show_regs_print_info+0x20/0x20 [ 47.571886][ T1325] ? load_image+0x3f0/0x3f0 [ 47.576383][ T1325] ? __local_bh_enable_ip+0x58/0x80 [ 47.581653][ T1325] print_address_description+0x7f/0x2c0 [ 47.587193][ T1325] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 47.592981][ T1325] kasan_report+0x10f/0x150 [ 47.597459][ T1325] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 47.603157][ T1325] __asan_report_load4_noabort+0x14/0x20 [ 47.608951][ T1325] pppol2tp_sock_to_session+0x1a0/0x1b0 [ 47.614665][ T1325] pppol2tp_release+0x150/0x2b0 [ 47.619692][ T1325] sock_close+0xb8/0x200 [ 47.623940][ T1325] ? sock_mmap+0xa0/0xa0 [ 47.628351][ T1325] __fput+0x22b/0x900 [ 47.632315][ T1325] ____fput+0x15/0x20 [ 47.636481][ T1325] task_work_run+0x127/0x190 [ 47.641282][ T1325] do_exit+0xb70/0x29a0 [ 47.646825][ T1325] ? __se_sys_clock_nanosleep+0x30b/0x3a0 [ 47.652631][ T1325] ? put_task_struct+0x90/0x90 [ 47.657418][ T1325] ? __kasan_check_write+0x14/0x20 [ 47.662558][ T1325] __x64_sys_exit+0x40/0x40 [ 47.667144][ T1325] x64_sys_call+0x44/0x9a0 [ 47.671573][ T1325] do_syscall_64+0x4c/0xa0 [ 47.676088][ T1325] ? clear_bhb_loop+0x50/0xa0 [ 47.681466][ T1325] ? clear_bhb_loop+0x50/0xa0 [ 47.686141][ T1325] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 47.692316][ T1325] RIP: 0033:0x7ffa277f30d9 [ 47.696939][ T1325] Code: Unable to access opcode bytes at RIP 0x7ffa277f30af. [ 47.704296][ T1325] RSP: 002b:00007ffa2624bef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 47.713108][ T1325] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007ffa277f30d9 [ 47.721762][ T1325] RDX: 00007ffa2624c9c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 47.729721][ T1325] RBP: 00007ffa2788a024 R08: 0000000000000000 R09: 0000000000000058 [ 47.737817][ T1325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 47.747648][ T1325] R13: 00007ffa27a7b038 R14: 00007ffa27a7afa0 R15: 00007ffcde41a4c8 [ 47.756147][ T1325] [ 47.760046][ T1325] [ 47.762409][ T1325] Allocated by task 1324: [ 47.766950][ T1325] __kasan_kmalloc+0xd4/0x100 [ 47.771637][ T1325] __kmalloc+0x13d/0x2c0 [ 47.775884][ T1325] l2tp_session_create+0x39/0xb60 [ 47.782462][ T1325] pppol2tp_connect+0xbf5/0x1640 [ 47.787844][ T1325] __sys_connect+0x3cb/0x450 [ 47.793314][ T1325] __x64_sys_connect+0x7a/0x90 [ 47.799815][ T1325] x64_sys_call+0x7c/0x9a0 [ 47.804677][ T1325] do_syscall_64+0x4c/0xa0 [ 47.810676][ T1325] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 47.817597][ T1325] [ 47.819957][ T1325] Freed by task 306: [ 47.824033][ T1325] kasan_set_track+0x4a/0x70 [ 47.828962][ T1325] kasan_set_free_info+0x23/0x40 [ 47.835179][ T1325] ____kasan_slab_free+0x125/0x160 [ 47.840413][ T1325] __kasan_slab_free+0x11/0x20 [ 47.845731][ T1325] slab_free_freelist_hook+0xc2/0x190 [ 47.851815][ T1325] kfree+0xc4/0x270 [ 47.855651][ T1325] l2tp_session_put+0xaf/0x1a0 [ 47.860435][ T1325] l2tp_session_delete+0x3a9/0x4a0 [ 47.865539][ T1325] l2tp_tunnel_del_work+0x180/0x3d0 [ 47.870821][ T1325] process_one_work+0x6c8/0xbb0 [ 47.876017][ T1325] worker_thread+0xaa0/0x1250 [ 47.880712][ T1325] kthread+0x3f5/0x4f0 [ 47.885774][ T1325] ret_from_fork+0x1f/0x30 [ 47.890296][ T1325] [ 47.892633][ T1325] Last potentially related work creation: [ 47.899074][ T1325] kasan_save_stack+0x3a/0x60 [ 47.904323][ T1325] __kasan_record_aux_stack+0xd2/0x100 [ 47.912664][ T1325] kasan_record_aux_stack_noalloc+0xb/0x10 [ 47.919055][ T1325] call_rcu+0x10b/0xf60 [ 47.923744][ T1325] pwq_unbound_release_workfn+0x283/0x2c0 [ 47.930037][ T1325] process_one_work+0x6c8/0xbb0 [ 47.935516][ T1325] worker_thread+0xaa0/0x1250 [ 47.940189][ T1325] kthread+0x3f5/0x4f0 [ 47.944447][ T1325] ret_from_fork+0x1f/0x30 [ 47.949036][ T1325] [ 47.951349][ T1325] The buggy address belongs to the object at ffff8881280de800 [ 47.951349][ T1325] which belongs to the cache kmalloc-512 of size 512 [ 47.965565][ T1325] The buggy address is located 0 bytes inside of [ 47.965565][ T1325] 512-byte region [ffff8881280de800, ffff8881280dea00) [ 47.978650][ T1325] The buggy address belongs to the page: [ 47.985735][ T1325] page:ffffea0004a03700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1280dc [ 47.998870][ T1325] head:ffffea0004a03700 order:2 compound_mapcount:0 compound_pincount:0 [ 48.008901][ T1325] flags: 0x4000000000010200(slab|head|zone=1) [ 48.015183][ T1325] raw: 4000000000010200 ffffea00043eb700 0000000300000003 ffff888100042f00 [ 48.026300][ T1325] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 48.036215][ T1325] page dumped because: kasan: bad access detected [ 48.043150][ T1325] page_owner tracks the page as allocated [ 48.048945][ T1325] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 286, ts 22548080345, free_ts 0 [ 48.068292][ T1325] post_alloc_hook+0x192/0x1b0 [ 48.073152][ T1325] prep_new_page+0x1c/0x110 [ 48.077742][ T1325] get_page_from_freelist+0x2c3a/0x2cd0 [ 48.083369][ T1325] __alloc_pages+0x1a2/0x460 [ 48.088317][ T1325] new_slab+0xa0/0x4d0 [ 48.092563][ T1325] ___slab_alloc+0x3ac/0x840 [ 48.097692][ T1325] __slab_alloc+0x49/0x90 [ 48.102159][ T1325] __kmalloc_track_caller+0x169/0x2c0 [ 48.108193][ T1325] __alloc_skb+0x210/0x730 [ 48.112607][ T1325] alloc_uevent_skb+0x85/0x240 [ 48.117552][ T1325] kobject_uevent_net_broadcast+0x1a6/0x5a0 [ 48.123456][ T1325] kobject_uevent_env+0x52b/0x700 [ 48.128649][ T1325] kobject_uevent+0x1d/0x30 [ 48.133764][ T1325] netdev_queue_update_kobjects+0x1c9/0x3e0 [ 48.139662][ T1325] netdev_register_kobject+0x281/0x330 [ 48.145122][ T1325] register_netdevice+0xeaa/0x1490 [ 48.150717][ T1325] page_owner free stack trace missing [ 48.156072][ T1325] [ 48.158396][ T1325] Memory state around the buggy address: [ 48.164073][ T1325] ffff8881280de700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.172143][ T1325] ffff8881280de780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.180275][ T1325] >ffff8881280de800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.190196][ T1325] ^ [ 48.194380][ T1325] ffff8881280de880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 48.202512][ T1325] ffff8881280de900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.211034][ T1325] ================================================================== [ 48.219891][ T1325] Disabling lock debugging due to kernel taint [ 48.235886][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.285810][ T994] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.293159][ T994] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.300635][ T30] audit: type=1400 audit(1786437791.838:324): avc: denied { create } for pid=1326 comm="syz.7.387" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 48.321048][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 48.329759][ T994] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.338500][ T30] audit: type=1400 audit(1786437791.868:325): avc: denied { read write } for pid=1326 comm="syz.7.387" name="cdrom" dev="configfs" ino=21953 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 48.362507][ T994] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.369962][ T994] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.405225][ T30] audit: type=1400 audit(1786437791.868:326): avc: denied { open } for pid=1326 comm="syz.7.387" path="/6/config/usb_gadget/g1/functions/mass_storage.0/lun.0/cdrom" dev="configfs" ino=21953 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 48.440755][ T30] audit: type=1400 audit(1786437791.908:327): avc: denied { unmount } for pid=1258 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 48.462012][ T30] audit: type=1400 audit(1786437792.728:328): avc: denied { write } for pid=277 comm="syz-executor" path="pipe:[14052]" dev="pipefs" ino=14052 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 48.486105][ T6] usb 7-1: device descriptor read/all, error -71 [ 48.518885][ T1325] ------------[ cut here ]------------ [ 48.527322][ T1325] WARNING: CPU: 0 PID: 1325 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 48.538527][ T1325] Modules linked in: [ 48.542744][ T1325] CPU: 0 PID: 1325 Comm: syz.7.386 Tainted: G B W syzkaller #0 [ 48.561094][ T1325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 48.571476][ T1325] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 48.578708][ T1325] Code: 5d c3 e8 2c 83 0b fd be 02 00 00 00 eb 0a e8 20 83 0b fd be 01 00 00 00 4c 89 f7 e8 33 02 f2 fd e9 0f ff ff ff e8 09 83 0b fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 f8 82 0b fd 4c 89 f7 be 03 [ 48.600306][ T1325] RSP: 0018:ffffc90000a77bf0 EFLAGS: 00010293 [ 48.606677][ T1325] RAX: ffffffff845e33d7 RBX: ffff8881063d2000 RCX: ffff88810ddd13c0 [ 48.614759][ T1325] RDX: 0000000000000000 RSI: 000000001678b640 RDI: 000000000c04eb7d [ 48.624264][ T1325] RBP: ffffc90000a77c10 R08: 0000000000000003 R09: 0000000000000004 [ 48.632416][ T1325] R10: dffffc0000000000 R11: fffffbfff0e18e4c R12: dffffc0000000000 [ 48.640716][ T1325] R13: dffffc0000000000 R14: 000000001678b640 R15: ffff8881280de800 [ 48.649013][ T1325] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 48.664051][ T1325] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.670643][ T1325] CR2: 0000560db9600af8 CR3: 000000010d77a000 CR4: 00000000003506b0 [ 48.691872][ T1325] DR0: f7ffffffffffffff DR1: 00000000000001fa DR2: ffffffffffffffff [ 48.699866][ T1325] DR3: fffff7ffefffff15 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 48.710048][ T1325] Call Trace: [ 48.716135][ T1325] [ 48.719108][ T1325] pppol2tp_release+0x150/0x2b0 [ 48.724158][ T1325] sock_close+0xb8/0x200 [ 48.728383][ T1325] ? sock_mmap+0xa0/0xa0 [ 48.732772][ T1325] __fput+0x22b/0x900 [ 48.736745][ T1325] ____fput+0x15/0x20 [ 48.740713][ T1325] task_work_run+0x127/0x190 [ 48.747030][ T1325] do_exit+0xb70/0x29a0 [ 48.751185][ T1325] ? __se_sys_clock_nanosleep+0x30b/0x3a0 [ 48.757208][ T1325] ? put_task_struct+0x90/0x90 [ 48.762086][ T1325] ? __kasan_check_write+0x14/0x20 [ 48.767185][ T1325] __x64_sys_exit+0x40/0x40 [ 48.773165][ T1325] x64_sys_call+0x44/0x9a0 [ 48.777584][ T1325] do_syscall_64+0x4c/0xa0 [ 48.782679][ T1325] ? clear_bhb_loop+0x50/0xa0 [ 48.787349][ T1325] ? clear_bhb_loop+0x50/0xa0 [ 48.792444][ T1325] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 48.798354][ T1325] RIP: 0033:0x7ffa277f30d9 [ 48.804717][ T1325] Code: Unable to access opcode bytes at RIP 0x7ffa277f30af. [ 48.812917][ T1325] RSP: 002b:00007ffa2624bef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 48.821343][ T1325] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007ffa277f30d9 [ 48.829538][ T1325] RDX: 00007ffa2624c9c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 48.839029][ T1325] RBP: 00007ffa2788a024 R08: 0000000000000000 R09: 0000000000000058 [ 48.847340][ T1325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 48.855486][ T1325] R13: 00007ffa27a7b038 R14: 00007ffa27a7afa0 R15: 00007ffcde41a4c8 [ 48.864037][ T8] device bridge_slave_1 left promiscuous mode [ 48.870160][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.877509][ T1325] [ 48.880612][ T1325] ---[ end trace d1393dd1a81edeef ]--- [ 48.886990][ T8] device bridge_slave_0 left promiscuous mode [ 48.893535][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.901772][ T8] device veth1_macvtap left promiscuous mode [ 48.908897][ T8] device veth0_vlan left promiscuous mode [ 49.453256][ T8] device bridge_slave_1 left promiscuous mode [ 49.459432][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.467182][ T8] device bridge_slave_0 left promiscuous mode [ 49.473699][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.482021][ T8] device bridge_slave_1 left promiscuous mode [ 49.488379][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.496280][ T8] device bridge_slave_0 left promiscuous mode [ 49.503133][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.512114][ T8] device veth1_macvtap left promiscuous mode [ 49.518303][ T8] device veth0_vlan left promiscuous mode [ 50.292090][ T8] device bridge_slave_1 left promiscuous mode [ 50.298227][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.306023][ T8] device bridge_slave_0 left promiscuous mode [ 50.312471][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.320634][ T8] device veth1_macvtap left promiscuous mode [ 50.326869][ T8] device veth0_vlan left promiscuous mode