last executing test programs: 31.038699427s ago: executing program 1 (id=1867): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0xf) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000000000002}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) io_uring_enter(0xffffffffffffffff, 0x2def, 0x0, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r3, 0x40045010, &(0x7f0000000300)=0xafc) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=ANY=[@ANYBLOB="2800000011146ff900000500000000"], 0x28}}, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000040)={0xf0f02a, 0x5}) socket$inet_sctp(0x2, 0x5, 0x84) syz_mount_image$msdos(&(0x7f00000002c0), &(0x7f00000003c0)='./file0\x00', 0x200084c, &(0x7f0000000300)={[{@fat=@time_offset={'time_offset', 0x3d, 0x4f7}}, {@fat=@sys_immutable}, {@dots}, {@fat=@nfs_nostale_ro}, {@dots}, {@dots}, {@dots}, {@dots}, {@dots}, {@dots}, {@fat=@allow_utime={'allow_utime', 0x3d, 0x9}}, {@nodots}, {@fat=@showexec}, {@dots}, {@fat=@dos1xfloppy}, {@fat=@check_strict}]}, 0x1, 0x254, &(0x7f0000000b80)="$eJzs3UFr02AYB/BnW7d2Q3Bn8RDw4knUb1CkghgQKjnoycD0sonQXaIX+zH8DH4UP4IfY6fdIjbBbqlMkKxZl98PSh7eP0mft4emhfdt393/eHz06fRD+fNbjEZJDCLmcR5xGNuxE5Wt+ri9qPfionkAAJtmOs3HXfdAi7ZWRvYjIt+NiOFKlH1fU1cAAAAAAAAAAAC0zPp/AOgf6/9vv9lsnB/Un98us/4fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6M55Wd4tr3h03R8A0D73fwDon3/f/+903SIA0DLf/wGgf16/eftynKaTaZKMIs7mRVZk1bHKn79IJ4+ThcPlWWdFke3WdTp5UuVJMz+oz3/613wvHj6o8t/Zs1dpIx/G0XVPHgAAAAAAAAAAAAAAAAAAAG6IR8kfjf39O4uq/FqNrOZVdeH3ARr79wdxb7CeOQAAAAAAAAAAAAAAAAAAAMCmO/385Tg/OXk/U2xc8aPFC8alkf34j+uM4ma8LIpWiq7fmQAAAAAAAAAAAAAAAAAAoH+Wm3677gQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAurP8///rK654+uEapwoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADccr8CAAD//4mskPc=") name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="14"], &(0x7f0000000700), 0x0) 27.25251871s ago: executing program 1 (id=1887): r0 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000240)=0xffffffffffffffff, 0x4) 27.123964363s ago: executing program 1 (id=1888): syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x80044940, &(0x7f0000000340)) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bind$inet6(0xffffffffffffffff, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a1c000000ffffffffffffffffffffffe7ee00000000000000000200", 0x57}], 0x1) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000300), 0x101a02, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0xfe, 0x7fffffff}]}) close_range(r4, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000001c0)='./bus\x00', 0x41, &(0x7f00000008c0)={[{@dax_inode}, {@nodiscard}, {@noblock_validity}, {@grpjquota}, {@grpjquota}, {@orlov}, {@abort}, {@bh}, {@stripe={'stripe', 0x3d, 0x10}}]}, 0x64, 0x50a, &(0x7f0000000200)="$eJzs3VFrHFsdAPD/bHZr06Y3ueqDXvB6tZW0aHeTxrbBh1pB9Kmg1vcak00I2WRDdtM2oWiKH0AQUcEnffFF8AMIUvDFRxEK+qyoKKKtPvigncvuTtI03U227TabZn8/mMw5Z2b2f86GmZ0zc5gJYGC9FxHXI+JJmqYXImI0K89lU2y1psZ6jx/dm21MSaTpzX8mkWRl25+VZPPT2WYnI+JrX474ZvJ83NrG5tJMpVJey/Kl+vJqqbaxeXFxeWahvFBemZqavDJ9dfry9ERP2nkmIq598a8/+O7PvnTtV5+586dbfz//rUa1RrLlu9vxgvL7LWw1vdD8LnZvsPaSwY6ifLOFmeF2aww9V3L/NdcJAID2Guf4H4yIT0bEhRiNof1PZwEAAIA3UPr5kfhfEpG2d6JDOQAAAPAGyTXHwCa5YjYWYCRyuWKxNYb3w3EqV6nW6p+er66vzLXGyo5FITe/WClPZGOFx6KQNPKTzfTT/KU9+amIeDsivj863MwXZ6uVuX5f/AAAAIABcXpP//8/o63+PwAAAHDMjPW7AgAAAMBrp/8PAAAAx5/+PwAAABxrX7lxozGl2++/nru9sb5UvX1xrlxbKi6vzxZnq2urxYVqdaH5zL7lgz6vUq2ufjZW1u+W6uVavVTb2Ly1XF1fqd9afOYV2AAAAMAhevvjD/6QRMTW54abU8OJ7jbtcjXgqMrvpJJs3ma3/uNbrflfDqlSwKEY6ncFgL7J97sCQN8U+l0BoO+SA5Z3HLzz22z+id7WBwAA6L3xj3a+/5/bd8ut/RcDR56dGAaX+/8wuJr3/7sdyetkAY6VgjMAGHivfP//QGn6QhUCAAB6bqQ5JblidnlvJHK5YjHiTPO1AIVkfrFSnoiItyLi96OFDzTyk80tkwP7DAAAAAAAAAAAAAAAAAAAAAAAAABAS5omkQIAAADHWkTub8mvW8/yHx89N7L3+sCJ5L+jkb0i9M6Pb/7w7ky9vjbZKP/XTnn9R1n5pX5cwQAAAICB8EIv8N/up2/34wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACglx4/uje7PR1m3H98ISLG2sXPx8nm/GQUIuLUv5PI79ouiYihHsQfbvz5SLv4SaNaOyHbxR/uQfyt+/vGj7HsW2gX/3QP4sMge9A4/lxvt//l4r3mvP3+l494Jv+yOh//Yuf4N9Rh/z/TZYx3Hv6i1DH+/Yh38u2PP9vxkw7xz3YZ/xtf39zstCz9ScR429+f5JlYpfryaqm2sXlxcXlmobxQXpmamrwyfXX68vREaX6xUs7+to3xvY/98sl+7T/VIf7YAe0/12X7///w7qMPtZKFdvHPn20T/zc/zdZ4Pn4u++37VJZuLB/fTm+10ru9+/Pfvbtf++c6tP+g///5Ltt/4avf+XOXqwIAh6C2sbk0U6mU145totFLPwLVkDiCiW/39APTNE0b+9QrfE4SR+FraSb6fWQCAAB67elJf79rAgAAAAAAAAAAAAAAAAAAAIPrMB4ntjfm1k4q6cUjtAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeuL9AAAA//+GAdlV") r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x100, 0x52) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r5, 0x8004587d, &(0x7f00000002c0)={@id={0x2, 0x0, @d}}) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f0000000f00)='.\x00', 0x1a5a438, &(0x7f0000001780)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB="9eb5c2474969e91e9d291913bb781ec5b1af0d4feebe2b355fc2af963c9555b0d564ebfe1197b86648de764caad7861a3715e6d77e9f1017671c55b21c7b9c14e40f02", @ANYRESHEX, @ANYRESHEX, @ANYRESHEX=0x0, @ANYBLOB="4c07f18b4a72a428cdf1fcc6a889d51c7d395bfc15396c272d41b4a79dba0739c1c7461ae19481932aa4c03054c8b2442a4c1e4311032bebb0cb70495acfcf1f08735df868c705", @ANYBLOB="37b57cfa7d0121345c29b6064f49a0f95b88671b8e9149556e5ff3c7012f7856b6557bae1d1d61efea623114a0b4b52f68387d2040dd08c5aa753b596ede3f3d637f96752310a389efcd8cf335ca9dbbbc10bda7a16342968c9ab4fd1ac65da604cd9b42d6d0dc0e895e0b2f42822d1b342f88a8d607008d20b22b776a70a07a2c53fc32be094c857279c58542b176bfbcc6c7e9808da687b44a8b21d23cc2f80050f8fd457f5a5595226d2008bcded226ab2e75d00ab5592daa23e809e04c2b370af460ae93b7efc32bf174830779058ad75290b9abb59be5f8859001e651c1d404a5f28eaf3781f2288249ae7b385a9c40929cae3fa5a6f142cd057ebdbc000000e34db2d14a6458499de0819d89f570a72fee0dd8cf744e0daf8f31b1d8edda87296ca7632e1e6e23", @ANYRES16, @ANYRES32, @ANYRESDEC, @ANYRESDEC, @ANYRESHEX, @ANYRES8], 0xb, 0x0, &(0x7f0000000000)) 26.691544465s ago: executing program 1 (id=1889): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000002380)=ANY=[@ANYBLOB], 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r0, 0x18000000000002a0, 0x4, 0x0, &(0x7f0000000640)="b9ff0300", 0x0, 0xe00, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x0, &(0x7f00000001c0)={[{@usrquota}, {@grpjquota}, {@nodelalloc}]}, 0x1, 0x4bc, &(0x7f0000000a40)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x400c800}, 0x84) mkdir(0x0, 0x0) syz_usb_connect$uac1(0x0, 0xa5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./bus\x00', 0x1f5) r2 = open(&(0x7f0000000000)='./file0\x00', 0x1607c0, 0x78e22799f4a46ffe) fcntl$setlease(r2, 0x400, 0x0) close(r2) renameat2(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000940)='./file7/file0\x00', 0x5) syz_emit_ethernet(0x7e, 0x0, 0x0) rename(0x0, &(0x7f0000000180)='./file0/file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) open$dir(&(0x7f0000000000)='./file1\x00', 0x8882, 0xa1) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$setregs(0xd, r3, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44c") ptrace$getregset(0x4205, r3, 0x2, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') creat(&(0x7f0000000140)='./file7/file0\x00', 0x152) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) 24.632640711s ago: executing program 1 (id=1900): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r3, &(0x7f0000000080), 0x10) bind$tipc(0xffffffffffffffff, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000040)={0x842, 0x2}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r4, &(0x7f0000000380)={&(0x7f0000000340)=@name={0x1e, 0x2, 0x2, {{0x1, 0x1}, 0xfffffffc}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x24008884}, 0x0) setsockopt$CAN_RAW_FILTER(r3, 0x65, 0x1, &(0x7f00000001c0)=[{{0x1}, {0x1, 0x1, 0x1, 0x1}}], 0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2182, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/bus/input/devices\x00', 0x0, 0x0) 23.890165361s ago: executing program 1 (id=1902): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/netfilter\x00') getdents64(r1, 0xffffffffffffffff, 0x43) keyctl$set_reqkey_keyring(0xe, 0x2) add_key$keyring(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000040), 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x33}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x70) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="880000001000010729bd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="8f6adde8810106006800348014003500776c616e310000003d43d7a881afc3622623ec0000000000000000140035006c6f00000000000000000000000000000400350076657468305f6d6163767461700800001400350064766d72703100000000000000000000140035007665745c315f746f5f62617461647600"], 0x88}, 0x1, 0x0, 0x0, 0x4c014}, 0x4040084) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000680)={'vlan1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r3, {0x4}, {}, {0xfff3}}}, 0x24}}, 0x800) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)={0x2, 0x4, 0x8, 0x1, 0x80, r1, 0x100000, '\x00', r3, r1, 0x2, 0x3}, 0x50) 23.612109849s ago: executing program 32 (id=1902): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/netfilter\x00') getdents64(r1, 0xffffffffffffffff, 0x43) keyctl$set_reqkey_keyring(0xe, 0x2) add_key$keyring(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000040), 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x33}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x70) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="880000001000010729bd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="8f6adde8810106006800348014003500776c616e310000003d43d7a881afc3622623ec0000000000000000140035006c6f00000000000000000000000000000400350076657468305f6d6163767461700800001400350064766d72703100000000000000000000140035007665745c315f746f5f62617461647600"], 0x88}, 0x1, 0x0, 0x0, 0x4c014}, 0x4040084) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000680)={'vlan1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r3, {0x4}, {}, {0xfff3}}}, 0x24}}, 0x800) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)={0x2, 0x4, 0x8, 0x1, 0x80, r1, 0x100000, '\x00', r3, r1, 0x2, 0x3}, 0x50) 13.441485884s ago: executing program 4 (id=1934): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x162281) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) read$char_usb(r3, &(0x7f00000000c0)=""/192, 0xc0) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, r4, 0x0, 0x4, 0x0) 12.542565889s ago: executing program 4 (id=1935): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) shutdown(r0, 0x1) fsopen(0x0, 0x1) fchdir(0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x600}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) recvfrom(r0, &(0x7f0000000480)=""/110, 0xfffffffffffffe9a, 0x734, 0x0, 0xfffffffffffffecb) 12.272295736s ago: executing program 4 (id=1937): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) close(0x3) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) close(r1) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x7, 0x10001, 0x8, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x65, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(r1) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffffc}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000a40)={{r3, 0xffffffffffffffff}, &(0x7f00000009c0), &(0x7f0000000a00)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r4, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r5, 0x2000000, 0xe, 0x0, &(0x7f0000000600)="c9f7b98600"/14, 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r0, &(0x7f00000006c0), &(0x7f0000000000), 0x2}, 0x20) 11.791997519s ago: executing program 4 (id=1938): ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, 0x0) syz_mount_image$exfat(&(0x7f0000000280), &(0x7f00000000c0)='./file2\x00', 0x4000, &(0x7f00000018c0)=ANY=[], 0xfd, 0x1501, &(0x7f0000002180)="$eJzs3Am4T1X3OPC19t6H62b4JpnP2uvwTYZNkoSSZEiSJCRzQpIkSZK4ZEpCEjLeJHPInG665nnInHTzSpIkJCTZ/+c2/P16h5/3fX/9/vq/d32e5zz2cs7aZ+27nu89w/Pc79ddh1VvVKNKfWaGf4f+bYC//JMEAAkAMBAAcgBAAABlc5bNmb4/i8akf+sk4n9JgxlXugJxJUn/Mzbpf8Ym/c/YpP8Zm/Q/Y5P+Z2zS/4xN+i9EhjYr39WyZdxN3v//f079T5Ll+p8h4D/aIf3/T6P/paOl/xmb9D9jk/5nbNL/jCy40gWIK0w+/xmb9F+IDO0Pf6e84dyVfqct27+wCSGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQ/w+c85cYAPhtfKXrEkIIIYQQQgghxB/Hv3ulKxBCCCGEEEIIIcT/PgQFGgwEkAkyQwJkgUS4CrJCNsgOOSAGV0NOuAZywbWQG/JAXsgH+aEAFIQQCCwwRFAICkMcroMicD0UhWJQHEqAg5JQCm6A0nAjlIGboCzcDOXgFigPFX4+Z7rboTLcAVXgTqgK1aA61IC7oCbcDbXgHqgN90IduA/qwv1QDx6A+tAAGsKD0AgegsbQBJpCM2gOLaDlZfKTc/y9/OehB7wAPaEXJEFv6AMvQl/oB/1hAAyEl2AQvAyD4RUYAkNhGLwKw+E1GAGvw0gYBaPhDRgDY2EcjIcJMBGS4U2YBG/BZHj7oWwwFabBdJgBM2EWvAOzYQ7MhXdhHsyHBZCcZREshiXwHiyF9yEFPoBl8CGkwnJYASthFayGNbAW1sF62AAbYRNshi2wFbbBR7AddsBO2AW7YQ/shY9hH3wC++FTSMPP/sX8s7/Ph24ICKhQoUGDmTATJmACJmIiZsWsmB2zYwxjmBNzYi7MhbkxN+bFvJiE+bEgFkRCQkbGQlgI4xjHIlgEi2JRLI7F0aHDUlgKS+ONWAbLYFksi+WwHJbHClgBb8VbsRJWwspYGatgFayKVbE6Vse78C68G2thLayNtbEO1sG6WBfrYT2sj/WxITbERtgIG2NjbIpNsTk2x5bYElthK2yNrbEttsV22A7bY3vsgB2wI3bETtgJO2Nn7IJdsCt2xW74HD6Hz+Pz+AK+gL2wquqNfbAP9sW+2B8H4AB8CQfhy/gyvoJDcCgOw1fxVXwNR+AZHImjcDSOxkpqLI7D8chqIiZjMmaGSTgZJ+MUnIpTcTrOwJk4C2fhbJyDc/BdnIfzcT4uxIW4GJfgElyK72MKpuAyPIupuBxX4EpchatxFa7FdbgWN+BG3ICbcTNuxa34EX6EO3AH7sJduAf34Mf4MX6Cn+AQTMM0PIAH8CAexEN4CA/jYTyCR/AoHsVjeAyP43E8gSfxFJ7E03gaz+BZPAcA5/E8XsALeBEvpn/4VTqjjMqkMqkElaASVaLKqrKq7Cq7iqmYyqlyqlwql8qtcqu8Kq/Kr/KrgqqgIkWKVaQKqUIqruKqiCqiiqqiqrgqrpxyqpQqpUqr0qqMKqPKqptVOXWLKq8qqDbuVnWrqqTausrqDlVFVVFVVTVVXdVQNVRNVVPVUrVUbVVb1VF1VF11v6qnemN/bKDSO9NIDcXGahg2Vc1Uc9VCvYYPq1ZqBLZWbVRb9agahSOxvWrlOqgnVEc1Djupp9R4fFp1UROxq3pWdVPPqe7qedVDtXY9VS81BXurPmo69lX9VH81QM3Gaiq9Y9XVK+r5zEPVMPWqWoyvqRHqdTVSjVKj1RtqjBqrxqnxaoKaqJLVm2qSektNVm+rKWqqmqamqxlqppql3lGz1Rw1V72r5qn5aoFaqBapxWqJek8tVe+rFPWBWqY+VKlquVqhVqpVarVao9aqdWq92qA2qk1qs9qitqpt6iO1Xe1QO9UutVvtUXvVx2qf+kTtV5+qNPWZOqD+og6qz9Uh9YU6rL5UR9RX6qj6Wh1T36jj6lt1Qp1Up9R36rT6Xp1RZ9U59YM6r35UF9RP6qLyCjRqpbU2OtCZdGadoLPoRH2Vzqqz6ew6h47pq3VOfY3Opa/VuXUendfk0/l1AV1Qh5q01awjXUgX1nF9nS6ir9dFdTFdXJfQTpfUpfQNurS+UZfRN+my+mZdTt+iy+sKuqIHfZuupG/XlfUduoq+U1fV1XR1XUPfpWvqu3UtfY+ure/VdfR9uq6+X9fTD+j6uoFuqB/UjfRDurFuopvqZrq5bqFb6od1K/2Ibq3b6Lb6Ud1OP6bb68d1B/2E7qif1J30U7qzflp30c/orvpZ3U0/p7vrn/RF7XVP3Usn6d66j35R99X9dH89QA/UL+lB+mU9WL+ih+iheph+VQ/Xr+kR+nU9Uo/So/Ubeoweq8fp8XqCnqiT9Zt6kn5LT9Zv6yl6qp6mp+sZeqbu/+tMc/+J/Lf+Tv7gn8++VW/TH+nteofeqXfp3XqP3qv36n16n96v9+s0naYP6AP6oD6oD+lD+rA+rI/oI/qoPqqP6WP6uD6uT+iT+gf9nT6tv9dn9Fl9Vv+gz+vz+sKvPwMwaJTRxpjAZDKZTYLJYhLNVSaryWaymxwmZq42Oc01Jpe51uQ2eUxek8/kNwVMQRMaMtawiUwhU9jEzXWmiLneFDXFTHFTwjhT0pQyN/yP8y9XX0vT0rQyrUxr09q0NW1NO9POtDftTQfTwXQ0HU0n08l0Np1NF9PFdDVdTTfTzXQ33U0P08P0ND1NkkkyfcyLpq/pZ/qbAWageckMMoPMYDPYDDFDzDAzzAw3w80IM8KMNCPNaDPajDFjzDgzzkwwE0yyz2EmmUlmsplsppgpZtrAHGaGmWFmmVlmtplt5pq5Zp6ZZxaYBWaRWWSWmCVmqVlqUkyKWWaWmVSz3Cw3K81Ks9qsNmvNWrPerDcbzUaz2Ww2qWab2Wa2m+1mp9lpdpvdZq/Za/aZfWa/2W/STJo5YA6Yg+agOWQOmcPmsDlijpij5qg5Zo6Z4+a4OWFOmFPmlDltTpsz5ow5Z86Z8+a8uWAumIvmYvptX6ACFZjABJmCTEFCkBAkBolB1iBrkD3IHsSCWJAzyBnkCq4Ncgd5grxBviB/UCAoGIQBBTbgIAoKBYWDeHBdUCS4PigaFAuKByUCF5QMSgU3BKWDG4MywU1B2eDmoFxwS1A+qBBUDG4NbgsqBbcHlYM7girBnUHVoFpQPagR3BXUDO4OagX3BLWDe4M6wX1B3eD+oF7wQFA/aBA0DB4MGgUPBY2DJkHToFnQPGgRtPxD5/f+TJ5HXM+wV5gU9g77hC+GfcN+Yf9wQDgwfCkcFL4cDg5fCYeEQ8Nh4avh8PC1cET4ejgyHBWODt8Ix4Rjw3Hh+HBCODFMDt8MJ4VvhZPDt8Mp4dRwWjA9nBHODGeF74Szwznh3PDdcF44P1wQLgwXhYtD/OWWGFLCD8Jl4Ydharg8XBGuDFeFq8M14dpwXbg+3BBuDDeFm8sO+uXQcHu4I9wZ7gp3h3vCveHH4b7wk3B/+GmYFn4WHgj/Eh4MPw8PhV+Eh8MvwyPhV+HR8OvwWPhNeDz8NjwRngxPhd+Fp8PvwzPh2fBc+EN4PvwxvBD+FF4MffrNffrlnQwZykSZKIESKJESKStlpeyUnWIUo5yUk3JRLspNuSkv5aX8lJ8KUkFKx8RUiApRnOJUhIpQUSpKxak4OXJUikpRaSpNZagMlaWyVI7KUXkqTxWpIt1Gt9HtdDvdQXfQnXQnVaNqVINqUE2qSbWoFtWm2lSH6lBdqkv1qB7Vp/rUkBpSI2pEjakxNaWm1JyaU0tqSa2oFbWm1tSW2lI7akftqT11oA7UkTpSJ+pEnakzdaEu1JW6UjfqRt2pO/WgHtSTelISJVEf6kN9qS/1p/40kAbSIBpEg2kwDaEhNIyG0XAaTiNoBI2kUTSa3qAxNJbG0XiaQBMpmZJpEk2iyTSZptAUmkbTaAbNoFk0i2bTbJpLc2kezaMFtIAW0SJaQktoKS2lFEqhZbSMUimVVtAKWkWraA2toXW0jjbQBtpEm2gLbaFttI2203baSTtpN+2mvbSX9tE+2k/7KY3S6AAdoIN0kA7RITpMh+kIHaGjdJSO0TE6TsfpBJ2gU3SKTtNpOkNn6Bydo/P0I12gn+gieUqwWWyivcpmtdlsdpvD/nWc1+az+W0BW9CGNrfN87uYrLVFbTFb3Jawzpa0pewNfxOXtxVsRXurvc1Wsrfbyra8zQL/Na5p77a17D22tr3X1rB3/S6uY++zde1Dtp5tYuvbZrahbWEb2YdsY9vENrXNbHPbwrazj9n29nHbwT5hO9on/yZeat+36+x6u8FutPvsJ/ac/cEetV/b8/ZH29P2sgPtS3aQfdkOtq/YIXbo72MAO9q+YcfYsXacHW8n2Il/E0+z0+0MO9POsu/Y2XbO38RL7Ht2nk2xC+xCu8gu/jlOrynFfmCX2Q9tql1uV9iVdpVdbdfYtf+31pV2s91it9q99mO73e6wO+0uu9vu+TlOX8d++6lNs5/ZI/Yre9B+bg/ZY/aw/fLnOH19x+w39rj91p6wJ+0p+509bb+3Z+zZn9efvvbv7E/2ovUWGFmxZsMBZ+LMnMBZOJGv4qycjbNzDo7x1ZyTr+FcfC3n5jycl/Nxfi7ABTlkYsvMERfiwhzn67gIX89FuRgX5xLsuCSX4hu4NN/IZfgmLss3czm+hctzBa7It/JtXIlv58p8B1fhO7kqV+PqXIPv4pp8N9fie7g238t1+D6uy/dzPX6A63MDbsgPciN+iBtzE27Kzbg5t+CW/DC34ke4Nbfhtvwot+PHuD0/zh34Ce7IT3Infoo789PchZ/hrvwsd+PnuDs/zz34Be7JvTiJe3MffpH7cj/uzwN4IL/Eg/hlHsyv8BAeysP4VR7Or/EIfp1H8igezW/wGB7L43g8T+CJnMxv8iR+iyfz2zyFp/I0ns4zeCbP4nd4Ns/hufwuz+P5vIAX8iJezEv4PV7K73MKf8DL+ENO5eW8glfyKl7Na3gtr+P1vIE38ibezFt4K2/jj3g77+CdvIt38x7eyx/zPv6E9/OnnMaf8QH+Cx/kz/kQf8GH+Us+wl/xUf6aj/E3fJy/5RN8kk/xd3yav+czfJbP8Q98nn/kC/wTX2TPEGGkIh2ZKIgyRZmjhChLlBhdFWWNskXZoxxRLLo6yhldE+WKro1yR3mivFG+KH9UICoYhRFFNuIoigpFhaN4dF1UJLo+KhoVi4pHJSIXlYxKRTdEpaMbozLRTVHZ6OaoXHRLVD6qEFWMbo1uiypFt0eVozuiKtGdUdWoWlQ9qhHdFdWM7o5qRfdEtaN7ozLRfVHd6P6oXvRAVD9qEDWMHowaRQ9FjaMmUdOoWdQ8ahG1jB6OWkWPRK2jNlHb6NGoXfRY1D56POoQPRF1jJ68tL9Y8MvV9K/2J0W9I/3rG7J79KL44viS+HvxpfH34ynxD+LL4h/GU+PL4yviK+Or4qvja+Jr4+vi6+Mb4hvjm+Kb41viW+Pe18gMDtMfhMG4wGVymV2Cy+IS3VUuq8vmsrscLuaudjndNS6Xu9bldnlcXpfP5XcFXEEXOnLWsYtcIVfYxd11roi73hV1xVxxV8I5V9KVci1cS9fStXKPuNaujWvrHnWPusfcY+7xhF8Ld53cU66ze9p1cc+4Z9yzrpt7znV3z7se7gXX0/VySS7J9XF9XF/X1/V3/d1AN9ANcoPcYDfYDXFD3DA3zA13w90IN8KNdCPdaDfajXFj3Dg3zk1wE1yyS3aT3CQ32U12U9wUN81NczPcDDfLzXKz3Ww3181189w8t8AtcIvcIrfELXFL3VKX4lLcMrfMpbpUt8KtcKvcKrfGrXHr3Dq3wW1wm9wmt8VtcdvcNrfdbXc73U632+12e91et8/tc/vdfpfm0twBd8AddAfdIfeFO+y+dEfcV+6o+9odc9+44+5bd8KddKec16fd9+6MO+vOuR/cefeju+B+chedd8mxN2OTYm/FJsfejk2JTY1Ni02PzYjNjM2KvRObHZsTmxt7NzYvNj+2ILYwtii2OLYk9l5saez9WErsg9iy2Iex1Njy2IrYytiq2OqY9wW2R76QL+zj/jpfxF/vi/pivrgv4Z0v6Uv5G3xpf6Mv42/yZf3Nvpy/xZf3FXxF38Q39c18c9/Ct/QP+1b+Ed/at/Ft/aO+nX/Mt/eP+w7+Cd/RP+k7+ad8Z/+07+Kf8V39s/N/7bLv4V/wPX0vn+R7+z7+Rd/X9/P9/QA/0L/kB/mX/WD/ih/ih/ph/lU/3L/mR/jX/Ug/yo/2b/gxfqwf58f7CX6iT/Zv+kn+LT/Zv+2n+Kl+mp/uZ/iZfpZ/x8/2c/xc/66f5+f7BX6hX+QX+yX+Pb/Uv+9T/Ad+mf/Qp/rlfoVf6Vf51X6NX+vX+fV+g9/oN/nNfovf6rf5j/x2v8Pv9Lv8br/H7/Uf+33+E7/ff+rT/Gf+gP+LP+g/94f8F/6w/9If8V/5o/5rf8x/44/7b/0Jf9Kf8t/50/57f8af9ef8D/68/9Ff8D/5i/I3a0IIIYQQ/xR9mf29/87/qV+3dH0AINuOfIf/es5NuX8Z91P7OsYA4IleXRv8tjVokJSU9OuxqRqCwgsBIHYp/+fvH/g1Xg5t4THoAG2g9N+tr5+q+PN93383f/xmgESALL/lpD8eJcJfz3/jP5i/yXt8ufkXAhQtfCkn/US/xZfmL/MP5t/T7jLzZ/k8GaD1f8nJCpfiS/OXgkfgSejwuyOFEEIIIYQQQohf9FPnu13u+Tb9+Ty/uZSTGS7Fl3s+v4zKf8QahBBCCCGEEEII8d97+rnujz/coUObzv/Jg8x/jjL+BAMEgD9BGTL48w+u9G8mIYQQQgghxB/t0k3/la5ECCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYTIuP79bwhT//TBV3qNQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghxJX2fwIAAP//5g1V0w==") openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, &(0x7f00000000c0)=""/31, 0x1f) getdents(r0, 0x0, 0x58) 11.543088456s ago: executing program 4 (id=1939): socket$key(0xf, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'veth0_to_team\x00'}) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) listen(0xffffffffffffffff, 0x4) writev(0xffffffffffffffff, &(0x7f00000000c0), 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x98}, 0x1, 0x0, 0x0, 0x4008885}, 0x4080) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r4, &(0x7f0000001040)={&(0x7f0000000040)={0x2, 0xffff, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f00000001c0)="2d0000008058", 0x6}], 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000830b040a"], 0x40}, 0x20008024) 8.884847318s ago: executing program 2 (id=1946): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x8, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000004000000850000006100000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000bc02000000000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r1, 0x18000000000002a0, 0xe40, 0x0, &(0x7f0000000300)="d2ff03076003008cb89e08f086dd", 0x0, 0xd5b1, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 8.245289526s ago: executing program 0 (id=1947): socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xa) r0 = socket$packet(0x11, 0x3, 0x300) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_mems\x00', 0x275a, 0x0) socket(0xa, 0x3, 0x3a) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x2, 0x300) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x18a) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000001200)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9fffff5ffffffff092403f3", @ANYRES8=r1, @ANYRES64=r0], 0x0) 7.987808833s ago: executing program 2 (id=1949): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000004080)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x120, 0x120, 0x4c8, 0x4c8, 0x3b0, 0x5e8, 0x5e8, 0x5e8, 0x5e8, 0x5e8, 0x6, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x30}, @empty, [0xffffff00, 0xffffffff, 0xff000000, 0xffffff00], [0x0, 0xff000000, 0xffffffff, 0x100000100], 'virt_wifi0\x00', 'veth1_to_bridge\x00', {}, {}, 0x33, 0x10, 0xd, 0x4}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x5, 0x9, 0x1, 0x5, 0x1, 0x4, 0xb, 0x2]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @empty}, @mcast1, [0x0, 0xff, 0xff, 0xffffffff], [0x0, 0xff000000, 0xffffff00, 0xff], 'geneve1\x00', 'dvmrp1\x00', {}, {0xff}, 0x33, 0x0, 0x1, 0x53a5583bd41996b}, 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00', 0x0, {0x6, 0x40}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558) 7.938097734s ago: executing program 2 (id=1950): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file2\x00', 0x8, &(0x7f0000000080)={[{@nodioread_nolock}, {@sb={'sb', 0x3d, 0x1}}]}, 0x4, 0x523, &(0x7f00000018c0)="$eJzs3cFvG1kZAPBvnLhJs+mmC3sABGxZFgqq6iTubrTqhfYCQlUlRMWJQxsSN4pi11Hsiib0kB65V6ISJ+A/4MYBqScO3LjBjUs5IBWoQA0SB6MZT1I3sZNAnbiJfz9pMvPeTP29F/e953mR5wUwtC5ExGZEnImIOxExlecn+RbX2lt63csXDxe2XjxcSKLVuvX3JDuf5kXHv0m9k7/meER8/zsRP0r2xm2sb6zMV6uVtTw93aytTjfWNy4vF/Kc8tzs3MynVz4p962uH9R+/fzbyzd+8NvffOnZHza/+ZO0WJM/PZed66xHP7WrXozJjrzRiLhxFMEGZDT//8PJk7a2z0TEh1n7n4qR7N0EAE6zVmsqWlOdaQDgtEvv/ycjKZTyuYDJKBRKpfYc3vsxUajWG81LU/X79xYjm8M6H8XC3eVqZSafKzwfxSRNz2bHr9Ll19KPK1ci4r2IeDx2NjtfWqhXFwf5wQcAhtg7u8b/f421x/9OxUEVDgA4OuODLgAAcOyM/wAwfIz/ADB8/ofx37cDAeCUcP8PAMPH+A8Aw+fA8f/R8ZQDADgW37t5M91aW+3nX28/qfvyYqWxUqrdXygt1NdWS0v1+lK1UlpotQ56vWq9vjr78U6ysb5xu1a/f695e7k2v1S5XfEsAQAYvPc+ePqndNDfvHo226JjLQdjNZxuhUEXABiYkUEXABgY3+eB4XWIe3zTAHDKdVmity2fIEh6XfDE4q9wUl38vPl/GFZvMv9v7gBOtv9v/v9bfS8HcPyM4TC8Wq3Emv8AMGTM8QM9//6f6/mIkCf9LwsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcFJPZlhRK2Vrgm+nPQqkUcS4izkcxubtcrcxExLsR8cex4lianh10oQGAN1T4a5Kv/3Vx6qPJ3WfPJP8ey/YR8eOf3/rZg/lmc202zf/HTn7zSZp/trlWPjOICgAAna7tzcrG73K+77iRf/ni4cL2dpxFfH69vbhoGncr39pnRmM0249HMSIm/pnk6bb088pIH+JvPoqIz23XfzwedESYzOZA2iuf7o6fxj7X9/idv//d8Quv1beQnUv3xex38dnYVTjgQE+vt/vJvO2lTTxvf4W4kO27t//xrId6c2n/lzbXrT39X2Gn/xvZEz/J2vyFnfT+JXn+8e++uyezNdU+9yjiC6Pd4ic78ZPu/W/xo0PW8c9f/PKHvc61fhFxsWv9t1ekrmXd7HSztjrdWN+4vFybX6osVe6Vy3OzczOfXvmkPJ3NUbd//r5bjL9dvfRur/hp/Sd6xB/fv/7xtUPW/5f/ufPDr+wT/xtf7f7+v79P/HRM/Poh489PXOu5fHcaf7FH/Q94/+PSIeM/+8vG4iEvBQCOQWN9Y2W+Wq2sHXCQftY86BoHhz9I7+3fgmJkB7EZ0a8XzCYlIqLrNekn6rejykd1kAws+q/6/YKD7pmAo/aq0Q+6JAAAAAAAAAAAAAAAQC+N9Y2Vse7f1urbwaDrCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwOn13wAAAP//KHnENg==") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, 0x0, 0x0) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r3, &(0x7f0000000740)="98e2d24a2d8ce4a509d138cc91611ed14f69b7d7aebfeca49d719bfbb537aef2a00ebefaf03915f43ec35efc4f2f060cab2fa2b5236842aaac0b9519376ea044a920d446a5c2a54c1ff847b71d1aab9f7b8323243230b8c20dc28ce7715a595fb6b0b71597c4888d791ba8eab8a133f969e0594d70a1b98e61bed565e34f3cd997040fe04a3259c409f0f5e0508f45bd23bf63ba65b20df98c34e561b6e820f83ecf47add09fc8bb21b550dc14233bcb5f16194ae6", 0xb5, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000340)=[@timestamp, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @timestamp, @window={0x3, 0xfffe}, @sack_perm], 0x2000000000000061) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000240)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x43}}, 0xfffffec4) r5 = socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@multicast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x27, 0x1c, 0x3fc, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @address_request}}}}, 0x0) sendmsg(r5, &(0x7f0000000640)={&(0x7f00000000c0)=@caif=@dgm={0x25, 0xd}, 0x2c, &(0x7f00000005c0)=[{&(0x7f0000000000)="4ba72c4cfd81685544f46c3f0800", 0x3e}], 0x2, 0x0, 0x0, 0x11000000}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r3, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) rt_tgsigqueueinfo(r0, 0xffffffffffffffff, 0x1d, 0x0) socket(0x10, 0x3, 0x0) syz_open_dev$vcsa(0x0, 0x1, 0x40402) lsetxattr$trusted_overlay_opaque(&(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000340), 0x2, 0x0) 6.847638234s ago: executing program 2 (id=1951): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001180)=ANY=[@ANYBLOB="12010000090003206d0414c34000ffff000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000640)=ANY=[@ANYBLOB="240000001800010900000000ffdbdf2502200000ff0000080000000208000100ac14141e0231"], 0x24}}, 0x0) r2 = fsopen(&(0x7f0000000000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) r5 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_pidfd_open(r5, 0x0) setns(r6, 0x24020000) mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f00000000c0)='sysfs\x00', 0x989, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000540)={0x24, &(0x7f00000003c0)={0x0, 0xa, 0x9, {0x9, 0x21, "4d80cb962c42e4"}}, 0x0, &(0x7f00000004c0), &(0x7f0000000500)={0x0, 0x21, 0x9, {0x9, 0x21, 0x6, 0x5, 0x1, {0x22, 0x5b9}}}}, 0x0) 6.847276784s ago: executing program 4 (id=1952): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000000)=0x100, 0x4) setsockopt$inet6_int(r0, 0x29, 0x33, &(0x7f00000000c0)=0xfa0, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8f}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r5, 0x400455c8, 0x4) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000019080)=0x30) ioctl$KDADDIO(r5, 0x4b34, 0x4) get_robust_list(r2, 0x0, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x52) ioctl$FITRIM(r6, 0xc0185879, 0x0) sendmsg$nl_route(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="200000001e00431b000000000000000007000000", @ANYRES32=0x0, @ANYBLOB="00000000000000b5"], 0x20}, 0x1, 0x0, 0x0, 0x14}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000580)=ANY=[@ANYBLOB="12015002091e182001072840f009040c090002060006"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) 5.847718891s ago: executing program 3 (id=1953): socket$inet6(0xa, 0x2, 0x0) r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) getsockname$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=@newlink={0x40, 0x10, 0x437, 0x2, 0x0, {0x0, 0x0, 0x0, r1, 0x544c3}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_IPTUN_COLLECT_METADATA={0x4}, @IFLA_IPTUN_FWMARK={0x8, 0x14, 0x2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x404c8c1}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5c0c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0x100577, 0x2, 0x0, 0x42}, &(0x7f0000000400), &(0x7f0000011000), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r5, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r5, 0x6, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0), 0x0}, 0x20) r6 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x4000000022383, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40081271, &(0x7f0000000100)=0x200) ioctl$VIDIOC_CREATE_BUFS(r6, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x2, {0x5, @vbi={0x0, 0x0, 0x4, 0x0, [0x200000], [0x8200, 0x5], 0x1}}}) ioctl$VIDIOC_QBUF(r6, 0xc058565d, &(0x7f0000000200)=@fd={0x200000, 0x5, 0x4, 0x0, 0x3, {}, {0x5, 0x0, 0xff, 0x0, 0x0, 0xfe, "8000"}, 0x0, 0x2, {}, 0x20800}) r7 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) write$cgroup_int(r7, &(0x7f0000000080)=0x3, 0x12) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) 5.822544782s ago: executing program 5 (id=1903): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast2, 0x2}, 0x1c) 5.730757814s ago: executing program 5 (id=1954): r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0x10, 0x2, 0x0) io_setup(0x43, &(0x7f0000000140)) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="190000000400000002000000020000000000", @ANYRES32=0x1, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000100000000000000"], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_getscheduler(r1) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40095505, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[], 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000240)={r2, &(0x7f0000000540), &(0x7f0000000040)=""/84}, 0x20) r3 = syz_open_procfs(0x0, &(0x7f0000000280)='coredump_filter\x00') r4 = socket$l2tp(0x2, 0x2, 0x73) getsockopt$sock_buf(r4, 0x1, 0x1c, 0x0, &(0x7f0000000100)=0xffda) preadv(r3, &(0x7f0000000000)=[{&(0x7f0000000100)=""/120, 0x78}], 0x1, 0x4, 0x0) write(r3, &(0x7f0000000040)="1c000000210025123510dbda164216270bdc3e51b667ff0003", 0x19) sendmmsg$sock(r0, &(0x7f0000000000)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[@txtime={{0x18, 0x1, 0x3d, 0x800000000}}], 0x18}}], 0x1, 0x800) 5.51202645s ago: executing program 5 (id=1955): timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) timer_settime(r0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=@base={0x4, 0x4, 0x4, 0x10005}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r1, 0x58, &(0x7f0000000340)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={r2}, 0xc) 5.49532789s ago: executing program 2 (id=1956): r0 = syz_open_dev$radio(0x0, 0x0, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x162281) r4 = dup2(r0, r0) read$char_usb(r4, &(0x7f00000000c0)=""/192, 0xc0) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, r5, 0x0, 0x4, 0x0) 4.654349284s ago: executing program 0 (id=1957): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f00000083c0)={{0x1, 0x0, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r2, 0x80585414, &(0x7f0000000180)) clock_gettime(0x2, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x4c}]}, &(0x7f0000000080)='syzkaller\x00'}, 0x80) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)={0x1c, r4, 0x0, 0xfffffffd, 0x25dfdbff, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8090}, 0x880) close(0xffffffffffffffff) ioctl$sock_SIOCBRDELBR(r3, 0x89a2, &(0x7f0000000000)='bridge0\x00') 4.551861076s ago: executing program 2 (id=1958): socket$inet6_icmp(0xa, 0x2, 0x3a) r0 = socket(0x10, 0x803, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, 0x0, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000014c0), 0x3ffffffffffff42, 0x162, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x4, &(0x7f0000130000/0x800000)=nil) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f000001bd00), 0x0, 0x0) 2.882426832s ago: executing program 3 (id=1959): bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) close(0x3) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) close(r0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x7, 0x10001, 0x8, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x65, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(r0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0xe0, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffdb4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe15, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8, 0xffffffffffffff4b, 0x0}}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffffc}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000a40)={{r2, 0xffffffffffffffff}, &(0x7f00000009c0), &(0x7f0000000a00)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r3, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r2}, 0x0, 0x0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000740)={r2, &(0x7f0000000000), &(0x7f00000000c0)=""/109}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000600)="c9f7b98600"/14, 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.656501858s ago: executing program 0 (id=1960): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8084}, 0x4004014) r1 = socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000040)={@remote}, 0x14) 2.506892242s ago: executing program 3 (id=1961): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) truncate(&(0x7f0000000140)='./file2\x00', 0x5c00) 2.382753915s ago: executing program 3 (id=1962): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) ptrace$ARCH_GET_FS(0x1e, r0, &(0x7f0000000040), 0x1003) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000001d711849000000000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_skb=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES64=0x0], 0x10) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) socket(0x10, 0x3, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001300)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x5, 0xa}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x3, 0x5}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0x5, 0xffff}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x488d8}, 0x20004804) 1.82576899s ago: executing program 5 (id=1963): socket$key(0xf, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'veth0_to_team\x00'}) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) listen(0xffffffffffffffff, 0x4) writev(0xffffffffffffffff, &(0x7f00000000c0), 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x98}, 0x1, 0x0, 0x0, 0x4008885}, 0x4080) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r2, &(0x7f0000001040)={&(0x7f0000000040)={0x2, 0xffff, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f00000001c0)="2d0000008058", 0x6}], 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000830b040a"], 0x40}, 0x20008024) 1.721461173s ago: executing program 0 (id=1964): sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000100)={0x1c, 0x2, 0x3, 0x101, 0x0, 0x0, {0x4, 0x0, 0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2a}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48841}, 0x2000c010) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000000203030100000000000000000400000a"], 0x1c}, 0x1, 0x0, 0x0, 0x40841}, 0x2000c010) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000000203010100000000000000000200000a090002"], 0x20}, 0x1, 0x0, 0x0, 0x20080041}, 0x20008090) 1.418888532s ago: executing program 3 (id=1965): r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0x10, 0x2, 0x0) io_setup(0x43, &(0x7f0000000140)) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="190000000400000002000000020000000000", @ANYRES32=0x1, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000100000000000000"], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_getscheduler(r1) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40095505, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[], 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000240)={r2, &(0x7f0000000540), &(0x7f0000000040)=""/84}, 0x20) r3 = syz_open_procfs(0x0, &(0x7f0000000280)='coredump_filter\x00') r4 = socket$l2tp(0x2, 0x2, 0x73) getsockopt$sock_buf(r4, 0x1, 0x1c, 0x0, &(0x7f0000000100)=0xffda) preadv(r3, &(0x7f0000000000)=[{&(0x7f0000000100)=""/120, 0x78}], 0x1, 0x4, 0x0) write(r3, &(0x7f0000000040)="1c000000210025123510dbda164216270bdc3e51b667ff0003", 0x19) sendmmsg$sock(r0, &(0x7f0000000000)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[@txtime={{0x18, 0x1, 0x3d, 0x800000000}}], 0x18}}], 0x1, 0x800) 1.348310913s ago: executing program 0 (id=1966): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) ptrace$ARCH_GET_FS(0x1e, r0, 0x0, 0x1003) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = fsopen(&(0x7f0000000100)='selinuxfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000000c0)={@cgroup, 0xffffffffffffffff, 0x11}, 0x10) syz_open_procfs(0x0, &(0x7f0000000280)='gid_map\x00') r4 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) openat$cgroup_ro(r5, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x5, 0x5, 0x9}}]}}, &(0x7f0000000180)=""/129, 0x32, 0x81, 0x1}, 0x28) 1.329330354s ago: executing program 5 (id=1967): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f0000000380)={[{@grpid}, {@barrier}, {@data_err_abort}, {@discard}, {@nouser_xattr}, {@nodelalloc}, {@nobarrier}, {@orlov}]}, 0x4, 0xbaf, &(0x7f0000004200)="$eJzs3M1rXFUbAPDn3ny2zftO+vIi1k0jIi2o07SSYotgKxU3LgTdCg3ppIRMP0giNWkWE/0HRF0LbgS1KF3YdTcKbt1o3VpcCEVioyCikTsfSWxmkrSd5Ibk94Mz95w5d+Z5nrlM7j0wNwHsWgPZQxpxICLOJhGF+vNpRHRXe70Rldp+C/OzI7/Pz44ksbj42i9JJBFxd352pPFeSX27rz7ojYhvX0zif++sjjs5PTM+XC6XJurjI1MXLh+ZnJ55ZuzC8PnS+dLFo8efGzo2dHzwxFDbav3jx1M3fnv85Z8qf37617Vf3/84iVPRV59bWUe7DMTA0meyUmdEDLc7WE466vWsrDPpXOdF6SYnBQBAS+mKa7hHohAdsXzxVoivvss1OQAAAKAtFjsiFgEAAIAdLrH+BwAAgB2u8TuAu/OzI42W7y8Sttad0xHRX6t/od5qM51RqW57oysi9t5NYuVtrUntZQ9tICJu/3Dii6zFJt2HvJbKXEQ82uz4J9X6+6t3ca+uP42IwTbEH7hnvN3qf7q7df2n2hA/7/oB2J1unq6dyFaf/9Kl659ocv7rbHLuehB5n/8a138Lq67/luvvaHH99+oGY1z95MMrreay+p+/8dLnjZbFz7YPVdR9uDMX8Vhns/qTpfqTFvWf3WCMwt9XSq3m8q5/8aOIQ9G8/oZk7f9PdGR0rFwarD02jTH3zdBnreLnXX92/Pe2qH+94395gzHeOHPmequ59etPf+5OXq/2uuvPvDU8NTVxNKI7eWX188fqN7S30Nin8R5Z/YefWPv736z+LESl/jlka4G5+jYbv31PzBeuXf1yrfqztV+ex//cAx7/dzcY48mv3zvcam7l+jdrWfzbSW0tDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANaUT0RZIWl/ppWixG7IuI/8fetHxpcuqp0UtvXjyXzUX0R1c6OlYuDUZEoTZOsvHRan95fOye8bMRsT8iPijsqY6LI5fK5/IuHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCX7IqIvkrQYEWlELBTStFjMOysAAACg7frzTgAAAADYdNb/AAAAsPNZ/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDJ9h+8eSuJiMrJPdWW6a7PdeWaGbDZ0rwTAHLTkXcCQG46804AyM19rvFdLsAOlKwz39typqftuQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwfR06cPNWEhGVk3uqLdNdn+tq+oqDW5gdsJnSvBMActOx1mTn1uUBbD1fcdi9mq/xgd0kWWe+d3mfyr9nejYtJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC2n75qS9JiRKTVfpoWixH/iYj+6EpGx8qlwYj4b0R8X+jqycY9eScNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA201Oz4wPl8ulCR0dnXw7yfZIo9bJ+y8TAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5mJyeGR8ul0sTk3lnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAORtcnpmfLhcLk1soHP9fnZe0cm7RgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8vNPAAAA///5ZQ4Q") chdir(&(0x7f0000000240)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file2\x00', 0xa00010, &(0x7f00000001c0), 0x21, 0x4bf, &(0x7f00000009c0)="$eJzs3U9vVF0ZAPDn3nbon7fv26Is1KggomgIM+0AlbDCjcYQEiNx5QJqOzRNZzpNZ4q0sijfwUQSV7rwA7gwcWHCyr073bnBhQkq0VATF2PmzhQKnSlF2s6b3t8vObn33DOd5zyd3HPaM+2cAHLrXERsRcSpiLgXEZPd60m3xM1OaT/u5YtH89svHs0n0Wrd+UeStbevxa6vafuo+5yjEfGD70b8ONkbt7GxuTxXrVbWuvVSs7ZaamxsXl6qzS1WFisr5fLszOz09SvXyoeW69nab55/Z+nWD3//uy89++PWN3/a7tZEt213Hoepk3rhVZy24Yi4dRTBBmCom8+pQXeE/0saEZ+JiPPZ/T8ZQ9mrCQCcZK3WZLQmd9cBgJMuzdbAkrQYUeicp2mx2FnDOxPjabXeaF66X19fWeislU1FIb2/VK1Md9cKp6KQtOsz2fnrevmt+pWIOB0RPxsZy+rF+Xp1YZA/+ABAjn30ev7P3gv490hn/gcATrjRQXcAADh25n8AyB/zPwDkj/kfAPLH/A8A+WP+B4D8Mf8DQK58//btdmltdz//euHBxvpy/cHlhUpjuVhbny/O19dWi4v1+mL2mT21dz1ftV5fnbka6w9LzUqjWWpsbN6t1ddXmnezz/W+WykcS1YAwH5On3365yQitm6MZSV27eVgroaTLR10B4CBGRp0B4CBsdsX5Jff8YEeW/S+ofMnQmN7G54cTX+Ao3fx89b/Ia+s/0N+Wf+H/LL+D/nVaiX2/AeAnLHGDxzs/f8evP8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAjk1kJUmL3b3AJyJNi8WIjyNiKgrJ/aVqZToiPomIP40URtr1mUF3GgD4QOnfku7+XxcnL0y83Xoq+c9IdoyIn/zizs8fzjWbazPt6//sXP/WWMST7vXyIPoPAHk09F6P3pmnd+bxHS9fPJrfKYffx/6ef7uzuWg77na3dFqGYzg7jkYhIsb/lXTrHcl7Z97b1uOI+Fyv/JNsbWSqu/Pp2/HbsT8+1vjpG/HTrK1zbH8vPnsIfYG8edoef272uv/SOJcde9//o9kI9eF2xr/tPeNf+mr8G+oz/p07SICxX0dc/cP3+sZ/HPGF4V7xk1fxkz7xLxwwx7988cvn+7W1fhlxMXrH3x2r1Kytlhobm5eXanOLlcXKSrk8OzM7ff3KtXIpW6Mu7axU7/X3G5c+2S//8T7xR9+R/9cOmP+v/nvvR1/ZJ/43vtr79T+zT/z2nPj1A8afG/9t3+272/EX+uT/rtf/0gHjP/vr5sIBHwoAHIPGxubyXLVaWRv0yU6HPi39ceIk1yeDHZeAo/f6ph90TwAAAAAAAAAAAAAAgH6O49+JBp0jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ9f/AgAA//9gOtV4") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) r0 = creat(&(0x7f0000000380)='./bus\x00', 0x0) io_setup(0x202, &(0x7f0000000200)=0x0) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000680)='./bus\x00', 0x0, 0x5000, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x8e18, 0x2, 0x0, 0x0, 0xa, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780800d1cbf7966d61f53dc17769048b0000fd0c000000000000000000000000000000000200000000000000000000000000008000", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) io_setup(0x800, &(0x7f0000000440)) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x100000, 0x16}]) 636.562823ms ago: executing program 0 (id=1968): socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xa) r0 = socket$packet(0x11, 0x3, 0x300) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_mems\x00', 0x275a, 0x0) socket(0xa, 0x3, 0x3a) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x2, 0x300) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x18a) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000001200)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9fffff5ffffffff092403f3", @ANYRES8=r1, @ANYRES64=r0], 0x0) 636.109903ms ago: executing program 3 (id=1969): socket$inet6(0xa, 0x2, 0x0) r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) getsockname$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=@newlink={0x40, 0x10, 0x437, 0x2, 0x0, {0x0, 0x0, 0x0, r1, 0x544c3}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_IPTUN_COLLECT_METADATA={0x4}, @IFLA_IPTUN_FWMARK={0x8, 0x14, 0x2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x404c8c1}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5c0c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0x100577, 0x2, 0x0, 0x42}, &(0x7f0000000400), &(0x7f0000011000), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r5, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r5, 0x6, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0), 0x0}, 0x20) r6 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x4000000022383, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40081271, &(0x7f0000000100)=0x200) ioctl$VIDIOC_CREATE_BUFS(r6, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x2, {0x5, @vbi={0x0, 0x0, 0x4, 0x0, [0x200000], [0x8200, 0x5], 0x1}}}) ioctl$VIDIOC_QBUF(r6, 0xc058565d, &(0x7f0000000200)=@fd={0x200000, 0x5, 0x4, 0x0, 0x3, {}, {0x5, 0x0, 0xff, 0x0, 0x0, 0xfe, "8000"}, 0x0, 0x2, {}, 0x20800}) r7 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) write$cgroup_int(r7, &(0x7f0000000080)=0x3, 0x12) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) 0s ago: executing program 5 (id=1970): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_gettime(0x2, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x4c}]}, &(0x7f0000000080)='syzkaller\x00'}, 0x80) r3 = socket$netlink(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) close(0xffffffffffffffff) ioctl$sock_SIOCBRDELBR(r3, 0x89a2, &(0x7f0000000000)='bridge0\x00') kernel console output (not intermixed with test programs): usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 310.347065][ T4380] usb 5-1: USB disconnect, device number 25 [ 310.517801][ T1109] usb 1-1: Using ep0 maxpacket: 32 [ 311.139730][ T7704] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 311.158333][ T1109] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 311.169876][ T7704] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 311.184935][ T1109] usb 1-1: can't read configurations, error -71 [ 311.193156][ T1109] usb usb1-port1: attempt power cycle [ 311.199433][ T7704] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 311.254723][ T7704] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 311.271044][ T7704] device geneve2 entered promiscuous mode [ 312.028612][ T7704] netdevsim netdevsim0 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 312.067690][ T7704] netdevsim netdevsim0 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 312.069575][ T7716] loop4: detected capacity change from 0 to 32768 [ 312.098966][ T7704] netdevsim netdevsim0 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 312.108411][ T7704] netdevsim netdevsim0 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 312.204699][ T7716] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 312.439894][ T4189] ocfs2: Unmounting device (7,4) on (node local) [ 312.564412][ T7728] netlink: 24 bytes leftover after parsing attributes in process `syz.0.988'. [ 313.451383][ T5237] usb 2-1: new full-speed USB device number 33 using dummy_hcd [ 313.983736][ T5237] usb 2-1: unable to get BOS descriptor or descriptor too short [ 314.031533][ T5237] usb 2-1: not running at top speed; connect to a high speed hub [ 314.071418][ T7702] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 314.121540][ T5237] usb 2-1: config 12 has an invalid interface number: 231 but max is 0 [ 314.135478][ T5237] usb 2-1: config 12 has no interface number 0 [ 314.159918][ T5237] usb 2-1: config 12 interface 231 has no altsetting 0 [ 315.391442][ T5237] usb 2-1: New USB device found, idVendor=2040, idProduct=9941, bcdDevice=93.b7 [ 315.400533][ T5237] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 315.451351][ T5237] usb 2-1: Product: syz [ 315.455591][ T5237] usb 2-1: Manufacturer: syz [ 315.460189][ T5237] usb 2-1: SerialNumber: syz [ 315.871417][ T5237] dvb-usb: found a 'Hauppauge Nova-T 500 Dual DVB-T' in cold state, will try to load a firmware [ 315.888908][ T5237] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 315.932098][ T5237] dib0700: firmware download failed at 7 with -71 [ 315.963259][ T5237] usb 2-1: USB disconnect, device number 33 [ 316.247263][ T7763] comedi comedi1: Minor 12 could not be opened [ 316.991118][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.378134][ T7786] loop3: detected capacity change from 0 to 1764 [ 318.486378][ T7791] tipc: Enabling of bearer rejected, already enabled [ 319.121341][ T5228] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 321.221486][ T5228] usb 5-1: unable to get BOS descriptor or descriptor too short [ 321.271366][ T5228] usb 5-1: not running at top speed; connect to a high speed hub [ 321.421552][ T5228] usb 5-1: config 12 has an invalid interface number: 231 but max is 0 [ 321.433156][ T5228] usb 5-1: config 12 has no interface number 0 [ 321.440912][ T5228] usb 5-1: config 12 interface 231 has no altsetting 0 [ 322.984306][ T7839] tipc: Enabling of bearer rejected, already enabled [ 323.012284][ T5228] usb 5-1: New USB device found, idVendor=2040, idProduct=9941, bcdDevice=93.b7 [ 323.037180][ T5228] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 323.414919][ T5228] usb 5-1: can't set config #12, error -71 [ 323.456396][ T5228] usb 5-1: USB disconnect, device number 26 [ 323.510934][ T5005] Bluetooth: hci5: Frame reassembly failed (-84) [ 323.540203][ T5005] Bluetooth: hci5: Frame reassembly failed (-84) [ 324.709531][ T7870] binder: BINDER_SET_CONTEXT_MGR bad uid 0 != 16832 [ 324.718375][ T7870] binder: 7869:7870 ioctl 4018620d 200000000100 returned -1 [ 324.732572][ T7870] binder: BINDER_SET_CONTEXT_MGR bad uid 0 != 16832 [ 324.739394][ T7870] binder: 7869:7870 ioctl 4018620d 200000001000 returned -1 [ 325.430497][ T7879] tipc: Enabling of bearer rejected, already enabled [ 326.141465][ T4528] Bluetooth: hci5: command 0x1003 tx timeout [ 326.147544][ T146] Bluetooth: hci5: sending frame failed (-49) [ 326.603967][ T7891] loop1: detected capacity change from 0 to 512 [ 327.386199][ T7891] EXT4-fs (loop1): Ignoring removed orlov option [ 327.392703][ T7891] EXT4-fs (loop1): Ignoring removed bh option [ 327.873356][ T7891] EXT4-fs (loop1): orphan cleanup on readonly fs [ 327.884589][ T7891] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.1036: bg 0: block 248: padding at end of block bitmap is not set [ 327.902328][ T7891] Quota error (device loop1): write_blk: dquota write failed [ 327.910317][ T7891] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 327.922927][ T7891] EXT4-fs error (device loop1): ext4_acquire_dquot:6236: comm syz.1.1036: Failed to acquire dquot type 1 [ 328.044726][ T7891] EXT4-fs (loop1): 1 truncate cleaned up [ 328.052629][ T7891] EXT4-fs (loop1): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 328.078438][ T7889] EXT4-fs (loop1): shut down requested (2) [ 328.084859][ T7889] EXT4-fs (loop1): warning: mounting fs with errors, running e2fsck is recommended [ 328.113614][ T7] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 328.121654][ T7889] EXT4-fs (loop1): re-mounted. Opts: . Quota mode: writeback. [ 328.129198][ T7889] ext4 filesystem being remounted at /209/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 328.171364][ T4528] Bluetooth: hci5: command 0x1001 tx timeout [ 328.178568][ T146] Bluetooth: hci5: sending frame failed (-49) [ 328.389679][ T7909] input: syz1 as /devices/virtual/input/input10 [ 328.485617][ T7] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 328.493176][ T7911] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 328.506834][ T7] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 328.529567][ T7] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 328.542555][ T7914] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 328.548933][ T7911] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 328.554907][ T7] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 328.587112][ T7911] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 328.590948][ T7] usb 3-1: config 0 descriptor?? [ 328.633518][ T7] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 328.644040][ T7911] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 328.680013][ T7911] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 328.694161][ T7911] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 328.710514][ T7911] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 328.718562][ T7916] tipc: Enabling of bearer rejected, already enabled [ 329.031465][ T21] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 329.431863][ T21] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 329.499623][ T21] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 329.612530][ T21] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 329.622469][ T21] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 329.631010][ T21] usb 2-1: SerialNumber: syz [ 330.170327][ T21] usb 2-1: 0:2 : does not exist [ 330.306496][ T7] Bluetooth: hci5: command 0x1009 tx timeout [ 330.333435][ T21] usb 2-1: USB disconnect, device number 34 [ 330.362490][ T7930] loop2: detected capacity change from 0 to 7 [ 330.409044][ T7930] Dev loop2: unable to read RDB block 7 [ 330.420561][ T7930] loop2: unable to read partition table [ 330.437372][ T7930] loop2: partition table beyond EOD, truncated [ 330.491294][ T7930] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑච) failed (rc=-5) [ 330.617670][ T4238] usb 3-1: USB disconnect, device number 44 [ 331.623316][ T7945] loop1: detected capacity change from 0 to 512 [ 331.784114][ T7945] EXT4-fs (loop1): Ignoring removed orlov option [ 331.790858][ T7945] EXT4-fs (loop1): Ignoring removed bh option [ 331.928023][ T7945] EXT4-fs (loop1): orphan cleanup on readonly fs [ 331.953858][ T7945] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.1054: bg 0: block 248: padding at end of block bitmap is not set [ 331.977666][ T7945] Quota error (device loop1): write_blk: dquota write failed [ 331.985506][ T7945] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 331.995711][ T7945] EXT4-fs error (device loop1): ext4_acquire_dquot:6236: comm syz.1.1054: Failed to acquire dquot type 1 [ 332.011645][ T7945] EXT4-fs (loop1): 1 truncate cleaned up [ 332.020009][ T7945] EXT4-fs (loop1): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 332.050654][ T7944] EXT4-fs (loop1): shut down requested (2) [ 332.057047][ T7944] EXT4-fs (loop1): warning: mounting fs with errors, running e2fsck is recommended [ 332.097010][ T7944] EXT4-fs (loop1): re-mounted. Opts: . Quota mode: writeback. [ 332.104661][ T7944] ext4 filesystem being remounted at /214/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 332.371623][ T7] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 332.621342][ T7] usb 5-1: Using ep0 maxpacket: 32 [ 332.912223][ T7] usb 5-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 332.967240][ T7] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 333.084568][ T7] usb 5-1: Product: syz [ 333.129516][ T7] usb 5-1: Manufacturer: syz [ 333.155497][ T7] usb 5-1: SerialNumber: syz [ 334.740618][ T7] usb 5-1: config 0 descriptor?? [ 337.211546][ T7] RobotFuzz Open Source InterFace, OSIF 5-1:0.0: failure sending bit rate [ 337.279604][ T7] RobotFuzz Open Source InterFace, OSIF: probe of 5-1:0.0 failed with error -110 [ 337.301540][ T7986] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1067'. [ 337.331835][ T7] usb 5-1: USB disconnect, device number 27 [ 337.770484][ T8002] 9pnet_virtio: no channels available for device syz [ 337.863323][ T8003] loop1: detected capacity change from 0 to 512 [ 338.537845][ T8003] EXT4-fs (loop1): Ignoring removed orlov option [ 338.544936][ T8003] EXT4-fs (loop1): Ignoring removed bh option [ 338.574045][ T8003] EXT4-fs (loop1): orphan cleanup on readonly fs [ 338.586682][ T8003] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.1071: bg 0: block 248: padding at end of block bitmap is not set [ 338.602091][ T8003] Quota error (device loop1): write_blk: dquota write failed [ 338.609575][ T8003] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 338.619792][ T8003] EXT4-fs error (device loop1): ext4_acquire_dquot:6236: comm syz.1.1071: Failed to acquire dquot type 1 [ 338.632960][ T8003] EXT4-fs (loop1): 1 truncate cleaned up [ 338.646389][ T8003] EXT4-fs (loop1): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 338.674766][ T8000] EXT4-fs (loop1): shut down requested (2) [ 338.681086][ T8000] EXT4-fs (loop1): warning: mounting fs with errors, running e2fsck is recommended [ 338.741351][ T5237] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 338.805366][ T8000] EXT4-fs (loop1): re-mounted. Opts: . Quota mode: writeback. [ 338.813039][ T8000] ext4 filesystem being remounted at /217/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 338.981414][ T5237] usb 1-1: Using ep0 maxpacket: 32 [ 339.111488][ T5237] usb 1-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 339.133955][ T5237] usb 1-1: config 0 interface 0 has no altsetting 0 [ 339.156122][ T5237] usb 1-1: New USB device found, idVendor=1b1c, idProduct=1c09, bcdDevice= 0.00 [ 339.169011][ T5237] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.201662][ T5237] usb 1-1: config 0 descriptor?? [ 339.221360][ T4231] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 339.410775][ T8019] bridge0: port 2(bridge_slave_1) entered disabled state [ 339.418503][ T8019] bridge0: port 1(bridge_slave_0) entered disabled state [ 339.771438][ T4231] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 339.804062][ T4231] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 339.840861][ T5237] corsair-psu 0003:1B1C:1C09.0005: unknown main item tag 0x0 [ 339.854812][ T5237] corsair-psu 0003:1B1C:1C09.0005: unknown main item tag 0x0 [ 339.864985][ T5237] corsair-psu 0003:1B1C:1C09.0005: unknown main item tag 0x0 [ 339.875849][ T5237] corsair-psu 0003:1B1C:1C09.0005: unknown main item tag 0x0 [ 339.883606][ T5237] corsair-psu 0003:1B1C:1C09.0005: unknown main item tag 0x0 [ 339.899336][ T5237] corsair-psu 0003:1B1C:1C09.0005: hidraw0: USB HID v4.08 Device [HID 1b1c:1c09] on usb-dummy_hcd.0-1/input0 [ 339.911466][ T4231] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 339.924446][ T4231] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 339.932765][ T4231] usb 5-1: SerialNumber: syz [ 340.039643][ T8005] corsair-psu 0003:1B1C:1C09.0005: pid 8005 passed too short report [ 340.061386][ T5237] corsair-psu 0003:1B1C:1C09.0005: unable to initialize device (-71) [ 340.080137][ T5237] corsair-psu: probe of 0003:1B1C:1C09.0005 failed with error -71 [ 340.107973][ T5237] usb 1-1: USB disconnect, device number 36 [ 340.158333][ T8019] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 340.179843][ T8029] fido_id[8029]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 340.219131][ T8019] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 340.234120][ T4231] usb 5-1: 0:2 : does not exist [ 340.277868][ T4231] usb 5-1: USB disconnect, device number 28 [ 340.498885][ T8019] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.507992][ T8019] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.517772][ T8019] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.526800][ T8019] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.640536][ T8019] syz.2.1077 (8019) used greatest stack depth: 19960 bytes left [ 340.657248][ T8031] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 340.678602][ T8031] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 340.698553][ T8031] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 340.718967][ T8031] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 340.727863][ T8031] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 340.749367][ T8031] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 340.758233][ T8031] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 340.778921][ T8031] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 340.797211][ T8031] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 340.807490][ T8031] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 340.834539][ T8031] device bridge_slave_0 left promiscuous mode [ 340.841186][ T8031] bridge0: port 1(bridge_slave_0) entered disabled state [ 340.859479][ T8031] device bridge_slave_1 left promiscuous mode [ 340.866283][ T8031] bridge0: port 2(bridge_slave_1) entered disabled state [ 340.876122][ T8031] bond0: (slave bond_slave_0): Releasing backup interface [ 340.889957][ T8031] bond0: (slave bond_slave_1): Releasing backup interface [ 340.935013][ T8031] team0: Port device team_slave_0 removed [ 340.958043][ T8031] team0: Port device team_slave_1 removed [ 340.964992][ T8031] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 340.972916][ T8031] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 340.984005][ T8031] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 340.991953][ T8031] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 341.004600][ T8031] team0: Port device macvlan0 removed [ 341.014541][ T8032] team0: Mode changed to "activebackup" [ 341.729198][ T8055] loop4: detected capacity change from 0 to 512 [ 342.299189][ T8055] EXT4-fs (loop4): Ignoring removed orlov option [ 342.305950][ T8055] EXT4-fs (loop4): Ignoring removed bh option [ 342.323690][ T8055] EXT4-fs (loop4): orphan cleanup on readonly fs [ 342.331916][ T8055] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.1089: bg 0: block 248: padding at end of block bitmap is not set [ 342.347509][ T8055] Quota error (device loop4): write_blk: dquota write failed [ 342.355334][ T8055] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 342.365342][ T8055] EXT4-fs error (device loop4): ext4_acquire_dquot:6236: comm syz.4.1089: Failed to acquire dquot type 1 [ 342.379350][ T8055] EXT4-fs (loop4): 1 truncate cleaned up [ 342.387454][ T8055] EXT4-fs (loop4): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 342.407111][ C1] vkms_vblank_simulate: vblank timer overrun [ 342.428807][ T8053] EXT4-fs (loop4): shut down requested (2) [ 342.436305][ T8053] EXT4-fs (loop4): warning: mounting fs with errors, running e2fsck is recommended [ 342.482420][ T8053] EXT4-fs (loop4): re-mounted. Opts: . Quota mode: writeback. [ 342.489966][ T8053] ext4 filesystem being remounted at /235/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 344.116804][ C1] scsi_io_completion_action: 6 callbacks suppressed [ 344.116849][ C1] sd 0:0:1:0: tag#5574 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 344.133421][ C1] sd 0:0:1:0: tag#5574 CDB: Read(6) 08 00 00 00 00 00 [ 344.697382][ T8112] loop3: detected capacity change from 0 to 512 [ 344.784463][ T8112] EXT4-fs (loop3): Ignoring removed orlov option [ 344.791102][ T8112] EXT4-fs (loop3): Ignoring removed bh option [ 344.991372][ T8112] EXT4-fs (loop3): orphan cleanup on readonly fs [ 345.274501][ T8112] EXT4-fs error (device loop3): ext4_validate_block_bitmap:438: comm syz.3.1106: bg 0: block 248: padding at end of block bitmap is not set [ 345.292889][ T8112] Quota error (device loop3): write_blk: dquota write failed [ 345.300361][ T8112] Quota error (device loop3): qtree_write_dquot: Error -117 occurred while creating quota [ 345.311139][ T8112] EXT4-fs error (device loop3): ext4_acquire_dquot:6236: comm syz.3.1106: Failed to acquire dquot type 1 [ 345.319331][ T8119] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 345.334132][ T8112] EXT4-fs (loop3): 1 truncate cleaned up [ 345.340316][ T8112] EXT4-fs (loop3): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 345.376453][ T8103] EXT4-fs (loop3): shut down requested (2) [ 345.382884][ T8103] EXT4-fs (loop3): warning: mounting fs with errors, running e2fsck is recommended [ 345.587927][ T8119] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 345.588398][ T8103] EXT4-fs (loop3): re-mounted. Opts: . Quota mode: writeback. [ 345.605662][ T8103] ext4 filesystem being remounted at /210/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 347.063317][ T8143] binder_alloc: 8142: pid 8142 spamming oneway? 2 buffers allocated for a total size of 5120 [ 347.076167][ T8143] binder_alloc: 8142: pid 8142 spamming oneway? 3 buffers allocated for a total size of 5128 [ 349.027373][ T8173] loop4: detected capacity change from 0 to 512 [ 349.477458][ T8173] EXT4-fs (loop4): Ignoring removed orlov option [ 349.484170][ T8173] EXT4-fs (loop4): Ignoring removed bh option [ 349.549834][ T8173] EXT4-fs (loop4): orphan cleanup on readonly fs [ 349.566917][ T8173] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.1122: bg 0: block 248: padding at end of block bitmap is not set [ 349.592117][ T8173] Quota error (device loop4): write_blk: dquota write failed [ 349.599563][ T8173] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 349.609578][ T8173] EXT4-fs error (device loop4): ext4_acquire_dquot:6236: comm syz.4.1122: Failed to acquire dquot type 1 [ 349.670226][ T8173] EXT4-fs (loop4): 1 truncate cleaned up [ 349.676519][ T8173] EXT4-fs (loop4): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 349.704524][ T8160] EXT4-fs (loop4): shut down requested (2) [ 349.710712][ T8160] EXT4-fs (loop4): warning: mounting fs with errors, running e2fsck is recommended [ 349.791551][ T8160] EXT4-fs (loop4): re-mounted. Opts: . Quota mode: writeback. [ 349.799194][ T8160] ext4 filesystem being remounted at /239/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 351.194167][ T8234] loop1: detected capacity change from 0 to 512 [ 351.731963][ T8234] EXT4-fs (loop1): Ignoring removed orlov option [ 351.738353][ T8234] EXT4-fs (loop1): Ignoring removed bh option [ 351.840151][ T8234] EXT4-fs (loop1): orphan cleanup on readonly fs [ 351.848281][ T8234] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.1142: bg 0: block 248: padding at end of block bitmap is not set [ 351.888728][ T8234] Quota error (device loop1): write_blk: dquota write failed [ 351.896179][ T8234] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 351.906595][ T8234] EXT4-fs error (device loop1): ext4_acquire_dquot:6236: comm syz.1.1142: Failed to acquire dquot type 1 [ 351.945241][ T8234] EXT4-fs (loop1): 1 truncate cleaned up [ 351.966309][ T8234] EXT4-fs (loop1): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 352.001060][ T8228] EXT4-fs (loop1): shut down requested (2) [ 352.007402][ T8228] EXT4-fs (loop1): warning: mounting fs with errors, running e2fsck is recommended [ 352.249135][ T8228] EXT4-fs (loop1): re-mounted. Opts: . Quota mode: writeback. [ 352.256763][ T8228] ext4 filesystem being remounted at /231/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 353.303304][ T8258] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 353.654871][ T4202] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 353.665626][ T4202] CPU: 0 PID: 4202 Comm: kworker/u5:8 Not tainted syzkaller #0 [ 353.673202][ T4202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 353.683265][ T4202] Workqueue: hci1 hci_rx_work [ 353.687965][ T4202] Call Trace: [ 353.691246][ T4202] [ 353.694174][ T4202] dump_stack_lvl+0x188/0x250 [ 353.698856][ T4202] ? show_regs_print_info+0x20/0x20 [ 353.704054][ T4202] ? load_image+0x400/0x400 [ 353.708568][ T4202] sysfs_create_dir_ns+0x26a/0x290 [ 353.713686][ T4202] ? sysfs_warn_dup+0xa0/0xa0 [ 353.718368][ T4202] ? process_one_work+0x85f/0x1010 [ 353.723483][ T4202] ? do_raw_spin_unlock+0x11d/0x230 [ 353.728691][ T4202] kobject_add_internal+0x6e0/0xd90 [ 353.733902][ T4202] kobject_add+0x160/0x230 [ 353.738337][ T4202] ? kobject_init+0x1d0/0x1d0 [ 353.743027][ T4202] ? klist_children_get+0x50/0x50 [ 353.748062][ T4202] ? get_device_parent+0x121/0x3f0 [ 353.753180][ T4202] device_add+0x483/0xfb0 [ 353.757523][ T4202] hci_conn_add_sysfs+0xd1/0x1e0 [ 353.762472][ T4202] le_conn_complete_evt+0xc48/0x15c0 [ 353.767782][ T4202] ? cs_le_create_conn+0x5e0/0x5e0 [ 353.772906][ T4202] ? preempt_schedule_common+0xa5/0xd0 [ 353.778378][ T4202] ? preempt_schedule+0xbc/0xd0 [ 353.783235][ T4202] ? schedule_preempt_disabled+0x20/0x20 [ 353.788872][ T4202] ? __mutex_trylock_common+0x155/0x260 [ 353.794430][ T4202] hci_le_meta_evt+0x285/0x3c90 [ 353.799287][ T4202] ? hci_event_packet+0x37b/0x1370 [ 353.804404][ T4202] ? __lock_acquire+0x7d10/0x7d10 [ 353.809446][ T4202] ? hci_remote_host_features_evt+0x280/0x280 [ 353.815520][ T4202] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 353.821159][ T4202] ? mark_lock+0x94/0x320 [ 353.825575][ T4202] ? mutex_unlock+0x10/0x10 [ 353.830082][ T4202] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 353.836082][ T4202] ? lock_chain_count+0x20/0x20 [ 353.840958][ T4202] ? __rwlock_init+0x140/0x140 [ 353.845743][ T4202] hci_event_packet+0xe48/0x1370 [ 353.850694][ T4202] ? lockdep_hardirqs_on+0x94/0x140 [ 353.855906][ T4202] ? rcu_lock_release+0x20/0x20 [ 353.860764][ T4202] ? hci_send_to_monitor+0x9c/0x4a0 [ 353.865971][ T4202] hci_rx_work+0x255/0xa10 [ 353.870418][ T4202] process_one_work+0x85f/0x1010 [ 353.875378][ T4202] ? worker_detach_from_pool+0x240/0x240 [ 353.881014][ T4202] ? lockdep_hardirqs_off+0x70/0x100 [ 353.886311][ T4202] ? _raw_spin_lock_irq+0xb7/0xf0 [ 353.891342][ T4202] ? _raw_spin_lock_irqsave+0x100/0x100 [ 353.896895][ T4202] ? wq_worker_running+0x97/0x170 [ 353.901929][ T4202] worker_thread+0xaa6/0x1290 [ 353.906621][ T4202] ? lockdep_hardirqs_on+0x94/0x140 [ 353.911825][ T4202] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 353.917738][ T4202] kthread+0x436/0x520 [ 353.921810][ T4202] ? rcu_lock_release+0x20/0x20 [ 353.926663][ T4202] ? kthread_blkcg+0xd0/0xd0 [ 353.931261][ T4202] ret_from_fork+0x1f/0x30 [ 353.935694][ T4202] [ 353.960458][ T4202] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 353.974543][ T4202] Bluetooth: hci1: failed to register connection device [ 354.757310][ T8280] loop1: detected capacity change from 0 to 32768 [ 355.823846][ T8280] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 355.859080][ T8293] tmpfs: Unknown parameter 'quota' [ 355.903512][ T8295] netlink: 'syz.2.1162': attribute type 10 has an invalid length. [ 355.924077][ T8295] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 356.045978][ T4185] ocfs2: Unmounting device (7,1) on (node local) [ 356.046803][ T8295] 8021q: adding VLAN 0 to HW filter on device bond1 [ 356.082993][ T8295] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 356.104861][ T8295] bond1: (slave macvlan2): Enslaving as a backup interface with an up link [ 356.167955][ T5409] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 359.499378][ T8349] device syzkaller0 entered promiscuous mode [ 359.512355][ T8354] xt_recent: hitcount (262144) is larger than allowed maximum (255) [ 359.531840][ T8354] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1183'. [ 360.504384][ T8365] netlink: 'syz.3.1186': attribute type 3 has an invalid length. [ 362.557769][ T8388] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 362.654922][ T8396] device syzkaller0 entered promiscuous mode [ 363.117458][ T2421] pvrusb2: request_firmware fatal error with code=-110 [ 363.276051][ T2421] pvrusb2: Failure uploading firmware1 [ 363.357047][ T2421] pvrusb2: Device initialization was not successful. [ 363.401511][ T7] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 363.418422][ T2421] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 363.511512][ T2421] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 363.686023][ T2421] usb 4-1: Direct firmware load for v4l-pvrusb2-29xxx-01.fw failed with error -2 [ 363.704985][ T2421] usb 4-1: Falling back to sysfs fallback for: v4l-pvrusb2-29xxx-01.fw [ 363.955497][ T4233] pvrusb2: Device being rendered inoperable [ 364.101660][ T7] usb 2-1: Using ep0 maxpacket: 8 [ 364.251969][ T7] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 364.270480][ T7] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 364.282422][ T7] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 364.345139][ T7] usb 2-1: config 0 descriptor?? [ 365.355986][ T7] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 365.435752][ T8460] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1214'. [ 365.478399][ T7] usb 2-1: USB disconnect, device number 35 [ 365.526573][ T8462] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.676951][ T8462] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.801055][ T8462] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.930417][ T8462] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 366.176172][ T8462] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.267075][ T8462] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.464905][ T8462] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.689733][ T8462] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 367.121699][ T4232] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 367.521762][ T4232] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 367.612773][ T4232] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 367.733780][ T4232] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 367.789343][ T4232] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 367.807247][ T4232] usb 2-1: SerialNumber: syz [ 368.091391][ T7] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 368.899127][ T4232] usb 2-1: 0:2 : does not exist [ 369.082444][ T4232] usb 2-1: USB disconnect, device number 36 [ 369.308481][ C1] sd 0:0:1:0: tag#5610 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 369.318534][ C1] sd 0:0:1:0: tag#5610 CDB: Read(6) 08 00 00 00 00 00 [ 369.325867][ C1] sd 0:0:1:0: tag#5611 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 369.335805][ C1] sd 0:0:1:0: tag#5611 CDB: Read(6) 08 00 00 00 00 00 [ 369.342708][ C1] sd 0:0:1:0: tag#5612 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 369.352597][ C1] sd 0:0:1:0: tag#5612 CDB: Read(6) 08 00 00 00 00 00 [ 369.359419][ C1] sd 0:0:1:0: tag#5613 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 369.369274][ C1] sd 0:0:1:0: tag#5613 CDB: Read(6) 08 00 00 00 00 00 [ 369.376167][ C1] sd 0:0:1:0: tag#5614 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 369.386072][ C1] sd 0:0:1:0: tag#5614 CDB: Read(6) 08 00 00 00 00 00 [ 369.392917][ C1] sd 0:0:1:0: tag#5615 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 369.402778][ C1] sd 0:0:1:0: tag#5615 CDB: Read(6) 08 00 00 00 00 00 [ 369.409600][ C1] sd 0:0:1:0: tag#5616 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 369.411352][ T7] usb 5-1: Using ep0 maxpacket: 32 [ 369.419480][ C1] sd 0:0:1:0: tag#5616 CDB: Read(6) 08 00 00 00 00 00 [ 369.431428][ C1] sd 0:0:1:0: tag#5617 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 369.441296][ C1] sd 0:0:1:0: tag#5617 CDB: Read(6) 08 00 00 00 00 00 [ 369.448108][ C1] sd 0:0:1:0: tag#5618 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 369.457957][ C1] sd 0:0:1:0: tag#5618 CDB: Read(6) 08 00 00 00 00 00 [ 369.464787][ C1] sd 0:0:1:0: tag#5619 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 369.474645][ C1] sd 0:0:1:0: tag#5619 CDB: Read(6) 08 00 00 00 00 00 [ 369.500002][ T8514] loop3: detected capacity change from 0 to 1024 [ 369.604571][ T4177] udevd[4177]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 369.637658][ T8514] EXT4-fs (loop3): Ignoring removed bh option [ 370.208200][ T8514] EXT4-fs (loop3): mounted filesystem without journal. Opts: nobarrier,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,i_version,stripe=0x0000000000000002,bh,init_itable,,errors=continue. Quota mode: none. [ 370.235488][ T7] usb 5-1: config 0 has an invalid interface number: 119 but max is 0 [ 370.249691][ T7] usb 5-1: config 0 has no interface number 0 [ 370.257573][ T7] usb 5-1: config 0 interface 119 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 370.278285][ T7] usb 5-1: config 0 interface 119 altsetting 0 has an invalid endpoint with address 0xD3, skipping [ 370.296964][ T7] usb 5-1: config 0 interface 119 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 370.951390][ T7] usb 5-1: string descriptor 0 read error: -71 [ 370.957888][ T7] usb 5-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 371.036557][ T7] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 371.100971][ T7] usb 5-1: config 0 descriptor?? [ 371.145151][ T7] usb 5-1: can't set config #0, error -71 [ 371.170855][ T8538] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 371.189570][ T7] usb 5-1: USB disconnect, device number 29 [ 371.249986][ T8543] team0: Device macvlan0 failed to change mtu [ 371.337507][ T8549] netlink: 100 bytes leftover after parsing attributes in process `syz.3.1244'. [ 371.369633][ T8529] loop1: detected capacity change from 0 to 40427 [ 371.509856][ T8529] F2FS-fs (loop1): Invalid SB checksum offset: 0 [ 371.722599][ T8553] loop4: detected capacity change from 0 to 32768 [ 371.765533][ T8529] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 372.311143][ T8529] F2FS-fs (loop1): invalid crc value [ 372.410381][ T8553] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 372.460976][ T8566] loop3: detected capacity change from 0 to 4096 [ 372.532148][ T4189] ocfs2: Unmounting device (7,4) on (node local) [ 372.540258][ T8529] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 372.771978][ T8529] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 372.823185][ T8529] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 373.604090][ T8567] syz.0.1247 (8567) used greatest stack depth: 18328 bytes left [ 373.681713][ T4185] attempt to access beyond end of device [ 373.681713][ T4185] loop1: rw=2049, want=45104, limit=40427 [ 373.951309][ T4231] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 374.465941][ T8599] loop3: detected capacity change from 0 to 32768 [ 374.521732][ T4231] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 374.560975][ T4231] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 374.590026][ T8599] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 374.725770][ T4187] ocfs2: Unmounting device (7,3) on (node local) [ 374.772005][ T4231] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 374.796060][ T4231] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 374.816575][ T4231] usb 5-1: SerialNumber: syz [ 376.193501][ T4379] usb 2-1: new full-speed USB device number 37 using dummy_hcd [ 376.234766][ T4738] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 376.571439][ T4379] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 376.589206][ T4379] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x6 has invalid wMaxPacketSize 0 [ 376.599575][ T4379] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 376.614859][ T4738] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 376.627823][ T4738] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 376.634055][ T4231] usb 5-1: 0:2 : does not exist [ 376.672056][ T4231] usb 5-1: USB disconnect, device number 30 [ 376.746833][ T4738] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 376.760195][ T4738] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 376.769443][ T4738] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 376.781678][ T4738] usb 1-1: config 0 descriptor?? [ 376.902005][ T4379] usb 2-1: New USB device found, idVendor=00d7, idProduct=0000, bcdDevice= 0.40 [ 377.071279][ T4379] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 377.105325][ T4379] usb 2-1: Product: syz [ 377.109537][ T4379] usb 2-1: Manufacturer: syz [ 377.161980][ T4379] usb 2-1: SerialNumber: syz [ 377.284373][ T4738] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 377.307418][ T4738] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 377.327880][ T4738] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 377.356833][ T4738] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 377.382426][ T4177] udevd[4177]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 377.382906][ T4738] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 377.450033][ T4738] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 377.465244][ T4738] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 377.476032][ T4738] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 377.489224][ T4738] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 377.500522][ T4738] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 377.509653][ T4738] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 377.517823][ T4738] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 377.525791][ T4738] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 377.533792][ T4738] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 377.541900][ T4738] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 377.550223][ T4738] plantronics 0003:047F:FFFF.0006: No inputs registered, leaving [ 377.568821][ T4738] plantronics 0003:047F:FFFF.0006: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 377.681433][ T4379] cdc_ncm 2-1:1.0: bind() failure [ 377.717808][ T4379] cdc_ncm: probe of 2-1:1.1 failed with error -71 [ 377.751736][ T4379] cdc_mbim: probe of 2-1:1.1 failed with error -71 [ 377.781531][ T4379] usbtest: probe of 2-1:1.1 failed with error -71 [ 377.799125][ T4379] usb 2-1: USB disconnect, device number 37 [ 378.497675][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.559745][ T8653] loop3: detected capacity change from 0 to 512 [ 378.623957][ T8653] EXT4-fs (loop3): 1 truncate cleaned up [ 378.654716][ T8653] EXT4-fs (loop3): mounted filesystem without journal. Opts: noload,stripe=0x000000000000030c,jqfmt=vfsv1,nojournal_checksum,jqfmt=vfsv1,usrjquota=,,errors=continue. Quota mode: none. [ 381.525375][ T7] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 381.534213][ T4738] usb 1-1: USB disconnect, device number 37 [ 381.689520][ T8668] loop4: detected capacity change from 0 to 256 [ 381.701244][ T8668] exfat: Deprecated parameter 'utf8' [ 381.820153][ T8668] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0xf8a64500, utbl_chksum : 0xe619d30d) [ 381.844900][ T8673] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1287'. [ 382.200779][ T4738] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 382.853654][ T8684] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 382.861813][ T8684] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 384.182825][ T4738] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 384.198561][ T4738] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 384.281525][ T4738] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 384.290868][ T4738] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 384.304964][ T4738] usb 2-1: SerialNumber: syz [ 384.613836][ T4738] usb 2-1: 0:2 : does not exist [ 384.684378][ T4738] usb 2-1: USB disconnect, device number 38 [ 385.593035][ T4177] udevd[4177]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 388.341803][ C1] scsi_io_completion_action: 6 callbacks suppressed [ 388.341848][ C1] sd 0:0:1:0: tag#5593 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 388.358390][ C1] sd 0:0:1:0: tag#5593 CDB: Read(6) 08 00 00 00 00 00 [ 388.365893][ C1] sd 0:0:1:0: tag#5594 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 388.375747][ C1] sd 0:0:1:0: tag#5594 CDB: Read(6) 08 00 00 00 00 00 [ 388.382581][ C1] sd 0:0:1:0: tag#5595 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 388.392453][ C1] sd 0:0:1:0: tag#5595 CDB: Read(6) 08 00 00 00 00 00 [ 388.399240][ C1] sd 0:0:1:0: tag#5596 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 388.409157][ C1] sd 0:0:1:0: tag#5596 CDB: Read(6) 08 00 00 00 00 00 [ 388.416086][ C1] sd 0:0:1:0: tag#5597 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 388.425992][ C1] sd 0:0:1:0: tag#5597 CDB: Read(6) 08 00 00 00 00 00 [ 388.432823][ C1] sd 0:0:1:0: tag#5598 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 388.442647][ C1] sd 0:0:1:0: tag#5598 CDB: Read(6) 08 00 00 00 00 00 [ 388.449434][ C1] sd 0:0:1:0: tag#5599 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 388.459267][ C1] sd 0:0:1:0: tag#5599 CDB: Read(6) 08 00 00 00 00 00 [ 388.466092][ C1] sd 0:0:1:0: tag#5600 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 388.475939][ C1] sd 0:0:1:0: tag#5600 CDB: Read(6) 08 00 00 00 00 00 [ 388.482757][ C1] sd 0:0:1:0: tag#5601 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 388.492584][ C1] sd 0:0:1:0: tag#5601 CDB: Read(6) 08 00 00 00 00 00 [ 388.499362][ C1] sd 0:0:1:0: tag#5602 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 388.509185][ C1] sd 0:0:1:0: tag#5602 CDB: Read(6) 08 00 00 00 00 00 [ 393.658073][ T4528] usb 1-1: new full-speed USB device number 38 using dummy_hcd [ 394.172459][ T4528] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 394.222458][ T4528] usb 1-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 394.302061][ T4528] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 394.361347][ T4528] usb 1-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 394.524342][ T8785] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1319'. [ 394.562761][ T4528] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 394.571364][ T8785] netlink: 43 bytes leftover after parsing attributes in process `syz.3.1319'. [ 394.581314][ T4528] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 394.599596][ T4528] usb 1-1: Product: syz [ 394.603875][ T4528] usb 1-1: Manufacturer: syz [ 394.608250][ T8785] netlink: 'syz.3.1319': attribute type 5 has an invalid length. [ 394.618629][ T4528] usb 1-1: SerialNumber: syz [ 394.646548][ T8785] netlink: 43 bytes leftover after parsing attributes in process `syz.3.1319'. [ 395.161577][ T4528] cdc_ncm 1-1:1.0: bind() failure [ 395.172463][ T4528] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 395.198637][ T4528] cdc_ncm 1-1:1.1: bind() failure [ 395.256924][ T4528] usb 1-1: USB disconnect, device number 38 [ 396.113029][ T8813] loop4: detected capacity change from 0 to 512 [ 396.646118][ T8813] EXT4-fs (loop4): Ignoring removed orlov option [ 396.653104][ T8813] EXT4-fs (loop4): Ignoring removed bh option [ 396.690715][ T8813] EXT4-fs (loop4): orphan cleanup on readonly fs [ 396.708653][ T8813] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.1324: bg 0: block 248: padding at end of block bitmap is not set [ 397.757907][ T8813] Quota error (device loop4): write_blk: dquota write failed [ 397.765441][ T8813] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 397.776221][ T8813] EXT4-fs error (device loop4): ext4_acquire_dquot:6236: comm syz.4.1324: Failed to acquire dquot type 1 [ 397.789812][ T8813] EXT4-fs (loop4): 1 truncate cleaned up [ 397.796068][ T8813] EXT4-fs (loop4): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 397.831308][ T8808] EXT4-fs (loop4): shut down requested (2) [ 397.837678][ T8808] EXT4-fs (loop4): warning: mounting fs with errors, running e2fsck is recommended [ 397.939851][ T8808] EXT4-fs (loop4): re-mounted. Opts: . Quota mode: writeback. [ 397.947437][ T8808] ext4 filesystem being remounted at /275/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 398.933865][ T8850] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1336'. [ 399.100879][ T8853] fuse: Unknown parameter 'user_i00000000000000000000' [ 400.554693][ T8871] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1342'. [ 400.661697][ T8871] tipc: Enabling of bearer rejected, already enabled [ 402.124901][ T8887] fuse: Unknown parameter 'user_i00000000000000000000' [ 402.982958][ C1] scsi_io_completion_action: 6 callbacks suppressed [ 402.983003][ C1] sd 0:0:1:0: tag#5571 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 402.999550][ C1] sd 0:0:1:0: tag#5571 CDB: Read(6) 08 00 00 00 00 00 [ 403.518436][ T8911] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1355'. [ 403.653045][ T8911] tipc: Enabling of bearer rejected, already enabled [ 403.682292][ T26] audit: type=1326 audit(2000000290.439:140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8913 comm="syz.1.1357" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fedb1bcbdd9 code=0x0 [ 404.694215][ T8928] fuse: Unknown parameter 'user_i00000000000000000000' [ 406.030627][ T8948] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1367'. [ 406.590140][ T8953] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1369'. [ 406.618186][ T8953] tipc: Enabling of bearer rejected, already enabled [ 406.657765][ T26] audit: type=1326 audit(2000000293.399:141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8954 comm="syz.2.1370" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f2a3e7cddd9 code=0x0 [ 408.490918][ T8975] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1375'. [ 408.563503][ T8978] fuse: Unknown parameter 'user_i00000000000000000000' [ 408.925675][ T8985] xt_hashlimit: size too large, truncated to 1048576 [ 409.633446][ T8998] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1381'. [ 409.699163][ T8998] tipc: Enabling of bearer rejected, already enabled [ 410.071049][ T26] audit: type=1326 audit(2000000296.819:142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9006 comm="syz.0.1383" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f91f5097dd9 code=0x0 [ 410.407305][ T9013] loop3: detected capacity change from 0 to 512 [ 410.706701][ T9013] EXT4-fs (loop3): Ignoring removed orlov option [ 410.713193][ T9013] EXT4-fs (loop3): Ignoring removed bh option [ 411.012983][ T9013] EXT4-fs (loop3): orphan cleanup on readonly fs [ 411.022940][ T9013] EXT4-fs error (device loop3): ext4_validate_block_bitmap:438: comm syz.3.1384: bg 0: block 248: padding at end of block bitmap is not set [ 411.038305][ T9013] Quota error (device loop3): write_blk: dquota write failed [ 411.045933][ T9013] Quota error (device loop3): qtree_write_dquot: Error -117 occurred while creating quota [ 411.056028][ T9013] EXT4-fs error (device loop3): ext4_acquire_dquot:6236: comm syz.3.1384: Failed to acquire dquot type 1 [ 411.069576][ T9013] EXT4-fs (loop3): 1 truncate cleaned up [ 411.075823][ T9013] EXT4-fs (loop3): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 411.112173][ T9011] EXT4-fs (loop3): shut down requested (2) [ 411.118470][ T9011] EXT4-fs (loop3): warning: mounting fs with errors, running e2fsck is recommended [ 411.181369][ T9011] EXT4-fs (loop3): re-mounted. Opts: . Quota mode: writeback. [ 411.189610][ T9011] ext4 filesystem being remounted at /264/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 411.368053][ T9022] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1386'. [ 411.558676][ T9029] fuse: Unknown parameter 'user_i00000000000000000000' [ 412.016110][ T9034] loop3: detected capacity change from 0 to 32768 [ 412.819216][ T9034] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 413.131130][ T4187] ocfs2: Unmounting device (7,3) on (node local) [ 413.820364][ T9054] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1393'. [ 413.830346][ T9054] tipc: Enabling of bearer rejected, already enabled [ 413.881674][ T26] audit: type=1326 audit(2000000300.639:143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9055 comm="syz.0.1395" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f91f5097dd9 code=0x0 [ 414.479755][ T9075] fuse: Unknown parameter 'user_i00000000000000000000' [ 415.175128][ T9087] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1405'. [ 415.191776][ T9087] tipc: Enabling of bearer rejected, already enabled [ 416.631125][ T9104] loop4: detected capacity change from 0 to 512 [ 416.666949][ T9104] EXT4-fs (loop4): Ignoring removed orlov option [ 416.673479][ T9104] EXT4-fs (loop4): Ignoring removed bh option [ 416.693716][ T9104] EXT4-fs (loop4): orphan cleanup on readonly fs [ 416.701544][ T9104] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.1409: bg 0: block 248: padding at end of block bitmap is not set [ 416.717947][ T9104] Quota error (device loop4): write_blk: dquota write failed [ 416.725494][ T9104] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 416.735550][ T9104] EXT4-fs error (device loop4): ext4_acquire_dquot:6236: comm syz.4.1409: Failed to acquire dquot type 1 [ 416.749753][ T9104] EXT4-fs (loop4): 1 truncate cleaned up [ 416.757352][ T9104] EXT4-fs (loop4): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 416.781829][ T9104] EXT4-fs (loop4): shut down requested (2) [ 416.788181][ T9104] EXT4-fs (loop4): warning: mounting fs with errors, running e2fsck is recommended [ 416.816011][ T9104] EXT4-fs (loop4): re-mounted. Opts: . Quota mode: writeback. [ 416.824067][ T9104] ext4 filesystem being remounted at /293/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 416.861288][ T4528] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 416.960730][ T26] audit: type=1326 audit(2000000303.709:144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9117 comm="syz.3.1413" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fafd7ceadd9 code=0x0 [ 417.074674][ T9121] fuse: Unknown parameter 'user_i00000000000000000000' [ 417.131373][ T4528] usb 2-1: Using ep0 maxpacket: 32 [ 417.256965][ T9127] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1416'. [ 417.361092][ T9129] tipc: Enabling of bearer rejected, already enabled [ 417.564430][ T4528] usb 2-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 417.732742][ T4528] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 417.765378][ T4528] usb 2-1: Product: syz [ 417.769565][ T4528] usb 2-1: Manufacturer: syz [ 417.831252][ T4528] usb 2-1: SerialNumber: syz [ 417.894926][ T4528] usb 2-1: config 0 descriptor?? [ 418.719301][ T4528] RobotFuzz Open Source InterFace, OSIF 2-1:0.0: failure sending bit rate [ 418.727954][ T4528] RobotFuzz Open Source InterFace, OSIF: probe of 2-1:0.0 failed with error -71 [ 418.746047][ T4528] usb 2-1: USB disconnect, device number 39 [ 421.411018][ T9162] loop1: detected capacity change from 0 to 40427 [ 421.482488][ T9162] F2FS-fs (loop1): Unrecognized mount option "memory=low" or missing value [ 422.354293][ T26] audit: type=1326 audit(2000000309.109:145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9178 comm="syz.1.1432" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fedb1bcbdd9 code=0x0 [ 422.641499][ T4528] usb 5-1: new full-speed USB device number 32 using dummy_hcd [ 422.665710][ T9188] fuse: Unknown parameter 'user_i00000000000000000000' [ 423.091479][ T4528] usb 5-1: unable to get BOS descriptor or descriptor too short [ 423.141528][ T4528] usb 5-1: not running at top speed; connect to a high speed hub [ 423.241590][ T4528] usb 5-1: config 12 has an invalid interface number: 231 but max is 0 [ 423.254529][ T4528] usb 5-1: config 12 has no interface number 0 [ 423.270440][ T4528] usb 5-1: config 12 interface 231 has no altsetting 0 [ 423.451470][ T4528] usb 5-1: New USB device found, idVendor=2040, idProduct=9941, bcdDevice=93.b7 [ 423.461304][ T4528] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 423.526006][ T4528] usb 5-1: Product: syz [ 423.536153][ T4528] usb 5-1: Manufacturer: syz [ 423.555413][ T4528] usb 5-1: SerialNumber: syz [ 423.563959][ T5228] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 423.623864][ T9205] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1437'. [ 423.659163][ T9205] tipc: Enabling of bearer rejected, already enabled [ 423.893184][ T5228] usb 2-1: Using ep0 maxpacket: 32 [ 423.912341][ T9180] xt_recent: hitcount (262144) is larger than allowed maximum (255) [ 423.922633][ T9180] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1431'. [ 424.003231][ T9221] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1441'. [ 424.515259][ T2421] pvrusb2: request_firmware fatal error with code=-110 [ 424.580949][ T2421] pvrusb2: Failure uploading firmware1 [ 424.615243][ T2421] pvrusb2: Device initialization was not successful. [ 424.625504][ T2421] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 424.855914][ T2421] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 425.040760][ T4233] pvrusb2: Device being rendered inoperable [ 425.091508][ T4528] dvb-usb: found a 'Hauppauge Nova-T 500 Dual DVB-T' in cold state, will try to load a firmware [ 425.103210][ T4528] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 425.138369][ T4528] dib0700: firmware download failed at 7 with -71 [ 425.167057][ T4528] usb 5-1: USB disconnect, device number 32 [ 425.231609][ T5228] usb 2-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 425.240785][ T5228] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 425.249358][ T5228] usb 2-1: Product: syz [ 425.253907][ T5228] usb 2-1: Manufacturer: syz [ 425.263589][ T5228] usb 2-1: SerialNumber: syz [ 425.270292][ T5228] usb 2-1: config 0 descriptor?? [ 425.441843][ T4233] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 425.551982][ T5228] RobotFuzz Open Source InterFace, OSIF 2-1:0.0: failure sending bit rate [ 425.603850][ T5228] RobotFuzz Open Source InterFace, OSIF: probe of 2-1:0.0 failed with error -71 [ 425.878383][ T5228] usb 2-1: USB disconnect, device number 40 [ 425.951695][ T4233] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 425.978410][ T4233] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 425.998018][ T26] audit: type=1326 audit(2000000312.749:146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9231 comm="syz.4.1445" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff19e4b0dd9 code=0x0 [ 426.821466][ T4233] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 426.871214][ T4233] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 426.911712][ T4233] usb 4-1: can't set config #1, error -71 [ 426.919415][ T4233] usb 4-1: USB disconnect, device number 21 [ 426.929760][ T9249] fuse: Unknown parameter 'user_i00000000000000000000' [ 426.930440][ T9250] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1450'. [ 426.968349][ T9250] tipc: Enabling of bearer rejected, already enabled [ 428.111913][ T9264] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1454'. [ 428.125968][ T9264] loop1: detected capacity change from 0 to 512 [ 428.142840][ T9267] xt_recent: hitcount (262144) is larger than allowed maximum (255) [ 428.155115][ T9267] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1455'. [ 428.181465][ T9264] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 429.211606][ T4528] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 429.521606][ T4528] usb 1-1: Using ep0 maxpacket: 32 [ 429.756829][ T9288] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1462'. [ 429.771282][ T26] audit: type=1326 audit(2000000316.499:147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9285 comm="syz.3.1461" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fafd7ceadd9 code=0x0 [ 429.802291][ T9288] tipc: Enabling of bearer rejected, already enabled [ 429.823923][ T5228] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 430.468983][ T4528] usb 1-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 430.529977][ T4528] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 430.538536][ T4528] usb 1-1: Product: syz [ 430.546245][ T4528] usb 1-1: Manufacturer: syz [ 430.550876][ T4528] usb 1-1: SerialNumber: syz [ 430.558738][ T4528] usb 1-1: config 0 descriptor?? [ 430.564532][ T9296] fuse: Unknown parameter 'user_i00000000000000000000' [ 430.638214][ T9298] loop3: detected capacity change from 0 to 4096 [ 431.031432][ T4528] RobotFuzz Open Source InterFace, OSIF 1-1:0.0: failure sending bit rate [ 431.048060][ T4528] RobotFuzz Open Source InterFace, OSIF: probe of 1-1:0.0 failed with error -71 [ 431.060726][ T5228] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 431.072649][ T5228] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 431.110425][ T4528] usb 1-1: USB disconnect, device number 39 [ 431.354814][ T5228] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 431.402159][ T9319] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1470'. [ 432.363564][ T5228] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 432.371970][ T5228] usb 2-1: SerialNumber: syz [ 432.401369][ T5228] usb 2-1: can't set config #1, error -71 [ 432.449256][ T5228] usb 2-1: USB disconnect, device number 41 [ 432.569717][ T9325] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1473'. [ 432.600246][ T9325] tipc: Enabling of bearer rejected, already enabled [ 433.073495][ C1] sd 0:0:1:0: tag#5608 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 433.083422][ C1] sd 0:0:1:0: tag#5608 CDB: Read(6) 08 00 00 00 00 00 [ 433.321250][ T26] audit: type=1326 audit(2000000320.059:148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9333 comm="syz.3.1475" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fafd7ceadd9 code=0x0 [ 433.356608][ T9336] fuse: Unknown parameter 'user_i00000000000000000000' [ 435.483416][ T4263] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 435.550368][ T9363] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1483'. [ 435.563245][ T9363] loop1: detected capacity change from 0 to 512 [ 435.634160][ T9363] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 435.731347][ T4263] usb 1-1: Using ep0 maxpacket: 32 [ 435.776570][ T9368] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1485'. [ 435.789483][ T9368] tipc: Enabling of bearer rejected, already enabled [ 435.979270][ T5228] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 436.021614][ T4263] usb 1-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 436.032409][ T4263] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 436.040913][ T4263] usb 1-1: Product: syz [ 436.049393][ T4263] usb 1-1: Manufacturer: syz [ 436.062136][ T4263] usb 1-1: SerialNumber: syz [ 436.116925][ T4263] usb 1-1: config 0 descriptor?? [ 436.401720][ T4263] RobotFuzz Open Source InterFace, OSIF 1-1:0.0: failure sending bit rate [ 436.440021][ T4263] RobotFuzz Open Source InterFace, OSIF: probe of 1-1:0.0 failed with error -71 [ 436.621411][ T9380] fuse: Unknown parameter 'user_i00000000000000000000' [ 436.636318][ T4263] usb 1-1: USB disconnect, device number 40 [ 436.697781][ T26] audit: type=1326 audit(2000000323.449:149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9381 comm="syz.1.1490" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fedb1bcbdd9 code=0x0 [ 437.551534][ T5228] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 437.567921][ T5228] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 438.865907][ T5228] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 438.875195][ T5228] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 438.883578][ T5228] usb 4-1: SerialNumber: syz [ 439.171417][ T5228] usb 4-1: can't set config #1, error -71 [ 439.189984][ T5228] usb 4-1: USB disconnect, device number 22 [ 439.218032][ T9411] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1498'. [ 439.241829][ T9411] tipc: Enabling of bearer rejected, already enabled [ 439.425415][ C1] sd 0:0:1:0: tag#5578 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 439.435340][ C1] sd 0:0:1:0: tag#5578 CDB: Read(6) 08 00 00 00 00 00 [ 439.448350][ T9423] fuse: Unknown parameter 'user_i00000000000000000000' [ 439.469335][ T9420] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1499'. [ 439.481980][ T9420] loop3: detected capacity change from 0 to 512 [ 439.523094][ T9420] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 439.864134][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.882109][ T5228] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 440.616367][ T26] audit: type=1326 audit(2000000327.369:150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9433 comm="syz.2.1506" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f2a3e7cddd9 code=0x0 [ 440.641342][ T5228] usb 1-1: Using ep0 maxpacket: 32 [ 441.661475][ T5228] usb 1-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 441.685851][ T5228] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 441.697055][ T9450] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1510'. [ 441.713297][ T5228] usb 1-1: Product: syz [ 441.717674][ T5228] usb 1-1: Manufacturer: syz [ 441.728923][ T9450] tipc: Enabling of bearer rejected, already enabled [ 441.739231][ T5228] usb 1-1: SerialNumber: syz [ 441.779422][ T5228] usb 1-1: config 0 descriptor?? [ 441.963326][ T4530] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 442.071783][ T5228] RobotFuzz Open Source InterFace, OSIF 1-1:0.0: failure sending bit rate [ 442.096676][ T5228] RobotFuzz Open Source InterFace, OSIF: probe of 1-1:0.0 failed with error -71 [ 442.201505][ T9461] fuse: Unknown parameter 'user_i00000000000000000000' [ 442.203778][ T5228] usb 1-1: USB disconnect, device number 41 [ 442.343631][ T4530] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 442.380990][ T4530] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 443.163417][ T4530] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 443.172650][ T4530] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 443.180648][ T4530] usb 5-1: SerialNumber: syz [ 444.117649][ T4530] usb 5-1: 0:2 : does not exist [ 444.141870][ T4530] usb 5-1: USB disconnect, device number 33 [ 444.327343][ T4528] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 444.571599][ T4528] usb 1-1: Using ep0 maxpacket: 32 [ 444.681377][ T4530] usb 5-1: new full-speed USB device number 34 using dummy_hcd [ 444.691684][ T4528] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 444.712225][ T4528] usb 1-1: config 0 has no interfaces? [ 444.881441][ T4528] usb 1-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 444.896715][ T4528] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 444.907392][ T4528] usb 1-1: Product: syz [ 444.946895][ T4528] usb 1-1: Manufacturer: syz [ 444.953160][ T4528] usb 1-1: SerialNumber: syz [ 444.965416][ T4528] usb 1-1: config 0 descriptor?? [ 445.452317][ T4530] usb 5-1: unable to get BOS descriptor or descriptor too short [ 445.512942][ T4530] usb 5-1: not running at top speed; connect to a high speed hub [ 445.565912][ T4528] usb 1-1: USB disconnect, device number 42 [ 445.653023][ T4530] usb 5-1: config 12 has an invalid interface number: 231 but max is 0 [ 445.707941][ T4530] usb 5-1: config 12 has no interface number 0 [ 446.471412][ T4530] usb 5-1: config 12 interface 231 has no altsetting 0 [ 446.631620][ T4530] usb 5-1: New USB device found, idVendor=2040, idProduct=9941, bcdDevice=93.b7 [ 447.024076][ T4530] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 447.035141][ T4530] usb 5-1: Product: syz [ 447.039390][ T4530] usb 5-1: Manufacturer: syz [ 447.046203][ T4530] usb 5-1: SerialNumber: syz [ 448.797011][ T26] audit: type=1326 audit(2000000335.549:151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9511 comm="syz.0.1530" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f91f5097dd9 code=0x0 [ 448.961309][ T4530] usb 5-1: can't set config #12, error -71 [ 448.968789][ T4177] udevd[4177]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 448.992086][ T4530] usb 5-1: USB disconnect, device number 34 [ 450.172181][ T9521] fuse: Unknown parameter 'user_i00000000000000000000' [ 450.503606][ T4530] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 451.071340][ T4530] usb 4-1: Using ep0 maxpacket: 32 [ 451.731524][ T4530] usb 4-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 451.745074][ T4530] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 451.754223][ T4530] usb 4-1: Product: syz [ 451.758479][ T4530] usb 4-1: Manufacturer: syz [ 451.767747][ T4530] usb 4-1: SerialNumber: syz [ 451.832698][ T4530] usb 4-1: config 0 descriptor?? [ 451.891578][ T5237] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 451.891557][ T5228] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 452.211580][ T5237] usb 2-1: Using ep0 maxpacket: 32 [ 452.261830][ T5228] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 452.457132][ T5228] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 452.518430][ T4530] RobotFuzz Open Source InterFace, OSIF 4-1:0.0: failure sending bit rate [ 452.527375][ T5237] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 452.538199][ T4530] RobotFuzz Open Source InterFace, OSIF: probe of 4-1:0.0 failed with error -71 [ 452.551363][ T5237] usb 2-1: config 0 has no interfaces? [ 452.564742][ T4530] usb 4-1: USB disconnect, device number 23 [ 452.701641][ T5228] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 452.711577][ T5228] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 452.723326][ T5228] usb 1-1: SerialNumber: syz [ 452.781578][ T5237] usb 2-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 452.793476][ T5237] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.813761][ T5237] usb 2-1: Product: syz [ 452.824778][ T5237] usb 2-1: Manufacturer: syz [ 452.835703][ T5237] usb 2-1: SerialNumber: syz [ 452.874558][ T5237] usb 2-1: config 0 descriptor?? [ 453.013728][ T5228] usb 1-1: 0:2 : does not exist [ 453.049855][ T5228] usb 1-1: USB disconnect, device number 43 [ 453.123281][ T4177] udevd[4177]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 453.981798][ T9565] loop4: detected capacity change from 0 to 32768 [ 453.985025][ T9551] Set syz1 is full, maxelem 6117 reached [ 454.037802][ T4232] usb 2-1: USB disconnect, device number 42 [ 454.216699][ T9567] loop3: detected capacity change from 0 to 512 [ 454.245970][ T9565] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 454.283947][ T9567] EXT4-fs (loop3): Ignoring removed orlov option [ 454.290448][ T9567] EXT4-fs (loop3): Ignoring removed bh option [ 454.316611][ T9567] EXT4-fs (loop3): orphan cleanup on readonly fs [ 454.324953][ T9567] EXT4-fs error (device loop3): ext4_validate_block_bitmap:438: comm syz.3.1544: bg 0: block 248: padding at end of block bitmap is not set [ 454.345128][ T9567] Quota error (device loop3): write_blk: dquota write failed [ 454.352871][ T9567] Quota error (device loop3): qtree_write_dquot: Error -117 occurred while creating quota [ 454.362910][ T9567] EXT4-fs error (device loop3): ext4_acquire_dquot:6236: comm syz.3.1544: Failed to acquire dquot type 1 [ 454.464403][ T9567] EXT4-fs (loop3): 1 truncate cleaned up [ 454.481763][ T9567] EXT4-fs (loop3): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 454.511564][ T9564] EXT4-fs (loop3): shut down requested (2) [ 454.517971][ T9564] EXT4-fs (loop3): warning: mounting fs with errors, running e2fsck is recommended [ 454.538184][ T4189] ocfs2: Unmounting device (7,4) on (node local) [ 454.556097][ T9572] fuse: Unknown parameter 'user_i00000000000000000000' [ 454.565516][ T9564] EXT4-fs (loop3): re-mounted. Opts: . Quota mode: writeback. [ 454.573691][ T9564] ext4 filesystem being remounted at /296/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 454.792712][ T26] audit: type=1326 audit(2000000341.549:152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9581 comm="syz.3.1547" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fafd7ceadd9 code=0x0 [ 457.801410][ T4738] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 457.821514][ T4263] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 459.419651][ T9617] loop4: detected capacity change from 0 to 32768 [ 459.427996][ T4738] usb 2-1: Using ep0 maxpacket: 32 [ 459.581439][ T4263] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 459.608450][ T9617] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 459.638347][ T4263] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 459.871827][ T4263] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 459.931622][ T4738] usb 2-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 460.022395][ T4263] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 460.030707][ T4738] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.046262][ T4263] usb 4-1: SerialNumber: syz [ 460.057762][ T4738] usb 2-1: Product: syz [ 460.064340][ T4738] usb 2-1: Manufacturer: syz [ 460.153329][ T4738] usb 2-1: SerialNumber: syz [ 460.185306][ T4189] ocfs2: Unmounting device (7,4) on (node local) [ 460.282523][ T4738] usb 2-1: config 0 descriptor?? [ 460.403160][ T4263] usb 4-1: 0:2 : does not exist [ 460.459243][ T4263] usb 4-1: USB disconnect, device number 24 [ 460.511765][ T4738] RobotFuzz Open Source InterFace, OSIF 2-1:0.0: failure sending bit rate [ 460.541768][ T4738] RobotFuzz Open Source InterFace, OSIF: probe of 2-1:0.0 failed with error -71 [ 460.558002][ T4420] udevd[4420]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 460.600624][ T4738] usb 2-1: USB disconnect, device number 43 [ 460.629303][ T26] audit: type=1326 audit(2000000347.379:153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9633 comm="syz.1.1561" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fedb1bcbdd9 code=0x0 [ 460.651525][ T4379] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 460.801955][ T9640] fuse: Unknown parameter 'user_i00000000000000000000' [ 460.916221][ T4379] usb 5-1: Using ep0 maxpacket: 32 [ 462.041530][ T4379] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 462.084965][ T4379] usb 5-1: config 0 has no interfaces? [ 463.591538][ T4379] usb 5-1: string descriptor 0 read error: -71 [ 463.599602][ T4379] usb 5-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 463.786690][ T4379] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.089969][ T4379] usb 5-1: config 0 descriptor?? [ 464.154890][ T4379] usb 5-1: can't set config #0, error -71 [ 464.185850][ T4379] usb 5-1: USB disconnect, device number 35 [ 464.581235][ T4379] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 464.723110][ T9685] loop3: detected capacity change from 0 to 512 [ 464.999055][ T9685] EXT4-fs (loop3): Ignoring removed orlov option [ 465.005836][ T9685] EXT4-fs (loop3): Ignoring removed bh option [ 465.337138][ T9685] EXT4-fs (loop3): orphan cleanup on readonly fs [ 465.344657][ T9685] EXT4-fs error (device loop3): ext4_validate_block_bitmap:438: comm syz.3.1575: bg 0: block 248: padding at end of block bitmap is not set [ 465.372587][ T9685] Quota error (device loop3): write_blk: dquota write failed [ 465.380054][ T9685] Quota error (device loop3): qtree_write_dquot: Error -117 occurred while creating quota [ 465.390174][ T9685] EXT4-fs error (device loop3): ext4_acquire_dquot:6236: comm syz.3.1575: Failed to acquire dquot type 1 [ 465.403098][ T9685] EXT4-fs (loop3): 1 truncate cleaned up [ 465.421868][ T9685] EXT4-fs (loop3): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 465.451125][ T9683] EXT4-fs (loop3): shut down requested (2) [ 465.457619][ T9683] EXT4-fs (loop3): warning: mounting fs with errors, running e2fsck is recommended [ 465.507070][ T9683] EXT4-fs (loop3): re-mounted. Opts: . Quota mode: writeback. [ 465.514813][ T9683] ext4 filesystem being remounted at /304/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 465.527108][ T4379] usb 5-1: Using ep0 maxpacket: 32 [ 465.841394][ T4379] usb 5-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 465.870834][ T4379] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 465.891070][ T4379] usb 5-1: Product: syz [ 465.906779][ T4379] usb 5-1: Manufacturer: syz [ 465.931274][ T4379] usb 5-1: SerialNumber: syz [ 465.951285][ T4738] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 465.964503][ T4379] usb 5-1: config 0 descriptor?? [ 466.149890][ T26] audit: type=1326 audit(2000000352.899:154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9691 comm="syz.2.1577" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f2a3e7cddd9 code=0x0 [ 466.231321][ T4379] RobotFuzz Open Source InterFace, OSIF 5-1:0.0: failure sending bit rate [ 466.243550][ T4379] RobotFuzz Open Source InterFace, OSIF: probe of 5-1:0.0 failed with error -71 [ 466.282011][ T4379] usb 5-1: USB disconnect, device number 36 [ 466.322468][ T4738] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 466.335013][ T4738] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 466.348940][ T9695] fuse: Unknown parameter 'user_i00000000000000000000' [ 466.421401][ T4738] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 466.430707][ T4738] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 466.438869][ T4738] usb 4-1: SerialNumber: syz [ 467.423793][ T4738] usb 4-1: 0:2 : does not exist [ 467.439997][ T4738] usb 4-1: USB disconnect, device number 25 [ 469.251920][ T4177] udevd[4177]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 470.512846][ T9733] loop4: detected capacity change from 0 to 512 [ 471.890483][ T9737] fuse: Unknown parameter 'user_i00000000000000000000' [ 471.912837][ T9733] EXT4-fs (loop4): Ignoring removed orlov option [ 471.919277][ T9733] EXT4-fs (loop4): Ignoring removed bh option [ 471.933436][ T26] audit: type=1326 audit(2000000358.689:155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9739 comm="syz.1.1591" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fedb1bcbdd9 code=0x0 [ 471.989760][ T9733] EXT4-fs (loop4): orphan cleanup on readonly fs [ 471.997640][ T9733] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.1588: bg 0: block 248: padding at end of block bitmap is not set [ 472.016630][ T9733] Quota error (device loop4): write_blk: dquota write failed [ 472.024169][ T9733] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 472.034159][ T9733] EXT4-fs error (device loop4): ext4_acquire_dquot:6236: comm syz.4.1588: Failed to acquire dquot type 1 [ 472.068291][ T9733] EXT4-fs (loop4): 1 truncate cleaned up [ 472.074496][ T9733] EXT4-fs (loop4): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 472.105422][ T9726] EXT4-fs (loop4): shut down requested (2) [ 472.111774][ T9726] EXT4-fs (loop4): warning: mounting fs with errors, running e2fsck is recommended [ 472.181627][ T9726] EXT4-fs (loop4): re-mounted. Opts: . Quota mode: writeback. [ 472.189211][ T9726] ext4 filesystem being remounted at /326/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 472.501486][ T4232] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 473.471271][ T4232] usb 1-1: Using ep0 maxpacket: 32 [ 473.751699][ T4232] usb 1-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 473.983169][ T4232] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 474.286142][ T4232] usb 1-1: Product: syz [ 474.311640][ T4232] usb 1-1: Manufacturer: syz [ 474.316319][ T4232] usb 1-1: SerialNumber: syz [ 474.330618][ T4232] usb 1-1: config 0 descriptor?? [ 474.581346][ T4232] RobotFuzz Open Source InterFace, OSIF 1-1:0.0: failure sending bit rate [ 474.593597][ T4232] RobotFuzz Open Source InterFace, OSIF: probe of 1-1:0.0 failed with error -71 [ 474.760732][ T4232] usb 1-1: USB disconnect, device number 44 [ 477.072764][ T9790] fuse: Unknown parameter 'user_i00000000000000000000' [ 477.261233][ T4379] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 477.324859][ T26] audit: type=1326 audit(2000000364.079:156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9793 comm="syz.3.1606" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fafd7ceadd9 code=0x0 [ 478.335923][ T4379] usb 2-1: device not accepting address 44, error -71 [ 478.424582][ T9812] loop1: detected capacity change from 0 to 256 [ 481.765553][ T9832] fuse: Unknown parameter 'user_i00000000000000000000' [ 482.358083][ T9849] loop4: detected capacity change from 0 to 4096 [ 482.381380][ T5228] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 482.406969][ T9849] EXT4-fs (loop4): inline encryption not supported [ 482.423237][ T9849] EXT4-fs (loop4): Test dummy encryption mode enabled [ 482.430297][ T9849] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 482.430297][ T9849] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 482.430297][ T9849] [ 482.465571][ T9849] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a8428018, mo2=0003] [ 482.501894][ T9849] System zones: 0-5 [ 482.525694][ T9849] EXT4-fs (loop4): mounted filesystem without journal. Opts: debug,delalloc,inlinecrypt,test_dummy_encryption,errors=continue,errors=continue,delalloc,nouser_xattr,,errors=continue. Quota mode: writeback. [ 482.681252][ T5228] usb 4-1: Using ep0 maxpacket: 32 [ 483.781640][ T5228] usb 4-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 484.501709][ T5228] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.510334][ T5228] usb 4-1: Product: syz [ 484.514924][ T5228] usb 4-1: Manufacturer: syz [ 484.519600][ T5228] usb 4-1: SerialNumber: syz [ 484.526764][ T5228] usb 4-1: config 0 descriptor?? [ 485.731403][ T5228] RobotFuzz Open Source InterFace, OSIF 4-1:0.0: failure sending bit rate [ 485.750974][ T5228] RobotFuzz Open Source InterFace, OSIF: probe of 4-1:0.0 failed with error -71 [ 485.763109][ T5228] usb 4-1: USB disconnect, device number 26 [ 486.158335][ T9888] fuse: Unknown parameter 'user_i00000000000000000000' [ 486.432927][ T9897] loop1: detected capacity change from 0 to 1024 [ 486.528734][ T9897] EXT4-fs (loop1): mounted filesystem without journal. Opts: barrier,errors=continue,noquota,noblock_validity,barrier,grpjquota=,,errors=continue. Quota mode: none. [ 486.622869][ T9897] ext4 filesystem being mounted at /319/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 486.946807][ T9897] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.1633: bg 0: block 112: padding at end of block bitmap is not set [ 487.688874][ T9897] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 319 with max blocks 1 with error 28 [ 487.730199][ T9897] EXT4-fs (loop1): This should not happen!! Data will be lost [ 487.730199][ T9897] [ 487.740096][ T9897] EXT4-fs (loop1): Total free blocks count 0 [ 487.746561][ T9897] EXT4-fs (loop1): Free/Dirty block details [ 487.752625][ T9897] EXT4-fs (loop1): free_blocks=0 [ 487.757642][ T9897] EXT4-fs (loop1): dirty_blocks=16 [ 487.762838][ T9897] EXT4-fs (loop1): Block reservation details [ 487.768833][ T9897] EXT4-fs (loop1): i_reserved_data_blocks=1 [ 490.692520][ T9929] fuse: Unknown parameter 'user_i00000000000000000000' [ 491.466844][ T9951] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1649'. [ 491.531915][ T9951] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1649'. [ 493.671217][ T4738] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 493.872845][ T9971] fuse: Unknown parameter 'user_i00000000000000000000' [ 493.961482][ T4738] usb 5-1: Using ep0 maxpacket: 32 [ 494.445635][ T4738] usb 5-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 494.455927][ T4738] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.465048][ T4738] usb 5-1: Product: syz [ 494.469235][ T4738] usb 5-1: Manufacturer: syz [ 494.474162][ T4738] usb 5-1: SerialNumber: syz [ 494.484812][ T4738] usb 5-1: config 0 descriptor?? [ 495.054052][ T4738] RobotFuzz Open Source InterFace, OSIF 5-1:0.0: failure sending bit rate [ 495.234153][ T4738] RobotFuzz Open Source InterFace, OSIF: probe of 5-1:0.0 failed with error -71 [ 495.258334][ T4738] usb 5-1: USB disconnect, device number 37 [ 496.879280][T10017] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1670'. [ 496.893439][T10017] loop1: detected capacity change from 0 to 512 [ 496.986764][T10017] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 497.103894][ T4528] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 498.561307][ T4528] usb 4-1: Using ep0 maxpacket: 32 [ 499.298775][ T4528] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 499.358431][ T4528] usb 4-1: config 0 has no interfaces? [ 499.801300][ T4528] usb 4-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 499.820736][ T4528] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.851221][ T4528] usb 4-1: Product: syz [ 499.857105][ T4528] usb 4-1: config 0 descriptor?? [ 499.891370][ T4528] usb 4-1: can't set config #0, error -71 [ 499.904953][ T4528] usb 4-1: USB disconnect, device number 27 [ 500.221216][ T5237] usb 1-1: new full-speed USB device number 45 using dummy_hcd [ 500.321216][ T4528] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 500.731702][ T4528] usb 4-1: Using ep0 maxpacket: 32 [ 500.791396][ T5237] usb 1-1: unable to get BOS descriptor or descriptor too short [ 500.871569][ T5237] usb 1-1: not running at top speed; connect to a high speed hub [ 501.031737][ T5237] usb 1-1: config 12 has an invalid interface number: 231 but max is 0 [ 501.045890][ T5237] usb 1-1: config 12 has no interface number 0 [ 501.056510][ T5237] usb 1-1: config 12 interface 231 has no altsetting 0 [ 501.091536][ T4528] usb 4-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 501.109497][ T4528] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.120894][ T4528] usb 4-1: Product: syz [ 501.130587][ T4528] usb 4-1: Manufacturer: syz [ 501.138925][ T4528] usb 4-1: SerialNumber: syz [ 501.152803][ T4528] usb 4-1: config 0 descriptor?? [ 501.231491][ T5237] usb 1-1: New USB device found, idVendor=2040, idProduct=9941, bcdDevice=93.b7 [ 501.490399][T10065] loop4: detected capacity change from 0 to 32768 [ 501.499453][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.586535][ T4528] RobotFuzz Open Source InterFace, OSIF 4-1:0.0: failure sending bit rate [ 501.595362][ T5237] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.612212][ T4528] RobotFuzz Open Source InterFace, OSIF: probe of 4-1:0.0 failed with error -71 [ 501.621526][ T5237] usb 1-1: Product: syz [ 501.626053][ T5237] usb 1-1: Manufacturer: syz [ 501.630826][ T5237] usb 1-1: SerialNumber: syz [ 501.638221][ T4528] usb 4-1: USB disconnect, device number 28 [ 501.670641][T10065] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 501.903637][T10049] xt_recent: hitcount (262144) is larger than allowed maximum (255) [ 501.922468][T10049] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1678'. [ 501.943758][T10049] udc-core: couldn't find an available UDC or it's busy [ 501.950745][T10049] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 501.968567][ T4189] ocfs2: Unmounting device (7,4) on (node local) [ 502.051754][ T5237] dvb-usb: found a 'Hauppauge Nova-T 500 Dual DVB-T' in cold state, will try to load a firmware [ 502.083099][ T5237] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 502.265764][ T5237] dib0700: firmware download failed at 7 with -71 [ 502.293211][ T5237] usb 1-1: USB disconnect, device number 45 [ 502.383175][T10080] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1686'. [ 503.572276][T10098] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1691'. [ 506.021334][ T5237] usb 5-1: new full-speed USB device number 38 using dummy_hcd [ 506.297879][T10130] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1700'. [ 506.831408][ T5237] usb 5-1: unable to get BOS descriptor or descriptor too short [ 506.941329][ T5237] usb 5-1: not running at top speed; connect to a high speed hub [ 507.022471][ T5237] usb 5-1: config 12 has an invalid interface number: 231 but max is 0 [ 507.038562][ T5237] usb 5-1: config 12 has no interface number 0 [ 507.057592][ T5237] usb 5-1: config 12 interface 231 has no altsetting 0 [ 507.241302][ T5237] usb 5-1: New USB device found, idVendor=2040, idProduct=9941, bcdDevice=93.b7 [ 507.260827][ T5237] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.270986][ T5237] usb 5-1: Product: syz [ 507.285785][ T5237] usb 5-1: Manufacturer: syz [ 507.290429][ T5237] usb 5-1: SerialNumber: syz [ 507.357360][T10125] loop3: detected capacity change from 0 to 32768 [ 508.194333][T10121] xt_recent: hitcount (262144) is larger than allowed maximum (255) [ 508.199745][T10125] (syz.3.1696,10125,1):ocfs2_initialize_super:2313 ERROR: status = -12 [ 508.212325][T10121] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1699'. [ 508.226213][T10121] udc-core: couldn't find an available UDC or it's busy [ 508.234329][T10121] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 508.259025][T10125] (syz.3.1696,10125,1):ocfs2_fill_super:1177 ERROR: status = -12 [ 508.371544][ T5228] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 508.471520][ T5237] dvb-usb: found a 'Hauppauge Nova-T 500 Dual DVB-T' in cold state, will try to load a firmware [ 508.490354][ T5237] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 508.555618][ T5237] dib0700: firmware download failed at 7 with -71 [ 508.599014][ T5237] usb 5-1: USB disconnect, device number 38 [ 508.641431][ T5228] usb 2-1: Using ep0 maxpacket: 32 [ 508.802684][ T5228] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 508.825795][ T5228] usb 2-1: config 0 has no interfaces? [ 509.011572][ T5228] usb 2-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 509.026035][ T5228] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.027126][T10159] loop4: detected capacity change from 0 to 128 [ 509.040912][ T5228] usb 2-1: Product: syz [ 509.049647][ T5228] usb 2-1: Manufacturer: syz [ 509.058701][ T5228] usb 2-1: SerialNumber: syz [ 509.072854][ T5228] usb 2-1: config 0 descriptor?? [ 509.322692][T10167] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1708'. [ 509.329709][ T5228] usb 2-1: USB disconnect, device number 46 [ 511.441283][ T4238] usb 2-1: new full-speed USB device number 47 using dummy_hcd [ 511.861533][ T4238] usb 2-1: unable to get BOS descriptor or descriptor too short [ 511.915429][ T4238] usb 2-1: not running at top speed; connect to a high speed hub [ 512.021409][ T4238] usb 2-1: config 12 has an invalid interface number: 231 but max is 0 [ 512.056666][ T4238] usb 2-1: config 12 has no interface number 0 [ 512.071309][ T4238] usb 2-1: config 12 interface 231 has no altsetting 0 [ 512.109227][T10210] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1723'. [ 512.251500][ T4238] usb 2-1: New USB device found, idVendor=2040, idProduct=9941, bcdDevice=93.b7 [ 512.277568][ T4238] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.317042][ T4238] usb 2-1: Product: syz [ 512.340194][ T4238] usb 2-1: Manufacturer: syz [ 512.366999][ T4238] usb 2-1: SerialNumber: syz [ 512.439417][T10206] loop4: detected capacity change from 0 to 32768 [ 512.572182][T10206] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 512.643253][T10203] xt_recent: hitcount (262144) is larger than allowed maximum (255) [ 512.753841][T10203] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1722'. [ 512.795997][T10203] udc-core: couldn't find an available UDC or it's busy [ 512.851218][T10203] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 513.041315][ T4238] dvb-usb: found a 'Hauppauge Nova-T 500 Dual DVB-T' in cold state, will try to load a firmware [ 513.052158][ T4232] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 513.070592][ T4238] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 513.101360][ T4238] dib0700: firmware download failed at 7 with -71 [ 513.136428][ T4238] usb 2-1: USB disconnect, device number 47 [ 513.224596][ T4189] ocfs2: Unmounting device (7,4) on (node local) [ 513.301388][ T4232] usb 1-1: Using ep0 maxpacket: 32 [ 513.303470][T10225] fuse: Unknown parameter 'user_i00000000000000000000' [ 513.413774][T10227] tipc: Enabling of bearer rejected, already enabled [ 513.421999][ T4232] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 513.436948][ T4232] usb 1-1: config 0 has no interfaces? [ 513.601296][ T4232] usb 1-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 513.630804][ T4232] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.664566][ T4232] usb 1-1: Product: syz [ 513.669270][ T4232] usb 1-1: Manufacturer: syz [ 513.676969][ T4232] usb 1-1: SerialNumber: syz [ 513.695998][ T4232] usb 1-1: config 0 descriptor?? [ 514.584951][ T4232] usb 1-1: USB disconnect, device number 46 [ 515.568834][T10260] fuse: Unknown parameter 'user_i00000000000000000000' [ 515.731230][T10262] tipc: Enabling of bearer rejected, already enabled [ 516.181338][ T4528] usb 5-1: new full-speed USB device number 39 using dummy_hcd [ 516.681798][ T4528] usb 5-1: unable to get BOS descriptor or descriptor too short [ 516.764898][ T4528] usb 5-1: not running at top speed; connect to a high speed hub [ 516.881545][ T4528] usb 5-1: config 12 has an invalid interface number: 231 but max is 0 [ 516.909658][ T4528] usb 5-1: config 12 has no interface number 0 [ 516.961671][ T4528] usb 5-1: config 12 interface 231 has no altsetting 0 [ 517.201677][ T4528] usb 5-1: New USB device found, idVendor=2040, idProduct=9941, bcdDevice=93.b7 [ 517.262792][ T4528] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 517.281310][ T4528] usb 5-1: Product: syz [ 517.288358][ T4528] usb 5-1: Manufacturer: syz [ 517.294385][ T4528] usb 5-1: SerialNumber: syz [ 517.568483][T10266] xt_recent: hitcount (262144) is larger than allowed maximum (255) [ 517.611051][T10266] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1740'. [ 517.660777][T10266] udc-core: couldn't find an available UDC or it's busy [ 517.676234][T10266] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 517.831452][ T5228] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 517.871569][ T4528] dvb-usb: found a 'Hauppauge Nova-T 500 Dual DVB-T' in cold state, will try to load a firmware [ 517.897156][ T4528] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 517.941259][ T4528] dib0700: firmware download failed at 7 with -71 [ 517.968523][ T4528] usb 5-1: USB disconnect, device number 39 [ 518.101285][ T5228] usb 2-1: Using ep0 maxpacket: 32 [ 518.232674][ T5228] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 518.248706][ T5228] usb 2-1: config 0 has no interfaces? [ 518.389396][T10299] fuse: Unknown parameter 'user_i00000000000000000000' [ 518.441390][ T5228] usb 2-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 518.470326][ T5228] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.504422][ T5228] usb 2-1: Product: syz [ 518.515933][T10301] tipc: Enabling of bearer rejected, already enabled [ 518.524278][ T5228] usb 2-1: Manufacturer: syz [ 518.545355][ T5228] usb 2-1: SerialNumber: syz [ 518.572253][ T5228] usb 2-1: config 0 descriptor?? [ 518.846573][ T5237] usb 2-1: USB disconnect, device number 48 [ 521.031676][ T4232] usb 1-1: new full-speed USB device number 47 using dummy_hcd [ 521.441419][ T4232] usb 1-1: unable to get BOS descriptor or descriptor too short [ 521.491505][ T4232] usb 1-1: not running at top speed; connect to a high speed hub [ 521.571489][ T4232] usb 1-1: config 12 has an invalid interface number: 231 but max is 0 [ 521.590207][ T4232] usb 1-1: config 12 has no interface number 0 [ 521.610543][ T4232] usb 1-1: config 12 interface 231 has no altsetting 0 [ 522.721447][ T4232] usb 1-1: New USB device found, idVendor=2040, idProduct=9941, bcdDevice=93.b7 [ 522.732756][ T4232] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.745445][ T4232] usb 1-1: Product: syz [ 522.751469][ T4232] usb 1-1: Manufacturer: syz [ 522.758584][ T4232] usb 1-1: SerialNumber: syz [ 523.003632][T10330] xt_recent: hitcount (262144) is larger than allowed maximum (255) [ 523.081725][T10330] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1760'. [ 523.221997][T10330] udc-core: couldn't find an available UDC or it's busy [ 523.229142][T10330] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 523.238272][T10363] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1769'. [ 523.250678][T10363] loop4: detected capacity change from 0 to 512 [ 523.381771][T10363] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 524.324179][ T4232] dvb-usb: found a 'Hauppauge Nova-T 500 Dual DVB-T' in cold state, will try to load a firmware [ 524.352093][ T4232] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 524.401322][ T4232] dib0700: firmware download failed at 7 with -71 [ 524.473793][ T4232] usb 1-1: USB disconnect, device number 47 [ 527.644133][T10408] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1780'. [ 527.658605][T10408] loop3: detected capacity change from 0 to 512 [ 527.733984][T10408] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 531.882071][T10448] loop3: detected capacity change from 0 to 32768 [ 532.020669][T10448] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 532.300254][ T4187] ocfs2: Unmounting device (7,3) on (node local) [ 533.590684][T10481] loop4: detected capacity change from 0 to 512 [ 533.749579][T10481] EXT4-fs (loop4): Ignoring removed orlov option [ 533.756165][T10481] EXT4-fs (loop4): Ignoring removed bh option [ 533.779313][T10481] EXT4-fs (loop4): orphan cleanup on readonly fs [ 533.788062][T10481] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.1801: bg 0: block 248: padding at end of block bitmap is not set [ 533.804468][T10481] Quota error (device loop4): write_blk: dquota write failed [ 533.812000][T10481] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 533.822030][T10481] EXT4-fs error (device loop4): ext4_acquire_dquot:6236: comm syz.4.1801: Failed to acquire dquot type 1 [ 533.836611][T10481] EXT4-fs (loop4): 1 truncate cleaned up [ 533.867951][T10481] EXT4-fs (loop4): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 533.894904][T10477] EXT4-fs (loop4): shut down requested (2) [ 533.901682][T10477] EXT4-fs (loop4): warning: mounting fs with errors, running e2fsck is recommended [ 533.936783][T10477] EXT4-fs (loop4): re-mounted. Opts: . Quota mode: writeback. [ 533.944678][T10477] ext4 filesystem being remounted at /365/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 537.981207][ T4738] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 538.944722][T10529] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1813'. [ 538.959985][T10529] loop4: detected capacity change from 0 to 512 [ 538.981742][ T4738] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 539.010700][ T4738] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 539.153590][ T4738] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 539.172269][T10529] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 539.201259][ T4738] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 539.229243][ T4738] usb 2-1: SerialNumber: syz [ 539.537333][ T4738] usb 2-1: 0:2 : does not exist [ 539.578191][ T4738] usb 2-1: USB disconnect, device number 49 [ 539.695221][ T4177] udevd[4177]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 539.991354][ T7] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 540.301261][ T7] usb 4-1: Using ep0 maxpacket: 32 [ 540.421717][ T7] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 540.548482][ T7] usb 4-1: config 0 has no interfaces? [ 540.821414][ T7] usb 4-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 540.955480][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 541.025831][ T7] usb 4-1: Product: syz [ 541.062574][ T7] usb 4-1: Manufacturer: syz [ 541.083661][ T7] usb 4-1: SerialNumber: syz [ 541.114329][ T7] usb 4-1: config 0 descriptor?? [ 541.370314][ T7] usb 4-1: USB disconnect, device number 29 [ 542.634888][T10592] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1831'. [ 544.851246][ T4263] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 545.121865][ T4263] usb 5-1: Using ep0 maxpacket: 32 [ 545.241994][ T4263] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 545.261152][ T4263] usb 5-1: config 0 has no interfaces? [ 545.622767][ T4263] usb 5-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 545.714177][ T4263] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 545.740746][ T4263] usb 5-1: Product: syz [ 545.751035][ T4263] usb 5-1: Manufacturer: syz [ 545.761383][ T4263] usb 5-1: SerialNumber: syz [ 545.896522][ T4263] usb 5-1: config 0 descriptor?? [ 546.175278][ T7] usb 5-1: USB disconnect, device number 40 [ 547.842173][T10651] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1849'. [ 547.870210][T10651] loop3: detected capacity change from 0 to 512 [ 547.931030][T10651] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 548.671493][T10655] loop4: detected capacity change from 0 to 512 [ 548.783076][T10655] EXT4-fs (loop4): Ignoring removed orlov option [ 548.789602][T10655] EXT4-fs (loop4): Ignoring removed bh option [ 548.825923][T10655] EXT4-fs (loop4): orphan cleanup on readonly fs [ 548.838363][T10655] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.1851: bg 0: block 248: padding at end of block bitmap is not set [ 548.853845][T10655] Quota error (device loop4): write_blk: dquota write failed [ 548.861407][T10655] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 548.871397][T10655] EXT4-fs error (device loop4): ext4_acquire_dquot:6236: comm syz.4.1851: Failed to acquire dquot type 1 [ 548.891706][T10655] EXT4-fs (loop4): 1 truncate cleaned up [ 548.897882][T10655] EXT4-fs (loop4): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 548.921710][T10655] EXT4-fs (loop4): shut down requested (2) [ 548.927999][T10655] EXT4-fs (loop4): warning: mounting fs with errors, running e2fsck is recommended [ 549.011243][T10655] EXT4-fs (loop4): re-mounted. Opts: . Quota mode: writeback. [ 549.019454][T10655] ext4 filesystem being remounted at /379/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 551.091342][ T7] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 551.434104][T10694] loop3: detected capacity change from 0 to 32768 [ 551.560534][T10694] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 551.579413][ T7] usb 1-1: Using ep0 maxpacket: 32 [ 552.401255][ T7] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 552.426955][ T7] usb 1-1: config 0 has no interfaces? [ 552.660409][ T4187] ocfs2: Unmounting device (7,3) on (node local) [ 552.771620][ T7] usb 1-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 552.790183][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 552.812356][ T7] usb 1-1: Product: syz [ 552.820817][ T7] usb 1-1: Manufacturer: syz [ 552.826664][ T7] usb 1-1: SerialNumber: syz [ 552.857767][ T7] usb 1-1: config 0 descriptor?? [ 553.773066][ T4528] usb 1-1: USB disconnect, device number 48 [ 554.054384][T10726] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1867'. [ 554.066825][T10726] loop1: detected capacity change from 0 to 512 [ 554.105198][T10726] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 554.916316][T10742] printk: syz.0.1875 (10742): Attempt to access syslog with CAP_SYS_ADMIN but no CAP_SYSLOG (deprecated). [ 557.531007][T10780] raw_sendmsg: syz.2.1886 forgot to set AF_INET. Fix it! [ 557.622908][ T4263] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 557.717762][T10785] loop1: detected capacity change from 0 to 512 [ 557.777170][T10785] EXT4-fs (loop1): Ignoring removed orlov option [ 557.783748][T10785] EXT4-fs (loop1): Ignoring removed bh option [ 557.808936][T10785] EXT4-fs (loop1): orphan cleanup on readonly fs [ 557.817353][T10785] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.1888: bg 0: block 248: padding at end of block bitmap is not set [ 557.834912][T10785] Quota error (device loop1): write_blk: dquota write failed [ 557.842438][T10785] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 557.852662][T10785] EXT4-fs error (device loop1): ext4_acquire_dquot:6236: comm syz.1.1888: Failed to acquire dquot type 1 [ 557.866196][T10785] EXT4-fs (loop1): 1 truncate cleaned up [ 557.872499][T10785] EXT4-fs (loop1): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 557.896319][T10785] EXT4-fs (loop1): shut down requested (2) [ 557.902680][T10785] EXT4-fs (loop1): warning: mounting fs with errors, running e2fsck is recommended [ 557.939118][T10785] EXT4-fs (loop1): re-mounted. Opts: . Quota mode: writeback. [ 557.946868][T10785] ext4 filesystem being remounted at /363/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 558.272518][T10792] loop1: detected capacity change from 0 to 512 [ 558.325910][ T4263] usb 1-1: Using ep0 maxpacket: 32 [ 558.334724][T10795] device sit0 entered promiscuous mode [ 558.367258][T10795] netlink: 'syz.4.1891': attribute type 1 has an invalid length. [ 558.400480][T10792] EXT4-fs (loop1): mounted filesystem without journal. Opts: usrquota,grpjquota=,nodelalloc,,errors=continue. Quota mode: writeback. [ 558.408326][T10795] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1891'. [ 558.433914][T10792] ext4 filesystem being mounted at /364/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 558.601371][ T4263] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 558.611783][ T4263] usb 1-1: config 0 has no interfaces? [ 559.615495][T10792] overlayfs: conflicting lowerdir path [ 559.685977][ T4263] usb 1-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 559.705502][ T4263] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.726174][ T4263] usb 1-1: Product: syz [ 559.740671][ T4263] usb 1-1: Manufacturer: syz [ 559.748790][ T4263] usb 1-1: SerialNumber: syz [ 560.086674][ T4263] usb 1-1: config 0 descriptor?? [ 560.181318][ T4263] usb 1-1: can't set config #0, error -71 [ 560.198457][ T4263] usb 1-1: USB disconnect, device number 49 [ 560.548693][T10830] loop4: detected capacity change from 0 to 512 [ 560.616237][T10830] EXT4-fs (loop4): Ignoring removed orlov option [ 560.622839][T10830] EXT4-fs (loop4): Ignoring removed bh option [ 560.648727][T10830] EXT4-fs (loop4): orphan cleanup on readonly fs [ 560.660419][T10830] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.1899: bg 0: block 248: padding at end of block bitmap is not set [ 560.688711][T10830] Quota error (device loop4): write_blk: dquota write failed [ 560.696881][T10830] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 560.706943][T10830] EXT4-fs error (device loop4): ext4_acquire_dquot:6236: comm syz.4.1899: Failed to acquire dquot type 1 [ 560.734948][T10830] EXT4-fs (loop4): 1 truncate cleaned up [ 560.768522][T10830] EXT4-fs (loop4): mounted filesystem without journal. Opts: dax=inode,nodiscard,noblock_validity,grpjquota=,grpjquota=,orlov,abort,bh,stripe=0x0000000000000010,,errors=continue. Quota mode: writeback. [ 560.812246][T10830] EXT4-fs (loop4): shut down requested (2) [ 560.818606][T10830] EXT4-fs (loop4): warning: mounting fs with errors, running e2fsck is recommended [ 560.898159][T10830] EXT4-fs (loop4): re-mounted. Opts: . Quota mode: writeback. [ 560.906218][T10830] ext4 filesystem being remounted at /392/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 560.967985][ T4375] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 561.083867][ T4375] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 561.427466][ T4375] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 561.682834][ T4375] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 562.733249][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.153689][ T7] usb 5-1: new full-speed USB device number 41 using dummy_hcd [ 563.266628][ T4375] tipc: Disabling bearer [ 563.318749][ T4375] tipc: Left network mode [ 563.377772][T10841] chnl_net:caif_netlink_parms(): no params data found [ 563.581383][ T7] usb 5-1: unable to get BOS descriptor or descriptor too short [ 563.651413][ T7] usb 5-1: not running at top speed; connect to a high speed hub [ 563.708797][T10841] bridge0: port 1(bridge_slave_0) entered blocking state [ 563.741553][T10841] bridge0: port 1(bridge_slave_0) entered disabled state [ 563.761506][ T7] usb 5-1: config 12 has an invalid interface number: 231 but max is 0 [ 563.762476][T10841] device bridge_slave_0 entered promiscuous mode [ 563.778363][T10841] bridge0: port 2(bridge_slave_1) entered blocking state [ 563.785488][T10841] bridge0: port 2(bridge_slave_1) entered disabled state [ 563.793560][T10841] device bridge_slave_1 entered promiscuous mode [ 563.810535][ T7] usb 5-1: config 12 has no interface number 0 [ 563.841003][ T7] usb 5-1: config 12 interface 231 has no altsetting 0 [ 564.019936][T10841] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 564.031444][ T7] usb 5-1: New USB device found, idVendor=2040, idProduct=9941, bcdDevice=93.b7 [ 564.054278][ T7] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.078696][ T7] usb 5-1: Product: syz [ 564.091259][ T7] usb 5-1: Manufacturer: syz [ 564.130733][ T7] usb 5-1: SerialNumber: syz [ 564.174050][T10841] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 564.335672][T10841] team0: Port device team_slave_0 added [ 564.386448][T10841] team0: Port device team_slave_1 added [ 564.434742][T10841] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 564.455578][T10841] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 564.530173][T10841] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 564.548311][T10858] xt_recent: hitcount (262144) is larger than allowed maximum (255) [ 564.571243][ T4528] Bluetooth: hci0: command 0x0409 tx timeout [ 564.669812][T10841] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 564.713423][T10841] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 564.715704][T10858] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1909'. [ 564.747540][T10841] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 566.016370][T10858] udc-core: couldn't find an available UDC or it's busy [ 566.023518][T10858] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 566.253919][T10841] device hsr_slave_0 entered promiscuous mode [ 566.280285][T10841] device hsr_slave_1 entered promiscuous mode [ 566.302907][T10841] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 566.333155][T10841] Cannot create hsr debugfs directory [ 566.473518][ T7] dvb-usb: found a 'Hauppauge Nova-T 500 Dual DVB-T' in cold state, will try to load a firmware [ 566.499802][ T7] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 566.555577][ T7] dib0700: firmware download failed at 7 with -71 [ 566.582895][ T7] usb 5-1: USB disconnect, device number 41 [ 566.653084][ T4530] Bluetooth: hci0: command 0x041b tx timeout [ 567.131319][ T7] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 567.171921][ T4375] device hsr_slave_0 left promiscuous mode [ 567.271448][ T4375] device hsr_slave_1 left promiscuous mode [ 567.308842][ T4375] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 567.350729][ T4375] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 567.390073][ T4375] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 567.450310][ T4375] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 567.461185][ T7] usb 1-1: Using ep0 maxpacket: 32 [ 567.581408][ T7] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 567.603978][ T7] usb 1-1: config 0 has no interfaces? [ 567.702382][ T4375] device bridge_slave_1 left promiscuous mode [ 567.742572][ T4375] bridge0: port 2(bridge_slave_1) entered disabled state [ 567.761476][ T7] usb 1-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 567.786934][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.795712][ T7] usb 1-1: Product: syz [ 567.807586][ T7] usb 1-1: Manufacturer: syz [ 567.828353][ T7] usb 1-1: SerialNumber: syz [ 567.849277][ T7] usb 1-1: config 0 descriptor?? [ 567.877839][ T4375] device bridge_slave_0 left promiscuous mode [ 567.902441][ T4375] bridge0: port 1(bridge_slave_0) entered disabled state [ 568.567156][ T4238] usb 1-1: USB disconnect, device number 50 [ 568.794060][ T4528] Bluetooth: hci0: command 0x040f tx timeout [ 569.230048][ T4375] device veth1_macvtap left promiscuous mode [ 569.262136][ T4375] device veth0_macvtap left promiscuous mode [ 569.490180][ T4375] device veth1_vlan left promiscuous mode [ 569.643107][ T4375] device veth0_vlan left promiscuous mode [ 570.143625][ T4375] team0 (unregistering): Port device bridge2 removed [ 570.259935][ T4375] bond4 (unregistering): Released all slaves [ 570.299875][ T4375] bond3 (unregistering): (slave geneve2): Releasing active interface [ 570.328453][ T4375] bond3 (unregistering): Released all slaves [ 570.371022][ T4375] bond2 (unregistering): Released all slaves [ 570.395876][ T4375] bond1 (unregistering): Released all slaves [ 570.485733][ T4375] team0 (unregistering): Port device macvlan0 removed [ 570.611772][ T4375] team0 (unregistering): Port device team_slave_1 removed [ 570.653856][ T4375] team0 (unregistering): Port device team_slave_0 removed [ 570.667793][ T4375] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 570.684250][ T4375] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 570.766796][ T4375] bond0 (unregistering): Released all slaves [ 570.811317][ T5237] Bluetooth: hci0: command 0x0419 tx timeout [ 570.979101][T10977] loop3: detected capacity change from 0 to 512 [ 571.043799][T10841] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 571.142295][T10841] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 571.179744][T10841] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 571.229715][T10977] EXT4-fs (loop3): 1 truncate cleaned up [ 571.235569][T10977] EXT4-fs (loop3): mounted filesystem without journal. Opts: noload,stripe=0x000000000000030c,jqfmt=vfsv1,nojournal_checksum,jqfmt=vfsv1,usrjquota=,,errors=continue. Quota mode: none. [ 571.262068][T10841] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 571.841603][ T26] audit: type=1804 audit(2000000458.519:157): pid=10990 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.1931" name="/newroot/365/file1/bus" dev="loop3" ino=19 res=1 errno=0 [ 572.234392][T10841] 8021q: adding VLAN 0 to HW filter on device bond0 [ 572.330414][T10841] 8021q: adding VLAN 0 to HW filter on device team0 [ 572.368438][ T4187] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz-executor: invalid indirect mapped block 4294901760 (level 0) [ 572.391714][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 572.402324][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 572.442185][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 572.481948][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 572.551670][ T8729] bridge0: port 1(bridge_slave_0) entered blocking state [ 572.558832][ T8729] bridge0: port 1(bridge_slave_0) entered forwarding state [ 572.580727][ T4187] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz-executor: invalid indirect mapped block 4294967295 (level 1) [ 572.608042][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 572.619112][ T4187] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #13: comm syz-executor: invalid indirect mapped block 65535 (level 2) [ 572.642213][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 572.651867][ T8729] bridge0: port 2(bridge_slave_1) entered blocking state [ 572.658945][ T8729] bridge0: port 2(bridge_slave_1) entered forwarding state [ 572.704717][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 572.739773][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 572.759583][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 572.831523][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 572.867837][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 572.929778][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 572.944495][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 572.992718][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 573.024899][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 573.038601][T11020] loop4: detected capacity change from 0 to 256 [ 573.052251][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 573.097336][T11020] exFAT-fs (loop4): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 573.138609][T10841] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 573.179133][T10841] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 573.209651][ T4653] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 573.236159][ T4653] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 574.467892][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 574.481327][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 574.535609][T10841] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 575.289339][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 575.319873][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 575.402993][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 575.453153][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 575.500054][T10841] device veth0_vlan entered promiscuous mode [ 575.540500][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 575.584469][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 575.617029][T10841] device veth1_vlan entered promiscuous mode [ 575.753567][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 575.812185][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 576.066632][T10841] device veth0_macvtap entered promiscuous mode [ 576.288353][T10841] device veth1_macvtap entered promiscuous mode [ 576.583387][ T5409] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 576.596748][ T5409] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 576.627054][T10841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 576.658728][T10841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 576.688745][T10841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 576.717309][T10841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 576.768170][T10841] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 576.779241][ T4374] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 576.796615][ T4374] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 576.836616][T10841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 576.857465][T10841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 576.888096][T10841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 576.906352][ T5228] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 576.934455][T10841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 576.966917][T10841] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 576.997677][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 577.013027][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 577.055438][T10841] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 577.088692][T10841] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 577.143865][T10841] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 577.374678][T10841] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 577.981513][ T5228] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 578.001176][ T5228] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 578.173474][ T5228] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 578.204423][ T5228] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 578.221491][ T5228] usb 1-1: SerialNumber: syz [ 578.479819][ T4374] Bluetooth: hci5: received HCILL_GO_TO_SLEEP_ACK in state 0 [ 578.671065][ T4374] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 578.672723][ T4216] Bluetooth: hci5: Frame reassembly failed (-84) [ 578.700308][ T4374] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 578.781999][ T4216] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 578.827477][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 578.843244][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 578.868546][ T4216] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 579.033709][ T5228] usb 1-1: 0:2 : does not exist [ 579.081385][ T5228] usb 1-1: USB disconnect, device number 51 [ 579.317164][T11079] udevd[11079]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 580.651219][ T4232] Bluetooth: hci5: command 0x1003 tx timeout [ 580.657376][ T4202] Bluetooth: hci5: sending frame failed (-49) [ 582.731519][ T4738] Bluetooth: hci5: command 0x1001 tx timeout [ 582.742069][ T4202] Bluetooth: hci5: sending frame failed (-49) [ 583.619526][T11198] loop5: detected capacity change from 0 to 4096 [ 583.724385][T11198] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 583.724385][T11198] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 583.724385][T11198] [ 584.138878][T11198] EXT4-fs (loop5): Ignoring removed orlov option [ 584.204425][T11198] EXT4-fs (loop5): mounted filesystem without journal. Opts: grpid,barrier,data_err=abort,discard,nouser_xattr,nodelalloc,nobarrier,orlov,,errors=continue. Quota mode: writeback. [ 584.451245][ T7] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 584.492094][T11198] loop_set_status: loop5 () has still dirty pages (nrpages=7) [ 584.811207][ T4232] Bluetooth: hci5: command 0x1009 tx timeout [ 585.099053][T10841] [ 585.101432][T10841] ====================================================== [ 585.108615][T10841] WARNING: possible circular locking dependency detected [ 585.115651][T10841] syzkaller #0 Not tainted [ 585.120068][T10841] ------------------------------------------------------ [ 585.127080][T10841] syz-executor/10841 is trying to acquire lock: [ 585.133314][T10841] ffff88805fc18ea8 (&dquot->dq_lock){+.+.}-{3:3}, at: dquot_commit+0x5a/0x410 [ 585.142205][T10841] [ 585.142205][T10841] but task is already holding lock: [ 585.149568][T10841] ffff88807473e628 (&ei->i_data_sem/2){++++}-{3:3}, at: ext4_truncate+0x97f/0x10f0 [ 585.158897][T10841] [ 585.158897][T10841] which lock already depends on the new lock. [ 585.158897][T10841] [ 585.169304][T10841] [ 585.169304][T10841] the existing dependency chain (in reverse order) is: [ 585.178323][T10841] [ 585.178323][T10841] -> #2 (&ei->i_data_sem/2){++++}-{3:3}: [ 585.186160][T10841] down_read+0x44/0x2e0 [ 585.190849][T10841] ext4_map_blocks+0x33c/0x1b30 [ 585.196230][T10841] ext4_getblk+0x176/0x670 [ 585.201176][T10841] ext4_bread+0x26/0x180 [ 585.205945][T10841] ext4_quota_read+0x1b3/0x3a0 [ 585.211240][T10841] find_tree_dqentry+0x188/0xb30 [ 585.216711][T10841] find_tree_dqentry+0x3eb/0xb30 [ 585.222176][T10841] qtree_read_dquot+0x13c/0x680 [ 585.227558][T10841] v2_read_dquot+0xc0/0x110 [ 585.232585][T10841] dquot_acquire+0x152/0x520 [ 585.237727][T10841] ext4_acquire_dquot+0x2d9/0x4a0 [ 585.243280][T10841] dqget+0x778/0xeb0 [ 585.247705][T10841] __dquot_initialize+0x3c3/0xcd0 [ 585.253263][T10841] ext4_process_orphan+0x54/0x300 [ 585.258813][T10841] ext4_orphan_cleanup+0xad2/0x1320 [ 585.264538][T10841] ext4_fill_super+0x8d6e/0x94f0 [ 585.270006][T10841] mount_bdev+0x287/0x3c0 [ 585.274865][T10841] legacy_get_tree+0xe6/0x180 [ 585.280074][T10841] vfs_get_tree+0x88/0x270 [ 585.285015][T10841] do_new_mount+0x24a/0xa40 [ 585.290046][T10841] __se_sys_mount+0x2e3/0x3d0 [ 585.295262][T10841] do_syscall_64+0x4c/0xa0 [ 585.300217][T10841] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 585.306646][T10841] [ 585.306646][T10841] -> #1 (&s->s_dquot.dqio_sem){++++}-{3:3}: [ 585.314743][T10841] down_read+0x44/0x2e0 [ 585.319426][T10841] v2_read_dquot+0x4a/0x110 [ 585.324455][T10841] dquot_acquire+0x152/0x520 [ 585.329568][T10841] ext4_acquire_dquot+0x2d9/0x4a0 [ 585.335119][T10841] dqget+0x778/0xeb0 [ 585.339541][T10841] __dquot_initialize+0x3c3/0xcd0 [ 585.345092][T10841] ext4_process_orphan+0x54/0x300 [ 585.350642][T10841] ext4_orphan_cleanup+0xad2/0x1320 [ 585.356376][T10841] ext4_fill_super+0x8d6e/0x94f0 [ 585.361847][T10841] mount_bdev+0x287/0x3c0 [ 585.366706][T10841] legacy_get_tree+0xe6/0x180 [ 585.371911][T10841] vfs_get_tree+0x88/0x270 [ 585.376857][T10841] do_new_mount+0x24a/0xa40 [ 585.381886][T10841] __se_sys_mount+0x2e3/0x3d0 [ 585.387086][T10841] do_syscall_64+0x4c/0xa0 [ 585.392030][T10841] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 585.398477][T10841] [ 585.398477][T10841] -> #0 (&dquot->dq_lock){+.+.}-{3:3}: [ 585.406127][T10841] __lock_acquire+0x2c42/0x7d10 [ 585.411512][T10841] lock_acquire+0x19e/0x400 [ 585.416540][T10841] __mutex_lock_common+0x1e3/0x2400 [ 585.422268][T10841] mutex_lock_nested+0x17/0x20 [ 585.427559][T10841] dquot_commit+0x5a/0x410 [ 585.432509][T10841] ext4_write_dquot+0x1f0/0x360 [ 585.437895][T10841] mark_all_dquot_dirty+0xf9/0x400 [ 585.443543][T10841] __dquot_free_space+0x7ca/0xb90 [ 585.449097][T10841] ext4_free_blocks+0x1b2b/0x24d0 [ 585.454657][T10841] ext4_ext_remove_space+0x211e/0x42b0 [ 585.460658][T10841] ext4_ext_truncate+0x192/0x240 [ 585.466126][T10841] ext4_truncate+0xa09/0x10f0 [ 585.471330][T10841] ext4_evict_inode+0xb4f/0x1090 [ 585.476798][T10841] evict+0x4c9/0x8d0 [ 585.481234][T10841] vfs_rmdir+0x3b4/0x430 [ 585.486009][T10841] do_rmdir+0x2a1/0x740 [ 585.490696][T10841] __x64_sys_unlinkat+0xc0/0xe0 [ 585.496082][T10841] do_syscall_64+0x4c/0xa0 [ 585.501150][T10841] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 585.507591][T10841] [ 585.507591][T10841] other info that might help us debug this: [ 585.507591][T10841] [ 585.517834][T10841] Chain exists of: [ 585.517834][T10841] &dquot->dq_lock --> &s->s_dquot.dqio_sem --> &ei->i_data_sem/2 [ 585.517834][T10841] [ 585.531493][T10841] Possible unsafe locking scenario: [ 585.531493][T10841] [ 585.538933][T10841] CPU0 CPU1 [ 585.544284][T10841] ---- ---- [ 585.549631][T10841] lock(&ei->i_data_sem/2); [ 585.554215][T10841] lock(&s->s_dquot.dqio_sem); [ 585.561623][T10841] lock(&ei->i_data_sem/2); [ 585.568728][T10841] lock(&dquot->dq_lock); [ 585.573128][T10841] [ 585.573128][T10841] *** DEADLOCK *** [ 585.573128][T10841] [ 585.581254][T10841] 5 locks held by syz-executor/10841: [ 585.586686][T10841] #0: ffff88807dd0c460 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x3d/0x90 [ 585.595816][T10841] #1: ffff88805e7653b0 (&type->i_mutex_dir_key#4/1){+.+.}-{3:3}, at: do_rmdir+0x1c1/0x740 [ 585.605812][T10841] #2: ffff88807dd0c650 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x44a/0x1090 [ 585.615281][T10841] #3: ffff88807473e628 (&ei->i_data_sem/2){++++}-{3:3}, at: ext4_truncate+0x97f/0x10f0 [ 585.625094][T10841] #4: ffffffff8c4415f8 (dquot_srcu){....}-{0:0}, at: rcu_lock_acquire+0x5/0x30 [ 585.634134][T10841] [ 585.634134][T10841] stack backtrace: [ 585.640011][T10841] CPU: 0 PID: 10841 Comm: syz-executor Not tainted syzkaller #0 [ 585.647627][T10841] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 585.657718][T10841] Call Trace: [ 585.660998][T10841] [ 585.663920][T10841] dump_stack_lvl+0x188/0x250 [ 585.668590][T10841] ? load_image+0x400/0x400 [ 585.673084][T10841] ? show_regs_print_info+0x20/0x20 [ 585.678274][T10841] ? print_circular_bug+0x12b/0x1a0 [ 585.683461][T10841] check_noncircular+0x296/0x330 [ 585.688387][T10841] ? add_chain_block+0x940/0x940 [ 585.693334][T10841] ? lockdep_lock+0xf1/0x1f0 [ 585.697917][T10841] ? mark_lock+0x94/0x320 [ 585.702239][T10841] ? mark_lock+0x94/0x320 [ 585.706577][T10841] __lock_acquire+0x2c42/0x7d10 [ 585.711424][T10841] ? __bfs+0x2a3/0x5c0 [ 585.715485][T10841] ? verify_lock_unused+0x140/0x140 [ 585.720671][T10841] ? check_noncircular+0x189/0x330 [ 585.725776][T10841] ? add_chain_block+0x940/0x940 [ 585.730699][T10841] ? lockdep_lock+0xf1/0x1f0 [ 585.735277][T10841] ? lockdep_unlock+0x143/0x2e0 [ 585.740119][T10841] lock_acquire+0x19e/0x400 [ 585.744611][T10841] ? dquot_commit+0x5a/0x410 [ 585.749187][T10841] ? __might_sleep+0xf0/0xf0 [ 585.753764][T10841] ? read_lock_is_recursive+0x10/0x10 [ 585.759134][T10841] ? mark_lock+0x94/0x320 [ 585.763451][T10841] ? dquot_commit+0x5a/0x410 [ 585.768029][T10841] __mutex_lock_common+0x1e3/0x2400 [ 585.773219][T10841] ? dquot_commit+0x5a/0x410 [ 585.777799][T10841] ? mark_lock+0x94/0x320 [ 585.782121][T10841] ? __might_sleep+0xf0/0xf0 [ 585.786724][T10841] ? mutex_lock_io_nested+0x60/0x60 [ 585.791910][T10841] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 585.797881][T10841] mutex_lock_nested+0x17/0x20 [ 585.802639][T10841] dquot_commit+0x5a/0x410 [ 585.807095][T10841] ? __ext4_journal_start_sb+0x1bd/0x360 [ 585.812719][T10841] ext4_write_dquot+0x1f0/0x360 [ 585.817572][T10841] mark_all_dquot_dirty+0xf9/0x400 [ 585.822669][T10841] __dquot_free_space+0x7ca/0xb90 [ 585.827686][T10841] ext4_free_blocks+0x1b2b/0x24d0 [ 585.832705][T10841] ? ext4_mb_discard_preallocations_should_retry+0x690/0x690 [ 585.840068][T10841] ? do_raw_read_unlock+0x39/0x70 [ 585.845089][T10841] ? _raw_read_unlock+0x24/0x40 [ 585.849928][T10841] ? ext4_is_pending+0x176/0x1c0 [ 585.854858][T10841] ext4_ext_remove_space+0x211e/0x42b0 [ 585.860320][T10841] ? ext4_ext_index_trans_blocks+0xf0/0xf0 [ 585.866123][T10841] ? ext4_es_remove_extent+0x24f/0x3e0 [ 585.871585][T10841] ext4_ext_truncate+0x192/0x240 [ 585.876534][T10841] ext4_truncate+0xa09/0x10f0 [ 585.881217][T10841] ? __ext4_mark_inode_dirty+0x700/0x700 [ 585.886859][T10841] ext4_evict_inode+0xb4f/0x1090 [ 585.891917][T10841] ? _raw_spin_unlock+0x24/0x40 [ 585.896760][T10841] ? ext4_inode_is_fast_symlink+0x390/0x390 [ 585.902650][T10841] ? do_raw_spin_unlock+0x11d/0x230 [ 585.907856][T10841] ? ext4_inode_is_fast_symlink+0x390/0x390 [ 585.913738][T10841] evict+0x4c9/0x8d0 [ 585.917629][T10841] ? proc_nr_inodes+0x320/0x320 [ 585.922469][T10841] ? do_raw_spin_unlock+0x11d/0x230 [ 585.927654][T10841] ? _raw_spin_unlock+0x24/0x40 [ 585.932489][T10841] ? iput+0x706/0x8a0 [ 585.936461][T10841] vfs_rmdir+0x3b4/0x430 [ 585.940695][T10841] do_rmdir+0x2a1/0x740 [ 585.944838][T10841] ? __phys_addr_symbol+0x2b/0x70 [ 585.949855][T10841] ? d_delete_notify+0x150/0x150 [ 585.954788][T10841] ? strncpy_from_user+0x1fb/0x360 [ 585.959916][T10841] ? getname_flags+0x1fe/0x500 [ 585.964677][T10841] __x64_sys_unlinkat+0xc0/0xe0 [ 585.969518][T10841] do_syscall_64+0x4c/0xa0 [ 585.973921][T10841] ? clear_bhb_loop+0x30/0x80 [ 585.978591][T10841] ? clear_bhb_loop+0x30/0x80 [ 585.983262][T10841] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 585.989163][T10841] RIP: 0033:0x7f70e082cef7 [ 585.993571][T10841] Code: 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 b8 07 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 586.013171][T10841] RSP: 002b:00007ffefc8acdf8 EFLAGS: 00000207 ORIG_RAX: 0000000000000107 [ 586.021574][T10841] RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 00007f70e082cef7 [ 586.029541][T10841] RDX: 0000000000000200 RSI: 00007ffefc8adfa0 RDI: 00000000ffffff9c [ 586.037509][T10841] RBP: 00007f70e08c3120 R08: 0000000000018560 R09: 0000000000000001 [ 586.045471][T10841] R10: 0000000000000000 R11: 0000000000000207 R12: 00007ffefc8adfa0 [ 586.053435][T10841] R13: 00007f70e08c3120 R14: 000000000008ebb3 R15: 00007ffefc8b0160 [ 586.061401][T10841] [ 586.113771][ T7] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 586.127647][ T7] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 586.211369][ T7] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 586.220885][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 586.229881][ T7] usb 1-1: SerialNumber: syz [ 586.572969][ T7] usb 1-1: 0:2 : does not exist [ 586.583517][ T7] usb 1-1: USB disconnect, device number 52 [ 586.791764][T11079] udevd[11079]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory