last executing test programs: 5m47.514170944s ago: executing program 2 (id=959): syz_usbip_server_init(0x3) syz_usbip_server_init(0x3) syz_usbip_server_init(0x3) syz_usbip_server_init(0x3) syz_usbip_server_init(0x3) 5m45.730344749s ago: executing program 2 (id=966): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000000c0)=ANY=[@ANYBLOB="380000006c00010025bd7000ffdbdf2500000000", @ANYRES32=r3, @ANYBLOB="800001001800000018003480140035"], 0x38}, 0x1, 0x0, 0x0, 0x40800c0}, 0x4008010) 5m45.499734265s ago: executing program 2 (id=970): socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x4048aecb, &(0x7f0000000080)) 5m45.207241382s ago: executing program 2 (id=973): openat$rfkill(0xffffffffffffff9c, 0x0, 0x2642, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) 5m45.051944696s ago: executing program 2 (id=975): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./sys/kernel/tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/kernel/tracing/instances/A\x00', 0x1ff) 5m44.047159272s ago: executing program 2 (id=977): r0 = socket(0x10, 0x803, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x275a, 0x0) fcntl$lock(r1, 0x6, &(0x7f0000000080)={0x1, 0x1}) r2 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r3 = getpid() mlock(&(0x7f00009a7000/0x4000)=nil, 0x4000) r4 = syz_open_dev$mtd(&(0x7f0000000100), 0x48a99fbe, 0x10b241) ioctl$MTDFILEMODE(r4, 0x4d13, 0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000a50000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7050000080000a8c5000000a5000000180100002020640500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b300000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x35, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) eventfd(0xfffffff9) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) bind$can_j1939(r2, &(0x7f0000000380)={0x1d, 0x0, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2) syz_genetlink_get_family_id$wireguard(&(0x7f0000000280), r2) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0x4}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0x3, 0x1, 0x8, 0x9, 0xfffffffc, 0x1a000, 0x8, 0x4}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 5m28.990515775s ago: executing program 32 (id=977): r0 = socket(0x10, 0x803, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x275a, 0x0) fcntl$lock(r1, 0x6, &(0x7f0000000080)={0x1, 0x1}) r2 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r3 = getpid() mlock(&(0x7f00009a7000/0x4000)=nil, 0x4000) r4 = syz_open_dev$mtd(&(0x7f0000000100), 0x48a99fbe, 0x10b241) ioctl$MTDFILEMODE(r4, 0x4d13, 0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000a50000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7050000080000a8c5000000a5000000180100002020640500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b300000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x35, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) eventfd(0xfffffff9) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) bind$can_j1939(r2, &(0x7f0000000380)={0x1d, 0x0, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2) syz_genetlink_get_family_id$wireguard(&(0x7f0000000280), r2) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0x4}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0x3, 0x1, 0x8, 0x9, 0xfffffffc, 0x1a000, 0x8, 0x4}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 5m17.199257215s ago: executing program 0 (id=1090): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[@text32={0x20, &(0x7f00000000c0)="0f0b6b766d0f05", 0x7}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000100)={0x1, 0x0, [{0x0, 0x0, 0x0, 0x0, 0x68747541, 0x444d4163, 0x69746e65}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5m16.587309121s ago: executing program 0 (id=1092): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xa, 0x5, 0x2, 0x4}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000001c40)={0x4, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7020000010000ee850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24048045}, 0x20000000) 5m16.063270124s ago: executing program 0 (id=1093): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20040000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000000c0)={0x44, 0x0, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_FRAME={0x26, 0x33, @action={{{}, {0x9}, @device_b, @device_b, @from_mac=@device_b}, @channel_switch={0x0, 0x4, {{0x25, 0x3}, @val={0x3e, 0x1, 0x20}, @void}}}}]}, 0x44}}, 0x0) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x79b}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[], 0x20}}, 0x0) io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) 5m14.632114611s ago: executing program 0 (id=1097): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x80500, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xe) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000100)=0x1) ioctl$PPPIOCATTCHAN(r1, 0x40047454, 0x0) 5m14.310773359s ago: executing program 0 (id=1100): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0xa82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f00000000c0)={0xc, 0x0, 0x5a}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000019000/0x18000)=nil, &(0x7f0000000980)=[@text64={0x40, 0x0}], 0x1, 0x79, &(0x7f00000001c0)=[@cr4={0x1, 0x8045}], 0x1) ioctl$KVM_X86_SET_MCE(r2, 0x4040ae9e, &(0x7f00000004c0)={0xf900000000000000, 0x4, 0x1008000009, 0x0, 0x2}) ioctl$KVM_X86_SET_MCE(r2, 0x4040ae9e, &(0x7f0000000000)={0xe200000000000000, 0x3000, 0xfffffffffffffffd, 0x2, 0x2}) 5m12.383231608s ago: executing program 0 (id=1111): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x4, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x14, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5m11.931031219s ago: executing program 33 (id=1111): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x4, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x14, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4m21.340354877s ago: executing program 3 (id=1314): syz_usb_connect(0x0, 0x2d, 0x0, 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000280), 0xa2040, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) symlinkat(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00') chdir(&(0x7f0000000140)='./file0\x00') ioctl$TCSETS(r2, 0x40045431, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x22, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) modify_ldt$write2(0x11, &(0x7f0000000040)={0x0, 0x100000, 0x4000, 0x0, 0x2, 0x1, 0x1, 0x0, 0x1, 0x1}, 0x10) modify_ldt$read(0x0, 0x0, 0x11) r4 = syz_open_pts(r2, 0x141601) ioctl$TIOCGPTPEER(r2, 0x5441, 0x2185) fcntl$setstatus(r4, 0x4, 0x102800) close_range(r1, r2, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) r5 = gettid() timer_create(0x2, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) read$char_usb(r0, &(0x7f00000002c0)=""/151, 0x97) timer_settime(0x0, 0x0, 0x0, 0x0) close(r0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000040), 0x104, 0x0) unshare(0x6a040000) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) 4m19.631222651s ago: executing program 3 (id=1322): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2}, 0x28) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000100)={0x0, 0x0}) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) 4m19.130770113s ago: executing program 3 (id=1325): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000001000)=ANY=[@ANYBLOB="1201000200000040501d4d610001000000010902200001010080320904000002ff0000000705010200020007058202000200"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000100)={0x40, 0x1, 0x1e, "4d61501d0100000000000000100000000000800700000000000038040000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000200)={0x40, 0x40, 0x1, "80"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000300)={0x40, 0x50}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000400)={0x40, 0x51, 0x8, "0102030405060708"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000500)={0x40, 0x54, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000600)={0x40, 0x56, 0x7d, "00ffffffffffff0004430100000000000000010480000000010000000000000000000000000001010101010101010101010101010101000000fd00324b1e53110200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002c"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4m15.414910478s ago: executing program 3 (id=1343): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000280)='./file0\x00', 0x280440e, &(0x7f0000000500)={[{@debug}, {@test_dummy_encryption_v1}, {@inlinecrypt}, {@delalloc}, {@noinit_itable}, {@norecovery}, {@minixdf}, {@nodioread_nolock}, {@errors_remount}, {@jqfmt_vfsv0}, {@usrquota}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x8}}]}, 0x1, 0xbdb, &(0x7f0000001000)="$eJzs3M1rHOcZAPBnRqsP23JXLqXUvVilFBtK17KLTG0KtYtLLz0U2mvBQl4ZofUHkoorWdBV8g+EJP9ALjkkJsGH+OxLArnmkjjXmBwCJihWAiEkCrMfkiztSpa1q1Hk3w9ezfsxM+/zaKSdeWF3A3hhDWc/0ojjEXEliSg2+tOI6KvVBiKq9f2WlxbGv1laGE9iZeVfXyaRRMSTpYXx5rmSxvZIozEQER/9NYmfv7x53pm5+amxSqU83Wifnr1+6/TM3PwfJq+PXStfK984c+5Po2dHz42cH+1Yrt9+dvH+17/5++fV7976/u5Xr72ZxMUYbIytz6OR9a4Nx/Dq72S9QkSMdeD8+0FPI5/1eSaFbQ5KuxwUAABtpeue4X4ZxeiJtYe3Yrz/ca7BAQAAAB2x0hOxAgAAABxwifU/AAAAHHDN9wE8WVoYb5Z835Gwtx5fioihev7LjVIfKUS1th2I3og4/CSJ9R9rTeqH7dpwRDz69Py7WYkWn0PutupiRPyq1fVPavkPNT4JvTH/NCJGOjD/8Ib2Tyn/ix2YP+/8AXgxPbhUv5Ftvv+lq88/0eL+V2hx73oeed//ms9/y5ue/9by72nz/PfPZ5zjTiFutxvL8v/z/b+90yzZ/Nl2V0ntwOPFiF8XWuWfrOaftMn/yjbnTqJ+iuIPt8vt9sk7/5U3Ik5G6/ybkq2/n+j0xGSlPFL/2XKOxQ9H3243f975Z9f/cJv8t7j+A1nfrafO1P5Lff5z+fK9TZ2N3bfPP/2iL/l3rdbX6Pnf2Ozs9JmIvuQfm/vPbp1vc5/mObL8T/126///Vn//2WtCtfG3kaWy2Nhm7Zc2zPmXu3feaxdPc/2X5/W/uvPrX+t75Rnn+N0Hr57a2Nf8fq3169+sZPM/SuprYQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABoSiNiMJK0FBFJrZ6mpVLEkYj4RRxOKzdnZn8/cfO/N65mYxFD0ZtOTFbKIxFRrLeTrH2mVl9rn93Q/mNEHIuI14uHau3S+M3K1byTBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYNWRiBiMJC1FRBoRy8U0LZXyjgoAAADouKG8AwAAAAC6zvofAAAADj7rfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALrs2IkHD5OIqF44VCuZvsZYb66RAd2W5h0AkJuevAMAclPIOwAgNztc43tcgAMo2WZ8oGVv9urR35V4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANifTh5/8DCJiOqFQ7WS6WuM9bY84sQeRgd0U5p3AEBuerYaLOxdHMDee+5/8aOdjQPYe63X+MCLJNlmfGBtn+rTI/1diwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/WewVpK0FBFprZ6mpVLE0YgYit5kYrJSHomIn0XEJ8Xe/qzdn3fQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdNzM3PzUWKVSnn6eSrK7w1VU2lX+vz/C2NtKUqsM5B1GvZL3KxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHmYmZufGqtUytMzeUcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5G1mbn5qrFIpTz9D5d5Odl5XyTtHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADy82MAAAD//1sCDDY=") syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x408e, &(0x7f0000000240), 0x0, 0x44f, &(0x7f0000001c00)="$eJzs3MtvG8UfAPDvruP0/Ut+pTz6AAIFEfFImrRAD1xAIHEACQkO5RiStCp1G9QEiVYVFITKEVXijjgi8RdwggsCTkhc4Y4qVaiXFk5Ga+82tmunTojjEH8+0rYzu+PMfD079uxONgEMrLHsnyRid0T8FhEj9WxzgbH6f7duXJr968al2SSq1Tf/TGrlbt64NFsULV63K8+MpxHpp0kcbFPv4oWLZ2YqlfnzeX5y6ex7k4sXLj5z+uzMqflT8+emjx8/dnTq+eemn12XOLM23Tzw4cKh/a++ffX12RNX3/npm6SIvyWOdTK20sHHq9V1rq6/9jSkk6E+NoRVKUVE1l3l2vgfiVIsd95IvPJJXxsH9FS1Wq3u6nz4chXYwpLotuSZ/PMC2BqKL/rs+rfYNmjqsSlcf7F+AZTFfSvf6keGIs3LlFuub9fTWEScuPz3l9kWvbkPAQDQ5Lts/vN0u/lfGvc1lPtfvjY0GhH/j4i9EXFPROyLiHsjamXvj4gHVll/6yLJnfOf9NqaAutSNv97IV/bap7/FbO/GC3luT21+MvJydOV+SP5ezIe5W1ZfmqFOr5/+dfPOx1rnP9lW1Z/MRfM23FtaFvza+Zmlmb+TcyNrn8ccWCoXfzJ7ZWAJCL2R8SBNdZx+smvD3U61in+cjc/eB3WmapfRTxR7//L0RJ/IVl5fXJye1Tmj0wWZ8Wdfv7lyhud6r97//dW1v87257/t+MfTRrXaxdXX8eV3z/reE2z1vN/OHmrlh7O930ws7R0fipiOHmt3ujG/dPLry3yRfks/vHD7cf/3lh+Jw5GRHYSPxgRD0XEw3nbH4mIRyPi8Arx//jSY++uPf7eyuKfW1X/LyeGo3VP+0TpzA/fNlU6upr4s/4/VkuN53u6+fzrpl1rO5sBAADgvyeNiN2RpBO302k6MVH/ffl9sTOtLCwuPXVy4f1zc/VnBEajnBZ3ukYa7odO5Zf1RX66JX80v2/8RWlHLT8xu1CZ63fwMOB2dRj/mT9K/W4d0HOe14LBZfzD4DL+YXAZ/zC42oz/Hf1oB7DxauN/e/O+j/rUFmBjtXz/W/aDAeL6HwaX8Q+Dqxj/1W19bgiwkRZ3xN0fkm9ObI+IrgtLbNVEpJuiGRI9StQ+Hrr6MzwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACb2T8BAAD//yrT4qg=") mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x109041, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000480)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x2, 0x7fff0000}]}) mount$bind(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000180)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x2859052, 0x0) mount$bind(&(0x7f0000000880)='./file0/../file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x1adc11, 0x0) mount$bind(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000000)='./file0/file0\x00', 0x0, 0x887008, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r0, &(0x7f0000004200)={0x2020}, 0x2020) 4m14.852961412s ago: executing program 3 (id=1345): r0 = syz_mount_image$udf(&(0x7f0000000c40), &(0x7f00000000c0)='./file1\x00', 0x200000, &(0x7f0000000000)=ANY=[@ANYBLOB='noadinicb,nostrict,mode=00000000000000000000004,uid=forget,noadinicb,umask=00000000000000040002000,lastblock=00000000000000000013,undelete,partition=00000000000000000005,\x00'], 0x47, 0xc11, &(0x7f0000000d00)="$eJzs3V1oXOl5B/DnnSOtRto00WYTb9Jm04GUxCi18VdsBZcgZxW1AccbIit0r6LRh51h5ZGR5MabtkFtSQu9Cd2b0psimi4t5KJX3V5WabaQUAol5CK9KAiaLHvRC10ECi0bhXPmHWlky7ayXlvS7u+3zP7PnHnO+P0YnzkCvzoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAER89nOXTp1OB90KAOBxujL5pVNnff8DwLvKVT//AwAAAAAAAAAAAADAYZeiiGORYujVzTRdPe+oX261b92eGp/Y+7DBFClqUVT15aN++szZc586f2G0m/c//u324Xh+8uqlxnOLN24uzS8vz881ptqt2cW5+X2/w8Mef6eRagAaN168NXft2nLjzMmzu16+Pfz6wJPHhi9eOHF+tFs7NT4xMdlT09f/lv/0u9xrhccTUUQzUrw5/EZqRkQtHn4sHvDZedQGq06MVJ2YGp+oOrLQarZXyhdTLVfVIho9B411x+gxzMVDGYtYLZtfNnik7N7kzeZSc2ZhvvHF5tJKa6W12E61TmvL/jSiFqMpYi0iNgbufrv+KOKjkeLlU5tpJiKK7jh8sloY/OD21B5BH/ehbGejP2KtdgTm7BAbiCKuRIqfvXY8Zssxy4/4eMQXynw14pUyPxORyg/GuYif7vE54mjqiyL+PVIsps00V50PuueVy19ufL59bbGntnteOfLfD4/TIT831aOImeqMv5ne+sUOAAAAAAAAAAAAAAAAAG+3wSji25HiT579vWpdcVTr0t93cfQ9L/x275rxZx7wPmXtyYhYre1vTW5/XjqcauV/j6Bj7Es9ivhGXv/3RwfdGAAAAAAAAAAAAAAAAAAAgHe1Il6IFF85cTytRe89xVvt642rzZmFzl1hu/f+7d4zfWtra6uROjmWczrnas61nOs5N3JGLR+fcyzndM7VnGs513Nu5IwiH59zLOd0ztWcaznXc27kjL58fM6xnNM5V3Ou5VzPuZEzDsm9ewEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3klqUcTPI8W3vraZIkXEWMR0dHJ94KBbBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACU6qmIk5Fi/YV69XytFnE1In6+tbXVfUTEZpkP66D7CgAAAAAAAAAAAAAAAAAAAIdWKuJjkeLp/9tMjYi4Pfz6wJPHhi9eOHF+tIgiUlnSW//85NVLjecWb9xcml9enp9rTLVbs4tz8/v94+qXW+1bt6fGJx5JZx5o8BG3f7D+3OLNl5Za17+6sufrQ/VLM8srS83ZvV+OwahFTPfuGakaPDU+UTV6odVsV4em2j0aWIsY229nAAAAAAAAAAAAAAAAAAAAODSGUhGfixQ/+a9zqbtuvK+z5v9XOs+K7dpX/mDndwEs3JFdvb8/YD/bab8NHakW3jemxicmJnt29/XfXVq2KaUinokUn3j5Q9V6+BRDe66NL+veW9bdOJfrhn+trFvdVVUfmRqfaFxZbJ+4tLCwONtcac4szDcmbzZn9/2LAwAAAAAAAAAAAAAAAAAAAOA+hlIRP4oU//P3/5G6953P6//7Os961v//VrWEvlJPu3Nbtbb/vdXa/s72+y6ODn302XvtfxTr/8s2pVTENyPF2R99qLqffnf9//QdtWXdn0WKN579SK6rPVHWNbvd6bzjtdbC/Kmy9q8jxa+/2a2NqvZ6rn16p/Z0WTsYKf5yc3ftV3PtB3Zqz5S1xyPF9/5779oP7tSeLWt/Ein+6e8a3dqhsvb3c+2xndqTs4sLcw8a1nL+vxMp/vbK76Run+85/z2//2H1jtx215zff/vtmv/hnn2reV7/NM9/8wHzfz5SfKf+kVzXGfuZ/PpT1f935v8TkeI//2137bVc+/6d2tP77dZBK+f/25Hiu3/14+0+5/nPI7szQ73z/6t9u3P7U3JA8/9Uz77h3K7ZX3Is3o2WX/r6i82FhfklGzZs2NjeOOgzE49D+f3/55Hi/48VqXsdk7//39N5tnP997/f2Pn+v3hHbjug7//39+y7mK9a+vsi6is3bvY/E1FffunrJ1o3mtfnr8+3z5w+9elPnz996vT5/ie6F3c7W/seu3eCcv5/ECl++A8/3P45Zvf1397X/0N35LYDmv+ne/u067pm30PxrlTO/99Eiqc+++Ptnzfvd/3f/fn/+Md25/bfvwOa/w/07BvO7Wr9kmMBAAAAAAAAAABwlAylIv4iUvzuH/9m6q4h2s+//5u7I7cd0L//Otazb+4xrWvY9yADABwi5fXfByPFP299f3st9+7rv/iNbm3v9d+9HIb7/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwFGXoog/jBRDr26m9YHyeUf9cqt96/bU+MTehw2mSFGLoqovH/XTZ86e+9T5C6PdvP/xb7cPx/OTVy81nlu8cXNpfnl5fq4x1W7NLs7N7/sdHvb4O41UA9C48eKtuWvXlhtnTp7d9fLt4dcHnjw2fPHCifOj3dqp8YmJyZ6avv63/KffJd1j/xNRxPcjxZvDb6TvDkTU4uHH4gGfnUdtsOrESNWJqfGJqiMLrWZ7pXwx1XJVLaLRc9BYd4wew1w8lLGI1bL5ZYNHyu5N3mwuNWcW5htfbC6ttFZai+1U67S27E8jajGaItYiYmPg7rfrjyK+GSlePrWZ/mUgouiOwyevTH7p1NkHt6f2CPq4D2U7G/0Ra7UjMGeH2EAU8Y+R4mevHY/vDUT0RecRH4/4QpmvRrxS5mciUvnBOBfx0z0+RxxNfVHEuUixmDbTawPl+aB7Xrn85cbn29cWe2q755Uj//3wOB3yc1M9ivhBdcbfTP/q7zUAAAAAAAAAAAAAAADAIVLEWqT4yonjqVofvL2muNW+3rjanFnoLOvrrv3rrpne2traaqROjuWczrmacy3nes6NnFHLx+ccyzmdczXnWs71nBs5o8jH5xzLOZ1zNedazvWcGzmjLx+fcyzndM7VnGs513Nu5IxDsnYPAAAAAAAAAAAAAAAAAAB4Z6lFUd3F/Vtf20xbA537S09HJ9fdD/Qd7xcBAAD//0kCdPc=") r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_QGROUP_ASSIGN(r0, 0x40189429, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv6_delrule={0x44, 0x18, 0x1, 0x0, 0x25dfdbff, {0xa, 0x80, 0x0, 0x0, 0x0, 0x3}, [@FRA_DST={0x14, 0x7, @ipv4={'\x00', '\xff\xff', @remote}}, @FRA_SRC={0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x2b}}]}, 0x44}}, 0x20000000) setrlimit(0x1, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) pwrite64(r3, &(0x7f00000000c0)='a', 0x200000c1, 0x404043000) truncate(&(0x7f0000000340)='./file1\x00', 0x20fffbfffc) 4m13.927270196s ago: executing program 3 (id=1352): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1a2) mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = open(&(0x7f0000000040)='./file1\x00', 0x808400, 0x43) chdir(&(0x7f00000003c0)='./bus\x00') unlink(&(0x7f0000000140)='./file0\x00') mkdirat(r0, &(0x7f0000000340)='./file0\x00', 0xf3) mknod$loop(0x0, 0x6000, 0x0) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') 4m13.502777307s ago: executing program 34 (id=1352): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1a2) mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = open(&(0x7f0000000040)='./file1\x00', 0x808400, 0x43) chdir(&(0x7f00000003c0)='./bus\x00') unlink(&(0x7f0000000140)='./file0\x00') mkdirat(r0, &(0x7f0000000340)='./file0\x00', 0xf3) mknod$loop(0x0, 0x6000, 0x0) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') 26.580990513s ago: executing program 5 (id=1989): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/nvmet/subsystems/testnqn\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nvmet/subsystems/testnqn/attr_allow_any_host\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/testnqn/namespaces/1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x42, 0x1ff) ftruncate(r1, 0x1000) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/nvmet/subsystems/testnqn/namespaces/1/device_path\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='./file0\x00', 0x7) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testnqn/namespaces/1/buffered_io\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='1\x00', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/subsystems/testnqn/namespaces/1/enable\x00', 0x2, 0x0) write(r4, &(0x7f0000000300)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r5, &(0x7f00000003c0)='loop\x00', 0x4) symlinkat(&(0x7f0000000400)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/ports/1/subsystems/testnqn\x00') r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) write(r6, &(0x7f00000004c0), 0x0) 22.654959493s ago: executing program 5 (id=1993): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x1}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, 0x0) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r3, 0xc01064c7, &(0x7f00000001c0)={0x0, 0x0, 0x0}) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r4, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) shutdown(r4, 0x1) r5 = socket(0x2d, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) connect$netlink(r5, &(0x7f0000000080)=@proc={0x10, 0x0, 0x25dfdbfc, 0x8000000}, 0xc) 20.436046339s ago: executing program 5 (id=1998): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2501, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x7, 0x1, 0x41, 0xc3d, 0x0, 0x2004cb, 0xffffffdfffffffff, 0xa1d, 0xa, 0x100005, 0x79, 0x3, 0x2], 0x3332d000, 0x202}) r3 = openat$vicodec0(0xffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0x4000, 0xe000, 0x0, 0x77, 0x0, 0x3, 0xcb, 0x2, 0x0, 0x6, 0x6, 0xf4}, {0x2, 0x9000, 0x3, 0xeb, 0x2, 0x0, 0x0, 0xff, 0x7, 0x0, 0x3}, {0xeeee0000, 0x1000, 0xe, 0x0, 0x7, 0xc4, 0x5, 0x1, 0x45, 0x1, 0x4, 0xfc}, {0x1, 0x0, 0x9, 0x4, 0x81, 0x0, 0x9, 0x0, 0x3, 0x0, 0x9}, {0x0, 0xffff1000, 0x3, 0x4, 0x0, 0x4, 0x0, 0x6, 0x2, 0x34, 0xff}, {0xffff1000, 0x1, 0x0, 0x78, 0x8, 0x0, 0x2, 0x1c, 0xa3, 0xff, 0x5}, {0xeeee8000, 0xdddd1000, 0xa, 0x7, 0x0, 0x0, 0x7, 0x20, 0x0, 0x3}, {0x0, 0x10000, 0xa, 0x0, 0xa4, 0x7, 0x8, 0x40, 0x26, 0x0, 0x0, 0xfe}, {0x80a0000, 0x9}, {0x3000, 0xfffd}, 0xddf8ffdb, 0x0, 0x0, 0x120, 0x0, 0xf801, 0xdddd1000, [0x80000001, 0x0, 0xffffffffffffffff, 0xfffffffffffffffe]}) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000540)={0x5, 0x7, 0x3, 0x0, 0x4}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x608}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)=@gettaction={0x30, 0x32, 0x100, 0x70bd28, 0x25dfdbfb, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x7947}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xffffffff}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000880}, 0x40881) r4 = openat$kvm(0xffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_GET_API_VERSION(r4, 0xae00, 0x0) r5 = syz_open_dev$audion(&(0x7f0000000580), 0x3, 0x0) getsockname$l2tp6(r5, &(0x7f00000005c0)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000600)=0x20) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newtfilter={0x44, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xb, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_PERTURB={0x8, 0xc, 0x2}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0xd0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17.979173262s ago: executing program 5 (id=2004): r0 = socket(0x10, 0x803, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x275a, 0x0) fcntl$lock(r1, 0x6, &(0x7f0000000080)={0x1, 0x1}) r2 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r4 = getpid() mlock(&(0x7f00009a7000/0x4000)=nil, 0x4000) r5 = syz_open_dev$mtd(&(0x7f0000000100), 0x48a99fbe, 0x10b241) ioctl$MTDFILEMODE(r5, 0x4d13, 0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000a50000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r8], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x35, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) eventfd(0xfffffff9) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) bind$can_j1939(r2, &(0x7f0000000380)={0x1d, r3, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2) syz_genetlink_get_family_id$wireguard(&(0x7f0000000280), r2) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0x4}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0x3, 0x1, 0x8, 0x9, 0xfffffffc, 0x1a000, 0x8, 0x4}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 17.351714348s ago: executing program 1 (id=2005): ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000000080)={0x0, 0xffff, 0x0, 0x0, 0x0}) prlimit64(r0, 0xe, &(0x7f0000000100)={0x7, 0x9}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = semget$private(0x0, 0x207, 0x0) semctl$GETALL(r4, 0x0, 0xd, 0xfffffffffffffffe) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0xffffffff, 0x100, 0x2, 0x1e1}, 0x0, 0x0, 0x0) r6 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt(r6, 0x10d, 0xe, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r7, 0x10f, 0x84, &(0x7f00000003c0), &(0x7f0000000400)=0x4) syz_ublk_add_dev(r5, 0x0, 0x0, 0x0, 0x0, 0x0) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0x2, 0x1e5}, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000140)) syz_mount_image$exfat(0x0, &(0x7f0000000300)='./bus\x00', 0x448c, 0x0, 0x0, 0x0, &(0x7f0000000300)) mount$bind(0x0, &(0x7f0000000100)='.\x00', 0x0, 0x21, 0x0) 17.020450056s ago: executing program 6 (id=2006): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) socket$nl_generic(0x10, 0x3, 0x10) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x2) ptrace$pokeuser(0x6, r3, 0x388, 0x41d9fda7) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='dummy_udc.0', 0xb) pselect6(0x40, &(0x7f0000000000)={0x8, 0x2, 0x1, 0x1a4d994a, 0x8, 0xfffffffffffffe00, 0xfffffffffffffffe, 0x8}, 0x0, &(0x7f0000000080)={0x2, 0x8, 0x7, 0x4, 0x3, 0x9, 0x4, 0xfffffffffffffff7}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000180)={&(0x7f0000000140)={[0x5]}, 0x8}) 15.603298762s ago: executing program 1 (id=2007): syz_mount_image$vfat(&(0x7f0000001200), &(0x7f0000001240)='./file0\x00', 0x0, &(0x7f0000002480)=ANY=[@ANYBLOB="00e789da34e04a1ffb124b2c2fb684c70b90bbb45efd97899a16f2df4fa2e8f06ac2c5352509e3c51d882eb3ec0dd3b1c96e980163890d2d0d1b8d3d62f6d77b0209e166e2ca4c35483d49316daf522556a16cab12d75a852bc680da7ea837480feb2060a1e20a59b7745235030000004ed0351cb5b416ba1c57217be5a338392f831617ee8c35bb61f0a9eeed3b1226b18c4b455ab222d7ae1b5258d5643d70000000000000000000ae468a387d9e63008000000000000063a454d1ab8760076a893752105f030c49caf2fdfe6bc9743a68593b576e2f2f6ab69e1b974ac90855ac250f8f73e16bc593730b88d7a3346b945e276875915040ce4901262cd8ce8191ee84e3ce5526a0a43b707cc711a3311f840cad641a013c6dd783aa895227b3d50a86e15a57e26666aaa296b7ddc4c8f421cf9d76d344bf6522f5d1138659d3de84ce13b085a2ed9d66c93767378423521cc4ea440e0ac3b953e1ca1675a716a97a5c3106aba648f119eeab4747b9b53000475e0a34514ccf397ea6f170e018122a98f135beac48d2ed195e20fdd226c7f5a20000ad1fcfbee59924e161280a8b78fe34b2fa3efa7c1d4268bf090000ecb4ece3234c232659fee3ff9e6d21e008a570bb490a65b84ea8b6d6507355cb1112fae6e3456bf8da53e1df20458e59456822dbb8dbd7ce0f928d5fbd6414fe8ab5277f3fd5ce6be044993f93e697a69484cc0e65ec742443c84e21a440998c8d69c12c2db7aee2872c6e0671d639e8f6bece219dcd0f69b9867dfc3187c882c035809c81832d7416f90c734be30c2faf0c22bfc8d95dfc7b9bac96b838c98ae5a75b9dc9e967ef5edf311bbebd7ca803cea8f5b9ec5b3edd6c44d633b71bde97a3c10a468432ff3d4e63ce3ecfa640d44b70b68744d26e72389e6c61767725d2c692443bc949c28b1a374e541bd352ca2f3bf64d883862dc24d8e27d86b6e38bc269f110c3d563f8e4ec9a98016b6b58157deeefa8fa022514bdc75f794094700cb8fa2b61310cbf9058bce5f2399055929e0fc732e0d5db926fe1b09a2993ff038d8099c229bda0801f8b81719d73b4abac97f704a0942051bae38b00b69d7fa69d738f99f73b19082ec0c99442d97ddbf68a4822aa2a2673478f81f14f67beee619b9d9882f7eabfb5000000000000000000003ff8795b5ec2de11479e781396117c84449647684239c9b9475b389a6a76d36c31f39539d928d2c58f188b4bf713d0915df4cc7de48a930935dbb01c9422d604467d209fd1421c7fc503cabde4bb193ff3654377c6e4fb72dcfc835f760bae7447068c2e43433e3d77c6805b559a04f3ebb741a9bbf57274b1da7800000000000000000000000000000000000000001c4f225672f3465b2638e921d80d58dca4ee4592d8cc0c06b2e390b7b1c713a46bc8ece9be25f055a59032576bc00a844c32b46040a607eaeb886ec0cb8e90c5a4075caa8a358ab81e78ad794a20f772b73466a43cd696401521793e54b1c4aa58d506b661f393e7233337473f36c2dbb15ae673afe82ebe45cc6f776162e43b74d9b9ca6f68d6bc8261600b27431e0f6f4f1e0947f69d2d812ebc9d2a8869b14a84dbdcdc5055b97a241e2f707740bb966b6c58408aceb9f6a943f614d2a6093c60c0dfb511b02f191ef6fa6e5a1a86687a44ec6098439a2ef55a4ba07e2b0f62ae86e1458f63f6b8b2d2b9990495f17b6d1052b19472a97d41204a8be48e380be2e6885c7de0807f2c154ad4f25b16027bc4aeb85dc798e7eef25631bfd79c8e0aff725dcd4b91c61bf8d72f74e4dbae"], 0x1, 0x11f4, &(0x7f0000001280)="$eJzs3M+LG2UYB/DHbWvr1v2h1moL0he96GXo7sGLgiyyBWlAaRuhFYSpO9GQMQmZsBARV09e/TvEozdBvOllL/4N3vbisQdxxMTapsRDqXTa8Plc8pD3/cLzkjDwDvPO0ZvffNrrVFknH8fKE2/FyjAi3UqRYiVu+zJee+PnX166ev3G5Z1Wa/dKSpd2rm29nlJav/DjB59/9/JP49Pvf7/+w8k43Pzw6Pft3w7PHp47+vPaJ90qdavUH4xTnm4OBuP8ZlmkvW7Vy1J6ryzyqkjdflWM5sY75WA4nKS8v7e2OhwVVZXy/iT1ikkaD9J4NEn5x3m3n7IsS2urwYNof3urruuIuj4RT0Zd1/VTsRqn4+lYi/XYiM14Jp6N5+JMPB9n44V4Mc5NZzXdNwAAAAAAAAAAAAAAAAAAACyXBzr/f6Hh5gEAAAAAAAAAAAAAAAAAAGBJXL1+4/JOq7V7JaVTEeXX++399uxzNr7TiW6UUcTF2Ig/Ynr6f2ZWX3qntXsxTW3GV+XBP/mD/fax+fzW9HUCC/Nbs3yaz5+M1bvz27ERZxbntxfmT8Wrr9yVz2Ijfv0oBlHGXvydvZP/Yiult99t3ZM/P50HAAAAyyBL/1q4f8+y/xqf5e/j/sA9++vjcf54s2snopp81svLshg1XtzuaPbNQUQ8Io0tcXHi0Wjj/y2Ozf2Rmu/nMS2auybx8Nz50ZvuBAAAAAAAAAAAgPvxMB4nbHqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/MUOHAsAAAAACPO3TqNjAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4KgAA//86R81g") socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/pm_freeze_timeout', 0x80802, 0x0) sendfile(r0, r0, 0x0, 0x6) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) socket(0x10, 0x803, 0x0) syz_emit_ethernet(0x76, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100000008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) ioctl$int_in(r4, 0x5421, &(0x7f0000000440)=0x6) connect$bt_rfcomm(r4, &(0x7f00000001c0)={0x1f, @any, 0x6}, 0xa) close(r4) 15.30412315s ago: executing program 5 (id=2008): semget$private(0x0, 0x7, 0x191) r0 = getpid() prlimit64(r0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) read$char_usb(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f00000000c0)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000009f40)={0x98f90e, 0xffffbfff, '\x00', @p_u32=&(0x7f0000009f00)=0x1}}) mmap$IORING_OFF_SQ_RING(0x0, 0x1000, 0x4000003, 0x50032, 0xffffffffffffffff, 0x0) ioctl$IOMMU_HWPT_INVALIDATE$TEST(0xffffffffffffffff, 0x3b8d, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r2, 0x0) r3 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_SECURITY_KEYRING(r3, 0x110, 0x2, 0x0, 0x0) syz_clone(0x100, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) write$UHID_CREATE2(0xffffffffffffffff, 0x0, 0x119) mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, 0x0) 15.108977935s ago: executing program 6 (id=2009): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x4, 0x0, 0xfffffffe}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x404c2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 12.914358181s ago: executing program 4 (id=2010): r0 = socket(0x10, 0x803, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x275a, 0x0) fcntl$lock(r1, 0x6, &(0x7f0000000080)={0x1, 0x1}) r2 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r4 = getpid() mlock(&(0x7f00009a7000/0x4000)=nil, 0x4000) r5 = syz_open_dev$mtd(&(0x7f0000000100), 0x48a99fbe, 0x10b241) ioctl$MTDFILEMODE(r5, 0x4d13, 0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000a50000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7050000080000a8c5000000a5000000180100002020640500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb70200"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x35, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) eventfd(0xfffffff9) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) bind$can_j1939(r2, &(0x7f0000000380)={0x1d, r3, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2) syz_genetlink_get_family_id$wireguard(&(0x7f0000000280), r2) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0x4}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0x3, 0x1, 0x8, 0x9, 0xfffffffc, 0x1a000, 0x8, 0x4}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 12.111327131s ago: executing program 5 (id=2011): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) keyctl$clear(0x3, 0xfffffffffffffffd) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x206, 0x20182) ioctl$USBDEVFS_ALLOW_SUSPEND(r4, 0x5522) r5 = socket(0x10, 0x803, 0x0) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000d9bffc), 0x4) sendto(r5, &(0x7f0000000380)="120000", 0x3, 0x20000090, 0x0, 0x0) recvmmsg(r5, &(0x7f0000000a80), 0x0, 0x10120, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000000140)={0x0, 0x2, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d80672e65a6a0a72e19c2b60bd6276fd8bb6366e9d1ed9a60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d10d1f600"}) ioctl$USBDEVFS_ALLOW_SUSPEND(r3, 0x5522) 10.643619539s ago: executing program 1 (id=2012): r0 = socket(0x10, 0x803, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x275a, 0x0) fcntl$lock(r1, 0x6, &(0x7f0000000080)={0x1, 0x1}) r2 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r4 = getpid() mlock(&(0x7f00009a7000/0x4000)=nil, 0x4000) r5 = syz_open_dev$mtd(&(0x7f0000000100), 0x48a99fbe, 0x10b241) ioctl$MTDFILEMODE(r5, 0x4d13, 0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000a50000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7050000080000a8c5000000a5000000180100002020640500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x35, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) eventfd(0xfffffff9) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) bind$can_j1939(r2, &(0x7f0000000380)={0x1d, r3, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2) syz_genetlink_get_family_id$wireguard(&(0x7f0000000280), r2) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0x4}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0x3, 0x1, 0x8, 0x9, 0xfffffffc, 0x1a000, 0x8, 0x4}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 10.262530228s ago: executing program 4 (id=2013): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@enum={0x2, 0x0, 0x0, 0xf}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x28}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xf) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x123f41, 0x0) write$binfmt_aout(r4, 0x0, 0xff2e) ioctl$TCFLSH(r4, 0x540b, 0x1) fsopen(0x0, 0x1) fchdir(0xffffffffffffffff) ioctl$UBLK_U_CMD_ADD_DEV(0xffffffffffffffff, 0xc0207504, &(0x7f0000000280)={0xffffffff, 0xffff, 0x0, 0x0}) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0200000004000000040000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="000000000100"/19], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000100007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r5, @ANYBLOB="0000000002000000b705000008000000850000005d00000095"], &(0x7f0000000300)='GPL\x00', 0x2, 0x100a, &(0x7f0000002500)=""/4106, 0x0, 0x2b}, 0x94) 10.023338445s ago: executing program 6 (id=2014): connect$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x2, 0x80805, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x2000, 0x103) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000000), 0x1000000, &(0x7f0000000380)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}}) write$FUSE_NOTIFY_STORE(r3, &(0x7f0000000100)={0x29, 0x4, 0x0, {0x1, 0x0, 0x1, 0x0, [0x0]}}, 0x29) socket$inet_tcp(0x2, 0x1, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r4) 7.899184688s ago: executing program 4 (id=2015): syz_emit_ethernet(0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0xfffffffffffffffe) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet6_tcp(0xa, 0x1, 0x0) faccessat(0xffffffffffffffff, 0x0, 0x81) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x80000) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/timer_list\x00', 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r3) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r3, 0x0, 0x20000000) preadv(r3, &(0x7f0000001500)=[{&(0x7f0000004c80)=""/4093, 0xffd}], 0x1, 0xf73, 0xfc000000) 7.898862718s ago: executing program 1 (id=2016): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000300)=[@in6={0xa, 0x4e21, 0x4, @ipv4={'\x00', '\xff\xff', @loopback}, 0x6}], 0x1c) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, 0x0, 0x0) syz_usb_connect(0x5, 0x24, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x40, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_dev$vim2m(0x0, 0x1, 0x2) ioctl$vim2m_VIDIOC_DQBUF(r3, 0xc044560f, &(0x7f0000000380)=@mmap={0x0, 0x1, 0x4, 0x0, 0x1800002, {0x77359400}, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, "37bb54f0"}, 0x3}) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x13, r4, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0cc5605, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) ioctl$BLKZEROOUT(r5, 0x127f, &(0x7f0000000000)={0x600, 0x1000000}) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000000)={[0x80000038, 0xfff, 0x3fffa, 0x180, 0x2, 0xfffffffffffffffe, 0xf1, 0x0, 0x3, 0x5, 0x4005, 0x8, 0x0, 0x45, 0xfffffffffffffffd, 0xbdb], 0xeeee8000}) ioctl$KVM_RUN(r6, 0xae80, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000004980), 0x0, 0x20008000) 7.82180449s ago: executing program 6 (id=2017): syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000280), 0xa2040, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) symlinkat(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00') chdir(0x0) ioctl$TCSETS(r2, 0x40045431, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x22, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) modify_ldt$write2(0x11, &(0x7f0000000040)={0x0, 0x100000, 0x4000, 0x0, 0x2, 0x1, 0x1, 0x0, 0x1, 0x1}, 0x10) modify_ldt$read(0x0, 0x0, 0x11) r4 = syz_open_pts(r2, 0x141601) ioctl$TIOCGPTPEER(r2, 0x5441, 0x2185) fcntl$setstatus(r4, 0x4, 0x102800) close_range(r1, r2, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) r5 = gettid() timer_create(0x2, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) read$char_usb(r0, &(0x7f00000002c0)=""/151, 0x97) timer_settime(0x0, 0x0, 0x0, 0x0) close(r0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000040), 0x104, 0x0) unshare(0x6a040000) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) 6.167537963s ago: executing program 4 (id=2018): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xdfffffffd927fc35) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x20800, 0x0) ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) write$P9_RSTAT(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="490000007d0100000042007e0d0500000080020000000300000000000002000000000300000000800000ffffff7f0000000006006d73646f730002002b210600555c292f262901007b"], 0x49) ftruncate(0xffffffffffffffff, 0x2000009) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x1000040, &(0x7f00000002c0)={[{@barrier}, {@nodioread_nolock}, {@noquota}, {@oldalloc}, {@errors_remount}, {@nodioread_nolock}, {@bh}]}, 0x1, 0x59c, &(0x7f0000001840)="$eJzs3U9oHGUbAPBnZrNN/+T70g++Dz6lh6JChdJN0j9aPbVXsVDoQfCiYbMNJZtsySbahIDpvYg9iEov9aYHj4oHD+LFo1cvimeh2KDQ9KArm51N03S3bmI2W7O/H0z2fWdm93nfmX3e7AwzTAB962j9TxrxVERcTCKGNywbiGzh0cZ6qytLxfsrS8UkarVLvySRRMS9laVic/0kez0UEcsR8f+I+CYfcTxd/8h9zUJ1YXFqvFwuzWb1kbnpqyPVhcUTV6bHJ0uTpZlTL7505uzpM2MnxzY2935tYy2/tb7e+PHmuze+e+X2zU8/O7JcfH88iXMxlC3b2I+d1Ngm+Ti3af7pbgTroaTXDWBbclme11PpfzEcuSzrW6ltHBwGd6V5QBfVBiNq6zYUgT6QSHroU83fAfXj3+a0m78/7pxvHIDU466uLBXfiWb8gca5idi/dmxy8NfkoSOT+vHm4d1sKHvS8vWIGB0YePT7n2Tfv+0b3YkG0lVfn2/sqEf3f7o+/kSL8Weoee70b2qOf6vZ+LfaIn6uzfh3scMYv7/+00dt418fjKdbxk/W4yct4qcR8WaH8W+99uXZdstqH0cci9bxm5LHnx8euXylXBpt/G0Z46tjR15u3/+Ig23iN87Z7l9ryMb+78valHbY/y++/fyZ5cfEf/7Zx+//Vtv/QES812H8/9z75NV2y+5cT+7WfwVsdf8nkY/bHcZ/4dzRH7Kis4YAAAAAAAAAALCD0rVr2ZK0sF5O00KhcQ/vf+NgWq5U545frszPTDSueTsc+bR5pdVwo57U62PZ9bjN+slN9VO5LGDuwFq9UKyUJ3rcdwAAAAAAAAAAAAAAAAAAAHhSHNp0//9vubX7/zc/rhrYq9o/8hvY6+Q/9K+H8z/pWTuA3ef/P/StmvyH/iX/oX/Jf+hf8h/6l/yH/iX/oX/JfwAAAAAAAAAAAAAAAAAAAAAAAAAA6IqLFy7Up9r9laVivT4xsDA/VXnrxESpOlWYni8WipXZq4XJSmWyXCoUK9N/9XlJpXJ1NGbmr43MlapzI9WFxTemK/MzzWeKlvJd7xEAAAAAAAAAAAAAAAAAAAD88wytTUlaiMg36mlaKET8KyIOJ5FcvlIujUbEvyPi+1x+sF4f63WjAQAAAAAAAAAAAAAAAAAAYI+pLixOjZfLpdnuFQayUF0M0XlhYCsrR8Tyzjaj/olbflc+24A93nR7o5B7Mr6HT36hh4MSAAAAAAAAAAAAAAAAAAD0qQc3/Xb6jj+62yAAAAAAAAAAAAAAAAAAAADoS+nPSUTUp2PDzw1tXrovWc2tvUbE27cufXBtfG5udqw+/+76/LkPs/kne9F+oFPNPE0jop7HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAPVhcWp8XK5NLvNwmAH6/S6jwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADb8WcAAAD//y4WzlE=") openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) gettid() 3.575209818s ago: executing program 6 (id=2019): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000140)={0x40000000, 0x0, 0x0}, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') pread64(r2, 0x0, 0x0, 0x200) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x400000000a882, 0x0) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbtest/new_id\x00', 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 2.188579474s ago: executing program 4 (id=2020): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) syz_open_dev$sndctrl(&(0x7f0000000580), 0xc290, 0x40) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioprio_get$uid(0x3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r5 = openat$cgroup_procs(r3, &(0x7f0000000080)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f0000000300), 0x12) sendfile(r4, r4, 0x0, 0x10001) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f00000001c0)={0xfffffffc, 0x5, 0x0, 'queue0\x00', 0x10000}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(0xffffffffffffffff, 0x404c534a, &(0x7f0000000380)) 2.169650784s ago: executing program 1 (id=2021): r0 = socket(0x10, 0x803, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x275a, 0x0) fcntl$lock(r1, 0x6, &(0x7f0000000080)={0x1, 0x1}) r2 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r4 = getpid() mlock(&(0x7f00009a7000/0x4000)=nil, 0x4000) r5 = syz_open_dev$mtd(&(0x7f0000000100), 0x48a99fbe, 0x10b241) ioctl$MTDFILEMODE(r5, 0x4d13, 0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000a50000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7050000080000a8c5000000a5000000180100002020640500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x35, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) eventfd(0xfffffff9) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) bind$can_j1939(r2, &(0x7f0000000380)={0x1d, r3, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2) syz_genetlink_get_family_id$wireguard(&(0x7f0000000280), r2) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0x4}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0x3, 0x1, 0x8, 0x9, 0xfffffffc, 0x1a000, 0x8, 0x4}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 599.146114ms ago: executing program 6 (id=2022): r0 = socket(0x10, 0x803, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x275a, 0x0) fcntl$lock(r1, 0x6, &(0x7f0000000080)={0x1, 0x1}) r2 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r4 = getpid() mlock(&(0x7f00009a7000/0x4000)=nil, 0x4000) r5 = syz_open_dev$mtd(&(0x7f0000000100), 0x48a99fbe, 0x10b241) ioctl$MTDFILEMODE(r5, 0x4d13, 0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000a50000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7050000080000a8c5000000a5000000180100002020640500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x35, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) eventfd(0xfffffff9) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) bind$can_j1939(r2, &(0x7f0000000380)={0x1d, r3, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2) syz_genetlink_get_family_id$wireguard(&(0x7f0000000280), r2) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0x4}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0x3, 0x1, 0x8, 0x9, 0xfffffffc, 0x1a000, 0x8, 0x4}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 230.508554ms ago: executing program 1 (id=2023): syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000280), 0xa2040, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) symlinkat(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, 0x0) chdir(&(0x7f0000000140)='./file0\x00') ioctl$TCSETS(r2, 0x40045431, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x22, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) modify_ldt$write2(0x11, &(0x7f0000000040)={0x0, 0x100000, 0x4000, 0x0, 0x2, 0x1, 0x1, 0x0, 0x1, 0x1}, 0x10) modify_ldt$read(0x0, 0x0, 0x11) r4 = syz_open_pts(r2, 0x141601) ioctl$TIOCGPTPEER(r2, 0x5441, 0x2185) fcntl$setstatus(r4, 0x4, 0x102800) close_range(r1, r2, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) r5 = gettid() timer_create(0x2, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) read$char_usb(r0, &(0x7f00000002c0)=""/151, 0x97) timer_settime(0x0, 0x0, 0x0, 0x0) close(r0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000040), 0x104, 0x0) unshare(0x6a040000) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) 0s ago: executing program 4 (id=2024): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/drivers/xhci_hcd/bind\x00', 0x1, 0x0) write(r5, &(0x7f0000000400), 0x0) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x300) tgkill(r1, r1, 0x12) kernel console output (not intermixed with test programs): 0x85 has invalid maxpacket 1024 [ 364.450304][ T5807] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 364.484257][ T5807] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 364.505934][ T9536] BTRFS info (device loop1): enabling ssd optimizations [ 364.523876][ T5807] usb 4-1: Product: syz [ 364.530818][ T9536] BTRFS info (device loop1): auto enabling async discard [ 364.538410][ T5807] usb 4-1: Manufacturer: syz [ 364.552795][ T5807] usb 4-1: SerialNumber: syz [ 364.582690][ T5807] usb 4-1: config 0 descriptor?? [ 364.605155][ T9541] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 364.723014][ T28] audit: type=1800 audit(1785978976.682:16): pid=9536 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1036" name="file1" dev="loop1" ino=260 res=0 errno=0 [ 365.060374][ T5776] BTRFS info (device loop1): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 365.781668][ T9573] KVM: debugfs: duplicate directory 9573-4 [ 365.831757][ T23] usb 4-1: USB disconnect, device number 23 [ 366.144295][ T5084] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 366.154323][ T5084] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 366.164909][ T5781] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 366.181552][ T5781] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 366.201280][ T5781] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 366.211526][ T5781] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 367.403491][ T9581] chnl_net:caif_netlink_parms(): no params data found [ 367.670986][ T9619] loop0: detected capacity change from 0 to 512 [ 367.703856][ T9581] bridge0: port 1(bridge_slave_0) entered blocking state [ 367.719839][ T9581] bridge0: port 1(bridge_slave_0) entered disabled state [ 367.729465][ T9581] bridge_slave_0: entered allmulticast mode [ 367.737380][ T9581] bridge_slave_0: entered promiscuous mode [ 367.750973][ T9619] EXT4-fs (loop0): 1 truncate cleaned up [ 367.754915][ T9581] bridge0: port 2(bridge_slave_1) entered blocking state [ 367.765076][ T9581] bridge0: port 2(bridge_slave_1) entered disabled state [ 367.767747][ T9619] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 367.799940][ T9581] bridge_slave_1: entered allmulticast mode [ 367.818364][ T28] audit: type=1800 audit(1785978979.782:17): pid=9619 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1053" name="file1" dev="loop0" ino=13 res=0 errno=0 [ 367.842424][ T9581] bridge_slave_1: entered promiscuous mode [ 367.888046][ T28] audit: type=1800 audit(1785978979.842:18): pid=9623 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1053" name="file1" dev="loop0" ino=13 res=0 errno=0 [ 367.889060][ T9623] EXT4-fs error (device loop0): ext4_validate_block_bitmap:439: comm syz.0.1053: bg 0: block 465: padding at end of block bitmap is not set [ 367.931142][ T9581] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 367.944838][ T9581] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 367.957775][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 368.010157][ T9623] EXT4-fs (loop0): Delayed block allocation failed for inode 13 at logical offset 2 with max blocks 2 with error 28 [ 368.056686][ T9623] EXT4-fs (loop0): This should not happen!! Data will be lost [ 368.056686][ T9623] [ 368.111354][ T9623] EXT4-fs (loop0): Total free blocks count 0 [ 368.117416][ T9623] EXT4-fs (loop0): Free/Dirty block details [ 368.148249][ T9623] EXT4-fs (loop0): free_blocks=0 [ 368.169357][ T1097] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.173417][ T9623] EXT4-fs (loop0): dirty_blocks=2 [ 368.221057][ T9623] EXT4-fs (loop0): Block reservation details [ 368.224355][ T9581] team0: Port device team_slave_0 added [ 368.227246][ T9623] EXT4-fs (loop0): i_reserved_data_blocks=2 [ 368.261498][ T9581] team0: Port device team_slave_1 added [ 368.277808][ T5830] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 368.290108][ T5781] Bluetooth: hci1: command tx timeout [ 368.349953][ T1097] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.389111][ T9581] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 368.396214][ T9581] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 368.426946][ T9581] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 368.470990][ T1097] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.495331][ T9581] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 368.497782][ T5830] usb 2-1: Using ep0 maxpacket: 16 [ 368.512671][ T9581] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 368.520198][ T5830] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 368.582090][ T9581] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 368.583388][ T5830] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 368.619173][ T5767] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 368.647643][ T5830] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 368.657356][ T5830] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 368.672172][ T5830] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 368.686656][ T5830] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 368.713836][ T5830] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 368.718222][ T1097] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.758625][ T5830] usb 2-1: Manufacturer: syz [ 368.774879][ T5830] usb 2-1: config 0 descriptor?? [ 368.870813][ T9581] hsr_slave_0: entered promiscuous mode [ 368.891192][ T9581] hsr_slave_1: entered promiscuous mode [ 368.907389][ T9581] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 368.930112][ T9581] Cannot create hsr debugfs directory [ 368.969851][ T9633] loop3: detected capacity change from 0 to 32768 [ 369.035729][ T9633] XFS (loop3): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 369.119576][ T5830] rc_core: IR keymap rc-hauppauge not found [ 369.125545][ T5830] Registered IR keymap rc-empty [ 369.163571][ T9633] XFS (loop3): Ending clean mount [ 369.168443][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 369.205832][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 369.227050][ T9633] XFS (loop3): User initiated shutdown received. [ 369.234798][ T9633] XFS (loop3): Log I/O Error (0x6) detected at xfs_fs_goingdown+0x71/0x150 (fs/xfs/xfs_fsops.c:501). Shutting down filesystem. [ 369.251918][ T5830] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 369.277141][ T9633] XFS (loop3): Please unmount the filesystem and rectify the problem(s) [ 369.291247][ T5830] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input23 [ 369.316677][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 369.350882][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 369.408679][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 369.447679][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 369.495856][ T5775] XFS (loop3): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 369.505554][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 369.567709][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 369.598180][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 369.657759][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 369.740659][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 369.808232][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 369.919264][ T5830] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 370.145935][ T5830] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 370.367822][ T5781] Bluetooth: hci1: command tx timeout [ 370.434693][ T5830] usb 2-1: USB disconnect, device number 18 [ 370.551060][ T9581] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 370.733352][ T9581] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 370.794921][ T9581] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 370.952399][ T9581] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 371.789313][ T9581] 8021q: adding VLAN 0 to HW filter on device bond0 [ 372.457802][ T5781] Bluetooth: hci1: command tx timeout [ 372.628870][ T9581] 8021q: adding VLAN 0 to HW filter on device team0 [ 372.898494][ T5955] bridge0: port 1(bridge_slave_0) entered blocking state [ 372.905679][ T5955] bridge0: port 1(bridge_slave_0) entered forwarding state [ 372.982921][ T5955] bridge0: port 2(bridge_slave_1) entered blocking state [ 372.990149][ T5955] bridge0: port 2(bridge_slave_1) entered forwarding state [ 373.488802][ T5807] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 373.595704][ T1097] hsr_slave_0: left promiscuous mode [ 373.604534][ T1097] hsr_slave_1: left promiscuous mode [ 373.613412][ T1097] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 373.622727][ T1097] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 373.631814][ T1097] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 373.639707][ T1097] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 373.647699][ T1097] bridge_slave_1: left allmulticast mode [ 373.653870][ T1097] bridge_slave_1: left promiscuous mode [ 373.666440][ T1097] bridge0: port 2(bridge_slave_1) entered disabled state [ 373.683649][ T1097] bridge_slave_0: left allmulticast mode [ 373.695872][ T1097] bridge0: port 1(bridge_slave_0) entered disabled state [ 373.728525][ T5807] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 373.757824][ T5807] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 373.777674][ T5807] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 373.778466][ T27] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 373.795011][ T5807] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 373.812371][ T5807] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 373.826547][ T1097] veth1_macvtap: left promiscuous mode [ 373.833196][ T1097] veth0_macvtap: left promiscuous mode [ 373.844360][ T1097] veth1_vlan: left promiscuous mode [ 373.852281][ T5807] usb 4-1: config 0 descriptor?? [ 373.863283][ T1097] veth0_vlan: left promiscuous mode [ 373.997775][ T27] usb 1-1: Using ep0 maxpacket: 8 [ 374.009286][ T27] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 374.026620][ T27] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 374.045745][ T27] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 374.056131][ T27] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 374.077493][ T27] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 374.096562][ T27] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 374.106165][ T27] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 374.301399][ T5807] plantronics 0003:047F:FFFF.000C: No inputs registered, leaving [ 374.307173][ T9756] loop1: detected capacity change from 0 to 32768 [ 374.365930][ T5807] plantronics 0003:047F:FFFF.000C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 374.372244][ T27] usb 1-1: usb_control_msg returned -32 [ 374.384364][ T27] usbtmc 1-1:16.0: can't read capabilities [ 374.418021][ T9756] XFS (loop1): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 374.472031][ T9756] XFS (loop1): Ending clean mount [ 374.528636][ T5781] Bluetooth: hci1: command tx timeout [ 374.681374][ T8] usb 1-1: USB disconnect, device number 17 [ 374.750744][ T5776] XFS (loop1): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 375.402902][ T1097] team0 (unregistering): Port device team_slave_1 removed [ 375.460610][ T1097] team0 (unregistering): Port device team_slave_0 removed [ 375.515823][ T1097] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 375.573149][ T1097] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 375.996256][ T1097] bond0 (unregistering): Released all slaves [ 376.502819][ T5807] usb 4-1: USB disconnect, device number 24 [ 376.561948][ T9581] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 377.216811][ T9787] loop3: detected capacity change from 0 to 32768 [ 377.245009][ T9787] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop3 scanned by syz.3.1087 (9787) [ 377.289157][ T9787] BTRFS info (device loop3): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 377.310266][ T9787] BTRFS info (device loop3): using blake2b (blake2b-256-generic) checksum algorithm [ 377.330115][ T9787] BTRFS info (device loop3): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 377.353962][ T9787] BTRFS info (device loop3): use zstd compression, level 3 [ 377.374250][ T9787] BTRFS info (device loop3): using free space tree [ 377.448496][ T27] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 377.560890][ T9787] BTRFS info (device loop3): enabling ssd optimizations [ 377.597629][ T9787] BTRFS info (device loop3): auto enabling async discard [ 377.627674][ T27] usb 2-1: Using ep0 maxpacket: 32 [ 377.639773][ T27] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 377.660149][ T27] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 377.689934][ T27] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 377.693747][ T9581] veth0_vlan: entered promiscuous mode [ 377.717636][ T27] usb 2-1: Product: syz [ 377.726282][ T27] usb 2-1: Manufacturer: syz [ 377.750427][ T9581] veth1_vlan: entered promiscuous mode [ 377.757840][ T27] usb 2-1: SerialNumber: syz [ 377.784737][ T27] usb 2-1: config 0 descriptor?? [ 377.816828][ T9808] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 377.841729][ T28] audit: type=1800 audit(1785978989.802:19): pid=9787 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1087" name="file1" dev="loop3" ino=260 res=0 errno=0 [ 377.854523][ T9581] veth0_macvtap: entered promiscuous mode [ 377.934002][ T9581] veth1_macvtap: entered promiscuous mode [ 378.026967][ T9581] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 378.062415][ T9581] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 378.094480][ T9581] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 378.127599][ T9581] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 378.137469][ T9581] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 378.186345][ T9581] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 378.222215][ T9581] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 378.253928][ T9581] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 378.271465][ T5775] BTRFS info (device loop3): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 378.303297][ T9581] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 378.332702][ T9581] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 378.382719][ T9581] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 378.404914][ T9581] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 378.436141][ T9581] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 378.468502][ T9581] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 378.515654][ T9581] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.553856][ T9581] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.587271][ T9581] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.587796][ T9840] loop3: detected capacity change from 0 to 128 [ 378.608301][ T9581] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.724712][ T9840] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 378.748030][ T9840] ext4 filesystem being mounted at /291/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 378.851235][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.857661][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.067064][ T5955] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 379.075204][ T5955] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 379.222574][ T5955] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 379.237572][ T5955] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 379.290466][ T5810] usb 2-1: USB disconnect, device number 19 [ 379.322757][ T5775] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 380.699272][ T9877] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 380.877702][ T9877] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 381.431803][ T9897] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1107'. [ 381.537906][ T173] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 381.737635][ T173] usb 4-1: Using ep0 maxpacket: 32 [ 381.750443][ T173] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 381.770361][ T173] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 381.786176][ T173] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 381.811998][ T173] usb 4-1: Product: syz [ 381.834299][ T173] usb 4-1: Manufacturer: syz [ 381.858030][ T173] usb 4-1: SerialNumber: syz [ 381.871974][ T173] usb 4-1: config 0 descriptor?? [ 381.878007][ T9894] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 382.004632][ T11] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.229134][ T11] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.443192][ T11] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.672982][ T11] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.727080][ T9931] netlink: 'syz.1.1116': attribute type 1 has an invalid length. [ 382.809808][ T9931] bond2: entered promiscuous mode [ 382.815230][ T9931] 8021q: adding VLAN 0 to HW filter on device bond2 [ 382.940688][ T9934] 8021q: adding VLAN 0 to HW filter on device bond2 [ 382.972658][ T9934] bond2: (slave vti0): The slave device specified does not support setting the MAC address [ 383.018642][ T9934] bond2: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 383.045079][ T9934] bond2: (slave vti0): making interface the new active one [ 383.052566][ T9934] vti0: entered promiscuous mode [ 383.059844][ T9934] bond2: (slave vti0): Enslaving as an active interface with an up link [ 383.403824][ T5780] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 383.426141][ T5780] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 383.446932][ T5780] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 383.475158][ T5780] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 383.494432][ T5780] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 383.506322][ T5780] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 383.902294][ T173] usb 4-1: USB disconnect, device number 25 [ 384.589173][ T173] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 384.764383][ T9940] chnl_net:caif_netlink_parms(): no params data found [ 384.849504][ T173] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 384.869547][ T173] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 384.897322][ T173] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 384.916383][ T173] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 384.933134][ T173] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 384.950121][ T173] usb 2-1: config 0 descriptor?? [ 385.237758][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 385.259072][ T9940] bridge0: port 1(bridge_slave_0) entered blocking state [ 385.276211][ T9940] bridge0: port 1(bridge_slave_0) entered disabled state [ 385.285705][ T9940] bridge_slave_0: entered allmulticast mode [ 385.294443][ T9940] bridge_slave_0: entered promiscuous mode [ 385.359855][ T9940] bridge0: port 2(bridge_slave_1) entered blocking state [ 385.367313][ T9940] bridge0: port 2(bridge_slave_1) entered disabled state [ 385.377510][ T9940] bridge_slave_1: entered allmulticast mode [ 385.394890][ T9940] bridge_slave_1: entered promiscuous mode [ 385.451486][ T9940] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 385.520901][ T173] plantronics 0003:047F:FFFF.000D: No inputs registered, leaving [ 385.533054][ T173] plantronics 0003:047F:FFFF.000D: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 385.547012][ T9940] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 385.557774][ T5780] Bluetooth: hci0: command tx timeout [ 386.416418][ T9940] team0: Port device team_slave_0 added [ 386.467859][ T9940] team0: Port device team_slave_1 added [ 386.553846][ T9940] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 386.574646][ T9940] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 386.609198][ T9940] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 386.644879][ T173] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 386.662887][ T11] hsr_slave_0: left promiscuous mode [ 386.676480][ T11] hsr_slave_1: left promiscuous mode [ 386.683945][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 386.691525][ T11] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 386.699993][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 386.708133][ T11] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 386.717499][ T11] bridge_slave_1: left allmulticast mode [ 386.730417][ T11] bridge_slave_1: left promiscuous mode [ 386.736358][ T11] bridge0: port 2(bridge_slave_1) entered disabled state [ 386.752752][ T11] bridge_slave_0: left allmulticast mode [ 386.759426][ T11] bridge_slave_0: left promiscuous mode [ 386.765503][ T11] bridge0: port 1(bridge_slave_0) entered disabled state [ 386.817912][ T11] veth1_macvtap: left promiscuous mode [ 386.826913][ T11] veth0_macvtap: left promiscuous mode [ 386.842847][ T11] veth1_vlan: left promiscuous mode [ 386.851056][ T11] veth0_vlan: left promiscuous mode [ 386.868652][ T173] usb 5-1: Using ep0 maxpacket: 32 [ 386.883927][ T173] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 386.931807][ T173] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 386.953170][ T173] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 386.981770][ T173] usb 5-1: Product: syz [ 386.991894][ T173] usb 5-1: Manufacturer: syz [ 387.011756][ T173] usb 5-1: SerialNumber: syz [ 387.038639][ T173] usb 5-1: config 0 descriptor?? [ 387.054159][T10008] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 387.210473][ C0] plantronics 0003:047F:FFFF.000D: usb_submit_urb(ctrl) failed: -1 [ 387.655415][ T5780] Bluetooth: hci0: command tx timeout [ 387.996025][ T11] team0 (unregistering): Port device team_slave_1 removed [ 388.086778][ T173] usb 2-1: USB disconnect, device number 20 [ 388.100974][ T11] team0 (unregistering): Port device team_slave_0 removed [ 388.215283][ T11] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 388.296021][ T11] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 388.865441][ T11] bond0 (unregistering): Released all slaves [ 389.026238][ T9940] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 389.044140][ T9940] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 389.106740][ T9940] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 389.323159][ T9940] hsr_slave_0: entered promiscuous mode [ 389.335019][ T9940] hsr_slave_1: entered promiscuous mode [ 389.363690][T10037] loop1: detected capacity change from 0 to 256 [ 389.719006][ T5780] Bluetooth: hci0: command tx timeout [ 390.123369][ T9940] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 390.547452][ T9940] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 390.637210][ T9940] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 390.714744][ T9940] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 391.225548][ T9940] 8021q: adding VLAN 0 to HW filter on device bond0 [ 391.281695][ T9940] 8021q: adding VLAN 0 to HW filter on device team0 [ 391.326650][ T5955] bridge0: port 1(bridge_slave_0) entered blocking state [ 391.333863][ T5955] bridge0: port 1(bridge_slave_0) entered forwarding state [ 391.363650][ T5955] bridge0: port 2(bridge_slave_1) entered blocking state [ 391.370882][ T5955] bridge0: port 2(bridge_slave_1) entered forwarding state [ 391.428449][ T173] usb 5-1: USB disconnect, device number 2 [ 391.797755][ T5780] Bluetooth: hci0: command tx timeout [ 392.166141][ T9940] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 392.844484][ T5955] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 392.908060][T10104] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 392.993257][ T9940] veth0_vlan: entered promiscuous mode [ 393.035294][ T9940] veth1_vlan: entered promiscuous mode [ 393.144607][ T9940] veth0_macvtap: entered promiscuous mode [ 393.175321][ T9940] veth1_macvtap: entered promiscuous mode [ 393.235802][ T9940] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 393.265066][ T9940] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 393.302671][ T9940] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 393.350667][ T9940] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 393.363221][ T9940] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 393.379319][ T9940] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 393.418837][ T9940] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 393.543698][T10148] loop1: detected capacity change from 0 to 512 [ 393.572069][ T9940] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 393.656442][ T9940] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 393.667745][T10148] EXT4-fs error (device loop1): ext4_iget_extra_inode:4740: inode #15: comm syz.1.1154: corrupted in-inode xattr: invalid ea_ino [ 394.132666][ T9940] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 394.202324][T10148] EXT4-fs error (device loop1): ext4_orphan_get:1409: comm syz.1.1154: couldn't read orphan inode 15 (err -117) [ 394.215746][T10148] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 394.219068][ T9940] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 394.246002][ T9940] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 394.265919][ T9940] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 394.286047][ T9940] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 394.474812][ T9940] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.521517][ T9940] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.534935][ T9940] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.544323][ T9940] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.646209][ T5776] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 394.789940][T10163] syzkaller1: entered promiscuous mode [ 394.825205][T10163] syzkaller1: entered allmulticast mode [ 394.924185][ T4393] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 394.946257][ T4393] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 395.041534][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 395.076300][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 395.100496][T10169] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 395.438385][ T5810] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 395.637796][ T5810] usb 4-1: Using ep0 maxpacket: 32 [ 395.659081][ T5810] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 395.699460][ T5810] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 395.720542][ T5810] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 395.734861][ T5810] usb 4-1: Product: syz [ 395.739334][ T5768] IPVS: starting estimator thread 0... [ 395.755110][ T5810] usb 4-1: Manufacturer: syz [ 395.760239][ T5810] usb 4-1: SerialNumber: syz [ 395.778376][ T5810] usb 4-1: config 0 descriptor?? [ 395.785506][T10177] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 395.838142][T10197] IPVS: using max 19 ests per chain, 45600 per kthread [ 396.400459][ T5768] usb 4-1: USB disconnect, device number 26 [ 397.742850][T10248] block device autoloading is deprecated and will be removed. [ 398.348005][ T2184] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 398.557843][ T2184] usb 5-1: Using ep0 maxpacket: 32 [ 398.570193][ T2184] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 398.598406][ T2184] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 398.608685][ T2184] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 398.617197][ T2184] usb 5-1: Product: syz [ 398.623520][ T2184] usb 5-1: Manufacturer: syz [ 398.632219][ T2184] usb 5-1: SerialNumber: syz [ 398.660250][ T2184] usb 5-1: config 0 descriptor?? [ 398.669613][T10263] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 399.087103][ T5810] usb 5-1: USB disconnect, device number 3 [ 399.481275][T10303] loop5: detected capacity change from 0 to 512 [ 399.515026][T10303] EXT4-fs: quotafile must be on filesystem root [ 399.657094][T10303] Mass Storage Function, version: 2009/09/11 [ 399.667813][T10303] LUN: removable file: (no medium) [ 399.711996][ T28] audit: type=1800 audit(1785979011.672:20): pid=10303 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1183" name="file" dev="configfs" ino=38660 res=0 errno=0 [ 399.739564][T10303] mass_storage.0/lun.0: unable to open backing file: file0 [ 400.072881][T10318] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1185'. [ 401.053659][T10343] loop4: detected capacity change from 0 to 512 [ 401.109782][T10343] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 401.150838][ T23] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 401.164717][T10343] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 401.197854][T10343] ext4 filesystem being mounted at /28/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 401.283614][T10343] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:4059: comm syz.4.1190: Allocating blocks 64-65 which overlap fs metadata [ 401.305463][T10343] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:4059: comm syz.4.1190: Allocating blocks 64-65 which overlap fs metadata [ 401.357635][ T23] usb 6-1: Using ep0 maxpacket: 32 [ 401.360314][ T23] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 401.362313][ T23] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 401.362341][ T23] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 401.362362][ T23] usb 6-1: Product: syz [ 401.362376][ T23] usb 6-1: Manufacturer: syz [ 401.362390][ T23] usb 6-1: SerialNumber: syz [ 401.370153][ T23] usb 6-1: config 0 descriptor?? [ 401.371449][T10339] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 401.436373][T10355] loop1: detected capacity change from 0 to 512 [ 401.520026][T10355] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 401.551127][T10342] EXT4-fs (loop4): pa ffff88805baee1d0: logic 1, phys. 44, len 84 [ 401.560063][T10342] EXT4-fs error (device loop4): ext4_mb_release_inode_pa:5393: group 0, free 63, pa_free 64 [ 401.652326][T10355] ext4 filesystem being mounted at /306/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 401.746953][T10355] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 96 vs 65376 free clusters [ 401.812306][T10355] EXT4-fs (loop1): Delayed block allocation failed for inode 16 at logical offset 10 with max blocks 23 with error 28 [ 401.844109][ T9581] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 401.846699][T10355] EXT4-fs (loop1): This should not happen!! Data will be lost [ 401.846699][T10355] [ 401.923438][T10355] EXT4-fs (loop1): Total free blocks count 0 [ 401.967656][T10355] EXT4-fs (loop1): Free/Dirty block details [ 401.989690][T10355] EXT4-fs (loop1): free_blocks=65280 [ 402.006974][T10355] EXT4-fs (loop1): dirty_blocks=28 [ 402.032946][T10355] EXT4-fs (loop1): Block reservation details [ 402.049669][T10355] EXT4-fs (loop1): i_reserved_data_blocks=28 [ 402.078761][T10370] EXT4-fs (loop1): Delayed block allocation failed for inode 16 at logical offset 5 with max blocks 27 with error 28 [ 402.213184][ T23] usb 6-1: USB disconnect, device number 2 [ 402.529745][T10386] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1198'. [ 402.651803][T10391] jffs2: notice: (10391) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 402.791983][T10400] loop5: detected capacity change from 0 to 512 [ 403.074059][T10400] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 403.473826][ T5758] udevd[5758]: incorrect ext4dev checksum on /dev/loop5 [ 403.602122][T10400] EXT4-fs error (device loop5): ext4_resize_begin:62: comm syz.5.1200: resize_inode disabled but reserved GDT blocks non-zero [ 404.348991][ T9940] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 405.679024][ T28] audit: type=1326 audit(1785979017.642:21): auid=4294967295 uid=255 gid=0 ses=4294967295 subj=unconfined pid=10454 comm="syz.1.1210" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5e15d9e0d9 code=0x0 [ 406.630357][T10441] loop5: detected capacity change from 0 to 32768 [ 406.645932][T10441] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz.5.1207 (10441) [ 406.698690][T10441] BTRFS info (device loop5): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 406.709792][T10441] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm [ 406.719091][T10441] BTRFS info (device loop5): setting nodatasum [ 406.726960][T10441] BTRFS info (device loop5): force zlib compression, level 3 [ 406.735369][T10441] BTRFS info (device loop5): setting incompat feature flag for COMPRESS_LZO (0x8) [ 406.746058][T10441] BTRFS info (device loop5): use lzo compression, level 0 [ 406.756543][T10441] BTRFS info (device loop5): turning on flush-on-commit [ 406.766325][T10441] BTRFS info (device loop5): enabling auto defrag [ 406.774261][T10441] BTRFS info (device loop5): max_inline at 4096 [ 406.837861][T10441] BTRFS info (device loop5): using free space tree [ 407.435484][T10441] BTRFS info (device loop5): enabling ssd optimizations [ 407.994797][ T9940] BTRFS info (device loop5): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 408.287632][ T5810] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 408.347010][T10516] FAULT_FLAG_ALLOW_RETRY missing 801 [ 408.374967][T10516] CPU: 1 PID: 10516 Comm: syz.1.1220 Not tainted syzkaller #0 [ 408.382499][T10516] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 408.392599][T10516] Call Trace: [ 408.395923][T10516] [ 408.398879][T10516] dump_stack_lvl+0x18c/0x250 [ 408.403659][T10516] ? show_regs_print_info+0x20/0x20 [ 408.408901][T10516] ? load_image+0x420/0x420 [ 408.413497][T10516] ? assert_fault_locked+0x17f/0x3a0 [ 408.418825][T10516] handle_userfault+0x11e4/0x13b0 [ 408.423881][T10516] ? lockdep_hardirqs_on+0x98/0x150 [ 408.429136][T10516] ? userfaultfd_wp_unpopulated+0xa0/0xa0 [ 408.434986][T10516] ? do_raw_spin_unlock+0x121/0x230 [ 408.440270][T10516] ? free_unref_page+0x190/0x2e0 [ 408.445271][T10516] handle_mm_fault+0x3ce9/0x4a50 [ 408.450247][T10516] ? handle_mm_fault+0xe6/0x4a50 [ 408.455269][T10516] ? numa_migrate_prep+0x350/0x350 [ 408.460416][T10516] ? follow_page_pte+0x6dd/0x1ae0 [ 408.465536][T10516] ? pmd_lock+0x60/0x60 [ 408.469734][T10516] __get_user_pages+0x604/0x1580 [ 408.474732][T10516] ? populate_vma_page_range+0x380/0x380 [ 408.480406][T10516] populate_vma_page_range+0x2c1/0x380 [ 408.485912][T10516] ? fixup_user_fault+0x750/0x750 [ 408.490986][T10516] mprotect_fixup+0x9a3/0xcd0 [ 408.495716][T10516] ? change_protection+0x31e0/0x31e0 [ 408.501039][T10516] ? apparmor_file_mprotect+0xfe/0x120 [ 408.506584][T10516] ? bpf_lsm_file_mprotect+0x9/0x10 [ 408.511848][T10516] do_mprotect_pkey+0x7c3/0xcc0 [ 408.516744][T10516] ? prot_none_test+0x10/0x10 [ 408.521463][T10516] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 408.527496][T10516] __x64_sys_mprotect+0x80/0x90 [ 408.532386][T10516] do_syscall_64+0x55/0xb0 [ 408.536840][T10516] ? clear_bhb_loop+0x40/0x90 [ 408.541675][T10516] ? clear_bhb_loop+0x40/0x90 [ 408.546383][T10516] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 408.552318][T10516] RIP: 0033:0x7f5e15d9e0d9 [ 408.556767][T10516] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 408.576405][T10516] RSP: 002b:00007f5e16c5d028 EFLAGS: 00000246 ORIG_RAX: 000000000000000a [ 408.577627][ T5810] usb 5-1: Using ep0 maxpacket: 32 [ 408.584858][T10516] RAX: ffffffffffffffda RBX: 00007f5e16025fa0 RCX: 00007f5e15d9e0d9 [ 408.597991][T10516] RDX: 000000000000000f RSI: 0000000000004000 RDI: 0000200000ffc000 [ 408.605996][T10516] RBP: 00007f5e15e35024 R08: 0000000000000000 R09: 0000000000000000 [ 408.609491][ T5810] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 408.613980][T10516] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 408.613999][T10516] R13: 00007f5e16026038 R14: 00007f5e16025fa0 R15: 00007ffe061aa7e8 [ 408.614027][T10516] [ 408.868111][ T5810] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 408.877216][ T5810] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 408.892008][ T5810] usb 5-1: Product: syz [ 408.896244][ T5810] usb 5-1: Manufacturer: syz [ 408.901431][ T5810] usb 5-1: SerialNumber: syz [ 408.937503][ T5810] usb 5-1: config 0 descriptor?? [ 408.968352][T10506] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 410.891091][T10550] loop3: detected capacity change from 0 to 32768 [ 410.942021][T10550] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz.3.1226 (10550) [ 411.042137][T10550] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 411.086382][T10550] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm [ 411.125962][T10550] BTRFS info (device loop3): setting nodatasum [ 411.146162][T10550] BTRFS info (device loop3): force zlib compression, level 3 [ 411.180534][T10550] BTRFS info (device loop3): setting incompat feature flag for COMPRESS_LZO (0x8) [ 411.192481][T10550] BTRFS info (device loop3): use lzo compression, level 0 [ 411.235509][T10550] BTRFS info (device loop3): turning on flush-on-commit [ 411.265244][T10550] BTRFS info (device loop3): enabling auto defrag [ 411.288864][T10550] BTRFS info (device loop3): max_inline at 4096 [ 411.329201][T10550] BTRFS info (device loop3): using free space tree [ 411.370934][ T5830] usb 5-1: USB disconnect, device number 4 [ 411.586500][T10550] BTRFS info (device loop3): enabling ssd optimizations [ 412.220879][ T5775] BTRFS info (device loop3): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 412.816009][T10605] ip_tables: iptables: counters copy to user failed while replacing table [ 416.032900][ T5768] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 416.237660][ T5768] usb 5-1: Using ep0 maxpacket: 32 [ 416.245303][ T5768] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 416.260245][ T5768] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 416.269709][ T5768] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 416.278033][ T5768] usb 5-1: Product: syz [ 416.282478][ T5768] usb 5-1: Manufacturer: syz [ 416.287110][ T5768] usb 5-1: SerialNumber: syz [ 416.298324][ T5768] usb 5-1: config 0 descriptor?? [ 416.306641][T10622] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 416.762677][ T5781] Bluetooth: hci3: command 0x0406 tx timeout [ 418.023442][ T2184] usb 5-1: USB disconnect, device number 5 [ 418.255391][T10660] loop4: detected capacity change from 0 to 64 [ 418.656911][T10667] md: md2 stopped. [ 419.008418][T10657] loop5: detected capacity change from 0 to 32768 [ 419.063465][T10677] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 420.438000][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 420.870735][T10718] loop5: detected capacity change from 0 to 8192 [ 420.928716][T10718] FAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 421.023517][T10714] loop1: detected capacity change from 0 to 32768 [ 421.131832][T10714] XFS (loop1): Mounting V5 Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a [ 421.267492][T10714] XFS (loop1): Ending clean mount [ 421.301945][T10714] XFS (loop1): Quotacheck needed: Please wait. [ 421.396222][T10714] XFS (loop1): Quotacheck: Done. [ 421.566336][ T5776] XFS (loop1): Unmounting Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a [ 421.671971][ T23] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 421.890255][ T23] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 421.911845][ T23] usb 6-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 421.950402][ T23] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 421.975620][ T23] usb 6-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 422.003483][ T23] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 422.024443][ T23] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 422.037731][ T23] usb 6-1: Product: syz [ 422.043741][ T23] usb 6-1: Manufacturer: syz [ 422.056960][T10748] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 422.080719][ T23] cdc_wdm 6-1:1.0: skipping garbage [ 422.085993][ T23] cdc_wdm 6-1:1.0: skipping garbage [ 422.110142][ T23] cdc_wdm: probe of 6-1:1.0 failed with error -22 [ 422.460288][T10766] ip_tables: iptables: counters copy to user failed while replacing table [ 422.829089][ T23] usb 6-1: USB disconnect, device number 3 [ 423.652907][T10785] loop5: detected capacity change from 0 to 512 [ 423.741212][T10785] EXT4-fs error (device loop5): ext4_get_branch:178: inode #13: block 33619980: comm syz.5.1274: invalid block [ 423.856928][T10785] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #13: comm syz.5.1274: invalid indirect mapped block 10 (level 1) [ 423.931870][T10785] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #13: comm syz.5.1274: invalid indirect mapped block 8 (level 1) [ 424.007220][T10785] EXT4-fs (loop5): 1 truncate cleaned up [ 424.014892][T10785] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 424.186795][ T9940] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 424.714548][T10806] loop1: detected capacity change from 0 to 512 [ 424.751496][T10806] EXT4-fs (loop1): bad block size 8192 [ 425.553920][T10832] ip_tables: iptables: counters copy to user failed while replacing table [ 427.105767][T10858] loop4: detected capacity change from 0 to 128 [ 427.158923][T10858] FAT-fs (loop4): Invalid FSINFO signature: 0x41615200, 0x61417272 (sector = 1) [ 427.304525][ T28] audit: type=1800 audit(1785979039.262:22): pid=10858 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1286" name="file2" dev="loop4" ino=1048690 res=0 errno=0 [ 427.351135][T10858] FAT-fs (loop4): error, invalid access to FAT (entry 0x00000100) [ 427.407179][T10858] FAT-fs (loop4): Filesystem has been set read-only [ 427.466493][T10858] syz.4.1286: attempt to access beyond end of device [ 427.466493][T10858] loop4: rw=524288, sector=2065, nr_sectors = 8 limit=128 [ 427.512459][T10858] FAT-fs (loop4): error, invalid access to FAT (entry 0x00000100) [ 427.532556][T10858] FAT-fs (loop4): error, invalid access to FAT (entry 0x00000100) [ 427.555436][T10858] syz.4.1286: attempt to access beyond end of device [ 427.555436][T10858] loop4: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 428.137722][ T23] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 428.347803][ T23] usb 5-1: Using ep0 maxpacket: 8 [ 428.363980][ T23] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 428.382866][ T23] usb 5-1: config 179 has no interface number 0 [ 428.397952][ T23] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 428.437856][ T23] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 428.457729][ T23] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 428.483198][ T23] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 428.522045][ T23] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 428.617652][ T23] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 428.626817][ T23] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 428.838411][T10886] ip_tables: iptables: counters copy to user failed while replacing table [ 428.854997][T10871] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 430.243083][T10899] netlink: 'syz.1.1296': attribute type 5 has an invalid length. [ 430.298324][T10871] loop4: detected capacity change from 0 to 1024 [ 430.925937][ T5810] usb 5-1: USB disconnect, device number 6 [ 430.925979][ C1] xpad 5-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 430.940504][ C1] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 432.040040][T10956] zonefs (nullb0) ERROR: Not a zoned block device [ 432.656904][T10968] overlayfs: failed to verify origin (356/file1, ino=1980, err=-116) [ 432.671874][T10968] overlayfs: failed to verify origin (356/file1, ino=1980, err=-116) [ 433.616903][T10982] loop5: detected capacity change from 0 to 32768 [ 433.645138][T10982] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz.5.1315 (10982) [ 433.696481][T10982] BTRFS info (device loop5): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 433.726931][T10982] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm [ 433.759883][T10982] BTRFS info (device loop5): setting nodatasum [ 433.766159][T10982] BTRFS info (device loop5): force zlib compression, level 3 [ 433.784008][T10982] BTRFS info (device loop5): setting incompat feature flag for COMPRESS_LZO (0x8) [ 433.815143][T10982] BTRFS info (device loop5): use lzo compression, level 0 [ 433.861559][T10982] BTRFS info (device loop5): turning on flush-on-commit [ 433.894396][T10982] BTRFS info (device loop5): enabling auto defrag [ 433.939171][T10982] BTRFS info (device loop5): max_inline at 4096 [ 433.945494][T10982] BTRFS info (device loop5): using free space tree [ 434.135644][T10982] BTRFS info (device loop5): enabling ssd optimizations [ 434.976267][ T9940] BTRFS info (device loop5): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 435.267842][ T173] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 435.485465][ T173] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 435.514309][ T173] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 435.715750][T11072] loop5: detected capacity change from 0 to 64 [ 436.401663][ T173] gud 4-1:1.0: Failed to get connectors (error=-5) [ 436.425505][ T173] gud: probe of 4-1:1.0 failed with error -5 [ 436.980926][T11105] loop4: detected capacity change from 0 to 512 [ 437.023794][T11105] EXT4-fs (loop4): bad block size 8192 [ 437.722108][T11121] loop4: detected capacity change from 0 to 2048 [ 437.833973][T11121] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 437.879066][T11121] ext4 filesystem being mounted at /63/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 438.034505][T11132] EXT4-fs error (device loop4): ext4_validate_block_bitmap:439: comm ext4lazyinit: bg 0: block 368: padding at end of block bitmap is not set [ 438.075705][T11121] fs-verity: sha512 using implementation "sha512-avx2" [ 438.116732][T11121] fs-verity (loop4, inode 13): Error -28 writing Merkle tree block 1 [ 438.126628][T11121] fs-verity (loop4, inode 13): Error -28 building Merkle tree [ 438.256772][ T9581] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 438.673545][ T23] usb 4-1: USB disconnect, device number 27 [ 438.802384][T11159] loop3: detected capacity change from 0 to 4096 [ 438.821144][T11159] EXT4-fs: inline encryption not supported [ 438.859930][T11159] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 438.882486][T11159] EXT4-fs (loop3): Test dummy encryption mode enabled [ 438.925725][T11159] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=280ec1a8, mo2=0003] [ 438.954773][T11159] System zones: 0-5 [ 438.966572][T11159] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 439.533503][ T9629] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 440.098510][ T5807] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 440.235792][ T4393] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 440.282606][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.289064][ T5807] usb 2-1: Using ep0 maxpacket: 16 [ 440.294362][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.306301][ T5807] usb 2-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 440.317284][ T5807] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 440.418955][ T5807] usb 2-1: config 0 descriptor?? [ 440.468153][ T5807] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 441.001714][ T4393] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 441.176720][ T4393] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 441.272048][ T5781] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 441.285327][ T5781] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 441.318583][ T5781] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 441.328351][ T5781] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 441.345891][ T5781] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 441.356326][ T5781] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 441.512257][ T4393] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 442.089593][T11214] chnl_net:caif_netlink_parms(): no params data found [ 442.518362][T11214] bridge0: port 1(bridge_slave_0) entered blocking state [ 442.558054][T11214] bridge0: port 1(bridge_slave_0) entered disabled state [ 442.565416][T11214] bridge_slave_0: entered allmulticast mode [ 442.590411][T11214] bridge_slave_0: entered promiscuous mode [ 442.637183][ T5807] gspca_sonixj: reg_r err -71 [ 442.642262][ T5807] sonixj: probe of 2-1:0.0 failed with error -71 [ 442.661115][T11214] bridge0: port 2(bridge_slave_1) entered blocking state [ 442.682570][T11214] bridge0: port 2(bridge_slave_1) entered disabled state [ 442.693039][ T5807] usb 2-1: USB disconnect, device number 21 [ 442.702836][T11214] bridge_slave_1: entered allmulticast mode [ 442.721222][T11214] bridge_slave_1: entered promiscuous mode [ 442.992512][T11214] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 443.099306][T11214] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 443.396193][T11214] team0: Port device team_slave_0 added [ 443.421032][T11214] team0: Port device team_slave_1 added [ 443.482151][T11268] loop1: detected capacity change from 0 to 512 [ 443.505836][T11214] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 443.513571][ T5781] Bluetooth: hci2: command tx timeout [ 443.566770][T11214] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 443.621681][T11268] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 443.733572][T11214] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 443.769594][T11268] EXT4-fs warning (device loop1): dx_probe:869: inode #2: comm syz.1.1362: Unimplemented hash flags: 0x0001 [ 443.817232][T11214] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 443.833745][T11268] EXT4-fs warning (device loop1): dx_probe:966: inode #2: comm syz.1.1362: Corrupt directory, running e2fsck is recommended [ 443.864296][T11214] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 443.935852][T11280] EXT4-fs warning (device loop1): dx_probe:869: inode #2: comm syz.1.1362: Unimplemented hash flags: 0x0001 [ 443.993512][T11280] EXT4-fs warning (device loop1): dx_probe:966: inode #2: comm syz.1.1362: Corrupt directory, running e2fsck is recommended [ 443.998534][T11214] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 444.009222][T11281] EXT4-fs warning (device loop1): dx_probe:869: inode #2: comm syz.1.1362: Unimplemented hash flags: 0x0001 [ 444.028798][T11281] EXT4-fs warning (device loop1): dx_probe:966: inode #2: comm syz.1.1362: Corrupt directory, running e2fsck is recommended [ 444.051573][T11268] EXT4-fs warning (device loop1): dx_probe:869: inode #2: comm syz.1.1362: Unimplemented hash flags: 0x0001 [ 444.090557][T11268] EXT4-fs warning (device loop1): dx_probe:966: inode #2: comm syz.1.1362: Corrupt directory, running e2fsck is recommended [ 444.126774][T11280] EXT4-fs warning (device loop1): dx_probe:869: inode #2: comm syz.1.1362: Unimplemented hash flags: 0x0001 [ 444.192645][T11280] EXT4-fs warning (device loop1): dx_probe:966: inode #2: comm syz.1.1362: Corrupt directory, running e2fsck is recommended [ 444.282303][ T5776] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 444.323410][T11214] hsr_slave_0: entered promiscuous mode [ 444.350974][T11292] fuse: Bad value for 'fd' [ 444.359429][T11214] hsr_slave_1: entered promiscuous mode [ 444.421029][T11214] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 444.447990][T11214] Cannot create hsr debugfs directory [ 444.519067][T11296] vivid-007: ================= START STATUS ================= [ 444.530748][T11296] vivid-007: Enable Output Cropping: true [ 444.544939][T11296] vivid-007: Enable Output Composing: true [ 444.566924][T11296] vivid-007: Enable Output Scaler: true [ 444.578119][T11296] vivid-007: Tx RGB Quantization Range: Automatic [ 444.586889][T11296] vivid-007: Transmit Mode: HDMI [ 444.596861][T11296] vivid-007: Display Present: true inactive [ 444.611962][T11296] vivid-007: Hotplug Present: 0x00000001 [ 444.620032][T11296] vivid-007: RxSense Present: 0x00000001 [ 444.627708][T11296] vivid-007: EDID Present: 0x00000001 [ 444.633189][T11296] vivid-007: ================== END STATUS ================== [ 444.655608][ T4393] hsr_slave_0: left promiscuous mode [ 444.663932][ T4393] hsr_slave_1: left promiscuous mode [ 444.672310][ T4393] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 444.685624][ T4393] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 444.694459][ T4393] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 444.704423][ T4393] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 444.719014][ T4393] bridge_slave_1: left allmulticast mode [ 444.724796][ T4393] bridge_slave_1: left promiscuous mode [ 444.736036][ T4393] bridge0: port 2(bridge_slave_1) entered disabled state [ 444.760527][ T4393] bridge_slave_0: left allmulticast mode [ 444.766445][ T4393] bridge_slave_0: left promiscuous mode [ 444.777597][ T4393] bridge0: port 1(bridge_slave_0) entered disabled state [ 444.835684][ T4393] veth1_macvtap: left promiscuous mode [ 444.842102][ T4393] veth0_macvtap: left promiscuous mode [ 444.847863][ T4393] veth1_vlan: left promiscuous mode [ 444.853550][ T4393] veth0_vlan: left promiscuous mode [ 444.984817][ T4393] bond2 (unregistering): Released all slaves [ 445.361417][ T4393] bond1 (unregistering): Released all slaves [ 445.567661][ T5780] Bluetooth: hci2: command tx timeout [ 446.301302][T11311] block device autoloading is deprecated and will be removed. [ 446.575520][ T4393] team0 (unregistering): Port device team_slave_1 removed [ 446.636973][ T4393] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 446.737101][ T4393] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 447.015499][T11320] Bluetooth: MGMT ver 1.22 [ 447.365645][ T4393] bond0 (unregistering): Released all slaves [ 447.643313][ T5780] Bluetooth: hci2: command tx timeout [ 447.723846][ T5830] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 447.751846][T11329] loop5: detected capacity change from 0 to 512 [ 447.797138][T11329] EXT4-fs (loop5): mounting ext3 file system using the ext4 subsystem [ 447.850165][ T5830] hid-generic 0000:0000:0000.000E: hidraw0: HID v0.00 Device [syz1] on syz0 [ 447.854477][T11329] EXT4-fs (loop5): invalid journal inode [ 447.926905][T11329] EXT4-fs (loop5): can't get journal size [ 447.975986][T11329] EXT4-fs error (device loop5): ext4_protect_reserved_inode:182: inode #2: comm syz.5.1377: blocks 4-4 from inode overlap system zone [ 448.007816][T11329] EXT4-fs (loop5): failed to initialize system zone (-117) [ 448.015543][T11329] EXT4-fs (loop5): mount failed [ 448.120911][T11214] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 448.193958][T11214] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 448.229095][T11214] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 448.298750][T11214] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 448.582203][T11344] loop5: detected capacity change from 0 to 2048 [ 448.598841][T11214] 8021q: adding VLAN 0 to HW filter on device bond0 [ 448.646229][T11344] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 448.681718][T11214] 8021q: adding VLAN 0 to HW filter on device team0 [ 448.739838][T11344] ext4 filesystem being mounted at /63/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 448.847470][ T1097] bridge0: port 1(bridge_slave_0) entered blocking state [ 448.854758][ T1097] bridge0: port 1(bridge_slave_0) entered forwarding state [ 449.019504][T11358] input: syz0 as /devices/virtual/input/input24 [ 449.677957][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 449.685151][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 449.776864][ T5780] Bluetooth: hci2: command tx timeout [ 450.209179][ T9940] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 450.972394][T11214] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 451.395136][T11410] loop4: detected capacity change from 0 to 512 [ 451.432501][T11410] EXT4-fs: Ignoring removed oldalloc option [ 451.488173][T11410] EXT4-fs: inline encryption not supported [ 451.529540][T11410] EXT4-fs: Mount option(s) incompatible with ext2 [ 451.631445][ T5758] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 451.834224][T11421] loop4: detected capacity change from 0 to 2048 [ 451.950498][T11214] veth0_vlan: entered promiscuous mode [ 452.012990][T11214] veth1_vlan: entered promiscuous mode [ 452.079419][T11426] loop5: detected capacity change from 0 to 256 [ 452.207379][T11214] veth0_macvtap: entered promiscuous mode [ 452.273981][T11214] veth1_macvtap: entered promiscuous mode [ 452.380375][T11214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 452.416715][T11214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 452.453521][T11214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 452.497956][T11214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 452.528238][T11214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 452.545539][T11214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 452.561245][T11214] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 452.589542][T11214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 452.638618][T11214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 452.666962][T11214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 452.699130][T11214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 452.727633][T11214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 452.755982][T11214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 452.779845][T11214] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 452.820361][T11214] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 452.833425][T11214] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 452.851850][T11443] block device autoloading is deprecated and will be removed. [ 452.866649][T11214] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 452.895853][T11214] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.327302][ T4393] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 453.347431][ T4393] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 453.499620][ T6277] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 453.514346][ T6277] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 454.010930][T11481] binder: 11480:11481 ioctl c0306201 200000000680 returned -14 [ 457.261028][ T27] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 457.417821][ T27] usb 2-1: device descriptor read/64, error -71 [ 457.692028][ T27] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 457.854420][ T27] usb 2-1: device descriptor read/64, error -71 [ 457.979321][ T27] usb usb2-port1: attempt power cycle [ 458.247473][T11525] netlink: 164 bytes leftover after parsing attributes in process `syz.6.1413'. [ 458.398019][ T27] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 458.456603][ T27] usb 2-1: device descriptor read/8, error -71 [ 458.827960][ T27] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 458.993911][ T27] usb 2-1: device descriptor read/8, error -71 [ 459.186401][ T27] usb usb2-port1: unable to enumerate USB device [ 459.691998][T11548] loop5: detected capacity change from 0 to 1024 [ 459.911040][T11548] EXT4-fs (loop5): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 460.098944][T11548] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (38281!=20869) [ 460.279479][T11548] EXT4-fs (loop5): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 460.482131][T11548] EXT4-fs error (device loop5): ext4_ext_check_inode:532: inode #3: comm syz.5.1419: pblk 0 bad header/extent: too large eh_max - magic f30a, entries 2, max 15(4), depth 0(0) [ 460.836529][T11548] EXT4-fs (loop5): no journal found [ 460.936726][T11548] EXT4-fs (loop5): can't get journal size [ 461.313391][T11548] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 461.799093][ T9940] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 462.054065][T11568] binder: BINDER_SET_CONTEXT_MGR already set [ 462.085383][T11568] binder: 11567:11568 ioctl 4018620d 200000004a80 returned -16 [ 462.112157][T11554] loop1: detected capacity change from 0 to 32768 [ 462.163031][T11554] BTRFS: device fsid 5e4b7888-5e56-43f0-8345-635ad0fd87c6 devid 1 transid 8 /dev/loop1 scanned by syz.1.1420 (11554) [ 462.307756][T11554] BTRFS info (device loop1): first mount of filesystem 5e4b7888-5e56-43f0-8345-635ad0fd87c6 [ 462.338875][T11554] BTRFS info (device loop1): using blake2b (blake2b-256-generic) checksum algorithm [ 462.396811][T11554] BTRFS info (device loop1): using free space tree [ 462.665950][T11554] BTRFS info (device loop1): enabling ssd optimizations [ 462.720128][T11554] BTRFS info (device loop1): auto enabling async discard [ 464.340654][ T5776] BTRFS info (device loop1): last unmount of filesystem 5e4b7888-5e56-43f0-8345-635ad0fd87c6 [ 464.877669][ T5830] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 464.997398][ T28] audit: type=1800 audit(1785979076.952:23): pid=11644 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1433" name="attr_allow_any_host" dev="configfs" ino=45859 res=0 errno=0 [ 465.065659][ T28] audit: type=1800 audit(1785979077.022:24): pid=11641 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1433" name="addr_trtype" dev="configfs" ino=45866 res=0 errno=0 [ 465.089935][ T5830] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 465.123969][ T5830] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 465.169667][ T5830] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 465.218769][ T5830] usb 5-1: config 0 descriptor?? [ 465.266027][ T5830] pwc: Askey VC010 type 2 USB webcam detected. [ 465.294341][ T5810] nvmet: creating nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:38d948ca-c70b-4af7-9bdb-18e876d5cbec. [ 465.376335][T11641] nvme nvme0: creating 2 I/O queues. [ 465.404412][T11641] nvme nvme0: new ctrl: "testnqn" [ 465.438063][ T5830] pwc: send_video_command error -71 [ 465.444061][ T5830] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 465.464108][ T5830] Philips webcam: probe of 5-1:0.0 failed with error -71 [ 465.478660][ T5830] usb 5-1: USB disconnect, device number 7 [ 465.689591][T11668] loop5: detected capacity change from 0 to 512 [ 465.751895][ T5758] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 466.037796][ T5830] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 466.268779][ T5830] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 466.287949][ T5830] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 466.309885][ T5830] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.327994][ T5830] usb 5-1: config 0 descriptor?? [ 466.346547][ T5830] pwc: Askey VC010 type 2 USB webcam detected. [ 466.414541][T11681] loop6: detected capacity change from 0 to 512 [ 466.448792][T11681] EXT4-fs: Ignoring removed i_version option [ 466.454853][T11681] EXT4-fs: Ignoring removed oldalloc option [ 466.531429][T11681] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 466.789110][ T5830] pwc: recv_control_msg error -32 req 02 val 2b00 [ 466.798937][ T5830] pwc: recv_control_msg error -32 req 02 val 2700 [ 466.807946][ T5830] pwc: recv_control_msg error -32 req 02 val 2c00 [ 466.817242][ T5830] pwc: recv_control_msg error -32 req 04 val 1000 [ 466.833337][ T5830] pwc: recv_control_msg error -32 req 04 val 1300 [ 467.060460][ T5830] pwc: recv_control_msg error -71 req 02 val 2000 [ 467.079057][ T5830] pwc: recv_control_msg error -71 req 02 val 2100 [ 467.090037][T11214] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 467.097119][ T5830] pwc: recv_control_msg error -71 req 04 val 1500 [ 467.107713][ T5830] pwc: recv_control_msg error -71 req 02 val 2500 [ 467.125068][ T5830] pwc: recv_control_msg error -71 req 02 val 2400 [ 467.138108][ T5830] pwc: recv_control_msg error -71 req 02 val 2600 [ 467.169785][ T5830] pwc: recv_control_msg error -71 req 02 val 2900 [ 467.207286][ T5830] pwc: recv_control_msg error -71 req 02 val 2800 [ 467.230523][ T5830] pwc: recv_control_msg error -71 req 04 val 1100 [ 467.253350][ T5830] pwc: recv_control_msg error -71 req 04 val 1200 [ 467.305847][ T5830] pwc: Registered as video103. [ 467.308854][ T28] audit: type=1800 audit(1785979079.252:25): pid=11706 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1444" name="iTerminal" dev="configfs" ino=45955 res=0 errno=0 [ 467.325188][ T5830] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input25 [ 467.383864][ T5830] usb 5-1: USB disconnect, device number 8 [ 467.931029][T11726] loop4: detected capacity change from 0 to 8 [ 468.170386][T11735] loop4: detected capacity change from 0 to 16 [ 468.182822][T11735] erofs: (device loop4): mounted with root inode @ nid 36. [ 468.207790][ T5780] Bluetooth: hci1: Malformed MSFT vendor event: 0x02 [ 470.496914][T11782] loop5: detected capacity change from 0 to 1024 [ 470.512356][T11782] EXT4-fs: Ignoring removed orlov option [ 470.593855][T11782] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 470.992752][ T9940] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 471.300342][T11804] loop1: detected capacity change from 0 to 16 [ 471.350255][T11804] erofs: (device loop1): mounted with root inode @ nid 36. [ 472.073714][T11804] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress 1929 in[58, 4038] out[2639] [ 472.117121][T11804] erofs: (device loop1): z_erofs_read_folio: read error -117 @ 39 of nid 36 [ 472.249590][T11810] loop5: detected capacity change from 0 to 128 [ 472.356457][T11810] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 472.458836][T11810] ext4 filesystem being mounted at /89/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 472.574225][T11810] EXT4-fs (loop5): re-mounted 76b65be2-f6da-4727-8c75-0525a5b65a09 ro. [ 472.576487][T11822] EXT4-fs error (device loop5): htree_dirblock_to_tree:1112: inode #2: block 4: comm syz.5.1471: bad entry in directory: inode out of bounds - offset=1012, inode=128, rec_len=12, size=1024 fake=1 [ 472.670059][ T9940] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 472.817443][T11812] loop6: detected capacity change from 0 to 32768 [ 472.833288][T11812] BTRFS: device fsid 28302361-d975-4c41-bd4c-c547b14b74a1 devid 1 transid 8 /dev/loop6 scanned by syz.6.1472 (11812) [ 472.894424][T11812] BTRFS info (device loop6): first mount of filesystem 28302361-d975-4c41-bd4c-c547b14b74a1 [ 472.905233][T11812] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm [ 472.929115][T11812] BTRFS info (device loop6): using free space tree [ 472.974818][T11828] kvm: pic: non byte write [ 473.066530][T11812] BTRFS info (device loop6): enabling ssd optimizations [ 473.094250][T11812] BTRFS info (device loop6): auto enabling async discard [ 473.166098][T11843] syzkaller0: entered promiscuous mode [ 473.204806][T11843] syzkaller0: entered allmulticast mode [ 473.515465][T11214] BTRFS info (device loop6): last unmount of filesystem 28302361-d975-4c41-bd4c-c547b14b74a1 [ 474.412017][T11860] loop1: detected capacity change from 0 to 32768 [ 474.457321][T11860] JBD2: Ignoring recovery information on journal [ 474.615894][T11860] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 474.627927][ T2184] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 474.786022][ T2184] usb 5-1: device descriptor read/64, error -71 [ 474.909944][ T28] audit: type=1804 audit(1785979086.862:26): pid=11860 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.1481" name="/newroot/380/bus/file1" dev="loop1" ino=17059 res=1 errno=0 [ 475.052803][T11884] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 475.055348][ T28] audit: type=1804 audit(1785979087.012:27): pid=11860 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.1481" name="/newroot/380/bus/bus" dev="loop1" ino=17058 res=1 errno=0 [ 475.096807][ T2184] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 475.103631][T11884] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 475.126026][T11884] kvm: requested 13409 ns i8254 timer period limited to 200000 ns [ 475.199144][ T5776] ocfs2: Unmounting device (7,1) on (node local) [ 475.277952][ T2184] usb 5-1: device descriptor read/64, error -71 [ 475.409935][ T2184] usb usb5-port1: attempt power cycle [ 475.827777][ T2184] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 475.869324][ T2184] usb 5-1: device descriptor read/8, error -71 [ 475.878131][T11907] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 476.278087][ T2184] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 476.323951][ T2184] usb 5-1: device descriptor read/8, error -71 [ 476.918180][ T2184] usb usb5-port1: unable to enumerate USB device [ 477.116622][T11925] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 477.143001][T11928] loop6: detected capacity change from 0 to 1024 [ 477.542118][T11943] binder: 11941:11943 ioctl c0306201 200000000680 returned -14 [ 477.967813][ T5810] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 478.479052][ T5810] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 478.587868][ T5810] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 478.816142][ T5810] usb 7-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 0.00 [ 479.010481][ T5810] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 479.067170][ T5810] usb 7-1: Product: syz [ 479.072336][ T5810] usb 7-1: Manufacturer: syz [ 479.087325][ T5810] usb 7-1: SerialNumber: syz [ 479.118008][T11948] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 479.146337][T11948] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 479.201339][ T5810] input: syz syz as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/input/input26 [ 479.236730][ C0] usbtouchscreen 7-1:1.0: usbtouch_irq - usb_submit_urb failed with result: -1 [ 479.291838][ T5810] input: syz syz as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.1/input/input27 [ 479.310367][T11970] loop1: detected capacity change from 0 to 1024 [ 479.443787][T11970] hfsplus: request for non-existent node 33554434 in B*Tree [ 479.502106][T11970] hfsplus: request for non-existent node 33554434 in B*Tree [ 479.560966][T11970] hfsplus: request for non-existent node 33554434 in B*Tree [ 479.593489][T11970] hfsplus: request for non-existent node 33554434 in B*Tree [ 479.625602][ T28] audit: type=1800 audit(1785979091.582:28): pid=11982 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1508" name="attr_allow_any_host" dev="configfs" ino=47651 res=0 errno=0 [ 479.639673][T11970] hfsplus: request for non-existent node 33554434 in B*Tree [ 479.671422][T11982] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 479.748018][ T28] audit: type=1800 audit(1785979091.632:29): pid=11982 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1508" name="addr_trtype" dev="configfs" ino=47656 res=0 errno=0 [ 479.798234][T11970] hfsplus: request for non-existent node 33554434 in B*Tree [ 479.840735][T11970] hfsplus: request for non-existent node 33554434 in B*Tree [ 479.851376][ T5830] nvmet: creating nvm controller 2 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:38d948ca-c70b-4af7-9bdb-18e876d5cbec. [ 479.882630][T11970] hfsplus: request for non-existent node 33554434 in B*Tree [ 479.884208][T11982] nvme nvme1: creating 2 I/O queues. [ 479.901358][T11982] nvme nvme1: new ctrl: "testnqn" [ 479.944720][T11988] loop5: detected capacity change from 0 to 512 [ 479.945659][T11970] hfsplus: request for non-existent node 33554434 in B*Tree [ 480.018837][T11970] hfsplus: request for non-existent node 33554434 in B*Tree [ 480.041688][T11988] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 480.056284][T11970] hfsplus: request for non-existent node 33554434 in B*Tree [ 480.083929][T11970] hfsplus: request for non-existent node 33554434 in B*Tree [ 480.105048][T11988] ext4 filesystem being mounted at /101/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 480.139823][T11970] hfsplus: request for non-existent node 33554434 in B*Tree [ 480.139842][T11970] hfsplus: request for non-existent node 33554434 in B*Tree [ 480.167246][ T28] audit: type=1800 audit(1785979092.102:30): pid=11970 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1507" name="file1" dev="loop1" ino=19 res=0 errno=0 [ 480.353679][ T9940] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 480.464012][T11720] usb 7-1: USB disconnect, device number 2 [ 480.751292][T12012] geneve2: entered promiscuous mode [ 482.292029][T12037] md: serialize_policy is only effective for raid1 [ 482.695040][T12018] loop1: detected capacity change from 0 to 32768 [ 482.806355][T12018] JBD2: Ignoring recovery information on journal [ 482.921969][T12018] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 483.083543][ T28] audit: type=1800 audit(1785979095.042:31): pid=12060 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1523" name="zoned" dev="configfs" ino=47745 res=0 errno=0 [ 483.112851][T12061] loop4: detected capacity change from 0 to 256 [ 483.141144][T12018] ocfs2: Unmounting device (7,1) on (node local) [ 483.191297][ T28] audit: type=1800 audit(1785979095.072:32): pid=12060 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1523" name="memory_backed" dev="configfs" ino=47746 res=0 errno=0 [ 483.305213][T12064] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 483.305284][T12061] exFAT-fs (loop4): error, invalid dentry access beyond EOF (clu : 5, eidx : 129) [ 483.327659][ T28] audit: type=1800 audit(1785979095.082:33): pid=12060 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1523" name="zone_nr_conv" dev="configfs" ino=47747 res=0 errno=0 [ 483.392604][T12061] exFAT-fs (loop4): Filesystem has been set read-only [ 483.402104][ T28] audit: type=1800 audit(1785979095.082:34): pid=12060 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1523" name="power" dev="configfs" ino=47748 res=0 errno=0 [ 483.423059][T12069] exFAT-fs (loop4): error, bogus directory size (clus : ondisk(2) != counted(1)) [ 483.482060][T12060] null_blk: disk nullb1 created [ 483.564831][ T5776] ocfs2: Unmounting device (7,1) on (node local) [ 483.765824][T12075] syzkaller0: entered promiscuous mode [ 483.788247][T12075] syzkaller0: entered allmulticast mode [ 483.820188][T12075] tipc: Started in network mode [ 483.843653][T12075] tipc: Node identity 560507dc0c5f, cluster identity 4711 [ 483.867924][T12075] tipc: Enabled bearer , priority 0 [ 483.896488][T12074] tipc: Resetting bearer [ 484.034133][T12074] tipc: Disabling bearer [ 484.266785][T12065] loop6: detected capacity change from 0 to 32768 [ 484.582296][T12101] syz.4.1529 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 485.229120][ T28] audit: type=1804 audit(1785979097.182:35): pid=12065 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.6.1525" name="/newroot/31/file0/file1" dev="loop6" ino=4 res=1 errno=0 [ 488.778124][ T5781] Bluetooth: hci1: command 0x0406 tx timeout [ 489.046822][T12165] binder_alloc: 12164: binder_alloc_buf, no vma [ 489.200707][T12167] loop4: detected capacity change from 0 to 512 [ 489.226181][T12167] EXT4-fs: Ignoring removed bh option [ 489.258574][T12167] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 489.328505][T12167] EXT4-fs (loop4): 1 truncate cleaned up [ 489.336506][T12167] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 489.544512][ T28] audit: type=1800 audit(1785979101.502:36): pid=12167 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1542" name="file2" dev="loop4" ino=16 res=0 errno=0 [ 489.640485][T12180] syzkaller0: entered promiscuous mode [ 490.056835][ T9581] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 490.290052][T12173] syz.6.1543 (12173): drop_caches: 2 [ 490.505228][T12194] syzkaller0: entered promiscuous mode [ 490.520563][T12195] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1547'. [ 490.540055][T12194] syzkaller0: entered allmulticast mode [ 491.004115][T12210] syzkaller0: entered promiscuous mode [ 491.038733][T12210] syzkaller0: entered allmulticast mode [ 491.327771][ T5807] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 491.478629][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 491.494913][T12231] Bluetooth: hci0: invalid length 0, exp 2 for type 7 [ 491.542555][ T5807] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 491.577717][ T5807] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 491.607691][ T5807] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 491.636084][ T5807] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 491.653930][ T5807] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 491.684647][ T5807] usb 5-1: config 0 descriptor?? [ 491.977708][ T5768] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 491.995699][T12218] loop4: detected capacity change from 0 to 2048 [ 492.207818][ T5768] usb 7-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.00 [ 492.475150][ T5768] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 492.855376][ T5807] plantronics 0003:047F:FFFF.000F: No inputs registered, leaving [ 492.935853][ T5807] plantronics 0003:047F:FFFF.000F: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 493.951537][T12237] loop5: detected capacity change from 0 to 32768 [ 494.967900][ T5810] usb 5-1: reset high-speed USB device number 13 using dummy_hcd [ 495.137992][ T5810] usb 5-1: device descriptor read/64, error -32 [ 495.417700][ T5810] usb 5-1: reset high-speed USB device number 13 using dummy_hcd [ 495.492072][ T2134] usb 7-1: USB disconnect, device number 3 [ 496.295622][T12288] input: syz1 as /devices/virtual/input/input28 [ 496.607116][ T5768] usb 5-1: USB disconnect, device number 13 [ 497.818270][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 498.261260][ C0] nvme nvme1: long keepalive RTT (1650 ms) [ 499.473089][T12305] loop1: detected capacity change from 0 to 1764 [ 501.722206][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.728814][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.838773][T12332] loop5: detected capacity change from 0 to 512 [ 501.846420][T12332] EXT4-fs: Ignoring removed oldalloc option [ 502.031788][T12332] EXT4-fs error (device loop5): ext4_quota_enable:7144: comm syz.5.1573: inode #50331648: comm syz.5.1573: iget: illegal inode # [ 502.156532][T12339] loop1: detected capacity change from 0 to 512 [ 502.388561][T12339] EXT4-fs warning (device loop1): ext4_xattr_inode_get:560: inode #11: comm syz.1.1575: EA inode hash validation failed [ 502.410945][T12339] EXT4-fs error (device loop1): ext4_do_update_inode:5256: inode #15: comm syz.1.1575: corrupted inode contents [ 502.431969][T12339] EXT4-fs (loop1): Remounting filesystem read-only [ 502.438735][T12339] EXT4-fs warning (device loop1): ext4_evict_inode:274: xattr delete (err -5) [ 502.448578][T12339] EXT4-fs (loop1): 1 orphan inode deleted [ 502.467004][T12339] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 502.750098][T12332] EXT4-fs (loop5): Remounting filesystem read-only [ 502.756672][T12332] EXT4-fs warning (device loop5): ext4_enable_quotas:7188: Failed to enable quota tracking (type=2, err=-117, ino=50331648). Please run e2fsck to fix. [ 502.783986][T12334] loop4: detected capacity change from 0 to 8192 [ 502.915645][T12332] EXT4-fs (loop5): mount failed [ 503.000016][T12334] loop4: p4 [ 503.013777][T12334] loop4: p4 size 262144 extends beyond EOD, truncated [ 503.089169][T12344] loop6: detected capacity change from 0 to 512 [ 503.177164][T12344] EXT4-fs (loop6): inodes count not valid: 40 vs 32 [ 503.519721][ T5758] udevd[5758]: inotify_add_watch(7, /dev/loop4p4, 10) failed: No such file or directory [ 503.757550][ C0] sched: RT throttling activated [ 503.864882][ T5776] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 504.595129][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 507.032991][T12391] syzkaller0: entered promiscuous mode [ 507.045219][T12391] syzkaller0: entered allmulticast mode [ 507.098275][T12391] tipc: Started in network mode [ 507.103209][T12391] tipc: Node identity c2dd125dbba9, cluster identity 4711 [ 507.125905][T12391] tipc: Enabled bearer , priority 0 [ 507.148590][T12390] tipc: Resetting bearer [ 507.188212][T12395] loop6: detected capacity change from 0 to 1024 [ 507.256208][T12390] tipc: Disabling bearer [ 508.577785][ T2184] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 509.387744][ T2184] usb 2-1: Using ep0 maxpacket: 16 [ 509.399711][ T2184] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 509.410068][ T2184] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 509.740905][ T2184] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 509.841735][ T2184] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.927624][ T2184] usb 2-1: Product: syz [ 509.931853][ T2184] usb 2-1: Manufacturer: syz [ 509.952094][ T2184] usb 2-1: SerialNumber: syz [ 510.205604][ T2184] usb 2-1: 0:2 : does not exist [ 510.242807][ T2184] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 510.308562][ T2184] usb 2-1: USB disconnect, device number 26 [ 510.381117][ T5758] udevd[5758]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 510.473308][T12443] syzkaller0: entered promiscuous mode [ 510.490859][T12443] syzkaller0: entered allmulticast mode [ 511.616142][T12460] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=384 (768 ns) > initial count (6 ns). Using initial count to start timer. [ 512.816733][T12482] loop4: detected capacity change from 0 to 512 [ 512.852989][T12482] EXT4-fs (loop4): inodes count not valid: 40 vs 32 [ 512.907786][T11720] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 514.145587][T11720] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 514.157803][T11720] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 514.196759][T11720] usb 2-1: config 220 has no interface number 2 [ 514.226883][T11720] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 514.247992][T11720] usb 2-1: config 220 interface 0 has no altsetting 0 [ 514.271617][T11720] usb 2-1: config 220 interface 76 has no altsetting 0 [ 514.284645][T11720] usb 2-1: config 220 interface 1 has no altsetting 0 [ 514.297061][T11720] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 514.313191][T11720] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.323218][T12499] syzkaller0: entered promiscuous mode [ 514.329471][T12499] syzkaller0: entered allmulticast mode [ 514.343580][T11720] usb 2-1: Product: syz [ 514.348627][T11720] usb 2-1: Manufacturer: syz [ 514.353257][T11720] usb 2-1: SerialNumber: syz [ 514.600730][T11720] usb 2-1: Found UVC 7.01 device syz (8086:0b07) [ 514.627936][T11720] usb 2-1: No valid video chain found. [ 514.641953][T11720] usb 2-1: selecting invalid altsetting 0 [ 514.702216][T11720] usb 2-1: selecting invalid altsetting 0 [ 514.710420][T11720] usbtest: probe of 2-1:220.1 failed with error -22 [ 514.733660][T11720] usb 2-1: USB disconnect, device number 27 [ 518.900205][T12528] binder: 12527:12528 unknown command 0 [ 518.905966][T12528] binder: 12527:12528 ioctl c0306201 2000000001c0 returned -22 [ 518.908202][T12522] syzkaller0: entered promiscuous mode [ 518.920169][T12522] syzkaller0: entered allmulticast mode [ 519.089754][T12533] loop1: detected capacity change from 0 to 512 [ 519.144333][T12533] EXT4-fs (loop1): inodes count not valid: 40 vs 32 [ 519.448374][T12537] loop1: detected capacity change from 0 to 8192 [ 526.105679][T12577] loop6: detected capacity change from 0 to 1024 [ 526.128301][ T5810] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 526.369477][ T5810] usb 2-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 0.00 [ 526.549330][ T5810] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 526.570543][T12577] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 526.787817][T12577] usb usb8: usbfs: process 12577 (syz.6.1636) did not claim interface 0 before use [ 526.903446][T11214] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 528.786398][T12606] syzkaller0: entered promiscuous mode [ 528.803524][T12606] syzkaller0: entered allmulticast mode [ 530.665741][ T5810] usb 2-1: USB disconnect, device number 28 [ 530.740488][T12612] TC_ACT_REPEAT abuse ? [ 531.218401][ T5810] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 531.624485][ T5810] usb 2-1: Using ep0 maxpacket: 32 [ 531.632442][ T5810] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 531.663767][ T5810] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 531.677341][T12624] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 531.685510][T12624] IPv6: NLM_F_CREATE should be set when creating new route [ 531.723734][ T5810] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 531.763580][ T5810] usb 2-1: Product: syz [ 531.768105][ T5810] usb 2-1: Manufacturer: syz [ 531.773089][ T5810] usb 2-1: SerialNumber: syz [ 531.780471][ T5810] usb 2-1: config 0 descriptor?? [ 531.794331][T12624] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 532.211445][T12634] loop5: detected capacity change from 0 to 512 [ 533.666821][T12634] EXT4-fs warning (device loop5): ext4_xattr_inode_get:560: inode #11: comm syz.5.1652: EA inode hash validation failed [ 533.679947][T12634] EXT4-fs error (device loop5): ext4_do_update_inode:5256: inode #15: comm syz.5.1652: corrupted inode contents [ 533.693356][T12634] EXT4-fs (loop5): Remounting filesystem read-only [ 533.699987][T12634] EXT4-fs warning (device loop5): ext4_evict_inode:274: xattr delete (err -5) [ 533.709090][T12634] EXT4-fs (loop5): 1 orphan inode deleted [ 533.716124][T12634] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 534.813685][ T9940] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 535.218336][T12646] kvm: pic: non byte write [ 535.422260][ T27] usb 2-1: USB disconnect, device number 29 [ 535.700290][T12645] loop6: detected capacity change from 0 to 32768 [ 538.073498][T12679] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 539.957958][ T5807] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 540.290669][ T5807] usb 5-1: Using ep0 maxpacket: 32 [ 540.369941][ T5807] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 540.582676][ T5807] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 540.698130][ T5807] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 540.808646][ T5807] usb 5-1: Product: syz [ 540.852373][T12690] syzkaller0: entered promiscuous mode [ 540.858672][ T5807] usb 5-1: Manufacturer: syz [ 540.894199][ T5807] usb 5-1: SerialNumber: syz [ 540.906410][T12690] syzkaller0: entered allmulticast mode [ 541.004471][ T5807] usb 5-1: config 0 descriptor?? [ 542.025098][T12694] syzkaller0: entered promiscuous mode [ 542.031589][T12694] syzkaller0: entered allmulticast mode [ 542.140466][ T5807] usb 5-1: USB disconnect, device number 14 [ 542.399514][T12713] loop5: detected capacity change from 0 to 256 [ 547.874580][T12765] syzkaller0: entered promiscuous mode [ 547.950795][T12765] syzkaller0: entered allmulticast mode [ 549.861087][T12787] loop6: detected capacity change from 0 to 16 [ 549.882740][T12787] erofs: (device loop6): mounted with root inode @ nid 36. [ 549.945618][ T5780] erofs: (device loop6): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[9000] [ 549.975466][T12787] erofs: (device loop6): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 549.997858][ T23] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 550.007761][ T28] audit: type=1800 audit(1785979161.962:37): pid=12787 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1689" name="file2" dev="loop6" ino=89 res=0 errno=0 [ 550.219530][ T23] usb 6-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.00 [ 550.238369][ T23] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 550.287998][ T23] snd-ua101 6-1:1.0: sample format descriptor not found [ 550.445971][T12802] binder_alloc: 12800: binder_alloc_buf, no vma [ 551.056734][T12810] syzkaller0: entered promiscuous mode [ 551.064434][T12810] syzkaller0: entered allmulticast mode [ 552.150404][ T28] audit: type=1800 audit(1785979164.112:38): pid=12825 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1698" name="UDC" dev="configfs" ino=52425 res=0 errno=0 [ 552.187010][ T5810] hid-generic 0000:0000:0000.0010: unknown main item tag 0x0 [ 552.244865][ T5810] hid-generic 0000:0000:0000.0010: unknown main item tag 0x0 [ 552.285027][T12825] configfs-gadget.g1 gadget.0: HOST MAC 96:e4:fd:9b:2f:20 [ 552.306621][T12825] configfs-gadget.g1 gadget.0: MAC b6:f4:e7:69:ad:44 [ 552.331647][ T5810] hid-generic 0000:0000:0000.0010: hidraw0: HID v0.00 Device [syz0] on syz0 [ 552.585034][T12834] fido_id[12834]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 552.629049][T11720] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 552.695259][ T5810] usb 6-1: USB disconnect, device number 4 [ 552.863400][T11720] usb 1-1: Dual-Role OTG device on HNP port [ 552.879834][T11720] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 6.06 [ 552.928329][T11720] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 553.012513][T11720] usb 1-1: bad CDC descriptors [ 553.045970][T11720] gspca_main: spca501-2.14.0 probing 0000:0000 [ 553.086015][T11720] gspca_spca501: reg write: error -32 [ 553.110575][T11720] spca501 1-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 553.141133][T11720] spca501: probe of 1-1:1.0 failed with error -22 [ 553.187195][T11720] usb-storage 1-1:1.1: USB Mass Storage device detected [ 553.254387][T11720] scsi host1: usb-storage 1-1:1.1 [ 554.445698][ T4393] scsi 1:0:0:0: Direct-Access Linux File-Stor Gadget 0606 PQ: 0 ANSI: 2 [ 554.611517][ T4393] scsi 1:0:0:0: Attached scsi generic sg1 type 0 [ 554.640285][T12852] sd 1:0:0:0: Power-on or device reset occurred [ 554.725147][ T23] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 554.943343][ T59] sd 1:0:0:0: [sdb] Media removed, stopped polling [ 555.145685][ T23] usb 6-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 0.00 [ 555.266809][ T23] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 555.349784][ T23] i2c-tiny-usb 6-1:1.0: version 0.00 found at bus 006 address 005 [ 555.362721][ T59] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 555.434270][T12840] syz.4.1699 (12840): drop_caches: 2 [ 556.242787][ T23] i2c i2c-1: connected i2c-tiny-usb device [ 557.048964][T12926] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1707'. [ 557.135500][T12926] 8021q: adding VLAN 0 to HW filter on device bond3 [ 557.160709][T12936] saa7115: probe of 0-0021 failed with error -5 [ 557.166889][T12937] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1707'. [ 557.170235][T12936] i2c i2c-0: new_device: Instantiated device saa7115 at 0x21 [ 557.185415][T12936] i2c i2c-0: Failed to register i2c client saa7115 at 0x21 (-16) [ 557.205868][T12937] bond3: entered promiscuous mode [ 557.237863][T12937] bond3: entered allmulticast mode [ 557.314127][T12926] dummy0: entered promiscuous mode [ 557.324522][T12926] dummy0: entered allmulticast mode [ 557.333549][T12926] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 557.345536][T12935] syzkaller0: entered promiscuous mode [ 557.351343][T12935] syzkaller0: entered allmulticast mode [ 557.427191][T12941] syzkaller0: entered promiscuous mode [ 557.434036][T12941] syzkaller0: entered allmulticast mode [ 558.559278][T12430] usb 6-1: USB disconnect, device number 5 [ 558.697634][ T5810] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 558.902433][ T5810] usb 5-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.00 [ 558.931811][ T5810] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 558.979474][ T5810] snd-ua101 5-1:1.0: invalid bNumEndpoints [ 559.018372][T12976] syzkaller0: entered promiscuous mode [ 559.023905][T12976] syzkaller0: entered allmulticast mode [ 559.060404][T12976] tipc: Started in network mode [ 559.067842][T12976] tipc: Node identity ae0c3f220de2, cluster identity 4711 [ 559.078792][T12976] tipc: Enabled bearer , priority 0 [ 559.115534][T12975] tipc: Resetting bearer [ 559.213096][T12975] tipc: Disabling bearer [ 559.717837][ T23] usb 2-1: new full-speed USB device number 30 using dummy_hcd [ 559.751932][T12990] loop5: detected capacity change from 0 to 164 [ 559.935905][ T23] usb 2-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice= 1.00 [ 559.950948][ T23] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 560.031444][T12995] syzkaller0: entered promiscuous mode [ 560.037053][T12995] syzkaller0: entered allmulticast mode [ 560.142077][T12997] Bluetooth: hci0: invalid length 0, exp 2 for type 10 [ 560.548020][T12430] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 560.763649][ T23] dvb_ttusb_budget: cmd xter failed, receive error -75 [ 560.916221][ T23] dvb_ttusb_budget: ttusb_init_controller: error [ 561.005374][T12430] usb 6-1: Using ep0 maxpacket: 32 [ 561.064272][ T23] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 561.114045][T12430] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 561.145993][T12430] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 561.178909][ T27] usb 5-1: USB disconnect, device number 15 [ 561.248428][T12430] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 561.279457][T12430] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 561.294243][T12430] usb 6-1: Product: syz [ 561.308705][T12430] usb 6-1: Manufacturer: syz [ 561.313509][T12430] usb 6-1: SerialNumber: syz [ 561.326171][T12430] usb 6-1: config 0 descriptor?? [ 561.396986][ T23] DVB: Unable to find symbol stv0299_attach() [ 561.425408][T13018] syzkaller0: entered promiscuous mode [ 561.436104][T13018] syzkaller0: entered allmulticast mode [ 561.451957][ T23] DVB: Unable to find symbol tda8083_attach() [ 561.460982][ T23] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 561.621114][T13021] loop4: detected capacity change from 0 to 64 [ 561.788704][T13024] syzkaller0: entered promiscuous mode [ 561.794439][T13024] syzkaller0: entered allmulticast mode [ 561.875141][ T23] usb 6-1: USB disconnect, device number 6 [ 562.088983][T13031] syzkaller0: entered promiscuous mode [ 562.094584][T13031] syzkaller0: entered allmulticast mode [ 562.123478][T13031] tipc: Enabled bearer , priority 0 [ 562.167934][T13030] tipc: Resetting bearer [ 562.265145][T13030] tipc: Disabling bearer [ 562.551310][ T5810] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 562.707772][ T5810] usb 5-1: device descriptor read/64, error -71 [ 563.007643][ T5810] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 563.027695][ T27] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 563.168440][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.175232][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.185503][ T5810] usb 5-1: device descriptor read/64, error -71 [ 563.218109][ T27] usb 6-1: Using ep0 maxpacket: 32 [ 563.225424][ T27] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 563.236331][ T27] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 563.260921][ T27] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 563.273920][ T27] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 563.284726][ T27] usb 6-1: Product: syz [ 563.293554][ T27] usb 6-1: Manufacturer: syz [ 563.299796][ T27] usb 6-1: SerialNumber: syz [ 563.308269][ T27] usb 6-1: config 0 descriptor?? [ 563.396226][ T5810] usb usb5-port1: attempt power cycle [ 564.048314][ T5810] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 564.218543][ T5810] usb 5-1: device descriptor read/8, error -71 [ 564.287415][ T23] usb 2-1: USB disconnect, device number 30 [ 564.488565][ T5810] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 564.497073][T13073] syzkaller0: entered promiscuous mode [ 564.517479][T13073] syzkaller0: entered allmulticast mode [ 564.614383][ T5810] usb 5-1: device descriptor read/8, error -71 [ 564.748935][ T5810] usb usb5-port1: unable to enumerate USB device [ 565.237971][ T5781] Bluetooth: hci2: command 0x0406 tx timeout [ 565.373487][ T5810] usb 6-1: USB disconnect, device number 7 [ 567.792601][T13135] usb 1-1: USB disconnect, device number 18 [ 568.764903][T13143] loop1: detected capacity change from 0 to 512 [ 568.902984][T13143] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 568.979826][ T5810] smpboot: CPU 1 is now offline [ 569.021715][T13143] ext4 filesystem being mounted at /440/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 569.100633][ T5830] usb 6-1: new full-speed USB device number 8 using dummy_hcd [ 569.329738][ T5830] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 569.362005][T13143] EXT4-fs error (device loop1): ext4_do_update_inode:5256: inode #2: comm syz.1.1752: corrupted inode contents [ 569.387983][ T5830] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 569.411009][T13149] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 569.443160][ T0] Disabled fast string operations [ 569.449549][ T5830] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 569.472242][ T5830] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 569.480900][ T5830] usb 6-1: Product: syz [ 569.485096][ T5830] usb 6-1: Manufacturer: syz [ 569.490287][ T5830] usb 6-1: SerialNumber: syz [ 569.635593][T13143] EXT4-fs (loop1): Remounting filesystem read-only [ 569.718849][ T5830] usb 6-1: 0:2 : does not exist [ 569.738086][ T5830] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 569.833603][ T5830] usb 6-1: USB disconnect, device number 8 [ 569.901098][ T5758] udevd[5758]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 570.212183][ T5776] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 570.711307][T13177] loop7: detected capacity change from 0 to 16384 [ 572.209449][T13178] loop7: detected capacity change from 16384 to 0 [ 572.870193][T13196] tipc: Enabling of bearer rejected, failed to enable media [ 573.084859][T13211] loop1: detected capacity change from 0 to 512 [ 573.133884][T13211] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 573.207926][ T5810] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 573.254833][T13223] tipc: Enabling of bearer rejected, failed to enable media [ 573.358278][ T5776] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 573.417670][ T5810] usb 5-1: Using ep0 maxpacket: 32 [ 573.434840][ T5810] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 573.480235][ T5810] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 574.323051][ T5810] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 574.363998][ T5810] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 574.393808][ T5810] usb 5-1: Product: syz [ 574.418046][ T5810] usb 5-1: Manufacturer: syz [ 574.436798][ T5810] usb 5-1: SerialNumber: syz [ 574.453808][ T5810] usb 5-1: config 0 descriptor?? [ 574.712021][T13235] syzkaller0: entered promiscuous mode [ 574.736533][T13235] syzkaller0: entered allmulticast mode [ 575.264916][ T5768] usb 5-1: USB disconnect, device number 20 [ 575.578265][T13244] syzkaller0: entered promiscuous mode [ 575.610096][T13244] syzkaller0: entered allmulticast mode [ 575.631876][T13244] sch_tbf: burst 3 is lower than device syzkaller0 mtu (1500) ! [ 576.579659][T13264] syzkaller0: entered promiscuous mode [ 576.599633][T13264] syzkaller0: entered allmulticast mode [ 577.397954][ T5768] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 577.588982][ T5768] usb 2-1: Using ep0 maxpacket: 32 [ 577.606105][ T5768] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 578.077811][ T5768] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 578.112583][ T5768] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 578.139823][ T5768] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 578.167056][ T5768] usb 2-1: Product: syz [ 578.182045][ T5768] usb 2-1: Manufacturer: syz [ 578.197235][ T5768] usb 2-1: SerialNumber: syz [ 578.218788][ T5768] usb 2-1: config 0 descriptor?? [ 579.300831][T13300] fuse: Bad value for 'fd' [ 579.349076][T13302] tipc: Enabled bearer , priority 0 [ 579.376861][T13302] syzkaller0: entered promiscuous mode [ 579.390988][T13302] syzkaller0: entered allmulticast mode [ 579.424056][T13302] tipc: Resetting bearer [ 579.501120][ T5768] usb 2-1: USB disconnect, device number 31 [ 579.555285][T13301] tipc: Resetting bearer [ 579.628929][T13301] tipc: Disabling bearer [ 588.350373][T13368] syzkaller0: entered promiscuous mode [ 588.372155][T13373] loop1: detected capacity change from 0 to 1024 [ 588.380851][T13368] syzkaller0: entered allmulticast mode [ 588.496350][T13373] hfsplus: request for non-existent node 33423360 in B*Tree [ 588.529128][T13373] hfsplus: request for non-existent node 33423360 in B*Tree [ 588.566037][T13379] hfsplus: request for non-existent node 33423360 in B*Tree [ 588.596170][T13379] hfsplus: request for non-existent node 33423360 in B*Tree [ 588.624662][T13380] hfsplus: request for non-existent node 33423360 in B*Tree [ 588.662874][T13380] hfsplus: request for non-existent node 33423360 in B*Tree [ 588.695991][T13373] hfsplus: request for non-existent node 33423360 in B*Tree [ 588.735115][T13373] hfsplus: request for non-existent node 33423360 in B*Tree [ 588.817881][T13379] hfsplus: request for non-existent node 33423360 in B*Tree [ 588.853169][T13379] hfsplus: request for non-existent node 33423360 in B*Tree [ 588.902293][T13387] jffs2: notice: (13387) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 588.937837][T13380] hfsplus: request for non-existent node 33423360 in B*Tree [ 588.960933][T13380] hfsplus: request for non-existent node 33423360 in B*Tree [ 588.970745][T13388] syzkaller0: entered promiscuous mode [ 588.992180][T13388] syzkaller0: entered allmulticast mode [ 589.010522][T13373] hfsplus: request for non-existent node 33423360 in B*Tree [ 589.033537][T13373] hfsplus: request for non-existent node 33423360 in B*Tree [ 589.080795][T13379] hfsplus: request for non-existent node 33423360 in B*Tree [ 589.089466][T13379] hfsplus: request for non-existent node 33423360 in B*Tree [ 589.110857][T13373] hfsplus: request for non-existent node 33423360 in B*Tree [ 589.118853][T13373] hfsplus: request for non-existent node 33423360 in B*Tree [ 589.131009][T13373] hfsplus: request for non-existent node 33423360 in B*Tree [ 589.147875][T13373] hfsplus: request for non-existent node 33423360 in B*Tree [ 589.178584][T13373] hfsplus: request for non-existent node 33423360 in B*Tree [ 589.198339][T13373] hfsplus: request for non-existent node 33423360 in B*Tree [ 589.246444][T13394] syzkaller0: entered promiscuous mode [ 589.265431][T13394] syzkaller0: entered allmulticast mode [ 595.411253][T13447] loop0: detected capacity change from 0 to 128 [ 597.262778][T13473] tipc: Enabling of bearer rejected, failed to enable media [ 602.030105][T13518] tipc: Enabling of bearer rejected, failed to enable media [ 603.682965][T11720] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 604.319731][T11720] usb 5-1: config 0 has no interfaces? [ 604.332626][T11720] usb 5-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice= 1.00 [ 604.342419][T11720] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.357427][T11720] usb 5-1: Product: syz [ 604.367211][T11720] usb 5-1: Manufacturer: syz [ 604.376130][T11720] usb 5-1: SerialNumber: syz [ 604.396824][T11720] usb 5-1: config 0 descriptor?? [ 604.758852][T11720] usb 5-1: USB disconnect, device number 21 [ 607.683018][T13616] md: serialize_policy is only effective for raid1 [ 608.916807][T13620] ip6gre0: Master is either lo or non-ether device [ 610.051134][T13637] syzkaller0: entered promiscuous mode [ 610.062839][T13637] syzkaller0: entered allmulticast mode [ 610.224515][T13639] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 610.240092][T13645] loop1: detected capacity change from 0 to 1024 [ 610.264152][T13639] kvm: pic: non byte read [ 610.282061][T13639] kvm: pic: level sensitive irq not supported [ 610.282275][T13639] kvm: pic: non byte read [ 613.332413][T13679] loop4: detected capacity change from 0 to 512 [ 613.369809][T13679] UDF-fs: warning (device loop4): udf_load_vrs: No VRS found [ 613.393998][T13679] UDF-fs: Scanning with blocksize 512 failed [ 613.521667][T13679] UDF-fs: warning (device loop4): udf_load_vrs: No VRS found [ 613.551558][T13679] UDF-fs: Scanning with blocksize 1024 failed [ 613.582125][T13679] UDF-fs: warning (device loop4): udf_load_vrs: No VRS found [ 613.602407][T13679] UDF-fs: Scanning with blocksize 2048 failed [ 613.625995][T13679] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 613.645200][T13688] tipc: Enabling of bearer rejected, failed to enable media [ 614.146876][T13679] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 614.844722][T13701] tipc: Enabling of bearer rejected, failed to enable media [ 620.297755][T13758] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1901'. [ 620.321415][T13758] bond0: option arp_all_targets: invalid value (181) [ 620.506568][T13762] netlink: 'syz.6.1902': attribute type 12 has an invalid length. [ 620.531369][T13762] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1902'. [ 620.577801][T13762] bond0: option primary_reselect: invalid value (12) [ 623.102677][T13786] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 623.327964][T13793] syzkaller0: entered promiscuous mode [ 623.338175][T13793] syzkaller0: entered allmulticast mode [ 624.617048][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.625808][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 627.269751][ T28] audit: type=1800 audit(1785979239.232:39): pid=13839 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1917" name="zoned" dev="configfs" ino=56865 res=0 errno=0 [ 627.293861][ T28] audit: type=1800 audit(1785979239.232:40): pid=13839 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1917" name="zone_nr_conv" dev="configfs" ino=56866 res=0 errno=0 [ 627.319415][ T28] audit: type=1800 audit(1785979239.232:41): pid=13839 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1917" name="power" dev="configfs" ino=56867 res=0 errno=0 [ 627.431294][T13839] zonefs (nullb1) ERROR: Invalid checksum (Expected 0xe5e709d3, got 0x59bfab05) [ 629.723627][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 631.623416][ T28] audit: type=1326 audit(1785979243.582:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13846 comm="syz.6.1920" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88a239e0d9 code=0x7ffc0000 [ 631.656002][ T28] audit: type=1326 audit(1785979243.582:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13846 comm="syz.6.1920" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88a239e0d9 code=0x7ffc0000 [ 631.688611][ T28] audit: type=1326 audit(1785979243.582:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13846 comm="syz.6.1920" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88a239e0d9 code=0x7ffc0000 [ 631.746777][ T28] audit: type=1326 audit(1785979243.582:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13846 comm="syz.6.1920" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88a239e0d9 code=0x7ffc0000 [ 631.792793][ T28] audit: type=1326 audit(1785979243.582:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13846 comm="syz.6.1920" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88a239e0d9 code=0x7ffc0000 [ 631.821669][ T28] audit: type=1326 audit(1785979243.582:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13846 comm="syz.6.1920" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f88a239e0d9 code=0x7ffc0000 [ 631.821710][ T28] audit: type=1326 audit(1785979243.582:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13846 comm="syz.6.1920" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f88a239e0d9 code=0x7ffc0000 [ 632.581119][T13864] xt_CT: You must specify a L4 protocol and not use inversions on it [ 635.147920][T13823] syzkaller0: entered promiscuous mode [ 635.155793][T13823] syzkaller0: entered allmulticast mode [ 635.178403][T13830] tipc: Enabled bearer , priority 0 [ 635.230818][T13818] tipc: Resetting bearer [ 635.380761][T13886] Mass Storage Function, version: 2009/09/11 [ 635.392520][T13818] tipc: Disabling bearer [ 635.554435][T13886] LUN: removable file: (no medium) [ 636.568478][T13915] syzkaller0: entered promiscuous mode [ 636.822572][T13915] syzkaller0: entered allmulticast mode [ 642.753334][T13965] loop1: detected capacity change from 0 to 128 [ 644.004651][T13977] ubi16: attaching mtd0 [ 644.014047][T13977] ubi16: scanning is finished [ 644.018971][T13977] ubi16 error: ubi_read_volume_table: the layout volume was not found [ 644.088859][T13977] ubi16 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 647.958605][T14018] 8021q: adding VLAN 0 to HW filter on device bond1 [ 648.497644][T14039] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1957'. [ 648.509994][T14039] dummy0: entered promiscuous mode [ 648.515989][T14039] macsec1: entered promiscuous mode [ 648.521393][T14039] macsec1: entered allmulticast mode [ 648.526678][T14039] dummy0: entered allmulticast mode [ 651.392771][T14052] syzkaller0: entered promiscuous mode [ 652.381265][T14052] syzkaller0: entered allmulticast mode [ 654.401913][T14082] ceph: No mds server is up or the cluster is laggy [ 654.955167][T14093] syzkaller0: entered promiscuous mode [ 654.986778][T14093] syzkaller0: entered allmulticast mode [ 655.919512][ T28] kauditd_printk_skb: 17 callbacks suppressed [ 655.919527][ T28] audit: type=1800 audit(1785979267.882:66): pid=14106 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1970" name="attr_allow_any_host" dev="configfs" ino=57816 res=0 errno=0 [ 655.931566][T14106] nvmet: adding nsid 1 to subsystem testnqn [ 656.084574][ T28] audit: type=1800 audit(1785979268.042:67): pid=14111 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1970" name="addr_trtype" dev="configfs" ino=57826 res=0 errno=0 [ 656.090411][T14111] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 657.757815][ T5768] nvmet: creating nvm controller 3 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:38d948ca-c70b-4af7-9bdb-18e876d5cbec. [ 657.800684][T14106] nvme nvme2: creating 2 I/O queues. [ 657.816350][T14106] nvme nvme2: new ctrl: "testnqn" [ 657.996425][ T28] audit: type=1804 audit(1785979269.952:68): pid=14120 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.6.1975" name="bus" dev="ramfs" ino=57871 res=1 errno=0 [ 659.397875][ T28] audit: type=1804 audit(1785979269.982:69): pid=14120 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.6.1975" name="bus" dev="ramfs" ino=57871 res=1 errno=0 [ 664.778916][T14140] syzkaller0: entered promiscuous mode [ 664.815000][T14140] syzkaller0: entered allmulticast mode [ 665.725185][T14157] jffs2: notice: (14157) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 666.308181][T14160] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1986'. [ 666.488356][T14160] kernel profiling enabled (shift: 5) [ 667.588767][ T28] audit: type=1800 audit(1785979279.552:70): pid=14167 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1989" name="attr_allow_any_host" dev="configfs" ino=57996 res=0 errno=0 [ 667.635060][T12907] nvme nvme0: rescanning namespaces. [ 667.649548][ T28] audit: type=1800 audit(1785979279.562:71): pid=14167 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1989" name="device_path" dev="configfs" ino=57997 res=0 errno=0 [ 667.669702][T14167] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 667.671133][ T1097] nvme nvme2: rescanning namespaces. [ 667.685167][T12916] nvme nvme1: rescanning namespaces. [ 667.754520][ T28] audit: type=1800 audit(1785979279.562:72): pid=14167 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1989" name="buffered_io" dev="configfs" ino=57998 res=0 errno=0 [ 667.784193][ T28] audit: type=1800 audit(1785979279.572:73): pid=14167 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1989" name="enable" dev="configfs" ino=58000 res=0 errno=0 [ 667.810633][ T28] audit: type=1800 audit(1785979279.622:74): pid=14167 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1989" name="addr_trtype" dev="configfs" ino=58005 res=0 errno=0 [ 668.019856][T12908] Dev nvme0n1: unable to read RDB block 8 [ 668.026457][T12908] nvme0n1: unable to read partition table [ 668.064057][T12908] nvme0n1: partition table beyond EOD, truncated [ 668.569840][T14167] nvme_fabrics: missing parameter 'transport=%s' [ 671.231031][T14167] nvme_fabrics: missing parameter 'nqn=%s' [ 671.562659][ T5780] Bluetooth: hci2: Malformed LE Event: 0x1b [ 675.411344][T14217] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1999'. [ 675.754808][T14219] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 675.972048][T14226] overlayfs: failed to resolve './file2': -2 [ 676.459056][T14232] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 676.663902][T14224] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 676.692043][T14224] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 683.694121][T14254] overlayfs: failed to clone upperpath [ 685.468247][T14278] fuse: Bad value for 'fd' [ 686.043504][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.050009][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 694.198013][ C0] [ 694.200400][ C0] ================================ [ 694.205492][ C0] WARNING: inconsistent lock state [ 694.210588][ C0] syzkaller #0 Tainted: G S [ 694.216580][ C0] -------------------------------- [ 694.221709][ C0] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. [ 694.228553][ C0] syz.6.2022/14311 [HC0[0]:SC1[1]:HE1:SE0] takes: [ 694.234968][ C0] ffff888050444130 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x10d/0x250 [ 694.244377][ C0] {SOFTIRQ-ON-W} state was registered at: [ 694.250092][ C0] lock_acquire+0x19e/0x420 [ 694.254704][ C0] lock_sock_nested+0x48/0x100 [ 694.259576][ C0] x25_bind+0x20a/0x460 [ 694.263805][ C0] __sys_bind+0x2f0/0x3f0 [ 694.268269][ C0] __x64_sys_bind+0x7a/0x90 [ 694.272940][ C0] do_syscall_64+0x55/0xb0 [ 694.277863][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 694.283844][ C0] irq event stamp: 88398 [ 694.288068][ C0] hardirqs last enabled at (88398): [] __local_bh_enable_ip+0x13a/0x1c0 [ 694.298040][ C0] hardirqs last disabled at (88397): [] __local_bh_enable_ip+0xdb/0x1c0 [ 694.307950][ C0] softirqs last enabled at (75108): [] __irq_exit_rcu+0xd3/0x190 [ 694.317325][ C0] softirqs last disabled at (88275): [] __irq_exit_rcu+0xd3/0x190 [ 694.326678][ C0] [ 694.326678][ C0] other info that might help us debug this: [ 694.334715][ C0] Possible unsafe locking scenario: [ 694.334715][ C0] [ 694.342153][ C0] CPU0 [ 694.345411][ C0] ---- [ 694.349462][ C0] lock(sk_lock-AF_X25); [ 694.353796][ C0] [ 694.357366][ C0] lock(sk_lock-AF_X25); [ 694.361862][ C0] [ 694.361862][ C0] *** DEADLOCK *** [ 694.361862][ C0] [ 694.369992][ C0] 1 lock held by syz.6.2022/14311: [ 694.375197][ C0] #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb_core+0x34/0x230 [ 694.385324][ C0] [ 694.385324][ C0] stack backtrace: [ 694.391201][ C0] CPU: 0 PID: 14311 Comm: syz.6.2022 Tainted: G S syzkaller #0 [ 694.400126][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 694.410368][ C0] Call Trace: [ 694.413641][ C0] [ 694.416479][ C0] dump_stack_lvl+0x18c/0x250 [ 694.421157][ C0] ? show_regs_print_info+0x20/0x20 [ 694.426347][ C0] ? __kernel_text_address+0xd/0x30 [ 694.431541][ C0] ? unwind_get_return_address+0x91/0xc0 [ 694.437188][ C0] valid_state+0x13b/0x1d0 [ 694.441600][ C0] mark_lock_irq+0xad/0x900 [ 694.446094][ C0] ? stack_trace_save+0xaa/0x100 [ 694.451022][ C0] ? save_trace+0xcd0/0xcd0 [ 694.455698][ C0] ? mark_lock+0x94/0x320 [ 694.460021][ C0] ? save_trace+0x5d/0xcd0 [ 694.464439][ C0] mark_lock+0x208/0x320 [ 694.468674][ C0] __lock_acquire+0xcfc/0x7d80 [ 694.473436][ C0] ? verify_lock_unused+0x140/0x140 [ 694.478626][ C0] ? verify_lock_unused+0x140/0x140 [ 694.483817][ C0] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 694.489787][ C0] ? __lock_acquire+0x7d80/0x7d80 [ 694.494805][ C0] ? lock_chain_count+0x20/0x20 [ 694.499656][ C0] lock_acquire+0x19e/0x420 [ 694.504153][ C0] ? x25_kill_by_neigh+0x10d/0x250 [ 694.509290][ C0] ? read_lock_is_recursive+0x20/0x20 [ 694.514653][ C0] ? __local_bh_enable_ip+0x13a/0x1c0 [ 694.520019][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 694.525248][ C0] ? __local_bh_enable_ip+0x13a/0x1c0 [ 694.530611][ C0] ? _local_bh_enable+0xa0/0xa0 [ 694.535474][ C0] lock_sock_nested+0x48/0x100 [ 694.540234][ C0] ? x25_kill_by_neigh+0x10d/0x250 [ 694.545380][ C0] x25_kill_by_neigh+0x10d/0x250 [ 694.550339][ C0] x25_lapb_receive_frame+0x1a7/0xef0 [ 694.555843][ C0] ? netif_receive_skb_core+0x34/0x230 [ 694.561318][ C0] ? netif_receive_skb_core+0x34/0x230 [ 694.566796][ C0] ? x25_device_event+0x280/0x280 [ 694.571813][ C0] netif_receive_skb_core+0x16a/0x230 [ 694.577360][ C0] lapbeth_napi_poll+0x42/0x80 [ 694.582156][ C0] __napi_poll+0xbb/0x460 [ 694.586539][ C0] net_rx_action+0x65f/0xcc0 [ 694.591130][ C0] ? net_tx_action+0x950/0x950 [ 694.595890][ C0] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 694.601864][ C0] ? lock_chain_count+0x20/0x20 [ 694.606736][ C0] handle_softirqs+0x27d/0x820 [ 694.611495][ C0] ? read_tsc+0x9/0x20 [ 694.615562][ C0] ? ktime_get+0x24b/0x280 [ 694.620003][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 694.624758][ C0] ? do_softirq+0x1a0/0x1a0 [ 694.629252][ C0] __irq_exit_rcu+0xd3/0x190 [ 694.633841][ C0] ? irq_exit_rcu+0x20/0x20 [ 694.638364][ C0] irq_exit_rcu+0x9/0x20 [ 694.642600][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 694.648235][ C0] [ 694.651161][ C0] [ 694.654082][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 694.660109][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x10/0x60 [ 694.666280][ C0] Code: 89 fb e8 13 00 00 00 48 8b 3d ac 0b 05 0d 48 89 de 5b e9 b3 b1 57 00 cc cc cc f3 0f 1e fa 48 8b 04 24 65 48 8b 0d b0 46 7c 7e <65> 8b 15 b1 46 7c 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 [ 694.685890][ C0] RSP: 0018:ffffc90004dffc40 EFLAGS: 00000282 [ 694.691955][ C0] RAX: ffffffff81cbb86c RBX: ffff88802b7e2340 RCX: ffff88802b7e1e00 [ 694.699925][ C0] RDX: ffff88802b7e223c RSI: ffffffff8acadd60 RDI: ffffffff8b1d0ca0 [ 694.707890][ C0] RBP: 0000000000000b8c R08: ffffc90004dff6a7 R09: 1ffff920009bfed4 [ 694.715856][ C0] R10: dffffc0000000000 R11: fffff520009bfed5 R12: dffffc0000000000 [ 694.723824][ C0] R13: 1ffff110056fc468 R14: ffffffff8bc35c40 R15: ffff88807af42f80 [ 694.731816][ C0] ? __might_fault+0x9c/0x120 [ 694.736494][ C0] __might_fault+0x9c/0x120 [ 694.741014][ C0] do_recvmmsg+0x3a0/0x810 [ 694.745426][ C0] ? __sys_recvmmsg+0x290/0x290 [ 694.750301][ C0] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 694.756319][ C0] __x64_sys_recvmmsg+0x199/0x250 [ 694.761365][ C0] ? do_recvmmsg+0x810/0x810 [ 694.765955][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 694.771171][ C0] do_syscall_64+0x55/0xb0 [ 694.775602][ C0] ? clear_bhb_loop+0x40/0x90 [ 694.780287][ C0] ? clear_bhb_loop+0x40/0x90 [ 694.784964][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 694.790849][ C0] RIP: 0033:0x7f88a239e0d9 [ 694.795260][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 694.814893][ C0] RSP: 002b:00007f88a3227028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 694.823305][ C0] RAX: ffffffffffffffda RBX: 00007f88a2626090 RCX: 00007f88a239e0d9 [ 694.831271][ C0] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000006 [ 694.839242][ C0] RBP: 00007f88a2435024 R08: 0000000000000000 R09: 0000000000000000 [ 694.847231][ C0] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 694.855231][ C0] R13: 00007f88a2626128 R14: 00007f88a2626090 R15: 00007ffc0b5e95a8 [ 694.863225][ C0] [ 694.866319][ C0] BUG: sleeping function called from invalid context at net/core/sock.c:3546 [ 694.875133][ C0] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14311, name: syz.6.2022 [ 694.884301][ C0] preempt_count: 100, expected: 0 [ 694.889389][ C0] RCU nest depth: 1, expected: 0 [ 694.894328][ C0] INFO: lockdep is turned off. [ 694.899155][ C0] Preemption disabled at: [ 694.899163][ C0] [] handle_softirqs+0x101/0x820 [ 694.910023][ C0] CPU: 0 PID: 14311 Comm: syz.6.2022 Tainted: G S syzkaller #0 [ 694.918941][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 694.928984][ C0] Call Trace: [ 694.932330][ C0] [ 694.935190][ C0] dump_stack_lvl+0x18c/0x250 [ 694.939875][ C0] ? show_regs_print_info+0x20/0x20 [ 694.945070][ C0] ? load_image+0x420/0x420 [ 694.949567][ C0] ? handle_softirqs+0x101/0x820 [ 694.954485][ C0] __might_resched+0x48d/0x5f0 [ 694.959292][ C0] ? handle_softirqs+0x101/0x820 [ 694.964211][ C0] ? __might_sleep+0xe0/0xe0 [ 694.968800][ C0] ? read_lock_is_recursive+0x20/0x20 [ 694.974201][ C0] ? __local_bh_enable_ip+0x13a/0x1c0 [ 694.979576][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 694.984775][ C0] ? __local_bh_enable_ip+0x13a/0x1c0 [ 694.990144][ C0] ? _local_bh_enable+0xa0/0xa0 [ 694.994974][ C0] lock_sock_nested+0x5d/0x100 [ 694.999722][ C0] x25_kill_by_neigh+0x10d/0x250 [ 695.004654][ C0] x25_lapb_receive_frame+0x1a7/0xef0 [ 695.010010][ C0] ? netif_receive_skb_core+0x34/0x230 [ 695.015465][ C0] ? netif_receive_skb_core+0x34/0x230 [ 695.020955][ C0] ? x25_device_event+0x280/0x280 [ 695.026065][ C0] netif_receive_skb_core+0x16a/0x230 [ 695.031525][ C0] lapbeth_napi_poll+0x42/0x80 [ 695.036287][ C0] __napi_poll+0xbb/0x460 [ 695.040612][ C0] net_rx_action+0x65f/0xcc0 [ 695.045199][ C0] ? net_tx_action+0x950/0x950 [ 695.049960][ C0] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 695.055940][ C0] ? lock_chain_count+0x20/0x20 [ 695.060788][ C0] handle_softirqs+0x27d/0x820 [ 695.065542][ C0] ? read_tsc+0x9/0x20 [ 695.069600][ C0] ? ktime_get+0x24b/0x280 [ 695.074203][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 695.078979][ C0] ? do_softirq+0x1a0/0x1a0 [ 695.083485][ C0] __irq_exit_rcu+0xd3/0x190 [ 695.088073][ C0] ? irq_exit_rcu+0x20/0x20 [ 695.092571][ C0] irq_exit_rcu+0x9/0x20 [ 695.096804][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 695.102435][ C0] [ 695.105356][ C0] [ 695.108275][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 695.114249][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x10/0x60 [ 695.120400][ C0] Code: 89 fb e8 13 00 00 00 48 8b 3d ac 0b 05 0d 48 89 de 5b e9 b3 b1 57 00 cc cc cc f3 0f 1e fa 48 8b 04 24 65 48 8b 0d b0 46 7c 7e <65> 8b 15 b1 46 7c 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 [ 695.140210][ C0] RSP: 0018:ffffc90004dffc40 EFLAGS: 00000282 [ 695.146280][ C0] RAX: ffffffff81cbb86c RBX: ffff88802b7e2340 RCX: ffff88802b7e1e00 [ 695.154248][ C0] RDX: ffff88802b7e223c RSI: ffffffff8acadd60 RDI: ffffffff8b1d0ca0 [ 695.162215][ C0] RBP: 0000000000000b8c R08: ffffc90004dff6a7 R09: 1ffff920009bfed4 [ 695.170196][ C0] R10: dffffc0000000000 R11: fffff520009bfed5 R12: dffffc0000000000 [ 695.178181][ C0] R13: 1ffff110056fc468 R14: ffffffff8bc35c40 R15: ffff88807af42f80 [ 695.186159][ C0] ? __might_fault+0x9c/0x120 [ 695.190860][ C0] __might_fault+0x9c/0x120 [ 695.195366][ C0] do_recvmmsg+0x3a0/0x810 [ 695.199797][ C0] ? __sys_recvmmsg+0x290/0x290 [ 695.204652][ C0] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 695.210546][ C0] __x64_sys_recvmmsg+0x199/0x250 [ 695.215565][ C0] ? do_recvmmsg+0x810/0x810 [ 695.220189][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 695.225432][ C0] do_syscall_64+0x55/0xb0 [ 695.229869][ C0] ? clear_bhb_loop+0x40/0x90 [ 695.234567][ C0] ? clear_bhb_loop+0x40/0x90 [ 695.239263][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 695.245156][ C0] RIP: 0033:0x7f88a239e0d9 [ 695.249563][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 695.269162][ C0] RSP: 002b:00007f88a3227028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 695.277568][ C0] RAX: ffffffffffffffda RBX: 00007f88a2626090 RCX: 00007f88a239e0d9 [ 695.285546][ C0] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000006 [ 695.293519][ C0] RBP: 00007f88a2435024 R08: 0000000000000000 R09: 0000000000000000 [ 695.301481][ C0] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 695.309437][ C0] R13: 00007f88a2626128 R14: 00007f88a2626090 R15: 00007ffc0b5e95a8 [ 695.317412][ C0] [ 698.190525][ T5768] usb 2-1: new high-speed USB device number 32 using dummy_hcd