last executing test programs: 6m14.898986414s ago: executing program 32 (id=29): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/sys/net/ipv6/conf/all/disable_ipv6\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') sendfile(r0, r1, 0x0, 0x1) 5m18.972976556s ago: executing program 33 (id=473): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000001c0), 0x13f, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x8, &(0x7f0000000300), 0x13f, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xffff, 0x647, @empty, 0xa098}, {0xa, 0x4ea5, 0x9, @dev={0xfe, 0x80, '\x00', 0x3f}, 0xc}, r1, 0x8001}}, 0x48) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 3m54.382497581s ago: executing program 34 (id=1112): r0 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r2, 0x5760, 0x1f) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r2, 0x100000000000f7) read$watch_queue(r1, &(0x7f00000000c0)=""/13, 0xd) keyctl$revoke(0x3, r0) 3m44.470414772s ago: executing program 35 (id=1166): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000680), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000006c0)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000700)=0x8) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000740)=0x126) pwritev(r0, &(0x7f0000000780)=[{&(0x7f00000007c0)="00214500002c00000000400600000a0000010a00000200500050000000010000000160100385bc40df0001010101", 0x2e}], 0x1, 0x6, 0x0) pwritev(r0, &(0x7f0000000800)=[{&(0x7f0000000840)="00214500001400000000400600000a0000010a000002005000500000ffff0000ffff683003060000e40201010101", 0x2e}], 0x1, 0x3, 0x0) 3m30.037640354s ago: executing program 36 (id=1220): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012", @ANYRES32=0x0], 0x48) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002f00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r2, r3, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r2}, &(0x7f00000000c0), &(0x7f0000000700)=r1}, 0x20) sendmsg$inet(r0, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) 2m54.679752189s ago: executing program 8 (id=1432): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_timeval(r0, 0x1, 0x43, &(0x7f0000000000)={0x0, 0x2710}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000100)=0x401, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) 2m54.548498493s ago: executing program 8 (id=1435): mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000000)={0x15, 0x65, 0xffff, 0x1000, 0x8, '9P2000.u'}, 0x15) r2 = dup(r1) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000480)={0x18, 0x3, 0x0, {0x5, 0x55ebfbc84edab159, 0x0, 'wfdno\xd6a\xab\xff\x8cjVI\xf5\xd3qT`\xa9\xbe)\xab\xab\x19\xb1\xee\xb6\xa1\x98\x8eG1\xc9\xdfyE^(\x9f\x91\x92X\xb1^{\xff\x02\xd8p\x9f\x94\xe4\xb8\xd2 ^\xd2 \xd7\xa9\x80\xe9\xcc\x98\x8c\xa1?\xb5\xbf<\x8cY\r\x8dH\xf3\x9dgr\xdc\xd0\xae\x86\xa7B\xb1\xee\x11\xa2bz`\x1c\xcd\x93ZI%\x9fi\xea\xc9\x1dK\x96\x9a2{4\xbf\xa9\xf8\xb1_%;~\xbf]\xc7\x93rbf\x8b\xf1\x9f\x91\t\xda\x18\xa5\xc2\xd1\xd8\x9e\xcdI\x9b\xf33K\xf3x\xe6\xf9\xf3d\xdf\xd8\x01+\xcb\xa5\x9a\t\xbe\x1dkE\xdd\xfb\xc7\x05\xca\x8bvlQ\x04\xc3\xdd\r\x9ap\x96\x93\xbc\x16\xdd\xec\xe8\xb4v\x89\x92\xd9/\x84\x1aE\xe6d\xb7F\x89\x00\xe9e\xb6\xe1]\x86\xcb\t\xde\x8bD#\x90\xed\x8d\xab\xb1*\xa2\x13\x86\xd2j\xc5\xbb0\x1bwrM\r\x8dD\x85\x98\xdd\xc6\x0ea)\x03\xe5\xa2s\xe3\x96\xc9N\x1d\xf1Ve\xc26\xcfZ\xe3h\x13\xa0Dk\xc1\xda^\x00\xc7\n\xc1`\xc0\x18\xfbBD\x83\x8e\xef\xcb\xf6\x8eK\xf7\x83<\xf6\xff'}}, 0x26) mount$9p_fd(0x0, &(0x7f00000005c0)='./file0\x00', &(0x7f0000000600), 0x12, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[], [], 0x6b}}) 2m54.256854592s ago: executing program 8 (id=1436): r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='source', &(0x7f0000000280)='c:::/\x83\xc1\xcfD\xc4AO\x06)\xb03\xfcI\x95w\x96\x9b\xe9\xa6\x1a\x96\xael\x11\xa6\x06\xe3G\xb1\x1d$\xc2;\x8f\xf3\x13\xebB\x93\x94\x01\x8b\x88\xeb\xa3\x01\rx\x86bK&\x13a~\x04/\x18\x14ZM\xcb\xad\x92>\xe5\x01V\xdc\x05#\x13\xe9F\xa0\x1b\xf8\xe12\xe9\x80\x988\xd8?\x86\xe9i\x7f\xa8\xe0c\x94\xc1\xae\x9c\xba\x1c\xfa\xbc\xa8\xbf\xff\xfe\xfe!\x7f2\xf1\xc7P\x80A\x1c2k\xf6}P\x19\xee:i|0\x1c\x13u\xb0I\xaa\xe3\x14\x9a\x1f\x9f(\xd1$\x06\xa8&t&A0\xa7\xef\x9cL\x8e1K', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsopen(&(0x7f0000000340)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000380)='source', &(0x7f00000006c0)='c:::/\x83\xc1\xcfD\xc4AO\x06)\xb03\xfcI\x95w\x96\x9b\xe9\xa6\x1a\x96\xael\x11\xa6\x06\xe3G\xb1\x1d$\xc2;\x8f\xf3\x13\xebB\x93\x94\x01\x8b\x88\xfe\xe1\xbc#\xeb\xa3\x01\rx\x86bK&\x13a~\x04/\x18\x14ZM\xcb\xad\x92>\xe5\x01V\xdc\x05#\x13\xe9F\xa0l91&Y\x1b\xb0\x1a\xd8?\x86\xe9i\x7f\xa8\xe0c\x94\xc1\xae\x9c\xba\x1c\xfa\xbc\xa8\xbf\xff\xfe\xfe!\x7f2tDx\a\xc7P\x80A\x1c2k\xf6}P\x19\xee:i|0\x1c\x13u\xb0I\xaa\xe3\x14\x9a\x1f\x9f(\xd1$\x06\xa8&t&A0\xeaG\xe04\xe8x\x99\x88t\xc3\xf5\xfa\xe2\xc7\"\x99mo\"\x11\x9eC\x11j\x9a\xd3\t\x9f\x1a2dv\xeen\x04\xab9\xb19p\x1bpC\x18\xc0\xb3O\xf9\xf0', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) 2m52.731523248s ago: executing program 8 (id=1443): syz_mount_image$vfat(&(0x7f0000000800), &(0x7f0000000840)='./file2\x00', 0x80420c, &(0x7f0000000880)=ANY=[], 0x7, 0x37b, &(0x7f00000008c0)="$eJzs3U9oI1UcwPFf/k2TLNvkIIqC9OEi6GVoo2cxyC4IAZfuRtwVhNl2oiFjUjKhGhHbnjwq3j0JHkpvFjwUtGchF296EaG3XgQFK6gj8y+Z/OufmDRs+/1Ayct77zfzXual/CbtZI7f+vz9WsXWK0ZL4mklMRGRE5G8xCUUCx7jXlkT+eyHbtu2vHjj95+evfegnPYr1J3i/ZcKSqnFpe8++DgTdDtYkE7+nePfCkedfFBlq6qt6o2WMtSjxi8t45FlqvWqXdOVumuZhm2qat02m377N0GQ1djYaCujvn4zu9HUxFZGva1qZlu1GqrVbCvjXaNaV7quq5tZwVnKu6urRnHC4LUpDwYz0mwWjYSIZIZayrtzGRAAAJirwfw/7qb0Z+X/Ed38/6Eslkq3V5XbuZf/7z132Lrx5v5ikP8faEedJztPH/97/71qL/9/+Wd/W335v3s60cv/G/75QaUv/zftEfn/l3KB/H84I7pmJs3/8zMYCyazpA1Vxfqeufl/Nnj/enbe3lv2CuT/AAAAAAAAAAAAAAAAAAAAAAA8Dk4cJ+c4Ti58DH96lxAEz3EljTv+CyKSdo++w/G/yu49eChp78I99xhbn26WN8v+Y9DhUEQsMf9xBrlrI7zySLny8r21FcRvbZYTXkuxIlU3XlYkJ3lvPUXiHefO66XbK8oXxHcvU8pG4wuSkyei8d96q9ONL/THB/vX5IVbkXhdcvLjmjTEknUvsrf/T1aUeu2N0kB8xusnIr9e+kEBAAAAAGDKdNU18vxd18e1+98yUqx4HxOZsiw5+Xv0+f3yyPPzZO6Z5LxnDwAAAADA9WC3P6oZEjebXsGyRhUyMrZpCoVkX01KRIb6JMSytIHw1GlbTkRmeN7xaOLfweT/zuur8FW9SFT4jxTuwLtNwR1VZLLxhPP3amLJ5/8Imv666Lxi2+ItgO1oU1zOEZ4cHPySW6FGdr41djs7wUS6NeHHRtqY11nuDm8nfspKSA3VOLHJFsBTX3z95/TeIK/sByvgw7M771imsyXnOSgDBXcXw02pmf/iAQAAAHDpekl/WPNqtDl6I5HozXL4yz0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFM0k6/0GyiM3/vCZU4VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmLv/AgAA//99b+/k") mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f00000001c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000240)='./file0/../file0\x00') mount$bind(&(0x7f0000000280)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000300)='./file0/../file0\x00', &(0x7f0000000340)='./file0\x00') 2m52.524151769s ago: executing program 8 (id=1447): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='27', 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_open_procfs$userns(0x0, &(0x7f0000000280)) 2m52.065961756s ago: executing program 8 (id=1452): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000000)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0), 0x20000328) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000180)={0x0, 0x8}, 0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) 2m51.62714398s ago: executing program 37 (id=1452): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000000)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0), 0x20000328) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000180)={0x0, 0x8}, 0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) 2m34.538055073s ago: executing program 4 (id=1535): bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x22, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1f, 0x1, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000fcffffff0000000007000000850000009e"], 0x0, 0x545, 0x0, 0x0, 0x40f00, 0x34}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd45, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r0, 0x4) sendmsg$inet(r2, &(0x7f0000000100)={0x0, 0xc000, 0x0}, 0x20000000) 2m34.402376657s ago: executing program 4 (id=1536): r0 = msgget(0x2, 0x200) msgctl$IPC_RMID(r0, 0x0) msgget(0x0, 0x710) msgget(0x2, 0x624) msgget(0x1, 0x240) msgget(0x3, 0x606) 2m34.267595561s ago: executing program 4 (id=1538): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) connect$can_bcm(r0, &(0x7f0000000140)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000200)=ANY=[@ANYBLOB="050000003008"], 0x80}, 0x1, 0x0, 0x0, 0x40084}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x4004844) close(r0) 2m34.134494664s ago: executing program 4 (id=1540): syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x10, &(0x7f0000000000), 0xfd, 0x244, &(0x7f0000000680)="$eJzs3T9oJFUcB/DvzO565m6RUxtB/AMiooFwdoJNbBQCEoKIoEJExEZJhJhgl1jZWGitksomiJ3RUtIEG0WwipoiNoIGC4OFFiu7k0hMVqNu3Dkynw9MZibz3vzesPN9u83sBmisq0mmk7SSTCbpJCmON7i7Wq4e7q5PbM8nvd4TPxWDdtV+5ajflSRrSR5KslUWeamdrGw+s/fLzmP3vbncuff9zacnxnqRh/b3dh8/eG/2jY9mHlz54qsfZotMp/un6zp/xZD/tYvklv+j2HWiaNc9Av6Judc+/Lqf+1uT3DPIfydlqhfvraUbtjp54N2/6vv2j1/ePs6xAuev1+v03wPXekDjlEm6KcqpJNV2WU5NVZ/hv2ldLl9eXHp18sXF5YUX6p6pgPPSTXYf/eTSx1dO5P/7VpV/4OLq5//JuY1v+9sHrbpHA4zFHdWqn//J51bvj/xD48g/NJf8Q3PJPzSX/ENzyT80l/zDBdb5+8PyD80l/9Bc8g/NdTz/AECz9C7V/QQyUJe65x8AAAAAAAAAAAAAAAAAAOC09Ynt+aNlXDU/eyfZfyRJe1j91uD3iJMbB38v/1z0m/2hqLqN5Nm7RjzBiD6o+enrm76rt/7nd9Zbf3UhWXs9ybV2+/T9Vxzef//dzWcc7zw/YoF/qTix//BT461/0m8b9daf2Uk+7c8/14bNP2VuG6yHzz/ds79i+Uyv/DriCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABib3wMAAP//+kBtTA==") openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x22042, 0x3db) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x14, 0xd, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e7376b7a5ff537ed73ac58818d78c660e677df8dc905b90242b7c528a076d2f6a00400", "036c5bc6780820d1cbf7966d61fdcf335263bd9b0abdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) 2m33.220120407s ago: executing program 4 (id=1550): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r0, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000200)=r1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000180)=0x20000, &(0x7f00000001c0)=r1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r2, 0xffffffffffffffff}, &(0x7f0000000500)=0x2000000, &(0x7f0000000540)=r1}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r3, &(0x7f0000000480)='87', &(0x7f00000005c0)=""/152}, 0x20) 2m32.868592823s ago: executing program 4 (id=1553): setresuid(0x0, 0xee00, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000200)="a10100001400add427323b470c45b45602067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) 2m32.546768476s ago: executing program 38 (id=1553): setresuid(0x0, 0xee00, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000200)="a10100001400add427323b470c45b45602067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) 2m20.959319467s ago: executing program 0 (id=1620): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) close(r1) bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=@base={0x10, 0x4, 0x4, 0x2}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x6, 0x15, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @xdp=0x25, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r2, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 2m19.905351925s ago: executing program 0 (id=1635): mknodat$md(0xffffffffffffff9c, &(0x7f0000000940)='./md0\x00', 0x6180, 0x0) r0 = openat$md_node(0xffffffffffffff9c, &(0x7f0000000980)='./md0\x00', 0x2, 0x0) ioctl$SET_ARRAY_INFO(r0, 0x40480923, &(0x7f0000000240)={0xfffffffe, 0x77, 0x0, 0x0, 0x5, 0x72f, 0x0, 0x2, 0x0, 0x1000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000}) ioctl$ADD_NEW_DISK(r0, 0x40140921, &(0x7f0000000a40)={0x0, {0x1, 0x0}, 0x0, 0x6}) ioctl$ADD_NEW_DISK(r0, 0x40140921, &(0x7f0000000a80)={0x1, {0x1, 0x1}, 0x1, 0x6}) ioctl$RUN_ARRAY(r0, 0x400c0930, 0x0) 2m19.726425703s ago: executing program 0 (id=1629): r0 = io_uring_setup(0x68be, &(0x7f0000003680)={0x0, 0x48c3, 0x8, 0x0, 0xd1}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000240)={0x0, 0xdfffffee, 0x80000000, 0xfffffffd, 0x13, "a15f06e3975c6e28a8d1002000008b8d2b697b"}) r2 = syz_open_pts(r1, 0x40601) ioctl$TIOCCONS(r2, 0x541d) close_range(r0, 0xffffffffffffffff, 0x0) 2m19.579458248s ago: executing program 0 (id=1630): syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0xe, &(0x7f0000000040)={[{@barrier_val={'barrier', 0x3d, 0x101}}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x6}}]}, 0x1, 0x453, &(0x7f0000000300)="$eJzs3M2PE+UfAPDvTLfw2x/grogvvKiraNz4sssCKgcPajTxgImJHvS42V0IUljDrokQomAMnowx8W48+i940osxnky86t2QEMMF8FQz7czSlrbslnaL9vNJBp5n5pk+z7czT/vMPJ0NYGRNZf8kEdsj4veImKhnmwtM1f+7fvX8wo2r5xeSqFbf/iuplbt29fxCUbTYb1uemU4j0s+S2Num3pWz507OVypLZ/L87OqpD2ZXzp577sSp+eNLx5dOHzxy5PChuRdfOPh8X+LM2nRtz8fL+3a/8d5Xbx79oin+ljj6ZKrbxier1T5XN1w7GtLJ2BAbwoaUIiI7XOVa/5+IUtw8eBPx+qdDbRwwUNVqtbqt8+YLVeA/LInmvC4Po6L4os+uf4uldRDw8uCGH0N35ZX6BVAW9/V8qW8ZizQvU265vu2nqYh498Lf32RLDOY+BABAkx+y8c+z7cZ/aTzQUO6efG5oMiLujYidEXFfROyKiPsjamUfjIiHNlh/6yTJreOf9HJPga1TNv57KZ/bah7/FaO/mCzluR21+MvJsROVpQP5ezId5a1Zfq5LHT++9tuXnbY1jv+yJau/GAvm7bg8trV5n8X51fk7ibnRlYsRe8baxZ+szQQkEbE7Ivb0WMeJp7/b12nb7ePvog/zTNVvI56qH/8L0RJ/Iek+Pzn7v6gsHZgtzopb/fLrpbc61X9H8fdBdvz/3/b8X4t/Mmmcr13ZeB2X/vi84zVNr+f/luSdWnpLvu6j+dXVM3MRW5Kj9UY3rj94c98iX5TP4p/e377/74yb78TeiMhO4ocj4pGIeDRv+2MR8XhE7O8S/8+vPvF+7/EPVhb/4oaO/1piPKJlTYdE6eRP3zdVOnlL/De6H//DtdR0vmY9n3/raVdvZzMAAAD8+6QRsT2SdGYtnaYzM/Xfy++KSCvLK6vPHFv+8PRi/RmBySinxZ2uiYb7oXP5ZX09fzEi6j8tKLYfyu8bf10ar+VnFpYri8MOHkbcttosRl1j/8/8WRpeu4BN4nktGF36P4wu/R9Gl/4Po6tN/x8fRjuAzZf1/9Y/s/XJkNoCbK6W73/TfjBCXP/D6NL/YXTp/zCSVsbj9g/Jd00Ur9Tj7ndTotrPF4zysMMZbCLSu6IZEgNKDPdzCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoF/+CQAA///E5ODv") mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x181) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000180)='./file0\x00', 0x14a0, &(0x7f0000000200)=ANY=[], 0x1, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0, 0x0) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000080)={0x6081, 0x5, 0x1, 0x4}) 2m19.025412445s ago: executing program 0 (id=1633): syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000140)={0x1d, r1, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) syz_genetlink_get_family_id$wireguard(&(0x7f00000001c0), r0) 2m18.260545202s ago: executing program 0 (id=1641): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r0, 0xffffffffffffffff}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1f, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000000000085000000a500000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000640)={r2}, 0xc) 2m17.669733143s ago: executing program 39 (id=1641): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r0, 0xffffffffffffffff}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1f, 0x18, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000000000085000000a500000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000640)={r2}, 0xc) 1m12.560402841s ago: executing program 6 (id=2095): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x32}}, 0x0) getsockname$packet(r1, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000010000507000000000004000000000000", @ANYRES32=r2, @ANYBLOB="00000016010000001800120008000100736974000c0002000800030036"], 0x38}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x439, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0xe403, r2, 0x40083}, [@IFLA_LINKINFO={0x10, 0x12, 0x0, 0x1, @sit={{0x8}, {0x4}}}, @IFLA_AF_SPEC={0xc, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x2, 0x0, 0x1, {0x4}}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20008004}, 0x0) 1m12.443623044s ago: executing program 6 (id=2088): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926", 0x20}], 0x1}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/72, 0x48}], 0x1}, 0x0) 1m12.238356384s ago: executing program 6 (id=2089): syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80383, 0x0) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000140)={0x0, 0x5961, 0x10000, 0x0, 0x213}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$SNDCTL_SEQ_RESET(r0, 0x5100) 1m11.99007878s ago: executing program 6 (id=2091): syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0xe, &(0x7f0000000040)={[{@barrier_val={'barrier', 0x3d, 0x101}}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x6}}]}, 0x1, 0x453, &(0x7f0000000300)="$eJzs3M2PE+UfAPDvTLfw2x/grogvvKiraNz4sssCKgcPajTxgImJHvS42V0IUljDrokQomAMnowx8W48+i940osxnky86t2QEMMF8FQz7czSlrbslnaL9vNJBp5n5pk+z7czT/vMPJ0NYGRNZf8kEdsj4veImKhnmwtM1f+7fvX8wo2r5xeSqFbf/iuplbt29fxCUbTYb1uemU4j0s+S2Num3pWz507OVypLZ/L87OqpD2ZXzp577sSp+eNLx5dOHzxy5PChuRdfOPh8X+LM2nRtz8fL+3a/8d5Xbx79oin+ljj6ZKrbxier1T5XN1w7GtLJ2BAbwoaUIiI7XOVa/5+IUtw8eBPx+qdDbRwwUNVqtbqt8+YLVeA/LInmvC4Po6L4os+uf4uldRDw8uCGH0N35ZX6BVAW9/V8qW8ZizQvU265vu2nqYh498Lf32RLDOY+BABAkx+y8c+z7cZ/aTzQUO6efG5oMiLujYidEXFfROyKiPsjamUfjIiHNlh/6yTJreOf9HJPga1TNv57KZ/bah7/FaO/mCzluR21+MvJsROVpQP5ezId5a1Zfq5LHT++9tuXnbY1jv+yJau/GAvm7bg8trV5n8X51fk7ibnRlYsRe8baxZ+szQQkEbE7Ivb0WMeJp7/b12nb7ePvog/zTNVvI56qH/8L0RJ/Iek+Pzn7v6gsHZgtzopb/fLrpbc61X9H8fdBdvz/3/b8X4t/Mmmcr13ZeB2X/vi84zVNr+f/luSdWnpLvu6j+dXVM3MRW5Kj9UY3rj94c98iX5TP4p/e377/74yb78TeiMhO4ocj4pGIeDRv+2MR8XhE7O8S/8+vPvF+7/EPVhb/4oaO/1piPKJlTYdE6eRP3zdVOnlL/De6H//DtdR0vmY9n3/raVdvZzMAAAD8+6QRsT2SdGYtnaYzM/Xfy++KSCvLK6vPHFv+8PRi/RmBySinxZ2uiYb7oXP5ZX09fzEi6j8tKLYfyu8bf10ar+VnFpYri8MOHkbcttosRl1j/8/8WRpeu4BN4nktGF36P4wu/R9Gl/4Po6tN/x8fRjuAzZf1/9Y/s/XJkNoCbK6W73/TfjBCXP/D6NL/YXTp/zCSVsbj9g/Jd00Ur9Tj7ndTotrPF4zysMMZbCLSu6IZEgNKDPdzCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoF/+CQAA///E5ODv") mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x181) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000180)='./file0\x00', 0x14a0, &(0x7f0000000200)=ANY=[], 0x1, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0, 0x0) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000080)={0x6081, 0x5, 0x1, 0x4}) 1m11.393763111s ago: executing program 6 (id=2096): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000500)=ANY=[@ANYBLOB="1400000010000100000000000000000000000a0020000000000a0100000000000000000005"], 0xb0}}, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0xfffffffd, 0xffffffffffffffff, 0x4}, 0x38) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r0, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) 1m11.325071758s ago: executing program 1 (id=2098): mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f00000009c0)=0x9, 0x8, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000a00)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000a40)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000a80)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) 1m10.80876289s ago: executing program 6 (id=2099): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="5800000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000008440000300012800b00010067656e657665000020000280140007000000000000000000000000007fff0001050004000100000008000a00", @ANYRES32=r2], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1m10.284199224s ago: executing program 40 (id=2099): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="5800000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000008440000300012800b00010067656e657665000020000280140007000000000000000000000000007fff0001050004000100000008000a00", @ANYRES32=r2], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1m10.276529034s ago: executing program 1 (id=2101): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000000)={0x0, 0x5, 0x6d, {0x6d, 0x9, "7a431dd5d990ec2d0338ac6f7567f3c69146d3457cd4594324fc03ff5c0cd639b9405c1dc333c82b8752866c149ebd6734fd7766b21851fadfb7933468395370aaba893a77f05858427a3d0f8d39b62ad9dacdf0c808ae06bace09a62cf40dc4f26fa4d42ff5c970940db2"}}, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x2, 0x8, 0x2, "815f4e90", "9bbd4796"}}, 0x0}, 0x0) 1m8.196811226s ago: executing program 1 (id=2104): openat$kvm(0xffffffffffffff9c, 0x0, 0x20040, 0x0) timer_create(0x2, 0x0, &(0x7f0000000400)) timer_settime(0x0, 0x1, &(0x7f0000000440)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_create(0x2, 0x0, &(0x7f0000000480)=0x0) timer_settime(r0, 0x1, &(0x7f00000004c0)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_delete(r0) 1m8.135299723s ago: executing program 1 (id=2105): syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0xe, &(0x7f0000000040)={[{@barrier_val={'barrier', 0x3d, 0x101}}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x6}}]}, 0x1, 0x453, &(0x7f0000000300)="$eJzs3M2PE+UfAPDvTLfw2x/grogvvKiraNz4sssCKgcPajTxgImJHvS42V0IUljDrokQomAMnowx8W48+i940osxnky86t2QEMMF8FQz7czSlrbslnaL9vNJBp5n5pk+z7czT/vMPJ0NYGRNZf8kEdsj4veImKhnmwtM1f+7fvX8wo2r5xeSqFbf/iuplbt29fxCUbTYb1uemU4j0s+S2Num3pWz507OVypLZ/L87OqpD2ZXzp577sSp+eNLx5dOHzxy5PChuRdfOPh8X+LM2nRtz8fL+3a/8d5Xbx79oin+ljj6ZKrbxier1T5XN1w7GtLJ2BAbwoaUIiI7XOVa/5+IUtw8eBPx+qdDbRwwUNVqtbqt8+YLVeA/LInmvC4Po6L4os+uf4uldRDw8uCGH0N35ZX6BVAW9/V8qW8ZizQvU265vu2nqYh498Lf32RLDOY+BABAkx+y8c+z7cZ/aTzQUO6efG5oMiLujYidEXFfROyKiPsjamUfjIiHNlh/6yTJreOf9HJPga1TNv57KZ/bah7/FaO/mCzluR21+MvJsROVpQP5ezId5a1Zfq5LHT++9tuXnbY1jv+yJau/GAvm7bg8trV5n8X51fk7ibnRlYsRe8baxZ+szQQkEbE7Ivb0WMeJp7/b12nb7ePvog/zTNVvI56qH/8L0RJ/Iek+Pzn7v6gsHZgtzopb/fLrpbc61X9H8fdBdvz/3/b8X4t/Mmmcr13ZeB2X/vi84zVNr+f/luSdWnpLvu6j+dXVM3MRW5Kj9UY3rj94c98iX5TP4p/e377/74yb78TeiMhO4ocj4pGIeDRv+2MR8XhE7O8S/8+vPvF+7/EPVhb/4oaO/1piPKJlTYdE6eRP3zdVOnlL/De6H//DtdR0vmY9n3/raVdvZzMAAAD8+6QRsT2SdGYtnaYzM/Xfy++KSCvLK6vPHFv+8PRi/RmBySinxZ2uiYb7oXP5ZX09fzEi6j8tKLYfyu8bf10ar+VnFpYri8MOHkbcttosRl1j/8/8WRpeu4BN4nktGF36P4wu/R9Gl/4Po6tN/x8fRjuAzZf1/9Y/s/XJkNoCbK6W73/TfjBCXP/D6NL/YXTp/zCSVsbj9g/Jd00Ur9Tj7ndTotrPF4zysMMZbCLSu6IZEgNKDPdzCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoF/+CQAA///E5ODv") mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x181) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000180)='./file0\x00', 0x14a0, &(0x7f0000000200)=ANY=[], 0x1, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0, 0x0) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000080)={0x6081, 0x5, 0x1, 0x4}) 1m7.640211333s ago: executing program 1 (id=2107): openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000580), 0x100}, 0x0) select(0x46, 0x0, 0x0, &(0x7f0000000400)={0xfefdffffffffffff, 0x1, 0x2, 0x2}, &(0x7f0000000440)={0x0, 0x2710}) 1m7.08361725s ago: executing program 1 (id=2109): r0 = syz_usb_connect(0x2, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="120100004366b408c70b0800c84f010203010902"], 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff0007058102"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408106050000010000000109021900010100803209040000010a"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x10000) 1m6.565982613s ago: executing program 41 (id=2109): r0 = syz_usb_connect(0x2, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="120100004366b408c70b0800c84f010203010902"], 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff0007058102"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408106050000010000000109021900010100803209040000010a"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x10000) 15.284364181s ago: executing program 5 (id=2430): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x3c, r2, 0x1, 0x1070bd0c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_L2SPEC_TYPE={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40811}, 0x20) 15.00456186s ago: executing program 5 (id=2435): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x10000, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, 0x0}], 0x1, 0x60, &(0x7f00000001c0)=[@cr4={0x1, 0x44008}], 0x1) ioctl$KVM_RUN(r2, 0xae80, 0x0) 14.758190065s ago: executing program 5 (id=2436): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x8040, 0x0) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0xffffffff, @remote}}}, 0x108) r2 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x6, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x3, @local}}}, 0x108) close_range(r0, 0xffffffffffffffff, 0x0) 14.557123896s ago: executing program 5 (id=2439): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000380)='./file0\x00', 0x200000, &(0x7f00000003c0)={[{@resgid={'resgid', 0x3d, 0xee00}}, {@mblk_io_submit}, {@grpquota}, {@nojournal_checksum}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@nobarrier}, {@nogrpid}, {@noauto_da_alloc}, {@stripe={'stripe', 0x3d, 0x6}}]}, 0x3, 0x572, &(0x7f0000000480)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwIF6kCCIWxD/Au8fiH6B/RUELRUrQg5fIbGbbbZLNJunWbJ3PB6Z9b2ayb96++b79zs4uG0BhjWT/lCJejoivk4iDbdsGI984srLf0sNrk9mSxPLyJ38mkeTrWvsn+f/788pLEfHLFxHHS2vbrS8szlSq1XQur482Zi+P1hcWT1ycrUyn0+ml8YmJU29NjL/7zts96+vr5/7+7uO7H5z66ujStz/dP3Q7iTNxIN/W3o+ncKO9MhIj+XMyFGdW7TjWg8b6SbLTB8C2DORxPhTZHHAwBvKoB/7/rkfEMlBQifiHgmrlAa1r+x5dBz83Hry/cgG0tv+DK++NxJ7mtdG+peSJK6Psene4B+1nbfz8x53b2RJd3oe43oP2AFpu3IyIk4ODa+e/JJ//tu9k883jja1uo2ivP7CT7mb5zxvr5T+lR/lPrJP/7F8ndreje/yX7vegmY6y/O+9dfPfR1PX8EBee6GZ8w0lFy5W05MR8WJEHIuh3Vl9o/s5p5buLXfa1p7/ZUvWfisXzI/j/uDuJ/9mqtKoPE2f2z24GfHK4/w3iTXz/55mrrt6/LPn41xW+PXLrm0cSe+82mlb9/63630GvPxjxGvrjv/jO1rJxvcnR5vnw2jrrFjrr1tHfuvU/tb633vZ+O/buP/DSfv92vrW2/hhzz9pp23bPf93JZ82y7vydVcrjcbcWMSu5KO168cf/22r3to/6/+xoxvPf+ud/3sj4rNN9v/W4Vsdd+2H8Z/a0vhvvXDvw8+/79T+5sb/zWbpWL5mM/PfZg/waZ47AAAAAAAA6DeliDgQSan8qFwqlcsrn+84HPtK1Vq9cfxCbf7SVDS/KzscQ6XWne6DbZ+HGMs/D9uqj6+qT0TEoYj4ZmBvs16erFWndrrzAAAAAAAAAAAAAAAAAAAA0Cf2d/j+f+b3gZ0+OuCZ85PfUFxd478Xv/QE9CWv/1Bc4h+KS/xDcYl/KC7xD8Ul/qG4xD8Ul/gHAAAAAAAAAAAAAAAAAAAAAAAAAACAnjp39my2LC89vDaZ1aeuLMzP1K6cmErrM+XZ+cnyZG3ucnm6VpuupuXJ2my3x6vWapfHxmP+6mgjrTdG6wuL52dr85ca5y/OVqbT8+nQf9IrAAAAAAAAAAAAAAAAAAAAeL7UFxZnKtVqOqfQsXA6+uIwtl1Iuo3y6fxk2NIjR14Y3PkOKjyDwg5PTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQ5t8AAAD//8nLNLM=") open(&(0x7f0000000a00)='./bus\x00', 0x400141042, 0x22) mount(&(0x7f0000000a40)=@loop={'/dev/loop', 0x0}, &(0x7f0000000a80)='./bus\x00', 0x0, 0x5000, 0x0) r0 = open(&(0x7f0000000ac0)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x14, 0xd, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e7376b7a5ff537ed73ac58818d78c660e677df8dc905b90242b7c528a076d2f6a00400", "036c5bc6780820d1cbf7966d61fdcf335263bd9b0abdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x14b) 13.894496723s ago: executing program 5 (id=2444): r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) syz_usb_connect(0x0, 0x3f, 0x0, 0x0) bind$can_j1939(r0, &(0x7f0000000080)={0x1d, r1, 0x8000000000000003, {}, 0xfd}, 0x18) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newchain={0x24, 0x64, 0x1, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r1, {0x1, 0xffe0}, {0xc, 0xfff3}, {0x6, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0xfd27c4eff795f0e1}, 0x480c5) close(r0) 12.631211232s ago: executing program 9 (id=2451): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x4, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 12.537663882s ago: executing program 5 (id=2452): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000104000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000010401010000009f9c02480000fff5000500010001"], 0x1c}, 0x1, 0x0, 0x0, 0x60000081}, 0x800) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x1c, 0x1, 0x4, 0x5, 0x0, 0x0, {0x3, 0x0, 0x10}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x26088888) close_range(r0, 0xffffffffffffffff, 0x0) 12.424843623s ago: executing program 9 (id=2454): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e21, @broadcast}, 0x10) ioctl$int_in(r0, 0x5452, &(0x7f0000000140)=0x3) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f00000001c0), 0xffffffffffffff94, 0x201, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000240)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 12.0618474s ago: executing program 42 (id=2452): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000104000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000010401010000009f9c02480000fff5000500010001"], 0x1c}, 0x1, 0x0, 0x0, 0x60000081}, 0x800) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x1c, 0x1, 0x4, 0x5, 0x0, 0x0, {0x3, 0x0, 0x10}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x26088888) close_range(r0, 0xffffffffffffffff, 0x0) 11.432572794s ago: executing program 9 (id=2460): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000480)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000052406000105240000200d240f0100000000000000000006241a0000000905810300020000000904010000020d00000904010102020d0000090502000200000009"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) quotactl$Q_QUOTAOFF(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x1010, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 8.962002086s ago: executing program 9 (id=2467): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='dctcp', 0x5) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000600)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f00ffffff03c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c001f4002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4040) 8.779114604s ago: executing program 9 (id=2468): r0 = syz_clone(0x20804000, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000b80)='task\x00') syz_read_part_table(0x407b, &(0x7f00000010c0)="$eJzszz9K83AcBvCnafu+qRSKoJMgFgc3iZtTLuDcXbq6OjmomJs4igfwHt7B1SNUpDa2ijiIiPL5LMn3eZLfn/Cjis8+eFy8lG3USXI3vV1PsjNOU1XzsrfoB69/Vwfpr5VFhklO3y8+ufnq+QEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgN/h3/zxfykqlvLkIklzf7Y3eJnLtp1upTmvczhMys1RctVNv97uZCMZ77/Z5uQo6SYP6bXRZPR9twIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/pLj1fFydSw+Kp5d76ap+207mz2xO8cEAIBADAM7gkBMYrJY4Pc7A0mb/ZldybnzWwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeO3AgAAAAAADk/9oIVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVdiBAxkAAAAAYf7WebQfAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeCkAAP//oYMWnA==") fchdir(r1) mount(0x0, &(0x7f0000005140)='.\x00', &(0x7f0000005180)='proc\x00', 0x0, 0x0) syz_open_procfs$namespace(r0, &(0x7f00000051c0)='ns/net\x00') 7.875122747s ago: executing program 9 (id=2471): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) r2 = fcntl$dupfd(r1, 0x406, r1) fcntl$setstatus(r1, 0x4, 0x42000) recvmmsg$unix(r2, &(0x7f0000000800), 0x400018e, 0x10040, 0x0) 3.204715483s ago: executing program 7 (id=2487): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev/console\x00', 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000100)=0x2) r1 = syz_open_procfs(0x0, &(0x7f0000000b40)='fd/3\x00') ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) 3.03861631s ago: executing program 7 (id=2489): r0 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c000090400000207010100090501020002"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000003c0)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x20, 0x0, 0x1}}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r1, &(0x7f0000000440)=[{&(0x7f0000000480)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x1, &(0x7f00000002c0)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r2, 0xffffffffffffffff, 0x0) 2.088901027s ago: executing program 2 (id=2495): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = eventfd2(0x0, 0x1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x0, r1}) ppoll(&(0x7f0000000080)=[{r1, 0x40}], 0x1, 0x0, 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000280)="569534ab1bbe0e03", 0x8}], 0x1) 1.615359195s ago: executing program 3 (id=2498): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000002e80)=0x1, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000002ec0)={@private=0xe1010203, @empty, 0x1}, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) sendto(r2, &(0x7f0000002f00)="340000001a00010001000000000000000220000000000000000000000800030001000000080002000101010108000100e1010203", 0x34, 0x0, 0x0, 0x0) 1.461357441s ago: executing program 3 (id=2499): r0 = syz_open_procfs(0x0, &(0x7f0000000180)='attr\x00') fchdir(r0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000940)='\x00', 0x89901) fchdir(r1) mount_setattr(0xffffffffffffff9c, &(0x7f0000000980)='.\x00', 0x0, &(0x7f00000009c0)={0xf, 0x5, 0x0, {r1}}, 0x20) openat(0xffffffffffffff9c, &(0x7f0000002d80)='./file1\x00', 0x4842, 0x0) 1.311960996s ago: executing program 3 (id=2500): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000007c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="04000000040000000400000010"], 0x50) close(0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x8, &(0x7f0000000300)=ANY=[@ANYBLOB="18120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7030000f2717ca8bfa400000000000007040000f8ffffffb705000000000000850000001900000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback=0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 1.227729705s ago: executing program 7 (id=2501): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000050000000100000001000013040000000200000088060000ff0f0000002e2e"], 0x0, 0x35}, 0x28) syz_emit_ethernet(0x4d, &(0x7f0000000200)={@local, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cabf00", 0x17, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x0, 0x0, "a78ce54006"}]}}}}}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180005000000ffff000077b9080000009500000000d3a07e"], &(0x7f0000000080)='GPL\x00', 0x7, 0x4fa, &(0x7f0000000cc0)=""/4096, 0x40f00, 0x5, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f00000002c0)={0x0, 0x2, 0x4, 0x9}, 0x1, 0x0, 0x0, 0xff3e, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000240)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.220108166s ago: executing program 3 (id=2502): mknodat$loop(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1004, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x2008800, &(0x7f00000010c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}}) openat2$dir(0xffffff9c, &(0x7f0000000300)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000300), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000080)='ubifs\x00', 0x0, 0x0) close(0x3) 1.046580713s ago: executing program 2 (id=2503): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000300)={0x0, 0x4}, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000180)={0x0, 0x13529edb}, &(0x7f0000000280)=0x8) 1.004791578s ago: executing program 7 (id=2504): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) bpf$ITER_CREATE(0x21, 0x0, 0x0) 987.517719ms ago: executing program 3 (id=2505): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000100), 0x1, 0x4bc, &(0x7f0000000200)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") r0 = creat(&(0x7f00000006c0)='./bus\x00', 0x101) r1 = open(&(0x7f0000000700)='./file1\x00', 0x86442, 0x10) dup3(r1, r0, 0x0) io_setup(0x91, &(0x7f0000000740)=0x0) io_submit(r2, 0x3f0a, &(0x7f0000000780)=[&(0x7f00000007c0)={0xf04aef, 0x3d8, 0x4, 0x0, 0x0, r0, &(0x7f0000000800), 0x200a00}]) 884.42973ms ago: executing program 7 (id=2506): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/ports/1\x00', 0x1ff) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='ipv4', 0x4) 812.724877ms ago: executing program 2 (id=2507): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x181) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000001c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x14a0, &(0x7f0000000700)=ANY=[], 0x1, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x88040, 0x12) read$FUSE(r0, 0x0, 0x0) 667.862832ms ago: executing program 7 (id=2508): syz_mount_image$exfat(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', 0x4884, &(0x7f00000001c0)=ANY=[], 0x1, 0x153c, &(0x7f0000000380)="$eJzs3AuYTlXbOPD7XmvtMSSeJjlM1lr35kkOiyTJISSHJKkkSU4JSZO8kpAYQpKGJCSHIYkhJIeJSeN8Ph8SkqRJkpCckvW/Jubv7a33q++t7/Ve79y/69rXrPvZe6197+d+Dmvv65n9TdehtZvUqdGIiOBPwQt/EgEgFgAGAkBeAAgAoHxc+bjM9TklJv65nbC/1gMplzsDdjlx/bM3rn/2xvXP3rj+2RvXP3vj+mdvXP/sjevPWHa2aVqhq3jJvgtf/8/O+Pv/v0hG6bFfrCl9TTeAmD/aheufvXH9/2sFf2Qjrn/2xvXPrmIvdwLsPwC//7ODHP90Ddc/e+P6M5adXe7rz5d7gch/2HNwJOeFwvz+tlkl/HPHzxhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOM/Ruc9pcoAMhqX+68GGOMMcYYY4wx9tfxOS53BowxxhhjjDHGGPu/hyBAgoIAYiAHxEJOyAUCAK6EPJAXInAVxMHVkA+ugfxQAApCIYiHa6EwaDBggSCEIlAUonAdFIProTiUgJJQChyUhjJwA5SFG6Ec3ATl4WaoALdARagElaEK3ApVoRpUh9ugBtwONaEW1IY6cAfUhTuhHtwF9eFuaAD3wL1wHzSE+6ERPACN4UFoAg9BU3gYmkFzaAEtodW/1P856AnPQy/oDYnQB/rCC9AP+sMAeBEGwkswCF6GwfAKJMEQGAqvwjB4DYbD6zACRsIoeANGw5swBsbCOBgPyTABJsJbMAnehsnwDkyBqZAC02A6vAszYCbMgvdgNrwPc2AuzIP5kAofwAJYCGnwISyCjyAdFsMSWArLYDmsgJWwClbDGlgL62A9bICNsAk2wxbYCttgO+yAj2EnfAK7YDfsgU9hL3z2v+x/6h/6d0NAQIECFSqMwRiMxVjMhbkwN+bGPJgHIxjBOIzDfJgP82N+LIgFMR7jsTAWRoMGCQmLYBGMYhSLYTEsjsWxJJZEhw7LYBksizdiOSyH5bE8VsAKWBErYSWsglWwKlbF6lgda2ANrIk1sTbWxjvwDuyD9bAe1sf62AAbZF2ewkbYCBtjY2yCTbApNsVm2AxbYAtsha2wNbbGNtgG22E7bI/tsQN2wARMwI7YETthJ+yMnbELdsGu2BW7YXfsnvFcDsDn8XnsjTVFH+yLfbEfJuUYgC/ii/gSDsKX8WV8BZNwCA7FV/FVfA2H40kcgSNxFI7CquJNHINjkcR4TMZknIgTcRJOwsxE38GpmILTcDpOxxk4E2fiezgb38f3cS7OxfmYiqm4ABdiGqbhIjyF6bgYl+BSXIbLcRmuxFW4EtfgWlyD63E9bsSNuBk341bcittxO36MCgA/wd24G5NwL+7FfbgP9+N+PIAHMAMz8CAexEN4CA/jYTyCR/AoHsPjeAxP4Ak8iafwNJ7Gs3gWz+Ez8V81/rjE6iQQmZRQIkbEiFgRK3KJXCK3yC3yiDwiIiIiTsSJfCKfyC/yi4KioIgX8aKwKCyMMIJEGAMAIiqiopgoJoqL4qKkKCmccKKMKCPKirKinCgnyoubRQVxi6goKom2roqoIqqKdq66uE3UEDVETVFL1BZ1RB1RV9QV9UQ9UV/UFw1EA3GvuE80FH1wAD4gMivTRAzBpmIoNhPNhbz4CdZaDMc2oq1oJx4TI3EEdhCtXYJ4UnQUY7CT+JsYi0+LLmI8dhXPim6iu+ghnhM9RRvXS/QWk7GP6CumYj/RXwwQL4oZWEu8h7Nz1haviCQxRAwVr4r5+JoYLl4XI8RIMUq8IUaLN8UYMVaME+NFspggJoq3xCTxtpgs3hFTxFSRIqaJ6eJdMUPMFLPEe2K2eF/MEXPFPDFfpIoPxAKxUKSJD8Ui8ZFIF4vFErFULBPLxQqxUqwSq8UasVasE+vFBrFRbBKbxRYRC9vEdrFDfCx2ik/ELrFb7BGfir3iM7FPfC72iy/EAfGlyBBfiYPia3FIfCMOi2/FEfGdOCqOiePie3FC/CBOilPitDgjzoofxTnxkzgvvACJUkgplQxkjMwhY2VOmUteIXPL4OKze5WMk1fLfPIamV8WkAVlIRkvr5WFpZZGWkkylEVkURmV18li8npZXJaQJWUp6WRpWUbeIMvKG2U5eZMsL2+WFeQtsqKsJCvLKvJWWVVWkxC5sI+aspasLevIO2Qi3CnrybtkfXm3bCDvkffK+2RDeb9sJB+QjeWDsol8SDaVD8tmsrlsIVvKVvIR2Vo+KtvItrKdfEy2l4/LDvIJmSCflB2lv/gSeVp2kc/IrvJZ2U12lz3kT/K89LKX7C2hD8i+8gXZT/aXA2IBQL4kB8mX5WD5ikySQ+RQ+aocJl+Tw+XrcoQcKUfJN+Ro+aYcI8fKcXK8TJYT5ET5lpwk35aT5TtyipwqU+Q0OUAO/HmkWVL+bv+3fqP/4J/3vlFukpvlFrlVbpPb5Q75sdwpd8pdcpfcI/fIvXKv3Cf3yf1yvzwgD8gMmSEPyoPykDwkD8vD8og8Io/KY/KM/F6ekD/Ik/KUPCXPyLPyrDx38TkAhUooqZQKVIzKoWJVTpVLXaFyqytVHpVXRdRVKk5drfKpa1R+VSBnQVVIxatrVWGllVFWkQpVEVVURdV1ePEFo0qqUsqp0qqMuuEf+6v/ob8qpq5XxVWJX/TPyi/xn+TXSrVSrVVr1Ua1Ue1UO9VetVcdVAeVoBJUR9VRdVKdVGfVWXVRXVRX1TXz9aB6qB6qp+qpeqleKlElqr7qBdVP9VcD1ItqoHpJDVKD1GA1WCWpJDVUDVXD1DA1XA1XI3KAGqVGqdFqtBqjxqhxapxKVslqopqoJqlJarKarKaoKSpFpajparqaoWaoWWqWmq1mqzlqjpqn5qlUlaoWqAUqTaWpRWqRSleL1WK1VC1Vy9VytVKtVKvVarVWrVXr1XqVrjapTWqL2qK2qW1qh9qhdqqdapfYpfaoPWqv2qv2qX1qv9qvDqgDKkNlqIPqoDqkDqnD6rA6oo6oo+qoOq6OqxPqhDqpTqrT6rQ6q86qc+qcOq/OZ077AhGIQAUqiAligtggNsgV5ApyB7mDPEGeIBJEgrggLsgXXBPkDwoEBYNCQXxwbVA40IEJbCAuFj0aXBcUC64PigclgpJBqcAFpYMywQ1B2eDGoFxwU1A+uDmoENwSVAwqBZWDKsGtQdWgWlA9uC2oEdwe1AxqBbWDOsEdQd3gzqBecFdQP7g7aBDcE9wb3Bc0DO4PGgUPBI2DB4MmwUNB0+DhoFnQPGgRtAxa/aXje3+ywKOul+6tE3Uf3Ve/oPvp/nqAflEP1C/pQfplPVi/opP0ED1Uv6qH6df0cP26HqFH6lH6DT1av6nH6LF6nB6vk/UEPVG/pSfpt/Vk/Y6eoqfqFD1NT9fv6hl6pp6l39Oz9ft6jp6r5+n5OlV/oBfohTpNf6gX6Y90ul6sl+ileplerlfolXqVXq3X6LV6nV6vN+iNepPerLforXqb3q536I/1Tv2J3qV36z36U71Xf6b36c/1fv2FPqC/1Bn6K31Qf60P6W/0Yf2tPqK/00f1MX1cf69P6B/0SX1Kn9Zn9Fn9oz6nf9Lntc+c3Gd+vRtllIkxMSbWxJpcJpfJbXKbPCaPiZiIiTNxJp/JZ/Kb/KagKWjiTbwpbAqbTGTIFDFFTNRETTFTzBQ3xU1JU9I440wZU8aUNWVNOVPOlDflTQVTwVQ0FU1lU9ncam411Uw1c5u5zdxubje1TC1Tx9QxdU1dU8/UM/VNfdPANDD3mntNQ9PQNDKNTGPT2DQxTUxT09Q0M81MC9PCtDKtTGvT2rQxbUw70860N+1NB9PBJJgE09F0NJ1MJ9PZdDZdTBfT1XQ13Uw308P0MD1NT9PLXPwRdO++pp/pZwaYAWagGWgGmUFmsBlskkySGWqGmmFmmBluhpsRZqQZlTlRNW+aMWasGWfGm2STbCaaiWaSmWQmm8lmipliUkyKmW6mmxlmhpllZpnZZraZY+aYeWaeSTWpZoFZYNJMmllkFpl0k26WmCVmmVlmVpgVZpVZZdaYNWYdrDMbzAazyWwyW8wWs81sMzvMDrPT7DS7zC6zx+wxe81es8/sM/vNfnPAHDAZJsMcNAfNIXPIHDaHzRFzxBw1R81xc9ycMCfMSXPSnDanzVlT4OL3pTexNqfNZa+wue2VNo/Na/8xLmgL2Xh7rS1stc1vC/wiNtba4raELWlLWWdL2zL2hl/FFW0lW9lWsbfaqraarf6ruK6909azd9n69m5bx97xi7iBvcdmzk4aIgLY5raxbWmb2IdsU/uwbWab2xa2pW1vH7cd7BM2wT5pO9qnfhUvsAvtKrvarrFr7S672562Z+wh+409a3+0vWxvO9C+ZAfZl+1g+4pNskN+FY+yb9jR9k07xo614+z4X8VT7FSbYqfZ6fZdO8PO/FWcaj+ws22anWPn2nl2/s9xZk5p9kO7yH5k020AS+xSu8wutyvsyqxcfV673m6wG+1O+4ndYrfabXa73ZE1Eba77R77qd1rP7MH7dd2v/3CHrCHbYb96uc48/gO22/tEfudPWqP2eP2e3vC/qCyemce+/f2J3veeguEBCRJUUAxlINiKSfloisoN11JeSgvRegqiqOrKR9dQ/mpABWkQhRP11Jh0mTIElFIRagoRek6ykqvJJUiR6WpDN1AZelGKkc3UXm6mSrQLVSRKlFlqkK3UlWqRtXpNqpBt1NNqkW1qQ7dQXXpTqpHd1F9upsa0D10L91HDel+akQPUGN6kJrQQ9SUHqZm1JxaUEtqRY9Qa3qU2lBbakePUXt6nDrQE5RAT1JHeoo60d+oMz1NXegZ6krPUjfqTj3oOepJz1Mv6k2J1If60gvUj/rTAHqRBtJLNIhepsH0CiXREBpKr9Iweo2G0+s0gkbSKHqDRtObNIbG0jgaT8k0gSbSWzSJ3qbJ9A5NoamUQtNoOr1LM2gmzaL3aDa9T3NoLs2j+ZRKH9ACWkhp9CEtoo8onRbTElpKy2g5raCVtIpW0xpaS+toPW2gjbSJNtMW2krbaDvtoI9pJ31Cu2g37aFPaS99Rkif0376gg7Ql5RBX9FB+poO0Td0mL71vek7OkrH6Dh9TyfoBzpJp+g0naGz9COdo5/oPHmCEEMRylCFQRgT5ghjw5xhrvCKMHd4ZZgnzBtGwqvCuPDqMF94TZg/LBAWDAuF8eG1YeFQhya0IYVhWCQsGkbD68Ji4fVh8bBEWDIsFbqwdFgmvCEsG94YlgtvCsuHN4cVwlvCimGl8KG7q4S3hlXDamH18LawRnh7WDOsFdYO64R3hHXDO8N64V1h/fDusFx4T3hveF/YMLw/bBQ+EDYOHwybhA+FTcOHw2Zh87BF2DJsFT4Stg4fDduEbcN24WNh+/DxsEP4RJgQPhl2DJ/6ef09C//5+sSwT9g3fCF8IfT+LjkvOj+aGv0guiC6MJoW/TC6KPpRND26OLokujS6LLo8uiK6Mroqujq6Jro2ui66ProhujHqfZ0c4NAJJ51ygYtxOVysy+lyuStcbnely+Pyuoi7ysW5q10+d43L7wq4gq6Qi6+WwxV22hlnHbnQFXFFXdRd54q5611xV8KVdKWcc6VdGdfStXKtXGv3qGvj2rp27jH3mHvcPe6ecE+4J11H95Tr5P7mOrunXRf3jHvGPeu6ue6uh3vO9XQT8lx4Tya6vq6v6+f6uQFugBvoBrpBbpAb7Aa7JJfkhrqhbpgb5oa74W6EG+FGuVFutBvtxrgxbpwb55JdspvoJrpJbpKb7Ca7KW6KS3Epbrqb7ma4Ga7qzAt7mePmuHlunkt1qW6By5wzprlFbpFLd+luiVvilrllboVb4Va5VW6NW+PWuXVug9vgNrlNbovb4ra5bW6H2+F2up1ul897YVC31+1z+9x+t98dcF+6DPeVO+i+dofcN+6w+9Ydcd+5o+6YO+6+dyfcD+6kO+VOuzPurPvRnXM/ufPOu+TIhMjEyFuRSZG3I5Mj72SOGkmJTItMj7wbmRGZGZkVeS8yO/J+ZE5kbmReZH4kNfJBZEFkYSQt8mFkUeSjSHpkcWRJZGlkWWR5xPtrt4S+iC/qo/46X8xf74v7Er6kL+WdL+3L+Bt8WX+jL+dv8uX9zb6Cv8VX9JV8Zf+wb+ab+xa+pW/lH/Gt/aO+jW/r2/nHfHv/uO/gn/AJ/knf0T/lO/m/+c7+ad/FP+O7+md9N9/d9/DP+Z7+ed/L9/aJvo/v61/w/Xx/P8C/6Af6l/wg/7If7F/xSX6IH+pf9cP8a364f92P8CP9qJg3/OisU2QY75P9BD/Rv+Un+bf9ZP+On+Kn+hQ/zU/37/oZfqaf5d/zs/37fo6f6+f5+T7Vf+AX+IU+zX/oF/mPfLpfnHVR2a/wK/0qv9qv8Wv9Or/eb/Ab/Sa/2W/xW/02v93v8B/7nf4Tv8vv9nv8p36v/8zv85/7/f4Lf8B/6TP8V/6g/9of8t/4w/5bf8R/54/6Y/64/96f8D/4k/6UP+3P+LP+R3/O/+TP8/+sMcYYY4z9IRMuNcUv11y4nN/nN/qIv9u4LwBcubVQxt+vz5xRrst/od1fxLePAMCTvbs+kLXUrJmYmHhx23QJQdG5mfNuuHj3AYAYyIoBFkM7eBwSoC2U/c38+4vuZ+l3xo/eDJDr7/rEwqX40vifA2Dib4z/yGOjFlQIT8f9D+PPBShe9FKfnHApXgztfr6+0hbK/ZP8C7T+nfxzfpEM0Obv+uSGS/Gl/MvAo/AUJPxiS8YYY4wxxhhj7IL+onLnrPPPrF98/tb5eby61CcHXIp/7/ycMcYYY4wxxhhjl9/T3Xs88UhCQtvO//tG9d/fRv2xAWN+a1VT+FcT48a/1PAe4P8XDgD+5IAAmQ357zyKzf+WfSVdfOtkPZJ1B81lZ3wA/xml/Csal/FDiTHGGGOMMfZ/4tKk/5ePq8uVEGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxlg392Xu8wR+4S9/lPkbGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGPscvt/AQAA///TsfjR") r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4ea3, 0x0, @remote, 0x9}, 0x1c) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000019200)=@raw={'raw\x00', 0x8, 0x3, 0x4d8, 0x180, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x408, 0xffffffff, 0xffffffff, 0x408, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@loopback, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x158, 0x180, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@iprange={{0x68}, {@ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4=@multicast2, @ipv6=@loopback, @ipv6=@empty}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x538) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x9511, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xff8a}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 573.009081ms ago: executing program 2 (id=2509): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000021c0)={0xaa, 0x100}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa08, 0x0) 488.62729ms ago: executing program 2 (id=2510): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000400)={0x1, 0x0, [{0x4b564d01, 0x0, 0x1}]}) syz_kvm_setup_cpu$x86(r1, r0, &(0x7f0000fa7000/0x18000)=nil, &(0x7f0000000240)=[@text64={0x40, 0x0}], 0x1, 0x8, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 96.0537ms ago: executing program 3 (id=2511): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = gettid() timer_create(0x0, &(0x7f0000000300)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000340)) timer_settime(0x0, 0x0, &(0x7f0000000380)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) recvmmsg(r1, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0}, 0x92e6}], 0x1, 0x20, 0x0) 0s ago: executing program 2 (id=2512): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000140)='./file0\x00', 0x3, &(0x7f0000000180)={[{@user_xattr}, {@nobarrier}, {@norecovery}, {@errors_remount}, {@grpid}]}, 0x8, 0x638, &(0x7f00000001c0)="$eJzs3c9vVNUeAPDvnekv2vfeFPLynriQJsZAorS0gCHGRNgTgj92riotBCmUtDVaJLEkuDExbjQxceVC/AdcK4mJKxduXbhxZUiIIV2AITLm3pkp02mnP4aZ3tJ+PuEy99wzc8+5bb89Z07PuRPArjWU/leI2B8RV5OIUl1eV1QzhyrPW7x3/dzivfRYufzmn0lc/yhZqD9XUn0cqL7471IkvxQi9hVXljs7f+3S+NTU5Ew1PTJ3+erI7Py1wxcvj1+YvDB5ZezlsRPHjx0/MXqk9YsrZv+WnL757vulT868/c1XD5PRb387k8TJeFR9QnptjS/vbb3kzFAMRbniQf3x9Ot64gnPvV3cL9V+Th5LGg+wbZ2v/jx2R8T/oxTFuu9mKT5+PdfKAR1VTqLWRgG7TtJS/Pe1vyLAFqv1Ayrv7Svb+r2GQod7JcBWuHuqMgBQif3uiKjEf6lcvp+NDUZfNjbQv5gsG+dJIuIJRuaWpGX8/OOZm+kWDeNwy4YNv2hDYcAyCzeyUe5aqNW1/0kWm4PRl6X6FwvL4r9Qt6XH32ix/KGG9Mb6H0A7LNyIiGeq7X/P5uJ/qC7+32mxfPEPAAAAAAAA7XP7VES8tNr8v0LU5v/89F253Dj/ZyAiTrah/PX//le4U91J2lAcUOfuqYhXV53/uzTHd7BYTf07mw/QnZy/ODV5JCL+ExGHors3TY82nLd+hvDhT/d92az8+vl/6ZaWX5sLWD3Tna6GhbgT43PjT3rdQMTdGxHPZvN/D1SPLJ//k7b/ySrzf9P4vrrBMva9cOtss7z14x/olPLXEQdXbf8fd7eTte/PMZL1B0ZqvYKVnvvws++blS/+IT9p+99fif+eWD3+e5P6+/XMbu78PRFxdL6r3Cy/1f5/T/JWMRay89cWMc7NjEb0JKeLtXJTH4zPzc2Mba7OsFPV4iF7HK3E/6Hn1x7/W+r/18XhnohY2GCZ/3s08HuzPO0/5CeN/4m1+/+Dy9v/ze+M3Rr8oUnxydkNtf/Hsjb9UPWI8T+ot/J+HBsN0FyqCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABPuUJE/CuSwvDSfqEwPBwxEBH/jf7C1PTs3Ivnp9+7MpHmZZ//X6h90m+pkk5qn/8/GBHdEZGmx6rpWv7RiNgbEZ8X92Tp4XPTUxN5XzwAAAAAAAAAAAAAAAAAAABsEwPZmv9yb+P6/9QfxbxrB3RcV/VRvMPu09XyK8u9ba0IsOVaj3/gabfx+O/uaD2Ardc8/h88LGe2tDrAFtL/h92rxfj35wLYAbT/sFttcEyvr9P1APKg/QcAAAAAgB1l74HbvyYRsfDKnmxL9VTzTPaHna2QdwWA3JjDC7tX13TeNQDy0sp7/P4O1APIT7K099eqi/2bz/5POlMhAAAAAAAAAAAAAGCFg/ut/4fdau31/+b2w062xvr/1YLf7QJgB2n+0R/aftjpvMcHknV+EVj/DwAAAAAAAAAAAADbQN+1S+NTU5Mzs/NP385rLbyqN+/KL4xvhy9de3cedebM3RGxPS6wXTtJRNSORFfzJ9duwZFjVXP+vQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACz5JwAA//9kxidU") openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(0xffffffffffffffff, r0) ioctl$BTRFS_IOC_LOGICAL_INO_V2(0xffffffffffffffff, 0xc038943b, &(0x7f00000000c0)={0x0, 0x0, '\x00', 0x7f0aa8ade1217b54, 0x0}) quotactl$Q_QUOTAON(0xffffffff80000200, &(0x7f0000000f00)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000f40)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') kernel console output (not intermixed with test programs): 788] usb 2-1: USB disconnect, device number 6 [ 357.341312][T12796] fido_id[12796]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 357.404939][T11212] usb 3-1: Using ep0 maxpacket: 8 [ 357.429192][T11212] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 357.454944][T11212] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 357.480188][T11089] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 357.494988][T11212] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 357.566840][T11212] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 357.606950][T11212] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 357.648256][T11212] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 357.674804][T11212] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 357.778921][T12798] loop6: detected capacity change from 0 to 32768 [ 357.833921][T12798] XFS (loop6): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4 [ 357.926078][T11212] usb 3-1: GET_CAPABILITIES returned 0 [ 357.933011][T11212] usbtmc 3-1:16.0: can't read capabilities [ 357.982863][T12798] XFS (loop6): Ending clean mount [ 358.030620][T12798] XFS (loop6): Quotacheck needed: Please wait. [ 358.149417][T11212] usb 3-1: USB disconnect, device number 20 [ 358.165989][T12798] XFS (loop6): Quotacheck: Done. [ 358.369923][T12838] loop9: detected capacity change from 0 to 33280 [ 358.397609][T12838] EXT4-fs (loop9): encrypted files will use data=ordered instead of data journaling mode [ 358.456709][T12838] EXT4-fs (loop9): ext4_check_descriptors: Checksum for group 0 failed (35405!=33349) [ 358.477206][T10409] XFS (loop6): Unmounting Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4 [ 358.510263][T12838] EXT4-fs (loop9): orphan cleanup on readonly fs [ 358.575332][T12838] EXT4-fs (loop9): 1 truncate cleaned up [ 358.583550][T12838] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 358.600574][T11212] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 358.738876][T11089] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 358.795464][T11212] usb 3-1: Using ep0 maxpacket: 8 [ 358.836646][T11212] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 358.865524][T11212] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 358.904987][T11212] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 358.945013][T11212] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 358.965050][T12854] netlink: 31 bytes leftover after parsing attributes in process `syz.1.1875'. [ 358.986837][T11212] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 359.014731][T12854] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1875'. [ 359.035004][T11212] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 359.073651][T11212] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.319400][T11212] usb 3-1: usb_control_msg returned -71 [ 359.328666][T11212] usbtmc 3-1:16.0: can't read capabilities [ 359.371960][T11212] usb 3-1: USB disconnect, device number 21 [ 359.649078][T12883] "syz.1.1883" (12883) uses obsolete ecb(arc4) skcipher [ 359.747716][T12890] loop1: detected capacity change from 0 to 32896 [ 359.798782][T12890] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 359.827324][T12890] ext4 filesystem being mounted at /41/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 360.214320][T12910] vlan2: entered promiscuous mode [ 360.240249][T12006] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 360.257546][T12910] bridge0: entered promiscuous mode [ 360.275236][T12910] vlan2: entered allmulticast mode [ 360.292126][T12910] bridge0: entered allmulticast mode [ 360.325561][T12910] bridge0: port 3(vlan2) entered blocking state [ 360.360544][T12910] bridge0: port 3(vlan2) entered disabled state [ 360.370972][ T52] Bluetooth: hci1: unexpected subevent 0x0e length: 12 < 15 [ 360.392993][T12917] loop1: detected capacity change from 0 to 256 [ 360.488152][T12917] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 360.748382][T12926] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 361.185263][T10118] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 361.199015][T12932] loop6: detected capacity change from 0 to 32768 [ 361.209265][T12932] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop6 scanned by syz.6.1896 (12932) [ 361.270078][T12932] BTRFS info (device loop6): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 361.323205][T12932] BTRFS info (device loop6): using sha256 (sha256-avx2) checksum algorithm [ 361.369496][T12932] BTRFS info (device loop6): using free space tree [ 361.407312][T10118] usb 10-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 361.425329][T10118] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 361.551151][T12932] BTRFS info (device loop6): enabling ssd optimizations [ 361.582012][T12932] BTRFS info (device loop6): auto enabling async discard [ 361.820670][T12977] loop2: detected capacity change from 0 to 128 [ 361.960636][T12976] syz.2.1900: attempt to access beyond end of device [ 361.960636][T12976] loop2: rw=2049, sector=138, nr_sectors = 8 limit=128 [ 362.481586][T10118] usb 10-1: ATUSB: AT86RF231 version 1 [ 362.691961][T10118] usb 10-1: Firmware version (0.0) predates our first public release. [ 362.717037][T10409] BTRFS info (device loop6): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 362.732498][T10118] usb 10-1: Please update to version 0.2 or newer [ 362.820518][T10118] usb 10-1: USB disconnect, device number 6 [ 363.308469][T13017] loop2: detected capacity change from 0 to 128 [ 363.429714][T10513] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 363.558548][T13025] FAULT_INJECTION: forcing a failure. [ 363.558548][T13025] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 363.627334][T13025] CPU: 1 PID: 13025 Comm: syz.6.1902 Not tainted syzkaller #0 [ 363.636341][T13025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 363.648435][T13025] Call Trace: [ 363.652382][T13025] [ 363.655907][T13025] dump_stack_lvl+0x18c/0x250 [ 363.661551][T13025] ? show_regs_print_info+0x20/0x20 [ 363.667820][T13025] ? load_image+0x420/0x420 [ 363.673254][T13025] ? __lock_acquire+0x7eb0/0x7eb0 [ 363.679318][T13025] should_fail_ex+0x394/0x4c0 [ 363.684972][T13025] prepare_alloc_pages+0x1e1/0x5b0 [ 363.691144][T13025] __alloc_pages+0x134/0x460 [ 363.696682][T13025] ? zone_statistics+0x170/0x170 [ 363.702637][T13025] ? handle_mm_fault+0xe6/0x4a40 [ 363.708603][T13025] ? __lock_acquire+0x7eb0/0x7eb0 [ 363.714663][T13025] __folio_alloc+0x10/0x20 [ 363.719983][T13025] vma_alloc_folio+0x474/0x8f0 [ 363.725736][T13025] ? handle_mm_fault+0xe6/0x4a40 [ 363.731701][T13025] handle_mm_fault+0x1ab0/0x4a40 [ 363.737652][T13025] ? handle_mm_fault+0xe6/0x4a40 [ 363.743608][T13025] ? numa_migrate_prep+0x350/0x350 [ 363.749770][T13025] ? lock_chain_count+0x20/0x20 [ 363.755618][T13025] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 363.761984][T13025] do_user_addr_fault+0xeb7/0x13e0 [ 363.768160][T13025] exc_page_fault+0x64/0x100 [ 363.773698][T13025] asm_exc_page_fault+0x26/0x30 [ 363.779557][T13025] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 363.786552][T13025] Code: 75 f1 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb c9 a4 c3 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 29 f8 48 01 [ 363.810106][T13025] RSP: 0018:ffffc90004e1fbb0 EFLAGS: 00050206 [ 363.817409][T13025] RAX: ffffffff842f2b01 RBX: 0000000000001000 RCX: 0000000000000080 [ 363.826987][T13025] RDX: 0000000000000000 RSI: ffff88807ba5cf80 RDI: 0000200000003000 [ 363.835192][ T5788] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 363.836543][T13025] RBP: ffffc90004e1fcf0 R08: ffff88807ba5cfff R09: 1ffff1100f74b9ff [ 363.855188][T13025] R10: dffffc0000000000 R11: ffffed100f74ba00 R12: 0000200000003080 [ 363.864782][T13025] R13: ffff88807ba5c000 R14: 0000200000002080 R15: ffff88807ba5c000 [ 363.874374][T13025] ? _copy_to_user+0x1/0xa0 [ 363.879803][T13025] _copy_to_user+0x85/0xa0 [ 363.885120][T13025] pagemap_read+0x4e4/0x790 [ 363.890559][T13025] ? clear_refs_write+0xa20/0xa20 [ 363.896608][T13025] ? common_file_perm+0x198/0x1f0 [ 363.902668][T13025] ? fsnotify_perm+0x271/0x5e0 [ 363.908396][T13025] ? clear_refs_write+0xa20/0xa20 [ 363.914431][T13025] vfs_read+0x298/0x990 [ 363.919565][T13025] ? kernel_read+0x1e0/0x1e0 [ 363.925098][T13025] ? __fget_files+0x28/0x460 [ 363.930618][T13025] ? __fget_files+0x3fc/0x460 [ 363.936235][T13025] ? __fdget+0x180/0x210 [ 363.941343][T13025] ? __x64_sys_pread64+0xf7/0x220 [ 363.947401][T13025] __x64_sys_pread64+0x198/0x220 [ 363.953354][T13025] ? ksys_pread64+0x1c0/0x1c0 [ 363.958993][T13025] ? lockdep_hardirqs_on+0x98/0x150 [ 363.965250][T13025] do_syscall_64+0x55/0xb0 [ 363.970583][T13025] ? clear_bhb_loop+0x40/0x90 [ 363.976213][T13025] ? clear_bhb_loop+0x40/0x90 [ 363.981846][T13025] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 363.988944][T13025] RIP: 0033:0x7f4639da8fd9 [ 363.994257][T13025] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 364.017801][T13025] RSP: 002b:00007f463ac84028 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 [ 364.027915][T13025] RAX: ffffffffffffffda RBX: 00007f463a025fa0 RCX: 00007f4639da8fd9 [ 364.037496][T13025] RDX: 0000000000019000 RSI: 0000200000001380 RDI: 0000000000000003 [ 364.047072][T13025] RBP: 00007f4639e37fed R08: 0000000000000000 R09: 0000000000000000 [ 364.056656][T13025] R10: 0000001000000300 R11: 0000000000000246 R12: 0000000000000000 [ 364.066239][T13025] R13: 00007f463a026038 R14: 00007f463a025fa0 R15: 00007ffd844f01f8 [ 364.075839][T13025] [ 364.096945][ T5788] usb 3-1: Using ep0 maxpacket: 32 [ 364.157283][ T5788] usb 3-1: config 0 has no interfaces? [ 364.163915][ T5788] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 364.207400][ T5788] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 364.263149][ T5788] usb 3-1: config 0 descriptor?? [ 364.263750][T13039] .: renamed from bond0 (while UP) [ 364.285460][T13039] FAULT_INJECTION: forcing a failure. [ 364.285460][T13039] name failslab, interval 1, probability 0, space 0, times 0 [ 364.329025][T13039] CPU: 0 PID: 13039 Comm: syz.6.1911 Not tainted syzkaller #0 [ 364.338036][T13039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 364.350119][T13039] Call Trace: [ 364.354071][T13039] [ 364.357600][T13039] dump_stack_lvl+0x18c/0x250 [ 364.363247][T13039] ? show_regs_print_info+0x20/0x20 [ 364.369510][T13039] ? load_image+0x420/0x420 [ 364.374942][T13039] ? __might_sleep+0xe0/0xe0 [ 364.380469][T13039] ? __lock_acquire+0x7eb0/0x7eb0 [ 364.386521][T13039] should_fail_ex+0x394/0x4c0 [ 364.392159][T13039] should_failslab+0x9/0x20 [ 364.397573][T13039] slab_pre_alloc_hook+0x59/0x300 [ 364.403622][T13039] ? kobject_get_path+0xc3/0x2c0 [ 364.409569][T13039] ? kobject_get_path+0xc3/0x2c0 [ 364.415508][T13039] __kmem_cache_alloc_node+0x53/0x260 [ 364.421961][T13039] ? kobject_get_path+0xc3/0x2c0 [ 364.427873][T13039] __kmalloc+0xa7/0x240 [ 364.432848][T13039] ? slab_free_freelist_hook+0x154/0x240 [ 364.439595][T13039] kobject_get_path+0xc3/0x2c0 [ 364.445306][T13039] kobject_rename+0x194/0x4f0 [ 364.450899][T13039] ? kobject_init_and_add+0x1a0/0x1a0 [ 364.457326][T13039] ? sysfs_rename_link_ns+0x17f/0x1b0 [ 364.463758][T13039] device_rename+0x15d/0x1e0 [ 364.469250][T13039] dev_change_name+0x308/0x8e0 [ 364.474959][T13039] ? end_current_label_crit_section+0x170/0x170 [ 364.482441][T13039] ? dev_ioctl+0x5dc/0x1140 [ 364.487830][T13039] ? __lock_acquire+0x7eb0/0x7eb0 [ 364.493839][T13039] ? dev_alloc_name+0x1d0/0x1d0 [ 364.499646][T13039] ? full_name_hash+0x92/0xe0 [ 364.505246][T13039] ? dev_ifsioc+0x316/0xc40 [ 364.510640][T13039] dev_ioctl+0x5ec/0x1140 [ 364.515819][T13039] sock_do_ioctl+0x239/0x310 [ 364.521311][T13039] ? sock_show_fdinfo+0xb0/0xb0 [ 364.527128][T13039] sock_ioctl+0x5be/0x7e0 [ 364.532306][T13039] ? sock_poll+0x460/0x460 [ 364.537595][T13039] ? bpf_lsm_file_ioctl+0x9/0x10 [ 364.543509][T13039] ? security_file_ioctl+0x80/0xa0 [ 364.549640][T13039] ? sock_poll+0x460/0x460 [ 364.554921][T13039] __se_sys_ioctl+0xfd/0x170 [ 364.560451][T13039] do_syscall_64+0x55/0xb0 [ 364.565742][T13039] ? clear_bhb_loop+0x40/0x90 [ 364.571336][T13039] ? clear_bhb_loop+0x40/0x90 [ 364.576930][T13039] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 364.583985][T13039] RIP: 0033:0x7f4639da8fd9 [ 364.589264][T13039] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 364.612770][T13039] RSP: 002b:00007f463ac84028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 364.622844][T13039] RAX: ffffffffffffffda RBX: 00007f463a025fa0 RCX: 00007f4639da8fd9 [ 364.632387][T13039] RDX: 0000200000000140 RSI: 0000000000008923 RDI: 0000000000000003 [ 364.641940][T13039] RBP: 00007f4639e37fed R08: 0000000000000000 R09: 0000000000000000 [ 364.651490][T13039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 364.661034][T13039] R13: 00007f463a026038 R14: 00007f463a025fa0 R15: 00007ffd844f01f8 [ 364.670595][T13039] [ 364.759960][T10118] usb 3-1: USB disconnect, device number 22 [ 364.975052][ T5788] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 365.054369][T13056] loop6: detected capacity change from 0 to 1024 [ 365.189504][ T5788] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 365.203512][ T5788] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 365.225394][ T5788] usb 2-1: Product: syz [ 365.234662][T13059] hfsplus: request for non-existent node 62977 in B*Tree [ 365.237567][ T5788] usb 2-1: Manufacturer: syz [ 365.252754][ T5788] usb 2-1: SerialNumber: syz [ 365.271708][T13059] hfsplus: request for non-existent node 62977 in B*Tree [ 365.312953][ T5919] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 365.448175][T12456] hfsplus: b-tree write err: -5, ino 3 [ 365.548912][T13068] device-mapper: table: 248:4: adding target device (start sect 0 len 5320) caused an alignment inconsistency [ 365.571915][ T5788] usb 2-1: USB disconnect, device number 7 [ 365.663335][T13075] loop6: detected capacity change from 0 to 256 [ 366.038501][T13088] netlink: 'syz.6.1923': attribute type 11 has an invalid length. [ 366.395750][ T5919] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 366.424020][ T5919] ath9k_htc: Failed to initialize the device [ 366.441106][ T5788] usb 2-1: ath9k_htc: USB layer deinitialized [ 366.475943][T13109] warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow [ 366.805312][ T5788] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 367.064897][ T5788] usb 2-1: Using ep0 maxpacket: 8 [ 367.090487][ T5788] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 367.143609][ T5788] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 367.154574][ T5788] usb 2-1: Product: syz [ 367.165025][ T5788] usb 2-1: Manufacturer: syz [ 367.170600][ T5788] usb 2-1: SerialNumber: syz [ 367.189422][ T5788] usb 2-1: config 0 descriptor?? [ 367.462126][ T5788] radio-si470x 2-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 367.503143][ T5788] radio-si470x: probe of 2-1:0.0 failed with error -5 [ 367.543827][ T5788] usb 2-1: USB disconnect, device number 8 [ 367.738048][T13151] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 368.498893][T13169] loop8: detected capacity change from 0 to 7 [ 368.545373][T13169] loop8: [CUMANA/ADFS] p1 [Linux] p2 [ADFS] p1 [Linux] p2 [ 368.623450][T13169] loop8: partition table partially beyond EOD, truncated [ 368.664208][T13169] loop8: p1 size 1905483274 extends beyond EOD, truncated [ 368.746791][T13169] loop8: p2 start 121280928 is beyond EOD, truncated [ 368.880688][T13160] loop1: detected capacity change from 0 to 131072 [ 368.888547][ C0] sched: RT throttling activated [ 368.930201][T13160] F2FS-fs (loop1): invalid crc value [ 368.952703][T13160] F2FS-fs (loop1): Found nat_bits in checkpoint [ 369.002985][T10513] udevd[10513]: inotify_add_watch(7, /dev/loop8p1, 10) failed: No such file or directory [ 369.029145][T13160] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 369.078374][ T28] kauditd_printk_skb: 3 callbacks suppressed [ 369.078388][ T28] audit: type=1800 audit(1794450778.858:141): pid=13160 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1941" name="bus" dev="loop1" ino=10 res=0 errno=0 [ 369.895422][ T27] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 370.094944][ T27] usb 10-1: Using ep0 maxpacket: 8 [ 370.117403][ T27] usb 10-1: config index 0 descriptor too short (expected 74, got 45) [ 370.137774][ T27] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 370.192242][ T27] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 370.244932][ T27] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 370.273538][ T27] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 370.315602][ T27] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 370.364952][ T27] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 370.388311][ T27] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 370.601873][T13232] tipc: Started in network mode [ 370.613669][T13232] tipc: Node identity ac1414aa, cluster identity 4711 [ 370.625974][ T27] usb 10-1: GET_CAPABILITIES returned 0 [ 370.632710][ T27] usbtmc 10-1:16.0: can't read capabilities [ 370.640733][T13232] tipc: Enabled bearer , priority 10 [ 370.652681][T13235] IPv6: NLM_F_CREATE should be specified when creating new route [ 370.662888][T13235] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 370.673419][T13235] IPv6: NLM_F_CREATE should be set when creating new route [ 370.844773][T13199] usbtmc 10-1:16.0: send_request_dev_dep_msg_in returned -71 [ 370.882393][T11212] usb 10-1: USB disconnect, device number 7 [ 371.513573][T13272] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1971'. [ 371.745125][T11212] tipc: Node number set to 2886997162 [ 371.865597][T12458] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0xa [ 372.140946][T13298] nftables ruleset with unbound set [ 372.351209][ T28] audit: type=1326 audit(1794450782.118:142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13304 comm="syz.1.1979" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f341fda8fd9 code=0x0 [ 372.638433][T13318] loop9: detected capacity change from 0 to 34816 [ 372.673560][T13318] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 372.748028][T13318] CacheFiles: mkdir cache failed with error -105 [ 372.770684][T13318] CacheFiles: Failed to register: -105 [ 372.861390][T11089] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 372.886248][ T27] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 373.086812][ T27] usb 7-1: config 1 has an invalid descriptor of length 211, skipping remainder of the config [ 373.118074][ T27] usb 7-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 373.143895][ T27] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 78, changing to 10 [ 373.161188][ T27] usb 7-1: New USB device found, idVendor=06f8, idProduct=b000, bcdDevice= 0.40 [ 373.184873][ T27] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 373.194521][ T27] usb 7-1: Product: syz [ 373.214891][ T27] usb 7-1: Manufacturer: syz [ 373.220460][ T27] usb 7-1: SerialNumber: syz [ 373.360278][T13349] loop1: detected capacity change from 0 to 256 [ 373.399858][T13349] exFAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 373.419486][T13349] exFAT-fs (loop1): Medium has reported failures. Some data may be lost. [ 373.429932][ T5788] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 373.449692][T13349] exFAT-fs (loop1): failed to load upcase table (idx : 0x0000ff98, chksum : 0xc64c91aa, utbl_chksum : 0xe619d30d) [ 373.468741][T13349] exFAT-fs (loop1): failed to load alloc-bitmap [ 373.482263][T13349] exFAT-fs (loop1): failed to recognize exfat type [ 373.512061][ T27] usb 7-1: 0:2 : does not exist [ 373.570598][ T27] usb 7-1: USB disconnect, device number 13 [ 373.636150][ T5788] usb 10-1: Using ep0 maxpacket: 32 [ 373.648595][ T5788] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 373.677482][ T5788] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 373.700779][ T5788] usb 10-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 373.717150][ T5788] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 373.744729][ T5788] usb 10-1: config 0 descriptor?? [ 373.763475][ T5788] hub 10-1:0.0: USB hub found [ 373.785503][ T5870] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 373.942883][T13362] FAULT_INJECTION: forcing a failure. [ 373.942883][T13362] name failslab, interval 1, probability 0, space 0, times 0 [ 373.962980][ T5788] hub 10-1:0.0: config failed, can't read hub descriptor (err -22) [ 373.965609][T13362] CPU: 1 PID: 13362 Comm: syz.2.1990 Not tainted syzkaller #0 [ 373.981453][T13362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 373.993540][T13362] Call Trace: [ 373.997488][T13362] [ 374.001009][T13362] dump_stack_lvl+0x18c/0x250 [ 374.006662][T13362] ? show_regs_print_info+0x20/0x20 [ 374.012924][T13362] ? load_image+0x420/0x420 [ 374.018347][T13362] ? __might_sleep+0xe0/0xe0 [ 374.019222][ T5870] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 374.023863][T13362] ? __lock_acquire+0x7eb0/0x7eb0 [ 374.023899][T13362] should_fail_ex+0x394/0x4c0 [ 374.047653][T13362] should_failslab+0x9/0x20 [ 374.053111][T13362] slab_pre_alloc_hook+0x59/0x300 [ 374.057000][ T5870] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 374.059181][T13362] ? snd_pcm_hw_rule_add+0x18c/0x7f0 [ 374.059212][T13362] ? snd_pcm_hw_rule_add+0x18c/0x7f0 [ 374.059232][T13362] __kmem_cache_alloc_node+0x53/0x260 [ 374.059254][T13362] ? snd_pcm_hw_rule_add+0x18c/0x7f0 [ 374.059273][T13362] __kmalloc_node_track_caller+0xa4/0x230 [ 374.059305][T13362] krealloc+0x86/0x120 [ 374.059330][T13362] snd_pcm_hw_rule_add+0x18c/0x7f0 [ 374.059352][T13362] ? snd_pcm_hw_rule_mulkdiv+0x2b0/0x2b0 [ 374.059372][T13362] ? snd_pcm_post_pause+0x290/0x290 [ 374.059389][T13362] ? __raw_spin_lock_init+0x45/0x100 [ 374.059414][T13362] ? snd_interval_ranges+0x300/0x300 [ 374.059438][T13362] ? snd_pcm_attach_substream+0x841/0xad0 [ 374.059470][T13362] snd_pcm_open_substream+0xef7/0x2540 [ 374.059510][T13362] ? snd_pcm_drop+0x250/0x250 [ 374.059544][T13362] snd_pcm_oss_open+0xf80/0x1c50 [ 374.059586][T13362] ? snd_pcm_oss_mmap+0x680/0x680 [ 374.059612][T13362] ? soundcore_open+0x274/0x4c0 [ 374.059646][T13362] ? do_task_dead+0xd0/0xd0 [ 374.059680][T13362] chrdev_open+0x58c/0x600 [ 374.059706][T13362] ? cd_forget+0x160/0x160 [ 374.059733][T13362] ? fsnotify_perm+0x3ed/0x5e0 [ 374.059758][T13362] do_dentry_open+0x880/0x14b0 [ 374.059786][T13362] ? cd_forget+0x160/0x160 [ 374.059814][T13362] path_openat+0x284f/0x3270 [ 374.059857][T13362] ? do_sys_openat2+0xda/0x1d0 [ 374.059879][T13362] ? __x64_sys_openat+0x139/0x160 [ 374.059905][T13362] ? verify_lock_unused+0x140/0x140 [ 374.059925][T13362] ? do_filp_open+0x430/0x430 [ 374.093877][ T5870] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 374.096132][T13362] do_filp_open+0x1f2/0x430 [ 374.096168][T13362] ? vfs_tmpfile+0x620/0x620 [ 374.096207][T13362] ? _raw_spin_unlock+0x28/0x40 [ 374.118748][ T5870] usb 2-1: SerialNumber: syz [ 374.120772][T13362] ? alloc_fd+0x590/0x640 [ 374.120812][T13362] do_sys_openat2+0x134/0x1d0 [ 374.193192][ T5788] hid-generic 0003:046D:C31C.000F: item fetching failed at offset 0/1 [ 374.198015][T13362] ? do_sys_open+0xe0/0xe0 [ 374.198056][T13362] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 374.223939][ T5788] hid-generic: probe of 0003:046D:C31C.000F failed with error -22 [ 374.226216][T13362] ? lock_chain_count+0x20/0x20 [ 374.226251][T13362] __x64_sys_openat+0x139/0x160 [ 374.226279][T13362] do_syscall_64+0x55/0xb0 [ 374.226301][T13362] ? clear_bhb_loop+0x40/0x90 [ 374.226322][T13362] ? clear_bhb_loop+0x40/0x90 [ 374.226345][T13362] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 374.226368][T13362] RIP: 0033:0x7f7cc09a8fd9 [ 374.226386][T13362] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 374.296406][ T5870] cdc_ether 2-1:1.0: skipping garbage [ 374.302888][T13362] RSP: 002b:00007f7cc18e3028 EFLAGS: 00000246 [ 374.352431][ T5870] usb 2-1: bad CDC descriptors [ 374.352640][T13362] ORIG_RAX: 0000000000000101 [ 374.352651][T13362] RAX: ffffffffffffffda RBX: 00007f7cc0c25fa0 RCX: 00007f7cc09a8fd9 [ 374.410831][T13362] RDX: 0000000000000000 RSI: 0000200000000400 RDI: ffffffffffffff9c [ 374.420411][T13362] RBP: 00007f7cc0a37fed R08: 0000000000000000 R09: 0000000000000000 [ 374.429994][T13362] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 374.439579][T13362] R13: 00007f7cc0c26038 R14: 00007f7cc0c25fa0 R15: 00007fffd74342e8 [ 374.449177][T13362] [ 374.565211][ T5788] usb 10-1: USB disconnect, device number 8 [ 374.595654][ T5870] usb 2-1: USB disconnect, device number 9 [ 374.732672][T13387] device-mapper: table: 248:6: striped: Couldn't parse stripe destination (-ENOENT) [ 374.744709][T13387] device-mapper: ioctl: error adding target to table [ 374.756296][T13387] device-mapper: table: 248:6: snapshot-origin: Cannot get target device (-ENOENT) [ 374.768997][T13387] device-mapper: ioctl: error adding target to table [ 375.142262][T13406] netlink: 8 bytes leftover after parsing attributes in process `syz.9.1996'. [ 375.475280][T13425] IPv6: NLM_F_CREATE should be specified when creating new route [ 375.502891][T13425] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 375.511654][T13425] IPv6: NLM_F_CREATE should be set when creating new route [ 375.538875][T13428] tipc: Started in network mode [ 375.565334][T13428] tipc: Node identity ac1414aa, cluster identity 4711 [ 375.575892][T13428] tipc: Enabled bearer , priority 10 [ 375.659718][T13432] device-mapper: table: 248:7: striped: Couldn't parse stripe destination (-ENOENT) [ 375.689485][T13432] device-mapper: ioctl: error adding target to table [ 375.731404][T13432] device-mapper: table: 248:7: snapshot-origin: Cannot get target device (-ENOENT) [ 375.767019][T13432] device-mapper: ioctl: error adding target to table [ 375.946124][T13446] loop1: detected capacity change from 0 to 33280 [ 375.969714][T13446] EXT4-fs: Ignoring removed nobh option [ 376.076631][T13446] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.2006: invalid indirect mapped block 256 (level 2) [ 376.217561][T13446] EXT4-fs (loop1): 2 truncates cleaned up [ 376.251439][T13446] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 376.311822][T13446] overlay: Unknown parameter 'fsname' [ 376.407442][T13445] EXT4-fs error (device loop1): ext4_validate_block_bitmap:430: comm syz.1.2006: bg 0: block 5: invalid block bitmap [ 376.460712][T13445] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 33 with error 28 [ 376.487591][T13445] EXT4-fs (loop1): This should not happen!! Data will be lost [ 376.487591][T13445] [ 376.505482][T13445] EXT4-fs (loop1): Total free blocks count 0 [ 376.535067][T13445] EXT4-fs (loop1): Free/Dirty block details [ 376.542365][T13445] EXT4-fs (loop1): free_blocks=0 [ 376.571122][T13445] EXT4-fs (loop1): dirty_blocks=33 [ 376.585907][ T5788] tipc: Node number set to 2886997162 [ 376.595021][T13445] EXT4-fs (loop1): Block reservation details [ 376.602237][T13445] EXT4-fs (loop1): i_reserved_data_blocks=33 [ 376.695987][T13473] IPv6: NLM_F_CREATE should be specified when creating new route [ 376.732986][T13473] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 376.741772][T13473] IPv6: NLM_F_CREATE should be set when creating new route [ 376.758364][T12006] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 376.966163][T13462] loop9: detected capacity change from 0 to 32768 [ 376.986717][T13462] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop9 scanned by syz.9.2011 (13462) [ 377.049764][T13462] BTRFS info (device loop9): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 377.088140][T13462] BTRFS info (device loop9): using sha256 (sha256-avx2) checksum algorithm [ 377.120167][T13462] BTRFS info (device loop9): using free space tree [ 377.173890][ T28] audit: type=1800 audit(1794450786.948:143): pid=13484 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.2026" name="console" dev="configfs" ino=34614 res=0 errno=0 [ 377.323703][T13462] BTRFS info (device loop9): enabling ssd optimizations [ 377.369681][T13462] BTRFS info (device loop9): auto enabling async discard [ 378.396552][T13512] loop6: detected capacity change from 0 to 131072 [ 378.415015][T13512] F2FS-fs (loop6): invalid crc value [ 378.464044][T13512] F2FS-fs (loop6): Found nat_bits in checkpoint [ 378.519879][T13512] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e4 [ 378.658815][ T28] audit: type=1800 audit(1794450788.428:144): pid=13512 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.2018" name="bus" dev="loop6" ino=10 res=0 errno=0 [ 378.735436][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.745410][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.223103][T13549] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2030'. [ 379.918470][T11089] BTRFS info (device loop9): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 380.915001][ T23] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 381.127933][ T23] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 381.177243][ T23] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 381.203050][ T23] usb 10-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 381.242723][ T23] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 381.306020][ T23] usb 10-1: config 0 descriptor?? [ 381.561604][T13618] FAULT_INJECTION: forcing a failure. [ 381.561604][T13618] name failslab, interval 1, probability 0, space 0, times 0 [ 381.578939][T13618] CPU: 0 PID: 13618 Comm: syz.6.2044 Not tainted syzkaller #0 [ 381.584564][T13617] loop1: detected capacity change from 0 to 34816 [ 381.587898][T13618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 381.587914][T13618] Call Trace: [ 381.587922][T13618] [ 381.587932][T13618] dump_stack_lvl+0x18c/0x250 [ 381.587965][T13618] ? show_regs_print_info+0x20/0x20 [ 381.587989][T13618] ? load_image+0x420/0x420 [ 381.588013][T13618] ? __lock_acquire+0x7eb0/0x7eb0 [ 381.638392][T13618] should_fail_ex+0x394/0x4c0 [ 381.644019][T13618] should_failslab+0x9/0x20 [ 381.649421][T13618] slab_pre_alloc_hook+0x59/0x300 [ 381.655446][T13618] ? legacy_init_fs_context+0x51/0xc0 [ 381.661886][T13618] __kmem_cache_alloc_node+0x53/0x260 [ 381.668318][T13618] ? legacy_init_fs_context+0x51/0xc0 [ 381.674750][T13618] kmalloc_trace+0x2a/0xe0 [ 381.680075][T13618] legacy_init_fs_context+0x51/0xc0 [ 381.686309][T13618] alloc_fs_context+0x618/0x7a0 [ 381.692122][T13618] __se_sys_fsopen+0xa0/0x2c0 [ 381.697722][T13618] do_syscall_64+0x55/0xb0 [ 381.703007][T13618] ? clear_bhb_loop+0x40/0x90 [ 381.708603][T13618] ? clear_bhb_loop+0x40/0x90 [ 381.714199][T13618] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 381.721258][T13618] RIP: 0033:0x7f4639da8fd9 [ 381.726574][T13618] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 381.750097][T13618] RSP: 002b:00007f463ac84028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 381.760185][T13618] RAX: ffffffffffffffda RBX: 00007f463a025fa0 RCX: 00007f4639da8fd9 [ 381.769764][T13618] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000140 [ 381.779316][T13618] RBP: 00007f4639e37fed R08: 0000000000000000 R09: 0000000000000000 [ 381.788863][T13618] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 381.798417][T13618] R13: 00007f463a026038 R14: 00007f463a025fa0 R15: 00007ffd844f01f8 [ 381.807980][T13618] [ 381.860644][T13617] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 381.893666][ T23] savu 0003:1E7D:2D5A.0010: hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.9-1/input0 [ 381.956267][T13617] CacheFiles: mkdir cache failed with error -105 [ 381.984489][T13617] CacheFiles: Failed to register: -105 [ 382.132161][T12006] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 382.174988][T11212] usb 10-1: USB disconnect, device number 9 [ 383.124926][T10117] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 383.337379][T10117] usb 3-1: Using ep0 maxpacket: 8 [ 383.366617][T10117] usb 3-1: config index 0 descriptor too short (expected 74, got 45) [ 383.384940][T10117] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 383.405389][T10117] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 383.419461][T10117] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 383.446160][T10117] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 383.471534][T10117] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 383.503610][T10117] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 383.538215][T10117] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 383.795645][T10117] usb 3-1: GET_CAPABILITIES returned 0 [ 383.802772][T10117] usbtmc 3-1:16.0: can't read capabilities [ 384.084258][T13658] usbtmc 3-1:16.0: send_request_dev_dep_msg_in returned -71 [ 384.117579][T10117] usb 3-1: USB disconnect, device number 23 [ 384.812980][T13706] loop1: detected capacity change from 0 to 32768 [ 384.829317][T13706] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by syz.1.2055 (13706) [ 384.897058][T13706] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 384.924512][T13706] BTRFS info (device loop1): using sha256 (sha256-avx2) checksum algorithm [ 384.973896][T13706] BTRFS info (device loop1): using free space tree [ 385.187796][T13706] BTRFS info (device loop1): enabling ssd optimizations [ 385.216079][T13706] BTRFS info (device loop1): auto enabling async discard [ 385.918728][ T52] Bluetooth: hci3: command 0x0406 tx timeout [ 386.520352][T13783] warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow [ 386.613070][T12006] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 387.283912][T13805] ip_tables: iptables: counters copy to user failed while replacing table [ 387.295005][ T5870] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 387.503313][ T5870] usb 3-1: config 1 has an invalid descriptor of length 211, skipping remainder of the config [ 387.539522][ T5870] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 387.565305][ T5870] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 78, changing to 10 [ 387.590103][ T5870] usb 3-1: New USB device found, idVendor=06f8, idProduct=b000, bcdDevice= 0.40 [ 387.615239][ T5870] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.635366][ T5870] usb 3-1: Product: syz [ 387.640412][ T5870] usb 3-1: Manufacturer: syz [ 387.661408][ T5870] usb 3-1: SerialNumber: syz [ 387.789825][T13825] warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow [ 387.917123][ T5870] usb 3-1: 0:2 : does not exist [ 388.024223][ T5870] usb 3-1: USB disconnect, device number 24 [ 389.550470][T13883] loop6: detected capacity change from 0 to 33280 [ 389.574481][T13883] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 389.760318][T13883] EXT4-fs (loop6): 1 truncate cleaned up [ 389.798295][T13883] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 390.520728][T10409] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 390.719562][ T9136] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.903856][ T9136] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.092325][ T9136] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.244772][ T9136] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.393679][T13925] bridge0: port 1(bridge_slave_0) entered disabled state [ 391.409919][T13925] bridge0: port 2(bridge_slave_1) entered disabled state [ 391.554019][T13921] rxe_eth0 speed is unknown, defaulting to 1000 [ 391.562093][T13928] netlink: 'syz.9.2108': attribute type 16 has an invalid length. [ 391.572267][T10117] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 391.602041][T13928] netlink: 'syz.9.2108': attribute type 17 has an invalid length. [ 391.660977][T13928] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 391.719501][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 391.733574][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 391.746734][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 391.775203][T10117] usb 2-1: Using ep0 maxpacket: 32 [ 391.781505][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 391.795486][ T52] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 391.804337][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 391.832908][T10117] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 391.861783][T10117] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 391.875682][T10117] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 391.886649][T10117] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 391.899998][T10117] usb 2-1: config 0 descriptor?? [ 391.921688][T10117] hub 2-1:0.0: USB hub found [ 391.962956][T13930] rxe_eth0 speed is unknown, defaulting to 1000 [ 392.167618][T10117] hub 2-1:0.0: config failed, can't read hub descriptor (err -22) [ 392.205830][ T9136] tipc: Disabling bearer [ 392.215505][ T9136] tipc: Left network mode [ 392.419308][T10117] hid-generic 0003:046D:C31C.0011: item fetching failed at offset 0/1 [ 392.430630][T10117] hid-generic: probe of 0003:046D:C31C.0011 failed with error -22 [ 392.472322][T13934] rxe_eth0 speed is unknown, defaulting to 1000 [ 392.791542][T10117] usb 2-1: USB disconnect, device number 10 [ 393.211245][T13934] chnl_net:caif_netlink_parms(): no params data found [ 393.364714][T13965] loop1: detected capacity change from 0 to 33280 [ 393.401217][T13965] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 393.439514][T13965] EXT4-fs (loop1): 1 truncate cleaned up [ 393.488528][T13965] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 393.929491][ T52] Bluetooth: hci3: command tx timeout [ 393.949375][T13934] bridge0: port 1(bridge_slave_0) entered blocking state [ 393.962697][T13934] bridge0: port 1(bridge_slave_0) entered disabled state [ 393.973825][T13934] bridge_slave_0: entered allmulticast mode [ 393.995691][T13934] bridge_slave_0: entered promiscuous mode [ 394.087720][T13934] bridge0: port 2(bridge_slave_1) entered blocking state [ 394.100991][T13934] bridge0: port 2(bridge_slave_1) entered disabled state [ 394.110210][T13934] bridge_slave_1: entered allmulticast mode [ 394.118355][T13934] bridge_slave_1: entered promiscuous mode [ 394.210645][T13934] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 394.239537][T13934] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 394.291890][T13934] team0: Port device team_slave_0 added [ 394.304106][T12006] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 394.306901][T13934] team0: Port device team_slave_1 added [ 394.504441][T13934] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 394.558393][T13934] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 394.684523][T13934] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 394.704437][T13934] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 394.712878][T13934] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 394.768551][T13934] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 394.788962][ T9136] hsr_slave_0: left promiscuous mode [ 394.796244][ T9136] hsr_slave_1: left promiscuous mode [ 394.807256][ T9136] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 394.816928][ T9136] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 394.847417][ T9136] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 394.870029][ T9136] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 394.895775][ T9136] bridge_slave_1: left allmulticast mode [ 394.913469][ T9136] bridge_slave_1: left promiscuous mode [ 394.933298][ T9136] bridge0: port 2(bridge_slave_1) entered disabled state [ 394.958207][ T9136] bridge_slave_0: left allmulticast mode [ 394.975079][ T9136] bridge_slave_0: left promiscuous mode [ 394.981981][ T9136] bridge0: port 1(bridge_slave_0) entered disabled state [ 395.079562][ T9136] veth1_macvtap: left promiscuous mode [ 395.086759][ T9136] veth0_macvtap: left promiscuous mode [ 395.093528][ T9136] veth1_vlan: left promiscuous mode [ 395.115351][ T9136] veth0_vlan: left promiscuous mode [ 395.238739][T14002] ip_tables: iptables: counters copy to user failed while replacing table [ 395.334685][ T5795] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 395.357146][ T5795] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 395.368832][ T5795] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 395.379679][ T5795] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 395.388959][ T5795] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 395.397810][ T5795] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 395.997936][ T5795] Bluetooth: hci3: command tx timeout [ 396.439261][ T9136] team0 (unregistering): Port device team_slave_1 removed [ 396.520825][ T9136] team0 (unregistering): Port device team_slave_0 removed [ 396.626211][ T9136] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 396.733677][ T9136] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 397.175328][T11212] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 397.358755][ T9136] bond0 (unregistering): Released all slaves [ 397.367810][T11212] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 397.381388][T11212] usb 10-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 397.398860][T11212] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 397.515275][ T5795] Bluetooth: hci1: command tx timeout [ 397.572575][T13934] hsr_slave_0: entered promiscuous mode [ 397.596313][T13934] hsr_slave_1: entered promiscuous mode [ 397.739207][T14003] rxe_eth0 speed is unknown, defaulting to 1000 [ 397.779171][T11212] qmi_wwan 10-1:1.0: cdc-wdm0: USB WDM device [ 397.876053][T11212] wwan wwan0: port wwan0qmi0 attached [ 397.948721][ C0] wdm_int_callback: 459 callbacks suppressed [ 397.948743][ C0] qmi_wwan 10-1:1.0: nonzero urb status received: -71 [ 397.964104][ C0] wdm_int_callback: 459 callbacks suppressed [ 397.964124][ C0] qmi_wwan 10-1:1.0: wdm_int_callback - 0 bytes [ 397.981263][ C0] qmi_wwan 10-1:1.0: nonzero urb status received: -71 [ 397.989424][ C0] qmi_wwan 10-1:1.0: wdm_int_callback - 0 bytes [ 397.997401][ C0] qmi_wwan 10-1:1.0: nonzero urb status received: -71 [ 398.005556][ C0] qmi_wwan 10-1:1.0: wdm_int_callback - 0 bytes [ 398.013684][ C0] qmi_wwan 10-1:1.0: nonzero urb status received: -71 [ 398.021822][ C0] qmi_wwan 10-1:1.0: wdm_int_callback - 0 bytes [ 398.030567][ C0] qmi_wwan 10-1:1.0: nonzero urb status received: -71 [ 398.038719][ C0] qmi_wwan 10-1:1.0: wdm_int_callback - 0 bytes [ 398.046585][ C0] qmi_wwan 10-1:1.0: nonzero urb status received: -71 [ 398.054728][ C0] qmi_wwan 10-1:1.0: wdm_int_callback - 0 bytes [ 398.062459][ C0] qmi_wwan 10-1:1.0: nonzero urb status received: -71 [ 398.070626][ C0] qmi_wwan 10-1:1.0: wdm_int_callback - 0 bytes [ 398.078923][ C0] qmi_wwan 10-1:1.0: nonzero urb status received: -71 [ 398.079409][ T5795] Bluetooth: hci3: command tx timeout [ 398.087050][ C0] qmi_wwan 10-1:1.0: wdm_int_callback - 0 bytes [ 398.087278][ C0] qmi_wwan 10-1:1.0: nonzero urb status received: -71 [ 398.109158][ C0] qmi_wwan 10-1:1.0: wdm_int_callback - 0 bytes [ 398.117700][ C0] qmi_wwan 10-1:1.0: nonzero urb status received: -71 [ 398.125867][ C0] qmi_wwan 10-1:1.0: wdm_int_callback - 0 bytes [ 398.245404][T11212] qmi_wwan 10-1:1.0 wwan0: register 'qmi_wwan' at usb-dummy_hcd.9-1, WWAN/QMI device, fa:bb:72:be:ee:0c [ 398.339056][T11212] usb 10-1: USB disconnect, device number 10 [ 398.346391][ C0] qmi_wwan 10-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 398.389710][T11212] qmi_wwan 10-1:1.0 wwan0: unregister 'qmi_wwan' usb-dummy_hcd.9-1, WWAN/QMI device [ 398.487057][T11212] wwan wwan0: port wwan0qmi0 disconnected [ 398.787332][ T9136] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.942739][ T9136] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.113121][ T9136] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.320688][ T9136] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.378251][T14003] chnl_net:caif_netlink_parms(): no params data found [ 399.512426][T14059] netlink: 'syz.9.2126': attribute type 3 has an invalid length. [ 399.597011][ T5795] Bluetooth: hci1: command tx timeout [ 399.679551][T14003] bridge0: port 1(bridge_slave_0) entered blocking state [ 399.702007][T14003] bridge0: port 1(bridge_slave_0) entered disabled state [ 399.713248][T14003] bridge_slave_0: entered allmulticast mode [ 399.727148][T14003] bridge_slave_0: entered promiscuous mode [ 399.773357][T14003] bridge0: port 2(bridge_slave_1) entered blocking state [ 399.789233][T14003] bridge0: port 2(bridge_slave_1) entered disabled state [ 399.803867][T14003] bridge_slave_1: entered allmulticast mode [ 399.817218][T14003] bridge_slave_1: entered promiscuous mode [ 399.913063][T13934] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 399.933298][T13934] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 399.949133][T14003] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 399.975040][T13934] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 400.029691][ T9136] tipc: Disabling bearer [ 400.053587][ T9136] tipc: Left network mode [ 400.063808][T14003] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 400.081487][T13934] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 400.155172][ T5795] Bluetooth: hci3: command tx timeout [ 400.338036][T14003] team0: Port device team_slave_0 added [ 400.350598][T14003] team0: Port device team_slave_1 added [ 400.429886][T14003] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 400.438955][T14003] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 400.470358][T14003] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 400.491455][T14003] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 400.500729][T14003] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 400.532291][T14003] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 400.641937][T14003] hsr_slave_0: entered promiscuous mode [ 400.649786][T14003] hsr_slave_1: entered promiscuous mode [ 400.658220][T14003] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 400.667413][T14003] Cannot create hsr debugfs directory [ 401.096047][T13934] 8021q: adding VLAN 0 to HW filter on device bond0 [ 401.208477][T13934] 8021q: adding VLAN 0 to HW filter on device team0 [ 401.311804][T12453] bridge0: port 1(bridge_slave_0) entered blocking state [ 401.320421][T12453] bridge0: port 1(bridge_slave_0) entered forwarding state [ 401.350018][T12453] bridge0: port 2(bridge_slave_1) entered blocking state [ 401.358577][T12453] bridge0: port 2(bridge_slave_1) entered forwarding state [ 401.514201][T13934] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 401.545219][ T789] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 401.683471][ T5795] Bluetooth: hci1: command tx timeout [ 401.685869][T13934] veth0_vlan: entered promiscuous mode [ 401.733280][T13934] veth1_vlan: entered promiscuous mode [ 401.769216][ T9136] hsr_slave_0: left promiscuous mode [ 401.769394][ T789] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 401.792483][ T9136] hsr_slave_1: left promiscuous mode [ 401.797731][ T789] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 401.811288][ T789] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 401.831880][ T9136] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 401.835212][ T789] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 401.841403][ T9136] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 401.852884][ T789] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 401.870251][ T789] usb 3-1: Product: syz [ 401.871075][ T9136] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 401.875484][ T789] usb 3-1: Manufacturer: syz [ 401.875503][ T789] usb 3-1: SerialNumber: syz [ 401.896075][ T9136] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 401.905751][ T9136] bridge_slave_1: left allmulticast mode [ 401.912591][ T9136] bridge_slave_1: left promiscuous mode [ 401.919997][ T9136] bridge0: port 2(bridge_slave_1) entered disabled state [ 401.931033][ T9136] bridge_slave_0: left allmulticast mode [ 401.938200][ T9136] bridge_slave_0: left promiscuous mode [ 401.945310][ T9136] bridge0: port 1(bridge_slave_0) entered disabled state [ 401.980883][ T9136] veth1_macvtap: left promiscuous mode [ 401.987737][ T9136] veth0_macvtap: left promiscuous mode [ 401.994449][ T9136] veth1_vlan: left promiscuous mode [ 402.001417][ T9136] veth0_vlan: left promiscuous mode [ 402.101028][ T789] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 25 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 402.357253][ T8] usb 3-1: USB disconnect, device number 25 [ 402.581698][T14081] usblp0: removed [ 403.039866][ T9136] team0 (unregistering): Port device team_slave_1 removed [ 403.113963][ T9136] team0 (unregistering): Port device team_slave_0 removed [ 403.221875][ T9136] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 403.367278][ T9136] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 403.756684][ T5795] Bluetooth: hci1: command tx timeout [ 403.902663][ T9136] bond0 (unregistering): Released all slaves [ 404.101125][T14102] syz_tun: entered allmulticast mode [ 404.146251][T14098] syz_tun: left allmulticast mode [ 404.342140][T13934] veth0_macvtap: entered promiscuous mode [ 404.591760][T13934] veth1_macvtap: entered promiscuous mode [ 404.645763][T13934] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 404.666065][T13934] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 404.697862][T13934] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 404.746299][T13934] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 404.773254][T13934] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 404.805059][ T789] usb 3-1: new full-speed USB device number 26 using dummy_hcd [ 404.834660][T13934] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 404.847653][T13934] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.858376][T13934] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.869051][T13934] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.880402][T13934] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 405.032992][ T789] usb 3-1: config 0 interface 0 altsetting 255 endpoint 0x4 has invalid maxpacket 12336, setting to 64 [ 405.056639][ T789] usb 3-1: config 0 interface 0 has no altsetting 0 [ 405.068580][ T789] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 405.082962][ T789] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 405.093800][ T789] usb 3-1: Product: syz [ 405.102564][ T789] usb 3-1: Manufacturer: syz [ 405.109649][ T789] usb 3-1: SerialNumber: syz [ 405.116273][T12454] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 405.123573][T14003] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 405.134414][ T789] usb 3-1: config 0 descriptor?? [ 405.138191][T12454] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 405.151779][ T789] usb 3-1: selecting invalid altsetting 0 [ 405.153300][T14003] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 405.216864][T14003] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 405.238927][T12456] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 405.241877][T14003] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 405.261925][T12456] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 405.468533][T14113] usb 3-1: cannot submit urb 0, error -8: unknown error [ 405.483214][T14003] 8021q: adding VLAN 0 to HW filter on device bond0 [ 405.498269][ T789] usb 3-1: USB disconnect, device number 26 [ 405.561422][T14003] 8021q: adding VLAN 0 to HW filter on device team0 [ 405.627830][T12454] bridge0: port 1(bridge_slave_0) entered blocking state [ 405.636485][T12454] bridge0: port 1(bridge_slave_0) entered forwarding state [ 405.680861][T12454] bridge0: port 2(bridge_slave_1) entered blocking state [ 405.689532][T12454] bridge0: port 2(bridge_slave_1) entered forwarding state [ 405.744756][T14127] loop9: detected capacity change from 0 to 33280 [ 405.793538][T14127] EXT4-fs (loop9): Test dummy encryption mode enabled [ 405.813950][T14127] EXT4-fs (loop9): encrypted files will use data=ordered instead of data journaling mode [ 405.838007][T14129] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2149'. [ 405.858379][T14127] EXT4-fs error (device loop9): ext4_orphan_get:1434: comm syz.9.2148: bad orphan inode 131083 [ 405.876417][T14130] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2149'. [ 405.889529][T14127] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 406.014732][T14003] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 406.089176][T14138] loop5: detected capacity change from 0 to 32896 [ 406.118998][T14003] veth0_vlan: entered promiscuous mode [ 406.179714][T14138] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 406.198050][T11089] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 406.229090][T14003] veth1_vlan: entered promiscuous mode [ 406.310565][T14138] ext4 filesystem being mounted at /3/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 406.429932][T14003] veth0_macvtap: entered promiscuous mode [ 406.448386][T14138] EXT4-fs (loop5): re-mounted 76b65be2-f6da-4727-8c75-0525a5b65a09 ro. [ 406.460059][T14003] veth1_macvtap: entered promiscuous mode [ 406.484383][T14148] EXT4-fs (loop5): re-mounted 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w. [ 406.543393][T14003] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 406.560441][T14149] ip_tables: iptables: counters copy to user failed while replacing table [ 406.573900][T14003] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 406.587999][T14003] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 406.593189][T14149] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 406.622697][T14149] ip_tables: iptables: counters copy to user failed while replacing table [ 406.625522][T14003] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 406.661436][T14003] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 406.670226][T13934] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 406.694539][T14003] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 406.712197][T14003] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 406.774913][T14003] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 406.815825][T14003] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 406.874583][T14003] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 406.903421][T14003] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.918930][T14003] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.930765][T14003] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.941320][T14003] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 407.068820][T12454] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 407.087315][T12454] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 407.121406][ T1145] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 407.148863][ T1145] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 407.285326][T14160] loop9: detected capacity change from 0 to 33280 [ 407.325689][T14160] EXT4-fs (loop9): encrypted files will use data=ordered instead of data journaling mode [ 407.375561][T14160] EXT4-fs (loop9): 1 truncate cleaned up [ 407.383588][T14160] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 407.791273][T11089] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 408.090576][T14196] af_packet: tpacket_rcv: packet too big, clamped from 54 to 4294967286. macoff=82 [ 408.229275][T14200] loop9: detected capacity change from 0 to 128 [ 408.246960][T14201] loop2: detected capacity change from 0 to 33280 [ 408.275616][T14201] EXT4-fs: Ignoring removed nobh option [ 408.358714][T14201] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.2169: invalid indirect mapped block 256 (level 2) [ 408.399579][T14201] EXT4-fs (loop2): 2 truncates cleaned up [ 408.411962][T14201] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 408.472848][T14201] overlay: Unknown parameter 'fsname' [ 408.578377][T14199] EXT4-fs error (device loop2): ext4_validate_block_bitmap:430: comm syz.2.2169: bg 0: block 5: invalid block bitmap [ 408.617209][T14199] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 33 with error 28 [ 408.668341][T14199] EXT4-fs (loop2): This should not happen!! Data will be lost [ 408.668341][T14199] [ 408.693526][T14199] EXT4-fs (loop2): Total free blocks count 0 [ 408.712074][T14199] EXT4-fs (loop2): Free/Dirty block details [ 408.748332][T14199] EXT4-fs (loop2): free_blocks=0 [ 408.755021][T14199] EXT4-fs (loop2): dirty_blocks=33 [ 408.766647][T14199] EXT4-fs (loop2): Block reservation details [ 408.773453][T14209] syz.9.2168: attempt to access beyond end of device [ 408.773453][T14209] loop9: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 408.799194][T14209] Buffer I/O error on dev loop9, logical block 128, lost async page write [ 408.805179][T14199] EXT4-fs (loop2): i_reserved_data_blocks=33 [ 408.917334][ T28] audit: type=1326 audit(1794450818.701:145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14219 comm="syz.5.2172" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6a403a8fd9 code=0x0 [ 408.970945][ T5779] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 409.039092][T14222] rxe_eth0 speed is unknown, defaulting to 1000 [ 409.156890][T14223] bridge0: port 1(bridge_slave_0) entered disabled state [ 409.197420][T14223] bridge0: port 2(bridge_slave_1) entered disabled state [ 409.271338][T14226] netlink: 'syz.3.2173': attribute type 16 has an invalid length. [ 409.302953][T14226] netlink: 'syz.3.2173': attribute type 17 has an invalid length. [ 409.391374][T14226] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 409.898749][T14253] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2179'. [ 410.166129][T14268] Set syz1 is full, maxelem 2 reached [ 410.981817][T14265] loop3: detected capacity change from 0 to 32768 [ 411.059711][T14265] XFS (loop3): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 411.186019][ T28] audit: type=1326 audit(1794450820.971:146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14295 comm="syz.2.2188" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7cc09a8fd9 code=0x0 [ 411.254407][T14265] XFS (loop3): Ending clean mount [ 411.470942][T14003] XFS (loop3): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 411.873255][T14322] netlink: 'syz.5.2194': attribute type 16 has an invalid length. [ 411.903108][T14322] netlink: 'syz.5.2194': attribute type 17 has an invalid length. [ 412.011751][T14322] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 412.056290][T14301] loop9: detected capacity change from 0 to 32768 [ 412.161664][T14301] XFS (loop9): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 412.295568][T14301] XFS (loop9): Ending clean mount [ 412.362902][T14346] loop5: detected capacity change from 0 to 764 [ 412.391633][ T28] audit: type=1800 audit(1794450822.151:147): pid=14301 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.9.2189" name="file1" dev="loop9" ino=6150 res=0 errno=0 [ 412.441149][T14346] rock: directory entry would overflow storage [ 412.497905][T14346] rock: sig=0x5245, size=8, remaining=5 [ 412.688796][T14355] 9p: Unknown Cache mode or invalid value 7777777777777777777 [ 412.723425][T11089] XFS (loop9): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 412.993295][T14364] loop2: detected capacity change from 0 to 128 [ 413.323273][T14364] syz.2.2205: attempt to access beyond end of device [ 413.323273][T14364] loop2: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 413.346091][T14364] Buffer I/O error on dev loop2, logical block 128, lost async page write [ 414.236375][T14410] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2214'. [ 414.333495][T14396] loop5: detected capacity change from 0 to 32768 [ 414.392149][T14396] loop5: p1 p3 < > [ 414.727974][T10890] udevd[10890]: inotify_add_watch(7, /dev/loop5p3, 10) failed: No such file or directory [ 414.732460][T10513] udevd[10513]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 414.867688][T14434] loop5: detected capacity change from 0 to 128 [ 415.124381][T14434] syz.5.2219: attempt to access beyond end of device [ 415.124381][T14434] loop5: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 415.146289][T14434] Buffer I/O error on dev loop5, logical block 128, lost async page write [ 415.465757][T14458] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2226'. [ 415.566556][ T5864] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 415.767738][ T5864] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 415.779870][ T5864] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 415.819036][ T5864] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 415.866652][ T5864] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 415.881260][ T5864] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 415.924856][ T5864] usb 4-1: Product: syz [ 415.934942][ T5864] usb 4-1: Manufacturer: syz [ 415.951194][ T5864] usb 4-1: SerialNumber: syz [ 416.051294][T14480] loop2: detected capacity change from 0 to 764 [ 416.083660][T14480] rock: directory entry would overflow storage [ 416.100261][T14480] rock: sig=0x5245, size=8, remaining=5 [ 416.210513][ T5864] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 18 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 416.418989][ T5864] usb 4-1: USB disconnect, device number 18 [ 416.441060][T14491] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2237'. [ 416.459622][T14491] netlink: 'syz.2.2237': attribute type 7 has an invalid length. [ 416.483257][T14491] netlink: 'syz.2.2237': attribute type 8 has an invalid length. [ 416.493804][T14491] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2237'. [ 416.635141][ T5795] Bluetooth: hci2: command 0x0406 tx timeout [ 416.649795][T14448] usblp0: removed [ 417.333186][T14534] input: syz1 as /devices/virtual/input/input16 [ 418.594984][ T5862] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 418.805265][ T5862] usb 6-1: Using ep0 maxpacket: 32 [ 418.842083][ T5862] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 418.855462][ T5862] usb 6-1: config 0 has no interface number 0 [ 418.862843][ T5862] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 418.924868][ T5862] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 418.968741][ T5862] usb 6-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 418.995137][ T5862] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.037998][ T5862] usb 6-1: config 0 descriptor?? [ 419.252186][T14606] input: syz1 as /devices/virtual/input/input17 [ 419.671541][ T5862] uclogic 0003:28BD:0094.0012: pen parameters not found [ 419.697166][ T5862] uclogic 0003:28BD:0094.0012: interface is invalid, ignoring [ 419.892484][T14635] Set syz1 is full, maxelem 2 reached [ 419.941388][ T5919] usb 6-1: USB disconnect, device number 8 [ 421.640592][T14692] loop2: detected capacity change from 0 to 33280 [ 421.662265][T14694] input: syz0 as /devices/virtual/input/input18 [ 421.680379][T14692] EXT4-fs (loop2): Test dummy encryption mode enabled [ 421.700580][T14692] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 421.771179][T14692] EXT4-fs error (device loop2): ext4_orphan_get:1434: comm syz.2.2281: bad orphan inode 131083 [ 421.848274][T14692] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 421.911252][T14692] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 421.978129][T14703] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2284'. [ 422.003763][T14703] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2284'. [ 422.042331][T14703] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 422.104524][ T5779] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 422.863609][T14728] xt_CT: You must specify a L4 protocol and not use inversions on it [ 423.658925][T14756] FAULT_INJECTION: forcing a failure. [ 423.658925][T14756] name fail_futex, interval 1, probability 0, space 0, times 0 [ 423.702092][T14756] CPU: 0 PID: 14756 Comm: syz.3.2297 Not tainted syzkaller #0 [ 423.708529][T14760] loop9: detected capacity change from 0 to 33280 [ 423.711081][T14756] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 423.711098][T14756] Call Trace: [ 423.711106][T14756] [ 423.711115][T14756] dump_stack_lvl+0x18c/0x250 [ 423.743966][T14756] ? show_regs_print_info+0x20/0x20 [ 423.750229][T14756] ? load_image+0x420/0x420 [ 423.755660][T14756] ? get_user_pages_fast_only+0xa0/0xa0 [ 423.762340][T14756] ? __schedule+0x1577/0x4720 [ 423.767988][T14756] should_fail_ex+0x394/0x4c0 [ 423.773637][T14756] get_futex_key+0x858/0xf40 [ 423.779175][T14756] ? futex_setup_timer+0xc0/0xc0 [ 423.785107][T14756] futex_wait_requeue_pi+0x2c2/0xa50 [ 423.791507][T14756] ? futex_requeue_pi_complete+0x210/0x210 [ 423.798508][T14756] ? futex_wait+0x529/0x640 [ 423.803950][T14756] ? futex_wait_setup+0x270/0x270 [ 423.810026][T14756] ? file_end_write+0x159/0x250 [ 423.815882][T14756] ? vfs_write+0x5de/0x9a0 [ 423.821222][T14756] do_futex+0x133/0x3e0 [ 423.826235][T14756] ? __ia32_sys_get_robust_list+0x110/0x110 [ 423.833321][T14756] __se_sys_futex+0x3a9/0x440 [ 423.838950][T14756] ? __x64_sys_futex+0xf0/0xf0 [ 423.844701][T14756] ? __x64_sys_futex+0x21/0xf0 [ 423.850447][T14756] do_syscall_64+0x55/0xb0 [ 423.855775][T14756] ? clear_bhb_loop+0x40/0x90 [ 423.861419][T14756] ? clear_bhb_loop+0x40/0x90 [ 423.867063][T14756] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 423.874156][T14756] RIP: 0033:0x7f077c3a8fd9 [ 423.879495][T14756] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 423.903038][T14756] RSP: 002b:00007f077d1a7028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 423.913154][T14756] RAX: ffffffffffffffda RBX: 00007f077c625fa0 RCX: 00007f077c3a8fd9 [ 423.922737][T14756] RDX: 0000000000000001 RSI: 000000000000000b RDI: 0000000000000000 [ 423.932317][T14756] RBP: 00007f077c437fed R08: 0000200000000380 R09: 0000000000000001 [ 423.941900][T14756] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 423.951488][T14756] R13: 00007f077c626038 R14: 00007f077c625fa0 R15: 00007ffd592b93c8 [ 423.961118][T14756] [ 423.979441][T14760] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 424.008975][T14760] ext4 filesystem being mounted at /206/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 424.034921][ T790] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 424.075922][T11089] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 424.172175][T14771] loop3: detected capacity change from 0 to 256 [ 424.220749][T14771] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010321, chksum : 0x3a8a43f6, utbl_chksum : 0xe619d30d) [ 424.263204][ T790] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 424.285584][ T790] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 424.320013][ T790] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 424.357467][ T790] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 424.375280][ T790] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 424.395685][ T790] usb 6-1: Product: syz [ 424.400764][ T790] usb 6-1: Manufacturer: syz [ 424.441903][T14762] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 424.471797][ T790] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 424.479280][T14781] loop2: detected capacity change from 0 to 32896 [ 424.529635][ T790] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 424.550972][T14781] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 424.576456][T14781] ext4 filesystem being mounted at /594/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 424.876529][ T9] usb 6-1: USB disconnect, device number 9 [ 424.902599][ T5779] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 424.915376][ T9] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 424.951331][ T9] garmin_gps 6-1:1.0: device disconnected [ 425.039569][T14796] input: syz0 as /devices/virtual/input/input19 [ 425.682055][T14823] FAULT_INJECTION: forcing a failure. [ 425.682055][T14823] name fail_futex, interval 1, probability 0, space 0, times 0 [ 425.700434][T14823] CPU: 0 PID: 14823 Comm: syz.9.2314 Not tainted syzkaller #0 [ 425.709434][T14823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 425.721516][T14823] Call Trace: [ 425.725467][T14823] [ 425.728999][T14823] dump_stack_lvl+0x18c/0x250 [ 425.732625][ T49] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 425.734622][T14823] ? show_regs_print_info+0x20/0x20 [ 425.734657][T14823] ? load_image+0x420/0x420 [ 425.734691][T14823] should_fail_ex+0x394/0x4c0 [ 425.734718][T14823] get_futex_key+0x16a/0xf40 [ 425.767854][T14823] ? futex_setup_timer+0xc0/0xc0 [ 425.773773][T14823] ? put_page+0xea/0x260 [ 425.778858][T14823] futex_wait_setup+0xbc/0x270 [ 425.784569][T14823] ? futex_wait_multiple+0x970/0x970 [ 425.790899][T14823] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 425.798092][T14823] futex_wait_requeue_pi+0x353/0xa50 [ 425.804454][T14823] ? futex_requeue_pi_complete+0x210/0x210 [ 425.811413][T14823] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 425.818489][T14823] ? wake_up_q+0xca/0x100 [ 425.823684][T14823] ? file_end_write+0x159/0x250 [ 425.829489][T14823] ? vfs_write+0x5de/0x9a0 [ 425.834779][T14823] do_futex+0x133/0x3e0 [ 425.839758][T14823] ? __ia32_sys_get_robust_list+0x110/0x110 [ 425.846816][T14823] __se_sys_futex+0x3a9/0x440 [ 425.852411][T14823] ? __x64_sys_futex+0xf0/0xf0 [ 425.858110][T14823] ? __x64_sys_futex+0x21/0xf0 [ 425.863813][T14823] do_syscall_64+0x55/0xb0 [ 425.869099][T14823] ? clear_bhb_loop+0x40/0x90 [ 425.874695][T14823] ? clear_bhb_loop+0x40/0x90 [ 425.880299][T14823] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 425.887372][T14823] RIP: 0033:0x7efd227a8fd9 [ 425.892650][T14823] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 425.916155][T14823] RSP: 002b:00007efd2374a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 425.926231][T14823] RAX: ffffffffffffffda RBX: 00007efd22a25fa0 RCX: 00007efd227a8fd9 [ 425.935775][T14823] RDX: 0000000000000001 RSI: 000000000000000b RDI: 0000000000000000 [ 425.945322][T14823] RBP: 00007efd22837fed R08: 0000200000000380 R09: 0000000000000001 [ 425.954867][T14823] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 425.964414][T14823] R13: 00007efd22a26038 R14: 00007efd22a25fa0 R15: 00007ffd674811f8 [ 425.973973][T14823] [ 426.003469][T14827] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 426.974779][T14596] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 426.997062][T14865] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 427.839635][T14907] "syz.2.2334" (14907) uses obsolete ecb(arc4) skcipher [ 427.949330][T14911] loop3: detected capacity change from 0 to 256 [ 428.163287][T14917] loop5: detected capacity change from 0 to 33280 [ 428.199044][T14917] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 428.249784][T14917] EXT4-fs (loop5): 1 truncate cleaned up [ 428.277870][T14917] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 428.445174][T14903] loop9: detected capacity change from 0 to 32768 [ 428.459004][T14926] block nbd2: Device being setup by another task [ 428.460760][T14917] EXT4-fs (loop5): shut down requested (2) [ 428.480956][T14925] block nbd2: shutting down sockets [ 428.550916][T14903] loop9: p1 p3 < > [ 428.589344][T13934] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 430.155026][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 430.305241][ T5919] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 430.539819][T14983] loop2: detected capacity change from 0 to 33280 [ 430.597442][T14983] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 430.667314][T14983] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (35405!=33349) [ 430.715263][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 430.736420][T14983] EXT4-fs (loop2): orphan cleanup on readonly fs [ 430.749465][T14983] EXT4-fs (loop2): 1 truncate cleaned up [ 430.793704][T14983] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 430.883815][ T5779] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 431.333302][T15000] loop3: detected capacity change from 0 to 4096 [ 431.363864][T15006] FAULT_INJECTION: forcing a failure. [ 431.363864][T15006] name failslab, interval 1, probability 0, space 0, times 0 [ 431.404351][T15006] CPU: 0 PID: 15006 Comm: syz.5.2357 Not tainted syzkaller #0 [ 431.413372][T15006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 431.425461][T15006] Call Trace: [ 431.429410][T15006] [ 431.432950][T15006] dump_stack_lvl+0x18c/0x250 [ 431.438590][T15006] ? show_regs_print_info+0x20/0x20 [ 431.444847][T15006] ? load_image+0x420/0x420 [ 431.450272][T15006] ? __might_sleep+0xe0/0xe0 [ 431.455804][T15006] ? __lock_acquire+0x7eb0/0x7eb0 [ 431.461852][T15006] should_fail_ex+0x394/0x4c0 [ 431.467489][T15006] should_failslab+0x9/0x20 [ 431.472908][T15006] slab_pre_alloc_hook+0x59/0x300 [ 431.478960][T15006] ? snd_seq_prioq_new+0x47/0x90 [ 431.484907][T15006] __kmem_cache_alloc_node+0x53/0x260 [ 431.491380][T15006] ? snd_seq_prioq_new+0x47/0x90 [ 431.497337][T15006] kmalloc_trace+0x2a/0xe0 [ 431.502669][T15006] snd_seq_prioq_new+0x47/0x90 [ 431.508405][T15006] snd_seq_queue_alloc+0x118/0x740 [ 431.514576][T15006] snd_seq_ioctl_create_queue+0x7f/0x3b0 [ 431.521369][T15006] snd_seq_ioctl+0x28e/0x450 [ 431.526920][T15006] ? snd_seq_poll+0x1d0/0x1d0 [ 431.532584][T15006] ? bpf_lsm_file_ioctl+0x9/0x10 [ 431.538528][T15006] ? security_file_ioctl+0x80/0xa0 [ 431.544680][T15006] ? snd_seq_poll+0x1d0/0x1d0 [ 431.550315][T15006] __se_sys_ioctl+0xfd/0x170 [ 431.555846][T15006] do_syscall_64+0x55/0xb0 [ 431.561162][T15006] ? clear_bhb_loop+0x40/0x90 [ 431.566799][T15006] ? clear_bhb_loop+0x40/0x90 [ 431.572440][T15006] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 431.579526][T15006] RIP: 0033:0x7f6a403a8fd9 [ 431.584837][T15006] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 431.608377][T15006] RSP: 002b:00007f6a412f1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 431.618497][T15006] RAX: ffffffffffffffda RBX: 00007f6a40625fa0 RCX: 00007f6a403a8fd9 [ 431.628082][T15006] RDX: 00002000000001c0 RSI: 00000000c08c5332 RDI: 0000000000000003 [ 431.637663][T15006] RBP: 00007f6a40437fed R08: 0000000000000000 R09: 0000000000000000 [ 431.647246][T15006] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 431.655033][T15017] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 431.656802][T15006] R13: 00007f6a40626038 R14: 00007f6a40625fa0 R15: 00007ffd617c7ff8 [ 431.679071][T15006] [ 431.757031][ T28] audit: type=1800 audit(1794450841.535:148): pid=15000 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2356" name="bus" dev="loop3" ino=18 res=0 errno=0 [ 431.768734][T15000] NILFS (loop3): nilfs_sufile_do_free: segment 9 is already clean [ 431.965214][ T5862] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 432.034005][T15032] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2362'. [ 432.175015][ T5862] usb 10-1: Using ep0 maxpacket: 32 [ 432.193520][ T5862] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 432.228106][ T5862] usb 10-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 432.239842][ T5862] usb 10-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 432.253127][ T5862] usb 10-1: Product: syz [ 432.263097][ T5862] usb 10-1: Manufacturer: syz [ 432.281416][ T5862] usb 10-1: SerialNumber: syz [ 432.297142][ T5862] usb 10-1: config 0 descriptor?? [ 432.313692][T15018] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 432.327707][T15043] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2365'. [ 432.328083][ T5862] hub 10-1:0.0: bad descriptor, ignoring hub [ 432.352764][ T5862] hub: probe of 10-1:0.0 failed with error -5 [ 433.175225][T15014] usb 10-1: reset high-speed USB device number 11 using dummy_hcd [ 433.306895][T15045] loop2: detected capacity change from 0 to 131072 [ 433.318408][ T5864] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 433.345369][T15045] F2FS-fs (loop2): Wrong CP boundary, start(512) end(1536) blocks(0) [ 433.356161][T15045] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 433.368424][T15045] F2FS-fs (loop2): invalid crc value [ 433.385474][T15045] F2FS-fs (loop2): Found nat_bits in checkpoint [ 433.459039][T15045] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 433.467611][T15045] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4 [ 433.486624][T15014] usb 10-1: device firmware changed [ 433.498724][ T5862] usb 10-1: USB disconnect, device number 11 [ 433.514967][T15045] F2FS-fs (loop2): checksum invalid, nid = 4, ino_of_node = 4, 8e2acc4a vs. 485a57e3 [ 433.540363][ T5864] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 433.576120][ T5864] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x87 has invalid maxpacket 64 [ 433.603586][ T5864] usb 4-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 433.643655][ T5864] usb 4-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.00 [ 433.668916][ T5864] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 433.690863][ T5864] usb 4-1: Product: syz [ 433.710079][ T5864] usb 4-1: Manufacturer: syz [ 433.725063][ T5864] usb 4-1: SerialNumber: syz [ 433.756074][ T5862] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 433.995169][ T5862] usb 10-1: Using ep0 maxpacket: 32 [ 434.031048][ T5862] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 434.061413][ T5862] usb 10-1: string descriptor 0 read error: -22 [ 434.079150][ T5862] usb 10-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 434.101230][ T5862] usb 10-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 434.120487][ T5862] usb 10-1: config 0 descriptor?? [ 434.135543][T15018] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 434.180185][ T5862] hub 10-1:0.0: bad descriptor, ignoring hub [ 434.186465][T15038] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 434.197932][ T5862] hub: probe of 10-1:0.0 failed with error -5 [ 434.354965][ T27] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 434.557279][ T27] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 434.576710][ T5862] usb 10-1: USB disconnect, device number 12 [ 434.584906][ T27] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 434.625284][ T27] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 434.666335][ T27] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 434.693086][ T27] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 434.707682][ T27] usb 6-1: config 0 descriptor?? [ 434.828835][ C1] ATM dev 0: usbatm_complete: urb 0xffff888079d56b00 failed (-71)! [ 434.838458][ C1] ATM dev 0: usbatm_complete: urb 0xffff888079d56600 failed (-71)! [ 434.848035][ C1] ATM dev 0: usbatm_complete: urb 0xffff888026748b00 failed (-71)! [ 434.857613][ C1] ATM dev 0: usbatm_complete: urb 0xffff888026748a00 failed (-71)! [ 434.935231][ C1] ATM dev 0: usbatm_complete: urb 0xffff888079d56b00 failed (-71)! [ 434.944850][ C1] ATM dev 0: usbatm_complete: urb 0xffff888079d56600 failed (-71)! [ 434.954411][ C1] ATM dev 0: usbatm_complete: urb 0xffff888026748b00 failed (-71)! [ 434.963975][ C1] ATM dev 0: usbatm_complete: urb 0xffff888026748a00 failed (-71)! [ 435.045106][ C1] ATM dev 0: usbatm_complete: urb 0xffff888079d56b00 failed (-71)! [ 435.123738][ T5862] usb 4-1: USB disconnect, device number 20 [ 435.207068][ T27] plantronics 0003:047F:FFFF.0013: reserved main item tag 0xd [ 435.250085][ T27] plantronics 0003:047F:FFFF.0013: No inputs registered, leaving [ 435.262013][ T5795] Bluetooth: hci2: unexpected subevent 0x0e length: 12 < 15 [ 435.267967][T15105] loop9: detected capacity change from 0 to 256 [ 435.318363][ T27] plantronics 0003:047F:FFFF.0013: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 435.338951][T15105] FAT-fs (loop9): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 435.601654][T10117] usb 6-1: USB disconnect, device number 10 [ 437.204987][ T5864] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 437.249765][T15155] loop9: detected capacity change from 0 to 32768 [ 437.326933][T15184] tipc: Started in network mode [ 437.333029][T15184] tipc: Node identity 1000001, cluster identity 4711 [ 437.337786][T15155] XFS (loop9): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4 [ 437.342629][T15184] tipc: Node number set to 16777217 [ 437.433250][ T5864] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 437.497263][ T5864] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x87 has invalid maxpacket 64 [ 437.539111][ T5864] usb 3-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 437.611277][ T5864] usb 3-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.00 [ 437.626649][T15155] XFS (loop9): Ending clean mount [ 437.654927][ T5864] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 437.662694][T15155] XFS (loop9): Quotacheck needed: Please wait. [ 437.664651][ T5864] usb 3-1: Product: syz [ 437.702262][ T5864] usb 3-1: Manufacturer: syz [ 437.718174][ T5864] usb 3-1: SerialNumber: syz [ 437.753110][T15155] XFS (loop9): Quotacheck: Done. [ 437.865237][T11556] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 437.932152][T11089] XFS (loop9): Unmounting Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4 [ 438.081804][T11556] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 438.106051][T11556] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 438.134868][T11556] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 438.174286][T11556] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 438.186225][T15170] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 438.205337][T11556] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.227339][T11556] usb 4-1: config 0 descriptor?? [ 438.235042][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 438.244365][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 438.668517][T11556] plantronics 0003:047F:FFFF.0014: reserved main item tag 0xd [ 438.700802][T11556] plantronics 0003:047F:FFFF.0014: No inputs registered, leaving [ 438.748478][T11556] plantronics 0003:047F:FFFF.0014: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 438.832283][ C1] usbatm_complete: 3 callbacks suppressed [ 438.832304][ C1] ATM dev 0: usbatm_complete: urb 0xffff888063bb7b00 failed (-71)! [ 438.848779][ C1] ATM dev 0: usbatm_complete: urb 0xffff888063bb7900 failed (-71)! [ 438.858358][ C1] ATM dev 0: usbatm_complete: urb 0xffff888063bb7f00 failed (-71)! [ 438.867951][ C1] ATM dev 0: usbatm_complete: urb 0xffff888063bb7500 failed (-71)! [ 438.985544][ C1] ATM dev 0: usbatm_complete: urb 0xffff888063bb7b00 failed (-71)! [ 438.995148][ C1] ATM dev 0: usbatm_complete: urb 0xffff888063bb7900 failed (-71)! [ 439.004697][ C1] ATM dev 0: usbatm_complete: urb 0xffff888063bb7f00 failed (-71)! [ 439.014242][ C1] ATM dev 0: usbatm_complete: urb 0xffff888063bb7500 failed (-71)! [ 439.078409][ T9] usb 4-1: USB disconnect, device number 21 [ 439.095612][ C1] ATM dev 0: usbatm_complete: urb 0xffff888063bb7b00 failed (-71)! [ 439.105217][ C1] ATM dev 0: usbatm_complete: urb 0xffff888063bb7900 failed (-71)! [ 439.133762][ T5864] usb 3-1: USB disconnect, device number 28 [ 440.160917][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.168874][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.583976][T15249] loop3: detected capacity change from 0 to 32768 [ 440.647566][T15249] loop3: p1 p3 < > [ 440.717888][T15270] loop2: detected capacity change from 0 to 32896 [ 440.771915][T15270] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 440.882756][T15270] ext4 filesystem being mounted at /627/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 440.905246][T15275] loop3: detected capacity change from 0 to 8 [ 441.123353][T15281] FAULT_INJECTION: forcing a failure. [ 441.123353][T15281] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 441.188923][T15281] CPU: 0 PID: 15281 Comm: syz.5.2404 Not tainted syzkaller #0 [ 441.197940][T15281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 441.210022][T15281] Call Trace: [ 441.213977][T15281] [ 441.217512][T15281] dump_stack_lvl+0x18c/0x250 [ 441.223151][T15281] ? show_regs_print_info+0x20/0x20 [ 441.229424][T15281] ? load_image+0x420/0x420 [ 441.234854][T15281] ? __might_fault+0xaa/0x120 [ 441.240485][T15281] ? __lock_acquire+0x7eb0/0x7eb0 [ 441.246534][T15281] ? __up_read+0x2b8/0x6b0 [ 441.251850][T15281] ? __virt_addr_valid+0x10c/0x380 [ 441.258009][T15281] should_fail_ex+0x394/0x4c0 [ 441.263640][T15281] _copy_to_user+0x2f/0xa0 [ 441.268956][T15281] pagemap_read+0x4e4/0x790 [ 441.274382][T15281] ? wake_up_q+0xca/0x100 [ 441.279612][T15281] ? clear_refs_write+0xa20/0xa20 [ 441.285661][T15281] ? common_file_perm+0x198/0x1f0 [ 441.291709][T15281] ? fsnotify_perm+0x271/0x5e0 [ 441.297452][T15281] ? clear_refs_write+0xa20/0xa20 [ 441.303518][T15281] vfs_read+0x298/0x990 [ 441.308539][T15281] ? kernel_read+0x1e0/0x1e0 [ 441.314076][T15281] ? __fget_files+0x28/0x460 [ 441.319612][T15281] ? __fget_files+0x3fc/0x460 [ 441.325262][T15281] ? __fdget+0x180/0x210 [ 441.330377][T15281] ? __x64_sys_pread64+0xf7/0x220 [ 441.336445][T15281] __x64_sys_pread64+0x198/0x220 [ 441.342413][T15281] ? ksys_pread64+0x1c0/0x1c0 [ 441.348058][T15281] ? lockdep_hardirqs_on+0x98/0x150 [ 441.354325][T15281] do_syscall_64+0x55/0xb0 [ 441.359659][T15281] ? clear_bhb_loop+0x40/0x90 [ 441.365303][T15281] ? clear_bhb_loop+0x40/0x90 [ 441.370949][T15281] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 441.378043][T15281] RIP: 0033:0x7f6a403a8fd9 [ 441.383335][T15281] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 441.406855][T15281] RSP: 002b:00007f6a412f1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 [ 441.416940][T15281] RAX: ffffffffffffffda RBX: 00007f6a40625fa0 RCX: 00007f6a403a8fd9 [ 441.426490][T15281] RDX: 0000000000019000 RSI: 0000200000001380 RDI: 0000000000000003 [ 441.436041][T15281] RBP: 00007f6a40437fed R08: 0000000000000000 R09: 0000000000000000 [ 441.445595][T15281] R10: 0000001000000300 R11: 0000000000000246 R12: 0000000000000000 [ 441.455163][T15281] R13: 00007f6a40626038 R14: 00007f6a40625fa0 R15: 00007ffd617c7ff8 [ 441.464745][T15281] [ 441.521907][T10513] udevd[10513]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 441.523676][T10890] udevd[10890]: inotify_add_watch(7, /dev/loop3p3, 10) failed: No such file or directory [ 441.551599][ T5779] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 441.614777][T15291] loop8: detected capacity change from 0 to 7 [ 441.643342][T15291] loop8: [CUMANA/ADFS] p1 [Linux] p2 [ADFS] p1 [Linux] p2 [ 441.671723][T15291] loop8: partition table partially beyond EOD, truncated [ 441.703798][T15291] loop8: p1 size 1905483274 extends beyond EOD, truncated [ 441.737492][T15291] loop8: p2 start 121280928 is beyond EOD, truncated [ 441.855741][T10513] udevd[10513]: inotify_add_watch(7, /dev/loop8p1, 10) failed: No such file or directory [ 441.985891][ T5864] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 442.179073][ T5864] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 442.202910][ T5864] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 442.457612][ T5864] cdc_acm 3-1:1.0: ttyACM0: USB ACM device [ 442.804966][ T9] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 442.959979][T15321] loop5: detected capacity change from 0 to 32768 [ 443.016795][ T9] usb 10-1: Using ep0 maxpacket: 32 [ 443.023408][T15321] XFS (loop5): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4 [ 443.038537][ T9] usb 10-1: too many endpoints for config 0 interface 0 altsetting 5: 146, using maximum allowed: 30 [ 443.059160][ T9] usb 10-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 443.076876][ T9] usb 10-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 146 [ 443.093098][ T9] usb 10-1: config 0 interface 0 has no altsetting 0 [ 443.102058][ T9] usb 10-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 443.113539][ T9] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 443.132084][ T9] usb 10-1: config 0 descriptor?? [ 443.234351][T15321] XFS (loop5): Ending clean mount [ 443.257603][T15321] XFS (loop5): Quotacheck needed: Please wait. [ 443.389729][T15321] XFS (loop5): Quotacheck: Done. [ 443.526649][T13934] XFS (loop5): Unmounting Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4 [ 443.560861][ T9] hid-multitouch 0003:1FD2:6007.0015: No inputs registered, leaving [ 443.651741][ T9] hid-multitouch 0003:1FD2:6007.0015: hiddev0,hidraw0: USB HID v0.00 Device [HID 1fd2:6007] on usb-dummy_hcd.9-1/input0 [ 443.951337][T11556] usb 10-1: USB disconnect, device number 13 [ 444.153894][T15353] netlink: 16255 bytes leftover after parsing attributes in process `syz.5.2416'. [ 445.433704][T15389] loop9: detected capacity change from 0 to 8192 [ 446.827868][T15443] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 447.005615][T15451] loop5: detected capacity change from 0 to 33792 [ 447.014618][T15451] EXT4-fs: Ignoring removed mblk_io_submit option [ 447.085733][T15451] EXT4-fs (loop5): stripe (6) is not aligned with cluster size (16), stripe is disabled [ 447.162506][T15451] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 447.203773][T15456] loop3: detected capacity change from 0 to 4096 [ 447.234290][T15456] ntfs3: loop3: Different NTFS sector size (4096) and media sector size (512). [ 447.342967][T15451] loop5: detected capacity change from 33792 to 64 [ 447.410731][T15456] ntfs3: loop3: ino=19, mi_enum_attr [ 447.444946][T15456] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 447.486515][T15456] ntfs3: loop3: Failed to initialize $Extend/$ObjId. [ 447.529953][T13934] EXT4-fs warning (device loop5): ext4_empty_dir:3141: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 447.565174][T15468] loop9: detected capacity change from 0 to 256 [ 447.591482][T13934] EXT4-fs warning (device loop5): ext4_empty_dir:3141: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 447.610324][T13934] EXT4-fs warning (device loop5): ext4_empty_dir:3141: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 447.652724][T15468] FAT-fs (loop9): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 447.692185][T13934] EXT4-fs warning (device loop5): ext4_empty_dir:3141: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 447.747242][T15468] FAT-fs (loop9): error, invalid FAT chain (i_pos 196, last_block 8200) [ 447.762236][T13934] EXT4-fs warning (device loop5): ext4_empty_dir:3141: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 447.797368][T13934] EXT4-fs warning (device loop5): ext4_empty_dir:3141: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 447.805475][T15468] FAT-fs (loop9): Filesystem has been set read-only [ 447.823748][T13934] EXT4-fs warning (device loop5): ext4_empty_dir:3141: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 447.846489][T13934] EXT4-fs warning (device loop5): ext4_empty_dir:3141: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 447.875983][T15473] FAT-fs (loop9): error, invalid FAT chain (i_pos 196, last_block 8200) [ 447.905851][T13934] EXT4-fs warning (device loop5): ext4_empty_dir:3141: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 447.965710][T13934] EXT4-fs warning (device loop5): ext4_empty_dir:3141: inode #11: lblock 0: comm syz-executor: error -12 reading directory block [ 448.164333][T15359] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 448.183173][T15482] FAULT_INJECTION: forcing a failure. [ 448.183173][T15482] name failslab, interval 1, probability 0, space 0, times 0 [ 448.212346][T15482] CPU: 0 PID: 15482 Comm: syz.9.2447 Not tainted syzkaller #0 [ 448.221349][T15482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 448.233432][T15482] Call Trace: [ 448.237387][T15482] [ 448.240918][T15482] dump_stack_lvl+0x18c/0x250 [ 448.246558][T15482] ? show_regs_print_info+0x20/0x20 [ 448.252820][T15482] ? load_image+0x420/0x420 [ 448.258250][T15482] ? __might_sleep+0xe0/0xe0 [ 448.263780][T15482] ? __lock_acquire+0x7eb0/0x7eb0 [ 448.269861][T15482] should_fail_ex+0x394/0x4c0 [ 448.275496][T15482] should_failslab+0x9/0x20 [ 448.280918][T15482] slab_pre_alloc_hook+0x59/0x300 [ 448.286971][T15482] ? ntfs_init_fs_context+0x1d5/0x490 [ 448.293446][T15482] __kmem_cache_alloc_node+0x53/0x260 [ 448.299915][T15482] ? ntfs_init_fs_context+0x1d5/0x490 [ 448.306395][T15482] kmalloc_trace+0x2a/0xe0 [ 448.311732][T15482] ntfs_init_fs_context+0x1d5/0x490 [ 448.318003][T15482] alloc_fs_context+0x618/0x7a0 [ 448.323860][T15482] __se_sys_fsopen+0xa0/0x2c0 [ 448.329500][T15482] do_syscall_64+0x55/0xb0 [ 448.334821][T15482] ? clear_bhb_loop+0x40/0x90 [ 448.340454][T15482] ? clear_bhb_loop+0x40/0x90 [ 448.346094][T15482] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 448.353197][T15482] RIP: 0033:0x7efd227a8fd9 [ 448.358513][T15482] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 448.382056][T15482] RSP: 002b:00007efd2374a028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 448.392176][T15482] RAX: ffffffffffffffda RBX: 00007efd22a25fa0 RCX: 00007efd227a8fd9 [ 448.401764][T15482] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000f40 [ 448.411346][T15482] RBP: 00007efd22837fed R08: 0000000000000000 R09: 0000000000000000 [ 448.420931][T15482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 448.430515][T15482] R13: 00007efd22a26038 R14: 00007efd22a25fa0 R15: 00007ffd674811f8 [ 448.440112][T15482] [ 448.486010][T15458] kmmpd-loop5: attempt to access beyond end of device [ 448.486010][T15458] loop5: rw=14337, sector=128, nr_sectors = 2 limit=64 [ 448.511682][ T9] usb 3-1: USB disconnect, device number 29 [ 448.526747][T15458] Buffer I/O error on dev loop5, logical block 64, lost sync page write [ 448.872488][T15504] netlink: 'syz.9.2451': attribute type 15 has an invalid length. [ 448.882715][T15504] netlink: 'syz.9.2451': attribute type 15 has an invalid length. [ 449.095761][T15513] loop2: detected capacity change from 0 to 512 [ 449.276613][ T5919] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 449.461663][T15524] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 449.504863][ T5919] usb 4-1: Using ep0 maxpacket: 8 [ 449.513880][ T5919] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 449.555471][ T5919] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 449.595289][ T5919] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 449.617564][ T5919] usb 4-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 449.634924][ T5919] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 449.655102][ T5919] usb 4-1: Product: syz [ 449.660143][ T5919] usb 4-1: Manufacturer: syz [ 449.684864][ T5919] usb 4-1: SerialNumber: syz [ 449.982500][ T5795] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 450.001011][ T5795] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 450.017478][ T5795] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 450.029423][ T5795] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 450.042732][ T5795] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 450.057947][ T5795] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 450.134362][T15534] rxe_eth0 speed is unknown, defaulting to 1000 [ 450.275207][ T27] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 450.320311][ T5919] usb 4-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 450.344162][ T5919] usb 4-1: clock source 0 is not valid, cannot use [ 450.364490][ T5919] usb 4-1: 1:1: cannot get freq (v2/v3): err -32 [ 450.384928][ T5864] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 450.474875][ T27] usb 3-1: Using ep0 maxpacket: 8 [ 450.483037][ T27] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 450.511148][ T27] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 450.533943][ T27] usb 3-1: New USB device found, idVendor=0d46, idProduct=2011, bcdDevice= 1.00 [ 450.555142][ T27] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 450.576552][ T27] kobil_sct 3-1:1.0: KOBIL USB smart card terminal converter detected [ 450.591400][ T27] usb 3-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 450.603710][ T5864] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 450.616676][ T5864] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 450.622927][ T5919] usb 4-1: USB disconnect, device number 22 [ 450.633233][ T5864] usb 10-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 450.662409][ T5864] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 450.674416][ T5864] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 450.684714][ T5864] usb 10-1: Product: syz [ 450.685557][T15534] chnl_net:caif_netlink_parms(): no params data found [ 450.689854][ T5864] usb 10-1: Manufacturer: syz [ 450.703796][ T5864] usb 10-1: SerialNumber: syz [ 450.956295][T15534] bridge0: port 1(bridge_slave_0) entered blocking state [ 450.965628][T15534] bridge0: port 1(bridge_slave_0) entered disabled state [ 450.974395][T15534] bridge_slave_0: entered allmulticast mode [ 450.984203][T15534] bridge_slave_0: entered promiscuous mode [ 450.995923][T15534] bridge0: port 2(bridge_slave_1) entered blocking state [ 451.004673][T15534] bridge0: port 2(bridge_slave_1) entered disabled state [ 451.014294][T15534] bridge_slave_1: entered allmulticast mode [ 451.023744][T15534] bridge_slave_1: entered promiscuous mode [ 451.102587][T15534] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 451.124743][T15534] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 451.208700][T15534] team0: Port device team_slave_0 added [ 451.243143][T15534] team0: Port device team_slave_1 added [ 451.322471][T15534] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 451.348757][T15534] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 451.379945][ C1] vkms_vblank_simulate: vblank timer overrun [ 451.389468][T15534] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 451.404595][ T27] usb 3-1: USB disconnect, device number 30 [ 451.436709][ T27] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 451.482604][ T27] kobil_sct 3-1:1.0: device disconnected [ 451.490387][T15534] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 451.513153][T15534] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 451.584888][T15534] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 451.665070][ T28] kauditd_printk_skb: 2 callbacks suppressed [ 451.665086][ T28] audit: type=1800 audit(1794450861.435:149): pid=15569 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2462" name="max_speed" dev="configfs" ino=42497 res=0 errno=0 [ 451.802010][T15534] hsr_slave_0: entered promiscuous mode [ 451.812058][ T5864] cdc_ncm 10-1:1.0: bind() failure [ 451.836102][ T5864] cdc_ncm: probe of 10-1:1.1 failed with error -71 [ 451.836957][T15534] hsr_slave_1: entered promiscuous mode [ 451.856643][ T5864] cdc_mbim: probe of 10-1:1.1 failed with error -71 [ 451.882100][ T5864] usbtest: probe of 10-1:1.1 failed with error -71 [ 451.890408][T15534] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 451.905175][T15534] Cannot create hsr debugfs directory [ 451.949939][ T5864] usb 10-1: USB disconnect, device number 14 [ 452.155052][ T5795] Bluetooth: hci3: command tx timeout [ 452.621789][T15578] loop3: detected capacity change from 0 to 32768 [ 452.693957][T15578] XFS (loop3): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 452.855122][T15578] XFS (loop3): Ending clean mount [ 453.024387][T14003] XFS (loop3): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 453.392756][T15614] loop9: detected capacity change from 0 to 32768 [ 453.451724][T15614] loop9: p1 p3 < > [ 453.595030][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 453.971272][T10513] udevd[10513]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 454.009908][T10890] udevd[10890]: inotify_add_watch(7, /dev/loop9p3, 10) failed: No such file or directory [ 454.199477][T15534] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 454.248259][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 454.262065][ T5795] Bluetooth: hci3: command tx timeout [ 454.280625][T15534] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 454.331210][T15534] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 454.373521][T15534] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 454.672971][T15534] 8021q: adding VLAN 0 to HW filter on device bond0 [ 454.713143][T15635] FAULT_INJECTION: forcing a failure. [ 454.713143][T15635] name failslab, interval 1, probability 0, space 0, times 0 [ 454.759531][T15635] CPU: 0 PID: 15635 Comm: syz.3.2470 Not tainted syzkaller #0 [ 454.768540][T15635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 454.780623][T15635] Call Trace: [ 454.784574][T15635] [ 454.788105][T15635] dump_stack_lvl+0x18c/0x250 [ 454.793745][T15635] ? show_regs_print_info+0x20/0x20 [ 454.800011][T15635] ? load_image+0x420/0x420 [ 454.805436][T15635] ? __might_sleep+0xe0/0xe0 [ 454.810972][T15635] ? __lock_acquire+0x7eb0/0x7eb0 [ 454.817030][T15635] should_fail_ex+0x394/0x4c0 [ 454.822673][T15635] should_failslab+0x9/0x20 [ 454.828096][T15635] slab_pre_alloc_hook+0x59/0x300 [ 454.834145][T15635] kmem_cache_alloc+0x5a/0x2d0 [ 454.839877][T15635] ? __kernfs_new_node+0xe5/0x7f0 [ 454.845935][T15635] __kernfs_new_node+0xe5/0x7f0 [ 454.851875][T15635] ? kernfs_new_node+0x260/0x260 [ 454.857841][T15635] ? up_write+0x1be/0x410 [ 454.863038][T15635] kernfs_new_node+0x14c/0x260 [ 454.868754][T15635] __kernfs_create_file+0x4b/0x2e0 [ 454.874886][T15635] sysfs_add_file_mode_ns+0x237/0x2f0 [ 454.881364][T15635] internal_create_group+0x431/0xd10 [ 454.887702][T15635] ? kernfs_add_one+0x149/0x6b0 [ 454.893521][T15635] ? sysfs_create_group+0x20/0x20 [ 454.899536][T15635] ? up_write+0x1be/0x410 [ 454.904717][T15635] sysfs_create_groups+0x59/0x120 [ 454.910730][T15635] device_add_attrs+0xdf/0x830 [ 454.916437][T15635] ? device_add_class_symlinks+0x240/0x240 [ 454.923393][T15635] ? device_add_class_symlinks+0x21f/0x240 [ 454.930341][T15635] device_add+0x51a/0xc40 [ 454.935523][T15635] netdev_register_kobject+0x188/0x320 [ 454.942064][T15635] register_netdevice+0x12aa/0x1ba0 [ 454.948298][T15635] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 454.955043][T15635] ? netif_stacked_transfer_operstate+0x210/0x210 [ 454.962725][T15635] ? mutex_unlock+0x10/0x10 [ 454.968110][T15635] ? vscnprintf+0x80/0x80 [ 454.973292][T15635] ? net_generic+0x1e/0x240 [ 454.978686][T15635] ? radix_tree_lookup+0x267/0x280 [ 454.984817][T15635] ppp_dev_configure+0x850/0xad0 [ 454.990739][T15635] ppp_ioctl+0xafb/0x1bc0 [ 454.995919][T15635] ? ppp_poll+0x250/0x250 [ 455.001092][T15635] ? __fget_files+0x28/0x460 [ 455.006597][T15635] ? bpf_lsm_file_ioctl+0x9/0x10 [ 455.012505][T15635] ? security_file_ioctl+0x80/0xa0 [ 455.018625][T15635] ? ppp_poll+0x250/0x250 [ 455.023805][T15635] __se_sys_ioctl+0xfd/0x170 [ 455.029299][T15635] do_syscall_64+0x55/0xb0 [ 455.034578][T15635] ? clear_bhb_loop+0x40/0x90 [ 455.040171][T15635] ? clear_bhb_loop+0x40/0x90 [ 455.045769][T15635] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 455.052829][T15635] RIP: 0033:0x7f077c3a8fd9 [ 455.058109][T15635] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 455.081623][T15635] RSP: 002b:00007f077d1a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 455.091704][T15635] RAX: ffffffffffffffda RBX: 00007f077c625fa0 RCX: 00007f077c3a8fd9 [ 455.101258][T15635] RDX: 0000200000001700 RSI: 00000000c004743e RDI: 0000000000000004 [ 455.110812][T15635] RBP: 00007f077c437fed R08: 0000000000000000 R09: 0000000000000000 [ 455.120358][T15635] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 455.129903][T15635] R13: 00007f077c626038 R14: 00007f077c625fa0 R15: 00007ffd592b93c8 [ 455.139465][T15635] [ 455.246185][T15534] 8021q: adding VLAN 0 to HW filter on device team0 [ 455.274214][ T80] bridge0: port 1(bridge_slave_0) entered blocking state [ 455.282917][ T80] bridge0: port 1(bridge_slave_0) entered forwarding state [ 455.324804][ T80] bridge0: port 2(bridge_slave_1) entered blocking state [ 455.333367][ T80] bridge0: port 2(bridge_slave_1) entered forwarding state [ 455.421221][T15534] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 455.446604][T15534] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 455.630266][T15534] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 455.797601][T15534] veth0_vlan: entered promiscuous mode [ 455.806403][ T28] audit: type=1326 audit(1794450865.575:150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 455.829505][T15534] veth1_vlan: entered promiscuous mode [ 455.909004][ T28] audit: type=1326 audit(1794450865.575:151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 455.942242][T15534] veth0_macvtap: entered promiscuous mode [ 455.987194][ T28] audit: type=1326 audit(1794450865.575:152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 455.989861][T15534] veth1_macvtap: entered promiscuous mode [ 456.090576][ T28] audit: type=1326 audit(1794450865.615:153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 456.122089][T15534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 456.156393][T15534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 456.187485][ T28] audit: type=1326 audit(1794450865.615:154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 456.200518][T15534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 456.255071][ T28] audit: type=1326 audit(1794450865.615:155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 456.260586][T15534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 456.304342][ T28] audit: type=1326 audit(1794450865.615:156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 456.339900][ T5795] Bluetooth: hci3: command tx timeout [ 456.359557][T15534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 456.422994][T15534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 456.454931][ T28] audit: type=1326 audit(1794450865.615:157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 456.501934][T15534] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 456.541216][T15534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 456.564915][ T28] audit: type=1326 audit(1794450865.615:158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 456.594177][T15534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 456.594207][T15534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 456.594223][T15534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 456.594239][T15534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 456.594252][T15534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 456.596567][T15534] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 456.709239][ T28] audit: type=1326 audit(1794450865.615:159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 456.743953][T15534] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 456.764764][T15534] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 456.784880][T15534] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 456.811969][ T28] audit: type=1326 audit(1794450865.615:160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 456.841254][T15534] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 456.841745][ T28] audit: type=1326 audit(1794450865.615:161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 456.881663][ T28] audit: type=1326 audit(1794450865.615:162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 456.915408][T15680] netlink: 'syz.3.2479': attribute type 19 has an invalid length. [ 456.933483][T15680] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2479'. [ 456.980886][T15680] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 456.991954][T15680] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 457.003530][T15680] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 457.014196][T15680] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 457.022237][ T28] audit: type=1326 audit(1794450865.615:163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 457.085787][T15680] netlink: 'syz.3.2479': attribute type 19 has an invalid length. [ 457.099347][T15680] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2479'. [ 457.105450][ T28] audit: type=1326 audit(1794450865.615:164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 457.183420][ T28] audit: type=1326 audit(1794450865.615:165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 457.354919][ T28] audit: type=1326 audit(1794450865.615:166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 457.406917][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 457.445103][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 457.474877][ T28] audit: type=1326 audit(1794450865.625:167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 457.526359][ T80] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 457.573637][ T80] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 457.574900][ T28] audit: type=1326 audit(1794450865.625:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15666 comm="syz.2.2476" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cc09a8fd9 code=0x7ffc0000 [ 458.398114][ T5795] Bluetooth: hci3: command tx timeout [ 458.806521][ T9] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 458.978169][T15744] netlink: 'syz.2.2493': attribute type 1 has an invalid length. [ 459.027936][ T9] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 459.050986][ T9] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 459.062094][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 459.071936][ T9] usb 8-1: Product: syz [ 459.081789][ T9] usb 8-1: Manufacturer: syz [ 459.087641][ T9] usb 8-1: SerialNumber: syz [ 459.122476][T15744] 8021q: adding VLAN 0 to HW filter on device bond3 [ 459.149852][T15748] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2493'. [ 459.200345][T15748] netlink: 'syz.2.2493': attribute type 1 has an invalid length. [ 459.231470][T15748] bond3: option mode: unable to set because the bond device is up [ 459.329285][ T9] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 459.547327][ T23] kernel write not supported for file /184/setgroups (pid: 23 comm: kworker/1:0) syzkaller syzkaller login: [ 459.597824][ C0] usblp0: nonzero write bulk status received: -71 [ 459.609847][ T9] usb 8-1: USB disconnect, device number 2 [ 459.635099][T15729] usblp0: removed [ 460.410387][T15792] UBIFS error (pid: 15792): cannot open "./file0", error -22 [ 460.570296][T15801] loop3: detected capacity change from 0 to 33280 [ 460.672884][T15801] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 460.725340][T15801] ext4 filesystem being mounted at /83/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 461.016962][T15816] loop7: detected capacity change from 0 to 256 [ 461.067062][T15816] exFAT-fs (loop7): failed to load upcase table (idx : 0x00011e7e, chksum : 0x04bede55, utbl_chksum : 0xe619d30d) [ 461.156779][T15816] xt_hashlimit: size too large, truncated to 1048576 [ 461.335938][T14003] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 461.495324][ T1105] ------------[ cut here ]------------ [ 461.503789][ T1105] WARNING: CPU: 1 PID: 1105 at io_uring/io_uring.c:3292 io_ring_exit_work+0x3c1/0x860 [ 461.516219][ T1105] Modules linked in: [ 461.520903][ T1105] CPU: 1 PID: 1105 Comm: kworker/u4:8 Not tainted syzkaller #0 [ 461.530299][ T1105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 461.542513][ T1105] Workqueue: iou_exit io_ring_exit_work [ 461.549673][ T1105] RIP: 0010:io_ring_exit_work+0x3c1/0x860 [ 461.556692][ T1105] Code: 89 e5 48 8b 7c 24 28 48 8b 34 24 e8 19 2a 11 00 48 85 c0 41 bc 00 20 00 00 75 1c e8 69 ab f8 f6 e9 b3 fd ff ff e8 5f ab f8 f6 <0f> 0b b8 70 17 00 00 48 89 04 24 eb c3 c7 84 24 90 00 00 00 00 00 [ 461.580354][ T1105] RSP: 0018:ffffc900047d7a40 EFLAGS: 00010293 [ 461.587702][ T1105] RAX: ffffffff8a8f3341 RBX: ffff888058a94000 RCX: ffff8880252a8000 [ 461.597931][ T1105] RDX: 0000000000000000 RSI: fffffffffffffffc RDI: 0000000000000000 [ 461.608193][ T1105] RBP: ffffc900047d7bb0 R08: ffffc900047d79c7 R09: 1ffff920008faf38 [ 461.618435][ T1105] R10: dffffc0000000000 R11: fffff520008faf39 R12: ffff888058a94510 [ 461.628243][ T1105] R13: 0000000100003e52 R14: 0000000100003e56 R15: dffffc0000000000 [ 461.637961][ T1105] FS: 0000000000000000(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000 [ 461.648751][ T1105] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 461.656713][ T1105] CR2: 0000200000eea030 CR3: 0000000051f62000 CR4: 00000000003506e0 [ 461.666362][ T1105] Call Trace: [ 461.670313][ T1105] [ 461.673851][ T1105] ? io_ring_ctx_wait_and_kill+0x2b0/0x2b0 [ 461.680914][ T1105] ? _raw_spin_unlock_irq+0x23/0x50 [ 461.687234][ T1105] ? process_scheduled_works+0x975/0x1600 [ 461.694161][ T1105] ? process_scheduled_works+0x975/0x1600 [ 461.701126][ T1105] process_scheduled_works+0xa60/0x1600 [ 461.707966][ T1105] ? worker_attach_to_pool+0x370/0x370 [ 461.715049][ T1105] ? assign_work+0x3cc/0x5d0 [ 461.720590][ T1105] worker_thread+0xa5e/0xfe0 [ 461.726323][ T1105] ? _raw_spin_unlock+0x40/0x40 [ 461.732172][ T1105] ? __kthread_parkme+0x71/0x1c0 [ 461.738501][ T1105] kthread+0x2fa/0x390 [ 461.743411][ T1105] ? pr_cont_work+0x550/0x550 [ 461.749118][ T1105] ? kthread_blkcg+0xd0/0xd0 [ 461.754646][ T1105] ret_from_fork+0x48/0x80 [ 461.760305][ T1105] ? kthread_blkcg+0xd0/0xd0 [ 461.766064][ T1105] ret_from_fork_asm+0x11/0x20 [ 461.771822][ T1105] [ 461.775527][ T1105] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 461.784269][ T1105] CPU: 1 PID: 1105 Comm: kworker/u4:8 Not tainted syzkaller #0 [ 461.793332][ T1105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 461.805419][ T1105] Workqueue: iou_exit io_ring_exit_work [ 461.812096][ T1105] Call Trace: [ 461.816040][ T1105] [ 461.819568][ T1105] dump_stack_lvl+0x18c/0x250 [ 461.825199][ T1105] ? show_regs_print_info+0x20/0x20 [ 461.831470][ T1105] ? load_image+0x420/0x420 [ 461.836905][ T1105] panic+0x2ca/0x720 [ 461.841593][ T1105] ? bpf_jit_dump+0xd0/0xd0 [ 461.846994][ T1105] ? ret_from_fork_asm+0x11/0x20 [ 461.852912][ T1105] __warn+0x2e0/0x470 [ 461.857671][ T1105] ? io_ring_exit_work+0x3c1/0x860 [ 461.863798][ T1105] ? io_ring_exit_work+0x3c1/0x860 [ 461.869908][ T1105] report_bug+0x2be/0x4f0 [ 461.875088][ T1105] ? io_ring_exit_work+0x3c1/0x860 [ 461.881200][ T1105] ? io_ring_exit_work+0x3c1/0x860 [ 461.887316][ T1105] ? io_ring_exit_work+0x3c3/0x860 [ 461.893427][ T1105] handle_bug+0xcf/0x120 [ 461.898500][ T1105] exc_invalid_op+0x1a/0x50 [ 461.903895][ T1105] asm_exc_invalid_op+0x1a/0x20 [ 461.909696][ T1105] RIP: 0010:io_ring_exit_work+0x3c1/0x860 [ 461.916545][ T1105] Code: 89 e5 48 8b 7c 24 28 48 8b 34 24 e8 19 2a 11 00 48 85 c0 41 bc 00 20 00 00 75 1c e8 69 ab f8 f6 e9 b3 fd ff ff e8 5f ab f8 f6 <0f> 0b b8 70 17 00 00 48 89 04 24 eb c3 c7 84 24 90 00 00 00 00 00 [ 461.940085][ T1105] RSP: 0018:ffffc900047d7a40 EFLAGS: 00010293 [ 461.947376][ T1105] RAX: ffffffff8a8f3341 RBX: ffff888058a94000 RCX: ffff8880252a8000 [ 461.956933][ T1105] RDX: 0000000000000000 RSI: fffffffffffffffc RDI: 0000000000000000 [ 461.966506][ T1105] RBP: ffffc900047d7bb0 R08: ffffc900047d79c7 R09: 1ffff920008faf38 [ 461.976050][ T1105] R10: dffffc0000000000 R11: fffff520008faf39 R12: ffff888058a94510 [ 461.985594][ T1105] R13: 0000000100003e52 R14: 0000000100003e56 R15: dffffc0000000000 [ 461.995150][ T1105] ? io_ring_exit_work+0x3c1/0x860 [ 462.001280][ T1105] ? io_ring_ctx_wait_and_kill+0x2b0/0x2b0 [ 462.008237][ T1105] ? _raw_spin_unlock_irq+0x23/0x50 [ 462.014455][ T1105] ? process_scheduled_works+0x975/0x1600 [ 462.021301][ T1105] ? process_scheduled_works+0x975/0x1600 [ 462.028160][ T1105] process_scheduled_works+0xa60/0x1600 [ 462.034826][ T1105] ? worker_attach_to_pool+0x370/0x370 [ 462.041378][ T1105] ? assign_work+0x3cc/0x5d0 [ 462.046874][ T1105] worker_thread+0xa5e/0xfe0 [ 462.052373][ T1105] ? _raw_spin_unlock+0x40/0x40 [ 462.058171][ T1105] ? __kthread_parkme+0x71/0x1c0 [ 462.064079][ T1105] kthread+0x2fa/0x390 [ 462.068938][ T1105] ? pr_cont_work+0x550/0x550 [ 462.074536][ T1105] ? kthread_blkcg+0xd0/0xd0 [ 462.080020][ T1105] ret_from_fork+0x48/0x80 [ 462.085301][ T1105] ? kthread_blkcg+0xd0/0xd0 [ 462.090793][ T1105] ret_from_fork_asm+0x11/0x20 [ 462.096501][ T1105] [ 462.100346][ T1105] Kernel Offset: disabled [ 462.105630][ T1105] Rebooting in 86400 seconds..