last executing test programs: 12.547009136s ago: executing program 4 (id=2153): r0 = socket$pppl2tp(0x18, 0x1, 0x1) recvmmsg(r0, 0x0, 0x0, 0x10021, 0x0) 12.461255048s ago: executing program 4 (id=2154): ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00'}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x11, 0x4, 0x4, 0xbf22, 0x2, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x18000000}, 0x48) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000440)={0x28, 0x0, 0x0, @local}, 0x10) socket$nl_sock_diag(0x10, 0x3, 0x4) syz_emit_ethernet(0x0, 0x0, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000180)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x18, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x6, 0x4, 0xfffb, 0x0, 0x4ffd, {[@sack_perm={0x4, 0x2}]}}}}}}}}, 0x0) socketpair$tipc(0x1e, 0x6, 0x0, &(0x7f0000000000)) 12.210287524s ago: executing program 4 (id=2156): syz_mount_image$vfat(&(0x7f0000003880), &(0x7f0000000600)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="696f636861727365743d63703836322c666c7573682c757466383d312c636f6465706167653d313235302c636865636b3d6e6f726d616c2c696f636861727365743d6d61636963656c616e642c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e39352c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6572726f72733d72656d6f756e742d726f2c756e695f786c6174653d312c757466383d302c6e6f6e756d7461696c3d302c757466383d302c726f6469722c00a3649d1ef31283cde359cdd79881e80ea9a73bdfebba876b1b6991727372fab5c06d827162dec02af83915aed87e82508947cb8da929dffbe60191983c89011f7c0c624911c866effe7b3862bc7deb89a1eee1891818e3048383f6419a18a80364add28d1dad0ec3ea2682ff61a9116877ea36abce12d68bf3"], 0xfd, 0x2a8, &(0x7f0000000240)="$eJzs3c9qK1UcB/DfpGkSdZEsXInigC5cXW7vE6RIL1zMSslCXah4b0GaILRQ8A/GrgRXblz6BILQnS/hxjfwAQR3dlE4MslMk9Q07UDT+ufz2fT0nPOd8zuTaUsXOfnw5fHB0zz2T778LTqdLBr96MdZFr1oROXrWNL/LgCAf7OzlOKPNFMnl0VEZ3NlAQAbVPvv/+nGSwIANuydd997a3cw2Hs7zzvxePzN8bD4z774Ohvf3Y9PYhTP4mF04zwiXZi1H6eUJs280IvXx5PjYZEcf/BLef3d3yOm+Z3oRm/atZx/MtjbyWcW8pOijufL9ftF/lF048UV6z8Z7D1akY9hK954baH+B9GNXz+OT2MUT6dFzPNf7eT5m+n7P794vyivyGeT42F7Om8ubd3xSwMAAAAAAAAAAAAAAAAAAAAAwH/Yg/LsnHZMz+8pusrzd7bOi2+2I6/0ls/nmeWz6kKXzgeapPihOl/nYZ7nqZw4zzfjpWY072fXAAAAAAAAAAAAAAAAAAAA8M9y9NnnBx+NRs8Ob6VRnQZQva2//nVOp6n+Qs+rsT7Vnq/VKJtrloitak4WsbaeYhO3dFuuazx3Vc0//lT3gp3r52wXa3VucRfVy73QE1VPtvoeti8md6qH5OeqJ6WUWnHD1VtXDaVaj19r5VC39t1ovTBtTNbMieyqwr59Zf5zWQ5ll3fRWrrPS43tsrEQv/Rs1Hqe//67InNaBwAAAAAAAAAAAAAAAAAAbNT8Tb8rBk/WRhupvbGyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBOzT//v0ZjUoZvMLkVh0f3vEUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+B/4KAAD//+KpXP8=") r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000002100)=@mangle={'mangle\x00', 0x64, 0x6, 0x590, 0x300, 0xd0, 0xd0, 0xd0, 0xd0, 0x4c0, 0x4c0, 0x4c0, 0x4c0, 0x4c0, 0x6, 0x0, {[{{@ipv6={@remote, @private1, [0xff], [0xffffff00, 0x0, 0xffffff00], 'gre0\x00', 'syzkaller1\x00', {0xff}, {}, 0x0, 0x0, 0x7}, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x9}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x590}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x29, 0xfc, 0x6, 0xfb, 0x3, @remote, @empty, @loopback, [0xffffffff, 0xff000000, 0x0, 0xff], [0x0, 0x0, 0x0, 0xffffffff], [0xffffff00, 0xff, 0xff000000], 0x82}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x3f0}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@local, @ipv6=@remote, 0x20, 0x8, 0x6}}}, {{@ipv6={@local, @private1={0xfc, 0x1, '\x00', 0x1}, [0x0, 0xff000000, 0xff000000], [0xff000000, 0x0, 0xff], 'tunl0\x00', 'veth0_to_bond\x00', {}, {0xf7d589580f149d60}, 0x0, 0x5, 0x7, 0x18}, 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00', 0x0, {0x2, 0x8}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5f0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) bpf$MAP_CREATE(0x0, &(0x7f00000043c0)=ANY=[@ANYBLOB="0a00000002000000040000000400000000000000", @ANYRES32, @ANYBLOB="00a400"/20, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) keyctl$set_reqkey_keyring(0xe, 0xfffffffffffffff8) get_robust_list(0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x40, 0x9, 0x7ffc1fff}]}) syz_mount_image$vfat(&(0x7f0000000100), &(0x7f00000000c0)='./file0\x00', 0x204858, &(0x7f00000002c0)=ANY=[@ANYBLOB="756e695f786c6174653d312c696f636861727365743d757466382c0097b75cbdde02821d0f899c2377ee9577397fc18b433d0c59e692b381740ca495e1c145c5922679338b5f97722752a98440a5725268a242c0263564f968d3c178704feaf8a412df818275708882ea9a4048c6e458a1f05b83f2e69b965b1df203b21de293ee375647f886a5310889982079aa7b1fb4eefe7f768eec58b19cf50faa8af129503175f4262df73df51d3641ff78b86127c1db8ef165bfa3bd20797fde6ff91a0e45d3d7c1c6d1ce0a72be8c1fdb00000000bb10541149fc9f7f374f57b07713ef5870a5f62357be114a4d8e925becf2d6eafbbd2ba7a07fec3414361d551da0464ce8c1e21ba3debd6b839e3c7545e08c343dd9566721b848b22eaad7d3b4f7e756373917e426f0f9fb64550639f4fc6195c7e9e25295d7cdf0531e8f7d67ff11fc61d80c6f36a81f2263e6b4b846d802f37eb1dba973d1b61945e708827c01ac28e70d5d9e26bf9752d5829bbfc48c045e151e13c4c41fe54f930521693955c554f1ff94bab2ab7fe9605bfaec155ae25380ab217d2f11d7f4bfda07c5d645c891d310567761", @ANYRES32, @ANYRES32, @ANYRES8, @ANYRES32], 0x1, 0x347, &(0x7f0000001840)="$eJzs3cFrHFUcB/Bf15q0tenmIIKC+NCLXpYk/gMu0oIYUGIj1YMwNRNddrobdpbKFrG9iTf/juLRmyCC51y8e/OWi8ceiiu7m6TZNTlY2EzLfj6QvF/m5cu82WWW32X2Hdz68U57t2zsZv2ovZfickTUHkWsRi2OXDgca+N6KU56EO/Ub/35+iefff5hc3Pz+lZKN5o3391IKV1749dvvv3pzd/6L33687VflmN/9YuDvzf+2n9l/9WDf25+3SpTq0ydbj9l6Xa3289uF3naaZXtRkofF3lW5qnVKfPe1Pxu0d3bG6Sss7NyZa+Xl2XKOoPUzgep30393iBlX2WtTmo0GmnlSiyWp7ne7YdbW1lzDovhHP0we+Dy9J+9XjMb3cPL/0luP5zrwgCAZ9Js/1+LS+PjFfX/Ry3K/+//Lyx6//809P+LYNT/Lx3ev9P0/wAAAAAAAAAAAAAA8Dx4NBzWh8Nh/Wic/al6fcyX93+xnXhw71JE8f3d7bvbk3Ey39yNVhSRx1rU43HE8FiMnxS88cHm9bU0thord+5P8qPxhen8etRjdTo/+j3Kr6eUhvdTms6/OP5Gi+P8RtTj5dPzG5Pzz+SX4u23TuQbUY8/voxuFLETo+yT/HfrKb3/0eZMfnn8fwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAshkY6dur+/Y3GWfOT/PH++mtRj8en78+/dur+/BfjtYvVXjsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCkH99pZUeS98y8exBlTw0NVLez8i4i5neL3q3HW66yopFiOM6auHt6Tla9wXFT8wQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVeLLpd9UrAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoErl4F47K4q8N8ei6msEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4nvwbAAD//xBWIbM=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0xe, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x1, &(0x7f0000000040)=0x7) r2 = accept4$unix(0xffffffffffffffff, &(0x7f0000000480), &(0x7f0000000500)=0x6e, 0x80800) connect$unix(r2, &(0x7f0000000540)=@file={0x1, './file0\x00'}, 0x6e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000009500f000000000006926000000000000bf67000000000000560602000fff070067060000200000007a0a00ff0ee60000bf250000000000002d350000000000006507000002080000270700004c0000001f75000000000000bf54000000000000070400000400f9ffcd35010000000000ce0400000000000014000000000000009500000000000000db13d4d8b741f2cdaabc8383c8f56bb5df3083d20f8c2b84a800ea6553f304000000815dcf00c3eebc52267b042d1966d7ded3c5c49a08a503ea6dcfafbc718c3ada3d8ac0836d6454745e30a274f8d51744003c5b20451b624db6f58b32917c4d30d16b7edb732bc3ac330b16c442aff70d27659bc58e296b16750c5577c848754b4894b07f15bab1c640a5c0c4fd62f9db829b301ef67fd2b2736f3af0c54af2412313b17c4c9081c4ed0572261960e227d34cfbfdb247bc2351c9d8363a8cb18b7330604da78b0aba47545f9a25a80dd7d28a5ae41824f611dd2de6dd581c52698f9542a444a8a3969946faded55a48b0ed45e8659f7e3730489befb866f8ba2eb2018000000000000003ea6a5be537b3c7c178dbdfaa67785410ad604f5c1e777cea1a9f878c448631eb5dd48835b7a975ed7a1f61121cb3ce2288d8ceba4e5c69cdf643d0f07bfe1d8cb0fd2ec6179ac010623714e83c7b03ab88bfac90b5f975abbe443136c221bcda1e"], &(0x7f0000000100)='GPL\x00'}, 0x48) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) unshare(0x22020600) r5 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg(r5, 0x0, 0x0, 0x1c) 11.028782139s ago: executing program 4 (id=2167): setns(0xc9, 0x0) r0 = socket(0x840000000002, 0x3, 0x100) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x9004}, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newlink={0x48, 0x10, 0xffffffffffffffcf, 0x70bd27, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, 0x26a3c, 0x5922b}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @empty}]}}}, @IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x10}}]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x20040000) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @remote}, 0x61) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2280, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x200000, &(0x7f0000000240)={[{@sysvgroups}, {@norecovery}, {@block_validity}, {@norecovery}, {@nogrpid}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {}, {@noauto_da_alloc}, {@nombcache}, {@barrier}, {@nojournal_checksum}, {@nodelalloc}, {@errors_remount}, {@dioread_nolock}]}, 0x3, 0x577, &(0x7f0000000640)="$eJzs3c9rHFUcAPDvbJI2/aFNoRT1IIEerNRumsQfFYTWo2ixoPe6bKahZNMt2U1pYqHtwV68SBFELIh/gHePxX/Av6KghSIl6MFLZDazzTbJ5lc3TXQ+H5j2vZnZvHn75vv2Ozu7bACFNZz9U4p4NSK+SSKOdGzrj3zj8NJ+C09uVhcO3Kwmsbj42Z9JJPm69v5J/v+hvPJKRPz6VcSp0up2G3PzU5VaLZ3J6yPN6Wsjjbn501emK5PpZHp1bHz87DvjY++/927P+vrmxb+///TBR2e/PrHw3c+Pjt5L4nwczrd19uM53O6sDMdw/pwMxPkVO472oLG9JNntA2Bb+vI4H4hsDjgSfXnUA/9/tyJiESioRPxDQbXzgNa1fb7sbkbyYj3+cOkCaHX/+5feG4nB1rXRwYXkmSuj7Hp3qAftZ2388sf9e9kSG7wPcasH7QG03b4TEWf6+1fPf0k+/23fmdabx+tb2UbRXn9gNz3I8p+31sp/Sk/zn1gj/zm0Ruxux8bxX3rUg2a6yvK/D9bMf59OXUN9ee2lVs43kFy+UkvPRMTLEXEyBvZn9fXu55xdeLjYbVtn/pctWfvtXDA/jkf9+599zESlWXmePnd6fCfiteX8N4lV8/9gK9ddOf7Z83Fxk20cT++/3m3bxv3v1PsMePGniDfWHP/lO1rJ+vcnR1rnw0j7rFjtr7vHf+vW/tb633vZ+B9cv/9DSef92sbW2/hx8J+027btnv/7ks9b5X2xdP12o9JszoxG7Es+WV4f+fqx5ce26+39s/6fPLH+/LfW+X8gIr7YZP/vHrvbdde9MP4TWxr/rRcefvzlD93a39z4v90qnczXbGb+2+wBPs9zBwAAAAAAAHtNKSIOR1IqPy2XSuXy0uc7jsXBUq3eaJ66XJ+9OhGt78oOxUCpfaf7SMfnIUbzz8O262Mr6uMRcTQivu070KqXq/XaxG53HgAAAAAAAAAAAAAAAAAAAPaIQ12+/5/5vW+3jw7YcX7yG4prw/jvxS89AXuS138oLvEPxSX+objEPxSX+IfiEv9QXOIfikv8AwAAAAAAAAAAAAAAAAAAAAAAAAAAQE9dvHAhWxYXntysZvWJ63OzU/XrpyfSxlR5erZartZnrpUn6/XJWlqu1qc3+nu1ev3a6FjM3hhppo3mSGNu/tJ0ffZq89KV6cpkeikdeCG9AgAAAAAAAAAAAAAAAAAAgP+Wxtz8VKVWS2cUuhbOxZ44jG0Xko1G+Vx+Mmyrif7d76DCDhQ2NX0M7ujkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5fwMAAP//lvwy6w==") setxattr$trusted_overlay_upper(&(0x7f0000000380)='./file0/file0\x00', &(0x7f00000001c0), &(0x7f0000001400)=ANY=[], 0x835, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000200)="66b9a00d00000f32dbd567f0879f00a00000670f4fa1ea000000660f388080062e0f01c5baf80c66b8d789868866efbafc0cec0f0666b9800000c00f320f304466b8010000000f23d80f21f86635800000300f23f866350a00000044360f01d1", 0x60}], 0x1, 0x54, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$KVM_SET_CPUID(r5, 0x4008ae8a, &(0x7f00000002c0)) ioctl$KVM_RUN(r5, 0xae80, 0x0) sendmmsg$inet(r2, &(0x7f0000000040), 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="020000000400000008000000"], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r6 = getpid() sched_setscheduler(r6, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r9 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r9) 10.54828278s ago: executing program 4 (id=2170): ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00'}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x0, 0x4, 0x4, 0xbf22, 0x282}, 0x50) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x268}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f0000000280)={'ipvlan1\x00', 0x400}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000140)={0x0, @loopback, @dev}, &(0x7f0000000180)=0xc) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000200)=r4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f00000005c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14, 0x14, 0x4, [@enum={0x3, 0x1, 0x0, 0xf, 0x4000000, [{}]}]}, {0x0, [0x0, 0x0]}}, &(0x7f0000002200)=""/4110, 0x30, 0x100e, 0x1}, 0x28) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) close(0x3) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4000, 0x6, &(0x7f0000b56000/0x4000)=nil) bind$vsock_stream(r1, &(0x7f0000000440)={0x28, 0x0, 0x0, @local}, 0x10) socket$nl_sock_diag(0x10, 0x3, 0x4) syz_emit_ethernet(0x0, 0x0, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000080)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x1c, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e25, 0x41424344, 0x41424344, 0x1, 0x0, 0x7, 0x4, 0xfffb, 0x0, 0x4ffd, {[@sack_perm={0x4, 0x2}, @window={0x3, 0x3, 0x7}]}}}}}}}}, 0x0) socketpair$tipc(0x1e, 0x6, 0x0, &(0x7f0000000000)) 10.276223756s ago: executing program 4 (id=2174): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2404a8f5}, 0x4008004) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, 0x0) socket$pptp(0x18, 0x1, 0x2) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) sendmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f0000000300)=@in={0x2, 0x4e22, @remote}, 0x80, 0x0}}], 0x1, 0x20008840) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f00000008c0)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000900)={"b1f19a2c5ec395de82968fcf4ecc4f1a", r4, 0x0, {0x7, 0x5}, {0x2, 0x1}, 0x0, [0xc, 0x8000000000000000, 0x5, 0x3, 0x4, 0xac0, 0x3, 0xaf6d, 0x3, 0x1, 0x1ff, 0x3, 0x5, 0x6, 0xd4d5, 0xffff]}) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x200080c0, &(0x7f00000001c0)={0xa, 0x2, 0x7fff, @loopback, 0x3}, 0x1c) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="480100001000010400000000000000000000000000000000000000000000000100000000000000000000000000009f6ef8419721836b00000a00808000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000001000012343200000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffffff000000000000000000000000000000000a000000000000000000000058000200636263286165732900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000"], 0x148}}, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$sock_buf(r6, 0x1, 0xc, &(0x7f0000000080)=""/75, &(0x7f0000000140)=0x4b) open$dir(&(0x7f0000000180)='./file0/../file0\x00', 0x400000, 0xa9) r7 = syz_mount_image$fuse(&(0x7f0000000280), &(0x7f00000002c0)='./file0\x00', 0x8020a0, &(0x7f0000000600)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="fdb65f69643d", @ANYRESDEC=0xee00, @ANYBLOB=',blksize=0x0000000000000000,defcontext=system_u,dont_measure,fu', @ANYRESDEC=0xee00, @ANYBLOB=',fowner>', @ANYRESDEC=0xee01, @ANYBLOB=',subj_role=tmpfs\x00,appraise,\x00'], 0x0, 0x0, &(0x7f0000000740)="74ec763500f58f0911dec1fadeb48dcd71b79d9e38e7a7e9b32e7e60be2cd94dc9b6bceaa24847bb2233e857c620fa87992e6bfcf85a35341f1bcf9f53fe7666d87c7bdaad3a47a6f94992f8292298d4d6ee1c10e1323e5753b549e4ab7c76e241790b66d434bc7fa541d71f5a1c2190d9a262bfa1b8a41c7cf66356ac49fa152bacc322d9eabadcf81023affe24cf5e164ec7c21bc107") mkdirat(r7, &(0x7f0000000800)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x201899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x8b101a, 0x0) mount$tmpfs(0x0, &(0x7f0000000880)='./file0/../file0\x00', &(0x7f0000000840), 0x39095, 0x0) umount2(&(0x7f0000000100)='./file0\x00', 0x0) sendmsg$nl_xfrm(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="fc000000130001040000000000000000000046e3cfff732253a400000000000100000000000000000000000000003f1070089f000100000000000000000a0080", @ANYBLOB="755ab613d94526d41e1ea6647f70381a68240aac50257c70bcef3d1c3b8942c895d36538ebc858172d8a3d1522246d69e71ee85b6ad988a650e0d7091015210e79e1b4da32db3538c288639f7d415d2c1893112294d46e3f391118bd9e5275e3608e708b3356b5d40f918a8c9ae824569661a3d5c794ec821f8febd7e7e229513fceb2e83345b00bb889", @ANYRES32=0x0, @ANYBLOB="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000440005000000000000000000000000000000000100001234320000000a000000000000000000000000000000000000010000000000000000ffffffffffffffffffffffff"], 0xfc}}, 0x0) sendto$inet6(r3, &(0x7f00000000c0)='\x00', 0x1, 0x24000040, 0x0, 0x0) 10.275991526s ago: executing program 32 (id=2174): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2404a8f5}, 0x4008004) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, 0x0) socket$pptp(0x18, 0x1, 0x2) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) sendmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f0000000300)=@in={0x2, 0x4e22, @remote}, 0x80, 0x0}}], 0x1, 0x20008840) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f00000008c0)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000900)={"b1f19a2c5ec395de82968fcf4ecc4f1a", r4, 0x0, {0x7, 0x5}, {0x2, 0x1}, 0x0, [0xc, 0x8000000000000000, 0x5, 0x3, 0x4, 0xac0, 0x3, 0xaf6d, 0x3, 0x1, 0x1ff, 0x3, 0x5, 0x6, 0xd4d5, 0xffff]}) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x200080c0, &(0x7f00000001c0)={0xa, 0x2, 0x7fff, @loopback, 0x3}, 0x1c) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="480100001000010400000000000000000000000000000000000000000000000100000000000000000000000000009f6ef8419721836b00000a00808000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000001000012343200000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffffff000000000000000000000000000000000a000000000000000000000058000200636263286165732900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000"], 0x148}}, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$sock_buf(r6, 0x1, 0xc, &(0x7f0000000080)=""/75, &(0x7f0000000140)=0x4b) open$dir(&(0x7f0000000180)='./file0/../file0\x00', 0x400000, 0xa9) r7 = syz_mount_image$fuse(&(0x7f0000000280), &(0x7f00000002c0)='./file0\x00', 0x8020a0, &(0x7f0000000600)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="fdb65f69643d", @ANYRESDEC=0xee00, @ANYBLOB=',blksize=0x0000000000000000,defcontext=system_u,dont_measure,fu', @ANYRESDEC=0xee00, @ANYBLOB=',fowner>', @ANYRESDEC=0xee01, @ANYBLOB=',subj_role=tmpfs\x00,appraise,\x00'], 0x0, 0x0, &(0x7f0000000740)="74ec763500f58f0911dec1fadeb48dcd71b79d9e38e7a7e9b32e7e60be2cd94dc9b6bceaa24847bb2233e857c620fa87992e6bfcf85a35341f1bcf9f53fe7666d87c7bdaad3a47a6f94992f8292298d4d6ee1c10e1323e5753b549e4ab7c76e241790b66d434bc7fa541d71f5a1c2190d9a262bfa1b8a41c7cf66356ac49fa152bacc322d9eabadcf81023affe24cf5e164ec7c21bc107") mkdirat(r7, &(0x7f0000000800)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x201899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x8b101a, 0x0) mount$tmpfs(0x0, &(0x7f0000000880)='./file0/../file0\x00', &(0x7f0000000840), 0x39095, 0x0) umount2(&(0x7f0000000100)='./file0\x00', 0x0) sendmsg$nl_xfrm(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="fc000000130001040000000000000000000046e3cfff732253a400000000000100000000000000000000000000003f1070089f000100000000000000000a0080", @ANYBLOB="755ab613d94526d41e1ea6647f70381a68240aac50257c70bcef3d1c3b8942c895d36538ebc858172d8a3d1522246d69e71ee85b6ad988a650e0d7091015210e79e1b4da32db3538c288639f7d415d2c1893112294d46e3f391118bd9e5275e3608e708b3356b5d40f918a8c9ae824569661a3d5c794ec821f8febd7e7e229513fceb2e83345b00bb889", @ANYRES32=0x0, @ANYBLOB="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000440005000000000000000000000000000000000100001234320000000a000000000000000000000000000000000000010000000000000000ffffffffffffffffffffffff"], 0xfc}}, 0x0) sendto$inet6(r3, &(0x7f00000000c0)='\x00', 0x1, 0x24000040, 0x0, 0x0) 2.28572194s ago: executing program 3 (id=2410): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000006c0)=ANY=[@ANYBLOB="5c0000000201010400000000000000000a00100024000280140001"], 0x5c}, 0x1, 0x0, 0x0, 0x4800}, 0x4000) 2.249936031s ago: executing program 3 (id=2413): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x2007, &(0x7f0000000980)=0x0) r2 = eventfd2(0x39, 0x80000) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000240)={0x1f}, 0x0, 0x0) io_submit(r1, 0x1, &(0x7f0000000280)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x1, r2}]) 1.862692429s ago: executing program 1 (id=2438): bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1, 0x4, 0x8, 0x10, 0x0, 0x1}, 0x50) 1.86230108s ago: executing program 1 (id=2440): sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x60, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) mount(0x0, &(0x7f0000000100)='./myproc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./myproc/interrupts\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000010000000000000000000000791208000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x8, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) unshare(0x6a040000) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000001080)={0x200000, 0x200000, 0x0, 0x0, 0x0, 0x4}) 1.250933193s ago: executing program 3 (id=2450): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), r0) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)={0x34, r1, 0x1, 0x4070bd2d, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x80d0}, 0x4800) 1.142988315s ago: executing program 3 (id=2453): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='0', 0x1) r1 = socket(0x40000000015, 0x805, 0x0) getsockopt(r1, 0x114, 0x271d, &(0x7f0000019100)=""/102399, &(0x7f00000000c0)=0x18fff) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 1.136288595s ago: executing program 3 (id=2454): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='./file1\x00', 0x2000094, &(0x7f0000000440)=ANY=[@ANYBLOB="6e6f6e756d7461696c2c6e66732c73686f72746e616d653d6c6f7765722c757466383d312c64656275672c696f636861727365743d757466382c73686f72746e616d653d6d697865642c757466383d312c00484516000000000037c015c57600912233eefc80e89be5a1ef2c27ebf5171169dcfa4805d89c7e1f70d73d649ba4afab8b2194a9e8b537ad2ed68f8319883b84237da3bf9213365872b3f3"], 0x1, 0x2d3, &(0x7f0000000800)="$eJzs3MFqE1EUxvHTpE3TlDYRRFBQD7rRTWjjA2iQFsSAUpuiLoSpnWjImJSZUImIzUbc+hzFpTtBfQC7EXdu3RVBcNOFGGkmU5N2WidJm6T2/4MyNzn3496m03KmMLNx9/WTQs5J5oyyhKIqIZGqbIoktkYNQ41jqD6OSLOqXB7/GTp75979m+lMZmZOdTY9fyWlqpPn3z99/ubCx/L4wtvJd6Oynniw8SP1bf3U+umN3/OP886IOFosldXQxVKpbCxapi7lnUJS9bZlGo6p+aJj2i31nFVaXq6oUVyaiC3bpuOoUaxowaxouaRlu6LGIyNf1GQyqRMxOS7ivu8OB0hm1+bmjPSe5Vq4i12hD8b83rTtdNW/mF3rwZ4AAMCA2b//d3v9vfv/zIJ77Kj/1/xe/b9I1/3/p0jvP8ujoNry6h/9v8f/AiN6YJvCobLttBFr/P62ov8HAAAAAAAAAAAAAAAAAAAAAOAo2KzV4rVaLe4dva/Rxg0e3ut+7xOHo82fv/dAgKt93DIOUNONe1ER69VKdiXrHt16Oid5scSUKYnLr/r50OCOZ29kZqa0LiEfrNVGfnUlG5atcygdkfz2YgkvP1S/Dc3Nnzsx7ea1NT8iseb1UxKXk/7rp3zzEbl0sSmflLh8figlsWRJ5GvjhK7nX0yrXr+V2ZEf25oHAAAAAMB/Ianbdl2/1+v1CVHZXXfzbfx/YMf19bCcCfKISgAAAAAA0DWn8qxgWJZpdzAYFZEu4m0Pxnu4VoDBkIj4lcIyKDtsHlwTkU7isUHYfPuDqIi472gn8e/b8UCpWoA5wyLS94/FdkJBJ/f7LxMAAACAg/a36W8j9OXlIe4IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDjJ+jDw7z5u0peYZ9403Lhnn+DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAD5EwAA///2eRRy") openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x842, 0x22) 1.027632058s ago: executing program 3 (id=2456): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x3a, &(0x7f0000001c00)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x7407, 0xfffffffffffffffd}}}}}}, 0x0) readv(r0, &(0x7f00000001c0)=[{&(0x7f0000004000)=""/4095, 0xfff}], 0x1) 1.027340158s ago: executing program 0 (id=2457): r0 = socket$nl_route(0x10, 0x3, 0x0) setns(0xc9, 0x0) r1 = gettid() sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c0000001000030425bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0022000018430000140012800900010076657468000000000500000008001300", @ANYRES32=r1], 0x3c}, 0x1, 0x0, 0x0, 0x20000804}, 0x0) 954.568509ms ago: executing program 0 (id=2459): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee7, 0x8031, 0xffffffffffffffff, 0x8ccbf000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) mkdir(0x0, 0x1ff) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000340)=ANY=[@ANYBLOB="61122800000000006113380000000000bf1000000000000025000200091b00003d200000000000008701000000000000bc26000000000000bf67000000000000150300000ee600f0670200000300000015030000ffffffffbf050000000000000f650000000000006507f4ff02000400070700006b3128fe1f75000000000000bf540000000000000705000003001500ae430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe70305863f970eac3590ac99b798f8125f1c322c2a154a8a8d"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sk_msg}, 0x48) 952.983069ms ago: executing program 1 (id=2460): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x200000000000000, 0x0, 0x240400d5}, 0x2000c000) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='dir0/trace_marker\x00', 0x1, 0x0) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0) write(r5, &(0x7f0000000240)="62f5ff6ccf3d2ec97f0e4bc8a900d2e75067a5109d749cdf1ba00926335fdca4d6df9c6093533dbe86131af765f8be39df30e3e4f257006bf1826c92170c", 0x3e) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace\x00', 0x0, 0x104) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000540)={0x6, 'dvmrp0\x00', {0x1}, 0xc}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) 866.392781ms ago: executing program 2 (id=2463): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x2000, 0x0, 0x0, 0x11, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote}, {0x0, 0x4e20, 0x8}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x41000}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x40}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 526.695879ms ago: executing program 0 (id=2465): r0 = socket$inet6(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000000000100000800010001"], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {0x0, 0x0, 0x10}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x368, 0x140, 0x12, 0x60a, 0x0, 0x202, 0x298, 0x2e8, 0x2e8, 0x298, 0x2c0, 0x4, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @dev}, @mcast2, [], [], 'veth1_to_bond\x00', 'xfrm0\x00'}, 0x0, 0x118, 0x140, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x1, 0x8b, 0xd2, 0x4, 0x4, 0x4, 0xa216}}, @common=@inet=@socket2={{0x28}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff}, {0xffffffffffffffff}}}}, {{@ipv6={@private2, @loopback, [], [], 'vxcan1\x00', 'geneve0\x00'}, 0x0, 0x138, 0x158, 0x0, {}, [@common=@srh1={{0x90}, {0x3c, 0x1, 0xd1, 0x1, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, @private0, @dev={0xfe, 0x80, '\x00', 0x22}, [0xff, 0xffffff00, 0x0, 0xffff00], [0xffffff00, 0x0, 0xff, 0xffffffff], [0xff000000, 0xffffffff, 0xff, 0xff000000], 0x900, 0x4000}}]}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c8) 474.84943ms ago: executing program 0 (id=2467): setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0x20, &(0x7f0000000000)={@in6={{0xa, 0x4e22, 0xf, @ipv4={'\x00', '\xff\xff', @empty}, 0x3}}, 0x0, 0x0, 0x2, 0x0, "a30b3b28af4d2f246a016542daa845f387713f4048ff2ece1e75f1fc0100f41e4de6256109383664417165bba0dd5ace522fa788000000000033035551502f07b4001a00"}, 0xd8) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020a040007000000b6f1ffff000085410500"], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e"], 0x70}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) 474.55312ms ago: executing program 2 (id=2468): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000016c0)=@newsa={0x138, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x784, 0x4e24, 0x7, 0x0, 0x0, 0x0, 0x3a}, {@in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4d2, 0x6c}, @in6=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8, 0x2}, {0xffffffffffffffff, 0x40000000000, 0x1f, 0xfffffffffffffffe}, {0x20000002, 0xfffffffc, 0x40}, 0x70bd2e, 0x3504, 0x2, 0x4, 0x0, 0x32}, [@algo_comp={0x48, 0x3, {{'lzjh\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) 447.1613ms ago: executing program 2 (id=2469): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000070000090900010073797a300000000068000000090a014eac705a00000000000700000608000a40000000000900020073797a31000000000900010073797a3000000000080005400000001724001280200001800c000100636f756e74657200100002800c000240000000000000000c08000340000001"], 0xb0}, 0x1, 0x0, 0x0, 0x8000}, 0x20050800) 420.738931ms ago: executing program 0 (id=2471): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x20, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x9, 0x1, 0xd0}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x80) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file1\x00', 0x42, 0x0) write$P9_RREADLINK(r0, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) setsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000040)=0xf, 0x4) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) fsopen(0x0, 0x0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r1, &(0x7f0000000180)={'#! ', './file0', [{0x20, '# \xa5\xbd\xd5\xa8\x83$\x97\x99\x9046A\x99\xbe\xcd\xe6Z\xab\x82\t'}, {0x20, ' '}]}, 0x25) close(r1) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 322.894003ms ago: executing program 2 (id=2472): r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160a62) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BLKGETZONESZ(r0, 0x80041284, 0x0) 322.643643ms ago: executing program 5 (id=2473): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000840)={0x0, {0x2, 0x0, @empty}, {0x4, 0x0, @loopback}, {0x2, 0x0, @remote}, 0x4, 0x0, 0x0, 0xfdffffffffffffff, 0x0, &(0x7f00000001c0)='lo\x00', 0x5, 0x0, 0x3}) fcntl$lock(r0, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0xfffd, @empty}, {0x2, 0x4000, @loopback}, {0x2, 0x0, @private}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x7, 0x3}) 234.487415ms ago: executing program 2 (id=2474): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000080)=0x2, 0x37) setsockopt$inet_udp_encap(r0, 0x11, 0x68, &(0x7f0000000040)=0x1, 0x4d) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000080)=0x2, 0x4) 230.735285ms ago: executing program 5 (id=2475): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000140)=@bpf_lsm={0x18, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="180000008d510000000000000000000079a00000000000007b00e0ff00000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000002800000850000004300000095"], &(0x7f0000000100)='GPL\x00', 0x3, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xdc}, 0x94) 146.577687ms ago: executing program 2 (id=2476): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x14, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000001000000850000008600000018", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa2"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd0d, &(0x7f00000001c0)="04000000000000000000") 146.231027ms ago: executing program 0 (id=2477): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @broadcast}, 0x2}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f0000000480)="a2e092") 145.919977ms ago: executing program 5 (id=2478): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x3d8, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x100, 0x130, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x438) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x5, 0xe, @dev={0xfe, 0x80, '\x00', 0x17}, 0x7}, 0x1c) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000003300)=[{&(0x7f0000000500)="06f2da4cc04d8670c1f0dcc422b856d751a2e787a1c36180a266ae4c4a0a4c6984cc89feb2ec3cf512ca83dc60ad19dcb62cb8eac74990d9feb2bf3085592cd871918bb814a81ee86077fd1e63850498cb77b8bd532dd3f30022cd9231ae0db79499f43e08a0dcb4d6f6091044a9e424f2e8cef7e584dd6e2fed55117a1209c2920ea8d639f2342a62e31b9f9e1f617c64baaf68440c940ebde60272840941e79839bcbf05b79f081f04a87b559882d12b0562cee734a4b44cbe1f87c3a114e6041b5fc7b8cb6e0c7a87029f0ac8d69da22e0b6c7a5cb0ceb3053e78754b8f8118f35207fd5626ff753ce501a7050f912b4ab4a7fc3eea5356d82b2bbac245174efe3ab4c7c58fc5cddf1252878b658b0a0c8906f3a15ab9607ea042fc6ab1d6de51b4890cf22a9e587d96a33ff84537882acc392cfc7fefa98d06ca9e5b8278be006efefc22ea1926c52119cfa29dab3292b38bd3dfb3eb507f72dfa0c93195d6250d70b48d3bf8807299d5a204018bbbfb529adc371f4d863fb99510ab5bce383dc072bbd8590ebe5dc18afecda4d6785b96e30802158abbf34ef058e6b957441557ac43d04a2180fc524e6496a9df50abf76776765635bf34ac8c361ff782b38d30cab883869fe750448ca7e6e3be4452397b9e8fc2d474940114a2e43fbbbc15a35177f5522a7f1696924531d9121426ff9408e6f0d59f89a16fd06891094d37a3695d5cff29ba29ddd3a2603dc8bccb3f832323169ed0e463e056709f8964d9a1a22f2cf72c916cd9c6573816fc55f6a7daee666dd016abc1c0a509f8680aefb3dec283c2948d1f0111ad609087b7bd5bbb09254a20de618ffbd2c1d92953ef603994af037fad88e085b2165d34191701e24c229f5209f2acf5aa7bd18695b88217a33e9e67d57cd1e8f4b2c8df943faddb1509f7bf9a8bf7af645d90c78f2b4da42661d1c7fcc04e026f0401df8765bdb99dd594f184fc5e923ecdbf70ac700dffa6130211e510fb7cc744dddff878aaff73bc95d6b76d854a6966cefdc165a91b49ee31e114156da128d93916bcc81ce36d940990a8fffdab0a26c92640217eae3bc6eb1c19c7772fdeb6da211644ee570091999af3e8629c13e20000000000", 0x323}, {&(0x7f0000001440)="884ab464847da64b706f21833e820163d1f2bd12864a028d63d2b6d5b3f4b8ee1929e89e43e9a2d3eeea181e9b1464a9528b1ff78a976a56932a993f225583f10287998b6908650c21d03a45a07796fb1c4863e5c36cbe082d128e5b37d9e2755530bfc088c19cff45e48558cc8b80cb22d4939d168953c6ba6262b4e500000020bced710000000044df68525aaca640244729bc08fd4698a8ebfd7863b07462dd358739b9b03b8c6fed19900201139ee540319bfe186a57d03d6fa69056e764a159376720070fb3f59e048076486ba3eb60ec8d524fb6f04c7c503dbbd3c35b10392c4c02963515dcb81232e5b664682ba3432820992f5feef072584fd1730da81a99a550f80999d0db425c3f67874cb5652f3efa34998cd1750cb1fb873aa326bc611405970de6751bd21dfd6f34278462b4fa3d3f065e16d63a45b5b5a59841ec1e300395635454730a82ba7a386c4874743e8a58bf364bca9357864f25e4ae82bcead5d781fc00c7c83765f585892919baaff679965a79ec24deaa1ab25ad85736371dad808f809dcf806f37801b0b645f7e1ead1f7d253267eda1dd7f74bfb3ccf7202cf630aee34906e52f5cbf684075961b34fbd8dca037dc4fd16ebbf7b04e5da931aa3d00bbf979db9cc6f350f0bc6c5b3627c7c09aa72e06e2a9364399cd94d2751a41be853c83e484d58602299f800559418dd5d1062e008c94766560b9aa648af83675d62e50c4f8e32e7af92c854a03b12b694688de4e351dfc829fd227e11cd6b7390a76aa5004f72c9a7a4b46a430b29d87415cff34671471a02484162a927df10e87d43904c5f307f862e1b7c1402eab9f28677f269e98bf96d9f9b54cf240fc54d2c59c589ca77bb7fae8d2fbbe7bf2dbfe77ef49d74631476b45804d57f7293c24d9d96771d614bd75c4e6a29bb6227e14209ef852ac050b1c68418408ee03f1765a7331719207375be9777c8c3ddb9ea41f95441b9a6e964cb10d9b87a1d241272ffa0e6b85dea2098fa7cc5c044dc5cd63a6b4c7fbb134d5f3d92535755a2ae442386ca633108f74fdfc439ba7b3a42f48ac6ca97e32f9eb0e6e3404e3e9daf1dcfb32233e051de56fe2fc3837768c7ca58d93fa3d115d751c1a1d977879ff9eeb9625f64edf2dfe8eb997e7aef141972935639eb8309eeb0d48feef10e2b4df31c873378655c4f740fa88fbcbde4911f50bf98d5e956a7cf02ab25769cd8ffaa99451aff5d234de158e0b2be61170627be036fdeda08550cbc41457fde37a28b4dc1e88d27bcbd43cbb8cff537e63e04a963b7c776e21a3ebe0b8c0982656a69982020090eb0b6a333f7bcabda3a889b846926275276b8baf5c82ff47b8140bec940982a5f22dcc987ba1f20df0f826d5b1b7f9405d5f9f0a576f03c1fad24f610b002eb44b0b000034fe8dac914891c3c8ed430391fe8b7d184eff0632c3dc682a92db0a1f9ac98de3f4b7afe1fa1dd22be007880c0314cca16579ac0da7b0a1666f9b75eead478ad61447c6d6a8cf95d426b14759099b55ade8d86b5d9dcd51fd2438605fa4cdb67e4189dd7786554c0931bdc2d8a97c16818a24695f4f6b3698cf5f64c46a0985a118b72277f385a1cac6852423f9d7f8bd85241297bb", 0x489}], 0x2, 0x0, 0x0, 0x2c}, 0x44004) 139.990707ms ago: executing program 5 (id=2479): syz_emit_ethernet(0x11, &(0x7f0000000340)={@local, @random="2f1db5a60b3b", @void, {@llc_tr={0x11, {@llc={0x0, 0x2, "d9"}}}}}, 0x0) 115.890848ms ago: executing program 5 (id=2480): unshare(0x400) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x10) 68.862559ms ago: executing program 5 (id=2481): syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x400, &(0x7f0000000180), 0x2, 0x786, &(0x7f0000000f80)="$eJzs3c9rHGUfAPDvbLNJ37Tv27zwwms9BQQNlG5Mja2Ch4oHESwU9Gy7bLahZpMt2U1pQkCLCF4EFQ+CXnq2Wm9e/XHVP8C7B2mpmhYjHiQym9102+ymmzSbbdnPByZ5npnZfOc7z8w8T3aG3QD61mj6IxNxOCI+SCIO1ecnEZGtlQYiTq6vt7qyXEinJNbWXvstqa1ze2W5EE2vSR2oVx6LiO/ejTiS2Ry3srg0ky+VivP1+nh19sJ4ZXHp6PnZ/HRxujh3fGJy8tiJZ08c371c//hx6eCND19+6suTf73z/2vvf5/EyThYX9acx24ZjdH6Psmmu/AuL8Vbux2up5JebwA7kp6a+9bP8jicpOWBXm8SANBl6Sh0DQDoM4n+HwD6TON9gNsry4XG1Nt3JPbWzRcjYv96/o37m+tLBur37PbX7oMO307uujOSRMTILsQfjYjPvn7jajpFl+5DArTy9uWIODsyuvn6n2x6ZmG7nu5gndF76hvxf8o+YHTgfr5Jxz/PtRr/ZTbGP9Fi/DPU4tzdibbn/4bM9V0I01Y6/nuh6dm21ab860b21Wv/ro35ssm586Viem37T0SMRXYorU9sEWPs1t+32i1rHv/9/tGbn6fx09931shcHxi6+zVT+Wr+QXJudvNyxOMDrfJPNto/aTP+Pd1hjFeef+/TdsvS/NN8G9Pm/Ltr7UrEky3b/84TbcmWzyeO1w6H8cZB0cJXP38y3C5+c/un0+rK8loScXX3M20tbf/hrfMfSZqf16xsP8YPVw59225Zi/wLjf+F1rU+/geT12vlwfq8S/lqdX4iYjB5dfP8Y3de26g31k/zH3ui9fm/1fGfjk7Odpj/wI1fv9h5/t2V5j+1rfbffuHa6sy+dvE7a//JWmmsPqeT61+nG/gg+w4AAAAAAAAAAAAAAAAAAAAAAAAAOpWJiIORZHIb5Uwml1v/Du//xXCmVK5Uj5wrL8xNRe27skcim2l81OWhps9Dnah/Hn6jfuye+jMR8d+I+HjoX7V6rlAuTfU6eQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACoO9Dm+/9Tvwz1eusAgK7Z3+sNAAD2nP4fAPqP/h8A+o/+HwD6j/4fAPqP/h8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAuO33qVDqt/bmyXEjrUxcXF2bKF49OFSszudmFQq5Qnr+Qmy6Xp0vFXKE8e7+/VyqXL0zG3MKl8WqxUh2vLC6dmS0vzFXPnJ/NTxfPFLN7khUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbE9lcWkmXyoV5xUegcJAvdUelu3ZUSHTSGKvgg52K4uHYGd2r9DDixIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAI+SfAAAA///WoyFe") connect$inet6(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) 67.736939ms ago: executing program 1 (id=2482): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000400)=@bridge_getneigh={0x28, 0x1e, 0x3c964e403b131b43, 0x0, 0x0, {0x7, 0x0, 0x0, 0x0, 0x1080c, 0x40475}, [@IFLA_MASTER={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 46.658529ms ago: executing program 1 (id=2483): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000000, 0x8031, 0xffffffffffffffff, 0x94173000) mremap(&(0x7f0000a01000/0x4000)=nil, 0x4000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f00009a1000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000fef000/0x4000)=nil) mremap(&(0x7f0000678000/0x3000)=nil, 0x3000, 0x3000, 0x3, &(0x7f000084c000/0x3000)=nil) mremap(&(0x7f000040b000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f00004b3000/0x4000)=nil) 0s ago: executing program 1 (id=2484): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x18, 0x7, &(0x7f00000003c0)=ANY=[@ANYBLOB="8510000004000000950000000000000018000000000000000000000000000000950000000000000085100000fcffffff95"], &(0x7f00000000c0)='GPL\x00'}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000b40)={r0, 0xe0, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000001080)=[0x0], 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8, 0x0, 0x0}}, 0x10) kernel console output (not intermixed with test programs): T4303] xt_hashlimit: Unknown mode mask 2000, kernel too old? [ 230.146220][ T4305] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1298'. [ 230.211835][ T4313] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1301'. [ 230.478633][ T4321] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1305'. [ 230.533430][ T24] audit: type=1400 audit(1786713213.246:2861): avc: denied { append } for pid=4322 comm="syz.4.1306" name="kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 230.584646][ T4323] APIC base relocation is unsupported by KVM [ 230.585082][ T4323] Disabled LAPIC found during irq injection [ 230.642058][ T4332] xt_hashlimit: max too large, truncated to 1048576 [ 230.649332][ T4332] xt_hashlimit: Unknown mode mask 2000, kernel too old? [ 230.674643][ T4334] netlink: 144 bytes leftover after parsing attributes in process `syz.0.1311'. [ 230.999411][ T4343] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1314'. [ 231.388941][ T4353] EXT4-fs (loop2): mounted filesystem without journal. Opts: nouid32,errors=remount-ro,grpjquota=,sysvgroups,grpjquota=, [ 231.402953][ T4353] ext4 filesystem being mounted at /194/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 231.684984][ T4374] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 231.693291][ T4374] EXT4-fs (loop2): Cannot turn on journaled quota: type 1: error -2 [ 231.702703][ T4374] EXT4-fs error (device loop2): ext4_orphan_get:1427: comm syz.2.1325: bad orphan inode 15 [ 231.713828][ T4374] EXT4-fs (loop2): Remounting filesystem read-only [ 231.720735][ T4374] ext4_test_bit(bit=14, block=4) = 1 [ 231.726481][ T4374] is_bad_inode(inode)=0 [ 231.730759][ T4374] NEXT_ORPHAN(inode)=0 [ 231.735114][ T4374] max_ino=32 [ 231.738428][ T4374] i_nlink=1 [ 231.741608][ T4374] EXT4-fs (loop2): mounted filesystem without journal. Opts: delalloc,usrjquota="errors=continue,noload,errors=remount-ro,grpjquota="prjquota,quota,jqfmt=vfsv1, [ 232.603143][ T4404] netlink: 'syz.4.1334': attribute type 8 has an invalid length. [ 232.904265][ T24] audit: type=1400 audit(1786713215.616:2862): avc: denied { create } for pid=4412 comm="syz.4.1338" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 233.506815][ T4434] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 233.535836][ T4436] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4436 comm=syz.1.1348 [ 233.600989][ T4437] overlayfs: failed to clone lowerpath [ 233.607246][ T4437] overlayfs: unrecognized mount option "verity=on:fsmagic=0xfffffffffffffffc" or missing value [ 233.653585][ T4441] overlayfs: missing 'lowerdir' [ 233.686822][ T4445] xt_hashlimit: max too large, truncated to 1048576 [ 233.715201][ T4445] xt_hashlimit: Unknown mode mask 2000, kernel too old? [ 233.772767][ T4450] EXT4-fs warning (device loop4): dx_probe:845: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 233.784379][ T4450] EXT4-fs warning (device loop4): dx_probe:848: Enable large directory feature to access it [ 233.784777][ T4460] 9pnet: Insufficient options for proto=fd [ 233.794797][ T4450] EXT4-fs warning (device loop4): dx_probe:946: inode #2: comm syz.4.1353: Corrupt directory, running e2fsck is recommended [ 233.813957][ T4450] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -117 [ 233.823588][ T4450] EXT4-fs error (device loop4): ext4_iget_extra_inode:4692: inode #15: comm syz.4.1353: corrupted in-inode xattr [ 233.837489][ T4450] EXT4-fs error (device loop4): ext4_orphan_get:1406: comm syz.4.1353: couldn't read orphan inode 15 (err -117) [ 233.851523][ T4450] EXT4-fs (loop4): mounted filesystem without journal. Opts: jqfmt=vfsv1,noblock_validity,auto_da_alloc=0x0000000000000004,jqfmt=vfsold,nolazytime,grpjquota=.dax,resuid=0x0000000000000000,lazytime,grpid,,,errors=continue [ 233.851971][ T4470] overlayfs: missing 'lowerdir' [ 233.888150][ T24] audit: type=1400 audit(1786713216.596:2863): avc: denied { append } for pid=4449 comm="syz.4.1353" name="loop4" dev="devtmpfs" ino=119 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 233.919437][ T4450] SELinux: Context system_u:object_r:tun_tap_device_t:s0 is not valid (left unmapped). [ 233.922394][ T24] audit: type=1400 audit(1786713216.606:2864): avc: denied { map } for pid=4449 comm="syz.4.1353" path="/dev/loop4" dev="devtmpfs" ino=119 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 233.929802][ T4450] EXT4-fs error (device loop4): ext4_xattr_set_entry:1608: inode #2: comm syz.4.1353: corrupted xattr entries [ 233.973632][ T24] audit: type=1400 audit(1786713216.646:2865): avc: denied { relabelto } for pid=4449 comm="syz.4.1353" name="/" dev="loop4" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:tun_tap_device_t:s0" [ 233.989865][ T4476] __nla_validate_parse: 5 callbacks suppressed [ 233.989874][ T4476] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1363'. [ 234.032072][ T4478] netlink: 144 bytes leftover after parsing attributes in process `syz.0.1364'. [ 234.079447][ T4484] netlink: 96 bytes leftover after parsing attributes in process `syz.4.1367'. [ 234.363890][ T4489] EXT4-fs (loop4): Quota format mount options ignored when QUOTA feature is enabled [ 234.374442][ T4489] EXT4-fs (loop4): Test dummy encryption mode enabled [ 234.383006][ T4489] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=284ec018, mo2=0003] [ 234.391325][ T4489] System zones: 0-5 [ 234.397062][ T4489] EXT4-fs (loop4): mounted filesystem without journal. Opts: debug,jqfmt=vfsv0,inlinecrypt,test_dummy_encryption,nodelalloc,nojournal_checksum,delalloc,usrquota,noinit_itable,,errors=continue [ 234.428705][ T4498] overlayfs: empty lowerdir [ 234.506247][ T4489] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=2971058176 (47536930816 ns) > initial count (3939824 ns). Using initial count to start timer. [ 234.654571][ T4510] overlayfs: missing 'lowerdir' [ 234.690847][ T4517] xt_hashlimit: size too large, truncated to 1048576 [ 234.893933][ T4522] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1377'. [ 234.922264][ T24] audit: type=1326 audit(1786713217.626:2866): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4530 comm="syz.0.1379" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdc11f7e0d9 code=0x7ffc0000 [ 234.948383][ T24] audit: type=1326 audit(1786713217.626:2867): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4530 comm="syz.0.1379" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdc11f7e0d9 code=0x7ffc0000 [ 234.977402][ T24] audit: type=1326 audit(1786713217.626:2868): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4530 comm="syz.0.1379" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7fdc11f7e0d9 code=0x7ffc0000 [ 235.004374][ T24] audit: type=1326 audit(1786713217.626:2869): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4530 comm="syz.0.1379" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fdc11f7de42 code=0x7ffc0000 [ 235.035213][ T24] audit: type=1326 audit(1786713217.626:2870): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4530 comm="syz.0.1379" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fdc11f3e90e code=0x7ffc0000 [ 235.064760][ T24] audit: type=1326 audit(1786713217.626:2871): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4530 comm="syz.0.1379" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7fdc11f7df07 code=0x7ffc0000 [ 236.240084][ T4547] overlayfs: missing 'lowerdir' [ 236.250618][ T4550] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1386'. [ 236.308765][ T4553] xt_hashlimit: size too large, truncated to 1048576 [ 236.330633][ T4548] device veth0_vlan left promiscuous mode [ 236.337456][ T4548] device veth0_vlan entered promiscuous mode [ 236.345888][ T4548] device veth1_macvtap left promiscuous mode [ 236.383285][ T4548] device veth1_macvtap entered promiscuous mode [ 236.396084][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 236.407854][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 236.432466][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 236.438181][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 236.450199][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 236.457436][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 236.465107][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 236.473911][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 236.482327][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 236.489395][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 236.496952][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 236.505490][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 236.515754][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 236.524237][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 236.532488][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 236.540747][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 236.549000][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 236.557420][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 236.565729][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 236.574015][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 236.590050][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 236.607540][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 236.625110][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 236.637761][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 236.650040][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 236.662400][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 236.675483][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 236.689647][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 236.705711][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 236.714385][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 236.722520][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 236.730593][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 236.738381][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 236.746142][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 236.754458][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 236.762796][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 236.770558][ T4560] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1390'. [ 236.779679][ T4551] netlink: 'syz.2.1384': attribute type 8 has an invalid length. [ 236.792214][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 236.837788][ T4581] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1399'. [ 236.874377][ T4588] tipc: Enabling of bearer rejected, failed to enable media [ 236.965774][ T4603] xt_hashlimit: size too large, truncated to 1048576 [ 237.040118][ T4607] netlink: 292 bytes leftover after parsing attributes in process `syz.2.1408'. [ 237.050377][ T4604] overlayfs: missing 'lowerdir' [ 237.073728][ T4577] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1397'. [ 237.226032][ T4625] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1413'. [ 237.462801][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 237.615690][ T4631] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=94 sclass=netlink_xfrm_socket pid=4631 comm=syz.1.1415 [ 237.903674][ T4670] xt_hashlimit: size too large, truncated to 1048576 [ 238.029882][ T24] kauditd_printk_skb: 40 callbacks suppressed [ 238.029894][ T24] audit: type=1326 audit(1786713220.736:2912): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4674 comm="syz.3.1432" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2412d440d9 code=0x7ffc0000 [ 238.071745][ T24] audit: type=1326 audit(1786713220.776:2913): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4674 comm="syz.3.1432" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f2412d440d9 code=0x7ffc0000 [ 238.156239][ T24] audit: type=1326 audit(1786713220.776:2914): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4674 comm="syz.3.1432" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f2412d43e42 code=0x7ffc0000 [ 238.185531][ T24] audit: type=1326 audit(1786713220.776:2915): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4674 comm="syz.3.1432" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f2412d0490e code=0x7ffc0000 [ 238.234509][ T24] audit: type=1326 audit(1786713220.776:2916): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4674 comm="syz.3.1432" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7f2412d43f07 code=0x7ffc0000 [ 238.305946][ T4681] netlink: 'syz.1.1434': attribute type 8 has an invalid length. [ 239.338619][ T24] audit: type=1326 audit(1786713220.776:2917): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4674 comm="syz.3.1432" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f2412d0490e code=0x7ffc0000 [ 239.422371][ T24] audit: type=1326 audit(1786713220.776:2918): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4674 comm="syz.3.1432" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f2412d0490e code=0x7ffc0000 [ 239.464628][ T24] audit: type=1326 audit(1786713220.776:2919): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4674 comm="syz.3.1432" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2412d440d9 code=0x7ffc0000 [ 239.705114][ T24] audit: type=1326 audit(1786713220.776:2920): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4674 comm="syz.3.1432" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7f2412d440d9 code=0x7ffc0000 [ 239.740095][ T24] audit: type=1326 audit(1786713220.776:2921): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4674 comm="syz.3.1432" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2412d440d9 code=0x7ffc0000 [ 239.784033][ T4707] __nla_validate_parse: 2 callbacks suppressed [ 239.784042][ T4707] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1443'. [ 239.818068][ T25] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 239.834566][ T25] hid-generic 0000:0000:0000.0009: hidraw0: HID v0.00 Device [syz1] on syz0 [ 240.245629][ T4719] netlink: 'syz.0.1447': attribute type 8 has an invalid length. [ 240.822452][ T398] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 240.994715][ T4740] F2FS-fs (loop4): Unrecognized mount option "inli^e_dKntry" or missing value [ 241.072413][ T398] usb 3-1: Using ep0 maxpacket: 8 [ 241.078926][ T4745] exfat: Bad value for 'fmask' [ 241.165247][ T4748] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1458'. [ 241.190051][ T4753] exfat: Bad value for 'fmask' [ 241.203938][ T4752] bridge0: port 3(syz_tun) entered blocking state [ 241.210579][ T4752] bridge0: port 3(syz_tun) entered disabled state [ 241.217864][ T4752] device syz_tun entered promiscuous mode [ 241.223896][ T4752] bridge0: port 3(syz_tun) entered blocking state [ 241.230370][ T4752] bridge0: port 3(syz_tun) entered forwarding state [ 241.232566][ T398] usb 3-1: unable to get BOS descriptor or descriptor too short [ 241.290861][ T4760] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1463'. [ 241.322536][ T398] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 241.342628][ T398] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 241.359012][ T398] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 65535, setting to 1024 [ 241.370448][ T398] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1024 [ 241.380725][ T398] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 241.390578][ T398] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 241.400834][ T398] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 241.416225][ T4765] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 241.453583][ T4765] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 241.476743][ T4765] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:476: comm syz.4.1462: Invalid block bitmap block 0 in block_group 0 [ 241.490715][ T4765] EXT4-fs error (device loop4) in ext4_mb_clear_bb:5650: Corrupt filesystem [ 241.499825][ T4765] EXT4-fs error (device loop4): ext4_clear_blocks:880: inode #11: comm syz.4.1462: attempt to clear invalid blocks 983261 len 1 [ 241.513566][ T4765] EXT4-fs error (device loop4): __ext4_get_inode_loc:4451: comm syz.4.1462: Invalid inode table block 0 in block_group 0 [ 241.526775][ T4765] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5971: Corrupt filesystem [ 241.536669][ T4765] EXT4-fs error (device loop4) in ext4_orphan_del:3292: Corrupt filesystem [ 241.545939][ T4765] EXT4-fs error (device loop4): __ext4_get_inode_loc:4451: comm syz.4.1462: Invalid inode table block 0 in block_group 0 [ 241.559174][ T4765] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5971: Corrupt filesystem [ 241.568949][ T4765] EXT4-fs error (device loop4): ext4_truncate:4403: inode #11: comm syz.4.1462: mark_inode_dirty error [ 241.580212][ T398] usb 3-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 241.580382][ T4765] EXT4-fs error (device loop4) in ext4_orphan_cleanup:3106: Corrupt filesystem [ 241.589290][ T398] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.589299][ T398] usb 3-1: Product: syz [ 241.589312][ T398] usb 3-1: Manufacturer: syz [ 241.598982][ T4765] EXT4-fs error (device loop4): __ext4_get_inode_loc:4451: comm syz.4.1462: Invalid inode table block 0 in block_group 0 [ 241.606925][ T398] usb 3-1: SerialNumber: syz [ 241.611488][ T4765] EXT4-fs (loop4): 1 truncate cleaned up [ 241.617508][ T398] usb 3-1: config 0 descriptor?? [ 241.629483][ T4765] EXT4-fs (loop4): mounted filesystem without journal. Opts: dioread_nolock,resuid=0x0000000000000000,journal_dev=0x0000000000000002,noblock_validity,,errors=continue [ 241.652480][ T4730] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 241.694796][ T398] snd-usb-audio: probe of 3-1:0.0 failed with error -12 [ 241.747968][ T4765] EXT4-fs error (device loop4): __ext4_get_inode_loc:4451: comm syz.4.1462: Invalid inode table block 0 in block_group 0 [ 241.956027][ T4727] EXT4-fs (loop2): mounted filesystem without journal. Opts: barrier,nodioread_nolock,noquota,barrier,block_validity,nodioread_nolock,nodelalloc,resuid=0x0000000000000000,noload,,errors=continue [ 241.975718][ T4727] ext4 filesystem being mounted at /209/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 242.019564][ T4726] EXT4-fs error (device loop2): ext4_map_blocks:742: inode #15: comm syz.2.1449: lblock 0 mapped to illegal pblock 0 (length 1) [ 242.033876][ T4727] EXT4-fs error (device loop2): ext4_map_blocks:632: inode #15: comm syz.2.1449: lblock 0 mapped to illegal pblock 0 (length 1) [ 242.049151][ T4726] EXT4-fs error (device loop2): ext4_map_blocks:632: inode #15: comm syz.2.1449: lblock 0 mapped to illegal pblock 0 (length 1) [ 242.062881][ T4726] EXT4-fs error (device loop2): ext4_map_blocks:632: inode #15: comm syz.2.1449: lblock 0 mapped to illegal pblock 0 (length 1) [ 242.077277][ T4727] udc-core: couldn't find an available UDC or it's busy [ 242.086400][ T4727] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 242.226490][ T25] usb 3-1: USB disconnect, device number 25 [ 242.558720][ T4803] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1475'. [ 242.830801][ T4807] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 242.857954][ T4807] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 242.885296][ T4807] F2FS-fs (loop2): Found nat_bits in checkpoint [ 242.972626][ T4807] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 242.979892][ T4807] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 243.019440][ T4807] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1477'. [ 243.061264][ T282] attempt to access beyond end of device [ 243.061264][ T282] loop2: rw=2049, want=40968, limit=40427 [ 243.064446][ T4829] fuse: Bad value for 'fd' [ 243.081304][ T4831] tc_dump_action: action bad kind [ 243.097918][ T24] kauditd_printk_skb: 26 callbacks suppressed [ 243.097929][ T24] audit: type=1400 audit(1786713225.806:2948): avc: denied { mounton } for pid=4830 comm="syz.1.1485" path="/321/file1" dev="tmpfs" ino=1781 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 243.301856][ T4841] FAULT_INJECTION: forcing a failure. [ 243.301856][ T4841] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 243.315266][ T4841] CPU: 1 PID: 4841 Comm: syz.2.1483 Not tainted syzkaller #0 [ 243.322765][ T4841] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 243.332835][ T4841] Call Trace: [ 243.336272][ T4841] __dump_stack+0x21/0x24 [ 243.340614][ T4841] dump_stack_lvl+0x1a7/0x208 [ 243.345303][ T4841] ? show_regs_print_info+0x18/0x18 [ 243.350504][ T4841] dump_stack+0x15/0x1c [ 243.354738][ T4841] should_fail+0x3ab/0x500 [ 243.359166][ T4841] should_fail_usercopy+0x1a/0x20 [ 243.364264][ T4841] _copy_from_user+0x20/0xd0 [ 243.368896][ T4841] addrconf_del_ifaddr+0xd6/0x180 [ 243.373934][ T4841] ? inet6_addr_add+0x970/0x970 [ 243.378873][ T4841] ? __switch_to_asm+0x3a/0x60 [ 243.383695][ T4841] ? __schedule+0xc0b/0x13e0 [ 243.388354][ T4841] inet6_ioctl+0x1eb/0x280 [ 243.392778][ T4841] ? inet6_getname+0x5f0/0x5f0 [ 243.397604][ T4841] ? kvm_sched_clock_read+0x18/0x40 [ 243.402895][ T4841] ? __kasan_check_read+0x11/0x20 [ 243.407926][ T4841] ? preempt_schedule_irq+0xca/0x120 [ 243.413213][ T4841] ? preempt_schedule_notrace+0x120/0x120 [ 243.419002][ T4841] sock_do_ioctl+0xda/0x380 [ 243.423604][ T4841] ? __irq_exit_rcu+0x40/0x150 [ 243.428376][ T4841] ? sock_show_fdinfo+0xa0/0xa0 [ 243.433299][ T4841] ? irqentry_exit+0x56/0x60 [ 243.437896][ T4841] ? sysvec_apic_timer_interrupt+0xcb/0xe0 [ 243.443775][ T4841] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 243.450024][ T4841] sock_ioctl+0x472/0x740 [ 243.454361][ T4841] ? sock_poll+0x350/0x350 [ 243.458803][ T4841] ? __fget_files+0x2e1/0x340 [ 243.463592][ T4841] ? security_file_ioctl+0x84/0xa0 [ 243.468718][ T4841] ? sock_poll+0x350/0x350 [ 243.473206][ T4841] __se_sys_ioctl+0x121/0x1a0 [ 243.477887][ T4841] __x64_sys_ioctl+0x7b/0x90 [ 243.482473][ T4841] do_syscall_64+0x31/0x40 [ 243.486885][ T4841] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 243.492847][ T4841] RIP: 0033:0x7faee95540d9 [ 243.497270][ T4841] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 243.516967][ T4841] RSP: 002b:00007faee7fad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 243.525556][ T4841] RAX: ffffffffffffffda RBX: 00007faee97dbfa0 RCX: 00007faee95540d9 [ 243.533610][ T4841] RDX: 0000200000000140 RSI: 0000000000008936 RDI: 0000000000000003 [ 243.541620][ T4841] RBP: 00007faee7fad090 R08: 0000000000000000 R09: 0000000000000000 [ 243.549629][ T4841] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 243.557599][ T4841] R13: 00007faee97dc038 R14: 00007faee97dbfa0 R15: 00007ffd0b3bd1c8 [ 243.686021][ T4851] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1491'. [ 243.881769][ T4856] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1494'. [ 243.897244][ T4850] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 243.906467][ T4850] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 243.939364][ T4850] F2FS-fs (loop2): Found nat_bits in checkpoint [ 243.965130][ T4850] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 243.965960][ T4859] EXT4-fs (loop4): Quota format mount options ignored when QUOTA feature is enabled [ 243.972466][ T4850] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 243.982038][ T4859] EXT4-fs (loop4): Test dummy encryption mode enabled [ 244.006501][ T4859] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=284ec018, mo2=0003] [ 244.014826][ T4859] System zones: 0-5 [ 244.019590][ T4859] EXT4-fs (loop4): mounted filesystem without journal. Opts: debug,jqfmt=vfsv0,inlinecrypt,test_dummy_encryption,nodelalloc,nojournal_checksum,delalloc,usrquota,noinit_itable,,errors=continue [ 244.170580][ T24] audit: type=1400 audit(1786713226.876:2949): avc: denied { listen } for pid=4878 comm="syz.4.1499" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 244.297337][ T24] audit: type=1400 audit(1786713227.006:2950): avc: denied { accept } for pid=4880 comm="syz.2.1498" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 244.466320][ T4895] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1507'. [ 244.543805][ T4893] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 244.552018][ T4893] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 244.577602][ T4893] F2FS-fs (loop2): Found nat_bits in checkpoint [ 244.614077][ T4893] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 244.621292][ T4893] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 244.655213][ T4893] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1506'. [ 244.682286][ T282] attempt to access beyond end of device [ 244.682286][ T282] loop2: rw=2049, want=40968, limit=40427 [ 244.761475][ T4912] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1510'. [ 244.835030][ T24] audit: type=1326 audit(1786713227.546:2951): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4920 comm="syz.2.1515" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faee95540d9 code=0x7ffc0000 [ 244.883726][ T24] audit: type=1326 audit(1786713227.546:2952): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4920 comm="syz.2.1515" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7faee95540d9 code=0x7ffc0000 [ 244.884479][ T4921] overlayfs: unrecognized mount option "verity=require" or missing value [ 244.909372][ T24] audit: type=1326 audit(1786713227.566:2953): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4920 comm="syz.2.1515" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faee95540d9 code=0x7ffc0000 [ 244.952447][ T24] audit: type=1326 audit(1786713227.566:2954): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4920 comm="syz.2.1515" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faee95540d9 code=0x7ffc0000 [ 244.978486][ T24] audit: type=1326 audit(1786713227.586:2955): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4920 comm="syz.2.1515" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faee95540d9 code=0x7ffc0000 [ 245.004909][ T4924] EXT4-fs (loop4): Ignoring removed orlov option [ 245.005941][ T24] audit: type=1326 audit(1786713227.586:2956): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4920 comm="syz.2.1515" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faee95540d9 code=0x7ffc0000 [ 245.036877][ T4924] EXT4-fs (loop4): Unrecognized mount option "smackfsroot={--\%-" or missing value [ 245.037750][ T24] audit: type=1326 audit(1786713227.586:2957): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4920 comm="syz.2.1515" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=81 compat=0 ip=0x7faee95540d9 code=0x7ffc0000 [ 245.073631][ T4924] SELinux: Context system_u:object_r:fsadm_exec_t:s0 is not valid (left unmapped). [ 245.074191][ T4921] overlayfs: failed to resolve './bus': -2 [ 245.172526][ T4930] netlink: 'syz.2.1518': attribute type 8 has an invalid length. [ 245.308693][ T4943] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1524'. [ 245.361552][ T4945] FAT-fs (loop4): Directory bread(block 64) failed [ 245.368299][ T4945] FAT-fs (loop4): Directory bread(block 65) failed [ 245.375038][ T4945] FAT-fs (loop4): Directory bread(block 66) failed [ 245.381772][ T4945] FAT-fs (loop4): Directory bread(block 67) failed [ 245.388388][ T4945] FAT-fs (loop4): Directory bread(block 68) failed [ 245.395036][ T4945] FAT-fs (loop4): Directory bread(block 69) failed [ 245.401596][ T4945] FAT-fs (loop4): Directory bread(block 70) failed [ 245.408352][ T4945] FAT-fs (loop4): Directory bread(block 71) failed [ 245.414971][ T4945] FAT-fs (loop4): Directory bread(block 72) failed [ 245.421580][ T4945] FAT-fs (loop4): Directory bread(block 73) failed [ 245.472284][ T4948] xt_hashlimit: max too large, truncated to 1048576 [ 245.472405][ T352] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 245.487017][ T4948] xt_hashlimit: Unknown mode mask 2000, kernel too old? [ 245.609020][ T7] attempt to access beyond end of device [ 245.609020][ T7] loop4: rw=1, want=1768, limit=256 [ 245.620518][ T7] attempt to access beyond end of device [ 245.620518][ T7] loop4: rw=1, want=1928, limit=256 [ 245.632863][ T7] attempt to access beyond end of device [ 245.632863][ T7] loop4: rw=1, want=4008, limit=256 [ 245.645286][ T7] attempt to access beyond end of device [ 245.645286][ T7] loop4: rw=1, want=6064, limit=256 [ 245.658851][ T7] attempt to access beyond end of device [ 245.658851][ T7] loop4: rw=1, want=9728, limit=256 [ 245.672810][ T7] attempt to access beyond end of device [ 245.672810][ T7] loop4: rw=1, want=13824, limit=256 [ 245.687114][ T7] attempt to access beyond end of device [ 245.687114][ T7] loop4: rw=1, want=18480, limit=256 [ 245.703680][ T7] attempt to access beyond end of device [ 245.703680][ T7] loop4: rw=1, want=26672, limit=256 [ 245.742382][ T352] usb 3-1: device descriptor read/64, error -71 [ 246.096099][ T4957] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 246.114057][ T4957] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 246.132398][ T352] usb 3-1: device descriptor read/64, error -71 [ 246.170091][ T4957] F2FS-fs (loop4): Found nat_bits in checkpoint [ 246.213729][ T4957] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 246.221018][ T4957] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 246.472576][ T352] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 246.631511][ T4973] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 246.752432][ T352] usb 3-1: device descriptor read/64, error -71 [ 247.482390][ T352] usb 3-1: device descriptor read/64, error -71 [ 247.482425][ T25] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 247.612581][ T352] usb usb3-port1: attempt power cycle [ 247.732352][ T25] usb 5-1: Using ep0 maxpacket: 32 [ 247.892408][ T25] usb 5-1: unable to get BOS descriptor or descriptor too short [ 247.972432][ T25] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 247.981566][ T25] usb 5-1: config 1 has no interface number 0 [ 248.022414][ T352] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 248.142393][ T25] usb 5-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 248.151628][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.159986][ T25] usb 5-1: Product: syz [ 248.164318][ T25] usb 5-1: Manufacturer: syz [ 248.168957][ T25] usb 5-1: SerialNumber: syz [ 248.192413][ T352] usb 3-1: device descriptor read/8, error -71 [ 248.240034][ T24] kauditd_printk_skb: 138 callbacks suppressed [ 248.240045][ T24] audit: type=1400 audit(1786713230.946:3096): avc: denied { create } for pid=4987 comm="syz.2.1538" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 248.384731][ T5005] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 248.405797][ T352] usb 3-1: device descriptor read/8, error -71 [ 248.421937][ T5005] EXT4-fs (loop2): mounted filesystem without journal. Opts: discard,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x0000000000000080,delalloc,nogrpid,noauto_da_alloc,dioread_nolock,,errors=continue [ 248.486562][ T5023] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1550'. [ 248.506580][ T25] usb 5-1: USB disconnect, device number 37 [ 248.636406][ T5037] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 248.644558][ T5037] netem: change failed [ 248.733821][ T5044] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1559'. [ 248.917041][ T5051] device vlan2 entered promiscuous mode [ 248.923157][ T5051] bridge0: port 2(vlan2) entered blocking state [ 248.929414][ T5051] bridge0: port 2(vlan2) entered disabled state [ 248.944124][ T5048] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 248.954407][ T5048] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 248.971808][ T5048] F2FS-fs (loop2): Found nat_bits in checkpoint [ 248.982513][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 249.015080][ T5048] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 249.022282][ T5048] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 249.044243][ T5048] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1561'. [ 249.057691][ T24] audit: type=1326 audit(1786713231.766:3097): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5063 comm="syz.1.1566" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faec93890d9 code=0x7ffc0000 [ 249.083200][ T24] audit: type=1326 audit(1786713231.766:3098): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5063 comm="syz.1.1566" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faec93890d9 code=0x7ffc0000 [ 249.083494][ T282] handle_bad_sector: 1 callbacks suppressed [ 249.083505][ T282] attempt to access beyond end of device [ 249.083505][ T282] loop2: rw=2049, want=40968, limit=40427 [ 249.108902][ T24] audit: type=1326 audit(1786713231.766:3099): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5063 comm="syz.1.1566" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7faec93890d9 code=0x7ffc0000 [ 249.162085][ T24] audit: type=1326 audit(1786713231.766:3100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5063 comm="syz.1.1566" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7faec9388e42 code=0x7ffc0000 [ 249.203376][ T24] audit: type=1326 audit(1786713231.766:3101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5063 comm="syz.1.1566" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7faec934990e code=0x7ffc0000 [ 249.228564][ T24] audit: type=1326 audit(1786713231.776:3102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5063 comm="syz.1.1566" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7faec9388f07 code=0x7ffc0000 [ 249.255011][ T24] audit: type=1326 audit(1786713231.796:3103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5063 comm="syz.1.1566" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7faec934990e code=0x7ffc0000 [ 249.282008][ T5072] FAT-fs (loop4): Directory bread(block 64) failed [ 249.282373][ T24] audit: type=1326 audit(1786713231.796:3104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5063 comm="syz.1.1566" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7faec934990e code=0x7ffc0000 [ 249.289895][ T5072] FAT-fs (loop4): Directory bread(block 65) failed [ 249.343399][ T5072] FAT-fs (loop4): Directory bread(block 66) failed [ 249.350445][ T5072] FAT-fs (loop4): Directory bread(block 67) failed [ 249.507685][ T5072] FAT-fs (loop4): Directory bread(block 68) failed [ 249.606462][ T5072] FAT-fs (loop4): Directory bread(block 69) failed [ 249.715526][ T5072] FAT-fs (loop4): Directory bread(block 70) failed [ 249.808213][ T5072] FAT-fs (loop4): Directory bread(block 71) failed [ 249.820831][ T24] audit: type=1326 audit(1786713231.836:3105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5063 comm="syz.1.1566" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faec93890d9 code=0x7ffc0000 [ 250.223087][ T5072] FAT-fs (loop4): Directory bread(block 72) failed [ 250.239835][ T5072] FAT-fs (loop4): Directory bread(block 73) failed [ 250.270001][ T5078] fuse: Bad value for 'group_id' [ 250.435533][ T5120] overlayfs: failed to resolve 'fsuuid=a6502e7f-0rc3-Â1d1-': -2 [ 250.444995][ T5121] netlink: 292 bytes leftover after parsing attributes in process `syz.2.1581'. [ 250.567977][ T5130] FAT-fs (loop2): Directory bread(block 64) failed [ 250.577182][ T5130] FAT-fs (loop2): Directory bread(block 65) failed [ 250.584132][ T5130] FAT-fs (loop2): Directory bread(block 66) failed [ 250.591948][ T5130] FAT-fs (loop2): Directory bread(block 67) failed [ 250.608212][ T5130] FAT-fs (loop2): Directory bread(block 68) failed [ 250.621109][ T5130] FAT-fs (loop2): Directory bread(block 69) failed [ 250.632992][ T5130] FAT-fs (loop2): Directory bread(block 70) failed [ 250.665282][ T5130] FAT-fs (loop2): Directory bread(block 71) failed [ 250.671945][ T5130] FAT-fs (loop2): Directory bread(block 72) failed [ 250.678544][ T5130] FAT-fs (loop2): Directory bread(block 73) failed [ 250.759566][ T5142] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1590'. [ 250.772592][ T301] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 251.022392][ T301] usb 5-1: Using ep0 maxpacket: 16 [ 251.142658][ T301] usb 5-1: config 32 has an invalid interface number: 64 but max is 0 [ 251.167795][ T301] usb 5-1: config 32 has an invalid descriptor of length 0, skipping remainder of the config [ 251.254648][ T301] usb 5-1: config 32 has no interface number 0 [ 251.306491][ T301] usb 5-1: New USB device found, idVendor=0bd3, idProduct=0569, bcdDevice= 0.5b [ 251.386534][ T301] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 251.739185][ T5154] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 251.772935][ T341] attempt to access beyond end of device [ 251.772935][ T341] loop2: rw=1, want=1768, limit=256 [ 251.786688][ T341] attempt to access beyond end of device [ 251.786688][ T341] loop2: rw=1, want=1928, limit=256 [ 251.802284][ T341] attempt to access beyond end of device [ 251.802284][ T341] loop2: rw=1, want=9456, limit=256 [ 251.826771][ T341] attempt to access beyond end of device [ 251.826771][ T341] loop2: rw=1, want=21144, limit=256 [ 251.844514][ T341] attempt to access beyond end of device [ 251.844514][ T341] loop2: rw=1, want=28816, limit=256 [ 251.929234][ T5173] fuse: Bad value for 'fd' [ 251.993823][ T5179] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 252.012990][ T5179] EXT4-fs (loop2): Test dummy encryption mode enabled [ 252.021201][ T5179] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=284ec018, mo2=0003] [ 252.029554][ T5179] System zones: 0-5 [ 252.034295][ T5179] EXT4-fs (loop2): mounted filesystem without journal. Opts: debug,jqfmt=vfsv0,inlinecrypt,test_dummy_encryption,nodelalloc,nojournal_checksum,delalloc,usrquota,noinit_itable,,errors=continue [ 252.119702][ T5179] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=2971058176 (47536930816 ns) > initial count (3939824 ns). Using initial count to start timer. [ 252.474012][ T5197] netlink: 'syz.0.1607': attribute type 8 has an invalid length. [ 252.505385][ T5199] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 252.665146][ T5214] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1615'. [ 252.776651][ T5222] netlink: 'syz.0.1618': attribute type 8 has an invalid length. [ 252.904158][ T5226] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 252.922449][ T5226] EXT4-fs (loop2): Test dummy encryption mode enabled [ 252.929418][ T5226] EXT4-fs (loop2): Unrecognized mount option "obj_role=jqfmt=vfsv0" or missing value [ 253.089960][ T5244] netlink: 292 bytes leftover after parsing attributes in process `syz.2.1626'. [ 253.159259][ T5248] fuse: Bad value for 'user_id' [ 254.170733][ T5258] netlink: 'syz.3.1630': attribute type 8 has an invalid length. [ 254.225962][ T949] usb 5-1: USB disconnect, device number 38 [ 254.301643][ T24] kauditd_printk_skb: 146 callbacks suppressed [ 254.301653][ T24] audit: type=1326 audit(1786713237.006:3252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5276 comm="syz.1.1639" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faec93890d9 code=0x7ffc0000 [ 254.483732][ T5270] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 254.565277][ T5270] EXT4-fs error (device loop4): ext4_mb_generate_buddy:824: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 254.586529][ T24] audit: type=1326 audit(1786713237.006:3253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5276 comm="syz.1.1639" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faec93890d9 code=0x7ffc0000 [ 254.589418][ T5287] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1642'. [ 254.612198][ T5270] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 31 with max blocks 33 with error 28 [ 254.633223][ T24] audit: type=1326 audit(1786713237.026:3254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5276 comm="syz.1.1639" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7faec93890d9 code=0x7ffc0000 [ 254.647517][ T5270] EXT4-fs (loop4): This should not happen!! Data will be lost [ 254.647517][ T5270] [ 254.659064][ T24] audit: type=1326 audit(1786713237.026:3255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5276 comm="syz.1.1639" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7faec9388e42 code=0x7ffc0000 [ 254.670134][ T5270] EXT4-fs (loop4): Total free blocks count 0 [ 254.751595][ T5270] EXT4-fs (loop4): Free/Dirty block details [ 254.758121][ T5270] EXT4-fs (loop4): free_blocks=4096 [ 254.763676][ T5270] EXT4-fs (loop4): dirty_blocks=80 [ 254.769309][ T5270] EXT4-fs (loop4): Block reservation details [ 254.775860][ T5270] EXT4-fs (loop4): i_reserved_data_blocks=5 [ 254.784511][ T5270] EXT4-fs error (device loop4) in ext4_setattr:5745: error 28 [ 254.819541][ T24] audit: type=1326 audit(1786713237.026:3256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5276 comm="syz.1.1639" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7faec934990e code=0x7ffc0000 [ 254.939243][ T24] audit: type=1326 audit(1786713237.026:3257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5276 comm="syz.1.1639" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7faec9388f07 code=0x7ffc0000 [ 255.011415][ T24] audit: type=1326 audit(1786713237.046:3258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5276 comm="syz.1.1639" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7faec934990e code=0x7ffc0000 [ 255.038838][ T24] audit: type=1326 audit(1786713237.046:3259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5276 comm="syz.1.1639" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7faec934990e code=0x7ffc0000 [ 255.066154][ T24] audit: type=1326 audit(1786713237.146:3260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5276 comm="syz.1.1639" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faec93890d9 code=0x7ffc0000 [ 255.230993][ T24] audit: type=1326 audit(1786713237.166:3261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5276 comm="syz.1.1639" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faec93890d9 code=0x7ffc0000 [ 255.277263][ T5298] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1646'. [ 255.984245][ T5306] F2FS-fs (loop4): invalid crc value [ 256.035033][ T5321] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 256.052184][ T5306] F2FS-fs (loop4): Found nat_bits in checkpoint [ 256.067428][ T5321] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 256.120699][ T5306] F2FS-fs (loop4): Cannot turn on quotas: -2 on 2 [ 256.135057][ T5306] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 256.143494][ T5321] F2FS-fs (loop2): Found nat_bits in checkpoint [ 256.202705][ T5306] netlink: 292 bytes leftover after parsing attributes in process `syz.4.1644'. [ 256.231228][ T5321] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 256.289060][ T5321] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 256.758161][ T5361] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1665'. [ 257.063777][ T5356] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 257.083922][ T5356] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 257.111532][ T5356] F2FS-fs (loop2): invalid crc_offset: 33558524 [ 257.141778][ T5356] F2FS-fs (loop2): Found nat_bits in checkpoint [ 257.200678][ T5356] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 257.200821][ T5376] xt_TPROXY: Can be used only with -p tcp or -p udp [ 257.207825][ T5356] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 257.264514][ T5380] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1672'. [ 258.433273][ T5398] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1679'. [ 258.442560][ T5398] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1679'. [ 258.571004][ T5404] xt_TPROXY: Can be used only with -p tcp or -p udp [ 258.662958][ T5412] EXT4-fs (loop4): Test dummy encryption mode enabled [ 258.961583][ T5412] EXT4-fs (loop4): Ignoring removed orlov option [ 259.009334][ T5412] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,debug_want_extra_isize=0x0000000000000010,nodioread_nolock,test_dummy_encryption,lazytime,stripe=0x0000000000000000,minixdf,orlov,,errors=continue [ 259.074334][ T5412] fscrypt: AES-256-CTS-CBC using implementation "cts(cbc-aes-aesni)" [ 259.401993][ T5441] netlink: 100 bytes leftover after parsing attributes in process `syz.1.1694'. [ 259.732398][ T301] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 259.927062][ T5453] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1699'. [ 259.944600][ T5457] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1701'. [ 259.972536][ T301] usb 5-1: Using ep0 maxpacket: 16 [ 260.182499][ T25] usb 3-1: new full-speed USB device number 30 using dummy_hcd [ 260.252427][ T301] usb 5-1: New USB device found, idVendor=0d49, idProduct=7010, bcdDevice= c.90 [ 260.261664][ T301] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 260.269945][ T301] usb 5-1: Product: syz [ 260.274397][ T301] usb 5-1: Manufacturer: syz [ 260.279045][ T301] usb 5-1: SerialNumber: syz [ 260.287575][ T301] usb 5-1: config 0 descriptor?? [ 260.332815][ T301] ums-onetouch 5-1:0.0: USB Mass Storage device detected [ 260.534387][ T5483] udc-core: couldn't find an available UDC or it's busy [ 260.541501][ T5483] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 260.549353][ T25] usb 3-1: unable to get BOS descriptor or descriptor too short [ 260.576915][ T949] usb 5-1: USB disconnect, device number 39 [ 260.627751][ T5491] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1713'. [ 260.653311][ T5493] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1714'. [ 260.668485][ T24] kauditd_printk_skb: 75 callbacks suppressed [ 260.668495][ T24] audit: type=1400 audit(1786713243.376:3337): avc: denied { bind } for pid=5494 comm="syz.1.1715" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 260.695903][ T25] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 260.708595][ T25] usb 3-1: can't read configurations, error -71 [ 260.732356][ T24] audit: type=1400 audit(1786713243.436:3338): avc: denied { getopt } for pid=5494 comm="syz.1.1715" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 260.782417][ T24] audit: type=1400 audit(1786713243.486:3339): avc: denied { setattr } for pid=5501 comm="syz.4.1719" name="ptmx" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ptmx_t tclass=chr_file permissive=1 [ 260.854073][ T5506] raw_sendmsg: syz.3.1720 forgot to set AF_INET. Fix it! [ 260.968822][ T24] audit: type=1400 audit(1786713243.676:3340): avc: denied { ioctl } for pid=5514 comm="syz.3.1723" path="socket:[31094]" dev="sockfs" ino=31094 ioctlcmd=0x6611 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 261.040536][ T24] audit: type=1400 audit(1786713243.746:3341): avc: denied { shutdown } for pid=5517 comm="syz.1.1726" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 261.197821][ T5533] netlink: 'syz.4.1732': attribute type 8 has an invalid length. [ 261.491737][ T24] audit: type=1400 audit(1786713244.196:3342): avc: denied { connect } for pid=5539 comm="syz.2.1734" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 261.583813][ T5549] __nla_validate_parse: 1 callbacks suppressed [ 261.583821][ T5549] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1738'. [ 261.599762][ T5549] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1738'. [ 261.665464][ T5553] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1740'. [ 261.672355][ T301] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 261.922368][ T301] usb 5-1: Using ep0 maxpacket: 32 [ 261.994536][ T25] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 262.013899][ T24] audit: type=1400 audit(1786713244.726:3343): avc: denied { create } for pid=5563 comm="syz.3.1744" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 262.033738][ T24] audit: type=1400 audit(1786713244.726:3344): avc: denied { setattr } for pid=5563 comm="syz.3.1744" name="NETLINK" dev="sockfs" ino=30166 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 262.112502][ T301] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 262.123950][ T301] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 262.134700][ T301] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 262.144811][ T301] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 262.185083][ T301] usb 5-1: config 0 descriptor?? [ 262.362422][ T25] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 262.372689][ T25] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 262.526269][ T5574] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 262.540267][ T25] usb 3-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 262.549753][ T25] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.558338][ T25] usb 3-1: Product: syz [ 262.562955][ T25] usb 3-1: Manufacturer: syz [ 262.620484][ T25] usb 3-1: SerialNumber: syz [ 262.656234][ T5577] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1749'. [ 262.665645][ T5577] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1749'. [ 262.718912][ T301] koneplus 0003:1E7D:2D51.000A: unknown main item tag 0x0 [ 262.726715][ T301] koneplus 0003:1E7D:2D51.000A: unknown main item tag 0x0 [ 262.734925][ T301] koneplus 0003:1E7D:2D51.000A: unknown main item tag 0x0 [ 262.743289][ T301] koneplus 0003:1E7D:2D51.000A: item fetching failed at offset 4/5 [ 262.883994][ T301] koneplus 0003:1E7D:2D51.000A: parse failed [ 262.890141][ T301] koneplus: probe of 0003:1E7D:2D51.000A failed with error -22 [ 262.924360][ T5538] udc-core: couldn't find an available UDC or it's busy [ 262.931980][ T5538] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 262.942728][ T20] usb 5-1: USB disconnect, device number 40 [ 262.949006][ T5575] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1748'. [ 262.962205][ T5584] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1752'. [ 262.990843][ T5586] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1753'. [ 263.003150][ T25] usb 3-1: unit 4 not found! [ 263.009955][ T25] usb 3-1: USB disconnect, device number 32 [ 263.142624][ T5603] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1759'. [ 263.945281][ T25] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 264.075862][ T5618] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 264.085305][ T5618] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 264.111669][ T5618] F2FS-fs (loop2): Found nat_bits in checkpoint [ 264.154418][ T5618] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 264.161537][ T5618] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 264.192341][ T25] usb 5-1: Using ep0 maxpacket: 16 [ 264.198613][ T282] attempt to access beyond end of device [ 264.198613][ T282] loop2: rw=2049, want=40968, limit=40427 [ 264.211042][ T5639] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1772'. [ 264.214294][ T5636] fuse: Bad value for 'fd' [ 264.605457][ T5653] xt_CT: No such helper "netbios-ns" [ 264.632454][ T25] usb 5-1: unable to get BOS descriptor or descriptor too short [ 264.780483][ T5654] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 265.006081][ T24] audit: type=1400 audit(1786713247.716:3345): avc: denied { read append } for pid=5671 comm="syz.2.1783" name="rtc0" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 265.032530][ T25] usb 5-1: string descriptor 0 read error: -22 [ 265.043735][ T25] usb 5-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 265.060006][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 265.123483][ T25] usb 5-1: 1:1 : bogus bTerminalLink 4 [ 265.212716][ T5682] FAT-fs (loop2): Unrecognized mount option "utf1=1" or missing value [ 265.302787][ T5622] udc-core: couldn't find an available UDC or it's busy [ 265.309930][ T5622] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 265.342366][ T25] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 265.350439][ T5682] EXT4-fs (loop2): mounted filesystem without journal. Opts: lazytime,errors=remount-ro, [ 265.360530][ T5682] ext4 filesystem being mounted at /275/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 265.373367][ T25] usb 5-1: USB disconnect, device number 41 [ 265.396547][ T5682] EXT4-fs error (device loop2): ext4_get_first_dir_block:3708: inode #12: comm syz.2.1786: Attempting to read directory block (0) that is past i_size (3) [ 265.424944][ T5682] EXT4-fs (loop2): Remounting filesystem read-only [ 265.439103][ T7] EXT4-fs (loop2): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 265.450635][ T7] Quota error (device loop2): write_blk: dquota write failed [ 265.567956][ T301] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 265.575931][ T301] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 265.575977][ T2881] udevd[2881]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 265.592383][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 265.617667][ T5695] EXT4-fs (loop2): orphan cleanup on readonly fs [ 265.631078][ T5695] EXT4-fs error (device loop2): ext4_ext_check_inode:500: inode #4: comm syz.2.1790: pblk 0 bad header/extent: too large eh_depth - magic f30a, entries 1, max 4(4), depth 2048(2048) [ 265.650869][ T5695] EXT4-fs error (device loop2): ext4_quota_enable:6454: comm syz.2.1790: Bad quota inode: 4, type: 1 [ 265.662441][ T5695] EXT4-fs warning (device loop2): ext4_enable_quotas:6495: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 265.677633][ T5695] EXT4-fs (loop2): Cannot turn on quotas: error -117 [ 265.684609][ T5695] EXT4-fs (loop2): mounted filesystem without journal. Opts: quota,noblock_validity,journal_dev=0x0000000000000003,journal_dev=0x000000000000000b,barrier=0x0000000000000081,minixdf,inode_readahead_blks=0x0000000000000040,,errors=continue [ 266.102389][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 266.502379][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 266.768082][ T5736] overlayfs: failed to clone upperpath [ 267.155176][ T5723] F2FS-fs (loop2): Corrupted extension count (64 + 1 > 64) [ 267.192634][ T5730] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 267.313533][ T5723] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 267.343035][ T5730] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 267.363169][ T5723] F2FS-fs (loop2): invalid crc value [ 267.369828][ T5723] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 267.399765][ T5730] F2FS-fs (loop4): Found nat_bits in checkpoint [ 267.407210][ T5723] F2FS-fs (loop2): Start checkpoint disabled! [ 267.414328][ T5723] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 267.421502][ T5723] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 267.439661][ T5730] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 267.446794][ T5730] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 267.470921][ T284] attempt to access beyond end of device [ 267.470921][ T284] loop4: rw=2049, want=40968, limit=40427 [ 267.763925][ T5757] F2FS-fs (loop4): Corrupted extension count (64 + 1 > 64) [ 267.779521][ T5757] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 267.789397][ T5757] F2FS-fs (loop4): invalid crc value [ 267.795702][ T5757] F2FS-fs (loop4): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 267.826602][ T5757] F2FS-fs (loop4): Start checkpoint disabled! [ 267.833583][ T5757] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 267.840758][ T5757] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 267.957745][ T5757] attempt to access beyond end of device [ 267.957745][ T5757] loop4: rw=2049, want=57344, limit=40427 [ 267.978949][ T5757] attempt to access beyond end of device [ 267.978949][ T5757] loop4: rw=2049, want=122880, limit=40427 [ 267.999558][ T5757] attempt to access beyond end of device [ 267.999558][ T5757] loop4: rw=2049, want=61440, limit=40427 [ 268.012081][ T5757] attempt to access beyond end of device [ 268.012081][ T5757] loop4: rw=2049, want=49160, limit=40427 [ 268.102457][ T25] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 268.276152][ T5757] attempt to access beyond end of device [ 268.276152][ T5757] loop4: rw=2049, want=53248, limit=40427 [ 268.289748][ T5757] attempt to access beyond end of device [ 268.289748][ T5757] loop4: rw=2049, want=69640, limit=40427 [ 268.301925][ T5757] attempt to access beyond end of device [ 268.301925][ T5757] loop4: rw=2049, want=69648, limit=40427 [ 268.313576][ T5757] attempt to access beyond end of device [ 268.313576][ T5757] loop4: rw=2049, want=69656, limit=40427 [ 268.492540][ T25] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 268.504823][ T25] usb 3-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 268.514226][ T25] usb 3-1: config 220 interface 0 has no altsetting 0 [ 268.692461][ T25] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 268.705683][ T25] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 268.722330][ T25] usb 3-1: Product: syz [ 268.726614][ T25] usb 3-1: Manufacturer: syz [ 268.731292][ T25] usb 3-1: SerialNumber: syz [ 269.095991][ T5786] __nla_validate_parse: 6 callbacks suppressed [ 269.096001][ T5786] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1817'. [ 269.124044][ T5789] xt_hashlimit: size too large, truncated to 1048576 [ 269.249552][ T5791] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 269.291643][ T24] kauditd_printk_skb: 1 callbacks suppressed [ 269.291654][ T24] audit: type=1400 audit(1786713251.996:3346): avc: denied { execute } for pid=5790 comm="syz.4.1820" path="/287/file1/file1" dev="loop4" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 269.331023][ T5762] netlink: 100 bytes leftover after parsing attributes in process `syz.2.1811'. [ 269.462599][ T25] uvcvideo: Found UVC 0.00 device syz (8086:0b07) [ 269.469309][ T25] uvcvideo: No valid video chain found. [ 269.476316][ T25] usb 3-1: USB disconnect, device number 33 [ 269.782360][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 269.869035][ T24] audit: type=1400 audit(1786713252.576:3347): avc: denied { create } for pid=5813 comm="syz.1.1829" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 269.933637][ T5824] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1833'. [ 269.953393][ T5827] xt_hashlimit: size too large, truncated to 1048576 [ 269.980421][ T24] audit: type=1400 audit(1786713252.686:3348): avc: denied { mount } for pid=5830 comm="syz.4.1835" name="/" dev="pstore" ino=1257 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 270.025505][ T5831] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 270.073794][ T5831] EXT4-fs (loop4): mounted filesystem without journal. Opts: user_xattr,init_itable=0x0000000000000010,dioread_nolock,acl,debug_want_extra_isize=0x0000000000000070,sb=0x0000000000000000,stripe=0x000000000000bb4b,data_err=abort,max_batch_time=0x00000000000003fe,abort,noinit_itable,,errors=continue [ 270.148627][ T5831] EXT4-fs (loop4): Remounting file system with no journal so ignoring journalled data option [ 270.159746][ T5831] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 270.172229][ T5831] EXT4-fs (loop4): changing journal_checksum during remount not supported; ignoring [ 270.182009][ T5831] EXT4-fs error (device loop4): ext4_remount:5882: Abort forced by user [ 270.190618][ T5831] EXT4-fs (loop4): Remounting filesystem read-only [ 270.202754][ T5831] EXT4-fs (loop4): re-mounted. Opts: nogrpid,journal_ioprio=0x0000000000000001,user_xattr,grpjquota=,data=writeback,noblock_validity,minixdf,journal_checksum, [ 270.881138][ T5857] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1845'. [ 270.968793][ T5859] netlink: 100 bytes leftover after parsing attributes in process `syz.0.1846'. [ 271.105472][ T5866] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 271.106859][ T5871] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1850'. [ 271.131078][ T5866] EXT4-fs (loop2): Test dummy encryption mode enabled [ 271.140279][ T5866] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=284ec018, mo2=0003] [ 271.149950][ T5866] System zones: 0-5 [ 271.154212][ T5874] xt_hashlimit: size too large, truncated to 1048576 [ 271.154933][ T5866] EXT4-fs (loop2): mounted filesystem without journal. Opts: debug,jqfmt=vfsv0,inlinecrypt,test_dummy_encryption,nodelalloc,nojournal_checksum,delalloc,usrquota,noinit_itable,,errors=continue [ 271.258970][ T5866] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=2971058176 (47536930816 ns) > initial count (3939824 ns). Using initial count to start timer. [ 271.621337][ T5893] netlink: 100 bytes leftover after parsing attributes in process `syz.0.1857'. [ 272.625219][ T5911] xt_hashlimit: size too large, truncated to 1048576 [ 272.742364][ T5920] netlink: 100 bytes leftover after parsing attributes in process `syz.4.1868'. [ 273.107164][ T5934] xt_hashlimit: max too large, truncated to 1048576 [ 273.117440][ T5934] xt_hashlimit: Unknown mode mask 2000, kernel too old? [ 273.158825][ T5938] netlink: 144 bytes leftover after parsing attributes in process `syz.2.1875'. [ 274.338457][ T5956] netlink: 100 bytes leftover after parsing attributes in process `syz.1.1881'. [ 274.932765][ T5972] FAT-fs (loop2): Unrecognized mount option "utf1=1" or missing value [ 274.982593][ T5977] exfat: Bad value for 'fmask' [ 275.083576][ T5972] EXT4-fs (loop2): mounted filesystem without journal. Opts: lazytime,errors=remount-ro, [ 275.093564][ T5972] ext4 filesystem being mounted at /290/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 275.117117][ T5972] EXT4-fs error (device loop2): ext4_get_first_dir_block:3708: inode #12: comm syz.2.1886: Attempting to read directory block (0) that is past i_size (3) [ 275.135718][ T5972] EXT4-fs (loop2): Remounting filesystem read-only [ 275.143700][ T5972] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1886'. [ 275.159330][ T7] EXT4-fs (loop2): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 275.170184][ T7] Quota error (device loop2): write_blk: dquota write failed [ 275.177910][ T7] Quota error (device loop2): free_dqentry: Can't write quota data block 5 [ 275.223398][ T5990] netlink: 100 bytes leftover after parsing attributes in process `syz.1.1893'. [ 275.244501][ T24] audit: type=1326 audit(1786713257.956:3349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5984 comm="syz.4.1890" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f80d60570d9 code=0x7ffc0000 [ 275.272385][ T24] audit: type=1326 audit(1786713257.956:3350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5984 comm="syz.4.1890" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f80d60570d9 code=0x7ffc0000 [ 275.310185][ T24] audit: type=1326 audit(1786713257.956:3351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5984 comm="syz.4.1890" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f80d60570d9 code=0x7ffc0000 [ 275.358464][ T24] audit: type=1326 audit(1786713257.956:3352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5984 comm="syz.4.1890" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f80d6056e42 code=0x7ffc0000 [ 275.383927][ T24] audit: type=1326 audit(1786713257.956:3353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5984 comm="syz.4.1890" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f80d601790e code=0x7ffc0000 [ 275.465119][ T24] audit: type=1326 audit(1786713257.956:3354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5984 comm="syz.4.1890" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7f80d6056f07 code=0x7ffc0000 [ 275.491103][ T24] audit: type=1326 audit(1786713257.956:3355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5984 comm="syz.4.1890" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f80d601790e code=0x7ffc0000 [ 276.453998][ T24] audit: type=1326 audit(1786713258.016:3356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5984 comm="syz.4.1890" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f80d6056d6b code=0x7ffc0000 [ 277.452162][ T6016] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 277.532944][ T6013] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 277.930860][ T6013] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 277.970433][ T6013] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:476: comm syz.4.1898: Invalid block bitmap block 0 in block_group 0 [ 277.974149][ T6027] netlink: 100 bytes leftover after parsing attributes in process `syz.3.1904'. [ 277.984565][ T6013] EXT4-fs error (device loop4) in ext4_mb_clear_bb:5650: Corrupt filesystem [ 278.002758][ T6013] EXT4-fs error (device loop4): ext4_clear_blocks:880: inode #11: comm syz.4.1898: attempt to clear invalid blocks 983261 len 1 [ 278.007543][ T6018] Alternate GPT is invalid, using primary GPT. [ 278.016671][ T6013] EXT4-fs error (device loop4): __ext4_get_inode_loc:4451: comm syz.4.1898: Invalid inode table block 0 in block_group 0 [ 278.104448][ T6018] loop2: p1 p2 p3 [ 278.133201][ T6031] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1905'. [ 278.282162][ T6013] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5971: Corrupt filesystem [ 278.282472][ T6031] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1905'. [ 278.310653][ T6013] EXT4-fs error (device loop4) in ext4_orphan_del:3292: Corrupt filesystem [ 278.322337][ T6013] EXT4-fs error (device loop4): __ext4_get_inode_loc:4451: comm syz.4.1898: Invalid inode table block 0 in block_group 0 [ 278.344489][ T6013] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5971: Corrupt filesystem [ 278.354377][ T6013] EXT4-fs error (device loop4): ext4_truncate:4403: inode #11: comm syz.4.1898: mark_inode_dirty error [ 278.369329][ T6013] EXT4-fs error (device loop4) in ext4_orphan_cleanup:3106: Corrupt filesystem [ 278.376692][ T3128] udevd[3128]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 278.389432][ T2881] udevd[2881]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 278.396069][ T5700] udevd[5700]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 278.401073][ T6013] EXT4-fs error (device loop4): __ext4_get_inode_loc:4451: comm syz.4.1898: Invalid inode table block 0 in block_group 0 [ 278.422586][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 278.450558][ T6013] EXT4-fs (loop4): 1 truncate cleaned up [ 278.456695][ T6013] EXT4-fs (loop4): mounted filesystem without journal. Opts: dioread_nolock,resuid=0x0000000000000000,journal_dev=0x0000000000000002,noblock_validity,,errors=continue [ 278.725950][ T6013] EXT4-fs error (device loop4): __ext4_get_inode_loc:4451: comm syz.4.1898: Invalid inode table block 0 in block_group 0 [ 279.629493][ T6058] bridge0: port 1(bridge_slave_0) entered disabled state [ 279.639799][ T6058] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1916'. [ 279.648900][ T6058] bridge0: port 1(bridge_slave_0) entered blocking state [ 279.655960][ T6058] bridge0: port 1(bridge_slave_0) entered forwarding state [ 279.787663][ T6066] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65309 sclass=netlink_route_socket pid=6066 comm=syz.1.1918 [ 280.120032][ T6074] tipc: Started in network mode [ 280.144516][ T6074] tipc: Own node identity aaaaaaaaaaaa, cluster identity 4711 [ 280.161637][ T6074] tipc: Enabled bearer , priority 0 [ 280.222442][ T398] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 280.607227][ T6085] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1924'. [ 280.698511][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 281.333985][ T6096] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1928'. [ 281.531607][ T6100] xt_hashlimit: max too large, truncated to 1048576 [ 281.542327][ T398] usb 3-1: Using ep0 maxpacket: 32 [ 281.548242][ T6100] xt_hashlimit: Unknown mode mask 2000, kernel too old? [ 281.603358][ T5] tipc: 32-bit node address hash set to aaaa0000 [ 281.622392][ T398] usb 3-1: device descriptor read/all, error -71 [ 281.709398][ T6105] device vlan2 entered promiscuous mode [ 281.735889][ T6105] bridge0: port 2(vlan2) entered blocking state [ 281.742175][ T6105] bridge0: port 2(vlan2) entered disabled state [ 281.777985][ T24] kauditd_printk_skb: 38 callbacks suppressed [ 281.778007][ T24] audit: type=1400 audit(1786713264.486:3395): avc: denied { write } for pid=6106 comm="syz.4.1933" name="ppp" dev="devtmpfs" ino=153 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 282.958059][ T6137] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1944'. [ 283.156769][ T6146] netlink: 144 bytes leftover after parsing attributes in process `syz.1.1947'. [ 283.360096][ T6156] xt_hashlimit: size too large, truncated to 1048576 [ 283.818890][ T6121] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 284.054538][ T6164] EXT4-fs (loop4): Quota format mount options ignored when QUOTA feature is enabled [ 284.078047][ T6164] EXT4-fs (loop4): Test dummy encryption mode enabled [ 284.107910][ T6164] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=284ec018, mo2=0003] [ 284.116457][ T6164] System zones: 0-5 [ 284.121088][ T6164] EXT4-fs (loop4): mounted filesystem without journal. Opts: debug,jqfmt=vfsv0,inlinecrypt,test_dummy_encryption,nodelalloc,nojournal_checksum,delalloc,usrquota,noinit_itable,,errors=continue [ 284.244263][ T6164] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=2971058176 (47536930816 ns) > initial count (3939824 ns). Using initial count to start timer. [ 284.376979][ T6184] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1959'. [ 284.574289][ T6182] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1958'. [ 284.628873][ T6179] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1957'. [ 284.797798][ T6221] x_tables: ip_tables: socket match: used from hooks POSTROUTING, but only valid from PREROUTING/INPUT [ 285.232335][ T5] usb 5-1: new full-speed USB device number 42 using dummy_hcd [ 285.552411][ T5] usb 5-1: not running at top speed; connect to a high speed hub [ 285.792405][ T5] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 285.802910][ T5] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 285.812132][ T5] usb 5-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 285.823532][ T5] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.885710][ T5] uvcvideo: Found UVC 1.00 device (046d:0825) [ 285.893265][ T5] uvcvideo: No valid video chain found. [ 285.899072][ T6257] netlink: 'syz.1.1987': attribute type 8 has an invalid length. [ 285.929999][ T6258] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 285.950281][ T6258] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 285.961701][ T6258] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:476: comm syz.2.1983: Invalid block bitmap block 0 in block_group 0 [ 285.975586][ T6258] EXT4-fs error (device loop2) in ext4_mb_clear_bb:5650: Corrupt filesystem [ 285.984558][ T6258] EXT4-fs error (device loop2): ext4_clear_blocks:880: inode #11: comm syz.2.1983: attempt to clear invalid blocks 983261 len 1 [ 285.998096][ T6258] EXT4-fs error (device loop2): __ext4_get_inode_loc:4451: comm syz.2.1983: Invalid inode table block 0 in block_group 0 [ 286.011292][ T6258] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5971: Corrupt filesystem [ 286.021013][ T6258] EXT4-fs error (device loop2) in ext4_orphan_del:3292: Corrupt filesystem [ 286.030104][ T6258] EXT4-fs error (device loop2): __ext4_get_inode_loc:4451: comm syz.2.1983: Invalid inode table block 0 in block_group 0 [ 286.043103][ T6258] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5971: Corrupt filesystem [ 286.052734][ T6258] EXT4-fs error (device loop2): ext4_truncate:4403: inode #11: comm syz.2.1983: mark_inode_dirty error [ 286.064220][ T6258] EXT4-fs error (device loop2) in ext4_orphan_cleanup:3106: Corrupt filesystem [ 286.073546][ T6258] EXT4-fs error (device loop2): __ext4_get_inode_loc:4451: comm syz.2.1983: Invalid inode table block 0 in block_group 0 [ 286.076141][ T6232] netlink: 144 bytes leftover after parsing attributes in process `syz.4.1978'. [ 286.086611][ T6258] EXT4-fs (loop2): 1 truncate cleaned up [ 286.105206][ T6258] EXT4-fs (loop2): mounted filesystem without journal. Opts: dioread_nolock,resuid=0x0000000000000000,journal_dev=0x0000000000000002,noblock_validity,,errors=continue [ 286.202642][ T6258] EXT4-fs error (device loop2): __ext4_get_inode_loc:4451: comm syz.2.1983: Invalid inode table block 0 in block_group 0 [ 286.203891][ T6269] x_tables: ip_tables: socket match: used from hooks POSTROUTING, but only valid from PREROUTING/INPUT [ 286.216116][ T6270] x_tables: ip_tables: socket match: used from hooks POSTROUTING, but only valid from PREROUTING/INPUT [ 286.358750][ T24] audit: type=1326 audit(1786713269.066:3396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6277 comm="syz.3.1994" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2412d440d9 code=0x7ffc0000 [ 286.383780][ T24] audit: type=1326 audit(1786713269.066:3397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6277 comm="syz.3.1994" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2412d440d9 code=0x7ffc0000 [ 286.409276][ T24] audit: type=1326 audit(1786713269.096:3398): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6277 comm="syz.3.1994" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f2412d440d9 code=0x7ffc0000 [ 286.434371][ T24] audit: type=1326 audit(1786713269.096:3399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6277 comm="syz.3.1994" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f2412d43e42 code=0x7ffc0000 [ 286.459427][ T24] audit: type=1326 audit(1786713269.096:3400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6277 comm="syz.3.1994" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f2412d0490e code=0x7ffc0000 [ 286.484725][ T24] audit: type=1326 audit(1786713269.096:3401): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6277 comm="syz.3.1994" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7f2412d43f07 code=0x7ffc0000 [ 286.509682][ T24] audit: type=1326 audit(1786713269.096:3402): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6277 comm="syz.3.1994" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f2412d0490e code=0x7ffc0000 [ 286.535094][ T24] audit: type=1326 audit(1786713269.096:3403): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6277 comm="syz.3.1994" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f2412d0490e code=0x7ffc0000 [ 286.560654][ T24] audit: type=1326 audit(1786713269.096:3404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6277 comm="syz.3.1994" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2412d440d9 code=0x7ffc0000 [ 287.174611][ T25] usb 5-1: USB disconnect, device number 42 [ 287.641845][ T6291] netlink: 'syz.4.1999': attribute type 8 has an invalid length. [ 287.681227][ T24] kauditd_printk_skb: 28 callbacks suppressed [ 287.681239][ T24] audit: type=1400 audit(1786713270.386:3433): avc: denied { ioctl } for pid=6297 comm="syz.4.2001" path="/326/tracing/dynamic_events" dev="tracefs" ino=12713 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 287.692410][ T301] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 288.032507][ T301] usb 3-1: Using ep0 maxpacket: 16 [ 288.212418][ T301] usb 3-1: unable to get BOS descriptor or descriptor too short [ 288.242340][ T5] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 288.302399][ T301] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 288.312614][ T301] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 288.323783][ T301] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 288.481306][ T6310] netlink: 76 bytes leftover after parsing attributes in process `syz.3.2005'. [ 288.495462][ T6312] xt_hashlimit: max too large, truncated to 1048576 [ 288.502075][ T6312] xt_hashlimit: Unknown mode mask 2000, kernel too old? [ 288.512435][ T301] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 288.521497][ T301] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 288.529739][ T301] usb 3-1: Product: syz [ 288.534072][ T301] usb 3-1: Manufacturer: syz [ 288.538665][ T301] usb 3-1: SerialNumber: syz [ 288.593485][ T6323] netlink: 100 bytes leftover after parsing attributes in process `syz.3.2011'. [ 288.642414][ T5] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 288.653559][ T5] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 288.663498][ T5] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 288.676523][ T5] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 288.685606][ T5] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 288.695242][ T5] usb 5-1: config 0 descriptor?? [ 288.802874][ T301] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 288.811211][ T301] snd-usb-audio: probe of 3-1:1.0 failed with error -22 [ 288.974063][ T24] audit: type=1400 audit(1786713271.686:3434): avc: denied { accept } for pid=6326 comm="syz.1.2013" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 289.000023][ T6329] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2014'. [ 289.035675][ T24] audit: type=1400 audit(1786713271.746:3435): avc: denied { mounton } for pid=6332 comm="syz.1.2016" path="/file0" dev="rootfs" ino=19847 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 289.120561][ T6339] netlink: 76 bytes leftover after parsing attributes in process `syz.1.2018'. [ 289.174721][ T5] plantronics 0003:047F:FFFF.000B: No inputs registered, leaving [ 289.188991][ T5] plantronics 0003:047F:FFFF.000B: hiddev96,hidraw0: USB HID v0.00 Joystick [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 289.264809][ T300] tipc: Subscription rejected, illegal request [ 289.282400][ T301] usb 3-1: 2:1 : bogus bTerminalLink 6 [ 289.382394][ T6347] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2021'. [ 289.523573][ T301] usb 3-1: USB disconnect, device number 36 [ 289.595514][ T6358] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 289.621635][ T6358] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 289.663937][ T6373] netlink: 76 bytes leftover after parsing attributes in process `syz.3.2030'. [ 289.685606][ T24] audit: type=1400 audit(1786713272.396:3436): avc: denied { listen } for pid=6374 comm="syz.3.2032" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 289.710728][ T6375] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2032'. [ 289.772494][ T24] audit: type=1326 audit(1786713272.486:3437): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6374 comm="syz.3.2032" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2412d440d9 code=0x7ffc0000 [ 289.797743][ T24] audit: type=1326 audit(1786713272.486:3438): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6374 comm="syz.3.2032" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2412d440d9 code=0x7ffc0000 [ 289.822933][ T24] audit: type=1326 audit(1786713272.486:3439): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6374 comm="syz.3.2032" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2412d440d9 code=0x7ffc0000 [ 289.848233][ T24] audit: type=1326 audit(1786713272.486:3440): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6374 comm="syz.3.2032" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7f2412d440d9 code=0x7ffc0000 [ 289.873499][ T24] audit: type=1326 audit(1786713272.486:3441): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6374 comm="syz.3.2032" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2412d440d9 code=0x7ffc0000 [ 289.898599][ T24] audit: type=1326 audit(1786713272.486:3442): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6374 comm="syz.3.2032" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2412d440d9 code=0x7ffc0000 [ 290.122438][ T301] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 290.218089][ T6386] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2034'. [ 290.236108][ T6388] xt_hashlimit: size too large, truncated to 1048576 [ 290.502368][ T301] usb 3-1: config 24 has too many interfaces: 158, using maximum allowed: 32 [ 290.511237][ T301] usb 3-1: config 24 has an invalid descriptor of length 171, skipping remainder of the config [ 290.521685][ T301] usb 3-1: config 24 has 1 interface, different from the descriptor's value: 158 [ 290.533142][ T6401] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=6401 comm=syz.3.2041 [ 290.547554][ T6401] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6401 comm=syz.3.2041 [ 290.561029][ T6401] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=6401 comm=syz.3.2041 [ 290.622509][ T5] usb 5-1: reset high-speed USB device number 43 using dummy_hcd [ 290.699866][ T6407] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2044'. [ 290.709162][ T301] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0014, bcdDevice= 0.40 [ 290.718320][ T301] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.726964][ T301] usb 3-1: Product: syz [ 290.731564][ T301] usb 3-1: Manufacturer: syz [ 290.736314][ T301] usb 3-1: SerialNumber: syz [ 290.845090][ T6411] xt_hashlimit: size too large, truncated to 1048576 [ 291.014758][ T6428] geneve1: tun_chr_ioctl cmd 1074025677 [ 291.020350][ T6428] geneve1: linktype set to 804 [ 291.063264][ T6436] fuse: Bad value for 'fd' [ 291.172417][ T301] usb 3-1: 0:1 : does not exist [ 291.177551][ T301] usb 3-1: unit 80 not found! [ 291.197369][ T301] usb 3-1: USB disconnect, device number 37 [ 291.252376][ T6445] netlink: 'syz.4.2061': attribute type 8 has an invalid length. [ 291.894333][ T6461] exfat: Bad value for 'fmask' [ 291.994203][ T6470] xt_hashlimit: size too large, truncated to 1048576 [ 292.112843][ T5] usb 5-1: device descriptor read/64, error -71 [ 292.309243][ T6479] xt_hashlimit: max too large, truncated to 1048576 [ 292.316173][ T6479] xt_hashlimit: Unknown mode mask 2000, kernel too old? [ 292.402336][ T301] usb 3-1: new full-speed USB device number 38 using dummy_hcd [ 292.522325][ T5] usb 5-1: device descriptor read/64, error -71 [ 292.533825][ T6488] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 292.862609][ T301] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 292.880429][ T301] usb 3-1: config 0 has no interface number 0 [ 292.916376][ T301] usb 3-1: config 0 interface 41 has no altsetting 0 [ 293.112706][ T301] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 293.149879][ T301] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 293.227406][ T301] usb 3-1: Product: syz [ 293.264387][ T301] usb 3-1: Manufacturer: syz [ 293.305534][ T301] usb 3-1: SerialNumber: syz [ 293.376309][ T301] usb 3-1: config 0 descriptor?? [ 293.719490][ T5] usb 5-1: reset high-speed USB device number 43 using dummy_hcd [ 293.753082][ T6518] __nla_validate_parse: 5 callbacks suppressed [ 293.753093][ T6518] netlink: 236 bytes leftover after parsing attributes in process `syz.1.2088'. [ 293.783647][ T6520] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 293.848826][ T6528] netlink: 292 bytes leftover after parsing attributes in process `syz.0.2093'. [ 294.993326][ T5] usb 5-1: device descriptor read/64, error -71 [ 295.023615][ T6546] device bridge2 entered promiscuous mode [ 295.040546][ T6546] netlink: 'syz.1.2099': attribute type 4 has an invalid length. [ 295.052402][ T6546] netlink: 'syz.1.2099': attribute type 5 has an invalid length. [ 295.060581][ T6546] netlink: 3657 bytes leftover after parsing attributes in process `syz.1.2099'. [ 295.069997][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 295.080559][ T6475] udc-core: couldn't find an available UDC or it's busy [ 295.091387][ T6475] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 295.142637][ T301] CoreChips 3-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffb9 [ 295.283052][ T301] CoreChips: probe of 3-1:0.41 failed with error -71 [ 295.306659][ T301] usb 3-1: USB disconnect, device number 38 [ 295.313780][ T24] kauditd_printk_skb: 559 callbacks suppressed [ 295.313791][ T24] audit: type=1400 audit(1786713278.026:4002): avc: denied { execmem } for pid=6552 comm="syz.3.2101" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 295.425464][ T6545] F2FS-fs (loop4): invalid crc value [ 295.432059][ T6545] F2FS-fs (loop4): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 295.459970][ T6545] F2FS-fs (loop4): Start checkpoint disabled! [ 295.466833][ T6545] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 295.487835][ T24] audit: type=1400 audit(1786713278.196:4003): avc: denied { create } for pid=6543 comm="syz.4.2098" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 295.603460][ T7] handle_bad_sector: 2028 callbacks suppressed [ 295.603472][ T7] attempt to access beyond end of device [ 295.603472][ T7] loop4: rw=2049, want=40976, limit=40427 [ 295.745064][ T6561] EXT4-fs (loop2): Test dummy encryption mode enabled [ 295.748173][ T24] audit: type=1400 audit(1786713278.456:4004): avc: denied { create } for pid=6569 comm="syz.4.2102" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 295.769383][ T6561] EXT4-fs (loop2): Ignoring removed bh option [ 295.779426][ T24] audit: type=1400 audit(1786713278.486:4005): avc: denied { write } for pid=6569 comm="syz.4.2102" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 295.800055][ T6570] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2102'. [ 295.800087][ T24] audit: type=1400 audit(1786713278.486:4006): avc: denied { nlmsg_write } for pid=6569 comm="syz.4.2102" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 295.812832][ T6561] EXT4-fs (loop2): mounted filesystem without journal. Opts: test_dummy_encryption=v1,max_dir_size_kb=0x0000000000000002,block_validity,bh,noauto_da_alloc,errors=continue,,errors=continue [ 295.848627][ T6561] ext4 filesystem being mounted at /318/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 295.892787][ T6561] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2103'. [ 295.916027][ T6561] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 295.996278][ T6580] EXT4-fs (loop4): VFS: Found ext4 filesystem with unknown checksum algorithm. [ 296.006672][ T5700] udevd[5700]: incorrect ext4 checksum on /dev/loop4 [ 297.059768][ T287] usb 5-1: USB disconnect, device number 43 [ 297.278930][ T24] audit: type=1400 audit(1786713279.986:4007): avc: denied { read write } for pid=6607 comm="syz.4.2119" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 297.322337][ T24] audit: type=1400 audit(1786713280.016:4008): avc: denied { open } for pid=6607 comm="syz.4.2119" path="/dev/raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 297.371002][ T24] audit: type=1400 audit(1786713280.016:4009): avc: denied { ioctl } for pid=6607 comm="syz.4.2119" path="/dev/raw-gadget" dev="devtmpfs" ino=253 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 297.607748][ T24] audit: type=1400 audit(1786713280.316:4010): avc: denied { read } for pid=6622 comm="syz.3.2123" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 297.730693][ T6617] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,jqfmt=vfsv1,errors=remount-ro,nodiscard, [ 297.822411][ T287] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 297.960687][ T6593] EXT4-fs error (device loop2): ext4_iget_extra_inode:4692: inode #12: comm syz.2.2111: corrupted in-inode xattr [ 297.983711][ T6593] EXT4-fs (loop2): Remounting filesystem read-only [ 298.043160][ T6635] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2128'. [ 298.063327][ T6635] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2128'. [ 298.072323][ T287] usb 5-1: Using ep0 maxpacket: 16 [ 298.149021][ T24] audit: type=1326 audit(1786713280.856:4011): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6634 comm="syz.1.2128" exe="/root/ci2-android-5-10/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7faec93890d9 code=0x0 [ 298.192494][ T287] usb 5-1: config 0 has an invalid interface number: 105 but max is 0 [ 298.201371][ T287] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 298.222829][ T287] usb 5-1: config 0 has no interface number 0 [ 298.359537][ T6593] EXT4-fs (loop2): Unrecognized mount option "memory=low" or missing value [ 298.382421][ T287] usb 5-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 298.391718][ T287] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.405215][ T287] usb 5-1: Product: syz [ 298.411214][ T287] usb 5-1: Manufacturer: syz [ 298.423746][ T287] usb 5-1: SerialNumber: syz [ 298.433468][ T287] usb 5-1: config 0 descriptor?? [ 298.837691][ T6655] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 298.855049][ T6655] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 298.871680][ T6608] EXT4-fs (loop4): Test dummy encryption mode enabled [ 298.914833][ T6608] EXT4-fs (loop4): Ignoring removed oldalloc option [ 299.130247][ T6687] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2142'. [ 299.152871][ T6608] EXT4-fs (loop4): 1 truncate cleaned up [ 299.158639][ T6608] EXT4-fs (loop4): mounted filesystem without journal. Opts: test_dummy_encryption=v1,bsdgroups,nouid32,i_version,jqfmt=vfsv1,oldalloc,stripe=0x0000000000000005,,errors=continue [ 299.175483][ T6655] F2FS-fs (loop2): Found nat_bits in checkpoint [ 299.235770][ T6655] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 299.243115][ T6655] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 299.253143][ T287] uvcvideo: Found UVC 0.00 device syz (046d:08f3) [ 299.260287][ T287] uvcvideo: No valid video chain found. [ 299.267013][ T6698] netlink: 'syz.0.2145': attribute type 8 has an invalid length. [ 299.307919][ T6655] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2133'. [ 299.325163][ T282] attempt to access beyond end of device [ 299.325163][ T282] loop2: rw=2049, want=40968, limit=40427 [ 299.682352][ T287] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 299.807026][ T6717] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2151'. [ 300.007023][ T353] usb 5-1: USB disconnect, device number 44 [ 300.132514][ T287] usb 3-1: Using ep0 maxpacket: 8 [ 300.154319][ T6725] xt_hashlimit: size too large, truncated to 1048576 [ 300.252388][ T287] usb 3-1: config 0 interface 0 altsetting 129 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 300.272407][ T287] usb 3-1: config 0 interface 0 altsetting 129 endpoint 0x81 has invalid wMaxPacketSize 0 [ 300.282416][ T287] usb 3-1: config 0 interface 0 has no altsetting 0 [ 300.289031][ T287] usb 3-1: New USB device found, idVendor=1e7d, idProduct=3138, bcdDevice= 0.00 [ 300.298112][ T287] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 300.312860][ T287] usb 3-1: config 0 descriptor?? [ 300.367407][ T24] kauditd_printk_skb: 1 callbacks suppressed [ 300.367419][ T24] audit: type=1326 audit(1786713283.076:4013): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6729 comm="syz.4.2156" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f80d60570d9 code=0x7ffc0000 [ 300.398639][ T24] audit: type=1326 audit(1786713283.076:4014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6729 comm="syz.4.2156" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f80d60570d9 code=0x7ffc0000 [ 300.423943][ T24] audit: type=1326 audit(1786713283.086:4015): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6729 comm="syz.4.2156" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f80d60570d9 code=0x7ffc0000 [ 300.449041][ T24] audit: type=1326 audit(1786713283.086:4016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6729 comm="syz.4.2156" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f80d6056e42 code=0x7ffc0000 [ 300.474076][ T24] audit: type=1326 audit(1786713283.086:4017): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6729 comm="syz.4.2156" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f80d601790e code=0x7ffc0000 [ 300.499057][ T24] audit: type=1326 audit(1786713283.086:4018): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6729 comm="syz.4.2156" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7f80d6056f07 code=0x7ffc0000 [ 300.524240][ T24] audit: type=1326 audit(1786713283.116:4019): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6729 comm="syz.4.2156" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f80d601790e code=0x7ffc0000 [ 300.549276][ T24] audit: type=1326 audit(1786713283.116:4020): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6729 comm="syz.4.2156" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f80d6056d6b code=0x7ffc0000 [ 300.574702][ T24] audit: type=1326 audit(1786713283.116:4021): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6729 comm="syz.4.2156" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f80d6056d6b code=0x7ffc0000 [ 300.599634][ T24] audit: type=1326 audit(1786713283.116:4022): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6729 comm="syz.4.2156" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f80d601790e code=0x7ffc0000 [ 300.821527][ T6737] netlink: 'syz.0.2158': attribute type 8 has an invalid length. [ 300.887473][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 300.904173][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 300.937329][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 300.953932][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 300.961127][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 300.969224][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 300.969341][ T6744] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2162'. [ 300.986161][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 300.993486][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.000403][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.008323][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.016635][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.024989][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.032019][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.039769][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.047437][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.054820][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.061768][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.070107][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.079858][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.096108][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.103859][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.110902][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.572504][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.579840][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.588697][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.595721][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.602539][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.609323][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.616150][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.622945][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.629744][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.636627][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.643460][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.650296][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.660629][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.668275][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.675387][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.682346][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.689350][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.696199][ T287] ryos 0003:1E7D:3138.000C: unknown main item tag 0x0 [ 301.705520][ T287] ryos 0003:1E7D:3138.000C: hidraw0: USB HID v10.02 Device [HID 1e7d:3138] on usb-dummy_hcd.2-1/input0 [ 301.787276][ T6759] EXT4-fs (loop4): Ignoring removed orlov option [ 301.805793][ T6759] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 301.839199][ T6759] EXT4-fs (loop4): mounted filesystem without journal. Opts: sysvgroups,norecovery,block_validity,norecovery,nogrpid,orlov,debug_want_extra_isize=0x0000000000000080,bsddf,noauto_da_alloc,nombcache,barrier,nojournal_checksum,nodelalloc,errors=remount-ro,dioread_nolock, [ 302.524074][ T20] usb 3-1: USB disconnect, device number 39 [ 302.671017][ T6785] bridge0: port 1(bridge_slave_0) entered blocking state [ 302.678295][ T6785] bridge0: port 1(bridge_slave_0) entered disabled state [ 302.686270][ T6785] device bridge_slave_0 entered promiscuous mode [ 302.693964][ T6785] bridge0: port 2(bridge_slave_1) entered blocking state [ 302.701239][ T6785] bridge0: port 2(bridge_slave_1) entered disabled state [ 302.713713][ T6785] device bridge_slave_1 entered promiscuous mode [ 302.756849][ T6785] bridge0: port 2(bridge_slave_1) entered blocking state [ 302.763965][ T6785] bridge0: port 2(bridge_slave_1) entered forwarding state [ 302.771251][ T6785] bridge0: port 1(bridge_slave_0) entered blocking state [ 302.778305][ T6785] bridge0: port 1(bridge_slave_0) entered forwarding state [ 302.859019][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 302.867845][ T2385] bridge0: port 1(bridge_slave_0) entered disabled state [ 302.875709][ T2385] bridge0: port 2(bridge_slave_1) entered disabled state [ 302.891381][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 302.900081][ T2385] bridge0: port 1(bridge_slave_0) entered blocking state [ 302.907135][ T2385] bridge0: port 1(bridge_slave_0) entered forwarding state [ 302.923411][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 302.932062][ T2385] bridge0: port 2(bridge_slave_1) entered blocking state [ 302.939139][ T2385] bridge0: port 2(bridge_slave_1) entered forwarding state [ 302.972828][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 302.993937][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 303.035513][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 303.054437][ T300] device bridge_slave_1 left promiscuous mode [ 303.060876][ T300] bridge0: port 2(bridge_slave_1) entered disabled state [ 303.070447][ T300] device bridge_slave_0 left promiscuous mode [ 303.076887][ T300] bridge0: port 1(bridge_slave_0) entered disabled state [ 303.267573][ T6805] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2182'. [ 303.299945][ T6802] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2181'. [ 303.325808][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 303.334498][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 303.343579][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 303.351948][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 303.366080][ T6785] device veth0_vlan entered promiscuous mode [ 303.389297][ T6809] netlink: 144 bytes leftover after parsing attributes in process `syz.3.2184'. [ 303.394313][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 303.425844][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 303.442643][ T6785] device veth1_macvtap entered promiscuous mode [ 303.466371][ T6811] xt_hashlimit: size too large, truncated to 1048576 [ 303.552859][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 303.656107][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 303.683599][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 303.903453][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 303.992669][ T2385] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 304.174994][ T6818] ------------[ cut here ]------------ [ 304.425272][ T6818] trace type BPF program uses run-time allocation [ 304.451248][ T6836] overlayfs: failed to clone upperpath [ 304.471145][ T6818] WARNING: CPU: 1 PID: 6818 at kernel/bpf/verifier.c:10519 check_map_prog_compatibility+0x5d8/0x740 [ 304.536151][ T6818] Modules linked in: [ 304.540100][ T6818] CPU: 0 PID: 6818 Comm: syz.5.2175 Not tainted syzkaller #0 [ 304.547600][ T6818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 304.558872][ T6818] RIP: 0010:check_map_prog_compatibility+0x5d8/0x740 [ 304.566280][ T6818] Code: 85 e9 14 fe ff ff e8 c7 db ef ff 31 c0 e9 15 fe ff ff e8 bb db ef ff c6 05 85 be 4b 05 01 48 c7 c7 20 db 25 85 e8 28 42 04 03 <0f> 0b e9 7d fc ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 9b fa ff [ 304.595563][ T6818] RSP: 0000:ffffc90001327430 EFLAGS: 00010246 [ 304.602313][ T6818] RAX: a130b45370fd0600 RBX: 0000000000000001 RCX: 0000000000080000 [ 304.610627][ T6818] RDX: ffffc9000b29a000 RSI: 0000000000002971 RDI: 0000000000002972 [ 304.618905][ T6818] RBP: ffffc90001327470 R08: ffff8881f7152fbf R09: 1ffff1103ee2a5f7 [ 304.627853][ T6818] R10: dffffc0000000000 R11: ffffed103ee2a5f8 R12: ffff888122a30000 [ 304.636234][ T6818] R13: 0000000000000011 R14: dffffc0000000000 R15: ffff88810fe1a000 [ 304.644504][ T6818] FS: 00007f43d1fb16c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 304.653831][ T6818] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 304.660623][ T6818] CR2: 00002000000bd038 CR3: 000000011c207000 CR4: 00000000003506a0 [ 304.669020][ T6818] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 304.677257][ T6818] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 304.686030][ T6818] Call Trace: [ 304.689834][ T6818] ? __fdget+0x1a1/0x230 [ 304.694922][ T6818] resolve_pseudo_ldimm64+0x557/0x10b0 [ 304.700967][ T6818] ? bpf_check+0xdce0/0xdce0 [ 304.706651][ T6818] ? kvmalloc_node+0x88/0x130 [ 304.711778][ T6818] bpf_check+0x91f9/0xdce0 [ 304.717074][ T6818] ? get_page_from_freelist+0x225f/0x23f0 [ 304.723819][ T6818] ? __alloc_pages_nodemask+0x29a/0x640 [ 304.729514][ T6818] ? bpf_get_btf_vmlinux+0x60/0x60 [ 304.751281][ T6818] ? 0xffffffffa0014000 [ 304.756432][ T6818] ? is_bpf_text_address+0x177/0x190 [ 304.762245][ T6818] ? selinux_bpf_prog_alloc+0x51/0x140 [ 304.768976][ T6818] ? __kernel_text_address+0xa0/0x100 [ 304.805521][ T6818] ? unwind_get_return_address+0x4d/0x90 [ 304.824232][ T6846] netlink: 144 bytes leftover after parsing attributes in process `syz.1.2195'. [ 304.834042][ T6818] ? stack_trace_save+0xf0/0xf0 [ 304.839138][ T6818] ? arch_stack_walk+0xee/0x140 [ 304.844890][ T6818] ? stack_trace_save+0xa6/0xf0 [ 304.849844][ T6818] ? stack_trace_snprint+0xe0/0xe0 [ 304.855730][ T6818] ? selinux_bpf_prog_alloc+0x51/0x140 [ 304.861285][ T6818] ? selinux_bpf_prog_alloc+0x51/0x140 [ 304.874830][ T6818] ? __kasan_kmalloc+0xe6/0x100 [ 304.879785][ T6818] ? __kasan_kmalloc+0xd4/0x100 [ 304.884753][ T6818] ? kmem_cache_alloc_trace+0x179/0x2e0 [ 304.890353][ T6818] ? selinux_bpf_prog_alloc+0x51/0x140 [ 304.895890][ T6818] ? security_bpf_prog_alloc+0x62/0x90 [ 304.901382][ T6818] ? bpf_prog_load+0x9fa/0x14e0 [ 304.906326][ T6818] ? __se_sys_bpf+0x49a/0x740 [ 304.911058][ T6818] ? __x64_sys_bpf+0x7b/0x90 [ 304.915753][ T6818] ? do_syscall_64+0x31/0x40 [ 304.920404][ T6818] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 304.926579][ T6818] ? memset+0x35/0x40 [ 304.930959][ T6818] ? bpf_obj_name_cpy+0x193/0x1e0 [ 304.936069][ T6818] bpf_prog_load+0x1004/0x14e0 [ 304.940888][ T6818] ? map_freeze+0x330/0x330 [ 304.945483][ T6818] ? selinux_bpf+0xc7/0xf0 [ 304.949954][ T6818] ? security_bpf+0x82/0xa0 [ 304.954672][ T6818] __se_sys_bpf+0x49a/0x740 [ 304.959252][ T6818] ? __x64_sys_bpf+0x90/0x90 [ 304.964231][ T6818] ? __kasan_check_read+0x11/0x20 [ 304.969343][ T6818] __x64_sys_bpf+0x7b/0x90 [ 304.974452][ T6818] do_syscall_64+0x31/0x40 [ 304.979025][ T6818] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 304.985148][ T6818] RIP: 0033:0x7f43d35580d9 [ 304.989849][ T6818] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 305.017131][ T6818] RSP: 002b:00007f43d1fb1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 305.025848][ T6818] RAX: ffffffffffffffda RBX: 00007f43d37dffa0 RCX: 00007f43d35580d9 [ 305.034035][ T6818] RDX: 0000000000000094 RSI: 00002000000000c0 RDI: 0000000000000005 [ 305.052044][ T6818] RBP: 00007f43d35ef024 R08: 0000000000000000 R09: 0000000000000000 [ 305.060257][ T6818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 305.069820][ T6818] R13: 00007f43d37e0038 R14: 00007f43d37dffa0 R15: 00007ffed0844738 [ 305.078048][ T6818] ---[ end trace 4f8d297987fa3a3d ]--- [ 305.095112][ T6861] mip6: mip6_rthdr_init_state: spi is not 0: 3590586368 [ 305.195020][ T6875] serio: Serial port ptm0 [ 305.262440][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 305.392468][ T25] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 305.498427][ T24] kauditd_printk_skb: 113 callbacks suppressed [ 305.498437][ T24] audit: type=1400 audit(1786713288.206:4136): avc: denied { unmount } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 305.551985][ T6924] fuse: Bad value for 'fd' [ 305.629942][ T6942] fuse: Bad value for 'fd' [ 305.636038][ T25] usb 6-1: Using ep0 maxpacket: 32 [ 305.734146][ T6922] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 2070) [ 305.746106][ T6966] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 305.762589][ T25] usb 6-1: config 0 has no interfaces? [ 305.764068][ T6922] FAT-fs (loop2): Filesystem has been set read-only [ 305.768522][ T25] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 305.784401][ T24] audit: type=1400 audit(1786713288.506:4137): avc: denied { create } for pid=6967 comm="syz.3.2251" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 305.786095][ T25] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.813138][ T24] audit: type=1400 audit(1786713288.526:4138): avc: denied { getopt } for pid=6969 comm="syz.1.2250" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 305.818952][ T25] usb 6-1: config 0 descriptor?? [ 305.863645][ T24] audit: type=1400 audit(1786713288.566:4139): avc: denied { create } for pid=6973 comm="syz.1.2253" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 305.892355][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 306.137660][ T5] usb 6-1: USB disconnect, device number 2 [ 306.262717][ T24] audit: type=1400 audit(1786713288.976:4140): avc: denied { read } for pid=7000 comm="syz.2.2264" name="filter" dev="tracefs" ino=3771 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 306.398005][ T7023] netlink: 200 bytes leftover after parsing attributes in process `syz.0.2275'. [ 306.455423][ T7041] netlink: 508 bytes leftover after parsing attributes in process `syz.3.2286'. [ 306.474619][ T7045] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2280'. [ 306.497602][ T7045] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2280'. [ 306.729211][ T7072] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2300'. [ 306.745862][ T7081] SELinux: Context system_u: is not valid (left unmapped). [ 306.756179][ T24] audit: type=1400 audit(1786713289.466:4141): avc: denied { relabelto } for pid=7079 comm="syz.2.2303" name="341" dev="tmpfs" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:" [ 306.793286][ T24] audit: type=1400 audit(1786713289.496:4142): avc: denied { associate } for pid=7079 comm="syz.2.2303" name="341" dev="tmpfs" ino=1925 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:" [ 306.829012][ T24] audit: type=1400 audit(1786713289.496:4143): avc: denied { write } for pid=282 comm="syz-executor" name="341" dev="tmpfs" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:" [ 306.854534][ T5] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 306.864928][ T24] audit: type=1400 audit(1786713289.496:4144): avc: denied { remove_name } for pid=282 comm="syz-executor" name="binderfs" dev="tmpfs" ino=1929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:" [ 306.892423][ T24] audit: type=1400 audit(1786713289.496:4145): avc: denied { rmdir } for pid=282 comm="syz-executor" name="341" dev="tmpfs" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:" [ 307.158546][ T7139] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2329'. [ 307.168105][ T7139] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2329'. [ 307.262405][ T5] usb 6-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 307.278494][ T5] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 307.281710][ T7142] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 307.304321][ T5] usb 6-1: New USB device found, idVendor=054c, idProduct=0268, bcdDevice= 0.00 [ 307.313723][ T5] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 307.367113][ T5] usb 6-1: config 0 descriptor?? [ 307.538078][ T7157] EXT4-fs (loop2): orphan cleanup on readonly fs [ 307.545565][ T7157] EXT4-fs warning (device loop2): ext4_enable_quotas:6495: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 307.560606][ T7157] EXT4-fs (loop2): Cannot turn on quotas: error -117 [ 307.567421][ T7157] EXT4-fs error (device loop2): ext4_orphan_get:1406: comm syz.2.2336: couldn't read orphan inode 26 (err -116) [ 307.579756][ T7157] EXT4-fs (loop2): Remounting filesystem read-only [ 307.586360][ T7157] EXT4-fs (loop2): mounted filesystem without journal. Opts: errors=remount-ro, [ 307.612719][ T6865] udc-core: couldn't find an available UDC or it's busy [ 307.619742][ T6865] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 307.699664][ T6865] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 307.711476][ T6865] EXT4-fs warning (device loop5): ext4_expand_extra_isize_ea:2799: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 307.724917][ T6865] EXT4-fs (loop5): 1 truncate cleaned up [ 307.730626][ T6865] EXT4-fs (loop5): mounted filesystem without journal. Opts: nodioread_nolock,barrier,debug_want_extra_isize=0x0000000000000068,errors=remount-ro,nombcache,quota,resgid=0x0000000000000000, [ 307.857869][ T7185] xt_hashlimit: size too large, truncated to 1048576 [ 307.872371][ T5] usb 6-1: string descriptor 0 read error: -71 [ 307.893261][ T5] usb 6-1: USB disconnect, device number 3 [ 308.000291][ T7191] netlink: 5 bytes leftover after parsing attributes in process `syz.1.2350'. [ 309.197940][ T7232] netlink: 'syz.1.2368': attribute type 32 has an invalid length. [ 309.265892][ T7223] EXT4-fs (loop5): Ignoring removed mblk_io_submit option [ 309.299836][ T7223] EXT4-fs (loop5): mounted filesystem without journal. Opts: grpid,mblk_io_submit,errors=continue,user_xattr,inode_readahead_blks=0x0000000000004000,nodelalloc,minixdf,barrier=0x0000000000000101,,errors=continue [ 309.507523][ T7294] EXT4-fs (loop5): Ignoring removed nobh option [ 309.523820][ T7294] EXT4-fs (loop5): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,nobh,,errors=continue [ 309.535295][ T7294] ext4 filesystem being mounted at /9/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 310.241570][ T7308] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 310.299579][ T7328] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2410'. [ 310.309683][ T7328] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2410'. [ 310.324618][ T7328] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2410'. [ 310.334070][ T7328] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2410'. [ 310.393802][ T7329] FAT-fs (loop2): bogus logical sector size 0 [ 310.402675][ T7329] FAT-fs (loop2): Can't find a valid FAT filesystem [ 310.465198][ T7358] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 310.470933][ T7361] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2423'. [ 310.493286][ T7358] EXT4-fs (loop2): 1 truncate cleaned up [ 310.504020][ T7358] EXT4-fs (loop2): mounted filesystem without journal. Opts: journal_dev=0x0000000000000007,max_batch_time=0x0000000000000002,debug_want_extra_isize=0x000000000000006a,block_validity,minixdf,nombcache,,errors=continue [ 310.512186][ T24] kauditd_printk_skb: 5 callbacks suppressed [ 310.512195][ T24] audit: type=1401 audit(1786713293.216:4150): op=setxattr invalid_context="" [ 310.696853][ T7390] netlink: 172 bytes leftover after parsing attributes in process `syz.1.2435'. [ 310.770467][ T7401] netlink: 'syz.2.2441': attribute type 4 has an invalid length. [ 310.780996][ T7401] netlink: 'syz.2.2441': attribute type 4 has an invalid length. [ 310.785022][ T24] audit: type=1400 audit(1786713293.466:4151): avc: denied { mounton } for pid=7395 comm="syz.5.2439" path="/proc/41/task" dev="proc" ino=36463 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 310.849608][ T24] audit: type=1400 audit(1786713293.556:4152): avc: denied { append } for pid=7406 comm="syz.5.2444" name="001" dev="devtmpfs" ino=177 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 310.933209][ T7414] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 310.960003][ T7414] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 311.038181][ T300] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 311.062361][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 311.459951][ T24] audit: type=1400 audit(1786713294.166:4153): avc: denied { write } for pid=7425 comm="syz.2.2452" path="socket:[36530]" dev="sockfs" ino=36530 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 311.585286][ T7435] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2457'. [ 311.621780][ T24] audit: type=1400 audit(1786713294.326:4154): avc: denied { setcurrent } for pid=7436 comm="syz.5.2458" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 311.715472][ T24] audit: type=1401 audit(1786713294.376:4155): op=security_bounded_transition seresult=denied oldcontext=root:sysadm_r:sysadm_t newcontext=system_u:object_r:hugetlbfs_t [ 312.295986][ T24] audit: type=1400 audit(1786713295.006:4156): avc: denied { lock } for pid=7486 comm="syz.5.2473" path="socket:[35803]" dev="sockfs" ino=35803 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 312.340404][ T7462] device sit0 left promiscuous mode [ 312.358031][ T7462] device bridge2 left promiscuous mode [ 312.440209][ T24] audit: type=1400 audit(1786713295.146:4157): avc: denied { read write } for pid=7497 comm="syz.2.2476" name="control" dev="devtmpfs" ino=260 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 312.569368][ T24] audit: type=1400 audit(1786713295.176:4158): avc: denied { open } for pid=7497 comm="syz.2.2476" path="/408/dev/mapper/control" dev="devtmpfs" ino=260 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 312.597444][ T7515] ================================================================== [ 312.605552][ T7515] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 312.612230][ T7515] Write of size 8 at addr ffff888135e04950 by task syz.0.2477/7515 [ 312.620113][ T7515] [ 312.622455][ T7515] CPU: 1 PID: 7515 Comm: syz.0.2477 Tainted: G W syzkaller #0 [ 312.631215][ T7515] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 312.634275][ T24] audit: type=1400 audit(1786713295.176:4159): avc: denied { ioctl } for pid=7497 comm="syz.2.2476" path="/408/dev/mapper/control" dev="devtmpfs" ino=260 ioctlcmd=0xfd0d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 312.641263][ T7515] Call Trace: [ 312.641283][ T7515] __dump_stack+0x21/0x24 [ 312.641292][ T7515] dump_stack_lvl+0x1a7/0x208 [ 312.641311][ T7515] ? show_regs_print_info+0x18/0x18 [ 312.684801][ T7515] ? thaw_kernel_threads+0x220/0x220 [ 312.690085][ T7515] ? debug_smp_processor_id+0x17/0x20 [ 312.695460][ T7515] print_address_description+0x7f/0x2c0 [ 312.701012][ T7515] ? mutex_lock+0x85/0xf0 [ 312.705457][ T7515] kasan_report+0x100/0x140 [ 312.709974][ T7515] ? mutex_lock+0x85/0xf0 [ 312.712035][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 312.714314][ T7515] kasan_check_range+0x249/0x2a0 [ 312.714325][ T7515] __kasan_check_write+0x14/0x20 [ 312.714336][ T7515] mutex_lock+0x85/0xf0 [ 312.714353][ T7515] ? mutex_trylock+0xb0/0xb0 [ 312.740389][ T7515] ? l2tp_session_put+0xb2/0x1a0 [ 312.745489][ T7515] ? l2tp_session_delete+0x3a9/0x4a0 [ 312.750760][ T7515] pppol2tp_release+0x178/0x2b0 [ 312.755590][ T7515] sock_close+0xb8/0x200 [ 312.759824][ T7515] ? sock_mmap+0xa0/0xa0 [ 312.764112][ T7515] __fput+0x2dc/0x730 [ 312.768078][ T7515] ____fput+0x15/0x20 [ 312.772042][ T7515] task_work_run+0x127/0x190 [ 312.776613][ T7515] exit_to_user_mode_loop+0xcb/0xe0 [ 312.781797][ T7515] exit_to_user_mode_prepare+0x76/0xa0 [ 312.787247][ T7515] syscall_exit_to_user_mode+0x1d/0x40 [ 312.792682][ T7515] do_syscall_64+0x3d/0x40 [ 312.797079][ T7515] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 312.803006][ T7515] RIP: 0033:0x7fdc11f7e0d9 [ 312.807417][ T7515] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 312.827013][ T7515] RSP: 002b:00007ffebad435d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 312.835417][ T7515] RAX: 0000000000000000 RBX: 00007ffebad436c0 RCX: 00007fdc11f7e0d9 [ 312.843375][ T7515] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 312.851503][ T7515] RBP: 000000000004c4e3 R08: 0000000000000001 R09: 0000000000000000 [ 312.859459][ T7515] R10: 0000001b2d220000 R11: 0000000000000246 R12: 00007ffebad43700 [ 312.867410][ T7515] R13: 00007fdc12205fac R14: 000000000004c516 R15: 00007fdc12205fa0 [ 312.875504][ T7515] [ 312.877819][ T7515] Allocated by task 7516: [ 312.882145][ T7515] __kasan_kmalloc+0xd4/0x100 [ 312.886824][ T7515] __kmalloc+0x19f/0x330 [ 312.891184][ T7515] l2tp_session_create+0x39/0xb60 [ 312.896215][ T7515] pppol2tp_connect+0xbf5/0x1640 [ 312.901175][ T7515] __sys_connect+0x3ce/0x450 [ 312.905748][ T7515] __x64_sys_connect+0x7a/0x90 [ 312.910502][ T7515] do_syscall_64+0x31/0x40 [ 312.914899][ T7515] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 312.920770][ T7515] [ 312.923079][ T7515] Freed by task 7515: [ 312.927044][ T7515] kasan_set_track+0x4a/0x70 [ 312.931621][ T7515] kasan_set_free_info+0x23/0x40 [ 312.936631][ T7515] ____kasan_slab_free+0x125/0x160 [ 312.941752][ T7515] __kasan_slab_free+0x11/0x20 [ 312.946518][ T7515] slab_free_freelist_hook+0xc5/0x190 [ 312.951902][ T7515] kfree+0xc0/0x270 [ 312.955691][ T7515] l2tp_session_put+0xb2/0x1a0 [ 312.960554][ T7515] l2tp_session_delete+0x3a9/0x4a0 [ 312.965654][ T7515] pppol2tp_release+0x169/0x2b0 [ 312.970487][ T7515] sock_close+0xb8/0x200 [ 312.974735][ T7515] __fput+0x2dc/0x730 [ 312.978696][ T7515] ____fput+0x15/0x20 [ 312.982658][ T7515] task_work_run+0x127/0x190 [ 312.987238][ T7515] exit_to_user_mode_loop+0xcb/0xe0 [ 312.992414][ T7515] exit_to_user_mode_prepare+0x76/0xa0 [ 312.997868][ T7515] syscall_exit_to_user_mode+0x1d/0x40 [ 313.003324][ T7515] do_syscall_64+0x3d/0x40 [ 313.007902][ T7515] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 313.013780][ T7515] [ 313.016125][ T7515] The buggy address belongs to the object at ffff888135e04800 [ 313.016125][ T7515] which belongs to the cache kmalloc-512 of size 512 [ 313.030430][ T7515] The buggy address is located 336 bytes inside of [ 313.030430][ T7515] 512-byte region [ffff888135e04800, ffff888135e04a00) [ 313.043945][ T7515] The buggy address belongs to the page: [ 313.049601][ T7515] page:ffffea0004d78100 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888135e06000 pfn:0x135e04 [ 313.061125][ T7515] head:ffffea0004d78100 order:2 compound_mapcount:0 compound_pincount:0 [ 313.069443][ T7515] flags: 0x4000000000010200(slab|head) [ 313.075016][ T7515] raw: 4000000000010200 ffffea0004d51c00 0000000300000003 ffff888100043080 [ 313.083593][ T7515] raw: ffff888135e06000 0000000080100004 00000001ffffffff 0000000000000000 [ 313.092152][ T7515] page dumped because: kasan: bad access detected [ 313.098540][ T7515] page_owner tracks the page as allocated [ 313.104252][ T7515] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 6642, ts 298054743842, free_ts 297597141575 [ 313.124984][ T7515] prep_new_page+0x176/0x190 [ 313.129555][ T7515] get_page_from_freelist+0x225f/0x23f0 [ 313.135077][ T7515] __alloc_pages_nodemask+0x29a/0x640 [ 313.140426][ T7515] new_slab+0x84/0x3f0 [ 313.144574][ T7515] ___slab_alloc+0x2f8/0x4c0 [ 313.149147][ T7515] __slab_alloc+0x63/0xa0 [ 313.153465][ T7515] __kmalloc_track_caller+0x1e4/0x310 [ 313.158813][ T7515] __alloc_skb+0xdc/0x520 [ 313.163148][ T7515] alloc_skb_with_frags+0xa3/0x560 [ 313.168238][ T7515] sock_alloc_send_pskb+0x87f/0x9a0 [ 313.173412][ T7515] sock_alloc_send_skb+0x32/0x40 [ 313.178398][ T7515] __ip_append_data+0x1f8a/0x30b0 [ 313.183402][ T7515] ip_make_skb+0x1e5/0x400 [ 313.187814][ T7515] udp_sendmsg+0x1771/0x2140 [ 313.192391][ T7515] inet_sendmsg+0xa5/0xc0 [ 313.196725][ T7515] ____sys_sendmsg+0x5be/0x8f0 [ 313.201464][ T7515] page last free stack trace: [ 313.206174][ T7515] free_unref_page_prepare+0x2b7/0x2d0 [ 313.211615][ T7515] __free_pages+0x146/0x390 [ 313.216099][ T7515] __vunmap+0x801/0x980 [ 313.220232][ T7515] vfree+0x61/0x90 [ 313.224008][ T7515] kcov_mmap+0x8f/0x130 [ 313.228147][ T7515] mmap_file+0x60/0xb0 [ 313.232192][ T7515] mmap_region+0x11fd/0x19c0 [ 313.236777][ T7515] do_mmap+0x85f/0xf50 [ 313.240840][ T7515] vm_mmap_pgoff+0x1f4/0x350 [ 313.245420][ T7515] ksys_mmap_pgoff+0x16f/0x1e0 [ 313.250246][ T7515] __x64_sys_mmap+0xfa/0x110 [ 313.254834][ T7515] do_syscall_64+0x31/0x40 [ 313.259235][ T7515] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 313.265105][ T7515] [ 313.267414][ T7515] Memory state around the buggy address: [ 313.273021][ T7515] ffff888135e04800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 313.281066][ T7515] ffff888135e04880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 313.289113][ T7515] >ffff888135e04900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 313.297159][ T7515] ^ [ 313.303821][ T7515] ffff888135e04980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 313.311866][ T7515] ffff888135e04a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 313.319904][ T7515] ================================================================== [ 313.327962][ T7515] Disabling lock debugging due to kernel taint [ 313.335259][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 313.357942][ T7511] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue