last executing test programs: 3m45.425244206s ago: executing program 0 (id=1801): mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x20, &(0x7f00000000c0)=[@in={0x2, 0x4e21, @rand_addr=0x64010100}, @in={0x2, 0x4e21, @loopback}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x85, &(0x7f0000000000)={r1, @in={{0x2, 0x4e23, @empty}}, 0x27c0}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x85, &(0x7f00000001c0)={r1, @in6={{0xa, 0x4e20, 0x3, @empty, 0xddb3}}}, 0x90) 3m44.399307622s ago: executing program 0 (id=1805): mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000040)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r2, 0x40047438, &(0x7f0000000040)) readv(r2, &(0x7f00000001c0)=[{&(0x7f0000000480)=""/225, 0xe1}], 0x1) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000e300020008000a00", @ANYRES32, @ANYBLOB="08001b"], 0x30}}, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) 3m43.885468135s ago: executing program 0 (id=1809): pipe2$9p(&(0x7f0000000140), 0x80000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000100), 0x4) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x36, &(0x7f0000000240)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @timestamp={0xd, 0x0, 0x0, 0x40, 0xf, 0x3, 0xd7df, 0xbd}}}}}, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x40, 0x148) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe000031f, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0xffffeff7, 0x40, 0x40000006}, 0x3c) 3m43.29896096s ago: executing program 0 (id=1812): mkdir(&(0x7f0000001a80)='./file0\x00', 0x1cb) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) mkdir(&(0x7f0000000140)='./file0/../file0\x00', 0x190) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x6000, 0x0) 3m42.347464884s ago: executing program 0 (id=1815): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x9, 0x82, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) statfs(0x0, 0x0) 3m41.462341316s ago: executing program 0 (id=1817): mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000040)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r2, 0x40047438, &(0x7f0000000040)) readv(r2, &(0x7f00000001c0)=[{&(0x7f0000000480)=""/225, 0xe1}], 0x1) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000e300020008000a00", @ANYRES32, @ANYBLOB="08001b"], 0x30}}, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) 3m40.702422926s ago: executing program 32 (id=1817): mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000040)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r2, 0x40047438, &(0x7f0000000040)) readv(r2, &(0x7f00000001c0)=[{&(0x7f0000000480)=""/225, 0xe1}], 0x1) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000e300020008000a00", @ANYRES32, @ANYBLOB="08001b"], 0x30}}, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) 2m55.619641426s ago: executing program 2 (id=2025): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) 2m55.234674466s ago: executing program 2 (id=2028): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x2001, 0x0) ioctl$SNAPSHOT_PLATFORM_SUPPORT(r0, 0x330f, 0x0) 2m51.52811871s ago: executing program 2 (id=2041): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/kallsyms\x00', 0x0, 0x0) read(r3, &(0x7f0000000400)=""/65536, 0x10000) 2m50.356620209s ago: executing program 2 (id=2050): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x21081e, &(0x7f00000001c0)={[{@grpquota}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x800}}, {@minixdf}]}, 0x1, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") open(&(0x7f00000002c0)='./bus\x00', 0x14927d, 0x8) mount(&(0x7f0000000440)=@loop={'/dev/loop', 0x0}, &(0x7f0000000200)='./bus\x00', 0x0, 0x1000, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0xa27b734c1a0bc97) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6f8, 0x0, 0x1, 0x4, 0x0, "ef35af413bb901527fe4f1ce5d29c3ee5e5c3676345a41499db7aac63a01010000000000004faa2ae2c08485d90000000000007700000c00002000", "036c432004cbc329834c9b1b167263bdbcef549ba197fce47d0100173400fff7ffffff000000f3e7f29b00000200000000000600", "b73200000000000000000d00000868b4cd786f3abb9bfffff100", [0x40000000004, 0x670]}) 2m49.398425424s ago: executing program 2 (id=2054): mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x3400, 0x1) 2m48.326353391s ago: executing program 2 (id=2058): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/kallsyms\x00', 0x0, 0x0) read(r1, &(0x7f0000000400)=""/65536, 0x10000) 2m47.639124198s ago: executing program 33 (id=2058): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/kallsyms\x00', 0x0, 0x0) read(r1, &(0x7f0000000400)=""/65536, 0x10000) 6.090299086s ago: executing program 1 (id=2558): r0 = socket(0xa, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="480000001400030400000000000000000a3f0000", @ANYRES32=r2, @ANYBLOB="14000200ff230000000000000000000000000001140006000000000006000000000000000000000008"], 0x48}}, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000040)={@private0={0xfc, 0x0, '\x00', 0x1}, r2}, 0x14) 5.865065032s ago: executing program 1 (id=2561): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x1ff) write$UHID_CREATE2(r6, 0x0, 0x0) lsetxattr$security_capability(0x0, &(0x7f0000000180), 0x0, 0x0, 0x0) sendmsg$nl_xfrm(r5, 0x0, 0x4810) 4.650119973s ago: executing program 1 (id=2565): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r1, r3, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x66, &(0x7f0000000400)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @broadcast, @void, {@mpls_uc={0x8847, {[], @ipv4=@gre={{0x5, 0x4, 0x1, 0x5, 0x58, 0x65, 0x0, 0x8, 0x2f, 0x0, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x1}, {0x1, 0x0, 0x1, 0x1}, {0x8, 0x88be, 0x3, {{0x7, 0x1, 0x9, 0x0, 0x1, 0x2, 0x2, 0xb}, 0x1, {0x2}}}, {0x8, 0x22eb, 0x4, {{0x6, 0x2, 0x6, 0x3, 0x1, 0x1, 0x4, 0x2e}, 0x2, {0x5, 0x5, 0x3, 0x7, 0x1, 0x1, 0x2, 0x1, 0x1}}}, {0x8, 0x6558, 0x1}}}}}}}, 0x0) 4.490078026s ago: executing program 1 (id=2567): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="48000000140003040000", @ANYRES32=r1, @ANYBLOB="14000200ff230000000000000000000000000001140006000000000006"], 0x48}}, 0x0) 4.246690213s ago: executing program 1 (id=2571): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) syz_clone(0x18000000, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x50100, 0x0) ioctl$FBIOGET_CON2FBMAP(r1, 0x460f, &(0x7f00000000c0)={0x26, 0x2}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r0, 0x0) syz_io_uring_setup(0x4cb, &(0x7f0000000580)={0x0, 0xe7b7, 0x13500, 0x0, 0x352}, &(0x7f0000000240), &(0x7f0000000040)=0x0, 0x0) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x181440) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) r3 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e"], 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000280)={0x84, &(0x7f0000000340)=ANY=[@ANYRES64=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_TTSTAMP(r4, 0x4161, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000080)='dctcp', 0x5) openat$dir(0xffffffffffffff9c, 0x0, 0xea, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) io_setup(0x8, &(0x7f0000000b40)) 2.436782208s ago: executing program 5 (id=2579): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x13, r0, 0x0) r1 = socket$inet(0x2, 0x802, 0x1) write(r1, &(0x7f0000000080)="08008edf773c8000", 0xfd) 2.436578798s ago: executing program 4 (id=2580): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="48000000140003040000", @ANYRES32=r1, @ANYBLOB="14000200ff230000000000000000000000000001140006000000000006"], 0x48}}, 0x0) 2.435732518s ago: executing program 3 (id=2581): r0 = socket(0xa, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="480000001400030400000000000000000a3f0000", @ANYRES32=r2, @ANYBLOB="14000200ff230000000000000000000000000001140006000000000006000000000000000000000008000800"], 0x48}}, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000040)={@private0={0xfc, 0x0, '\x00', 0x1}, r2}, 0x14) 2.294596182s ago: executing program 5 (id=2582): r0 = socket(0x840000000002, 0x3, 0x9) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000900)={0x4, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x2}}, 0x0, 0x3}, 0x94) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/asound/seq/clients\x00', 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) write(r2, &(0x7f0000000040)="1c0000001a009b8a140000003b00"/28, 0xfd99) recvmmsg(r2, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) r3 = getegid() fchownat(r1, &(0x7f0000000140)='./file0\x00', 0x0, r3, 0x1000) 2.293511122s ago: executing program 4 (id=2583): setns(0xc9, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r6, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r8, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_FROM={0x8, 0x3, 0xa0}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc004}, 0x2004c8c0) 2.254454003s ago: executing program 3 (id=2584): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000ac0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000f80)={0x24, r1, 0x1, 0x70bd27, 0x25dedbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SCAN_SUPP_RATES={0x8, 0x7d, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x46b2d3baca12a610}, 0x4048840) 2.078127667s ago: executing program 3 (id=2585): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000000), 0x8) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) listen(r1, 0x5) listen(r0, 0x5) 1.999127969s ago: executing program 5 (id=2586): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) mount(0x0, 0x0, 0x0, 0x1214040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x1ff) write$UHID_CREATE2(r6, 0x0, 0x0) lsetxattr$security_capability(0x0, &(0x7f0000000180), 0x0, 0x0, 0x0) sendmsg$nl_xfrm(r5, 0x0, 0x4810) 1.97115541s ago: executing program 4 (id=2587): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x600, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 1.858347933s ago: executing program 3 (id=2588): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x2}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xfff7, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x6}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000440)="bad386ddc7180869ab2b83b48ae1", 0xe, 0x24004095, &(0x7f00000001c0)={0x11, 0x88a8, r3, 0x1, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}}, 0x14) 1.608364799s ago: executing program 4 (id=2589): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x42902, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x44, 0x2c, 0xd27, 0x870b525, 0x8000, {0x0, 0x0, 0x0, r2, {0x8, 0xc}, {}, {0xa, 0x8}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x10, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}]}]}]}}]}, 0x44}}, 0x0) 748.548511ms ago: executing program 5 (id=2590): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='7', 0x1) modify_ldt$write2(0x11, 0x0, 0x0) 694.430053ms ago: executing program 4 (id=2591): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000039000/0x18000)=nil, &(0x7f0000000440)=[@textreal={0x8, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) connect$l2tp6(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 592.258215ms ago: executing program 3 (id=2592): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="48000000140003040000", @ANYRES32=r1, @ANYBLOB="14000200ff230000000000000000000000000001140006000000000006"], 0x48}}, 0x0) 590.006635ms ago: executing program 1 (id=2593): socket$kcm(0x10, 0x400000002, 0x0) epoll_create1(0x80000) socket$unix(0x1, 0x1, 0x0) setns(0xc9, 0x0) socket(0x8, 0x5, 0x5) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xa101, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x3, 0x1862, 0x15, "0062ba7d82000000000000000000f7fffeff00"}) syz_open_pts(r0, 0x8182) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x4000000000000000, 0x3}, 0x0, 0x0, 0x0, 0x0) 134.341607ms ago: executing program 4 (id=2594): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffd}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000800)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r2, 0x0, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x4a, &(0x7f0000000200)=ANY=[], 0x0) 133.824867ms ago: executing program 5 (id=2595): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00'}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[], 0x54}}, 0x0) 67.182368ms ago: executing program 3 (id=2596): prlimit64(0x0, 0xe, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x4000) r1 = epoll_create1(0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40088a01, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x1, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) unshare(0x2040400) sendmsg$NFT_BATCH(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000060a010400000000000000000a0000010900010073797a3100000000300004802c0001800b000100736f636b657400001c000280080002400000000b080001400000000308000300000000ff0900020073797a32"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) 0s ago: executing program 5 (id=2597): bpf$MAP_CREATE(0x0, 0x0, 0x50) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = syz_clone(0x2000400, 0x0, 0xfffffebf, 0x0, 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000005c0)=r0, 0x12) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f00000000c0)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_int(r4, 0x0, 0x0) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000280)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f0000000040)=0x1, 0x12) kernel console output (not intermixed with test programs): vice team_slave_1 added [ 543.851135][T11500] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 543.858773][T11500] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 543.998915][T11500] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 544.052990][T11500] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 544.079020][T11500] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 544.175712][T11662] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 544.211988][T11500] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 544.328088][T11662] ext4 filesystem being mounted at /67/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 544.557518][ T27] audit: type=1800 audit(1788327687.549:368): pid=11662 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2113" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 544.599465][T11673] 9pnet_fd: Insufficient options for proto=fd [ 544.871211][T11500] hsr_slave_0: entered promiscuous mode [ 544.991406][T11500] hsr_slave_1: entered promiscuous mode [ 545.149236][T11500] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 545.156909][T11500] Cannot create hsr debugfs directory [ 545.281083][T10851] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 545.924945][T11690] loop1: detected capacity change from 0 to 512 [ 546.471617][T11500] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 546.610620][T11500] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 546.729733][T11500] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 546.780312][T11698] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2121'. [ 546.923897][T11500] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 547.098140][T11700] FAULT_INJECTION: forcing a failure. [ 547.098140][T11700] name fail_futex, interval 1, probability 0, space 0, times 0 [ 547.208920][T11700] CPU: 1 PID: 11700 Comm: syz.4.2122 Not tainted syzkaller #0 [ 547.216496][T11700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 547.226611][T11700] Call Trace: [ 547.229935][T11700] [ 547.232920][T11700] dump_stack_lvl+0x18c/0x250 [ 547.237661][T11700] ? show_regs_print_info+0x20/0x20 [ 547.242907][T11700] ? load_image+0x420/0x420 [ 547.247463][T11700] ? __lock_acquire+0x1336/0x7d80 [ 547.252555][T11700] should_fail_ex+0x394/0x4c0 [ 547.257295][T11700] get_futex_key+0x136/0x1030 [ 547.262142][T11700] ? futex_setup_timer+0xc0/0xc0 [ 547.267174][T11700] futex_wake+0x127/0x4f0 [ 547.271548][T11700] ? futex_wake_mark+0x150/0x150 [ 547.276540][T11700] do_futex+0x35d/0x3e0 [ 547.280764][T11700] ? __might_fault+0xaa/0x120 [ 547.285477][T11700] ? __ia32_sys_get_robust_list+0x110/0x110 [ 547.291406][T11700] ? __might_fault+0xc6/0x120 [ 547.296122][T11700] mm_release+0x184/0x3a0 [ 547.300486][T11700] ? exit_mm_release+0x30/0x30 [ 547.305284][T11700] ? lockdep_hardirqs_on+0x98/0x150 [ 547.310554][T11700] exit_mm+0xa4/0x340 [ 547.314579][T11700] ? sysctl_delayacct+0x220/0x220 [ 547.319641][T11700] ? do_exit+0x2530/0x2530 [ 547.324115][T11700] do_exit+0x909/0x2530 [ 547.328316][T11700] ? put_task_struct+0xc0/0xc0 [ 547.333127][T11700] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 547.339159][T11700] ? get_signal+0x100e/0x1390 [ 547.343886][T11700] ? lock_chain_count+0x20/0x20 [ 547.348858][T11700] ? _raw_spin_lock_irq+0xbb/0xf0 [ 547.353926][T11700] do_group_exit+0x22d/0x2f0 [ 547.358558][T11700] ? lockdep_hardirqs_on+0x98/0x150 [ 547.363798][T11700] get_signal+0x12a6/0x1390 [ 547.368350][T11700] arch_do_signal_or_restart+0xc2/0x7b0 [ 547.373940][T11700] ? __ia32_sys_get_robust_list+0x110/0x110 [ 547.379878][T11700] ? get_sigframe_size+0x20/0x20 [ 547.384871][T11700] ? exit_to_user_mode_loop+0x3b/0x110 [ 547.390365][T11700] exit_to_user_mode_loop+0x70/0x110 [ 547.395683][T11700] exit_to_user_mode_prepare+0xee/0x180 [ 547.401263][T11700] syscall_exit_to_user_mode+0x1a/0x50 [ 547.406766][T11700] do_syscall_64+0x61/0xb0 [ 547.411244][T11700] ? clear_bhb_loop+0x40/0x90 [ 547.415953][T11700] ? clear_bhb_loop+0x40/0x90 [ 547.420672][T11700] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 547.426596][T11700] RIP: 0033:0x7f989f39e159 [ 547.431047][T11700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 547.450755][T11700] RSP: 002b:00007f98a02270e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 547.459243][T11700] RAX: fffffffffffffe00 RBX: 00007f989f625fa8 RCX: 00007f989f39e159 [ 547.467252][T11700] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f989f625fa8 [ 547.475264][T11700] RBP: 00007f989f625fa0 R08: 0000000000000000 R09: 0000000000000000 [ 547.483263][T11700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 547.491275][T11700] R13: 00007f989f626038 R14: 00007ffd995456f0 R15: 00007ffd995457d8 [ 547.499351][T11700] [ 548.015233][T11500] 8021q: adding VLAN 0 to HW filter on device bond0 [ 548.054016][T11709] 9pnet_fd: Insufficient options for proto=fd [ 548.142731][T11500] 8021q: adding VLAN 0 to HW filter on device team0 [ 548.212010][ T9093] bridge0: port 1(bridge_slave_0) entered blocking state [ 548.219325][ T9093] bridge0: port 1(bridge_slave_0) entered forwarding state [ 548.326987][ T9093] bridge0: port 2(bridge_slave_1) entered blocking state [ 548.334299][ T9093] bridge0: port 2(bridge_slave_1) entered forwarding state [ 549.816708][T11500] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 550.170957][T11739] syzkaller0: entered promiscuous mode [ 550.176538][T11739] syzkaller0: entered allmulticast mode [ 551.261182][T11761] 9pnet_fd: Insufficient options for proto=fd [ 551.741936][T11500] veth0_vlan: entered promiscuous mode [ 551.828273][T11500] veth1_vlan: entered promiscuous mode [ 552.013166][T11773] loop3: detected capacity change from 0 to 1024 [ 552.016643][T11500] veth0_macvtap: entered promiscuous mode [ 552.061356][T11500] veth1_macvtap: entered promiscuous mode [ 552.133262][T11500] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 552.205141][T11500] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 552.233160][T11500] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 552.264859][T11500] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 552.285727][T11500] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 552.313727][T11500] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 552.336729][T11500] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 552.339160][T11776] loop4: detected capacity change from 0 to 512 [ 552.386436][T11773] EXT4-fs (loop3): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 552.406625][T11500] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 552.450998][T11500] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 552.526794][T11500] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 552.548931][T11773] ext4 filesystem being mounted at /546/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 552.563877][T11500] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 552.665608][T11776] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 552.679131][T11500] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 552.749014][T11500] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 552.759349][T11779] EXT4-fs error (device loop3): ext4_validate_block_bitmap:439: comm ext4lazyinit: bg 0: block 112: padding at end of block bitmap is not set [ 552.799188][T11776] ext4 filesystem being mounted at /75/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 552.859022][T11779] EXT4-fs (loop3): Remounting filesystem read-only [ 552.871366][T11500] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 552.937273][T11500] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 552.996880][T11500] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.053618][T11500] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.069606][T11776] EXT4-fs error (device loop4): ext4_map_blocks:610: inode #2: block 18: comm syz.4.2139: lblock 23 mapped to illegal pblock 18 (length 1) [ 553.095694][T11500] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.267343][T10851] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 553.391999][ T5771] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 553.968131][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 554.226678][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 554.529272][ T1004] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 554.598938][ T1004] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 554.805585][T11795] 9pnet_fd: Insufficient options for proto=fd [ 555.543397][T11811] loop5: detected capacity change from 0 to 164 [ 557.775566][T11840] 9pnet_fd: Insufficient options for proto=fd [ 558.200211][T11836] syzkaller0: entered promiscuous mode [ 558.310480][T11836] syzkaller0: entered allmulticast mode [ 558.358399][T11845] FAULT_INJECTION: forcing a failure. [ 558.358399][T11845] name failslab, interval 1, probability 0, space 0, times 0 [ 558.388916][T11845] CPU: 1 PID: 11845 Comm: syz.5.2155 Not tainted syzkaller #0 [ 558.396487][T11845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 558.406605][T11845] Call Trace: [ 558.409946][T11845] [ 558.412931][T11845] dump_stack_lvl+0x18c/0x250 [ 558.417680][T11845] ? show_regs_print_info+0x20/0x20 [ 558.422949][T11845] ? load_image+0x420/0x420 [ 558.427524][T11845] ? __might_sleep+0xe0/0xe0 [ 558.432195][T11845] ? __lock_acquire+0x7d80/0x7d80 [ 558.437324][T11845] should_fail_ex+0x394/0x4c0 [ 558.442080][T11845] should_failslab+0x9/0x20 [ 558.446648][T11845] slab_pre_alloc_hook+0x59/0x300 [ 558.451756][T11845] kmem_cache_alloc+0x5a/0x2c0 [ 558.456716][T11845] ? security_inode_alloc+0x34/0x110 [ 558.462110][T11845] security_inode_alloc+0x34/0x110 [ 558.467313][T11845] inode_init_always+0x914/0xc90 [ 558.472325][T11845] new_inode_pseudo+0x95/0x1d0 [ 558.477135][T11845] __sock_create+0x12d/0x940 [ 558.481760][T11845] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 558.487784][T11845] __sys_socket+0xd7/0x1b0 [ 558.492240][T11845] __x64_sys_socket+0x7a/0x90 [ 558.496954][T11845] do_syscall_64+0x55/0xb0 [ 558.501413][T11845] ? clear_bhb_loop+0x40/0x90 [ 558.506135][T11845] ? clear_bhb_loop+0x40/0x90 [ 558.510850][T11845] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 558.516786][T11845] RIP: 0033:0x7f729939e159 [ 558.521235][T11845] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 558.540902][T11845] RSP: 002b:00007f729a2e3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 558.549354][T11845] RAX: ffffffffffffffda RBX: 00007f7299625fa0 RCX: 00007f729939e159 [ 558.557409][T11845] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 [ 558.565414][T11845] RBP: 00007f7299435024 R08: 0000000000000000 R09: 0000000000000000 [ 558.573417][T11845] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 558.581425][T11845] R13: 00007f7299626038 R14: 00007f7299625fa0 R15: 00007ffe8996d818 [ 558.589464][T11845] [ 558.689095][T11845] socket: no more sockets [ 562.319633][T11885] FAULT_INJECTION: forcing a failure. [ 562.319633][T11885] name failslab, interval 1, probability 0, space 0, times 0 [ 562.395936][T11885] CPU: 1 PID: 11885 Comm: syz.1.2165 Not tainted syzkaller #0 [ 562.403518][T11885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 562.413640][T11885] Call Trace: [ 562.416972][T11885] [ 562.419956][T11885] dump_stack_lvl+0x18c/0x250 [ 562.424714][T11885] ? show_regs_print_info+0x20/0x20 [ 562.429978][T11885] ? load_image+0x420/0x420 [ 562.434552][T11885] ? __might_sleep+0xe0/0xe0 [ 562.439202][T11885] ? __lock_acquire+0x7d80/0x7d80 [ 562.444311][T11885] should_fail_ex+0x394/0x4c0 [ 562.449061][T11885] should_failslab+0x9/0x20 [ 562.453638][T11885] slab_pre_alloc_hook+0x59/0x300 [ 562.458750][T11885] kmem_cache_alloc+0x5a/0x2c0 [ 562.463589][T11885] ? security_inode_alloc+0x34/0x110 [ 562.468949][T11885] security_inode_alloc+0x34/0x110 [ 562.474164][T11885] inode_init_always+0x914/0xc90 [ 562.479187][T11885] new_inode_pseudo+0x95/0x1d0 [ 562.484021][T11885] __sock_create+0x12d/0x940 [ 562.488688][T11885] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 562.494756][T11885] __sys_socket+0xd7/0x1b0 [ 562.499250][T11885] __x64_sys_socket+0x7a/0x90 [ 562.503986][T11885] do_syscall_64+0x55/0xb0 [ 562.508444][T11885] ? clear_bhb_loop+0x40/0x90 [ 562.513166][T11885] ? clear_bhb_loop+0x40/0x90 [ 562.517878][T11885] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 562.523808][T11885] RIP: 0033:0x7f9c2339e159 [ 562.528262][T11885] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 562.547902][T11885] RSP: 002b:00007f9c2421a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 562.556369][T11885] RAX: ffffffffffffffda RBX: 00007f9c23625fa0 RCX: 00007f9c2339e159 [ 562.564381][T11885] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 [ 562.572397][T11885] RBP: 00007f9c23435024 R08: 0000000000000000 R09: 0000000000000000 [ 562.580402][T11885] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 562.588403][T11885] R13: 00007f9c23626038 R14: 00007f9c23625fa0 R15: 00007ffe62e2a088 [ 562.596426][T11885] [ 562.675500][T11885] socket: no more sockets [ 563.172904][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.179874][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.952078][T11906] loop5: detected capacity change from 0 to 128 [ 564.732096][T11917] loop1: detected capacity change from 0 to 1024 [ 565.316544][T11917] EXT4-fs (loop1): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 565.775109][T11917] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 2: comm syz.1.2173: lblock 2 mapped to illegal pblock 2 (length 1) [ 565.792709][T11917] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 565.801271][T11917] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 48: comm syz.1.2173: lblock 0 mapped to illegal pblock 48 (length 1) [ 565.816084][T11917] Quota error (device loop1): v2_write_file_info: Can't write info structure [ 565.825271][T11917] EXT4-fs error (device loop1): ext4_acquire_dquot:6953: comm syz.1.2173: Failed to acquire dquot type 0 [ 565.837972][T11917] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 565.849023][T11917] EXT4-fs error (device loop1): ext4_evict_inode:254: inode #11: comm syz.1.2173: mark_inode_dirty error [ 565.863438][T11917] EXT4-fs warning (device loop1): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 565.874197][T11917] EXT4-fs (loop1): 1 orphan inode deleted [ 565.881604][T11917] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 565.897253][ T9093] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:11: lblock 1 mapped to illegal pblock 1 (length 1) [ 565.987217][ T9093] Quota error (device loop1): remove_tree: Can't read quota data block 1 [ 566.023023][ T9093] EXT4-fs error (device loop1): ext4_release_dquot:6989: comm kworker/u4:11: Failed to release dquot type 0 [ 566.419321][T11925] FAULT_INJECTION: forcing a failure. [ 566.419321][T11925] name failslab, interval 1, probability 0, space 0, times 0 [ 566.511943][T11925] CPU: 0 PID: 11925 Comm: syz.3.2175 Not tainted syzkaller #0 [ 566.519521][T11925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 566.529633][T11925] Call Trace: [ 566.532960][T11925] [ 566.535930][T11925] dump_stack_lvl+0x18c/0x250 [ 566.540676][T11925] ? show_regs_print_info+0x20/0x20 [ 566.545933][T11925] ? load_image+0x420/0x420 [ 566.550502][T11925] ? __lock_acquire+0x7d80/0x7d80 [ 566.555608][T11925] should_fail_ex+0x394/0x4c0 [ 566.560352][T11925] should_failslab+0x9/0x20 [ 566.564919][T11925] slab_pre_alloc_hook+0x59/0x300 [ 566.570020][T11925] kmem_cache_alloc_lru+0x4d/0x2b0 [ 566.575190][T11925] ? sock_alloc_inode+0x28/0xc0 [ 566.580098][T11925] sock_alloc_inode+0x28/0xc0 [ 566.584834][T11925] ? sockfs_init_fs_context+0xb0/0xb0 [ 566.590261][T11925] new_inode_pseudo+0x63/0x1d0 [ 566.595090][T11925] __sock_create+0x12d/0x940 [ 566.599742][T11925] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 566.605800][T11925] __sys_socket+0xd7/0x1b0 [ 566.610266][T11925] __x64_sys_socket+0x7a/0x90 [ 566.615056][T11925] do_syscall_64+0x55/0xb0 [ 566.619535][T11925] ? clear_bhb_loop+0x40/0x90 [ 566.624275][T11925] ? clear_bhb_loop+0x40/0x90 [ 566.629011][T11925] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 566.634956][T11925] RIP: 0033:0x7f815a79e159 [ 566.639414][T11925] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 566.659081][T11925] RSP: 002b:00007f815b6e5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 566.667561][T11925] RAX: ffffffffffffffda RBX: 00007f815aa25fa0 RCX: 00007f815a79e159 [ 566.675590][T11925] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 [ 566.683617][T11925] RBP: 00007f815a835024 R08: 0000000000000000 R09: 0000000000000000 [ 566.691648][T11925] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 566.699720][T11925] R13: 00007f815aa26038 R14: 00007f815aa25fa0 R15: 00007fff8d8c13c8 [ 566.707772][T11925] [ 566.715371][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 566.803442][ T5773] EXT4-fs error (device loop1): __ext4_get_inode_loc:4497: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 566.897198][ T5773] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 566.907781][T11925] socket: no more sockets [ 567.019636][ T5773] EXT4-fs error (device loop1): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 567.239344][T11937] FAULT_INJECTION: forcing a failure. [ 567.239344][T11937] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 567.309117][T11937] CPU: 1 PID: 11937 Comm: syz.5.2180 Not tainted syzkaller #0 [ 567.316712][T11937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 567.326823][T11937] Call Trace: [ 567.330153][T11937] [ 567.333133][T11937] dump_stack_lvl+0x18c/0x250 [ 567.337871][T11937] ? show_regs_print_info+0x20/0x20 [ 567.343133][T11937] ? load_image+0x420/0x420 [ 567.347694][T11937] ? __lock_acquire+0x7d80/0x7d80 [ 567.352789][T11937] should_fail_ex+0x394/0x4c0 [ 567.357538][T11937] prepare_alloc_pages+0x1e1/0x5b0 [ 567.362721][T11937] __alloc_pages+0x134/0x460 [ 567.367363][T11937] ? zone_statistics+0x170/0x170 [ 567.372344][T11937] ? alloc_pages+0x4e1/0x740 [ 567.376959][T11937] ? do_raw_spin_unlock+0x121/0x230 [ 567.382199][T11937] __get_free_pages+0xc/0x30 [ 567.386820][T11937] kasan_populate_vmalloc_pte+0x35/0x100 [ 567.392494][T11937] __apply_to_page_range+0x860/0xdd0 [ 567.397829][T11937] ? kasan_populate_vmalloc+0x70/0x70 [ 567.403285][T11937] ? apply_to_page_range+0x50/0x50 [ 567.408443][T11937] ? do_raw_spin_unlock+0x121/0x230 [ 567.413685][T11937] alloc_vmap_area+0x1d26/0x1e50 [ 567.418681][T11937] ? vm_map_ram+0xcf0/0xcf0 [ 567.423223][T11937] ? rcu_is_watching+0x15/0xb0 [ 567.428024][T11937] __get_vm_area_node+0x162/0x370 [ 567.433085][T11937] ? __kasan_kmalloc+0x8f/0xa0 [ 567.437883][T11937] __vmalloc_node_range+0x36f/0x1320 [ 567.443200][T11937] ? write_ldt+0x4d4/0x750 [ 567.447681][T11937] ? free_vm_area+0x50/0x50 [ 567.452228][T11937] ? write_ldt+0x4d4/0x750 [ 567.456673][T11937] __vmalloc+0x7a/0x90 [ 567.460771][T11937] ? write_ldt+0x4d4/0x750 [ 567.465227][T11937] write_ldt+0x4d4/0x750 [ 567.469511][T11937] ? native_write_gdt_entry+0x30/0x30 [ 567.474913][T11937] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 567.480950][T11937] ? lock_chain_count+0x20/0x20 [ 567.485864][T11937] __se_sys_modify_ldt+0x6c/0x2f0 [ 567.490941][T11937] do_syscall_64+0x55/0xb0 [ 567.495530][T11937] ? clear_bhb_loop+0x40/0x90 [ 567.500325][T11937] ? clear_bhb_loop+0x40/0x90 [ 567.505048][T11937] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 567.510991][T11937] RIP: 0033:0x7f729939e159 [ 567.515437][T11937] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 567.535107][T11937] RSP: 002b:00007f729a2e3028 EFLAGS: 00000246 ORIG_RAX: 000000000000009a [ 567.543558][T11937] RAX: ffffffffffffffda RBX: 00007f7299625fa0 RCX: 00007f729939e159 [ 567.551560][T11937] RDX: 0000000000000010 RSI: 0000200000000040 RDI: 0000000000000011 [ 567.559557][T11937] RBP: 00007f7299435024 R08: 0000000000000000 R09: 0000000000000000 [ 567.567556][T11937] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 567.575550][T11937] R13: 00007f7299626038 R14: 00007f7299625fa0 R15: 00007ffe8996d818 [ 567.583565][T11937] [ 567.749939][T11937] syz.5.2180: vmalloc error: size 65536, vm_struct allocation failed, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=syz5,mems_allowed=0-1 [ 567.806534][T11937] CPU: 0 PID: 11937 Comm: syz.5.2180 Not tainted syzkaller #0 [ 567.814105][T11937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 567.824229][T11937] Call Trace: [ 567.827551][T11937] [ 567.830527][T11937] dump_stack_lvl+0x18c/0x250 [ 567.835282][T11937] ? show_regs_print_info+0x20/0x20 [ 567.840548][T11937] ? load_image+0x420/0x420 [ 567.845112][T11937] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 567.851592][T11937] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 567.858157][T11937] warn_alloc+0x246/0x340 [ 567.862545][T11937] ? slab_free_freelist_hook+0x130/0x1a0 [ 567.868249][T11937] ? zone_watermark_ok_safe+0x230/0x230 [ 567.873853][T11937] ? __get_vm_area_node+0x17b/0x370 [ 567.879122][T11937] ? __get_vm_area_node+0x17b/0x370 [ 567.884391][T11937] ? __kasan_kmalloc+0x8f/0xa0 [ 567.889228][T11937] __vmalloc_node_range+0x394/0x1320 [ 567.894576][T11937] ? free_vm_area+0x50/0x50 [ 567.899130][T11937] ? write_ldt+0x4d4/0x750 [ 567.903581][T11937] __vmalloc+0x7a/0x90 [ 567.907688][T11937] ? write_ldt+0x4d4/0x750 [ 567.912155][T11937] write_ldt+0x4d4/0x750 [ 567.916442][T11937] ? native_write_gdt_entry+0x30/0x30 [ 567.921845][T11937] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 567.927862][T11937] ? lock_chain_count+0x20/0x20 [ 567.932767][T11937] __se_sys_modify_ldt+0x6c/0x2f0 [ 567.937837][T11937] do_syscall_64+0x55/0xb0 [ 567.942289][T11937] ? clear_bhb_loop+0x40/0x90 [ 567.947001][T11937] ? clear_bhb_loop+0x40/0x90 [ 567.951715][T11937] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 567.957640][T11937] RIP: 0033:0x7f729939e159 [ 567.962084][T11937] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 567.981733][T11937] RSP: 002b:00007f729a2e3028 EFLAGS: 00000246 ORIG_RAX: 000000000000009a [ 567.990183][T11937] RAX: ffffffffffffffda RBX: 00007f7299625fa0 RCX: 00007f729939e159 [ 567.998182][T11937] RDX: 0000000000000010 RSI: 0000200000000040 RDI: 0000000000000011 [ 568.006183][T11937] RBP: 00007f7299435024 R08: 0000000000000000 R09: 0000000000000000 [ 568.014183][T11937] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 568.022185][T11937] R13: 00007f7299626038 R14: 00007f7299625fa0 R15: 00007ffe8996d818 [ 568.030209][T11937] [ 568.168931][T11937] Mem-Info: [ 568.172161][T11937] active_anon:57986 inactive_anon:0 isolated_anon:0 [ 568.172161][T11937] active_file:14758 inactive_file:40181 isolated_file:0 [ 568.172161][T11937] unevictable:768 dirty:101 writeback:0 [ 568.172161][T11937] slab_reclaimable:10452 slab_unreclaimable:104462 [ 568.172161][T11937] mapped:34401 shmem:53049 pagetables:743 [ 568.172161][T11937] sec_pagetables:0 bounce:0 [ 568.172161][T11937] kernel_misc_reclaimable:0 [ 568.172161][T11937] free:1285314 free_pcp:8802 free_cma:0 [ 568.403767][T11937] Node 0 active_anon:232044kB inactive_anon:0kB active_file:59032kB inactive_file:160524kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:138556kB dirty:412kB writeback:0kB shmem:210924kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11272kB pagetables:3136kB sec_pagetables:0kB all_unreclaimable? no [ 568.570691][T11937] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 568.789020][T11937] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 568.827706][T11953] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 568.920225][T11937] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 568.926114][T11937] Node 0 DMA32 free:1232348kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:235304kB inactive_anon:0kB active_file:59032kB inactive_file:159700kB unevictable:1536kB writepending:412kB present:3129332kB managed:2586824kB mlocked:0kB bounce:0kB free_pcp:14596kB local_pcp:2204kB free_cma:0kB [ 569.123634][T11937] lowmem_reserve[]: 0 0 0 0 0 [ 569.128494][T11937] Node 0 Normal free:8kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:824kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 569.199047][T11937] lowmem_reserve[]: 0 0 0 0 0 [ 569.203893][T11937] Node 1 Normal free:3893540kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:16960kB local_pcp:7584kB free_cma:0kB [ 569.319004][T11937] lowmem_reserve[]: 0 0 0 0 0 [ 569.323871][T11937] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 569.355110][T11937] Node 0 DMA32: 7*4kB (ME) 1*8kB (U) 0*16kB 6*32kB (E) 4*64kB (UME) 1*128kB (U) 1*256kB (E) 27*512kB (UME) 4*1024kB (UM) 3*2048kB (UME) 294*4096kB (M) = 1229156kB [ 569.439047][T11937] Node 0 Normal: 0*4kB 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 569.479136][T11937] Node 1 Normal: 233*4kB (UME) 50*8kB (UME) 33*16kB (UME) 109*32kB (UME) 27*64kB (UME) 9*128kB (UME) 1*256kB (M) 2*512kB (UE) 1*1024kB (U) 2*2048kB (UE) 947*4096kB (M) = 3893540kB [ 569.558975][T11937] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 569.646751][T11937] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 569.839313][T11937] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 570.048649][T11937] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 570.409772][T11937] 110785 total pagecache pages [ 570.414745][T11937] 0 pages in swap cache [ 570.420703][T11937] Free swap = 124728kB [ 570.424937][T11937] Total swap = 124996kB [ 570.469689][T11937] 2097051 pages RAM [ 570.473589][T11937] 0 pages HighMem/MovableOnly [ 570.539151][T11937] 416959 pages reserved [ 570.551109][T11937] 0 pages cma reserved [ 571.064279][T11969] loop5: detected capacity change from 0 to 1024 [ 571.140768][T11969] EXT4-fs (loop5): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 571.338552][T11969] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 2: comm syz.5.2186: lblock 2 mapped to illegal pblock 2 (length 1) [ 571.366318][T11969] Quota error (device loop5): qtree_write_dquot: dquota write failed [ 571.410181][T11969] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 48: comm syz.5.2186: lblock 0 mapped to illegal pblock 48 (length 1) [ 571.465216][T11969] Quota error (device loop5): v2_write_file_info: Can't write info structure [ 571.543066][T11969] EXT4-fs error (device loop5): ext4_acquire_dquot:6953: comm syz.5.2186: Failed to acquire dquot type 0 [ 571.640572][T11969] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 571.697415][T11969] EXT4-fs error (device loop5): ext4_evict_inode:254: inode #11: comm syz.5.2186: mark_inode_dirty error [ 571.799596][T11969] EXT4-fs warning (device loop5): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 571.876015][T11969] EXT4-fs (loop5): 1 orphan inode deleted [ 571.894130][ T3471] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:9: lblock 1 mapped to illegal pblock 1 (length 1) [ 571.946066][T11969] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 572.006518][ T3471] Quota error (device loop5): remove_tree: Can't read quota data block 1 [ 572.059369][T11985] FAULT_INJECTION: forcing a failure. [ 572.059369][T11985] name failslab, interval 1, probability 0, space 0, times 0 [ 572.088954][ T3471] EXT4-fs error (device loop5): ext4_release_dquot:6989: comm kworker/u4:9: Failed to release dquot type 0 [ 572.218141][T11985] CPU: 0 PID: 11985 Comm: syz.1.2189 Not tainted syzkaller #0 [ 572.225700][T11985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 572.235871][T11985] Call Trace: [ 572.239190][T11985] [ 572.242157][T11985] dump_stack_lvl+0x18c/0x250 [ 572.246889][T11985] ? show_regs_print_info+0x20/0x20 [ 572.252138][T11985] ? load_image+0x420/0x420 [ 572.256687][T11985] ? __might_sleep+0xe0/0xe0 [ 572.261336][T11985] ? __lock_acquire+0x7d80/0x7d80 [ 572.266413][T11985] should_fail_ex+0x394/0x4c0 [ 572.271150][T11985] should_failslab+0x9/0x20 [ 572.275708][T11985] slab_pre_alloc_hook+0x59/0x300 [ 572.280844][T11985] kmem_cache_alloc+0x5a/0x2c0 [ 572.285689][T11985] ? security_inode_alloc+0x34/0x110 [ 572.291058][T11985] security_inode_alloc+0x34/0x110 [ 572.296234][T11985] inode_init_always+0x914/0xc90 [ 572.301233][T11985] new_inode_pseudo+0x95/0x1d0 [ 572.306055][T11985] __sock_create+0x12d/0x940 [ 572.310689][T11985] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 572.316728][T11985] __sys_socket+0xd7/0x1b0 [ 572.321196][T11985] __x64_sys_socket+0x7a/0x90 [ 572.325922][T11985] do_syscall_64+0x55/0xb0 [ 572.330387][T11985] ? clear_bhb_loop+0x40/0x90 [ 572.335118][T11985] ? clear_bhb_loop+0x40/0x90 [ 572.339852][T11985] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 572.345829][T11985] RIP: 0033:0x7f9c2339e159 [ 572.350286][T11985] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 572.369951][T11985] RSP: 002b:00007f9c2421a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 572.378413][T11985] RAX: ffffffffffffffda RBX: 00007f9c23625fa0 RCX: 00007f9c2339e159 [ 572.386426][T11985] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 [ 572.394431][T11985] RBP: 00007f9c23435024 R08: 0000000000000000 R09: 0000000000000000 [ 572.402439][T11985] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 572.410464][T11985] R13: 00007f9c23626038 R14: 00007f9c23625fa0 R15: 00007ffe62e2a088 [ 572.418510][T11985] [ 572.649022][T11985] socket: no more sockets [ 572.762024][T11500] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 572.789274][ T12] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:1: lblock 1 mapped to illegal pblock 1 (length 1) [ 572.836449][ T12] Quota error (device loop5): remove_tree: Can't read quota data block 1 [ 572.874763][ T12] EXT4-fs error (device loop5): ext4_release_dquot:6989: comm kworker/u4:1: Failed to release dquot type 0 [ 572.958418][T11500] EXT4-fs error (device loop5): __ext4_get_inode_loc:4497: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 573.048921][T11500] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 573.114420][T11500] EXT4-fs error (device loop5): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 573.464634][T12004] loop5: detected capacity change from 0 to 512 [ 574.190184][T12004] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 574.349126][T12004] ext4 filesystem being mounted at /14/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 574.793222][T11500] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 575.991887][T12033] FAULT_INJECTION: forcing a failure. [ 575.991887][T12033] name failslab, interval 1, probability 0, space 0, times 0 [ 576.162173][T12033] CPU: 0 PID: 12033 Comm: syz.3.2200 Not tainted syzkaller #0 [ 576.169743][T12033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 576.179845][T12033] Call Trace: [ 576.183172][T12033] [ 576.186142][T12033] dump_stack_lvl+0x18c/0x250 [ 576.190877][T12033] ? show_regs_print_info+0x20/0x20 [ 576.196135][T12033] ? load_image+0x420/0x420 [ 576.200690][T12033] ? __lock_acquire+0x7d80/0x7d80 [ 576.205775][T12033] should_fail_ex+0x394/0x4c0 [ 576.210515][T12033] should_failslab+0x9/0x20 [ 576.215075][T12033] slab_pre_alloc_hook+0x59/0x300 [ 576.220167][T12033] kmem_cache_alloc_lru+0x4d/0x2b0 [ 576.225335][T12033] ? sock_alloc_inode+0x28/0xc0 [ 576.230260][T12033] sock_alloc_inode+0x28/0xc0 [ 576.234994][T12033] ? sockfs_init_fs_context+0xb0/0xb0 [ 576.240421][T12033] new_inode_pseudo+0x63/0x1d0 [ 576.245243][T12033] __sock_create+0x12d/0x940 [ 576.249881][T12033] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 576.255938][T12033] __sys_socket+0xd7/0x1b0 [ 576.260406][T12033] __x64_sys_socket+0x7a/0x90 [ 576.265133][T12033] do_syscall_64+0x55/0xb0 [ 576.269614][T12033] ? clear_bhb_loop+0x40/0x90 [ 576.274351][T12033] ? clear_bhb_loop+0x40/0x90 [ 576.279089][T12033] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 576.285039][T12033] RIP: 0033:0x7f815a79e159 [ 576.289528][T12033] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 576.309200][T12033] RSP: 002b:00007f815b6e5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 576.317676][T12033] RAX: ffffffffffffffda RBX: 00007f815aa25fa0 RCX: 00007f815a79e159 [ 576.325703][T12033] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 [ 576.333723][T12033] RBP: 00007f815a835024 R08: 0000000000000000 R09: 0000000000000000 [ 576.341744][T12033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 576.349794][T12033] R13: 00007f815aa26038 R14: 00007f815aa25fa0 R15: 00007fff8d8c13c8 [ 576.357832][T12033] [ 576.400959][T12040] loop1: detected capacity change from 0 to 512 [ 576.509044][T12033] socket: no more sockets [ 576.599134][T12040] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 576.673265][T12040] ext4 filesystem being mounted at /538/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 577.214920][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 578.870429][T12079] FAULT_INJECTION: forcing a failure. [ 578.870429][T12079] name failslab, interval 1, probability 0, space 0, times 0 [ 579.049493][T12079] CPU: 1 PID: 12079 Comm: syz.1.2213 Not tainted syzkaller #0 [ 579.057060][T12079] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 579.067177][T12079] Call Trace: [ 579.070515][T12079] [ 579.073487][T12079] dump_stack_lvl+0x18c/0x250 [ 579.078231][T12079] ? show_regs_print_info+0x20/0x20 [ 579.083496][T12079] ? load_image+0x420/0x420 [ 579.088052][T12079] ? __might_sleep+0xe0/0xe0 [ 579.092699][T12079] ? __lock_acquire+0x7d80/0x7d80 [ 579.097793][T12079] should_fail_ex+0x394/0x4c0 [ 579.102555][T12079] should_failslab+0x9/0x20 [ 579.107128][T12079] slab_pre_alloc_hook+0x59/0x300 [ 579.112237][T12079] kmem_cache_alloc+0x5a/0x2c0 [ 579.117066][T12079] ? security_inode_alloc+0x34/0x110 [ 579.122418][T12079] security_inode_alloc+0x34/0x110 [ 579.127587][T12079] inode_init_always+0x914/0xc90 [ 579.132595][T12079] new_inode_pseudo+0x95/0x1d0 [ 579.137429][T12079] __sock_create+0x12d/0x940 [ 579.142096][T12079] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 579.148184][T12079] __sys_socket+0xd7/0x1b0 [ 579.152662][T12079] __x64_sys_socket+0x7a/0x90 [ 579.157400][T12079] do_syscall_64+0x55/0xb0 [ 579.161877][T12079] ? clear_bhb_loop+0x40/0x90 [ 579.166617][T12079] ? clear_bhb_loop+0x40/0x90 [ 579.171360][T12079] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 579.177304][T12079] RIP: 0033:0x7f9c2339e159 [ 579.181781][T12079] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 579.201448][T12079] RSP: 002b:00007f9c2421a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 579.209928][T12079] RAX: ffffffffffffffda RBX: 00007f9c23625fa0 RCX: 00007f9c2339e159 [ 579.217960][T12079] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 [ 579.225983][T12079] RBP: 00007f9c23435024 R08: 0000000000000000 R09: 0000000000000000 [ 579.234107][T12079] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 579.242135][T12079] R13: 00007f9c23626038 R14: 00007f9c23625fa0 R15: 00007ffe62e2a088 [ 579.250188][T12079] [ 579.319343][T12079] socket: no more sockets [ 579.939014][ T5776] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 580.238937][ T5776] usb 5-1: Using ep0 maxpacket: 32 [ 580.338976][ T5776] usb 5-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 580.389013][ T5776] usb 5-1: config 0 interface 0 has no altsetting 0 [ 580.417005][ T5776] usb 5-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 580.459252][ T5776] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 580.495437][ T5776] usb 5-1: config 0 descriptor?? [ 581.030735][ T5776] usbhid 5-1:0.0: can't add hid device: -71 [ 581.037111][ T5776] usbhid: probe of 5-1:0.0 failed with error -71 [ 581.103271][ T5776] usb 5-1: USB disconnect, device number 2 [ 581.599018][ T5776] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 581.948932][ T5776] usb 5-1: Using ep0 maxpacket: 32 [ 582.750891][ T5776] usb 5-1: unable to read config index 0 descriptor/all [ 582.757996][ T5776] usb 5-1: can't read configurations, error -71 [ 582.841967][T12123] FAULT_INJECTION: forcing a failure. [ 582.841967][T12123] name failslab, interval 1, probability 0, space 0, times 0 [ 582.909305][T12123] CPU: 1 PID: 12123 Comm: syz.1.2225 Not tainted syzkaller #0 [ 582.916866][T12123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 582.926974][T12123] Call Trace: [ 582.930286][T12123] [ 582.933245][T12123] dump_stack_lvl+0x18c/0x250 [ 582.937962][T12123] ? show_regs_print_info+0x20/0x20 [ 582.943193][T12123] ? load_image+0x420/0x420 [ 582.947731][T12123] ? __lock_acquire+0x7d80/0x7d80 [ 582.952797][T12123] should_fail_ex+0x394/0x4c0 [ 582.957517][T12123] should_failslab+0x9/0x20 [ 582.962060][T12123] slab_pre_alloc_hook+0x59/0x300 [ 582.967136][T12123] kmem_cache_alloc_lru+0x4d/0x2b0 [ 582.972296][T12123] ? sock_alloc_inode+0x28/0xc0 [ 582.977189][T12123] sock_alloc_inode+0x28/0xc0 [ 582.981912][T12123] ? sockfs_init_fs_context+0xb0/0xb0 [ 582.987322][T12123] new_inode_pseudo+0x63/0x1d0 [ 582.992123][T12123] __sock_create+0x12d/0x940 [ 582.996750][T12123] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 583.002772][T12123] __sys_socket+0xd7/0x1b0 [ 583.007221][T12123] __x64_sys_socket+0x7a/0x90 [ 583.011945][T12123] do_syscall_64+0x55/0xb0 [ 583.016392][T12123] ? clear_bhb_loop+0x40/0x90 [ 583.021110][T12123] ? clear_bhb_loop+0x40/0x90 [ 583.025827][T12123] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 583.031753][T12123] RIP: 0033:0x7f9c2339e159 [ 583.036208][T12123] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 583.055849][T12123] RSP: 002b:00007f9c2421a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 583.064297][T12123] RAX: ffffffffffffffda RBX: 00007f9c23625fa0 RCX: 00007f9c2339e159 [ 583.072297][T12123] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 [ 583.080301][T12123] RBP: 00007f9c23435024 R08: 0000000000000000 R09: 0000000000000000 [ 583.088299][T12123] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 583.096307][T12123] R13: 00007f9c23626038 R14: 00007f9c23625fa0 R15: 00007ffe62e2a088 [ 583.104322][T12123] [ 583.290159][T12123] socket: no more sockets [ 583.635892][T12132] loop4: detected capacity change from 0 to 164 [ 585.510024][T12161] FAULT_INJECTION: forcing a failure. [ 585.510024][T12161] name failslab, interval 1, probability 0, space 0, times 0 [ 585.588934][T12161] CPU: 1 PID: 12161 Comm: syz.3.2235 Not tainted syzkaller #0 [ 585.596495][T12161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 585.606604][T12161] Call Trace: [ 585.609925][T12161] [ 585.612901][T12161] dump_stack_lvl+0x18c/0x250 [ 585.617632][T12161] ? show_regs_print_info+0x20/0x20 [ 585.622888][T12161] ? load_image+0x420/0x420 [ 585.627450][T12161] ? __lock_acquire+0x7d80/0x7d80 [ 585.632541][T12161] should_fail_ex+0x394/0x4c0 [ 585.637289][T12161] should_failslab+0x9/0x20 [ 585.641854][T12161] slab_pre_alloc_hook+0x59/0x300 [ 585.646937][T12161] kmem_cache_alloc_lru+0x4d/0x2b0 [ 585.652115][T12161] ? sock_alloc_inode+0x28/0xc0 [ 585.657019][T12161] sock_alloc_inode+0x28/0xc0 [ 585.661725][T12161] ? sockfs_init_fs_context+0xb0/0xb0 [ 585.667125][T12161] new_inode_pseudo+0x63/0x1d0 [ 585.671920][T12161] __sock_create+0x12d/0x940 [ 585.676530][T12161] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 585.682542][T12161] __sys_socket+0xd7/0x1b0 [ 585.686993][T12161] __x64_sys_socket+0x7a/0x90 [ 585.691700][T12161] do_syscall_64+0x55/0xb0 [ 585.696152][T12161] ? clear_bhb_loop+0x40/0x90 [ 585.700855][T12161] ? clear_bhb_loop+0x40/0x90 [ 585.705565][T12161] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 585.711517][T12161] RIP: 0033:0x7f815a79e159 [ 585.715965][T12161] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 585.735631][T12161] RSP: 002b:00007f815b6e5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 585.744084][T12161] RAX: ffffffffffffffda RBX: 00007f815aa25fa0 RCX: 00007f815a79e159 [ 585.752084][T12161] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 [ 585.760075][T12161] RBP: 00007f815a835024 R08: 0000000000000000 R09: 0000000000000000 [ 585.768074][T12161] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 585.776068][T12161] R13: 00007f815aa26038 R14: 00007f815aa25fa0 R15: 00007fff8d8c13c8 [ 585.784084][T12161] [ 585.858984][T12161] socket: no more sockets [ 586.095836][T12166] loop4: detected capacity change from 0 to 1024 [ 586.389365][T12166] EXT4-fs (loop4): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 586.793648][T12166] EXT4-fs error (device loop4): ext4_map_blocks:610: inode #3: block 2: comm syz.4.2234: lblock 2 mapped to illegal pblock 2 (length 1) [ 586.982559][T12166] Quota error (device loop4): qtree_write_dquot: dquota write failed [ 587.152064][T12166] EXT4-fs error (device loop4): ext4_map_blocks:610: inode #3: block 48: comm syz.4.2234: lblock 0 mapped to illegal pblock 48 (length 1) [ 587.391570][T12166] Quota error (device loop4): v2_write_file_info: Can't write info structure [ 587.569002][T12166] EXT4-fs error (device loop4): ext4_acquire_dquot:6953: comm syz.4.2234: Failed to acquire dquot type 0 [ 587.852200][T12166] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 587.987165][T12166] EXT4-fs error (device loop4): ext4_evict_inode:254: inode #11: comm syz.4.2234: mark_inode_dirty error [ 588.261867][T12166] EXT4-fs warning (device loop4): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 588.440149][T12166] EXT4-fs (loop4): 1 orphan inode deleted [ 588.459080][ T42] EXT4-fs error (device loop4): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:2: lblock 1 mapped to illegal pblock 1 (length 1) [ 588.509612][T12166] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 588.629834][ T42] Quota error (device loop4): remove_tree: Can't read quota data block 1 [ 588.638368][ T42] EXT4-fs error (device loop4): ext4_release_dquot:6989: comm kworker/u4:2: Failed to release dquot type 0 [ 589.490291][ T1004] EXT4-fs error (device loop4): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:5: lblock 1 mapped to illegal pblock 1 (length 1) [ 589.540365][T10851] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 589.561821][ T1004] Quota error (device loop4): remove_tree: Can't read quota data block 1 [ 589.609097][ T1004] EXT4-fs error (device loop4): ext4_release_dquot:6989: comm kworker/u4:5: Failed to release dquot type 0 [ 589.769142][T10851] EXT4-fs error (device loop4): __ext4_get_inode_loc:4497: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 589.953691][T10851] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 590.178908][T10851] EXT4-fs error (device loop4): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 590.949272][T12249] FAULT_INJECTION: forcing a failure. [ 590.949272][T12249] name failslab, interval 1, probability 0, space 0, times 0 [ 591.034327][T12252] loop1: detected capacity change from 0 to 1024 [ 591.099355][T12249] CPU: 1 PID: 12249 Comm: syz.4.2246 Not tainted syzkaller #0 [ 591.106921][T12249] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 591.117032][T12249] Call Trace: [ 591.120366][T12249] [ 591.123343][T12249] dump_stack_lvl+0x18c/0x250 [ 591.128091][T12249] ? show_regs_print_info+0x20/0x20 [ 591.133350][T12249] ? load_image+0x420/0x420 [ 591.137940][T12249] ? __lock_acquire+0x7d80/0x7d80 [ 591.143037][T12249] should_fail_ex+0x394/0x4c0 [ 591.147786][T12249] should_failslab+0x9/0x20 [ 591.152363][T12249] slab_pre_alloc_hook+0x59/0x300 [ 591.157457][T12249] kmem_cache_alloc_lru+0x4d/0x2b0 [ 591.162630][T12249] ? sock_alloc_inode+0x28/0xc0 [ 591.167547][T12249] sock_alloc_inode+0x28/0xc0 [ 591.172288][T12249] ? sockfs_init_fs_context+0xb0/0xb0 [ 591.177727][T12249] new_inode_pseudo+0x63/0x1d0 [ 591.182552][T12249] __sock_create+0x12d/0x940 [ 591.187176][T12249] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 591.193202][T12249] __sys_socket+0xd7/0x1b0 [ 591.197656][T12249] __x64_sys_socket+0x7a/0x90 [ 591.202370][T12249] do_syscall_64+0x55/0xb0 [ 591.206822][T12249] ? clear_bhb_loop+0x40/0x90 [ 591.211534][T12249] ? clear_bhb_loop+0x40/0x90 [ 591.216251][T12249] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 591.222175][T12249] RIP: 0033:0x7f989f39e159 [ 591.226625][T12249] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 591.246276][T12249] RSP: 002b:00007f98a0227028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 591.254727][T12249] RAX: ffffffffffffffda RBX: 00007f989f625fa0 RCX: 00007f989f39e159 [ 591.262735][T12249] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 [ 591.270749][T12249] RBP: 00007f989f435024 R08: 0000000000000000 R09: 0000000000000000 [ 591.278754][T12249] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 591.286760][T12249] R13: 00007f989f626038 R14: 00007f989f625fa0 R15: 00007ffd995457d8 [ 591.294811][T12249] [ 591.306636][T12252] EXT4-fs (loop1): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 591.365232][T12249] socket: no more sockets [ 591.407736][T12252] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 2: comm syz.1.2254: lblock 2 mapped to illegal pblock 2 (length 1) [ 591.471593][T12252] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 591.501571][T12252] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 48: comm syz.1.2254: lblock 0 mapped to illegal pblock 48 (length 1) [ 591.622057][T12252] Quota error (device loop1): v2_write_file_info: Can't write info structure [ 591.687886][T12252] EXT4-fs error (device loop1): ext4_acquire_dquot:6953: comm syz.1.2254: Failed to acquire dquot type 0 [ 591.804887][T12252] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 591.925922][T12252] EXT4-fs error (device loop1): ext4_evict_inode:254: inode #11: comm syz.1.2254: mark_inode_dirty error [ 591.972477][T12252] EXT4-fs warning (device loop1): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 592.019005][T12252] EXT4-fs (loop1): 1 orphan inode deleted [ 592.026225][T12252] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 592.044783][ T3450] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:8: lblock 1 mapped to illegal pblock 1 (length 1) [ 592.149725][ T3450] Quota error (device loop1): remove_tree: Can't read quota data block 1 [ 592.190977][ T3450] EXT4-fs error (device loop1): ext4_release_dquot:6989: comm kworker/u4:8: Failed to release dquot type 0 [ 592.445910][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 592.465439][ T3471] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:9: lblock 1 mapped to illegal pblock 1 (length 1) [ 592.560292][ T3471] Quota error (device loop1): remove_tree: Can't read quota data block 1 [ 592.568834][ T3471] EXT4-fs error (device loop1): ext4_release_dquot:6989: comm kworker/u4:9: Failed to release dquot type 0 [ 592.737711][ T5773] EXT4-fs error (device loop1): __ext4_get_inode_loc:4497: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 592.800026][ T5773] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 592.852895][ T5773] EXT4-fs error (device loop1): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 594.196667][T12307] loop3: detected capacity change from 0 to 1024 [ 594.267021][T12307] EXT4-fs (loop3): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 594.445847][T12307] EXT4-fs error (device loop3): ext4_map_blocks:610: inode #3: block 2: comm syz.3.2268: lblock 2 mapped to illegal pblock 2 (length 1) [ 594.510170][T12307] Quota error (device loop3): qtree_write_dquot: dquota write failed [ 594.549017][T12307] EXT4-fs error (device loop3): ext4_map_blocks:610: inode #3: block 48: comm syz.3.2268: lblock 0 mapped to illegal pblock 48 (length 1) [ 594.803329][T12307] Quota error (device loop3): v2_write_file_info: Can't write info structure [ 594.951721][T12318] loop4: detected capacity change from 0 to 1024 [ 595.019342][T12318] EXT4-fs (loop4): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 595.137695][T12318] EXT4-fs error (device loop4): ext4_map_blocks:610: inode #3: block 2: comm syz.4.2267: lblock 2 mapped to illegal pblock 2 (length 1) [ 595.153072][T12318] Quota error (device loop4): qtree_write_dquot: dquota write failed [ 595.161576][T12318] EXT4-fs error (device loop4): ext4_map_blocks:610: inode #3: block 48: comm syz.4.2267: lblock 0 mapped to illegal pblock 48 (length 1) [ 595.185828][T12318] Quota error (device loop4): v2_write_file_info: Can't write info structure [ 595.194999][T12318] EXT4-fs error (device loop4): ext4_acquire_dquot:6953: comm syz.4.2267: Failed to acquire dquot type 0 [ 595.234971][T12307] EXT4-fs error (device loop3): ext4_acquire_dquot:6953: comm syz.3.2268: Failed to acquire dquot type 0 [ 595.260938][T12318] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 595.289024][T12318] EXT4-fs error (device loop4): ext4_evict_inode:254: inode #11: comm syz.4.2267: mark_inode_dirty error [ 595.340287][T12318] EXT4-fs warning (device loop4): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 595.351142][T12318] EXT4-fs (loop4): 1 orphan inode deleted [ 595.360137][T12318] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 595.701541][T12307] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 595.760318][T12307] EXT4-fs error (device loop3): ext4_evict_inode:254: inode #11: comm syz.3.2268: mark_inode_dirty error [ 595.857895][ T1004] EXT4-fs error (device loop4): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:5: lblock 1 mapped to illegal pblock 1 (length 1) [ 595.926592][T12307] EXT4-fs warning (device loop3): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 595.999036][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 596.014813][T12307] EXT4-fs (loop3): 1 orphan inode deleted [ 596.061900][T12307] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 596.095214][ T1004] Quota error (device loop4): remove_tree: Can't read quota data block 1 [ 596.148978][ T1004] EXT4-fs error (device loop4): ext4_release_dquot:6989: comm kworker/u4:5: Failed to release dquot type 0 [ 596.278153][ T1004] EXT4-fs error (device loop3): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:5: lblock 1 mapped to illegal pblock 1 (length 1) [ 596.409231][ T1004] Quota error (device loop3): remove_tree: Can't read quota data block 1 [ 596.458632][ T1004] EXT4-fs error (device loop3): ext4_release_dquot:6989: comm kworker/u4:5: Failed to release dquot type 0 [ 596.584165][T10851] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 596.710623][ T5771] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 596.730795][ T1004] EXT4-fs error (device loop3): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:5: lblock 1 mapped to illegal pblock 1 (length 1) [ 596.789883][ T1004] Quota error (device loop3): remove_tree: Can't read quota data block 1 [ 596.801340][ T1004] EXT4-fs error (device loop3): ext4_release_dquot:6989: comm kworker/u4:5: Failed to release dquot type 0 [ 596.819379][ T5771] EXT4-fs error (device loop3): __ext4_get_inode_loc:4497: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 596.849441][T10851] EXT4-fs error (device loop4): __ext4_get_inode_loc:4497: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 596.875380][ T5771] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 596.926914][ T5771] EXT4-fs error (device loop3): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 596.961594][T10851] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 597.096586][T10851] EXT4-fs error (device loop4): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 597.207445][T12338] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=none:owns=io+mem [ 598.223360][T12366] loop1: detected capacity change from 0 to 1024 [ 598.297982][T12366] EXT4-fs (loop1): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 598.504901][T12366] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 2: comm syz.1.2279: lblock 2 mapped to illegal pblock 2 (length 1) [ 598.520767][T12366] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 598.529089][T12366] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 48: comm syz.1.2279: lblock 0 mapped to illegal pblock 48 (length 1) [ 598.547966][T12366] Quota error (device loop1): v2_write_file_info: Can't write info structure [ 598.557031][T12366] EXT4-fs error (device loop1): ext4_acquire_dquot:6953: comm syz.1.2279: Failed to acquire dquot type 0 [ 598.572585][T12366] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 598.590362][T12366] EXT4-fs error (device loop1): ext4_evict_inode:254: inode #11: comm syz.1.2279: mark_inode_dirty error [ 598.609261][T12366] EXT4-fs warning (device loop1): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 598.620055][T12366] EXT4-fs (loop1): 1 orphan inode deleted [ 598.633033][T12366] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 598.928277][ T3450] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:8: lblock 1 mapped to illegal pblock 1 (length 1) [ 599.045858][ T3450] Quota error (device loop1): remove_tree: Can't read quota data block 1 [ 599.106464][ T3450] EXT4-fs error (device loop1): ext4_release_dquot:6989: comm kworker/u4:8: Failed to release dquot type 0 [ 599.320854][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 599.369707][ T5773] EXT4-fs error (device loop1): __ext4_get_inode_loc:4497: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 599.474390][ T5773] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 599.565050][ T5773] EXT4-fs error (device loop1): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 599.944229][T12386] loop1: detected capacity change from 0 to 1024 [ 600.063991][T12386] EXT4-fs (loop1): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 600.148304][T12386] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 2: comm syz.1.2281: lblock 2 mapped to illegal pblock 2 (length 1) [ 600.247533][T12395] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=none:owns=io+mem [ 600.288101][T12386] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 600.339004][T12386] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 48: comm syz.1.2281: lblock 0 mapped to illegal pblock 48 (length 1) [ 600.458911][T12386] Quota error (device loop1): v2_write_file_info: Can't write info structure [ 600.468112][T12386] EXT4-fs error (device loop1): ext4_acquire_dquot:6953: comm syz.1.2281: Failed to acquire dquot type 0 [ 600.529203][T12386] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 600.552548][T12398] loop4: detected capacity change from 0 to 512 [ 600.629190][T12386] EXT4-fs error (device loop1): ext4_evict_inode:254: inode #11: comm syz.1.2281: mark_inode_dirty error [ 600.679240][T12386] EXT4-fs warning (device loop1): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 600.735371][T12398] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 600.757378][T12386] EXT4-fs (loop1): 1 orphan inode deleted [ 600.779171][T12398] ext4 filesystem being mounted at /103/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 600.803520][ T1330] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:6: lblock 1 mapped to illegal pblock 1 (length 1) [ 600.893025][ T1330] Quota error (device loop1): remove_tree: Can't read quota data block 1 [ 600.903304][T12386] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 600.970054][T12398] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 3: comm syz.4.2287: path (unknown): bad entry in directory: directory entry overrun - offset=0, inode=2, rec_len=2060, size=2048 fake=1 [ 601.009572][ T1330] EXT4-fs error (device loop1): ext4_release_dquot:6989: comm kworker/u4:6: Failed to release dquot type 0 [ 601.115497][T12398] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 12: comm syz.4.2287: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=5066064, rec_len=1, size=2048 fake=0 [ 601.198125][T12398] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 13: comm syz.4.2287: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3653246737, rec_len=1, size=2048 fake=0 [ 601.282149][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 601.309180][ T3450] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:8: lblock 1 mapped to illegal pblock 1 (length 1) [ 601.408333][ T3450] Quota error (device loop1): remove_tree: Can't read quota data block 1 [ 601.478976][ T3450] EXT4-fs error (device loop1): ext4_release_dquot:6989: comm kworker/u4:8: Failed to release dquot type 0 [ 601.514165][ T5773] EXT4-fs error (device loop1): __ext4_get_inode_loc:4497: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 601.550719][ T5773] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 601.589167][ T5773] EXT4-fs error (device loop1): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 601.621836][T10851] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 602.781076][T12438] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=none:owns=io+mem [ 603.237852][T12442] loop1: detected capacity change from 0 to 1024 [ 603.304577][T12442] EXT4-fs (loop1): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 603.469033][T12442] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 2: comm syz.1.2298: lblock 2 mapped to illegal pblock 2 (length 1) [ 603.561555][T12442] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 603.590429][T12442] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 48: comm syz.1.2298: lblock 0 mapped to illegal pblock 48 (length 1) [ 603.614387][T12449] loop3: detected capacity change from 0 to 512 [ 603.654065][T12442] Quota error (device loop1): v2_write_file_info: Can't write info structure [ 603.696028][T12442] EXT4-fs error (device loop1): ext4_acquire_dquot:6953: comm syz.1.2298: Failed to acquire dquot type 0 [ 603.759590][T12442] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 603.761455][T12449] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 603.795031][T12442] EXT4-fs error (device loop1): ext4_evict_inode:254: inode #11: comm syz.1.2298: mark_inode_dirty error [ 603.879143][T12449] ext4 filesystem being mounted at /592/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 603.879207][T12442] EXT4-fs warning (device loop1): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 603.987809][T12449] EXT4-fs error (device loop3): ext4_readdir:263: inode #2: block 3: comm syz.3.2300: path (unknown): bad entry in directory: directory entry overrun - offset=0, inode=2, rec_len=2060, size=2048 fake=1 [ 604.020145][T12442] EXT4-fs (loop1): 1 orphan inode deleted [ 604.044942][ T42] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:2: lblock 1 mapped to illegal pblock 1 (length 1) [ 604.070402][T12442] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 604.100842][T12449] EXT4-fs error (device loop3): ext4_readdir:263: inode #2: block 12: comm syz.3.2300: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=5066064, rec_len=1, size=2048 fake=0 [ 604.143714][ T42] Quota error (device loop1): remove_tree: Can't read quota data block 1 [ 604.169417][ T42] EXT4-fs error (device loop1): ext4_release_dquot:6989: comm kworker/u4:2: Failed to release dquot type 0 [ 604.264437][T12449] EXT4-fs error (device loop3): ext4_readdir:263: inode #2: block 13: comm syz.3.2300: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3653246737, rec_len=1, size=2048 fake=0 [ 604.362250][T12449] EXT4-fs error (device loop3): ext4_readdir:263: inode #2: block 14: comm syz.3.2300: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3, rec_len=0, size=2048 fake=0 [ 604.412091][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 604.552926][T12415] loop5: detected capacity change from 0 to 1024 [ 604.768492][T12415] EXT4-fs (loop5): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 605.044444][T12415] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 2: comm syz.5.2289: lblock 2 mapped to illegal pblock 2 (length 1) [ 605.061674][T12415] Quota error (device loop5): qtree_write_dquot: dquota write failed [ 605.070217][T12415] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 48: comm syz.5.2289: lblock 0 mapped to illegal pblock 48 (length 1) [ 605.097832][T12415] Quota error (device loop5): v2_write_file_info: Can't write info structure [ 605.106892][T12415] EXT4-fs error (device loop5): ext4_acquire_dquot:6953: comm syz.5.2289: Failed to acquire dquot type 0 [ 605.124845][T12415] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 605.136881][T12415] EXT4-fs error (device loop5): ext4_evict_inode:254: inode #11: comm syz.5.2289: mark_inode_dirty error [ 605.154769][ T1330] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:6: lblock 1 mapped to illegal pblock 1 (length 1) [ 605.169139][T12415] EXT4-fs warning (device loop5): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 605.179732][T12415] EXT4-fs (loop5): 1 orphan inode deleted [ 605.186928][T12415] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 605.264233][ T1330] Quota error (device loop1): remove_tree: Can't read quota data block 1 [ 605.331208][ T1330] EXT4-fs error (device loop1): ext4_release_dquot:6989: comm kworker/u4:6: Failed to release dquot type 0 [ 605.479112][ T1330] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:6: lblock 1 mapped to illegal pblock 1 (length 1) [ 605.509956][ T1330] Quota error (device loop5): remove_tree: Can't read quota data block 1 [ 605.518497][ T1330] EXT4-fs error (device loop5): ext4_release_dquot:6989: comm kworker/u4:6: Failed to release dquot type 0 [ 605.613031][ T5773] EXT4-fs error (device loop1): __ext4_get_inode_loc:4497: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 605.614953][T11500] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 605.639215][T11500] EXT4-fs error (device loop5): __ext4_get_inode_loc:4497: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 605.656088][ T5771] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 605.711424][T11500] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 605.751660][ T5773] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 605.810306][T11500] EXT4-fs error (device loop5): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 605.828586][ T5773] EXT4-fs error (device loop1): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 606.020669][ T175] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 606.144343][T12478] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=none:owns=io+mem [ 606.288172][ T175] usb 5-1: Using ep0 maxpacket: 32 [ 606.300389][ T175] usb 5-1: config 0 has an invalid interface number: 119 but max is 0 [ 606.327672][ T175] usb 5-1: config 0 has no interface number 0 [ 606.352346][ T175] usb 5-1: config 0 interface 119 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 606.418979][ T175] usb 5-1: config 0 interface 119 altsetting 0 has an invalid endpoint with address 0xE3, skipping [ 606.439836][ T175] usb 5-1: config 0 interface 119 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 606.477454][ T175] usb 5-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 606.510576][ T175] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 606.561045][ T175] usb 5-1: Product: syz [ 606.565304][ T175] usb 5-1: Manufacturer: syz [ 606.611053][ T175] usb 5-1: SerialNumber: syz [ 606.647422][ T175] usb 5-1: config 0 descriptor?? [ 606.685965][T12471] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 606.718463][ T175] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.119/input/input19 [ 607.001872][ T175] usb 5-1: USB disconnect, device number 5 [ 607.107728][T12496] loop5: detected capacity change from 0 to 512 [ 607.147806][T12497] loop1: detected capacity change from 0 to 1024 [ 607.199388][T12497] EXT4-fs (loop1): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 607.277132][T12496] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 607.324999][T12497] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 2: comm syz.1.2312: lblock 2 mapped to illegal pblock 2 (length 1) [ 607.371926][T12496] ext4 filesystem being mounted at /40/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 607.457059][T12497] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 607.508975][T12497] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 48: comm syz.1.2312: lblock 0 mapped to illegal pblock 48 (length 1) [ 607.612448][T12497] Quota error (device loop1): v2_write_file_info: Can't write info structure [ 607.622538][T12496] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #2: block 18: comm syz.5.2313: lblock 23 mapped to illegal pblock 18 (length 1) [ 607.624875][T12497] EXT4-fs error (device loop1): ext4_acquire_dquot:6953: comm syz.1.2312: Failed to acquire dquot type 0 [ 607.718964][T12497] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 607.772061][T12497] EXT4-fs error (device loop1): ext4_evict_inode:254: inode #11: comm syz.1.2312: mark_inode_dirty error [ 607.821853][T12497] EXT4-fs warning (device loop1): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 607.841231][T11500] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 607.857487][T12497] EXT4-fs (loop1): 1 orphan inode deleted [ 607.869114][ T9093] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:11: lblock 1 mapped to illegal pblock 1 (length 1) [ 607.900748][T12497] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 607.930291][ T9093] Quota error (device loop1): remove_tree: Can't read quota data block 1 [ 607.975748][ T9093] EXT4-fs error (device loop1): ext4_release_dquot:6989: comm kworker/u4:11: Failed to release dquot type 0 [ 608.176648][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 608.189745][ T1330] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:6: lblock 1 mapped to illegal pblock 1 (length 1) [ 608.292949][ T1330] EXT4-fs error (device loop1): ext4_release_dquot:6989: comm kworker/u4:6: Failed to release dquot type 0 [ 608.349734][ T5773] EXT4-fs error (device loop1): __ext4_get_inode_loc:4497: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 608.411033][ T5773] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 608.459305][ T5773] EXT4-fs error (device loop1): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 608.697441][T12512] FAULT_INJECTION: forcing a failure. [ 608.697441][T12512] name failslab, interval 1, probability 0, space 0, times 0 [ 608.697521][T12512] CPU: 0 PID: 12512 Comm: syz.4.2319 Not tainted syzkaller #0 [ 608.697547][T12512] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 608.697562][T12512] Call Trace: [ 608.697572][T12512] [ 608.697583][T12512] dump_stack_lvl+0x18c/0x250 [ 608.697622][T12512] ? show_regs_print_info+0x20/0x20 [ 608.697651][T12512] ? load_image+0x420/0x420 [ 608.697679][T12512] ? __might_sleep+0xe0/0xe0 [ 608.697709][T12512] ? __lock_acquire+0x7d80/0x7d80 [ 608.697742][T12512] should_fail_ex+0x394/0x4c0 [ 608.697780][T12512] should_failslab+0x9/0x20 [ 608.697812][T12512] slab_pre_alloc_hook+0x59/0x300 [ 608.697846][T12512] ? __kernfs_new_node+0xaa/0x7f0 [ 608.697877][T12512] ? rcu_is_watching+0x15/0xb0 [ 608.697911][T12512] kmem_cache_alloc+0x5a/0x2c0 [ 608.697944][T12512] ? __kernfs_new_node+0xe5/0x7f0 [ 608.697983][T12512] __kernfs_new_node+0xe5/0x7f0 [ 608.698022][T12512] ? kernfs_new_node+0x260/0x260 [ 608.698069][T12512] ? sysfs_do_create_link_sd+0x75/0x110 [ 608.698103][T12512] kernfs_new_node+0x14c/0x260 [ 608.698151][T12512] kernfs_create_link+0xa7/0x200 [ 608.698179][T12512] sysfs_do_create_link_sd+0x83/0x110 [ 608.698208][T12512] device_create_sys_dev_entry+0x123/0x180 [ 608.698239][T12512] ? device_add_attrs+0x830/0x830 [ 608.698273][T12512] ? device_create_file+0xef/0x1b0 [ 608.698303][T12512] device_add+0x7c3/0xc40 [ 608.698339][T12512] device_create+0x26a/0x300 [ 608.698373][T12512] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 608.698398][T12512] ? _raw_spin_unlock+0x40/0x40 [ 608.698421][T12512] ? root_device_unregister+0x100/0x100 [ 608.698449][T12512] ? update_attr+0x550/0x730 [ 608.698485][T12512] ? is_console_locked+0x9/0x20 [ 608.698512][T12512] ? csi_J+0xa16/0xea0 [ 608.698545][T12512] vcs_make_sysfs+0x32/0x80 [ 608.698580][T12512] vc_allocate+0x5a7/0x680 [ 608.698612][T12512] ? vc_cons_allocated+0x70/0x70 [ 608.698652][T12512] con_install+0xa0/0x720 [ 608.698682][T12512] ? mutex_lock_nested+0x20/0x20 [ 608.698718][T12512] ? show_tty_active+0x30/0x30 [ 608.698760][T12512] tty_init_dev+0xd3/0x4c0 [ 608.698794][T12512] tty_open+0x7dd/0xcc0 [ 608.698835][T12512] ? __lock_acquire+0x7d80/0x7d80 [ 608.698866][T12512] ? tty_compat_ioctl+0x8b0/0x8b0 [ 608.698899][T12512] ? do_raw_spin_unlock+0x121/0x230 [ 608.698933][T12512] chrdev_open+0x58c/0x600 [ 608.698965][T12512] ? cd_forget+0x160/0x160 [ 608.698998][T12512] ? fsnotify_perm+0x3ed/0x5e0 [ 608.699035][T12512] do_dentry_open+0x880/0x14b0 [ 608.699070][T12512] ? cd_forget+0x160/0x160 [ 608.699104][T12512] path_openat+0x284f/0x3270 [ 608.699163][T12512] ? do_sys_openat2+0xda/0x1d0 [ 608.699192][T12512] ? __x64_sys_openat+0x139/0x160 [ 608.699225][T12512] ? verify_lock_unused+0x140/0x140 [ 608.699253][T12512] ? do_filp_open+0x430/0x430 [ 608.699301][T12512] do_filp_open+0x1f2/0x430 [ 608.699333][T12512] ? vfs_tmpfile+0x620/0x620 [ 608.699386][T12512] ? _raw_spin_unlock+0x28/0x40 [ 608.699409][T12512] ? alloc_fd+0x590/0x640 [ 608.699451][T12512] do_sys_openat2+0x134/0x1d0 [ 608.699485][T12512] ? do_sys_open+0xe0/0xe0 [ 608.699516][T12512] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 608.699548][T12512] ? lock_chain_count+0x20/0x20 [ 608.699582][T12512] __x64_sys_openat+0x139/0x160 [ 608.699618][T12512] do_syscall_64+0x55/0xb0 [ 608.699645][T12512] ? clear_bhb_loop+0x40/0x90 [ 608.699672][T12512] ? clear_bhb_loop+0x40/0x90 [ 608.699702][T12512] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 608.699729][T12512] RIP: 0033:0x7f989f35e98e [ 608.699752][T12512] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 608.699773][T12512] RSP: 002b:00007f98a0226b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 608.699800][T12512] RAX: ffffffffffffffda RBX: 00007f98a02276c0 RCX: 00007f989f35e98e [ 608.699818][T12512] RDX: 0000000000000002 RSI: 00007f98a0226c00 RDI: ffffffffffffff9c [ 608.699839][T12512] RBP: 00007f989f435024 R08: 0000000000000000 R09: 0000000000000000 [ 608.699853][T12512] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 608.699868][T12512] R13: 00007f989f626038 R14: 00007f989f625fa0 R15: 00007ffd995457d8 [ 608.699906][T12512] [ 608.806184][T12508] loop5: detected capacity change from 0 to 1024 [ 608.820406][T12508] EXT4-fs (loop5): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 608.890030][T12508] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 2: comm syz.5.2315: lblock 2 mapped to illegal pblock 2 (length 1) [ 608.899998][T12508] __quota_error: 1 callbacks suppressed [ 608.900016][T12508] Quota error (device loop5): qtree_write_dquot: dquota write failed [ 608.900082][T12508] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 48: comm syz.5.2315: lblock 0 mapped to illegal pblock 48 (length 1) [ 608.901463][T12508] Quota error (device loop5): v2_write_file_info: Can't write info structure [ 608.901580][T12508] EXT4-fs error (device loop5): ext4_acquire_dquot:6953: comm syz.5.2315: Failed to acquire dquot type 0 [ 608.901874][T12508] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 608.902114][T12508] EXT4-fs error (device loop5): ext4_evict_inode:254: inode #11: comm syz.5.2315: mark_inode_dirty error [ 608.903955][T12508] EXT4-fs warning (device loop5): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 608.904048][T12508] EXT4-fs (loop5): 1 orphan inode deleted [ 608.905445][T12508] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 608.934247][ T9093] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:11: lblock 1 mapped to illegal pblock 1 (length 1) [ 608.934668][ T9093] Quota error (device loop5): remove_tree: Can't read quota data block 1 [ 608.934709][ T9093] EXT4-fs error (device loop5): ext4_release_dquot:6989: comm kworker/u4:11: Failed to release dquot type 0 [ 609.845607][T11500] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 609.845854][T11500] EXT4-fs error (device loop5): __ext4_get_inode_loc:4497: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 609.846166][T11500] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 609.846368][T11500] EXT4-fs error (device loop5): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 610.145111][T12527] loop5: detected capacity change from 0 to 1024 [ 610.185871][T12527] EXT4-fs (loop5): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 610.233379][T12527] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 2: comm syz.5.2325: lblock 2 mapped to illegal pblock 2 (length 1) [ 610.233636][T12527] Quota error (device loop5): qtree_write_dquot: dquota write failed [ 610.233683][T12527] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 48: comm syz.5.2325: lblock 0 mapped to illegal pblock 48 (length 1) [ 610.233901][T12527] Quota error (device loop5): v2_write_file_info: Can't write info structure [ 610.233922][T12527] EXT4-fs error (device loop5): ext4_acquire_dquot:6953: comm syz.5.2325: Failed to acquire dquot type 0 [ 610.234166][T12527] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 610.234391][T12527] EXT4-fs error (device loop5): ext4_evict_inode:254: inode #11: comm syz.5.2325: mark_inode_dirty error [ 610.234602][T12527] EXT4-fs warning (device loop5): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 610.234689][T12527] EXT4-fs (loop5): 1 orphan inode deleted [ 610.236361][T12527] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 610.446682][T11500] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 610.471880][ T11] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:0: lblock 1 mapped to illegal pblock 1 (length 1) [ 610.472190][ T11] Quota error (device loop5): remove_tree: Can't read quota data block 1 [ 610.472231][ T11] EXT4-fs error (device loop5): ext4_release_dquot:6989: comm kworker/u4:0: Failed to release dquot type 0 [ 610.472646][T11500] EXT4-fs error (device loop5): __ext4_get_inode_loc:4497: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 610.472878][T11500] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 610.473084][T11500] EXT4-fs error (device loop5): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 610.793124][T12534] Bluetooth: MGMT ver 1.22 [ 610.819739][T12512] tty tty29: ldisc open failed (-12), clearing slot 28 [ 611.708265][T12538] binder: BINDER_SET_CONTEXT_MGR already set [ 611.729495][T12538] binder: 12537:12538 ioctl 4018620d 200000004a80 returned -16 [ 612.461572][T12549] loop4: detected capacity change from 0 to 1024 [ 612.570281][T12549] EXT4-fs (loop4): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 612.818937][T12549] EXT4-fs error (device loop4): ext4_map_blocks:610: inode #3: block 2: comm syz.4.2335: lblock 2 mapped to illegal pblock 2 (length 1) [ 612.909373][T12549] Quota error (device loop4): qtree_write_dquot: dquota write failed [ 612.917599][T12549] EXT4-fs error (device loop4): ext4_map_blocks:610: inode #3: block 48: comm syz.4.2335: lblock 0 mapped to illegal pblock 48 (length 1) [ 612.999408][T12549] Quota error (device loop4): v2_write_file_info: Can't write info structure [ 613.045715][T12549] EXT4-fs error (device loop4): ext4_acquire_dquot:6953: comm syz.4.2335: Failed to acquire dquot type 0 [ 613.092222][T12549] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 613.159204][T12549] EXT4-fs error (device loop4): ext4_evict_inode:254: inode #11: comm syz.4.2335: mark_inode_dirty error [ 613.220347][T12549] EXT4-fs warning (device loop4): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 613.266301][T12549] EXT4-fs (loop4): 1 orphan inode deleted [ 613.298114][ T1330] EXT4-fs error (device loop4): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:6: lblock 1 mapped to illegal pblock 1 (length 1) [ 613.331535][T12549] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 613.379181][ T1330] Quota error (device loop4): remove_tree: Can't read quota data block 1 [ 613.434090][ T1330] EXT4-fs error (device loop4): ext4_release_dquot:6989: comm kworker/u4:6: Failed to release dquot type 0 [ 613.673225][ T51] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 613.684609][ T51] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 613.697834][T10851] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 613.707040][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 613.714347][ T3450] EXT4-fs error (device loop4): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:8: lblock 1 mapped to illegal pblock 1 (length 1) [ 613.802301][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 613.810439][ T51] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 613.817939][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 613.898995][ T3450] Quota error (device loop4): remove_tree: Can't read quota data block 1 [ 613.907539][ T3450] EXT4-fs error (device loop4): ext4_release_dquot:6989: comm kworker/u4:8: Failed to release dquot type 0 [ 614.062390][T10851] EXT4-fs error (device loop4): __ext4_get_inode_loc:4497: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 614.139053][T10851] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 614.164187][T10851] EXT4-fs error (device loop4): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 614.631703][T12563] chnl_net:caif_netlink_parms(): no params data found [ 615.136427][T12563] bridge0: port 1(bridge_slave_0) entered blocking state [ 615.199627][T12563] bridge0: port 1(bridge_slave_0) entered disabled state [ 615.207249][T12563] bridge_slave_0: entered allmulticast mode [ 615.341149][T12563] bridge_slave_0: entered promiscuous mode [ 615.370999][T12563] bridge0: port 2(bridge_slave_1) entered blocking state [ 615.426414][T12588] loop1: detected capacity change from 0 to 512 [ 615.469113][T12589] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2348'. [ 615.499508][T12563] bridge0: port 2(bridge_slave_1) entered disabled state [ 615.525164][T12563] bridge_slave_1: entered allmulticast mode [ 615.597684][T12563] bridge_slave_1: entered promiscuous mode [ 615.641668][T12588] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 615.749200][T12588] ext4 filesystem being mounted at /587/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 615.859386][T12588] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #2: block 18: comm syz.1.2349: lblock 23 mapped to illegal pblock 18 (length 1) [ 615.876808][T12563] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 615.901598][ T51] Bluetooth: hci4: command tx timeout [ 615.984935][T12563] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 615.997238][T12597] EXT4-fs error (device loop1): ext4_readdir:263: inode #2: block 3: comm syz.1.2349: path (unknown): bad entry in directory: directory entry overrun - offset=0, inode=2, rec_len=2060, size=2048 fake=1 [ 616.252165][T12563] team0: Port device team_slave_0 added [ 616.301781][T12563] team0: Port device team_slave_1 added [ 616.509025][T12563] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 616.526878][T12563] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 616.560324][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 616.608892][T12563] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 617.002659][T12563] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 617.038888][T12563] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 617.064883][ C0] vkms_vblank_simulate: vblank timer overrun [ 617.190532][T12563] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 617.501082][ T9093] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 617.736391][ T9093] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 617.843866][T12563] hsr_slave_0: entered promiscuous mode [ 617.862712][T12563] hsr_slave_1: entered promiscuous mode [ 617.883661][T12563] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 617.904615][T12563] Cannot create hsr debugfs directory [ 617.954835][ T9093] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 617.984134][ T51] Bluetooth: hci4: command tx timeout [ 618.207451][T12631] loop5: detected capacity change from 0 to 512 [ 618.221658][ T9093] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 618.293828][T12631] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 618.372374][T12631] ext4 filesystem being mounted at /54/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 618.555295][T12631] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #2: block 18: comm syz.5.2362: lblock 23 mapped to illegal pblock 18 (length 1) [ 618.658810][T12636] EXT4-fs error (device loop5): ext4_readdir:263: inode #2: block 3: comm syz.5.2362: path (unknown): bad entry in directory: directory entry overrun - offset=0, inode=2, rec_len=2060, size=2048 fake=1 [ 618.787701][T11500] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 619.246198][ T9093] tipc: Left network mode [ 620.048929][ T51] Bluetooth: hci4: command tx timeout [ 620.177285][T12615] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 620.622795][T12659] loop4: detected capacity change from 0 to 512 [ 620.823345][T12659] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 620.930948][T12659] ext4 filesystem being mounted at /127/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 621.057277][T12659] EXT4-fs error (device loop4): ext4_map_blocks:610: inode #2: block 18: comm syz.4.2371: lblock 23 mapped to illegal pblock 18 (length 1) [ 621.168412][T12666] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 3: comm syz.4.2371: path (unknown): bad entry in directory: directory entry overrun - offset=0, inode=2, rec_len=2060, size=2048 fake=1 [ 621.531436][T10851] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 621.983081][T12563] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 622.129061][ T51] Bluetooth: hci4: command tx timeout [ 622.459075][T12563] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 622.527929][T12563] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 622.719888][T12563] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 623.844296][T12709] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2389'. [ 624.134239][ T9093] hsr_slave_0: left promiscuous mode [ 624.424239][ T9093] hsr_slave_1: left promiscuous mode [ 624.545509][T12725] loop1: detected capacity change from 0 to 1024 [ 624.581968][T12725] EXT4-fs (loop1): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 624.617639][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.624186][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.723720][T12725] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 2: comm syz.1.2393: lblock 2 mapped to illegal pblock 2 (length 1) [ 624.740870][T12725] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 624.749744][T12725] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 48: comm syz.1.2393: lblock 0 mapped to illegal pblock 48 (length 1) [ 624.771597][T12725] Quota error (device loop1): v2_write_file_info: Can't write info structure [ 624.780790][T12725] EXT4-fs error (device loop1): ext4_acquire_dquot:6953: comm syz.1.2393: Failed to acquire dquot type 0 [ 624.803909][T12725] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 624.815367][T12725] EXT4-fs error (device loop1): ext4_evict_inode:254: inode #11: comm syz.1.2393: mark_inode_dirty error [ 624.837929][T12725] EXT4-fs warning (device loop1): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 624.848683][T12725] EXT4-fs (loop1): 1 orphan inode deleted [ 624.862132][T12725] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 625.201905][ T3471] EXT4-fs error (device loop1): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:9: lblock 1 mapped to illegal pblock 1 (length 1) [ 625.219585][ T3471] Quota error (device loop1): remove_tree: Can't read quota data block 1 [ 625.228246][ T3471] EXT4-fs error (device loop1): ext4_release_dquot:6989: comm kworker/u4:9: Failed to release dquot type 0 [ 625.257972][ T9093] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 625.317459][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 625.332142][ T9093] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 625.355754][ T5773] EXT4-fs error (device loop1): __ext4_get_inode_loc:4497: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 625.377515][ T9093] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 625.429257][ T9093] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 625.449274][ T5773] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 625.483906][ T9093] bridge0: port 3(team0) entered disabled state [ 625.494584][ T5773] EXT4-fs error (device loop1): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 625.602858][ T9093] bridge_slave_1: left allmulticast mode [ 625.608596][ T9093] bridge_slave_1: left promiscuous mode [ 625.633913][ T9093] bridge0: port 2(bridge_slave_1) entered disabled state [ 625.682497][ T9093] bridge_slave_0: left allmulticast mode [ 625.698480][ T9093] bridge_slave_0: left promiscuous mode [ 625.720804][ T9093] bridge0: port 1(bridge_slave_0) entered disabled state [ 625.815836][ T9093] veth1_macvtap: left promiscuous mode [ 625.834235][ T9093] veth0_macvtap: left promiscuous mode [ 625.846143][ T9093] veth1_vlan: left promiscuous mode [ 625.856064][ T9093] veth0_vlan: left promiscuous mode [ 626.565966][ T9093] bond1 (unregistering): Released all slaves [ 627.856968][ T9093] team_slave_1 (unregistering): left promiscuous mode [ 627.866985][ T9093] team_slave_1 (unregistering): left allmulticast mode [ 627.882035][ T9093] team0 (unregistering): Port device team_slave_1 removed [ 627.960407][ T9093] team_slave_0 (unregistering): left promiscuous mode [ 627.967525][ T9093] team_slave_0 (unregistering): left allmulticast mode [ 627.981175][ T9093] team0 (unregistering): Port device team_slave_0 removed [ 628.055712][ T9093] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 628.136020][ T9093] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 628.765856][ T9093] bond0 (unregistering): Released all slaves [ 628.958896][T12743] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2400'. [ 629.304900][T12563] 8021q: adding VLAN 0 to HW filter on device bond0 [ 629.474569][T12563] 8021q: adding VLAN 0 to HW filter on device team0 [ 629.629988][ T1330] bridge0: port 1(bridge_slave_0) entered blocking state [ 629.637328][ T1330] bridge0: port 1(bridge_slave_0) entered forwarding state [ 629.716882][ T1330] bridge0: port 2(bridge_slave_1) entered blocking state [ 629.724319][ T1330] bridge0: port 2(bridge_slave_1) entered forwarding state [ 629.815878][T12754] loop4: detected capacity change from 0 to 512 [ 629.964469][T12754] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2404'. [ 630.592671][ T51] Bluetooth: hci3: ISO packet too small [ 630.939552][T12773] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2409'. [ 631.023237][T12777] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2410'. [ 631.503468][T12563] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 631.636765][T12787] loop4: detected capacity change from 0 to 512 [ 631.891169][T12563] veth0_vlan: entered promiscuous mode [ 631.918571][ T27] audit: type=1800 audit(1788327774.909:369): pid=12791 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2415" name="size" dev="configfs" ino=31045 res=0 errno=0 [ 631.973601][T12787] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2414'. [ 632.001360][T12563] veth1_vlan: entered promiscuous mode [ 632.029134][ T27] audit: type=1800 audit(1788327774.939:370): pid=12791 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2415" name="zoned" dev="configfs" ino=31046 res=0 errno=0 [ 632.163152][ T27] audit: type=1800 audit(1788327774.969:371): pid=12791 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2415" name="power" dev="configfs" ino=31050 res=0 errno=0 [ 632.225702][T12563] veth0_macvtap: entered promiscuous mode [ 632.259345][T12563] veth1_macvtap: entered promiscuous mode [ 632.354499][T12563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 632.658931][T12563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 632.781466][T12802] loop5: detected capacity change from 0 to 1024 [ 632.842252][T12802] EXT4-fs (loop5): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 632.960191][T12802] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 2: comm syz.5.2417: lblock 2 mapped to illegal pblock 2 (length 1) [ 632.976090][T12802] Quota error (device loop5): qtree_write_dquot: dquota write failed [ 632.984650][T12802] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 48: comm syz.5.2417: lblock 0 mapped to illegal pblock 48 (length 1) [ 633.000430][T12802] Quota error (device loop5): v2_write_file_info: Can't write info structure [ 633.009525][T12802] EXT4-fs error (device loop5): ext4_acquire_dquot:6953: comm syz.5.2417: Failed to acquire dquot type 0 [ 633.022517][T12802] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 633.040546][T12802] EXT4-fs error (device loop5): ext4_evict_inode:254: inode #11: comm syz.5.2417: mark_inode_dirty error [ 633.058232][T12802] EXT4-fs warning (device loop5): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 633.069106][T12802] EXT4-fs (loop5): 1 orphan inode deleted [ 633.081798][T12802] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 633.298883][T12563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 633.458927][T12563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 633.485963][ T1004] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:5: lblock 1 mapped to illegal pblock 1 (length 1) [ 633.513482][T12563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 633.538884][T12563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 633.560021][ T1004] Quota error (device loop5): remove_tree: Can't read quota data block 1 [ 633.568575][ T1004] EXT4-fs error (device loop5): ext4_release_dquot:6989: comm kworker/u4:5: Failed to release dquot type 0 [ 633.614427][T12563] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 633.671476][T12563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 633.748714][T12563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 633.771069][T11500] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 633.809123][T11500] EXT4-fs error (device loop5): __ext4_get_inode_loc:4497: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 633.832112][T12563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 633.867528][T12563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 633.888044][T12563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 633.909675][T12563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 633.943497][T12563] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 633.953347][T11500] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5940: Corrupt filesystem [ 634.045096][T11500] EXT4-fs error (device loop5): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 634.059998][T12563] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 634.108080][T12563] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 634.159131][T12563] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 634.178897][T12563] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 634.251270][T12812] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2421'. [ 634.342556][T12816] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2420'. [ 634.717424][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 634.735488][T12822] loop5: detected capacity change from 0 to 512 [ 634.745569][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 634.794396][T12822] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2425'. [ 635.030114][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 635.094058][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 635.449150][ T6027] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 635.701716][ T6027] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 635.728917][ T6027] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 635.802896][ T6027] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 635.864103][ T6027] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 635.988304][ T6027] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 636.028647][T12845] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2432'. [ 636.060690][ T6027] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 636.083328][ T6027] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 636.114871][ T6027] usb 5-1: Product: syz [ 636.142089][ T6027] usb 5-1: Manufacturer: syz [ 636.209557][ T6027] cdc_wdm 5-1:1.0: skipping garbage [ 636.258260][ T6027] cdc_wdm 5-1:1.0: skipping garbage [ 636.357542][ T6027] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 636.414970][ T6027] cdc_wdm 5-1:1.0: Unknown control protocol [ 636.487874][ T6027] usb 5-1: USB disconnect, device number 6 [ 636.909909][T12855] loop3: detected capacity change from 0 to 512 [ 637.031425][T12855] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2435'. [ 637.537127][T12859] tipc: Started in network mode [ 637.566517][T12859] tipc: Node identity 660c16082afd, cluster identity 4711 [ 637.623226][T11504] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 637.637565][T11504] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 637.647906][T11504] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 637.660909][T12859] tipc: Enabled bearer , priority 0 [ 637.671064][T11504] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 637.680281][T11504] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 637.687868][T11504] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 638.110824][ T3471] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 638.138891][ T3471] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 638.194584][T12867] syzkaller0: entered promiscuous mode [ 638.219263][T12867] syzkaller0: entered allmulticast mode [ 638.241467][T12869] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2440'. [ 638.279987][T12859] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 638.446560][T12870] tipc: Resetting bearer [ 638.512039][T12858] tipc: Resetting bearer [ 638.680068][T12858] tipc: Disabling bearer [ 638.781600][T12882] loop4: detected capacity change from 0 to 512 [ 638.930420][T12882] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2445'. [ 638.979081][ T3471] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 639.013284][ T3471] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 639.129356][ T6027] tipc: Node number set to 1290868232 [ 639.375568][ T3471] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 639.454391][ T3471] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 639.492865][T12890] EXT4-fs warning (device sda1): ext4_group_extend:1868: can't shrink FS - resize aborted [ 639.718760][ T3471] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 639.739137][T11504] Bluetooth: hci0: command tx timeout [ 639.779119][ T3471] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 640.142326][T12894] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input20 [ 640.525375][T12903] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2450'. [ 640.854260][T12864] chnl_net:caif_netlink_parms(): no params data found [ 641.207776][T12909] loop3: detected capacity change from 0 to 512 [ 641.807278][ T3471] tipc: Disabling bearer [ 641.813753][T11504] Bluetooth: hci0: command tx timeout [ 641.848251][T12909] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2454'. [ 641.904321][ T3471] tipc: Left network mode [ 642.143399][T12864] bridge0: port 1(bridge_slave_0) entered blocking state [ 642.244049][T12864] bridge0: port 1(bridge_slave_0) entered disabled state [ 642.309433][T12864] bridge_slave_0: entered allmulticast mode [ 642.342613][T12864] bridge_slave_0: entered promiscuous mode [ 642.405613][T12864] bridge0: port 2(bridge_slave_1) entered blocking state [ 642.437783][T12864] bridge0: port 2(bridge_slave_1) entered disabled state [ 642.469344][T12864] bridge_slave_1: entered allmulticast mode [ 642.516694][T12864] bridge_slave_1: entered promiscuous mode [ 643.702286][T12864] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 643.847226][T12944] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input21 [ 643.889471][T11504] Bluetooth: hci0: command tx timeout [ 644.244496][T12864] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 645.432692][T12968] loop4: detected capacity change from 0 to 512 [ 645.462180][T12970] jffs2: notice: (12970) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 645.942407][T12968] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2465'. [ 645.972676][T11504] Bluetooth: hci0: command tx timeout [ 648.475654][T12988] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input22 [ 649.549175][ T6027] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 649.806019][ T6027] usb 6-1: config 1 has an invalid interface number: 3 but max is 0 [ 649.836315][ T6027] usb 6-1: config 1 has no interface number 0 [ 649.879042][ T6027] usb 6-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 649.888282][ T6027] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 649.938051][ T6027] usb 6-1: Product: syz [ 649.948913][ T6027] usb 6-1: Manufacturer: syz [ 649.953618][ T6027] usb 6-1: SerialNumber: syz [ 650.332136][ T6027] usb 6-1: 3:1 : does not exist [ 650.338080][ T6027] usb 6-1: 3:2 : does not exist [ 650.513474][ T6027] usb 6-1: USB disconnect, device number 2 [ 652.296455][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 656.930176][T12864] team0: Port device team_slave_0 added [ 656.949585][T12984] syz_tun: entered allmulticast mode [ 656.955828][T12993] netlink: 'syz.5.2473': attribute type 1 has an invalid length. [ 656.971725][T12993] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 657.010964][T12864] team0: Port device team_slave_1 added [ 657.144180][T12984] syz_tun: left allmulticast mode [ 657.235485][T12998] loop5: detected capacity change from 0 to 512 [ 657.433745][T12998] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2475'. [ 657.625817][T12864] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 657.696803][T12864] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 657.900770][T12864] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 658.119541][T12864] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 658.152225][T12864] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 658.288903][T12864] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 658.355805][T13011] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2478'. [ 659.090856][T12864] hsr_slave_0: entered promiscuous mode [ 659.122529][T12864] hsr_slave_1: entered promiscuous mode [ 659.142685][ T27] audit: type=1800 audit(1788327802.129:372): pid=13032 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2481" name="nv" dev="sda1" ino=2051 res=0 errno=0 [ 659.170630][T13032] EXT4-fs warning (device sda1): verify_group_input:151: Cannot add at group 1986356271 (only 8 groups) [ 659.197361][T12864] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 659.223541][T12864] Cannot create hsr debugfs directory [ 659.662907][T13040] loop3: detected capacity change from 0 to 512 [ 659.834760][T13040] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2484'. [ 661.256283][T13063] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2489'. [ 662.399140][ T3471] hsr_slave_0: left promiscuous mode [ 662.425385][ T3471] hsr_slave_1: left promiscuous mode [ 662.451605][ T3471] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 662.479610][ T3471] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 662.510862][ T3471] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 662.527380][ T3471] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 662.562767][ T3471] bridge_slave_1: left allmulticast mode [ 662.574516][ T3471] bridge_slave_1: left promiscuous mode [ 662.587838][T13066] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input23 [ 662.612509][ T3471] bridge0: port 2(bridge_slave_1) entered disabled state [ 662.681357][ T3471] bridge_slave_0: left allmulticast mode [ 662.694019][ T3471] bridge_slave_0: left promiscuous mode [ 662.709140][ T3471] bridge0: port 1(bridge_slave_0) entered disabled state [ 662.883657][ T3471] veth1_macvtap: left promiscuous mode [ 662.904480][ T3471] veth0_macvtap: left promiscuous mode [ 662.930698][ T3471] veth1_vlan: left promiscuous mode [ 662.949061][ T3471] veth0_vlan: left promiscuous mode [ 663.323375][T13082] loop4: detected capacity change from 0 to 512 [ 663.720690][T13082] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2494'. [ 666.834339][T13107] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input24 [ 667.672035][ T3471] team0 (unregistering): Port device team_slave_1 removed [ 668.009922][ T3471] team0 (unregistering): Port device team_slave_0 removed [ 668.074123][T13114] loop4: detected capacity change from 0 to 512 [ 668.401438][T13114] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2504'. [ 668.479569][ T3471] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 668.931809][ T3471] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 669.810252][T11553] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 670.047024][T11553] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 670.080207][T11553] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 670.108909][T11553] usb 5-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 670.119297][T11553] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 670.127370][T11553] usb 5-1: Product: syz [ 670.165719][T11553] usb 5-1: Manufacturer: syz [ 670.173819][T11553] usb 5-1: SerialNumber: syz [ 670.202372][T11553] ti_usb_3410_5052 5-1:2.0: TI USB 5052 2 port adapter converter detected [ 670.265752][T11553] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 670.290019][T11553] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 671.412685][ T3471] bond0 (unregistering): Released all slaves [ 672.168337][T13102] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2500'. [ 674.965774][T13142] Bluetooth: MGMT ver 1.22 [ 675.091237][T13120] ti_usb_3410_5052_2 ttyUSB0: ti_write_byte - failed, -110 [ 675.426135][T13120] ti_usb_3410_5052_2 ttyUSB0: ti_get_lsr - get port status command failed, -32 [ 675.640146][T13120] ti_usb_3410_5052_2 ttyUSB0: ti_close - cannot send close port command, -32 [ 675.753298][T11553] usb 5-1: USB disconnect, device number 7 [ 675.829910][T11553] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 675.847175][T13152] binder: BINDER_SET_CONTEXT_MGR already set [ 675.888909][T13152] binder: 13150:13152 ioctl 4018620d 200000000040 returned -16 [ 675.926764][T11553] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 675.987177][T11553] ti_usb_3410_5052 5-1:2.0: device disconnected [ 676.380543][T13160] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2515'. [ 676.829981][T12864] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 676.916208][T12864] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 677.790484][T12864] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 678.015029][T13168] gadgetfs: bound to dummy_udc driver [ 678.035403][T12864] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 678.408003][T12864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 678.467993][T11504] Bluetooth: hci3: ISO packet too small [ 678.491423][T12864] 8021q: adding VLAN 0 to HW filter on device team0 [ 678.584093][ T1330] bridge0: port 1(bridge_slave_0) entered blocking state [ 678.591425][ T1330] bridge0: port 1(bridge_slave_0) entered forwarding state [ 678.633364][ T1330] bridge0: port 2(bridge_slave_1) entered blocking state [ 678.640696][ T1330] bridge0: port 2(bridge_slave_1) entered forwarding state [ 679.447197][T12864] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 679.643400][T13205] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2526'. [ 679.766565][T12864] veth0_vlan: entered promiscuous mode [ 679.860041][T12864] veth1_vlan: entered promiscuous mode [ 680.675797][T12864] veth0_macvtap: entered promiscuous mode [ 680.824398][T12864] veth1_macvtap: entered promiscuous mode [ 680.890169][T13217] jffs2: notice: (13217) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 680.924498][T12864] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 681.008957][T12864] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 681.033948][T12864] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 681.051598][T13217] overlayfs: failed to resolve './bus': -2 [ 681.069954][T11504] Bluetooth: hci2: ISO packet too small [ 681.119202][T12864] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 681.164127][T12864] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 681.199730][T12864] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 681.231494][T12864] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 681.273014][T12864] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 681.309784][T12864] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 681.329281][T12864] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 681.362484][T12864] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 681.382735][T12864] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 681.413825][T12864] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 681.451607][T12864] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 681.508658][T12864] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 681.531653][T13231] 9pnet_virtio: no channels available for device syz [ 681.548903][T12864] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 681.558163][T12864] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 681.579753][T12864] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 681.900253][T12806] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 681.908664][T12806] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 681.997553][T12806] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 682.008962][T12806] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 682.234856][T13245] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2536'. [ 683.161656][T13256] CacheFiles: Failed to register: -95 [ 683.462346][T13264] netlink: 'syz.1.2540': attribute type 1 has an invalid length. [ 683.481247][T13264] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2540'. [ 683.513541][T13266] autofs4:pid:13266:autofs_fill_super: called with bogus options [ 685.938300][T13315] nvmet: adding nsid 1 to subsystem testsubsys [ 686.054940][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.066662][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 687.622659][T13353] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2567'. [ 687.926607][T13361] 9pnet_virtio: no channels available for device syz [ 687.973974][T13366] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 688.239322][ T9407] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 688.440288][ T9407] usb 2-1: Using ep0 maxpacket: 8 [ 688.461008][ T9407] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 688.485877][ T9407] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 688.506648][ T9407] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 688.537775][ T9407] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 688.589800][ T9407] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 689.393707][ T9407] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 689.407968][ T9407] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 689.417985][ T9407] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 689.433212][ T9407] usbtmc: probe of 2-1:16.0 failed with error -22 [ 689.492857][T11504] Bluetooth: hci3: failed to read key size for handle 201 [ 689.501582][T11504] Bluetooth: hci3: unexpected event for opcode 0x1408 [ 689.651433][T13387] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2580'. [ 690.143199][T13404] syzkaller0: entered promiscuous mode [ 690.149304][T13404] syzkaller0: entered allmulticast mode [ 690.326272][T13410] syzkaller0: entered promiscuous mode [ 690.348764][T13410] syzkaller0: entered allmulticast mode [ 691.375127][ T175] usb 2-1: USB disconnect, device number 58 [ 691.387730][T13421] FAULT_INJECTION: forcing a failure. [ 691.387730][T13421] name fail_futex, interval 1, probability 0, space 0, times 0 [ 691.434935][T13421] CPU: 1 PID: 13421 Comm: syz.5.2590 Not tainted syzkaller #0 [ 691.442690][T13421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 691.452813][T13421] Call Trace: [ 691.456146][T13421] [ 691.459121][T13421] dump_stack_lvl+0x18c/0x250 [ 691.463874][T13421] ? show_regs_print_info+0x20/0x20 [ 691.469422][T13421] ? load_image+0x420/0x420 [ 691.474009][T13421] ? __lock_acquire+0x1336/0x7d80 [ 691.479124][T13421] should_fail_ex+0x394/0x4c0 [ 691.483876][T13421] get_futex_key+0x16f/0x1030 [ 691.488629][T13421] ? futex_setup_timer+0xc0/0xc0 [ 691.493644][T13421] futex_wake+0x127/0x4f0 [ 691.498046][T13421] ? reiserfs_abort+0x30/0x260 [ 691.502891][T13421] ? futex_wake_mark+0x150/0x150 [ 691.507910][T13421] do_futex+0x35d/0x3e0 [ 691.512133][T13421] ? __might_fault+0xaa/0x120 [ 691.516882][T13421] ? __ia32_sys_get_robust_list+0x110/0x110 [ 691.522852][T13421] ? __might_fault+0xc6/0x120 [ 691.527593][T13421] mm_release+0x184/0x3a0 [ 691.532001][T13421] ? exit_mm_release+0x30/0x30 [ 691.536830][T13421] ? lockdep_hardirqs_on+0x98/0x150 [ 691.542112][T13421] exit_mm+0xa4/0x340 [ 691.546256][T13421] ? sysctl_delayacct+0x220/0x220 [ 691.551339][T13421] ? do_exit+0x2530/0x2530 [ 691.555837][T13421] do_exit+0x909/0x2530 [ 691.560069][T13421] ? put_task_struct+0xc0/0xc0 [ 691.564904][T13421] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 691.571035][T13421] ? get_signal+0x100e/0x1390 [ 691.575767][T13421] ? lock_chain_count+0x20/0x20 [ 691.580676][T13421] ? _raw_spin_lock_irq+0xbb/0xf0 [ 691.585773][T13421] do_group_exit+0x22d/0x2f0 [ 691.590442][T13421] ? lockdep_hardirqs_on+0x98/0x150 [ 691.595728][T13421] get_signal+0x12a6/0x1390 [ 691.600314][T13421] arch_do_signal_or_restart+0xc2/0x7b0 [ 691.605947][T13421] ? __ia32_sys_get_robust_list+0x110/0x110 [ 691.611916][T13421] ? get_sigframe_size+0x20/0x20 [ 691.616960][T13421] ? exit_to_user_mode_loop+0x3b/0x110 [ 691.622495][T13421] exit_to_user_mode_loop+0x70/0x110 [ 691.627852][T13421] exit_to_user_mode_prepare+0xee/0x180 [ 691.633469][T13421] syscall_exit_to_user_mode+0x1a/0x50 [ 691.638997][T13421] do_syscall_64+0x61/0xb0 [ 691.643528][T13421] ? clear_bhb_loop+0x40/0x90 [ 691.648271][T13421] ? clear_bhb_loop+0x40/0x90 [ 691.653024][T13421] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 691.658992][T13421] RIP: 0033:0x7f729939e159 [ 691.663472][T13421] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 691.683232][T13421] RSP: 002b:00007f729a2e30e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 691.691745][T13421] RAX: fffffffffffffe00 RBX: 00007f7299625fa8 RCX: 00007f729939e159 [ 691.699798][T13421] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f7299625fa8 [ 691.707965][T13421] RBP: 00007f7299625fa0 R08: 0000000000000000 R09: 0000000000000000 [ 691.716001][T13421] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 691.724024][T13421] R13: 00007f7299626038 R14: 00007ffe8996d730 R15: 00007ffe8996d818 [ 691.732286][T13421] [ 691.842390][T13428] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2592'. [ 692.049405][T13437] ------------[ cut here ]------------ [ 692.054988][T13437] WARNING: CPU: 1 PID: 13437 at net/netfilter/nft_socket.c:220 nft_socket_init+0x2ee/0x3c0 [ 692.065320][T13437] Modules linked in: [ 692.069391][T13437] CPU: 1 PID: 13437 Comm: syz.3.2596 Not tainted syzkaller #0 [ 692.076924][T13437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 692.087205][T13437] RIP: 0010:nft_socket_init+0x2ee/0x3c0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 692.092937][T13437] Code: 30 84 c0 0f 85 d8 00 00 00 41 88 2c 24 bd 08 00 00 00 e9 b2 fe ff ff 89 f3 e8 5e 9b a8 f8 89 d8 e9 5c ff ff ff e8 52 9b a8 f8 <0f> 0b e9 4b ff ff ff 89 e9 80 e1 07 38 c1 0f 8c 8e fd ff ff 48 89 [ 692.112791][T13437] RSP: 0018:ffffc9000b8f71d8 EFLAGS: 00010287 [ 692.119020][T13437] RAX: ffffffff88ded71e RBX: ffff888064198020 RCX: 0000000000080000 [ 692.127227][T13437] RDX: ffffc90014fec000 RSI: 0000000000002020 RDI: 0000000000002021 [ 692.136062][T13437] RBP: 00000000000000ff R08: ffffffff8e8c872f R09: 1ffffffff1d190e5 [ 692.144234][T13437] R10: dffffc0000000000 R11: fffffbfff1d190e6 R12: 0000000000000100 [ 692.152375][T13437] R13: ffff888057d19198 R14: dffffc0000000000 R15: 1ffff1100c833004 [ 692.160474][T13437] FS: 00007f37726076c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 692.169600][T13437] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 692.176256][T13437] CR2: 0000200000009b00 CR3: 00000000582a3000 CR4: 00000000003506e0 [ 692.184359][T13437] Call Trace: [ 692.187695][T13437] [ 692.190750][T13437] nf_tables_newrule+0x176e/0x2870 [ 692.195955][T13437] ? nf_tables_delchain+0x1050/0x1050 [ 692.201512][T13437] ? __lock_acquire+0x7d80/0x7d80 [ 692.206627][T13437] ? mutex_unlock+0x10/0x10 [ 692.211398][T13437] ? __nla_parse+0x40/0x50 [ 692.215908][T13437] nfnetlink_rcv+0x1133/0x2490 [ 692.220979][T13437] ? nfnetlink_net_exit_batch+0xa0/0xa0 [ 692.226679][T13437] ? __lock_acquire+0x7d80/0x7d80 [ 692.232098][T13437] ? netlink_deliver_tap+0x2e/0x1b0 [ 692.237382][T13437] netlink_unicast+0x7b1/0x930 [ 692.242308][T13437] netlink_sendmsg+0x8d0/0xbf0 [ 692.247158][T13437] ? netlink_getsockopt+0x590/0x590 [ 692.252527][T13437] ? apparmor_socket_sendmsg+0x170/0x330 [ 692.258244][T13437] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 692.263721][T13437] ? security_socket_sendmsg+0x80/0xa0 [ 692.269332][T13437] ? netlink_getsockopt+0x590/0x590 [ 692.274620][T13437] ____sys_sendmsg+0x61b/0x980 [ 692.279551][T13437] ? __asan_memset+0x22/0x40 [ 692.284218][T13437] ? __sys_sendmsg_sock+0x30/0x30 [ 692.289570][T13437] ? __import_iovec+0x5f2/0x850 [ 692.294523][T13437] ? import_iovec+0x73/0xa0 [ 692.299195][T13437] ___sys_sendmsg+0x2a6/0x360 [ 692.304046][T13437] ? __sys_sendmsg+0x2b0/0x2b0 [ 692.309040][T13437] __se_sys_sendmsg+0x1d0/0x2c0 [ 692.313965][T13437] ? __x64_sys_sendmsg+0x80/0x80 [ 692.319078][T13437] ? lockdep_hardirqs_on+0x98/0x150 [ 692.324358][T13437] do_syscall_64+0x55/0xb0 [ 692.328931][T13437] ? clear_bhb_loop+0x40/0x90 [ 692.333848][T13437] ? clear_bhb_loop+0x40/0x90 [ 692.338606][T13437] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 692.344645][T13437] RIP: 0033:0x7f377179e159 [ 692.349210][T13437] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 692.369043][T13437] RSP: 002b:00007f3772607028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 692.377538][T13437] RAX: ffffffffffffffda RBX: 00007f3771a25fa0 RCX: 00007f377179e159 [ 692.385667][T13437] RDX: 0000000024000000 RSI: 0000200000000040 RDI: 0000000000000005 [ 692.393802][T13437] RBP: 00007f3771835024 R08: 0000000000000000 R09: 0000000000000000 [ 692.401914][T13437] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 692.410053][T13437] R13: 00007f3771a26038 R14: 00007f3771a25fa0 R15: 00007ffd14646538 [ 692.418107][T13437] [ 692.421276][T13437] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 692.428596][T13437] CPU: 1 PID: 13437 Comm: syz.3.2596 Not tainted syzkaller #0 [ 692.436092][T13437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 692.446177][T13437] Call Trace: [ 692.449484][T13437] [ 692.452441][T13437] dump_stack_lvl+0x18c/0x250 [ 692.457156][T13437] ? show_regs_print_info+0x20/0x20 [ 692.462568][T13437] ? load_image+0x420/0x420 [ 692.467133][T13437] panic+0x2ca/0x720 [ 692.471103][T13437] ? bpf_jit_dump+0xd0/0xd0 [ 692.475660][T13437] __warn+0x2e0/0x470 [ 692.479685][T13437] ? nft_socket_init+0x2ee/0x3c0 [ 692.484669][T13437] ? nft_socket_init+0x2ee/0x3c0 [ 692.489637][T13437] report_bug+0x2be/0x4f0 [ 692.494001][T13437] ? nft_socket_init+0x2ee/0x3c0 [ 692.498973][T13437] ? nft_socket_init+0x2ee/0x3c0 [ 692.503942][T13437] ? nft_socket_init+0x2f0/0x3c0 [ 692.508909][T13437] handle_bug+0xcf/0x120 [ 692.513190][T13437] exc_invalid_op+0x1a/0x50 [ 692.517727][T13437] asm_exc_invalid_op+0x1a/0x20 [ 692.522611][T13437] RIP: 0010:nft_socket_init+0x2ee/0x3c0 [ 692.528194][T13437] Code: 30 84 c0 0f 85 d8 00 00 00 41 88 2c 24 bd 08 00 00 00 e9 b2 fe ff ff 89 f3 e8 5e 9b a8 f8 89 d8 e9 5c ff ff ff e8 52 9b a8 f8 <0f> 0b e9 4b ff ff ff 89 e9 80 e1 07 38 c1 0f 8c 8e fd ff ff 48 89 [ 692.547852][T13437] RSP: 0018:ffffc9000b8f71d8 EFLAGS: 00010287 [ 692.553956][T13437] RAX: ffffffff88ded71e RBX: ffff888064198020 RCX: 0000000000080000 [ 692.561966][T13437] RDX: ffffc90014fec000 RSI: 0000000000002020 RDI: 0000000000002021 [ 692.569969][T13437] RBP: 00000000000000ff R08: ffffffff8e8c872f R09: 1ffffffff1d190e5 [ 692.577970][T13437] R10: dffffc0000000000 R11: fffffbfff1d190e6 R12: 0000000000000100 [ 692.585974][T13437] R13: ffff888057d19198 R14: dffffc0000000000 R15: 1ffff1100c833004 [ 692.593986][T13437] ? nft_socket_init+0x2ee/0x3c0 [ 692.598965][T13437] ? nft_socket_init+0x2ee/0x3c0 [ 692.603941][T13437] nf_tables_newrule+0x176e/0x2870 [ 692.609106][T13437] ? nf_tables_delchain+0x1050/0x1050 [ 692.614516][T13437] ? __lock_acquire+0x7d80/0x7d80 [ 692.619577][T13437] ? mutex_unlock+0x10/0x10 [ 692.624123][T13437] ? __nla_parse+0x40/0x50 [ 692.628580][T13437] nfnetlink_rcv+0x1133/0x2490 [ 692.633402][T13437] ? nfnetlink_net_exit_batch+0xa0/0xa0 [ 692.639053][T13437] ? __lock_acquire+0x7d80/0x7d80 [ 692.644131][T13437] ? netlink_deliver_tap+0x2e/0x1b0 [ 692.649372][T13437] netlink_unicast+0x7b1/0x930 [ 692.654181][T13437] netlink_sendmsg+0x8d0/0xbf0 [ 692.658988][T13437] ? netlink_getsockopt+0x590/0x590 [ 692.664228][T13437] ? apparmor_socket_sendmsg+0x170/0x330 [ 692.670330][T13437] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 692.675653][T13437] ? security_socket_sendmsg+0x80/0xa0 [ 692.681139][T13437] ? netlink_getsockopt+0x590/0x590 [ 692.686372][T13437] ____sys_sendmsg+0x61b/0x980 [ 692.691175][T13437] ? __asan_memset+0x22/0x40 [ 692.695802][T13437] ? __sys_sendmsg_sock+0x30/0x30 [ 692.700863][T13437] ? __import_iovec+0x5f2/0x850 [ 692.705760][T13437] ? import_iovec+0x73/0xa0 [ 692.710303][T13437] ___sys_sendmsg+0x2a6/0x360 [ 692.715013][T13437] ? __sys_sendmsg+0x2b0/0x2b0 [ 692.719853][T13437] __se_sys_sendmsg+0x1d0/0x2c0 [ 692.724744][T13437] ? __x64_sys_sendmsg+0x80/0x80 [ 692.729725][T13437] ? lockdep_hardirqs_on+0x98/0x150 [ 692.734966][T13437] do_syscall_64+0x55/0xb0 [ 692.739411][T13437] ? clear_bhb_loop+0x40/0x90 [ 692.744161][T13437] ? clear_bhb_loop+0x40/0x90 [ 692.748883][T13437] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 692.754831][T13437] RIP: 0033:0x7f377179e159 [ 692.759284][T13437] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 692.778945][T13437] RSP: 002b:00007f3772607028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 692.787488][T13437] RAX: ffffffffffffffda RBX: 00007f3771a25fa0 RCX: 00007f377179e159 [ 692.795499][T13437] RDX: 0000000024000000 RSI: 0000200000000040 RDI: 0000000000000005 [ 692.803505][T13437] RBP: 00007f3771835024 R08: 0000000000000000 R09: 0000000000000000 [ 692.811526][T13437] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 692.819547][T13437] R13: 00007f3771a26038 R14: 00007f3771a25fa0 R15: 00007ffd14646538 [ 692.827571][T13437] [ 692.831201][T13437] Kernel Offset: disabled [ 692.835651][T13437] Rebooting in 86400 seconds..