last executing test programs: 6m48.69337323s ago: executing program 32 (id=19): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000001840)={'vxcan1\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000001880)={0x1d, r1, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r0, &(0x7f00000018c0)={0x1d, r1, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) sendmmsg(r0, &(0x7f0000001900), 0x3fffffffffffe3d, 0xf5) getsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f0000001940), &(0x7f0000001980)=0x4) 6m32.485858383s ago: executing program 33 (id=89): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') r0 = open(&(0x7f0000000080)='.\x00', 0x0, 0x2) fstatfs(r0, &(0x7f0000005880)=""/41) 5m13.042604317s ago: executing program 2 (id=643): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000000180)=@filename='mtd0\x00', &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000300)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x101042, 0x15) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001440)={0x0, 0x0, &(0x7f0000001480)={&(0x7f00000014c0)=ANY=[@ANYBLOB="bc000000000105060100000000000000020000003400018014000180080001007f000001080002007f0000011c0002800500010006000000060002003039"], 0xbc}}, 0x0) pwrite64(r0, &(0x7f00000013c0)='2', 0xfdef, 0xe7c) 5m12.548775198s ago: executing program 2 (id=645): r0 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) setsockopt$sock_attach_bpf(r0, 0x84, 0x22, &(0x7f0000000000)=r3, 0x10) 5m12.299302993s ago: executing program 2 (id=649): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r1) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=ANY=[@ANYBLOB="400000001000390400000000fbdbdf2500100000", @ANYRES32=r2, @ANYBLOB="11980400419804002000128008000100736974001400028008000300ac1414aa06000f00030000"], 0x40}}, 0x0) sendto$packet(r0, &(0x7f0000000400)="05d936277c6f5422007f83477ca1b278e3e4018a34e7bfd3de1a00ad6762646c95c716727eb53bcc", 0x28, 0x0, &(0x7f0000000200)={0x11, 0x86dd, r2, 0x1, 0x4, 0x6, @local}, 0x14) 5m11.438138052s ago: executing program 2 (id=662): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$tmpfs(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x20000, 0x0) mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f00000000c0)='sysfs\x00', 0x989, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x11050ca, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89101) 5m10.929866564s ago: executing program 2 (id=669): r0 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r0, 0x0, 0x4, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2b, 0x0, {{@in6=@loopback, @in6=@dev={0xfe, 0x80, '\x00', 0xf}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x3c, 0xffffffffffffffff, 0x200000000000}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0x1, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0x0, 0x3c}, 0x2, @in=@broadcast, 0x6, 0x4, 0x1, 0x0, 0x0, 0x0, 0x2}]}]}, 0xfc}}, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) 5m8.833371469s ago: executing program 2 (id=688): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000080004000406000008001b"], 0x30}}, 0x0) sendmmsg$inet(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) 5m8.53011956s ago: executing program 34 (id=688): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000080004000406000008001b"], 0x30}}, 0x0) sendmmsg$inet(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) 4m18.151275811s ago: executing program 5 (id=986): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000002c80)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) recvmmsg(r0, &(0x7f0000005280)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000001d40)=""/61, 0x46}, {0x0, 0x20}], 0x2}, 0x10009}], 0x1, 0x10000, 0x0) sendmmsg$inet6(r0, &(0x7f0000001ac0)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000004f80)="000000f5b8ac2bb992ebd4c7b3ba4f60bfed002da6280c91950619c2a0e39042e0e7800ae7b041ff132d7fb40180000014c56dc066caab725095989d1fd81608b56aa6ac77", 0x45}], 0x1}}], 0x1, 0x20e8086) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 4m16.300162851s ago: executing program 5 (id=994): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="6c0000001000370403000000ffffffff00000000", @ANYRES32=r2, @ANYBLOB="2b1a0500000000004c0012800b00010069703667726500003c00028008000100", @ANYRES32=r2], 0x6c}, 0x1, 0x0, 0x0, 0x48800}, 0x4000010) sendmmsg$inet(r0, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e25, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1c000000000000000000000008000000", @ANYRES32=r2, @ANYBLOB="00000000e00000010000000024000000000000000000000007"], 0x48}}], 0x1, 0xc0) 4m16.21548388s ago: executing program 5 (id=995): io_uring_setup(0x28cc, &(0x7f0000000080)={0x0, 0x290b, 0x100, 0x2, 0x378}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r1, @ANYBLOB="00001700000000001c0037800b0001006970768a616e08000c0002800600010000000000050027"], 0x44}, 0x1, 0x0, 0x0, 0x4008010}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) 4m16.053065256s ago: executing program 5 (id=997): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x800012, &(0x7f00000001c0)=ANY=[@ANYBLOB="73686f72746e616d653d77696e6e742c666c7573682c646d61736b3d30303030303030303030303030303030303137373737372c73686f72746e616d653d77696e39352c636865636b3d7374726963742c73686f72746e616d653d6d697865642c6e6f6e756d7461696c3d302c757466383d312c73686f72746e616d653d77696e6e742c756e695f786c6174653d312c756e695f786c6174653d312c726f6469722c696f636861727365743d757466382c666d61736b3d30303030303030303030303030303030303030303030342c646d61736b3d30303030303030303030303030303030303030303030372c757466383d312c726f6469722c73686f72746e616d653d77696e39352c726f6469722c00743ccfec81d6c7d05b0f2a54ddce151ec4cbbaacb9552647fd950fedfdc024b395b227c138be0fc985194fd5e429dc44e63e7669bc9d4f66e3beaecb80fe73633280b1d3e82023d4f5c7f5a4989406c0f0d0cf537f132dc1e63d84a17532cb78ae7a368bc0029207b9b166705972f4e8dad041e6be170bf4", @ANYRES16], 0x1, 0x2c2, &(0x7f0000000540)="$eJzs3T+LI2UYAPBndpNJ7iySwkoEB7SwOm6vtckiOThMpaRQC128O5AkCHew4CkGK1sbSz+BINj5JWwEP4DgB7DzioNXJpkh2btJsoHLrX9+vyL77Lzv877POzPZPyzz7sevziZ3i7j/9Ze/R7ebxdEgBvE4i34cRS2llGJl8G0AAP9mj1OKP9PSJVMG5UsWEd3DlgYAHMje3/9/OnhJAMCBvff+B++cjkbDd4uiG7dn35yPy9/sy4/L9tP78WlM417cjF48Wf4toP5poXy9nVKat4pSP96Yzc/HZebso1+q8U/riU6iF/1FdDH/zmh4Uiyt5c/LOq5X8w/K+W9FL15umP/OaHirIT/Gebz5+lr9N6IXv34Sn8U07i6KWOV/dVIUb6fv/vriw7K8Mj+bn487i34r6fjFXRUAAAAAAAAAAAAAAAAAAAAAAP7rblR753RisX9Peajaf+f4SflJO4pa/+L+PMv8rB7oqf2B5im+T6nTihgNbxZFkaqOq/xWvNKK1tWsGgAAAAAAAAAAAAAAAAAAAP5ZHn7+aHI2nd570BD8dj1iQ9OGoN4NoH6sf0fW8aamwdqR1+LR5KyzecC1pqMq3DJpHNd9soity4lWux65v9dJ2D+4tqnmH37cd8Du7j7tbefn+QT13TU5y6KxTyfqI936mv683iePS86Vb2pKu2+/tSBvbOrtvfb8pUUw39Insm2FvfXH8sxVR7KnV5EvzmpjenttN47me6P5Wmx6pzwjW7yt8+f3xQcAAAAAAAAAAAAAAAAAALhg9dDvM03XdqQepc7BygIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAF2r1///3COZV8iU65/Hg4RUvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP+BvwMAAP//QSRWPA==") syz_mount_image$vfat(&(0x7f0000000840), &(0x7f0000000880)='./file0\x00', 0x10000, 0xffffffffffffffff, 0x0, 0x0, 0x0) mount(0x0, &(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)='devpts\x00', 0x3000096, 0x0) chroot(&(0x7f0000000940)='./file0\x00') mount$bind(&(0x7f0000000980)='.\x00', &(0x7f00000009c0)='./file0\x00', 0x0, 0x21d000, 0x0) pivot_root(&(0x7f0000000a00)='./file0\x00', &(0x7f0000000a40)='./file0/../file0/../file0\x00') 4m15.605707562s ago: executing program 5 (id=1000): r0 = socket$kcm(0x2, 0x2, 0x73) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000480)='bond_slave_0\x00', 0x10) bind$inet(r0, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r1 = socket$kcm(0x2, 0x2, 0x73) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000500)='veth1\x00', 0x10) bind$inet(r1, &(0x7f0000000540)={0x2, 0x4e22, @empty}, 0x10) 4m15.23549211s ago: executing program 5 (id=1003): unshare(0x22020600) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r0) close(r0) r1 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/mnt\x00') setns(r1, 0x0) 4m14.896396715s ago: executing program 35 (id=1003): unshare(0x22020600) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r0) close(r0) r1 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/mnt\x00') setns(r1, 0x0) 3m43.292192149s ago: executing program 7 (id=1151): setresuid(0x0, 0xee00, 0x0) r0 = io_uring_setup(0x1010, &(0x7f0000000640)={0x0, 0xbfffeffb, 0x800, 0x3, 0x2}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) setrlimit(0x40000000000008, &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x2300000000000000, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) 3m43.129557356s ago: executing program 7 (id=1153): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r0 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x0, &(0x7f0000000040)={0xf, 0xf3}, 0x20) 3m43.034064275s ago: executing program 7 (id=1154): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="12000000040000000400000008"], 0x48) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x49, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r1, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000850000000800000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4002000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3m42.095266501s ago: executing program 7 (id=1155): syz_mount_image$hfsplus(&(0x7f0000000640), &(0x7f0000000680)='./file0\x00', 0x80000c, &(0x7f0000000780)=ANY=[@ANYBLOB="706172743d3078303030303030303030303030303030342c6e6c733d61736369692c73657373696f6e3d3078666666666666666666666666666637662c747970653d883b7f382c63726561746f723dd4a620e92c6e6f6465636f6d706f73652c747970653d5dbcce902c756d61736b3d30303030303030303030303030303030303030303030312c63726561746f723d40f194712c626172726965722c63726561746f723d65fe04c22c6e6f6465636f6d706f73652c6465636f6d706f73652c63726561746f723d8a7222832c7569643d", @ANYRESDEC=0x0, @ANYBLOB="2c756d61736b3d30303030303030303030303030303030303030303030362c626172726965722c6e6f626172726965722c736d61636b66737472616e736d7574653d55dac73dddd1aa0ff491f57216572f1e671a989f42c64dc0b65d67d4250567573bb5e8d8c2d916d55de0fad0693e50202f126e0e71e930d123c47bc4a1d2ab46e52a07fd8ca501f330abb8b07d3a5364154ec1faf99b6a9779abe230ce8f5a290ef9442c7569643c", @ANYRES32, @ANYBLOB="101500000000", @ANYRES8, @ANYBLOB="069a8d832cbb2aa0e92a5d6083319d9fc77f6d6f182e2a5415c2f49ae5e513f0723ec491ea310f2bb11284da5060cf06", @ANYRES64], 0x1, 0x6f8, &(0x7f0000000980)="$eJzs3TtoJOcdAPD/rFarXQXOOvseTjBY+MAJEbmTTsiJ0uQSQlBhgnGK1OJO5xO30hlJDrojxHIefQpXqZxCnUkRnCrNQVLHGIJblYYEN67UKczszGpWu9pd6fS6+PcTs/PNfM/5z87M7g5iAvjaWpiK6tNIYmHqzc10eWd7tjmyPTuWZzcjohYRlYhqaxbJamS5d/IpvpmuzMsnh/Xz4fL8259/tfNFa6maT1n5Sr96PdS6V23lU0xGxEg+7zZ6SIufHOy+o727h7Y3rKS9hWnAbhSBiz89U6vwzPa6bLXzPv539tqv+lGOW+CCSlrXzS4TEeMRUY9oXfXzs0PlbEd38rbOewAAAABwVI2jV3lhN3ZjMy6dxnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg/1X+/P8knypFejKS4vn/tXxd5OkLaPCDED8ba82fnv5gAAAAAAAAAODUvbobu7EZl4rlvSS75/9a6R7/N+K9WI+lWIubsRmLsREbsRYzETFRaqi2ubixsTaT1Yy40qfm7fi0R83bh4/xzglvMwAAAAAAAABccPUB+Q9Hu9f9Nhb27/8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBFkESMtGbZdKVIT0SlGhH1iKil5bYiPi3Sz4mk18qnZz8OAAAAeCb1zsWkPkSdF96P3diMS8XyXpJ957+WfV+ux3uxGhuxHBvRjKW4l3+HTr/1V3a2Z5s727MrUZ9dSVf+/b97mVY7P/7ySEPPWozWbw+9e345K9GI+7GcrbkZdyOJVpeVvJWXd7Zn0/lKOq5sbB0+SMeU/CjXZzQjpfS99OX6J1n6j52/IlSPtInHMJZHpbeJLHe0HZHpfGxpjctFBHpHYuDeqfbtaSYq7V9+rvTvqXfMP+jf+/iBUj1/uTkXByNxOyrtPXStKxKjnZW//bePf/mgufrwwf31qYuzST29P7DEwUjMliJxvf974rmKxGDTWSSutpcX4mfxi5iKL8feirVYjl/FYmzE0mSRv5i/n9PXif6R+my8vPTWoJGkx+Rk+/zVa0yT0TGmmIyfZqnFeC3bp5diOZJ4FBFL8Ub2dztm2meD/T18dYijvjLEmbbkxneyWTtM0Ti87F+Ga/KkpHG9XIpr+Zw7keWV1+xH6cWeUSqudcNfj0qq38oTaQu/63t9OGsHIzFTisRLh71fWiH9c/apYb25+nDtweK7Q/b3ej5Pj6M/XKirRLqHX4x6vnGXs9ckO6ams7yX2lfYznjV8jsuLZWuvKvteq0j9efxKO51HKnfj7mYi/ms9LWs9GjXFSvNu95uqfMcnualn7Sq7Rs75c9bj6LZ+jwEwMU2/t3xWuM/jX81Pmr8vvGg8Wb9J2M/GHulFqP/HP1hdXrk9coryV/jo/jN/vd/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg+NYfP3m42GwurfVOVHpnJf1rLTb3igeJ9SnTkUjyR+UMUThZf/xkb2CD/RNj+fCOWf0kE8XTGstZxdMUOwtPnuIwkq2D+6s+eF8UT3kaooukK+Bp5WOPueh5f83oBdiVBxOTx6xe3q48UbxhS4WP/u5t9NpfIxHRq/CAE8fIM596gHN2a2Pl3Vvrj598b3ll8Z2ld5ZWR+fm5qfn596YvXV/ubk03XotVTj1h98CZ6X8caKtFhGvDq7b50GtAAAAAAAAAAAAwCk6i/+FOO9tBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ5vC1NRfRpJzEzfnE6Xd7Znm+lUpPdLViOiEhHJryOSf0TcidYUE6XmksP6+XB5/u3Pv9r5Yr+talG+ErF1aL3hbOVTTEbESD4/qfbuDm6vtp8c65GdtCOTBuxGETg4b/8LAAD//6Nb8HA=") write$sndseq(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) connect$bt_l2cap(0xffffffffffffffff, &(0x7f00000019c0)={0x1f, 0x8001}, 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000001bc0)='./tracefs_dir\x00', 0x1ff) mount(0x0, &(0x7f0000001c00)='./tracefs_dir\x00', &(0x7f0000001c40)='tracefs\x00', 0x0, 0x0) 3m41.826238499s ago: executing program 7 (id=1156): r0 = syz_io_uring_setup(0xf00, &(0x7f0000000080)={0x0, 0x5078, 0xc00, 0x2, 0x0, 0x0, 0x0}, &(0x7f0000000040)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000000)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x16, &(0x7f0000000400)={&(0x7f0000001000)={[{0x0, 0x0, 0x1}]}, 0x1}, 0x1) ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, &(0x7f0000001000)={0x0, "3efe72f3bf818ea09f4cf95d73c3ce3e8de711a7f3de0fc1cb8a24626d1d44910f2236bf9bae103e22391ea3cd172c2ac38179be234f63df3e6f5019535184ef5c39d04cc54c7bdd661cc2ff0d793bbc8433dbbb5ced195489d9389a1b55ef1389ec4f5bdceca542cc3fa739f22d94897c6b9abd311357d25e8ef7df7c43556d8f1107b003a9f87ddfc2dd335207b494877e48ec793e0995c184a0b644a16b065b3f6a987cc6bd06b7a618126a30b9e8aaa05814ca622407b092f3636481d7ab77487609081fb930df46404c837ff3e85d0cb475baf73af4f0702d828e5da37668e8d1396493ae1f100aa9c1fad6965352f36c8c09ad29fc695a266e7b0fd95de6688a99f6dea33f7432f2079339a45bb16c89d66fa2d81feebd0c42e53d9d5abfbacc40912bece541ebb43fc5e30e5724a394a841c9bfa09f08d9cd01d614546e650605921d4c55ad74479948dd4be6086d8f5a0f800461eb7633014de028d6492792cb27ad847037ad678f79e83232f138ab2f0ed350b9ab476d9c9ee41b5c4a96b28cc572f454c4c232aab45f1bc6b0c8caa19fc8c98e598c7891c9fb095ec923afd10c6306f0834d9da98892e9fd24186f446c1f87fced883ab43bcfbe54fc37d70459c049d87030494ebad22dc68cfaf694438ebc70e84a28f63c3b8905effdc87d477c1ddbab9ff5beed93a4d17819344148be913f949635156caf1e4b"}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x20, 0x0, r4, 0x0, &(0x7f0000000300)="93", 0x1, 0x1, 0x1}) io_uring_enter(r0, 0x1, 0x1, 0x5, 0x0, 0x0) 3m41.190969464s ago: executing program 7 (id=1159): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x3, 0x2, 0x3, 0x0, 0xffffffffffffffff, 0x3}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0xffffbfff, 0x1, 0x1}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x11, 0x15, &(0x7f0000000800)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1000009}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x61800, 0x4, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2, r1}, 0xc) 3m40.670842528s ago: executing program 36 (id=1159): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x3, 0x2, 0x3, 0x0, 0xffffffffffffffff, 0x3}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0xffffbfff, 0x1, 0x1}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x11, 0x15, &(0x7f0000000800)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1000009}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x61800, 0x4, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2, r1}, 0xc) 3m22.393811584s ago: executing program 6 (id=1272): unshare(0x60400) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x8c66) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000500)={0x9f, 0x0, 0x4, r2, 0x1}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000540)={0x86, 0x0, 0x3, r2, 0x5}) 3m21.947789199s ago: executing program 6 (id=1277): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000240)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000280)={'syzkaller0\x00', 0x1}) write$tun(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d23210000000000000000006"], 0x4a) 3m21.425287503s ago: executing program 6 (id=1279): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x48, 0x10, 0x439, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r1, 0x1a025, 0x1703}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0x7}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e20}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x410c4}, 0x4000020) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9, 0x0, 0x0, 0x4000000}, 0x0) 3m20.77186345s ago: executing program 6 (id=1282): syz_mount_image$vfat(&(0x7f0000000380), &(0x7f00000003c0)='./file0\x00', 0x0, &(0x7f0000000100)={[{@fat=@uid={'uid', 0x3d, 0xee00}}, {@iocharset={'iocharset', 0x3d, 'ascii'}}, {@utf8}, {@iocharset={'iocharset', 0x3d, 'iso8859-3'}}, {@shortname_win95}, {@uni_xlateno}, {@shortname_lower}, {@shortname_winnt}, {@numtail}, {@rodir}, {@numtail}, {@utf8no}, {@fat=@dos1xfloppy}]}, 0x1, 0x2c4, &(0x7f0000000e00)="$eJzs3cFr01AcwPHf2m3tOrb2MAYK4g+96CVs9S8osoFYUOY61IOQuVRLYzuaWqmI283r/o7h0YMo6P6BXXYTr8NLEQQvO4iRNcnadRXWuZppvx8Y7+2990te8rLxS6Bp4+7Gk2LeMfJmVSJxlYjIuuyJpPZrviG/jDTro9JuXa6Of/904c69+zcz2ezcgup8ZvFaWlUnL3549uL1pa3q+NKbyfcx2U49aHxL725Pb59r/FwMtl4WMXW5XK6ay7alKwWnaKjeti3TsbRQcqxKVdv683Z5dbWuZmllIrFasRxHzVJdi1Zdq2WtVupqPjILJTUMQycSMmiiPUfkNhcWzExfJoMwjHVrrFQyZrRrZ27zb0wKAACcLY2tjWgY+f/jgqMFR/O7h/L7o/l/RHrI/0UGOv/v3Ynz/7m3fZgN+mM//0/4f7+Hkf8DAAAAAAAAAAAAAAAAAAAAAPAv2HPdpOu6yaAMfmIiEheR4Pew54n+YP0HW9sH9+Ii9qtarpbzSq8/k5eC2GLJzIjIj+b14Lrx/cKrz9/Izs1o07R8tNf8+LVaLiqxID6Q8uObWvGzXry2x6/JiCTa95+WpEx1j093ia/lRuXKZTfm79kSQ5Ky81DKYstK87puxb+cVb1+K9sRP9YcBwAAAADA/8DQA6nO+/dmv6HBa0M6+r3G1vMBSR48H+i4P5/pen8+LOeHwztuAAAAAAAGiVN/XjRt26oMQCX4/oNT2WD4py5+3MHDIuK3vDsra9GqDK17q3K0KyIiJ91y9M9W+auIHGqZCn25T6Py5al3rg9aPv9+8NJEaP+UAAAAAPRFkPQP9RyZ2+nLhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGEDHfXlYMP4k7x5r2100nKMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzoZfAQAA//8eGxYV") r0 = syz_open_procfs(0x0, 0x0) read$FUSE(r0, 0x0, 0x0) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) 3m20.447376813s ago: executing program 6 (id=1285): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/target/core/rd_mcp_0/dev0\x00', 0x1ff) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) 3m19.753887314s ago: executing program 6 (id=1294): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000300)={0x0, "030000000000000023000000debd12ffff00000004000000001020000400", 0xffffffffffffffff}) r2 = epoll_create1(0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000080)={0x80000011}) epoll_pwait(r2, &(0x7f00000000c0)=[{}], 0x1, 0x3, 0x0, 0x0) 3m19.059512306s ago: executing program 37 (id=1294): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000300)={0x0, "030000000000000023000000debd12ffff00000004000000001020000400", 0xffffffffffffffff}) r2 = epoll_create1(0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000080)={0x80000011}) epoll_pwait(r2, &(0x7f00000000c0)=[{}], 0x1, 0x3, 0x0, 0x0) 3m15.271601924s ago: executing program 1 (id=1311): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_GET_DEBUGREGS(r2, 0x8080aea1, &(0x7f00000002c0)) 3m14.491892515s ago: executing program 1 (id=1313): r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) splice(r0, 0x0, r2, 0x0, 0x38f9, 0x7) fcntl$setstatus(r1, 0x4, 0x42c00) fcntl$setstatus(r1, 0x4, 0x2400) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x14, 0x0, 0x7}, 0x14}}, 0x0) 3m14.010224364s ago: executing program 1 (id=1315): syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000001380)='./file1\x00', 0x0, &(0x7f00000013c0), 0x1, 0x50f, &(0x7f0000001400)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") r0 = creat(&(0x7f0000001940)='./file1\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000001980)='./file2\x00', 0xa0c42, 0x100) r2 = openat(0xffffffffffffff9c, &(0x7f00000019c0)='./file1\x00', 0x101042, 0x15) pwrite64(r2, &(0x7f0000001a00)='2', 0xfdef, 0xc00) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000001a40)={0xc, r0, 0x2, 0x0, 0x0, 0xfffffffffe000001}) 3m13.321222155s ago: executing program 1 (id=1316): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x3c5093, 0x0) 3m12.965101651s ago: executing program 1 (id=1318): ioctl$PPPIOCSMAXCID(0xffffffffffffffff, 0x40047451, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000051c0)={0x1, 0x1000}, 0x4) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000005200)=[{{0x0, 0x0, 0x0}, 0xf1a2}, {{0x0, 0x0, 0x0}, 0x40}], 0x2, 0x0, 0x0) 3m8.796512458s ago: executing program 1 (id=1331): close(0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x4, 0x4, 0x1000, 0x0, r0}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0xd2, 0x9}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r1}, &(0x7f0000000180), &(0x7f00000002c0)=r0}, 0x20) 3m8.363981942s ago: executing program 38 (id=1331): close(0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x4, 0x4, 0x1000, 0x0, r0}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0xd2, 0x9}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r1}, &(0x7f0000000180), &(0x7f00000002c0)=r0}, 0x20) 52.496534554s ago: executing program 9 (id=2279): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x42, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f00000003c0)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@verity_on}]}) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0/file2\x00', 0x0, 0x8) 52.346242169s ago: executing program 9 (id=2280): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000106a053103000000000001090224000100008000090400101c0300010009210000000122f80409058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_mount_image$udf(&(0x7f0000000300), &(0x7f0000000340)='./file1\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="73686f727461642c756e64656c6574652c73657373696f6e3d30303030000800003030303030303030303139302c7d6f64653d30303030303030303030303030303030303030303030352c726f6f746469723d30303030303030303030303030303030303030352c646d6f64653d3030303030f100303030303030303030303030303030362c696f636861727365743d6370313235312c696f636861727365743d6b6f69382d722c6e6f7672732c007ce8b23d82aacbefd1de1daab7394a9b4696461da9ab46f2d71c895d8c"], 0xfc, 0xc41, &(0x7f0000000480)="$eJzs3U9sHNd9B/DfG5Hi0m4rxnYUJ42LTVuksmK5+hdTsQp3VdNsA8gyEYq5BeCKpNSFKZIgqUY20oLupYceAhRFDzkRaI0CKRoYTRH0yLQukFx8KHLqiWhhIyh6YIsAOQUMZvatuKRJmzb/iLI+H5v67s68N/PezHJGIvjmBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ8QcvXTl7Lt3vVgAAh+na6NfOnnf/B4CHynX//gcAAAAAAAAAAAAAgKMuRRGPR4q5a2tpvHrfVrva6r1zd2xoePtq/amqeawqX37Vzp2/cPHLzw1e6uTV1swH1N9vn4tXRq9fqb84e3tufmphYWqyPjbTmpidnNr1FvZaf6vT1QGo3371zuTNmwv1889e2LT67sB7fY+eHLg8+PSZpzplx4aGh0c3itS6y/d87Ia07TTC43gUcSZSPPO9n6ZmRBSx92NRO9xzv1V/1YnTVSfGhoarjky3mjOL5cqRzoEoIupdlRqdY7T9uYie3kPtw84aEUtl88sGny67NzrXnG/emJ6qjzTnF1uLrdmZkdRubdmfehRxKUUsR8Rq3/s31xtF9ESK75xYSzci4ljnOHypGhi8czuKA+zjLpTtrPdGLBcPwDk7wvqiiJcjxc/ePhUT+TpTXWu+GPFymT+IeLPMFyJS+cG4GPHuNp8jHkw9UcRfluf/8lqarK4HnevK1a/Xvzpzc7arbOe68hHvD++7Utyn+0P/ljwcR/zaVIsimtUVfy19/L/sAAAAAAAAAAAAAAAAALDf+qOIz0aKl/7jT6pxxVGNSz9xefAPB361e8z4kx+ynbLssxGxVOxuTO7xPDBwJI2kdJ/HEj/MalHEn+bxf2/c78YAAAAAAAAAAAAAAAAAAAA81Ir4SaR4/p1TaTm65xRvzdyqX2/emG7PCtuZ+7czZ/r6+vp6PbWzkXM851LO5ZwrOVdzRpHr52zkHM+5lHM550rO1ZxxLNfP2cg5nnMp53LOlZyrOaMn18/ZyDmecynncs6VnKs544jM3QsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8ElSRBG/iBTf/uZaihQRjYjxaOdK3/1uHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQ6ktFfD9S1P+ocW9ZT0Sk6v+2U+UfF6NxvMzHojFY5gvRuJKzWWVP44370H72pjcV8eNI0Vd7K1JPe1k+/73td/c+BvHmtzbefS6XPdZZOfBe36MnT1weHP6NJ3d6nbZrwOmrrZk7d+tjQ8PDo12Le/LeH+taNpD3W+xT34lYeO31V5vT01PzH/9F+RHYQ/UH6EX5DXIEmuHFYb2IniPRjPvTdx4C5f3/3Ujxu+/8Z+eG377/1+JX2u/u3eHj53+2cf9/fuuGdnn/79laL9//y3v6dvf/x7uWPZ//NtLbE1FbvD3XezKitvDa62dat5u3pm5NzVw8e/Yrg4NfuXC293hE7WZreqrr1b4cLgAAAAAAAAAAAAAAAIDDk4r4/UjR/PFaqkfE3Wq81sDlwafPPHUsjlXjrTaN235l9PqV+ouzt+fmpxYWpibrYzOtidnJqd3urlYN9xobGj6Qznyo/gNuf3/txdm51+Zbt/54cdv1j9Su3FhYnG9ObL86+qOIaHQvOV01eGxouGr0dKs5U1Ud2XYw/UfXm4r4r0gxcbGevpCX5fH/W0f4bxr/v7R1Qwc0/v9TXcvKfaZUxM8jxe/81ZPxhaqdj8T7jlku93eR4vSlz+dycbws12nDY9VDBNojA8uy/xcp/ukXm8t2xkO2xyBWZc/t/sg+GMrzfyJSfP8vvhu/mZdtfv7D9uf/ka0bOqDz/0TXskc2Pa9gz10nn/8zkeKFx9+K38rLPuj5H51nb5zKhe89n+OAzv+nu5YN5P3+9v50HQAAAAAAAAAA4IHWm4r4+0jxw+Ge9Fxetpvf/5vcuqED+v2vz3Qtm9yf+Yo+9MWeDyoAAAAAHBG9qYifRIpbi2/dG0O9efx31/jP39sY/zmUtqytfs73a9VzA/bz53/dBvJ+x/febQAAAAAAAAAAAAAAAAAAADhSUiriuTyf+ng1nn9yx/nUVyLFS//zTC6XTpblOvPAD1R/1q7Nzpy5Mj09O9FcbN6YnqqPzjUnpsq6T0SKtb/9fK5bVPOrd+abb8/xvjEX+3ykGP6HTtn2XOyducmf2Ch7riz7qUjx3/+Yy66vV2U781h/eqPs+bLs30SKb/zL5u12yp7cKHuhLPvdSPGjb9Q7ZR8py3aej/qZjbLPTswWB3BWAAAAAAAAAAAAAAAAAAAAeNj0piL+PFL87+3le2P58/z/vV1vK29+q2u+/y3uVvP8D1Tz/+/0+uPM/189V2Bpp70CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAnU4oiXo8Uc9fW0kpf+b6tdrU1c+fu2NDw9tX6U1XzWFW+/KqdO3/h4pefG7zUyQ+uv98+G6+MXr9Sf3H29tz81MLC1GR9bKY1MTs5test7LX+VqerA1C//eqdyZs3F+rnn72wafXdgff6Hj05cHnw6TNPdcqODQ0Pj3aV6en9qDt9Y8c1aYflx6OIv44Uz3zvp+mHfRFF7P1YbPvZ6dt9L/aov+rE6aoTY0PDVUemW82ZxXLlSOdAFBH1rkqNzjHat3NxQBoRS2XzywafLrs3Otecb96YnqqPNOcXW4ut2ZmR1G5t2Z96FHEpRSxHxOo256A3ing1UnznxFr6176IY53j8KVro187e37ndhQH2MddKNtZ741YLh6Ac3aE9UUR/xwpfvb2qfi3voieaH/FFyNeLvMHEW9G+3yn8oNxMeLdw/te5oD1RBH/X57/y2vp7b7yetC5rlz9ev2rMzdnu8p2risHcn84PP2Hurcjfm2qRRE/qq74a+nffV8DAAAAAAAAAAAAAAAAHCFF/HqkeP6dU6kaH3xvTHFr5lb9evPGdHtYX2fsX2fM9Pr6+no9tbORczznUs7lnCs5V3NGkevnbJRZW18fz++Xci7nXMm5mjOO5fo5GznHcy7lXM65knM1Z/Tk+jkbOcdzLuVczrmSczVnHJGxewAAAAAAAAAAAAAAAAAAwCdLUf2X4tvfXEvrfe35pcejnSvmA/3E+2UAAAD//xtt+zc=") syz_usb_control_io$hid(r0, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_ep_read(0xffffffffffffffff, 0x3, 0x0, 0x0) 50.08974663s ago: executing program 9 (id=2291): r0 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011001000000106d043ac500000000000109022d0001000070060904000504030002000921fcff400122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0xa, 0x101142) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000680)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000540)={0x20, 0x1, 0x1, 'J'}, 0x0}) ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0) 47.119754013s ago: executing program 9 (id=2318): syz_mount_image$udf(&(0x7f00000000c0), &(0x7f0000000000)='./file1\x00', 0x4000, &(0x7f0000000100)=ANY=[@ANYBLOB="6c617374626c6f636b3d30303030303030303030303030303030303030302c756d61736b3d30303030303030303030303030303030303030303030302c756e64656c6574652c6c6f6e6761642c73686f727461642c7569643d666f726765742c756e64656c6574652c696f636861727365743d757466382c73686f727461642c696f636861727365743d64656661756c742c7569643d666f726765742c6e6f7374726963742c73657373696f6e3d30303030303030303030303030303030303030302c706172746974696f6e3d30303030303030303030303030303030303030362c00b2e01f5c0b5c8fb2623d8f888e41dfceb3ecf959d23d90b071660660b17884bd109d37086024cf83fa"], 0x2, 0xc31, &(0x7f0000001ec0)="$eJzs3U9sHNd9B/DfGy3FldxWTOwoThoXm7ZIZcVy9S+mYhXuqqbZBpBlIRRzC8AVSakLUyRBUo1spAXTSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9HCRlD0wBYBcgoYzOxbckmRNi2KEmV9Pjb13Z19b/a9easZiuCbFwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAxB+8cun0mfSwWwEAPEhXRr56+qzrPwA8Vq759z8AAAAAAAAAAAAAABx0KYp4MlLMXllNY9Xzjvrldt/tO6NDw9tXO5Kqmoeq8uVX/czZc+e/9MLghW5ebk9/QP377bPx2si1S42XZ27Nzk3Oz09ONEan2+MzE5O73sNe6291sjoAjVuv3564cWO+cfb5c5tevjPwfv8TxwcuDj576plu2dGh4eGRjSL13vK1e25Ix04zPA5HEacixXPf+2lqRUQRez8W9Qc79lsdqTpxsurE6NBw1ZGpdmt6oXzxavdAFBGNnkrN7jHafiyi1vdA+7CzZsRi2fyywSfL7o3MtuZa16cmG1dbcwvthfbM9NXUaW3Zn0YUcSFFLEXESv/du+uLImqR4jvHVtP1iDjUPQ5frCYG79yOYh/7uAtlOxt9EUvFIzBmB1h/FPFqpPjZOydiPJ9nqnPNFyJeLfMHEW+V+VJEKj8Y5yPe2+ZzxKOpFkX8ZTn+F1fTRHU+6J5XLn+t8ZXpGzM9ZbvnlY94fbjrTPGQrg9HtuSDccDPTfUoolWd8VfTvX+zAwAAAAAAAAAAAAAAAMD9diSK+EykeOU//qSaVxzVvPRjFwf/cOBXe+eMP/0h+ynLPh8Ri8Xu5uQezhMDr6arKT3kucSPs3oU8ad5/t+3HnZjAAAAAAAAAAAAAAAAAAAAHmtF/CRSvPjuibQUvWuKt6dvNq61rk91VoXtrv1brZlei1hbW1trpE42c47lXMy5lHM550rOKHL9nM2cYzkXcy7lXM65kjMdyvVzNnOO5VzMuZRzOedKzvX252zmHMu5mHMp53LOlZxxQNbuBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4OCmiiF9Eim9/YzVFiohmxFh0crn/YbcOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACj1pyK+Hykaf9Rc31aLiFT933Gi/ON8NA+X+cloDpb5UjQv5WxVWWt+6yG0n73pS0X8OFL0199eH/A8/n2dZ+sfg3jrmxvPPlvr5KHuiwPv9z9x/NjFweHfeHqnx2m7Bpy83J6+facxOjQ8PNKzuZbf/ZM92wby+xb3p+tExPwbb77empqanLv3B+VHYA/VH6EHqfa49NSD6kHUDkQzHk7feQyU1//3IsXvvvuf3Qt+5/pfj1/pPFu/wsfP/2zj+v/i1h3t8vpf21ovX//La/p21/8ne7a9mL8b6atF1BduzfYdj6jPv/Hmqfat1s3Jm5PT50+f/vLg4JfPne47HFG/0Z6a7Hl0Xw4XAAAAAAAAAAAAAAAAwIOTivj9SNH68WpqRMSdar7WwMXBZ089cygOVfOtNs3bfm3k2qXGyzO3Zucm5+cnJxqj0+3xmYnJ3b5dvZruNTo0vC+d+VBH9rn9R+ovz8y+Mde++ccL275+tH7p+vzCXGt8+5fjSBQRzd4tJ6sGjw4NV42earemq6pXt51M/9H1pSL+K1KMn2+kz+dtef7/1hn+m+b/L27d0T7N//9Ez7byPVMq4ueR4nf+6un4fNXOo3HXMcvl/i5SnLzwuVwuDpflum3o3FegMzOwLPt/keKffrG5bHc+5JMbZc/s+sA+IsrxPxYpvv8X343fzNs23/9h+/E/unVH+zT+T/VsO7rpfgV77jp5/E9FipeefDt+K2/7oPt/dO+9cSIXXr8/xz6N/6d6tg3k9/3t+9N1AAAAAAAAAACAR1pfKuLvI8UPh2vphbxtN7//N7F1R/v0+1+f7tk2cX/WK/rQB3s+qAAAAABwQPSlIn4SKW4uvL0+h3rz/O+e+Z+/tzH/cyhtebX6Od+vVfcNuJ8//+s1kN93bO/dBgAAAAAAAAAAAAAAAAAAgAMlpSJeyOupj1Xz+Sd2XE99OVK88j/P5XLpeFmuuw78QPVn/crM9KlLU1Mz462F1vWpycbIbGt8sqz7VKRY/dvP5bpFtb56d735zhrvG2uxz0WK4X/olu2sxd5dm/ypjbJnyrKfiBT//Y+by3bXsf7URtmzZdm/iRRf/5ftyx7fKHuuLPvdSPGjrze6ZY+WZbv3R/30Rtnnx2eKfRgVAAAAAAAAAAAAAAAAAAAAHjd9qYg/jxT/e2tpfS5/Xv+/r+dp5a1v9qz3v8Wdap3/gWr9/50e38v6/9V9BRZ3elcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPh4SlHEm5Fi9spqWu4vn3fUL7enb98ZHRrevtqRVNU8VJUvv+pnzp47/6UXBi9084Pr32+fiddGrl1qvDxza3Zucn5+cqIxOt0en5mY3PUe9lp/q5PVAWjcev32xI0b842zz5/b9PKdgff7nzg+cHHw2VPPdMuODg0Pj/SUqfXd87vfJe2w/XAU8deR4rnv/TT9sD+iiL0fiw/57Oy3I1UnTladGB0arjoy1W5NL5QvXu0eiCKi0VOpWR6jtDFu+zkWe9KMWCybXzb4ZNm9kdnWXOv61GTjamtuob3Qnpm+mjqtLbvTiCIupIiliFjpv3t3fVHE65HiO8dW07/2Rxzqfla+eGXkq6fP7tyOYh/7uAtlOxt9EUvFIzBmB1h/FPHPkeJn75yIf+uPqEXnK74Q8WqZP4h4KzrjXf39OB/x3jafIx5NtSji/8vxv7ia3ukvzwfd88rlrzW+Mn1jpqds97zyyF8fHqQDfm6qRxE/qs74q+nf/b0GAAAAAAAAAAAAAAAAOECK+PVI8eK7J1I1P3h9TnF7+mbjWuv6VGdaX3fuX3fO9Nra2lojdbKZcyznYs6lnMs5V3JGkevnbJZZX1sby88Xcy7lXM65kjMO5fo5mznHci7mXMq5nHMlZ9Ry/ZzNnGM5F3Mu5VzOuZIzDsjcPQAAAAAAAAAAAAAAAAAA4OOlqP5L8e1vrKa1/s760mPRyWXrgX7s/TIAAP//YSD4sQ==") open(&(0x7f00000008c0)='./bus\x00', 0x400141042, 0x22) mount(&(0x7f0000000900)=@loop={'/dev/loop', 0x0}, &(0x7f0000000940)='./bus\x00', 0x0, 0x5000, 0x0) r0 = open(&(0x7f0000000980)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x14, 0xd, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e7376b7a5ff537ed73ac58818d78c660e677df8dc905b90242b7c528a076d2f6a00400", "036c5bc6780820d1cbf7966d61fdcf335263bd9b0abdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x0, 0x108) 46.25919722s ago: executing program 9 (id=2323): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$unix(r1, &(0x7f0000001bc0)=[{{0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000000380)='\b', 0x1}], 0x1, 0x0, 0x0, 0x90}}], 0x1, 0x20048800) io_setup(0x7, &(0x7f0000000000)=0x0) io_submit(r2, 0x1, &(0x7f00000002c0)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0xfffd, r1, 0x0}]) 45.539657184s ago: executing program 9 (id=2326): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES64=r0], 0x40}}, 0x0) unshare(0x8040480) ppoll(&(0x7f00000015c0)=[{r1, 0x80}], 0x1, 0x0, 0x0, 0x0) 44.99223829s ago: executing program 39 (id=2326): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES64=r0], 0x40}}, 0x0) unshare(0x8040480) ppoll(&(0x7f00000015c0)=[{r1, 0x80}], 0x1, 0x0, 0x0, 0x0) 6.282430149s ago: executing program 8 (id=2572): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x10008, &(0x7f0000000080)={[{@debug}, {@resuid={'resuid', 0x3d, 0xee01}}]}, 0xff, 0x49e, &(0x7f0000000f40)="$eJzs3M9vFFUcAPDvbH/Qyo9WRBQEraCR+KOlBZWDBzSaeNDERA94rG1BZKGG1gRIo8UYPBoS78ajiX+BNy9GPRgTr5p4NCREe6F4qpmdGbpsd0u3tF3pfj7Jdt/bmd33vjPv7b6Z15kA2tZA+ieJ2BYRv0dEX5a9fYWB7Gl+bmbs5tzMWBILC2//nVTWuzE3M1asWrxva545VIoofZbE8WRpuVMXL50ZLZcnzuf5oemzHw5NXbz03Omzo6cmTk2cGzl27OiR4RdfGHl+TeJM47qx9+PJfXtef/fqm2Mnrr7307dptXbvz5ZXx3FHN+sEVMdAutX+WaioXfZkE3W/F2yvSiedLawITemIiHR3dVX6f190xOLO64vXPm1p5YB1lf42bWm8eHYB2MSSaHUNgNYofujT49/isUFDj/+F6y9HdOfp+bmZsflb8XdGKX+9ax3LH4iIE7P/fpU+otnzEAAAq1AZ2zxbb/xXit2V52yuY0c+h9IfEfdHxM6IeCAidkXEgxGVdR+KiIezNy/0rbD8gZr80vFP6VrdOq+RdPz3UtXYb74q/vypvyPPba/E35WcPF2eOJxvk0PRtSXNDy9Txvev/vZFo2XV47/0kZZfjAXzClzrrDlBNz46PbpWG+H65Yi9nfXiT27NBKQtYE9E7G3uo3cUidNPf7Ov0Up3jn8ZazDPtPB1xFPZ/p+NmvgLyfLzk0M9UZ44PFS0iqV+/vXKW43Kv6v418D1A49kicX9X7NGVUMrlyfOTzVfxpU/Pm94TLPa9t+dvFOZs/7l/ey1C6PT0+eHI7qTNyr54piu8vrI4nsvjE73pvli/bT9HzpYv//vzN+T7v90K6WNeH9EPBoRj+V1fzwiDkTEwWXi//GVJz5YJv4kkmjd/r8cMV73++9W++9PqufrV5HoOPPDd41mzFe2/4/GbOW7NlP5/ruDlVbwLjcfAAAA3BNKEbEtktJglh7YFqXS4GD2P/y74r5SeXJq+pmTkx+dG8+uEeiPrlJxpquv6nzocDKbf2KWH8nPFRfLj+Tnjb/s6K3kB8cmy+Mtjh3a3dbb+38U/T/1V0erawesO9drQfuq7f+lFtUD2Hgr+f13LACb0+39vyf909uqugAby/E/tK96/f+TmrzxP2xOS/v/n3VuWQdsRsb/0L70f2hf+j+0pWYu54/jjRb1REQztwUoLhZY/V0FelZ8hX+7JIo7XqxnWb1x6Ux3/kqUWhRpR5ONbVMk0h6zsYUu3kMFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgXvZfAAAA//8hId5P") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) pwrite64(r0, &(0x7f00000001c0)='2', 0x1, 0xe7c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1, 0xe, 0x0, 0x0}, 0x94) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 5.626272846s ago: executing program 8 (id=2574): r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000) getsockname$packet(r0, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000016c0)=@newlink={0x50, 0x10, 0x401, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x1114}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FLOWINFO={0x8, 0x7, 0x5}, @IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast1}]}}}]}, 0x50}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x401, 0x4000000, 0x0, {0x0, 0x0, 0x0, r2, 0x100, 0xac}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x3}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40001}, 0x20004090) 5.18968684s ago: executing program 0 (id=2578): r0 = syz_open_dev$video(&(0x7f00000000c0), 0x3, 0x2) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000100)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f00000001c0)}, 0x400000}) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000200)={0x1, 0x1, 0x2}) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000300)=0x1) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000340)=0x2) 5.027897697s ago: executing program 0 (id=2579): r0 = syz_create_resource$futex(&(0x7f0000000000)=0x1) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000040)={0x0, 0x0, "d607f8f9951e76c13f64323723e7eecdf40c363423eb3d259266ec9c37865c6c1a4640ce1b22bb3327ef4f001d34c09f39c3539e4f8d3ee0878ae95bc7f52363c468a957ff3e24852548deb01efd54f11ed2c41d078b9cf1fc8f72566153c97e4af37017ea6b16b694bb4a6e4606c3fb19d1d2bd3c8c4e97da2233f9d5c3b90400000000000000c279f03558083906666827d61dcc3a633bffff250b5a293e3877adc1660edbc9a0307a25720a170e7f5670e419dc44febf7ddc73fd4a5a0b6c28665f7f46c7084e17c809268103a2584ab40a68e528329d97afc3612e325c1eb4a3ab2e156a97444800", "0615e456c196e819a321fdb3690bfab19538829a732a01781564ef7738cb5b82a704b3952f81c68bb4ceeaad63206f88201638e87c4981cbf9332cbc9c4d69e392bd33237ece7ad91e44edac0da8dacad81adf2e08c21ad6b44ce1f90bd618c255ca40cdb411485fb48a51d329c816b3488c7d032ef69c502c6e1236bd381efd410165988847c1dcb98a18ca2b853910e52044fa3b3026cb88de269537c8f26ffc3b15cbf279832bfc90bd95939043182e88050dfd2a4784a5d1453610fb1f1c2bac36c3800bda0178e898540debeef3636afd981d8af4ab119928448f90351aec113335eacf52a18c877364776f363610a15b37bcd36e6a7cba931151b9c9ba5779d550e9ab21603a43a25f3b4895d8dc4f3ce0e7d5e964e888169ea79a0848e9338b3d34d62e963fbf98834f4455419907f0ffdb76373af77a34edee7789f56e7f01bdab9614a0d460f791a06e6cf5243bf2b3a1624a80ec7e1116f1c81f5ef4b895be74bf67eea9193428b58a8b62b7976d3d2e59796c46ec918c83cd49c3f43dbd2967586966c19ace7b0bef5f94eb333b362649f1bfa114f8b1f126e97ec672cff77e2130823fa7a1df6760c6a8917815e9f0a409ed32b133df7dc9afceffcd472b35145c83c9167764d25ce214133c6170adeb6653b30b226a3b2ff1363ac862a540c7fab584cd051ce7ee951e0f121d43cff75afbdec6bc6f6e8f7db58c8086751320d22ee8582e915cabc536e3767e9a9230c9ae8b92398f0ca2a7141ea4588af7afde10e5ec2a6fe85ba5712e126629d4e3998fc4721cb638f2ef8356049e3448466e2c400d5e8baf843fa399907cb526b791c5350ce29204cb6fe50b892a69ec6dbecc28f032a745738faa12c2a34222942fef0ec0511da5fe0b565ceac429da7cc25cfe0320b40a514723e2392a6a361032343edb79fd83cd0a354837153542fd61b3156b54c566036e493250c3a3214738e3cacc24a50d5dfd17d5008b4ca629c3062f3417cb69c48b8b888ae51256bb4e6c68e95a71a00383ad9df263f6a775ded64fef20ed5cb5f31c33cb86f839d00a12e40cd31219113619c4e0585454cb1776278bfd7f5c4275792afb790e83ff0fc6925355c7aee7a070477d9ec2292366e39b9dc66f7adcf449a1a718e5217183faf0f679efc5cef20bcdcf2d12ea0684084ec0d693256e280025b23b5a08b7b1ebe7d41fb045793f971d6ee066604818cb09d86c1eda99a44c35476a113fd5d1a7543f8f99424ebb78dd9e00d719502a6eafa743a061fa3fa55e4deaa0a011b6b9d633f10e0c9446b5a2e3f6d6014ab00695366c1a6bf0c32f703aebb7988c7d4d322681458e85626302c70f37628835e1fcfff1da3099c0b4af433eb9a51f9609f2c0c09a98b18880c846b34d6ad0210f073765666100976ee1d928893f983580ea47a012144633b98e02c3e81869534ab985eb3a73e0bac892dac949f85db949285a6a7a490b1075467226af23df82d8dd09b7282490fbb3ada9ed4cae8f761aefbe0701de6b132f12044c58ac1c2607c8f51361de5bed021dea13fd0a440263cf0b304522a324b581ab274e7bdae5994316657b5c0ab0220d9b08739729f7a35d436878c182aec4f08dd161c11ee5b7937fae7835e8bfe98a44c8d4bbb2e0eee0cb5d7c93517e96a9fc8132e60f3ef7c735bea1934b37df451f981c8d9210e61278c871e6dad6ceb89aa4d7245658a63e65cec7b81d307426a60a31cc917844a14e1d9ad83bef1c9f736d1836687c950d1275caece0d46ab9f3b0e95d9cf560eb8134e8346b35e0a6f60e6a87a14c4aeb3e0d06158390660a52a6e44b524c1e16de2bf99870f78fc81d267072bc63e97d3f26d23fd59799ff2c847d6a724cebc2377a582ba73d99a610a095c28d66c60910ac64b7d18847fa98fd8528b72e0a149b082c731575b2e2763e67c821ba29eecd8b8c87981c4fb1fbbaaa4e8aa077ec98de1362fc7af7a0ac5e3297fd0d924124b2e255b5cc4f6b0873f3d34418d5ae0d6f734628f38cb9b856b2db3fbb2fafb76983eabc51a348e55789e997fa25cbe6e5031bd2e33d4e2686f964a65d1abf7f96a20a8b270b1522ace4adf6fdade5cd3f101574960d13267e2382f70027ebe5ef7f9418e14e6a8a130d2aec2253c8fe21825e3295774db0c9b1340ea28a96589ba0d9f79aa61b92aea6f704ef7f716d849b8c77e6922e198a086d8133491d0bb85b925825a6d307d7cc8f09c655aa3edabf84c75560dfb279ee3e8b825323279edc58c3161e72cf9ae02ef80d500da922c0abeb8b164abd9c17ef7c02e89000d67b0c2ddd078cacbf37c4826be3845948d598980d63c1d7aade89d0637d80a4c102a35eb027a08ef90cc20d17fc514926914e68e5de54b861200ffa4ce1cbc16e4ecf342a1176cdb561f7dea38b3ae0fd81260f72d34e6f33d364cf313d3b3161410dcbf5f0f0579a1d235b49bb5d27f85825b94f1899e7846d0292ad912d934574f9d55d2152dbfb39d662e6e0f2496182d012af8b4bebbdfa1d68e3e988869fb5cd9612db97e6cc574444f4b5025ec9827bafc55341bf6ad3fd4fab2ee43f343cb9bcec0c38384b5699e5c6d5973ba591978275c51a40200d340b9ed3681f08c69f58320f538f9cd78a34eb6ed55710d2478ea4bd15813921817b42f88f1bb038033b519668f0a2e8693b9a19c7bcf96eec04bda625b31c32f4286be922ab2c87aa30310c8f46551450d5bc26b5fbfdedaae0f756384023bb9a28d3200cfeaedd63d6afe076513e8ad73d16607cd4ede16344e60d8707357e82b1089258c56d851a435e23ce0919825e04471dd61a44c43e87c2959d4e89311a30ee8be010094d0ef109bb210dda58b21b685b9e9c078c9ded6117d9a88dd7799291969851cd4c3f22b5f870a275a692188dafcf6e89ba87b0eb61011de031fda25fb3349901d40da2bbdb76eda417c9fafd90fb23504ab150ca0033ea1d00000000000086ba3aaa79d0df4f2e4e4afa565e66d28aa167f835d080bf1d41d0e52dbf81c671f8eacae234bf4fc328302671fab46613b73daf2ace80aff2f80f6a9d84b82480178cc612aa90adfc80ab3bba7d1527fc6ab04f009011bf093494a0d329df4e53d855b1c0ff6a25d22052b3a778e1ca2fbe59c9eeedf99e13682d06da269560524ffa0f404b73b946edf900ee958ceba09a051e27a620fb78e7a352c182c8c2981ce822eeaf6323965b4b3f322d40d406a158b6f3cf5d74822de952fefc341d0dead6c1c8fed8e48e0a85b51c1dcc7796d3f45bb1f50467a475da76c356c9e031b096867da1dbb89c3a038d475dbcdb2df1278d5dba55c2fb5ba6a9778c2a244198491f0f711cdb2ef0332f347afffb1b098b4c59041ccb0c286bb2dd40e7ec713f6ffe0b1067678c748615dae3c1e090f3739a9035767fb9972580d19fdef49a5071f99c3706b8fa4991f430721cf3ca11af0e3bd7c4d0cd0ab5b7d98ee66730c20a098110e4a15ce0bfc88c41fe375f261fe3557e14eb5ff4a2cdf6a008fd7b6702951b8456e940fbd269a0f3ed515ac03cfecce67027d579e1226bd7b7381827453550343566508d38790ee838c3bf85c6c91a45e7a44752f57313533a3e82e4042e65d346afb20c0527575f79080aef4e1aa8d5868d190c8d37bdae7592e41bed37b9d4c30d8126d3debde02dff25f5ef1e48133e2a41cd1d347bd23dcce57a00189619db629c530dc112d22ac72bce353681264b5175be40b3ba84408d0f56762cc720e96c128447be7128748e185be2640115556bac64d060207e629b0144e501c1c49c6abd15c7982b01e22da2ad04bb28df1a27f31e18040c16406071d798bb40d901d001e22cc5ed870d08702f49f0021814cdd814901a13c7ab061bb4b8172c639b3449e24f656fee58186e69e6874ea95d946da781b49ca080ffb4a3c87746c661f43e9be52d0ba2ee368b9c143687c8846abac599069decf41e69fddcadf31c5f715917df12df4eedbfcc5805fe8e661b8fcd7b130d7bcc4a9a152de93a15dddacf3cf52479956185a3c5000d18ddce0236d5858c0d8761bca7446e3d30f3e8f48d5e8f86a60cbe46f038b1028ffd35590bdacfeebb86e28d42a923bdc3f9a307b919341a2a7dda096d41070db245c2c424aedd4a4bb9863169454d09f25fd0aa2da7bfc97ad7aca886dd998e041133e07899ad48f7cda600de48ac3951152dfbe6331b8acae24cfd2dd2b14696c75040685c756942a0d049ee9863a2e480388f93876f3910ecb3a59fa16c25b2b3636a542f92744495e10a4ce37f19f5c2256e2d61775d388e2a86b52f76add2f956aa02501f5badb94da12595b2bbf88b05dc70caae6766fd3df4f299d0ff71c8787249b255ea49b3d33b3f1a8c9403cb75d64264465c3578538382b23d721f8a49134020ca2d9e887d9949624ac6d63322b6507e277a0020db9bfa2928736b96c72fa3406a95adfe6b374ffa27001d37d3bbe725e75c257834572026c511f57dce67153a4008f9e75e07ed9237f600005800ee667c137fc78bc4fd4ebf4d228979ab0ccafbcd8b8daad76fb2abcfc585377ea6e19f170db898b950a7b0f4e75466a2ba26e7d60e0a6f5c54a3fe78677f3362c5b01ae791b62ee8a5d0fd65b739ece4f3b758d05a8e4e4ea7e4866ee67750ce2769f72a9f45780eadfae73b42d4dd4c614c797c694ece8af88cc732edabfa26ace57de54835c7551154dfa3be11a0d3b5845ac97b2da84410a652e72cd563acbb2b02bb59370cebaaa80014e3ad280944eae6fbf8d5f85237257bb5b8e5ec3e52dcf1f8394176b325a577804e9eb78d7015172d17ed15f905f705d56687f53988bb207c74fbeb2b03a700258e835362886239f4d8f1c2cf6d4d10ff26d2579ea40a5fb99e5b6d01cdeda050d3faa78ed674f2899be08332086c8bf0410a7d06099c50a2d949d49a0f21b43bcdfbdf435875cf5a9def46db63746574ee8a5b1fbcef411154e914dd9e5bb1b1bd2944581083fb66a017e7972df3daefc487e4198cb281d3a80637d52b41738b7f1a57c867d5b2ee5d72465657593339506fd0c30000d6445eb54cfb5ca9d35ef93eec6383224ebf85197eb6ed75f6c324f6a0345a25be6bb52ed347e57ccb059b903fb7db4e9f46513a4158ce29c1f5d6081b556bbc471e89225cad81aed34dae0f90ee8e7237b3b286e29b49d7a1700c537b28571f7d7e2a55e10792d6f7779ddefa3febdea5693048372a45903c04f1034581aac02f8a70e698be6e37fd411cf4b76317b47683f6b0f80dfdeef3a9767c7e5c30dff786093a21477431fea0458023953700"}) rseq(&(0x7f0000001040)={0x0, 0x0, 0x0, 0x4}, 0x20, 0x0, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) futex(r0, 0x7, 0x40000002, 0x0, r0, 0xffffffff) 4.760666364s ago: executing program 0 (id=2580): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x0, 0x11, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000000000000850000006a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x11, &(0x7f0000000200)=ANY=[], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r1}, 0xc) 4.642739516s ago: executing program 0 (id=2581): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000a00)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000a40)={0x0, 0x9}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000a80)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r0, &(0x7f0000000ac0)=[{{&(0x7f0000000b00)={0xa, 0x4e23, 0x0, @loopback, 0x50000000}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000b80)='\x00', 0x1}], 0x1}}], 0x1, 0x80) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000bc0)=ANY=[@ANYBLOB="12e01b3989dd", @ANYRES32=r0], 0x1000f) 3.773908645s ago: executing program 3 (id=2582): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0x6d1, 0x0, 0x0, 0x1000, 0x5}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_queues(r0, r6, &(0x7f0000000540)={0x0, 0x1aa5, 0x80, 0x2, 0x20000, 0x0, r1}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x1, 0x1, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x200, 0x0, 0x69, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffe, 0x4, 0x10000, 0xea}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6253, 0x2000, 0x3, 0x0, 0x0, r0}}], 0x1, &(0x7f00000003c0)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r5, '\x00', {0x100, 0xdbd, 0x0, 0x0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0x0, 0xffffffdb, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, 0x94) 3.766398386s ago: executing program 8 (id=2583): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r1, &(0x7f00000000c0)="c8", &(0x7f0000000000)=""/3, 0x2}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000003000000000000000040000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000005000000850000000600000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r2}, 0xc) 3.760404797s ago: executing program 4 (id=2584): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000040)={[0xa, 0x80000000000000, 0x4, 0x800000000000000d, 0x1000, 0x2, 0x1002, 0x9, 0x10000000000b, 0x81, 0x2, 0x2375, 0x8bd8, 0x7, 0xa3e, 0x208], 0x25000, 0x116156}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.639594279s ago: executing program 0 (id=2585): r0 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000180)=0x6, 0x4) setsockopt$inet_int(r0, 0x0, 0x14, &(0x7f0000000140)=0x400030, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000000380)={@broadcast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) 3.497214223s ago: executing program 8 (id=2586): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x140, 0x10, 0x1, 0xfffffffe, 0x25dfdbfd, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1, 0x1, 0x714, 0x4e23, 0x2, 0x0, 0x0, 0x80, 0x3c}, {@in=@dev={0xac, 0x14, 0x14, 0xe}, 0x4d4, 0x6c}, @in=@multicast2, {0x20000, 0x192, 0x6, 0xffff, 0x8251a, 0x1, 0xfffffffffffffff8, 0x2}, {0xffffffffffffffff, 0x2a, 0x1f, 0x101}, {0x6, 0xfffffffc, 0xffffffbc}, 0x70bd2a, 0x0, 0x2, 0x1, 0x0, 0x60}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @XFRMA_IF_ID={0x8, 0x1f, 0x2}]}, 0x140}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa}, {}, 0x0, 0x0, 0x1}, {{@in6=@dev, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x1c) 3.388711144s ago: executing program 4 (id=2587): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xe, &(0x7f0000000080)=0xe0e, 0x4) bind$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x1, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000000c0)=@req={0x1000, 0x4, 0x800, 0x8}, 0x10) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x0) write(r0, &(0x7f0000000000)="01", 0x1) 3.369670866s ago: executing program 3 (id=2588): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f00000001c0)={@my=0x1}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) close(0x3) syz_usb_connect$uac1(0x5, 0x0, 0x0, 0x0) 3.206930073s ago: executing program 4 (id=2589): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x8080, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'syzkaller0\x00', 0x2}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x44, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x1, 0x0, 0x1}}]}}]}, 0x44}}, 0x4084) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000640)=@newqdisc={0x170, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0xfffffffffffffcfb, 0x1, {0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x0) 2.978463166s ago: executing program 8 (id=2590): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000040)={0x0, 0xc1, 0x1, 0xfffffffd, 0x1f7}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x400, 0x3, 0x91}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x0, 0x26d}}], 0x1, 0x0, 0x0) mmap$IORING_OFF_SQES(0x0, 0x8, 0x1000008, 0x6206011, r3, 0x10000000) 2.934135401s ago: executing program 4 (id=2591): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000040), 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_DISABLE(r1, &(0x7f0000000180)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[], 0x14}}, 0x800) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000280)={'syz_tun\x00', &(0x7f00000002c0)=@ethtool_link_settings={0x2, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x20, 0x8, [0x0, 0x0, 0x0, 0x100, 0x5, 0xfffffffc, 0x0, 0x2]}}) 2.783982806s ago: executing program 8 (id=2592): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@ipv4_newnexthop={0x20, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_OIF={0x8, 0x5, 0x1}]}, 0x20}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@ipv4_newnexthop={0x20, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_OIF={0x8, 0x5, 0x1}]}, 0x20}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newnexthop={0x2c, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_GROUP={0x14, 0x2, [{0x1, 0x1}, {0x2, 0x1}]}]}, 0x2c}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@newlink={0x28, 0x10, 0x1, 0x70bd29, 0x259fdbfd, {0x0, 0x0, 0x0, 0x0, 0x21120, 0x68591}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x4000804) 2.732290191s ago: executing program 4 (id=2593): syz_open_dev$dri(&(0x7f0000000540), 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = fsopen(&(0x7f00000000c0)='ext4\x00', 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870fd00090582020002"], 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x12, &(0x7f0000000140)=ANY=[@ANYBLOB="a200004ef3b11f948ef66b0ee0b3d41b1b", @ANYRES16=r0]) 2.663586448s ago: executing program 0 (id=2594): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x6, 0x10, &(0x7f0000000e40)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000300000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000008000000850000001c00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) socket$l2tp(0x2, 0x2, 0x73) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010000500000000000000037f00040000", @ANYRES32=r1, @ANYBLOB="0200000000008000800012000800010076746936740002"], 0xa0}, 0x1, 0x0, 0x0, 0x8000}, 0x24040000) 653.714103ms ago: executing program 3 (id=2595): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1ab640, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x25000, 0x9000}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000000c0)={0xb000, 0x103000, 0x1}) fanotify_mark(0xffffffffffffffff, 0xffffff80, 0x40001019, 0xffffffffffffffff, 0x0) 613.995527ms ago: executing program 4 (id=2596): ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000100), 0x0, 0x822b01) openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000005740)={0x50, 0x0, 0x0, {0x7, 0x27, 0x0, 0x14a4014, 0x0, 0x2, 0x0, 0xfffffffd, 0x0, 0x0, 0x10, 0xfffffffe}}, 0x50) pselect6(0x40, &(0x7f0000007d40)={0x0, 0x0, 0x0, 0x0, 0x7e6b, 0x3, 0x7}, 0x0, &(0x7f0000007d80)={0x1d, 0x0, 0x800, 0x0, 0x3, 0x0, 0x6a9}, 0x0, 0x0) write$char_usb(r0, &(0x7f0000000140)="e2", 0xff0f) 315.174968ms ago: executing program 3 (id=2597): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in6=@empty, 0x0, 0x0, 0x0, 0x4c, 0xa, 0x20, 0x0, 0x8}, {0x8, 0x10, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000000, 0x0, 0x8}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}, 0x1, 0x0, 0x0, 0x48004}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}}}, 0xb8}}, 0x2c000010) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a00000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000020003000000000000000000000000000000000000000000050d000000000000fbffffffffffffff000000000000000000000000000040000000000000000002000000000000000002"], 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 131.517247ms ago: executing program 3 (id=2598): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {0x0, 0x0, 0xb}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/net/netfilter/nfnetlink_log\x00', 0x0, 0x0) read(r1, &(0x7f0000000280), 0x1000) 0s ago: executing program 3 (id=2599): r0 = gettid() r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) read(r1, &(0x7f00000006c0)=""/209, 0xd1) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f00000007c0)={0x335, @time={0x101, 0x10001}, 0x1b, {}, 0x2, 0x0, 0x6}) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r1, 0x40045304, &(0x7f0000000800)) tkill(r0, 0x7) kernel console output (not intermixed with test programs): rface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 386.347144][ T5905] usb 9-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 386.361541][ T5905] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 386.380704][ T5905] usb 9-1: config 0 descriptor?? [ 386.386862][ T9790] usb 1-1: Using ep0 maxpacket: 32 [ 386.414075][ T9790] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 386.425708][ T5925] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 386.435230][ T9790] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 386.447792][ T9790] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 386.457932][ T9790] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 386.477320][ T9790] usb 1-1: config 0 descriptor?? [ 386.506962][ T9790] hub 1-1:0.0: USB hub found [ 386.643810][ T5925] usb 5-1: Using ep0 maxpacket: 16 [ 386.668545][ T5905] iowarrior 9-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 386.669617][ T5925] usb 5-1: New USB device found, idVendor=14f7, idProduct=0500, bcdDevice=44.85 [ 386.731098][ T5925] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 386.742921][ T9790] hub 1-1:0.0: 1 port detected [ 386.750098][ T5925] usb 5-1: Product: syz [ 386.760066][ T5925] usb 5-1: Manufacturer: syz [ 386.802545][ T5925] usb 5-1: SerialNumber: syz [ 386.814354][ T5925] usb 5-1: config 0 descriptor?? [ 386.829373][ T5925] usb 5-1: selecting invalid altsetting 1 [ 386.835687][ T5925] technisat-usb2: could not set alternate setting to 0 [ 387.058731][ T5925] technisat-usb2: firmware version: 0.0 [ 387.073635][ T5925] dvb-usb: found a 'Technisat SkyStar USB HD (DVB-S/S2)' in warm state. [ 387.236708][ T9790] usb 9-1: USB disconnect, device number 6 [ 387.468954][ T5925] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 387.492466][ T5925] dvbdev: DVB: registering new adapter (Technisat SkyStar USB HD (DVB-S/S2)) [ 387.508286][ T5925] usb 5-1: media controller created [ 387.518093][ T5925] technisat-usb2: i2c-error: out failed 53 = -22 [ 387.551493][ T5925] dvb-usb: MAC address reading failed. [ 387.592889][ T5925] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 387.666807][T12520] technisat-usb2: i2c TX buffer can't exceed 62 bytes (dev 0x01) [ 387.690062][T12520] technisat-usb2: i2c-error: out failed 01 = -22 [ 387.717683][ T9790] hub 1-1:0.0: activate --> -90 [ 387.763369][ T5925] DVB: Unable to find symbol stv090x_attach() [ 387.785108][ T5925] dvb-usb: no frontend was attached by 'Technisat SkyStar USB HD (DVB-S/S2)' [ 387.924815][ T27] usb 1-1: USB disconnect, device number 6 [ 387.953544][ T5925] rc_core: IR keymap rc-technisat-usb2 not found [ 387.968230][ T5925] Registered IR keymap rc-empty [ 388.007618][ T5925] rc rc0: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 388.050700][ T5925] input: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input18 [ 388.084774][ T5925] dvb-usb: schedule remote query interval to 100 msecs. [ 388.092860][ T5925] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully initialized and connected. [ 388.113026][ T5925] usb 5-1: USB disconnect, device number 21 [ 388.150283][T12557] loop8: detected capacity change from 0 to 256 [ 388.190300][T12557] exFAT-fs (loop8): failed to load upcase table (idx : 0x0001fe89, chksum : 0xeb34f926, utbl_chksum : 0xe619d30d) [ 388.256330][ T5925] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully deinitialized and disconnected. [ 388.780282][T12570] sctp: [Deprecated]: syz.4.1812 (pid 12570) Use of int in max_burst socket option deprecated. [ 388.780282][T12570] Use struct sctp_assoc_value instead [ 389.137459][T12582] loop8: detected capacity change from 0 to 8 [ 389.184933][T12582] Dev loop8: unable to read RDB block 8 [ 389.193817][T12582] loop8: unable to read partition table [ 389.199787][T12582] loop8: partition table beyond EOD, truncated [ 389.212788][T12582] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 389.527340][T12597] netlink: 24 bytes leftover after parsing attributes in process `syz.9.1821'. [ 389.644578][T12601] loop5: detected capacity change from 0 to 7 [ 389.678524][T12601] Dev loop5: unable to read RDB block 7 [ 389.688132][T12601] loop5: unable to read partition table [ 389.704862][T12601] loop5: partition table beyond EOD, truncated [ 389.711419][T12604] netlink: 'syz.0.1823': attribute type 1 has an invalid length. [ 389.719568][T12601] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 389.836066][T12604] bond1: entered promiscuous mode [ 389.841176][T12604] bond1: entered allmulticast mode [ 389.877353][T12604] 8021q: adding VLAN 0 to HW filter on device bond1 [ 389.919570][T12613] loop9: detected capacity change from 0 to 256 [ 389.971825][T12609] erspan1: entered allmulticast mode [ 389.991462][T12613] exFAT-fs (loop9): failed to load upcase table (idx : 0x00010321, chksum : 0x3a8a43f6, utbl_chksum : 0xe619d30d) [ 390.038544][T12609] bond1: (slave erspan1): making interface the new active one [ 390.116776][T12609] erspan1: entered promiscuous mode [ 390.132893][ T28] kauditd_printk_skb: 4 callbacks suppressed [ 390.132911][ T28] audit: type=1800 audit(1700000013.430:277): pid=12613 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.9.1833" name="file1" dev="loop9" ino=1048765 res=0 errno=0 [ 390.180628][T12609] bond1: (slave erspan1): Enslaving as an active interface with an up link [ 390.207369][T12617] syz_tun: entered allmulticast mode [ 390.220399][T12621] lo: entered allmulticast mode [ 390.255157][T12615] lo: left allmulticast mode [ 390.291305][T12614] syz_tun: left allmulticast mode [ 391.243758][ T5905] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 391.465499][ T5905] usb 9-1: Using ep0 maxpacket: 32 [ 391.484357][ T5905] usb 9-1: config 0 has an invalid interface number: 12 but max is 0 [ 391.504878][ T5905] usb 9-1: config 0 has no interface number 0 [ 391.511104][ T5905] usb 9-1: config 0 interface 12 has no altsetting 0 [ 391.563070][ T5905] usb 9-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 391.582481][ T5905] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 391.627822][ T5905] usb 9-1: Product: syz [ 391.632094][ T5905] usb 9-1: Manufacturer: syz [ 391.647383][ T5905] usb 9-1: SerialNumber: syz [ 391.668637][ T5905] usb 9-1: config 0 descriptor?? [ 391.904374][T12669] kvm: kvm [12668]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 391.926280][T12669] kvm: kvm [12668]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 392.570291][T12691] loop9: detected capacity change from 0 to 128 [ 392.596789][T12691] EXT4-fs (loop9): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 392.652308][T12691] ext4 filesystem being mounted at /120/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 392.922475][ T5905] f81534 9-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 392.930601][T10495] EXT4-fs (loop9): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 392.948162][ T5905] f81534 9-1:0.12: f81534_find_config_idx: read failed: -71 [ 393.000473][ T5905] f81534 9-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 393.023042][ T5905] f81534: probe of 9-1:0.12 failed with error -71 [ 393.049841][T12701] loop0: detected capacity change from 0 to 512 [ 393.078518][ T5905] usb 9-1: USB disconnect, device number 7 [ 393.370706][T12708] loop4: detected capacity change from 0 to 2048 [ 393.402677][T12708] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 393.657234][T12719] loop4: detected capacity change from 0 to 128 [ 393.663963][ T5875] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 393.730922][T12719] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 393.801569][T12719] ext4 filesystem being mounted at /473/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 393.899963][ T5875] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 393.932773][ T5875] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 179, changing to 11 [ 393.967988][ T5875] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 393.990710][ T5875] usb 1-1: New USB device found, idVendor=06cb, idProduct=2968, bcdDevice= 0.00 [ 394.005150][ T5875] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 394.017301][ T5875] usb 1-1: config 0 descriptor?? [ 394.033606][ T27] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 394.232919][ T27] usb 10-1: Using ep0 maxpacket: 32 [ 394.247414][ T27] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 394.273745][ T27] usb 10-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 394.283908][ T27] usb 10-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 394.303953][ T5960] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 394.304368][ T27] usb 10-1: Product: syz [ 394.327076][ T27] usb 10-1: Manufacturer: syz [ 394.332180][ T27] usb 10-1: SerialNumber: syz [ 394.380495][ T27] usb 10-1: config 0 descriptor?? [ 394.418446][T12724] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 394.470799][ T5875] itetech 0003:06CB:2968.0012: unknown main item tag 0x0 [ 394.510113][ T5875] itetech 0003:06CB:2968.0012: unknown main item tag 0x0 [ 394.535160][ T5875] itetech 0003:06CB:2968.0012: unknown main item tag 0x0 [ 394.551073][ T5875] itetech 0003:06CB:2968.0012: unknown main item tag 0x0 [ 394.565150][ T5875] itetech 0003:06CB:2968.0012: unknown main item tag 0x0 [ 394.578131][ T5875] itetech 0003:06CB:2968.0012: unknown main item tag 0x0 [ 394.617242][ T5875] itetech 0003:06CB:2968.0012: hidraw0: USB HID v21.0a Device [HID 06cb:2968] on usb-dummy_hcd.0-1/input0 [ 394.666951][ T5875] usb 1-1: USB disconnect, device number 7 [ 394.974187][T12737] fido_id[12737]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 395.668255][ T5878] usb 10-1: USB disconnect, device number 2 [ 396.346948][T12775] loop4: detected capacity change from 0 to 1024 [ 396.382079][T12775] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 396.444369][T12775] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 396.595043][ T5960] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 396.863846][T12791] loop5: detected capacity change from 0 to 7 [ 397.040426][T12791] Dev loop5: unable to read RDB block 7 [ 397.047066][T12791] loop5: unable to read partition table [ 397.071347][T12791] loop5: partition table beyond EOD, truncated [ 397.114790][T12791] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 397.549856][T12813] netlink: 25 bytes leftover after parsing attributes in process `syz.8.1874'. [ 397.598513][T12813] eql: entered promiscuous mode [ 397.644547][T12814] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1875'. [ 397.715560][T12813] netlink: 45349 bytes leftover after parsing attributes in process `syz.8.1874'. [ 397.747496][T12813] 0ªX¹¦Dö»: renamed from eql [ 397.824347][T12813] 0ªX¹¦Dö»: remember to turn off Van-Jacobson compression on your slave devices [ 397.844442][T12813] 0ªX¹¦Dö»: left promiscuous mode [ 397.850279][T12813] 0ªX¹¦Dö»: entered allmulticast mode [ 398.071320][T12825] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 398.198013][T12825] overlayfs: failed to look up (tracing) for ino (-66) [ 398.854293][T12859] all: renamed from lo (while UP) [ 399.548588][ T28] audit: type=1326 audit(1700000022.851:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12875 comm="syz.0.1893" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7effa719f559 code=0x0 [ 399.579723][T12882] loop5: detected capacity change from 0 to 7 [ 399.596907][T12882] Dev loop5: unable to read RDB block 7 [ 399.608879][T12882] loop5: unable to read partition table [ 399.621504][T12882] loop5: partition table beyond EOD, truncated [ 399.631710][T12882] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 399.808220][T12886] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1895'. [ 399.836068][T12886] netlink: 14 bytes leftover after parsing attributes in process `syz.4.1895'. [ 400.452753][ T8384] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 400.632511][ T8384] usb 5-1: Using ep0 maxpacket: 8 [ 400.640043][ T8384] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 400.658970][T12912] 9pnet: p9_errstr2errno: server reported unknown error õ€ÿ0xffffffffffffffff [ 400.659443][ T8384] usb 5-1: config 0 has no interface number 0 [ 400.711350][ T8384] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 400.740145][ T8384] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 400.762467][ T8384] usb 5-1: Product: syz [ 400.778059][ T8384] usb 5-1: Manufacturer: syz [ 400.796827][ T8384] usb 5-1: SerialNumber: syz [ 400.814527][ T8384] usb 5-1: config 0 descriptor?? [ 401.043311][ T8384] usb 5-1: Found UVC 0.04 device syz (046d:08c3) [ 401.070238][ T8384] usb 5-1: Failed to initialize entity for entity 6 [ 401.084603][ T8384] usb 5-1: Failed to register entities (-22). [ 401.279788][ T8384] usb 5-1: USB disconnect, device number 22 [ 401.912554][ T5925] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 402.133162][ T5925] usb 9-1: Using ep0 maxpacket: 32 [ 402.151251][ T5925] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 402.183138][ T5925] usb 9-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 402.202853][ T5925] usb 9-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 402.211111][ T5925] usb 9-1: Product: syz [ 402.225539][ T5925] usb 9-1: Manufacturer: syz [ 402.230221][ T5925] usb 9-1: SerialNumber: syz [ 402.264278][ T5925] usb 9-1: config 0 descriptor?? [ 402.271698][T12951] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 402.313720][ T5925] hub 9-1:0.0: bad descriptor, ignoring hub [ 402.319748][ T5925] hub: probe of 9-1:0.0 failed with error -5 [ 402.409946][T12977] loop4: detected capacity change from 0 to 64 [ 402.755569][ T9790] usb 9-1: USB disconnect, device number 8 [ 402.881485][T12992] vhci_hcd vhci_hcd.0: Expecting SOCK_STREAM - found 3 [ 403.079722][T13002] loop9: detected capacity change from 0 to 128 [ 403.112529][ T23] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 403.200672][T13005] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 [ 403.305276][ T23] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 403.334257][ T23] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 403.368976][ T23] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 403.409707][ T23] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 403.430500][ T23] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 403.459744][ T23] usb 1-1: config 0 descriptor?? [ 403.948045][ T23] plantronics 0003:047F:FFFF.0013: No inputs registered, leaving [ 403.987868][ T23] plantronics 0003:047F:FFFF.0013: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 404.442848][T13037] block device autoloading is deprecated and will be removed. [ 404.702562][T13043] FAULT_INJECTION: forcing a failure. [ 404.702562][T13043] name failslab, interval 1, probability 0, space 0, times 0 [ 404.729148][T13043] CPU: 0 PID: 13043 Comm: syz.8.1933 Not tainted syzkaller #0 [ 404.736756][T13043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 404.746882][T13043] Call Trace: [ 404.750211][T13043] [ 404.753207][T13043] dump_stack_lvl+0x18c/0x250 [ 404.757955][T13043] ? show_regs_print_info+0x20/0x20 [ 404.763230][T13043] ? load_image+0x420/0x420 [ 404.767823][T13043] ? __might_sleep+0xe0/0xe0 [ 404.772466][T13043] ? __lock_acquire+0x7eb0/0x7eb0 [ 404.777563][T13043] should_fail_ex+0x394/0x4c0 [ 404.782305][T13043] should_failslab+0x9/0x20 [ 404.786884][T13043] slab_pre_alloc_hook+0x59/0x300 [ 404.792007][T13043] ? __get_vm_area_node+0x125/0x370 [ 404.797277][T13043] __kmem_cache_alloc_node+0x53/0x260 [ 404.802699][T13043] ? __get_vm_area_node+0x125/0x370 [ 404.807960][T13043] kmalloc_node_trace+0x26/0xe0 [ 404.812864][T13043] __get_vm_area_node+0x125/0x370 [ 404.817950][T13043] ? bpf_map_area_alloc+0x5e/0x110 [ 404.823118][T13043] vmap+0x126/0x2a0 [ 404.827019][T13043] ? bpf_ringbuf_alloc+0x30e/0x530 [ 404.832177][T13043] bpf_ringbuf_alloc+0x30e/0x530 [ 404.837199][T13043] ringbuf_map_alloc+0x1b0/0x2e0 [ 404.842203][T13043] map_create+0x877/0x12f0 [ 404.846696][T13043] __sys_bpf+0x651/0x890 [ 404.850978][T13043] ? bpf_link_show_fdinfo+0x560/0x560 [ 404.856414][T13043] ? lock_chain_count+0x20/0x20 [ 404.861308][T13043] __x64_sys_bpf+0x7c/0x90 [ 404.865757][T13043] do_syscall_64+0x55/0xb0 [ 404.870214][T13043] ? clear_bhb_loop+0x40/0x90 [ 404.874931][T13043] ? clear_bhb_loop+0x40/0x90 [ 404.879661][T13043] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 404.885617][T13043] RIP: 0033:0x7f269799f559 [ 404.890072][T13043] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 404.909716][T13043] RSP: 002b:00007f269880b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 404.918177][T13043] RAX: ffffffffffffffda RBX: 00007f2697c25fa0 RCX: 00007f269799f559 [ 404.926190][T13043] RDX: 0000000000000050 RSI: 0000200000000200 RDI: 0000000000000000 [ 404.934187][T13043] RBP: 00007f2697a36b20 R08: 0000000000000000 R09: 0000000000000000 [ 404.942187][T13043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 404.950214][T13043] R13: 00007f2697c26038 R14: 00007f2697c25fa0 R15: 00007ffe6475cce8 [ 404.958231][T13043] [ 405.221459][T13051] rxe_eth0 speed is unknown, defaulting to 1000 [ 405.792444][ T5905] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 406.022155][ T5905] usb 9-1: Using ep0 maxpacket: 16 [ 406.030756][ T5905] usb 9-1: config 0 has an invalid interface number: 98 but max is 0 [ 406.044465][ T5905] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 406.077724][ T5905] usb 9-1: config 0 has no interface number 0 [ 406.096176][ T5905] usb 9-1: config 0 interface 98 altsetting 2 bulk endpoint 0x8 has invalid maxpacket 16 [ 406.124384][ T5905] usb 9-1: config 0 interface 98 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 406.134972][ T9] usb 1-1: USB disconnect, device number 8 [ 406.150044][ T5905] usb 9-1: config 0 interface 98 has no altsetting 0 [ 406.179549][ T5905] usb 9-1: New USB device found, idVendor=0846, idProduct=1040, bcdDevice=d0.c9 [ 406.211603][ T5905] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.252782][ T5905] usb 9-1: Product: syz [ 406.257039][ T5905] usb 9-1: Manufacturer: syz [ 406.268514][ T5905] usb 9-1: SerialNumber: syz [ 406.291577][ T5905] usb 9-1: config 0 descriptor?? [ 406.308546][T13059] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 406.320622][T13059] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 406.413025][ T52] Bluetooth: hci3: command 0x0406 tx timeout [ 406.451385][T13080] bond3: entered promiscuous mode [ 406.457770][T13080] 8021q: adding VLAN 0 to HW filter on device bond3 [ 406.625547][T13059] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 406.672274][T13059] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 407.027567][T13099] netlink: 'syz.0.1947': attribute type 25 has an invalid length. [ 407.039014][T13099] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1947'. [ 407.084701][T13099] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 407.094833][T13099] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 407.103695][T13099] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 407.112589][T13099] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 407.157838][T13099] netlink: 'syz.0.1947': attribute type 25 has an invalid length. [ 407.185848][T13099] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1947'. [ 407.721371][ T5905] asix 9-1:0.98 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 407.773667][ T5905] asix: probe of 9-1:0.98 failed with error -71 [ 407.795229][ T5905] usb 9-1: USB disconnect, device number 9 [ 408.063997][T13126] netlink: 9 bytes leftover after parsing attributes in process `syz.0.1953'. [ 408.094812][T13126] gretap0: entered promiscuous mode [ 408.137487][T13126] netlink: 5 bytes leftover after parsing attributes in process `syz.0.1953'. [ 408.147016][T13126] 0ªî{X¹¦: renamed from gretap0 [ 408.157099][T13126] 0ªî{X¹¦: left promiscuous mode [ 408.162714][T13126] 0ªî{X¹¦: entered allmulticast mode [ 408.174079][T13126] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 408.427490][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802db7f800: rx timeout, send abort [ 408.436163][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88802db7f800: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 408.704359][T13146] loop4: detected capacity change from 0 to 4096 [ 408.726664][T13146] EXT4-fs: Ignoring removed mblk_io_submit option [ 408.749068][T13146] EXT4-fs (loop4): Test dummy encryption mode enabled [ 408.766630][T13151] ip_tables: iptables: counters copy to user failed while replacing table [ 408.811129][T13146] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 409.101504][ T5960] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 409.408443][T13144] loop8: detected capacity change from 0 to 32768 [ 409.450908][T13144] XFS (loop8): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 409.552124][ T27] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 409.597406][T13144] XFS (loop8): Ending clean mount [ 409.672578][T13179] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 409.726804][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802db7f400: rx timeout, send abort [ 409.735583][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88802db7f400: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 409.774749][ T27] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 409.793826][ T27] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 409.841289][ T27] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 409.866142][ T27] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 409.881991][ T27] usb 5-1: SerialNumber: syz [ 410.080686][ T9962] XFS (loop8): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 410.108081][ T27] usb 5-1: 0:2 : does not exist [ 410.132178][ T27] usb 5-1: unit 3 not found! [ 410.169237][ T27] usb 5-1: USB disconnect, device number 23 [ 410.325943][T10932] udevd[10932]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 410.781247][T13211] loop4: detected capacity change from 0 to 256 [ 410.787787][T13206] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 410.834132][T13211] exfat: Deprecated parameter 'utf8' [ 410.839648][T13211] exfat: Deprecated parameter 'namecase' [ 410.887722][T13211] exFAT-fs (loop4): failed to load upcase table (idx : 0x0001fe89, chksum : 0xc374f927, utbl_chksum : 0xe619d30d) [ 411.885410][T13241] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 411.912739][T13245] dccp_invalid_packet: P.Data Offset(80) too large [ 412.231216][T13259] netlink: 1363 bytes leftover after parsing attributes in process `syz.4.1989'. [ 412.550096][T13272] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1994'. [ 412.605638][T13275] loop4: detected capacity change from 0 to 256 [ 412.622106][ T5875] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 412.647091][T13275] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d) [ 412.821689][ T5875] usb 1-1: Using ep0 maxpacket: 8 [ 412.834637][ T5875] usb 1-1: config 0 has an invalid interface number: 31 but max is 0 [ 412.861793][ T5875] usb 1-1: config 0 has no interface number 0 [ 412.884712][ T5875] usb 1-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 412.896246][T13281] io-wq is not configured for unbound workers [ 412.906086][ T5875] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.952931][ T5875] usb 1-1: Product: syz [ 412.957182][ T5875] usb 1-1: Manufacturer: syz [ 412.975404][ T5875] usb 1-1: SerialNumber: syz [ 412.992071][ T5875] usb 1-1: config 0 descriptor?? [ 413.241398][ T5875] usb 1-1: Found UVC 0.04 device syz (046d:08c3) [ 413.262493][ T5875] usb 1-1: Failed to initialize entity for entity 6 [ 413.269184][ T5875] usb 1-1: Failed to register entities (-22). [ 413.409758][T13303] FAULT_INJECTION: forcing a failure. [ 413.409758][T13303] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 413.436487][T13303] CPU: 1 PID: 13303 Comm: syz.4.2004 Not tainted syzkaller #0 [ 413.444042][T13303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 413.454150][T13303] Call Trace: [ 413.457490][T13303] [ 413.460476][T13303] dump_stack_lvl+0x18c/0x250 [ 413.465226][T13303] ? show_regs_print_info+0x20/0x20 [ 413.470487][T13303] ? load_image+0x420/0x420 [ 413.475051][T13303] ? __might_fault+0xaa/0x120 [ 413.479792][T13303] ? __lock_acquire+0x7eb0/0x7eb0 [ 413.484893][T13303] ? __virt_addr_valid+0x10c/0x380 [ 413.490083][T13303] should_fail_ex+0x394/0x4c0 [ 413.494837][T13303] _copy_to_user+0x2f/0xa0 [ 413.499330][T13303] bpf_verifier_vlog+0x5ac/0x840 [ 413.504350][T13303] btf_verifier_log+0x11e/0x1a0 [ 413.509278][T13303] ? btf_parse_graph_root+0xb00/0xb00 [ 413.514710][T13303] ? __btf_verifier_log+0xe3/0x140 [ 413.519895][T13303] ? btf_check_sec_info+0x350/0x350 [ 413.525172][T13303] btf_func_proto_log+0x658/0x850 [ 413.530274][T13303] __btf_verifier_log_type+0x457/0x690 [ 413.535808][T13303] ? btf_int_show+0x2810/0x2810 [ 413.540737][T13303] btf_func_proto_check_meta+0xed/0x150 [ 413.546357][T13303] btf_check_all_metas+0x371/0xaf0 [ 413.551554][T13303] btf_parse_type_sec+0xfc/0x1960 [ 413.556632][T13303] ? btf_check_sec_info+0x350/0x350 [ 413.561881][T13303] ? __virt_addr_valid+0x10c/0x380 [ 413.567033][T13303] ? btf_verifier_log+0x1a0/0x1a0 [ 413.572104][T13303] ? btf_parse_hdr+0x545/0x700 [ 413.576919][T13303] ? btf_parse_str_sec+0x20d/0x2a0 [ 413.582077][T13303] btf_new_fd+0x440/0x9e0 [ 413.586485][T13303] ? bpf_btf_show_fdinfo+0x80/0x80 [ 413.591640][T13303] ? capable+0x88/0xe0 [ 413.595761][T13303] __sys_bpf+0x670/0x890 [ 413.600047][T13303] ? bpf_link_show_fdinfo+0x560/0x560 [ 413.605488][T13303] ? lock_chain_count+0x20/0x20 [ 413.610387][T13303] __x64_sys_bpf+0x7c/0x90 [ 413.614844][T13303] do_syscall_64+0x55/0xb0 [ 413.619435][T13303] ? clear_bhb_loop+0x40/0x90 [ 413.624170][T13303] ? clear_bhb_loop+0x40/0x90 [ 413.628896][T13303] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 413.634855][T13303] RIP: 0033:0x7fb35c79f559 [ 413.639312][T13303] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 413.658964][T13303] RSP: 002b:00007fb35d692028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 413.667413][T13303] RAX: ffffffffffffffda RBX: 00007fb35ca25fa0 RCX: 00007fb35c79f559 [ 413.675430][T13303] RDX: 0000000000000028 RSI: 0000200000001b40 RDI: 0000000000000012 [ 413.683432][T13303] RBP: 00007fb35c836b20 R08: 0000000000000000 R09: 0000000000000000 [ 413.691431][T13303] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 413.699436][T13303] R13: 00007fb35ca26038 R14: 00007fb35ca25fa0 R15: 00007ffdae967f28 [ 413.707451][T13303] [ 413.750637][ T5875] usb 1-1: USB disconnect, device number 9 [ 414.445424][T13326] ip_tables: iptables: counters copy to user failed while replacing table [ 414.462071][T13333] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 414.518823][T13326] ip_tables: iptables: counters copy to user failed while replacing table [ 414.757243][T13337] bridge0: port 2(bridge_slave_1) entered blocking state [ 414.764521][T13337] bridge0: port 2(bridge_slave_1) entered forwarding state [ 414.848209][T13314] loop4: detected capacity change from 0 to 32768 [ 414.940770][T13314] XFS (loop4): Mounting V5 Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a [ 415.100996][T13314] XFS (loop4): Ending clean mount [ 415.157780][T13314] XFS (loop4): Quotacheck needed: Please wait. [ 415.319657][T13314] XFS (loop4): Quotacheck: Done. [ 415.459065][ T28] audit: type=1800 audit(1700000038.752:279): pid=13314 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2007" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop4" ino=6156 res=0 errno=0 [ 415.523657][T13332] loop9: detected capacity change from 0 to 40427 [ 415.570600][T13332] F2FS-fs (loop9): Fix alignment : done, start(4096) end(16896) block(12288) [ 415.633156][T13332] F2FS-fs (loop9): invalid crc value [ 415.649910][T13332] F2FS-fs (loop9): invalid crc value [ 415.661662][T13332] F2FS-fs (loop9): Failed to get valid F2FS checkpoint [ 416.050216][ T5960] XFS (loop4): Unmounting Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a [ 416.249726][T13382] loop9: detected capacity change from 0 to 1024 [ 416.293469][T13382] EXT4-fs (loop9): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 416.469233][T13382] EXT4-fs error (device loop9): ext4_read_block_bitmap_nowait:478: comm syz.9.2023: Invalid block bitmap block 0 in block_group 0 [ 416.536718][T13382] EXT4-fs (loop9): Remounting filesystem read-only [ 416.555172][T13382] Quota error (device loop9): write_blk: dquota write failed [ 416.565329][T13382] Quota error (device loop9): qtree_write_dquot: Error -117 occurred while creating quota [ 416.579669][T13382] EXT4-fs (loop9): 1 orphan inode deleted [ 416.588893][T13382] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 416.775331][T10495] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 417.005412][T13406] vivid-001: disconnect [ 417.049751][T13404] vivid-001: reconnect [ 417.207375][T13414] loop4: detected capacity change from 0 to 128 [ 417.261555][T13414] EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem [ 417.350940][T13414] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 417.369908][T13414] ext2 filesystem being mounted at /521/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 417.656195][T13414] EXT4-fs error (device loop4): dx_make_map:1328: inode #2: block 63: comm syz.4.2029: bad entry in directory: inode out of bounds - offset=988, inode=128, rec_len=36, size=1024 fake=1 [ 417.721760][T13414] EXT4-fs error (device loop4) in do_split:2097: Corrupt filesystem [ 417.775766][ T5802] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 417.787636][ T5802] Bluetooth: hci1: Injecting HCI hardware error event [ 417.802818][ T5802] Bluetooth: hci1: hardware error 0x00 [ 418.025530][ T5960] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 418.066731][T13439] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2035'. [ 418.130413][T13439] hsr_slave_0: left promiscuous mode [ 418.160668][T13439] hsr_slave_1: left promiscuous mode [ 418.398088][T13448] loop9: detected capacity change from 0 to 1024 [ 418.439985][T13448] hfsplus: unable to parse mount options [ 418.994054][ T28] audit: type=1800 audit(1700000042.292:280): pid=13461 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2040" name="addr_adrfam" dev="configfs" ino=35845 res=0 errno=0 [ 419.371317][ T5925] usb 9-1: new full-speed USB device number 10 using dummy_hcd [ 419.447489][T13477] loop9: detected capacity change from 0 to 2048 [ 419.461588][ T5905] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 419.511658][T13477] EXT4-fs error (device loop9): ext4_orphan_get:1434: comm syz.9.2046: bad orphan inode 214 [ 419.554987][T13477] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 419.573518][ T5925] usb 9-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 419.586004][ T5925] usb 9-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 419.596322][ T5925] usb 9-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 419.609396][ T5925] usb 9-1: config 0 interface 0 has no altsetting 0 [ 419.616667][ T5925] usb 9-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 419.626179][ T5925] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.637304][ T5925] usb 9-1: config 0 descriptor?? [ 419.677992][ T5905] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 419.691502][ T5905] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.711531][ T5905] usb 1-1: Product: syz [ 419.724601][ T5905] usb 1-1: Manufacturer: syz [ 419.739502][ T5905] usb 1-1: SerialNumber: syz [ 419.770209][ T5905] usb 1-1: config 0 descriptor?? [ 419.884739][T10495] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 419.933153][ T5802] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 420.057918][ T5905] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 420.095352][ T5925] input: HID 17ef:6047 as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/0003:17EF:6047.0014/input/input19 [ 420.210013][T13474] loop4: detected capacity change from 0 to 32768 [ 420.269582][ T5925] lenovo 0003:17EF:6047.0014: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.8-1/input0 [ 420.352657][T13474] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 420.799590][ T5960] ocfs2: Unmounting device (7,4) on (node local) [ 420.889530][ T5905] dvb_usb_rtl28xxu: probe of 1-1:0.0 failed with error -71 [ 420.920072][ T5905] usb 1-1: USB disconnect, device number 10 [ 421.296800][ T5925] usb 9-1: reset full-speed USB device number 10 using dummy_hcd [ 421.921219][T13534] FAULT_INJECTION: forcing a failure. [ 421.921219][T13534] name failslab, interval 1, probability 0, space 0, times 0 [ 421.935386][T13534] CPU: 0 PID: 13534 Comm: syz.8.2059 Not tainted syzkaller #0 [ 421.942928][T13534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 421.953072][T13534] Call Trace: [ 421.956395][T13534] [ 421.959389][T13534] dump_stack_lvl+0x18c/0x250 [ 421.964172][T13534] ? show_regs_print_info+0x20/0x20 [ 421.969435][T13534] ? load_image+0x420/0x420 [ 421.974001][T13534] ? __might_sleep+0xe0/0xe0 [ 421.978650][T13534] ? __lock_acquire+0x7eb0/0x7eb0 [ 421.983753][T13534] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 421.989886][T13534] should_fail_ex+0x394/0x4c0 [ 421.994633][T13534] should_failslab+0x9/0x20 [ 421.999190][T13534] slab_pre_alloc_hook+0x59/0x300 [ 422.004274][T13534] ? alloc_super+0x5a/0x910 [ 422.008836][T13534] __kmem_cache_alloc_node+0x53/0x260 [ 422.014262][T13534] ? __lock_acquire+0x7eb0/0x7eb0 [ 422.019353][T13534] ? alloc_super+0x5a/0x910 [ 422.023924][T13534] kmalloc_trace+0x2a/0xe0 [ 422.028406][T13534] alloc_super+0x5a/0x910 [ 422.032837][T13534] sget_fc+0x2ee/0x930 [ 422.036962][T13534] ? kill_litter_super+0x60/0x60 [ 422.041959][T13534] ? mqueue_get_tree+0xf0/0xf0 [ 422.046774][T13534] get_tree_nodev+0x2a/0x140 [ 422.051450][T13534] vfs_get_tree+0x8c/0x280 [ 422.055930][T13534] fc_mount+0x1c/0xb0 [ 422.059995][T13534] mq_init_ns+0x3a1/0x510 [ 422.064401][T13534] copy_ipcs+0x309/0x500 [ 422.068699][T13534] create_new_namespaces+0x212/0x700 [ 422.074056][T13534] unshare_nsproxy_namespaces+0x11a/0x160 [ 422.079838][T13534] ksys_unshare+0x4fa/0x8f0 [ 422.084421][T13534] ? sighand_ctor+0x50/0x50 [ 422.088991][T13534] ? lock_chain_count+0x20/0x20 [ 422.093904][T13534] ? syscall_enter_from_user_mode+0x25/0x80 [ 422.099859][T13534] __x64_sys_unshare+0x38/0x40 [ 422.104680][T13534] do_syscall_64+0x55/0xb0 [ 422.109155][T13534] ? clear_bhb_loop+0x40/0x90 [ 422.113895][T13534] ? clear_bhb_loop+0x40/0x90 [ 422.118633][T13534] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 422.124582][T13534] RIP: 0033:0x7f269799f559 [ 422.129045][T13534] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 422.148710][T13534] RSP: 002b:00007f269880b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 422.157189][T13534] RAX: ffffffffffffffda RBX: 00007f2697c25fa0 RCX: 00007f269799f559 [ 422.165306][T13534] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006a040000 [ 422.173328][T13534] RBP: 00007f2697a36b20 R08: 0000000000000000 R09: 0000000000000000 [ 422.181348][T13534] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 422.189377][T13534] R13: 00007f2697c26038 R14: 00007f2697c25fa0 R15: 00007ffe6475cce8 [ 422.197431][T13534] [ 422.279854][ T5905] usb 9-1: USB disconnect, device number 10 [ 422.940270][T13556] FAULT_INJECTION: forcing a failure. [ 422.940270][T13556] name failslab, interval 1, probability 0, space 0, times 0 [ 422.978482][T13556] CPU: 0 PID: 13556 Comm: syz.0.2066 Not tainted syzkaller #0 [ 422.986127][T13556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 422.996330][T13556] Call Trace: [ 422.999655][T13556] [ 423.002639][T13556] dump_stack_lvl+0x18c/0x250 [ 423.007383][T13556] ? show_regs_print_info+0x20/0x20 [ 423.012657][T13556] ? load_image+0x420/0x420 [ 423.017235][T13556] ? __might_sleep+0xe0/0xe0 [ 423.021891][T13556] ? __lock_acquire+0x7eb0/0x7eb0 [ 423.026982][T13556] should_fail_ex+0x394/0x4c0 [ 423.031723][T13556] should_failslab+0x9/0x20 [ 423.036281][T13556] slab_pre_alloc_hook+0x59/0x300 [ 423.041379][T13556] kmem_cache_alloc+0x5a/0x2d0 [ 423.046194][T13556] ? security_file_alloc+0x34/0x120 [ 423.051454][T13556] security_file_alloc+0x34/0x120 [ 423.056543][T13556] init_file+0x94/0x1f0 [ 423.060762][T13556] alloc_empty_file+0xb7/0x1d0 [ 423.065590][T13556] alloc_file+0x5b/0x600 [ 423.069921][T13556] alloc_file_pseudo+0x184/0x210 [ 423.074929][T13556] ? fput+0x1a0/0x1a0 [ 423.079027][T13556] anon_inode_getfile+0xc5/0x1a0 [ 423.084155][T13556] init_listener+0x10f/0x1d0 [ 423.088814][T13556] do_seccomp+0x93a/0xdc0 [ 423.093318][T13556] ? prctl_set_seccomp+0x60/0x60 [ 423.098320][T13556] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 423.104377][T13556] ? lockdep_hardirqs_on+0x98/0x150 [ 423.109656][T13556] do_syscall_64+0x55/0xb0 [ 423.114135][T13556] ? clear_bhb_loop+0x40/0x90 [ 423.118877][T13556] ? clear_bhb_loop+0x40/0x90 [ 423.123622][T13556] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 423.129578][T13556] RIP: 0033:0x7effa719f559 [ 423.134045][T13556] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 423.153797][T13556] RSP: 002b:00007effa80f4028 EFLAGS: 00000246 ORIG_RAX: 000000000000013d [ 423.162267][T13556] RAX: ffffffffffffffda RBX: 00007effa7425fa0 RCX: 00007effa719f559 [ 423.170308][T13556] RDX: 0000200000000000 RSI: 000000000000000a RDI: 0000000000000001 [ 423.178335][T13556] RBP: 00007effa7236b20 R08: 0000000000000000 R09: 0000000000000000 [ 423.186356][T13556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 423.194376][T13556] R13: 00007effa7426038 R14: 00007effa7425fa0 R15: 00007ffee8eab2c8 [ 423.202417][T13556] [ 423.491232][ T2179] usb 5-1: new full-speed USB device number 24 using dummy_hcd [ 423.677085][ T2179] usb 5-1: config 0 interface 0 altsetting 24 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 423.705158][ T2179] usb 5-1: config 0 interface 0 has no altsetting 0 [ 423.712542][ T2179] usb 5-1: New USB device found, idVendor=1294, idProduct=1320, bcdDevice= 0.00 [ 423.722052][ T2179] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.796494][ T2179] usb 5-1: config 0 descriptor?? [ 424.265167][ T2179] hid-led 0003:1294:1320.0015: hidraw0: USB HID v10.01 Device [HID 1294:1320] on usb-dummy_hcd.4-1/input0 [ 424.319897][ T2179] hid-led 0003:1294:1320.0015: Riso Kagaku Webmail Notifier initialized [ 424.461194][ T5925] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 424.548750][ T2179] usb 5-1: USB disconnect, device number 24 [ 424.571355][ T175] leds riso_kagaku0:blue: Setting an LED's brightness failed (-38) [ 424.593317][ T175] leds riso_kagaku0:green: Setting an LED's brightness failed (-38) [ 424.614334][ T175] leds riso_kagaku0:red: Setting an LED's brightness failed (-38) [ 424.654333][ T5925] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 246, changing to 11 [ 424.687530][ T5925] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 424.716458][ T5925] usb 9-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 424.742969][ T5925] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 424.771947][ T5925] usb 9-1: config 0 descriptor?? [ 425.096025][T13614] loop9: detected capacity change from 0 to 512 [ 425.126523][T13614] EXT4-fs error (device loop9): ext4_map_blocks:610: inode #2: block 8: comm syz.9.2082: lblock 0 mapped to illegal pblock 8 (length 1) [ 425.154202][T13614] EXT4-fs (loop9): Remounting filesystem read-only [ 425.164339][T13614] EXT4-fs warning (device loop9): dx_probe:823: inode #2: lblock 0: comm syz.9.2082: error -117 reading directory block [ 425.182190][T13614] EXT4-fs (loop9): Cannot turn on journaled quota: type 0: error -117 [ 425.224401][ T5925] kovaplus 0003:1E7D:2D50.0016: unknown main item tag 0x0 [ 425.257869][T13614] EXT4-fs warning (device loop9): dx_probe:823: inode #2: lblock 0: comm syz.9.2082: error -117 reading directory block [ 425.302190][ T5925] kovaplus 0003:1E7D:2D50.0016: unknown main item tag 0x0 [ 425.338083][ T5925] kovaplus 0003:1E7D:2D50.0016: unknown main item tag 0x0 [ 425.358072][ T5925] kovaplus 0003:1E7D:2D50.0016: unknown main item tag 0x0 [ 425.392343][T13614] EXT4-fs (loop9): Cannot turn on journaled quota: type 1: error -117 [ 425.406475][ T5925] kovaplus 0003:1E7D:2D50.0016: unknown main item tag 0x0 [ 425.435744][ T5925] kovaplus 0003:1E7D:2D50.0016: unknown main item tag 0x0 [ 425.439801][T13614] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 425.476455][ T5925] kovaplus 0003:1E7D:2D50.0016: unknown main item tag 0x4 [ 425.487372][ T5925] kovaplus 0003:1E7D:2D50.0016: unknown main item tag 0x6 [ 425.497914][ T5925] kovaplus 0003:1E7D:2D50.0016: reserved main item tag 0xd [ 425.514764][ T5925] kovaplus 0003:1E7D:2D50.0016: reserved main item tag 0xd [ 425.545776][ T5925] kovaplus 0003:1E7D:2D50.0016: unknown main item tag 0x6 [ 425.561420][ T5925] kovaplus 0003:1E7D:2D50.0016: unexpected long global item [ 425.602029][ T5925] kovaplus 0003:1E7D:2D50.0016: parse failed [ 425.608791][ T5925] kovaplus: probe of 0003:1E7D:2D50.0016 failed with error -22 [ 425.622385][T10495] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 425.671278][ T5925] usb 9-1: USB disconnect, device number 11 [ 425.844209][T13632] FAULT_INJECTION: forcing a failure. [ 425.844209][T13632] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 425.890942][T13632] CPU: 1 PID: 13632 Comm: syz.9.2086 Not tainted syzkaller #0 [ 425.898501][T13632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 425.908613][T13632] Call Trace: [ 425.911933][T13632] [ 425.914897][T13632] dump_stack_lvl+0x18c/0x250 [ 425.919624][T13632] ? show_regs_print_info+0x20/0x20 [ 425.924865][T13632] ? load_image+0x420/0x420 [ 425.929414][T13632] ? __might_fault+0xaa/0x120 [ 425.934127][T13632] ? __lock_acquire+0x7eb0/0x7eb0 [ 425.939187][T13632] ? __virt_addr_valid+0x10c/0x380 [ 425.944336][T13632] should_fail_ex+0x394/0x4c0 [ 425.949054][T13632] _copy_to_user+0x2f/0xa0 [ 425.953522][T13632] bpf_verifier_vlog+0x5ac/0x840 [ 425.958516][T13632] btf_verifier_log+0x11e/0x1a0 [ 425.963435][T13632] ? btf_parse_graph_root+0xb00/0xb00 [ 425.968859][T13632] ? kvmalloc_node+0x70/0x180 [ 425.973594][T13632] ? __kmalloc_node+0xe4/0x240 [ 425.978397][T13632] ? btf_check_all_metas+0x5d9/0xaf0 [ 425.983716][T13632] ? rcu_is_watching+0x15/0xb0 [ 425.988541][T13632] btf_check_all_metas+0x9a7/0xaf0 [ 425.993693][T13632] btf_parse_type_sec+0xfc/0x1960 [ 425.998742][T13632] ? btf_check_sec_info+0x350/0x350 [ 426.003979][T13632] ? __virt_addr_valid+0x10c/0x380 [ 426.009137][T13632] ? btf_verifier_log+0x1a0/0x1a0 [ 426.014200][T13632] ? btf_parse_hdr+0x545/0x700 [ 426.018994][T13632] ? btf_parse_str_sec+0x20d/0x2a0 [ 426.024143][T13632] btf_new_fd+0x440/0x9e0 [ 426.028516][T13632] ? bpf_btf_show_fdinfo+0x80/0x80 [ 426.033841][T13632] ? capable+0x88/0xe0 [ 426.037952][T13632] __sys_bpf+0x670/0x890 [ 426.042230][T13632] ? bpf_link_show_fdinfo+0x560/0x560 [ 426.047685][T13632] ? lock_chain_count+0x20/0x20 [ 426.052578][T13632] __x64_sys_bpf+0x7c/0x90 [ 426.057028][T13632] do_syscall_64+0x55/0xb0 [ 426.061487][T13632] ? clear_bhb_loop+0x40/0x90 [ 426.066203][T13632] ? clear_bhb_loop+0x40/0x90 [ 426.070938][T13632] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 426.076865][T13632] RIP: 0033:0x7f4aee19f559 [ 426.081328][T13632] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 426.100966][T13632] RSP: 002b:00007f4aef02a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 426.109428][T13632] RAX: ffffffffffffffda RBX: 00007f4aee425fa0 RCX: 00007f4aee19f559 [ 426.117464][T13632] RDX: 0000000000000028 RSI: 0000200000003200 RDI: 0000000000000012 [ 426.125470][T13632] RBP: 00007f4aee236b20 R08: 0000000000000000 R09: 0000000000000000 [ 426.133492][T13632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 426.141496][T13632] R13: 00007f4aee426038 R14: 00007f4aee425fa0 R15: 00007fff0eac41c8 [ 426.149507][T13632] [ 427.269322][T13677] loop4: detected capacity change from 0 to 4096 [ 427.294074][T13677] ntfs3: loop4: Different NTFS sector size (4096) and media sector size (512). [ 427.368390][T13677] ntfs3: loop4: ino=19, mi_enum_attr [ 427.378089][T13677] ntfs3: loop4: Mark volume as dirty due to NTFS errors [ 427.388478][T13677] ntfs3: loop4: Failed to initialize $Extend/$ObjId. [ 427.686834][T13687] FAULT_INJECTION: forcing a failure. [ 427.686834][T13687] name failslab, interval 1, probability 0, space 0, times 0 [ 427.719731][T13687] CPU: 1 PID: 13687 Comm: syz.4.2099 Not tainted syzkaller #0 [ 427.727312][T13687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 427.737424][T13687] Call Trace: [ 427.740752][T13687] [ 427.743734][T13687] dump_stack_lvl+0x18c/0x250 [ 427.748571][T13687] ? show_regs_print_info+0x20/0x20 [ 427.753851][T13687] ? load_image+0x420/0x420 [ 427.758415][T13687] ? __lock_acquire+0x7eb0/0x7eb0 [ 427.763499][T13687] should_fail_ex+0x394/0x4c0 [ 427.768270][T13687] should_failslab+0x9/0x20 [ 427.772834][T13687] slab_pre_alloc_hook+0x59/0x300 [ 427.777926][T13687] kmem_cache_alloc+0x5a/0x2d0 [ 427.782783][T13687] ? security_inode_alloc+0x34/0x110 [ 427.788144][T13687] security_inode_alloc+0x34/0x110 [ 427.793327][T13687] inode_init_always+0x914/0xc90 [ 427.798329][T13687] new_inode_pseudo+0x95/0x1d0 [ 427.803158][T13687] __ns_get_path+0x249/0x5f0 [ 427.807822][T13687] ns_get_path+0x54/0x90 [ 427.812138][T13687] proc_ns_get_link+0x16c/0x2d0 [ 427.817026][T13687] ? proc_ns_instantiate+0xf0/0xf0 [ 427.822179][T13687] ? bpf_lsm_inode_follow_link+0x9/0x10 [ 427.827760][T13687] ? security_inode_follow_link+0xb7/0x100 [ 427.833600][T13687] ? proc_ns_instantiate+0xf0/0xf0 [ 427.838745][T13687] pick_link+0x666/0xdd0 [ 427.843029][T13687] step_into+0xc18/0xee0 [ 427.847312][T13687] ? rcu_read_lock_any_held+0xb4/0x140 [ 427.852830][T13687] ? rcu_read_lock_bh_held+0x100/0x100 [ 427.858330][T13687] ? set_root+0x3a0/0x3a0 [ 427.862691][T13687] ? d_splice_alias+0x114/0x330 [ 427.867583][T13687] path_openat+0x1656/0x3270 [ 427.872234][T13687] ? do_filp_open+0x430/0x430 [ 427.877002][T13687] do_filp_open+0x1f2/0x430 [ 427.881545][T13687] ? vfs_tmpfile+0x620/0x620 [ 427.886187][T13687] ? _raw_spin_unlock+0x28/0x40 [ 427.891071][T13687] ? alloc_fd+0x590/0x640 [ 427.895475][T13687] do_sys_openat2+0x134/0x1d0 [ 427.900212][T13687] ? do_sys_open+0xe0/0xe0 [ 427.904682][T13687] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 427.910718][T13687] ? lock_chain_count+0x20/0x20 [ 427.915686][T13687] __x64_sys_openat+0x139/0x160 [ 427.920640][T13687] do_syscall_64+0x55/0xb0 [ 427.925111][T13687] ? clear_bhb_loop+0x40/0x90 [ 427.929833][T13687] ? clear_bhb_loop+0x40/0x90 [ 427.934557][T13687] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 427.940491][T13687] RIP: 0033:0x7fb35c75fd8e [ 427.944955][T13687] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 427.964636][T13687] RSP: 002b:00007fb35d691ec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 427.973109][T13687] RAX: ffffffffffffffda RBX: 00007fb35d6926c0 RCX: 00007fb35c75fd8e [ 427.981130][T13687] RDX: 0000000000000002 RSI: 00007fb35d691f90 RDI: ffffffffffffff9c [ 427.989166][T13687] RBP: 00007fb35c836b20 R08: 0000000000000000 R09: 0000000000000000 [ 427.997187][T13687] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 428.005207][T13687] R13: 00007fb35ca26038 R14: 00007fb35ca25fa0 R15: 00007ffdae967f28 [ 428.013232][T13687] [ 428.041864][T13693] FAULT_INJECTION: forcing a failure. [ 428.041864][T13693] name failslab, interval 1, probability 0, space 0, times 0 [ 428.054733][T13693] CPU: 1 PID: 13693 Comm: syz.9.2101 Not tainted syzkaller #0 [ 428.062251][T13693] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 428.072386][T13693] Call Trace: [ 428.075717][T13693] [ 428.078700][T13693] dump_stack_lvl+0x18c/0x250 [ 428.083443][T13693] ? show_regs_print_info+0x20/0x20 [ 428.088701][T13693] ? load_image+0x420/0x420 [ 428.093291][T13693] ? __might_sleep+0xe0/0xe0 [ 428.097965][T13693] ? __lock_acquire+0x7eb0/0x7eb0 [ 428.103058][T13693] should_fail_ex+0x394/0x4c0 [ 428.107813][T13693] should_failslab+0x9/0x20 [ 428.112396][T13693] slab_pre_alloc_hook+0x59/0x300 [ 428.117473][T13693] ? sw_sync_debugfs_open+0xd3/0x310 [ 428.122827][T13693] __kmem_cache_alloc_node+0x53/0x260 [ 428.128273][T13693] ? sw_sync_debugfs_open+0xd3/0x310 [ 428.133629][T13693] kmalloc_trace+0x2a/0xe0 [ 428.138112][T13693] sw_sync_debugfs_open+0xd3/0x310 [ 428.143291][T13693] ? sw_sync_ioctl+0xaa0/0xaa0 [ 428.148126][T13693] ? apparmor_inode_getattr+0x2c0/0x2c0 [ 428.153739][T13693] ? __rwlock_init+0x150/0x150 [ 428.158570][T13693] ? lockdown_is_locked_down+0x3a/0xe0 [ 428.164124][T13693] ? sw_sync_ioctl+0xaa0/0xaa0 [ 428.168954][T13693] open_proxy_open+0x306/0x4d0 [ 428.173780][T13693] do_dentry_open+0x880/0x14b0 [ 428.178636][T13693] ? debugfs_file_put+0xb0/0xb0 [ 428.183571][T13693] path_openat+0x284f/0x3270 [ 428.188244][T13693] ? do_sys_openat2+0xda/0x1d0 [ 428.193088][T13693] ? __x64_sys_openat+0x139/0x160 [ 428.198164][T13693] ? verify_lock_unused+0x140/0x140 [ 428.203401][T13693] ? do_filp_open+0x430/0x430 [ 428.208153][T13693] do_filp_open+0x1f2/0x430 [ 428.212698][T13693] ? vfs_tmpfile+0x620/0x620 [ 428.217342][T13693] ? _raw_spin_unlock+0x28/0x40 [ 428.222246][T13693] ? alloc_fd+0x590/0x640 [ 428.226619][T13693] do_sys_openat2+0x134/0x1d0 [ 428.231336][T13693] ? do_sys_open+0xe0/0xe0 [ 428.235807][T13693] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 428.241836][T13693] ? lock_chain_count+0x20/0x20 [ 428.246728][T13693] __x64_sys_openat+0x139/0x160 [ 428.251627][T13693] do_syscall_64+0x55/0xb0 [ 428.256073][T13693] ? clear_bhb_loop+0x40/0x90 [ 428.260788][T13693] ? clear_bhb_loop+0x40/0x90 [ 428.265540][T13693] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 428.271471][T13693] RIP: 0033:0x7f4aee19f559 [ 428.275911][T13693] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 428.295559][T13693] RSP: 002b:00007f4aef02a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 428.304020][T13693] RAX: ffffffffffffffda RBX: 00007f4aee425fa0 RCX: 00007f4aee19f559 [ 428.312028][T13693] RDX: 00000000000c8c00 RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 428.320030][T13693] RBP: 00007f4aee236b20 R08: 0000000000000000 R09: 0000000000000000 [ 428.328048][T13693] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 428.336075][T13693] R13: 00007f4aee426038 R14: 00007f4aee425fa0 R15: 00007fff0eac41c8 [ 428.344111][T13693] [ 428.603394][T13702] netlink: 4 bytes leftover after parsing attributes in process `syz.9.2104'. [ 428.704292][T13699] loop8: detected capacity change from 0 to 4096 [ 429.867151][T13745] loop4: detected capacity change from 0 to 8 [ 430.426498][T13764] loop4: detected capacity change from 0 to 512 [ 430.564606][T13764] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 430.665743][T13764] ext4 filesystem being mounted at /540/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 430.874830][ T5960] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 431.074166][T13788] loop8: detected capacity change from 0 to 4096 [ 431.100650][ T8384] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 431.217899][T13788] ntfs3: loop8: Failed to load $Extend (-22). [ 431.238867][T13788] ntfs3: loop8: Failed to initialize $Extend. [ 431.330878][ T8384] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 431.360519][ T8384] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 431.414005][ T8384] usb 10-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 431.477529][ T8384] usb 10-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 431.497838][ T8384] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.581895][ T42] ntfs3: loop8: ino=5, mi_enum_attr [ 431.701018][T13804] overlayfs: failed to clone upperpath [ 431.816306][T13811] loop8: detected capacity change from 0 to 512 [ 431.979772][ T8384] cxacru 10-1:1.0: send of cm 0x91 failed (-71) [ 432.011426][ T5802] Bluetooth: hci2: command 0x0406 tx timeout [ 432.035294][ T8384] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 432.054066][ T8384] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 432.109231][ T8384] cxacru: probe of 10-1:1.0 failed with error -71 [ 432.226919][ T8384] usb 10-1: USB disconnect, device number 3 [ 432.734293][T13838] loop8: detected capacity change from 0 to 8192 [ 433.298342][T13864] KVM: debugfs: duplicate directory 13864-4 [ 433.316398][T13817] loop4: detected capacity change from 0 to 32768 [ 433.472972][T13817] XFS (loop4): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 433.609783][T13817] XFS (loop4): Ending clean mount [ 433.646094][T13882] overlayfs: failed to clone upperpath [ 433.728665][ T28] audit: type=1800 audit(1700000057.023:281): pid=13817 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2136" name="file1" dev="loop4" ino=4422 res=0 errno=0 [ 434.006982][T13889] overlayfs: failed to clone upperpath [ 434.154747][ T5960] XFS (loop4): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 434.718140][T13905] loop9: detected capacity change from 0 to 512 [ 434.841903][T13905] EXT4-fs (loop9): orphan cleanup on readonly fs [ 434.867159][T13905] EXT4-fs error (device loop9): ext4_ext_check_inode:532: inode #4: comm syz.9.2154: pblk 0 bad header/extent: too large eh_depth - magic f30a, entries 1, max 4(4), depth 2048(2048) [ 434.924307][T13905] EXT4-fs error (device loop9): ext4_quota_enable:7143: comm syz.9.2154: Bad quota inode: 4, type: 1 [ 434.940113][T13905] EXT4-fs warning (device loop9): ext4_enable_quotas:7184: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 434.967500][T13905] EXT4-fs (loop9): Cannot turn on quotas: error -117 [ 434.994859][T13905] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 435.135454][T10495] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 436.227144][T13931] loop9: detected capacity change from 0 to 32768 [ 436.329289][T13931] XFS (loop9): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 436.427395][T13931] XFS (loop9): Ending clean mount [ 436.525554][ T28] audit: type=1800 audit(1700000059.823:282): pid=13931 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.9.2159" name="file1" dev="loop9" ino=4422 res=0 errno=0 [ 437.049341][T10495] XFS (loop9): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 437.210240][ T791] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 437.257401][T13971] bridge0: port 3(team0) entered disabled state [ 437.264411][T13971] bridge0: port 2(bridge_slave_1) entered disabled state [ 437.272239][T13971] bridge0: port 1(bridge_slave_0) entered disabled state [ 437.413581][ T791] usb 5-1: too many endpoints for config 0 interface 0 altsetting 5: 70, using maximum allowed: 30 [ 437.434167][ T791] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 437.445548][ T791] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 70 [ 437.458899][ T791] usb 5-1: config 0 interface 0 has no altsetting 0 [ 437.466102][ T791] usb 5-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 437.476146][ T791] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 437.491062][ T791] usb 5-1: config 0 descriptor?? [ 437.663647][T13971] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 437.695619][T13971] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 437.907402][T13971] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.917707][T13971] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.928230][T13971] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.939560][T13971] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.973682][ T791] input: HID 060b:500a as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:060B:500A.0017/input/input20 [ 438.090989][ T791] cougar 0003:060B:500A.0017: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 060b:500a] on usb-dummy_hcd.4-1/input0 [ 438.444067][T13971] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 438.453190][T13971] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 438.462216][T13971] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 438.471201][T13971] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 439.593189][T10809] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 439.623852][T14045] overlayfs: failed to resolve './file0': -2 [ 439.800138][T10809] usb 9-1: Using ep0 maxpacket: 16 [ 439.822870][T10809] usb 9-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 439.852172][T10809] usb 9-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 439.874748][T10809] usb 9-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 439.926058][T10809] usb 9-1: config 0 interface 0 has no altsetting 0 [ 439.952730][T10809] usb 9-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 439.980729][ T5905] usb 5-1: USB disconnect, device number 25 [ 440.001281][T10809] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 440.061429][T10809] usb 9-1: config 0 descriptor?? [ 440.189658][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.197374][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.284364][ T175] libceph: connect (1)[c::]:6789 error -101 [ 440.294058][ T175] libceph: mon0 (1)[c::]:6789 connect error [ 440.355275][ T175] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 440.369407][ T175] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 440.571723][T14038] loop8: detected capacity change from 0 to 2048 [ 440.588673][ T5905] libceph: connect (1)[c::]:6789 error -101 [ 440.610188][T14038] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 440.617405][ T5905] libceph: mon0 (1)[c::]:6789 connect error [ 440.641316][ T2179] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 440.671177][T10809] hid (null): global environment stack underflow [ 440.688572][T10809] hid (null): unknown global tag 0xd [ 440.705175][T10809] hid (null): unknown global tag 0xb4 [ 440.825530][T14081] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 440.901807][T14083] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 440.926910][ T5875] usb 9-1: USB disconnect, device number 12 [ 441.126105][T14065] ceph: No mds server is up or the cluster is laggy [ 441.135780][ T8] libceph: connect (1)[c::]:6789 error -101 [ 441.159240][T14069] ceph: No mds server is up or the cluster is laggy [ 441.170267][ T8] libceph: mon0 (1)[c::]:6789 connect error [ 441.177382][ T8] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 442.057861][T14118] loop9: detected capacity change from 0 to 4096 [ 442.132942][T14118] ntfs3: loop9: Failed to load $Extend (-22). [ 442.167643][T14118] ntfs3: loop9: Failed to initialize $Extend. [ 442.205523][T14125] loop8: detected capacity change from 0 to 8 [ 442.267083][T14125] squashfs image failed sanity check [ 442.583330][ T42] ntfs3: loop9: ino=5, mi_enum_attr [ 442.820810][T14141] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 1, id = 0 [ 443.318955][T14133] loop4: detected capacity change from 0 to 32768 [ 443.382415][T14133] JBD2: Ignoring recovery information on journal [ 443.545136][T14133] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 444.055838][ T5960] ocfs2: Unmounting device (7,4) on (node local) [ 444.731226][ T52] Bluetooth: hci2: command 0x0406 tx timeout [ 444.853403][T14202] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2226'. [ 444.941572][T14206] loop9: detected capacity change from 0 to 128 [ 445.034617][T14206] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 445.084807][T14206] hpfs: filesystem error: improperly stopped [ 445.098189][T14206] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 445.115907][T14206] hpfs: You really don't want any checks? You are crazy... [ 445.123770][T14206] hpfs: Code page index out of array [ 445.129119][T14206] hpfs: code page support is disabled [ 445.136174][T14206] hpfs: hpfs_map_4sectors(): unaligned read [ 445.151388][T14206] hpfs: hpfs_map_4sectors(): unaligned read [ 445.157374][T14206] hpfs: filesystem error: unable to find root dir [ 445.242974][T14206] hpfs: hpfs_map_4sectors(): unaligned read [ 445.507846][T14227] vxcan1: tx drop: invalid sa for name 0x0000000000000002 [ 445.698013][T14235] netlink: 'syz.9.2234': attribute type 13 has an invalid length. [ 445.721174][T14235] netlink: 4 bytes leftover after parsing attributes in process `syz.9.2234'. [ 445.740346][T14235] netdevsim netdevsim9 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 445.749126][T14235] netdevsim netdevsim9 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 445.758441][T14235] netdevsim netdevsim9 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 445.767295][T14235] netdevsim netdevsim9 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 445.781308][T14235] netlink: 'syz.9.2234': attribute type 13 has an invalid length. [ 445.791998][T14235] netlink: 4 bytes leftover after parsing attributes in process `syz.9.2234'. [ 445.969854][T14243] gadgetfs: bound to dummy_udc driver [ 446.160466][T14252] loop4: detected capacity change from 0 to 1024 [ 446.186248][T14254] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 446.710702][T14272] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2246'. [ 446.928614][T14278] netlink: 51 bytes leftover after parsing attributes in process `syz.4.2248'. [ 446.993578][T14283] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 447.019248][T14283] bond1: (slave lo): Enslaving as an active interface with an up link [ 447.050787][T14283] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 447.079998][T14284] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2250'. [ 447.097122][T14284] netlink: 'syz.0.2250': attribute type 7 has an invalid length. [ 447.110041][T14284] netlink: 'syz.0.2250': attribute type 8 has an invalid length. [ 447.140147][T14284] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2250'. [ 447.473505][T14304] 9pnet_fd: p9_fd_create_unix (14304): problem connecting socket: ./file0: -5 [ 447.990735][T13996] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 448.182762][T13996] usb 5-1: config 0 interface 0 altsetting 255 endpoint 0x3 has invalid wMaxPacketSize 0 [ 448.213273][T13996] usb 5-1: config 0 interface 0 has no altsetting 0 [ 448.238038][T13996] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 448.265292][T13996] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 448.284030][T13996] usb 5-1: Product: syz [ 448.288291][T13996] usb 5-1: Manufacturer: syz [ 448.313693][T13996] usb 5-1: SerialNumber: syz [ 448.335152][T13996] usb 5-1: config 0 descriptor?? [ 448.366365][T13996] usb 5-1: selecting invalid altsetting 0 [ 448.634790][ T28] audit: type=1326 audit(1700000081.939:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14336 comm="syz.0.2265" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effa719f559 code=0x7fc00000 [ 448.688566][T13996] usb 5-1: USB disconnect, device number 26 [ 448.838900][T14351] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 1, id = 0 [ 449.334878][ T28] audit: type=1326 audit(1700000082.639:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14336 comm="syz.0.2265" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7effa719f559 code=0x7fc00000 [ 449.886265][T14383] loop4: detected capacity change from 0 to 2048 [ 450.171653][T14394] fuse: Bad value for 'fd' [ 450.680206][T13988] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 450.880118][T13988] usb 10-1: Using ep0 maxpacket: 16 [ 450.901565][T13988] usb 10-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 450.930433][T13988] usb 10-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 450.950403][T13988] usb 10-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 450.980095][T13988] usb 10-1: config 0 interface 0 has no altsetting 0 [ 450.996508][T13988] usb 10-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 451.018054][T13988] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.061115][T13988] usb 10-1: config 0 descriptor?? [ 451.200043][T14423] rxe_eth0 speed is unknown, defaulting to 1000 [ 451.539184][T14404] loop9: detected capacity change from 0 to 2048 [ 451.638084][T14404] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 451.718808][T13988] hid (null): global environment stack underflow [ 451.755080][T13988] hid (null): unknown global tag 0xd [ 451.777196][T13988] hid (null): unknown global tag 0xb4 [ 451.971910][T13996] usb 10-1: USB disconnect, device number 4 [ 453.081013][ T8] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 453.115812][T14482] fuse: Bad value for 'fd' [ 453.151359][T14485] loop8: detected capacity change from 0 to 16 [ 453.179661][T14485] erofs: (device loop8): mounted with root inode @ nid 36. [ 453.290308][ T8] usb 10-1: Using ep0 maxpacket: 16 [ 453.310570][ T8] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 453.336954][ T8] usb 10-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 453.378850][ T8] usb 10-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 453.414737][ T8] usb 10-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 453.469105][ T8] usb 10-1: config 0 interface 0 has no altsetting 0 [ 453.492595][ T8] usb 10-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 453.512196][ T8] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 453.545744][ T8] usb 10-1: config 0 descriptor?? [ 454.071893][ T8] logitech-djreceiver 0003:046D:C53A.001A: hiddev0,hidraw0: USB HID vff.fc Device [HID 046d:c53a] on usb-dummy_hcd.9-1/input0 [ 454.650367][T14530] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2309'. [ 454.776744][ T28] audit: type=1326 audit(1700000088.079:285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14532 comm="syz.8.2310" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f269799f559 code=0x0 [ 454.911797][ T8] usb 10-1: USB disconnect, device number 5 [ 455.657800][T14539] ceph: No mds server is up or the cluster is laggy [ 455.680139][T14544] ceph: No mds server is up or the cluster is laggy [ 455.737855][T14574] loop9: detected capacity change from 0 to 2048 [ 455.797922][T14574] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 456.031093][T14574] loop9: detected capacity change from 2048 to 64 [ 456.059376][T14581] UDF-fs: error (device loop9): udf_read_tagged: read failed, block=1347, location=35 [ 456.106725][T14581] UDF-fs: error (device loop9): udf_read_inode: (ino 1347) failed !bh [ 456.549444][T10495] syz-executor: attempt to access beyond end of device [ 456.549444][T10495] loop9: rw=2049, sector=128, nr_sectors = 1 limit=64 [ 456.594030][T10495] buffer_io_error: 138 callbacks suppressed [ 456.594050][T10495] Buffer I/O error on dev loop9, logical block 128, lost sync page write [ 457.366808][T10109] netdevsim netdevsim9 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 457.396537][T10109] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.604606][T10109] netdevsim netdevsim9 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 457.621500][T10109] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.788870][T10109] netdevsim netdevsim9 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 457.800799][T10109] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.829769][T14610] netlink: 27 bytes leftover after parsing attributes in process `syz.8.2329'. [ 458.052667][T10109] netdevsim netdevsim9 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 458.091299][T10109] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 458.622881][ T5802] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 458.638177][ T5802] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 458.651520][ T5802] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 458.660435][ T5802] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 458.690758][ T5802] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 458.702786][ T5802] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 458.816742][T14632] rxe_eth0 speed is unknown, defaulting to 1000 [ 458.896661][T14641] lo: entered promiscuous mode [ 458.905925][T14641] tunl0: entered promiscuous mode [ 458.916636][T14641] gre0: entered promiscuous mode [ 458.930498][T14641] 0ªî{X¹¦: entered promiscuous mode [ 458.936232][T14641] erspan0: entered promiscuous mode [ 458.942653][T14641] ip_vti0: entered promiscuous mode [ 458.948952][T14641] ip6_vti0: entered promiscuous mode [ 458.987589][T14641] sit0: entered promiscuous mode [ 458.996357][T14641] ip6tnl0: entered promiscuous mode [ 459.017997][T14641] ip6gre0: entered promiscuous mode [ 459.043376][T14641] syz_tun: entered promiscuous mode [ 459.060157][T14641] ip6gretap0: entered promiscuous mode [ 459.080110][T14641] bridge0: entered promiscuous mode [ 459.110352][T14641] vcan0: entered promiscuous mode [ 459.115641][T14641] bond0: entered promiscuous mode [ 459.160100][T14641] bond_slave_0: entered promiscuous mode [ 459.166056][T14641] bond_slave_1: entered promiscuous mode [ 459.200392][T14641] dummy0: entered promiscuous mode [ 459.222740][T14641] nlmon0: entered promiscuous mode [ 459.228119][T14641] caif0: entered promiscuous mode [ 459.260268][T14641] batadv0: entered promiscuous mode [ 459.265744][T14641] vxcan0: entered promiscuous mode [ 459.304833][T14641] vxcan1: entered promiscuous mode [ 459.323885][T14641] veth0: entered promiscuous mode [ 459.340490][T14641] veth1: entered promiscuous mode [ 459.345801][T14641] wg0: entered promiscuous mode [ 459.377423][T14641] wg1: entered promiscuous mode [ 459.383100][T14641] wg2: entered promiscuous mode [ 459.388202][T14641] veth0_to_bridge: entered promiscuous mode [ 459.407368][T14641] veth1_to_bridge: entered promiscuous mode [ 459.424650][T14641] veth0_to_bond: entered promiscuous mode [ 459.440730][T14641] veth1_to_bond: entered promiscuous mode [ 459.452060][T14641] veth0_to_team: entered promiscuous mode [ 459.458221][T14641] veth1_to_team: entered promiscuous mode [ 459.473715][T14641] veth0_to_batadv: entered promiscuous mode [ 459.490142][T14641] batadv_slave_0: entered promiscuous mode [ 459.496240][T14641] veth1_to_batadv: entered promiscuous mode [ 459.502643][T14641] batadv_slave_1: entered promiscuous mode [ 459.508703][T14641] xfrm0: entered promiscuous mode [ 459.530217][T14641] veth0_to_hsr: entered promiscuous mode [ 459.536238][T14641] hsr_slave_0: entered promiscuous mode [ 459.546341][T14641] veth1_to_hsr: entered promiscuous mode [ 459.556465][T14641] hsr_slave_1: entered promiscuous mode [ 459.562324][T14641] veth1_virt_wifi: entered promiscuous mode [ 459.575046][T14641] veth0_virt_wifi: entered promiscuous mode [ 459.591415][T14641] virt_wifi0: entered promiscuous mode [ 459.597774][T14641] vlan0: entered promiscuous mode [ 459.610529][T14641] vlan1: entered promiscuous mode [ 459.628126][T14641] macvlan0: entered promiscuous mode [ 459.638073][T14641] macvlan1: entered promiscuous mode [ 459.648195][T14641] ipvlan0: entered promiscuous mode [ 459.658295][T14641] ipvlan1: entered promiscuous mode [ 459.670420][T14641] macvtap0: entered promiscuous mode [ 459.675985][T14641] macsec0: entered promiscuous mode [ 459.702385][T14641] geneve0: entered promiscuous mode [ 459.707853][T14641] geneve1: entered promiscuous mode [ 459.734765][T14641] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 459.752436][T14641] netdevsim netdevsim0 netdevsim1: entered promiscuous mode [ 459.760678][T14641] netdevsim netdevsim0 netdevsim2: entered promiscuous mode [ 459.768207][T14641] netdevsim netdevsim0 netdevsim3: entered promiscuous mode [ 459.776575][T14641] mac80211_hwsim hwsim22 wlan0: entered promiscuous mode [ 459.784368][T14641] mac80211_hwsim hwsim23 wlan1: entered promiscuous mode [ 459.793184][T14641] bridge1: entered promiscuous mode [ 459.798683][T14641] ip6gre1: entered promiscuous mode [ 459.804952][T14641] sit1: entered promiscuous mode [ 459.812956][T14641] @: entered promiscuous mode [ 459.830857][T14641] gtp0: entered promiscuous mode [ 460.150272][T10810] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 460.350242][T10810] usb 9-1: Using ep0 maxpacket: 8 [ 460.365959][T10810] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 460.396498][T10810] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 460.432068][T10810] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 460.479488][T10810] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 460.515786][T10810] usb 9-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 460.556927][T10810] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 460.606907][T10810] hub 9-1:1.0: bad descriptor, ignoring hub [ 460.641052][T10810] hub: probe of 9-1:1.0 failed with error -5 [ 460.659390][T10810] cdc_wdm 9-1:1.0: skipping garbage [ 460.677606][T10810] cdc_wdm 9-1:1.0: skipping garbage [ 460.717460][T10810] cdc_wdm 9-1:1.0: cdc-wdm0: USB WDM device [ 460.745162][T10810] cdc_wdm 9-1:1.0: Unknown control protocol [ 460.810510][ T52] Bluetooth: hci2: command tx timeout [ 461.063654][T14632] chnl_net:caif_netlink_parms(): no params data found [ 461.100991][ T5874] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 461.338734][ T5874] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 461.367029][T14652] usb 9-1: reset high-speed USB device number 13 using dummy_hcd [ 461.370894][ T5874] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 461.402592][ T5874] usb 5-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 461.423668][T14652] usb 9-1: device reset changed ep0 maxpacket size! [ 461.454468][ T5874] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 461.471259][T10109] IPVS: stopping backup sync thread 14141 ... [ 461.473711][T14652] cdc_wdm 9-1:1.0: Error autopm - -16 [ 461.487990][T10809] usb 9-1: USB disconnect, device number 13 [ 461.493133][ T5874] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 461.700476][T10809] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 461.765618][T14632] bridge0: port 1(bridge_slave_0) entered blocking state [ 461.795027][T14632] bridge0: port 1(bridge_slave_0) entered disabled state [ 461.818681][T14632] bridge_slave_0: entered allmulticast mode [ 461.831571][T14632] bridge_slave_0: entered promiscuous mode [ 461.867457][T14632] bridge0: port 2(bridge_slave_1) entered blocking state [ 461.889679][T14632] bridge0: port 2(bridge_slave_1) entered disabled state [ 461.908216][T14632] bridge_slave_1: entered allmulticast mode [ 461.920199][T10809] usb 9-1: Using ep0 maxpacket: 32 [ 461.928390][T14632] bridge_slave_1: entered promiscuous mode [ 461.974464][ T5874] cxacru 5-1:1.0: send of cm 0x91 failed (-71) [ 461.987400][T10809] usb 9-1: unable to get BOS descriptor or descriptor too short [ 462.005893][ T5874] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 462.016915][T10809] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 462.031958][ T5874] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 462.051835][T10809] usb 9-1: can't read configurations, error -71 [ 462.061626][ T5874] cxacru: probe of 5-1:1.0 failed with error -71 [ 462.088080][ T5874] usb 5-1: USB disconnect, device number 27 [ 462.352632][T14632] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 462.407538][T14632] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 462.658075][T14632] team0: Port device team_slave_0 added [ 462.705763][T10109] hsr_slave_0: left promiscuous mode [ 462.726895][T10109] hsr_slave_1: left promiscuous mode [ 462.735839][T10109] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 462.754861][T10109] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 462.781112][T10109] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 462.798582][T10109] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 462.890355][ T52] Bluetooth: hci2: command tx timeout [ 462.914559][T10109] bridge_slave_1: left allmulticast mode [ 462.924340][T10109] bridge_slave_1: left promiscuous mode [ 462.930278][T10109] bridge0: port 2(bridge_slave_1) entered disabled state [ 462.959985][T10109] bridge_slave_0: left allmulticast mode [ 462.965770][T10109] bridge_slave_0: left promiscuous mode [ 462.972628][T10109] bridge0: port 1(bridge_slave_0) entered disabled state [ 463.195765][T10109] veth1_macvtap: left promiscuous mode [ 463.208399][T10109] veth0_macvtap: left promiscuous mode [ 463.230576][T10109] veth1_vlan: left promiscuous mode [ 463.235972][T10109] veth0_vlan: left promiscuous mode [ 463.541306][T10109] bond1 (unregistering): (slave lo): Releasing backup interface [ 463.550817][T10109] bond1 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 463.572328][T10109] bond1 (unregistering): Released all slaves [ 464.970246][ T52] Bluetooth: hci2: command tx timeout [ 465.123501][T10109] team0 (unregistering): Port device team_slave_1 removed [ 465.221168][T10109] team0 (unregistering): Port device team_slave_0 removed [ 465.307728][T10109] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 465.399781][T10109] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 466.244640][T10109] bond0 (unregistering): Released all slaves [ 466.350063][T13996] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 466.376496][T14632] team0: Port device team_slave_1 added [ 466.426575][T14632] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 466.450233][T14632] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 466.477328][T14632] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 466.509176][T14632] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 466.530748][T14632] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 466.561348][T13996] usb 9-1: Using ep0 maxpacket: 8 [ 466.567004][T14632] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 466.582423][T13996] usb 9-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 466.621473][T13996] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 466.635820][T13996] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 466.664378][T13996] usb 9-1: SerialNumber: syz [ 466.781820][T14632] hsr_slave_0: entered promiscuous mode [ 466.823078][T14632] hsr_slave_1: entered promiscuous mode [ 467.008313][T10109] IPVS: stop unused estimator thread 0... [ 467.060195][ T5802] Bluetooth: hci2: command tx timeout [ 467.346819][T13996] cdc_ether 9-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.8-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 467.903311][T13996] usb 9-1: USB disconnect, device number 16 [ 467.962346][T13996] cdc_ether 9-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.8-1, CDC Ethernet Device [ 468.424317][T14800] A link change request failed with some changes committed already. Interface gre2 may have been left with an inconsistent configuration, please check. [ 469.130373][T14820] netlink: 'syz.4.2384': attribute type 1 has an invalid length. [ 469.202522][T14820] 8021q: adding VLAN 0 to HW filter on device bond4 [ 469.316846][T14632] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 469.354057][T14632] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 469.371141][T14632] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 469.404707][T14632] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 469.685700][T14632] 8021q: adding VLAN 0 to HW filter on device bond0 [ 469.712047][T14844] loop8: detected capacity change from 0 to 8 [ 469.737726][T14632] 8021q: adding VLAN 0 to HW filter on device team0 [ 469.754310][T14844] loop8: [POWERTEC] p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 p11 p12 [ 469.780295][T14844] loop8: p1 start 4288016841 is beyond EOD, truncated [ 469.783184][ T3513] bridge0: port 1(bridge_slave_0) entered blocking state [ 469.787135][T14844] loop8: p2 start 3165339322 is beyond EOD, [ 469.794332][ T3513] bridge0: port 1(bridge_slave_0) entered forwarding state [ 469.829213][T14844] truncated [ 469.837946][T14844] loop8: p3 start 1682154808 is beyond EOD, truncated [ 469.853302][ T3513] bridge0: port 2(bridge_slave_1) entered blocking state [ 469.860587][ T3513] bridge0: port 2(bridge_slave_1) entered forwarding state [ 469.880266][T14844] loop8: p4 start 3943463599 is beyond EOD, truncated [ 469.904158][T14844] loop8: p5 start 811013402 is beyond EOD, truncated [ 469.922224][T14844] loop8: p6 start 756951815 is beyond EOD, truncated [ 469.943815][T14844] loop8: p7 start 2403667688 is beyond EOD, truncated [ 469.952986][T14844] loop8: p8 start 3785398083 is beyond EOD, truncated [ 469.980397][T14844] loop8: p9 start 905282166 is beyond EOD, truncated [ 470.002775][T14844] loop8: p10 start 2870114546 is beyond EOD, truncated [ 470.022389][T14844] loop8: p11 start 3134710577 is beyond EOD, truncated [ 470.030402][T14844] loop8: p12 start 3464954206 is beyond EOD, truncated [ 470.706386][T14632] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 470.715556][T14867] loop8: detected capacity change from 0 to 8 [ 470.872463][T14632] veth0_vlan: entered promiscuous mode [ 470.924694][T14632] veth1_vlan: entered promiscuous mode [ 470.999568][T14874] netlink: 'syz.0.2397': attribute type 9 has an invalid length. [ 471.029417][T14874] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2397'. [ 471.073794][T14632] veth0_macvtap: entered promiscuous mode [ 471.106677][T14632] veth1_macvtap: entered promiscuous mode [ 471.181308][T14632] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 471.195548][T14632] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 471.214930][T14632] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 471.252969][T14632] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 471.272920][T14632] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 471.288384][T14632] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 471.316766][T14632] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 471.337214][T14632] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 471.349256][T14632] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 471.366411][T14632] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 471.621578][ T3481] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 471.650430][ T3481] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 471.740378][ T3513] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 471.748306][ T3513] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 471.950131][T14895] FAULT_INJECTION: forcing a failure. [ 471.950131][T14895] name failslab, interval 1, probability 0, space 0, times 0 [ 471.968195][T14898] loop3: detected capacity change from 0 to 256 [ 471.996573][T14898] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 472.010153][T14895] CPU: 0 PID: 14895 Comm: syz.8.2402 Not tainted syzkaller #0 [ 472.017713][T14895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 472.027918][T14895] Call Trace: [ 472.031243][T14895] [ 472.034221][T14895] dump_stack_lvl+0x18c/0x250 [ 472.038963][T14895] ? show_regs_print_info+0x20/0x20 [ 472.044228][T14895] ? load_image+0x420/0x420 [ 472.048789][T14895] ? __lock_acquire+0x7eb0/0x7eb0 [ 472.053847][T14895] should_fail_ex+0x394/0x4c0 [ 472.058561][T14895] should_failslab+0x9/0x20 [ 472.063090][T14895] slab_pre_alloc_hook+0x59/0x300 [ 472.068142][T14895] ? __vb2_queue_alloc+0x142/0x1410 [ 472.073376][T14895] ? __vb2_queue_alloc+0x142/0x1410 [ 472.078609][T14895] __kmem_cache_alloc_node+0x53/0x260 [ 472.084012][T14895] ? __vb2_queue_alloc+0x142/0x1410 [ 472.089244][T14895] __kmalloc+0xa7/0x240 [ 472.093439][T14895] __vb2_queue_alloc+0x142/0x1410 [ 472.098511][T14895] vb2_core_reqbufs+0x9e8/0x10d0 [ 472.103500][T14895] ? vb2_verify_memory_type+0x570/0x570 [ 472.109083][T14895] ? __mutex_lock+0x30d/0xc80 [ 472.113809][T14895] ? do_vfs_ioctl+0x156c/0x1cc0 [ 472.118695][T14895] ? __video_do_ioctl+0x56d/0xde0 [ 472.123757][T14895] ? vb2_verify_memory_type+0x1fc/0x570 [ 472.129340][T14895] vb2_ioctl_reqbufs+0x474/0x790 [ 472.134326][T14895] __video_do_ioctl+0xa34/0xde0 [ 472.139221][T14895] ? video_ioctl2+0x30/0x30 [ 472.143776][T14895] ? __might_fault+0xc6/0x120 [ 472.148478][T14895] ? __might_fault+0xaa/0x120 [ 472.153190][T14895] video_usercopy+0x889/0x1360 [ 472.158120][T14895] ? video_ioctl2+0x30/0x30 [ 472.162656][T14895] ? v4l_printk_ioctl+0x160/0x160 [ 472.167734][T14895] v4l2_ioctl+0x18a/0x1e0 [ 472.172094][T14895] ? v4l2_poll+0x2b0/0x2b0 [ 472.176535][T14895] __se_sys_ioctl+0xfd/0x170 [ 472.181164][T14895] do_syscall_64+0x55/0xb0 [ 472.185617][T14895] ? clear_bhb_loop+0x40/0x90 [ 472.190329][T14895] ? clear_bhb_loop+0x40/0x90 [ 472.195064][T14895] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 472.201009][T14895] RIP: 0033:0x7f269799f559 [ 472.205455][T14895] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 472.225093][T14895] RSP: 002b:00007f269880b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 472.233544][T14895] RAX: ffffffffffffffda RBX: 00007f2697c25fa0 RCX: 00007f269799f559 [ 472.241632][T14895] RDX: 000020000001aa40 RSI: 00000000c0145608 RDI: 0000000000000004 [ 472.249631][T14895] RBP: 00007f2697a36b20 R08: 0000000000000000 R09: 0000000000000000 [ 472.257653][T14895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 472.265658][T14895] R13: 00007f2697c26038 R14: 00007f2697c25fa0 R15: 00007ffe6475cce8 [ 472.273679][T14895] [ 472.410421][ T28] audit: type=1804 audit(1700000105.709:286): pid=14898 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.2327" name="/newroot/0/bus/file1" dev="loop3" ino=1048831 res=1 errno=0 [ 472.433101][T14898] FAT-fs (loop3): error, invalid FAT chain (i_pos 196, last_block 8) [ 472.484380][T14898] FAT-fs (loop3): Filesystem has been set read-only [ 472.516188][T14898] FAT-fs (loop3): error, corrupted file size (i_pos 196, 2056) [ 472.849148][T14911] netlink: 'syz.0.2407': attribute type 15 has an invalid length. [ 472.867790][T14911] netlink: 'syz.0.2407': attribute type 15 has an invalid length. [ 473.167104][T14929] loop4: detected capacity change from 0 to 512 [ 473.201179][T14929] EXT4-fs: inline encryption not supported [ 473.253168][T14929] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 473.361741][T14929] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2 [ 473.365273][T14937] loop3: detected capacity change from 0 to 512 [ 473.377714][T14937] EXT4-fs: Ignoring removed bh option [ 473.392603][T14937] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 473.413487][T14929] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.2413: invalid indirect mapped block 2683928664 (level 1) [ 473.442289][T14929] EXT4-fs (loop4): 1 truncate cleaned up [ 473.449442][T14929] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 473.488956][T14937] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 473.503300][T14937] ext4 filesystem being mounted at /3/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 473.917603][T14632] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 474.498052][ T5960] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 474.908810][T14978] loop8: detected capacity change from 0 to 2048 [ 474.954086][T14978] NILFS (loop8): invalid segment: Magic number mismatch [ 474.990660][T14978] NILFS (loop8): trying rollback from an earlier position [ 475.045165][T14978] NILFS (loop8): recovery complete [ 475.083021][T14983] NILFS (loop8): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 475.180603][T14985] overlayfs: failed to clone upperpath [ 475.308929][T14978] overlayfs: upper fs does not support tmpfile. [ 475.354651][T14978] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 475.390784][T14978] overlayfs: failed to set xattr on upper [ 475.396695][T14978] overlayfs: ...falling back to redirect_dir=nofollow. [ 475.404349][T14978] overlayfs: ...falling back to index=off. [ 475.410527][T14978] overlayfs: ...falling back to uuid=null. [ 475.651797][ T8] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 475.863427][ T8] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 475.902913][ T8] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 475.929565][ T8] usb 4-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 475.946091][ T8] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 475.996801][ T8] spcp8x5 4-1:1.0: SPCP8x5 converter detected [ 476.023928][ T8] usb 4-1: SPCP8x5 converter now attached to ttyUSB0 [ 476.460413][T14993] SPCP8x5 ttyUSB0: failed to set control lines: -110 [ 476.479694][T14993] SPCP8x5 ttyUSB0: Set UART format 0x30b failed (error = -32) [ 476.499827][T14993] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 476.571969][T14993] SPCP8x5 ttyUSB0: unsupported baudrate, using 9600 [ 476.600088][T13996] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 476.611156][T14993] SPCP8x5 ttyUSB0: Set UART format 0x0 failed (error = -32) [ 476.822408][T13996] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 476.839220][T13996] usb 9-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 476.867825][T13996] usb 9-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 476.878758][T15032] overlayfs: failed to clone upperpath [ 476.900829][T13996] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.950320][T13996] usb 9-1: 1:1 : no or invalid class specific endpoint descriptor [ 477.356158][T13996] usb 9-1: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 4) [ 477.450647][T13996] usb 9-1: USB disconnect, device number 17 [ 478.382800][ T5875] usb 4-1: USB disconnect, device number 4 [ 478.415867][ T5875] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 478.444130][ T5875] spcp8x5 4-1:1.0: device disconnected [ 479.036587][T15086] rxe_eth0 speed is unknown, defaulting to 1000 [ 481.619570][T15169] loop4: detected capacity change from 0 to 4096 [ 481.645556][T15169] EXT4-fs: Ignoring removed nobh option [ 481.679517][T15169] EXT4-fs: Ignoring removed bh option [ 481.701979][T15169] EXT4-fs (loop4): Test dummy encryption mode enabled [ 481.729268][T15169] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 482.071808][ T5960] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 482.255245][T15184] loop8: detected capacity change from 0 to 2048 [ 482.344158][T15184] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 482.409675][T15189] lo: entered promiscuous mode [ 482.575361][T15189] tunl0: entered promiscuous mode [ 482.690257][T15189] gre0: entered promiscuous mode [ 482.900262][T15189] erspan0: entered promiscuous mode [ 482.947917][T15189] ip_vti0: entered promiscuous mode [ 482.953973][T15199] loop8: detected capacity change from 0 to 8 [ 482.976250][T15189] ip6_vti0: entered promiscuous mode [ 483.037875][T15189] sit0: entered promiscuous mode [ 483.300133][T15189] ip6tnl0: entered promiscuous mode [ 483.403610][T15189] ip6gre0: entered promiscuous mode [ 483.415257][T15189] tipc: Resetting bearer [ 483.497475][T15189] syz_tun: entered promiscuous mode [ 483.640624][T15189] ip6gretap0: entered promiscuous mode [ 483.699603][T15189] bridge0: entered promiscuous mode [ 483.853150][T15189] vcan0: entered promiscuous mode [ 483.905986][T15189] bond0: entered promiscuous mode [ 483.980949][T15189] team0: entered promiscuous mode [ 484.000473][T15220] atomic_op ffff88803179e198 conn xmit_atomic 0000000000000000 [ 484.015177][T15189] batman_adv: batadv0: Interface deactivated: dummy0 [ 484.105905][T15189] dummy0: entered promiscuous mode [ 484.200589][T15189] nlmon0: entered promiscuous mode [ 484.222170][T15189] caif0: entered promiscuous mode [ 484.263930][T15189] batadv0: entered promiscuous mode [ 484.375920][T15189] veth0: entered promiscuous mode [ 484.474235][T15189] veth1: entered promiscuous mode [ 484.546563][T15232] FAULT_INJECTION: forcing a failure. [ 484.546563][T15232] name failslab, interval 1, probability 0, space 0, times 0 [ 484.590940][T15232] CPU: 1 PID: 15232 Comm: syz.8.2487 Not tainted syzkaller #0 [ 484.598507][T15232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 484.608626][T15232] Call Trace: [ 484.611952][T15232] [ 484.615028][T15232] dump_stack_lvl+0x18c/0x250 [ 484.619783][T15232] ? show_regs_print_info+0x20/0x20 [ 484.625039][T15232] ? load_image+0x420/0x420 [ 484.629610][T15232] ? __lock_acquire+0x7eb0/0x7eb0 [ 484.634700][T15232] should_fail_ex+0x394/0x4c0 [ 484.639442][T15232] should_failslab+0x9/0x20 [ 484.644001][T15232] slab_pre_alloc_hook+0x59/0x300 [ 484.649083][T15232] ? __vb2_queue_alloc+0x142/0x1410 [ 484.654347][T15232] ? __vb2_queue_alloc+0x142/0x1410 [ 484.659607][T15232] __kmem_cache_alloc_node+0x53/0x260 [ 484.665042][T15232] ? __vb2_queue_alloc+0x142/0x1410 [ 484.670307][T15232] __kmalloc+0xa7/0x240 [ 484.674618][T15232] __vb2_queue_alloc+0x142/0x1410 [ 484.679712][T15232] ? vicodec_queue_setup+0x139/0x260 [ 484.685155][T15232] vb2_core_reqbufs+0x9e8/0x10d0 [ 484.690152][T15232] ? vb2_verify_memory_type+0x570/0x570 [ 484.695734][T15232] ? do_vfs_ioctl+0x156c/0x1cc0 [ 484.700641][T15232] v4l2_m2m_ioctl_reqbufs+0x16c/0x230 [ 484.706089][T15232] __video_do_ioctl+0xa34/0xde0 [ 484.710990][T15232] ? video_ioctl2+0x30/0x30 [ 484.715533][T15232] ? __might_fault+0xc6/0x120 [ 484.720249][T15232] ? __might_fault+0xaa/0x120 [ 484.724993][T15232] video_usercopy+0x889/0x1360 [ 484.729834][T15232] ? video_ioctl2+0x30/0x30 [ 484.734375][T15232] ? v4l_printk_ioctl+0x160/0x160 [ 484.739451][T15232] v4l2_ioctl+0x18a/0x1e0 [ 484.743817][T15232] ? v4l2_poll+0x2b0/0x2b0 [ 484.748266][T15232] __se_sys_ioctl+0xfd/0x170 [ 484.752907][T15232] do_syscall_64+0x55/0xb0 [ 484.757382][T15232] ? clear_bhb_loop+0x40/0x90 [ 484.762106][T15232] ? clear_bhb_loop+0x40/0x90 [ 484.766822][T15232] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 484.772779][T15232] RIP: 0033:0x7f269799f559 [ 484.777225][T15232] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 484.796875][T15232] RSP: 002b:00007f269880b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 484.805332][T15232] RAX: ffffffffffffffda RBX: 00007f2697c25fa0 RCX: 00007f269799f559 [ 484.813341][T15232] RDX: 0000200000000b80 RSI: 00000000c0145608 RDI: 0000000000000004 [ 484.821346][T15232] RBP: 00007f2697a36b20 R08: 0000000000000000 R09: 0000000000000000 [ 484.829356][T15232] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 484.837366][T15232] R13: 00007f2697c26038 R14: 00007f2697c25fa0 R15: 00007ffe6475cce8 [ 484.845385][T15232] [ 484.880090][T15189] wg0: entered promiscuous mode [ 484.990884][T15189] wg1: entered promiscuous mode [ 485.048783][T15189] wg2: entered promiscuous mode [ 485.098687][T15189] veth0_to_bridge: entered promiscuous mode [ 485.145660][T15189] bridge_slave_0: entered promiscuous mode [ 485.164912][T15241] overlayfs: failed to clone upperpath [ 485.195791][T15189] veth1_to_bridge: entered promiscuous mode [ 485.265697][T15189] bridge_slave_1: entered promiscuous mode [ 485.320567][T15189] veth0_to_bond: entered promiscuous mode [ 485.331157][T13990] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 485.350961][T15189] bond_slave_0: entered promiscuous mode [ 485.373358][T15247] overlayfs: failed to clone upperpath [ 485.384150][T15189] veth1_to_bond: entered promiscuous mode [ 485.401206][T15189] bond_slave_1: entered promiscuous mode [ 485.445448][T15189] veth0_to_team: entered promiscuous mode [ 485.469038][T15189] team_slave_0: entered promiscuous mode [ 485.501373][T15189] veth1_to_team: entered promiscuous mode [ 485.518807][T15189] team_slave_1: entered promiscuous mode [ 485.525284][T13990] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 485.537910][T15189] veth0_to_batadv: entered promiscuous mode [ 485.560880][T13990] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 485.580013][T13990] usb 4-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 485.588780][T15189] batadv_slave_0: entered promiscuous mode [ 485.589118][T13990] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 485.625085][T13990] usb 4-1: config 0 descriptor?? [ 485.711080][T15189] veth1_to_batadv: entered promiscuous mode [ 485.768995][T15189] batadv_slave_1: entered promiscuous mode [ 485.837134][T15189] xfrm0: entered promiscuous mode [ 485.869776][T15256] raw_sendmsg: syz.8.2498 forgot to set AF_INET. Fix it! [ 485.891171][T15189] veth0_to_hsr: entered promiscuous mode [ 485.959682][T15189] veth1_to_hsr: entered promiscuous mode [ 486.043159][T15189] hsr0: entered promiscuous mode [ 486.067225][T13990] hid-thrustmaster 0003:044F:B65D.001B: unknown main item tag 0x0 [ 486.086560][T13990] hid-thrustmaster 0003:044F:B65D.001B: unknown main item tag 0x0 [ 486.097069][T15189] veth1_virt_wifi: entered promiscuous mode [ 486.107079][T13990] hid-thrustmaster 0003:044F:B65D.001B: unknown main item tag 0x0 [ 486.124960][T13990] hid-thrustmaster 0003:044F:B65D.001B: unknown main item tag 0x0 [ 486.146408][T13990] hid-thrustmaster 0003:044F:B65D.001B: unknown main item tag 0x0 [ 486.164996][T13990] hid-thrustmaster 0003:044F:B65D.001B: unknown main item tag 0x0 [ 486.175474][T15189] veth0_virt_wifi: entered promiscuous mode [ 486.183908][T13990] hid-thrustmaster 0003:044F:B65D.001B: unknown main item tag 0x0 [ 486.202465][T15189] virt_wifi0: entered promiscuous mode [ 486.220239][T13990] hid-thrustmaster 0003:044F:B65D.001B: hidraw0: USB HID v0.00 Device [HID 044f:b65d] on usb-dummy_hcd.3-1/input0 [ 486.263412][T13990] hid-thrustmaster 0003:044F:B65D.001B: Wrong number of endpoints? [ 486.282365][ C1] hid-thrustmaster 0003:044F:B65D.001B: Wheel with model id 0x2 is a Thrustmaster T500RS [ 486.432334][T15189] macvtap0: entered promiscuous mode [ 486.497514][T15189] macsec0: entered promiscuous mode [ 486.523467][ C1] hid-thrustmaster 0003:044F:B65D.001B: Success?! The wheel should have been initialized! [ 486.589120][T15189] geneve0: entered promiscuous mode [ 486.634026][T15189] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 486.643509][T15189] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 486.653797][T15189] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 486.662915][T15189] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 486.677693][T15189] geneve1: entered promiscuous mode [ 486.735121][ T5874] usb 4-1: USB disconnect, device number 5 [ 486.752241][T15189] netdevsim netdevsim4 netdevsim1: entered promiscuous mode [ 486.809023][T15189] netdevsim netdevsim4 netdevsim2: entered promiscuous mode [ 486.840283][T15189] netdevsim netdevsim4 netdevsim3: entered promiscuous mode [ 486.886277][T15189] mac80211_hwsim hwsim10 wlan0: entered promiscuous mode [ 486.932546][T15189] mac80211_hwsim hwsim11 wlan1: entered promiscuous mode [ 486.950944][T15189] hsr1: entered promiscuous mode [ 486.977569][T15189] ipip0: entered promiscuous mode [ 487.007491][T15189] bond1: entered promiscuous mode [ 487.013182][T15189] gretap1: entered promiscuous mode [ 487.069086][T15189] sit1: entered promiscuous mode [ 487.280676][T15189] gre1: entered promiscuous mode [ 487.301343][T15189] ip6tnl1: entered promiscuous mode [ 487.358544][T15189] pimreg: entered promiscuous mode [ 487.379375][T15189] bond2: entered promiscuous mode [ 487.411885][T15189] gre2: entered promiscuous mode [ 487.437102][T15189] bond4: entered promiscuous mode [ 487.935358][T15285] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2508'. [ 488.155660][T15288] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2510'. [ 489.234299][T15332] FAULT_INJECTION: forcing a failure. [ 489.234299][T15332] name failslab, interval 1, probability 0, space 0, times 0 [ 489.281338][T15332] CPU: 0 PID: 15332 Comm: syz.8.2520 Not tainted syzkaller #0 [ 489.288895][T15332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 489.299014][T15332] Call Trace: [ 489.302340][T15332] [ 489.305318][T15332] dump_stack_lvl+0x18c/0x250 [ 489.310067][T15332] ? show_regs_print_info+0x20/0x20 [ 489.315341][T15332] ? load_image+0x420/0x420 [ 489.319906][T15332] ? __might_sleep+0xe0/0xe0 [ 489.324570][T15332] ? __lock_acquire+0x7eb0/0x7eb0 [ 489.329699][T15332] should_fail_ex+0x394/0x4c0 [ 489.334454][T15332] should_failslab+0x9/0x20 [ 489.339016][T15332] slab_pre_alloc_hook+0x59/0x300 [ 489.344107][T15332] ? key_user_lookup+0x1bc/0x450 [ 489.349195][T15332] kmem_cache_alloc+0x5a/0x2d0 [ 489.354124][T15332] ? key_alloc+0x306/0x1030 [ 489.358736][T15332] key_alloc+0x306/0x1030 [ 489.363169][T15332] keyring_alloc+0x45/0xb0 [ 489.367650][T15332] keyctl_get_persistent+0x4df/0x820 [ 489.373022][T15332] ? proc_key_users_show+0x310/0x310 [ 489.378400][T15332] __se_sys_keyctl+0x829/0xb50 [ 489.383234][T15332] ? __x64_sys_keyctl+0xc0/0xc0 [ 489.388157][T15332] ? do_futex+0x2ff/0x3e0 [ 489.392550][T15332] ? __ia32_sys_get_robust_list+0x110/0x110 [ 489.398535][T15332] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 489.404586][T15332] ? lock_chain_count+0x20/0x20 [ 489.409506][T15332] ? lockdep_hardirqs_on+0x98/0x150 [ 489.414771][T15332] ? __x64_sys_keyctl+0x20/0xc0 [ 489.419734][T15332] do_syscall_64+0x55/0xb0 [ 489.424214][T15332] ? clear_bhb_loop+0x40/0x90 [ 489.428978][T15332] ? clear_bhb_loop+0x40/0x90 [ 489.433748][T15332] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 489.439715][T15332] RIP: 0033:0x7f269799f559 [ 489.444182][T15332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 489.463886][T15332] RSP: 002b:00007f269880b028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 489.472372][T15332] RAX: ffffffffffffffda RBX: 00007f2697c25fa0 RCX: 00007f269799f559 [ 489.480415][T15332] RDX: fffffffffffffffd RSI: ffffffffffffffff RDI: 0000000000000016 [ 489.488457][T15332] RBP: 00007f2697a36b20 R08: 0000000000000000 R09: 0000000000000000 [ 489.496488][T15332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 489.504558][T15332] R13: 00007f2697c26038 R14: 00007f2697c25fa0 R15: 00007ffe6475cce8 [ 489.512652][T15332] [ 490.845269][T15362] atomic_op ffff88801f774198 conn xmit_atomic 0000000000000000 [ 490.993996][T15368] nbd0: detected capacity change from 0 to 63 [ 491.021551][ T52] block nbd0: Receive control failed (result -32) [ 491.048521][ T56] block nbd0: Dead connection, failed to find a fallback [ 491.058845][ T56] block nbd0: shutting down sockets [ 491.068766][ T56] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.078483][ T56] Buffer I/O error on dev nbd0, logical block 0, async page read [ 491.113470][ T8625] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 3 prio class 2 [ 491.122936][ T8625] Buffer I/O error on dev nbd0, logical block 1, async page read [ 491.131125][ T8625] Buffer I/O error on dev nbd0, logical block 2, async page read [ 491.138915][ T8625] Buffer I/O error on dev nbd0, logical block 3, async page read [ 491.147138][ T8625] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 491.156557][ T8625] Buffer I/O error on dev nbd0, logical block 0, async page read [ 491.164467][ T8625] Buffer I/O error on dev nbd0, logical block 1, async page read [ 491.172399][ T8625] Buffer I/O error on dev nbd0, logical block 2, async page read [ 491.180270][ T8625] Buffer I/O error on dev nbd0, logical block 3, async page read [ 491.188839][ T8625] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 491.198434][ T8625] Buffer I/O error on dev nbd0, logical block 0, async page read [ 491.207731][ T8625] Buffer I/O error on dev nbd0, logical block 1, async page read [ 491.216096][ T8625] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 491.225694][ T8625] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 491.235389][ T8625] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 491.245008][ T8625] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 491.258072][ T8625] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 491.267371][T14757] ldm_validate_partition_table(): Disk read failed. [ 491.274302][ T8625] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.285448][T14757] Dev nbd0: unable to read RDB block 0 [ 491.293769][T14757] nbd0: unable to read partition table [ 491.314712][T14757] ldm_validate_partition_table(): Disk read failed. [ 491.332008][T14757] Dev nbd0: unable to read RDB block 0 [ 491.343620][T14757] nbd0: unable to read partition table [ 491.411146][T15381] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2535'. [ 492.253394][T15417] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2546'. [ 492.296346][T15417] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2546'. [ 493.173661][T13983] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 493.360517][T13983] usb 4-1: Using ep0 maxpacket: 32 [ 493.372343][T13983] usb 4-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 493.394301][T13983] usb 4-1: config 0 interface 0 has no altsetting 0 [ 493.406893][T13983] usb 4-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 493.430361][T13983] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 493.447746][T13983] usb 4-1: config 0 descriptor?? [ 493.913051][T13983] corsair-cpro 0003:1B1C:0C10.001C: hidraw0: USB HID v4.06 Device [HID 1b1c:0c10] on usb-dummy_hcd.3-1/input0 [ 493.950972][ T5874] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 494.160176][ T5874] usb 9-1: Using ep0 maxpacket: 8 [ 494.179698][ T5874] usb 9-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 128, changing to 11 [ 494.210059][ T5874] usb 9-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 494.239709][ T5874] usb 9-1: config 0 interface 0 has no altsetting 0 [ 494.260044][ T5874] usb 9-1: New USB device found, idVendor=05ac, idProduct=0265, bcdDevice= 0.00 [ 494.284454][ T5874] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 494.309548][ T5874] usb 9-1: config 0 descriptor?? [ 494.353852][T13983] corsair-cpro: probe of 0003:1B1C:0C10.001C failed with error -71 [ 494.397562][T13983] usb 4-1: USB disconnect, device number 6 [ 494.428192][T15475] overlayfs: failed to clone upperpath [ 494.790503][ T5874] input: HID 05ac:0265 as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/0003:05AC:0265.001D/input/input21 [ 494.811571][ T9790] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 494.938462][ T5874] magicmouse 0003:05AC:0265.001D: input,hiddev0,hidraw0: USB HID v0.01 Device [HID 05ac:0265] on usb-dummy_hcd.8-1/input0 [ 495.017353][ T5874] usb 9-1: USB disconnect, device number 18 [ 495.023457][ T9790] usb 5-1: Using ep0 maxpacket: 32 [ 495.066836][ T9790] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 495.119792][ T9790] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 495.151243][ T9790] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 495.159529][ T9790] usb 5-1: Product: syz [ 495.184624][ T9790] usb 5-1: Manufacturer: syz [ 495.194593][ T9790] usb 5-1: SerialNumber: syz [ 495.222920][T15494] lo: entered promiscuous mode [ 495.228133][ T9790] usb 5-1: config 0 descriptor?? [ 495.257115][T15489] fido_id[15489]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/report_descriptor': No such file or directory [ 495.280399][T15480] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 495.301464][ T9790] hub 5-1:0.0: bad descriptor, ignoring hub [ 495.307825][ T9790] hub: probe of 5-1:0.0 failed with error -5 [ 495.345457][T15494] tunl0: entered promiscuous mode [ 495.424729][T15494] gre0: entered promiscuous mode [ 495.617648][T15494] gretap0: entered promiscuous mode [ 495.677798][T15494] erspan0: entered promiscuous mode [ 495.792374][T15494] ip_vti0: entered promiscuous mode [ 495.869297][T15494] ip6_vti0: entered promiscuous mode [ 495.971499][T15494] sit0: entered promiscuous mode [ 496.030193][T15480] usb 5-1: reset high-speed USB device number 28 using dummy_hcd [ 496.090983][T15494] ip6tnl0: entered promiscuous mode [ 496.106404][T15480] usb 5-1: device reset changed ep0 maxpacket size! [ 496.126426][T13990] usb 5-1: USB disconnect, device number 28 [ 496.141156][T15494] ip6gre0: entered promiscuous mode [ 496.226110][T15494] syz_tun: entered promiscuous mode [ 496.296750][T15494] ip6gretap0: entered promiscuous mode [ 496.320898][T13990] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 496.349437][T15494] bridge0: port 2(bridge_slave_1) entered disabled state [ 496.357310][T15494] bridge0: port 1(bridge_slave_0) entered disabled state [ 496.379131][T15494] bridge0: entered promiscuous mode [ 496.430231][T15494] vcan0: entered promiscuous mode [ 496.461810][T15494] bond0: entered promiscuous mode [ 496.466964][T15494] bond_slave_0: entered promiscuous mode [ 496.477860][T15494] bond_slave_1: entered promiscuous mode [ 496.521401][T15494] team0: entered promiscuous mode [ 496.524265][T13990] usb 5-1: Using ep0 maxpacket: 16 [ 496.526502][T15494] team_slave_0: entered promiscuous mode [ 496.527269][T15494] team_slave_1: entered promiscuous mode [ 496.560793][T15523] loop8: detected capacity change from 0 to 512 [ 496.563049][T13990] usb 5-1: unable to get BOS descriptor or descriptor too short [ 496.605581][T13990] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 496.615266][T15523] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 496.633859][T15523] System zones: 1-12 [ 496.646569][T13990] usb 5-1: can't read configurations, error -71 [ 496.657996][T15523] EXT4-fs error (device loop8): ext4_xattr_inode_iget:441: inode #12: comm syz.8.2572: missing EA_INODE flag [ 496.672293][T15494] dummy0: entered promiscuous mode [ 496.695230][T15523] EXT4-fs error (device loop8): ext4_xattr_inode_iget:446: comm syz.8.2572: error while reading EA inode 12 err=-117 [ 496.715858][T15494] nlmon0: entered promiscuous mode [ 496.731912][T15494] caif0: entered promiscuous mode [ 496.748255][T15494] batadv0: entered promiscuous mode [ 496.780505][T15523] EXT4-fs (loop8): 1 orphan inode deleted [ 496.795810][T15494] vxcan0: entered promiscuous mode [ 496.808237][T15523] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 496.831116][T15494] vxcan1: entered promiscuous mode [ 496.858242][T15494] veth0: entered promiscuous mode [ 496.949773][T15494] veth1: entered promiscuous mode [ 496.998604][T15494] wg0: entered promiscuous mode [ 497.052313][ T9962] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 497.067700][T15494] wg1: entered promiscuous mode [ 497.211748][T15494] wg2: entered promiscuous mode [ 497.255412][T15494] veth0_to_bridge: entered promiscuous mode [ 497.380779][T15494] veth1_to_bridge: entered promiscuous mode [ 497.496637][T15494] veth0_to_bond: entered promiscuous mode [ 497.582030][T15494] veth1_to_bond: entered promiscuous mode [ 497.694449][T15494] veth0_to_team: entered promiscuous mode [ 497.827967][T15494] veth1_to_team: entered promiscuous mode [ 497.927730][T15494] veth0_to_batadv: entered promiscuous mode [ 497.959695][T15494] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 497.983732][T15494] batadv_slave_0: entered promiscuous mode [ 498.030214][T15494] veth1_to_batadv: entered promiscuous mode [ 498.050344][T15494] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 498.079776][T15494] batadv_slave_1: entered promiscuous mode [ 498.115257][T15494] xfrm0: entered promiscuous mode [ 498.144774][T15494] veth0_to_hsr: entered promiscuous mode [ 498.197384][T15494] veth1_to_hsr: entered promiscuous mode [ 498.246447][T15494] hsr0: entered promiscuous mode [ 498.272988][T15494] veth1_virt_wifi: entered promiscuous mode [ 498.309236][T15494] veth0_virt_wifi: entered promiscuous mode [ 498.323037][T15494] virt_wifi0: entered promiscuous mode [ 498.378357][T15494] vlan0: entered promiscuous mode [ 498.400659][T15494] vlan1: entered promiscuous mode [ 498.408141][T15494] macvlan0: entered promiscuous mode [ 498.433810][T15494] macvlan1: entered promiscuous mode [ 498.471743][T15494] ipvlan0: entered promiscuous mode [ 498.478006][T15494] ipvlan1: entered promiscuous mode [ 498.513071][T15494] macvtap0: entered promiscuous mode [ 498.530595][T15494] macsec0: entered promiscuous mode [ 498.542747][T15494] geneve0: entered promiscuous mode [ 498.556059][T15494] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.566129][T15494] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.591449][T15494] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.608117][T15494] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.631474][T15494] geneve1: entered promiscuous mode [ 498.668659][T15494] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 498.682286][T15494] netdevsim netdevsim3 netdevsim1: entered promiscuous mode [ 498.696268][T15494] netdevsim netdevsim3 netdevsim2: entered promiscuous mode [ 498.711569][T15494] netdevsim netdevsim3 netdevsim3: entered promiscuous mode [ 498.753329][T15494] mac80211_hwsim hwsim24 wlan0: entered promiscuous mode [ 498.785101][T15494] mac80211_hwsim hwsim25 wlan1: entered promiscuous mode [ 499.573067][T15596] netlink: 316 bytes leftover after parsing attributes in process `syz.4.2589'. [ 499.950091][T15607] lo: entered promiscuous mode [ 500.026044][T15607] tunl0: entered promiscuous mode [ 500.056452][T15607] gre0: entered promiscuous mode [ 500.219429][T15607] gretap0: entered promiscuous mode [ 500.283629][T15607] erspan0: entered promiscuous mode [ 500.346744][T15607] ip_vti0: entered promiscuous mode [ 500.380064][T13985] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 500.399381][T15607] ip6_vti0: entered promiscuous mode [ 500.457239][T15607] sit0: entered promiscuous mode [ 500.483929][T15607] ip6tnl0: entered promiscuous mode [ 500.524749][T15607] ip6gre0: entered promiscuous mode [ 500.580121][T13985] usb 5-1: Using ep0 maxpacket: 32 [ 500.593032][T13985] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 500.605694][T13985] usb 5-1: config 0 has no interface number 0 [ 500.615727][T13985] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 500.630309][T13985] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 500.638726][T13985] usb 5-1: Product: syz [ 500.643283][T15607] syz_tun: entered promiscuous mode [ 500.657641][T13985] usb 5-1: Manufacturer: syz [ 500.663084][T13985] usb 5-1: SerialNumber: syz [ 500.677889][T13985] usb 5-1: config 0 descriptor?? [ 500.701611][T13985] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 500.721944][T15607] ip6gretap0: entered promiscuous mode [ 500.802819][T15607] bridge0: port 2(bridge_slave_1) entered disabled state [ 500.810741][T15607] bridge0: port 1(bridge_slave_0) entered disabled state [ 500.820489][T15607] bridge0: entered promiscuous mode [ 500.869613][T15607] vcan0: entered promiscuous mode [ 500.899800][T15607] bond0: entered promiscuous mode [ 500.905262][T15607] bond_slave_0: entered promiscuous mode [ 500.917096][T15607] bond_slave_1: entered promiscuous mode [ 500.948509][T13985] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 500.978493][T15607] team0: entered promiscuous mode [ 500.985393][T13985] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 500.994263][T15607] team_slave_0: entered promiscuous mode [ 501.015967][T15607] team_slave_1: entered promiscuous mode [ 501.091708][T15607] dummy0: entered promiscuous mode [ 501.161865][T15607] nlmon0: entered promiscuous mode [ 501.180147][T15607] caif0: entered promiscuous mode [ 501.205621][T15607] batadv0: entered promiscuous mode [ 501.266469][T15607] vxcan0: entered promiscuous mode [ 501.290910][T15607] vxcan1: entered promiscuous mode [ 501.315983][T15607] veth0: entered promiscuous mode [ 501.366182][T15607] veth1: entered promiscuous mode [ 501.417348][T15607] wg0: entered promiscuous mode [ 501.424255][ C1] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 501.433861][T13985] usb 5-1: USB disconnect, device number 31 [ 501.468546][T13985] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 501.485396][T15607] wg1: entered promiscuous mode [ 501.504358][T13985] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 501.516297][T15607] wg2: entered promiscuous mode [ 501.531578][T13985] quatech2 5-1:0.51: device disconnected [ 501.618297][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.628003][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.635597][T15607] veth0_to_bridge: entered promiscuous mode [ 501.718330][T15607] veth1_to_bridge: entered promiscuous mode [ 501.797423][T15607] veth0_to_bond: entered promiscuous mode [ 501.843108][T15607] veth1_to_bond: entered promiscuous mode [ 501.930744][T15607] veth0_to_team: entered promiscuous mode [ 502.032146][T15607] veth1_to_team: entered promiscuous mode [ 502.111298][T15607] veth0_to_batadv: entered promiscuous mode [ 502.145505][T15607] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 502.188191][T15607] batadv_slave_0: entered promiscuous mode [ 502.243991][T15607] veth1_to_batadv: entered promiscuous mode [ 502.280462][T15607] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 502.321397][T15607] batadv_slave_1: entered promiscuous mode [ 502.386273][T15607] xfrm0: entered promiscuous mode [ 502.438719][T15607] veth0_to_hsr: entered promiscuous mode [ 502.528228][T15607] veth1_to_hsr: entered promiscuous mode [ 502.606768][T15607] hsr0: entered promiscuous mode [ 502.681328][T15607] veth1_virt_wifi: entered promiscuous mode [ 502.720897][ T11] ------------[ cut here ]------------ [ 502.727828][ T11] WARNING: CPU: 1 PID: 11 at io_uring/io_uring.c:3219 io_ring_exit_work+0x3b9/0x830 [ 502.737591][ T11] Modules linked in: [ 502.741996][ T11] CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted syzkaller #0 [ 502.749440][ T11] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 502.760007][ T11] Workqueue: iou_exit io_ring_exit_work [ 502.765665][ T11] RIP: 0010:io_ring_exit_work+0x3b9/0x830 [ 502.772029][ T11] Code: fd 48 8b 7c 24 40 48 8b 74 24 10 e8 b1 26 11 00 48 85 c0 41 bf 00 20 00 00 75 1d e8 a1 90 f9 f6 e9 b1 fd ff ff e8 97 90 f9 f6 <0f> 0b b8 70 17 00 00 48 89 44 24 10 eb c1 c7 84 24 90 00 00 00 00 [ 502.791816][ T11] RSP: 0018:ffffc90000107a40 EFLAGS: 00010293 [ 502.797980][ T11] RAX: ffffffff8a8e4349 RBX: ffff88801f7e8000 RCX: ffff88801d643c00 [ 502.806305][ T11] RDX: 0000000000000000 RSI: fffffffffffffffe RDI: 0000000000000000 [ 502.814519][ T11] RBP: ffffc90000107bb0 R08: ffffc900001079c7 R09: 1ffff92000020f38 [ 502.822694][ T11] R10: dffffc0000000000 R11: fffff52000020f39 R12: dffffc0000000000 [ 502.831119][ T11] R13: 0000000100004e6d R14: 0000000100004e6f R15: ffff88801f7e8510 [ 502.839171][ T11] FS: 0000000000000000(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000 [ 502.848224][ T11] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 502.855063][ T11] CR2: 00007f6a393f4158 CR3: 00000000300b1000 CR4: 00000000003506e0 [ 502.863169][ T11] Call Trace: [ 502.866536][ T11] [ 502.869541][ T11] ? io_ring_ctx_wait_and_kill+0x2b0/0x2b0 [ 502.875496][ T11] ? preempt_schedule_thunk+0x1a/0x30 [ 502.881049][ T11] ? process_scheduled_works+0x975/0x1600 [ 502.886934][ T11] ? process_scheduled_works+0x975/0x1600 [ 502.892932][ T11] process_scheduled_works+0xa60/0x1600 [ 502.898592][ T11] ? worker_attach_to_pool+0x370/0x370 [ 502.904231][ T11] ? assign_work+0x3cc/0x5d0 [ 502.908912][ T11] worker_thread+0xa5e/0xfe0 [ 502.913678][ T11] kthread+0x2fa/0x390 [ 502.917813][ T11] ? pr_cont_work+0x550/0x550 [ 502.922667][ T11] ? kthread_blkcg+0xd0/0xd0 [ 502.927376][ T11] ret_from_fork+0x48/0x80 [ 502.931923][ T11] ? kthread_blkcg+0xd0/0xd0 [ 502.936804][ T11] ret_from_fork_asm+0x11/0x20 [ 502.941774][ T11] [ 502.944884][ T11] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 502.952213][ T11] CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted syzkaller #0 [ 502.959645][ T11] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 502.969747][ T11] Workqueue: iou_exit io_ring_exit_work [ 502.975348][ T11] Call Trace: [ 502.978703][ T11] [ 502.981715][ T11] dump_stack_lvl+0x18c/0x250 [ 502.986514][ T11] ? show_regs_print_info+0x20/0x20 [ 502.991786][ T11] ? load_image+0x420/0x420 [ 502.996384][ T11] panic+0x2ca/0x720 [ 503.000356][ T11] ? bpf_jit_dump+0xd0/0xd0 [ 503.004942][ T11] ? ret_from_fork_asm+0x11/0x20 [ 503.009966][ T11] __warn+0x2e0/0x470 [ 503.013998][ T11] ? io_ring_exit_work+0x3b9/0x830 [ 503.019158][ T11] ? io_ring_exit_work+0x3b9/0x830 [ 503.024311][ T11] report_bug+0x2be/0x4f0 [ 503.028781][ T11] ? io_ring_exit_work+0x3b9/0x830 [ 503.033930][ T11] ? io_ring_exit_work+0x3b9/0x830 [ 503.039076][ T11] ? io_ring_exit_work+0x3bb/0x830 [ 503.044231][ T11] handle_bug+0xcf/0x120 [ 503.048518][ T11] exc_invalid_op+0x1a/0x50 [ 503.053071][ T11] asm_exc_invalid_op+0x1a/0x20 [ 503.057974][ T11] RIP: 0010:io_ring_exit_work+0x3b9/0x830 [ 503.063740][ T11] Code: fd 48 8b 7c 24 40 48 8b 74 24 10 e8 b1 26 11 00 48 85 c0 41 bf 00 20 00 00 75 1d e8 a1 90 f9 f6 e9 b1 fd ff ff e8 97 90 f9 f6 <0f> 0b b8 70 17 00 00 48 89 44 24 10 eb c1 c7 84 24 90 00 00 00 00 [ 503.083475][ T11] RSP: 0018:ffffc90000107a40 EFLAGS: 00010293 [ 503.089583][ T11] RAX: ffffffff8a8e4349 RBX: ffff88801f7e8000 RCX: ffff88801d643c00 [ 503.097594][ T11] RDX: 0000000000000000 RSI: fffffffffffffffe RDI: 0000000000000000 [ 503.105612][ T11] RBP: ffffc90000107bb0 R08: ffffc900001079c7 R09: 1ffff92000020f38 [ 503.113623][ T11] R10: dffffc0000000000 R11: fffff52000020f39 R12: dffffc0000000000 [ 503.121892][ T11] R13: 0000000100004e6d R14: 0000000100004e6f R15: ffff88801f7e8510 [ 503.130082][ T11] ? io_ring_exit_work+0x3b9/0x830 [ 503.135252][ T11] ? io_ring_ctx_wait_and_kill+0x2b0/0x2b0 [ 503.141130][ T11] ? preempt_schedule_thunk+0x1a/0x30 [ 503.146547][ T11] ? process_scheduled_works+0x975/0x1600 [ 503.152318][ T11] ? process_scheduled_works+0x975/0x1600 [ 503.158099][ T11] process_scheduled_works+0xa60/0x1600 [ 503.163712][ T11] ? worker_attach_to_pool+0x370/0x370 [ 503.169244][ T11] ? assign_work+0x3cc/0x5d0 [ 503.173884][ T11] worker_thread+0xa5e/0xfe0 [ 503.178542][ T11] kthread+0x2fa/0x390 [ 503.182655][ T11] ? pr_cont_work+0x550/0x550 [ 503.187391][ T11] ? kthread_blkcg+0xd0/0xd0 [ 503.192024][ T11] ret_from_fork+0x48/0x80 [ 503.196653][ T11] ? kthread_blkcg+0xd0/0xd0 [ 503.201311][ T11] ret_from_fork_asm+0x11/0x20 [ 503.206138][ T11] [ 503.209796][ T11] Kernel Offset: disabled [ 503.214365][ T11] Rebooting in 86400 seconds..