last executing test programs: 8.887666813s ago: executing program 2 (id=198): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x0, &(0x7f0000000500)={[{@init_itable}]}, 0x1, 0x79f, &(0x7f0000000f80)="$eJzs3c1rHOUfAPDvbJKmSfv7JYKg9RQQNFC6MTVtFTxUPIhgoaBn27DZhppNtmQ3pQkBW0TwIqh4EPTSsy/15tWXq/4XHqSlalqseJDI7Eu7aXabbM3uhubzgck+z8xsnue7z8wzz+wMOwHsWWPpn0zEoYj4MIkYqc1PImKgkuqPOFld787aai6dklhff+P3pLLO7bXVXDS8J3WglnkyIn54L+JwZnO5peWVuelCIb9Yy0+U5y9MlJZXjpyfn57Nz+YXjk9OTR09cezE8Z2L9c+fVw7e+OjVZ78++fe7T1z74MckTsbB2rLGOHbKWIzVPpOB9CPc4JWdLqzHko3Zfb2qB+1Jd82+6l4eh2Ik+iqpFoa6WTMAoFPWAYC9651eVwAA6Jb69wC311Zz9am330h0182XI2J/Nf769c3qkv7aNbv9leugw7eTDVdGkogY3YHyxyLi82/f+jKdotYOyQ78X4CtXL4SEWdHxzb3/8mmexba9dyDFq4PVl7G7pu9144/0EvfpeOfF5qN/zJ3xz/RZPwz2GTffRhb7/+Z67VE3w4Ut0k6/nup4d62Ow3x14z21XL/q4z5BpJz5wv5tG/7f0SMx8Bgmp+srNp85DZ+659brcpvHP/98fHbX6Tlp6/31shc7x/c+J6Z6fL0f4277uaViKf6m8Wf3G3/pMX49/Q2y3jtxfc/a7UsjT+Ntz5tjr+z1q9GPNO0/e+1ZdLy/sT+YyeOT1Q2h4n6RtHEN798Otyq/Mb2T6e0/Pq5QDek7T/84PhHk8b7NUvtl/HT1ZHvWy3bOv7m2/++5M1Kun6j4aXpcnlxMmJf8vrm+Ufvvbeer6+fxj/+dPP9v1ps8+0/PSc8u834+2/89tXDx99ZafwzbbV/+4lrd+Za9t3ba/+pSmq8Nmc7/d8W9bocD701AwAAAAAAAAAAAAAAAAAAAAAAAED7MhFxMJJM9m46k8lmq8/wfjyGM4ViqXz4XHFpYSYqz8oejYFM/acuRxp+D3Wy9nv49fzR+/LPR8RjEfHJ4FAln80VCzO9Dh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAag60eP5/6tfBXtcOAOiY/b2uAADQdY7/ALD3tHf8H+pYPQCA7nH+DwB7z7aP/2c7Ww8AoHvaPf/v61A9AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeGSdPnUqndb/WlvNpfmZi8tLc8WLR2bypbns/FIumysuXsjOFouzhXw2V5xv+Y8uV18KxeKFqVhYujRRzpfKE6XllTPzxaWF8pnz89Oz+TP5ga5FBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADbV1pemZsuFPKLEg9MDO2OauyaRH/simo8Com+2BXVuD/R2EsM9a6DAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANjl/g0AAP//3BEuHw==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x143042, 0x80) write$UHID_GET_REPORT_REPLY(r0, &(0x7f0000000040)={0xa, {0x2, 0x4, 0x9}}, 0xa) pwritev2(r0, &(0x7f0000000100)=[{&(0x7f0000000080)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0) sendfile(r0, r0, 0x0, 0x7a680000) 8.421221403s ago: executing program 2 (id=204): mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000300)='./bus\x00', &(0x7f0000000000)='./bus\x00', &(0x7f0000000100), 0x0, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1f1) renameat2(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) 6.162861129s ago: executing program 2 (id=208): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000002140)={[0xfffffffffffffff5]}, 0x8, 0x0) readv(r1, &(0x7f0000002940)=[{&(0x7f00000000c0)=""/121, 0x80}, {0x0, 0xe00}], 0x10000000000000fb) 6.106359359s ago: executing program 2 (id=211): syz_mount_image$fuse(0x0, &(0x7f0000000100)='./file1\x00', 0x8, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x8}) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x1c0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file4\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x4) 6.06668922s ago: executing program 2 (id=215): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x200010, &(0x7f0000001040)={[{@iocharset={'iocharset', 0x3d, 'iso8859-3'}}, {@uni_xlate}, {@shortname_winnt}, {@shortname_winnt}, {@rodir}, {@utf8}, {@numtail}, {@shortname_win95}, {@iocharset={'iocharset', 0x3d, 'macceltic'}}, {@fat=@codepage={'codepage', 0x3d, '1250'}}, {@fat=@dos1xfloppy}, {@utf8no}, {@uni_xlate}, {@rodir}, {@iocharset={'iocharset', 0x3d, 'cp860'}}, {@utf8no}]}, 0x3, 0x28e, &(0x7f0000000640)="$eJzs3c9qK2UUAPAzTdIkukgWrkS4A7pwdbn1CVqkglgQlAjqQotNQZJQaCHQKsaufAKfQPBt3Igv4AMo7uxCHEln8q9OUlNtU7y/36aHc76T70xmSlfz9dNXBr2jk7Pjyy9/jkYjia3d2I2rJNqxFRNfR6mffi3PAwCP3FWWxW9Zrp6nzhdX1JZ0VrfufTgA4F7M//3f9CwAwMN4/8OP3tk7ONh/L00bEYNvhp0k8p95fe84Po9+dONZtOKPiGwqj996+2A/qulYO14bjIadcefgkx+Kz9/7JeK6fyda0S7v30lzc/2jYacWLxT77/aj++530YqXyvvfKOmPzna8/urc/E+jFT9+FifRj6Nitkn/Vztp+mb27e9ffDzOjvuT0bBTn64rVlce9MYAAAAAAAAAAAAAAAAAAAAAAPC/9jSdai+evzM5+H9FfcX5QKO583mepWmaJfn6WX81Xq5GdZPXDgAAAAAAAAAAAAAAAAAAAI/F2flF77Df756uEXxw65rJa/0lpfhzMVOPiLV2XwierNsVlWK0fhKx3l61qF933r64suZVNMfzdE+TavQOv8/udlNuBsk005wvPYl8r3GmmQdzmX+7ab8R18Hk6eodJrfd3EbZQ7IsqPzzebKSx295+/bNTLO4gpLFzRW7b794p68uay0pJRFRm36Zqz+n9p/cwdlvCgAAAAAAAAAAAAAAAAAA8MBmL/2WFC83MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbMDs//+vEYyK5r+VslbE+UUvq4wz1ShKG75EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAngN/BQAA//+6Smay") write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0xc, {"a2e3ad214fc752f91b25060987f70e06d038e7ff7fc6e5539b325d078b089b3b08386e090890e0878f0e1ac6e7049b334d959b429a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31303b305d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c0428918246d9e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff13d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1ccab2689bee59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae23034202210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ecdf5e08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) syz_open_dev$usbfs(0x0, 0xc, 0x800) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000a40)='memory.swap.current\x00', 0x275a, 0x0) 5.939633759s ago: executing program 2 (id=218): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x80002, 0x10b) write(r0, &(0x7f0000000000)='7', 0x1) add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) 5.893114319s ago: executing program 32 (id=218): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x80002, 0x10b) write(r0, &(0x7f0000000000)='7', 0x1) add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) 2.852976835s ago: executing program 1 (id=266): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000340)={0x1, 0x80000004}, 0x8) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000080)=0x498b, 0x4) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000005700)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x0, @mcast2, 0xd}, 0x1c, 0x0}}], 0x1, 0x4004800) 2.807123824s ago: executing program 1 (id=267): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x6, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1, 0xffffffffffffffff, 0x2000000}, 0xc) 2.775969525s ago: executing program 1 (id=269): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r0, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000006, 0x4132, 0xffffffffffffffff, 0x0) setreuid(0x0, 0xee01) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000280)=""/194) 2.745469275s ago: executing program 1 (id=271): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mount$bind(&(0x7f0000000280)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000580)='./file0/../file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000008c0)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000600)='./file0\x00', &(0x7f0000000300)='./file0/../file0\x00') 2.721246724s ago: executing program 1 (id=273): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x1, {0x42}}, 0x10) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x2, {{0x42}, 0x4}}, 0x10) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000140)={0x42, 0x1}, 0x10) 2.563644795s ago: executing program 1 (id=275): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="07000000040000008000000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000c40)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000060000850000001b000000b70000000000000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xa, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r1}, 0xc) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r1}, 0xc) 2.545221244s ago: executing program 33 (id=275): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="07000000040000008000000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000c40)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000060000850000001b000000b70000000000000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xa, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r1}, 0xc) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r1}, 0xc) 2.481092284s ago: executing program 4 (id=280): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) r1 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r0}, 0x8) close(r1) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000005c0)=@bpf_tracing={0x1a, 0x2, &(0x7f0000000200)=ANY=[@ANYBLOB="b70000000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x16733, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$OBJ_PIN_PROG(0x11, 0x0, 0x0) 2.480813464s ago: executing program 4 (id=281): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000000406c256d0000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB="000005"], 0x0, 0x0, 0x0, 0x0}, 0x0) socket$tipc(0x1e, 0x5, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) 2.480430314s ago: executing program 5 (id=282): connect$unix(0xffffffffffffffff, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @none}, 0xe) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x200, @none}, 0xe) 2.407687394s ago: executing program 5 (id=283): syz_mount_image$erofs(&(0x7f0000000000), &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="757365725f78617474722c6e6f61636c2c63616368655f73747261746567793d64697361626c65642c757365725f78617474722c6e6f757365725f78617474722c63616368655f73747261746567793d72656164616865612a28b0b8175cd13b743d73797374656d5f752c00ba42dd7949c511f4cdb47352a4aea93fcd7fcc56c027298c76eea49cc2c581eca86b67878b68d491fec2bedf0223ed89ed53760c76aad66383a6d7fdeb01dffa841cf2ba3dcfc661d7fc08f543a5193f"], 0x1, 0x192, &(0x7f0000000540)="$eJzslM1O6kAUx/8zLeVyc3d3d5MbF5KIC0pb1LgxhvgCJH7FnaiVoEUI1ERYadz6AG7d+gpuTHwRdWVMXLquaTuUgfBhFAKJ57c4/KbzdeaQHBAE8WN5fnp/vHpVA/+DJOLi+4vSXsMjYzjNJ/b+ptdu764fLler/yu9zvS8z9/v33yfU+BGezt3J8XvBnjkm+CYF74NBl34Lji2hNtg2BF+JHnFX6/rhyXH1vcrzoEvhh9MP1h+yHbmF+t6m+cxaVxvNI8LjmPXxijD6veW41iR8uPSfKs2hlQ/Exym8CwY1oUvI96qTViS1vkXDP/U9vnK998fw9irNhJRR/sHN72Qjil2Pg0vJZlG+dX1RcOUJDZc2v3Ju2GYk/qTKvWPjFuuZuqNZrpULhTton1iWdklY8EwFq1M0IjCOKD/JYL+9Fs6P9ZnrcY0nBVct2aGMRpbYezVcXnQ/zhSs+HY7/1a32zCeSb2scBSyoDlBEEQE2MGDN5wrPykEyUIgiAIgiAIgiAI4st8BAAA//9zQ3Pv") openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x183341, 0x0) r0 = inotify_init1(0x80000) inotify_add_watch(r0, &(0x7f0000000040)='./file1\x00', 0x7f7) link(&(0x7f0000000200)='./file1\x00', &(0x7f0000000300)='./bus\x00') 2.381559854s ago: executing program 5 (id=286): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f00009bc000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000040)="b9410101c0b800800000ba000000000f3067f0428170c939000000b9220b00000f32c7442402ac03023122ffd924962496d80f21350f22d80fc76f06400f239cc01643c744240000000000c744240206000000c7442406000000000f01142466460f2f8c6902000000b9da0b00000f32", 0x70}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.063656114s ago: executing program 5 (id=290): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x214802, &(0x7f0000000440)={[{@nojournal_checksum}, {@nombcache}, {@barrier}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@min_batch_time={'min_batch_time', 0x3d, 0x5}}, {@usrquota}, {@noauto_da_alloc}, {@grpjquota}, {@init_itable}]}, 0xff, 0x551, &(0x7f0000001640)="$eJzs3d9vU1UcAPDv7Tp+KyMhJPpgFnkQg3Rs8wcmPuCjUSKJvmOzXRaylpK1I2ySCA/y4oshJsZIYvwDfPeR+A/4V5AoCTFk0Qdfam53ywprt9EVNuznk9xyzj23nHt67vdwbs8lDWBojWcvhYhXIuLbJOJwR1kx8sLx1eNWHl6fybYkms3P/koiyfe1j0/yPw+2M8WI376OOFl4rMqx7KW+tDxfrlTShXznRKN6ZaK+tHzqUrU8l86ll6emp8+8Mz31/nvvDqytb57/54dP73505pvjK9//cv/I7STOxqG8rLMd23CjMzMe4/lnMhpnnzhwcgCV7SbJTp8AfRnJ43w0sjHgcIzkUQ/8/30VEU1gSCXiH4ZUex7Qvrcf0H3wC+PBh6s3QOvbX1z9biT2te6NDqwkj90ZJe0vMrYpq+PXP+/czrYY3PcQAJu6cTMiTheL68e/JB//+nd6C8c8WYfxD56fu9n8561u85/Co/lPdJn/HOwSu/3YPP4L9wdQTU/Z/O+DrvPffNFqLMZG8txLrexocvFSJc3Gtpcj4kSM7s3yG63nnFm51+xV1jn/y7as/vZcMD+P+8W9j79nttwob6/Vax7cjHi16/w3edT/SZf+zz6P81us41h657VeZZu3/9lq/hzxRtf+X1vRSjZen5xoXQ8T7ativb9vHfu9V/073f6s/w9s3P6xpHO9tv70dfy079+0V1m/1/+e5PNWek++71q50ViYjNiTfLJ+/9Tae9v59vFZ+08c33j863b974+IL7bY/ltHb/U8dFv9P4BF16z9s0/V/0+fuPfxlz/23/6s/99upU7ke7Yy/m31BLfz2QEAAAAAAMBuU4iIQ5EUSo/ShUKptPp8x9E4UKjU6o2TF2uvR6us9fxDob3SfbjjeYjJ/HnYdn7qifx0RByJiO9G9rfypZlaZXanGw8AAAAAAAAAAAAAAAAAAAC7xMEe//8/88fITp8d8Mz5yW8YXpvG/yB+6QnYlfz7D8NL/MPwEv8wvMQ/DC/xD8NL/MPwEv8wvMQ/AAAAAAAAAAAAAAAAAAAAAAAAAAAADNT5c+eyrbny8PpMlp+9urQ4X7t6ajatz5eqizOlmdrCldJcrTZXSUsztepmf1+lVrsyORWL1yYaab0xUV9avlCtLV5uXLhULc+lF9LR59IqAAAAAAAAAAAAAAAAAAAAeLHUl5bny5VKuiAh0VeiuDtOQ2LAiZ0emQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgzX8BAAD//7VBN58=") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@metacopy_on}]}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r0, &(0x7f0000000400)=""/4096, 0xc00) 2.046063934s ago: executing program 3 (id=291): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x5c}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x4, 0x4, &(0x7f0000000040)=ANY=[], 0x0}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) writev(r0, &(0x7f0000000240), 0xe) 2.009773414s ago: executing program 5 (id=292): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_buf(r1, 0x0, 0x8008000000010, &(0x7f00000000c0)="170000000200010400ffbe8c5ee17688a20032e80101000a000002a257fc5ad90200bb6a880000d6c8db000000df018002000000fc0607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dfc060115003901000000000000eaffff00000000000062068f5ee50ce5af9b1c5683ffffff02ff030000ba000840024f0298e9e90539062a80e605007f71174aa951f3c63e5a1b47b63a6323ded2231454668492f9c681a6a9fc", 0xb8) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @private, @broadcast}, @echo_reply={0xe0}}}}}, 0x0) 1.883700763s ago: executing program 3 (id=293): setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x4, 0x24, &(0x7f0000000580)=ANY=[], 0x0) ioctl$EVIOCRMFF(r0, 0xc0085504, &(0x7f0000000140)=0x10) 1.852415854s ago: executing program 5 (id=294): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) unshare(0x400) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x3ec0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x80000000000, 0x0, 0xfffffffffffff30a, 0x5}, &(0x7f0000000000)={0x1f, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffe, 0x9}, 0x0, 0x0, 0x0) 1.757508463s ago: executing program 34 (id=294): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) unshare(0x400) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x3ec0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x80000000000, 0x0, 0xfffffffffffff30a, 0x5}, &(0x7f0000000000)={0x1f, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffe, 0x9}, 0x0, 0x0, 0x0) 1.150602562s ago: executing program 3 (id=296): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x2800000, &(0x7f0000000140)={[{@commit={'commit', 0x3d, 0xffffffff}}, {@delalloc}, {@noauto_da_alloc}, {@test_dummy_encryption}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x1}}, {@errors_continue}, {@delalloc}, {@barrier}], [{@smackfsdef={'smackfsdef', 0x3d, 'lowerdir'}}]}, 0x1, 0xbe9, &(0x7f0000000500)="$eJzs3M9rXFsdAPDvvZn8atNOKiLWTSMiLYjTtJJii2ArFTcuBN0KDemkhEx/kERq0oAT/QdEXQtuBLUoXdh1Nwpu3WjdWt7iQXkvr3kPHo/35nHnRzJNZpo0meSm6ecDJ/ece+7c8/32zsw9p8xMAG+tsexPGnE6Im4kEcXm/jQiBuq1oYhq47i11eWpj1aXp5Ko1X78XhJJRLxYXZ5qnStpbo83G0MR8e/vJfGFX20dd35xaXayUinPNdvnF27fOz+/uPTNmduTt8q3yncuXPr2xMWJS+OXJ3qW68f/v/r4w6/+4J3qJ3/+9OEHv/1jEldjpNnXnkcz6z0bi7H1f5N2hYiY7MH5D4O+Zj7teSaFrccNtjfSAwgMAICO0rY53JeiGH2xMXkrxj/+k2twAAAAQE/U+iJqAAAAwBGXWP8DAADAEdf6HMCL1eWpVsn3EwkH6/m1iBht5L/WLI2eQlTr26Hoj4hjL5Jo/1pr0njYno1FxLP/Xf5bVqLD95D3W3UlIr7c6fon9fxHm9+E3px/GhHjPRh/bFP7Tcr/ag/Gzzt/AN5OT641bmRb73/p+vwnOtz/Ch3uXbuR9/2vNf9b2zL/28i/r8v870c7HOPBn35/v1tflv93Hn//r62SjZ9t95TUa3i+EvGVQqf8k/X8ky7539h8slqt9osOYxQ/u1/uNn7e+df+EHE2Ouffkrz694nOT89UyuONvx3HWPnXxF+6jZ93/tn1P9bMfzh2fP2Hsn33XjpT9x/1+en164+6dPVvn3/67kDyk3ptoLnn55MLC3MXIgaSH27df/HV+baOaZ0jy//c1179+u/0/M/eE6rN50aW+Upzm7V/uWnM7z588Pdu8bTWf3le/5tdnv/bvf5/vcMxvv7P35zr1te+/s1KNv6zpLEWBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICWNCJGIklLEZHU62laKkUcj4gvxrG0cnd+4RvTd39252bWFzEa/en0TKU8HhHFRjvJ2hfq9Y32xU3tb0XEqYj4XXG43i5N3a3czDt5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1h2PiJFI0lJEpBGxVkzTUinvqAAAAICeG807AAAAAGDf7Xr97z8OAAAA4I1hGQ8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMA+O3XmydMkIqpXhuslM9Ds6881MmC/pXkHAOSmL+8AgNwU8g4AyM1rrvFNF+AISrbpH+raM9jzWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4vM6efvI0iYjqleF6yQw0+/o7PuLMAUYH7Kc07wCA3PQ1Nic6dhYONhbgYO36Jd75HQN4g3Re4wNvk2Sb/qGNY6ov9wzuW0wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHD4j9ZKkpYhI6/U0LZUiTkTEaPQn0zOV8nhEnIyI/xb7B7P2YN5BAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0HPzi0uzk5VKeW43lWRvD1c5KpWThyOMfam8HxE9PWGh6wmTQ5JyvZL3OxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHmYX1yanaxUynPzeUcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5G1+cWl2slIpz+2g8uh1Dm6r5J0jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD5+TwAAP//L50MFA==") bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={0xffffffffffffffff, 0x2000002, 0x0, 0x4b, 0x0, 0x0, 0x80000000, 0x0, 0xff41, 0x0, 0x0, 0x0, 0x5}, 0x50) ptrace$getregset(0x4205, r0, 0x202, &(0x7f0000000240)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) 959.671622ms ago: executing program 3 (id=298): write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder-control\x00', 0x2, 0x0) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000002f00)={'binder0\x00'}) 959.544752ms ago: executing program 7 (id=295): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/block/sda/hctx0/tags\x00', 0x0, 0x0) close(0x4) 880.827192ms ago: executing program 7 (id=299): syz_mount_image$vfat(&(0x7f0000000480), &(0x7f00000004c0)='./file2\x00', 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="7379735f696d6d757461626c652c666d61736b3d30313737373737373737373737373737373737373737332c73686f72746e616d653d6c6f7765722c636865636b3d7374726963742c2c756e695f786c6174653d302c726f6469722c726f6469722c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6c6f7765722c6e6f6e756d7461696c3d302c756e695f786c6174653d312c756e695f786c6174653d312c6572726f72733d636f6e74696e75652c74696d655f6f66667365743d3078303030303030303030303030303465302c757466383d302c0077b5b28056fc4549d277ed7fab6b0be29df17f888ccab55cccc917ad315c8ea56f5a89c104f92d058b92f5881e69e06002f5914c03fefbeb09121733eaf5ded73df976fbd4cfcb8b70b0bf44da1b46bc0800000000000000f9e4ebbf71c77fc9a810ce726b8c6d6295a5f2e2b069b95ba8ecce52ded99b82923228c37d5e1ec11cdbcabb8a89cbf2cf2771d69e3cf0e6760094145e542e426bceaab9b2cf261046247bce0565db3ac5888b74efd48bc9f455e60f49496ca8137aba85fe39756814fda1f0624b33a2025792a2d47aff43355f9d23a606e1a477ccfff09befb1d0cf1599d272628028b9786e1fbfb3d637c2561421488c9d0000000094bf13ac582f6b67de0cad933631794271b2259fe5d73a74ad7da615c31505c7c0c168052d38e5b64c4bb7d0599e5dcf0000000000000000000000000000002790cf17418aa278cfc0c9d1c81c63e58b877706a808e9a51cc0d73e298db2939adc0efdab4745ab0e09ef8beaaf04e5374c2e7e4672e47fe5a25502919954242f8d779d84091f20646210edf871d3f20ad66fcf4b816323b8abb307381d4ada887dcc71e35f364baa1b93fd5ee36c02aa4628511442992ced893ab946472440b53fc08cc41403e167b1f2605e04d5f0c16ed49969b59d650d88642b10c7893fe9b664421a40f4822ffcc284dfe9aea76e4a04293c970f2dae776decf07b085e16511b0bd365b0f86c7fcd8df00a87f4dbbf8e623667e3b65e4c487055a2e5cd64402a4de537bf113fc7370099e4faebe6ea9d4f155f8f5f4c5f9b205ce1bbb16e002a19457e05a210d9e9820bc7f318ebfdfcc22f83150503b2", @ANYBLOB="d23c17f6ec01b3b820b1fdfffa233394c6e77c8285b061be4d1d842e4a63ec47a083470f375b81080001cf3df73c16fd31622d37a921bdbff76ef2fed6da828ab4e0f87928c18c0380050249fb6ab8cdc85b032f67dc95a947e63e3667ac2b1c953f5017b3cf2ce986800b84dcc3b33bfe950832606c010ac9f8a252454548986e9b7a88529e53efe01210aad5b2300137f1a62cd7a4a17b307956"], 0xff, 0x2a0, &(0x7f00000001c0)="$eJzs3T9rA2UYAPDnkjSNOqSIiyJ4oINTaV1dGqWC2EmJoA4abAuShEILASsYO/UTOPo9/AguLn4DwVVwa4fKyeXumtSmf2hjCvb3m57ee8/zPrkX0inPffX6sL97kMTJ2e/RaiVR24qtOE9iLWpR+SEaAQD8f5xnWfyVPSSzUVt8NwDAMhT//wtP3QsAsByffPb5R52dne2P07QVr7ZPR90kIoano26x3tmPb2IQe7ER7biIyC4V8Qcf7mxHI82txVvD8aibZw6//LWs3/kzYpK/Ge1Ym5+/mRYu81+sukujs79S/dGOV+bnv/Pv/BiOo9uMt9+c6X892vHb13EQg9iNPHea//1mmr6f/Xj23Rf5Nnl+Uovu6uS+qay+pCMBAAAAAAAAAAAAAAAAAAAAAOAZWE/TpBjfM5nfk1+azM8ZdesXk/X1tDI732dczQdKqkLFfKAsyhE94yx+qubrbKRpmpU3TvMb8VrDiwUAAAAAAAAAAAAAAAAAAAAgd/Ttcb83GOwdLiSopgFUP+t/aJ2tmStvxHG/V7+54Or995qdNpD3euvN0WjEgh7LXcELeT8Lr7w6PdxPowiqg1noXi+/VxQ97vfScql6yP1ectderergfp5dasYjG2uWHWRXz7R12erVrOaCnkbzpblLf2dZdr867/5RnFF5JZmM2Ljf7itlMPcD5kHr+ln8cnPBG78y6o/+0gEAAAAAAAAAAAAAAAAAAOaa/uh3zuLJram1/6wpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFiy6fv/q6AVEVevXAvGZfJt95RBMw6PnvgjAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Az8EwAA//9I2EsX") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) pwrite64(r0, &(0x7f00000000c0)='^', 0xb2b1, 0x8000c61) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) sendfile(r0, r1, 0x0, 0xe3aa6ea) 843.616452ms ago: executing program 6 (id=301): io_uring_setup(0x5748, &(0x7f0000000400)={0x0, 0x3bc1, 0x40, 0x2, 0x13c}) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1000, 0xfffffff7) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101240, 0x10a) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x0) 749.708822ms ago: executing program 4 (id=304): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.empty_time\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0) 650.093972ms ago: executing program 6 (id=305): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_sys\x00', &(0x7f0000000200)='sysfs\x00', 0xc000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_sys/bus/pci/devices/0000:00:01.0/config\x00', 0x2, 0x0) sendfile(r0, r0, 0x0, 0x401) 649.967402ms ago: executing program 0 (id=306): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x4}) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000900)={0x7}) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000000)={0x4}) 611.103292ms ago: executing program 6 (id=307): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket(0x2, 0x3, 0x6) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x1d0, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x138, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x1, 0xffffffff, 0xffffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x230) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x1d0, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x138, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x1, 0xffffffff, 0xffffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x230) 520.505021ms ago: executing program 6 (id=308): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x1810800, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./dev/kmsg\x00', 0x1, 0x0) io_setup(0x101, &(0x7f0000000980)=0x0) io_submit(r1, 0x1, &(0x7f0000000d80)=[&(0x7f0000000a40)={0x0, 0x0, 0x0, 0x1, 0xa, r0, 0x0, 0x0, 0x1, 0x0, 0x0, r0}]) 520.424572ms ago: executing program 4 (id=309): syz_read_part_table(0x5bd, &(0x7f0000000b80)="$eJzs2z9o02kYB/AnahAUzsXJ4bAOTi6KoxmsJFFRCNEu4qCgiJgpghAhINihzdDSDKVjl1LI0j9T0wwdjpYWOpfSoUehQ6ejXQpdmuOu7+3t9Q8Inw/8ePK+7zd58gy/8Q1+aZfir263m4mI7tWTf7uvlS88u116XH4dkYm3EdHzx28z/5xkUuK/X72T1ptpPTF+rTO49zTb2ni1f/fdYuNSOv+RnuuT7b5TD8e5m8ot3fjZXy0O1XKf14v17YG11ZfTu/ly+0WjOfM8++RDyi2neiXVr1GL7/El3kclKvExqmfUf6y1df/wVrE19+nRQaEzvPAg5UqnnPO4/b/1jLxp1nvvzd4cfVibXynvXD7KVf7H2wUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMWbyi3d+NlfLQ7Vcp/Xi/XtgbXVl9O7+XL7RaM58zz75EPKLad6JdWvUYvv8SXeRyUq8TGqZ9R/rLV1//BWsTX36dFBoTO88CDlSqec87j9v/WMvGnWe+/N3hx9WJtfKe9cPspVrp7THwAAAAAAAAAAAAAAAAAAAICIyBee3S49Lr+OyMTbiGj/3vvvVf9uuu+eSbk76cNm2p8Yv9YZ3HuabW282r/7brHxZ9r/kZ7rk+2+i5+Gk/o7AAD//5Yblcc=") r0 = openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0), 0x182902, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0xc4042, 0x1ff) ioprio_set$pid(0x2, 0x0, 0x0) sendfile(r1, r0, 0x0, 0x1fffe) 499.116861ms ago: executing program 0 (id=310): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000440)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x20}]}) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000000700)=@vmx={0x100, 0x0, 0x2080, {0x1000, 0xffffffffffffffff, {0x2}, 0x1, 0xfffffffffffffff6}, {'\x00', "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00"}}) 499.051961ms ago: executing program 3 (id=311): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCDISCONN(r0, 0x7439) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8) close(0x3) 364.224501ms ago: executing program 6 (id=312): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r2, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x3e, &(0x7f0000000840)={@local, @local, @val={@val={0x88a8, 0x0, 0x0, 0x3}, {0x8100, 0x6, 0x1, 0x1}}, {@ipv6={0x86dd, @generic={0x1, 0x6, 'FP ', 0x0, 0x67, 0x1, @private0, @ipv4={'\x00', '\xff\xff', @multicast1}}}}}, 0x0) 292.135801ms ago: executing program 0 (id=313): mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)={[], [], 0x2f}) r0 = syz_io_uring_setup(0xa95, &(0x7f0000000080)={0x0, 0x8c42, 0x400, 0x1, 0xa}, &(0x7f0000000040)=0x0, &(0x7f0000000340)=0x0, &(0x7f0000000180)=0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) syz_io_uring_submit$UBLK(r1, r2, r3, &(0x7f00000003c0)=@ublk_get_features_sqe={0x2e, 0x69, 0x0, 0xffffffffffffffff, 0x80207513, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffbb1, 0x0, 0x0, '\x00', {0x0, 0xffff, 0x0, 0x0}}) io_uring_enter(r0, 0x20, 0x20, 0x1, 0x0, 0x0) 250.614741ms ago: executing program 4 (id=314): r0 = epoll_create1(0x0) r1 = signalfd4(0xffffffffffffffff, &(0x7f00000000c0)={[0x4]}, 0x8, 0x800) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000100)={0xc000000b}) signalfd4(r1, &(0x7f0000000140)={[0xfffffffffffffff9]}, 0x8, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x80000000000, 0x0, 0xfffffffffffff30a, 0x5}, &(0x7f0000000000)={0x1f, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffe, 0x9}, 0x0, 0x0, 0x0) 223.717561ms ago: executing program 6 (id=315): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x10008, &(0x7f0000000080)={[{@debug}, {@resuid={'resuid', 0x3d, 0xee01}}]}, 0xff, 0x49e, &(0x7f0000000f40)="$eJzs3M9vFFUcAPDvbH/Qyo9WRBQEraCR+KOlBZWDBzSaeNDERA94rG1BZKGG1gRIo8UYPBoS78ajiX+BNy9GPRgTr5p4NCREe6F4qpmdGbpsd0u3tF3pfj7Jdt/bmd33vjPv7b6Z15kA2tZA+ieJ2BYRv0dEX5a9fYWB7Gl+bmbs5tzMWBILC2//nVTWuzE3M1asWrxva545VIoofZbE8WRpuVMXL50ZLZcnzuf5oemzHw5NXbz03Omzo6cmTk2cGzl27OiR4RdfGHl+TeJM47qx9+PJfXtef/fqm2Mnrr7307dptXbvz5ZXx3FHN+sEVMdAutX+WaioXfZkE3W/F2yvSiedLawITemIiHR3dVX6f190xOLO64vXPm1p5YB1lf42bWm8eHYB2MSSaHUNgNYofujT49/isUFDj/+F6y9HdOfp+bmZsflb8XdGKX+9ax3LH4iIE7P/fpU+otnzEAAAq1AZ2zxbb/xXit2V52yuY0c+h9IfEfdHxM6IeCAidkXEgxGVdR+KiIezNy/0rbD8gZr80vFP6VrdOq+RdPz3UtXYb74q/vypvyPPba/E35WcPF2eOJxvk0PRtSXNDy9Txvev/vZFo2XV47/0kZZfjAXzClzrrDlBNz46PbpWG+H65Yi9nfXiT27NBKQtYE9E7G3uo3cUidNPf7Ov0Up3jn8ZazDPtPB1xFPZ/p+NmvgLyfLzk0M9UZ44PFS0iqV+/vXKW43Kv6v418D1A49kicX9X7NGVUMrlyfOTzVfxpU/Pm94TLPa9t+dvFOZs/7l/ey1C6PT0+eHI7qTNyr54piu8vrI4nsvjE73pvli/bT9HzpYv//vzN+T7v90K6WNeH9EPBoRj+V1fzwiDkTEwWXi//GVJz5YJv4kkmjd/r8cMV73++9W++9PqufrV5HoOPPDd41mzFe2/4/GbOW7NlP5/ruDlVbwLjcfAAAA3BNKEbEtktJglh7YFqXS4GD2P/y74r5SeXJq+pmTkx+dG8+uEeiPrlJxpquv6nzocDKbf2KWH8nPFRfLj+Tnjb/s6K3kB8cmy+Mtjh3a3dbb+38U/T/1V0erawesO9drQfuq7f+lFtUD2Hgr+f13LACb0+39vyf909uqugAby/E/tK96/f+TmrzxP2xOS/v/n3VuWQdsRsb/0L70f2hf+j+0pWYu54/jjRb1REQztwUoLhZY/V0FelZ8hX+7JIo7XqxnWb1x6Ux3/kqUWhRpR5ONbVMk0h6zsYUu3kMFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgXvZfAAAA//8hId5P") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x182) r0 = open$dir(&(0x7f0000000000)='./file0\x00', 0x800, 0x20) rmdir(&(0x7f00000000c0)='./file0\x00') ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f00000001c0)=@v1={0x0, @aes128, 0x4, @desc3}) 212.707691ms ago: executing program 0 (id=316): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000200)=0x237a, 0x4) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) sendmmsg$inet6(r0, &(0x7f0000000e00)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @empty}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r0, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/35, 0x23}, 0x7}], 0x40000cb, 0x12141, 0x0) 165.894851ms ago: executing program 0 (id=317): setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0x42, 0x4, 0x278, 0xffffffff, 0x98, 0x11c0, 0x11c0, 0xffffffff, 0xffffffff, 0x1258, 0x1258, 0x1258, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'netpci0\x00', 'nr0\x00', {}, {}, 0x0, 0x2}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@ip={@empty, @remote, 0xff, 0x0, 'veth0_to_batadv\x00', 'team_slave_1\x00'}, 0x287, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x3, {0x8}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x1ff, 0x2, 0x1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2d8) r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000140)=ANY=[@ANYBLOB="bbbbbbbbbbbbffffffffffff86dd6000000000303a0020010000000000000800000000000000ff0200000000000000000000000000010103"], 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x1226, [{0xa00, 0x11}, {0x0, 0x100000000000000}]}, 0xa50) 165.008511ms ago: executing program 4 (id=327): r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) 71.084051ms ago: executing program 3 (id=318): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = epoll_create(0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000001c0)={0x10000001}) 0s ago: executing program 0 (id=319): socket$netlink(0x10, 0x3, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000700)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab190c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000980)=ANY=[], 0x78) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e23, 0x8020000c, @loopback, 0xffffffff}, 0x1c) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 15.696306][ T28] kauditd_printk_skb: 26 callbacks suppressed [ 15.696322][ T28] audit: type=1400 audit(1791439175.764:59): avc: denied { transition } for pid=224 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.701046][ T28] audit: type=1400 audit(1791439175.764:60): avc: denied { noatsecure } for pid=224 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.705083][ T28] audit: type=1400 audit(1791439175.774:61): avc: denied { write } for pid=224 comm="sh" path="pipe:[14461]" dev="pipefs" ino=14461 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 15.708747][ T28] audit: type=1400 audit(1791439175.774:62): avc: denied { rlimitinh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.711734][ T28] audit: type=1400 audit(1791439175.774:63): avc: denied { siginh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.112' (ED25519) to the list of known hosts. [ 25.050703][ T28] audit: type=1400 audit(1791439185.124:64): avc: denied { mounton } for pid=278 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.054559][ T278] cgroup: Unknown subsys name 'net' [ 25.073408][ T28] audit: type=1400 audit(1791439185.124:65): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.100824][ T28] audit: type=1400 audit(1791439185.154:66): avc: denied { unmount } for pid=278 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.101260][ T278] cgroup: Unknown subsys name 'devices' [ 25.249218][ T278] cgroup: Unknown subsys name 'hugetlb' [ 25.254953][ T278] cgroup: Unknown subsys name 'rlimit' [ 25.360283][ T28] audit: type=1400 audit(1791439185.434:67): avc: denied { setattr } for pid=278 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.383523][ T28] audit: type=1400 audit(1791439185.434:68): avc: denied { mounton } for pid=278 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.408446][ T28] audit: type=1400 audit(1791439185.434:69): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 25.438982][ T280] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 25.448464][ T28] audit: type=1400 audit(1791439185.524:70): avc: denied { relabelto } for pid=280 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.474053][ T28] audit: type=1400 audit(1791439185.524:71): avc: denied { write } for pid=280 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.506464][ T28] audit: type=1400 audit(1791439185.574:72): avc: denied { read } for pid=278 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.507781][ T278] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.532261][ T28] audit: type=1400 audit(1791439185.574:73): avc: denied { open } for pid=278 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.352735][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.359900][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.367548][ T286] device bridge_slave_0 entered promiscuous mode [ 26.375683][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.382836][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.390307][ T286] device bridge_slave_1 entered promiscuous mode [ 26.405741][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.412888][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.420426][ T287] device bridge_slave_0 entered promiscuous mode [ 26.428668][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.435729][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.443269][ T287] device bridge_slave_1 entered promiscuous mode [ 26.524889][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.532284][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.540021][ T288] device bridge_slave_0 entered promiscuous mode [ 26.573513][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.580688][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.588412][ T288] device bridge_slave_1 entered promiscuous mode [ 26.621397][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.628524][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.636039][ T290] device bridge_slave_0 entered promiscuous mode [ 26.643633][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.650742][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.658269][ T290] device bridge_slave_1 entered promiscuous mode [ 26.693478][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.700635][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.708179][ T289] device bridge_slave_0 entered promiscuous mode [ 26.737264][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.744366][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.752063][ T289] device bridge_slave_1 entered promiscuous mode [ 26.796721][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.803829][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.811178][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.818256][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.889970][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.897067][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.904361][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.911437][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.969408][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.976469][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.983801][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.990875][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.011522][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.018779][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.026084][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.033169][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.049203][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.057336][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.064707][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.072100][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.079591][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.086775][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.094444][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.102066][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.109276][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.138741][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.147098][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.154153][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.162496][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.170336][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.178029][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.186192][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.193270][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.200662][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.209029][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.216070][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.223565][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.231791][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.238875][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.246288][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.254388][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.265314][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.296332][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.304707][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.313176][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.320302][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.328504][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.336693][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.343779][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.351434][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.360189][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 27.371251][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.379824][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.406721][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.414512][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.422224][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.429968][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.438706][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 27.447289][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.455490][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.462608][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.475599][ T287] device veth0_vlan entered promiscuous mode [ 27.489328][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 27.497834][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.506023][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 27.514271][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.522950][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 27.531371][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.539650][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.546686][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.554224][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 27.562601][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.570965][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.578021][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.585496][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.593194][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.617290][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.625464][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 27.634083][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.642566][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.649689][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.657611][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.665974][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.674524][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 27.682588][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.690808][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 27.698962][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.707248][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.714743][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.723457][ T286] device veth0_vlan entered promiscuous mode [ 27.734455][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.752395][ T289] device veth0_vlan entered promiscuous mode [ 27.760592][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.769657][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.777680][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.785262][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 27.793645][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.801814][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 27.810144][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.820176][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 27.828520][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.837259][ T287] device veth1_macvtap entered promiscuous mode [ 27.852245][ T286] device veth1_macvtap entered promiscuous mode [ 27.861245][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.869160][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 27.877648][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.885823][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.894411][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 27.902700][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.914177][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.929865][ T289] device veth1_macvtap entered promiscuous mode [ 27.946577][ T288] device veth0_vlan entered promiscuous mode [ 27.954482][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.963151][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.971794][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.980485][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.989034][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.997659][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.005992][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 28.014555][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.023186][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 28.031339][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.052622][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.060588][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.068273][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.071620][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 28.078699][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.093057][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 28.101752][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.110200][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.118743][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.131256][ T290] device veth0_vlan entered promiscuous mode [ 28.143402][ T288] device veth1_macvtap entered promiscuous mode [ 28.156315][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.165650][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 28.175159][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.183553][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.195719][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.204541][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.212149][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.231990][ T290] device veth1_macvtap entered promiscuous mode [ 28.248883][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 28.257468][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.265550][ T315] loop2: detected capacity change from 0 to 1024 [ 28.266275][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 28.281005][ T315] EXT4-fs: Ignoring removed bh option [ 28.283550][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 28.295276][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.312300][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.321432][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.322356][ T315] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 28.346194][ T315] EXT4-fs (loop2): shut down requested (2) [ 28.359363][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 28.370247][ T315] EXT4-fs (loop2): unmounting filesystem. [ 28.370885][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.413465][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.425614][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.454173][ T325] syz.3.4 (325) used greatest stack depth: 21992 bytes left [ 28.466838][ T329] loop4: detected capacity change from 0 to 256 [ 28.473715][ T19] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 28.500515][ T332] Illegal XDP return value 332 on prog (id 1) dev N/A, expect packet loss! [ 28.541821][ T338] netlink: 28 bytes leftover after parsing attributes in process `syz.3.12'. [ 28.563429][ T341] netlink: 'syz.4.10': attribute type 4 has an invalid length. [ 28.611990][ T347] loop3: detected capacity change from 0 to 4096 [ 28.626369][ T347] EXT4-fs: Ignoring removed mblk_io_submit option [ 28.633052][ T351] binder: 350:351 ioctl c0306201 0 returned -14 [ 28.640419][ T351] binder: 350:351 ioctl c00c620f 200000000500 returned -22 [ 28.655650][ T347] EXT4-fs: Ignoring removed orlov option [ 28.673659][ T347] EXT4-fs: Mount option(s) incompatible with ext2 [ 28.685178][ T19] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.686709][ T354] loop4: detected capacity change from 0 to 512 [ 28.704514][ T19] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 28.715220][ T19] usb 2-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 28.724543][ T354] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 28.732089][ T19] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.744822][ T354] EXT4-fs (loop4): 1 truncate cleaned up [ 28.755618][ T19] usb 2-1: config 0 descriptor?? [ 28.761059][ T354] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 28.785999][ T347] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 28.802871][ T288] EXT4-fs (loop4): unmounting filesystem. [ 28.836530][ T365] loop4: detected capacity change from 0 to 1024 [ 28.844905][ T365] ======================================================= [ 28.844905][ T365] WARNING: The mand mount option has been deprecated and [ 28.844905][ T365] and is ignored by this kernel. Remove the mand [ 28.844905][ T365] option from the mount to silence this warning. [ 28.844905][ T365] ======================================================= [ 28.854544][ T301] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 28.892565][ T368] capability: warning: `syz.2.23' uses deprecated v2 capabilities in a way that may be insecure [ 28.930954][ T365] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 28.942874][ T365] ext4 filesystem being mounted at /5/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 28.981236][ T365] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #15: comm syz.4.22: lblock 0 mapped to illegal pblock 0 (length 1) [ 28.995143][ T365] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 29.007742][ T365] EXT4-fs (loop4): This should not happen!! Data will be lost [ 29.007742][ T365] [ 29.028259][ T8] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #15: block 4: comm kworker/u4:0: lblock 4 mapped to illegal pblock 4 (length 2) [ 29.042815][ T8] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 4 with max blocks 2 with error 117 [ 29.055308][ T8] EXT4-fs (loop4): This should not happen!! Data will be lost [ 29.055308][ T8] [ 29.065509][ T8] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #15: block 8: comm kworker/u4:0: lblock 8 mapped to illegal pblock 8 (length 8) [ 29.080145][ T8] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 29.092829][ T8] EXT4-fs (loop4): This should not happen!! Data will be lost [ 29.092829][ T8] [ 29.103032][ T301] usb 1-1: config 1 interface 0 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 29.105859][ T288] EXT4-fs (loop4): unmounting filesystem. [ 29.119867][ T301] usb 1-1: New USB device found, idVendor=174c, idProduct=56aa, bcdDevice= 1.00 [ 29.131183][ T301] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.139758][ T301] usb 1-1: Product: syz [ 29.144085][ T301] usb 1-1: Manufacturer: syz [ 29.148993][ T301] usb 1-1: SerialNumber: syz [ 29.180341][ T19] hid-steam 0003:28DE:1142.0001: unknown main item tag 0x0 [ 29.188943][ T19] hid-steam 0003:28DE:1142.0001: unknown main item tag 0x0 [ 29.196285][ T19] hid-steam 0003:28DE:1142.0001: collection stack underflow [ 29.204041][ T19] hid-steam 0003:28DE:1142.0001: item 0 0 0 12 parsing failed [ 29.212052][ T19] hid-steam 0003:28DE:1142.0001: steam_probe:parse of hid interface failed [ 29.221387][ T19] hid-steam: probe of 0003:28DE:1142.0001 failed with error -22 [ 29.360409][ T301] scsi host1: uas [ 29.370738][ T301] scsi 1:0:0:0: tag#4 sense submit err -2 uas-tag 1 inflight: s-st a-in a-cmd s-cmd [ 29.380290][ T301] scsi 1:0:0:0: tag#4 CDB: opcode=0x12 12 00 00 00 24 00 [ 29.392732][ T295] usb 2-1: USB disconnect, device number 2 [ 29.447218][ T56] scsi 1:0:0:0: tag#4 sense submit err -2 uas-tag 1 inflight: s-st a-in a-cmd s-cmd [ 29.456772][ T56] scsi 1:0:0:0: tag#4 CDB: opcode=0x12 12 00 00 00 24 00 [ 29.527125][ T56] scsi 1:0:0:0: tag#4 sense submit err -2 uas-tag 1 inflight: s-st a-in a-cmd s-cmd [ 29.536683][ T56] scsi 1:0:0:0: tag#4 CDB: opcode=0x12 12 00 00 00 24 00 [ 29.572618][ T318] usb 1-1: USB disconnect, device number 2 [ 29.821497][ T428] loop4: detected capacity change from 0 to 256 [ 29.912756][ T301] smpboot: CPU 1 is now offline [ 29.937158][ T436] x86: Booting SMP configuration: [ 30.238974][ T439] loop2: detected capacity change from 0 to 131072 [ 30.253567][ T439] F2FS-fs (loop2): invalid crc value [ 30.278959][ T439] F2FS-fs (loop2): Found nat_bits in checkpoint [ 30.307937][ T436] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 30.317887][ T439] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4 [ 30.327235][ T28] kauditd_printk_skb: 109 callbacks suppressed [ 30.327246][ T28] audit: type=1400 audit(1791439190.394:183): avc: denied { mount } for pid=437 comm="syz.2.52" name="/" dev="loop2" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 30.459007][ T28] audit: type=1400 audit(1791439190.534:184): avc: denied { read } for pid=452 comm="syz.0.56" name="ptp0" dev="devtmpfs" ino=264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 30.511093][ T28] audit: type=1400 audit(1791439190.544:185): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 30.587814][ T28] audit: type=1400 audit(1791439190.554:186): avc: denied { open } for pid=452 comm="syz.0.56" path="/dev/ptp0" dev="devtmpfs" ino=264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 30.667016][ T28] audit: type=1400 audit(1791439190.584:187): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 30.838038][ T473] loop4: detected capacity change from 0 to 128 [ 30.857123][ T453] loop0: detected capacity change from 0 to 40427 [ 30.879446][ T473] FAT-fs (loop4): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 30.881908][ T453] F2FS-fs (loop0): Corrupted extension count (64 + 1 > 64) [ 30.888766][ T28] audit: type=1400 audit(1791439190.954:188): avc: denied { mounton } for pid=452 comm="syz.0.56" path="/syzcgroup/unified/syz0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 30.906178][ T453] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 31.034095][ T28] audit: type=1400 audit(1791439191.104:189): avc: denied { read } for pid=474 comm="syz.2.57" name="msr" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 31.061037][ T477] loop4: detected capacity change from 0 to 512 [ 31.083990][ T28] audit: type=1400 audit(1791439191.134:190): avc: denied { open } for pid=474 comm="syz.2.57" path="/dev/cpu/0/msr" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 31.150368][ T477] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 31.169484][ T477] ext4 filesystem being mounted at /28/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.205604][ T28] audit: type=1400 audit(1791439191.274:191): avc: denied { map } for pid=485 comm="syz.2.70" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=16581 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 31.247056][ T453] F2FS-fs (loop0): Image doesn't support compression [ 31.253830][ T453] F2FS-fs (loop0): Image doesn't support compression [ 31.267876][ T288] EXT4-fs (loop4): unmounting filesystem. [ 31.291247][ T28] audit: type=1400 audit(1791439191.274:192): avc: denied { read write } for pid=485 comm="syz.2.70" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=16581 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 31.337677][ T453] F2FS-fs (loop0): invalid crc value [ 31.353892][ T453] F2FS-fs (loop0): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 31.423876][ T453] F2FS-fs (loop0): Start checkpoint disabled! [ 31.445877][ T453] F2FS-fs (loop0): f2fs_disable_checkpoint() finish, err:0 [ 31.486229][ T453] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 31.495933][ T453] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 31.805178][ T462] F2FS-fs (loop1): invalid crc_offset: 266236 [ 31.854319][ T462] F2FS-fs (loop1): Found nat_bits in checkpoint [ 31.889938][ T529] input: syz1 as /devices/virtual/input/input4 [ 31.927039][ T462] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 32.015983][ T471] F2FS-fs (loop3): invalid crc value [ 32.058795][ T471] F2FS-fs (loop3): Found nat_bits in checkpoint [ 32.147163][ T471] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 32.600957][ T503] F2FS-fs (loop4): Invalid segment/section count (458783, 24 x 150994945) [ 32.637744][ T503] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 32.657298][ T503] F2FS-fs (loop4): invalid crc value [ 32.687904][ T503] F2FS-fs (loop4): Found nat_bits in checkpoint [ 32.736359][ T554] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0xc8e61e97, utbl_chksum : 0xe619d30d) [ 32.774758][ T503] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 32.782731][ T503] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 32.876359][ T503] F2FS-fs (loop4): sanity_check_inode: inode (ino=4, mode=16877) should not have inline_data, run fsck to fix [ 32.889073][ T562] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 32.928157][ T564] F2FS-fs (loop4): Found FS corruption, run fsck to fix. [ 32.954185][ T566] EXT4-fs (loop3): 1 truncate cleaned up [ 33.002517][ T566] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 33.087370][ T566] EXT4-fs error (device loop3): ext4_validate_block_bitmap:438: comm syz.3.102: bg 0: block 465: padding at end of block bitmap is not set [ 33.137469][ T566] EXT4-fs (loop3): Delayed block allocation failed for inode 13 at logical offset 3 with max blocks 9 with error 28 [ 33.180156][ T566] EXT4-fs (loop3): This should not happen!! Data will be lost [ 33.180156][ T566] [ 33.200338][ T566] EXT4-fs (loop3): Total free blocks count 0 [ 33.206507][ T566] EXT4-fs (loop3): Free/Dirty block details [ 33.237966][ T566] EXT4-fs (loop3): free_blocks=0 [ 33.253128][ T566] EXT4-fs (loop3): dirty_blocks=9 [ 33.268463][ T566] EXT4-fs (loop3): Block reservation details [ 33.295011][ T566] EXT4-fs (loop3): i_reserved_data_blocks=9 [ 33.307009][ T318] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 33.333240][ T286] EXT4-fs (loop3): unmounting filesystem. [ 33.384773][ T586] set_capacity_and_notify: 11 callbacks suppressed [ 33.384796][ T586] loop4: detected capacity change from 0 to 128 [ 33.475487][ T552] loop2: detected capacity change from 0 to 131072 [ 33.484241][ T552] F2FS-fs (loop2): Invalid log blocks per segment (2236) [ 33.491570][ T552] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 33.501052][ T552] F2FS-fs (loop2): invalid crc value [ 33.510658][ T318] usb 2-1: unable to get BOS descriptor or descriptor too short [ 33.527845][ T318] usb 2-1: not running at top speed; connect to a high speed hub [ 33.546669][ T318] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 4 [ 33.561053][ T552] F2FS-fs (loop2): Found nat_bits in checkpoint [ 33.569371][ T318] usb 2-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 33.578601][ T318] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.586824][ T318] usb 2-1: Product: syz [ 33.591174][ T318] usb 2-1: Manufacturer: syz [ 33.595804][ T318] usb 2-1: SerialNumber: syz [ 33.627903][ T301] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 33.655307][ T552] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0 [ 33.662716][ T552] F2FS-fs (loop2): Mounted with checkpoint version = 753bd00b [ 33.804874][ T318] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 33.816994][ T301] usb 1-1: Using ep0 maxpacket: 8 [ 33.823332][ T301] usb 1-1: config index 0 descriptor too short (expected 1060, got 36) [ 33.837164][ T301] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.861362][ T301] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 33.892507][ T301] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 33.907079][ T301] usb 1-1: New USB device found, idVendor=1345, idProduct=3008, bcdDevice= 0.00 [ 33.916286][ T301] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.930342][ T301] usb 1-1: config 0 descriptor?? [ 34.004306][ T318] usb 2-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 34.014577][ T318] usb 2-1: found format II with max.bitrate = 4, frame size=7372 [ 34.026218][ T608] loop3: detected capacity change from 0 to 40427 [ 34.039744][ T619] bridge0: port 3(dummy0) entered blocking state [ 34.046245][ T608] F2FS-fs (loop3): Wrong segment_count / block_count (64 > 16384) [ 34.054210][ T619] bridge0: port 3(dummy0) entered disabled state [ 34.060732][ T608] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 34.070187][ T619] device dummy0 entered promiscuous mode [ 34.076807][ T619] bridge0: port 3(dummy0) entered blocking state [ 34.083270][ T619] bridge0: port 3(dummy0) entered forwarding state [ 34.092641][ T624] device dummy0 left promiscuous mode [ 34.098571][ T624] bridge0: port 3(dummy0) entered disabled state [ 34.106156][ T608] F2FS-fs (loop3): Found nat_bits in checkpoint [ 34.174189][ T608] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 34.182151][ T608] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 34.382952][ T644] loop4: detected capacity change from 0 to 256 [ 34.405042][ T318] usb 2-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 34.418114][ T644] FAT-fs (loop4): Directory bread(block 64) failed [ 34.424237][ T318] usb 2-1: found format II with max.bitrate = 4, frame size=7372 [ 34.424696][ T644] FAT-fs (loop4): Directory bread(block 65) failed [ 34.424802][ T644] FAT-fs (loop4): Directory bread(block 66) failed [ 34.458321][ T644] FAT-fs (loop4): Directory bread(block 67) failed [ 34.465082][ T644] FAT-fs (loop4): Directory bread(block 68) failed [ 34.478705][ T648] loop3: detected capacity change from 0 to 512 [ 34.486667][ T644] FAT-fs (loop4): Directory bread(block 69) failed [ 34.494133][ T644] FAT-fs (loop4): Directory bread(block 70) failed [ 34.520650][ T644] FAT-fs (loop4): Directory bread(block 71) failed [ 34.532690][ T644] FAT-fs (loop4): Directory bread(block 72) failed [ 34.539999][ T644] FAT-fs (loop4): Directory bread(block 73) failed [ 34.594549][ T644] syz.4.135: attempt to access beyond end of device [ 34.594549][ T644] loop4: rw=2049, sector=1224, nr_sectors = 4 limit=256 [ 34.609258][ T318] usb 2-1: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 0) [ 34.628096][ T318] usb 2-1: USB disconnect, device number 3 [ 34.688947][ T660] input: syz0 as /devices/virtual/input/input6 [ 34.745239][ T649] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.754621][ T649] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.763916][ T670] loop3: detected capacity change from 0 to 1024 [ 34.775054][ T649] device bridge_slave_0 entered promiscuous mode [ 34.785173][ T649] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.792692][ T649] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.800582][ T649] device bridge_slave_1 entered promiscuous mode [ 34.808013][ T670] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 34.818449][ T316] device bridge_slave_1 left promiscuous mode [ 34.824902][ T316] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.826184][ T670] ext4 filesystem being mounted at /31/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 34.843287][ T316] device bridge_slave_0 left promiscuous mode [ 34.854162][ T312] udevd[312]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 34.871553][ T316] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.880239][ T670] EXT4-fs error (device loop3): ext4_map_blocks:747: inode #15: comm syz.3.144: lblock 0 mapped to illegal pblock 0 (length 6) [ 34.896532][ T316] device veth1_macvtap left promiscuous mode [ 34.904136][ T316] device veth0_vlan left promiscuous mode [ 34.917373][ T670] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 6 with error 117 [ 34.941196][ T301] sony 0003:1345:3008.0002: can't set operational mode: step 2 [ 34.958207][ T301] sony 0003:1345:3008.0002: Failed to set controller into operational mode [ 34.967564][ T670] EXT4-fs (loop3): This should not happen!! Data will be lost [ 34.967564][ T670] [ 34.987340][ T301] sony 0003:1345:3008.0002: hiddev96,hidraw0: USB HID v80.00 Joystick [HID 1345:3008] on usb-dummy_hcd.0-1/input0 [ 35.016606][ T676] EXT4-fs error (device loop3): ext4_map_blocks:637: inode #15: block 1: comm syz.3.144: lblock 1 mapped to illegal pblock 1 (length 1) [ 35.017899][ T301] sony 0003:1345:3008.0002: failed to claim input [ 35.061783][ T301] usb 1-1: USB disconnect, device number 3 [ 35.061816][ T676] EXT4-fs error (device loop3): ext4_ext_remove_space:2945: inode #15: comm syz.3.144: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 2, max 4(4), depth 0(0) [ 35.095104][ T676] EXT4-fs error (device loop3) in ext4_setattr:5697: Corrupt filesystem [ 35.138864][ T677] fido_id[677]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 35.157813][ T286] EXT4-fs (loop3): unmounting filesystem. [ 35.261794][ T649] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.268927][ T649] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.276260][ T649] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.283356][ T649] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.317475][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.325466][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.357960][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 35.370346][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 35.400213][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 35.424050][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 35.439475][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.446601][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.455935][ T28] kauditd_printk_skb: 89 callbacks suppressed [ 35.455950][ T28] audit: type=1400 audit(1791439195.534:282): avc: denied { read } for pid=697 comm="syz.1.156" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 35.456173][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 35.495776][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 35.504399][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.511515][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.530973][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 35.545454][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 35.567613][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 35.577238][ T28] audit: type=1400 audit(1791439195.654:283): avc: denied { mounton } for pid=704 comm="syz.0.159" path="/proc/31/task" dev="proc" ino=17696 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 35.586894][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 35.627005][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 35.637324][ T28] audit: type=1400 audit(1791439195.714:284): avc: denied { mount } for pid=706 comm="syz.3.160" name="/" dev="configfs" ino=11961 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 35.648250][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 35.697473][ T28] audit: type=1400 audit(1791439195.764:285): avc: denied { read write } for pid=710 comm="syz.3.162" name="mtrr" dev="proc" ino=4026532003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 35.724037][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 35.744288][ T716] loop3: detected capacity change from 0 to 512 [ 35.751031][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 35.760400][ T649] device veth0_vlan entered promiscuous mode [ 35.762642][ T713] loop1: detected capacity change from 0 to 512 [ 35.780019][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 35.790021][ T28] audit: type=1400 audit(1791439195.764:286): avc: denied { open } for pid=710 comm="syz.3.162" path="/40/proc/mtrr" dev="proc" ino=4026532003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 35.818732][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 35.820482][ T713] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 35.834526][ T716] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 35.857139][ T713] ext4 filesystem being mounted at /21/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 35.874736][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 35.883475][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 35.893542][ T716] EXT4-fs (loop3): 1 orphan inode deleted [ 35.899636][ T28] audit: type=1400 audit(1791439195.764:287): avc: denied { ioctl } for pid=710 comm="syz.3.162" path="/40/proc/mtrr" dev="proc" ino=4026532003 ioctlcmd=0x4d08 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 35.907359][ T316] Quota error (device loop3): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 35.934436][ T716] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 35.940752][ T649] device veth1_macvtap entered promiscuous mode [ 35.961183][ T316] EXT4-fs error (device loop3): ext4_release_dquot:6864: comm kworker/u4:4: Failed to release dquot type 1 [ 35.972795][ T716] ext4 filesystem being mounted at /41/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 35.986349][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 35.994601][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 36.008039][ T28] audit: type=1400 audit(1791439196.084:288): avc: denied { write } for pid=720 comm="syz.0.165" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 36.027665][ T287] EXT4-fs (loop1): unmounting filesystem. [ 36.034287][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 36.064975][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 36.080297][ T286] EXT4-fs (loop3): unmounting filesystem. [ 36.089356][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 36.100047][ T28] audit: type=1400 audit(1791439196.104:289): avc: denied { remount } for pid=715 comm="syz.3.164" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 36.136117][ T675] loop4: detected capacity change from 0 to 131072 [ 36.141886][ T28] audit: type=1400 audit(1791439196.104:290): avc: denied { write } for pid=715 comm="syz.3.164" name="bus" dev="loop3" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 36.190919][ T675] F2FS-fs (loop4): Test dummy encryption mode enabled [ 36.222826][ T736] loop1: detected capacity change from 0 to 128 [ 36.231012][ T675] F2FS-fs (loop4): invalid crc value [ 36.249920][ T675] F2FS-fs (loop4): Found nat_bits in checkpoint [ 36.299997][ T736] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 36.328178][ T736] ext4 filesystem being mounted at /24/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 36.349369][ T675] F2FS-fs (loop4): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 36.376833][ T749] device batadv_slave_0 entered promiscuous mode [ 36.392880][ T748] device batadv_slave_0 left promiscuous mode [ 36.407081][ T675] F2FS-fs (loop4): Start checkpoint disabled! [ 36.414186][ T751] netlink: 12 bytes leftover after parsing attributes in process `syz.2.176'. [ 36.425395][ T287] EXT4-fs (loop1): unmounting filesystem. [ 36.432088][ T675] F2FS-fs (loop4): f2fs_disable_checkpoint() finish, err:0 [ 36.464594][ T751] netlink: 12 bytes leftover after parsing attributes in process `syz.2.176'. [ 36.473820][ T675] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 36.505665][ T759] netlink: 'syz.2.176': attribute type 15 has an invalid length. [ 36.534860][ T758] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 36.556994][ T758] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 36.572015][ T763] device vlan0 entered promiscuous mode [ 36.579138][ T763] device eth0 entered promiscuous mode [ 36.591926][ T758] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 36.591943][ T675] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 36.611078][ T758] System zones: 0-1, 3-36 [ 36.616481][ T758] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 36.670014][ T8] F2FS-fs (loop4): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 36.697435][ T287] EXT4-fs (loop1): unmounting filesystem. [ 37.148106][ T803] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 37.167771][ T806] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 37.176330][ T806] ext4 filesystem being mounted at /30/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 37.194803][ T743] F2FS-fs (loop3): Invalid segment/section count (458783, 24 x 150994945) [ 37.217467][ T743] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 37.225754][ T803] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 37.241249][ T287] EXT4-fs (loop1): unmounting filesystem. [ 37.245604][ T803] EXT4-fs (loop2): Delayed block allocation failed for inode 16 at logical offset 16 with max blocks 17 with error 28 [ 37.259562][ T743] F2FS-fs (loop3): invalid crc value [ 37.265788][ T803] EXT4-fs (loop2): This should not happen!! Data will be lost [ 37.265788][ T803] [ 37.275800][ T803] EXT4-fs (loop2): Total free blocks count 0 [ 37.282061][ T803] EXT4-fs (loop2): Free/Dirty block details [ 37.288885][ T743] F2FS-fs (loop3): Found nat_bits in checkpoint [ 37.295258][ T803] EXT4-fs (loop2): free_blocks=2415919504 [ 37.305417][ T803] EXT4-fs (loop2): dirty_blocks=32 [ 37.348725][ T803] EXT4-fs (loop2): Block reservation details [ 37.354785][ T803] EXT4-fs (loop2): i_reserved_data_blocks=2 [ 37.379183][ T743] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 37.386276][ T743] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 38.666950][ C1] sched: RT throttling activated [ 38.688096][ T807] set_capacity_and_notify: 4 callbacks suppressed [ 38.688116][ T807] loop4: detected capacity change from 0 to 40427 [ 39.657365][ T807] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 39.665216][ T807] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 39.678237][ T807] F2FS-fs (loop4): Found nat_bits in checkpoint [ 39.715455][ T649] EXT4-fs (loop2): unmounting filesystem. [ 39.738946][ T807] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 39.746045][ T807] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 39.895101][ T288] F2FS-fs (loop4): invalid namelen(0), ino:0, run fsck to fix. [ 39.895126][ T288] F2FS-fs (loop4): invalid namelen(0), ino:0, run fsck to fix. [ 39.907227][ T288] F2FS-fs (loop4): invalid namelen(0), ino:0, run fsck to fix. [ 39.932267][ T288] F2FS-fs (loop4): invalid namelen(0), ino:0, run fsck to fix. [ 39.949611][ T288] F2FS-fs (loop4): invalid namelen(0), ino:0, run fsck to fix. [ 39.966292][ T288] F2FS-fs (loop4): invalid namelen(0), ino:0, run fsck to fix. [ 39.974720][ T288] F2FS-fs (loop4): invalid namelen(0), ino:0, run fsck to fix. [ 40.162709][ T860] [ 40.188993][ T862] device-mapper: ioctl: Unable to interpret geometry settings. [ 40.248936][ T868] loop1: detected capacity change from 0 to 256 [ 40.431898][ T874] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.439441][ T874] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.447294][ T874] device bridge_slave_0 entered promiscuous mode [ 40.454680][ T874] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.462022][ T874] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.469771][ T874] device bridge_slave_1 entered promiscuous mode [ 40.499981][ T28] kauditd_printk_skb: 33 callbacks suppressed [ 40.499997][ T28] audit: type=1400 audit(1791439200.574:324): avc: denied { create } for pid=887 comm="syz.0.230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 40.533144][ T888] netlink: 140 bytes leftover after parsing attributes in process `syz.0.230'. [ 40.544569][ T28] audit: type=1400 audit(1791439200.604:325): avc: denied { write } for pid=887 comm="syz.0.230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 40.567702][ T888] netlink: 20 bytes leftover after parsing attributes in process `syz.0.230'. [ 40.590646][ T316] device bridge_slave_1 left promiscuous mode [ 40.596852][ T316] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.606598][ T316] device bridge_slave_0 left promiscuous mode [ 40.616144][ T891] loop4: detected capacity change from 0 to 1024 [ 40.622691][ T316] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.637846][ T316] device veth1_macvtap left promiscuous mode [ 40.651708][ T316] device veth0_vlan left promiscuous mode [ 40.657052][ T295] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 40.664455][ T891] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 40.681280][ T891] EXT4-fs error (device loop4): ext4_generic_delete_entry:2729: inode #2: block 16: comm syz.4.231: bad entry in directory: inode out of bounds - offset=0, inode=1538, rec_len=12, size=1024 fake=1 [ 40.714855][ T891] EXT4-fs error (device loop4) in ext4_delete_entry:2800: Corrupt filesystem [ 40.742580][ T891] EXT4-fs warning (device loop4): ext4_rename_delete:3778: inode #2: comm syz.4.231: Deleting old file: nlink 1, error=-117 [ 40.790728][ T288] EXT4-fs (loop4): unmounting filesystem. [ 40.821624][ T907] loop4: detected capacity change from 0 to 128 [ 40.829871][ T28] audit: type=1400 audit(1791439200.904:326): avc: denied { setopt } for pid=908 comm="syz.0.238" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 40.853695][ T907] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 40.859337][ T295] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 40.864077][ T907] ext4 filesystem being mounted at /52/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 40.901168][ T28] audit: type=1400 audit(1791439200.974:327): avc: denied { ioctl } for pid=906 comm="syz.4.237" path="/52/file1/file0" dev="loop4" ino=12 ioctlcmd=0x6613 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 40.915122][ T874] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.925742][ T295] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 40.932131][ T874] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.932410][ T874] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.956207][ T874] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.964338][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.975693][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.982706][ T295] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 40.982798][ T295] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 41.005676][ T295] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.015341][ T288] EXT4-fs (loop4): unmounting filesystem. [ 41.028920][ T295] usb 2-1: config 0 descriptor?? [ 41.038670][ T915] loop4: detected capacity change from 0 to 512 [ 41.059549][ T913] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 41.069692][ T915] EXT4-fs (loop4): 1 truncate cleaned up [ 41.075703][ T913] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 41.091500][ T915] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 41.095162][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 41.109188][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 41.118028][ T308] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.125127][ T308] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.133792][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 41.142921][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 41.151405][ T308] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.158552][ T308] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.167827][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 41.176769][ T915] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.240: bg 0: block 465: padding at end of block bitmap is not set [ 41.176805][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 41.208070][ T915] EXT4-fs (loop4): Delayed block allocation failed for inode 13 at logical offset 3 with max blocks 9 with error 28 [ 41.220898][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 41.233968][ T915] EXT4-fs (loop4): This should not happen!! Data will be lost [ 41.233968][ T915] [ 41.243759][ T915] EXT4-fs (loop4): Total free blocks count 0 [ 41.249796][ T915] EXT4-fs (loop4): Free/Dirty block details [ 41.252066][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 41.255725][ T915] EXT4-fs (loop4): free_blocks=0 [ 41.255743][ T915] EXT4-fs (loop4): dirty_blocks=9 [ 41.255756][ T915] EXT4-fs (loop4): Block reservation details [ 41.282457][ T915] EXT4-fs (loop4): i_reserved_data_blocks=9 [ 41.289500][ T922] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #13: comm syz.4.240: invalid indirect mapped block 234881024 (level 0) [ 41.306739][ T28] audit: type=1400 audit(1791439201.374:328): avc: denied { ioctl } for pid=923 comm="syz.0.243" path="socket:[18157]" dev="sockfs" ino=18157 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 41.327657][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 41.341392][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 41.361713][ T288] EXT4-fs (loop4): unmounting filesystem. [ 41.394340][ T874] device veth0_vlan entered promiscuous mode [ 41.402873][ T931] loop4: detected capacity change from 0 to 2048 [ 41.409911][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 41.418626][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 41.437207][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 41.444979][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 41.453777][ T295] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 41.471534][ T295] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 41.481925][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 41.490949][ T931] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 41.501236][ T931] ext4 filesystem being mounted at /54/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 41.512086][ T295] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 41.527354][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 41.545528][ T295] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 41.557641][ T874] device veth1_macvtap entered promiscuous mode [ 41.564941][ T28] audit: type=1400 audit(1791439201.634:329): avc: denied { setattr } for pid=928 comm="syz.4.245" name="/" dev="loop4" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 41.574355][ T295] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 41.613188][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 41.627320][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 41.628155][ T288] EXT4-fs (loop4): unmounting filesystem. [ 41.646027][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 41.654938][ T295] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 41.672998][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 41.681309][ T295] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 41.697358][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 41.705610][ T295] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 41.713802][ T295] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 41.722355][ T295] plantronics 0003:047F:FFFF.0003: No inputs registered, leaving [ 41.733326][ T295] plantronics 0003:047F:FFFF.0003: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 41.757032][ T295] usb 2-1: USB disconnect, device number 4 [ 41.808073][ T937] loop5: detected capacity change from 0 to 2048 [ 41.858879][ T937] loop5: p1 < > p4 [ 41.863536][ T937] loop5: p4 size 8388608 extends beyond EOD, truncated [ 41.871900][ T938] fido_id[938]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 41.900483][ T28] audit: type=1400 audit(1791439201.974:330): avc: denied { read write } for pid=936 comm="syz.5.219" name="loop5p4" dev="devtmpfs" ino=681 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 41.967354][ T28] audit: type=1400 audit(1791439202.004:331): avc: denied { open } for pid=936 comm="syz.5.219" path="/dev/loop5p4" dev="devtmpfs" ino=681 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 42.003575][ T28] audit: type=1400 audit(1791439202.004:332): avc: denied { map } for pid=936 comm="syz.5.219" path="/dev/loop5p4" dev="devtmpfs" ino=681 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 42.168633][ T312] udevd[312]: inotify_add_watch(7, /dev/loop5p4, 10) failed: No such file or directory [ 42.251481][ T940] loop4: detected capacity change from 0 to 40427 [ 42.280764][ T940] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 42.283939][ T28] audit: type=1400 audit(1791439202.354:333): avc: denied { set_context_mgr } for pid=952 comm="syz.1.253" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 42.288586][ T940] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 42.316890][ T940] F2FS-fs (loop4): invalid crc value [ 42.358515][ T940] F2FS-fs (loop4): Found nat_bits in checkpoint [ 42.446406][ T940] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 42.457002][ T940] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 42.477007][ T295] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 42.536608][ T968] input: syz0 as /devices/virtual/input/input7 [ 42.606470][ T930] loop3: detected capacity change from 0 to 131072 [ 42.634263][ T930] F2FS-fs (loop3): invalid crc value [ 42.666597][ T930] F2FS-fs (loop3): Found nat_bits in checkpoint [ 42.674036][ T295] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 42.704837][ T295] usb 6-1: config 0 has no interfaces? [ 42.717039][ T295] usb 6-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 42.746493][ T295] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 42.768083][ T295] usb 6-1: config 0 descriptor?? [ 42.797153][ T930] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 42.885019][ T970] loop1: detected capacity change from 0 to 256 [ 42.898321][ T308] Bluetooth: hci0: Frame reassembly failed (-84) [ 42.979656][ T919] usb 6-1: USB disconnect, device number 2 [ 43.075631][ T983] program syz.1.265 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 43.095367][ T983] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 43.151669][ T987] syz.1.266 (987) used greatest stack depth: 21752 bytes left [ 43.250880][ T997] EXT4-fs: Ignoring removed mblk_io_submit option [ 43.266945][ T997] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 43.278201][ T997] EXT4-fs error (device loop4): ext4_ext_check_inode:520: inode #11: comm syz.4.270: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 43.298040][ T997] EXT4-fs error (device loop4): ext4_orphan_get:1410: comm syz.4.270: couldn't read orphan inode 11 (err -117) [ 43.310092][ T997] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 43.326050][ T997] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:477: comm syz.4.270: Invalid block bitmap block 0 in block_group 0 [ 43.340003][ T997] EXT4-fs error (device loop4): ext4_acquire_dquot:6828: comm syz.4.270: Failed to acquire dquot type 0 [ 43.360874][ T308] EXT4-fs error (device loop4): ext4_release_dquot:6864: comm kworker/u4:3: Failed to release dquot type 0 [ 43.373852][ T287] syz-executor (287) used greatest stack depth: 21696 bytes left [ 43.387648][ T288] EXT4-fs (loop4): unmounting filesystem. [ 43.458188][ T1010] netlink: 4 bytes leftover after parsing attributes in process `syz.3.277'. [ 43.484291][ T1010] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.516367][ T1010] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.552779][ T1020] erofs: Bad value for 'cache_strategy' [ 43.637381][ T1030] erofs: (device loop3): mounted with root inode @ nid 36. [ 43.652875][ T1021] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.660065][ T1021] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.666658][ T450] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[9000] [ 43.673545][ T1021] device bridge_slave_0 entered promiscuous mode [ 43.679075][ T1030] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 43.688404][ T1021] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.702531][ T1021] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.704197][ T1030] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 43.721231][ T1030] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 43.728807][ T1021] device bridge_slave_1 entered promiscuous mode [ 43.733203][ T1030] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -10 in[4096, 0] out[4096] [ 43.787082][ T919] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 43.810917][ T1038] set_capacity_and_notify: 4 callbacks suppressed [ 43.810934][ T1038] loop3: detected capacity change from 0 to 512 [ 43.835581][ T1038] EXT4-fs (loop3): VFS: Can't find ext4 filesystem [ 43.842697][ T1021] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.849845][ T1021] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.857187][ T1021] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.864252][ T1021] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.893861][ T1041] loop5: detected capacity change from 0 to 1024 [ 43.906697][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.914818][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.924696][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.943551][ T1041] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 43.969107][ T913] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.982133][ T913] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.998287][ T919] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 44.009275][ T919] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 44.019281][ T919] usb 5-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 44.021617][ T913] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 44.029184][ T919] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.050586][ T1021] device veth0_vlan entered promiscuous mode [ 44.057906][ T919] usb 5-1: config 0 descriptor?? [ 44.064575][ T913] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 44.073807][ T913] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 44.081472][ T913] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 44.094472][ T913] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.105333][ T874] EXT4-fs (loop5): unmounting filesystem. [ 44.113029][ T1021] device veth1_macvtap entered promiscuous mode [ 44.127048][ T913] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 44.145948][ T913] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 44.157968][ T308] device bridge_slave_1 left promiscuous mode [ 44.164152][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.172407][ T308] device bridge_slave_0 left promiscuous mode [ 44.178842][ T308] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.187533][ T308] device veth1_macvtap left promiscuous mode [ 44.193612][ T308] device veth0_vlan left promiscuous mode [ 44.371645][ T1051] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.379146][ T1051] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.387182][ T1051] device bridge_slave_0 entered promiscuous mode [ 44.394838][ T1051] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.402492][ T1051] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.410586][ T1051] device bridge_slave_1 entered promiscuous mode [ 44.478955][ T1051] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.486093][ T1051] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.493460][ T1051] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.500544][ T1051] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.527375][ T913] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.535496][ T913] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.544315][ T913] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.562436][ T913] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 44.570971][ T913] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.578089][ T913] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.585814][ T913] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.595036][ T913] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.602152][ T913] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.623680][ T1052] loop6: detected capacity change from 0 to 40425 [ 44.631556][ T913] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.640130][ T913] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.647461][ T1052] F2FS-fs (loop6): fault_injection options not supported [ 44.660475][ T1052] F2FS-fs (loop6): Image doesn't support compression [ 44.669061][ T919] usb 5-1: string descriptor 0 read error: -71 [ 44.676842][ T919] uclogic 0003:256C:006D.0004: failed retrieving string descriptor #200: -71 [ 44.686087][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 44.686151][ T1052] F2FS-fs (loop6): heap/no_heap options were deprecated [ 44.702011][ T919] uclogic 0003:256C:006D.0004: failed retrieving pen parameters: -71 [ 44.714039][ T1052] F2FS-fs (loop6): invalid crc_offset: 0 [ 44.721045][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 44.728883][ T919] uclogic 0003:256C:006D.0004: failed probing pen v2 parameters: -71 [ 44.730691][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 44.737971][ T919] uclogic 0003:256C:006D.0004: failed probing parameters: -71 [ 44.747907][ T1052] F2FS-fs (loop6): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 0) [ 44.753189][ T919] uclogic: probe of 0003:256C:006D.0004 failed with error -71 [ 44.762866][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 44.781396][ T1052] F2FS-fs (loop6): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix. [ 44.785564][ T919] usb 5-1: USB disconnect, device number 2 [ 44.793014][ T1052] F2FS-fs (loop6): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. [ 44.805636][ T1051] device veth0_vlan entered promiscuous mode [ 44.835257][ T1052] F2FS-fs (loop6): Failed to read root inode [ 44.849912][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.869510][ T1051] device veth1_macvtap entered promiscuous mode [ 44.887762][ T1058] loop3: detected capacity change from 0 to 4096 [ 44.894561][ T1058] EXT4-fs: Invalid commit interval -1, must be smaller than 21474836 [ 44.915512][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 44.925740][ T602] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 44.929319][ T977] Bluetooth: hci0: command 0x1003 tx timeout [ 44.938616][ T976] Bluetooth: hci0: Opcode 0x0c20 failed: -22 [ 44.950674][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 45.121365][ T1068] loop7: detected capacity change from 0 to 256 [ 45.161344][ T1068] FAT-fs (loop7): error, clusters badly computed (0 != 128) [ 45.179062][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.202343][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.214142][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.229048][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.238708][ T308] device bridge_slave_1 left promiscuous mode [ 45.239828][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.246220][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.254687][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.269631][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.278535][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.304185][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.313100][ T308] device bridge_slave_0 left promiscuous mode [ 45.330127][ T308] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.337700][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.346276][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.361084][ T308] device veth1_macvtap left promiscuous mode [ 45.365209][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.384671][ T308] device veth0_vlan left promiscuous mode [ 45.394176][ T1086] ip_tables: iptables: counters copy to user failed while replacing table [ 45.405705][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.414578][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.424072][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.433074][ T1086] ip_tables: iptables: counters copy to user failed while replacing table [ 45.442048][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.452053][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.466367][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.492888][ T1091] [ 45.495715][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.509407][ T28] kauditd_printk_skb: 14 callbacks suppressed [ 45.509423][ T28] audit: type=1400 audit(1791439205.584:345): avc: denied { read write } for pid=1092 comm="syz.3.311" name="ppp" dev="devtmpfs" ino=158 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 45.523797][ T1089] loop4: detected capacity change from 0 to 2048 [ 45.545398][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.556656][ T28] audit: type=1400 audit(1791439205.614:346): avc: denied { open } for pid=1092 comm="syz.3.311" path="/dev/ppp" dev="devtmpfs" ino=158 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 45.560606][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.595809][ T28] audit: type=1400 audit(1791439205.614:347): avc: denied { ioctl } for pid=1092 comm="syz.3.311" path="/dev/ppp" dev="devtmpfs" ino=158 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 45.624517][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.635951][ T1089] GPT:first_usable_lbas don't match. [ 45.641561][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.654048][ T1089] GPT:34 != 290 [ 45.657787][ T1089] GPT: Use GNU Parted to correct GPT errors. [ 45.663945][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.674077][ T1089] loop4: p1 p2 p3 [ 45.677976][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.713449][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.754245][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.785974][ T1109] loop6: detected capacity change from 0 to 512 [ 45.791069][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.803885][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.821878][ T1109] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 45.825816][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.831060][ T1109] System zones: 1-12 [ 45.842780][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.851727][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.860358][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.868979][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.879731][ T1109] EXT4-fs error (device loop6): ext4_xattr_inode_iget:401: inode #12: comm syz.6.315: missing EA_INODE flag [ 45.884561][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.899973][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.915754][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.924693][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.933384][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.942229][ T1109] EXT4-fs error (device loop6): ext4_xattr_inode_iget:406: comm syz.6.315: error while reading EA inode 12 err=-117 [ 45.954534][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.954569][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.954605][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 45.984896][ T318] ================================================================== [ 45.993028][ T318] BUG: KASAN: use-after-free in enqueue_timer+0xae/0x480 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 46.000136][ T318] Write of size 8 at addr ffff888112e08a00 by task kworker/0:3/318 [ 46.008073][ T318] [ 46.010423][ T318] CPU: 0 PID: 318 Comm: kworker/0:3 Not tainted syzkaller #0 [ 46.017833][ T318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 46.027932][ T318] Workqueue: wg-crypt-wg0 wg_packet_tx_worker [ 46.034078][ T318] Call Trace: [ 46.037474][ T318] [ 46.040453][ T318] __dump_stack+0x21/0x24 [ 46.044832][ T318] dump_stack_lvl+0x110/0x170 [ 46.049555][ T318] ? __cfi_dump_stack_lvl+0x8/0x8 [ 46.054630][ T318] ? __cfi__printk+0x8/0x8 [ 46.059075][ T318] ? get_nohz_timer_target+0x7a/0x560 [ 46.064489][ T318] ? enqueue_timer+0xae/0x480 [ 46.069199][ T318] print_address_description+0x71/0x200 [ 46.074753][ T318] print_report+0x4a/0x60 [ 46.079090][ T318] kasan_report+0x122/0x150 [ 46.083605][ T318] ? enqueue_timer+0xae/0x480 [ 46.088294][ T318] __asan_report_store8_noabort+0x17/0x20 [ 46.094017][ T318] enqueue_timer+0xae/0x480 [ 46.098553][ T318] ? detach_if_pending+0xf5/0x300 [ 46.103589][ T318] __mod_timer+0x859/0xc00 [ 46.108013][ T318] mod_timer+0x1f/0x30 [ 46.112119][ T318] ? wg_timers_any_authenticated_packet_traversal+0x81/0x1a0 [ 46.119502][ T318] wg_timers_any_authenticated_packet_traversal+0x133/0x1a0 [ 46.126794][ T318] wg_packet_tx_worker+0x15e/0x500 [ 46.131920][ T318] process_one_work+0x717/0xc30 [ 46.136771][ T318] worker_thread+0xa4d/0x11d0 [ 46.141453][ T318] kthread+0x281/0x320 [ 46.145531][ T318] ? __cfi_worker_thread+0x10/0x10 [ 46.150643][ T318] ? __cfi_kthread+0x10/0x10 [ 46.155238][ T318] ret_from_fork+0x1f/0x30 [ 46.159681][ T318] [ 46.162697][ T318] [ 46.165027][ T318] Allocated by task 976: [ 46.169277][ T318] kasan_set_track+0x4b/0x70 [ 46.173884][ T318] kasan_save_alloc_info+0x1f/0x30 [ 46.179018][ T318] __kasan_kmalloc+0x95/0xb0 [ 46.183634][ T318] __kmalloc+0xb4/0x1e0 [ 46.187790][ T318] hci_alloc_dev_priv+0x27/0x1bd0 [ 46.192840][ T318] hci_uart_tty_ioctl+0x3c4/0xa70 [ 46.197864][ T318] tty_ioctl+0x8ef/0xc60 [ 46.202115][ T318] __se_sys_ioctl+0x12f/0x1b0 [ 46.206796][ T318] __x64_sys_ioctl+0x7b/0x90 [ 46.211402][ T318] x64_sys_call+0x58b/0x9a0 [ 46.215905][ T318] do_syscall_64+0x4c/0xa0 [ 46.220325][ T318] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 46.226232][ T318] [ 46.228553][ T318] Freed by task 976: [ 46.232437][ T318] kasan_set_track+0x4b/0x70 [ 46.237031][ T318] kasan_save_free_info+0x2b/0x40 [ 46.242060][ T318] ____kasan_slab_free+0x132/0x180 [ 46.247183][ T318] __kasan_slab_free+0x11/0x20 [ 46.251947][ T318] slab_free_freelist_hook+0xc2/0x190 [ 46.257318][ T318] __kmem_cache_free+0xb7/0x1b0 [ 46.262173][ T318] kfree+0x6f/0xf0 [ 46.265892][ T318] hci_release_dev+0x12a3/0x13b0 [ 46.270918][ T318] bt_host_release+0x82/0x90 [ 46.275509][ T318] device_release+0xa4/0x1d0 [ 46.280106][ T318] kobject_put+0x19d/0x280 [ 46.284520][ T318] put_device+0x1f/0x30 [ 46.288679][ T318] hci_dev_cmd+0x279/0x740 [ 46.293097][ T318] hci_sock_ioctl+0x41e/0x7f0 [ 46.297769][ T318] sock_do_ioctl+0x114/0x330 [ 46.302356][ T318] sock_ioctl+0x475/0x700 [ 46.306685][ T318] __se_sys_ioctl+0x12f/0x1b0 [ 46.311363][ T318] __x64_sys_ioctl+0x7b/0x90 [ 46.315968][ T318] x64_sys_call+0x58b/0x9a0 [ 46.320472][ T318] do_syscall_64+0x4c/0xa0 [ 46.324891][ T318] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 46.330781][ T318] [ 46.333103][ T318] Last potentially related work creation: [ 46.338813][ T318] kasan_save_stack+0x3a/0x60 [ 46.343497][ T318] __kasan_record_aux_stack+0xb6/0xc0 [ 46.348867][ T318] kasan_record_aux_stack_noalloc+0xb/0x10 [ 46.354672][ T318] insert_work+0x51/0x300 [ 46.359000][ T318] __queue_work+0x9d0/0xd50 [ 46.363507][ T318] queue_work_on+0xde/0x150 [ 46.368035][ T318] __hci_cmd_sync_sk+0xaa8/0xd80 [ 46.373002][ T318] hci_cmd_sync_status+0x53/0x120 [ 46.378036][ T318] hci_dev_cmd+0x642/0x740 [ 46.382481][ T318] hci_sock_ioctl+0x41e/0x7f0 [ 46.387156][ T318] sock_do_ioctl+0x114/0x330 [ 46.391747][ T318] sock_ioctl+0x475/0x700 [ 46.396094][ T318] __se_sys_ioctl+0x12f/0x1b0 [ 46.400770][ T318] __x64_sys_ioctl+0x7b/0x90 [ 46.405358][ T318] x64_sys_call+0x58b/0x9a0 [ 46.409878][ T318] do_syscall_64+0x4c/0xa0 [ 46.414303][ T318] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 46.420198][ T318] [ 46.422523][ T318] Second to last potentially related work creation: [ 46.429103][ T318] kasan_save_stack+0x3a/0x60 [ 46.433786][ T318] __kasan_record_aux_stack+0xb6/0xc0 [ 46.439156][ T318] kasan_record_aux_stack_noalloc+0xb/0x10 [ 46.444970][ T318] insert_work+0x51/0x300 [ 46.449309][ T318] __queue_work+0x9d0/0xd50 [ 46.453817][ T318] queue_work_on+0xde/0x150 [ 46.458325][ T318] hci_cmd_timeout+0x191/0x200 [ 46.463085][ T318] process_one_work+0x717/0xc30 [ 46.467933][ T318] worker_thread+0xa4d/0x11d0 [ 46.472607][ T318] kthread+0x281/0x320 [ 46.476696][ T318] ret_from_fork+0x1f/0x30 [ 46.481120][ T318] [ 46.483437][ T318] The buggy address belongs to the object at ffff888112e08000 [ 46.483437][ T318] which belongs to the cache kmalloc-8k of size 8192 [ 46.497488][ T318] The buggy address is located 2560 bytes inside of [ 46.497488][ T318] 8192-byte region [ffff888112e08000, ffff888112e0a000) [ 46.510937][ T318] [ 46.513277][ T318] The buggy address belongs to the physical page: [ 46.519689][ T318] page:ffffea00044b8200 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888112e0c000 pfn:0x112e08 [ 46.531232][ T318] head:ffffea00044b8200 order:3 compound_mapcount:0 compound_pincount:0 [ 46.539549][ T318] flags: 0x4000000000010200(slab|head|zone=1) [ 46.545663][ T318] raw: 4000000000010200 ffffea00044fae08 ffffea00044e9408 ffff888100043500 [ 46.554249][ T318] raw: ffff888112e0c000 0000000000020001 00000001ffffffff 0000000000000000 [ 46.562930][ T318] page dumped because: kasan: bad access detected [ 46.569347][ T318] page_owner tracks the page as allocated [ 46.575080][ T318] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 315, tgid 314 (syz.2.3), ts 28319600850, free_ts 28128500893 [ 46.597243][ T318] post_alloc_hook+0x1f5/0x210 [ 46.602020][ T318] prep_new_page+0x1c/0x110 [ 46.606530][ T318] get_page_from_freelist+0x2ca9/0x2d20 [ 46.612083][ T318] __alloc_pages+0x1fa/0x610 [ 46.616700][ T318] alloc_slab_page+0x6e/0xf0 [ 46.621296][ T318] new_slab+0x98/0x3e0 [ 46.625380][ T318] ___slab_alloc+0x70f/0xb70 [ 46.629994][ T318] __slab_alloc+0x5e/0xa0 [ 46.634355][ T318] __kmem_cache_alloc_node+0x204/0x2d0 [ 46.639828][ T318] __kmalloc+0xa4/0x1e0 [ 46.644018][ T318] mb_cache_create+0x194/0x5b0 [ 46.648791][ T318] ext4_xattr_create_cache+0x13/0x20 [ 46.654071][ T318] ext4_fill_super+0x5a37/0x73e0 [ 46.659026][ T318] get_tree_bdev+0x450/0x6a0 [ 46.663636][ T318] ext4_get_tree+0x1c/0x20 [ 46.668055][ T318] vfs_get_tree+0x9a/0x270 [ 46.672472][ T318] page last free stack trace: [ 46.677140][ T318] free_unref_page_prepare+0x81b/0x820 [ 46.682608][ T318] free_unref_page+0x93/0x530 [ 46.687291][ T318] __free_pages+0x67/0x100 [ 46.691722][ T318] __free_slab+0xc7/0x1a0 [ 46.696049][ T318] __unfreeze_partials+0x15a/0x190 [ 46.701158][ T318] put_cpu_partial+0xa9/0x100 [ 46.705838][ T318] __slab_free+0x1c4/0x280 [ 46.710257][ T318] ___cache_free+0xbf/0xd0 [ 46.714674][ T318] qlist_free_all+0xc6/0x140 [ 46.719281][ T318] kasan_quarantine_reduce+0x14a/0x170 [ 46.724741][ T318] __kasan_slab_alloc+0x24/0x80 [ 46.729609][ T318] slab_post_alloc_hook+0x4f/0x2d0 [ 46.734741][ T318] __kmem_cache_alloc_node+0x194/0x2d0 [ 46.740212][ T318] __kmalloc_node+0xa2/0x1e0 [ 46.744801][ T318] qdisc_alloc+0x82/0x750 [ 46.749138][ T318] qdisc_create_dflt+0x6b/0x3a0 [ 46.753998][ T318] [ 46.756321][ T318] Memory state around the buggy address: [ 46.761968][ T318] ffff888112e08900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.770032][ T318] ffff888112e08980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.778093][ T318] >ffff888112e08a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.786149][ T318] ^ [ 46.790215][ T318] ffff888112e08a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.798271][ T318] ffff888112e08b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.806322][ T318] ================================================================== [ 46.814371][ T318] Disabling lock debugging due to kernel taint [ 46.821236][ T28] audit: type=1400 audit(1791439206.054:348): avc: denied { write } for pid=278 comm="syz-executor" path="pipe:[14534]" dev="pipefs" ino=14534 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 46.865952][ T1109] EXT4-fs (loop6): 1 orphan inode deleted [ 46.877803][ T1109] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 46.894325][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 46.925500][ T1109] EXT4-fs (loop6): unmounting filesystem. [ 46.931501][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 46.957030][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 46.965624][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 46.997070][ C0] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 47.008852][ C0] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 47.017300][ C0] CPU: 0 PID: 1109 Comm: syz.6.315 Tainted: G B syzkaller #0 [ 47.026090][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 47.036176][ C0] RIP: 0010:__queue_work+0x582/0xd50 [ 47.041515][ C0] Code: b4 00 00 00 e8 7f 56 29 00 48 bb 00 00 00 00 00 fc ff df 4c 89 ef e8 7d 7a b9 03 4c 8b 65 d0 4c 8b 6d c0 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 20 e3 6e 00 49 8b 3e e8 18 76 b9 03 [ 47.061155][ C0] RSP: 0018:ffffc90000007c78 EFLAGS: 00010046 [ 47.067267][ C0] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88810f96e540 [ 47.075285][ C0] RDX: 0000000000000100 RSI: 000000007fffffff RDI: 000000007fffffff [ 47.077125][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.083294][ C0] RBP: ffffc90000007d08 R08: 0000000000000007 R09: 00000000fffffffb [ 47.099820][ C0] R10: dffffc0000000000 R11: ffffed10225c1139 R12: ffff888112e089c8 [ 47.107833][ C0] R13: ffff888132a2c000 R14: 0000000000000000 R15: 000000007fffffff [ 47.115842][ C0] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 47.117109][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.124807][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 47.139916][ C0] CR2: 000055558e7a7898 CR3: 0000000133130000 CR4: 00000000003506b0 [ 47.147919][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 47.155919][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 47.163935][ C0] Call Trace: [ 47.167248][ C0] [ 47.170132][ C0] delayed_work_timer_fn+0x61/0x80 [ 47.175295][ C0] ? __cfi_delayed_work_timer_fn+0x10/0x10 [ 47.177098][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.181126][ C0] call_timer_fn+0x46/0x2a0 [ 47.194153][ C0] ? __cfi_delayed_work_timer_fn+0x10/0x10 [ 47.197083][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.199994][ C0] __run_timers+0x672/0x9b0 [ 47.213013][ C0] ? calc_index+0x200/0x200 [ 47.217557][ C0] ? kvm_sched_clock_read+0x18/0x40 [ 47.222793][ C0] run_timer_softirq+0x6a/0xf0 [ 47.226922][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.236134][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.236127][ C0] handle_softirqs+0x1d7/0x600 [ 47.236163][ C0] __irq_exit_rcu+0x52/0xf0 [ 47.245344][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.249437][ C0] irq_exit_rcu+0x9/0x10 [ 47.249465][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 47.254672][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.262479][ C0] [ 47.262487][ C0] [ 47.262494][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 47.262521][ C0] RIP: 0010:stack_trace_consume_entry+0x6/0x290 [ 47.267655][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.272426][ C0] Code: 4c 24 78 75 09 48 8d 65 f0 5b 41 5e 5d c3 e8 31 cd 98 03 90 90 90 90 90 90 90 90 90 90 90 90 b8 b6 63 6b ad 55 48 89 e5 41 57 <41> 56 41 55 41 54 53 48 83 ec 20 48 ba 00 00 00 00 00 fc ff df 4c [ 47.281465][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.283877][ C0] RSP: 0018:ffffc90000d97270 EFLAGS: 00000257 [ 47.286864][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.292804][ C0] [ 47.292811][ C0] RAX: ffffffff81bc5cc4 RBX: ffffc90000d97340 RCX: 00000000001b2e00 [ 47.292827][ C0] RDX: ffffc90000d97401 RSI: ffffffff81bc5cc4 RDI: ffffc90000d97340 [ 47.300012][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.307750][ C0] RBP: ffffc90000d97278 R08: ffffc90000d97350 R09: ffffc90000d97348 [ 47.307769][ C0] R10: 0000000000000000 R11: fffff520001b2e5d R12: ffff88810f96e540 [ 47.307783][ C0] R13: 1ffff11021f2dd5d R14: ffffffff81620a30 R15: ffffc90000d97288 [ 47.307799][ C0] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 47.328459][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.336122][ C0] ? __reset_page_owner+0x54/0x190 [ 47.342748][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.350696][ C0] ? __reset_page_owner+0x54/0x190 [ 47.350724][ C0] arch_stack_walk+0x118/0x150 [ 47.353709][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.361047][ C0] ? __reset_page_owner+0x54/0x190 [ 47.361074][ C0] stack_trace_save+0xa6/0xf0 [ 47.369953][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.377652][ C0] ? __cfi_stack_trace_save+0x10/0x10 [ 47.377686][ C0] ? __stack_depot_save+0x36/0x490 [ 47.386129][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.393656][ C0] ? memset+0x35/0x40 [ 47.393682][ C0] save_stack+0x121/0x230 [ 47.402563][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.407820][ C0] ? __reset_page_owner+0x190/0x190 [ 47.407853][ C0] ? task_work_run+0x1e1/0x250 [ 47.416886][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.421549][ C0] ? do_exit+0xb0d/0x29f0 [ 47.430933][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.435182][ C0] ? do_group_exit+0x21b/0x2e0 [ 47.440469][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.448447][ C0] ? get_signal+0x167c/0x1700 [ 47.448483][ C0] ? exit_to_user_mode_loop+0x7a/0xb0 [ 47.454311][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.458283][ C0] ? exit_to_user_mode_prepare+0x87/0xd0 [ 47.458313][ C0] __reset_page_owner+0x54/0x190 [ 47.467198][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.472214][ C0] ? __kasan_check_write+0x14/0x20 [ 47.478378][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.485838][ C0] free_unref_page_prepare+0x81b/0x820 [ 47.490431][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.494201][ C0] free_unref_page+0x93/0x530 [ 47.503221][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.507898][ C0] ? __cfi_free_unref_page+0x10/0x10 [ 47.513184][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.521191][ C0] __free_pages+0x67/0x100 [ 47.521224][ C0] __vunmap+0xa3c/0xc00 [ 47.521252][ C0] ? _raw_spin_lock_irqsave+0xc2/0x130 [ 47.526379][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.534088][ C0] ? vunmap+0x60/0x60 [ 47.534114][ C0] vfree+0x61/0x90 [ 47.539460][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.547383][ C0] kcov_close+0x2b/0x50 [ 47.547407][ C0] ? __cfi_kcov_close+0x10/0x10 [ 47.552802][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.557478][ C0] __fput+0x1fd/0x8f0 [ 47.557514][ C0] ____fput+0x15/0x20 [ 47.566369][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.571669][ C0] task_work_run+0x1e1/0x250 [ 47.571700][ C0] ? __cfi_task_work_run+0x10/0x10 [ 47.571723][ C0] ? free_nsproxy+0x21f/0x270 [ 47.577987][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.585177][ C0] do_exit+0xb0d/0x29f0 [ 47.590918][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.598793][ C0] ? __cfi_do_exit+0x10/0x10 [ 47.604864][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.612792][ C0] ? plist_check_list+0x255/0x270 [ 47.612817][ C0] ? _raw_spin_lock+0x94/0xf0 [ 47.618238][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.626011][ C0] ? __kasan_check_write+0x14/0x20 [ 47.631854][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.639819][ C0] ? _raw_spin_lock_irq+0x95/0xf0 [ 47.644778][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.648429][ C0] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 47.654350][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.662479][ C0] do_group_exit+0x21b/0x2e0 [ 47.667902][ T1068] FAT-fs (loop7): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 47.670222][ C0] ? __kasan_check_write+0x14/0x20 [ 47.839076][ C0] ? recalc_sigpending+0x168/0x1c0 [ 47.844218][ C0] get_signal+0x167c/0x1700 [ 47.848749][ C0] ? __cfi_get_signal+0x10/0x10 [ 47.853619][ C0] arch_do_signal_or_restart+0xd1/0x11c0 [ 47.859267][ C0] ? do_futex+0x2e2/0x430 [ 47.863614][ C0] ? __cfi_do_futex+0x10/0x10 [ 47.868304][ C0] ? slab_free_freelist_hook+0xc2/0x190 [ 47.873879][ C0] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 47.880060][ C0] ? __se_sys_futex+0x136/0x310 [ 47.884932][ C0] ? fput+0x154/0x1a0 [ 47.888931][ C0] exit_to_user_mode_loop+0x7a/0xb0 [ 47.894144][ C0] exit_to_user_mode_prepare+0x87/0xd0 [ 47.899634][ C0] syscall_exit_to_user_mode+0x1a/0x30 [ 47.905123][ C0] do_syscall_64+0x58/0xa0 [ 47.909558][ C0] ? clear_bhb_loop+0x30/0x80 [ 47.914250][ C0] ? clear_bhb_loop+0x30/0x80 [ 47.918944][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 47.924851][ C0] RIP: 0033:0x7f072af9e199 [ 47.929313][ C0] Code: Unable to access opcode bytes at 0x7f072af9e16f. [ 47.936341][ C0] RSP: 002b:00007f072be3d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 47.944763][ C0] RAX: fffffffffffffe00 RBX: 00007f072b225fa8 RCX: 00007f072af9e199 [ 47.952747][ C0] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f072b225fa8 [ 47.960736][ C0] RBP: 00007f072b225fa0 R08: 0000000000000000 R09: 0000000000000000 [ 47.968726][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 47.976713][ C0] R13: 00007f072b226038 R14: 00007fff3f6ab510 R15: 00007fff3f6ab5f8 [ 47.984721][ C0] [ 47.987757][ C0] Modules linked in: [ 47.991794][ C0] ---[ end trace 0000000000000000 ]--- [ 47.997273][ C0] RIP: 0010:__queue_work+0x582/0xd50 [ 48.002582][ C0] Code: b4 00 00 00 e8 7f 56 29 00 48 bb 00 00 00 00 00 fc ff df 4c 89 ef e8 7d 7a b9 03 4c 8b 65 d0 4c 8b 6d c0 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 20 e3 6e 00 49 8b 3e e8 18 76 b9 03 [ 48.022236][ C0] RSP: 0018:ffffc90000007c78 EFLAGS: 00010046 [ 48.028319][ C0] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88810f96e540 [ 48.036300][ C0] RDX: 0000000000000100 RSI: 000000007fffffff RDI: 000000007fffffff [ 48.044288][ C0] RBP: ffffc90000007d08 R08: 0000000000000007 R09: 00000000fffffffb [ 48.052272][ C0] R10: dffffc0000000000 R11: ffffed10225c1139 R12: ffff888112e089c8 [ 48.060259][ C0] R13: ffff888132a2c000 R14: 0000000000000000 R15: 000000007fffffff [ 48.068242][ C0] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 48.077191][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.083793][ C0] CR2: 000055558e7a7898 CR3: 0000000133130000 CR4: 00000000003506b0 [ 48.091805][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 48.099788][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 48.107778][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 48.115098][ C0] Kernel Offset: disabled [ 48.119451][ C0] Rebooting in 86400 seconds..