last executing test programs: 45.90490903s ago: executing program 4 (id=498): r0 = syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) 45.716954706s ago: executing program 4 (id=503): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0xc0046209, 0xe0ffff00000000) 45.56662195s ago: executing program 4 (id=508): r0 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, 0x0, 0x0) 45.440448021s ago: executing program 4 (id=511): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100), 0x1a, 0x522, &(0x7f0000000c00)="$eJzs3U9sI1cZAPBvJsnau02bLfQAqNClFBa0WjvxtlHVC+VUIVQJ0SOHbUicKIodR7FTmrCH7JE7EpU4wYkzByQOSD1xR+IANy7lgFRgBWqQkHDlsZ11/ji2sondjX8/aeQ38zz+3tvRvGd93swLYGLdioj9iLgWEe9GxFzneNLZ4s321nrfJ48eLB88erCcRLP5zj+TrL51LHrOaXmm85n5iPjBWxE/So4F/VNEfXdvY6lSKW93DhUb1a1ifXfv7np1aa28Vt4slRYXFudfv/da6cL6+lL1Nx9fj4jf/+7LH/1x/1s/aTVrtlPX24+L1O76zGGclumI+N5lBBuDqU5/rp3n5HOdxEVKI+JzEfFydv/PxVR2NY86epm+PcLWAQCXodmci+Zc7z4AcNWlWQ4sSQudXMBspGmh0M7hvRA30kqt3rizWtvZXGnnym7GTLq6XinPd3KFN2MmWV2fLi9k5e5+pVxKju7fi4jnI+JnuevZfmG5VlkZ5xcfAJhgzxyb//+Ta8//AMAVl39czI2zHQDA6OTH3QAAYOTM/wAwecz/ADB5zP8AMHnM/wAwecz/ADBRvv/2262tedB5/vXKe7s7G7X37q6U6xuF6s5yYbm2vVVYq9XWsmf2VAd9XqVW21p4NXbeLzbK9Uaxvrt3v1rb2Wzcz57rfb88M5JeAQBnef6lD/+SRMT+G9ezLXqe9z9wrn7xslsHXKZ03A0AxmZq3A0Axubkal/ApJCPh8n1/2azGT1r90bEw8NSz8NA+/4XoQ+GCpNaNxQ+e25/8Qny/8BTTf4fJtf58v++y8NVIP8Pk6vZTKz5DwATRo4fSAbU9/7+P9/s2Rnu938AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4kmazLUkLnbXAZyNNC4WIZyPiZswkq+uV8nxEPBcRf87N5Fr7CxFh3SAAeJqlf08663/dnntl9njttdx/c9lrRPz4F+/8/P2lRmN7IeJa8q/D440POsdL42g/ADBId57uzuNdnzx6sNzdRtmej7/TXly0Ffegs7VrpmM6e81nuYYb/046+22t7ytTFxB//2FEfOG0/idZbuRmZ+XT4/FbsZ8dafz0SPw0q2u/tv4tPn8BbYFJ82Fr/HnztPsvjVvZ6+n3fz4boZ5cd/w7ODH+pYfj31Sf8e/WsDFe/cN3TxxszrXrHkZ8aTrioPvhPeNPN37SJ/4rQ8b/64tfeblfXfOXEbfjtP4nR2IVG9WtYn137+56dWmtvFbeLJUWFxbnX7/3WqmY5aiL3Uz1Sf94485z/eK3+n+jT/z8gP5/fcj+/+p/7/7wq2fE/+bXTr/+L5wRvzUnfmPI+Es3fpvvV9eKv9Kn/4Ou/50h43/0t72VEwcHLTgOAFya+u7exlKlUt5+8kL+zPekFxFiiEISsX/JIR4Xcr/+6VuD35wbWXvOWYh+VVOflRZemULuHGflL/Y+HbIw7pEJuGyPb/pxtwQAAAAAAAAAAAAAAOhnFH9ONO4+AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcHV9GgAA///+udUz") mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) 44.944509935s ago: executing program 4 (id=523): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, 0x0, &(0x7f0000000040)=0x1e) 43.988711039s ago: executing program 4 (id=532): r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$vim2m_VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f00000003c0)={0x3, @pix={0x6, 0x2, 0x32314142, 0x4, 0x803, 0x400b, 0x2, 0x2020003, 0x0, 0x6, 0x1, 0x1}}) 43.694645215s ago: executing program 32 (id=532): r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$vim2m_VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f00000003c0)={0x3, @pix={0x6, 0x2, 0x32314142, 0x4, 0x803, 0x400b, 0x2, 0x2020003, 0x0, 0x6, 0x1, 0x1}}) 42.821287022s ago: executing program 2 (id=559): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x24, @none={0x0, 0x3}}, 0x14, &(0x7f00000000c0)={0x0, 0x300}, 0x1, 0x0, 0x0, 0x20040001}, 0x20004080) 42.706217313s ago: executing program 2 (id=562): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'virt_wifi0\x00', &(0x7f0000002fc0)=@ethtool_link_settings={0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0xffffffff]}}) 42.313321938s ago: executing program 2 (id=565): r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$vim2m_VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)) 42.238595284s ago: executing program 2 (id=568): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100), 0x1a, 0x522, &(0x7f0000000c00)="$eJzs3U9sI1cZAPBvJsnau02bLfQAqNClFBa0WjvxtlHVC+VUIVQJ0SOHbUicKIodR7FTmrCH7JE7EpU4wYkzByQOSD1xR+IANy7lgFRgBWqQkHDlsZ11/ji2sondjX8/aeQ38zz+3tvRvGd93swLYGLdioj9iLgWEe9GxFzneNLZ4s321nrfJ48eLB88erCcRLP5zj+TrL51LHrOaXmm85n5iPjBWxE/So4F/VNEfXdvY6lSKW93DhUb1a1ifXfv7np1aa28Vt4slRYXFudfv/da6cL6+lL1Nx9fj4jf/+7LH/1x/1s/aTVrtlPX24+L1O76zGGclumI+N5lBBuDqU5/rp3n5HOdxEVKI+JzEfFydv/PxVR2NY86epm+PcLWAQCXodmci+Zc7z4AcNWlWQ4sSQudXMBspGmh0M7hvRA30kqt3rizWtvZXGnnym7GTLq6XinPd3KFN2MmWV2fLi9k5e5+pVxKju7fi4jnI+JnuevZfmG5VlkZ5xcfAJhgzxyb//+Ta8//AMAVl39czI2zHQDA6OTH3QAAYOTM/wAwecz/ADB5zP8AMHnM/wAwecz/ADBRvv/2262tedB5/vXKe7s7G7X37q6U6xuF6s5yYbm2vVVYq9XWsmf2VAd9XqVW21p4NXbeLzbK9Uaxvrt3v1rb2Wzcz57rfb88M5JeAQBnef6lD/+SRMT+G9ezLXqe9z9wrn7xslsHXKZ03A0AxmZq3A0Axubkal/ApJCPh8n1/2azGT1r90bEw8NSz8NA+/4XoQ+GCpNaNxQ+e25/8Qny/8BTTf4fJtf58v++y8NVIP8Pk6vZTKz5DwATRo4fSAbU9/7+P9/s2Rnu938AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4kmazLUkLnbXAZyNNC4WIZyPiZswkq+uV8nxEPBcRf87N5Fr7CxFh3SAAeJqlf08663/dnntl9njttdx/c9lrRPz4F+/8/P2lRmN7IeJa8q/D440POsdL42g/ADBId57uzuNdnzx6sNzdRtmej7/TXly0Ffegs7VrpmM6e81nuYYb/046+22t7ytTFxB//2FEfOG0/idZbuRmZ+XT4/FbsZ8dafz0SPw0q2u/tv4tPn8BbYFJ82Fr/HnztPsvjVvZ6+n3fz4boZ5cd/w7ODH+pYfj31Sf8e/WsDFe/cN3TxxszrXrHkZ8aTrioPvhPeNPN37SJ/4rQ8b/64tfeblfXfOXEbfjtP4nR2IVG9WtYn137+56dWmtvFbeLJUWFxbnX7/3WqmY5aiL3Uz1Sf94485z/eK3+n+jT/z8gP5/fcj+/+p/7/7wq2fE/+bXTr/+L5wRvzUnfmPI+Es3fpvvV9eKv9Kn/4Ou/50h43/0t72VEwcHLTgOAFya+u7exlKlUt5+8kL+zPekFxFiiEISsX/JIR4Xcr/+6VuD35wbWXvOWYh+VVOflRZemULuHGflL/Y+HbIw7pEJuGyPb/pxtwQAAAAAAAAAAAAAAOhnFH9ONO4+AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcHV9GgAA///+udUz") mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) 41.643121817s ago: executing program 2 (id=575): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b15, &(0x7f0000000000)={'wlan1\x00'}) 41.045324619s ago: executing program 2 (id=583): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x6, [@var={0x4, 0x0, 0x0, 0xe, 0x4}, @func_proto, @typedef={0x0, 0x0, 0x0, 0x10, 0x4}, @volatile={0x0, 0x0, 0x0, 0x9, 0x3}]}, {0x0, [0x0, 0x0, 0x0, 0x61]}}, 0x0, 0x52}, 0x20) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x1, @ANYBLOB="0000000000000000000000000000100000080000", @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="010000000300"], 0x5f) 40.722414458s ago: executing program 33 (id=583): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x6, [@var={0x4, 0x0, 0x0, 0xe, 0x4}, @func_proto, @typedef={0x0, 0x0, 0x0, 0x10, 0x4}, @volatile={0x0, 0x0, 0x0, 0x9, 0x3}]}, {0x0, [0x0, 0x0, 0x0, 0x61]}}, 0x0, 0x52}, 0x20) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x1, @ANYBLOB="0000000000000000000000000000100000080000", @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="010000000300"], 0x5f) 1.817692929s ago: executing program 6 (id=1166): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000003280)=ANY=[@ANYBLOB="140000001000010000000000000000030000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000020900010073797a30000000000900030073797a3200000000240b0000060a010400000000000000000100000008000b4000000000fc0a048028000180080001006c6f67001c0002800e00024073797a6b616c6c65720000000800054000000008d00a01800e000100696d6d656469617465000000bc0a0280640002804c0002800900020073797a32000000000900020073797a310000000008000180fffffffc0900020073797a31000000000800034000009c920900020073797a300000000008000180ffffffff14000280080003400000000808000180fffffffb0800014000000002080001400000000b500002804b000100fa62d7ba9ceeacf9aa4f832b78f35731f355d63e192a72aef5e68a05d1b806151b6bd1e2d74abafd383790ad363fdc1b7766748630b48f9beefdb33c86d5835a470b5ffd20d7e9006c0102805c00028008000180fffffffe0900020073797a30000000000900020073797a320000000008000180ffffffff0900020073797a320000000008000180fffffffd0900020073797a310000000008000180fffffffc0800034000000e5628000280080003400000000608000340000000070900020073797a320000000008000180fffffffe540002800900020073797a320000000008000180fffffffe0800034000000000080003400000000008000340000000090900020073797a310000000008000180fffffffe080003400000800108000180fffffffd8e000100818ce881ff18470752e86442e8b77ddcfc7a4c87f05cd36147be26c85cc854cc117db1906007a5a8c298f4724c8c743d46ec7f3ba478d9dfb10bbe9e4fdfc2188d62db9bb1364fed383fe0b0c3fbbab83959470cb0ffb14765c32f10b54d99531d04caaf264214997543a1c63637d9a3a20b7ce9312e545626eb375c88462c198f35cf8a11616de4fa0c000098020280eb00010099c8e680eb4d0e7f78e1fb62226ae541d997c8cb51c5ebd0bb7e2730b61310dcd7525807288a7ad8c00f6aa230a1d1b876ddb0e188384e7c79cd8af94a02451a04d8f116bde38077da45650d82bdd1767b03e3f35bc4a5769e659d8cdb6d9d9d717c78b50f6b3ac899b07a9eaf2c989654de7d6609299bad01ca1f3fa8b6229a6c69627a07f627880e902231b20368f3ae64fd12fc37afeb95f14a4dc3d0bc5f6e2afd0fc8ef6982054cffa703ee1376654019ad6d2add9052c5d2f2e0ba3318f931b2c5f2dcce5cbca6093c64d23b64e2f2061da3dd5983644280de22d592b63b5d7f6b571beb005400010041bbc64da6bacaad1bebec23352accccbca40d6ba87943f82df945bf4ccc5250a0c2b2cb13793380f424b280bfb960885af6df4afa26efa8fcd7a1243389ef3fcf1d709f775a9cd1dfb2b84fd03e5d70f800010001950b7c0ec30534e476b721ba6e82d03078fe63b683918ecbbb9c339c8cdd63689339ac43acd5973f4aac8720a98d18e13b98e11e291f3f3621ed29c717639f84bdd28810da6ae30538775f15e00133741e9de3f96f69ab363752fa962b3c71041ba1e463a91d782a968d9febb648b66e71a6827c53b3be014b785f61c4fd46fef00658f64cdd465edb61ba4c5f00849b2935c485da99a38489ecc29837433ac5446c3922d73153fd8fb2368a5ce4201760ca6778f570b7fcb38be633a02d57c5884b6bcbaf3bc28ca7686edb5d59e1b823a8f0f5ff788625995d51c16413783c6290a9714bd4dcbd2a388139f3e46f69916f335c0002800900020073797a3000000000080003400000000908000180000000000900020073797a3000000000080003400000000808000180fffffffd080003400000000408000340fffffff908000180fffffffb0800034000000003a80002801c000280080003400000020008000340fffffff508000340000000001400028008000340000000050800034000000007720001001c2cce526d2ee30fb33f426450278cb35ac06b1cef15fefc26b5c17a8c9251bed316fccb5588f2e071fc355537fcf458cf14217f16ce4c12a4b559f3e807c94c6cc4f418baebc6024b74b9dbc5ef66dbbe91812ea247db80670c101ed494f105ad9c09b4eaf8d5c133b46a311c1a00001c0302802000028008000180fffffffc0900020073797a320000000008000340000000035c00028008000180fffffffc08000180fffffffc08000180fffffffb0900020073797a300000000008000340000000060900020073797a30000000000900020073797a31000000000900020073797a310000000008000180fffffffbf6000100330e5af714359ac9da33381a13071148dbe4293800e6be0290efbb549850cda132ca27a55553fd77c3067504c4596086f4001f53d49e8111395ebccb983c6b04735a58ab2617dfc62123b09c8dc5a47154667414dc28e8369829764b2e3cc23303a882890bad6d3a70d9e15701ec8c4c15a46d38c9ed6bc8658f8a45a02083f563324a27c649bab7cbcb485c289bd8df0a040128df6891ab48095977e0463f8e3ed7ba6df976ee30768954dfeb3f08c942b2c9384aa0b78baf92ecf5e4d73788afb1bc5a8f7c4b454897cd8bcac7f19cdd949fac66756da3b9311e13362eee317df853f6bc7e4638eb145a1484d3780e09b50000c8000100d5c1e4159bf770e02e6e1ebe911d7513709588175328d2e11f2ebf3f6967c49bedcb2a5459a45272bb8084e3bb55ea7a80166d97ec16457ed7d2a834d9aafdb2a54110ddc7975eaeda4f897ec7d533c27df0ce5ff92cfedadc67fff850ee5d07822d72b27af229d17ad2f8d802ae40d98f373e348a04b4f0270c71f82319de3a0331f165204896e0e448cf7ea0f8eb32a312fda6716f72f0234742fe6708ad0adf587ea21d94b8c8f5080028dda1e21d3d9ac82d8edd12941631b72b692ecc262d6ae12393000100c56deda494a09379df59bad8f0f17376b307ce49571034af728b1c4bf694e3b91406b976944238ab36ccaf40e3d92952ba87aa27af6353a82868c9508577a1b6a349fce75b3e4952b04b9527f496b5555e6db110dec07430b01446635eff12f136dbcb54fd4dc90b02e1bc6488ed74efd9eeb1b6de6e2a234f6c323df5c28a0352d03b34ee4f64ab614078125aa3cc0048000280080003400000000c08000340000000010900020073797a310000000008000180fffffffd0800034000008000080003400000dc5b08000180fffffffc08000180fffffffb2c0202804b000100cece2d8ff50c68c1060c2e691ddc50c6d87b46b4e5f6695010163d98bac2d9d7693cff0ec1e2107f58d3c305c78e5a596df92f1dbe80793dce5424be9e7951890023db7d0b9b2700e5000100f46e4b21dd4b92221713eece21b0e3bfb3fe995725eca78713a8d11ac82a6aefeeeab4720bd136479523ccafa34771afedeafc55275842bb7adb37ff3c93b19d9d5139f8b67ee81e380faa9506e6c8e5956cf7efc9828438d340aa4bfe771769c6ddb2f8c31049c1fc37e8f28812ea0aadd0caa7e32f6bb4b2b7a4473e5fa876c87bf285a503660ea12a0cfff6863a87c64ea83c31e737e278edcad77cb964828c7049d335e25156fd4d1c2faada6a8363794fe487155fbfd7c2e1b8504d4a744357734f51fca0426ffe929280df27411f8a90a067b285e970fa1e403722ae91dd000000f400010073e22ba6603d1c92836887468b100c2dc430efeb2ef19c66bd0582fe94df7b5a20292fdfbd2009980dbf9651685f7713bfb0f42583e452670f29e2cabf848fcdcb7a2067f0b257efd7dc927e540584b08f026e14be231afa797e36410d8ad6cbced8c5d2cce2f5a8b75713e57b3161b5b4ce78f283bf59a04f90bc1c5a4371abed0124c621ecb51b6166ad39f14216c09456232b7ea8dd7058bbbeae8b1c13df7ffa1515a359309683421d783f4fb00547cb06b3f974e65f28397c2c16675436a414b6e28d61800c35bdc05f9837e14491ce0fa7c0fbf6f61dd8f7eceac62373ed913de212a188ad5fa12d0eab8a0b440900010073797a30"], 0xb98}, 0x1, 0x0, 0x0, 0x20000000}, 0x40800) 1.648884824s ago: executing program 6 (id=1168): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSPGRP(r0, 0x5410, &(0x7f00000000c0)) 1.616288657s ago: executing program 0 (id=1170): r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/igmp\x00') pread64(r0, &(0x7f0000002280)=""/4096, 0x1000, 0xd33) 1.529577874s ago: executing program 1 (id=1171): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000005880)={0x0, 0x0, &(0x7f0000005840)={&(0x7f0000000000)=@getsa={0x28, 0x12, 0x5, 0x70bd2b, 0x25dfdbfd, {@in6=@mcast1, 0x84d4, 0x8, 0x6c}}, 0x28}, 0x1, 0x0, 0x0, 0x1090}, 0x40080) 1.518521416s ago: executing program 6 (id=1172): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) 1.486278399s ago: executing program 3 (id=1173): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="5000000003080101000000000000000000000000050003001100000006000240004000002c0004"], 0x50}}, 0x0) 1.302685675s ago: executing program 1 (id=1175): r0 = socket(0x10, 0x80002, 0x4) sendmsg$nl_route_sched(r0, &(0x7f0000002980)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=@newtaction={0x14, 0x13, 0x53b}, 0x14}}, 0x0) 1.295167405s ago: executing program 3 (id=1176): r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x12, 0x80801) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, 0xffffffffffffffff) 1.271227817s ago: executing program 6 (id=1177): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000800)={r0, 0x18000000000002a0, 0x15, 0x0, &(0x7f00000004c0)="b9ff030768441a8cb89e14f00800e075702b1c1dac", 0x0, 0x4, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.213384473s ago: executing program 0 (id=1178): capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000580)='setgroups\x00') 1.12489639s ago: executing program 3 (id=1180): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_netfilter(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x28, 0x12, 0x0, 0x101, 0x0, 0x0, {0xc}, [@typed={0x8, 0x0, 0x0, 0x0, @uid=0xffffffffffffffff}, @nested={0xc, 0x0, 0x0, 0x1, [@typed={0x8, 0x31, 0x0, 0x0, @binary="748cf8e8"}]}]}, 0x28}}, 0x0) 1.115746231s ago: executing program 0 (id=1181): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="2800000012000100000000000000000007000000", @ANYRES32=0x0, @ANYBLOB="000000000000000008001c"], 0x28}}, 0x0) 1.100973533s ago: executing program 6 (id=1182): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000001c0)={0x1e, &(0x7f0000000200)=[{0xa, '\x00', @st={0x4, [{0x0, @uvalue=0x9}, {0x0, @uvalue=0x8}, {0x1, @svalue=0x3ba8}, {0x3, @svalue=0x1}]}, 0x3}, {0xc, '\x00', @st={0x4, [{0x2, @uvalue=0x9}, {0x3, @svalue=0x100}, {0x3, @uvalue=0x80000000}, {0x0, @uvalue=0x8}]}, 0x10000}]}) 1.091090163s ago: executing program 1 (id=1183): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="500000001800010000000000000003001d01000008000e00", @ANYRES32=0x0, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="1500010000000000000000007721f5438b20ffdf0300000008000900", @ANYBLOB="0822803065"], 0x50}, 0x1, 0x0, 0x0, 0xa8d0}, 0x0) 1.01923356s ago: executing program 5 (id=1184): pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cachetag={'cachetag', 0x3d, '\x14\xe2\xc3\x11\xe2\xcb\x86\xc8-Hs\xc6\xafm\xdc{\xde= 8) [ 106.887178][ T144] EXT4-fs error (device loop5): ext4_release_dquot:6270: comm kworker/u4:1: Failed to release dquot type 0 [ 106.918450][ T6169] EXT4-fs error (device loop5) in ext4_free_inode:362: Corrupt filesystem [ 106.934704][ T6169] EXT4-fs (loop5): 1 orphan inode deleted [ 106.940511][ T6169] EXT4-fs (loop5): mounted filesystem without journal. Opts: ; ,errors=continue. Quota mode: writeback. [ 107.043483][ T6194] xt_CONNSECMARK: invalid mode: 0 [ 107.063247][ T6185] loop6: detected capacity change from 0 to 4096 [ 107.207760][ T6185] ntfs3: loop6: Different NTFS' sector size (4096) and media sector size (512) [ 107.566105][ T5575] ntfs3: loop6: ntfs_sync_fs r=1a failed, -22. [ 107.591532][ T5575] ntfs3: loop6: Mark volume as dirty due to NTFS errors [ 107.695661][ T5575] ntfs3: loop6: ntfs_evict_inode r=1a failed, -22. [ 107.925852][ T6233] loop0: detected capacity change from 0 to 2048 [ 108.025085][ T6233] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 108.278618][ T6254] __nla_validate_parse: 1 callbacks suppressed [ 108.278636][ T6254] netlink: 16 bytes leftover after parsing attributes in process `syz.3.828'. [ 108.378125][ T6247] loop1: detected capacity change from 0 to 4096 [ 108.380328][ T6254] netlink: 16 bytes leftover after parsing attributes in process `syz.3.828'. [ 108.404236][ T6254] netlink: 7 bytes leftover after parsing attributes in process `syz.3.828'. [ 108.473655][ T6247] ntfs3: loop1: Different NTFS' sector size (4096) and media sector size (512) [ 108.778850][ T4184] ntfs3: loop1: ntfs_sync_fs r=1a failed, -22. [ 108.804187][ T4184] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 108.865110][ T4184] ntfs3: loop1: ntfs_evict_inode r=1a failed, -22. [ 109.004856][ T6282] MTD: Attempt to mount non-MTD device "/dev/loop3" [ 109.263516][ T6292] netlink: 40 bytes leftover after parsing attributes in process `syz.5.842'. [ 109.645817][ T6301] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 109.742095][ T6257] set_capacity_and_notify: 2 callbacks suppressed [ 109.742114][ T6257] loop0: detected capacity change from 0 to 32768 [ 109.794356][ T4228] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 109.870123][ T6267] loop6: detected capacity change from 0 to 32768 [ 109.896129][ T6257] JBD2: Ignoring recovery information on journal [ 109.942442][ T6313] netlink: 108 bytes leftover after parsing attributes in process `syz.5.848'. [ 109.991334][ T6267] (syz.6.833,6267,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 110.098018][ T6257] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 110.116428][ T6267] (syz.6.833,6267,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 110.194919][ T6267] JBD2: Ignoring recovery information on journal [ 110.354444][ T4228] usb 2-1: New USB device found, idVendor=09e1, idProduct=5121, bcdDevice=40.c1 [ 110.367306][ T4228] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.375574][ T4228] usb 2-1: Product: syz [ 110.376908][ T6267] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode. [ 110.379840][ T4228] usb 2-1: Manufacturer: syz [ 110.394271][ T4228] usb 2-1: SerialNumber: syz [ 110.415050][ T4183] ocfs2: Unmounting device (7,0) on (node local) [ 110.421858][ T4228] usb 2-1: config 0 descriptor?? [ 110.454359][ T4879] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 110.478438][ T6267] ocfs2: Unmounting device (7,6) on (node local) [ 110.684510][ T4228] int51x1: probe of 2-1:0.0 failed with error -22 [ 110.734254][ T4879] usb 6-1: Using ep0 maxpacket: 8 [ 110.920878][ T4879] usb 6-1: unable to get BOS descriptor or descriptor too short [ 110.935286][ T4414] usb 2-1: USB disconnect, device number 6 [ 111.024508][ T4879] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 111.047760][ T4879] usb 6-1: config 1 has no interface number 1 [ 111.053915][ T4879] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 111.109365][ T4879] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 111.275819][ T6354] openvswitch: netlink: Message has 4 unknown bytes. [ 111.304638][ T4879] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 111.334452][ T4879] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.342512][ T4879] usb 6-1: Product: syz [ 111.364163][ T4879] usb 6-1: Manufacturer: syz [ 111.370206][ T4879] usb 6-1: SerialNumber: syz [ 111.410887][ T6362] netlink: 'syz.0.860': attribute type 2 has an invalid length. [ 111.438422][ T6367] loop6: detected capacity change from 0 to 256 [ 111.475232][ T6362] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.860'. [ 111.546959][ T6367] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0xecc0b056, utbl_chksum : 0xe619d30d) [ 111.706533][ T6367] exFAT-fs (loop6): invalid start cluster (4278190088) [ 111.794512][ T4879] usb 6-1: 2:1: cannot set freq 15828157 to ep 0x82 [ 111.921785][ T4879] usb 6-1: USB disconnect, device number 2 [ 112.120260][ T6397] netlink: 224 bytes leftover after parsing attributes in process `syz.3.875'. [ 112.378561][ T6056] udevd[6056]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 112.417970][ T6407] loop3: detected capacity change from 0 to 2048 [ 112.521284][ T6407] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found [ 112.573938][ T6420] loop1: detected capacity change from 0 to 1024 [ 112.584491][ T6407] UDF-fs: Scanning with blocksize 512 failed [ 112.656931][ T6407] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 112.881579][ T6420] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:476: comm syz.1.883: Invalid block bitmap block 0 in block_group 0 [ 113.009132][ T6420] Quota error (device loop1): write_blk: dquota write failed [ 113.034286][ T6420] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 113.136431][ T6441] delete_channel: no stack [ 113.146490][ T6420] EXT4-fs error (device loop1): ext4_acquire_dquot:6234: comm syz.1.883: Failed to acquire dquot type 0 [ 113.181255][ T6395] loop0: detected capacity change from 0 to 32768 [ 113.215518][ T6420] EXT4-fs error (device loop1): ext4_free_blocks:6234: comm syz.1.883: Freeing blocks not in datazone - block = 0, count = 4096 [ 113.233779][ T6449] openvswitch: netlink: Message has 4 unknown bytes. [ 113.259579][ T6420] EXT4-fs error (device loop1): ext4_read_inode_bitmap:140: comm syz.1.883: Invalid inode bitmap blk 0 in block_group 0 [ 113.280392][ T154] Quota error (device loop1): remove_tree: Getting block too big (0 >= 8) [ 113.311746][ T154] EXT4-fs error (device loop1): ext4_release_dquot:6270: comm kworker/u4:2: Failed to release dquot type 0 [ 113.332288][ T6395] XFS (loop0): Mounting V5 Filesystem [ 113.398005][ T6420] EXT4-fs error (device loop1) in ext4_free_inode:362: Corrupt filesystem [ 113.465735][ T6420] EXT4-fs (loop1): 1 orphan inode deleted [ 113.471866][ T6420] EXT4-fs (loop1): mounted filesystem without journal. Opts: ; ,errors=continue. Quota mode: writeback. [ 113.663237][ T6395] XFS (loop0): Ending clean mount [ 113.676856][ T6469] loop6: detected capacity change from 0 to 2048 [ 113.814142][ T6469] UDF-fs: warning (device loop6): udf_load_vrs: No anchor found [ 113.864326][ T6469] UDF-fs: Scanning with blocksize 512 failed [ 113.898395][ T4183] XFS (loop0): Unmounting Filesystem [ 113.905996][ T6469] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 114.254278][ T4414] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 114.437743][ T6509] netlink: 12 bytes leftover after parsing attributes in process `syz.5.916'. [ 114.514362][ T4414] usb 4-1: Using ep0 maxpacket: 8 [ 114.620694][ T6516] netlink: 4 bytes leftover after parsing attributes in process `syz.6.919'. [ 114.634574][ T4414] usb 4-1: config 0 has an invalid interface number: 176 but max is 0 [ 114.653193][ T4414] usb 4-1: config 0 has no interface number 0 [ 114.673489][ T4414] usb 4-1: config 0 interface 176 altsetting 56 bulk endpoint 0x8 has invalid maxpacket 32 [ 114.714287][ T4414] usb 4-1: config 0 interface 176 altsetting 56 endpoint 0x7 has invalid maxpacket 16416, setting to 1024 [ 114.774223][ T4414] usb 4-1: config 0 interface 176 altsetting 56 bulk endpoint 0x7 has invalid maxpacket 1024 [ 114.809974][ T4414] usb 4-1: config 0 interface 176 has no altsetting 0 [ 114.903389][ T6527] delete_channel: no stack [ 114.962615][ T6534] loop1: detected capacity change from 0 to 256 [ 115.014474][ T4414] usb 4-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice=68.dc [ 115.036884][ T4414] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.064774][ T6534] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xecc0b056, utbl_chksum : 0xe619d30d) [ 115.084218][ T4414] usb 4-1: Product: syz [ 115.114207][ T4414] usb 4-1: Manufacturer: syz [ 115.129126][ T4414] usb 4-1: SerialNumber: syz [ 115.153101][ T6539] loop0: detected capacity change from 0 to 16 [ 115.165393][ T4414] usb 4-1: config 0 descriptor?? [ 115.184475][ T6534] exFAT-fs (loop1): invalid start cluster (4278190088) [ 115.194687][ T6487] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 115.201973][ T6487] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 115.239467][ T6539] erofs: (device loop0): mounted with root inode @ nid 36. [ 115.294741][ T6539] erofs: (device loop0): z_erofs_fill_inode_lazy: per-inode big pcluster without sb feature for nid 83 [ 115.328286][ T6539] erofs: (device loop0): z_erofs_readpage: failed to read, err [-117] [ 115.655445][ T4414] usb 4-1: probing VID:PID(0424:012C) [ 115.680170][ T4414] usb 4-1: vub300 testing BULK OUT EndPoint(0) 08 [ 115.687332][ T4424] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 115.717549][ T4414] usb 4-1: vub300 testing BULK OUT EndPoint(1) 07 [ 115.743719][ T4414] usb 4-1: Could not find two sets of bulk-in/out endpoint pairs [ 115.771505][ T4414] vub300: probe of 4-1:0.176 failed with error -22 [ 115.814991][ T4414] usb 4-1: USB disconnect, device number 5 [ 116.215044][ T4424] usb 7-1: New USB device found, idVendor=09e1, idProduct=5121, bcdDevice=40.c1 [ 116.239074][ T4424] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.304757][ T4424] usb 7-1: Product: syz [ 116.308982][ T4424] usb 7-1: Manufacturer: syz [ 116.313698][ T4424] usb 7-1: SerialNumber: syz [ 116.376399][ T4424] usb 7-1: config 0 descriptor?? [ 116.634496][ T4424] int51x1: probe of 7-1:0.0 failed with error -22 [ 116.877062][ T4414] usb 7-1: USB disconnect, device number 2 [ 116.950317][ T6630] tmpfs: Bad value for 'mpol' [ 117.026254][ T6635] loop0: detected capacity change from 0 to 64 [ 117.084700][ T6635] hfs: unable to locate alternate MDB [ 117.090838][ T6635] hfs: continuing without an alternate MDB [ 117.182853][ T6635] hfs: filesystem was not cleanly unmounted, running fsck.hfs is recommended. mounting read-only. [ 117.310047][ T6651] loop3: detected capacity change from 0 to 512 [ 117.365026][ T6651] EXT4-fs (loop3): Ignoring removed bh option [ 117.371413][ T6651] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 117.371413][ T6651] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 117.371413][ T6651] [ 117.465891][ T6660] netlink: 28 bytes leftover after parsing attributes in process `syz.5.974'. [ 117.543812][ T6660] netlink: 28 bytes leftover after parsing attributes in process `syz.5.974'. [ 117.554375][ T6651] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 117.651713][ T6651] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2807: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 117.775298][ T6651] EXT4-fs (loop3): 1 truncate cleaned up [ 117.781092][ T6651] EXT4-fs (loop3): mounted filesystem without journal. Opts: bh,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006c,nouser_xattr,nodelalloc,quota,,errors=continue. Quota mode: writeback. [ 117.995772][ T6681] loop5: detected capacity change from 0 to 16 [ 118.231838][ T6681] erofs: (device loop5): mounted with root inode @ nid 36. [ 118.340456][ T6681] erofs: (device loop5): z_erofs_fill_inode_lazy: per-inode big pcluster without sb feature for nid 83 [ 118.415084][ T6681] erofs: (device loop5): z_erofs_readpage: failed to read, err [-117] [ 118.465327][ T6700] loop6: detected capacity change from 0 to 64 [ 118.487373][ T6656] loop1: detected capacity change from 0 to 32768 [ 118.565631][ T6700] hfs: unable to locate alternate MDB [ 118.571977][ T6700] hfs: continuing without an alternate MDB [ 118.617013][ T6700] hfs: filesystem was not cleanly unmounted, running fsck.hfs is recommended. mounting read-only. [ 118.654419][ T6656] XFS (loop1): Mounting V5 Filesystem [ 118.844200][ T21] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 118.936254][ T6656] XFS (loop1): Ending clean mount [ 119.001449][ T4184] XFS (loop1): Unmounting Filesystem [ 119.104417][ T21] usb 4-1: Using ep0 maxpacket: 8 [ 119.126157][ T4413] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 119.183838][ T6731] loop6: detected capacity change from 0 to 4096 [ 119.250645][ T6731] ntfs3: loop6: Different NTFS' sector size (1024) and media sector size (512) [ 119.294463][ T21] usb 4-1: unable to get BOS descriptor or descriptor too short [ 119.420160][ T21] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 119.439535][ T21] usb 4-1: config 1 has no interface number 1 [ 119.454227][ T21] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 119.481897][ T21] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 119.504558][ T4413] usb 6-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 119.531024][ T4413] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 119.552699][ T4413] usb 6-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 119.577060][ T4413] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 119.589740][ T4413] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.614991][ T6741] loop0: detected capacity change from 0 to 1764 [ 119.621551][ T6743] device batadv0 entered promiscuous mode [ 119.637485][ T4413] usb 6-1: invalid MIDI out EP 0 [ 119.650186][ T6743] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 119.686769][ T21] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 119.712776][ T21] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.716926][ T6741] iso9660: Corrupted directory entry in block 2 of inode 1920 [ 119.727786][ T21] usb 4-1: Product: syz [ 119.733471][ T21] usb 4-1: Manufacturer: syz [ 119.738988][ T21] usb 4-1: SerialNumber: syz [ 119.827366][ T4413] snd-usb-audio: probe of 6-1:27.0 failed with error -22 [ 119.896187][ T4413] usb 6-1: USB disconnect, device number 3 [ 119.941254][ T4173] udevd[4173]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 120.264455][ T21] usb 4-1: 2:1: cannot set freq 15828157 to ep 0x82 [ 120.312485][ T21] usb 4-1: USB disconnect, device number 6 [ 120.487287][ T6765] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1022'. [ 120.497371][ T6765] netlink: 6 bytes leftover after parsing attributes in process `syz.0.1022'. [ 120.617038][ T6056] udevd[6056]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 120.881613][ T6771] loop0: detected capacity change from 0 to 4096 [ 120.909345][ T6787] loop6: detected capacity change from 0 to 1764 [ 121.009339][ T6787] iso9660: Corrupted directory entry in block 2 of inode 1920 [ 121.036534][ T6771] ntfs3: loop0: Different NTFS' sector size (1024) and media sector size (512) [ 121.123157][ T6802] loop5: detected capacity change from 0 to 1024 [ 121.313276][ T4236] hfsplus: b-tree write err: -5, ino 4 [ 121.367614][ T6816] loop1: detected capacity change from 0 to 1024 [ 121.505600][ T6824] MTD: Attempt to mount non-MTD device "./file0" [ 121.514438][ T6824] ./file0: Can't open blockdev [ 121.536912][ T4236] hfsplus: b-tree write err: -5, ino 4 [ 121.545549][ T6829] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 121.662680][ T6838] loop1: detected capacity change from 0 to 16 [ 121.709580][ T6838] MTD: Attempt to mount non-MTD device "/dev/loop1" [ 121.711479][ T6841] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1046'. [ 121.750726][ T6843] x_tables: ip_tables: REDIRECT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 121.754302][ T4228] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 122.214411][ T4228] usb 4-1: unable to get BOS descriptor or descriptor too short [ 122.294480][ T4228] usb 4-1: config 14 has an invalid interface number: 85 but max is 0 [ 122.317511][ T4228] usb 4-1: config 14 has no interface number 0 [ 122.323841][ T4228] usb 4-1: config 14 interface 85 has no altsetting 0 [ 122.377300][ T6877] xt_CT: No such helper "snmp_trap" [ 122.524467][ T4228] usb 4-1: New USB device found, idVendor=0458, idProduct=7003, bcdDevice=24.ae [ 122.564183][ T4228] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.572347][ T4228] usb 4-1: Product: syz [ 122.599054][ T4228] usb 4-1: Manufacturer: syz [ 122.603717][ T4228] usb 4-1: SerialNumber: syz [ 122.928365][ T4228] gspca_main: sn9c2028-2.14.0 probing 0458:7003 [ 122.976327][ T4228] gspca_sn9c2028: read1 error -71 [ 122.994259][ T4228] gspca_sn9c2028: read1 error -71 [ 123.014278][ T4228] gspca_sn9c2028: read1 error -71 [ 123.025153][ T4228] sn9c2028: probe of 4-1:14.85 failed with error -71 [ 123.079487][ T4228] usb 4-1: USB disconnect, device number 7 [ 123.160192][ T6921] xt_CT: No such helper "snmp_trap" [ 123.249971][ T6934] loop0: detected capacity change from 0 to 256 [ 123.368753][ T6934] FAT-fs (loop0): Directory bread(block 64) failed [ 123.388870][ T6934] FAT-fs (loop0): Directory bread(block 65) failed [ 123.433497][ T6934] FAT-fs (loop0): Directory bread(block 66) failed [ 123.471803][ T6934] FAT-fs (loop0): Directory bread(block 67) failed [ 123.534300][ T6934] FAT-fs (loop0): Directory bread(block 68) failed [ 123.543888][ T6952] loop1: detected capacity change from 0 to 1024 [ 123.563187][ T6934] FAT-fs (loop0): Directory bread(block 69) failed [ 123.589848][ T6956] netlink: 'syz.3.1090': attribute type 46 has an invalid length. [ 123.598265][ T6934] FAT-fs (loop0): Directory bread(block 70) failed [ 123.598611][ T6955] autofs4:pid:6955:check_dev_ioctl_version: ioctl control interface version mismatch: kernel(1.1), user(2.1), cmd(0xc0189374) [ 123.618468][ T6934] FAT-fs (loop0): Directory bread(block 71) failed [ 123.619437][ T6956] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1090'. [ 123.634178][ T6934] FAT-fs (loop0): Directory bread(block 72) failed [ 123.642393][ T6934] FAT-fs (loop0): Directory bread(block 73) failed [ 123.705217][ T6952] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 123.734637][ T6955] autofs4:pid:6955:validate_dev_ioctl: invalid device control module version supplied for cmd(0xc0189374) [ 123.738804][ T6952] EXT4-fs warning (device loop1): ext4_rmdir:3243: inode #11: comm syz.1.1087: empty directory 'file1' has too many links (111) [ 124.398615][ T6987] comedi: No check for data length of config insn id 33554458 is implemented [ 124.439228][ T6987] comedi: Add a check to check_insn_config_length in drivers/comedi/comedi_fops.c [ 124.482260][ T6987] comedi: Assuming n=15 is correct [ 125.132277][ T7020] autofs4:pid:7020:check_dev_ioctl_version: ioctl control interface version mismatch: kernel(1.1), user(2.1), cmd(0xc0189374) [ 125.162998][ T7022] process 'syz.0.1118' launched './file1' with NULL argv: empty string added [ 125.189056][ T7020] autofs4:pid:7020:validate_dev_ioctl: invalid device control module version supplied for cmd(0xc0189374) [ 125.524235][ T21] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 125.654177][ T4879] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 125.804421][ T21] usb 7-1: Using ep0 maxpacket: 8 [ 125.861537][ T7054] loop5: detected capacity change from 0 to 1024 [ 125.926868][ T4879] usb 2-1: Using ep0 maxpacket: 8 [ 125.973831][ T7054] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 126.013729][ T7054] EXT4-fs warning (device loop5): ext4_rmdir:3243: inode #11: comm syz.5.1135: empty directory 'file1' has too many links (111) [ 126.108650][ T4879] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x99, skipping [ 126.130650][ T7065] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1148'. [ 126.161624][ T21] usb 7-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 126.186652][ T21] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.214872][ T21] usb 7-1: Product: syz [ 126.219098][ T21] usb 7-1: Manufacturer: syz [ 126.223718][ T21] usb 7-1: SerialNumber: syz [ 126.344484][ T4879] usb 2-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 126.353596][ T4879] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.401392][ T4879] usb 2-1: Product: syz [ 126.419825][ T4879] usb 2-1: Manufacturer: syz [ 126.432118][ T4879] usb 2-1: SerialNumber: syz [ 126.478714][ T4879] usb 2-1: config 0 descriptor?? [ 126.546489][ T4879] streamzap 2-1:0.0: streamzap_probe: Unexpected desc.bNumEndpoints (0) [ 126.604580][ T7090] netlink: 'syz.0.1146': attribute type 46 has an invalid length. [ 126.653843][ T7090] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1146'. [ 126.754429][ T21] mxuport 7-1:254.0: mxuport_recv_ctrl_urb - usb_control_msg failed (-71) [ 126.781963][ T7096] loop3: detected capacity change from 0 to 1024 [ 126.791212][ T21] mxuport: probe of 7-1:254.0 failed with error -5 [ 126.826863][ T21] usb 7-1: USB disconnect, device number 3 [ 126.860519][ T4879] usb 2-1: USB disconnect, device number 7 [ 126.975882][ T7096] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 127.052740][ T7096] EXT4-fs warning (device loop3): ext4_rmdir:3243: inode #11: comm syz.3.1149: empty directory 'file1' has too many links (111) [ 127.434684][ T7126] loop1: detected capacity change from 0 to 512 [ 127.450176][ T7129] comedi: No check for data length of config insn id 33554458 is implemented [ 127.465181][ T7131] (unnamed net_device) (uninitialized): option all_slaves_active: invalid value (8) [ 127.514299][ T7129] comedi: Add a check to check_insn_config_length in drivers/comedi/comedi_fops.c [ 127.536457][ T7129] comedi: Assuming n=15 is correct [ 127.615752][ T7126] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.1160: bg 0: block 473: padding at end of block bitmap is not set [ 127.731859][ T7126] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6194: Corrupt filesystem [ 127.787494][ T7126] EXT4-fs (loop1): 1 orphan inode deleted [ 127.797435][ T7126] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 127.844697][ T7126] ext4 filesystem being mounted at /249/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 128.096445][ T7160] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1173'. [ 128.509511][ T7188] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1183'. [ 128.554296][ T7186] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 128.805302][ T7201] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.1187'. [ 128.840659][ T7207] ieee802154 phy0 wpan0: encryption failed: -22 [ 128.918502][ T7206] loop3: detected capacity change from 0 to 2048 [ 128.970046][ T7197] loop6: detected capacity change from 0 to 4096 [ 129.057036][ T7197] ntfs: (device loop6): ntfs_read_locked_inode(): $DATA attribute is missing. [ 129.102503][ T7197] ntfs: (device loop6): ntfs_read_locked_inode(): Failed with error code -2. Marking corrupt inode 0xa as bad. Run chkdsk. [ 129.148691][ T7216] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 129.159810][ T7197] ntfs: (device loop6): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 129.240328][ T7197] ntfs: volume version 3.1. [ 129.249625][ T26] audit: type=1800 audit(1771569326.868:4): pid=7206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1188" name="file2" dev="loop3" ino=16 res=0 errno=0 [ 129.332964][ T7206] NILFS (loop3): error -2 truncating bmap (ino=16) [ 129.559805][ T7216] ------------[ cut here ]------------ [ 129.565680][ T7216] WARNING: CPU: 1 PID: 7216 at fs/nilfs2/dat.c:200 nilfs_dat_commit_end+0x5ac/0x6b0 [ 129.575246][ T7216] Modules linked in: [ 129.579183][ T7216] CPU: 1 PID: 7216 Comm: segctord Not tainted syzkaller #0 [ 129.587094][ T7216] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 129.597452][ T7216] RIP: 0010:nilfs_dat_commit_end+0x5ac/0x6b0 [ 129.603473][ T7216] Code: 8b 34 24 48 83 c4 28 5b 41 5c 41 5d 41 5e 41 5f 5d e9 b8 54 03 00 e8 d3 63 6a fe e8 ae be f1 fd e9 b8 fc ff ff e8 c4 63 6a fe <0f> 0b e9 16 fc ff ff e8 b8 63 6a fe e8 93 be f1 fd e9 74 fe ff ff [ 129.623446][ T7216] RSP: 0018:ffffc9000402f390 EFLAGS: 00010293 [ 129.629597][ T7216] RAX: ffffffff830ebe7c RBX: ffff888078e0e1a0 RCX: ffff88807854d940 [ 129.637718][ T7216] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 00000000003f0002 [ 129.645753][ T7216] RBP: 0000000000000003 R08: ffff888070cbecb7 R09: 1ffff1100e197d96 [ 129.653867][ T7216] R10: dffffc0000000000 R11: ffffed100e197d97 R12: ffff88807854f0c8 [ 129.661918][ T7216] R13: ffff888024f8f9e0 R14: 00000000003f0002 R15: ffff88807d2200b0 [ 129.670481][ T7216] FS: 0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 [ 129.679480][ T7216] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 129.686131][ T7216] CR2: 00007f8f5908e9d3 CR3: 000000007224f000 CR4: 00000000003506e0 [ 129.694170][ T7216] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 129.702193][ T7216] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 129.710320][ T7216] Call Trace: [ 129.713727][ T7216] [ 129.716819][ T7216] nilfs_dat_commit_update+0x24/0x40 [ 129.722142][ T7216] nilfs_btree_commit_update_v+0x93/0x410 [ 129.727939][ T7216] nilfs_btree_propagate+0x95a/0xcf0 [ 129.733269][ T7216] nilfs_bmap_propagate+0x70/0x120 [ 129.738445][ T7216] nilfs_segctor_apply_buffers+0x15d/0x320 [ 129.744305][ T7216] ? nilfs_collect_file_data+0xc0/0xc0 [ 129.749814][ T7216] nilfs_segctor_scan_file+0x7af/0x9d0 [ 129.755344][ T7216] ? trace_nilfs2_collection_stage_transition+0x1a0/0x1a0 [ 129.762680][ T7216] ? nilfs_segbuf_extend_segsum+0x25d/0x360 [ 129.768654][ T7216] ? rcu_is_watching+0x11/0xa0 [ 129.773461][ T7216] nilfs_segctor_do_construct+0x1c26/0x6ca0 [ 129.779426][ T7216] ? add_chain_block+0x940/0x940 [ 129.784562][ T7216] ? verify_lock_unused+0x140/0x140 [ 129.789810][ T7216] ? nilfs_transaction_unlock+0x220/0x220 [ 129.795690][ T7216] ? nilfs_bmap_test_and_clear_dirty+0x4c/0x70 [ 129.801892][ T7216] ? clear_nonspinnable+0x60/0x60 [ 129.806986][ T7216] ? nilfs_segctor_confirm+0x24d/0x2d0 [ 129.812579][ T7216] ? __lock_acquire+0x7d10/0x7d10 [ 129.817669][ T7216] ? __rwlock_init+0x140/0x140 [ 129.822476][ T7216] ? do_raw_spin_unlock+0x11d/0x230 [ 129.827738][ T7216] ? _raw_spin_unlock+0x24/0x40 [ 129.832613][ T7216] ? nilfs_segctor_confirm+0x24d/0x2d0 [ 129.838179][ T7216] nilfs_segctor_construct+0x17b/0x690 [ 129.843688][ T7216] nilfs_segctor_thread+0x523/0x1180 [ 129.849171][ T7216] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 129.855396][ T7216] ? nilfs_iput_work_func+0x70/0x70 [ 129.860731][ T7216] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 129.866676][ T7216] ? _raw_spin_unlock+0x40/0x40 [ 129.871556][ T7216] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 129.877718][ T7216] ? init_wait_entry+0xd0/0xd0 [ 129.882531][ T7216] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 129.888490][ T7216] ? __kthread_parkme+0x157/0x1b0 [ 129.893740][ T7216] kthread+0x436/0x520 [ 129.897865][ T7216] ? nilfs_iput_work_func+0x70/0x70 [ 129.903089][ T7216] ? kthread_blkcg+0xd0/0xd0 [ 129.907736][ T7216] ret_from_fork+0x1f/0x30 [ 129.912250][ T7216] [ 129.915332][ T7216] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 129.922625][ T7216] CPU: 1 PID: 7216 Comm: segctord Not tainted syzkaller #0 [ 129.929846][ T7216] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 129.940006][ T7216] Call Trace: [ 129.943316][ T7216] [ 129.946357][ T7216] dump_stack_lvl+0x188/0x250 [ 129.951077][ T7216] ? show_regs_print_info+0x20/0x20 [ 129.956315][ T7216] ? load_image+0x400/0x400 [ 129.960861][ T7216] panic+0x2e5/0x810 [ 129.964792][ T7216] ? bpf_jit_dump+0xd0/0xd0 [ 129.969332][ T7216] ? ret_from_fork+0x1f/0x30 [ 129.973946][ T7216] ? nilfs_dat_commit_end+0x5ac/0x6b0 [ 129.979347][ T7216] __warn+0x248/0x2b0 [ 129.983362][ T7216] ? nilfs_dat_commit_end+0x5ac/0x6b0 [ 129.988765][ T7216] report_bug+0x1b7/0x2e0 [ 129.993163][ T7216] handle_bug+0x3a/0x70 [ 129.997451][ T7216] exc_invalid_op+0x16/0x40 [ 130.002065][ T7216] asm_exc_invalid_op+0x16/0x20 [ 130.007022][ T7216] RIP: 0010:nilfs_dat_commit_end+0x5ac/0x6b0 [ 130.013033][ T7216] Code: 8b 34 24 48 83 c4 28 5b 41 5c 41 5d 41 5e 41 5f 5d e9 b8 54 03 00 e8 d3 63 6a fe e8 ae be f1 fd e9 b8 fc ff ff e8 c4 63 6a fe <0f> 0b e9 16 fc ff ff e8 b8 63 6a fe e8 93 be f1 fd e9 74 fe ff ff [ 130.032758][ T7216] RSP: 0018:ffffc9000402f390 EFLAGS: 00010293 [ 130.038858][ T7216] RAX: ffffffff830ebe7c RBX: ffff888078e0e1a0 RCX: ffff88807854d940 [ 130.046866][ T7216] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 00000000003f0002 [ 130.054860][ T7216] RBP: 0000000000000003 R08: ffff888070cbecb7 R09: 1ffff1100e197d96 [ 130.062863][ T7216] R10: dffffc0000000000 R11: ffffed100e197d97 R12: ffff88807854f0c8 [ 130.070858][ T7216] R13: ffff888024f8f9e0 R14: 00000000003f0002 R15: ffff88807d2200b0 [ 130.078865][ T7216] ? nilfs_dat_commit_end+0x5ac/0x6b0 [ 130.084283][ T7216] nilfs_dat_commit_update+0x24/0x40 [ 130.089606][ T7216] nilfs_btree_commit_update_v+0x93/0x410 [ 130.095360][ T7216] nilfs_btree_propagate+0x95a/0xcf0 [ 130.100686][ T7216] nilfs_bmap_propagate+0x70/0x120 [ 130.105829][ T7216] nilfs_segctor_apply_buffers+0x15d/0x320 [ 130.111670][ T7216] ? nilfs_collect_file_data+0xc0/0xc0 [ 130.117158][ T7216] nilfs_segctor_scan_file+0x7af/0x9d0 [ 130.122662][ T7216] ? trace_nilfs2_collection_stage_transition+0x1a0/0x1a0 [ 130.129817][ T7216] ? nilfs_segbuf_extend_segsum+0x25d/0x360 [ 130.135738][ T7216] ? rcu_is_watching+0x11/0xa0 [ 130.140523][ T7216] nilfs_segctor_do_construct+0x1c26/0x6ca0 [ 130.146436][ T7216] ? add_chain_block+0x940/0x940 [ 130.151447][ T7216] ? verify_lock_unused+0x140/0x140 [ 130.156681][ T7216] ? nilfs_transaction_unlock+0x220/0x220 [ 130.162418][ T7216] ? nilfs_bmap_test_and_clear_dirty+0x4c/0x70 [ 130.168612][ T7216] ? clear_nonspinnable+0x60/0x60 [ 130.173664][ T7216] ? nilfs_segctor_confirm+0x24d/0x2d0 [ 130.179153][ T7216] ? __lock_acquire+0x7d10/0x7d10 [ 130.184219][ T7216] ? __rwlock_init+0x140/0x140 [ 130.189008][ T7216] ? do_raw_spin_unlock+0x11d/0x230 [ 130.194231][ T7216] ? _raw_spin_unlock+0x24/0x40 [ 130.199106][ T7216] ? nilfs_segctor_confirm+0x24d/0x2d0 [ 130.204592][ T7216] nilfs_segctor_construct+0x17b/0x690 [ 130.210086][ T7216] nilfs_segctor_thread+0x523/0x1180 [ 130.215429][ T7216] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 130.221360][ T7216] ? nilfs_iput_work_func+0x70/0x70 [ 130.226592][ T7216] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 130.232612][ T7216] ? _raw_spin_unlock+0x40/0x40 [ 130.237484][ T7216] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 130.243403][ T7216] ? init_wait_entry+0xd0/0xd0 [ 130.248199][ T7216] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 130.254118][ T7216] ? __kthread_parkme+0x157/0x1b0 [ 130.259190][ T7216] kthread+0x436/0x520 [ 130.263282][ T7216] ? nilfs_iput_work_func+0x70/0x70 [ 130.268506][ T7216] ? kthread_blkcg+0xd0/0xd0 [ 130.273128][ T7216] ret_from_fork+0x1f/0x30 [ 130.277015][ T7242] loop5: detected capacity change from 0 to 512 [ 130.277579][ T7216] [ 130.286915][ T7216] Kernel Offset: disabled [ 130.291412][ T7216] Rebooting in 86400 seconds..