last executing test programs: 3m37.418176692s ago: executing program 3 (id=6452): r0 = syz_usb_connect$uac3(0x3, 0xa0, &(0x7f0000000140)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x4b4, 0x384, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8e, 0x3, 0x1, 0x0, 0x20, 0x40, {0x8, 0xb, 0x2, 0x1, 0x1, 0x21, 0x30, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x4, 0xa, 0xffe}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x9, 0xd, 0xb, {0xa, 0x25, 0x25, 0x2, 0xe, 0x8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x80, 0x3, 0xc8, "a65abbca52b194594a"}, @format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x4, 0x4, 0x57, 0x1, "44d008d39853"}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x2, 0xff, 0x0, {0xa, 0x25, 0x25, 0x5, 0x6, 0x5}}}}}}}}]}}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xc}) syz_usb_control_io$uac3(r0, 0x0, 0x0) 3m35.590446301s ago: executing program 3 (id=6476): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x2, 0x181900) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f0000000600)={{0x3, 0x4, 0x3f3, 0x1, 'syz0\x00', 0x8a}, 0x0, [0x7f, 0x0, 0x401, 0x200, 0x7, 0x40, 0xe, 0x7, 0x596e, 0x8001, 0x1ff, 0x7f, 0x8, 0x6, 0x41a6bcaf, 0x4, 0x80, 0x9, 0x0, 0xfffffffffffffffc, 0x6, 0x2e, 0xb9b, 0x5, 0x7, 0x8000000000000000, 0x0, 0x2, 0x100, 0xd, 0x4000004, 0xfff, 0x2, 0x6, 0x6, 0xfff, 0x4, 0x80000001, 0x6, 0x6d, 0x100000000, 0x7fffffffffffffff, 0x7fff, 0xc, 0x4, 0x5, 0x2, 0x400, 0x8, 0x7ff, 0x5, 0xe, 0x6, 0x3cb, 0x200, 0x85d, 0x80d, 0xfffffffffffffff0, 0x6000000, 0x5, 0x3, 0x6, 0x80000001, 0x6, 0xef7e, 0x5, 0xf, 0x387, 0x2, 0x7fff, 0x0, 0x0, 0x3354, 0xfffffffffffffc00, 0x5, 0xb, 0x6c99, 0x560, 0x7, 0x9, 0x8, 0xae, 0x6, 0x80000000, 0x38c, 0x7fff, 0x3, 0x6, 0x4, 0x40000000200, 0x8, 0x9, 0x1, 0x70000000, 0x80000001, 0x613e6363, 0x51c3ff27, 0xc4a0, 0x8, 0x4, 0x1, 0x7a, 0x101, 0x7, 0x5, 0xdd28, 0x401, 0x8000000000000001, 0xa0, 0x100000001, 0x1, 0xfffffffffffffff8, 0x200, 0x7, 0x5, 0x8, 0x5, 0xfff, 0x3, 0x8, 0x0, 0x1, 0x0, 0x1000000000003ff, 0x6, 0x1, 0x1fb, 0xf6d]}) 3m35.426979396s ago: executing program 3 (id=6479): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=@newlink={0x40, 0x10, 0x439, 0x4070bd28, 0x1, {0x0, 0x0, 0x0, 0x0, 0x21801, 0x9101}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x1}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x410c0}, 0x4000020) 3m35.311234899s ago: executing program 3 (id=6481): syz_mount_image$exfat(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', 0x800, &(0x7f00000017c0)={[{@iocharset={'iocharset', 0x3d, 'macgreek'}}, {@umask={'umask', 0x3d, 0x4}}, {@namecase}, {@namecase}, {@fmask={'fmask', 0x3d, 0x8}}, {@discard}, {@keep_last_dots}, {@iocharset={'iocharset', 0x3d, 'euc-jp'}}, {@allow_utime={'allow_utime', 0x3d, 0x3}}, {@errors_continue}]}, 0x1, 0x1528, &(0x7f0000000280)="$eJzs3AuYT9X6OPD3XWvtMSS+TXIZ1lrv5ptclkmSXJLkkiRJkuSWkDTJkYTEEJI0JCG5DEkMIblMTBr3+/2SkCRNkoTklqz/M+FxOnX+p/M7/XKe37yf59mP9X73ftd+9/f9XvbeZubbrkNrNaldvRERwX8EL/yTBACxADAQAPICQAAA5ePKx2Wtzykx6T/bCftzPZh6pStgVxL3P3vj/mdv3P/sjfufvXH/szfuf/bG/c/euP+MZWebphW6hpfsu/D9/+yMv///D8ksM/bLNWWu6wYQ80dTuP/ZG/f//6zgj2zE/c/euP/ZVeyVLoD9F+D3f3aQ45+u4f5nb9x/xrKzK33/+UovEPkvew6O5LzQmL/q+BljjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMsb/AaX+ZAoBL4ytdF2OMMcYYY4wxxv48PseVroAxxhhjjDHGGGP/+xAESFAQQAzkgFjICblAAMDVkAfyQgSugTi4FvLBdZAfCkBBKATxUBiKgAYDFghCKArFIArXQ3G4AUpASSgFpcFBGUiAG6Es3ATl4GYoD7dABbgVKkIlqAxV4DaoCrdDNbgDqsOdUANqQi2oDXdBHbgb6sI9UA/uhfpwHzSA+6EhPACN4EFoDA9BE3gYmsIj0AyaQwtoCa3+R/nPQ094AXpBb0iCPtAXXoR+0B8GwEswEF6GQfAKDIZXIRmGwFB4DYbB6zAc3oARMBJGwZswGt6CMTAWxsF4SIEJMBHehknwDkyGd2EKTIVUmAbT4T2YATNhFrwPs+EDmANzYR7MhzT4EBbAQkiHj2ARfAwZsBiWwFJYBsthBayEVbAa1sBaWAfrYQNshE2wGbbAVtgG22EHfAI74VPYBbthD3wGe+HzfzP/1D/kd0NAQIECFSqMwRiMxVjMhbkwN+bGPJgHIxjBOIzDfJgP82N+LIgFMR7jsQgWQYMGCQmLYlGMYhSLY3EsgSWwFJZChw4TMAHL4k1YDstheSyPFbACVsRKWAmrYBWsilWxGlbD6lgda2ANrIW18C68C/tgXayL9bAe1sf6l25PYSNshI2xMTbBJtgUm2IzbIYtsAW2wlbYGltjG2yD7bAdtsf22AE7YCImYkfsiJ2wE3bGztgFu2BX7IrdsDt2z3w+B+AL+AL2xhqiD/bFvtgPk3MMwJfwJXwZB+Er+Aq+isk4BIfia/gavo7D8SSOwJE4CkdhVfEWjsGxSGI8pmAKTsSJOAknYVah7+JUTMVpOB2n4wyciTPxfZyNH+AHOBfn4nxMwzRcgAsxHdNxEZ7CDFyMS3ApLsPluAxX4ipciWtwLa7B9bgeN+JG3IybcStuxe24HT9BBYCf4m7cjcm4F/fiPtyH+3E/HsADmImZeBAP4iE8hIfxMB7BI3gUj+FxPIYn8ASexFN4Gk/jWTyL5/DZ+K8bf1JydTKILEooESNiRKyIFblELpFb5BZ5RB4RERERJ+JEPpFP5Bf5RUFRUMSLeFFEFBFGGEEijAEAERVRUVwUFyVECVFKlBJOOJEgEkRZUVaUE+VEeXGLqCBuFRVFJdHWVRFVRFXRzlUTd4jqorqoIWqKWqK2qC3qiDqirqgr6ol6or6oLxqI+0VD0QcH4IMiqzNNxBBsKoZiM9FcyIufYK3FcGwj2op24nExEkdgB9HaJYqnREcxBjuJv4mx+IzoIsZjV/Gc6Ca6ix7iedFTtHG9RG8xGfuIvmIq9hP9xQDxkpiBNcX7ODtnLfGqSBZDxFDxmpiPr4vh4g0xQowUo8SbYrR4S4wRY8U4MV6kiAlionhbTBLviMniXTFFTBWpYpqYLt4TM8RMMUu8L2aLD8QcMVfME/NFmvhQLBALRbr4SCwSH4sMsVgsEUvFMrFcrBArxSqxWqwRa8U6sV5sEBvFJrFZbBFbxTaxXewQn4id4lOxS+wWe8RnYq/4XOwTX4j94ktxQHwlMsXX4qD4RhwS34rD4jtxRHwvjopj4rj4QZwQP4qT4pQ4Lc6Is+IncU78LM4LL0CiFFJKJQMZI3PIWJlT5pJXydwyuPjsXiPj5LUyn7xO5pcFZEFZSMbLwrKI1NJIK0mGsqgsJqPyellc3iBLyJKylCwtnSwjE+SNsqy8SZaTN8vy8hZZQd4qK8pKsrKsIm+TVeXtEiIX9lFD1pS1ZG15l0yCu2VdeY+sJ++V9eV9soG8XzaUD8hG8kHZWD4km8iHZVP5iGwmm8sWsqVsJR+VreVjso1sK9vJx2V7+YTsIJ+UifIp2VH6iy+RZ2QX+azsKp+T3WR32UP+LM9LL3vJ3hL6gOwrX5T9ZH85IBYA5MtykHxFDpavymQ5RA6Vr8lh8nU5XL4hR8iRcpR8U46Wb8kxcqwcJ8fLFDlBTpRvy0nyHTlZviunyKkyVU6TA+TAX2aaJeW/zH/7d/IH/7L3jXKT3Cy3yK1ym9wud8hP5E65U+6Su+QeuUfulXvlPrlP7pf75QF5QGbKTHlQHpSH5CF5WB6WR+QReVQek2fkD/KE/FGelKfkKXlGnpVn5bmLzwEoVEJJpVSgYlQOFatyqlzqKpVbXa3yqLwqoq5RcepalU9dp/KrAqqgKqTiVWFVRGlllFWkQlVUFVNRdT1efMGoUqq0cqqMSlA3/jv5qri6QZVQJX+Vf6m+pH9SXyvVSrVWrVUb1Ua1U+1Ue9VedVAdVKJKVB1VR9VJdVKdVWfVRXVRXVVX1U11Uz1UD9VT9VS9VC+VpJJUX/Wi6qf6qwHqJTVQvawGqUFqsBqsklWyGqqGqmFqmBquhqsRaoQapUap0Wq0GqPGqHFqnEpRKWqimqgmqUlqspqspqgpKlWlqulqupqhZqhZapaarWarOWqOmqfmqTSVphaoBSpdpatFapHKUIvVYrVULVXL1XK1Uq1Uq9VqtVatVevVepWhNqlNaovaorapbWqH2qF2qp1ql9ql9qg9aq/aq/apfWq/2q8OqAMqU2Wqg+qgOqQOqcPqsDqijqij6qg6ro6rE+qEOqlOqtPqtDqrzqpz6pw6r85nnfYFIhCBClQQE8QEsUFskCvIFeQOcgd5gjxBJIgEcUFckC+4LsgfFAgKBoWC+KBwUCTQgQlsIC42PRpcHxQPbghKBCWDUkHpwAVlgoTgxqBscFNQLrg5KB/cElQIbg0qBpWCykGV4LaganB7UC24I6ge3BnUCGoGtYLawV1BneDuoG5wT1AvuDeoH9wXNAjuDxoGDwSNggeDxsFDQZPg4aBp8EjQLGgetAhaBq3+1Pm9P1ngMddL99ZJuo/uq1/U/XR/PUC/pAfql/Ug/YoerF/VyXqIHqpf08P063q4fkOP0CP1KP2mHq3f0mP0WD1Oj9cpeoKeqN/Wk/Q7erJ+V0/RU3Wqnqan6/f0DD1Tz9Lv69n6Az1Hz9Xz9Hydpj/UC/RCna4/0ov0xzpDL9ZL9FK9TC/XK/RKvUqv1mv0Wr1Or9cb9Ea9SW/WW/RWvU1v1zv0J3qn/lTv0rv1Hv2Z3qs/1/v0F3q//lIf0F/pTP21Pqi/0Yf0t/qw/k4f0d/ro/qYPq5/0Cf0j/qkPqVP6zP6rP5Jn9M/6/PaZ53cZ329G2WUiTExJtbEmlwml8ltcps8Jo+JmIiJM3Emn8ln8pv8pqApaOJNvCliipgsZMgUNUVN1ERNcVPclDAlTClTyjjjTIJJMGVNWVPOlDPlTXlTwVQwFU1FU9lUNreZ28zt5nZzh7nD3GnuNDVNTVPb1DZ1TB1T19Q19Uw9U9/UNw1MA9PQNDSNTCPT2DQ2TUwT09Q0Nc1MM9PCtDCtTCvT2rQ2bUwb0860M+1Ne9PBdDCJJtF0NB1NJ9PJdDadTRfTxXQ1XU030830MD1MT9PT9DK9TJJJMn1NX9PP9DMDzAAz0Aw0g8wgM9gMNskm2Qw1Q80wM8wMN8PNCDPSjMo6UTVvmTFmrBlnxpsUk2ImmolmkplkJpvJZoqZYlJNqpluppsZZoaZZWaZ2Wa2mWPmmHlmnkkzaWaBWWDSTbpZZBaZDJNhlpglZplZZlaYFWaVWWXWmDVmHawzG8wGs8lsMlvMFrPNbDM7zA6z0+w0u8wus8fsMXvNXrPP7DP7zX5zwBwwmSbTHDQHzSFzyBw2h80Rc8QcNUfNcXPcnDAnzElz0pw2p81ZU+Di96U3sTanzWWvsrnt1TaPzWv/MS5oC9l4W9gWsdrmtwV+FRtrbQlb0paypa2zZWyCvfE3cUVbyVa2Vexttqq93Vb7TVzH3m3r2ntsPXuvrW3v+lVc395nG9iHbUNEANvcNrYtbRP7sG1qH7HNbHPbwra07e0TtoN90ibap2xH+/Rv4gV2oV1lV9s1dq3dZXfb0/aMPWS/tWftT7aX7W0H2pftIPuKHWxftcl2yG/iUfZNO9q+ZcfYsXacHf+beIqdalPtNDvdvmdn2Jm/idPsh3a2Tbdz7Fw7z87/Jc6qKd1+ZBfZj22GDWCJXWqX2eV2hV15qVaf1663G+xGu9N+arfYrXab3W53XDoRtrvtHvuZ3Ws/twftN3a//dIesIdtpv36lzjr+A7b7+wR+709ao/Z4/YHe8L+qC5lZx37D/Zne956C4QEJElRQDGUg2IpJ+Wiqyg3XU15KC9F6BqKo2spH11H+akAFaRCFE+FqQhpMmSJKKSiVIyidD1dKq8UlSZHZSiBbqSydBOVo5upPN1CFehWqkiVqDJVoduoKt1O1egOqk53Ug2qSbWoNt1Fdehuqkv3UD26l+rTfdSA7qeG9AA1ogepMT1ETehhakqPUDNqTi2oJbWiR6k1PUZtqC21o8epPT1BHehJSqSnqCM9TZ3ob9SZnqEu9Cx1peeoG3WnHvQ89aQXqBf1piTqQ33pRepH/WkAvUQD6WUaRK/QYHqVkmkIDaXXaBi9TsPpDRpBI2kUvUmj6S0aQ2NpHI2nFJpAE+ltmkTv0GR6l6bQVEqlaTSd3qMZNJNm0fs0mz6gOTSX5tF8SqMPaQEtpHT6iBbRx5RBi2kJLaVltJxW0EpaRatpDa2ldbSeNtBG2kSbaQttpW20nXbQJ7STPqVdtJv20Ge0lz6nffQF7acv6QB9RZn0NR2kb+gQfUuH6Tvfm76no3SMjtMPdIJ+pJN0ik7TGTpLP9E5+pnOkycIMRShDFUYhDFhjjA2zBnmCq8Kc4dXh3nCvGEkvCaMC68N84XXhfnDAmHBsFAYHxYOi4Q6NKENKQzDomGxMBpeHxYPbwhLhCXDUmHp0IVlwoTwxrBseFNYLrw5LB/eElYIbw0rhpXCh++tEt4WVg1vD6uFd4TVwzvDGmHNsFZYO7wrrBPeHdYN7wnrhfeG5cL7wgbh/WHD8IGwUfhg2Dh8KGwSPhw2DR8Jm4XNwxZhy7BV+GjYOnwsbBO2DduFj4ftwyfCDuGTYWL4VNgxfPqX9fct/Ofrk8I+Yd/wxfDF0Pt75Lzo/Gha9MPogujCaHr0o+ii6MfRjOji6JLo0uiy6PLoiujK6Kro6uia6Nrouuj66Iboxqj3tXOAQyecdMoFLsblcLEup8vlrnK53dUuj8vrIu4aF+eudfncdS6/K+AKukIu3hV2RZx2xllHLnRFXTEXdde74u4GV8KVdKVcaedcGZfgWrpWrpVr7R5zbVxb18497h53T7gn3JPuSfeU6+iedp3c31xn94zr4p51z7rnXDfX3fVwz7uebkKeC+/JJNfX9XX9XD83wA1wA91AN8gNcoPdYJfskt1QN9QNc8PccDfcjXAj3Cg3yo12o90YN8aNc+NciktxE91EN8lNcpPdZDfFTXGpLtVNd9PdDDfDVZ15YS9z3Bw3z81zaS7NLXBZ54zpbpFb5DJchlvilrhlbplb4Va4VW6VW+PWuHVundvgNrhNbpPb4ra4bW6b2+F2uJ1up9vl816Y1O11+9w+t9/tdwfcVy7Tfe0Oum/cIfetO+y+c0fc9+6oO+aOux/cCfejO+lOudPujDvrfnLn3M/uvPMuJTIhMjHydmRS5J3I5Mi7kSmRqZHUyLTI9Mh7kRmRmZFZkfcjsyMfROZE5kbmReZH0iIfRhZEFkbSIx9FFkU+jmREFkeWRJZGlkWWR7wvvCX0RX0xH/XX++L+Bl/Cl/SlfGnvfBmf4G/0Zf1Nvpy/2Zf3t/gK/lZf0Vfylf0jvplv7lv4lr6Vf9S39o/5Nr6tb+cf9+39E76Df9In+qd8R/+07+T/5jv7Z3wX/6zv6p/z3Xx338M/73v6F3wv39sn+T6+r3/R9/P9/QD/kh/oX/aD/Ct+sH/VJ/shfqh/zQ/zr/vh/g0/wo/0o2Le9KMvXSLDeJ/iJ/iJ/m0/yb/jJ/t3/RQ/1af6aX66f8/P8DP9LP++n+0/8HP8XD/Pz/dp/kO/wC/06f4jv8h/7DP84ks3lf0Kv9Kv8qv9Gr/Wr/Pr/Qa/0W/ym/0Wv9Vv89v9Dv+J3+k/9bv8br/Hf+b3+s/9Pv+F3++/9Af8Vz7Tf+0P+m/8If+tP+y/80f89/6oP+aP+x/8Cf+jP+lP+dP+jD/rf/Ln/M/+PP/OGmOMMcbYHzLh8lD8es2F2/l9fidH/N3GfQHg6q2FMv9+fdYZ5br8F8b9RXz7CAA81bvrg5eWGjWSkpIubpshISg2F+DS/wRliYHL8WJoB09AIrSFsr9bf3/R/Sz9i/mjtwDk+rucWLgcX57/CwBM+p35H3181IIK4em4/8/8cwFKFLuckxMux4uh3S/3V9pCuX9Sf4HW/6L+nF+mALT5u5zccDm+XH8CPAZPQ+KvtmSMMcYYY4wxxi7oLyp3vnT9eeknPn/v+jxeXc7JAZfjf3V9zhhjjDHGGGOMsSvvme49nnw0MbFt539/UO1/lPWHB03hf2tmHvzuwHuAS48oAPgPJwTIGsi/8ig2/yX7Sr741vnHVcvO+AD+O1r5Zwyu8AcTY4wxxhhj7E93+aT/14+rK1UQY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDGWDf0Vf07sSh8jY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxdqX9vwAAAP//kfb+pw==") mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) 3m34.946251821s ago: executing program 3 (id=6487): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001900)=@newtaction={0x7c, 0x30, 0x1, 0x0, 0x0, {}, [{0x68, 0x1, [@m_mpls={0x64, 0x1, 0x0, 0x0, {{0x9}, {0x38, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x8, 0x2, 0xffffffffffffffff, 0x9, 0x2}, 0x3}}, @TCA_MPLS_BOS={0x5, 0x8, 0x1}, @TCA_MPLS_TC={0x5, 0x6, 0x1}, @TCA_MPLS_TTL={0x5, 0x7, 0x3e}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x7c}}, 0x0) 3m34.35788954s ago: executing program 3 (id=6494): r0 = openat$sequencer2(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000040)=@e={0xff, 0x3, 0xfd, 0x4, @SEQ_NOTEON=@note=0x25, 0x2c, 0x1, 0x7f}) 3m33.651240202s ago: executing program 32 (id=6494): r0 = openat$sequencer2(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000040)=@e={0xff, 0x3, 0xfd, 0x4, @SEQ_NOTEON=@note=0x25, 0x2c, 0x1, 0x7f}) 2.395360774s ago: executing program 0 (id=9320): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newtaction={0xf0, 0x30, 0x1, 0x2, 0x25dfdbfc, {}, [{0xdc, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0x7, 0x2, 0x4, 0x8000446, {}, {0x7, 0x0, 0x0, 0x0, 0x3}, 0xfffffffd}}]]}, {0x4}, {0xc}, {0xc}}}, @m_police={0x6c, 0x2, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0x10000005, 0x401, 0x1, 0x0, {0x0, 0x0, 0x0, 0x405}}}]]}, {0xfffffffffffffdaf}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0xf0}, 0x1, 0x0, 0x0, 0x8010}, 0x44830) 2.18190278s ago: executing program 0 (id=9322): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, 0x0}, 0x94) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100002d3d6a08c6050592ac29000000010902240003000000000904060000ff4f9b000904b000003a3846000904"], 0x0) 2.076352174s ago: executing program 2 (id=9324): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)={0x20, 0x18, 0x229, 0x0, 0x0, {0x2}, [@typed={0x4, 0x800}, @nested={0x7, 0x9, 0x0, 0x1, [@generic="a1fcd7"]}]}, 0x20}}, 0x0) 1.89417006s ago: executing program 2 (id=9325): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x25, &(0x7f0000000240)={@multicast1, @broadcast, @loopback}, 0xc) 1.798216643s ago: executing program 2 (id=9328): r0 = io_uring_setup(0x4c22, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x0, 0x359}) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x19, &(0x7f0000000300), 0x0) 1.760309714s ago: executing program 1 (id=9329): r0 = fsopen(&(0x7f0000000000)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000080)='source', &(0x7f0000000400)='//\xf2/\x06\b\xa30\\\xea\x00\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas\x9d\x14\xe3\v\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7Gl\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\n\x8c= next_index [ 724.309252][ T1319] find_entry called with index >= next_index [ 724.315318][ T1319] find_entry called with index >= next_index [ 724.617822][ T28] audit: type=1400 audit(2000000147.850:590): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=26260A3AF6EFF374925873ECE44CF3460B0BA260624F2A08BDBB6D3C92592016EA4E0F401876B1958B3F9AA5153386EED838C49D3A pid=1373 comm="syz.4.9148" [ 724.730697][ T1377] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 724.750129][ T1377] overlayfs: missing 'lowerdir' [ 725.068397][ T1388] loop1: detected capacity change from 0 to 2048 [ 725.155289][ T1388] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 725.780975][ T1432] netlink: 76 bytes leftover after parsing attributes in process `syz.0.9165'. [ 726.227195][ T1457] loop1: detected capacity change from 0 to 256 [ 726.271108][ T1457] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xf3da6b1f, utbl_chksum : 0xe619d30d) [ 726.298615][ T1461] netlink: 'syz.0.9177': attribute type 21 has an invalid length. [ 726.326007][ T1461] IPv6: NLM_F_CREATE should be specified when creating new route [ 726.866796][ T1453] loop2: detected capacity change from 0 to 32768 [ 726.923199][ T1453] ea_get: invalid extended attribute [ 726.944046][ T1453] ffff88805a05d670: 04 00 00 00 .... [ 727.045098][ T1460] loop4: detected capacity change from 0 to 32768 [ 727.121808][ T1460] XFS (loop4): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 727.228446][ T8] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 727.409777][ T1460] XFS (loop4): Ending clean mount [ 727.438229][ T8] usb 1-1: Using ep0 maxpacket: 32 [ 727.469765][ T8] usb 1-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 727.497932][ T8] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 727.515034][T23448] XFS (loop4): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 727.564783][ T8] usb 1-1: config 0 descriptor?? [ 727.608694][ T8] as10x_usb: device has been detected [ 727.622216][ T8] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 727.728914][ T8] usb 1-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 727.853699][ T8] as10x_usb: error during firmware upload part1 [ 727.871070][ T8] Registered device nBox DVB-T Dongle [ 727.886403][ T8] usb 1-1: USB disconnect, device number 57 [ 727.928033][ T5886] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 728.029917][ T8] Unregistered device nBox DVB-T Dongle [ 728.074216][ T8] as10x_usb: device has been disconnected [ 728.128990][ T5886] usb 2-1: Using ep0 maxpacket: 8 [ 728.141005][ T5886] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 728.155589][ T1559] loop2: detected capacity change from 0 to 1764 [ 728.168673][ T5886] usb 2-1: New USB device found, idVendor=05e1, idProduct=0893, bcdDevice=fd.5b [ 728.193717][ T5886] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.204259][ T1559] iso9660: Corrupted directory entry in block 2 of inode 1920 [ 728.209362][ T5886] usb 2-1: Product: syz [ 728.226680][ T5886] usb 2-1: Manufacturer: syz [ 728.233667][ T5886] usb 2-1: SerialNumber: syz [ 728.259824][ T5886] usb 2-1: config 0 descriptor?? [ 728.272929][ T5886] gspca_main: stk014-2.14.0 probing 05e1:0893 [ 728.297978][ T5886] usb 2-1: selecting invalid altsetting 1 [ 728.409550][ T1569] loop2: detected capacity change from 0 to 256 [ 728.457077][ T1569] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x25fbf2c1, utbl_chksum : 0xe619d30d) [ 728.737410][ T5886] usb 2-1: USB disconnect, device number 52 [ 728.772975][ T1586] loop4: detected capacity change from 0 to 4096 [ 728.825756][ T1586] ntfs: (device loop4): ntfs_read_locked_inode(): $DATA attribute is missing. [ 728.856245][ T1586] ntfs: (device loop4): ntfs_read_locked_inode(): Failed with error code -2. Marking corrupt inode 0xa as bad. Run chkdsk. [ 728.882527][ T1586] ntfs: (device loop4): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 728.911619][ T1586] ntfs: volume version 3.1. [ 729.102414][T23448] ntfs: (device loop4): ntfs_put_super(): Volume has errors. Leaving volume marked dirty. Run chkdsk. [ 729.345597][ T1618] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9205'. [ 729.388370][ T1618] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9205'. [ 729.779689][ T1645] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9213'. [ 729.808219][ T1645] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9213'. [ 730.190893][ T1668] openvswitch: netlink: Actions may not be safe on all matching packets [ 730.511072][ T1675] loop2: detected capacity change from 0 to 4096 [ 730.548364][ T1675] ntfs3: loop2: Different NTFS sector size (4096) and media sector size (512). [ 730.627098][ T1689] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9229'. [ 730.737100][ T1675] ntfs3: loop2: failed to convert "c46c" to iso8859-2 [ 730.987337][ T1701] loop2: detected capacity change from 0 to 2048 [ 731.015240][ T1701] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 731.453934][ T1719] netlink: 20 bytes leftover after parsing attributes in process `syz.2.9239'. [ 731.528478][ T1722] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9240'. [ 731.569122][ T1722] netlink: 56 bytes leftover after parsing attributes in process `syz.4.9240'. [ 731.765943][ T1697] loop1: detected capacity change from 0 to 32768 [ 732.037874][ T786] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 732.227820][ T786] usb 3-1: Using ep0 maxpacket: 16 [ 732.250114][ T786] usb 3-1: config 0 has no interfaces? [ 732.259263][ T786] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 732.273167][ T1760] CIFS mount error: No usable UNC path provided in device string! [ 732.273167][ T1760] [ 732.287829][ T786] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 732.312399][ T786] usb 3-1: Product: syz [ 732.316745][ T786] usb 3-1: Manufacturer: syz [ 732.326863][ T1760] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 732.338053][ T786] usb 3-1: SerialNumber: syz [ 732.359249][ T786] r8152-cfgselector 3-1: config 0 descriptor?? [ 732.527143][ T1769] x_tables: unsorted underflow at hook 2 [ 732.578621][ T786] usbip-host 3-1: 3-1 is not in match_busid table... skip! [ 732.621740][T19686] usb 3-1: config 0 descriptor?? [ 732.708510][ T1781] nvme_fabrics: missing parameter 'transport=%s' [ 732.716118][ T1781] nvme_fabrics: missing parameter 'nqn=%s' [ 732.791559][T19686] usb 3-1: can't set config #0, error -71 [ 732.798162][ T786] usb 3-1: USB disconnect, device number 57 [ 732.808356][ T5886] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 732.995413][ T1801] openvswitch: netlink: Key type 81 is out of range max 32 [ 733.010384][ T5886] usb 2-1: config 0 has an invalid interface number: 83 but max is 0 [ 733.028834][ T5886] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 733.048572][ T5886] usb 2-1: config 0 has no interface number 0 [ 733.058491][ T5886] usb 2-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=39.61 [ 733.075814][ T5886] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 733.101960][ T1804] loop4: detected capacity change from 0 to 256 [ 733.109004][ T5886] usb 2-1: config 0 descriptor?? [ 733.123876][ T5886] ttusbir 2-1:0.83: cannot find expected altsetting [ 733.169495][ T1804] FAT-fs (loop4): Directory bread(block 64) failed [ 733.176436][ T1804] FAT-fs (loop4): Directory bread(block 65) failed [ 733.189775][ T1804] FAT-fs (loop4): Directory bread(block 66) failed [ 733.196441][ T1804] FAT-fs (loop4): Directory bread(block 67) failed [ 733.203818][ T1804] FAT-fs (loop4): Directory bread(block 68) failed [ 733.210924][ T1804] FAT-fs (loop4): Directory bread(block 69) failed [ 733.226512][ T1804] FAT-fs (loop4): Directory bread(block 70) failed [ 733.236781][ T1804] FAT-fs (loop4): Directory bread(block 71) failed [ 733.253930][ T1804] FAT-fs (loop4): Directory bread(block 72) failed [ 733.263978][ T1804] FAT-fs (loop4): Directory bread(block 73) failed [ 733.328575][ T786] usb 2-1: USB disconnect, device number 53 [ 733.527147][ T1832] netlink: 'syz.2.9271': attribute type 1 has an invalid length. [ 733.716442][ T1845] libceph: resolve '0.' (ret=-3): failed [ 733.718754][ T5886] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 733.878028][ T5762] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 733.917910][ T5886] usb 1-1: Using ep0 maxpacket: 8 [ 733.931052][ T5886] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 733.971935][ T5886] usb 1-1: New USB device found, idVendor=05e1, idProduct=0893, bcdDevice=fd.5b [ 734.001824][ T5886] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 734.015144][ T5886] usb 1-1: Product: syz [ 734.027842][ T5886] usb 1-1: Manufacturer: syz [ 734.038064][ T5886] usb 1-1: SerialNumber: syz [ 734.049760][ T5886] usb 1-1: config 0 descriptor?? [ 734.071277][ T5886] gspca_main: stk014-2.14.0 probing 05e1:0893 [ 734.084005][ T5762] usb 5-1: Using ep0 maxpacket: 8 [ 734.091036][ T5886] usb 1-1: selecting invalid altsetting 1 [ 734.101470][ T5762] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 734.131377][ T5762] usb 5-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 734.148172][ T5762] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 734.166504][ T5762] usb 5-1: Product: syz [ 734.181347][ T5762] usb 5-1: Manufacturer: syz [ 734.186016][ T5762] usb 5-1: SerialNumber: syz [ 734.232294][ T5762] usb 5-1: config 0 descriptor?? [ 734.245999][ T5762] streamzap 5-1:0.0: streamzap_probe: endpoint doesn't match input device 0203 [ 734.472351][ T5886] usb 5-1: USB disconnect, device number 20 [ 734.523801][ T786] usb 1-1: USB disconnect, device number 58 [ 734.847149][ T28] audit: type=1326 audit(2000000158.080:591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1908 comm="syz.1.9285" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e0a59ce59 code=0x7ffc0000 [ 734.871173][ C0] vkms_vblank_simulate: vblank timer overrun [ 734.881725][ T28] audit: type=1326 audit(2000000158.080:592): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1908 comm="syz.1.9285" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e0a59ce59 code=0x7ffc0000 [ 734.926908][ T28] audit: type=1326 audit(2000000158.080:593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1908 comm="syz.1.9285" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e0a59ce59 code=0x7ffc0000 [ 734.986319][ T28] audit: type=1326 audit(2000000158.080:594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1908 comm="syz.1.9285" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=35 compat=0 ip=0x7f7e0a59ce59 code=0x7ffc0000 [ 735.037802][ T28] audit: type=1326 audit(2000000158.080:595): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1908 comm="syz.1.9285" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e0a59ce59 code=0x7ffc0000 [ 735.104344][ T28] audit: type=1326 audit(2000000158.140:596): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1908 comm="syz.1.9285" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f7e0a55d68e code=0x7ffc0000 [ 735.197037][ T28] audit: type=1326 audit(2000000158.140:597): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1908 comm="syz.1.9285" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e0a59ce59 code=0x7ffc0000 [ 735.221113][ C0] vkms_vblank_simulate: vblank timer overrun [ 735.247625][ T28] audit: type=1326 audit(2000000158.140:598): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1908 comm="syz.1.9285" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e0a59ce59 code=0x7ffc0000 [ 735.271683][ C0] vkms_vblank_simulate: vblank timer overrun [ 735.327627][ T28] audit: type=1326 audit(2000000158.150:599): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1908 comm="syz.1.9285" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f7e0a59ce59 code=0x7ffc0000 [ 735.351720][ C0] vkms_vblank_simulate: vblank timer overrun [ 735.366077][ T1923] netlink: 'syz.2.9289': attribute type 10 has an invalid length. [ 735.394959][ T28] audit: type=1326 audit(2000000158.150:600): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1908 comm="syz.1.9285" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f7e0a59ce59 code=0x7ffc0000 [ 735.419001][ C0] vkms_vblank_simulate: vblank timer overrun [ 735.427673][ T1923] veth1_vlan: left promiscuous mode [ 735.463473][ T1923] macvlan0: entered allmulticast mode [ 735.487741][ T1923] veth1_vlan: entered promiscuous mode [ 735.516704][ T1923] veth1_vlan: entered allmulticast mode [ 735.538671][ T1923] team0: Port device macvlan0 added [ 735.861579][ T1946] netlink: 104 bytes leftover after parsing attributes in process `syz.2.9298'. [ 735.891228][ T1948] No such timeout policy "syz0" [ 735.940768][ T1952] syz.0.9300: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz0,mems_allowed=0-1 [ 736.007986][ T1952] CPU: 1 PID: 1952 Comm: syz.0.9300 Not tainted syzkaller #0 [ 736.015431][ T1952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 736.025530][ T1952] Call Trace: [ 736.028909][ T1952] [ 736.031929][ T1952] dump_stack_lvl+0x18c/0x250 [ 736.036797][ T1952] ? show_regs_print_info+0x20/0x20 [ 736.042078][ T1952] ? load_image+0x420/0x420 [ 736.046673][ T1952] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 736.053150][ T1952] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 736.059690][ T1952] warn_alloc+0x246/0x340 [ 736.064096][ T1952] ? stack_trace_save+0xaa/0x100 [ 736.069088][ T1952] ? zone_watermark_ok_safe+0x230/0x230 [ 736.074683][ T1952] ? kasan_set_track+0x5f/0x70 [ 736.079492][ T1952] ? kasan_set_track+0x4e/0x70 [ 736.084278][ T1952] ? __kasan_kmalloc+0x8f/0xa0 [ 736.089066][ T1952] ? xsk_init_queue+0xad/0x100 [ 736.093929][ T1952] ? xsk_setsockopt+0x42e/0x760 [ 736.098797][ T1952] ? do_sock_setsockopt+0x175/0x1a0 [ 736.104071][ T1952] ? __x64_sys_setsockopt+0x182/0x200 [ 736.109467][ T1952] __vmalloc_node_range+0x126/0x1330 [ 736.114801][ T1952] ? free_vm_area+0x50/0x50 [ 736.119345][ T1952] vmalloc_user+0x74/0x80 [ 736.123703][ T1952] ? xskq_create+0xbf/0x170 [ 736.128238][ T1952] xskq_create+0xbf/0x170 [ 736.132630][ T1952] xsk_init_queue+0xad/0x100 [ 736.137253][ T1952] xsk_setsockopt+0x42e/0x760 [ 736.141993][ T1952] ? xsk_poll+0x680/0x680 [ 736.146356][ T1952] ? __fget_files+0x28/0x4b0 [ 736.150991][ T1952] ? __fget_files+0x28/0x4b0 [ 736.155622][ T1952] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 736.161223][ T1952] ? security_socket_setsockopt+0x7e/0xa0 [ 736.166987][ T1952] ? xsk_poll+0x680/0x680 [ 736.171510][ T1952] do_sock_setsockopt+0x175/0x1a0 [ 736.176565][ T1952] ? __fdget+0x180/0x210 [ 736.180836][ T1952] __x64_sys_setsockopt+0x182/0x200 [ 736.186063][ T1952] do_syscall_64+0x55/0xa0 [ 736.190558][ T1952] ? clear_bhb_loop+0x40/0x90 [ 736.195314][ T1952] ? clear_bhb_loop+0x40/0x90 [ 736.200021][ T1952] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 736.205985][ T1952] RIP: 0033:0x7f6188f9ce59 [ 736.210483][ T1952] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 736.230150][ T1952] RSP: 002b:00007f6189f33028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 736.238590][ T1952] RAX: ffffffffffffffda RBX: 00007f6189215fa0 RCX: 00007f6188f9ce59 [ 736.246583][ T1952] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 736.254565][ T1952] RBP: 00007f6189032d6f R08: 0000000000000004 R09: 0000000000000000 [ 736.262557][ T1952] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 736.270546][ T1952] R13: 00007f6189216038 R14: 00007f6189215fa0 R15: 00007ffc3e9f9b08 [ 736.278564][ T1952] [ 736.298358][ T1952] Mem-Info: [ 736.304983][ T1952] active_anon:6717 inactive_anon:0 isolated_anon:0 [ 736.304983][ T1952] active_file:12147 inactive_file:4881 isolated_file:0 [ 736.304983][ T1952] unevictable:768 dirty:504 writeback:0 [ 736.304983][ T1952] slab_reclaimable:11133 slab_unreclaimable:98904 [ 736.304983][ T1952] mapped:25183 shmem:1378 pagetables:719 [ 736.304983][ T1952] sec_pagetables:0 bounce:0 [ 736.304983][ T1952] kernel_misc_reclaimable:0 [ 736.304983][ T1952] free:1371165 free_pcp:13691 free_cma:0 [ 736.350210][ C0] vkms_vblank_simulate: vblank timer overrun [ 736.373613][ T1952] Node 0 active_anon:26968kB inactive_anon:0kB active_file:48588kB inactive_file:19184kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:100732kB dirty:2016kB writeback:0kB shmem:3976kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11524kB pagetables:2876kB sec_pagetables:0kB all_unreclaimable? no [ 736.386154][ T1959] bridge8: entered allmulticast mode [ 736.406156][ C0] vkms_vblank_simulate: vblank timer overrun [ 736.456631][ T1952] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:340kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 736.489597][ T1952] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 736.534503][ T1952] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 736.544652][ T1952] Node 0 DMA32 free:1586228kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:26872kB inactive_anon:0kB active_file:48532kB inactive_file:18484kB unevictable:1536kB writepending:2016kB present:3129332kB managed:2586952kB mlocked:0kB bounce:0kB free_pcp:26688kB local_pcp:7244kB free_cma:0kB [ 736.647851][ T1952] lowmem_reserve[]: 0 0 0 0 0 [ 736.652666][ T1952] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:96kB inactive_anon:0kB active_file:56kB inactive_file:700kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:20kB local_pcp:12kB free_cma:0kB [ 736.753221][ T1952] lowmem_reserve[]: 0 0 0 0 0 [ 736.785701][ T1952] Node 1 Normal free:3883072kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:340kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:28032kB local_pcp:14432kB free_cma:0kB [ 736.826506][ T1979] loop2: detected capacity change from 0 to 512 [ 736.838924][ T1979] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 736.897960][ T1979] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #16: comm syz.2.9307: invalid indirect mapped block 32768 (level 2) [ 736.924593][ T1952] lowmem_reserve[]: 0 0 0 0 0 [ 736.929491][ T1979] EXT4-fs (loop2): Remounting filesystem read-only [ 736.936506][ T1952] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 736.951822][ T1979] EXT4-fs (loop2): 1 orphan inode deleted [ 736.957592][ T1979] EXT4-fs (loop2): 1 truncate cleaned up [ 736.963796][ T1952] Node 0 DMA32: 713*4kB (UM) 960*8kB (UM) 333*16kB (UME) 194*32kB (UME) 102*64kB (UME) 55*128kB (UME) 37*256kB (UME) 22*512kB (UME) 18*1024kB (UME) 10*2048kB (UME) 364*4096kB (M) = 1586228kB [ 736.982816][ C0] vkms_vblank_simulate: vblank timer overrun [ 736.990189][ T786] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 736.997851][ T1952] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 737.019638][ T1979] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 737.030308][ T1952] Node 1 Normal: 216*4kB (UM) 68*8kB (UME) 42*16kB (UME) 105*32kB (UME) 40*64kB (UME) 8*128kB (UME) 1*256kB (M) 2*512kB (UM) 2*1024kB (ME) 2*2048kB (ME) 944*4096kB (M) = 3883072kB [ 737.081117][ T1952] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 737.091499][ T1952] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 737.114410][ T1952] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 737.124524][ T1952] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 737.134401][ T1952] 17764 total pagecache pages [ 737.139329][ T1952] 0 pages in swap cache [ 737.143529][ T1952] Free swap = 124216kB [ 737.147781][ T1952] Total swap = 124996kB [ 737.152142][ T1952] 2097051 pages RAM [ 737.155999][ T1952] 0 pages HighMem/MovableOnly [ 737.160818][ T1952] 416927 pages reserved [ 737.165177][ T1952] 0 pages cma reserved [ 737.184951][ T786] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 737.207914][ T786] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 737.222362][ T786] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 737.241561][ T786] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 737.254651][ T786] usb 5-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 737.268403][ T5775] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 737.317358][ T786] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 737.343509][ T786] usb 5-1: Product: syz [ 737.358383][ T786] usb 5-1: Manufacturer: syz [ 737.363406][ T786] usb 5-1: SerialNumber: syz [ 737.385659][ T786] usb 5-1: config 0 descriptor?? [ 737.415005][ T1999] loop1: detected capacity change from 0 to 164 [ 737.420148][ T786] ums-isd200 5-1:0.0: USB Mass Storage device detected [ 737.432295][ T2000] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9312'. [ 737.536904][ T1998] can0: slcan on ttyS3. [ 737.735869][ T786] ums-isd200: probe of 5-1:0.0 failed with error -22 [ 737.860591][ T1995] can0 (unregistered): slcan off ttyS3. [ 737.974456][ T5762] usb 5-1: USB disconnect, device number 21 [ 738.068827][ T2046] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9320'. [ 738.365826][ T2063] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9324'. [ 738.507955][ T5886] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 738.718136][ T5886] usb 1-1: Using ep0 maxpacket: 8 [ 738.729372][ T5886] usb 1-1: config 0 has an invalid interface number: 6 but max is 2 [ 738.768740][ T5886] usb 1-1: config 0 has an invalid interface number: 176 but max is 2 [ 738.815596][ T5886] usb 1-1: config 0 has no interface number 1 [ 738.827867][ T5886] usb 1-1: config 0 has no interface number 2 [ 738.850827][ T5886] usb 1-1: too many endpoints for config 0 interface 0 altsetting 255: 255, using maximum allowed: 30 [ 738.887994][ T5886] usb 1-1: config 0 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 738.926799][ T5886] usb 1-1: config 0 interface 0 has no altsetting 0 [ 738.948235][ T5886] usb 1-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 738.990053][ T5886] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 739.036930][ T5886] usb 1-1: config 0 descriptor?? [ 739.276512][ T5886] usb 1-1: Could not set interface, error -71 [ 739.303856][ T5886] qmi_wwan: probe of 1-1:0.0 failed with error -22 [ 739.345081][ T5886] usb 1-1: USB disconnect, device number 59 [ 739.504333][ T786] usb 3-1: new full-speed USB device number 58 using dummy_hcd [ 739.709959][ T786] usb 3-1: New USB device found, idVendor=055f, idProduct=c420, bcdDevice=6a.33 [ 739.724736][ T786] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 739.745878][ T786] usb 3-1: config 0 descriptor?? [ 739.766599][ T786] gspca_main: sunplus-2.14.0 probing 055f:c420 [ 740.175267][ T786] gspca_sunplus: reg_w_riv err -71 [ 740.190847][ T786] sunplus: probe of 3-1:0.0 failed with error -71 [ 740.221404][ T786] usb 3-1: USB disconnect, device number 58 [ 740.335940][ T2179] loop4: detected capacity change from 0 to 4096 [ 740.436257][ T2185] can0: slcan on ttyS3. [ 740.467465][ T2179] [ 740.469845][ T2179] ====================================================== [ 740.476890][ T2179] WARNING: possible circular locking dependency detected [ 740.483953][ T2179] syzkaller #0 Not tainted [ 740.488398][ T2179] ------------------------------------------------------ [ 740.495439][ T2179] syz.4.9347/2179 is trying to acquire lock: [ 740.501442][ T2179] ffff88802968a270 (&wnd->rw_lock){++++}-{3:3}, at: mark_as_free_ex+0x3e/0x380 [ 740.510515][ T2179] [ 740.510515][ T2179] but task is already holding lock: [ 740.517904][ T2179] ffff88805a01da30 (&ni->file.run_lock#2){++++}-{3:3}, at: ntfs3_setattr+0x512/0xb80 [ 740.527441][ T2179] [ 740.527441][ T2179] which lock already depends on the new lock. [ 740.527441][ T2179] [ 740.537879][ T2179] [ 740.537879][ T2179] the existing dependency chain (in reverse order) is: [ 740.546924][ T2179] [ 740.546924][ T2179] -> #1 (&ni->file.run_lock#2){++++}-{3:3}: [ 740.555057][ T2179] down_read+0x46/0x2e0 [ 740.559860][ T2179] run_unpack_ex+0x7fb/0xb80 [ 740.565014][ T2179] ntfs_iget5+0x2475/0x38a0 [ 740.570074][ T2179] dir_search_u+0x1fe/0x2e0 [ 740.575118][ T2179] ntfs_atomic_open+0x23b/0x520 [ 740.580506][ T2179] path_openat+0xf49/0x3230 [ 740.585543][ T2179] do_filp_open+0x1f5/0x430 [ 740.590596][ T2179] do_sys_openat2+0x134/0x1d0 [ 740.595828][ T2179] __x64_sys_openat+0x139/0x160 [ 740.601217][ T2179] do_syscall_64+0x55/0xa0 [ 740.606174][ T2179] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 740.612612][ T2179] [ 740.612612][ T2179] -> #0 (&wnd->rw_lock){++++}-{3:3}: [ 740.620107][ T2179] __lock_acquire+0x2df1/0x7d40 [ 740.625506][ T2179] lock_acquire+0x19e/0x420 [ 740.630551][ T2179] down_write_nested+0x9e/0x200 [ 740.635929][ T2179] mark_as_free_ex+0x3e/0x380 [ 740.641152][ T2179] run_deallocate_ex+0x19b/0x310 [ 740.646623][ T2179] attr_set_size+0xf27/0x2d70 [ 740.651847][ T2179] ntfs3_setattr+0x5d4/0xb80 [ 740.656967][ T2179] notify_change+0xb0d/0xe10 [ 740.662103][ T2179] do_truncate+0x1b0/0x240 [ 740.667057][ T2179] path_openat+0x2a32/0x3230 [ 740.672185][ T2179] do_filp_open+0x1f5/0x430 [ 740.677250][ T2179] do_sys_openat2+0x134/0x1d0 [ 740.682464][ T2179] __x64_sys_open+0x11f/0x140 [ 740.687700][ T2179] do_syscall_64+0x55/0xa0 [ 740.692657][ T2179] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 740.699089][ T2179] [ 740.699089][ T2179] other info that might help us debug this: [ 740.699089][ T2179] [ 740.709326][ T2179] Possible unsafe locking scenario: [ 740.709326][ T2179] [ 740.716789][ T2179] CPU0 CPU1 [ 740.722172][ T2179] ---- ---- [ 740.727544][ T2179] lock(&ni->file.run_lock#2); [ 740.732415][ T2179] lock(&wnd->rw_lock); [ 740.739198][ T2179] lock(&ni->file.run_lock#2); [ 740.746577][ T2179] lock(&wnd->rw_lock); [ 740.750849][ T2179] [ 740.750849][ T2179] *** DEADLOCK *** [ 740.750849][ T2179] [ 740.759007][ T2179] 4 locks held by syz.4.9347/2179: [ 740.764127][ T2179] #0: ffff88805b58c418 (sb_writers#18){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 740.773388][ T2179] #1: ffff88805a01dc30 (&sb->s_type->i_mutex_key#31){+.+.}-{3:3}, at: do_truncate+0x19c/0x240 [ 740.783766][ T2179] #2: ffff88805a01d980 (&ni->ni_lock#2/5){+.+.}-{3:3}, at: ntfs3_setattr+0x4fe/0xb80 [ 740.793468][ T2179] #3: ffff88805a01da30 (&ni->file.run_lock#2){++++}-{3:3}, at: ntfs3_setattr+0x512/0xb80 [ 740.803408][ T2179] [ 740.803408][ T2179] stack backtrace: [ 740.809300][ T2179] CPU: 0 PID: 2179 Comm: syz.4.9347 Not tainted syzkaller #0 [ 740.816688][ T2179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 740.826749][ T2179] Call Trace: [ 740.830041][ T2179] [ 740.832987][ T2179] dump_stack_lvl+0x18c/0x250 [ 740.837711][ T2179] ? load_image+0x420/0x420 [ 740.842253][ T2179] ? show_regs_print_info+0x20/0x20 [ 740.847500][ T2179] ? print_circular_bug+0x12b/0x1a0 [ 740.852722][ T2179] check_noncircular+0x2fc/0x400 [ 740.857680][ T2179] ? print_deadlock_bug+0x5d0/0x5d0 [ 740.862904][ T2179] ? lockdep_lock+0xf5/0x230 [ 740.867511][ T2179] ? _find_first_zero_bit+0xd3/0x100 [ 740.872846][ T2179] __lock_acquire+0x2df1/0x7d40 [ 740.877751][ T2179] ? lock_release+0xb5/0x8c0 [ 740.882363][ T2179] ? verify_lock_unused+0x140/0x140 [ 740.887580][ T2179] ? __lock_acquire+0x7d40/0x7d40 [ 740.892640][ T2179] ? __read_once_word_nocheck+0x9/0x10 [ 740.898122][ T2179] ? deref_stack_reg+0x1bd/0x240 [ 740.903081][ T2179] lock_acquire+0x19e/0x420 [ 740.907606][ T2179] ? mark_as_free_ex+0x3e/0x380 [ 740.912483][ T2179] ? stack_trace_save+0x100/0x100 [ 740.917536][ T2179] ? __might_sleep+0xe0/0xe0 [ 740.922161][ T2179] ? read_lock_is_recursive+0x20/0x20 [ 740.927551][ T2179] ? stack_trace_save+0xaa/0x100 [ 740.932506][ T2179] ? stack_trace_snprint+0xf0/0xf0 [ 740.937638][ T2179] ? check_noncircular+0x18a/0x400 [ 740.942774][ T2179] down_write_nested+0x9e/0x200 [ 740.947638][ T2179] ? mark_as_free_ex+0x3e/0x380 [ 740.952506][ T2179] ? down_read_non_owner+0x310/0x310 [ 740.957811][ T2179] mark_as_free_ex+0x3e/0x380 [ 740.962513][ T2179] run_deallocate_ex+0x19b/0x310 [ 740.967476][ T2179] ? attr_allocate_clusters+0x6b0/0x6b0 [ 740.973043][ T2179] ? run_is_mapped_full+0x334/0x410 [ 740.978268][ T2179] attr_set_size+0xf27/0x2d70 [ 740.982984][ T2179] ? put_page+0x260/0x260 [ 740.987333][ T2179] ? __mutex_lock+0x315/0xcc0 [ 740.992023][ T2179] ? read_lock_is_recursive+0x20/0x20 [ 740.997417][ T2179] ? down_write+0x16e/0x200 [ 741.001933][ T2179] ? down_read_killable+0x340/0x340 [ 741.007158][ T2179] ? block_truncate_page+0x168/0x9f0 [ 741.012466][ T2179] ntfs3_setattr+0x5d4/0xb80 [ 741.017083][ T2179] ? ntfs_getattr+0x2b0/0x2b0 [ 741.021777][ T2179] ? evm_inode_setattr+0x94/0x6a0 [ 741.026855][ T2179] ? bpf_lsm_inode_setattr+0x9/0x10 [ 741.032082][ T2179] ? try_break_deleg+0x79/0x120 [ 741.036958][ T2179] ? ntfs_getattr+0x2b0/0x2b0 [ 741.041685][ T2179] notify_change+0xb0d/0xe10 [ 741.046312][ T2179] do_truncate+0x1b0/0x240 [ 741.050745][ T2179] ? put_page_bootmem+0x2c0/0x2c0 [ 741.055792][ T2179] ? apparmor_file_truncate+0x24a/0x2e0 [ 741.061353][ T2179] ? ima_bprm_check+0x200/0x200 [ 741.066228][ T2179] path_openat+0x2a32/0x3230 [ 741.070871][ T2179] ? do_filp_open+0x430/0x430 [ 741.075562][ T2179] ? __virt_addr_valid+0x18c/0x540 [ 741.080697][ T2179] do_filp_open+0x1f5/0x430 [ 741.085210][ T2179] ? vfs_tmpfile+0x490/0x490 [ 741.089825][ T2179] ? _raw_spin_unlock+0x28/0x40 [ 741.094690][ T2179] ? alloc_fd+0x58f/0x630 [ 741.099059][ T2179] do_sys_openat2+0x134/0x1d0 [ 741.103782][ T2179] ? do_sys_open+0xe0/0xe0 [ 741.108231][ T2179] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 741.114239][ T2179] ? lock_chain_count+0x20/0x20 [ 741.119114][ T2179] __x64_sys_open+0x11f/0x140 [ 741.123825][ T2179] do_syscall_64+0x55/0xa0 [ 741.128268][ T2179] ? clear_bhb_loop+0x40/0x90 [ 741.132965][ T2179] ? clear_bhb_loop+0x40/0x90 [ 741.137668][ T2179] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 741.143579][ T2179] RIP: 0033:0x7f803d79ce59 [ 741.148022][ T2179] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 741.167656][ T2179] RSP: 002b:00007f803e73c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 741.176086][ T2179] RAX: ffffffffffffffda RBX: 00007f803da15fa0 RCX: 00007f803d79ce59 [ 741.184065][ T2179] RDX: 0000000000000100 RSI: 0000000000101240 RDI: 0000200000000140 [ 741.192054][ T2179] RBP: 00007f803d832d6f R08: 0000000000000000 R09: 0000000000000000 [ 741.200047][ T2179] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 741.208035][ T2179] R13: 00007f803da16038 R14: 00007f803da15fa0 R15: 00007ffeb79e1a98 [ 741.216057][ T2179] [ 741.294271][ T2184] can0 (unregistered): slcan off ttyS3. [ 747.291643][ T1289] ieee802154 phy1 wpan1: encryption failed: -22