last executing test programs:

58.990445905s ago: executing program 2 (id=35):
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0)
write$cgroup_freezer_state(r1, &(0x7f0000000040)='FROZEN\x00', 0x7)
mkdirat$cgroup(r0, &(0x7f00000000c0)='syz1\x00', 0x1ff)
readv(r1, &(0x7f0000000100)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1)

58.908268043s ago: executing program 2 (id=36):
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x3, @local, 0x9}, 0x1c)
bind$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0x2, @empty, 0x8}, 0x1c)
listen(r0, 0x204)
r1 = socket$netlink(0x10, 0x3, 0x4)
writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b4560a067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a09000000ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1)

58.908000164s ago: executing program 2 (id=37):
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x18, 0x4, 0x6, 0x10, 0x0, 0x70bd25, 0x25dfdbfc, [@sadb_address={0x3, 0x6, 0x2b, 0x20, 0x0, @in={0x2, 0x4e24, @multicast2}}, @sadb_x_policy={0x8, 0x12, 0x1, 0x0, 0x0, 0x0, 0x400, {0x30, 0x3c, 0x8, 0x4, 0x0, 0x557, 0x0, @in6=@ipv4={'\x00', '\xff\xff', @empty}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @sadb_address={0x3, 0x5, 0xff, 0x0, 0x0, @in={0x2, 0x4e22, @loopback}}]}, 0x80}}, 0x4040010)

58.790670308s ago: executing program 2 (id=38):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x14, r1, 0x7}, 0x14}}, 0x0)

58.790344837s ago: executing program 2 (id=39):
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0])
mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400))
chdir(&(0x7f0000000080)='./file1\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0)
mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2145c99, 0x0)
r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0)
ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0)

58.70702981s ago: executing program 2 (id=40):
r0 = openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000140)={{0x0, 0x1}, {0xf}})

43.481024569s ago: executing program 32 (id=40):
r0 = openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000140)={{0x0, 0x1}, {0xf}})

820.587842ms ago: executing program 1 (id=615):
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@bridge_getneigh={0x20, 0x1e, 0x300, 0x70bd2f, 0x25dfdbfd, {0x7, 0x0, 0x0, 0x0, 0x1000, 0x95c8}}, 0x20}, 0x1, 0x0, 0x0, 0x5}, 0x0)
r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x20c8a1, 0x1c800, 0x8, 0xc1})
io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0)

739.00424ms ago: executing program 1 (id=616):
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
write$UHID_INPUT(r1, &(0x7f00000011c0)={0x7, {"a2e3ad21ed0d52f91b5d330987f70e06d038e7ff7fc6e5539b0d47078b089b3907356d090890e0878f0e1ac6e7049b334a959b669a240d5d67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d07670936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70fe98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf1a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e470dea05918b41243513f000800000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3e3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14d9fdb8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a19000000000000006f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69b15c9f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d44400009a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc01008cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c16c02ed4b5d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaab1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106d26658b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6b14effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c110000a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b51028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6815d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3f3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a25d507dc59c51090840517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4e004a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6ce1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c817e9177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d543902113c4c859465c3c115c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc248850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafcc009fc074bb6b68a1f0c4649820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948998cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2fd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5dc4ff8f0104000000000000df72279fdb0d2b9e936e5a983c12fded79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d3700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa6e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9f07b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e3ebb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3fec86822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4cddd5d0fc5a752f9000", 0x723}}, 0x1006)

738.781289ms ago: executing program 1 (id=617):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0)
getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14)
sendmsg$nl_route(r1, 0x0, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x24, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xfff1}, {0xfff1, 0xffff}, {0xfff3}}}, 0x24}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@delchain={0x24, 0x29, 0x7d1cdc3e828018e9, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x2}, {0x0, 0xffff}}}, 0x24}}, 0x0)

649.957077ms ago: executing program 1 (id=618):
r0 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000940)=ANY=[@ANYBLOB="8800000020000100ffffffff00000000811420000000000712000000080006000080000014000200ff010000000000000000000000000001140002060000000000000000000000000000000114000200fe8000000000000000000000000000bb14000200fe880000000000000000000000000101140001"], 0x88}, 0x1, 0x0, 0x0, 0x20000811}, 0x0)

603.638523ms ago: executing program 1 (id=621):
timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=<r0=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
ioperm(0x1, 0xb, 0x7)

489.33188ms ago: executing program 1 (id=625):
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="12010000000000106a0531030000000000010902240001000080000904000201031d010009210000000122f80409058103"], 0x0)
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0xb10700, &(0x7f0000000840), 0x5, 0x47b, &(0x7f0000000200)="$eJzs28tvG8UfAPDvbh7t79dHQimPlgKBChHxSJq0QA9cQCBxKAIJDuUYEreK6jaoCRKtKhoQKhckVAkuXBBHJP4CblwQcELiWu6oUgW9tHAKWu9u6rh2XnXtUn8+0tozu2vPfL073tkZO4CeNZI9JBHbI+JSRAzl2ZU7jORP16+em/776rnpJJaW3vozqe137eq56XLXtHjeVrznaBqRfpIUhSwbyB7mz5w9MVWtVk4XK8cXTr43Pn/m7LOzJ6eOV45XTk0ePnzo4MQLz08+15Y4s7iu7f1wbt+e1965+Pr00Yvv/vxdVv/txfb6ONplJAv8r6Waxm1PtLuwLttRl076u1gRNqQvIvqLRnkphqIvbhy8oXj14zw13L0KArdNdm3a0nrz4hJwF0ui2zUAuqO80Gf3v+XSoa7HHeHKS/kNUBb39WLJt/Qvj2cMNNzfttNIRBxd/OfrbInbNA4BAFDvs+kvj8Qzzfp/adxft9/OYg5lOCLuiYhdEXFvROyOiPsiavs+EBEPbrD8kYb8zf2f9PKmAlunrP/3YjG3tbL/V/b+YrivyO2oxT+QHJutVg4Un8loDGzJ8hOrlPHDK7993mpbff8vW7Lyy75gUY/L/Q0DdDNTC1P5LNqtu/JRxN7+ZvEnyzMBSUTsiYi9G3vrnWVi9qlv9zVsW55iXDv+VbRhnmnpm4gn8+O/GA3x11d2lfnJ8a1RrRwYL8+Km/3y64U3W5W/7vi/atMBb3Clkj/XHf/GXYa3FonafO38xsu48PunLe9pNnv+DyZv147LYLHug6mFhdMTEYPJkVp+xfrJG68t8+X+2fk/ur95+99VvCYr56GIyE7ihyPikYh4tKj7YxHxeETsXyX+n15uva2MP9JNnP9tkMU/0/T7b/n8H07q5+s3keg78eP3rcpf3/E/VEuNFmtq339rWG8Fb+WzAwAAgP+KtPYb+CQdW06n6dhY/hv+3fH/tDo3v/D0sbn3T83kv5UfjoG0HOkaKsZDq7PVykSyWLxjPj46WYwVl+OlB4tx4y/6/lfLj03PVWe6HDv0um0t2n/mj75u1w647ZrNo00OdqEiQMc1tv90Zfb8G52sDNBR/q8NvWuN9p92qh5A57n+Q+9q1v7PN+TNBcDdyfUfepf2D71L+4fepf1DT7qV//X3bCKJiI4VevRkfqTukNgjykS6iZcncWdEIbFmotvfTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO3xbwAAAP//2s7mwA==")
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0)

368.803033ms ago: executing program 0 (id=629):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'pimreg\x00', 0x5005})
write$tun(r0, 0x0, 0x0)

250.550685ms ago: executing program 0 (id=632):
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x34, r2, 0x1, 0x70bd26, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x700}]}, 0x34}}, 0x20)

192.632786ms ago: executing program 0 (id=633):
r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)

192.410939ms ago: executing program 0 (id=634):
r0 = socket(0x1e, 0x4, 0x0)
connect$tipc(r0, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10)
sendmmsg$unix(r0, &(0x7f0000004400), 0x400000000000203, 0x0)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x3c}}, 0x10)

192.03243ms ago: executing program 3 (id=635):
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25}, 0x94)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r0, &(0x7f00000000c0), &(0x7f0000000000)=""/10, 0x2}, 0x20)
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000200)={r0, &(0x7f0000000080), &(0x7f0000000000)=""/10, 0x2}, 0x20)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000b40)={r0, &(0x7f0000000a80), 0x0}, 0x20)

129.33894ms ago: executing program 3 (id=636):
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x24, 0x68, 0x1, 0x0, 0x0, {}, [@NHA_ENCAP={0x8, 0x8, 0x0, 0x1, @MPLS_IPTUNNEL_DST={0x4}}, @NHA_BLACKHOLE={0x4}]}, 0x24}}, 0x0)

128.974996ms ago: executing program 3 (id=637):
r0 = socket$kcm(0x10, 0x2, 0x4)
close(r0)
socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000780)="5c00000013006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514001ac00800020004000c00060000000364bc24eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)

128.73728ms ago: executing program 0 (id=638):
r0 = syz_open_dev$loop(&(0x7f0000000440), 0x7, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000005c0)={r1, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x20, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9683dda1af1ea09de2b7fb0a0100000000000000000300", "2809e8dbe108598927875397bab22d0000b420a9c81f40f05f819e01177d3d458dac00000000000000000000003b00000000000000000200", "90be8b1c5512406c7f00", [0x4, 0x40000000000000]}})
write$FUSE_DIRENT(r1, 0x0, 0xb0)

60.790864ms ago: executing program 3 (id=639):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc)
r1 = socket$inet6(0xa, 0x3, 0x87)
setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@remote, @in=@multicast1, 0xfffd, 0x0, 0x4e20, 0x0, 0x2}, {0x0, 0x4, 0x1, 0x0, 0x0, 0x9, 0x0, 0x2}, {0x1ff, 0xffffffffe, 0x4053e5, 0x20}, 0x6, 0x1, 0x1, 0x0, 0x1, 0x1}, {{@in6=@rand_addr=' \x01\x00', 0x1, 0x32}, 0xa, @in6=@private0, 0x3502, 0x1, 0x0, 0x0, 0x6, 0xfffffffd}}, 0xe8)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}, 0x9df}, 0x1c)

60.392932ms ago: executing program 0 (id=640):
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000002f40)={[{@nodelalloc}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x5}}, {@bh}, {@init_itable}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=")
syz_mount_image$fuse(0x0, &(0x7f0000000740)='./bus\x00', 0x283016, 0x0, 0x11, 0x0, 0x0)
mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x8000, &(0x7f0000000180)={[{@workdir}]})

258.576µs ago: executing program 3 (id=641):
openat$random(0xffffffffffffff9c, &(0x7f0000000500), 0x1, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}})

0s ago: executing program 3 (id=642):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000f00)='kfree\x00', r0}, 0x18)
symlinkat(&(0x7f0000001040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, 0x0)
openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0)
ioctl$USBDEVFS_GET_CAPABILITIES(0xffffffffffffffff, 0x8004551a, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r3=>0xffffffffffffffff})
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14)
sendmsg$nl_route_sched(r2, &(0x7f0000006280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=@newtaction={0x68, 0x30, 0x1, 0x0, 0x0, {0x0, 0x0, 0x6a00}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x0, 0x2}, 0x2, r4}}]}, {0x4, 0xa}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0xffdff7e8}}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x400, 0xfffffff7}, 0x2}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x8000}, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:29787' (ED25519) to the list of known hosts.
syzkaller login: [   56.851145][ T5832] cgroup: Unknown subsys name 'net'
[   56.957373][ T5832] cgroup: Unknown subsys name 'cpuset'
[   56.961999][ T5832] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   58.891025][ T5832] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   63.619804][ T5236] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   63.625906][ T5849] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   63.630131][ T5849] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   63.633352][ T5849] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   63.637603][ T5849] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   63.648302][ T5854] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   63.652196][ T5854] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   63.655747][ T5854] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   63.659747][ T5858] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   63.663092][ T5858] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   63.699925][ T5853] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   63.712233][ T5856] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   63.712373][ T5853] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   63.721196][ T5856] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   63.728677][ T5856] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   64.033869][ T5850] chnl_net:caif_netlink_parms(): no params data found
[   64.087622][ T5846] chnl_net:caif_netlink_parms(): no params data found
[   64.094416][ T5855] chnl_net:caif_netlink_parms(): no params data found
[   64.226956][ T5850] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.230551][ T5850] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.233467][ T5850] bridge_slave_0: entered allmulticast mode
[   64.236982][ T5850] bridge_slave_0: entered promiscuous mode
[   64.262557][ T5850] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.265408][ T5850] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.268520][ T5850] bridge_slave_1: entered allmulticast mode
[   64.272403][ T5850] bridge_slave_1: entered promiscuous mode
[   64.297670][ T5846] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.300964][ T5846] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.303732][ T5846] bridge_slave_0: entered allmulticast mode
[   64.306716][ T5846] bridge_slave_0: entered promiscuous mode
[   64.310575][ T5846] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.312949][ T5846] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.315402][ T5846] bridge_slave_1: entered allmulticast mode
[   64.318565][ T5846] bridge_slave_1: entered promiscuous mode
[   64.328617][ T5855] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.333135][ T5855] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.335930][ T5855] bridge_slave_0: entered allmulticast mode
[   64.339697][ T5855] bridge_slave_0: entered promiscuous mode
[   64.355847][ T5850] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.369841][ T5855] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.372934][ T5855] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.375465][ T5855] bridge_slave_1: entered allmulticast mode
[   64.380809][ T5855] bridge_slave_1: entered promiscuous mode
[   64.386326][ T5850] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.392694][ T5846] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.421323][ T5846] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.452301][ T5855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.456434][ T5850] team0: Port device team_slave_0 added
[   64.468175][ T5855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.480178][ T5850] team0: Port device team_slave_1 added
[   64.483946][ T5846] team0: Port device team_slave_0 added
[   64.496964][ T5846] team0: Port device team_slave_1 added
[   64.540541][ T5855] team0: Port device team_slave_0 added
[   64.543826][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.546304][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.557329][ T5850] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.563390][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.566110][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.576065][ T5846] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.582260][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.584947][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.594907][ T5846] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.600647][ T5855] team0: Port device team_slave_1 added
[   64.603820][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.606830][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.618329][ T5850] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.680089][ T5855] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.682842][ T5855] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.694432][ T5855] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.706708][ T5846] hsr_slave_0: entered promiscuous mode
[   64.709700][ T5846] hsr_slave_1: entered promiscuous mode
[   64.713092][ T5855] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.715762][ T5855] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.726228][ T5855] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.782913][ T5850] hsr_slave_0: entered promiscuous mode
[   64.785875][ T5850] hsr_slave_1: entered promiscuous mode
[   64.788662][ T5850] debugfs: 'hsr0' already exists in 'hsr'
[   64.792683][ T5850] Cannot create hsr debugfs directory
[   64.861475][ T5855] hsr_slave_0: entered promiscuous mode
[   64.864507][ T5855] hsr_slave_1: entered promiscuous mode
[   64.867320][ T5855] debugfs: 'hsr0' already exists in 'hsr'
[   64.869897][ T5855] Cannot create hsr debugfs directory
[   65.135898][ T5846] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   65.155348][ T5846] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   65.168567][ T5846] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   65.182147][ T5846] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   65.211895][ T5850] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   65.229919][ T5850] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   65.246635][ T5850] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   65.271991][ T5850] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   65.286224][ T5855] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   65.293338][ T5855] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   65.306134][ T5855] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   65.314722][ T5855] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   65.448779][ T5850] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.454676][ T5846] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.470863][ T5855] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.482906][ T5850] 8021q: adding VLAN 0 to HW filter on device team0
[   65.491350][ T5846] 8021q: adding VLAN 0 to HW filter on device team0
[   65.504400][ T1091] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.507362][ T1091] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.521189][ T4527] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.524082][ T4527] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.528404][ T4527] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.530827][ T4527] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.537093][ T4527] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.540184][ T4527] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.548003][ T5855] 8021q: adding VLAN 0 to HW filter on device team0
[   65.574299][ T1091] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.576797][ T1091] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.582514][ T1091] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.585053][ T1091] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.639899][ T5850] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   65.670893][ T5856] Bluetooth: hci1: command tx timeout
[   65.749992][ T5849] Bluetooth: hci2: command tx timeout
[   65.752577][ T5856] Bluetooth: hci0: command tx timeout
[   65.829890][ T5855] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.836594][ T5846] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.846788][ T5850] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.882747][ T5846] veth0_vlan: entered promiscuous mode
[   65.897097][ T5846] veth1_vlan: entered promiscuous mode
[   65.932195][ T5850] veth0_vlan: entered promiscuous mode
[   65.950595][ T5855] veth0_vlan: entered promiscuous mode
[   65.954177][ T5846] veth0_macvtap: entered promiscuous mode
[   65.960343][ T5846] veth1_macvtap: entered promiscuous mode
[   65.968038][ T5855] veth1_vlan: entered promiscuous mode
[   65.984740][ T5850] veth1_vlan: entered promiscuous mode
[   65.996799][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.010528][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.029048][ T5695] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.034763][ T5695] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.038125][ T5695] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.045238][ T5695] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.074479][ T5855] veth0_macvtap: entered promiscuous mode
[   66.080506][ T5850] veth0_macvtap: entered promiscuous mode
[   66.094036][ T5855] veth1_macvtap: entered promiscuous mode
[   66.105444][ T5850] veth1_macvtap: entered promiscuous mode
[   66.149104][ T3013] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.151952][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.155068][ T3013] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.174105][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.203951][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.208762][   T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.212975][   T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.226552][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.236016][   T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.241816][   T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.256496][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.262661][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.268801][   T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.274461][   T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.277949][   T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.301853][   T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.384110][ T5846] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   66.385818][ T3013] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.394089][ T3013] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.435657][ T3013] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.438746][ T3013] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.467597][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.482466][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.507356][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.512346][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.702677][ T5927] gretap0: entered promiscuous mode
[   66.710650][ T5913] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[   66.750969][ T5929] loop0: detected capacity change from 0 to 16
[   66.859647][ T5900] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[   66.871767][ T5913] usb 2-1: Using ep0 maxpacket: 32
[   66.891712][ T5913] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC4, changing to 0x84
[   66.892820][ T5934] loop0: detected capacity change from 0 to 512
[   66.896566][ T5913] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7
[   66.922380][ T5913] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.16
[   66.929563][ T5913] usb 2-1: New USB device strings: Mfr=154, Product=2, SerialNumber=3
[   66.932952][ T5913] usb 2-1: Product: syz
[   66.934673][ T5913] usb 2-1: Manufacturer: syz
[   66.938516][ T5913] usb 2-1: SerialNumber: syz
[   66.944038][ T5934] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   66.952984][ T5934] ext4 filesystem being mounted at /6/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[   66.961096][ T5913] usb 2-1: config 0 descriptor??
[   66.976810][ T5913] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work!
[   66.984684][ T5934] EXT4-fs warning (device loop0): ext4_group_add:1716: Can't resize non-sparse filesystem further
[   67.010132][ T5900] usb 3-1: Using ep0 maxpacket: 16
[   67.012597][ T5855] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   67.025205][ T5900] usb 3-1: config 0 has an invalid interface number: 105 but max is 0
[   67.028472][ T5900] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[   67.036397][ T5900] usb 3-1: config 0 has no interface number 0
[   67.044368][ T5900] usb 3-1: New USB device found, idVendor=046d, idProduct=08d3, bcdDevice= b.28
[   67.048386][ T5900] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   67.055099][ T5900] usb 3-1: Product: syz
[   67.056816][ T5900] usb 3-1: Manufacturer: syz
[   67.058731][ T5900] usb 3-1: SerialNumber: syz
[   67.073435][ T5900] usb 3-1: config 0 descriptor??
[   67.082814][ T5900] uvcvideo 3-1:0.105: probe with driver uvcvideo failed with error -22
[   67.147238][ T5944] netlink: 48 bytes leftover after parsing attributes in process `syz.0.11'.
[   67.178007][ T5913] usb 2-1: USB disconnect, device number 2
[   67.178626][   T12] usb 2-1: Failed to submit usb control message: -71
[   67.186233][   T12] usb 2-1: unable to send the bmi data to the device: -71
[   67.196420][   T12] usb 2-1: unable to get target info from device
[   67.198898][   T12] usb 2-1: could not get target info (-71)
[   67.202727][   T12] usb 2-1: could not probe fw (-71)
[   67.286986][ T5899] usb 3-1: USB disconnect, device number 2
[   67.579465][   T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[   67.752972][ T5856] Bluetooth: hci1: command tx timeout
[   67.755378][   T10] usb 1-1: Using ep0 maxpacket: 32
[   67.759759][   T10] usb 1-1: config 2 has an invalid interface number: 1 but max is 0
[   67.763042][   T10] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config
[   67.767241][   T10] usb 1-1: config 2 has 2 interfaces, different from the descriptor's value: 1
[   67.775651][   T10] usb 1-1: New USB device found, idVendor=22b8, idProduct=2d97, bcdDevice=51.64
[   67.780731][   T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   67.784238][   T10] usb 1-1: Product: syz
[   67.786033][   T10] usb 1-1: Manufacturer: syz
[   67.788584][   T10] usb 1-1: SerialNumber: syz
[   67.801834][   T10] cdc_acm 1-1:2.1: probe with driver cdc_acm failed with error -22
[   67.813063][   T10] cdc_acm 1-1:2.0: probe with driver cdc_acm failed with error -22
[   67.829753][ T5856] Bluetooth: hci0: command tx timeout
[   67.832028][ T5849] Bluetooth: hci2: command tx timeout
[   68.005446][ T5886] usb 1-1: USB disconnect, device number 2
[   68.116418][ T5966] netlink: 20 bytes leftover after parsing attributes in process `syz.1.20'.
[   68.123016][ T5966] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0
[   68.178406][ T5968] loop1: detected capacity change from 0 to 1024
[   68.213387][ T5960] loop2: detected capacity change from 0 to 32768
[   68.225905][ T5968] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[   68.237977][ T5960] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.17 (5960)
[   68.246958][ T5968] ext4 filesystem being mounted at /5/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[   68.270824][ T5960] BTRFS info (device loop2): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8
[   68.278749][ T5960] BTRFS info (device loop2): using blake2b (blake2b-256-generic) checksum algorithm
[   68.298432][ T5960] BTRFS info (device loop2): using free-space-tree
[   68.320854][ T5846] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   68.435520][   T33] audit: type=1800 audit(1755049925.329:2): pid=5960 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.17" name="file1" dev="loop2" ino=260 res=0 errno=0
[   68.518012][ T5850] BTRFS info (device loop2): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8
[   69.227322][ T5900] usb 1-1: new high-speed USB device number 3 using dummy_hcd
[   69.392051][ T5900] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[   69.396112][ T5900] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
[   69.401204][ T5900] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[   69.404827][ T5900] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[   69.408128][ T5900] usb 1-1: SerialNumber: syz
[   69.625507][ T5900] usb 1-1: 0:2 : does not exist
[   69.642440][ T5900] usb 1-1: USB disconnect, device number 3
[   69.691017][ T6001] udevd[6001]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[   69.828147][ T6022] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2
[   69.834175][ T5849] Bluetooth: hci1: command tx timeout
[   69.875751][ T6018] loop1: detected capacity change from 0 to 32768
[   69.878477][ T6018] XFS: ikeep mount option is deprecated.
[   69.909466][ T5856] Bluetooth: hci0: command tx timeout
[   69.911565][ T5849] Bluetooth: hci2: command tx timeout
[   69.916027][ T6018] XFS (loop1): DAX unsupported by block device. Turning off DAX.
[   69.920136][ T6018] XFS (loop1): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[   69.934340][ T6018] XFS (loop1): Internal error !uuid_equal(&mp->m_sb.sb_uuid, &head->h_fs_uuid) at line 254 of file fs/xfs/xfs_log_recover.c.  Caller xlog_header_check_mount+0x93/0xe0
[   69.944095][ T6018] CPU: 0 UID: 0 PID: 6018 Comm: syz.1.33 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[   69.944120][ T6018] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   69.944129][ T6018] Call Trace:
[   69.944134][ T6018]  <TASK>
[   69.944141][ T6018]  dump_stack_lvl+0x189/0x250
[   69.944167][ T6018]  ? __pfx_dump_stack_lvl+0x10/0x10
[   69.944185][ T6018]  ? __phys_addr+0xd3/0x180
[   69.944204][ T6018]  ? __kasan_kmalloc_large+0x85/0xa0
[   69.944223][ T6018]  ? is_vmalloc_addr+0x52/0xb0
[   69.944242][ T6018]  xfs_corruption_error+0x122/0x170
[   69.944289][ T6018]  ? xlog_header_check_mount+0x93/0xe0
[   69.944308][ T6018]  xlog_header_check_mount+0xc6/0xe0
[   69.944323][ T6018]  ? xlog_header_check_mount+0x93/0xe0
[   69.944338][ T6018]  xlog_find_verify_log_record+0x32e/0x500
[   69.944365][ T6018]  xlog_find_zeroed+0x327/0x410
[   69.944385][ T6018]  xlog_find_head+0x5f/0x700
[   69.944397][ T6018]  ? lockdep_hardirqs_on+0x9c/0x150
[   69.944415][ T6018]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   69.944434][ T6018]  xlog_find_tail+0x3d/0x840
[   69.944450][ T6018]  ? try_to_wake_up+0x7f5/0x12b0
[   69.944471][ T6018]  xlog_recover+0x4b/0x3e0
[   69.944489][ T6018]  xfs_log_mount+0x253/0x3e0
[   69.944511][ T6018]  xfs_mountfs+0xe5e/0x2330
[   69.944535][ T6018]  ? __pfx_xfs_mountfs+0x10/0x10
[   69.944552][ T6018]  ? xfs_setup_dax_always+0x20f/0x290
[   69.944573][ T6018]  xfs_fs_fill_super+0x11b3/0x1600
[   69.944592][ T6018]  get_tree_bdev_flags+0x40e/0x4d0
[   69.944607][ T6018]  ? __pfx_xfs_fs_fill_super+0x10/0x10
[   69.944623][ T6018]  ? __pfx_get_tree_bdev_flags+0x10/0x10
[   69.944645][ T6018]  vfs_get_tree+0x92/0x2b0
[   69.944660][ T6018]  do_new_mount+0x2a2/0x9e0
[   69.944680][ T6018]  ? ns_capable+0x8a/0xf0
[   69.944692][ T6018]  ? __pfx_do_new_mount+0x10/0x10
[   69.944708][ T6018]  ? path_mount+0x61c/0xfe0
[   69.944724][ T6018]  ? user_path_at+0x44/0x60
[   69.944744][ T6018]  __se_sys_mount+0x317/0x410
[   69.944766][ T6018]  ? __pfx___se_sys_mount+0x10/0x10
[   69.944789][ T6018]  ? do_syscall_64+0xbe/0x3b0
[   69.944803][ T6018]  ? __x64_sys_mount+0x20/0xc0
[   69.944822][ T6018]  do_syscall_64+0xfa/0x3b0
[   69.944835][ T6018]  ? lockdep_hardirqs_on+0x9c/0x150
[   69.944848][ T6018]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   69.944860][ T6018]  ? exc_page_fault+0x9f/0xf0
[   69.944875][ T6018]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   69.944886][ T6018] RIP: 0033:0x7f369dd9038a
[   69.944901][ T6018] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   69.944912][ T6018] RSP: 002b:00007f369ec41e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   69.944927][ T6018] RAX: ffffffffffffffda RBX: 00007f369ec41ef0 RCX: 00007f369dd9038a
[   69.944936][ T6018] RDX: 0000200000000500 RSI: 0000200000000040 RDI: 00007f369ec41eb0
[   69.944943][ T6018] RBP: 0000200000000500 R08: 00007f369ec41ef0 R09: 000000000300c880
[   69.944950][ T6018] R10: 000000000300c880 R11: 0000000000000246 R12: 0000200000000040
[   69.944958][ T6018] R13: 00007f369ec41eb0 R14: 000000000000970d R15: 0000200000000080
[   69.944977][ T6018]  </TASK>
[   69.944982][ T6018] XFS (loop1): Corruption detected. Unmount and run xfs_repair
[   70.072993][ T6018] XFS (loop1): log has mismatched uuid - can't recover
[   70.076070][ T6018] XFS (loop1): empty log check failed
[   70.078340][ T6018] XFS (loop1): log mount/recovery failed: error -117
[   70.089611][ T6018] XFS (loop1): log mount failed
[   70.301535][ T6044] input: syz0 as /devices/virtual/input/input4
[   70.365420][ T6046] 9pnet: p9_errstr2errno: server reported unknown error @0x0000000000000007
[   70.956984][ T6064] cgroup: fork rejected by pids controller in /syz1
[   71.122644][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[   71.124999][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[   71.453428][ T6388] loop0: detected capacity change from 0 to 512
[   71.483655][ T6388] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   71.490392][ T6388] ext4 filesystem being mounted at /20/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[   71.499415][ T5852] usb 2-1: new high-speed USB device number 3 using dummy_hcd
[   71.531627][ T6388] Quota error (device loop0): do_check_range: Getting block 589828 out of range 1-5
[   71.536624][ T6388] Quota error (device loop0): qtree_read_dquot: Can't read quota structure for id 0
[   71.540868][ T6388] EXT4-fs error (device loop0): ext4_acquire_dquot:6933: comm syz.0.58: Failed to acquire dquot type 0
[   71.578175][ T5855] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   71.659492][ T5852] usb 2-1: Using ep0 maxpacket: 8
[   71.665785][ T5852] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[   71.670981][ T5852] usb 2-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a
[   71.674865][ T5852] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   71.683876][ T5852] usb 2-1: config 0 descriptor??
[   71.692074][ T5852] gspca_main: vc032x-2.14.0 probing 046d:0892
[   71.940126][ T5856] Bluetooth: hci1: command tx timeout
[   71.989913][ T5856] Bluetooth: hci0: command tx timeout
[   71.992075][ T5856] Bluetooth: hci2: command tx timeout
[   72.657097][   T33] audit: type=1326 audit(1755049929.549:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6396 comm="syz.0.60" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb6f6f8ebe9 code=0x7fc00000
[   72.666234][   T33] audit: type=1326 audit(1755049929.569:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6396 comm="syz.0.60" exe="/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fb6f6f8ebe9 code=0x7fc00000
[   72.678643][   T33] audit: type=1326 audit(1755049929.569:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6396 comm="syz.0.60" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb6f6f8ebe9 code=0x7fc00000
[   72.688154][   T33] audit: type=1326 audit(1755049929.569:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6396 comm="syz.0.60" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb6f6f8ebe9 code=0x7fc00000
[   72.701267][   T33] audit: type=1326 audit(1755049929.569:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6396 comm="syz.0.60" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb6f6f8ebe9 code=0x7fc00000
[   72.708921][   T33] audit: type=1326 audit(1755049929.569:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6396 comm="syz.0.60" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb6f6f8ebe9 code=0x7fc00000
[   72.717054][   T33] audit: type=1326 audit(1755049929.569:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6396 comm="syz.0.60" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb6f6f8ebe9 code=0x7fc00000
[   72.734453][ T6400] Bluetooth: MGMT ver 1.23
[   73.078181][ T6406] IPv6: NLM_F_REPLACE set, but no existing node found!
[   73.277325][ T6414] loop0: detected capacity change from 0 to 4096
[   73.282813][ T6414] EXT4-fs: Ignoring removed mblk_io_submit option
[   73.291956][ T5852] gspca_vc032x: reg_w err -71
[   73.296058][ T5852] vc032x 2-1:0.0: probe with driver vc032x failed with error -71
[   73.300295][ T6414] EXT4-fs (loop0): Test dummy encryption mode enabled
[   73.309559][ T5852] usb 2-1: USB disconnect, device number 3
[   73.311599][ T6414] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   73.385824][ T6414] fscrypt: AES-256-CBC-CTS using implementation "cts(cbc(ecb(aes-fixed-time)))"
[   73.424949][ T5855] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   73.505943][ T6422] loop0: detected capacity change from 0 to 4096
[   73.531874][ T6423] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[   73.674633][ T6429] loop0: detected capacity change from 0 to 1024
[   73.762217][ T6431] loop0: detected capacity change from 0 to 1024
[   73.765838][ T6431] EXT4-fs: Ignoring removed orlov option
[   73.771662][ T6431] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (52289!=20869)
[   73.775504][ T6431] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (16), stripe is disabled
[   73.781561][ T6431] EXT4-fs (loop0): invalid journal inode
[   73.891180][ T6437] netlink: 4 bytes leftover after parsing attributes in process `syz.0.76'.
[   74.191840][ T6459] loop0: detected capacity change from 0 to 4096
[   74.198048][ T6459] ntfs3(loop0): Different NTFS sector size (2048) and media sector size (512).
[   74.203429][ T6459] ntfs3(loop0): Failed to load $MFTMirr (-22).
[   74.324171][ T6473] overlayfs: missing 'lowerdir'
[   74.383777][ T6475] netlink: 84 bytes leftover after parsing attributes in process `syz.0.95'.
[   75.619724][ T6511] netlink: 16 bytes leftover after parsing attributes in process `syz.0.109'.
[   75.697605][ T6515] dummy0: entered allmulticast mode
[   75.769491][ T6519] nftables ruleset with unbound chain
[   75.795253][   T33] kauditd_printk_skb: 7 callbacks suppressed
[   75.795263][   T33] audit: type=1326 audit(1755049932.689:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6520 comm="syz.0.114" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb6f6f8ebe9 code=0x7ffc0000
[   75.807761][   T33] audit: type=1326 audit(1755049932.689:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6520 comm="syz.0.114" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb6f6f8ebe9 code=0x7ffc0000
[   75.815341][   T33] audit: type=1326 audit(1755049932.689:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6520 comm="syz.0.114" exe="/syz-executor" sig=0 arch=c000003e syscall=229 compat=0 ip=0x7fb6f6f8ebe9 code=0x7ffc0000
[   75.825153][   T33] audit: type=1326 audit(1755049932.689:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6520 comm="syz.0.114" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb6f6f8ebe9 code=0x7ffc0000
[   75.833365][   T33] audit: type=1326 audit(1755049932.689:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6520 comm="syz.0.114" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb6f6f8ebe9 code=0x7ffc0000
[   75.988325][ T6531] loop0: detected capacity change from 0 to 1024
[   76.016854][ T6531] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors
[   76.035874][ T6531] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869)
[   76.040911][ T6531] JBD2: no valid journal superblock found
[   76.043330][ T6531] EXT4-fs (loop0): Could not load journal inode
[   76.053400][ T6537] syz.1.122 calls setitimer() with new_value NULL pointer. Misfeature support will be removed
[   76.222297][ T6546] loop0: detected capacity change from 0 to 512
[   76.253251][ T6546] EXT4-fs (loop0): revision level too high, forcing read-only mode
[   76.257035][ T6546] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002]
[   76.261662][ T6546] System zones: 0-1, 15-15, 18-18, 34-34
[   76.264712][ T6546] EXT4-fs (loop0): orphan cleanup on readonly fs
[   76.268784][ T6546] Quota error (device loop0): v2_read_header: Failed header read: expected=8 got=0
[   76.275769][ T6546] EXT4-fs warning (device loop0): ext4_enable_quotas:7168: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix.
[   76.282723][ T6546] EXT4-fs (loop0): Cannot turn on quotas: error -22
[   76.285991][ T6546] EXT4-fs error (device loop0): ext4_orphan_get:1418: comm syz.0.126: bad orphan inode 16
[   76.290588][ T6546] ext4_test_bit(bit=15, block=18) = 1
[   76.292587][ T6546] is_bad_inode(inode)=0
[   76.294101][ T6546] NEXT_ORPHAN(inode)=0
[   76.295532][ T6546] max_ino=32
[   76.296915][ T6546] i_nlink=2
[   76.301309][ T6546] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback.
[   76.311486][ T6546] fscrypt (loop0, inode 16): Error -61 getting encryption context
[   76.330113][ T5855] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   76.535619][ T6551] loop0: detected capacity change from 0 to 32768
[   76.544811][ T6551] (syz.0.127,6551,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[   76.552863][ T6551] (syz.0.127,6551,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[   76.571754][ T6551] JBD2: Ignoring recovery information on journal
[   76.624657][ T6551] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
[   76.709522][ T5855] ocfs2: Unmounting device (7,0) on (node local)
[   77.541778][ T6567] loop1: detected capacity change from 0 to 256
[   78.638722][ T6586] netlink: 'syz.0.141': attribute type 1 has an invalid length.
[   78.646325][ T6586] netlink: 630 bytes leftover after parsing attributes in process `syz.0.141'.
[   78.942654][ T6598] loop0: detected capacity change from 0 to 1024
[   79.152363][ T6606] geneve2: entered promiscuous mode
[   79.154704][ T6606] geneve2: entered allmulticast mode
[   79.299881][ T5900] usb 1-1: new full-speed USB device number 4 using dummy_hcd
[   79.414342][ T6614] delete_channel: no stack
[   79.450989][ T5900] usb 1-1: config 0 has an invalid interface number: 128 but max is 0
[   79.454537][ T5900] usb 1-1: config 0 has no interface number 0
[   79.461408][ T5900] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a
[   79.465339][ T5900] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   79.468706][ T5900] usb 1-1: Product: syz
[   79.471567][ T5900] usb 1-1: Manufacturer: syz
[   79.473963][ T5900] usb 1-1: SerialNumber: syz
[   79.486078][ T5900] usb 1-1: config 0 descriptor??
[   79.931140][ T6634] overlayfs: failed to decode file handle (len=7, type=78, flags=0, err=-22)
[   80.101956][ T5900] usb 1-1: Firmware version (0.0) predates our first public release.
[   80.104785][ T5900] usb 1-1: Please update to version 0.2 or newer
[   80.132850][ T5900] usb 1-1: USB disconnect, device number 4
[   80.208383][ T6640] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   81.075320][ T6655] loop0: detected capacity change from 0 to 1024
[   81.093751][ T6655] =======================================================
[   81.093751][ T6655] WARNING: The mand mount option has been deprecated and
[   81.093751][ T6655]          and is ignored by this kernel. Remove the mand
[   81.093751][ T6655]          option from the mount to silence this warning.
[   81.093751][ T6655] =======================================================
[   81.106120][ T6655] EXT4-fs: inline encryption not supported
[   81.137241][ T6655] EXT4-fs (loop0): can't mount with commit=, fs mounted w/o journal
[   81.237436][ T6662] syz.0.175 uses obsolete (PF_INET,SOCK_PACKET)
[   81.413067][ T6660] loop1: detected capacity change from 0 to 32768
[   81.442479][ T6660] (syz.1.174,6660,0):ocfs2_journal_addressable:1935 ERROR: The journal cannot address the entire volume. Enable the 'block64' journal option with tunefs.ocfs2
[   81.442515][ T6660] (syz.1.174,6660,0):ocfs2_check_volume:2432 ERROR: status = -27
[   81.473171][ T6660] (syz.1.174,6660,1):ocfs2_mount_volume:1764 ERROR: status = -27
[   81.487622][ T6660] (syz.1.174,6660,1):ocfs2_fill_super:1177 ERROR: status = -27
[   81.613714][ T6673] loop0: detected capacity change from 0 to 2048
[   81.648398][ T6673] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[   81.654155][ T6673] ext4 filesystem being mounted at /92/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[   81.719009][ T5855] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   81.969511][ T5852] usb 2-1: new high-speed USB device number 4 using dummy_hcd
[   82.129425][ T5852] usb 2-1: Using ep0 maxpacket: 8
[   82.135009][ T5852] usb 2-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb
[   82.139883][ T5852] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   82.147559][ T5852] usb 2-1: config 0 descriptor??
[   82.974641][ T5852] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71
[   82.980382][ T5852] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x00b0: ffffffb9
[   82.999762][ T5852] asix 2-1:0.0: probe with driver asix failed with error -71
[   83.006498][ T5852] usb 2-1: USB disconnect, device number 4
[   83.513328][ T6688] process 'syz.1.184' launched '/dev/fd/3' with NULL argv: empty string added
[   83.586669][ T6692] 9pnet: p9_errstr2errno: server reported unknown error @0x0000000000000003
[   83.699094][ T6698] loop0: detected capacity change from 0 to 128
[   83.896361][ T6696] loop1: detected capacity change from 0 to 32768
[   83.964861][ T6696] bcachefs (loop1): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,foreground_target=invalid label 767,background_target=invalid device 7,nojournal_transaction_names
[   83.964876][ T6696]   allowing incompatible features above 0.0: (unknown version)
[   83.964881][ T6696]   features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes
[   83.986796][ T6696] bcachefs (loop1): Using encoding defined by superblock: utf8-12.1.0
[   83.990505][ T6696] bcachefs (loop1): initializing new filesystem
[   84.011733][ T6696] bcachefs (loop1): going read-write
[   84.018605][ T6696] bcachefs (loop1): marking superblocks
[   84.047686][ T6696] bcachefs (loop1): initializing freespace
[   84.055814][ T6696] bcachefs (loop1): done initializing freespace
[   84.074279][ T6696] bcachefs (loop1): reading snapshots table
[   84.076793][ T6696] bcachefs (loop1): reading snapshots done
[   84.110676][ T6696] bcachefs (loop1): done starting filesystem
[   84.166008][ T6696] syz.1.188 (6696) used greatest stack depth: 16056 bytes left
[   84.174053][ T5846] bcachefs (loop1): shutting down
[   84.175949][ T5846] bcachefs (loop1): going read-only
[   84.177944][ T5846] bcachefs (loop1): finished waiting for writes to stop
[   84.185706][ T5846] bcachefs (loop1): flushing journal and stopping allocators, journal seq 2
[   84.204735][ T5846] bcachefs (loop1): flushing journal and stopping allocators complete, journal seq 3
[   84.209098][ T5846] bcachefs (loop1): clean shutdown complete, journal seq 4
[   84.213093][ T5846] bcachefs (loop1): marking filesystem clean
[   84.228320][ T5846] bcachefs (loop1): shutdown complete
[   84.243278][ T6732] loop0: detected capacity change from 0 to 1024
[   84.246065][ T6732] EXT4-fs: Ignoring removed nobh option
[   84.247974][ T6732] EXT4-fs: inline encryption not supported
[   84.273522][ T6732] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[   84.296240][ T5855] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   85.472957][ T5856] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   85.476480][ T5856] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   85.479740][ T5856] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   85.482833][ T5856] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   85.485461][ T5856] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   85.529628][ T5852] usb 1-1: new high-speed USB device number 5 using dummy_hcd
[   85.689714][ T5852] usb 1-1: Using ep0 maxpacket: 32
[   85.696830][ T5852] usb 1-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c
[   85.703277][ T5852] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   85.706549][ T5852] usb 1-1: Product: syz
[   85.708357][ T5852] usb 1-1: Manufacturer: syz
[   85.711833][ T5852] usb 1-1: SerialNumber: syz
[   85.720946][ T5852] usb 1-1: config 0 descriptor??
[   85.728552][ T5852] gspca_main: gspca_topro-2.14.0 probing 06a2:0003
[   85.739768][ T6745] chnl_net:caif_netlink_parms(): no params data found
[   85.812062][ T5695] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   85.882834][ T5695] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   85.911729][ T6745] bridge0: port 1(bridge_slave_0) entered blocking state
[   85.914651][ T6745] bridge0: port 1(bridge_slave_0) entered disabled state
[   85.917739][ T6745] bridge_slave_0: entered allmulticast mode
[   85.926126][ T6745] bridge_slave_0: entered promiscuous mode
[   85.945885][ T5695] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   85.955434][ T6745] bridge0: port 2(bridge_slave_1) entered blocking state
[   85.958359][ T6745] bridge0: port 2(bridge_slave_1) entered disabled state
[   85.962594][ T6745] bridge_slave_1: entered allmulticast mode
[   85.965756][ T6745] bridge_slave_1: entered promiscuous mode
[   85.991001][ T6745] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   86.003774][ T5695] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   86.013428][ T6745] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   86.043529][ T6745] team0: Port device team_slave_0 added
[   86.049507][ T6745] team0: Port device team_slave_1 added
[   86.092900][ T6745] batman_adv: batadv0: Adding interface: batadv_slave_0
[   86.095972][ T6745] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   86.107043][ T6745] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   86.112776][ T6745] batman_adv: batadv0: Adding interface: batadv_slave_1
[   86.115563][ T6745] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   86.125473][ T6745] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   86.170911][  T790] usb 2-1: new high-speed USB device number 5 using dummy_hcd
[   86.212994][ T6745] hsr_slave_0: entered promiscuous mode
[   86.215636][ T6745] hsr_slave_1: entered promiscuous mode
[   86.218401][ T6745] debugfs: 'hsr0' already exists in 'hsr'
[   86.223044][ T6745] Cannot create hsr debugfs directory
[   86.263232][ T5695] bridge_slave_1: left allmulticast mode
[   86.265999][ T5695] bridge_slave_1: left promiscuous mode
[   86.270283][ T5695] bridge0: port 2(bridge_slave_1) entered disabled state
[   86.283101][ T5695] bridge_slave_0: left allmulticast mode
[   86.285700][ T5695] bridge_slave_0: left promiscuous mode
[   86.288457][ T5695] bridge0: port 1(bridge_slave_0) entered disabled state
[   86.319612][  T790] usb 2-1: Using ep0 maxpacket: 8
[   86.326297][  T790] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04
[   86.331506][  T790] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   86.335011][  T790] usb 2-1: Product: syz
[   86.343563][  T790] usb 2-1: Manufacturer: syz
[   86.345309][  T790] usb 2-1: SerialNumber: syz
[   86.349553][  T790] usb 2-1: config 0 descriptor??
[   86.494431][   T47] cfg80211: failed to load regulatory.db
[   86.561729][  T790] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state
[   86.617244][ T5695] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   86.623692][ T5695] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   86.628865][ T5695] bond0 (unregistering): Released all slaves
[   86.972345][ T6745] netdevsim netdevsim3 netdevsim0: renamed from eth0
[   87.014101][ T5695] hsr_slave_0: left promiscuous mode
[   87.017879][ T5695] hsr_slave_1: left promiscuous mode
[   87.024002][ T5695] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   87.027140][ T5695] batman_adv: batadv0: Removing interface: batadv_slave_0
[   87.033978][ T5695] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   87.036683][ T5695] batman_adv: batadv0: Removing interface: batadv_slave_1
[   87.058582][ T5695] veth1_macvtap: left promiscuous mode
[   87.061366][ T5695] veth0_macvtap: left promiscuous mode
[   87.065553][ T5695] veth1_vlan: left promiscuous mode
[   87.068325][ T5695] veth0_vlan: left promiscuous mode
[   87.152027][ T5852] gspca_topro: reg_r err -71
[   87.154255][ T5852] gspca_topro: Sensor soi763a
[   87.187505][ T5852] usb 1-1: USB disconnect, device number 5
[   87.400204][  T790] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71
[   87.408270][  T790] usb 2-1: USB disconnect, device number 5
[   87.509484][ T5856] Bluetooth: hci3: command tx timeout
[   87.514077][ T5695] team0 (unregistering): Port device team_slave_1 removed
[   87.546040][ T5695] team0 (unregistering): Port device team_slave_0 removed
[   88.336859][ T6745] netdevsim netdevsim3 netdevsim1: renamed from eth1
[   88.386510][ T6745] netdevsim netdevsim3 netdevsim2: renamed from eth2
[   88.456501][ T6745] netdevsim netdevsim3 netdevsim3: renamed from eth3
[   88.573007][ T6776] loop1: detected capacity change from 0 to 32768
[   88.591057][ T6776] BTRFS: device fsid 3d39d0ba-bdae-447e-827b-b091e1a68885 devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.208 (6776)
[   88.600017][ T6776] BTRFS info (device loop1): first mount of filesystem 3d39d0ba-bdae-447e-827b-b091e1a68885
[   88.604394][ T6776] BTRFS info (device loop1): using crc32c (crc32c-lib) checksum algorithm
[   88.608049][ T6776] BTRFS info (device loop1): using free-space-tree
[   88.666723][ T6745] 8021q: adding VLAN 0 to HW filter on device bond0
[   88.754813][ T6745] 8021q: adding VLAN 0 to HW filter on device team0
[   88.785397][ T1087] bridge0: port 1(bridge_slave_0) entered blocking state
[   88.788483][ T1087] bridge0: port 1(bridge_slave_0) entered forwarding state
[   88.817697][ T1087] bridge0: port 2(bridge_slave_1) entered blocking state
[   88.820947][ T1087] bridge0: port 2(bridge_slave_1) entered forwarding state
[   89.302952][ T6811] loop0: detected capacity change from 0 to 8
[   89.374395][ T6811] Page size > filesystem block size (5).  This is currently not supported!
[   89.527027][ T5846] BTRFS info (device loop1): last unmount of filesystem 3d39d0ba-bdae-447e-827b-b091e1a68885
[   89.568469][ T6745] 8021q: adding VLAN 0 to HW filter on device batadv0
[   89.589767][ T5856] Bluetooth: hci3: command tx timeout
[   89.746294][ T6745] veth0_vlan: entered promiscuous mode
[   89.782897][ T6745] veth1_vlan: entered promiscuous mode
[   89.848990][ T6745] veth0_macvtap: entered promiscuous mode
[   89.863911][ T6745] veth1_macvtap: entered promiscuous mode
[   89.908795][ T6745] batman_adv: batadv0: Interface activated: batadv_slave_0
[   89.935485][ T6745] batman_adv: batadv0: Interface activated: batadv_slave_1
[   89.966921][ T5879] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   89.986571][ T5879] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   90.022578][ T5879] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   90.031678][ T5879] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   90.106906][ T6836] sg_write: data in/out 197440/1 bytes for SCSI command 0xdd-- guessing data in;
[   90.106906][ T6836]    program syz.1.218 not setting count and/or reply_len properly
[   90.186520][ T3013] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   90.192988][ T3013] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   90.205537][ T6842] netlink: 8 bytes leftover after parsing attributes in process `syz.0.219'.
[   90.215506][ T6842] netlink: 4 bytes leftover after parsing attributes in process `syz.0.219'.
[   90.256231][   T12] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[   90.279301][   T12] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[   90.289618][   T12] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[   90.293319][   T12] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[   90.304435][ T3013] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   90.308680][ T3013] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   90.820377][ T6846] loop1: detected capacity change from 0 to 32768
[   90.864497][ T6846] XFS (loop1): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[   90.901302][ T6846] XFS (loop1): Ending clean mount
[   90.946571][ T5846] XFS (loop1): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[   91.405269][ T6918] bochs-drm 0000:00:01.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem
[   91.496632][ T6923] loop1: detected capacity change from 0 to 8
[   91.539612][ T6923] SQUASHFS error: lzo decompression failed, data probably corrupt
[   91.556261][ T6923] SQUASHFS error: Failed to read block 0x144: -5
[   91.558963][ T6923] SQUASHFS error: Unable to read metadata cache entry [142]
[   91.580248][ T6923] SQUASHFS error: Unable to read inode 0x11f
[   91.684818][ T5856] Bluetooth: hci3: command tx timeout
[   92.054916][ T6940] netlink: 'syz.3.246': attribute type 3 has an invalid length.
[   92.057719][ T6940] netlink: 766 bytes leftover after parsing attributes in process `syz.3.246'.
[   92.079569][ T6942] capability: warning: `syz.1.247' uses deprecated v2 capabilities in a way that may be insecure
[   92.106631][ T6942] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only
[   92.129475][ T6942] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off.
[   92.238962][ T6948] loop3: detected capacity change from 0 to 128
[   92.267992][ T6948] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[   92.286817][ T6948] ext4 filesystem being mounted at /7/mnt supports timestamps until 2038-01-19 (0x7fffffff)
[   92.371377][ T6955] loop1: detected capacity change from 0 to 512
[   92.381872][ T6955] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support!
[   92.395956][ T6955] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode
[   92.414846][ T6955] EXT4-fs warning (device loop1): ext4_expand_extra_isize_ea:2848: Unable to expand inode 11. Delete some EAs or run e2fsck.
[   92.423632][ T6955] EXT4-fs (loop1): 1 truncate cleaned up
[   92.432096][ T6955] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   92.569509][ T6745] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[   92.582816][ T5846] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   93.209992][ T6970] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   93.236694][ T6973] loop1: detected capacity change from 0 to 1024
[   93.258580][ T6973] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   93.303719][ T5846] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   93.484859][ T6994] netlink: 8 bytes leftover after parsing attributes in process `syz.1.259'.
[   93.669034][ T7005] loop1: detected capacity change from 0 to 512
[   93.695418][ T7005] EXT4-fs (loop1): revision level too high, forcing read-only mode
[   93.708346][ T7005] EXT4-fs (loop1): orphan cleanup on readonly fs
[   93.720384][ T7005] Quota error (device loop1): v2_read_file_info: Block with free entry 1 out of range (1, 6).
[   93.730421][ T7005] EXT4-fs warning (device loop1): ext4_enable_quotas:7168: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix.
[   93.738530][ T7005] EXT4-fs (loop1): Cannot turn on quotas: error -117
[   93.742686][ T7005] EXT4-fs error (device loop1): ext4_orphan_get:1392: inode #16: comm syz.1.262: casefold flag without casefold feature
[   93.748045][ T7005] EXT4-fs error (device loop1): ext4_orphan_get:1397: comm syz.1.262: couldn't read orphan inode 16 (err -117)
[   93.758278][ T7005] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback.
[   93.759469][ T5856] Bluetooth: hci3: command tx timeout
[   93.805599][ T5846] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   94.003443][ T7001] loop3: detected capacity change from 0 to 32768
[   94.010557][ T7001] XFS: ikeep mount option is deprecated.
[   94.022622][ T7001] XFS: ikeep mount option is deprecated.
[   94.033352][ T7001] XFS: noikeep mount option is deprecated.
[   94.085372][ T7001] XFS (loop3): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[   94.183538][ T7025] MTD: Attempt to mount non-MTD device "/dev/nullb0"
[   94.193816][ T7025] cramfs: wrong magic
[   94.268954][ T7001] XFS (loop3): Ending clean mount
[   94.496756][ T6745] XFS (loop3): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[   94.670707][ T7033] loop3: detected capacity change from 0 to 1024
[   94.694040][ T7033] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[   94.729428][ T5913] usb 1-1: new high-speed USB device number 6 using dummy_hcd
[   94.953781][ T5913] usb 1-1: New USB device found, idVendor=0c70, idProduct=f010, bcdDevice= 0.00
[   94.968016][ T5913] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   94.981054][ T5913] usb 1-1: config 0 descriptor??
[   95.447920][ T5913] aquacomputer_d5next 0003:0C70:F010.0001: item fetching failed at offset 1/5
[   95.473946][ T5913] aquacomputer_d5next 0003:0C70:F010.0001: probe with driver aquacomputer_d5next failed with error -22
[   95.621830][ T5913] usb 1-1: USB disconnect, device number 6
[   95.810983][ T7050] netlink: 'syz.1.275': attribute type 10 has an invalid length.
[   96.141511][ T6745] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   96.293325][ T5900] IPVS: starting estimator thread 0...
[   96.400588][ T7060] IPVS: using max 78 ests per chain, 187200 per kthread
[   96.530639][ T7072] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount.
[   96.547341][ T7072] CIFS: Unable to determine destination address
[   96.770652][ T7062] loop3: detected capacity change from 0 to 32768
[   96.780235][ T5852] usb 2-1: new high-speed USB device number 6 using dummy_hcd
[   96.787858][ T7062] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.279 (7062)
[   96.828660][ T7062] BTRFS info (device loop3 state S): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[   96.838740][ T7062] BTRFS info (device loop3 state S): using crc32c (crc32c-lib) checksum algorithm
[   96.843629][ T7062] BTRFS info (device loop3 state S): using free-space-tree
[   96.949411][ T5852] usb 2-1: Using ep0 maxpacket: 32
[   96.959884][ T5852] usb 2-1: unable to get BOS descriptor or descriptor too short
[   96.968249][ T5852] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[   96.969907][   T26] BTRFS warning (device loop3 state S): checksum verify failed on logical 1052672 mirror 1 wanted 0x37e030f7 found 0xf6479a7e level 0, ignored
[   96.976388][ T5852] usb 2-1: New USB device found, idVendor=17ef, idProduct=7000, bcdDevice=a1.ec
[   96.990797][ T5852] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   96.991451][ T1088] BTRFS warning (device loop3 state S): checksum verify failed on logical 5332992 mirror 1 wanted 0x0a5e5d25 found 0xcd9414ca level 0, ignored
[   96.993657][ T5852] usb 2-1: Product: syz
[   97.002073][ T5852] usb 2-1: Manufacturer: syz
[   97.004210][ T5852] usb 2-1: SerialNumber: syz
[   97.008922][   T26] BTRFS warning (device loop3 state S): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0x28b693f7 level 0, ignored
[   97.018416][ T7062] BTRFS error (device loop3 state CS): failed to load root free space
[   97.032666][ T5852] usb 2-1: config 0 descriptor??
[   97.067565][ T1088] BTRFS warning (device loop3 state CS): checksum verify failed on logical 5267456 mirror 1 wanted 0x22fa3277 found 0x0d9b21b0 level 0, ignored
[   97.317958][ T6745] BTRFS info (device loop3 state CS): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[   97.422854][ T5913] usb 2-1: USB disconnect, device number 6
[   97.874879][ T7098] loop3: detected capacity change from 0 to 2048
[   97.891276][ T7098] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024)
[   97.902891][ T6001] udevd[6001]: incorrect nilfs2 checksum on /dev/loop3
[   97.905481][ T7098] NILFS (loop3): mounting unchecked fs
[   97.907296][ T7098] NILFS (loop3): recovery required for readonly filesystem
[   97.915742][ T7098] NILFS (loop3): write access will be enabled during recovery
[   97.924202][ T7098] NILFS (loop3): norecovery option specified, skipping roll-forward recovery
[   97.932162][ T7098] NILFS (loop3): couldn't remount because the filesystem is in an incomplete recovery state
[   98.091453][ T7108] loop3: detected capacity change from 0 to 128
[   98.135432][ T7108] syz.3.291: attempt to access beyond end of device
[   98.135432][ T7108] loop3: rw=2051, sector=128, nr_sectors = 913 limit=128
[   98.639909][ T5900] usb 2-1: new high-speed USB device number 7 using dummy_hcd
[   98.667202][ T7121] loop3: detected capacity change from 0 to 32768
[   98.688872][ T7121] XFS (loop3): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[   98.720375][ T7121] XFS (loop3): Ending clean mount
[   98.767711][ T6745] XFS (loop3): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[   98.808339][ T5900] usb 2-1: config 0 has an invalid interface number: 188 but max is 0
[   98.812473][ T5900] usb 2-1: config 0 has no interface number 0
[   98.822611][ T5900] usb 2-1: config 0 interface 188 has no altsetting 0
[   98.840827][ T5900] usb 2-1: New USB device found, idVendor=0483, idProduct=3747, bcdDevice=dc.ab
[   98.844743][ T5900] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   98.867363][ T5900] usb 2-1: config 0 descriptor??
[   98.898506][ T5900] ftdi_sio 2-1:0.188: FTDI USB Serial Device converter detected
[   98.931020][ T5900] ftdi_sio ttyUSB0: unknown device type: 0xdcab
[   98.993590][ T7134] loop0: detected capacity change from 0 to 512
[   99.002925][ T7134] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled
[   99.012428][ T7134] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   99.016801][ T7134] ext4 filesystem being mounted at /145/bus supports timestamps until 2038-01-19 (0x7fffffff)
[   99.032116][ T7136] loop3: detected capacity change from 0 to 8192
[   99.033937][   T33] audit: type=1800 audit(1755049955.929:22): pid=7134 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.299" name="file1" dev="loop0" ino=15 res=0 errno=0
[   99.082176][ T5855] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   99.123021][ T5852] usb 2-1: USB disconnect, device number 7
[   99.127643][ T5852] ftdi_sio 2-1:0.188: device disconnected
[   99.218488][ T7144] comedi comedi4: bad chanlist[0]=0x0000b8eb chan=47339 range length=2
[   99.590323][ T5852] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[   99.779472][ T5852] usb 4-1: Using ep0 maxpacket: 16
[   99.782882][ T5852] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[   99.786629][ T5852] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[   99.791384][ T5852] usb 4-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice= 0.00
[   99.794383][ T5852] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   99.800021][ T5852] usb 4-1: config 0 descriptor??
[  100.089014][ T7159] netlink: 4 bytes leftover after parsing attributes in process `syz.1.306'.
[  100.211174][ T7165] loop1: detected capacity change from 0 to 256
[  100.251244][ T7165] FAT-fs (loop1): Directory bread(block 64) failed
[  100.256938][ T5852] input: HID 0955:7214 Haptics as /devices/virtual/input/input6
[  100.262526][ T7165] FAT-fs (loop1): Directory bread(block 65) failed
[  100.273844][ T7165] FAT-fs (loop1): Directory bread(block 66) failed
[  100.276685][ T7165] FAT-fs (loop1): Directory bread(block 67) failed
[  100.281990][ T7165] FAT-fs (loop1): Directory bread(block 68) failed
[  100.284595][ T7165] FAT-fs (loop1): Directory bread(block 69) failed
[  100.290538][ T7165] FAT-fs (loop1): Directory bread(block 70) failed
[  100.293189][ T7165] FAT-fs (loop1): Directory bread(block 71) failed
[  100.295769][ T7165] FAT-fs (loop1): Directory bread(block 72) failed
[  100.302063][ T7165] FAT-fs (loop1): Directory bread(block 73) failed
[  100.308570][ T5852] shield 0003:0955:7214.0002: Registered Thunderstrike controller
[  100.322264][ T5852] shield 0003:0955:7214.0002: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.3-1/input0
[  100.462512][ T6760] shield 0003:0955:7214.0002: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO
[  100.481037][ T6760] shield 0003:0955:7214.0002: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO
[  100.490797][ T5852] usb 4-1: USB disconnect, device number 2
[  100.497509][ T6760] shield 0003:0955:7214.0002: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO
[  100.507880][ T6760] shield 0003:0955:7214.0002: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV
[  100.814054][ T5879] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  100.818528][ T5879] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  100.824433][ T5879] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  100.828789][ T5879] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  100.939742][ T7187] loop1: detected capacity change from 0 to 8
[  101.138228][ T7203] loop0: detected capacity change from 0 to 512
[  101.180302][ T7203] EXT4-fs error (device loop0): ext4_validate_block_bitmap:441: comm syz.0.326: bg 0: block 393: padding at end of block bitmap is not set
[  101.196795][ T7203] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6657: Corrupt filesystem
[  101.208050][ T7203] EXT4-fs (loop0): 2 truncates cleaned up
[  101.212100][ T7203] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  101.256285][ T5855] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  101.337329][ T7212] loop1: detected capacity change from 0 to 256
[  101.393500][ T7212] FAT-fs (loop1): Directory bread(block 64) failed
[  101.396042][ T7212] FAT-fs (loop1): Directory bread(block 65) failed
[  101.398702][ T7212] FAT-fs (loop1): Directory bread(block 66) failed
[  101.403501][ T7212] FAT-fs (loop1): Directory bread(block 67) failed
[  101.408330][ T7199] loop3: detected capacity change from 0 to 32768
[  101.410540][ T7212] FAT-fs (loop1): Directory bread(block 68) failed
[  101.424417][ T7212] FAT-fs (loop1): Directory bread(block 69) failed
[  101.438305][ T7212] FAT-fs (loop1): Directory bread(block 70) failed
[  101.451526][ T7212] FAT-fs (loop1): Directory bread(block 71) failed
[  101.463801][ T7212] FAT-fs (loop1): Directory bread(block 72) failed
[  101.470711][ T7212] FAT-fs (loop1): Directory bread(block 73) failed
[  101.474965][ T7199] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode.
[  101.785747][ T6745] ocfs2: Unmounting device (7,3) on (node local)
[  102.089637][ T5913] usb 2-1: new high-speed USB device number 8 using dummy_hcd
[  102.249609][ T5913] usb 2-1: Using ep0 maxpacket: 16
[  102.271039][ T5913] usb 2-1: config 0 has an invalid interface number: 157 but max is 0
[  102.277075][ T5913] usb 2-1: config 0 has no interface number 0
[  102.281391][ T5913] usb 2-1: config 0 interface 157 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16
[  102.286028][ T5913] usb 2-1: config 0 interface 157 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64
[  102.305671][ T5913] usb 2-1: New USB device found, idVendor=058f, idProduct=9720, bcdDevice=fb.74
[  102.319375][ T5913] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  102.322890][ T5913] usb 2-1: Product: syz
[  102.339623][ T5913] usb 2-1: Manufacturer: syz
[  102.346510][ T5913] usb 2-1: SerialNumber: syz
[  102.370846][ T5913] usb 2-1: config 0 descriptor??
[  102.383725][ T7221] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  102.388556][ T7221] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  102.410355][ T5913] pl2303 2-1:0.157: required interrupt-in endpoint missing
[  102.517347][ T7230] loop3: detected capacity change from 0 to 256
[  102.565241][ T7230] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0x76dfe2a7, utbl_chksum : 0xe619d30d)
[  102.574212][ T7230] exFAT-fs (loop3): failed to load alloc-bitmap
[  102.577010][ T7230] exFAT-fs (loop3): failed to recognize exfat type
[  102.693688][ T6760] usb 2-1: USB disconnect, device number 8
[  102.988801][ T7240] loop3: detected capacity change from 0 to 4096
[  103.026033][ T7240] ntfs3(loop3): Mark volume as dirty due to NTFS errors
[  103.098743][ T7251] loop0: detected capacity change from 0 to 512
[  103.255738][ T7265] dvmrp5: entered allmulticast mode
[  103.262704][ T7265] pimreg: entered allmulticast mode
[  103.332152][ T7269] loop1: detected capacity change from 0 to 1024
[  103.335874][ T7269] EXT4-fs: Ignoring removed nobh option
[  103.342420][ T7269] EXT4-fs: Ignoring removed bh option
[  103.362724][ T7269] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  103.389971][ T6760] usb 4-1: new high-speed USB device number 3 using dummy_hcd
[  103.390096][ T5846] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  103.559438][ T6760] usb 4-1: Using ep0 maxpacket: 32
[  103.576927][ T6760] usb 4-1: config 0 has an invalid interface number: 9 but max is 0
[  103.589092][ T6760] usb 4-1: config 0 has no interface number 0
[  103.613699][ T6760] usb 4-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c
[  103.626896][ T6760] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  103.636398][ T6760] usb 4-1: Product: syz
[  103.648644][ T6760] usb 4-1: Manufacturer: syz
[  103.657676][ T6760] usb 4-1: SerialNumber: syz
[  103.697696][ T6760] usb 4-1: config 0 descriptor??
[  103.720479][ T6760] gspca_main: gspca_topro-2.14.0 probing 06a2:0003
[  103.964375][ T6760] gspca_topro: reg_w err -71
[  103.999472][ T6760] gspca_topro: Sensor soi763a
[  104.025012][ T6760] usb 4-1: USB disconnect, device number 3
[  104.671792][ T7312] loop0: detected capacity change from 0 to 1024
[  104.686746][ T7312] EXT4-fs: Ignoring removed orlov option
[  104.711212][ T7312] EXT4-fs (loop0): invalid inodes per group: 0
[  104.711212][ T7312] 
[  105.072531][ T7327] netlink: 24 bytes leftover after parsing attributes in process `syz.1.359'.
[  105.142259][ T7334] libceph: resolve '0' (ret=-3): failed
[  105.205877][ T7336] loop1: detected capacity change from 0 to 2048
[  105.224505][ T7336] UDF-fs: error (device loop1): udf_process_sequence: Primary Volume Descriptor not found!
[  105.245506][ T7336] UDF-fs: warning (device loop1): udf_fill_super: No fileset found
[  105.380810][ T7346] netlink: 'syz.1.368': attribute type 2 has an invalid length.
[  105.430789][ T7350] loop1: detected capacity change from 0 to 512
[  105.453066][ T7350] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  105.457433][ T7350] ext4 filesystem being mounted at /153/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  105.477696][ T7350] EXT4-fs (loop1): re-mounted 00000000-0000-0000-0000-000000000000 ro.
[  105.495718][ T5846] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  105.852923][ T7372] loop0: detected capacity change from 0 to 8
[  105.884295][ T7372] SQUASHFS error: Failed to read block 0x1ec: -5
[  105.887278][ T7372] SQUASHFS error: Unable to read metadata cache entry [1ea]
[  105.969538][ T6760] usb 2-1: new high-speed USB device number 9 using dummy_hcd
[  106.119357][ T6760] usb 2-1: Using ep0 maxpacket: 32
[  106.131498][ T6760] usb 2-1: config 0 has no interfaces?
[  106.138986][ T6760] usb 2-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72
[  106.148534][ T6760] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  106.153333][ T6760] usb 2-1: Product: syz
[  106.155244][ T6760] usb 2-1: Manufacturer: syz
[  106.165164][ T6760] usb 2-1: SerialNumber: syz
[  106.169981][ T6760] usb 2-1: config 0 descriptor??
[  106.250036][ T7380] loop0: detected capacity change from 0 to 32768
[  106.380621][ T5913] usb 2-1: USB disconnect, device number 9
[  106.481664][ T7388] netlink: 12 bytes leftover after parsing attributes in process `syz.0.384'.
[  106.967640][ T7406] loop0: detected capacity change from 0 to 40427
[  106.976223][ T7406] F2FS-fs (loop0): invalid crc value
[  107.006639][ T7406] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 1
[  107.012737][ T7406] F2FS-fs (loop0): Start checkpoint disabled!
[  107.025255][ T7406] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6
[  107.103285][ T7415] syz.0.393: attempt to access beyond end of device
[  107.103285][ T7415] loop0: rw=10241, sector=45096, nr_sectors = 8 limit=40427
[  107.111313][ T7415] syz.0.393: attempt to access beyond end of device
[  107.111313][ T7415] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  107.116575][ T7415] syz.0.393: attempt to access beyond end of device
[  107.116575][ T7415] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  107.122205][ T7415] syz.0.393: attempt to access beyond end of device
[  107.122205][ T7415] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  107.128274][ T7415] syz.0.393: attempt to access beyond end of device
[  107.128274][ T7415] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  107.135258][ T7415] syz.0.393: attempt to access beyond end of device
[  107.135258][ T7415] loop0: rw=2049, sector=45104, nr_sectors = 8 limit=40427
[  107.143939][ T7415] syz.0.393: attempt to access beyond end of device
[  107.143939][ T7415] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  107.156278][ T7415] syz.0.393: attempt to access beyond end of device
[  107.156278][ T7415] loop0: rw=2049, sector=45104, nr_sectors = 8 limit=40427
[  107.163741][ T7415] syz.0.393: attempt to access beyond end of device
[  107.163741][ T7415] loop0: rw=2049, sector=45104, nr_sectors = 8 limit=40427
[  107.168978][ T7415] syz.0.393: attempt to access beyond end of device
[  107.168978][ T7415] loop0: rw=2049, sector=45104, nr_sectors = 8 limit=40427
[  107.193829][   T33] audit: type=1800 audit(1755049963.989:23): pid=7415 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.393" name="bus" dev="loop0" ino=10 res=0 errno=0
[  107.781371][ T6760] usb 4-1: new high-speed USB device number 4 using dummy_hcd
[  107.941454][ T6760] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  107.948053][ T6760] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  107.955385][ T6760] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00
[  107.961028][ T6760] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  107.967420][ T6760] usb 4-1: config 0 descriptor??
[  108.403788][ T6760] pyra 0003:1E7D:2CF6.0003: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.3-1/input0
[  108.648650][ T7433] loop1: detected capacity change from 0 to 16
[  108.654997][ T7433] erofs: Unknown parameter ''
[  108.888504][ T1087] CPU: 0 UID: 0 PID: 1087 Comm: kworker/u9:3 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  108.888526][ T1087] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  108.888533][ T1087] Workqueue: writeback wb_workfn (flush-7:0)
[  108.888553][ T1087] Call Trace:
[  108.888558][ T1087]  <TASK>
[  108.888563][ T1087]  dump_stack_lvl+0x189/0x250
[  108.888602][ T1087]  ? __pfx_dump_stack_lvl+0x10/0x10
[  108.888613][ T1087]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  108.888627][ T1087]  ? __pfx_queue_work_on+0x10/0x10
[  108.888638][ T1087]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  108.888649][ T1087]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  108.888669][ T1087]  f2fs_handle_critical_error+0x37c/0x540
[  108.888685][ T1087]  f2fs_write_end_io+0x886/0xb60
[  108.888703][ T1087]  __submit_merged_bio+0x27a/0x6a0
[  108.888714][ T1087]  __submit_merged_write_cond+0x255/0x530
[  108.888725][ T1087]  f2fs_write_data_pages+0x261d/0x3000
[  108.888760][ T1087]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  108.888783][ T1087]  ? __pfx_f2fs_available_free_memory+0x10/0x10
[  108.888819][ T1087]  ? __pfx_f2fs_balance_fs_bg+0x10/0x10
[  108.888841][ T1087]  ? trace_f2fs_writepages+0x7f/0x200
[  108.888854][ T1087]  ? f2fs_write_node_pages+0x478/0x6e0
[  108.888870][ T1087]  ? __pfx_f2fs_write_node_pages+0x10/0x10
[  108.888893][ T1087]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  108.888908][ T1087]  do_writepages+0x32e/0x550
[  108.888926][ T1087]  ? reacquire_held_locks+0x127/0x1d0
[  108.888934][ T1087]  ? writeback_sb_inodes+0x384/0x1010
[  108.888946][ T1087]  __writeback_single_inode+0x145/0xff0
[  108.888955][ T1087]  ? do_raw_spin_unlock+0x4d/0x240
[  108.888969][ T1087]  writeback_sb_inodes+0x6c7/0x1010
[  108.888986][ T1087]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  108.889008][ T1087]  ? __pfx_writeback_sb_inodes+0x10/0x10
[  108.889055][ T1087]  ? rcu_is_watching+0x15/0xb0
[  108.889074][ T1087]  wb_writeback+0x43b/0xaf0
[  108.889117][ T1087]  ? queue_io+0x391/0x590
[  108.889131][ T1087]  ? __pfx_wb_writeback+0x10/0x10
[  108.889148][ T1087]  ? _raw_spin_unlock_irq+0x23/0x50
[  108.889163][ T1087]  wb_workfn+0x409/0xef0
[  108.889202][ T1087]  ? __pfx_wb_workfn+0x10/0x10
[  108.889215][ T1087]  ? __lock_acquire+0xab9/0xd20
[  108.889231][ T1087]  ? process_scheduled_works+0x9ef/0x17b0
[  108.889240][ T1087]  ? _raw_spin_unlock_irq+0x23/0x50
[  108.889247][ T1087]  ? process_scheduled_works+0x9ef/0x17b0
[  108.889253][ T1087]  ? process_scheduled_works+0x9ef/0x17b0
[  108.889260][ T1087]  process_scheduled_works+0xae1/0x17b0
[  108.889296][ T1087]  ? __pfx_process_scheduled_works+0x10/0x10
[  108.889317][ T1087]  worker_thread+0x8a0/0xda0
[  108.889335][ T1087]  kthread+0x711/0x8a0
[  108.889345][ T1087]  ? __pfx_worker_thread+0x10/0x10
[  108.889351][ T1087]  ? __pfx_kthread+0x10/0x10
[  108.889361][ T1087]  ? _raw_spin_unlock_irq+0x23/0x50
[  108.889368][ T1087]  ? lockdep_hardirqs_on+0x9c/0x150
[  108.889376][ T1087]  ? __pfx_kthread+0x10/0x10
[  108.889385][ T1087]  ret_from_fork+0x3fc/0x770
[  108.889394][ T1087]  ? __pfx_ret_from_fork+0x10/0x10
[  108.889404][ T1087]  ? __switch_to_asm+0x39/0x70
[  108.889413][ T1087]  ? __switch_to_asm+0x33/0x70
[  108.889421][ T1087]  ? __pfx_kthread+0x10/0x10
[  108.889430][ T1087]  ret_from_fork_asm+0x1a/0x30
[  108.889445][ T1087]  </TASK>
[  109.001571][ T1087] F2FS-fs (loop0): Stopped filesystem due to reason: 3
[  109.214696][ T6760] pyra 0003:1E7D:2CF6.0003: couldn't init struct pyra_device
[  109.218485][ T6760] pyra 0003:1E7D:2CF6.0003: couldn't install mouse
[  109.261716][ T6760] pyra 0003:1E7D:2CF6.0003: probe with driver pyra failed with error -71
[  109.272640][ T6760] usb 4-1: USB disconnect, device number 4
[  110.070287][ T5913] usb 4-1: new high-speed USB device number 5 using dummy_hcd
[  110.221349][ T5913] usb 4-1: config 0 has an invalid interface number: 101 but max is 0
[  110.224175][ T5913] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  110.227788][ T5913] usb 4-1: config 0 has no interface number 0
[  110.229954][ T5913] usb 4-1: config 0 interface 101 has no altsetting 0
[  110.234524][ T5913] usb 4-1: New USB device found, idVendor=12d1, idProduct=1c1f, bcdDevice=ef.18
[  110.237806][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  110.241065][ T5913] usb 4-1: Product: syz
[  110.242957][ T5913] usb 4-1: Manufacturer: syz
[  110.244912][ T5913] usb 4-1: SerialNumber: syz
[  110.248834][ T5913] usb 4-1: config 0 descriptor??
[  110.253938][ T5913] usb 4-1: bad CDC descriptors
[  110.257339][ T5913] option 4-1:0.101: GSM modem (1-port) converter detected
[  110.464426][ T5913] usb 4-1: USB disconnect, device number 5
[  110.471479][ T5913] option 4-1:0.101: device disconnected
[  110.919387][ T5913] usb 2-1: new high-speed USB device number 10 using dummy_hcd
[  111.079615][ T5913] usb 2-1: Using ep0 maxpacket: 8
[  111.083612][ T5913] usb 2-1: unable to get BOS descriptor or descriptor too short
[  111.089437][ T5913] usb 2-1: config 0 has an invalid interface number: 88 but max is 0
[  111.096138][ T5913] usb 2-1: config 0 has no interface number 0
[  111.098650][ T5913] usb 2-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 0, changing to 7
[  111.104439][ T5913] usb 2-1: config 0 interface 88 altsetting 8 endpoint 0x86 has invalid wMaxPacketSize 0
[  111.108181][ T5913] usb 2-1: config 0 interface 88 has no altsetting 0
[  111.116289][ T5913] usb 2-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31
[  111.121335][ T5913] usb 2-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3
[  111.124551][ T5913] usb 2-1: Product: syz
[  111.126329][ T5913] usb 2-1: SerialNumber: syz
[  111.137136][ T5913] usb 2-1: config 0 descriptor??
[  111.381423][ T5913] input: syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.88/input/input7
[  111.419838][ T5913] usb 2-1: USB disconnect, device number 10
[  111.490478][ T7496] loop3: detected capacity change from 0 to 16
[  111.507450][ T7496] erofs (device loop3): mounted with root inode @ nid 36.
[  111.518954][   T33] audit: type=1800 audit(1755049968.409:24): pid=7496 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.431" name="file1" dev="loop3" ino=86 res=0 errno=0
[  111.669556][ T5900] usb 1-1: new high-speed USB device number 7 using dummy_hcd
[  111.820902][ T5900] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7
[  111.825312][ T5900] usb 1-1: New USB device found, idVendor=2040, idProduct=5530, bcdDevice=a8.82
[  111.829034][ T5900] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  111.836786][ T5900] usb 1-1: config 0 descriptor??
[  111.844211][ T5900] smsusb:smsusb_probe: board id=8, interface number 0
[  111.847326][ T5900] smsusb:smsusb_probe: Device initialized with return code -19
[  112.052249][ T5900] usb 1-1: USB disconnect, device number 7
[  112.127492][ T7513] loop1: detected capacity change from 0 to 32768
[  112.133500][ T7513] (syz.1.439,7513,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  112.138313][ T7513] (syz.1.439,7513,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  112.147200][ T7513] JBD2: Ignoring recovery information on journal
[  112.166253][ T7513] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode.
[  112.188443][ T7513] ocfs2: Unmounting device (7,1) on (node local)
[  112.264178][ T7517] loop1: detected capacity change from 0 to 256
[  112.603234][ T7525] netlink: 28 bytes leftover after parsing attributes in process `syz.0.444'.
[  112.715988][ T7531] loop0: detected capacity change from 0 to 512
[  112.723013][ T7531] EXT4-fs: Ignoring removed nobh option
[  112.751595][ T7531] EXT4-fs error (device loop0): ext4_do_update_inode:5653: inode #3: comm syz.0.447: corrupted inode contents
[  112.771650][ T7531] EXT4-fs error (device loop0): ext4_dirty_inode:6538: inode #3: comm syz.0.447: mark_inode_dirty error
[  112.782514][ T7531] EXT4-fs error (device loop0): ext4_do_update_inode:5653: inode #3: comm syz.0.447: corrupted inode contents
[  112.788236][ T7531] EXT4-fs error (device loop0): __ext4_ext_dirty:206: inode #3: comm syz.0.447: mark_inode_dirty error
[  112.797566][ T7531] Quota error (device loop0): write_blk: dquota write failed
[  112.803493][ T7531] Quota error (device loop0): qtree_write_dquot: Error -117 occurred while creating quota
[  112.807734][ T7531] EXT4-fs error (device loop0): ext4_acquire_dquot:6933: comm syz.0.447: Failed to acquire dquot type 0
[  112.819759][ T7531] EXT4-fs error (device loop0): ext4_do_update_inode:5653: inode #16: comm syz.0.447: corrupted inode contents
[  112.826194][ T7531] EXT4-fs error (device loop0): ext4_dirty_inode:6538: inode #16: comm syz.0.447: mark_inode_dirty error
[  112.832995][ T7531] EXT4-fs error (device loop0): ext4_do_update_inode:5653: inode #16: comm syz.0.447: corrupted inode contents
[  112.838280][ T7531] EXT4-fs error (device loop0): __ext4_ext_dirty:206: inode #16: comm syz.0.447: mark_inode_dirty error
[  112.842748][ T7531] EXT4-fs error (device loop0): ext4_do_update_inode:5653: inode #16: comm syz.0.447: corrupted inode contents
[  112.849037][ T7531] EXT4-fs error (device loop0) in ext4_orphan_del:305: Corrupt filesystem
[  112.853667][ T7531] EXT4-fs error (device loop0): ext4_do_update_inode:5653: inode #16: comm syz.0.447: corrupted inode contents
[  112.857740][ T7531] EXT4-fs error (device loop0): ext4_truncate:4666: inode #16: comm syz.0.447: mark_inode_dirty error
[  112.861862][ T7531] EXT4-fs error (device loop0) in ext4_process_orphan:347: Corrupt filesystem
[  112.867456][ T7531] EXT4-fs (loop0): 1 truncate cleaned up
[  112.870968][ T7531] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  112.875513][ T7531] ext4 filesystem being mounted at /190/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  112.881061][ T7527] loop3: detected capacity change from 0 to 32768
[  112.891165][ T7527] bcachefs (/dev/loop3): error validating superblock: Invalid superblock section members_v2: device 0: bucket size 9 smaller than btree node size 256
[  112.891165][ T7527] members_v2 (size 152):
[  112.891165][ T7527] Device:                        0
[  112.891165][ T7527]   Label:                       (none)
[  112.891165][ T7527]   UUID:                        7af6772b-00de-4159-84cd-1faead05e13e
[  112.891165][ T7527]   Size:                        589824
[  112.891165][ T7527]   read errors:                 0
[  112.891165][ T7527]   write errors:                0
[  112.891165][ T7527]   checksum errors:             0
[  112.891165][ T7527]   seqread iops:                0
[  112.891165][ T7527]   seqwrite iops:               0
[  112.891165][ T7527]   randread iops:               0
[  112.891165][ T7527]   randwrite iops:              0
[  112.891165][ T7527]   Bucket size:                 4608
[  112.891165][ T7527]   First bucket:                0
[  112.891165][ T7527]   Buckets:                     128
[  112.891165][ T7527]   Last mount:                  1714618368
[  112.891165][ T7527]   Last superblock write:       42
[  112.891165][ T7527]   State:                       rw
[  112.891165][ T7527]   Data allowed:                journal,btree,user
[  112.891165][ T7527]   Has data:                    (none)
[  112.891165][ T7527]   Btree allocated bitmap blocksize:1
[  112.891165][ T7527]   Btree allocated bitmap:      0000000000000000000001000010000010011000000000000000000000000000
[  112.891165][ T7527]   Durab
[  112.891319][ T7527] bcachefs: bch2_fs_get_tree() error: invalid_sb_members
[  112.970744][ T5855] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  113.176887][ T7540] loop3: detected capacity change from 0 to 2048
[  113.197869][ T7541] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  113.286616][ T7541] NILFS (loop3): vblocknr = 23 has abnormal lifetime: start cno (= 4294967298) > current cno (= 3)
[  113.292132][ T7541] NILFS error (device loop3): nilfs_bmap_propagate: broken bmap (inode number=4)
[  113.302193][ T7541] Remounting filesystem read-only
[  113.305532][ T6745] NILFS (loop3): disposed unprocessed dirty file(s) when stopping log writer
[  113.372973][ T7547] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.452'.
[  113.532716][ T7553] loop3: detected capacity change from 0 to 8192
[  113.537966][ T7553] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  114.033968][ T7584] loop0: detected capacity change from 0 to 16
[  114.045055][ T7584] erofs (device loop0): mounted with root inode @ nid 36.
[  114.084220][ T7573] loop3: detected capacity change from 0 to 32768
[  114.101849][ T7573] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.463 (7573)
[  114.153270][ T7573] BTRFS info (device loop3): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[  114.157489][ T7573] BTRFS info (device loop3): using sha256 (sha256-lib) checksum algorithm
[  114.206644][ T7593] loop1: detected capacity change from 0 to 16
[  114.211690][ T7573] BTRFS info (device loop3): using free-space-tree
[  114.223431][ T7594] loop0: detected capacity change from 0 to 256
[  114.225961][ T7594] exfat: Deprecated parameter 'namecase'
[  114.227893][ T7594] exfat: Deprecated parameter 'utf8'
[  114.242181][ T7593] erofs (device loop1): mounted with root inode @ nid 36.
[  114.263559][ T7593] erofs (device loop1): readahead error at folio 2 @ nid 89
[  114.281430][ T7594] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x1a9973fb, utbl_chksum : 0xe619d30d)
[  114.295825][ T7593] erofs (device loop1): readahead error at folio 1 @ nid 89
[  114.318730][ T7593] erofs (device loop1): read error -117 @ 1 of nid 89
[  114.331303][   T33] audit: type=1800 audit(1755049971.229:25): pid=7593 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.473" name="file3" dev="loop1" ino=89 res=0 errno=0
[  114.357193][ T7573] BTRFS info (device loop3): checking UUID tree
[  114.469023][ T7573] BTRFS info (device loop3): balance: start -d -m
[  114.502183][ T7573] BTRFS info (device loop3): relocating block group 6881280 flags data|metadata
[  114.604789][ T7573] BTRFS info (device loop3): relocating block group 5242880 flags data|metadata
[  114.661187][ T7624] loop0: detected capacity change from 0 to 4096
[  114.734241][ T7573] BTRFS info (device loop3): found 9 extents, stage: move data extents
[  114.784285][ T7573] BTRFS info (device loop3): balance: canceled
[  114.828184][ T6745] BTRFS info (device loop3): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[  115.002401][ T7626] loop1: detected capacity change from 0 to 40427
[  115.018839][ T7626] F2FS-fs (loop1): invalid crc value
[  115.091778][ T7626] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  115.096903][ T7626] F2FS-fs (loop1): Start checkpoint disabled!
[  115.113839][ T7626] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6
[  115.141198][ T7642] loop3: detected capacity change from 0 to 256
[  115.176949][ T7642] exFAT-fs (loop3): failed to load upcase table (idx : 0x00011a39, chksum : 0xd54015fb, utbl_chksum : 0xe619d30d)
[  115.203727][ T1087] bio_check_eod: 183 callbacks suppressed
[  115.203745][ T1087] kworker/u9:3: attempt to access beyond end of device
[  115.203745][ T1087] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  115.235784][ T1087] CPU: 0 UID: 0 PID: 1087 Comm: kworker/u9:3 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  115.235808][ T1087] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  115.235817][ T1087] Workqueue: writeback wb_workfn (flush-7:1)
[  115.235839][ T1087] Call Trace:
[  115.235845][ T1087]  <TASK>
[  115.235850][ T1087]  dump_stack_lvl+0x189/0x250
[  115.235869][ T1087]  ? __pfx_dump_stack_lvl+0x10/0x10
[  115.235882][ T1087]  ? __pfx_queue_work_on+0x10/0x10
[  115.235893][ T1087]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  115.235906][ T1087]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  115.235925][ T1087]  f2fs_handle_critical_error+0x37c/0x540
[  115.235968][ T1087]  f2fs_write_end_io+0x886/0xb60
[  115.235999][ T1087]  __submit_merged_bio+0x27a/0x6a0
[  115.236018][ T1087]  __submit_merged_write_cond+0x255/0x530
[  115.236036][ T1087]  f2fs_write_data_pages+0x261d/0x3000
[  115.236100][ T1087]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  115.236126][ T1087]  ? __pfx_f2fs_available_free_memory+0x10/0x10
[  115.236167][ T1087]  ? __pfx_f2fs_balance_fs_bg+0x10/0x10
[  115.236190][ T1087]  ? trace_f2fs_writepages+0x7f/0x200
[  115.236204][ T1087]  ? f2fs_write_node_pages+0x478/0x6e0
[  115.236220][ T1087]  ? __pfx_f2fs_write_node_pages+0x10/0x10
[  115.236245][ T1087]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  115.236260][ T1087]  do_writepages+0x32e/0x550
[  115.236278][ T1087]  ? reacquire_held_locks+0x127/0x1d0
[  115.236290][ T1087]  ? writeback_sb_inodes+0x384/0x1010
[  115.236310][ T1087]  __writeback_single_inode+0x145/0xff0
[  115.236327][ T1087]  ? do_raw_spin_unlock+0x4d/0x240
[  115.236345][ T1087]  writeback_sb_inodes+0x6c7/0x1010
[  115.236385][ T1087]  ? __pfx_writeback_sb_inodes+0x10/0x10
[  115.236427][ T1087]  ? rcu_is_watching+0x15/0xb0
[  115.236445][ T1087]  wb_writeback+0x43b/0xaf0
[  115.236464][ T1087]  ? queue_io+0x391/0x590
[  115.236479][ T1087]  ? __pfx_wb_writeback+0x10/0x10
[  115.236499][ T1087]  ? _raw_spin_unlock_irq+0x23/0x50
[  115.236517][ T1087]  wb_workfn+0x409/0xef0
[  115.236541][ T1087]  ? __pfx_wb_workfn+0x10/0x10
[  115.236557][ T1087]  ? __lock_acquire+0xab9/0xd20
[  115.236580][ T1087]  ? process_scheduled_works+0x9ef/0x17b0
[  115.236594][ T1087]  ? _raw_spin_unlock_irq+0x23/0x50
[  115.236604][ T1087]  ? process_scheduled_works+0x9ef/0x17b0
[  115.236613][ T1087]  ? process_scheduled_works+0x9ef/0x17b0
[  115.236625][ T1087]  process_scheduled_works+0xae1/0x17b0
[  115.236653][ T1087]  ? __pfx_process_scheduled_works+0x10/0x10
[  115.236685][ T1087]  worker_thread+0x8a0/0xda0
[  115.236716][ T1087]  kthread+0x711/0x8a0
[  115.236734][ T1087]  ? __pfx_worker_thread+0x10/0x10
[  115.236744][ T1087]  ? __pfx_kthread+0x10/0x10
[  115.236758][ T1087]  ? _raw_spin_unlock_irq+0x23/0x50
[  115.236768][ T1087]  ? lockdep_hardirqs_on+0x9c/0x150
[  115.236782][ T1087]  ? __pfx_kthread+0x10/0x10
[  115.236795][ T1087]  ret_from_fork+0x3fc/0x770
[  115.236808][ T1087]  ? __pfx_ret_from_fork+0x10/0x10
[  115.236823][ T1087]  ? __switch_to_asm+0x39/0x70
[  115.236836][ T1087]  ? __switch_to_asm+0x33/0x70
[  115.236850][ T1087]  ? __pfx_kthread+0x10/0x10
[  115.236866][ T1087]  ret_from_fork_asm+0x1a/0x30
[  115.236893][ T1087]  </TASK>
[  115.236899][ T1087] F2FS-fs (loop1): Stopped filesystem due to reason: 3
[  115.286347][ T7648] loop0: detected capacity change from 0 to 512
[  115.416311][ T7648] EXT4-fs: Ignoring removed mblk_io_submit option
[  115.421726][ T7648] EXT4-fs: inline encryption not supported
[  115.424098][ T7648] EXT4-fs: Ignoring removed mblk_io_submit option
[  115.427572][ T7648] EXT4-fs (loop0): Test dummy encryption mode enabled
[  115.431190][ T7648] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[  115.442036][ T7648] EXT4-fs (loop0): 1 truncate cleaned up
[  115.447926][ T7648] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  115.615431][ T7648] fscrypt: AES-256-XTS using implementation "xts(ecb(aes-fixed-time))"
[  115.651950][ T5855] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  115.816395][ T7656] loop3: detected capacity change from 0 to 32768
[  115.916808][ T7680] loop1: detected capacity change from 0 to 2048
[  115.928752][ T7656] bcachefs (loop3): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,foreground_target=invalid label 767,background_target=invalid device 7,nojournal_transaction_names
[  115.928768][ T7656]   allowing incompatible features above 0.0: (unknown version)
[  115.928772][ T7656]   features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes
[  115.928878][ T7683] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  115.953615][ T7680] NILFS error (device loop1): nilfs_check_folio: bad entry in directory #2: disallowed inode number - offset=56, inode=6, rec_len=24, name_len=5
[  115.957286][ T7680] Remounting filesystem read-only
[  115.961701][ T7656] bcachefs (loop3): Using encoding defined by superblock: utf8-12.1.0
[  115.981423][ T7656] bcachefs (loop3): initializing new filesystem
[  115.991689][ T7656] bcachefs (loop3): going read-write
[  116.000128][ T7656] bcachefs (loop3): marking superblocks
[  116.032689][ T7689] loop1: detected capacity change from 0 to 1024
[  116.042322][ T7656] bcachefs (loop3): initializing freespace
[  116.054560][ T7656] bcachefs (loop3): done initializing freespace
[  116.064276][ T7656] bcachefs (loop3): reading snapshots table
[  116.066851][ T7656] bcachefs (loop3): reading snapshots done
[  116.096454][ T7656] bcachefs (loop3): done starting filesystem
[  116.159340][ T6745] bcachefs (loop3): shutting down
[  116.161750][ T6745] bcachefs (loop3): going read-only
[  116.163876][ T6745] bcachefs (loop3): finished waiting for writes to stop
[  116.180653][ T6745] bcachefs (loop3): flushing journal and stopping allocators, journal seq 2
[  116.217011][ T6745] bcachefs (loop3): flushing journal and stopping allocators complete, journal seq 3
[  116.355219][ T7693] afs: Unknown parameter 'A~|vN'
[  116.431343][ T6745] bcachefs (loop3): clean shutdown complete, journal seq 4
[  116.468345][ T6745] bcachefs (loop3): marking filesystem clean
[  116.566496][ T6745] bcachefs (loop3): shutdown complete
[  116.921365][ T3564] hfsplus: b-tree write err: -5, ino 4
[  118.003604][ T7711] sctp: [Deprecated]: syz.1.506 (pid 7711) Use of struct sctp_assoc_value in delayed_ack socket option.
[  118.003604][ T7711] Use struct sctp_sack_info instead
[  119.177399][ T7730] netlink: 'syz.3.515': attribute type 11 has an invalid length.
[  119.199364][ T5900] usb 1-1: new full-speed USB device number 8 using dummy_hcd
[  119.278396][ T7738] loop1: detected capacity change from 0 to 1024
[  119.327633][ T3013] hfsplus: b-tree write err: -5, ino 4
[  119.371086][ T5900] usb 1-1: unable to get BOS descriptor or descriptor too short
[  119.374112][ T5900] usb 1-1: not running at top speed; connect to a high speed hub
[  119.377530][ T5900] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping
[  119.381198][ T5900] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config
[  119.387682][ T5900] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
[  119.397793][ T5900] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  119.402848][ T5900] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  119.405436][ T5900] usb 1-1: Product: syz
[  119.406811][ T5900] usb 1-1: Manufacturer: syz
[  119.408398][ T5900] usb 1-1: SerialNumber: syz
[  119.676549][ T7744] loop1: detected capacity change from 0 to 32768
[  119.683864][ T7744] XFS: attr2 mount option is deprecated.
[  119.698277][ T7744] XFS (loop1): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  119.721685][ T7744] XFS (loop1): Ending clean mount
[  119.744890][ T7744] XFS (loop1): Quotacheck needed: Please wait.
[  119.781533][ T7744] XFS (loop1): Quotacheck: Done.
[  119.802156][ T5846] XFS (loop1): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  120.007643][ T7758] netlink: 4 bytes leftover after parsing attributes in process `syz.1.525'.
[  120.041856][ T5900] usb 1-1: 0:2 : does not exist
[  120.055530][ T5900] usb 1-1: USB disconnect, device number 8
[  120.446595][ T7766] fuse: Bad value for 'fd'
[  120.603344][ T7777] capability: warning: `syz.3.535' uses 32-bit capabilities (legacy support in use)
[  120.747738][ T7787] fuse: Bad value for 'fd'
[  120.903331][ T7797] netlink: 16178 bytes leftover after parsing attributes in process `syz.3.542'.
[  121.317306][ T7823] netlink: 24 bytes leftover after parsing attributes in process `syz.3.548'.
[  121.385812][ T7828] loop1: detected capacity change from 0 to 8
[  121.402407][ T7828] SQUASHFS error: Unable to read inode 0x127
[  122.792151][ T7865] loop0: detected capacity change from 0 to 512
[  122.824682][ T7865] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  122.961787][ T5855] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  123.023097][ T7873] netlink: 4 bytes leftover after parsing attributes in process `syz.0.566'.
[  123.048593][ T7875] warning: `syz.3.567' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[  123.164522][ T7883] 9pnet_fd: Insufficient options for proto=fd
[  124.961886][   T33] audit: type=1326 audit(1755049981.859:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7923 comm="syz.3.587" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa4a5f8ebe9 code=0x0
[  126.020179][ T7932] loop0: detected capacity change from 0 to 256
[  126.067314][ T7932] FAT-fs (loop0): Directory bread(block 64) failed
[  126.099405][ T7932] FAT-fs (loop0): Directory bread(block 65) failed
[  126.102337][ T7932] FAT-fs (loop0): Directory bread(block 66) failed
[  126.104972][ T7932] FAT-fs (loop0): Directory bread(block 67) failed
[  126.107539][ T7932] FAT-fs (loop0): Directory bread(block 68) failed
[  126.111127][ T7932] FAT-fs (loop0): Directory bread(block 69) failed
[  126.113669][ T7932] FAT-fs (loop0): Directory bread(block 70) failed
[  126.116274][ T7932] FAT-fs (loop0): Directory bread(block 71) failed
[  126.119470][ T7932] FAT-fs (loop0): Directory bread(block 72) failed
[  126.122206][ T7932] FAT-fs (loop0): Directory bread(block 73) failed
[  126.462807][ T7957] netlink: 'syz.3.598': attribute type 1 has an invalid length.
[  126.466361][ T7957] netlink: 'syz.3.598': attribute type 1 has an invalid length.
[  126.476747][ T7957] netlink: 'syz.3.598': attribute type 1 has an invalid length.
[  126.480812][ T7957] netlink: 'syz.3.598': attribute type 1 has an invalid length.
[  126.485067][ T7957] netlink: 'syz.3.598': attribute type 1 has an invalid length.
[  126.488403][ T7957] netlink: 'syz.3.598': attribute type 1 has an invalid length.
[  126.495669][ T7957] netlink: 'syz.3.598': attribute type 1 has an invalid length.
[  126.502258][ T7957] netlink: 'syz.3.598': attribute type 1 has an invalid length.
[  126.505823][ T7957] netlink: 'syz.3.598': attribute type 1 has an invalid length.
[  126.515781][ T7957] netlink: 'syz.3.598': attribute type 1 has an invalid length.
[  127.750246][ T7989] netlink: 28 bytes leftover after parsing attributes in process `syz.0.611'.
[  127.753760][ T7989] netlink: 28 bytes leftover after parsing attributes in process `syz.0.611'.
[  128.522566][ T8030] batadv1: entered promiscuous mode
[  128.757874][ T8048] loop0: detected capacity change from 0 to 1024
[  128.762846][ T8048] EXT4-fs: Ignoring removed bh option
[  128.777083][ T8050] 9pnet_fd: Insufficient options for proto=fd
[  128.779512][ T8048] EXT4-fs (loop0): stripe (5) is not aligned with cluster size (16), stripe is disabled
[  128.793630][ T8048] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  128.812744][ T8048] overlay: Bad value for 'workdir'
[  128.837239][ T5855] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
Connection to localhost closed by remote host.
[  129.033246][ T8057] loop0: detected capacity change from 0 to 40427
[  129.046223][ T8057] F2FS-fs (loop0): invalid crc value
[  129.083708][ T8057] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 1
[  129.087376][ T8057] F2FS-fs (loop0): Start checkpoint disabled!
[  129.092339][ T8057] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6
[  132.555145][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[  132.557750][ T1363] ieee802154 phy1 wpan1: encryption failed: -22

VM DIAGNOSIS:
01:53:15  Registers:
info registers vcpu 0

CPU#0
RAX=c6aab970bfae7600 RBX=ffffffff81968308 RCX=c6aab970bfae7600 RDX=0000000000000001
RSI=ffffffff8d9b4408 RDI=ffffffff8be32600 RBP=ffffffff8de07eb8 RSP=ffffffff8de07d80
R8 =ffff88804b032f9b R9 =1ffff110096065f3 R10=dffffc0000000000 R11=ffffed10096065f4
R12=ffffffff8fa34230 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a20
RIP=ffffffff8b7893f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b8624000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f1079a41580 CR3=00000001118b8000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000001 XMM01=0000000000000000 000055556aa55488
XMM02=02de0192800402d4 8a10000402000b80 XMM03=0010000fffffffff ffff040a10000601
XMM04=65642f01ffffffff ffffffffed080003 XMM05=0100100000080000 040ffffff3fd1000
XMM06=0801519e00020014 0360208080808200 XMM07=1203706f6f6c2f76 65642f01ffffffff
XMM08=ffffffffed080003 0010000fffffffff XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=5abd1a7502f4fd00 RBX=ffffffff81968308 RCX=5abd1a7502f4fd00 RDX=0000000000000001
RSI=ffffffff8d9b4408 RDI=ffffffff8be32600 RBP=ffffc90000177f20 RSP=ffffc90000177de0
R8 =ffff888136632f9b R9 =1ffff11026cc65f3 R10=dffffc0000000000 R11=ffffed1026cc65f4
R12=ffffffff8fa34230 R13=0000000000000001 R14=0000000000000001 R15=1ffff11020005000
RIP=ffffffff8b7893f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c24000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000560a14e0c680 CR3=00000001118b8000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000001 XMM01=0000000000000000 000055556aa55488
XMM02=02de0192800402d4 8a10000402000b80 XMM03=0010000fffffffff ffff040a10000601
XMM04=65642f01ffffffff ffffffffed080003 XMM05=0100100000080000 040ffffff3fd1000
XMM06=0801519e00020014 0360208080808200 XMM07=1203706f6f6c2f76 65642f01ffffffff
XMM08=ffffffffed080003 0010000fffffffff XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
